# Proof audit pass 1 — issue 8963

Issue: [#8963](https://git.cafe/pingdotgg/t3code/issues/8963). Read-only inspection of the entire two-file diff, base [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121) to head [476597e33b](https://git.cafe/pingdotgg/t3code/commit/476597e33b), branch fix/issue-8963. No PR. No code changes, captures, server operations, pushes or comments performed for this audit. Prior independent reviewers both report MERGE after the queued-edit target correction; no unresolved review findings in this proof audit. Matrix below specifies evidence still to collect, not completed verification.

## Scope and minimum evidence

The production caller is ChatView; the other caller is the navigation browser-test probe. Web and Electron desktop share this hook. Ordinary thread draft and temporary queued-edit draft are distinct targets. Cancelled and expired user-input requests now transfer changed custom answers into the owning environment/thread draft before pruning question drafts. Resolved, pending, missing, unchanged initial answers and blank custom answers do not transfer. Multiple questions concatenate in question order, trim answer edges and separate nonempty text with two newlines. Referenced thread-context records transfer before cleanup; deleted reference records must not transfer. Existing thread draft text and context records must survive.

All rows involve interaction or time and require RECORDING, including negative outcomes. Screenshots alone cannot establish preservation across Stop. Minimum core capture set: R1 before and after at **1440/light, 1440/dark, 390/light, 390/dark** CSS viewport widths (use a consistent viewport height, e.g. 900). This is eight short clips, or four clearly labeled continuous before/after pairs from separate base and head sessions. Replay R1 identically on base and head. Do not run a base bundle against head runtime/state without the runtime lead establishing compatible isolated sessions. Other rows need head recordings once at the assigned combination below; combine consecutive negative subcases in one clip. Do not multiply the whole matrix by four: typography is unchanged. R2 provides narrow long-content stress; R3 provides dark narrow queued-edit coverage. Every clip shows typed pending answer, triggering action and resulting composer; do not cut across the transition. Label actual measured width, theme and revision.

| ID / capture | Exact synthetic fixture and interaction | Required observable result | Practical seed / boundary |
|---|---|---|---|
| R1 RECORDING; four width/theme combinations, base + head | Thread `Proof A`; empty ordinary draft. Real Codex async question `Which color?`, options Purple/Green, custom enabled. Type `Purple please. Keep this unsent answer.` while run remains in `sleep 120`; click Stop. | Base composer loses answer; head composer retains exact trimmed answer once; question closes. Edit the restored text to show it is usable. | Real app/provider flow S1. Lead already reproduced this flow; recreate with clean synthetic state for public evidence. |
| R2 RECORDING; 390/light | `Proof A` ordinary draft `Earlier draft`; retain existing reference to `Proof B`. One request with Q1 typed `First answer`, Q2 a 30-line synthetic answer ending `END-8963`, Q3 untouched. Navigate back/forward, add references to `Proof B` and `Proof C` in Q2, delete C chip, then Stop. | Prior draft + blank line + Q1 + blank line + Q2, in order; Q3 adds nothing. Existing B context and referenced question B context remain usable; removed C does not return. Scroll to END; no horizontal spill or obscured editing controls. Revisit A: no duplicate append. | S1 with multiple questions; enter prior draft during the run before question arrives (agent waits 15 seconds first). Use the actual composer thread-reference picker for both existing and question chips. Never substitute plain link text for a structured chip. |
| R3 RECORDING; 390/dark | Queue message `Queued original` during running `Proof A`; open its Edit action (or configured Edit queued message keybinding). Keep a prior ordinary draft `Earlier draft`. With temporary queued edit open, type pending answer `Answer belongs to Proof A`; Stop; cancel queued edit. Revisit A. | Queued edit text is not the destination of carry-back. After cancelling edit, ordinary A draft is `Earlier draft\n\nAnswer belongs to Proof A`; answer remains once. Queue text is not silently replaced by the answer. | S1 + real queue UI. Open queue edit before the async question if necessary (agent delay). UI buttons and keybinding call the same edit path; one entry point sufficient. |
| R4 RECORDING; 1440/dark | One request, Q1 initialAnswer `Seed unchanged` untouched, Q2 initialAnswer `Seed old` changed to `Seed edited`, Q3 empty or spaces only, Q4 option-only selection. Stop. | Only `Seed edited` transfers; unchanged seed, whitespace and selected-option labels do not appear. | Ask provider for these exact initial-answer shapes if its live question tool exposes them. Otherwise use S2 projection fixture, labeled client fixture. Do not call a seed impossible until actual provider tool schema is checked. |
| R5 RECORDING; 1440/light | Fresh request; type `Submitted answer`, submit through question UI and await resolved question. Separate request: type `Still pending`, switch A→B→A without closing it. Separate request: type spaces and Stop with empty ordinary draft. | Resolved answer does not reappear in ordinary draft. Pending answer stays in question editor, without copying into ordinary draft. Blank cancellation leaves composer empty. | S1 real UI submit/navigation/Stop. Submission changes server state: use real runtime response rather than projection fixture for this row. |
| R6 RECORDING; 1440/light | A has two pending requests with distinct IDs: type `Request one` and `Request two` using actual request navigation. Cancel/Stop; return after navigating away and back. | Both available custom drafts transfer once, in runtime-request iteration order and question order, without one request overwriting the other. | S1: two sequential async calls while agent keeps working; confirm both remain pending before typing. If provider only permits one request, use S2 for two-request client path and label it. |
| R7 RECORDING; 1440/dark | In A type pending `A only`; switch to B with draft `B untouched`; cancel A from another authorized app client, then return A. Also switch environment E1→E2→E1 while A pending/closing; E2 has draft `E2 untouched`. | Neither B nor E2 acquires A text; A recovers once when its detail arrives. A loading shell/null detail must not discard question draft. Revisit all destinations. | Real app, second Browser-panel client, synthetic environments only. E2 must be a genuine linked/connected isolated environment. If unavailable, same-ID cross-environment collision and controlled shell-before-detail are S2 harness-only; record them as client isolation proof, not real remote proof. No browser reload: answer store is in memory. |
| R8 RECORDING; 1440/light | Type `Expired answer` in A; keep same browser/tab alive while real runtime recovery closes request as expired; reconnect and revisit A. | Answer transfers once, question closes, no loss during disconnected/loading interval. | Real recovery requires runtime lead's coordinated same-tab restart, outside evidence child's no-server authority. Normal graceful shutdown may yield cancelled rather than expired: inspect status, do not mislabel. If real expiry cannot be obtained within scope, S2 status transition pending→expired proves changed client branch only; explicitly label client fixture, backend expiry unverified. |

