# Proof audit, pass 1 — fixture specification

Findings first

1. **Evidence is insufficient at this pass.** No capture was supplied for acceptance in this pass; no runtime test or capture was executed by this auditor. Source inspection establishes the matrix, not a passing result. The added regression exercises computed delivery order, a rejected completion move, and moving back to the end. It never completes the active run or observes actual queue promotions. A helper result alone does not satisfy the server runtime transcript requirement. See [the pinned regression][S4].
2. **The before revision must be chosen correctly.** Audited [PR #25697](https://git.cafe/pingdotgg/t3code/pull/25697) at [39da8b2458](https://git.cafe/pingdotgg/t3code/commit/39da8b24584ab2f453dd4835713d4b221e0df955). During this audit, `origin/main` resolved to [6f6c6c14b7](https://git.cafe/pingdotgg/t3code/commit/6f6c6c14b76e72d7abd43b8e6ebffff17eadc89e), an ancestor of the requested head. That is the frozen before revision for `git diff origin/main 39da8b2458` in this report. The head's parent [7b7d993403](https://git.cafe/pingdotgg/t3code/commit/7b7d9934030e2122c608501c847253c955268dba) already contains the production fix: its diff to the audited head is tests only. Using that parent as the before revision would not reproduce the original rejection. The live forge metadata reports another head, [ad518480c9](https://git.cafe/pingdotgg/t3code/commit/ad518480c9c8f252bf5ca200789de4d3682128af); its checks and linked old artifacts are not accepted proof for this pinned pass.
3. **No changed visual render path was found.** The four changed files are [Orchestrator][S1], [QueuedRunOrder][S2], [runtimeLayer.test][S4], and [the run contract][S3]. Web's [QueuedRunsControl][S7] and [ChatView][S8], desktop's web surface, and mobile's [ThreadQueueControl][S9] use [the shared workflow selector][S6]. That selector hides both delegated completions and notifications, sorts visible runs by position/ordinal, and does not read the new marker. No completion target is offered by those client controls. Ordinary queue rows, empty/count states, collapsed rows, drag handles, pending/loading/error presentation, attachments/text length, edit/steer/send-now controls, themes, widths, and iOS/Android layout branches are unchanged. Delivery timing can change when a run starts, but no new presentation is introduced. Screenshots cannot establish this fix; use server transcripts.
4. **Use the pinned API names.** The issue calls the operations `t3_queue_list` and `t3_queue_reorder`; this revision exposes [the consolidated `t3_queue` tool][S10] with `action: "list"` or `"reorder"`. [The handler][S5] maps writes to the real orchestrator. A list item contains only `queuedRunId`, `text`, and `truncated`; list responses also have `nextCursor`. Neither queuePosition nor the marker is exposed through MCP. Print projection/event data separately and label it diagnostic. A successful write returns `sequence`; dispatch errors become `orchestration_error` with the cause text. Do not invent a marker field in a tool transcript.
5. **Goal reset is intentional and needs proof.** Both changed goal paths clear priority. The resolved review discussion explicitly says normalization restores completions → goal → ordinary messages. The code supports that interpretation; this audit does not report that reset as a bug. In particular, an unchanged numeric queuePosition does not excuse retaining a true marker. A no-op reorder with a new command ID produces no domain events and the outer dispatcher rejects it with `Command produced no domain events.`; do not claim all accepted-looking moves succeed.
6. **Stop is not a neutral release operation.** [Stopping a parent disposes its current completion delivery][S14]; holdQueue=true also disposes outstanding cohorts. Use a terminal event to release A in ordinary delivery fixtures. For goal-stop/restart fixtures whose expected result retains completions, give C a historical owner P distinct from active A. Use an explicitly injected held queue for the resume fixture. Record same-owner cancellation separately as R20; do not claim every completion survives Stop.
7. **Use an honestly labelled orchestrator harness on this VM.** No real Claude/Codex credentials are available. A normal server start of a real turn may fail and consume/hold the queue; it is not a deterministic way to keep an active run. The real runtime layer with in-memory SQLite and a registered stub provider is realistic for this server change. Keep the active run at starting/running until explicitly released. Actual server promotions to `starting` can be observed without executing a real provider turn. For native steering, goal interruption, or effects that need a provider session, use a fake adapter/session as in [SteeringCompletion.integration][S11], not a real provider. All such evidence must say **harness capture; real orchestrator/event sink/projection store; stub provider; injected terminal events; no real model execution**.

