# PASS1 proof matrix

Scope: [#22800](https://git.cafe/pingdotgg/t3code/pull/22800), [mirror #22801](https://github.com/pingdotgg/t3code/pull/22801). Full eight-file diff inspected, pinned to AFTER [224ad28ee9](https://git.cafe/pingdotgg/t3code/commit/224ad28ee98c6a0e483e4fd10e4055b24f92710d) versus BEFORE [e27a03e94d](https://git.cafe/pingdotgg/t3code/commit/e27a03e94d43b504cfc3933282af913763312afd). This is a server-only proof plan; scoped tests plus real-running isolated-app transcripts replace pixel captures by explicit authorization. No render changes, pixel matrix, screenshots, desktop/mobile duplicate captures, or browser work required for this audit.

## Minimum: two AFTER runtime rows

| Row | Seeded data | Affected? | BEFORE / AFTER needed | Exact successful proof | Seeding path |
| --- | --- | --- | --- | --- | --- |
| R1 master-only fresh creation | Named Git project, bare origin default master, local/tracking master, no main and no cached origin/HEAD; unbound task created through actual schedule_task(bindToCurrentThread=false), interval 3600000ms | Yes: creation previously persisted main | BEFORE real-app transcript and trace already supplied. AFTER actual schedule_task then run_scheduled_task_now required at pinned HEAD | Persisted task thread_id=null; workspace strategy worktree, baseRef=refs/remotes/origin/master, startFromOrigin=true. Record task ID, returned fresh thread ID, persisted run ID/status, prepared worktree path/branch, and Git commit/ref evidence as specified below | Existing /tmp/issue-16183-fixture/project with sibling bare origin.git; project 9b67ce6b-1ea0-42fb-83df-cfe8b4a547f7. Existing fixture commit 5cade2a196ef3c8da4151a9e8ced1c1b5a04c336. Lead uses isolated /home/ubuntu/wt/issue-16183/.t3; audit must not mutate it |
| R2 master-only explicit update/unbind | Same project and uncached origin/HEAD. Create a separate task using actual schedule_task bound to an existing stopped fixture thread; then actual update_scheduled_task(bindToCurrentThread=false) | Yes: independent update call site previously persisted main | BEFORE old source hardcodes main for explicit false; focused baseline regression evidence suffices, no second BEFORE app session required. AFTER bound-create -> explicit unbind -> run_scheduled_task_now required | Before update: same task ID, nonnull thread_id, root strategy. After update: same task ID, thread_id=null, worktree strategy with refs/remotes/origin/master and startFromOrigin=true. Manual run creates a fresh thread distinct from original bound thread and R1; same prepared-worktree and persisted run proof as R1 | Reuse fixture/project registration without changing default or adding main. Lead seeds bound task through app tools; check/record absence of origin/HEAD immediately before unbind; do not assume R1 left it uncached |

## Exact runtime acceptance record for each AFTER row

1. Record UTC time, full server source SHA, isolated home and endpoints (lead-owned web localhost:6547, server localhost:14587), actual tool names/inputs/results, and task/thread/run IDs. Never publish pairing credentials or auth tokens. Git checkout SHA alone does not establish the running process revision: identify the server restart/build serving this SHA.
2. Before trigger, record default branch advertised by the local bare origin, show-ref for local/tracking master, absence of main and cached refs/remotes/origin/HEAD, and expected default commit. Do not add another branch to the original master-only fixture. Tests separately prove choosing default over a feature HEAD.
3. Show persisted scheduled_tasks task_id, project_id, thread_id, workspace_strategy_json, run_count, last_run_status and last_run_error after mutation and after manual trigger. Link trigger to returned thread and its scheduled-task message/run using IDs or command/event correlation; do not infer association from title alone.
4. Show durable thread worktreePath/branch and run projection/event state after background preparation. Evidence must show preparation released the run out of preparing, with provider start/running or completed state and no workspace-preparation error. A completed harmless no-edit prompt plus persisted completed run is strongest and avoids commit drift. A later unrelated provider failure is not full successful-run evidence and must be labeled separately.
5. In the actual child worktree, record git worktree list --porcelain, symbolic-ref HEAD, rev-parse HEAD, and rev-parse refs/remotes/origin/master from the fixture project. With a no-edit prompt, child HEAD must equal the default SHA captured at trigger time. This binds durable thread path/branch to a real prepared checkout from master, rather than merely accepting the schedule. If agent commits occur, record initial checkout SHA/event or reflog and prove default ancestry explicitly.
6. Include relevant server preparation/release trace or persisted preparation events. last_run_status=succeeded alone is NEVER sufficient: it already occurred in BEFORE while asynchronous worktree preparation failed with ref_not_found.

Existing BEFORE: /tmp/issue-16183-evidence/before.txt and before-server-log.ndjson, source SHA e27a03e94d43b504cfc3933282af913763312afd. [Public BEFORE transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cd0f6c30f8b467f4/before.txt), [public server trace](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0ec2ade24f428ab6/before-server-log.ndjson). Stored BEFORE task scheduled-task:f335beaf-630e-474f-8663-a3b113eb8f47 had main and scheduler succeeded, while ThreadLaunchService.prepareInBackground failed during provision-worktree. BEFORE artifact does not include a complete persisted child/run query; retain the existing explicit failure transcript/trace rather than inventing additional baseline data.

