# Proof audit PASS1 — issue16524

Scope: immutable local head `46d7a11a45`, base `a46f80ee28`, branch `fix/issue-16524`, checkout `/home/ubuntu/wt/issue-16524`. Full 44-file diff read, including tests and fixture-only dependency updates. This is an evidence plan, not an AFTER pass or code-review approval. No app, browser, server, test, or repository mutation performed by this auditor. Matrix written outside the checkout.

## Evidence contract

Every UI row below requires BEFORE and AFTER evidence at **1440-wide light, 1440-wide dark, 390-wide light, 390-wide dark**. Use a fixed documented height (suggest 900 desktop, 844 narrow), same fixture and framing on both revisions. This is four viewport/theme cases per UI row per applicable surface; 390 web does not substitute for native mobile. Desktop means the Electron client, not a desktop browser. Native mobile requires a real native client on an iOS simulator/device, with equivalent light/dark narrow captures; retain the requested 1440-wide capture requirement as an explicit unfulfilled prerequisite if the native client cannot run at that width. Do not silently substitute tablet/web evidence for native phone evidence.

All rows involving interaction, loading, delayed enrichment, query invalidation, navigation, provider turns, branch changes, or resume require **recording**, beginning before the trigger and continuing through the observable settled outcome. Also extract a settled still in each viewport/theme case. Pure static states can use stills. A screenshot of a result alone does not prove a transition. Combine multiple actions in one recording where legible, but index timestamps to each row and state. Record exact head, client build, environment, project root, checkout root, provider/model, fixture branch, viewport, theme, expected outcome, actual outcome, and artifact URLs. Redact tokens, pairing links, credentials, and personal data. Upload scripts/logs/evidence with ghdrop; do not commit fixture code or PR assets.

Server-only rows require a runtime transcript showing inputs and authoritative results, plus a focused **red test at base / green test at head** for the claimed behavior. A test name or test source alone is not a red-test result. Capture deterministic milestones (committed event/effect drain/provider completion); no sleep-based success assertions. Do not label unsatisfied prerequisites as passed.

## Fixture recipe for capture agent (suggestion, not executed)

Reuse the lead's synthetic `/tmp/issue-16524-repro` repository and project rooted at its `ios` directory. Preserve its existing BEFORE data. Create synthetic committed sentinel files with distinct contents in root `README.md`, `ios/README.md`, `ios/docs/setup.md`, root `docs/setup.md`, and sibling `shared/file.ts`. Include a filename with spaces and a text file with known line numbers. Put distinct test skills under `ios/.agents/skills/ios-release/SKILL.md` and `ios/.claude/skills/ios-release/SKILL.md`; a root-only sentinel skill distinguishes accidental root discovery. Verify each provider's supported skill convention rather than assuming both paths are consumed by every provider. Commit fixtures before creating a worktree so skills are present there. Keep all material synthetic.

Use real app New worktree creation and real persisted turns; request provider `pwd`, read sentinels, and invoke the chosen skill to leave an observable result. Have the agent return Markdown links to `docs/setup.md:line`, `../shared/file.ts:line`, a basename-only file, an absolute checkout file, and a local image/media asset. Seed a legacy persisted relative mention through an older real client/base run rather than manually fabricating only a rendered component. Add controlled fixture branches where `ios` is a directory, absent, and a regular file; branch operations apply only to the disposable fixture checkout. Include a root project and a no-worktree subdirectory thread as compact controls.

For realistic existing data, the lead may run `vp run migrate-dev-db` only with its isolated dev server stopped, then add synthetic fixture projects/threads via supported app/service paths. Never run against or write to `~/.t3/userdata`; do not migrate while the existing lead session is running. Prefer adding synthetic records through the current isolated app over rebuilding the lead's active state. Any seed helper lives under `/tmp`, is uploaded, and records supported APIs used. No direct event-store fabrication without stating it as a limitation.