Scope and caller inventory

- [Reorder handler][S1]: missing/nonqueued moving run; automatic moving message (delegated completion OR notification) refused; null anchor appends; nonnull anchor found/not found including self; insertion around all queued runs; last delegated completion absent/present; automatic/nonautomatic classification; priority false/missing/true; position and marker unchanged vs changed; optional rootNodeId in emitted events. Every successful reorder assigns contiguous positive positions and only marks non-completion runs before the final delegated completion. Payloads for unmarked, nonpriority runs keep the field absent; clearing a true field writes false. Completion runs are not marked by the reorder.
- [Ordering helper][S2]: only queued statuses; priority class is delegatedCompletion OR marker exactly true; position falls back to ordinal for missing/null; ordinal breaks equal position ties. Notifications alone are not completion-priority runs. All direct callers are MCP list, reorder, goal normalization, and `nextQueuedRun`; the latter is used by automatic promotion, default queue resume, and default queued-start failure attribution. Explicit queued-run start selects its named run instead. [Client commands][S12] send the same reorder/promote/resume commands through environment RPC.
- [Promote handler and goal normalization][S1]: ordinary promotion cancels its queue run and steers/restarts; a native goal uses the goal path, resets its own flag at position 1, normalizes other ordinary queued runs, and may interrupt the active run. The helper also runs on incoming native goals that stop active work. Stop also disposes the interrupted run's completion cohort. The helper skips automatic completions, clears other ordinary markers even when positions already match, and handles both an interrupt target and no interrupt target. Missing queued execution state, inactive thread, and unsupported goal commands retain existing errors. These are controls, not new UI fixtures.
- [Contract][S3] and [projection persistence][S13]: optional boolean is carried by run.created/run.updated, event JSON, projection payload JSON and thread detail transport. No schema migration is needed for optional payload data. Missing and false mean no priority; true means priority. Roundtrip and rebuild must retain true and explicit false. No client reads it for layout. No new RPC endpoint, permission, scheduled-task path, provider adapter, or connection-origin branch is introduced.
- Queue ordering is provider-independent. Native goals are recognized only for Codex/Claude drivers; Claude pause/resume remain unsupported. Cursor, Grok, OpenCode and Antigravity do not acquire native goal semantics. Ordinary queue behavior still follows their existing capabilities. A local/remote/relay/tunnel client dispatches the same destination-environment command; no origin/network fixture is justified by this diff. Existing provider start/limit/hold/error gates remain in force.

Fixture conventions and capture method

`A` = one active blocking run; `C1/C2/C3` = queued messages with delegatedCompletion metadata; `U/V/W` = ordinary queued messages; `G` = native goal command; `N` = notification; `P` = historical completion-owning run distinct from A where specified. Lists below are **delivery order**, not raw projection insertion order. Unless explicitly stated, all queue records start with no marker. `q` denotes queuePosition. Use distinct stable IDs and short unique text labels so the complete list can be checked without truncation.

**H seed (preferred here):** use the [runtimeLayer lifecycle setup][S4] with real RuntimeLayer, EventSink, ProjectionStore, ThreadCommandExecutor and in-memory SQLite, plus its registered Codex stub and test settings. `thread.create`, then `message.dispatch(start_immediately)` creates A; ordinary `message.dispatch(queue_after_active)` creates U/V. To create each valid completion generation, mirror the pinned regression: write A's delegatedCompletion state as open with `nextGeneration=g+1` and delivery `{messageId, generation:g, taskIds}`, then dispatch an agent/server queued message with matching `{parentRunId:A.id, generation:g, taskIds}`. Do not fake a completion by merely naming its text C1. For R12/R13, create/finish P before starting A, and use P rather than A for completion cohort state and parentRunId; a stopped A then owns none of those completion deliveries. Keep these writes and all terminal injections visible in the log. To seed legacy positions or deliberately missing identity, use explicit EventSink writes and label that state as injected.