## Scoped controls: tests sufficient, no added runtime captures

All paths below are relative to /home/ubuntu/wt/issue-16183. Test seeding is in apps/server/src/mcp/OrchestratorMcpService.test.ts, describe scheduled task workspace strategies (line 1940), helper checkWorkspaceStrategy (line 2091 onward). Real Git fixtures are scoped temporary directories, with mocked task persistence/thread service; these are not running-app evidence.

| Row | Seeded data | Affected? | BEFORE / AFTER needed | Exact successful proof | Seeding path |
| --- | --- | --- | --- | --- | --- |
| C1 main unbound create + unbind | origin default main, cached HEAD, checked-out feature/root with distinct commit | Resolution implementation changes; compatibility control | AFTER focused tests; no runtime duplication | Both save qualified origin/main, null thread; actual Git fetch/create yields default commit, not feature commit | checkWorkspaceStrategy create/update main false |
| C2 bound create + explicitly bound update | Named master project, bound thread | No intended behavior change; early-return control | AFTER focused tests | Existing thread retained, root workspace | checkWorkspaceStrategy create/update master true |
| C3 prompt-only update | Existing unbound explicit release/custom-base strategy, startFromOrigin=false | Must preserve existing strategy when bind flag omitted | AFTER focused test | Exact explicit workspace preserved, no default recomputation applied | preserves an explicit workspace when updating only the prompt |
| C4 Scratch create + unbind | Managed Scratch non-Git directory, bound existing task for unbind case | Yes: newly uses root rather than impossible Git worktree | AFTER focused tests sufficient under server exception | thread_id=null, root strategy, zero Git resolver calls for both operations | Scratch test at line 1942, managed-folder and Git mocks |
| C5 cached master | master default cached in origin/HEAD; feature/root checked out | Yes: cached resolver path | AFTER focused real-Git create/update tests | Qualified refs/remotes/origin/master; created worktree HEAD equals default | checkWorkspaceStrategy create/update master false |
| C6 uncached master | Reachable master origin, no cached remote HEAD | Yes: ls-remote discovery path; runtime R1/R2 also cover | AFTER focused real-Git tests and R1/R2 | Same qualified master ref; actual Git worktree equals default | cacheRemoteHead:false |
| C7 non-origin upstream, absent default refs | Only upstream remote, cached and uncached HEAD variants; remove local master and upstream/master | Yes: remote selection and qualified ref parsing/fetch | AFTER focused real-Git tests, both create/update | Saves refs/remotes/upstream/master; resolves remote even with absent tracking ref; fetches and creates default-based worktree | remoteName:upstream, removeLocalDefault:true; cacheRemoteHead true/false |
| C8 no remote | Local main plus feature/root | Yes: local fallback | AFTER focused real-Git create/update tests | Saves main, no remote target, created worktree equals local main | hasRemote:false |
| C9 offline uncached origin | Local main, uncached HEAD; remote points to missing local bare path | Yes: remote-failure fallback | AFTER focused real-Git create/update tests | Save succeeds with local main; restore connectivity before launch; fetch/create yields main commit. Does not claim offline launch | unreachableRemote:true, cacheRemoteHead:false |
| C10 remote lacks advertised HEAD | Reachable bare origin with HEAD pointing to nonexistent branch, local main | Yes: missing symref fallback | AFTER focused real-Git create/update tests | Saves main, branch tracking still resolves; actual fetch/create yields default main commit | missingRemoteHead:true, cacheRemoteHead:false |

Bounded verification command for capture lead, if fresh logs are needed: vp test run apps/server/src/mcp/OrchestratorMcpService.test.ts -t 'scheduled task workspace strategies'. Keep the invoked SHA and outcome. Existing prior reports of all 41 focused tests and lint/typecheck are reports, not independently rerun in this PASS1. No repo-wide tests warranted. Other changed test files only provide the newly required ManagedProjectFolders dependency; no additional user-visible matrix rows.

## Findings and uncovered proof

No concrete code defect identified in the full pinned diff for this proof audit. Creation and explicit unbind share the new resolver; omitted bind flag preserves the existing workspace. Scratch bypasses Git. The Git tests exercise fetch and real worktree creation, including qualified non-origin remote refs, not merely strategy snapshots.

AFTER R1 and R2 runtime transcripts/trace and durable child/run + Git proof remain intentionally uncaptured: capture follows PASS1. This matrix is ready; readiness is not runtime acceptance or merge approval. Unknown-default/non-Git named project errors and local-master/HEAD fallback-only variants are not separate existing test rows; they are nonblocking residual branches for this minimum, not claims of tested coverage. No need to multiply runtime captures across providers, clients, connection modes, or timer cadence: schemas, adapters, render code and trigger dispatch are unchanged.

FRICTION category | happened | avoidance
--- | --- | ---
Resource | df -h / first showed 6.0G free, above 2GB stop threshold | No cleanup or other process interference needed
Evidence | Scheduler success predates asynchronous preparation and masks BEFORE failure | Require durable child/run release and matching real Git worktree for each AFTER row
Scope | Initial GitCafe read returned stale head b53588bb11d3e3d377ab3c35cbb1326538120e6a; lead subsequently confirmed publication of current 224ad28 via recovered normal route | Audit pinned full local diff; capture must identify actual running SHA; never silently substitute head
Tooling | Initial source search guessed two nonexistent file paths | Located scheduledTasks service and read actual paths; no implementation edits
Network | Prior DNS outage reported; normal GitCafe read succeeded in this pass | Try normal ghdrop once, preserve local artifact and report any failure; no alternate route/auth

VERDICT: SUFFICIENT