## S1 — real app commands and clean setup

Reuse healthy task runtime at web port 7602/server 15642 only after runtime lead confirms synthetic clean state. Existing runtime contains seeded personal thread names: do not publish its sidebar, tabs, search lists, notifications, project paths or terminal output. Collapsing a sidebar is not sufficient assurance. Runtime lead must supply a clean isolated synthetic environment/profile/state before public capture; this audit does not stop or seed that runtime. Use project `Proof workspace`, threads `Proof A`, `Proof B`, `Proof C`, and optional environment `Proof E2`. Create these via normal app project/new-thread actions; B/C each need one synthetic message so context picker records are meaningful.

Reusable full agent prompt: `This is a UI evidence fixture. Do not inspect files or modify code. Run sleep 15 first so I can prepare a composer draft or queued edit. Then use request_user_input to ask an optional asynchronous question with header Color, question Which color?, options Purple and Green, and allow a custom answer. Leave it unanswered and immediately run sleep 120 so Stop remains available. Do not close the question yourself.` Use the current tool's actual asynchronous option/schema; optional async questions are essential, a blocking request cannot execute the following sleep. If a model cannot emit it, reuse the runtime lead's proven Codex configuration rather than inventing a tool flag. For R2/R4/R6 replace the requested question shape with the row's exact data. Confirm actual rendered questions/status before recording; agent prose claiming a tool was called is insufficient.

Queue setup: while agent is sleeping, enter `Queued original` and use Queue; open queue menu Edit (or configured command `thread.editQueuedMessage`); retain its temporary draft until R3's cancel action. Prior ordinary draft is entered after queueing and before opening Edit. For normal rows type `Earlier draft` before question arrival. Context setup: insert B/C using composer thread-reference UI, then remove C in the pending editor. Do not inject Zustand state for shapes reachable through these actions.

Use test-t3-app: preview_status, preview_open if needed, then existing safe pairing/auth and preview snapshots/interactions/recording tools. No own server, no alternate browser. Reuse a single tab per case; navigation preserves in-memory question drafts, reload does not. Never expose pairing URLs/tokens in public media. No actual capture authorization or recording work is implied by this read-only audit.