**H promotion:** subscribe with a deterministic registration barrier to persisted run.updated events; inject terminal updates for A and each subsequent promoted run, await the precise next starting event, and print the reread projection after each. Await Deferred/Queue events and drain the effect worker where applicable; no sleeps, yield/poll loops, elapsed-time assertions, or retries. Assert at most one starting/running run, each expected promotion exactly once, no skipped IDs, and empty final queue. Keep provider effects stubbed or undrained where the lifecycle harness intentionally has no sessions. Claim server promotion, not provider execution.

**P seed (possible elsewhere, not available unassisted on this VM):** use an isolated real server via its authenticated orchestration RPC/WebSocket or `t3_queue` MCP entry point, with an already blocked/held active run and real delegated completion deliveries. Reorder and list need no live model by themselves, but organically creating a running parent and delegated completions needs a provider or a test adapter. Do not write production/live userdata, use another thread's running provider, or pretend harness EventSink writes are supported public RPC. There is no public queue-position/marker injection API for legacy/equal-position fixtures.

**MCP boundary:** use the real toolkit handler with test invocation context/ThreadManagementService backed by the real orchestrator (or an isolated authenticated server). If omitted, label output `harness projection in delivery order`, not `t3_queue_list output`. Use `t3_queue({action:"list",threadId,...})`, `t3_queue({action:"reorder",threadId,queuedRunId,beforeRunId})`, and `t3_queue({action:"promote_to_steer",threadId,queuedRunId,targetRunId})`. Persisted-event/projection diagnostics supplement but do not replace the true MCP response.

All interaction/time rows are marked **recording**: a chronological text runtime recording is the required medium; still images are insufficient. It need not be a screen video. Each recording must print revision, fixture/seed inputs, commands with IDs/parameters, success/error, relevant persisted event/field changes, list/order before and after, and observed promotions where requested. Expected results alone are not captures.