## Collapsed fixture matrix

W = web; D = desktop Electron (shared web code, separate client proof); M = native mobile; S = server/runtime. `R+still x4` means recording plus settled still across the four viewport/theme combinations above. All AFTER cells are currently UNVERIFIED.

| ID | Meaningful affected states and observable assertion | Surface / environment requirement | Minimum evidence / present status | Diff basis |
|---|---|---|---|---|
| U1 | Project `repo/ios` → New worktree → first real turn: provider `pwd` is `wt/ios`; `$ios-release` appears and is usable; root-only skill is distinguishable; stored worktreePath stays `wt`. Show draft before creation and thread after delivery. | W,D,M; isolated environment with worktree capability and authenticated Codex; Claude variant exercises its distinct skill discovery. M must include NewTaskDraftScreen and routed thread, not only an existing thread. | R+still x4 per surface; authoritative launch transcript joined to U1. Lead supplies BEFORE W only; no AFTER. | RuntimePolicy; project enrichment; web ChatView/Composer; mobile draft/route/detail/composer |
| U2 | Same project with no worktree stays `repo/ios`; repository-root project with worktree stays `wt`. Skills and picker match those cwd values. Compact negative controls prevent an unconditional `/ios` fix. | W,D,M; two synthetic control threads; same local environment/provider. | R+still x4; combine control transitions in one indexed recording. Unverified. | threadAgentCwd; both useThreadAgentCwd hooks; composer consumers |
| U3 | Existing worktree's `ios` directory → branch with missing `ios` → restored directory → branch with regular file named `ios`: cwd/skills/picker use `wt/ios`, then `wt`, then `wt/ios`, then `wt`. Show mounted UI updating after branch change and after completed run changes checkout; no stale directory cache. | W,D,M; disposable fixture branches; filesystem-read grant; mounted thread throughout; both branch-change and completed-run refresh triggers. | R+still x4; record transient/settled state and actual provider cwd each transition. Unverified. | both cwd hooks; fileMetadata invalidation; RuntimePolicy stat fallback |
| U4 | `@` picker searches agent cwd, selects `ios/docs/setup.md`, draft chip opens that file, send, persisted user chip opens same sentinel after reload. A root `docs/setup.md` collision must not win. | W,D,M; nested thread with both sentinel files; native composer route and feed handlers required. | R+still x4; show contents/line after draft click and persisted-chip click. Unverified. | ChatComposer; UserMessageContextChips; mobile command menu/ThreadComposer/ThreadFeed; shared path helpers |
| U5 | Checkout tree context-menu mention and drag-to-composer mention select nested `ios` file and root/sibling file; draft/persisted chips open the intended file. Repeat from tree embedded in file preview and host-folder tree. Host-folder mentions retain host absolute path. | W,D only; full file panel and preview explorer; host filesystem permission and disposable host folder. Native has no changed tree producer in this diff. | R+still x4; each producer needs timestamped action; preview explorer and host-folder can share recording. Unverified. | FileBrowserPanel mentionPath/drag controller; RightPanelSurfaceContent; FilePreviewPanel |
| U6 | Legacy saved relative `ios/docs/setup.md` and root `README.md` mentions remain checkout-relative after upgrade; new absolute nested mentions still resolve after reload/thread switch. Show distinct root and nested file contents. | W,D,M; base-created real persisted relative mention plus head-created absolute mention. | R+still x4; reload and return to thread in recording. Unverified. | shared rebase helper; web user chips/composer; mobile mention-specific handler |
| U7 | Agent reply relative `docs/setup.md` opens `wt/ios/docs/setup.md`; `../shared/file.ts` opens checkout sibling; line anchor honored; basename fallback stays based on agent cwd; absolute file link still works. Escape outside checkout on mobile must retain its documented rejection behavior for relative links. | W,D,M; synthetic reply from actual turn or documented supported fixture API; collision sentinels and known lines. | R+still x4; record every distinct resolution class and target contents; one recording may cover all. Unverified. | ChatMarkdown openAt; mobile resolveNestedFileLinkPath/ThreadFeed; shared rebase helper |
| U8 | Local image/file/media reply under `ios` renders/opens correctly and file navigation lands on intended checkout file; existing attachment/asset survives reload and thread switch. No root/nested collision or stale previous-thread preview. | W,D,M; small synthetic image and file/media supported by each client; assets served by isolated environment. | R+still x4; navigation/media interaction requires recording; static rendered image still alone insufficient. Unverified. | web Markdown media onOpenFile + changed markdown cwd; mobile feed workspaceRoot/image source; file panel root context |
