# Proof audit 1: remote Lineage row labels

PR [#33181](https://git.cafe/pingdotgg/t3code/pull/33181). Read-only audit; no fresh captures were produced in this pass.

## Findings

1. **Existing proof is insufficient.** The contributor before/after images show a useful remote-running-row example, but satisfy **zero complete rows** below. They identify neither capture commit, show only a 552×300-pixel dark cropped panel (described as scaled 2×), have no full-client viewport, no light counterpart, no narrow counterpart, no computed diff image, and no interaction recording. They show neither a delegated parent nor any tooltip. They are supplemental evidence for R3/R4 only; the underlying full title length and client connection state cannot be established from the crops.
2. **Capture the exact audited revisions.** Before: [4c361199f4](https://git.cafe/pingdotgg/t3code/commit/4c361199f47f6ea32a2c14835df392640d0f7c63). After: [bb4b3fb5dd](https://git.cafe/pingdotgg/t3code/commit/bb4b3fb5dd6b06f73603a458073eea37c644aebe). The after revision is the local merge; the PR currently reports [ab10098890](https://git.cafe/pingdotgg/t3code/commit/ab10098890f2a25334f1a2ce87146d252e1635ea). Contributor images do not claim either audited revision. Record full SHAs in the capture manifest. A later pushed change requires matching evidence or an explicit unchanged-surface comparison.
3. **The changed browser test is partial coverage only.** It covers an unavailable remote environment, a completed task, long title/name, and a 320px test wrapper. It checks title width >0, tooltip strings, and blocked navigation. It does not check the delegated-parent width, connected-parent hint, preserved status width, or horizontal overflow. The existing delegated-parent test mocks no environment and supplies no fallback label, so it never renders the label changed by this diff. These are proof gaps, not a request for more visual tests.
4. **Local servers can model real remote delegation.** Two isolated dev servers with different persisted environment IDs can link over loopback without T3 Connect. A server-side link is separate from a browser catalog connection. Missing catalog entry means `useEnvironment` returns null; simply making a known connection offline does not select that branch. Controlled labelled harness evidence is realistic for the full matrix, especially long/empty synthetic labels, status variants, and missing parent shells. Do not claim harness captures are a real app or macOS Electron capture.

