# Manual proof procedure

AI-assisted; verified with the tests and tools listed above.

## Environment

Two exact detached checkouts; isolated fresh databases created with T3CODE_DEV_SEED=0 and T3CODE_AUTO_BOOTSTRAP_PROJECT_FROM_CWD=0. No live database was copied. Synthetic git project named Reasoning proof, identical agent and command fixtures, same light theme. Web: Chromium 1280x800 CSS pixels (screenshots DPR 2). Desktop: actual Linux Electron under headless-desktop, 1100x780, each checkout's own compiled desktop and server with its matching Vite web client. OpenCode 1.19.5 was real, not a replay or a mocked response. The transparent HTTP proxy forwarded unchanged request bytes to the real OpenCode server; only its evidence view redacts identifiers.

The scenario guide was read from current main. Manual verification was chosen because the requested proof requires OpenCode's real catalog and outgoing provider protocol, which the replay provider cannot demonstrate.

## Fixtures and commands

Start OpenCode on port 41900 with a primary agent `proof` whose prompt is `Reply with exactly: Agent Proof complete. Do not use tools.` and no tools. Register native command `proof` with template `Reply with exactly: Native command complete.` and agent `proof`. Start proxy-driver.mjs on 41901; configure both T3 OpenCode instances' externalUrl to that proxy. Configure textGenerationModelSelection with a real catalog model advertising an empty variants map, plus options [{"id":"variant","value":"medium"}]. The secondary catalog model's display name alone was changed to Catalog Proof for privacy; variants were not changed.

Create the synthetic project with the app CLI. In an authenticated Vite browser, evaluate browser-seed.js with checkoutPath, projectId and the catalog model identifier as parameters. The initial Agent-change thread has no selected options. The saved-selection thread starts with medium plus agent proof through the real thread-create RPC. Repeat on each commit.

1. Select the reported empty-variants catalog model. Open model options, search its name so unrelated model identifiers are hidden. Capture invented Reasoning choices on base, their absence and retained Agent on head.
2. Change Agent from Build to Proof, close the menu, send `Reply with exactly: Agent Proof complete. Do not use tools.`. Mark the proxy phase before sending. Observe completion and the forwarded prompt_async request. Automatic title generation also calls the real text-generation path (session/message); inspect both payloads.
3. Reopen the synthetic saved-medium thread without changing options, send the same message. For the web send, head normalizes the selection. Separately create a saved-medium thread using the reported catalog model, open it in the browser, and invoke the actual server CLI: `node apps/server/src/bin.ts thread send THREAD 'Reply with exactly: Agent Proof complete. Do not use tools.' --base-dir .t3 --wait --json`. Both sides complete; read-only SQLite inspection confirms medium remains stored on both sides. This isolates server recovery from UI normalization.
4. Send `/proof` as a native command, observe `Native command complete.` and session/command payload. Also invoke `/proof` with the CLI against the still-saved-medium thread to exercise the adapter without UI normalization.
5. In each actual Electron app, open the same catalog model options. The desktop screenshots cover options rendering only.

Before each static capture, compare two screenshots 500ms apart; all final static pairs were pixel-identical. Every submitted image was opened and every recording inspected through extracted frames. Recordings include an appended seven-second still of the actual request inspector for that exact phase, making payloads readable without relying on a text transcript. A grey rectangle masks environment details. The recorded interaction is otherwise unchanged; server-stale clips retain the first 25 seconds, including completed replies. Request inspection uses Object.hasOwn(payload, 'variant'), so absent and null are distinct.

## Scope and limits

Base demonstrably offers invented Reasoning and sends medium; head hides Reasoning, retains Agent, omits the property, and completes. The current upstream accepted base requests too: the historical `Variant unavailable` rejection itself was not reproduced. Text generation and native commands were executed against real OpenCode. Desktop options were exercised; desktop full turns and mobile were not. The Android pool worker stayed disconnected through retry. The unrelated pending-steer admission/interruption behavior was not exercised.