# Issue 16507 — final read-only proof audit, pass 2

Issue: [#16507](https://git.cafe/pingdotgg/t3code/issues/16507).
Reviewed head: [d3be7b9378](https://git.cafe/pingdotgg/t3code/commit/d3be7b93785ccd1227374f6daf6f2222e8dcf896), full SHA `d3be7b93785ccd1227374f6daf6f2222e8dcf896`.
Base: local `origin/t3code/rebuild-mobile-app-swift`, [4619c0bca6](https://git.cafe/pingdotgg/t3code/commit/4619c0bca6a385e53f3479e4e52a9cdf2d12ff62).
Worktree: `/home/ubuntu/wt/issue-16507`; budget ceiling 60 minutes. Local refs were inspected without fetching or modifying them. The brief's combined branch/SHA string was resolved as the branch above and its matching SHA.

Native proof is insufficient: zero native captures and zero native executable assertions. N0–N9 remain UNVERIFIED — cannot-verify ios-swift. The explicit user rule permits Julius's Swift-base PR with that limitation; this audit does not turn that permission into native proof, merge approval, or permission to write a PR.

## Artifacts and provenance

- [Final matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d87e6ef85f135db/16507-matrix-final.md): updates the head, complete diff size and N7 late-config correction while retaining fixtures and capture requirements.
- [Original matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d33c48f32410f970/16507-matrix.md): first-commit source audit; its old head and missing same-ID reseed concern are superseded.
- [Evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ff79ce7d8b1ea68d/16507-evidence.md): final-head source expectations and honest zero-proof declaration; reviewed against local source.
- [Native-check log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8201d778de9806ef/16507-native-check.log): exactly `[swift-ios-ci] error: missing required command: xcodebuild`. This establishes a missing prerequisite, not compilation failure in changed Swift and not a successful build.
- [Server transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/df1d2d919c96e972/16507-runtime.log): attributed by the lead/brief to real main [b5a226e49c](https://git.cafe/pingdotgg/t3code/commit/b5a226e49c). Its three lines contain no SHA, time, command exit status or full request/response trace. Attribution is external to the log. It supports the setting value and the two reported browse results only.

Local supplied artifact bytes were read; public predecessor URLs are the supplied publication references, not independently downloaded copies. The final artifacts were uploaded with ghdrop. No screenshots, recordings, native build identity, device/iOS metadata or measured pixel delta exist. No substitute RN/web evidence is credited. No native rebuild was attempted: this host is Linux and neither swift nor xcodebuild is on PATH.

## Complete diff review

All four changed files and both commits were reviewed against the resolved base: 51 additions / 5 deletions. `git diff --check` passed. This is whitespace validation only. No compiler, executable behavior test, browser, native capture, server startup, fixture creation or CI rerun was performed. The issue was read through cafe after verifying origin is GitCafe. No PR was identified or worked on; no PR linking or PR write was needed.

1. [ServerConfigModels.swift](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Core/ServerConfigModels.swift#L224): adds optional string, CodingKey and decodeIfPresent. Missing/null is intended to decode nil; empty/padded strings are retained here. Runtime decoding and synthesized encoding remain unexecuted.
2. [FeatureModels.swift](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Features/Shared/FeatureModels.swift#L54): adds optional environment property, key and compatible optional decode. No required wire field is introduced. Round-trip/legacy-cache behavior remains unexecuted.
3. [NativeFeatureClient.swift](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/App/NativeFeatureClient.swift#L6713): maps settings from the dictionary indexed by the environment being mapped, rather than globally active environment. Read config storage and snapshot mapping in context; cross-environment behavior still needs native execution.
4. [AddProjectView.swift](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Features/Workspace/AddProjectView.swift#L636): reset seeds browser, Folder and Clone from trimmed configured base with home fallback. Existing helper supplies trailing separator and clone suffix behavior. Final commit records environment/path seed, observes normalized base changes, guards reseed against edited destination, different localPath, environment mismatch and in-flight submission/clone state, and reloads without selection. Explicit folder selection clears seed. These are source observations, not verified visible results.

