Proof audit pass 1 — [#26983](https://git.cafe/pingdotgg/t3code/pull/26983)

Reviewed before [37fbefd](https://github.com/pingdotgg/t3code/commit/37fbefd147197fab9d88f9c120560c3f21b52cfc) (merge-base and origin/main) and after [45c1162](https://github.com/pingdotgg/t3code/commit/45c1162b91872e5e7a7ddd7843b24364caca0f4d). Both local refs and the PR API agreed. Read-only inspection; no capture, source edit, test run, push, or comment was performed for this pass.

Findings

1. The old after transcript is not proof of the requested head. Capture BOTH sides again on the exact revisions above, using the same driver and independently fresh, identically seeded databases. This pass judges the completeness and feasibility of this matrix, not the sufficiency of existing evidence or merge readiness.
2. Counting threads is the wrong oracle. The service groups by projectId, worktreePath, and branch, then calls branchPullRequest once per group initially. A shared-checkout child can contribute zero additional calls even on main. Rows R03 and R04 isolate that case by settling the parent AFTER startup, before the next minute sweep.
3. A discovered PR that needs persistence causes a second branchPullRequest call with freshGitState:true. Separate this validation call from the first discovery call; do not describe every group as exactly one total call in all states. Cache hits can still be branchPullRequest calls without git subprocesses.
4. Startup backfill is unconditional after activation. Only the minute sweep checks shouldRunOpportunisticWork. A connected socket alone is insufficient: a foreground, unexpired activity lease and an unconstrained host are required. Headless child events still refresh.
5. The predicate checks the direct relationshipToParent only. Local app-owned delegates and native projected children use subagent; forks, including forks of children, remain eligible. Linked-environment delegation launches an ordinary destination thread and is outside the exclusion. Native children may have no runs, so a provider-native completion must not be assumed to emit the child's run.updated or checkpoint.captured event.
6. No matrix blocker was found. The public flows cover the changed predicate and its important observable consequences. Internal races, impossible field combinations, and deterministic fault/status injections are explicitly labelled harness observations below; they cannot substitute for real-server core evidence.

Source basis

- [synchronize and all changed collection consumers](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/ThreadPullRequestService.ts#L120): snapshot selection; startup pendingBackfill; membership eviction; archived/settled/branch guards; grouping; repository/cwd lookup; sync/update and error paths.
- [every caller and event selector](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/ThreadPullRequestService.ts#L354): one serial drainable worker; thread.created, thread.unarchived, thread.metadata-updated use refresh:false; thread.unsettled and checkpoint.captured use refresh:true; run.updated uses refresh:true only for completed, failed, cancelled, interrupted. Other events/statuses do nothing. start schedules unconditional backfill, then policy-gated minute sweeps.
- [server startup registration](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/server.ts#L548), [active/deleted/settled snapshot SQL](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/ProjectionStore.ts#L5918), [foreground activity policy](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/background/BackgroundPolicy.ts#L191).
- [local delegate child creation](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/Orchestrator.ts#L7260), [shared child constructor](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/packages/provider-core/src/server/subagentProjection.ts#L45), [native Codex projection](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.ts#L2800), [fork lineage](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/ThreadForkService.ts#L80), [remote delegates are ordinary destination threads](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/peer/RemoteDelegation.ts#L63).
- [lookup call and options](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/git/GitManager.ts#L2628), [cache durations](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/git/GitManager.ts#L166), [five-minute git-state cache](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/git/GitManager.ts#L2375).
- [new regression test](https://github.com/pingdotgg/t3code/blob/45c1162b91872e5e7a7ddd7843b24364caca0f4d/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts#L182) covers startup + one minute + a child's checkpoint event using mocks. It does not establish runtime coverage of forks, shared grouping, native creation, archived states, or settled backfill.

Capture contract

Viewport, theme, width, platform rendering, and screenshots do not apply. Every required capture is a RECORDING in the sense of an ordered runtime transcript: raw log/trace excerpts plus per-request lookup and git subprocess counts. A single aggregate number or a database still is insufficient for time/event-dependent rows.

Before means 37fbefd147197fab9d88f9c120560c3f21b52cfc; after means 45c1162b91872e5e7a7ddd7843b24364caca0f4d. Log actual running source SHA, source cleanliness/instrumentation, server PID, explicit isolated home and database, server activation/restart, driver hash, fixture manifest, normalized thread lineage/branch/worktree/settled/archive/reference fields, and activity policy at each boundary. Each side starts from a fresh empty database, seeds through the same app/RPC/MCP driver, then restarts to exercise startup with the seeded records. Do not reuse the before database as the after database. Use a new timestamped run directory; never erase earlier runs.

