# Capture execution status — 2026-10-24

F1 and B1 captured (2/2) at BEFORE [b1622197fa](https://git.cafe/pingdotgg/t3code/commit/b1622197fa0d2177053b57198b7bbc9e753b4f58) / AFTER [86f313103d](https://git.cafe/pingdotgg/t3code/commit/86f313103db553087566fef071a1835a54c3ceb5). This is capture status; fresh independent proof audit remains pending. The detailed governing matrix follows unchanged below.

| Row | Execution result | Primary evidence |
|---|---|---|
| F1 | Normal finite control, pre-decoder real-Chunk interception, OPEN-socket error, no late automatic replacement, explicit Retry completion, close/reopen | [BEFORE video](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0933dfcdb2edaaa7/F1-before.mp4) / [AFTER video](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2bcecdf31c54f722/F1-after.mp4) |
| B1 | Valid first values before all faults, healthy gap, 250→500→1k→2k→4k→8k→16k→30k→30k, session reset to 250ms, old retry cancellation, final normal recovery | [BEFORE video](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a546549985157b81/B1-before.mp4) / [AFTER video](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0265913f3700df29/B1-after.mp4) |

All main endpoints have independently stable RGB duplicates >550ms apart, inspected Diff0 ×8 and threshold16. Transcripts: [BEFORE](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b2110e294a34398e/before-transcript.json) / [AFTER](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b58abb8a48f5c80d/after-transcript.json).

---

# Updated proof matrix — read-only pass 1 after bot fixes

Scope: [#4589](https://github.com/pingdotgg/t3code/issues/4589), [#24400](https://github.com/pingdotgg/t3code/pull/24400). Audited checkout HEAD [86f313103d](https://git.cafe/pingdotgg/t3code/commit/86f313103d). Full diff against [fef851bee0](https://git.cafe/pingdotgg/t3code/commit/fef851bee0); increment against [b1622197fa](https://git.cafe/pingdotgg/t3code/commit/b1622197fa). Full diff changes only RPC runtime plus two focused test files. This is a proof-scope audit, not an implementation verdict.

## Decision

Reuse all six accepted original rows for their original first-failure and normal/reconnect claims. Add two current-HEAD real-app interaction recordings: F1 progressive Find decoder failure/retry, and B1 shell repeated-fault/backoff/session replacement. No wholesale V1–V6 refresh and no new four-way viewport/theme sweep is necessary: no component, CSS, breakpoint, or rendering implementation changed. The finite failure makes an existing error UI reachable again; verify it in the real app once, rather than treating it as a redesigned component. If F1 discovers clipping or a new rendering defect, expand only that path to 1440/390 × light/dark.

Old evidence remains explicitly captured BASE [27e0c684c5](https://git.cafe/pingdotgg/t3code/commit/27e0c684c5) / HEAD [383a473f2e](https://git.cafe/pingdotgg/t3code/commit/383a473f2e), never relabeled as current-HEAD execution. [Original corrected public index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e472b85181cef193/index.md) contains all recordings, matched stills, amplified Diff0 ×8, threshold16, and corrected RGB-stable duplicates. Their prior SUFFICIENT audit is accepted as input; this pass did not independently re-open every video or image.

| Row | Surface/state | Target tag(s) | Disposition / precise claim |
|---|---|---|---|
| V1 | Shell 1440×900 light; normal settle/unsettle, ordinary reconnect, first malformed Chunk then unsettle | `orchestration.subscribeShell` | REUSE captured old SHAs. First retry still 250ms; same recomputed input, same state application. Normal paths/session switch unchanged. Does not prove repeated backoff. |
| V2 | Shell 390×844 light / drawer | `orchestration.subscribeShell` | REUSE first-failure interaction and compact presentation at old SHAs. |
| V3 | Shell 1440×900 dark | `orchestration.subscribeShell` | REUSE first-failure interaction and dark presentation at old SHAs. |
| V4 | Shell 390×844 dark / drawer | `orchestration.subscribeShell` | REUSE first-failure interaction and compact dark presentation at old SHAs. |
| V5 | Selected thread 1440×900 light; syncing banner clears after first fault | `orchestration.subscribeThread` | REUSE. Same first 250ms retry, cursor recomputation and completion marker consumer. Healthy shell also updates title, so title alone is not selected-stream proof. |
| V6 | Terminal drawer 1440×900 light; BEFORE → AFTER after first fault | `terminal.attach`, `subscribeTerminalMetadata` | REUSE. Same first 1s default delay; attach still recomputes `resume:true` and retains terminal identity. Old row does not prove `terminal.observe`. |
| F1 | Selected persisted thread, Find open, query → Search failed → Retry → completed result; close/reopen | `orchestration.searchThreadStream` | NEW at exact current HEAD, 1440×900 light. Prove error reaches real UI, no automatic same-session replacement, explicit retry succeeds. Also retain normal finite completion control. |
| B1 | Shell with valid metadata before each injected fault; recovery, isolated later fault, capped retry, session replacement | `orchestration.subscribeShell` | NEW at exact current HEAD, 1440×900 light. Record real interaction plus timestamps/IDs/socket identity; prove growth despite valid first values, 30s cap, accumulation across healthy gaps, reset on replacement and cancellation of old retry. |

