# Proof audit after cleanup revert

No blocking proof finding for [#23218](https://github.com/pingdotgg/t3code/pull/23218), addressing [#21219](https://git.cafe/pingdotgg/t3code/issues/21219). This is the requested narrow PROOF AUDIT, not a new full implementation review or live CI certification.

Reviewed head: [f9c17f6f97](https://github.com/pingdotgg/t3code/commit/f9c17f6f97480643c60af0463283374e969783e8). Base: [ed9b7ca9c5](https://github.com/pingdotgg/t3code/commit/ed9b7ca9c53843ea1e6b466bf7d52928d10e7db0). Read worktree AGENTS.md and pr-audit SKILL.md. Used /home/ubuntu/wt/issue-21219 read-only as explicitly requested; HEAD matched and git status was clean. No implementation edits, tests, servers, browsers, screenshots, uploads, polling, or forge writes.

## Tree and retained original proof

Independently compared Git objects: final head and [9054687df3](https://github.com/pingdotgg/t3code/commit/9054687df3666294018f30298c32cfe77aaa6fb3) have the identical whole-tree object 5b3476c45a9848297f523f15987f4ce5e334c6dd. Their diff is empty, including tests. The three production files also have an empty diff against the earlier runtime-tested implementation revision [597823c8ad](https://github.com/pingdotgg/t3code/commit/597823c8ad18a4870c39d834e907b5ef56476e4e). Reusing original runtime and green evidence is justified; a new runtime would repeat the same production behavior.

Inspected all four changed files against the specified base. The change preserves optional idle error in the prompt response, adds its optional nullable type, reuses the pre-existing failure mapper, and handles explicit error before generic prompt success settlement. It adds two registry regressions. No cleanup classification, parser, regex, authentication policy, permissions, credential handling, client rendering, or wire contract to clients changes.

Original red evidence (/tmp/issue21219-proof-red.txt) reports both new cases failing on baseline with completed versus failed, with the other 14 passing. This is a delegated reproduction summary, not raw runner output. Retained raw green outputs show 16 registry, 59 adapter, and 42 combined client/registry passes, consistent with 26 client tests and 101 distinct tests. /tmp/issue21219-proof-postmerge.txt independently records 101/101 across three files. These are retained outputs, not tests rerun by this audit.

Read local copies of the [before runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4115034ebe84ea8f/before-runtime.txt) and [fixed runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/12a15043042aa3f3/fixed-runtime.txt). They identify real acplause v0.202610.0, deliberately invalid nonsecret key, accepted v2 prompt, then idle/error with Missing Authentication header. Baseline records silent completed on fresh and handoff routes. Fixed records failed, one failure item, and running→failed durable transitions on both routes. The fixed transcript explicitly says retained raw provider logs are baseline traffic; fixed evidence comes from durable projections and the primary's integrated client observation. I did not independently repeat that client observation. The fresh route is described precisely as a fresh acplause thread resumed for the fixed pass.

The current regression cases check detailed message or nonempty omitted-details fallback, then complete a following successful prompt and count exactly one terminal for the failed turn through that boundary. They do not establish uniqueness for every arbitrary future unsolicited event. Existing success, cancellation, interruption/drain, following-agent-work and recovery controls support compatibility; no new reconnect guarantee is claimed. Null details share the same nullish fallback, and omitted stopReason retains end_turn behavior. Error without explicit error stopReason is deliberately outside scope.

## Revert and current test claims

/tmp/issue21219-focused-after.txt records two files, 31/31 passing. Current source has 16 registry cases and 15 integration fixtures. Historical /tmp/issue21219-final-registry-tests.txt has 17 cases and belongs to the reverted cleanup; it must not be presented as final-head proof.

The fixture logs retain 15/15 base and original-source runs and 13/15 cleanup-era results. The failures explicitly reject run.interrupt as not interruptible in stop_background_work_after_failed_turn and stop_background_work_after_release. The fixture assertion deliberately expects the failed turn's command on the Waiting strip before Stop, then interrupted afterward while the run remains failed. Together with final tree equality and the subsequent 31/31 run, this supports the revert restoring the supported command lifetime. A request to close all tools on failed finalize cannot be imposed as this fix's acceptance condition: the broad rule conflicts with existing supported stoppable commands. Any narrower policy for genuinely foreground tools needs its own supported classification and scope; no such change is required here.

/tmp/issue21219-shard7-after.txt records 52 passing files and one failing file, 470 passing tests and two failures out of 472. Both failures are RepositoryIdentityResolver expected SSH versus actual HTTPS remote URL assertions. Independently read global Git configuration: it rewrites git@github.com: and ssh://git@github.com/ to https://github.com/. This directly explains the observed values; the four-file PR does not touch repository identity. This is not a green shard and should not be described as one.

The revised body reports that RepositoryIdentityResolver passes 11/11 with GIT_CONFIG_GLOBAL=/dev/null. No separate saved raw output for that isolated rerun was found among the supplied artifacts. Therefore 11/11 is reported by the primary, not independently output-verified here. This minor evidence limit does not undermine the directly observed environment explanation or the ACP proof.

## Visual matrix and uncovered gaps

The revised body (/tmp/issue21219-body-after-revert.md), existing visual matrix (/tmp/issue21219-proof-matrix.txt), and actual final diff agree: zero changed render paths and zero required visual fixture rows. Existing clients display the changed shared-server outcome through unchanged rendering. No screenshots or new runtime required. Desktop/native mobile were not run; real success/cancel controls were not run with the invalid key. Their coverage is deterministic fixture evidence, as already disclosed. No live forge metadata/check state was refreshed under this read-only no-polling brief. The superseded /tmp/issue21219-final-proof.md was not used as current evidence.

## FRICTION

Evidence provenance | Historical 17-test output and cleanup-era audit can be mistaken for final proof | Anchor every claim to final tree equality and use focused-after plus shard7-after outputs.
Environment | Global SSH-to-HTTPS Git rewrite causes two unrelated shard failures | Disclose 470/472 and the rewrite separately; retain isolated-config rerun output for independently checking the reported 11/11.
Runtime provenance | Fixed raw provider logs do not contain fixed traffic | Attribute fixed observations to durable transitions and the primary integrated pass; do not claim a new raw-protocol capture.

VERDICT: SUFFICIENT