Use authenticated orchestration.dispatchCommand for public thread.create, thread.metadata.update, thread.settle, thread.unsettle, thread.archive, thread.unarchive, thread.delete and thread.fork flows. Seed actual local delegate children through delegate_task from an active parent provider session, both default shared checkout and isolation:worktree. Await branch/worktree preparation and child completion before measurement. Seed a native child with a genuine provider spawn, and record its stored subagent origin and lineage. A public thread.create cannot set lineage; do not fake one with that RPC. Observe full thread snapshots/event records rather than relying on sidebar shells, which may omit hidden children. Persisted sync evidence may be read from isolated state read-only. Do not post to, mutate, or seed the developer's live database or forge.

A scripted WebSocket client may report server.reportClientActivity with visible/focused activity and refresh its lease during connected phases (default TTL 45 seconds). No browser is needed. Capture policy state; stop activity reports and disconnect for the headless phase. A real app client is also usable only with the lead's separate browser authorization. No transport/client/provider permutation is needed beyond proving one native child and one app-owned child: the filter consumes their shared stored lineage, and does not inspect provider, client, transport, title, model, or task status.

Count completed branchPullRequest service spans beneath each ThreadPullRequestServiceV2.synchronize span using trace/parent ancestry, not timestamp overlap (groups run concurrently). The implementation's span is named branchPullRequest; inner lookupBranchPullRequest spans are not separate service calls. Count initial discovery and persistence revalidation separately when identifiable, and always retain the total. Include descendant git process executions, exit status, cwd/branch attribution when available, cache phase and errors. Exclude seed-time event refreshes, provider git activity and unrelated broadcasters from sweep totals. If existing telemetry lacks a discriminator, isolate the fixture/window or add a disclosed observation-only observer outside the checkout; never infer a child's exclusion from a zero delta in a shared group. Preserve raw evidence and counter source, redact authentication/pairing secrets, and upload them with the transcript. Do not fix an expected number such as the old 42 git commands: warm cache can legitimately give zero subprocesses. Cold/expired cache counts must be measured and compared for the same fixture on both sides.

In the table, counts are isolated fixture contributions, not a whole server's totals unless stated. Standard rows use a recognized repository and existing local branch with no matching PR, null saved PR references, existing worktree paths, active non-archived state and no events in the measured sweep. This yields one initial call per group and no persistence revalidation. A, B, C, D, E and F name minimum transcript bundles; all require before AND after. READY means seedable and specified, NOT captured or passed. HARNESS means explicitly injected/replayed/internal-state evidence, not a normal product capture. Rows S16–S19 inventory unchanged branches; they are not additional minimum acceptance captures for this filter.

