Server-only evidence transcript — issue 23687

Revisions
Base: 2c8bdf6177
Head: 7ca41e9da546c518d1b48d7190dca0998bdcf434 (independently verified)
Red-test commit: ffcf9a01f5
Worktree: /home/ubuntu/wt/issue-23687

Scope and provenance
Two independent reviews returned MERGE (lead-reported).
Proof-audit 1: matrix EMPTY, 0 rows; no render changes, screenshots, or video required (lead-reported).
This capture only read Git metadata and trace logs, wrote its own temporary transcript,
and uploaded that sanitized transcript. It did not change code, commit, push, post a
forge comment, start a server, or replay the request against the lead-owned server.
No credentials, project IDs, thread IDs, or private thread text are included.

Lead-recorded setup and request
vp install
vp run dev
The dev runner automatically seeded a 55.6 MB copy. The browser was paired and loaded.
Server port: 15174. Web port: 7134.
The lead programmatically captured a short-lived orchestration:read token from:
node apps/server/src/bin.ts auth session issue --base-dir /home/ubuntu/wt/issue-23687/.t3 --subject mcp-client --ttl 30m --scope orchestration:read --token-only
The lead initialized POST /mcp with protocolVersion 2025-06-18, retained the
Mcp-Session-Id response header, and called t3_thread_list for the seeded project.
An external sqlite3 connection held BEGIN IMMEDIATE until the HTTP response;
the lead released it with rollback in finally.

Before response — lead-recorded, not reconstructed from trace logs
Main/base: response after 5027 ms; OrchestratorMcpFailure, unable to list threads.
The supplied record contains no full wire-response JSON, so none is asserted here.

After response — lead-recorded, not reconstructed from trace logs
Head: response after 54 ms; success, 1 thread. Private response content omitted.

Independently extracted raw trace evidence
Source: .t3/userdata/logs/server.trace.ndjson and its rotated .1 file.
Each transaction's parentSpanId resolves to OrchestratorMcpService.listThreads.
Only timing, connection role, outcome, and non-private error classification are retained.

Uncontended before:
  startTimeUnixNano: 1792704696606565760
  sql.transaction durationMs: 4.870762
  db.connection: writer
  db.lock_wait_ms: 0.031
  exit: Success
  parent OrchestratorMcpService.listThreads durationMs: 7.653664
Contended before:
  startTimeUnixNano: 1792704732412406516
  sql.transaction durationMs: 5013.654632
  exit: Failure
  cause: SqlError / LockTimeoutError / database is locked
  db.connection and db.lock_wait_ms absent on this failed transaction span
  parent OrchestratorMcpService.listThreads durationMs: 5015.448839
Contended after:
  startTimeUnixNano: 1792705156250048222
  sql.transaction durationMs: 11.656937
  db.connection: reader
  db.lock_wait_ms: 0.028
  exit: Success
  parent OrchestratorMcpService.listThreads durationMs: 13.817982
HTTP wall times and SQL span times measure different boundaries.

Lead-reported validation (not rerun by this capture)
Red: five reader-routing tests failed, expected reader, received writer, at ffcf9a01f5.
Green: ProjectionStore.test 39/39; shared SQLite 16/16.
Server lint and server typecheck passed.

Optional current-server replay (not executed by this capture)
Run from /home/ubuntu/wt/issue-23687 with the lead's existing server available.
Supply a seeded project ID privately through T3_EVIDENCE_PROJECT_ID; the example
prints only elapsed time and success/error status. Never print the token or response.
This takes a temporary write reservation on the isolated dev database and rolls it
back; coordinate with the server owner before replaying.

T3_EVIDENCE_PROJECT_ID='<seeded-project-id>' python3 - <<'PY'
import json, os, sqlite3, subprocess, time, urllib.request
base = '/home/ubuntu/wt/issue-23687/.t3'
token = subprocess.check_output([
    'node', 'apps/server/src/bin.ts', 'auth', 'session', 'issue',
    '--base-dir', base, '--subject', 'mcp-client', '--ttl', '30m',
    '--scope', 'orchestration:read', '--token-only',
], text=True, stderr=subprocess.DEVNULL).strip()
headers = {'Authorization': 'Bearer ' + token,
           'Content-Type': 'application/json',
           'Accept': 'application/json, text/event-stream'}
def post(payload):
    req = urllib.request.Request('http://127.0.0.1:15174/mcp',
        data=json.dumps(payload).encode(), headers=headers, method='POST')
    with urllib.request.urlopen(req, timeout=30) as response:
        return response.headers, response.read().decode()
response_headers, _ = post({'jsonrpc':'2.0', 'id':1, 'method':'initialize',
    'params':{'protocolVersion':'2025-06-18', 'capabilities':{},
              'clientInfo':{'name':'sanitized-evidence', 'version':'1'}}})
session = response_headers.get('Mcp-Session-Id')
if session:
    headers['Mcp-Session-Id'] = session
headers['MCP-Protocol-Version'] = '2025-06-18'
post({'jsonrpc':'2.0', 'method':'notifications/initialized'})
connection = sqlite3.connect(base + '/userdata/statev2.sqlite')
try:
    connection.execute('BEGIN IMMEDIATE')
    started = time.monotonic()
    _, body = post({'jsonrpc':'2.0', 'id':2, 'method':'tools/call',
        'params':{'name':'t3_thread_list',
                  'arguments':{'projectId':os.environ['T3_EVIDENCE_PROJECT_ID']}}})
    elapsed = round((time.monotonic() - started) * 1000)
    messages = ([json.loads(line[5:].strip()) for line in body.splitlines()
                 if line.startswith('data:') and line[5:].strip() != '[DONE]']
                if body.lstrip().startswith('event:') or body.lstrip().startswith('data:')
                else [json.loads(body)])
    response = next(message for message in messages if message.get('id') == 2)
    failed = 'error' in response or response.get('result', {}).get('isError', False)
    print(json.dumps({'elapsedMs':elapsed, 'status':'error' if failed else 'success'}))
finally:
    connection.rollback()
    connection.close()
PY

Capture limitations
The original full HTTP responses and test output were not independently captured
in this step. Their summaries above are explicitly attributed to the lead.
The optional replay is provided for reproducibility and was not executed here.