# Proof audit pass 1 — fixture and comparison contract

PR [#21046](https://git.cafe/pingdotgg/t3code/pull/21046), branch `fix/local-git-status-upstream`, head [bb35b94](https://git.cafe/pingdotgg/t3code/commit/bb35b941115a0a9f818e8512eebe67c29ee68355), pinned base [5211acfe](https://git.cafe/pingdotgg/t3code/commit/5211acfe95a0c6d82a60e2524b5e46b47fe67a3e). Source checkout: `/home/ubuntu/wt/pr-21046`. Full SHA values belong in the capture manifest. Audit date: 2026-10-28 UTC.

**Pass 1 complete: capture specification, not a pass-2 evidence verdict.** No edits, tests, dev servers, browser sessions, pushes or comments were made. The complete four-file diff, production callers, stream reducer, settings and relevant provider boundary were inspected. Forge metadata matches the pinned head and base; it reports 37 successful checks, zero pending/failing. That is metadata, not independently rerun validation.

The four changed files are byte-identical between the earlier captured head [8be315bd](https://git.cafe/pingdotgg/t3code/commit/8be315bd6f5d17a028c7adcdd907401730d8a53f) and this head. Git history shows no changes under `apps/server/src/git` or `apps/server/src/vcs` between the earlier base [975b3dc5](https://git.cafe/pingdotgg/t3code/commit/975b3dc56850d8a22dc90462219e53be95d8dcf7) and this pinned base. This supports reusing fixture designs; it does not relabel historical runtime captures as current-revision runs. The [earlier pass-2 audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6ce9cb58503300db/proof-audit-pass-2.md) was read. The [later index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3307e2be223a4c12/index-r2.md) and its driver/harness were inspected as fixture references only; their coverage claims have not been audited here.

## What changes, and what does not create another fixture dimension

No component, CSS, client, contract or wire schema changed. There are **zero changed render components** to enumerate. The affected observable state is branch identity, dirty files/line totals, default/upstream flags, PR identity and ahead/behind/default counts. The proof is a **recording**, meaning an ordered machine-readable runtime transcript. Stills cannot establish a held request, pending RPC, event ordering, cancellation or recovery. Viewport × theme × platform is **n/a × n/a × server protocol** for every row. No browser permission or UI recording is needed for this scope.

The subscription still emits `snapshot {local,remote}`, `localUpdated {local}` and `remoteUpdated {remote}`. Remote `null` merges to no PR, no upstream and zero counts, including `aheadOfDefaultCount:0`. Absence of the optional count is distinct from zero when a real remote object exists. Every emitted payload and intermediate merged state must be retained. Split events can briefly expose old-local/null-remote before new-local/null-remote; do not erase that state or the additional null publications in localOnly paths.

Long names, file counts, titles, light/dark, narrow/wide, desktop/mobile layout, loading placeholders and renderer error presentation are unchanged consumers, so they do not multiply this server matrix. Clean versus dirty, empty versus populated remote, absent versus cached-null remote, branch changes, count changes, pending work and failures *do* select changed server branches and appear below. OS-specific rendering and provider-agent variants add no changed branch. The server uses the same handlers over direct, remote/relay and tunnel connections; transport rendering is outside the claim.

## Complete caller and branch map

Source links are pinned to the reviewed revision.

