# Final isolated adversarial review, round 3

**FIX_FIRST — evidence remains incomplete; no confirmed production-code defect.** Reviewed local branch `fix/issue-15873`, head [7dcb809db8](https://git.cafe/pingdotgg/t3code/commit/7dcb809db870aa1903a6031cdf93b6155ac8124d), complete nine-file diff from [b5a226e49c](https://git.cafe/pingdotgg/t3code/commit/b5a226e49c52ecab4ddc2d678a7012d97e651a6a), for [#15873](https://git.cafe/pingdotgg/t3code/issues/15873). No PR exists. This is a prepublication review, not permission to merge. Read the pr-audit skill, issue and public reproduction comment, full production/test/fixture diff, relevant callers, incremental/cache paths, and Find SQL/memory paths. No edits in the worktree, commits, pushes, comments, browser/server launches, or delegated work.

## Confirmed findings

1. **Evidence blocker, not a demonstrated product bug:** settled seeded web comparisons do not establish the required active/mounted/native behaviors. `/tmp/issue-15873-capture/index.md` explicitly leaves active steering into a different running turn, mounted answer dispatch/echo and map updates, hot-to-reload convergence, native iOS, Electron and Android unverified. S merely changes `inputIntent` in a completed snapshot. No installed current-source native iOS app was exercised. The prior evidence standard is therefore still unmet. The user permits a PR with named cannot-verify surfaces; that permits publication, not a MERGE verdict or silently waived acceptance criteria. Smallest next step: preserve these limits in the PR handoff and obtain the missing production-route transition/native evidence, without changing correct production code to satisfy a screenshot checklist. Independent proof-audit pass 2 is separate and its result is not assumed here.

No confirmed production regression with a supported input sequence was found. Round-1 mobile/cache and server Find concerns are addressed in the reviewed head; no prior finding is being carried forward solely on reputation.

## Worth having, smallest shape, product decisions

The fix is worth having: a persisted answer delivered after a queued run must be visible where the agent responds to it. Keeping only the historical card makes the conversation misleading. Matching the asking run to the answer's run is the smallest useful rule. The map replaces the former set without a new dependency, schema, transport, service, or provider adapter.

The user explicitly decided **same-run-only folding**. An adjacent answer in a different run remains a bubble, even without an intervening message. An answer steering a different active run also remains a bubble. Both retain the old question-card answer history. I found no reason to override that product decision. Web/mobile projection logic preserves the question row and suppresses only same-run synthetic answer messages. Find applies the same rule in both SQL and memory implementations. The existing incremental web fallback rebuilds when async answer rows append or nonstreaming prefix facts change; mobile now compares map values as well as keys before reusing a prefix.

## Minor notes from the newly added fixture files

- **P3, fixture-only stale metadata:** [seed.py:45](/home/ubuntu/wt/issue-15873/scripts/fixtures/issue-15873/seed.py:45) remaps run-ID strings and run ordinals for A/L/C but does not normalize the provider-thread numeric `last_run_ordinal` / payload `lastRunOrdinal`, originally 3 at [runtime.json:282](/home/ubuntu/wt/issue-15873/scripts/fixtures/issue-15873/runtime.json:282). Reproduction: invoke `fixtures()` in memory; A and L retain runs 1–2, C only run 1, yet all report provider last-run ordinal 3. This does not affect the folded-message comparison or invalidate the supplied settled timeline/Find pixels. It does mean these fixtures cannot certify provider lifecycle, rewind, or subsequent dispatch. Smallest cleanup, if they are extended for those purposes: normalize both fields to the retained maximum and assert their agreement. No additional product test is warranted for this fixture limitation.
- C retains the original synthetic message's `turn_start` intent after moving it inside the asking run. It is a deliberate folding control, not evidence of genuine same-run provider steering. S similarly proves settled steer presentation only. README/index already limit those claims appropriately.
- The seeder has a few unused locals and dense statements, but a general fixture framework would be more complexity than this one-off replay needs. Avoid expanding its remit.

## Complexity, parsers, input loops, malformed benchmark

Production additions have no regex or new free-text parser. Web and in-memory Find build a map in one item scan and do one lookup per candidate. Mobile does the same plus linear map equality before prefix reuse. SQL adds one `json_extract(...,'$.runId')` per loaded payload and a map lookup during the existing filter. These preserve expected O(V) work/O(Q) folding metadata for V visible items and Q answered questions. The new tests add finite fixture construction and expected-message assertions, not application input loops.

The new fixture code was included in this review, not exempted as capture tooling:

- `seed.py:26` is the only added regex: fixed UUID groups or fixed `msg_`/`call_`/`rs_` prefixes followed by hex digits. No nested quantifier or ambiguous recursive pattern. Scanning is O(N) in serialized bytes; fixed-length UUID near-matches have bounded work per position.
- JSON decoding/encoding is linear in bytes per pass. Remapping each of T distinct identifiers with whole-document `replace` costs O(T*N), plus O(T log T) sorting. If generalized to growing identifier sets, that can become quadratic; here it runs only on the fixed committed offline fixture, not a runtime path. Later run/node/message/checkpoint transforms, validation, and SQL insertion visit finite tables/rows; membership checks use sets/maps. Fixed outer loop: five cases. Long answer generation: seven paragraphs. No retry loop or unbounded traversal was added.
- Independently executed `fixtures()` with `python3 -B` without calling `seed()` or writing a database: all five cases validate in about 85 ms on this shared host. Verified request→`async-answer:` linkage, G/A/S/L different-run versus C same-run, retained answers, and no overlapping UUID/native-prefix identities across cases.
- Independently benchmarked **3,000 malformed whitespace tokens**, 40,499 bytes (`ffffffff-ffff-ffff-ffff-fffffffffffZ`, `call_`, `msg_z`, `rs_z`, repeated 750 times), 1,000 iterations. Regex median 2.683 ms, total 5,482 ms; maximum 139.781 ms on the shared host. JSON rejection median 0.0027 ms, total 3.634 ms; maximum 0.077 ms. No backtracking blowup observed. Parent's separate benchmark reports a different malformed input/timing; I do not substitute it for this run or interpret scheduling outliers as algorithmic growth. This is an offline helper benchmark, not a UI latency claim.