## Render-path inventory and equivalence classes

- Production chain: ChatView → ThreadDetailsPanel → ThreadRelationshipsPanel → RemoteSubagentRow / DelegatedFromRow → ThreadDetailsControl / Tooltip. Each changed row has exactly one production caller, both inside the same panel. The panel also has direct browser-test callers. ChatView omits the details panel when embedded; drafts and compact/essential density omit relationships; `showLineage=false` omits both changed row types. `showSideChats` controls a separate, unchanged local-row section. Settings → Appearance → thread details and the card context menu share Lineage visibility settings. The `threadPanel.toggle` command/keybinding opens/closes this same surface; no second remote-row renderer lives in Settings or a command palette.
- Remote row inputs: `agent.remoteChild` is required; `childThreadId` is null for an actual remote task. All projected subagents with `remoteChild !== undefined` enter the remote list, regardless of local shells. Title is `agent.title ?? "Subagent"`, then the existing `Subagent:` / root-task-path formatter. Provider lookup uses the *remote* environment ID and provider-instance ID: found → provider glyph, absent → Bot glyph. Both have fixed 16px geometry and a status dot. The status label stays untruncated; only `on <label>` truncates inside the new half-row cap. A null title differs from an empty title: null gets the fallback; empty stays empty. Remote labels are strings and have no truthiness guard, so an empty label still leaves `on` and a status.
- All schema-valid remote statuses: pending→Queued, running→Running, waiting→Waiting (active group); completed→Done, failed→Failed, cancelled/interrupted→Stopped, idle→Idle (Previous agents). Only failed makes the trailing text destructive. Other strings handled by the shared status helper, including `error`, cannot be produced by the typed remote-subagent schema and need no invented remote fixture. Existing error handling remains relevant to local rows, not this changed renderer.
- Grouping: local rows precede remote rows within each group. Related and active lists begin expanded with no group label. Previous agents begins collapsed, shows a count and failed count, and expands on click. Each group initially displays six rows; Show more adds 12 (6→18→30), with a 13.5rem scrolling list. A previous-only panel can omit the Lineage heading; a running row or delegated parent restores it. Remote rows have no elapsed-time text or stop button. Local merge/stop/disconnect/workflow busy/error surfaces use the unchanged local renderer and are not new capture requirements for this diff.
- Parent inputs: `currentThread.delegatedFrom` may come from the loaded projection, relationship shell, or archived shell. A present `useQuietThreadShell(parentRef)` supplies the current parent title; otherwise use the delegation snapshot title. Label is `environment?.label ?? currentThread.linkOrigin?.label`, then a truthiness guard: missing/empty hides the label. Known environment uses the changed hint `Open parent agent on <environment.label>`; missing environment uses the fallback-label or generic connection hint. Empty fallback differs from missing for the existing nullish tooltip expression, even though both omit the label. Parent rows have a fixed corner-arrow glyph, no status text, and a muted dot.
- Interactions: delayed hover (200ms), pointer leave/dismissal, keyboard focus/activation, enabled click navigating to the scoped remote/parent route, unavailable click doing nothing, Previous agents expand/collapse, Show more, vertical list scroll, and app/card visibility. Neither row checks connection phase, loading, or errors independently. Known connecting/offline/error entries share the enabled branch; null projection with no relationship shells renders no changed row, not a skeleton. Parent-shell arrival can replace the snapshot title. There is no clock-driven row layout branch; state transitions, delayed hover, and popup placement need recordings.
- Surfaces: web local and remote clients and desktop share this web component. Provider differences are bounded to the existing fixed-size glyph. Native mobile uses separate UI and is outside this web-only diff; a narrow browser is still web. No OS-specific branch changes here. Chromium evidence cannot prove macOS-native scrollbar painting, though recorded scrollWidth/clientWidth geometry can prove absence of the overflow that caused it.

## Capture rules and minimum set

**V×T = four coordinates:** wide 1440×1000 and narrow 390×844 CSS viewport, each light and dark, at the same DPR/zoom/fonts on before and after. Wide should exercise inline details, narrow the popup; verify the actual placement rather than assuming it from window size. Production inline card width is **280 CSS px**, not the test's 320. Popup outer width includes padding; report the actual card and row bounding widths. The harness must render the real complete relationships panel inside a 280px card using production CSS; a 320px additional check may supplement it. If the real narrow popup is narrower than 280px, also render at that measured width.

For each required resting row below capture **before + after + pixel diff** at V×T. Include the complete client viewport, card boundaries, headings, row edges, and list scrollbars. For a labelled harness, include its complete viewport, the whole panel/card, the label “Component harness — synthetic data”, fixture ID, and the viewport/theme; never present it as full-app evidence. Keep tooltip portals in the frame. Exact identical fixtures and interaction steps must run against both audited SHAs.

Rows can share an image when the actual panel naturally renders them together: R1–R4 fit in one four-row active list; all five R5 statuses fit in one expanded Previous agents list. D1–D5 require separate parent-thread scenes because the production panel has only one delegated parent. Thus the required resting set can be **seven scenes × four coordinates = 28 before/after/diff triplets**, rather than one file per listed row. R6 is a supplemental edge-control scene, not another required triplet. Do not manufacture several parent rows in one panel.

H1, H2 and G1 are **recording** fixtures; stills alone do not satisfy them. They can be chapters in a single before/after recording per V×T coordinate, with a manifest mapping fixture IDs to timestamps. Include open/closed hover states, changed parent tooltip, navigation/no-op outcomes, paging and status transitions. Record same states on both SHAs and provide a labelled before/after frame plus image diff at each material checkpoint. Controls D6 and G2 can share this trace; they need no additional theme/viewport cross-product because they do not execute changed code. An integrated real-client pass is still required; a synthetic harness does not establish real app routing/placement.