| Row / named fixture | Diff affects? | Required data and interaction | What the recording must show | Seed / real-app feasibility | Minimum capture / pass-1 status |
| --- | --- | --- | --- | --- | --- |
| R01 — front correction and later completion | Yes: removed anchor rejection and priority ordering | A active; initial `C1,C2,U,V`. Move U before C1; then create C3 while A remains active. | **recording**. Before baseline: exact old rejection `Queued messages cannot be reordered ahead of automatic completion delivery.`, no queue/run event mutation, then C3 arrives and promotions `C1,C2,C3,U,V`. After head: reorder sequence; U=true; list `U,C1,C2,C3,V`; actual promotions in exactly that order after releasing A. C1/C2/C3 retain their relative order. | H; P only with blocked real parent and completion delivery source. No real provider required in H. | **M1 paired before/after — MISSING**. Added regression covers computed order, not actual delivery. |
| R02 — insert between completions | Yes | Fresh `C1,C2,U,V`; move U before C2. | **recording**. Baseline rejects; head list/promotions `C1,U,C2,V`; U=true, contiguous q. Proves anchor need not be first completion and C1 is not jumped. | H or P as R01. | **M1 variant paired — MISSING**. |
| R03 — ordinary anchor inside priority prefix | Yes: marker computed for every run | Reach `U,C1,C2,V,W` by explicit reorder; move V before U (ordinary anchor), then move W before V. | **recording**. Final list/promotions `W,V,U,C1,C2`; U/V/W all true; completion markers not set; existing U priority survives another run's move. This covers multiple marked runs and an ordinary beforeRunId inside the prefix. | H; P can issue the same reorders after R01-like seed. | **M1 continuation — MISSING**. |
| R04 — move back with ordinary nonnull anchor | Yes: clear marker | Reach `U,C1,C2,V,W`; move U before W. | **recording**. U true→false; order/promotions `C1,C2,V,U,W`, not U-first; completion order unchanged. This is the nonnull reverse operation. | H/P; independent reset of R01 seed. | **M2 reverse operations — MISSING**. |
| R05 — append with beforeRunId null | Yes: append and clear marker | Reach `U,C1,C2,V`; move U to null. | **recording**. Exact null command and success; U true→false, contiguous q; list/promotions `C1,C2,V,U`. Repeating with a new command ID when already normalized must be handled as R08, not fabricated as success. | H/P. | **M2 continuation — MISSING**. Added regression checks only helper order. |
| R06 — marker-only update at unchanged position | Yes: new equality guard | Inject legacy q `U=1,C1=2,C2=3` with missing markers, while A blocks. Effective order is `C1,C2,U`. Move U before C1. | **recording**. Head emits U update setting true although its q stays 1; C1/C2 q can remain unchanged; actual order becomes `U,C1,C2`. Before rejects. Also show unchanged unaffected records receive no gratuitous marker. | **Labelled H capture only** for injected legacy q. Public RPC cannot set q directly. | **M3 legacy/equality paired — MISSING**. |
| R07 — legacy completion priority and comparator boundaries | Yes: compatibility of changed helper | Fresh legacy records with no marker and a false variant: ordinary q1, completions q2/q3; include nonqueued run excluded from list. Small helper subfixture uses missing/null q and equal q with distinct ordinals. | **recording** for legacy actual promotions: `C1,C2,U` with no priority granted to U. Missing and false equivalent. Label the small fallback/tie check as a static harness result: effective q is q??ordinal, ordinal breaks ties; nonqueued records excluded. Never infer promotion from that static subcheck. | **Labelled H capture**; valid legacy records through EventSink; helper-only boundary data is not a running app. | **M3 variant before/after preservation — MISSING**. Existing helper test covers only one unmarked legacy order. |
| R08 — no completions, cardinality and no-op controls | No: preserved guard/ordinary behavior | Empty queue; singleton U; ordinary U/V with no completions. Missing/false markers. Move V before U; append a non-last ordinary run; repeat an already normalized move under a new command ID. | **recording**. Empty/missing moving ID gives `Run ... is not queued.`; real two-run moves succeed and normalize q without creating true markers; singleton q1 append and repeated normalized move reject `Command produced no domain events.` with unchanged run records/domain-event sequence. A previously unnormalized singleton can emit a q update. | H/P except injected noncontiguous singleton q is H only. | **Control; may share M2/M4 — NOT CAPTURED**. Existing behavior, not a standalone changed-row blocker. |
| R09 — moving automatic messages is forbidden | No: preserved protection, relevant to new allowance | `C1,C2,U` and separate queued N. Attempt C2 before C1, C2 to null, and N before U. | **recording**. Each rejects `Automatic completion deliveries cannot be reordered.`; no run payload/order/domain-event sequence changes. A rejected-command receipt may be persisted: do not claim the entire database is unchanged. Subsequent ordinary move before C succeeds (R01). | H/P for C; N can be server/provider-created; H is deterministic. | **Control; fold into M1/M4 — NOT CAPTURED**. Added regression checks one error tag only. |
| R10 — stale/self/invalid anchor | No: preserved validation | queued U; missing/running/completed moving ID; queued U with missing/nonqueued beforeRunId; beforeRunId=U itself. | **recording**. Invalid moving ID: `Run ... is not queued.`; invalid or self anchor: `Queue target ... is not queued.`; queue and run-domain-event sequence unchanged. Distinguish projection/thread lookup failure from these dispatch errors if tested. | H/P; create a known active and terminal run for nonqueued IDs. | **Control; M4 — NOT CAPTURED**. |
| R11 — promoting a marked goal clears its own priority without stopping | Yes: changed promote payload, targetRunId undefined in helper | A running with no driving goal; G=`/goal clear`; reorder G before C1 so order `G,C1,U` and G q1=true. Promote G to steer into A. | **recording**. G remains queued at q1 but true→false; no native steer and no interrupt request because clear has no active goal to stop. Delivery order is `C1,G,U`; release A and observe it. This specifically proves the changed own-marker reset at unchanged q. | **Labelled H capture** with Codex fake provider session/goal fixture from steering integration. P needs a suitable real session. | **M5 goal promote no-stop — MISSING**. |
| R12 — goal promotion resets another marker at unchanged position | Yes: changed normalization skip/payload | Seed effective `C0,U,C1,G` via reorder, q1/2/3/4 and U=true; G=`/goal ship it`, A live; completions owned by historical P, not A. Promote G into A. | **recording**. U q2 stays 2 but true→false; G q1=false; C records unchanged; A interrupt requested; resulting queue/delivery `C0,C1,G,U`. Show actual promotions after the controlled stop. This is intentional goal normalization, not a lost-priority defect. | **Labelled H capture**, fake provider sessions/interrupt acknowledgement. P possible with native goal provider. | **M5 goal promote stop variant — MISSING**. |
| R13 — incoming goal normalization | Yes: second helper caller | Reach `U,C1,C2,V` with U=true and A live; C1/C2 owned by historical P; send native `/goal ship it` with auto delivery intent (not explicit queue-only), through message.dispatch. | **recording**. G queued q1; U/V normalized to q2/q3 with U=false; A stop requested; effective list/promotions `C1,C2,G,U,V`. The fixture must reach the message.dispatch helper call, not merely repeat promote. | **Labelled H capture**, fake Codex/Claude goal-capable adapter/session. | **M6 incoming goals — MISSING**. |
