# Issue 24797 — read-only proof audit, pass 1

Scope: complete diff a96cf0818e..d9033f42f3fa3757fb54eddff31013d15568ef11 in /home/ubuntu/wt/issue-24797. Two changed files: ThreadPullRequestService.ts and ThreadPullRequestService.test.ts. Checkout was clean at inspection. No repository edits, tests, server, browser, forge operations, or lead scratch modifications performed by this audit.

## Visual fixture matrix

**EMPTY.** No changed render path, component caller, prop shape, visible condition, UI interaction, layout, motion, or timing surface. The change selects the server-side working directory for branch PR discovery. Web/desktop/mobile consume the existing contracts and projections unchanged. No screenshot or recording is required. The server event triggers below are runtime proof, not visual fixtures.

| Changed visible render surface | Fixture | Evidence |
| --- | --- | --- |
| None | EMPTY | Red/green regression test plus real-server runtime transcript |

## Complete diff coverage

| Changed path / condition / caller | Required proof | Current evidence / gap |
| --- | --- | --- |
| Existing worktree directory without .git: old exists(worktree) becomes exists(join(worktree, '.git')) | Lookup cwd becomes project.workspaceRoot, preserving requested branch | Added regression test asserts exactly [project.workspaceRoot]; supplied base runtime trace shows old repeated not_a_repository. Red/green results and after runtime pending |
| Valid linked-worktree .git file | Lookup cwd remains worktreePath | Supplied before trace has one worktree success; after preservation case pending |
| Valid standalone repository .git directory | Lookup cwd remains worktreePath | After preservation case pending |
| Null worktreePath / absent worktree .git | Root fallback remains | Source confirms null short-circuit and fallback; missing-path control can share the fallback runtime fixture |
| Initial branchPullRequest({cwd, branch}, {refresh}) and second revalidation call with {freshGitState:true} | Both use the selected cwd; branch remains unchanged | Source shares cwd variable; runtime should capture fresh revalidation if a matching PR is detected. Do not require forging a PR solely for this audit |
| Startup backfill + opportunistic sweep; thread.created/unarchived/metadata-updated; thread.unsettled/checkpoint.captured; terminal run.updated | All call the same synchronize worker; no new trigger behavior | Source confirms shared worker. Startup sweep covered by added test; use thread.unsettled refresh for deterministic real-server proof. No need to repeat every trigger |
| New Effect Path dependency and three test-layer Path.layer additions | Runtime service initializes, existing focused service tests still pass | NodeServices.layer exists in production server wiring; focused test/runtime results pending |
| Added regression test: folder exists, .git does not; activation/sweep Deferred and service.drain | Fail on base specifically because cwd is worktree, pass on head with cwd root | Test source has deterministic synchronization and exact cwd assertion. No execution claimed |

## Minimal runtime cases for lead

Use isolated state and real GitManager/server traces. No agent turns or forge writes needed. Preserve the existing /tmp/issue-24797-repro fixture. Record revision, filesystem state, trigger, requested branch, actual cwd, and completed Git operation outcome per case. Refresh through thread.unsettled (settle/unsettle with fresh command IDs when needed), as in the existing procedure, to avoid cached git reads.

| ID | Fixture | Trigger | Expected observable result | Evidence format |
| --- | --- | --- | --- | --- |
| R1 fallback | Existing linked worktree folder after removing its .git; project root remains a valid repository | Fresh event-driven lookup, then a second refresh | Both lookups use project root, retain fixture branch, and Git remotes operation succeeds; no not_a_repository for this fixture | Server transcript/spans plus filesystem check; no recording |
| R2 file preserved | Valid linked worktree with readable .git file pointing to valid Git metadata | Fresh lookup | cwd is linked worktree; Git remotes succeeds | Server transcript/spans plus .git file check; no recording |
| R3 directory preserved | Separate valid repository used as thread.worktreePath, with a .git directory and suitable branch/origin | Fresh lookup | cwd is that repository; Git remotes succeeds | Server transcript/spans plus .git directory check; no recording |

R2 can precede R1 using the same linked worktree. R3 is necessary because .git file and directory are distinct supported shapes. Optional cheap controls: null worktreePath and nonexistent worktree path both select root. They are unchanged behavior, not extra minimum runtime cases. If a matching PR causes the freshGitState revalidation call, include that span to show it uses the same cwd. A successful remotes span proves local Git validity, not remote PR API success; distinguish those outcomes explicitly.

## Existing evidence assessment

[Before runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3330e86fd9bc0280/before-runtime.json) contains one successful worktree remotes span followed by two failures at the same cwd with not_a_repository. [Reproduction procedure](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1a0b0e7d062767c9/reproduction.md) attributes this to base a96cf0818e, real server, isolated state, linked-worktree .git removal and explicit refresh events. This is appropriate before evidence. The extracted trace itself does not embed revision or filesystem observations; retain the procedure as its provenance and include those details in the after transcript.

## Pass 2 acceptance criteria

1. Confirm head/base and final complete diff have not expanded; rederive matrix if they have. Visual matrix remains EMPTY for this scope.
2. Provide a regression run against base with the new test and needed Path test wiring applied outside the audited checkout: fails on expected cwd (actual worktree versus expected project root), rather than setup/import errors. Provide matching head run that passes. Lead owns any temporary test preparation; this auditor made no edits.
3. Focused ThreadPullRequestService test file passes on final head; show command, revision, exit status and relevant output. No repo-wide checks needed.
4. Provide R1/R2/R3 after observations with actual cwd and successful real Git remotes operations. R1 includes repeated fresh refresh to address recurring failures. Preserve branch identity. Explain unrelated forge/network failures separately.
5. No claim that .git existence validates malformed/stale Git metadata: the implementation checks marker presence only. A broken .git file/directory remains outside the demonstrated fix. Only elevate this if issue scope requires handling it.
6. No screenshots, browser run, or video requested for this server-only diff. Lead's server transcript plus red/green test is the required proof.

## FRICTION

category | cause | remedy
--- | --- | ---
PROOF_PENDING | Pass 1 is source review; lead owns server and after observations | Supply red/green focused test results and R1/R2/R3 runtime transcript for pass 2
PROVENANCE | Before trace is extracted spans; revision and filesystem transition live in separate procedure | Keep both linked; include revision and filesystem facts alongside after spans
SCOPE_BOUNDARY | .git marker existence does not establish full repository validity | Describe this as missing-marker fallback; do not imply repair of corrupt/stale Git metadata

Pass 1 verdict: proof plan is appropriate; final behavior remains unverified until pass 2. No concrete blocking defect identified in the reviewed diff.