| U9 | Same live nested thread switches supported model in place with cwd unchanged; switch provider and continue in `wt/ios`; stop/reopen historical Claude session created at old worktree-root cwd and continue with correct cwd/history behavior. Show no stranded turn and actual `pwd`. | W,D,M launch entry points; authenticated installed Codex/Claude with models that advertise required transition support; historical Claude native session from base. | R+still x4; pair with S4 transcript; old-Claude resume cannot be certified with a newly fabricated head-only session. Unverified. | ProviderSwitchService resolved target cwd; RuntimePolicy; existing transition/resume path impacted indirectly |
| U10 | Whole-checkout Git/diff/checkpoint behavior: one real turn edits `ios` and `shared`; UI diff shows both, checkpoint restore/rewind restores both; attachment/asset root remains checkout root. Include normal completion and one alternate lifecycle path (e.g. queued follow-up or restart) using same fixture. | W,D,M for visible diff/restore paths supported by client; S authoritative checkpoint scopes; disposable worktree, permissions to edit/restore. | R+still x4; record action through settled restore; pair with S5. Unverified. | six Orchestrator checkpoint-scope cwd precedence sites; unchanged stored worktreePath; file panel root |
| S1 | Repository root enrichment for clone `.git` directory and linked-worktree `.git` file, no remote, identity lookup failure, and non-repository project. Initial WS snapshot, delayed enrichment refresh, HTTP shell response and ProjectService shell agree. | S; disposable repositories; controllable identity resolver failure; authenticated HTTP/WS scopes. | Runtime transcript + focused base-red/head-green tests. Existing tests cover no remote/identity failure only; no run verified. | repositoryRoot; ProjectEnrichmentService; ProjectService; http; ws; contracts |
| S2 | Client retains repositoryRoot through unenriched project delta; explicit refresh changes/clears it; workspace-root move does not retain old enrichment; older server omitting optional field yields legacy root behavior. Reconnect does not retain stale directory metadata. | S/client-runtime; deterministic shell event/snapshot fixture; old-schema payload; no browser required. | Runtime/event transcript + base-red/head-green behavior tests. Existing shellReducer/fileMetadata test source is not execution evidence. | shellReducer; optional contract field; fileMetadata tests |
| S3 | Runtime cwd resolution directory/missing/file and stat-error fallback; missing project with worktree retains root fallback; no-worktree missing project reports resolve error. POSIX and Windows helper paths, same-root/outside-root/no-known-root controls. | S; filesystem/path service fixture; Windows-shaped helper inputs do not prove native Windows execution. All providers receive common resolved policy; no need to multiply UI rows by six providers. | Runtime policy transcript + base-red/head-green tests; note which error/Windows cases remain unit-only. | RuntimePolicy; shared threadAgentCwd/path; provider replay/Grok dependency fixtures |
| S4 | Provider/model transition receives actual resolved target cwd: same-cwd live supported switch stays in session; provider change and old root-cwd session are planned consistently and resume completes without lost history. Verify failure-to-resolve policy fallback explicitly. | S; real provider sessions for runtime proof, controlled registry for red test; adapters Codex/Claude mandatory for requested behaviors; Cursor/Grok/OpenCode/Antigravity common-policy decision documented, runtime coverage only if available. | Runtime transition/session IDs and cwd transcript + base-red/head-green focused test. New switch test only covers one same-instance model case. | ProviderSwitchService; runtimeLayer injection; replay harness dependency |
| S5 | Checkpoint scope stores `wt` on affected initial/restart/queued/retry/continuation lifecycle paths; real checkpoint capture and restore include both nested and sibling edits. `worktreePath`, Git, and asset resolution remain checkout-root based. | S; real disposable Git checkout; effect worker drain/persisted milestones; supported lifecycle commands. | Runtime event/outbox/scope + actual Git/file restore transcript; focused base-red/head-green test. Current new test checks first scope cwd, cancels provider start, and does not prove actual capture/restore or all six sites. | Orchestrator six scope sites; runtimeLayer new scope test |