| R14 — goal-looking input that does not normalize | Yes: priority-state interaction; preserved branch | Starting from `U,C1,V` with U=true: explicitly queue native `/goal ship it` without deliveryIntent; separately auto-send `/goal clear` with no active goal. Optional unsupported-driver variant treats /goal as ordinary text. | **recording**. Neither path calls stop normalization: U retains true and order `U,C1,V,G`; no goal-induced interrupt. Contrast with R13 using the actual command fields. Claude pause/resume error is existing behavior and can remain a test-only control. | H with appropriate fake driver/session; public queue-only dispatch possible in P. No real provider in H. | **M6 non-normalizing variants — MISSING**. |
| R15 — ordinary marked message promoted to steering | Yes: new flagged-input lifecycle interaction | Reach `U,C1,V` with U=true and steerable A; promote U. Use one native steering fixture; interrupt/restart fallback may share existing behavior tests (use owner P if completions are meant to survive the restart). | **recording**. U's queued run becomes cancelled and disappears from queue; its text delivered exactly once by the steering effect (or labelled restart fallback); no stale flagged queued run competes with C1. Remaining delivery order `C1,V`; terminal U status filters any retained historical marker out. Automatic target/missing-state errors remain controls. | **Labelled H capture**, fake ProviderReplayHarness session and worker drain; lifecycle layer with unused sessions cannot alone prove steer delivery. | **M7 ordinary promotion — MISSING**. |
| R16 — contract persistence and replay | Yes: optional persisted field | Save missing/false/true run variants. Reorder U ahead of C then rebuild projections; move U back and rebuild again. Replay same accepted command ID. | **recording**. Print event payload and reloaded projection: missing remains accepted, true survives serialization/rebuild and keeps `U,C`, false survives reverse operation and restores `C,U`. Replayed command yields replayed receipt/no duplicate updates. Contract optional boolean must not become required. Label in-memory rebuild honestly; do not call it a process restart. | **Labelled H capture** through real EventSink, contract JSON codecs and ProjectionMaintenance. No public API to inject field variants. | **M3/M8 persistence continuation — MISSING**. |
| R17 — hold/default resume versus selected send-now | Yes: changed helper's resume and promotion callers | Seed marked `U,C1,V`; inject queueHeld=true for all queued runs and terminal A in a controlled EventSink batch. Do not use run.interrupt(holdQueue=true): it disposes completion cohorts. Default queue.resume then separately fresh selected queued-run.start(V). Also run resumeQueuedRuns while held and after release. | **recording**. Held queue starts nothing and retains markers; default resume selects U; each later auto promotion respects delivery order. Explicit send-now selects V by ID and then resumes the remaining `U,C1` priority order; it is not required to choose U first. Capture exact events/IDs, not resume count alone. Existing usage-limit/archived/disabled-provider holds can remain controls, since their predicates did not change. | **Labelled H capture** for the injected held state preserving C. Public Stop does not produce this exact seed because it disposes C; P must use another valid held-state source. Auto provider starts need stub or credentials. | **M8 resume — MISSING**. |
| R18 — default queued-start failure attributes correct run | Yes: changed helper's error caller | Marked `U,C1,V`, no blocking run; inject missing rootNodeId on U (valid nullable contract field) and default-resume. Separate explicit selected-run variant can use V. | **recording**. Default start fails the priority-selected U with missing execution identity/queued_start_failed, rather than failing C1. Print failure run ID, remaining queue/status and absence of duplicate starts. For explicit selected-run failure, the named run remains failure target. Do not require timing-sensitive downstream failure cascades to settle without a deterministic barrier. | **Labelled H capture only** for corrupt/incomplete execution identity. Public RPC cannot inject it. No real provider needed: failure is before provider start. | **M8 failure variant — MISSING**. |
| R19 — agent queue list/read and paged order | Yes: changed helper's MCP caller | Reuse R01 five-item result `U,C1,C2,C3,V`; call real t3_queue list with limit2 and cursors 0/2/4; read U; issue reorder and one R09 error through handler. | **recording**. Pages concatenate exactly to delivery order; nextCursor is 2,4,null. Entries are `{queuedRunId,text,truncated}`; read resolves same U text; successful write gives sequence; forbidden move gives orchestration_error and explanatory text. A 1001-character U variant should show list truncated=true and read untruncated (read ceiling 16000); text-length behavior is a control, not a separate visual fixture. Completion entries must actually appear: client filtering is not applied to MCP. | H with **real MCP toolkit handler + invocation context** backed by orchestrator; P via authenticated MCP also valid. Plain helper output does not cover this row. | **M1 MCP recording integrated, or M9 — MISSING**. |
| R20 — same-owner Stop cancellation control | No: existing lifecycle rule constrains fixtures | A owns C1/C2 and currently reserved delivery C2; U is marked before them. Send a stopping goal into A, and separately test holdQueue=true. | **recording**. The currently reserved C2 delivery is cancelled by cohort disposal; older synthetic generations are not guaranteed to be cancelled by that one cohort operation. Print which IDs are cancelled, retained or held and do not assert the R12/R13/R17 full-order expectations on this seed. With one valid current delivery C, it is C that is cancelled; goal normalization still clears ordinary priority. | H with matching cohort metadata and fake session; P can observe real parent-owned deliveries. | **Control/seed constraint; share M5/M8 — NOT CAPTURED**. |
| R21 — web/desktop/mobile presentation | No changed render path | Any R01 queue seen through shared selector; C/N hidden; visible U/V use the existing positions/counts. | Source audit only. No screenshot or browser recording required. No theme/width/platform, empty/loading/error, text/attachment, collapsed-count or optimistic-row permutations are introduced. Existing client reorder/steer/edit/cancel/send controls remain. | Source trace [shared workflow][S6] → [web][S7]/[ChatView][S8], shared detail atoms → [mobile][S9]; desktop wraps web. No browser launched. | **EXCLUDED — source coverage complete**. |
| R22 — last completion removed, then an unchanged-position reorder | Yes: no-completion marker reset branch | Reach `U,C1,V` with U=true; cancel the current C1 delivery through queued-run.cancel so only U/V remain. Move U before V under a fresh command ID, then enqueue C2. | **recording**. Cancellation leaves U queued with its prior true marker; reorder at the same U q1 writes false despite unchanged position because lastCompletionIndex=-1. The next fresh completion C2 takes normal priority: list/promotions `C2,U,V`. This is distinct from R08's unmarked no-op: it must produce an update and succeed. | H through real cancellation/reorder commands, with matching current cohort ownership; P possible with a valid current completion. No provider needed in H. | **M3 marker-only variant — MISSING**. |

