# Proof audit, pass 1

Audited [#32331](https://git.cafe/pingdotgg/t3code/pull/32331), head [c2b6687333](https://github.com/pingdotgg/t3code/commit/c2b66873331d2ff68c0dd7767de08315465ae461), against merge-base [e5b0718a8a](https://github.com/pingdotgg/t3code/commit/e5b0718a8a297823920d1bf3a7d5cbacd57263ea). Read-only: no repository edits, pushes, reviews, or comments.

## Findings

The existing proof is incomplete: R2, R3, R4, R7, R9, R10, and R11 are missing. No existing evidence was contradicted by this audit.

- The persistent-defect test proves eventual failure and a parent wake, but not the boundary of exactly three consecutive defects. After observing the first retry it releases every subsequent retry automatically; a threshold of two or four would also satisfy its assertions.
- No test interleaves defects with a successful nonterminal follow attempt or an ordinary failure. Both new reset operations could be removed without the three defect tests detecting that regression.
- Recording give-up after a defect is covered. An ordinary failure while recording is not injected. Shutdown while retrying either the follow or the give-up recorder is also not exercised with an explicit follower exit and unchanged task assertion. Existing scope/restart tests provide baseline shutdown coverage only.
- The assertion that every new execution of `follow` starts its count afresh has no targeted same-task re-entry fixture.

The PR's current Verification section lists three defect tests and a short before/after test transcript. The before transcript is historical evidence, not rerun here: doing so by replacing source would violate this audit's read-only scope. Its after transcript refers to an older revision. The requested command was rerun against the exact audited head and confirmed all 31 tests pass:

```text
cwd: /home/user/wt/pr-32331/apps/server
$ vp test run src/peer/RemoteDelegation.test.ts
 RUN  v5.0.5 /home/user/wt/pr-32331/apps/server
 Test Files  1 passed (1)
      Tests  31 passed (31)
   Start at  16:38:59
   Duration  31.47s (tests 53%, transform 23%, import 23%, setup 1%)
```

Full local transcript: `/tmp/lead-32331-r1/audit-1/test-transcript.txt`.

## Scope, paths, and evidence policy

Only `apps/server/src/peer/RemoteDelegation.ts` and its test change relative to the stated merge-base. There are no components or render paths, layout variants, themes, viewport widths, or platform-specific branches. These fixtures apply to the shared server behavior used by all clients and providers through linked environments.

`follow` has one direct caller, `followOne`. That wrapper is reached from: (1) new remote delegation, (2) the startup scan of open remote tasks, and (3) the `subagent.updated` event listener for an owed remote stop. Its `again` flag can execute `follow` again for the same task. The public delegation entry is `OrchestratorMcpService.delegateTask`; server startup calls `RemoteDelegation.start`. Cancellation and parent Stop affect the state the same follower reads; they do not supply separate retry implementations.

The minimum evidence is a focused server test plus a short transcript of that test passing, with assertions tied to committed task events, continuation offers, retry queues, or fiber completion. Every row below depends on a sequence or lifecycle interaction, so its evidence kind is **recording**: a textual runtime transcript is appropriate for this server-only change. No video or browser capture is required.

For **every row**, test + transcript suffices. No separate dev-server/RPC or two-machine run is needed: the existing harness runs the actual parent orchestrator with in-memory SQLite, real peer forwarding and OAuth/MCP HTTP, and a controlled remote thread. The existing `beforeFollow`, `beforeRead`, `steppedRetries`, Deferred, Ref, and stored-event helpers can inject these otherwise nondeterministic faults and synchronize without sleeps. A normal two-machine run is feasible for ordinary delegation, but reliably injecting these server defects through public RPC alone is not; it would require instrumentation and add no necessary proof here.

## Fixture matrix

All test names below refer to `apps/server/src/peer/RemoteDelegation.test.ts`. `D` means an injected defect; `F` an ordinary typed failure; `S(false)` a successful follow attempt that reports unfinished work. Missing fixture recipes describe work for the implementation owner, not changes made in this audit.

