# Proof audit pass 2

Findings first: **evidence is insufficient for the pass-1 integrated behavior matrix**. No new confirmed implementation defect emerged from this proof-focused inspection. This is an evidence verdict, not disagreement with the two code reviewers’ MERGE decisions.

PR [#19352](https://git.cafe/pingdotgg/t3code/pulls/19352), issue [#19351](https://git.cafe/pingdotgg/t3code/issues/19351).
Pinned fixture evidence: [321edbb8bd](https://git.cafe/pingdotgg/t3code/commit/321edbb8bdf1dca19f779cfeb984ef1d7988b285). Checkout advanced during inspection to [df0337f39e](https://git.cafe/pingdotgg/t3code/commit/df0337f39e); git diff confirms no changes to fixture, Orchestrator, OrchestratorMcpService or subagentProjection from the pinned fixture revision. Seven upstream files changed, including the MCP toolkit description. GitCafe pr view at audit start still reported [589b34e2](https://git.cafe/pingdotgg/t3code/commit/589b34e2bada363733901973a51f61eae1ac612e); therefore local-head evidence must not silently be called verification of the forge-reported revision. No push requested or performed.

## Evidence validated

Read committed runner end to end and traced production resolver/finalizer/read-page paths plus permanent regression tests. Independently parsed all 62 trace records and verified every indexed artifact checksum. All four delegated/monitor x completed/failed cases have internally consistent identities: cancelled queue run, its moved message on the active joined run, promoted task/node/item running with absent summary, terminal result from that joined run, exactly one transfer for that run, shared result transfer ID, and acknowledged task identities 2/1. Twelve negative page reads retain claimed delivery. Original delegation's INITIAL_DONE transfer is separate and must not be mistaken for a duplicate joined result.

The source dispatches actual delegated_task.request, message.dispatch and queued-message.promote-to-steer; a deterministic adapter receives steer before completion is released. A real event sink, SQLite projections and effect worker execute the lifecycle. MCP service reads use a forwarding ThreadManagement facade. The assistant message/item are written synthetically through EventSink before the adapter terminal event; failed result pages contain provider_error items. This supports server-service behavior and identity assertions. It is not real transport, live inference, pixel, native-client or process-restart proof.

Runtime artifact [index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/80c1490771cdf358/19352-headless-runtime.txt), [archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2c65aeb4a6c43c2c/19352-headless-runtime.tar.gz). Fixture hash independently matches 39c9a4d23747bd43bcaeefee000bb0e524627ebcb034b138769ef1b1ada27144.

Baseline main [8acbefefc5](https://git.cafe/pingdotgg/t3code/commit/8acbefefc51b4d281dcd04108c82baa1ab902b0e) has a lead-owned [recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1148e2500a0096d0/mcp-launch-client-3a4d8f55b3-b4a3-4452-a0bb-549d6f59fde1-fwd-3aa767d85dd83e0c560-171b3392-4fff-4ea1-879c-9bac1f85ce45-mp4.mp4) and [runtime trace](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0cdf41de611d50ec/main-runtime.txt) showing false cancellation while the target continues, then FOLLOWUP_DONE. Read local trace/handoff; did not independently replay the video in a browser. No after capture supplied at report creation.