## Source basis and caller equivalence

[client.ts](https://git.cafe/pingdotgg/t3code/blob/86f313103d/packages/client-runtime/src/rpc/client.ts): per-subscription session closure starts both counters at zero; `onFirst` resets only domain counter. Stream faults increment a separate counter. First delay therefore remains options base (shell/thread 250ms), or default 1s (terminal and generic atoms). Same-session transport/decode recovery uses the same recursive input recomputation. `switchMap` replaces/cancels the old session branch. A foreground explicit resubscription also recreates this closure; do not mislabel a focus/wake reset as a replacement-session test.

The only tag exception is `orchestration.searchThreadStream`: transport failure drains and waits for session replacement as before the feature; a SchemaError defect fails through to its consumer as before the feature. It does not silently restart. [orchestration.ts](https://git.cafe/pingdotgg/t3code/blob/86f313103d/packages/client-runtime/src/state/orchestration.ts) uses `completeWhen: result.complete !== false`, zero idle TTL. [useThreadFind.ts](https://git.cafe/pingdotgg/t3code/blob/86f313103d/apps/web/src/components/chat/useThreadFind.ts) maps the failed atom to error; [ThreadFindBar.tsx](https://git.cafe/pingdotgg/t3code/blob/86f313103d/apps/web/src/components/chat/ThreadFindBar.tsx) already renders Search failed and Retry. Command palette and chat keybinding converge on this controller. Web/desktop share this UI; no mobile progressive Find caller was found. Responsive web is not native-mobile proof.

Other direct/generic durable callers share that same branch and add no distinct changed counter policy: server config/lifecycle and welcome (state/server.ts); auth access (auth.ts); terminal observe/events/metadata/attach (terminal.ts); orchestration shell/thread/expanded command output (orchestration.ts plus shell.ts/threads.ts); preview events/discovered servers (preview.ts); device state (device.ts); VCS status/worktree setup (vcs.ts); project clone progress (sourceControl.ts); PR refresh notifications (pullRequests.ts); storage cleanup report/provider auth/Codex callback/provider install/scheduled tasks/resource telemetry (server.ts). These are source-audited affected consumers, not individually exercised app passes. Generic atom creation funnels through [runtime.ts](https://git.cafe/pingdotgg/t3code/blob/86f313103d/packages/client-runtime/src/state/runtime.ts). No account/provider, PR, cloud device, or long clone fixture is needed to re-prove the common retry counter. Do not claim their product-specific recovery/resume behavior from B1. ChatGPT handoff uses `runStream`, bypassing this changed durable branch; unary calls likewise do not apply.

## Smallest fixture and concrete capture steps

Lead owns one isolated current-HEAD server after tests; capturers attach only. Persist one project and one stopped thread; no scheduled task, pending turn or live provider. Existing minimal fixture suffices, including an empty persisted thread for a zero-match Find result. Use a nonempty query. Do not start a provider to manufacture history. Pair privately. No live userdata writes. Use selected-thread route generated by the app, not an invented ID/URL; seed IDs are environment-local. Verify progressive capability `threadFindProgressive:true` and an actual `orchestration.searchThreadStream` request rather than unary search.