| ID / named fixture | Data and path | Diff effect | Minimum bundle / mode | How to seed | What the transcript must show, before → after | Pass-1 status |
|---|---|---|---|---|---|---|
| R01 empty and branchless | Empty active snapshot; then root and subagent with branch:null, no automatic PR | Child filtered earlier; observable no-op preserved | A / recording | Start empty; create branchless root; genuine child inherits branchless checkout; no worktree isolation | Zero calls at empty startup/minute; zero calls for branchless records on either side. These must not explain away zeros in positive fixtures | READY |
| R02 root + fork + multiple worktree delegates | One active root group P, one active fork group F, three local delegated worktree groups W1–W3; distinct project/worktree/branch tuples, no matching PR | W1–W3 removed from sweeps; P and F preserved | A / recording: seeded startup, two eligible minute sweeps, one sweep after git-state expiry | Active parent delegates three minimal tasks with isolation:worktree; fork a completed run via thread.fork and set a distinct branch/worktree through metadata RPC. Wait for checkout preparation; restart seeded app; maintain activity | Exactly 5 → 2 initial calls per sweep, branch attribution P,F,W1,W2,W3 → P,F; all sweep options refresh:false. Measure git counts at cold, warm and >5-minute git-state expiry; child-only worktree git discovery disappears after. No CPU/disconnect claim follows from this small fixture alone | READY |
| R03 shared local delegate | P and one app-owned child C have identical tuple; all other fixture records isolated or archived | Child disappears despite grouping masking its cost | B / recording | Default delegate_task without isolation inherits P's checkout/branch. First observe sweep with both active; then thread.settle P AFTER startup while C remains active; do not restart during isolation phase | Both active: 1 → 1 group call. After parent settlement: next minute 1 → 0. Snapshot proves P settled, C active and relationship:subagent. No child sweep sync after fix. Startup would backfill a settled parent missing a saved PR, so restart is excluded from this phase | READY |
| R04 shared provider-native child | Same tuple as P; subagent origin:provider_native, direct subagent lineage | Same exclusion as app-owned child, independent of origin | B / recording, separate native variant | Ask a supported provider to spawn a minimal native child; verify projected app child and branch/worktree inheritance; repeat R03 parent-settlement phase | Both active 1 → 1; parent settled after startup 1 → 0. Include actual native spawn and stored child lineage/origin. Native parent lifecycle status alone is not evidence of a child-specific refresh | READY |
| R05 direct fork relationship and remote scope boundary | Fork of a child has relationship:fork even though an ancestor is subagent; linked-environment delegated destination is an ordinary thread | Direct fork/root retained; ancestor/task labels do not exclude | A / recording for fork; destination mapping code-audited, separate remote run optional | Fork a completed child run via public thread.fork; give fork its own tuple for observable counting. A remote delegate destination would be seeded via target.environmentId on two isolated environments, not the user's live machines | Fork contributes 1 → 1 startup/minute even with subagent ancestor. Remote destination has null relationship and remains sweep eligible (1 → 1 if captured); no requirement that a local hidden child exists for remote delegation | READY; remote runtime optional |
| R06 startup settled, missing automatic PR | Settled root, settled fork, settled local child, distinct branches; branchPullRequest null/absent. Settlement means settledOverride: settled OR settledAt non-null | Child excluded before pendingBackfill insertion; root/fork backfill retained | C / recording | Settle real fixture records via thread.settle, then restart. Public settlement sets both fields; the two independent field-only variants are labelled projection harness seeds | Startup initial calls 3 → 2, with root/fork branch attribution only after fix. No-match success finishes their pending backfill; following minute excludes all settled records, 0 → 0. Child must not return on later sweep. Record fields, not just idle run status | READY; field-only subvariants HARNESS |
| R07 settled, saved automatic PR | Root/fork/child settled with non-null branchPullRequest; no pending retry | Observable skip preserved; child filtered earlier | C / recording | Let an existing repository PR be discovered on each fixture before settling; use automatic branchPullRequest, not only linkedPullRequest; restart | Zero calls for these records at startup and minutes on both sides. Saved references remain. This distinguishes missing automatic reference backfill from explicit PR links | READY |
| R08 settled failed backfill and exhaustion | Settled root and child with missing automatic PR, distinct groups, deterministic lookup failure; attempt budget 5 | Child never admitted to pendingBackfill after fix | F / recording, disclosed fault-injected real-server harness | Same public creation/settlement then restart; scratch-only git executable wrapper fails one selected discovery subprocess type on every attempt in each matching cwd, identically on both revisions. Also recovery variant: remove fault before exhaustion. No source/credential edits | Startup plus four eligible minute retries: root 5 → 5 attempted service calls; child 5 → 0; sixth eligible sweep gives no further settled retry. Recovery success (including null detection) ends retries sooner. Log errors and partial git attempts; zero after must coexist with root failures as positive control. Do not claim direct visibility into pendingBackfill without instrumentation | HARNESS, capturable; minimum backfill failure discriminator |
| R09 archived and unarchived | Archived root and child, with branch; active location and archivedAt guards; deletion negative control | Archived observable no-op preserved; restored child still excluded from sweep | C + D / recording | Archive through RPC, restart, measure; unarchive each through RPC; delete a separate fixture and observe absence | Archived startup/minute: 0 → 0. Unarchive emits a targeted refresh:false request and 1 → 1 no-PR call for each restored eligible record, including child. Next minute root 1 → 1, child 1 → 0. Deleted record contributes zero and its failed/missing lookup cannot be called a child refresh | READY |
| R10 child refresh:false selectors | thread.created, thread.metadata-updated, thread.unarchived; child active with branch | Per-thread bypass preserved | D / recording | Use real delegation creation; title metadata change (or branch/worktree update), plus R09 unarchive. Creation before worktree preparation can be branchless; use shared branched child for created selector or label a synthetic isolated selector harness | Each observed eligible child event enqueues its own targeted request; no-PR call 1 → 1, refresh:false. Separate metadata and preparation refreshes from initial branchless child creation. Subsequent minute still skips child only after fix | READY; isolated created timing variant HARNESS if needed |
| R11 child refresh:true selectors | checkpoint.captured and thread.unsettled; targeted reads bypass settled guard | Per-thread bypass preserved, even for settled child | D / recording | Complete a genuine child turn to capture checkpoint; settle then unsettle child via RPC. Also issue title metadata update while child remains settled to exercise targeted settled read without unsetting it | Checkpoint and unsettle each produce a child targeted no-PR call 1 → 1 with refresh:true. Metadata while settled produces 1 → 1 refresh:false. Count actual event-to-request correlation; checkpoint + terminal run can cause TWO requests and must not be reported as one per turn | READY |