| Changed entry / helper | Callers and branching inputs | Fixture coverage |
|---|---|---|
| [GitWorkflowService.currentBranch](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/git/GitWorkflowService.ts#L336) | New service method, no RPC; only production caller is `readRemoteStatus`, before and after its remote read. Repository detection absent/fails; symbolic-ref exit 0/nonempty/empty, exit 1, other exit, null exit/process failure. Exactly one `refs/heads/` prefix removed. | P20; integration identity in P07; caller failure in P10 |
| [updateCachedLocalStatus](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/vcs/VcsStatusBroadcaster.ts#L266) | Called by loadLocalStatus, refreshLocalStatusCore and full refresh. Local fingerprint same/different; remote belongs to same/different branch or is absent; publish false on initial load, true on refresh. A clear publishes null remote before changed local. | P01, P02–P08, P10–P12, P15–P16 |
| updateCachedRemoteStatus | Called by getStatus (silent), localOnly/full refresh, poll, missing-PR refresh and auto-pull success/reconciliation. Candidate absent or branch-compatible/incompatible; fingerprint same/different; cached-null differs from absent. | P04, P07–P09, P12, P15–P19 |
| getStatus / getStatusParts | No external production caller of broadcaster getStatus found; it remains a service entry. Both cached parts fast path; cold/local-only initial load; latest cache after lock; compatible remote write followed by one consistent reread. getStatusParts fallback loads local if absent; no production operation removes a loaded local cache entry. | P09, P18; P01 initial-load control |
| refreshLocalStatus / refreshLocalStatusCore | Direct caller: [RunFinalizationService observer](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/orchestration-v2/RunFinalizationService.ts#L101); also internal read reconciliation, refresh, poll and pull. Invalidates local and publishes without remote lock. | P05; P02–P04, P07, P10–P12, P15–P16 |
| refreshStatus, localOnly=false/omitted | [ws.ts](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/ws.ts#L2921) explicit RPC; detached `refreshGitStatus` after pull, stacked action, prepare-PR-thread, worktree create/remove, ref create/switch, init, completed clone and publish-repository. [WorktreeMcpService handoff](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/mcp/WorktreeMcpService.ts#L334) also invokes it. All collapse to the same changed service path; mutation implementations did not change. Local scan before lock; full invalidation after earlier writer finishes; fetch on/off; second local read after fetch; optional pull; final cache reread. | P02–P03, P07–P08, P10–P11, P15–P18 |
| refreshStatus, localOnly=true | Same explicit RPC. Warm same branch with remote; changed branch; no prior local; no prior remote. Local scan/publication precedes lock, response can still wait. Zero owned remote reads; null sentinel may be installed later. | P04; P06/P07.b |
| readRemoteStatus | Used by cold getStatus, full refresh, refreshRemoteStatus, missing-PR refresh, post-pull read. Invalidate cwd remote cache unconditionally; compare branch before/after; refresh local if branch changed OR cached local differs; discard only if probes differ; cache writer also verifies candidate against latest local. | P07–P12, P15–P20 |
| refreshRemoteStatus | Only makeRemoteRefreshLoop: immediate cold active lookup, then periodic ticks. New/changed ahead, behind or aheadOfDefault triggers local refresh; same counts but changed PR publishes only remote; identical fingerprint suppresses publication. Optional auto-pull. | P01.b, P12, P15–P17 |
| maybeAutoPull | Called by fetching full refresh and fetching poll, never fetch-off or missing-PR-only. Remote null/upstream/ahead/behind/policy gates; local repo/default/dirty/branch gates; success, error before pullAttempted, error after mutation, reconciliation failure. New branch mismatch gate must be isolated from every old exclusion. | P15–P17, P18 |
| refreshPullRequestStatus | Finalization observer after local scan: non-null non-default branch, matching thread branch, matching/no active run. Service gate: local absent; cached remote *value* null; remote absent; remote object with PR missing/present; any original-cwd policy demand allowed. Always no-fetch + refreshMissingPullRequest. | P19; P05 finalization controls |
| streamStatus / loop (unchanged structure, changed callees) | [subscribeVcsStatus](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/ws.ts#L2915); includeRemote omitted/true retains active poller, false passive; realPath normalization/fallback; initial uncached lookup bypasses policy/fetch-off tick suppression; shared alias demands, last-active unsubscribe; failure/defect backoff and interruption. | P01, P12, optional P13/P14 |

All client consumers reach [client-runtime vcs.status](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/packages/client-runtime/src/state/vcs.ts#L285) and the [shared stream reducer](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/packages/shared/src/git.ts#L339). Web/desktop consumers are ChatView, GitActionsControl, ThreadStatusIndicators (passive), DiffPanel, BranchToolbarBranchSelector, PullRequestThreadDialog, both SidebarThreadRow render variants (passive), and sourceControlActions' decision reads. Mobile consumers are ThreadRouteScreen, DraftThreadHeader, new-task-flow-provider, useReviewHeaderPresentation, GitCommitSheet, GitOverviewSheet and GitBranchesSheet. Desktop wraps web. Chat refresh, branch/git actions and their palette/keybinding entry points reuse these paths. Settings select fetch/pull policies. Scheduled/provider turns use finalization, independent of which agent provider ran. No changed provider adapter or client-specific route exists. A sidebar's separate linked-PR state must not be mistaken for this VCS stream's PR.

