# Proof audit pass 1 — fixture matrix for [#22947](https://git.cafe/pingdotgg/t3code/pulls/22947)

Head: [995209445b](https://git.cafe/pingdotgg/t3code/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7); merge-base: [680152e27b](https://git.cafe/pingdotgg/t3code/commit/680152e27b2a961686389ca69a1557cbb2c55f08). Read-only source audit in `/home/ubuntu/wt/pr-22947-after`. No runtime claims: every execution cell below is **PENDING**.

## Execution contract

Each B row is a behavioral fixture; each R row is a render fixture. Execute **each applicable B × R pairing** at all four cells: 1440×900 light, 1440×900 dark, 390×844 light, 390×844 dark. This factorization is the complete matrix, not permission to sample only one surface or theme. R rows specify the state that makes that renderer applicable; settled-only R rows pair with completion/interrupt transitions, and setup-only R rows require the setup seed. Web and Electron share render code but require separate client passes. Native iOS/Android are separate clients; requested dimensions are logical viewport targets, not a claim that responsive web proves native behavior. Record actual native bounds; report unsupported exact sizing as friction.

Seed all rows in a disposable copied checkout/server state outside the audited worktree. With that dev server stopped, run `vp run migrate-dev-db` there to copy a read-only live snapshot into its own `.t3`; create a synthetic project/thread and discard copied pending work. Never run against or mutate live `~/.t3/userdata`. Start its server with normal single-origin dev configuration. Use real UI plus typed service/MCP dispatch to create the states described below. Use a controllable provider fixture through the real server transport for exact steering/restart/failure timing; record adapter and command evidence. Do not seed only React props or edit browser clocks/DOM. Rare historical ordering fixtures may use an isolated event-sourced driver, clearly labeled; they do not replace UI interaction proofs.

For every take retain run IDs, requestedAt, startedAt, workStartedAt, completedAt, delivery mode, sender/child relation, and persisted terminal/start milestones. Wait for persisted events/effect-worker drain, not arbitrary sleeps. A uses an obvious >10s work interval; place a clearly different gap before B when reset vs inheritance is at issue. Record continuously across trigger, boundary and at least two subsequent ticks; for minute-only list formatting also record its next visible minute boundary or correlate with simultaneously visible second-resolution header plus persisted anchor. Compare before/after revisions with the same seed where the bug should reproduce.

**I+T = interaction plus time recording required. T = time recording required. Stills INSUFFICIENT for every row below.** Supplemental stills can assess typography/theme only. P = pending, not passed.

