# Issue 17484 — proof audit pass 1

Scope: read-only review of `/home/ubuntu/wt/issue-17484`, branch `fix/issue-17484`, complete base-to-head diff. Base `70e5e384da`; regression `a67624fdfe`; head `f750ae4cf45468145341ef3050c1a5c7b09960d4`. No PR. No tests executed in this audit; no browsers, dev servers, repository edits, or public comments.

## UI fixture matrix: empty

The complete diff contains only `apps/server/src/project/AgentSessionScanner.ts` and `AgentSessionScanner.test.ts`. There are no changed render paths, components, styles, client conditionals, UI interactions, contracts, or navigation. Existing import results become correct because the server stops rejecting individually valid transcripts after a shared record allowance is depleted. This is a backend behavior fix with an existing visible result, not a changed visible surface. No screenshot or recording is required for this diff. The supplied screenshot is optional context, not proof of aggregate import correctness. No responsive/theme/client visual permutations are justified.

## Changed paths and callers

- `readTranscript` (scanner lines 817–900): removes caller-provided `recordLimit`; each read now rejects only when its local count exceeds `MAX_IMPORT_RECORDS = 100_000`. Removes `recordCount` from returned snapshot. The local counter remains. Both Claude and Codex pass through this same reader.
- `prepareRecentThreads` (1315–1455): removes scan-wide `recordsRemaining`, its zero-budget early skip, its second skip conditional, the shrinking allowance argument to `readTranscript`, and the post-success decrement. Keeps newest-first processing, completed-source recognition, duplicate handling, byte and transcript budgets, workspace identity, and file identity checks.
- Public `recentThreads` delegates to `prepareRecentThreads`; `AgentSessionImporter.importRecentAgentThreads` consumes its outcomes. `Skipped` increases skippedCount; `Importable` persists an imported thread; `AlreadyImported` contributes to importedCount. This explains why retrying can hide the old first-import failure.
- Existing transport: `ws.ts` agentSessionsImport -> importer. Existing web command: `apps/web/src/state/agentSessions.ts` -> `WelcomeWizard.tsx`. Desktop shares web. No client code changed; no independent mobile render proof is required. Discovery (`scan`) is unchanged.
- New test at scanner test line 1262 creates four distinct Codex transcripts for one workspace in deterministic recency order: 20,000 + 20,000 + 20,000 + 58,000 = 118,000 records. All four ordered session IDs must be Importable. The fixture includes metadata and a visible prompt per transcript, with filler records.

## Collapsed backend proof fixtures (not a UI matrix)

1. Aggregate-valid first import: four transcripts above, each below 100,000; combined above 100,000; below existing byte/transcript limits. Affected: shrinking record allowance and shared exhaustion branches. Capture: targeted failing/passing test output plus real-app runtime text transcript and read-only persisted-thread inspection. Expected before: three Importable plus one Skipped; first app import reports 3 imported/1 skipped. Expected after: four distinct Importable outcomes; fresh app first import reports importedCount=4, skippedCount=0 and persists all four session IDs/prompts. One fixture covers ordering, the partial remaining budget, and first-import behavior; separate screenshots add no proof.
2. Individual cap retained: exact 100,000 records accepted; excessive transcript rejected; following older valid transcript still accepted. Affected: reader comparison changed to fixed constant. Capture: focused streaming-reader boundary tests, especially `skips excessive records without blocking an older valid transcript`, and `handles the exact record limit and an interior blank overflow=%s`. The latter exercises the standalone parser, so it alone does NOT prove the changed streaming-reader cap. Exact-cap streaming coverage is desirable if absent; minimum cap preservation requires the existing recentThreads excessive-file test to pass, plus source inspection of the fixed >100,000 guard. No app capture is needed for the cap.

Claude/Codex do not need duplicate runtime recordings: the changed allowance is provider-neutral and both use the same reader. Codex reproduces the reported failure. No new support is introduced for Cursor, Grok, OpenCode, or Antigravity. Shared limits still bound the scan to 100 attempted transcripts and 4 GiB aggregate bytes; per-file limit remains 100,000 records and 4 GiB. Selected-history retention remains 32 MiB. This intentionally removes the aggregate record budget; total record work can increase within the remaining limits. Do not claim aggregate 100,000-record protection remains.

## Minimum acceptance evidence and current status

- RED: run the newly committed regression at test-only commit `a67624fdfe` (or against base implementation without editing this checkout) and retain output identifying the failing fourth outcome. Source inspection predicts failure but is not an executed red result.
- GREEN: same focused test at `f750ae4cf4` yields all four IDs. Run the relevant existing streaming excessive-record test and standalone exact/overflow boundary cases. No repo-wide tests/typecheck are needed for this proof audit.
- Runtime BEFORE is supplied and was read: [runtime-before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/be68c8b00484b94f/issue-17484-runtime-before.txt). It records base commit, real web app, four discovered conversations, initial import 3 with one skipped, persisted sessions 1–3, and retry importing all four. This establishes the fourth transcript is independently valid.
- Runtime AFTER is still needed: same four-file fixture on fixed head, fresh isolated app state with no completed imports, same project and provider home. Record discovered=4, first import=4/skipped=0, and read-only persistence of all four unique sessions including the 58,000-record transcript. Record head and fixture counts in the transcript. Do not reuse the before database after retry: AlreadyImported can make the old code report four too.
- Optional retry after the successful fresh import may confirm idempotence; it cannot substitute for the fresh first import.
- Existing screenshot: [before screenshot](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fa2bd6ef2f01147a/browser-screenshot-localhost-mvipl8iy-399931ed.png). Not inspected in this no-browser audit and not needed for acceptance.

Verdict: source-derived proof scope is backend-only; UI matrix empty. Not proof-complete until red/green outputs, cap-test outputs, and fixed-head fresh-first-import transcript are attached. No implementation correctness finding from the inspected diff; this is a proof-scope assessment, not a full code review.

FRICTION
- Evidence URL could not be read by the web tool; direct read-only curl succeeded.
- No red/green execution logs or fixed-head runtime transcript were supplied; this audit intentionally did not run tests or start an app.
- No PR exists; nothing was created, linked, or commented on.

END — proof audit pass 1