## Comparison contract — two artifacts per fixture

Every included subfixture gets **Diff0 and DiffT**, either separate files or clearly keyed sections in its Pxx files. A group-level pass cannot conceal a missing subfixture. Paired rows run the base checkout's own server/service and the head checkout's own server/service. Head-only rows instead compare head to the declared oracle and print `NOT_COMPARABLE_TO_BASE` with their reason in both artifacts.

**Diff0 — exact event/payload comparison.** Extract `{observer, events:[...]}` per subscription, retaining its own wire order and every event (initial and reconnect snapshots included as separately named observers). Canonicalize JSON object-key order; do not sort arrays. Normalize only timestamps, run identities and request identities. Run identity includes the *specific manifest-listed timestamped run-root prefix* inside `cwd`, `workingTree.rootPath` or typed errors: replace that prefix with `<RUN>`, preserving every suffix. Do not strip arbitrary paths. Use a bijective mapping for RPC/request/trace/span identities and preserve which request each record refers to. Put revision, side, environment, seed/git commands, provenance text, sequence counters and raw diagnostic logs in a separate manifest, not in the event projection. Do not remove event types, duplicates, nulls, fields, file order, branch names, PR fields, optional-versus-present values, counts or errors. Do not compare a total order spanning stream and RPC channels. Raw merged logs retain that arrival order for diagnosis.

Threshold: **zero omitted events, zero payload tolerances, zero unexpected stream-order changes**. On unchanged controls expect empty Diff0. On affected rows expect only the explicit semantic changes in the table: early/split local publication, branch invalidation/discard, recovery eligibility and changed call paths. List every remaining delta with actual before/head values; a nonempty before/head diff is expected for a fix and is not itself a failure. An extra null publication is a real delta to expose, not normalize away. Once the head row oracle is fixed, a recapture must match its stream projection exactly under the above normalization. P20 has no stream: Diff0 is the ordered canonical method-result/error sequence instead.

**DiffT — semantic order, RPC and checkpoint comparison.** Independently replay each stream with the pinned revision's `applyGitStatusStreamEvent`; retain every intermediate merged state. Compare (1) exact event order within each stream, (2) RPC/service final values or typed failures keyed by request identity, (3) pending/resolved/failed state and value at every named closed-gate checkpoint, (4) upstream/workflow start→hold→release→completion order and read/pull counts, (5) final reconnect/cache state. Ignore only RPC-result versus stream-arrival interleaving where neither causally gates the other. Two streams' independent arrival order is likewise not one total order. A stream swap, missing payload, early RPC resolution, extra pull, wrong PR/count, missing checkpoint or mismatched reducer state is a semantic failure.

Threshold: **zero semantic mismatches to the row's declared oracle; zero reducer mismatches; all mandatory head assertions PASS; no unexplained before/head delta**. On controls expect identical canonical outcomes. Before-side regression failures are retained with actual values and matched to the row's explicit expected delta; they are not harness crashes. No percentage/pixel threshold applies. A small test that swaps adjacent stream/RPC arrivals must leave DiffT unchanged; swapping two events within a stream must change it. DiffT must include values, not merely assert PASS/FAIL and discard observations.

Harnesses serialize outcomes as stable records such as `{fixture:"P17.a",assertion:"pull-count",expected:0,actual:0,outcome:"PASS"}`. Put `{revision,sourceRun,method:"controlled service harness",notes:...}` in separate provenance. Never write `PASS inferred ...` on one side and `PASS` on the other. Stable assertion IDs must match across revisions. Head-only expected records are an oracle, not invented base records. Capture error tags, operation, exit code and relevant stable fields; raw stack traces are diagnostics outside canonical outcomes.

