# Takeover review and verification: PR 17031

Original: [#17031](https://git.cafe/pingdotgg/t3code/pulls/17031), @ehfreema, ehfreema/lct3 fix/execute-html-render-inline at [ed7d8da](https://github.com/ehfreema/lct3/commit/ed7d8daef8ecbd49d00480ffb6e2d1f8c0f2a4aa).
Replacement: takeover/pr-17031-inline-pages at [6374f21](https://git.cafe/pingdotgg/t3code/commit/6374f21afcf7c47d6cbc23f398399fc53fa41149), based on main.

## Result

STOPPED at review round 1. Both independent reviewers returned NEEDS_JULIUS for ACP identity classification and guest-page content-trust changes. No fixes, proof audit, provider runs, or captures were performed after that verdict, per the takeover's hard-stop rule.

## Confirmed outstanding findings

- Reviewer A (Codex gpt-6.1-sol): packages/provider-acp/src/server/adapter.ts:2675 projects native child MCP raw output without acpMcpToolCallOutput. A recognized Grok child call returning {type:'MCP',output:{OkayOutput:JSON.stringify({htmlRender:page})}} therefore fails page extraction and compaction. The parent path unwraps it. Fix would apply the existing normalization to recognized native-child MCP calls and add a focused adapter regression.
- Reviewer B (Claude Opus 5.5): packages/provider-acp/src/server/runtimeModel.ts:1133 adds rawInput.toolName to all identity candidates. {rawInput:{toolName:'html_render',query:'...'},title:'ToolSearch'} is then misclassified as t3-code.html_render through the existing bare-title matcher. Fix would admit only qualified mcp__<server>__<tool> rawInput.toolName values and add a negative regression.
- Reviewer B noted an existing OpenCode native-task gap: child execute calls can publish under the parent MCP session's thread segment, so the requested child sourceThreadId check rejects their pages. This follows the requested ownership rule, not a regression; separate T3 delegate_task sessions were not verified.

## Tests

Original PR: 13 added tests across 7 files. Takeover: 9 added tests across 6 existing files, 8 failing on main plus one existing-metadata regression guard. Tester verified all 9 with the original implementation temporarily applied, then reverted implementation before committing tests.

Implementation focused checks: shared htmlRender/toolOutput 26; provider-acp runtimeModel 50; server AcpAdapterV2 66; server attachmentStore/GuestShareService/TurnStartReads 35; web session-logic 49; mobile threadActivity 41. Total 267 passed. Scoped typechecks, format, lint passed.

check:changed: all 34 package typechecks, both knip stages, lint, format, GraphQL, unused patches passed. Tests: 312 passed, 1 existing terminal-output test timed out under the broader run. The same test passed in isolation unchanged; the original failure remains recorded. No timeout or retry configuration was changed. docs/POLICY.md referenced by the brief was absent.

Reviewer A additionally ran 86 parser/attachment tests and 3 targeted client/adapter tests; reviewer B ran the five changed suites (232 tests). No committed scratch was found.

## Complexity

Result reading retains depth 4, 128 nodes, 32 blocks and a 16-KiB parsed-string budget. Bare text-block key validation is O(k) time/allocation; annotation scanning is O(n), OkayOutput unwrap O(1), attachment suffix uses fixed/bounded quantifiers. Cleanup adds one fixed-substring payload scan.

Reviewer A found two pre-existing adversarial quadratic patterns now reused: moved /^[-_]+|[-_]+$/g takes about 41 ms for 3,000 interior underscores and 591 ms for 12,000; existing /^mcp__(.+?)__(.+)$/i takes about 82 ms for a malformed 3,000-unit repeated-delimiter candidate. This supersedes the implementer's and reviewer B's 'linear in practice' observations. No overlapping nested quantifier was introduced. Fixes were not made after the hard stop.

## Evidence

No fixture matrix, captures, recordings, visual diffs or proof-audit verdict. Web and mobile are unverified visually. No actual OpenCode, Devin, CodeBuddy or Grok run was performed. Server/shared/provider-acp have focused tests, but no runtime transcript. No browser, server or emulator was started by the lead.

## Shape and reuse

Replacement on origin, never the contributor fork. Two commits: tests [f4c02b8](https://git.cafe/pingdotgg/t3code/commit/f4c02b8097) and implementation [6374f21](https://git.cafe/pingdotgg/t3code/commit/6374f21afcf7c47d6cbc23f398399fc53fa41149). Reused attachment-thread normalization, ownership check, bare-reference gate and ACP field facts. Replaced isolated text-parsing budgets with a standard MCP text-block shape check, localized Grok annotation stripping to the adapter boundary, and dropped generic non-MCP output unwrapping. Added guest loading and bare-reference deletion discovery for the changed behavior.

Models/harnesses: Claude Opus 5.5 through Claude Agent for tests, implementation and review B; gpt-6.1-sol through Codex for PR lead and review A, coordinated through T3 Code.

## Public logs and benchmark probes

[pr-17031-check.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/58c32b412aa38755/pr-17031-check.log)
[pr-17031-terminal-test.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/050ace1ef73e9e6f/pr-17031-terminal-test.log)
[bench17031.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ff4d37804f73ba55/bench17031.ts)
[bench.test.ts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0f773236e75c5b9c/bench.test.ts)

## FRICTION
brief | Original implementation patch no longer applied cleanly to current main | Re-derive against main and use the patch only as reference
brief | Isolated OkayOutput regression required exporting the adapter helper | Specify whether helper exports or full replay coverage are preferred
brief | One metadata regression guard already passed on main | Distinguish preservation guards from the failing regression minimum
 tool | Em-dash lint also flags the escaped provider annotation | Document the existing scoped-disable pattern
 tool | vp test hid benchmark console output | Pass --silent=false for benchmark probes
 tool | Filtered adapter suites still spent substantial time importing | Narrower package-level fixtures where practical
runbook | Reviewer briefly created then deleted probe files in the worktree | Put benchmark drivers under /tmp from the start
 tool | Initial 60-second delegated wait returned before the test step completed | Use a wait timeout covering the step budget
forge | Initial claim comment failed with ConnectionRefused; retry succeeded | Reliable GitCafe connectivity
brief | docs/POLICY.md flake list referenced by the brief is absent | Supply the current flake-policy path
forge | GitHub draft creation initially could not resolve the just-pushed GitCafe branch | Allow for the documented mirror propagation delay
infra | Existing ACP 16-MiB terminal-output test timed out in check:changed, then passed alone unchanged | Reduce concurrent verification contention