## Row verdicts

| Row | Status | Accepted proof and remaining difference |
|---|---|---|
| 1 queued/held opening | PARTIAL | Queued task_status with absent result exists. No held/idle runtime opening or client clip. Permanent test seeds idle; it does not demonstrate queue interaction. |
| 2 promotion while active | PARTIAL | Actual promotion, moved-message intent, cancelled queue, running stored task/node/item, MCP running/working and result-pending proven. No fixed-client click/keyboard footage or bounded follow-up wait transcript. |
| 3 delegated completion | PARTIAL | Joined completed result, shared transfer and final parent projections proven. No visible held interval, no-flash sequence, or result-detail recording. |
| 4 held opening and failure | PARTIAL | Actual joined failure and correct error result proven. Held opening is synthetic-test-only; no failure card/detail footage. |
| 5 taskless monitor | PARTIAL | Actual monitor notification topology, no active owner task, running-to-terminal and one transfer proven, including failed variant. No client sequence. |
| 6 restart chain | PARTIAL | Permanent source test constructs two cuts, second before start, and verifies pending/final chain result; unrelated later continuation tested for delegated and ownerless monitor. Not included in runtime artifact; no actual process restart/reconnect recording. |
| 7 assistant-only acknowledgement | SUFFICIENT (service) | One result page excluding moved user message acknowledges correct 2/1 task IDs and exposes same joined transfer; failure error pages also covered. |
| 8 pagination guards | SUFFICIENT (service) | Non-result, truncated and nonzero-offset reads leave delivery claimed, followed by eligible page acknowledgement in all four cases. |
| 9 idempotency/reconnect | PARTIAL | Repeated recovery/read leaves tasks, runs and transfers identical. No real reconnect or terminal-card persistence capture. No explicit completion/wake event-count assertion; snapshot stability is narrower. |
| 10 unpromoted controls | PARTIAL | Ordinary INITIAL_DONE setup exercises unpromoted completion. Runtime fixture lacks genuine unpromoted cancellation and explicit unrelated-result rejection control. Existing general tests do not replace a recorded control claim. |
| 11 joined boundary statuses | MISSING focused proof | Runtime fixture only exercises held-running -> completed/failed. No promoted-target waiting, starting, interrupted or genuinely cancelled parameter cases. General restart tests cover some non-promoted boundaries only. |

No additional layout/design screenshot matrix is needed. The needed before/after difference is behavioral: same identifiable queued follow-up, actual Steer, sustained running parent card while child is active, joined terminal result detail, then reload/reconnect retaining that result. A still final card cannot prove no stopped flash. Obtain delegated success, held-to-failure and taskless-monitor recordings; add real two-cut restart footage for any claim of actual restart verification. Include brief keyboard promotion on web. Native mobile and desktop remain unverified; native clips are required only for claims that those clients were verified, not a new Cartesian matrix.

## Limits and minimum follow-up

Do not add a nonexistent task_wait capability just to satisfy the old wording. Current source has private waitForTask reached by delegate_task(mode=wait), with no way to select queued follow-up B. task_status and delegatedTaskResultPending are proven; bounded B wait is unavailable/not performed, not passed. This is not an auth/MCP hard stop.

Preserve the disclosed async promotion-sync crash window: immediate persisted parent state may remain pending until subagent.updated; fixture waits for that milestone. It does not establish atomic synchronization. Completion-before-steer-delivery fallback is also not exercised, because the fixture deliberately gates completion on steer receipt.

The lead reports two final code reviewers MERGE and focused post-merge tests pending. Those are separate from this proof audit. No typecheck/build or full-suite repetition requested or run here. Independent serial rerun completed successfully at df0337f39e: 4/4 cases passed, exit 0. Fresh artifacts: /tmp/t3-promoted-delegation-LKKyxC/{manifest.json,trace.ndjson,verdict.json}. Manifest reports clean tracked files and the identical fixture hash. This independently reproduces all four service scenarios after the main merge; it adds no UI or real-restart coverage.

## FRICTION

- Read-only scope honored: no edits inside checkout, pushes, posted comments/reviews, browser or listening server. Report/artifacts live outside the checkout.
- Host contention delayed import/output during independent rerun. Both the original artifact validation and fresh 4/4 post-merge execution are distinguished above.
- Lead owns Chrome/client capture. Installation/loading and preview failures do not constitute after proof. No new after recording available at report creation.
- Native clients and real process restart not performed. No auth/MCP hard-stop requirement introduced.

VERDICT: INSUFFICIENT — incomplete rows 1–6, 9–11; rows 7–8 sufficient as service evidence. Native-client claims remain unverified. Await after recordings and concrete restart/control evidence or explicitly narrow the acceptance scope.