# Proof audit pass 1

Issue: [#25621](https://git.cafe/pingdotgg/t3code/issues/25621)
Base: [0604547a3a](https://git.cafe/pingdotgg/t3code/commit/0604547a3a)
Head: [d487d6cb5e](https://git.cafe/pingdotgg/t3code/commit/d487d6cb5e)

## Scope and visual fixture matrix

The complete diff contains only ProjectionStore.ts (seven SQL membership predicates) and ProjectionStore.test.ts (one regression). It replaces expanded bound-variable lists with a single encoded JSON array selected via json_each. No client, contract, navigation, styling, or render path changes. Web, desktop, and mobile consume the same corrected server shell data; no surface-specific rendering implementation changed. Provider and connection-mode behavior is unchanged.

Per the requested server-only procedure, the visual fixture matrix is EMPTY (0 rows). There are no affected render paths, viewport/theme permutations, interaction rows, or required recordings. Startup failure can manifest in an existing client error surface, but this diff does not alter that rendering path. Proof is the failing regression followed by passing tests and a short runtime transcript.

| Render path | Fixture | Viewport | Theme | Interaction | Recording |
|---|---|---|---|---|---|

## Server proof inventory derived from the diff

These are query/data coverage rows, not visual fixtures.

| Changed membership | Input dimension | Evidence / limitation |
|---|---|---|
| Shell thread selection | Explicit thread ID list | Same JSON encoding already used elsewhere in this module; new regression does not supply an explicit threadIds option |
| Shell run rows | Fork-source thread IDs | Existing projection suite passes; no new >32,766 fork-source fixture |
| Shell run item counts | Fork-source thread IDs, nonnull run IDs | Existing projection suite passes; no new large fork-source fixture |
| Shell item counts | Selected thread IDs | New 32,767-thread unscoped + active snapshot regression passes; empty child tables still force SQL preparation |
| Provider thread rows | Selected thread IDs | Same large-thread regression exercises statement preparation; no populated provider rows in new fixture |
| Pending task rows | Selected thread IDs | Same large-thread regression exercises statement preparation; no populated pending tasks in new fixture |
| Pending active-run UNION | Running run IDs | Existing projection suite passes; new fixture has no active runs, so does not exercise this branch at high cardinality |

## Evidence and findings

- Supplied test-red.log: one regression fails with ProjectionStoreReadError caused by SQLite "too many SQL variables"; 46 other tests skipped. This audit did not independently rerun the base or establish the supplied log's commit provenance.
- Audit execution on the supplied head: `vp test run apps/server/src/orchestration-v2/ProjectionStore.test.ts` — 47 tests pass, one file passes. Full output is retained outside the repository in proof-audit-pass1-green.log.
- Supplied runtime-before.txt: reports 32,767 nondeleted/nonarchived threads fail startup with the same SQL error; 32,766-thread control recovers. These historical observations were read, not reproduced during this audit.
- Lead-owned runtime-after.log: recovery completed at 22:44:14.339. Early shell / WebSocket requests return 401; those requests do not prove authenticated shell delivery. The log is still being produced by the lead. Completion requires the lead's finalized transcript tying the head, 32,767-thread fixture, successful recovery, and successful authenticated shell read together. Do not upload the raw log: it contains a pairing token.
- No concrete correctness defect found by diff inspection. JSON string membership preserves the nonnull string ID semantics while reducing each list to one parameter; existing encodeIdList helper and json_each are reused.
- Proof status: regression red/green verified from supplied red plus fresh green; visual matrix complete and empty; finalized runtime-after proof remains with the lead.
- No source edits, PR, browser use, server launch, or issue/comment writes performed. This matrix upload is the explicitly requested public artifact.

## FRICTION

| category | what | prevention |
|---|---|---|
| Evidence completion | After log is live and early requests are unauthenticated; successful startup alone does not prove shell delivery | Lead finalizes a sanitized transcript with commit, fixture count, recovery, authenticated request status and returned thread count |
| Evidence hygiene | Raw runtime-after log includes a pairing token | Publish only a sanitized, selected transcript; retain raw logs locally |
| Test coverage | New large fixture covers thread cardinality, not populated fork-source or active-run cardinality | State the boundary honestly; if those branches are claimed as independently proven, supply focused data-level evidence |
| Test invocation | Root test invocation had discovery overhead; a second package-scoped invocation was started before the first result arrived | Run from apps/server with its package-relative file path and await one invocation |