## Fixture matrix

Status PENDING means no current evidence satisfies the required capture rule. SOURCE-CONTROL means an unchanged branch was established by source inspection and needs only the shared control trace. All data strings below are synthetic.

| ID | Named fixture and exact data | Diff effect / expected result | Minimum artifact | Seeding route | Status |
|---|---|---|---|---|---|
| R1 | Fit baseline: title `Scan`, label `QA`, pending; known client environment and provider | Changed remote label structure must preserve fit text and Queued status | Resting V×T, shared active scene | H remote fixture; real A parent via P | PENDING |
| R2 | Long title only: `Audit relationship labels across the synthetic staging workspace`, label `QA`, waiting; known environment | Title ellipsizes; short environment and Waiting remain readable | Resting V×T, shared active scene | H / P | PENDING |
| R3 | Long environment only: title `Scan`, label `QA Station with an intentionally very long synthetic environment name`, running; known environment | Environment truncates within cap, short title survives, Running never truncates, no x overflow | Resting V×T, shared active scene | H recommended; P with controlled synthetic projected label | PENDING; contributor crop only supplemental |
| R4 | Long both / unbroken: title `InvestigateSyntheticRemoteRelationshipLayoutAcrossEnvironments`, label `SyntheticEnvironmentWithAnIntentionallyVeryLongUnbrokenMachineLabel`, running; missing client environment/provider | Both strings truncate independently, title width >0, Running intact; disabled opacity and Bot fallback visible | Resting V×T, shared active scene | H remote with `useEnvironment=null`, provider map empty; P without adding B to browser | PENDING; contributor crop only supplemental |
| R5 | Previous-only status board: five long-title/long-label remotes, statuses completed, failed, cancelled, interrupted, idle; mix short synthetic labels where useful | Initially collapsed; expanded shows Done / destructive Failed / Stopped / Stopped / Idle, visible count and failed count; no forced Lineage heading | Resting V×T after expansion plus G1 recording for entry | H, set five subagents and no other relations; P yields common completed/failed/cancelled cases | PENDING |
| R6 | Nullable/empty controls: title null with long label; title `Subagent: /root/check_labels` with long label; empty title with label empty | Fallback `Subagent`, formatted `Check Labels`, and intentional empty-title case; empty remote label still leaves `on` and status. Do not mistake intentional absence for squeeze regression | Supplemental checkpoints in H1/G1 recording; no separate required triplets | H (legacy/schema-permitted edge values); normal producer does not create empty environment names | PENDING control |
| D1 | Connected parent, fit baseline: live parent title `Review`, environment `QA`, conflicting fallback `Old alias` | Fit parent/label preserved; hover must say `Open parent agent on QA`, using current environment label over fallback | Resting V×T; H2 hover recording | H parent fixture; P B child with A in browser catalog | PENDING |
| D2 | Known environment, parent shell not loaded: long delegation snapshot title, environment `QA`; shell null | Snapshot title ellipsizes, short label readable; changed connected hint still names QA | Resting V×T; H2 checkpoint | H `useQuietThreadShell=null`; P B child before loading A parent | PENDING |
| D3 | Connected parent: live title `Review`, long synthetic environment label; fallback `Old alias` | Environment cap/truncation preserves short title; tooltip exposes full current environment label | Resting V×T; H2 hover recording | H; P with controlled client alias | PENDING |
