# Issue 19728 — proof audit pass 1

Issue: [#19728](https://git.cafe/pingdotgg/t3code/issues/19728)

Scope: unpublished branch in `/home/ubuntu/wt/issue-19728`; base `70e5e384da`, audited HEAD `496acd1a37ef189204504f8f6729ab0ecb344cd7`. Read-only source/evidence review; no branch edits, tests executed, pushes, comments, captures, server launches, or browser launches. This report is an audit artifact outside the worktree.

## Decision

The user’s server-only proof rule applies. The complete diff is `ThreadSettlementService.ts` plus its existing test file. There are no changed client files, contracts, UI components, layouts, rendering branches, or transport paths. Existing clients observe the resulting settled state through the unchanged projection path. That observable state consequence does not require a visual matrix under this rule.

**Visual matrix: `[]` (zero affected render rows).**

**Recording requirements: none.** Viewports 1440/390, light/dark, web/desktop/mobile, and interaction/time recording dimensions are not applicable. Do not manufacture UI fixtures or request unrelated UI evidence. Backend time-dependent behavior is proved by tests and a runtime transcript.

The worktree AGENTS.md says: “A server-only fix with no visible surface ships the test plus a short runtime transcript.” The user explicitly defines this pass as no changed visible/render surface, consistent with this diff.

## Backend fixture matrix

These are policy fixtures, not visual rows. Unit coverage is source inspection, not an independently executed green run.

| Fixture | Expected result | Evidence / requirement |
| --- | --- | --- |
| Idle eligible thread, two synced open links, age 4 days, threshold 3, keep=false | Settle at latest activity anchor | Added regression case; supplied red transcript fails on unchanged production policy. Core real-runtime before/after fixture. |
| Same, keep=true | Remain active | Added parameterized test; supplied red transcript says this control passes. Final green required. |
| Open plus merged link, keep=false/true | Inactivity settlement only when keep=false; merged layer must not force settlement | Added assertions for both keep values; final green required. |
| Unsynced link (snapshot=null), keep=false/true | Remain active | Added assertions; final green required. |
| No linked PR, same eligible age/settings | Settle normally | Existing inactivity tests; baseline real-runtime control is settled. Preserve this control in final transcript. |
| Recent activity, disabled threshold, latest activity/creation anchor, snooze wake | Preserve existing inactivity guards and anchors | Existing resolver tests. No separate runtime or visual expansion required for unchanged guards. |
| All links terminal / legacy PR lookup; candidate blockers; project overrides | Preserve existing merge/close and eligibility behavior | Existing resolver/worker tests. No claim of new runtime coverage for these branches. |

## Caller reasoning

Production resolver calls are confined to ThreadSettlementService: settleThread resolves effective project settings and dispatches `thread.auto-settle`; wouldSettle checks legacy lookup candidates. The initial settleThread call receives pullRequest=null. Threads with visible links are excluded from the later legacy lookup pass, so open-link behavior reaches the changed policy through the first pass. Existing scheduled, settings-change, PR-sync/link, provider/run, and merge-triggered sweeps share this server service. ProjectionSettlement.test.ts also calls the resolver as a test consistency check. No caller is a renderer.

## Existing evidence inspected

- [Red regression transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d4e0159d103df6be/issue-19728-red.txt): test-only commit `03515f056c`, production base `70e5e384da`; targeted command fails keep=false with received null rather than the expected activity timestamp; keep=true passes. It is a short summarized transcript, not a complete independently rerun log. The final mixed-state and unsynced assertions were added after this test-only commit; do not claim those assertions individually failed on base.
- [Baseline runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8e173e91ef8470cd/issue-19728-runtime-before.json): identifies base `70e5e384da`, Date.now +4 days external preload, threshold=3, keep=false. The unlinked control is settled, with settledAt equal to createdAt; `triage-19728-open` remains active with two synced open native-stack links. This establishes the relevant before-state failure and a functioning settlement control.
- The brief reports ordinary app-RPC creation, manual command-palette linking, an exploratory fixed-source hot restart, and a coherent isolated backup `/tmp/issue-19728-baseline.sqlite`. Those provenance details and the exploratory after result are lead-reported, not independently verified by this audit. No final-head after artifact was supplied.

## Required backend transcript conditions

1. Identify the exact executed revision: final HEAD `496acd1a37ef189204504f8f6729ab0ecb344cd7`, clean tracked source, runtime invocation, and server package/test commands. Include a passing run of the final focused regression cases, preferably the containing settlement test file. Do not substitute the two MERGE opinions for execution evidence.
2. Identify the isolated T3 home/database path and restoration from the coherent baseline backup with the server stopped. No production/live database writes. Show or state fixture provenance: ordinary app RPC thread creation and actual manual PR linking, with real synced open PR snapshots; no direct policy invocation or fabricated database outcome as the runtime proof.
3. Disclose the time harness explicitly: external Date.now preload +4 days, unchanged across comparable base/head runs; this is a real dev-server execution with a clock harness, not naturally elapsed four-day observation. Record effective decision time and relevant activity/creation anchor so age >3 days is checkable. A synthetic or unseedable fallback must be labelled harness evidence rather than a real-user fixture.
4. Record effective project-resolved threshold=3 and keep=false (and auto-settle-on-merge value), linked thread ID, both links/snapshot states, activity timestamps, and pre-run settledOverride/settledAt. Confirm no candidate blocker: archive/explicit override, pin/disable, pending runtime request, active run/background task, queued turn, or unexpired snooze. A compact snapshot is sufficient.
5. Start the actual final-head server through its ordinary settlement worker path. Read the persisted `thread.settled` event / authoritative projection after settlement; include thread ID, settledOverride=settled, settledAt and activity anchor, and show both linked PRs still open. This must demonstrate inactivity settlement rather than a PR merge/close or a manual settle command. Include event provenance if available; command dispatch alone is insufficient.
6. Retain the unlinked control and report its settled state. If the restored baseline already contains that control settled, say so; do not claim a second transition occurred. Correlate the same linked fixture identity and settings between before and after.
7. Publish the short final-head runtime transcript and final green test result. Keep credentials, pairing tokens, environment secrets, and unrelated user data out of artifacts. No screenshot, browser recording, or separate runtime run for every unchanged guard is required.

## Coverage limits and disposition

**Proof-plan PASS; proof completion PENDING final-head green/runtime evidence.** The supplied baseline and red artifacts support the core bug. The after-run on the copied backup has not yet been audited, so this pass does not certify completed end-to-end proof. No new tests or runtime execution were performed by the auditor. The before JSON omits effective project override resolution, candidate guard fields, and persisted event provenance; the final transcript should fill those gaps without expanding into unrelated UI work. Client rendering, additional providers, remote/tunnel delivery, and mobile interaction were not exercised and are outside the changed-policy proof scope.

## FRICTION

- tool: web fetch could not access the supplied artifacts; Python urllib received HTTP 403. curl fetched both successfully. Resolved; no evidence access blocker.
- brief: exploratory fixed-source after result has no supplied artifact; final-head replay is explicitly pending with the lead.
- runbook: no blocker. Worktree AGENTS.md independently supports the server-only transcript rule.
- infra: no blocker observed; server intentionally stopped and launches remain with primary.
- forge: not used; no issue/PR mutations or forge CLI reads were necessary.
- policy: no conflict; empty visual matrix follows the explicit user rule.
- model: no model-related blocker observed; prior reviewer opinions not independently reproduced.
- other: none.