# Proof audit pass 1

Reviewed branch `fix/issue-16900`, head [8ede7461b5](https://git.cafe/pingdotgg/t3code/commit/8ede7461b5a92f50a85ee1e3f143565293472b0c), against base [22840ab943](https://git.cafe/pingdotgg/t3code/commit/22840ab943b8418744b48223411e46ba4fdcef1a). Complete diff inspected: 2 files, 302 insertions, 1 deletion. Checkout matched requested head and was clean. No PR exists in this audit's scope.

## Scope and visual matrix

The changed paths are `apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts` and its `.test.ts`. Production changes format a native child's terminal result and offer a message-text continuation for a completed or failed direct child when no root turn is active on the parent provider thread and the originating parent was not terminalized unsuccessfully. Tests add late-child, nested-child, and active-root fixtures, and update the resumed-child expectation.

No web, desktop, mobile, client-runtime, contract, renderer, style, layout, or asset path changes. There is a user-visible behavioral outcome (the parent resumes and replies), but no actual rendering diff. The prescribed proof is a red test plus a runtime transcript. Screenshots add no required visual proof here.

Visual matrix: empty (zero fixtures).

| Changed render path | Visual fixture | Before/after image |
| --- | --- | --- |

The runtime transcript must still show the observable resumed conversation and persisted execution, rather than treating “server-only” as exemption from end-to-end proof. Web/desktop/mobile share this server behavior; no separate visual/client permutation is justified by this diff. Other providers and app-owned delegation are outside the changed native-Codex path. A local isolated runtime suffices; no new network/origin behavior calls for a relay/tunnel matrix.

## Fixture matrix derived from changed paths

| Fixture | Focused proof in source | Minimum real runtime transcript assertion | Pass-1 evidence |
| --- | --- | --- | --- |
| Native direct child completes after settled root | New late-child replay: zero offers before child completion, exactly one after, result marker, message_text delivery | Native spawn (not app-owned delegate_task); root finishes first; child finishes later; no user input/wait call; one automatic continuation consumes exact unique result and completes | Before failure available; final-head runtime pending |
| Foreground root remains active | Guard scans active root turns on same provider thread; first child completion in resumed-child fixture occurs within root | Child finishes while original root is still active; root receives result natively; no extra server wake/run after settling | Source/replay reasoning; runtime pending |
| Later active root on same thread | New second-root replay asserts no continuation for old child's late result | Finish root 1, begin root 2, complete root-1 child during root 2; result available to root 2; no competing or queued redundant wake | New replay present; runtime pending |
| Nested native child | New grandchild replay: no root wake at grandchild completion; one at direct child completion | Root settled; grandchild completes while direct child remains running; root run count unchanged; direct child later completes and causes root continuation containing direct-child result | New replay present; runtime pending |
| Child resumes / result preservation | Updated existing resume fixture requires one wake with CODEX_RESUME_DONE; preserves result through empty final | Resume a native child after initial completion; its later result wakes settled root once and carries correct nonempty result, without replaying old result | Focused fixture present; runtime pending |
| Cancelled/interrupted or failed parent | New guard checks terminalizedNonCompletedNativeTurns; existing interrupt fixtures exercise child terminalization | Stop parent while native child exists; demonstrate late completion cannot resurrect cancelled/failed parent; record final child state and unchanged root run count | Relevant existing fixtures, but not an explicit new late-completion/no-wake assertion in changed tests; runtime pending |
| Failed or interrupted child | New offer condition includes failed and excludes interrupted | For genuinely failed direct child after completed root, parent receives one failure wake without fabricated success. For interrupted/cancelled child, no completion wake | Branch visible in production; changed tests do not directly demonstrate both branches; runtime pending |
| Recovery after stop | New wake suppression and retained contexts affect lifecycle boundary | After cancellation case, send explicit fresh user turn; it completes normally. If a child is resumed, only eligible current completion is delivered; cancelled work does not spontaneously restart | Runtime pending |

Runtime cases can share one capture, but each needs explicit ordering and assertions. Foreground and later-active-root cases are distinct. Do not substitute the nested case for either. Failed-parent and failed-child cases should use genuine supported failure events; a shell command returning nonzero is not necessarily a failed provider turn. If a failure cannot be induced, label that coverage focused-test-only rather than claim runtime coverage.

## Minimum transcript contents

Record exact checkout SHA, provider CLI version/model/options, OS, isolated T3 home identifier (no secrets), and capture method. For each case include root/native-child IDs and parent relationships, unique markers, initial prompt, pertinent native spawn/completion events, persisted root run start/end/status, child terminal status/time, continuation message origin/text and resulting parent answer. Show root end < child end < automatic continuation start for the principal reproduction. Establish that no user message or manual wait caused that continuation. Show the child completion event and post-processing observation boundary for no-wake cases; an unexplained short delay or run count sampled before processing is insufficient. Include enough event/run data to detect duplicate wakes after delivery and settling.

This is runtime evidence through real Codex and T3 continuation delivery, not another replay harness. No browser capture is required from this auditor; the primary is capturing final runtime separately. Avoid credentials, pairing URLs, private unrelated conversations, and customer data in public evidence.

## Evidence classification

- [Existing before runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/454ea3b43e7070c5/runtime-before.txt) was fetched and read. It identifies base, Codex 0.163.0, model, Linux, real isolated web runtime, and persisted timings. Root 1 ended 20:32:07.489Z; native child completed 20:33:14Z; no automatic run followed. Manual user recovery later consumed NATIVE_CHILD_16900_DONE. Two further children also completed without automatic continuation. This supports the original failure, not final-head success or all guard cases.
- User reports red [98d149dbae](https://git.cafe/pingdotgg/t3code/commit/98d149dbae149f96137922277e96299d86007a65): continuation length expected 1, actual 0. Commit inspected and contains the focused regression test; red execution output was not supplied or independently rerun here.
- User reports three review regressions failed on prior [07a6e34897](https://git.cafe/pingdotgg/t3code/commit/07a6e3489786ff8f3c23b6aeb04cf844ade415c4), and 103 tests now pass. Treat these as reported focused-test results; exact commands/output and head association should accompany final proof. No tests were run in this read-only proof audit.
- The new tests observe adapter continuation offers, not a real provider consuming the server message and answering. Existing ProviderContinuationService code maps message_text to server-created message.dispatch and queue_after_active, with a focused service test for that mapping. This explains the intended integration but does not replace runtime proof.

## FRICTION

Final-head runtime evidence is still being captured by the primary and was not available to this pass. Red and green execution logs are reported, not attached. Cancellation/failure and resumed-child coverage must be labeled precisely: existing lifecycle tests and an aggregate passing count do not establish real late-result delivery or suppression. No visible diff justifies requesting screenshots or expanding this into browser verification. No source edits, servers, browsers, pushes, comments, or forge mutations were performed; only the requested temporary report and ghdrop upload were created. Own temporary report is removed after successful upload.

## VERDICT INSUFFICIENT

The proof method is sufficient in design: red regression test plus real runtime transcript, with an empty visual matrix. The supplied evidence is insufficient to certify final-head behavior now. Attach the final-head runtime assertions above and exact red/green test output; reassess against those artifacts. This is a proof-completeness verdict, not a claim that a code defect was found or a merge-readiness approval.