| D4 | Connected parent: long live title and long synthetic environment label, distinct old snapshot title | Both title and label truncate; live title wins snapshot, full live title and environment recoverable in hover | Resting V×T; H2 hover recording | H; P after opening/renaming A parent and returning to B child | PENDING |
| D5 | Parent absent from client catalog: long snapshot title and long `thread.linkOrigin.label`, parent shell null | Changed fallback label cap applies; row disabled; tooltip says delegated from full fallback label and asks to connect; click stays put | Resting V×T; H2 hover/no-op recording | H; P B child while only B is in browser catalog | PENDING |
| D6 | Parent unavailable, no fallback label; second checkpoint empty fallback string | No trailing span in either case. Missing label gives generic `a linked environment`; empty string preserves existing empty-string hint behavior. Neither branch executes changed span/text | Shared H2 control checkpoints, no separate V×T requirement | H omit `linkOrigin`, then set label empty; legacy/synthetic only for empty | SOURCE-CONTROL; runtime checkpoint pending |
| H1 | Remote hover/focus/navigation for known and missing catalog environments, long strings; provider found and absent | Full title + `Open on <label>` versus `Runs on <label>. Connect…`; dismiss; known click/Enter goes to scoped B thread, missing remains on A. Also a known offline/connecting presentation remains enabled (do not confuse with null) | **recording**, V×T; can share one combined trace with H2/G1 | H deterministic hook/router changes; P real client route `/<A-id>/<parent-id>` | PENDING |
| H2 | Parent hover/focus/navigation for D1–D6, plus snapshot→live title arrival | Changed `Open parent agent on <full environment>` visible after hover delay, tooltip unclipped in narrow popup, title/label selection correct, known navigation to A, missing no-op, leave dismisses | **recording**, V×T; before must visibly lack environment in connected hint | H controlled `useEnvironment` / `useQuietThreadShell`; P real `/<B-id>/<child-id>` | PENDING |
| G1 | Mixed and paged list: 19 active rows with local row(s) preceding long remote rows; previous group includes five terminal statuses; start at six, Show 12 more→18, Show 1 more→19; collapse/reopen Previous agents. Separate phase running→completed | Changed remote layout remains sound at top/bottom, scrolling only vertically; new finished row moves to collapsed previous group, count/heading update. Inspect scrollWidth≤clientWidth for each list and row; source has no elapsed timer | **recording**, V×T; one controlled trace can also show 0/1/6/7 boundaries via checkpoints | H data updates (no time sleeps/polling); P genuine delegation for one run transition, harness for boundary counts | PENDING |
| G2 | Visibility/empty/placement controls: null projection and no shells; delegatedFrom absent and zero remotes; Lineage off with Side chats on; compact/essential density, draft, embedded; restore full density and Lineage | Changed rows absent under these guards; local/side-chat UI unaffected. Full mode re-exposes the same two renderers. Include card hide/reopen via command and context-menu/Appearance setting where integrated | Shared integrated control **recording**, one representative coordinate; full/restored scenes covered by required V×T | Real app route and settings; H for null/shell fixtures. No need to invent row-level loading/error UI | SOURCE-CONTROL; integrated trace pending |