## Behavioral fixtures

| ID | Caller / branch | How the real app is seeded and exercised | Required observable result | Proof | 1440×900 L | 1440×900 D | 390×844 L | 390×844 D |
|---|---|---|---|---|---|---|---|---|
| B01 | Fresh user turn, new provider thread | Create isolated project/thread; send a user prompt with start_immediately; hold provider running. | No workStartedAt; requestedAt before start then own startedAt; tick upward. | I+T; stills INSUFFICIENT | P | P | P | P |
| B02 | Fresh user turn, existing provider session | Complete A; wait a visibly distinct gap; send ordinary user B in same thread. | Fresh B clock, never A; exercises immediate reused-session caller at 5782. | I+T; stills INSUFFICIENT | P | P | P | P |
| B03 | Immediate new-provider path | Complete A; switch provider or fork with portable handoff, then dispatch B; retain command/projection trace. | Fresh B for user; exercises second immediate caller at 6469. | I+T; stills INSUFFICIENT | P | P | P | P |
| B04 | Native steer, user | Start A for >10s; send user steer_active while provider accepts native steering. | Same run and anchor across steer; no reset. | I+T; stills INSUFFICIENT | P | P | P | P |
| B05 | Native steer, agent continuation | Start A; separate coordinator sends MCP message with steer_active; keep A running. | Same run and anchor; agent input does not reset elapsed time. | I+T; stills INSUFFICIENT | P | P | P | P |
| B06 | Restart fallback steer | Start A with adapter requiring restart or force restart_active; steer; let replacement attempt run. | Same run spread retains clock across new attempt, no flash to zero. | I+T; stills INSUFFICIENT | P | P | P | P |
| B07 | Queue promotion → native steer | Start A; queue user B; promote B with queued-message.promote-to-steer. | Queued B consumed into A; same clock; no duplicate queued run. | I+T; stills INSUFFICIENT | P | P | P | P |
| B08 | Queue promotion → restart fallback | As B07 with restart-only adapter; promote B. | Same run/clock across restart; queued message removed once. | I+T; stills INSUFFICIENT | P | P | P | P |
| B09 | Late steer race | Complete provider A but delay projection/steer boundary; submit steer that falls back to new turn. | Fresh user run if steer is too late; no inherited clock merely from intended steer. | I+T; stills INSUFFICIENT | P | P | P | P |
| B10 | Automatic queued unrelated agent | A running; unrelated coordinator sends createdBy=agent, creationSource=mcp, senderThreadId set, queue_after_active; finish A. | B inherits A effective anchor when terminal event automatically drains queue. | I+T; stills INSUFFICIENT | P | P | P | P |
| B11 | Automatic queued app-owned child | Create real app-owned child C of A; C sends ordinary queued MCP update to A; finish A. | B inherits A; child relation not required for automatic queue. | I+T; stills INSUFFICIENT | P | P | P | P |
| B12 | Automatic queued user follow-up | A running; user queues B; finish A. | B resets, even though started automatically; queue wait is not work time. | I+T; stills INSUFFICIENT | P | P | P | P |
| B13 | Immediate unrelated agent after completion | Complete A; unrelated coordinator sends ordinary start_immediately B. | B resets; agent identity alone is insufficient. | I+T; stills INSUFFICIENT | P | P | P | P |
| B14 | Immediate historical app-owned child | Create C as app-owned child, finish A/C; C sends ordinary immediate MCP B to parent after a gap. | B inherits A despite historical completed child; gap is included by current rule. | I+T; stills INSUFFICIENT | P | P | P | P |
| B15 | Idle queue agent | Complete A; unrelated agent queues B while idle (queue_after_active). | Explicit/no-endedRunId queue start resets B. | I+T; stills INSUFFICIENT | P | P | P | P |
| B16 | Held queue resume, unrelated agent | Queue agent B behind A; stop A so queue is held; wait distinct gap; use queue.resume. | Fresh B; excludes A and pause. | I+T; stills INSUFFICIENT | P | P | P | P |
| B17 | Held queue Send now, unrelated agent | Same held setup as B16; use queued-run.start for B. | Fresh B; distinct explicit-start caller. | I+T; stills INSUFFICIENT | P | P | P | P |
| B18 | Held queue resume, historical child | Create child C; queue C ordinary message; stop A and hold; resume queue after gap. | Fresh B even though C is registered app-owned. | I+T; stills INSUFFICIENT | P | P | P | P |
| B19 | Held queue Send now, historical child | Same as B18; start selected queued run. | Fresh B; child match must not override explicit queue. | I+T; stills INSUFFICIENT | P | P | P | P |
| B20 | Explicit unheld queued selection | Leave queued ordinary agent B behind nonblocking stopped work; start B explicitly with queued-run.start, not terminal-event drain. | Fresh B with no endedRunId; verify actual command path in trace. | I+T; stills INSUFFICIENT | P | P | P | P |
| B21 | Notification wake, immediate and queued | Generate real notification delivery; execute immediate, automatic queue, and held explicit resume as separate takes. | Notification exemption inherits previous effective anchor in all three delivery modes; do not apply ordinary-message reset expectation. | I+T; stills INSUFFICIENT | P | P | P | P |
| B22 | Delegated completion, immediate and queued | Use app-owned delegation; finish child while parent idle / busy / queue held; accept delivery when needed. | delegatedCompletion exemption retains effective anchor in immediate, automatic and explicit modes. | I+T; stills INSUFFICIENT | P | P | P | P |
| B23 | Interrupted → restart continuation | Start A; interrupt; after gap invoke actual resume/recovery path producing restartContinuationOfRunId. | Explicit continuation marker inherits prior effective anchor; distinguish from fresh prompt or held ordinary queue. | I+T; stills INSUFFICIENT | P | P | P | P |
| B24 | Interrupted → ordinary follow-up | Stop A; send new user prompt without restartContinuationOfRunId. | Fresh clock; stopped A duration remains frozen. | I+T; stills INSUFFICIENT | P | P | P | P |
| B25 | Completed original and continuation | Use B10/B14 then finish B with tools and final reply; expand/collapse settled folds. | Live timer disappears; Worked/Continued durations stay fixed. Settled folds use run/segment boundaries, not automatically workStartedAt. | I+T; stills INSUFFICIENT | P | P | P | P |
| B26 | Reconnect while inherited work runs | Reach running B via B10; disconnect only client transport, keep server/provider running; reconnect then hard reload. | Rehydrated runtime retains inherited anchor and elapsed offline time; no reset to connection time. | I+T; stills INSUFFICIENT | P | P | P | P |
| B27 | Reconnect while fresh work runs | Reach B via B02; disconnect/reconnect and reload while B runs. | Fresh B anchor survives; no stale A clock or duplicate timer. | I+T; stills INSUFFICIENT | P | P | P | P |
| B28 | Multiple chained agent wakes | A → automatic agent B → automatic agent C, all live provider turns. | Recursive effective anchor survives multiple workStartedAt hops. | I+T; stills INSUFFICIENT | P | P | P | P |
| B29 | Queued prompt ahead of agent update | A runs; queue fresh user B then agent C; finish A then B. | B starts fresh; C inherits latest started B, not stale A or queue-enqueue time. | I+T; stills INSUFFICIENT | P | P | P | P |
| B30 | Delegated priority overtakes queue | A runs; queue user B; deliver delegated completion C that jumps queue; let next run start. | Anchor chosen at actual start; retain trace of run order; fresh B still resets. | I+T; stills INSUFFICIENT | P | P | P | P |
| B31 | No previously started run | New thread with notification / delegated completion / eligible agent wake; no prior startedAt. | Helper returns no inherited anchor; requestedAt → startedAt fallback, no invalid duration. | I+T; stills INSUFFICIENT | P | P | P | P |
| B32 | Eligibility negative controls | Separate takes: agent without senderThreadId; agent source other than mcp; native-origin child; unrelated immediate sender. Use legitimate service/typed test driver for unavailable UI inputs. | No ordinary-message inheritance; automatic queue only eligible when all three identity predicates hold. | I+T; stills INSUFFICIENT | P | P | P | P |
| B33 | Previous-run selection and ties | Use isolated event-sourced fixture driver: started runs with different startedAt/order, equal starts with differing ordinals, plus newer never-started queued run. | Choose latest startedAt then ordinal; ignore never-started run; carry its effective workStartedAt. | I+T; stills INSUFFICIENT | P | P | P | P |
| B34 | Provider failure queue hold | Run A to usage_limit/provider_error with queued B; observe hold; explicitly release when supported. | No false automatic continuation while held; ordinary explicit B starts fresh. | I+T; stills INSUFFICIENT | P | P | P | P |

