# Proof audit pass 1

Issue [#23702](https://git.cafe/pingdotgg/t3code/issues/23702). Complete diff audited: [ef92441313](https://git.cafe/pingdotgg/t3code/commit/ef92441313) → [29ce300674](https://git.cafe/pingdotgg/t3code/commit/29ce300674), two files, 109 insertions. Read-only audit; no servers, browser, tests, or forge writes performed.

## Classification and fixture matrix

**Rendering matrix: empty (0 rows).** Only `apps/server/src/orchestration-v2/ThreadPullRequestService.ts` and its test change. No web, desktop, mobile, contracts, rendering, layout, navigation, or UI entry-point changes. The production change reads the existing BackgroundPolicy and gates only the minute-based opportunistic sweep. Startup backfill and domain-event refreshes remain outside the gate. This shared server behavior applies to all clients and connection modes; screenshots add no proof.

## Exact server proof

- **Deterministic red/green:** the added `does not sweep branch pull requests while no client is connected` test runs the real service/worker with BackgroundPolicy false, an eligible branch fixture, and an event queue. Awaiting a refreshed lookup from `checkpoint.captured` proves headless event-driven discovery remains live. After draining that work, advancing TestClock ten minutes and draining must produce zero further lookups. Lead reports the same test fails with ten extra lookups on [1e1b2b9ea9](https://git.cafe/pingdotgg/t3code/commit/1e1b2b9ea9), then all six focused tests pass on the patched head. Source confirms the red commit lacks the sweep gate. Keep command, commit, test name, assertion diff/count, and green six-test summary in the proof transcript; execution results were supplied by the lead, not rerun by this auditor.
- **Real-app before:** [pre-fix transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8c69149e095c00ab/issue-23702-before.txt), also inspected at `/tmp/issue-23702-before.txt`, records isolated fixture/state, browser departure at 21:01:56 UTC and no sockets on server port 14162. Synchronize spans and successful `listPullRequestsByHead` calls continue at 21:03 and 21:04. This demonstrates actual headless periodic provider work. A global quota delta alone would be weaker because unrelated consumers can share that budget.
- **Real-app after (pending lead recording):** identify patched head, isolated state and same eligible branch fixture, enabled GitHub host and valid auth, server port, live process, trace source and exact UTC bounds. Record client disconnect/no server sockets and no user/domain-event work during the window. Starting from 21:09:42 UTC, observe at least through 21:14:42 UTC: five minutes covers the maximum 120-second lease TTL plus multiple one-minute sweep opportunities. Show no new periodic `ThreadPullRequestServiceV2.synchronize` / branch `listPullRequestsByHead` work after leases expire. Explicitly distinguish any already queued/in-flight work, startup backfill, and event-driven refresh; the patch does not promise zero provider traffic from every subsystem. Include trace counts/query and enough trace continuity or another server-alive marker that silence cannot mean the app stopped or logging failed.
- **Positive control:** retain evidence that discovery is functional with policy allowed (a connected foreground client generates discovery before disconnect, or resumes it after reconnect). The deterministic headless checkpoint lookup separately proves that the new gate does not suppress turn-completion discovery. No additional browser session is required for this audit; use the lead's existing recording/transcript.

## Verdict

Classification confirmed; no UI fixture rows or screenshots required. No proof-design defect found. Final proof acceptance remains pending the patched runtime transcript and recorded red/green outputs; the supplied review verdicts do not substitute for those artifacts. This fix establishes bounded idle discovery, not a new general quota/backoff policy, and deliberately permits startup backfill and event-triggered work.

FRICTION none.