## Existing BEFORE supplied by lead

Only W New worktree Codex reproduction is claimed by the lead: synthetic project `/tmp/issue-16524-repro/ios`, cwd incorrectly at checkout root and `$ios` omitted. This auditor did not inspect or recapture these artifacts. They do not cover all viewport/theme/surface rows.

- [BEFORE screenshot](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0ad4e05dbd11ba4/browser-screenshot-localhost-mvmd8d7a-bb269251.png)
- [BEFORE recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ef9e6a23b5169321/mcp-launch-client-3af0bd65b4-1580-4c7d-a80f-264a7193468f-fwd-3a9347d9e336075a3a2-0d704395-7a0b-4bc7-947b-f73af3357165-mp4.mp4)

## Unverified prerequisites and FRICTION

1. No AFTER capture or runtime test was run in this read-only audit. All matrix expectations remain unverified. Existing lead dev session `73500`, web port `6346`, server port `14386`, isolated `.t3`, was not operated. Capture agent must confirm build/head and fixture ownership before use.
2. Desktop Electron and native iOS/Android availability, authentication, build freshness, permissions, pairing, and native 1440 capture support are unverified. Four responsive web captures cannot certify desktop or mobile. Native platform coverage must name iOS and Android separately; if only one is available, report the other as unverified rather than multiplying every row mechanically.
3. The user references an EVIDENCE standard but supplied no additional document beyond the explicit 1440/390 light/dark and recording/static requirements. This matrix applies those requirements literally; any further lead-owned naming/height/retention convention needs reconciliation before capture.
4. BEFORE evidence outside U1 must still be collected on base, including a real historical Claude session. This may require a separate isolated base environment; do not reset or operate the lead checkout/session to obtain it.
5. Provider subscriptions, supported live-switch models, Claude historical session storage, and other adapter availability are unverified. `pwd` output plus native session identity/history is needed; a UI label or mocked policy is insufficient.
6. Fixtures need real branch variants and colliding sentinel paths. Missing-directory and regular-file branches are different stat outcomes but one collapsed fallback row. Branch restoration is essential to prove cache invalidation in both directions.
7. Full visual cross product is expensive: ten collapsed UI rows, four capture cases, applicable W/D/M surfaces, before/after, plus recordings. Reuse indexed recordings and representative settled frames where one flow proves several rows; do not claim unavailable cases. Narrow layout may require opening file surfaces as overlays rather than side-by-side, and native tree producers are N/A.
8. New tests do not establish red/green execution. RuntimePolicy covers directory/missing/file; enrichment covers identity failure/no remote; switch covers one same-instance model; checkpoint test checks scope only. Actual resume, all scope lifecycle sites, asset integrity, host tree, and real restore need runtime evidence or explicit gaps.
9. Filesystem-read-denied/offline/older-server states cannot authoritatively stat the nested candidate in the new hooks. Mark their UI fallback behavior as unverified if encountered; they are environment qualifications, not a new product-wide matrix expansion.
10. No fixture scripts were created. If capture seeding needs a helper, keep it outside the worktree and upload the exact script with evidence; never publish environment secrets or live user records.

Coverage accounting: all 44 changed files map to U1–U10/S1–S5. Fixture-only changes in transferBudgetV2, GrokAdapterV2, DelegatedCompletionDelivery, ProjectSettingsUpgrade and ProviderReplayHarness update dependency/enrichment wiring; they create no separate visible product state. New/changed helper tests support S2/S3/U4/U6/U7. There is no changed command-palette/keybinding-specific producer in this diff requiring a separate row; any shared New worktree entry point should reuse U1's asserted outcome.