## Evidence versus diff

Independently viewed original PNGs with `view_image`: G 390/light BEFORE and AFTER, S 1440/light AFTER, C 390/dark AFTER, F 390/light AFTER. G visibly adds exactly the chronological answer bubble between queued reply and acknowledgment while retaining the old answer-card preview. S has the separate bubble and Steer label. C has the historical answer preview and no extra bubble. F shows 1/1 and highlights the answer bubble. These are settled observations, not dispatch or cache-identity proof.

Independently recalculated hashes and RGB differences for **all 30 supplied local pairs**. All 120 referenced file hashes match; Diff0 counts, >16 max-channel DiffT counts, and generated diff image pixels all reproduce exactly. All four C pairs have zero changed pixels at both thresholds. I did not download or recertify every public URL. Narrow PNGs are 780×1688 for 390×844 CSS/DPR2. Wide PNGs are original tool output downsampled to 1280×889 despite a 1440×1000 CSS/DPR2 viewport; they cannot establish native-resolution wide pixel equivalence.

The index accurately distinguishes BEFORE [ed9b7ca9c5](https://git.cafe/pingdotgg/t3code/commit/ed9b7ca9c53843ea1e6b466bf7d52928d10e7db0) from AFTER [7dcb809db8](https://git.cafe/pingdotgg/t3code/commit/7dcb809db870aa1903a6031cdf93b6155ac8124d). BEFORE includes the unrelated Node build pin absent from the requested diff; both captures reportedly used Node 24.21.0. This does not test the future merged release toolchain. I inspected the build-pin commit scope, but did not merge it.

Eight MP4s and recorded metadata are present. Action offsets are wall-clock initiation times; several exceed compressed media duration. They are not certified media seek timestamps. No ffmpeg/ffprobe executable was available in PATH, and this review forbids browser launches. I therefore do not claim playback inspection or verification of those interaction sequences. The index discloses this limit. Missing hot-cache, active-steer, history paging, copy/revert/error controls, and native evidence remain missing; 30 correct comparisons do not replace them.

## Tests and compatibility

Independently ran the three focused files on this head: **105 tests passed** (49 web, 37 mobile, 19 server). Targeted lint for those six TypeScript files passed. `git diff --check` passed. The worktree was clean during inspection; final status showed an untracked fixture `__pycache__/` appearing concurrently. All Python commands in this review used `-B`; I left that directory untouched. No tracked file changed. No repo-wide checks, fresh typecheck, or CI for a nonexistent PR were run. The first `vp` invocation failed due to PATH; the successful run used the worktree's `node_modules/.bin`.

The added tests cover a distinct missed behavior: late cross-run answer ordering through web full/incremental projection, mobile cold/cached feeds, and SQL/memory Find. Existing same-run tests retain card history and suppression. More duplicate queued-gap cases would add little. If expanding automated coverage, the distinct gap is warm mobile map-value reassociation with unchanged keys, asserting fresh/warm equivalence and retained card history; this is not a confirmed defect and does not call for an extra test per rendering branch. A real active-different-run integrated replay would resolve a different evidence gap than another static unit test.

No database migration, wire requirement, provider flag, request dispatch, permission enforcement, sandbox, approval, trust, credential, or MCP semantic change exists in the production diff. The stopped fixture records contain `full-access`/provider-capability metadata, but do not alter enforcement or execute approvals; no credential/auth/event/outbox rows or live native identifiers were found in the committed sample. **NEEDS_JULIUS is not triggered by a sensitive semantic change in this revision.**

Existing persisted answer data gains visibility without rewriting it. Nullable run IDs retain legacy null/null folding; unmatched valid messages remain visible because absence is `undefined`, not `null`. Question outside a loaded history window means no matching fold map entry and the answer remains a message; later hydration can rebuild/recompute. Source/inherited item identities are used by Find as before. Cancellation still follows unchanged dispatch logic; no new request or side effect was introduced. Reconnect should converge from persisted projections, but mounted reconnect/cancel/history transitions were not exercised here. Old clients retain their old hiding behavior against the unchanged schema; this fix cannot backport client rendering. Codex, Claude, Cursor, Grok, OpenCode and Antigravity share the projected-item rule; only the supplied Codex provenance was reproduced previously. Remote/relay/tunnel and multi-device behavior are not independently certified. Desktop wraps changed web logic; native mobile uses its separately changed helper. Neither fact substitutes for Electron/iOS/Android runtime verification.

This last allowed review round does not request another adversarial round. Publish only with the explicit cannot-verify handoff if that is the dispatcher's authorized next step; readiness remains unproven.

FRICTION category|what|prevention: tooling|vp absent from initial PATH|prepend worktree node_modules/.bin; evidence|static S and replay grids cannot prove active/cache/native transitions|name each unverified behavior and capture production-route transitions; media|wall-clock offsets differ from compressed playback and no decoder in PATH|index actual media timestamps during capture; fixture|lastRunOrdinal remains 3 after run removal|normalize derived numeric metadata if extending beyond settled replay; scope|no PR/CI or merged build verification exists|do not describe prepublication local results as merge readiness.
VERDICT: FIX_FIRST