# Evidence-only proof audit, pass 1

PR [#23456](https://git.cafe/pingdotgg/t3code/pulls/23456). Verdict: **EVIDENCE INCOMPLETE — supplement proof before final evidence approval**. This is not a confirmed code-defect verdict or a full merge audit.

## Revision and scope

Reviewed local clean checkout `/home/ubuntu/wt/pr-23456`, head [dca0af89a8](https://git.cafe/pingdotgg/t3code/commit/dca0af89a8b60ae4a5dd81859fa5ee06c7544aaf), branch `fix/issue-20348`, PR target `main`, PR-reported base [96bae5465b](https://git.cafe/pingdotgg/t3code/commit/96bae5465bc5dfaedc890998a7a71672fb470ae2). Read the entire two-file diff against that base: manager 66 changed lines and tests 130 added lines, total 163 insertions/33 deletions. Head is a merge of the fix with the reported main revision. Local `main` is stale (local merge-base is 07d38b8d17167c8d17fba1184dbe13a307fada74); it was deliberately not used as the audit baseline. No fetch or checkout mutations.

Description and all four linked artifacts were read/downloaded before diff inspection. Local copies: `/tmp/pr-23456-evidence/{before,after,red,tests}.txt`. No runtime captures, server starts, tests, browser use, repository edits, PR comments, pushes, merges, claims, watches, or polling. T3 PR registration was performed as required by the harness; it is not a forge edit or a watch.

## Minimum fixture matrix derived from the final diff

| Row | Fixture / required observable result | Existing evidence | Assessment / missing proof |
| --- | --- | --- | --- |
| P | Exact final head in real app, same environment/session across settlement and follow-up | After transcript declares full `buildSHA`, real web app and Codex instance; times follow head commit; actual DB/native IDs and protocol excerpts | Real runtime is credibly represented, but build/process provenance is asserted rather than demonstrated. Supplement existing run with recorded launch/worktree/process identity or equivalent existing build metadata tying server code to final SHA, dirty state/source digest and session continuity. Current checkout SHA alone cannot establish the historical running process. |
| A | Child attached before parent settlement; settle parent; same child's next turn completes without losing subscription | Before: child unsubscribe then native PONG but app run stuck. After: READY at 07:57:25, parent completed 07:57:31, parent unsubscribe 07:57:50, child PONG/completed at 07:58:02; target child absent from all three selected unsubscribe requests | **Sufficient behavioral proof of sequential regression/fix**, subject to P. Preserve captures; no repeat requested. Missing raw persisted assistant text is not a blocker for this lifecycle fix: native PONG plus durable completed child run is adequate. Visible PONG is an operator observation, not independently shown by DB message content. |
| U | Projected native child with no independent app attachment is still unloaded when parent settles; parent cleanup also remains intact | After protocol shows two old child IDs and parent unsubscribed. New unit test asserts unattached child unload; 43-test summary reports pass | **Partial runtime proof.** Parent cleanup shown. Old child IDs lack owner/provider-thread/subagent mapping and pre-settlement attachment state, so they cannot conclusively establish the intended unattached-child fixture. Supplement existing run with selected projection/lifecycle records mapping those IDs and proving unattached state; if unavailable, deliver one focused real-runtime cleanup transcript. No need to repeat A. |
| C1 | Child attaches first while parent cleanup is pending: owner lock/recheck preserves that child's native subscription | New attached-child test is sequential; after runtime follow-up occurs nine seconds after parent unsubscribe | **Missing overlap proof.** A does not prove lock behavior under contention. Deliver a real-server trace with correlated owner/native IDs and an attachment-before-unload ordering; child must remain subscribed and next turn complete. |
| C2 | Parent cleanup begins unloading an unattached child; attachment arriving during unload waits, then reloads/subscribes and completes next turn | Existing Deferred-gated unit test checks self-thread detach/reattach and resume count, not parent projection traversing another owner; aggregate 43-pass log | **Missing child-owner overlap proof.** Deliver a real-server trace demonstrating unload start, overlapping attach request, unload completion, subsequent resume/reload and successful persisted child completion. Deterministic non-mutating diagnostic tracing is preferable to timing guesses; explicitly label any injected delay and keep provider/runtime real. C1/C2 can share one small transcript bundle. |