## S2 — controlled client fixture, only where needed

Existing helper: `node apps/server/scripts/t3-sqlite-state.ts query --base-dir <isolated-home> --sql "PRAGMA table_info(orchestration_v2_projection_runtime_requests)"`; inspect matching threads/turn_items tables and schema first. Runtime lead must stop the isolated server before any direct write. Use `node apps/server/scripts/t3-sqlite-state.ts exec --base-dir <isolated-home> --file /tmp/t3-seed.sql`, one SQL statement per invocation; helper backs up writes. Follow test-t3-app/references/sqlite-fixtures.md. Never write live ~/.t3/userdata, never touch event history, never overwrite the running 7602 state.

Start with app-created synthetic project/thread rows. Seed matching V2 runtime request and user_input_request turn item, with unique request/node/item IDs, matching thread/run IDs and valid ISO times. Runtime request: kind user_input, status pending, responseCapability message (or supported schema object); matching turn item: type user_input_request, same requestId, questions with id/header/question/options/allowCustomAnswer/initialAnswer as needed. Schema source: packages/contracts/src/orchestrationV2.ts; concrete fixture example: ComposerPendingUserInputPanel.navigation.browser.test.tsx questionProjection. Type all custom answers via real client editor after pending fixture is loaded. A closed-at-start fixture proves nothing: carry needs local question draft followed by closed projection.

For exact pending→expired, missing-detail, or otherwise inaccessible provider shape, evidence runner needs a controlled projection-update harness feeding the real ChatView/hook in the same client session, preserving editor-entered stores. SQLite seed alone does not deliver that transition; restarting/reloading casually can erase it or invoke recovery. Existing navigation browser-test probe demonstrates rerendering but does not itself prove full ChatView/queue/context UI. If no such full-app harness is available, mark the row unverified and give runtime lead the fixture needs; do not claim a ready-made harness exists. Projection-only recordings establish client draft behavior, never backend cancellation/expiry/resolution. R1 remains a real app recording regardless of supplemental harness coverage.

## Collapsed states and surface limits

No factorial expansion across providers: hook consumes provider-normalized requests; real Codex supplies integration proof, other providers need no fabricated support claims. Approval/non-user-input requests do not enter new carry loop; structural guards suffice. Missing matching turn item and missing request draft safely skip; use code/test evidence rather than separate public clips. Multiple questions/requests, existing text, blank, unchanged seed, resolved, pending, queued-edit, context records, switch/loading and expired are distinct paths covered above. Removed file/image attachment preservation is outside this diff: it transfers referenced thread contexts, not every attachment kind.

Web/local real path is required. Remote/environment scoping is R7; no separate tunnel transport recording needed for this client-only change. macOS desktop shell/IPC is unverified from Linux; same React code supports shared behavior but does not verify macOS shell. Not a blocker for this scope. Mobile uses separate logic and is unaffected by these two changed web files. Settings/command palette add no independent carry implementation; Stop and queue-edit entry points feed shared state paths. Do not invent screenshot evidence for them.

## FRICTION

| Category | What | Prevention |
|---|---|---|
| Privacy | Existing runtime contains personal seeded thread names. | Runtime lead supplies synthetic clean state before public capture; review all frame contents. |
| Lifecycle | Reload destroys in-memory pending answers; graceful restart may cancel rather than expire. | Keep tab alive; verify actual status; use labeled controlled client transition only when required. |
| Draft target | Queued edit has temporary DraftId and cancel clears it. | R3 must finish by cancelling edit and inspecting owning thread draft. |
| Fixture fidelity | Projection seed has no coherent event history and cannot prove backend behavior. | Keep R1/R5 real; label S2 explicitly; never drive backend assertions from raw projection edits. |
| Provider shape | Async, multiple requests or initialAnswer may not exist in selected tool schema. | Inspect actual supported tool; reuse proven configuration; label only genuinely inaccessible shapes harness-only. |
| Authority | Evidence child cannot start/stop servers or write running SQLite. | Coordinate fixture preparation/recovery with runtime lead; never mutate current runtime. |
| Platform | Linux cannot verify macOS Electron shell over an assumed SSH report. | Report macOS shell unverified without treating shared client fix as blocked. |

Handoff needs: clean synthetic running app with safe auth; base and head sessions for R1; proven Codex async configuration; A/B/C threads; queue Edit availability; thread-reference picker; optional second synthetic client/environment; runtime lead coordination for expiry or explicitly labeled controlled client harness. No source/private data is included in this matrix.