# PR #21460 proof audit, pass 2 (fresh auditor)

Code under proof: 4cc74410d2. Branch head: 9b97de29a6. BEFORE: 8d3b061121.

## SHA and scope checks
- `git diff --stat 4cc74410d2 origin/takeover/opencode-pending-snapshots`: the only difference is `OpenCode2PendingSnapshots.evidence.test.ts` (+159). Branch head is 9b97de29a6bf. Confirmed.
- merge-base(4cc74410d2, origin/main) = 8d3b061121fe. Confirmed.
- The transcript headers give "SHA under test" as 8d3b0611… (before) and 4cc74410… (after). Both match. `git -C cap/before rev-parse HEAD` = 8d3b0611…
- The driver file in the BEFORE worktree is byte-identical (`cmp`) to the committed 9b97de29a6 copy.
- 8d3b061121..4cc74410d2 touches 3 files: the adapter, `ProviderAdapter.ts` (+2) and `OpenCode2AdapterV2.test.ts`. No fixture, harness or orchestrator files differ.
- Labels are honest. Each transcript header says "recorded fixtures, NOT a running server, NOT live OpenCode". It also explains that the adapter stream is tapped because of the drop at ProviderEventIngestor.ts:565. SUMMARY.md has the same caveats and a "Not verified" section.

## Independent rebuild (task 2)
Steps: `git worktree add --detach /tmp/ev-21460/audit2 9b97de29a6` (HEAD verified), then `pnpm install --offline` (ok), then `EV_TRANSCRIPT=… vp test run …evidence.test.ts`.
- Result: 6/6 passed, the same as driver-after.vitest.log.
- R1 section: 56 lines, **identical** to transcript-after.txt R1 after normalizing the run-specific root-turn native id. In practice the id also matched unnormalized, because the fixture UUIDs are deterministic.
- The whole transcript body (excluding `#` header) is identical to transcript-after.txt (`diff` empty).
- The worktree was removed afterwards (`git worktree remove --force`). It no longer shows in `git worktree list`.

## Row table
| row | capture | BEFORE | AFTER | supports claim? | label |
|---|---|---|---|---|---|
| R1 nested background | transcript-before/after (opencode2_nested_background), named test R1, my rebuild | FAIL: flag absent. Domain: middle session never lists the grandchild call (0 rows), 12 provider-thread.updated rows | PASS. Ordered: middle/root `true` from adapter[52-53], held through root turn completed (111) and grandchild completion (139-146), then `false` only after middle turn:2 completes (163-164). Domain: middle lists the grandchild in 3 rows, 19 rows total | Yes. Caveat: the BEFORE "FAIL" is partly tautological because the field did not exist. The real BEFORE/AFTER discriminator is the intermediate-ancestor roster refresh, which is visible at the domain level. The driver asserts only "≥1 true and every final value false". Ordering is visible in the transcript, and the named adapter test asserts it | recorded, harness |
| R1-compat | opencode2_background | FAIL (flag absent, tautological) | PASS | Yes (compat + snapshot settles false) | recorded, harness |
| R2 held wake → caller | named-after / named-after-minus-2-lines / named-before-transplanted | FAIL (120 s timeout, no true snapshot) | PASS. With the two 4cc74410d2 lines reverted: FAIL at :1421, caller stays `true` | Yes. This is the only row where 4cc74410d2 itself is discriminating, and the red diff is exactly the two `syncRosterAncestors(state)` lines | synthetic test only, no fixture |
| R2b cancelled report during held wake | named logs | FAIL (:1339 undefined≠false) | PASS. Also passes without the two lines, as expected: it belongs to the parent commit's change | Yes | synthetic test only |
| R2c-compat reconcile/interrupt | opencode2_resume_after_restart, opencode2_interrupt | PASS | PASS, no thread ends on `true` | Compatibility only. The reconcile/`discardWakes` emission is not asserted | recorded, harness |
| R3 single-session | opencode2_simple, opencode2_tool_call | PASS | PASS (fixture output.ts unchanged, extra snapshot rows only) | Yes (no regression) | recorded, harness |
| scoped suites | scoped-tests-after.log | – | 102/102 | regression | test |

## Unverified rows (task 3)
1. **Live OpenCode ≥2.0 run.** The box has opencode 1.18.18 and no auth, so the v2 adapter is unreachable. This is an acceptable gap. The recorded fixtures are real OpenCode 2 transcripts, and they drive the real orchestrator stack.
2. **Real `bin.ts` server / WS client observation.** No HTTP/SSE OpenCode 2 fake exists, and at this head `pendingBackgroundWork` is dropped at ProviderEventIngestor.ts:565, so a client could not see the flag anyway. Acceptable: the user-observable effect belongs to stacked #21461 and must be proven there. Only the domain-row refresh of intermediate ancestors is observable at this head, and the harness shows it (0 → 3 middle rows).
3. **R2 `takeRunningWake` call site (adapter.ts:3287) on its own.** The red run removed both lines together. Only the `runWake` path has a dedicated test. Minor gap, acceptable: the change at that site is the same one-line call after the same `replay(wake)`.
4. **R2c reconcile/`discardWakes` `syncRosterAncestors` emissions.** Covered only by compat replays, with no focused assertion. Acceptable as a non-blocking gap: the compat fixtures pass and end on `false`/no `true`. It would be worth a test in #21461, where the flag is consumed.
5. **R2/R2b have no recorded fixture.** The race isn't practical to drive by prompt, so these rows rest on synthetic adapter tests with before/after/red logs. Acceptable for an adapter-internal fix.

Conclusion: every matrix row is covered at the strength its label claims. The SHAs match, my rebuild reproduced R1 and the full AFTER transcript byte-for-byte, and the remaining gaps are inherent to a server-only change whose client-visible effect needs #21461.

AUDIT: SUFFICIENT