This is four behavioral fixtures (A/U/C1/C2) plus a shared provenance requirement P, not an empty matrix. Transcript evidence is appropriate; screenshots would add little. No viewport/theme/client screenshot cross-product is justified. Web, desktop and mobile use the same changed server lifecycle; local/remote/relay/tunnel transport differences do not add a distinct changed branch. No contracts/render paths changed. OpenCode runtime was explicitly not exercised; preserve that limitation rather than claiming provider equivalence. Unsupported/exclusive runtimes do not enter this multiple-provider-thread unload branch. Native-child and T3-delegated lineage should be identified in supplied mappings; the added unit fixture uses `origin: provider_native`, while the real transcript IDs are T3 delegated-task threads. ProjectionStore includes provider thread IDs referenced by subagents without filtering origin, so the real reproduction remains relevant, but does not separately demonstrate native-only creation.

## Independent source and artifact checks

- The change takes each projected provider thread's `appThreadId` (fallback parent) as the attachment-lock key and attachment-set lookup, then unloads only if that owner is detached and runtime identity is unchanged. Read attach/resume and projection query context. ProjectionStore includes child provider threads through parent subagent references. CodexAdapter `unloadThread` issues native `thread/unsubscribe`, directly supporting the transcript interpretation.
- Independently hashed manager source from historical before revision and PR base: both SHA256 `7cb7cde77cfb6477ac121df1c0982638cab15e414890b4970bb801ab7db47bf0`. Thus the stated baseline-source equivalence is true for the changed manager, not a claim that whole builds match. Final manager SHA256 `2424f84d8cebaf64133f5d915127f0752e22e146d2fa5498c50fcc2e8c6d70f3`.
- After transcript SHA256 `46eb81d301e78d4382a3bf11142814d42b2c5e0fe4b7d2621bdbfb641d1a9243`; before `f41d52bc8aa21ec94b8fdcd585014c64bd813a35b94f633ed891a25e3b67211d`; red `c1a592585db888a479c1efea37cf2607c4d055a5f564833a6ab73df60ede6f8a`; tests `ce6b4156ce429ba76a981dfcb6b4f6f34c417bb5987efd0368f11c657aa514f0`.
- Red log contains the meaningful attached-child failure: received native-child unload instead of none. Green log reports 43 passed at 07:56:18, after head commit time 07:56:02; it contains no SHA, command line or named case list. Temporal consistency is not final-head process attestation. Test log path `/home/ubuntu/wt/issue-20348` no longer exists here, so its historical checkout state could not be independently inspected.
- Existing concurrency test uses a controlled adapter and Deferred signals, a good deterministic logic check; its child-owner specificity is limited. Unit evidence does not substitute for the requested real-runtime concurrency proof. No confirmed implementation bug is asserted in this evidence-only pass.
- Artifacts are selected human-produced excerpts, not raw complete logs. The no-target-unsubscribe and no-restart claims are plausible and internally consistent; the excerpt itself cannot independently establish omitted events or process continuity. Parent receives another turn at 07:58:03, after child success; that does not invalidate the child result.

## Checks — exactly one status read

`cafe pr status 23456` returned the reviewed full head SHA, **34 successful / 0 pending / 0 failing**, stored observation, no rulesets matched, mergeable verdict. Conflict snapshot used newer base 8d3b061121fe65669d5d43d011b48cd3027a4108 and reported no conflicts at 10:11:50 UTC. This was one status read, not monitoring; no recheck performed.

## FRICTION

No capture performed or required for this audit. All four artifact downloads succeeded. Broad scratch discovery encountered permission-denied systemd-private directories; these are unrelated to evidence. The historical runtime checkout path is absent. No dedicated evidence runbook was found in the searched project docs and installed skill filenames; read the applicable nonvisual-evidence guidance in `prepare-pr/SKILL.md` and the `pr-audit`, `cafe-cli`, `cafe-pr` skills. No auth/network blocker. No secret or live database access needed.

## Handoff for pass 2

Keep existing A and red/green artifacts. Deliver a provenance supplement P, mapped unattached cleanup U (prefer existing records), and one correlated real-runtime contention bundle covering both C1/C2. Pass 2 should independently check identity/order/completion against the final head, not rely on this report's conclusions. If the maintainer accepts deterministic unit coverage instead of real-runtime concurrency, record that explicit scope decision; do not silently mark C1/C2 runtime-proven. Correct the description's empty-matrix/0-of-0 assertion when evidence is updated; no PR edit was made by this audit.