Minimum capture set and pass-2 acceptance

- **M1**: paired before/after primary script, with R01/R02 plus the R03 continuation, actual promotions, and real MCP boundary R19. R09 automatic-move protection can be recorded in the same script. Fresh independent branches/seeds prevent one failed baseline reorder from preventing later fixture setup. If a baseline cannot reach a new marked state via public commands, print that failed precondition; mark any injected state explicitly rather than claiming it was organically reachable.
- **M2**: reverse-operation recording R04/R05, sharing ordinary/no-op R08 controls. Fresh resets are allowed within one transcript.
- **M3**: legacy/equality recording R06/R07/R22, plus R16 persistence/rebuild. R06 needs a paired baseline; R07 demonstrates preserved behavior before/after. Comparator boundary subchecks are explicitly static harness captures.
- **M4**: a short error/control section R09/R10; it can live in M1/M2. No need for separate image/video files.
- **M5**: goal-promotion recording R11/R12, including actual controlled stop/no-stop outcomes and unchanged-q marker clears.
- **M6**: incoming-goal recording R13/R14 through the other caller.
- **M7**: ordinary promotion recording R15 using a fake provider session and observable delivery effect.
- **M8**: held/default/selected resume and deterministic start-failure recording R17/R18. R16's persisted flag check can also share this recording. Do not expand into a full provider error matrix.
- **M9** only if M1 does not run the real MCP handler: a separate R19 boundary recording. Do not label a simulation of queueEntry as actual tool output.