Reuse [public reproduction](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/244e395a27a58a24/reproduction.md) and [public driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56a15d832e1e01de/browser-driver.js), replacing hardcoded fixture IDs. Install tracking before app subscriptions. Track request tag/ID, socket, monotonic timestamp, incoming Chunk/Exit, faults and successful unary receipts. Never upload socket URLs containing auth, cookies, settings/secrets, DB or pairing material.

F1:
1. Load the selected stopped thread at 1440×900 light; confirm fonts and RPC readiness. Open Find via normal keybinding or command palette. Run a normal query once and show completion without retries.
2. Arm one targeted incoming-frame replacement before entering a fresh query. Tiny searches may finish in one Chunk: post-typing `fault()` is racy. Intercept the first real incoming Chunk for this tag/current request ID before the app listener decodes it, replace only its values with the driver's invalid item, and log original frame plus controlled replacement. Install the receive hook before app listeners (init instrumentation/reload if necessary). Keep every other tag/frame unmodified; do not synthesize React state, error props or atom results. A simple late receive listener cannot suppress the app's earlier listener.
3. Record query, Search failed and Retry. Keep socket OPEN; observe no replacement search request for >1s (the erroneous finite retry's former base is 1s), then click Retry with injection disarmed. Assert a fresh real request ID and completed result/zero matches, settled busy state, then Close find and reopen. Capture error endpoint before clicking Retry plus completed endpoint.
4. Optional finite transport control is a focused runtime test/transcript, not another four-way UI recording. Keep its claim separate: transport drains awaiting replacement; it is not the decoder-error UI case.

B1:
1. Open shell/sidebar; settle thread. Track actual current shell request. Before each fault, receive valid shell metadata/completion on that request; inject only malformed Chunk into it, while keeping the same socket OPEN. Send real unsettle/settle commands and verify receipts plus shell changes after recovery, without reload.
2. Repeat faults on successive current request IDs. Measure fault timestamp → replacement Request timestamp, not request → request (fixture/metadata waiting adds time). Expected delays 250, 500, 1000, 2000, 4000, 8000, 16000, 30000, 30000ms, with browser scheduling tolerance recorded, not a pixel-perfect timing assertion. This takes at least 91.75s of retry waits. Keep focus/wake resubscription out of the run.
3. Include a healthy gap after an earlier recovery, then another fault: next delay continues growing rather than resetting. Log valid first values so a continuously zero-value failure cannot falsely prove the metadata regression fix.
4. During a later pending capped retry, close only the tracked app socket (never Vite). Let supervisor replace it. Fault the new session's shell once: delay returns to approximately 250ms. Wait beyond the old pending deadline and confirm no old-session retry escapes; verify the current stream remains live. Disarm injection and show a final normal settle/unsettle recovery. Transcript establishes IDs, same/replaced session, delays and cancellation; video establishes visible interaction.

For each NEW row: exact build SHA, browser/CSS viewport/DPR/theme, recorded narration/time labels, endpoint stills plus independently stable duplicate RGB pairs, and request transcript. For a paired comparison retain native exported dimensions, Diff0 ×8 and threshold16. Current HEAD proof can be compared with the prior increment only if that build is separately available; the minimum does not require starting a second server. Old baseline is not an increment-before capture and must not be labeled so. Video and timestamp transcript are the primary evidence for timing; static diffs cannot prove backoff. No need to manufacture changing pixels during each wait.

## Tests and FRICTION

35/35 including finite error-atom red/green and backoff/cap/reset is lead-reported input, not rerun by this read-only auditor. Keep focused test output attached to exact HEAD. Those tests cover deterministic policy details; B1/F1 add real client integration. Domain/auth/normal completion paths should stay assigned to focused tests rather than account fixtures. No implementation verdict.

FRICTION: natural incident trigger remains unknown; controlled decoder fault must be labeled. Old recordings are historical exact-SHA proof, not new-HEAD recordings. Finite receive interception is a new driver requirement; the existing late fault helper alone is insufficient. Lead must supply server URL and fixture IDs privately; capturers must not start servers. Browser scheduling affects timings; transcript required. Existing PNG downscale and reduced-motion limitations remain documented in original evidence. Native clients, remote/relay/tunnel, provider-specific flows and other consumers are not newly verified. No edits/pushes/comments, tests, servers or browser use occurred in this pass; scratch/downloads only under /tmp/issue-4589-proof-r2.