# Issue 22577 — independent proof audit, pass 1

Scope: /home/ubuntu/wt/issue-22577, head d1736d522188655d5dd4215ffbff4d9d17065c63 against base 70e5e384da. Read-only repository audit; no edits, tests, servers, browsers, pushes, or comments performed. This report is an evidence plan, not an assertion that pending proof passed.

## Decision

Agree independently with an empty visual matrix under the explicitly authorized server-only exemption. The complete diff contains only Orchestrator.ts (queue policy) and runtimeLayer.test.ts (one regression test). No render paths, client callers, styling, layout, conditional UI, or UI interactions change. Web/desktop/mobile, local/remote/tunnel, themes and viewports share the same server policy; multiplying visual fixtures across these axes adds no proof. No screenshots or recordings are required for this exempt server-only matrix. If the lead adds any UI interaction/time evidence rows, each must be a recording, not still images.

The exemption needs red/green regression evidence plus a real-runtime event transcript. Existing before transcript demonstrates the bug, but after-runtime and red/green command output remain pending in this audit. Do not mark proof complete yet.

## Visual matrix (empty: zero fixtures)

| Fixture | Changed render path / caller / conditional | Data / interaction | Viewport | Theme | Seed | Required artifact |
| --- | --- | --- | --- | --- | --- | --- |

Affected visual rows: none. Minimum viewport set: empty. Minimum theme set: empty. No UI seeding fixtures.

## Complete change and caller coverage

| Changed path / caller | Conditional or data distinction | Collapsed proof fixture / assertion |
| --- | --- | --- |
| followsCurrentConversation | Missing message returns false; delegatedCompletion present returns true; otherwise existing monitor + non-buffered predicate | Missing/ordinary/provider-buffered messages preserve stored selection; delegated completion joins existing app-owned monitor policy |
| queuedRunModelSelection -> startQueuedRun | Completion queued with old selection; current thread selection changes before drain | R1: queued run starts with entire current ModelSelection, thread selection never reverts |
| followsCurrentConversation -> startQueuedRun provider-thread choice | Current active provider thread matches selected instance; otherwise existing root for selected provider; otherwise new provider thread | R2: completion follows current conversation; run, attempt, root node, checkpoint scope and active thread agree on provider-thread routing |
| startQueuedRun usage-limit and provider enable/failure guards | Effective selected provider, rather than original queued provider, determines queue hold | R3: limited current provider holds completion; old-provider limit does not incorrectly hold a completion moved to an available provider. Disabled selected provider remains held |
| queued-run.resume -> queuedRunModelSelection | Resume validates effective provider usage limit before clearing queueHeld | Collapse with R3; resume and automatic drain must agree |
| runtimeLayer.test.ts added case | Parent ends with open generation-1 delivery; second run active; completion queues; selection changes; second completes; resume | R1 unit fixture exists; asserts starting + current run/thread selection. Does not itself prove actual adapter invocation or cross-provider routing |
| Unchanged monitor and ordinary user paths | Server monitor follows conversation; provider-buffered monitor/user queue retains its own selection | R4: retain existing focused controls; no new visual fixture |

R2/R3 are risk-directed server checks because the changed shared predicate reaches these callers; they are not additional UI/time rows. Existing monitor coverage does not establish delegated-completion-specific cross-provider behavior. Same-provider model switching is the smallest required real-runtime reproducer; cross-provider routing and limit checks may use deterministic focused tests rather than expanding the real-app run.

## Required proof milestones

| Proof | Exact setup / ordered milestones | Acceptance and evidence status |
| --- | --- | --- |
| Red regression | Run the added named runtimeLayer regression with its test body on base implementation, outside the reviewed checkout if necessary; capture exact revision, command, test name, failure and expected/actual model | Must fail because completion starts on original selection. Not executed by this read-only reviewer; source inspection predicts failure, which is not a substitute for output |
| Green regression | Same named test on reviewed head; capture revision, exact command and passing assertion output | Must pass, with queued run starting on current selection and thread preserving it. Pending evidence |
| Before real runtime | Parent A starts on selection S0; async delegated child outlives parent; parent completes with open delegated delivery; second user run B blocks queue; child finishes; completion C is persisted queued at S0; persist thread selection S1; B completes; C starts/runs at S0 and thread reverts | Supplied transcript establishes this sequence, including queue 22:48:35.387Z, S1 Sonnet 22:50:09.131Z, rollback + C starting Opus 22:50:19.095Z. Picker-only draft changes are not a persisted selection |
| After real runtime | On reviewed head in isolated state repeat same causal sequence. Capture run/message correlation and delegated parent/generation/task linkage; C queued under S0; persisted thread.model-selection-updated to S1 before B ends; B terminal; same C transitions queued -> starting -> running on S1; adapter/provider session uses S1; C completes; thread remains S1 | Lead will perform. Include timestamps, run identity/ordinal, instanceId, model and options at queue/select/start/running/end, plus provider-thread/session identity sufficient to verify actual routing. No rollback to S0; exactly one completion delivery; no substitution of a new user turn for C |

Before artifact: [22577-reproduction.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/df63f6dae4a4ced8/22577-reproduction.txt). Local copy read at /tmp/22577-reproduction.txt. Attempt 1 steered into the still-active parent and is not a reproducer; attempt 2 is the qualifying queued-completion case. Existing transcript omits IDs and delegation linkage; after transcript should retain sanitized stable correlation labels to close that ambiguity.

No committed seeding script is needed for the explicitly authorized server-only exemption. The committed deterministic regression fixture already seeds the relevant state. The real-runtime transcript should state reproducible setup and persisted selection action; isolated disposable runtime state is sufficient. Do not add database seed machinery or commit audit artifacts solely to satisfy an empty visual matrix.

Evidence guidance: docs/EVIDENCE.md in t3code-ops was not available at /home/ubuntu/t3code-ops or in a bounded /home/ubuntu checkout search (depth 4). No missing-document policy has been invented.

FRICTION none.