## Concrete seeding instructions

**H — labelled component harness (recommended for matrix completeness).** Start from the existing browser test's synthetic projection and disposable render helper. Import production index.css, render the actual ThreadRelationshipsPanel with real Tooltip/ThreadDetailsControl, a router, `showLineage=true`, and a measured 280px card. Parameterize `useEnvironment` by environment ID, `useQuietThreadShell` by scoped parent ref, and `useEnvironmentProviders` by environment+instance. The existing test hardcodes all three to null/empty; leaving those mocks unchanged cannot cover connected parent/remote cases. Put synthetic parent relation on `projection.thread.delegatedFrom={environmentId:"qa-parent-env",threadId:"qa-parent",title:<snapshot>}` and fallback on `thread.linkOrigin.label`. Put synthetic remote records on `projection.subagents`, with unique IDs, `childThreadId:null`, and `remoteChild={environmentId:"qa-child-env",threadId:"qa-child-N",label:<synthetic>}`. Reuse the fixture's other schema fields; expose no runtime model identifiers in pictures, manifests, logs, or uploads. Load the real router for integrated navigation; a memory router demonstrates only the component's requested route. Use actual pointer/focus events and record popup opening, not just an already-open screenshot.

**P — real app path (feasible without T3 Connect, not executed by this auditor).** Launch two servers with distinct isolated homes/database files and ports, each generating its own environment ID; never share/copy an environment-ID file between them. Enable Linked environments in Settings → Labs on each. Obtain a pairing credential from B's own dev CLI/Connections, and call A's authenticated `peerLinks.link` RPC with `{url:"http://127.0.0.1:<B-port>",pairingCode:<credential>,access:<chosen scope>}`; make the reverse link if testing calls in both directions. Browser catalog connections must be added/removed independently. A mere link, fork, or top-level thread launch does not make `remoteChild`: from an *active A parent run's own MCP session*, invoke `delegate_task` with `target.environmentId=B`, an explicit B project ID if repository matching is ambiguous, and an available provider selection. RemoteDelegation launches B's ordinary child with delegatedFrom, records A's task with remoteChild, and follows its status. Do not use remote worktree isolation (explicitly rejected). Parent route is `/<A-env>/<parent-thread>`; child route is `/<B-env>/<child-thread>`. In the same browser, add both environments to test enabled navigation; use a browser profile with only A or only B for the null-environment branches. Disable/forget in the isolated test browser rather than stopping a live machine. An active parent run and working provider/MCP session are necessary; Replay alone is not demonstrated here to issue this remote delegation. Use the harness rather than paying for a large collection of real runs just to generate label/count states.

Both server labels normally come from the VM hostname; two servers on one VM can therefore have identical labels but different IDs. That does not block actual remote relationships. It does mean long synthetic server-label variants need controlled synthetic fixture data; do not change the VM's hostname to make screenshots. Parent display labels can use browser catalog aliases. No assumption of a working tunnel or T3 Connect is needed.

## Source anchors

- [Changed rows, grouping, paging and callers](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/components/chat/ThreadRelationshipsControl.tsx).
- [Existing browser harness and its unavailable-only mocks](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/components/chat/ThreadRelationshipsControl.browser.test.tsx).
- [Panel density/draft/settings guards](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/components/chat/ThreadDetailsPanel.tsx), [280px card layout](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/components/chat/threadDetailsCardLayout.ts), [inline/popover card](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/components/chat/ThreadDetailsCard.tsx).
- [Remote relationship and status schemas](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/packages/contracts/src/orchestrationV2.ts), [status display helper](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/components/chat/ThreadRelationshipIcon.tsx).
- [Loopback acceptance, self-ID rejection, OAuth link handshake](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/server/src/peer/PeerLinks.ts), [remote delegate requires active parent and writes both relationships](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/server/src/peer/RemoteDelegation.ts).
- [Browser environment presence follows catalog, not connection phase](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/packages/client-runtime/src/state/presentation.ts), [web environment hook](https://git.cafe/pingdotgg/t3code/blob/bb4b3fb5dd6b06f73603a458073eea37c644aebe/apps/web/src/state/environments.ts).

Contributor sources already public: [before image](https://gist.githubusercontent.com/f4llenz/1c0dbaa1f34e00218f910d1713c38a10/raw/f5d8327388d0a88138f732945f0bb51e167eed7b/lineage-before.png), [after image](https://gist.githubusercontent.com/f4llenz/1c0dbaa1f34e00218f910d1713c38a10/raw/f5d8327388d0a88138f732945f0bb51e167eed7b/lineage-after.png). No contributor assets were re-uploaded by this auditor.

FRICTION: none

VERDICT: INSUFFICIENT R1–R5, D1–D5 matching-SHA viewport/theme before/after/diff sets; H1/H2/G1 recordings; R6/D6/G2 control checkpoints and real-client integration pass