Followed the shared sheet/callers in [WorkspaceView.swift](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Features/Workspace/WorkspaceView.swift#L158), the browse/path helper in [ProjectCreationModels.swift](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Features/Workspace/ProjectCreationModels.swift#L187), manual destination binding, repository resolution, directory response guards and separate New-project root path. There are no server, web, RN, desktop, provider-adapter, transport or contract implementation changes. Existing entry paths share the sheet; native parity remains unverified. Setting authoring is an input fixture; agent/MCP and scheduler changes are not needed for this client seed fix. Switching back, dismiss/reopen, remote A/B and stale response handling are in the native matrix; no tunnel-specific behavior is claimed. No documentation change is necessary to explain this bug fix.

## Row-by-row proof decision

Every N row has zero captures and zero native executable proof. Source evidence supports intent only. Recording means continuous native before/after interaction with matched fixtures, exact build identity, environment and async completion; still images cannot establish ordering or retention.

| Row | Evidence reviewed | Missing proof / decision |
|---|---|---|
| S0 | Existing main transcript: config value `/tmp/issue-16507-projects`; home browse parent `/home/ubuntu`; configured browse parent `/tmp/issue-16507-projects`, empty entries. | Limited server baseline only. No native automatic selection, tilde config resolution, children, clone, A/B or timing proof. Empty entries cannot establish navigation. |
| N0 | Optional config/environment decode and environment-indexed mapping. | Missing executable decode, missing/null/empty/whitespace cases, legacy round-trip and A/B isolation assertions. UNVERIFIED. |
| N1 | Configured Folder reset and directory separator helper. | Missing native configured/trimmed/trailing-slash initial browse and child selection recordings, V1 and specified V2 light/keyboard visibility. UNVERIFIED. |
| N2 | Trimmed blank maps to `~/`; clone appends repository name. | Missing native absent/null/empty/whitespace Folder/Clone fallback recordings and request evidence. UNVERIFIED. |
| N3 | Repository edits call suggestion helper using browsePath unless destination edited; lookup updates suggestion. | Missing empty/input-changed clone destination, navigation and one ready provider lookup recording. UNVERIFIED. |
| N4 | Initial remote/environment feed shared sheet; reset derives suffix without requiring later text edit. | Missing actual clonePrompt trigger, correct selected host and preseeded destination recording. UNVERIFIED. |
| N5 | Destination binding sets edit flag; localPath equality guards late reseed; initial browse uses updateSelection=false; explicit browse clears seed. | Missing edit/config/suggestion retention and async completion recordings, including specified V2. Folder edit tracking uses current equality, not historical edit tracking: editing away and back to exact seed makes it eligible again. Do not claim every historical edit permanently disables reseed. UNVERIFIED. |
| N6 | Reset recomputes environment-specific base; loadDirectory checks request UUID and environment ID. | Missing controlled delayed A response, switch B, return A, clone suffix/manual reset and Folder run. No stale result or request ordering execution proof. UNVERIFIED. |
| N7 | Final head observes normalized configured base and performs guarded reseed; original absent-observer concern is corrected in source. | Missing cold-start ordering and late-arrival unedited/edited recordings. Also missing config-arrival-during-lookup and old/new browse overlap runs. No claim of native timing success. UNVERIFIED. |
| N8 | Sidebar, NewTask callback, palette, empty-project fallback and clonePrompt share sheet. | Missing labeled native entry-path recordings and dismiss/reopen prompt cleanup proof. UNVERIFIED. |
| N9 | Configured missing path enters existing browse error/direct-entry flow; New uses environment.newProjectsRoot. | Missing native error/recovery and independent New-root recording. UNVERIFIED. |

Fixtures remain a proposal, not prepared native test data: two isolated environments, distinct home/configured roots, nested/existing repo children, independent New root and disposable clone URLs. No fixture execution log or ready native runner was provided. Windows is a conditional extension only if supported Windows remote hosts are claimed. No broad provider/device/theme cross-product is required. The matrix's minimal V1/V2 cases remain outstanding.