| R12 terminal run selectors and ignored statuses/events | run.updated status completed/failed/cancelled/interrupted vs preparing/queued/starting/running/waiting/rolled_back; non-selector events such as thread.settled/thread.archived | Per-thread behavior preserved; only listed statuses enqueue | D / recording: real completed; remaining selector equivalence via labelled event harness or deterministic provider | Complete a child normally; cancellation/interruption via app controls where reliably reachable. Force failure only in a labelled fixture provider; replay other domain event/status selectors through the real service harness, not public dispatch of a fabricated event | Each listed terminal event causes 1 → 1 refresh:true request when child eligible. Unlisted statuses and ignored events cause no request. Archive/settle may affect next sweep but do not themselves trigger refresh. Underlying events from an action must be enumerated, not assumed absent | READY for completed; other selectors HARNESS unless naturally captured |
| R13 no foreground activity / constrained policy | Seeded root and hidden worktree child, then no live activity lease; later child targeted event | Startup exclusion applies headless; minute policy gate unchanged | E / recording | Start seeded app without foreground report; record policy false; observe scheduled minute window. Trigger child metadata event through scripted RPC without reporting foreground activity, or finish child run | Startup root+child 2 → 1 despite policy false. Minute policy checks occur but no synchronize request/lookups, 0 → 0. Child event still yields 1 → 1 targeted lookup. Briefly reconnecting a socket alone must not silently set policy true | READY |
| R14 actual PR discovery / sync revalidation | Existing open PR matching project repository, automatic reference initially null; root and distinct child groups; later saved reference already equal | Sweeps stop child discovery/persistence; own refresh still resolves and persists | A or C + D / recording | Use existing PR on an authorized repository. Seed local fixture project with no remote so no auto link can resolve; stop isolated server; configure that fixture repo's origin to the existing PR repository, fetch that existing head, and set its local branch/upstream appropriately; restart. This changes only fixture repo config, creates no forge PR | Changed root reference: initial + freshGitState validation = 2 → 2 total calls and persisted automatic reference. Child sweep: 2 → 0. The subsequent real child metadata/checkpoint request is 1 → 2 total calls: before already saved the reference; after must detect, validate and store it now. Later, once references are equal on both sides, root sweep is one call with no sync and each child own refresh is one call. Log repository match and persisted result, not only lookup counts | READY |
| R15 PR opened/visible after child turn | Child turn ended, no further child events; PR becomes discoverable externally; root or fork control eligible | Deliberate semantic boundary: no sweep-only discovery on hidden child until own event | D / recording; may reuse R14 origin transition | Finish child while fixture repo has no usable remote, then stop/configure fixture remote to existing PR/restart, with no child trigger in between; R14 is the startup equivalent. A real externally opened PR can exercise minute-only variant if separately authorized | Before a child event: control discovers PR; before child sweep may discover/update, after zero child calls/sync. Then child metadata/checkpoint discovers or retains the reference on before and discovers/stores it on after; account for the additional validation call only on the side that still needs persistence. Do not claim child PR freshness between its events, or assume native provider completion necessarily supplies one | READY; minute-only external PR variant optional |
| S16 guards and cwd fallbacks | Project missing; repository selector absent; PR from different canonical repository; worktree exists/missing/null; branch null with stale automatic ref; null/undefined saved PR | Children bypass all these on sweep; root/fork and targeted paths unchanged | Supplemental recording / harness where state cannot be public-seeded | Public metadata can set a nonexistent worktree path (no deletion needed); scratch repo can have no remote. Race-only missing project or stale branch:null reference after an event are harness fixtures | Missing project or unresolvable repository with branch yields zero calls; missing worktree falls back to project root (one discovery group); mismatched detected PR causes no sync. branch:null gives no git call and may clear stale auto ref; empty unchanged refs give no update. Targeted children retain these rules. No host/provider or path-width matrix is required | CODE-AUDITED; optional harness |
| S17 summary/replacement data branches | Existing auto ref with worktree:null vs non-null; no detection; previous summary same/different head and open/closed/merged. Explicit pullRequests length zero/nonzero; linkedPullRequest null/present, equal/different detected open PR; linked prior open/closed/merged | Child sweep now skips existing summary/update work too; all other request types retain it | Supplemental recording / harness | Preexisting refs via real discovery/link RPC where practical; race-prone stale ref/legacy zero-length combinations via labelled projection/service harness | Preserve prior automatic ref only for root checkout, same branch and closed/merged summary. Replace legacy explicit linked ref only when zero explicit links, new detected open/different ref and prior closed/merged. Equal refs with no replacement cause no sync. Summary failures log warning and fail only relevant backfill. No new UI/theme fixture results | CODE-AUDITED; optional harness |
| S18 validation, commit races, errors | PR changed/deleted during second lookup; repository identity changed; project deleted or root changed before dispatch; dispatch rejection; per-thread/group/snapshot error; interruption | Unchanged retained/targeted paths; child sweep avoids this work | Supplemental HARNESS recording | Deterministic Deferred-controlled service harness using original implementation; public API cannot safely position every race. A real server network fixture can demonstrate representative failures if labelled | Failed consistency/project guard must not persist stale refs; failBackfill decrements relevant pending entries, success/no-change deletes them; per-thread/group failures log and allow other work; outer snapshot failure logs refresh failure; interruption is not swallowed. Group concurrency stays 32, worker remains serial | CODE-AUDITED; optional harness |
| S19 pending membership and settled snapshot breadth | Pending ID loses branch, disappears/deleted, or becomes subagent; backfill:true vs ordinary sweep with/without pending map | Filtered visible IDs remove subagent pending entries; child no longer causes broad settled snapshots | Supplemental HARNESS recording | Pending map is private; no public command reparents a thread into subagent. Use service harness with changing snapshots; public metadata branch:null and delete cover two attainable cases | Snapshot opts: startup unsettledOnly:false; normal minute true without pending, false while retained pending exists. Missing/branchless/filtered-subagent IDs are evicted before processing; no renewed child retry. Settled records with existing refs stay excluded even when another record broadens the snapshot | CODE-AUDITED; optional harness |