For all held-request rows, log mutation completion, request-start/head selector, acknowledged gate-closed, RPC starts, named checkpoint, release acknowledgement, completion and passive reconnect. Record the actual local-event IDs since mutation; never infer event occurrence from dirty-state flags. Use the same explicitly recorded 1,200 ms negative-observation window on real-server before/head runs, keep the upstream gate closed during it, and do not claim a latency benchmark from it. Head must actually show the required event while closed. Harnesses synchronize with Deferred/Queue/TestClock, not sleeps/polling or a timeout that is counted as success. A gate-trigger timeout means **UNREACHED**, not a captured before failure.

## Seed methods used in the matrix

**R — actual server + typed RPC + synthetic Git.** Capturer creates a new timestamped scratch run for each revision, supplies `T3CODE_DEV_SEED=0 vp run dev --no-seed --home-dir <run>/.t3`, and reads actual ports from dev-runner output. Never point at live userdata. Keep driver, HTTP mock, preload and logs under the lead's scratch, outside reviewed trees. No VITE origin overrides. Redact complete auth-bearing startup lines before saving; never upload auth files, tickets or pairing URLs. Use a fresh private dev token and one-use `/api/auth/websocket-ticket/rpc` ticket; construct Effect RpcClient from that checkout's WsRpcGroup. Do not invent a getStatus RPC. Existing [driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b53fc77b8839ed0d/driver.mjs), [seed](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/267de4617c788b4b/seed.mjs), [mock](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8727d88f4b164c0a/mock.mjs) and [preload](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/41be2b31992cc0b3/preload.mjs) are starting points, not certified captures.

Set fetch off through the current settings shape: `server.updateSettings({patch:{backgroundActivity:{profile:"battery-saver",overrides:{}}}})`. The legacy top-level automaticGitFetchInterval alone is not the authoritative setting. Make main with README `base\n`, branch A=`release`, a tag also named `release`, local tracking refs origin/main and origin/release, origin/HEAD→origin/main, and configured branch upstream. Use an inert synthetic GitHub-shaped origin solely to select the provider; never fetch/push it. Seed distinct local commit graphs so A has ahead=1 and B has ahead=2; PR HTTP responses do not supply these counts. Use fixed commit author/committer dates and synthetic PR fields. B is `heads/release` in collision rows, otherwise `feature/b`. Read exact identity with `git symbolic-ref HEAD`, and record porcelain and diff numstat as independent oracles. A dirty mutation adds `changed\n` to README, yielding one insertion and zero deletions.

Passive evidence: `subscribeVcsStatus({cwd,includeRemote:false})`; await snapshot. Explicit concurrent requests: `vcs.refreshStatus({cwd,localOnly:false|true})`, fork without awaiting prior request, and record each promise. Do not send concurrent proof through the client mutation scheduler, which serializes some operations. Reconnect with a new passive stream after settling. Active rows use includeRemote true/omitted.

**G — held GraphQL boundary inside R.** [GitHubSourceControlProvider](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/packages/source-control-github/src/server/GitHubSourceControlProvider.ts#L535) performs listByHead over HTTP GraphQL; a slow `gh pr` stub does not hold it. A narrowly scoped fetch preload redirects only the synthetic provider API to a loopback mock. Supply /user discovery, quota headers and alias-aware GraphQL nodes (including prefixed batch variables/aliases). PR A=613/head A, B=614/head B; never use an intentionally mismatched node filtered before broadcaster. Arm/acknowledge/release exactly one request; freeze its branch and response at request start, not release. Unsupported requests fail locally. A discovery-only gh stub may answer auth/version/token, but must reject PR calls. Keep holds below upstream timeout. Label this real server/real Git/**mock provider HTTP**, never live upstream or real gh PR lookup.

**B — real bare-Git fetch/pull seed.** Separate run: local bare origin, work clone and peer clone, origin/HEAD main. Advance main from peer; push only to the local bare repository. Feature branch has known pre/post-fetch branchChanges totals. Enable fetch via performance profile (or a validated custom interval), and use `defaultAutoPull:true` with a registered isolated project and no overriding project policy for pull rows. Keep defaultAutoPull false for fetch-only rows. Real ticks also require `server.reportClientActivity` with an active visible/focused web client, vcs-status cwd scope and live TTL. There is no TestClock RPC; exact timer/failure/scheduler rows use H. No real external remote is necessary.