These are logical capture sections, not a demand for nine files or videos. A single reproducible harness driver can emit named sections in a before log and an after log, with focused fixtures. Every affected row R01–R07, R11–R19 and R22 must be traceable to observed output; controls R08–R10/R20 may be covered briefly or by existing focused test results, with limitations stated. No UI capture is required.

For the original regression, retain an assertion that fails on before for the original rejection and passes on head. Also retain a resilient transcript driver that logs the before rejection and continues through baseline promotions; a failing-test exit alone is not the runtime transcript. For states newly possible only on head (true markers/goal reset), baseline may be labelled `unreachable through original reorder`; still print the identical scripted command sequence and its observed outcomes. Never quietly prepatch the before implementation or fabricate before markers.

Provide the exact driver, revision SHAs, focused test commands and exits, raw logs and concise before/after interpretation. Capture setup must be synthetic and isolated. Rerun no repo-wide suites. A transcript must distinguish computed order, persisted state, actual server promotion to starting, stub provider delivery, and real provider execution. Only the first four are feasible/needed here. No live server, browser, or real turn was started by this auditor.

Source anchors (all pinned to the audited head)

[S1]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/orchestration-v2/Orchestrator.ts#L8310
[S2]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/orchestration-v2/QueuedRunOrder.ts#L3
[S3]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/packages/contracts/src/orchestrationV2.ts#L629
[S4]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/orchestration-v2/runtimeLayer.test.ts#L5222
[S5]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/mcp/toolkits/thread/handlers.ts#L253
[S6]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/packages/client-runtime/src/state/threadWorkflows.ts#L111
[S7]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/web/src/components/chat/QueuedRunsControl.tsx#L109
[S8]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/web/src/components/ChatView.tsx#L2854
[S9]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/mobile/src/features/threads/ThreadQueueControl.tsx#L63
[S10]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/mcp/toolkits/thread/tools.ts#L80
[S11]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1053
[S12]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/packages/client-runtime/src/operations/commands.ts#L1054
[S14]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/orchestration-v2/Orchestrator.ts#L10060
[S13]: https://github.com/pingdotgg/t3code/blob/39da8b24584ab2f453dd4835713d4b221e0df955/apps/server/src/orchestration-v2/ProjectionStore.ts#L2085

Coverage and limits: full pinned four-file diff; handler guards and event emission; every ordering-helper caller; goal dispatch/promotion and reset; contract payload persistence; real lifecycle/steering harness seeds; shared workflow and web/mobile queue entry points. Read-only `git diff --check` passed. No acceptance of old remote artifacts, no test execution, no runtime/browser capture, and no claim of a real process restart or real provider execution. This is a proof-specification pass, not a completed correctness or merge audit. The 60-minute budget was not exhausted. Files written only in the requested scratch directory. No long-lived processes started and none left running; no edits, pushes, or comments made. Disk available was 21 GB at both checks.

FRICTION:
- forge | GitCafe issue lookup for [#25646](https://github.com/pingdotgg/t3code/issues/25646) returned NOT_FOUND (request 03104ee181e452d17190fe8022a97e16); the PR-linked GitCafe [#25644](https://git.cafe/pingdotgg/t3code/issues/25644) supplied the original report instead | Use the known GitCafe mirror issue number in the capture brief.
- brief | The named MCP list/reorder tools are consolidated into t3_queue actions at the pinned revision; resolved by tracing the real toolkit | Specify pinned action names for the driver.

VERDICT: INSUFFICIENT R01, R02, R03, R04, R05, R06, R07, R11, R12, R13, R14, R15, R16, R17, R18, R19, R22