# PASS1 proof audit — issue 15720

Scope: /home/ubuntu/wt/issue-15720, branch fix/issue-15720.
Full diff: base 11adcb0e25 → head 1e0934a32d0fcc7eaee86855a0816926fd74b4fb.
Read-only source audit; no tests, servers, browser, captures, or forge operations performed. This temporary audit artifact and its requested upload are the only writes.

## Decision

Visual fixture matrix: EMPTY (0 rows). All three changed files are server adapter code or server tests. No changed render caller, branch, layout shape, width, theme, or client interaction implementation exists in this diff. Web/desktop/mobile, narrow/wide, light/dark are not visual permutations for this fix. No screenshot or recording is required under the supplied server-only issue-procedure exception. The affected behavior is interactive and timing-sensitive; use a timestamped runtime transcript rather than visual capture.

PASS1 proof status: INCOMPLETE pending final-head runtime evidence and a recorded red regression. Reported 215 passing tests is supplied context, not independently verified. Reported main web reproduction (>70 seconds without a steer reply) establishes the symptom; previous-head 154b55fce3 reply in 1.4 seconds does not prove final head.

## Changed paths and operational fixture matrix

| Fixture | Changed branch / caller | Required observable proof | Evidence mode / current gap |
| --- | --- | --- | --- |
| F1 foreground Bash, no pending input | ProviderTurnControlService → ProviderSessionManager → Claude steerTurn; active Bash and pendingRuntimeRequests.size === 0 | Existing live query receives interrupt before priority-now offer; slow Bash is interrupted; exact STEERED_NOW arrives before the deliberately slow command would finish; no replacement query/session, premature terminal event, duplicate response, or abandoned running turn | Red test + final-head real SDK/CLI runtime transcript REQUIRED; timing/interaction affected, recording exempt |
| F2 pending question and pending approval | Same steer path, active Bash, pendingRuntimeRequests.size > 0 | No interrupt; priority-now message offered; pending question/approval remains unanswered until explicit answer and can then resolve normally; no synthetic denial/cancellation | Focused deterministic proof for both question and approval; added question test asserts only no interrupt and priority, not successful later resolution; approval fixture absent from added tests |
| F3 normal completion during interrupt | Interrupt begins; result completes active turn before interrupt returns; failIfTurnEnded rechecks activeTurn and queryContext | Steer fails; no offer into ended query; orchestrator delivers follow-up once as tracked work, no untracked native work | Added Deferred-driven unit test proves adapter rejection/no offer; focused completion integration evidence needed for tracked follow-up, not a timing-dependent manual race |
| F4 interrupt failure while turn stays active | catch warning then recheck then offer | Warning recorded; priority-now steer still offered; aborted segment does not strand the turn | Added unit test proves offer; deterministic segment/result continuation proof needed; no separate real CLI fault injection necessary |
| F5 no active Bash / foreground subagents | Existing backgroundForegroundSubagents before interrupt gate; no Bash skips interrupt | No new interrupt without active Bash; foreground subagent preservation precedes interrupt when Bash coexists; steering continues | Reuse focused existing regression coverage; real multi-subagent demo not minimum proof |
| F6 automatic delivery modes | Changed ClaudeAutomaticDelivery integration mock branches: user steering and promoted queued message interrupt; child completion and scheduled message must not interrupt | Both steer modes abort foreground build while preserving intended automatic-delivery behavior; non-steer modes never interrupt | Existing four-case integration test output at final head; mocked SDK is not real-runtime proof |

## Minimum evidence package

1. Regression transcript: run the added foreground-command regression against the base implementation and show it fails because interrupt was not called, then show it passes with final implementation. Record exact commits, command, test name, expected failure, and exit codes. A prior runtime hang is useful supporting evidence but is not the requested red test.
2. Final-head focused test transcript: exact commands and exit codes for ClaudeAdapterV2.test.ts and ClaudeAutomaticDelivery.integration.test.ts, plus focused steering-completion proof if existing evidence does not already demonstrate tracked fallback after adapter rejection. Include the pending-approval and question-resolution checks above or mark them unverified. Reported total alone is insufficient provenance.
3. One real runtime reproduction at final head, using the established issue procedure and real Claude SDK/CLI, isolated test state. Record app commit, Claude CLI/SDK version, model, initial prompt, actual slow foreground command, command-start time, steer-submit time and text, interrupt/control acknowledgement or tool-abort event, assistant reply and timestamp, final terminal state. The slow command must demonstrably still be running at steer submission. Use the same slow fixture as the base reproduction, not a different quick task.
4. Correlate query/session identity and provider turn/run IDs across the runtime transcript: one live query remains in use, aborted_tools is treated as a steered segment, and the final response finishes tracked work once. A fast visible reply alone cannot establish same-live-query correctness. State reply latency; 1.4 seconds is historical context, not a prescribed universal cutoff. Require completion comfortably before the slow command's configured finish/timeout.

No new client-wide UI sweep, screenshot, video, theme matrix, viewport matrix, other-provider live run, relay/tunnel run, or mobile/desktop capture is necessary. Shared server behavior reaches all clients; this audit does not claim to have verified those clients or connection modes. No public comment or PR is needed.

## Unverified surfaces / limits

- Final-head real CLI behavior and same-query identity; final-head runtime is pending.
- Actual test execution, 215-pass provenance, and base red execution were not inspected or rerun.
- Pending approval remains protected and both pending input types remain answerable; new question test only proves the interrupt gate.
- Full orchestrator completion-race fallback and exactly-once delivery were not executed in this audit.
- SDK interrupt-error continuation, foreground-subagent coexistence, all clients and remote modes were not runtime-verified here.
- No separate EVIDENCE document was supplied/read; this matrix follows the operational rules and explicit server-only exception stated in the review brief.

## FRICTION

category|what|avoidance
proof-provenance|Earlier-head fast reply and aggregate passing count cannot certify final head|Attach exact-head test and runtime transcripts with commit and command provenance
scope|A visual matrix would introduce unrelated width/theme/client permutations|Keep visual matrix empty; use operational fixtures and timestamped transcript
pending-input|No-interrupt assertion does not demonstrate an approval/question remains answerable|Prove explicit answer resolution for both request types with deterministic fixtures
race|Adapter no-offer assertion alone does not establish tracked orchestrator follow-up|Use deterministic completion integration evidence, not repeated manual timing attempts