Minimum capture set

There is no viewport × theme multiplication. Record each of A–F on both pinned revisions. Several rows share one recording; separate timestamped phases, not separate screenshots, are the unit of evidence.

- A: empty/branchless setup, then seeded composite startup, connected minute sweeps and >5-minute cold-cache recurrence; include root, fork-of-child and three worktree delegates. A distinct group for the fork is necessary to prove it is swept.
- B: shared local delegate and shared native child variants, each alone with its parent; active-parent sweep then parent-settled-after-startup sweep. Their equal first counts must not be presented as evidence that the child was excluded.
- C: settled missing refs, settled saved refs and archived fixtures at startup, plus successful backfill completion. Seed distinct tuples and report per-branch attribution; archive/unarchive child behavior continues in D.
- D: child-specific events: observed created, metadata, unarchive, unsettle, completed run and checkpoint; preserve known-PR persistence and the intentional lack of sweep-only child discovery. The other terminal status selectors may be one labelled harness equivalence transcript, not four costly provider runs. Record that it is harness coverage.
- E: seeded startup with policy false, minute gate observation, and headless child-specific refresh.
- F: labelled real-server fault fixture for five settled backfill attempts and recovery. Root positive control makes the child's zero meaningful. Harness coverage is supplemental to, and cannot replace, A–E real-app captures.

Independent field-only settlement states and S16–S19 need no additional minimum runtime captures for this one-predicate change. They are listed so future claims do not silently extend beyond measured behavior. They can be proven with the existing service harness if code review raises a concrete concern. A future pass may mark a required row PASS only from the corresponding exact-head evidence; none is PASS in this pass.

Expected scope limits: this matrix does not establish performance at hundreds of threads, CPU utilization, fewer client disconnects, or universal provider-native completion refresh. Those claims require their own measurements/events. It does establish a capturable plan for sweep exclusion, preserved forks/root work, settled/backfill behavior and retained child per-thread refresh.

FRICTION: none