**H — labelled production-service harness.** Import VcsStatusBroadcaster.layer from the selected checkout; provide controlled workflow, BackgroundPolicy, VcsAutomaticFetchInterval, VcsAutoPullPolicy and FileSystem; observe its real stream. Supply contract-valid local/remote objects (omit optional sourceControlProvider if absent; do not substitute null). Freeze the remote result at call start. Maintain independent `actualBranch` and `localSnapshot` where a branch probe/local-cache mismatch is under test. Emit raw events, call options/counts, gates, canonical method results and assertion records. Use Deferred/Queue/TestClock and tracked fibers. [Earlier harness](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/208c25ea845190ed/harness-r2.mjs) is a starting point; its fake fetch/pull is simulated. Direct getStatus/local-refresh/missing-PR methods have no public RPC, so direct-method captures must be H. A real completed matching turn can reach the latter two methods, but is not needed merely to expose them. Never label a full-refresh RPC as missing-PR-only.

**S — head scheduler harness.** Use the existing test's tracer end of updateCachedRemoteStatus + scheduler yield, switch local to B via refreshLocalStatus, then let the suspended operation return. No public app gate deterministically targets this scheduling window.

**C — branch-reader harness with real Git.** Import head GitWorkflowService and call currentBranch directly over temporary real Git repos. Use real VcsProcess/Git subprocesses and real repository detection where possible. Controlled command/registry adapters are explicitly labelled for otherwise unreachable outputs/errors. The method has no public RPC. See [existing real-Git branch-race test](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/git/GitManager.test.ts#L739) and [scheduler tests](https://git.cafe/pingdotgg/t3code/blob/bb35b941115a0a9f818e8512eebe67c29ee68355/apps/server/src/vcs/VcsStatusBroadcaster.test.ts#L758) for patterns.

## Matrix

`CORE` = minimum headline claim proof. `REQ` = changed-path proof required for a complete diff-wide package. `CONTROL` = unchanged behavior, not-required separately. Every row says **recording**; dimensions are always n/a × n/a. `paired` means base + head, with both comparisons above. Pxx subfixtures can share one continuous recording but need separate named checkpoints/outcomes. Comma-separated explicit variant IDs each designate a separate execution, not permission to sample just one.