## Render fixtures

| ID | Render path | Additional real-app seed / interaction | Check | Proof | 1440×900 L | 1440×900 D | 390×844 L | 390×844 D |
|---|---|---|---|---|---|---|---|---|
| R01 | Web/desktop chat working row | B01 then B10, before tools and while tools/reasoning run | WorkingTimelineRow uses activeTurnStartedAt; one timer header; no layout jump. | I+T; stills INSUFFICIENT | P | P | P | P |
| R02 | Web/desktop chat fallback label | Use isolated service fixture with active run but absent timer anchor during hydration | Working... fallback; changes to elapsed timer once authoritative runtime arrives. | I+T; stills INSUFFICIENT | P | P | P | P |
| R03 | Web/desktop sidebar Working duration | B10; show selected and nonselected thread, expanded sidebar; on narrow screen open sidebar drawer | WorkingDuration uses runtime activityStartedAt; stays consistent with chat at same instant. | I+T; stills INSUFFICIENT | P | P | P | P |
| R04 | Web/desktop sidebar waiting duration | Complete provider turn with pending background work that presents waiting; show sidebar | Waiting elapsed derives completedAt, not inherited work start; keep semantic distinction. | I+T; stills INSUFFICIENT | P | P | P | P |
| R05 | Web/desktop preparation and compaction replacement | Launch actual new worktree setup; then trigger real context compaction during work | Setting up worktree… / compaction label masks working timer; restoration keeps correct anchor. | I+T; stills INSUFFICIENT | P | P | P | P |
| R06 | Web/desktop worktree slot handoff | Launch setup with long background script; allow agent to start before script ends | Setup slot → working header with background setup chip; correct anchor and no duplicate header. | I+T; stills INSUFFICIENT | P | P | P | P |
| R07 | Web/desktop settled and interrupted folds | B25 and B24; ensure tool/reasoning items exist; expand each fold and steer segment | Worked for / Continued for / You stopped after are frozen; segment and whole-turn semantics stay distinct. | I+T; stills INSUFFICIENT | P | P | P | P |
| R08 | Native mobile floating working pill | B10; open ready thread with no approval/input/compaction; scroll and show keyboard | WorkingTimer ticks inherited anchor; pill remains readable and tappable around keyboard/scroll control. | I+T; stills INSUFFICIENT | P | P | P | P |
| R09 | Native mobile working thread-list duration | B10; navigate back to list and reopen thread | ThreadListV2Duration uses shared runtime; no reset on navigation. | I+T; stills INSUFFICIENT | P | P | P | P |
| R10 | Native mobile waiting thread-list duration | R04 state; navigate to thread list | Waiting age uses completedAt rather than work clock. | I+T; stills INSUFFICIENT | P | P | P | P |
| R11 | Native mobile worktree card handed-off timer | New worktree with setup continuing after agent starts | WorktreeSetupCard handedOff && working renders Working for with turnStartedAt. | I+T; stills INSUFFICIENT | P | P | P | P |
| R12 | Native mobile worktree working header | Reach worktree-started state where setupWorkingStartedAt exists and no setup card | WorktreeWorkingHeader renders Working for; transitions retain effective work anchor. | I+T; stills INSUFFICIENT | P | P | P | P |
| R13 | Native mobile timer suppression / return | B10 then pending approval, user input, child input, compaction, syncing, disconnect, preparation as separate takes | Floating status replaces/hides timer by priority; returning ready restores elapsed work, never starts over. | I+T; stills INSUFFICIENT | P | P | P | P |
| R14 | Native mobile settled/interrupted feed | B25/B24 with tool groups and steer segments; expand/collapse work folds | No active working pill when settled; frozen history durations remain coherent. | I+T; stills INSUFFICIENT | P | P | P | P |
| R15 | Formatting boundaries all active timer renderers | Hold real A through 59→60s and 59m→1h; long-boundary fixture may replay persisted older start in isolated server before connecting | Chat, sidebar and native formats intentionally differ; compare anchor/elapsed units, not identical strings; no clipping. | I+T; stills INSUFFICIENT | P | P | P | P |

