# Issue 19124 — proof audit pass 1

Scope: branch `fix/issue-19124`, diff `70e5e384da..13f0f0a1d4`, read-only inspection in `/home/ubuntu/wt/issue-19124`. Inspected HEAD: `13f0f0a1d4800b575147a24da1cd9d05a84ea2da`. No PR. No source edits, tests, browser, or server launched by this reviewer.

## Named fixture matrix: issue-19124-render-fixtures-v1

**Empty: 0 rows.** The diff changes only `apps/server/src/orchestration-v2/ProviderTurnStartService.ts` and its test. No changed render paths, client callers, client conditions, or client interactions. The server-only empty-matrix exception applies. No interaction/time recording rows, screenshots, viewport grid, or theme grid required.

## Changed server behavior (proof scope, not UI matrix rows)

A normal provider turn on a thread with a missing managed worktree and recorded branch first prunes stale worktrees and tries to check out the recorded branch. Only `ref_not_found` now retries with `refName: HEAD`, `newRefName: <recorded branch>`, and the same path, using the project workspace root as cwd. Existing-branch success, non-ref errors, fallback failures, interruption handling, managed-path eligibility, and missing-project handling retain their existing control flow. Auth/local command early returns precede recovery and are unchanged.

The new focused regression test simulates missing-ref failure and successful branch recreation. It checks the final call's cwd, branch name, and path. It intentionally fails later during projection reads; it is not proof that a provider starts. It does not explicitly assert `refName: HEAD`, exactly two calls, or no fallback on unrelated errors. These are limitations of the unit assertion; no concrete implementation defect found in this proof audit. Runtime evidence must supply end-to-end continuation proof.

## Minimal required evidence

1. Focused regression output showing the new deleted-branch test fails against the baseline implementation and passes at the fixed commit. Include command, revisions, failing assertion, and exit statuses. A passing focused file run covers the existing managed-location controls. No repo-wide typecheck needed.
2. Baseline runtime transcript: completed thread in a managed worktree; merge into project checkout; remove worktree and delete branch; send follow-up; observe missing-workspace/provider failure. The supplied transcript satisfies this baseline and also demonstrates branch-existing recovery.
3. Fixed runtime transcript at `13f0f0a1d4`: same managed thread/path and branch absent before sending `AFTER_FIX`; send follow-up; server recreates exact path and branch; Codex replies `AFTER_FIX`. Include revision/environment, cleanup commands or observations proving both absences, recovery log or filesystem/git observations proving recreation, and final response. Record resulting branch HEAD/base if available, since fallback deliberately uses project checkout HEAD.

Baseline artifact inspected: [runtime before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/de9f0d1d1e83264c/issue-19124-runtime-before.txt).

## Evidence status and gaps

- Baseline: inspected; Linux x86_64, web dev app, Codex CLI 0.163.0 / GPT-6.1-Sol, isolated state. Missing branch fails repeatedly; restoring branch alone lets server recover the path and resume.
- After: lead reports completed real-app run at fixed commit, removed managed path and deleted `t3/reply-ready` again, sent `AFTER_FIX`, server recreated same path/branch and Codex replied `AFTER_FIX`. Transcript is being generated; not independently inspected in this pass.
- Red/green regression output: not supplied or inspected in this pass. Test source exists, which is not execution evidence.
- Proof disposition: server-only applicability accepted; evidence package remains pending the fixed runtime transcript and red/green output. No additional UI proof required.

## Affected surfaces and limits

Web, desktop, and mobile clients share this server recovery path. Provider startup recovery is before provider execution and is not Codex-specific. Direct runtime validation is Linux/web/Codex only; desktop shell, native mobile, other operating systems, other providers, and remote/relay/tunnel modes have not been runtime-tested here. No client render or wire-contract changes; do not claim those surfaces were directly exercised. MCP/scheduled callers reaching the same service receive the same recovery behavior; no separate entry-point implementation changed.

## FRICTION category | happened | avoided

| category | happened | avoided |
| --- | --- | --- |
| Evidence availability | Fixed transcript still being generated; red/green output absent from reviewer input. | No pass claim based only on reported success or test source. |
| Scope | Server-only diff, zero rendering changes. | No unnecessary UI fixture/theme/viewport or recording requirement. |
| Operational isolation | Read-only source and baseline-artifact inspection only. | No browser/server launch, source edits, push, comments, PR creation, or watcher. |