| Row / fixture and required data | Diff affected? | Minimum recording evidence / how to produce | Existing PR-body evidence and audit status |
| --- | --- | --- | --- |
| **R1 — transient defect recovers.** Open remote task; sequence `D`, then remote run completes successfully. | Yes: defect conversion and retry. | Test + transcript. Existing `a follower that hits a defect retries instead of dropping the task`; observe retry queue before releasing it, then await committed completed result. | **COVERED.** Named in Verification; before failure and after pass recorded. Current 31-test run passes. |
| **R2 — exactly three consecutive defects give up.** Open remote task; `D,D,D`; no fourth follow attempt; task becomes failed and parent gets a continuation offer. | Yes: threshold, terminal recording, wake. | Test + transcript. Extend `a follower that keeps hitting defects fails the task and wakes the parent`: count attempts; step two retries; observe give-up at the third defect; assert exactly three follow attempts along with its existing persisted failure, remote thread identity, and parent wake assertions. Read source to confirm the explanatory result text; no copy-text test is required. | **MISSING boundary proof.** Existing test covers eventual failure, remote thread identity, and wake, but drains retries forever and never asserts the attempt count. It passes with other thresholds. |
| **R3 — success resets the defect streak.** Open task; `D,D,S(false),D,D`, then successful completion. Task must not give up after the first defect following success. | Yes: `Effect.tap(noDefect)` at line 532. | Test + transcript. Extend harness sequencing in `beforeFollow`; use a real nonterminal remote wait response or ended-here/settlement transition to return false, then inject later defects. Gate each milestone by Deferred/Queue and await final persisted success. No current test produces this sequence. | **MISSING.** Existing transient test ends on its first success, so cannot detect a missing reset. |
| **R4 — ordinary failure resets the defect streak.** Open task; `D,D,F,D,D`, then success. Use a retryable typed error rather than a final link/thread refusal. | Yes: `Effect.tapError(() => noDefect)` at line 545. | Test + transcript. Sequence `beforeRead` with an ordinary orchestrator error or make peer forwarding fail ordinarily between injected defects; step retries and assert the task stays open until the final successful result. No current mixed sequence exists. | **MISSING.** Offline-peer tests contain no preceding defects and cannot detect a missing reset. |
| **R5 — giving up preserves an existing result and owed stop.** Completed task with result `All green.`, `stoppedThere:false`, `stopCount:1`; repeated defects while trying to deliver Stop. | Yes: give-up result guard. | Test + transcript. Existing `a follower that keeps hitting defects leaves a stop it owes owed`; await follower end versus an event increasing the stop count; inspect persisted result, status, and original owed stop. | **COVERED.** Verification names this test, its intermediate regression failure, and the suite pass. Current run passes. |
| **R6 — give-up recording retries a defect.** Open task reaches give-up; its first recorder read dies once, then succeeds. | Yes: nested `failOnDefect` and retry. | Test + transcript. Existing persistent-defect test passes `defects.beforeRead`, which injects exactly this defect only after follow attempts have begun failing; await committed failure and parent offer. | **COVERED.** Verification explicitly describes the recording defect injection; current run passes. |
| **R7 — give-up recording retries an ordinary failure.** Open task reaches give-up; first recorder read or complete dispatch returns a typed persistence/orchestrator failure; next succeeds. | Yes: nested ordinary-error retry. | Test + transcript. Parameterize the recording injection alongside R6 to return an ordinary error through `beforeRead`, or a dispatch failure, and await the same committed failure and parent wake after releasing the retry. Existing hook supports typed errors. | **MISSING.** R6 injects only `Effect.die`; no test injects an ordinary failure in this recorder. |
| **R8 — shutdown during a normal remote wait ends the follower.** Open task has no result; service scope closes before remote completion; a fresh service later follows the same task. | Wrapper changed; baseline lifecycle behavior retained. | Test + transcript. Existing `follows an open task again after the laptop restarts` closes the first service scope while work is running and then completes through the new service. | **COVERED baseline.** Included in the PR's 31-test suite transcript and confirmed at the audited head. This does not prove R9 or R10. |
| **R9 — shutdown during follow retry ends without give-up.** Open task has hit a defect and is paused in `steppedRetries`; close its service scope. | Yes: defect conversion/retry/catch boundary. | Test + transcript. Capture follower via `Effect.withFiber`, await first retry queue offer, close only its service scope, await the captured fiber, then read persisted task through a surviving database/service. Assert no failure result or parent wake was invented. No sleeps. | **MISSING.** Existing shutdown/restart tests do not first pause a defecting follower in its retry schedule or assert this terminal distinction. |
| **R10 — shutdown during give-up-recording retry ends the recorder.** Third defect reaches give-up; recorder injection fails; nested retry is paused; service scope closes. | Yes: nested defect conversion and retry. | Test + transcript. Use `beforeRead` to signal the recorder fault and capture its fiber; wait for its retry offer, close service scope, await fiber exit, inspect still-unrecorded task through surviving state. This specifically checks interruption cannot be converted into another recorder retry. | **MISSING.** Persistent-defect test lets the recorder recover; it never interrupts this nested retry. |
| **R11 — a new execution of follow starts a fresh streak.** Same task and service; one follow execution accumulates defects and ends; a later owed-Stop event/startup rescan invokes follow again. | Yes: `Effect.suspend` scopes the counter; `followOne` can repeat it. | Test + transcript. Extend the owed-stop fixture: after its first follower ends, trigger a later parent Stop and capture the new follower; step its first two defects and assert it is still retrying before its own third defect. The existing start listener, Stop command, and hooks can drive this without calling private functions. | **MISSING.** PR states the reset occurs on each run, but tests do not distinguish a new same-task streak from a retained count. |
| **R12 — ordinary transport failures still retry; final refusals still fail normally.** No defects. Retryable unreachable peer recovers; revoked/forgotten link or gone thread instead records final failure. | Existing branches remain inside the changed wrapper. | Test + transcript. Existing `a parent stopped while the box is unreachable still stops its task there`, `fails the task when the box revokes the link, and cancel interrupts it there`, and `fails the task when its thread there is gone, or the link here is`. | **COVERED regression baseline.** All are included in the PR suite transcript and pass in the current run. Default schedule remains unbounded by inspection; no timing/video test is needed. |

The give-up guard also returns when no remote child remains. That is a trivial defensive no-op, not a new user flow: source inspection of the guard at line 559 is sufficient; a synthetic projection mutation would not add useful proof. `followOnce` already exits for the same absent-child shape. Likewise the error-message formatting and unchanged retry delay constants do not justify additional tests.

No separate fixture per client, provider model, theme, or transport origin is necessary: the changed code has no such branch. New delegation, restart, and the owed-stop event entry paths are represented in R1, R8, and R5 respectively.

FRICTION: none

VERDICT: INSUFFICIENT R2, R3, R4, R7, R9, R10, R11