## Source derivation

- Changed helper and three callers: [Orchestrator.ts:411](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/server/src/orchestration-v2/Orchestrator.ts#L411), queue selection at 1844, reused-session start at 5782, handoff/provider-switch start at 6469. Automatic queue is `endedRunId` present and not queueHeld; ordinary explicit queue resets. Notification/delegated/restart markers bypass that ordinary predicate.
- Steer branches: [Orchestrator.ts:4372](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/server/src/orchestration-v2/Orchestrator.ts#L4372) native steering; restart spreads targetRun at 4650. Promotion enters the same steer dispatcher. Terminal-event queue drain passes endedRunId at 11849; queue.resume/queued-run.start do not at 11789.
- New regression cases: [runtimeLayer.test.ts:3921](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/server/src/orchestration-v2/runtimeLayer.test.ts#L3921) covers ten origin/delivery combinations. Tests seed some events directly; they are not visual proof and do not cover every render path above.
- Shared anchor: [orchestrationV2.ts:571](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/packages/contracts/src/orchestrationV2.ts#L571) chooses workStartedAt → startedAt → requestedAt; [threadExecution.ts:257](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/packages/client-runtime/src/state/threadExecution.ts#L257) publishes runtime activityStartedAt; [models.ts:320](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/packages/client-runtime/src/state/models.ts#L320) resolves runtime before legacy summary fallback.
- Web/desktop: [TimelineWorkGroupRows.tsx:286](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/web/src/components/chat/TimelineWorkGroupRows.tsx#L286); [MessagesTimeline.logic.ts:1575](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/web/src/components/chat/MessagesTimeline.logic.ts#L1575) working row, setup override at 1921, settled fold durations at 1175; [SidebarThreadRow.tsx:157](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/web/src/components/sidebar/SidebarThreadRow.tsx#L157) and status branches at 1340.
- Native: [floating-working-control.tsx:565](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/mobile/src/features/threads/floating-working-control.tsx#L565); [ThreadDetailScreen.tsx:660](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/mobile/src/features/threads/ThreadDetailScreen.tsx#L660) status precedence; [thread-list-v2-items.tsx:1024](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/mobile/src/features/threads/thread-list-v2-items.tsx#L1024); [worktree-setup-card.tsx:43](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/mobile/src/features/threads/worktree-setup-card.tsx#L43) and header at 150; [ThreadFeed.tsx:2641](https://git.cafe/pingdotgg/t3code/src/commit/995209445bb3dca1a13649f5d509a6a46f49d6b7/apps/mobile/src/features/threads/ThreadFeed.tsx#L2641) slot selection.

## FRICTION

- This pass produces a source-derived fixture plan, not executed visual proof. No browser, simulator, dev server, provider, or time recording was launched. Browser/computer-use permission was not requested because execution was outside this read-only matrix task.
- Historical ordering, missing metadata, and exact terminal/steer races are not all constructible from normal UI alone. They require the labeled isolated typed fixture driver plus persisted-event trace. Do not quietly substitute static component fixtures.
- Native exact viewport support and actual available provider steering capabilities remain to be established by the execution owner. A provider lacking native steer must exercise the fallback and mark the native case unsupported for that adapter, not passed.
- Every provider (Codex, Claude, Cursor, Grok, OpenCode, Antigravity) must be classified for native steer/restart/unsupported; no adapter code changes occur in this diff. Local and remote/relay/tunnel must preserve the same server anchor; repeat B26 on each available connection mode and mark unavailable modes explicitly.
- A large historical gap is intentionally retained for immediate historical-child updates and continuation exemptions. A recording must distinguish that policy from the explicit ordinary-queue reset; no claim is made here that settled run-duration labels equal the active inherited work duration.
- No forge comments, reviews, branch writes, or repository edits were made. T3 PR association is app metadata only. Artifact upload is explicitly requested.