## Corrections, contradictions and remaining source concern

The first matrix described the earlier [371bb822b0](https://git.cafe/pingdotgg/t3code/commit/371bb822b06546f970c82ab28d37c787f8da4bd0). Its 19-addition count, old head and statement that no same-ID reseed exists are stale at final head. The final matrix corrects them. The evidence index correctly describes the final guarded reseed. The stale report is not evidence that final head still lacks the fix.

The server log is correctly labeled main/server-only in the evidence index. It cannot be promoted into final-head Swift proof. The native prerequisite error is correctly labeled unavailable compilation, not a discovered Swift compiler regression. The explicit exception permits this evidence status for Julius's Swift-base PR; missing proof remains missing. No unsupported claim of captures, compilation success, visual parity or pixel change was found in the supplied evidence index.

A source-visible edge remains in [reseedLateBaseDirectory](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Features/Workspace/AddProjectView.swift#L667): it returns while isSubmitting is true. [resolveRepository](https://git.cafe/pingdotgg/t3code/blob/d3be7b93785ccd1227374f6daf6f2222e8dcf896/apps/swift-ios/Features/Workspace/AddProjectView.swift#L881) uses that same flag and clears it on completion, without retrying the seed. Conditional trigger: sheet seeded at home, configured base arrives during provider lookup, no path edits, lookup finishes and normalized config remains unchanged. There is no explicit subsequent reseed trigger, so destination can remain home-based until reopen/switch/another config change. This is a static control-flow concern with unproven runtime reachability, not a native reproduction. It is limited to the late-arrival/lookup overlap; it does not contradict the correction for normal unedited late arrival. Severity: minor functional edge if reachable; not an established merge blocker in this proof audit. Smallest potential remedy is to retry the same guarded reseed after non-destructive lookup finishes; prove ordering and retention natively before deciding a change is needed. No source was edited.

## FRICTION

| valid category | happened | prevention |
|---|---|---|
| platform | Linux lacks Swift/Xcode; supplied native check stops at missing xcodebuild. | Preserve cannot-verify ios-swift for N0–N9; use authorized macOS/iOS later. Do not substitute web/RN or repeatedly attempt impossible rebuilds. |
| proof provenance | Server transcript is brief-attributed to main and has no embedded SHA/time stamp. | Keep S0 partial and separate; stamp future evidence with revision/environment/time and full request outcome. |
| timing coverage | Final observer/guards and overlapping lookup/browse order have no native run. | Exercise continuous N5/N6/N7 order variants; distinguish static concern from reproduced behavior. |
| fixture readiness | Native A/B fixtures and runner metadata have not been demonstrated. | Prepare isolated fixtures and record device/iOS/build/theme/viewport before native acceptance. |
| operational brief | `/home/ubuntu/t3code-ops/docs/EVIDENCE.md` is absent. | Use the explicit user brief and existing applicable categories; no external approved-category taxonomy was available to validate. |
| inspection noise | Initial ref parse used the joined branch/SHA string; a broad source read exceeded output limits. | Resolve ref and SHA independently; reread focused sections and inspect the untruncated full diff. |


## Concurrent worktree advance

The initial HEAD and full diff were the requested [d3be7b9378](https://git.cafe/pingdotgg/t3code/commit/d3be7b93785ccd1227374f6daf6f2222e8dcf896). Final read-only status found a clean worktree now at externally created [7a5fcf45e1](https://git.cafe/pingdotgg/t3code/commit/7a5fcf45e1f6df8fd5b1b1c42545ed76c9135b2f). Its only diff adds a guarded reseed retry after repository lookup clears isSubmitting, addressing the requested head's static lookup-overlap concern in source. This report remains pinned to the explicitly requested d3be7b9378; it does not audit or certify native behavior of the later head. No native evidence was added by that source correction. No source or git mutation was performed by this audit.

VERDICT INSUFFICIENT
Missing rows: N0, N1, N2, N3, N4, N5, N6, N7, N8, N9. S0 is limited server-only evidence. Eligible for the explicitly permitted Swift platform exception; native proof is not sufficient.