| Fixture | Affected / priority / sides | Data and interaction (recording) | Exact observation / allowed before→head change | App seeding or harness |
|---|---|---|---|---|
| P01.a cold passive | Indirect; embedded CORE control; paired | Fresh cwd, empty cache, clean A, passive subscribe | Initial local snapshot/remote null; zero remote reads owned by passive; both revisions. | R passive subscription; embed in core sessions. |
| P01.b cold active held | Indirect; CONTROL; paired | Cold A, includeRemote true (omitted equivalent), G holds initial lookup | Local snapshot while held, later A/613; initial remote call occurs despite fetch-off. No new local-first polling claim. | R+G, active stream. |
| P01.c warm/reconnect | Indirect; embedded CORE control; paired | Warm A/613, then passive reconnect after each race | Exact latest cache visible without owned remote lookup; after discard B/null, after recovery B/614. | R new passive stream; embed in core sessions. |
| P02 own held full refresh | Yes; CORE; paired | Warm A/613; dirty README, then full refresh; hold its lookup | Base local stays old until release; head localUpdated dirty/+1/-0 while gate closed and RPC pending; final cache/result converge. | R+G explicit full RPC. |
| P03 queued full refresh | Yes; CORE; paired | Warm A; full F1 holds remote lock; dirty only after hold; start full F2 | Head dirty local published with F1/F2 both pending and zero F2 remote starts before F1 release. Base local scan queues. Settle writers in order, fresh final PR retained. | R+G, two concurrent typed RPC fibers. |
| P04.a queued localOnly | Yes; CORE; paired | Same as P03, F2 localOnly=true, same A with cached PR | Head local publishes before release; both RPCs still pending. F2 owns zero remote reads, same-branch PR retained after lock. Base local scan waits. | R+G; replace F2 only. |
| P04.b warm unlocked localOnly | Indirect; CONTROL; paired | Warm same A/613, dirty then localOnly without competing writer | Dirty publication, retained PR/counts, zero remote reads; head split local event versus base's existing local update semantics as observed. | R localOnly RPC; can append P04.a. |
| P04.c cold localOnly | Yes; REQ; paired | Fresh A; passive initial local but remote absent; localOnly | No remote read. Head installs cached-null and may emit remoteUpdated:null despite already-null snapshot; base's event form differs. Preserve exact null event. | R fresh cwd; append P04. |
| P05.a direct local switch | Yes; REQ; paired | Warm A/613, direct refreshLocalStatus after actualBranch/local becomes B | Head remoteUpdated:null precedes localUpdated B, zero owned remote reads, reconnect B/null; base local-only update can retain A remote. | H direct service (no direct RPC). Real finalization is an alternative app trigger. |
| P05.b direct same-branch dirty | Indirect; CONTROL; paired | Warm A/613, dirty A, refreshLocalStatus | Same-branch PR retained, local event, zero remote reads. | H direct service; may append P05.a before switching. |
| P06 cached A→B without flight | Yes; REQ, merge into P07.b if identical checkpoints; paired | Warm A/613, checkout B, localOnly, no remote held | Head clears remote before local B then may publish another null when sentinel installed; base combined B/null snapshot. Both final B/null. Full B recovery can share P08. | R localOnly RPC then passive reconnect. No separate run if P07.b covers no-flight checkpoints too. |
| P07.a held A→B, collision | Yes; CORE; paired | A=release with tag release; held full lookup for A; checkout B=heads/release; **no local refresh after checkout**; release A/613/count1 | Base can attach A/613/count1 to B. Head probes detect branch change, publish B, discard remote; final result/reconnect exactly B/null/zero counts. No prefix loss. | R+G; git symbolic-ref oracle. |
| P07.b held A→B with queued localOnly | Yes; CORE; paired | Warm A; hold F1; checkout B; start localOnly F2 before release | Head proactively publishes remote clear then local B while gate closed; F1/F2 pending. Discard late A; final B/null. Checkpoint text references actual event IDs. Extra null updates remain visible. | R+G, concurrent F2; can reuse P04/P06 controls. |
| P08.a B recovery | Yes; CORE; paired | Continue P07.a after discarded A; next full lookup returns B/614/count2 | Next lookup occurs, B/614/count2 in result, stream and reconnect; no A cache TTL poisoning. Both eventually recover; head was safe before recovery. | R+G responding to B; distinct real Git count graph. |
| P08.b identical repeat | Indirect; embedded CORE control; paired | Repeat settled B refresh with identical local/remote payloads | Zero duplicate stream updates; RPC still returns same B/614/count2. | R repeat full RPC + passive reconnect. |
| P09.a cold getStatus with intervening local | Yes; REQ; paired | H cold getStatus holds captured A; independently dirty/switch local B and refreshLocalStatus; release A | While held getStatus pending and snapshot B; head final result/cache B/null, older captured local cannot overwrite newer local. Base may restore captured A. | H direct getStatus; no getStatus RPC. |
| P09.b initial writer then queued full | Yes; REQ; paired | H cold held getStatus; switch/refresh local B; queue full B/614 | Later remote read cannot start until initial writer exits; head initial result uses compatible latest local, later writer/reconnect B/614. | H two fibers + gate; warm fast-path no-read can be appended as control. |
| P10.a provider HTTP failure | Yes for early local; REQ; paired | Warm A/613, dirty, held provider HTTP response becomes 503 | Head dirty local before failure; actual GitManager catches provider error and retains last-known PR (or null if none); don't demand RPC failure. Record real resulting value. | R+G failure response, no injected workflow error. |
| P10.b workflow remote failure | Yes; REQ; paired | H warm A/613, dirty A, hold remoteStatus then fail typed GitManagerError | Head publishes dirty before release; RPC/service fails with injected error; reconnect retains dirty local + compatible old remote. Base misses early local. | H workflow gate/failure; exact tag/operation recorded. |
| P10.b2 branch switch before workflow failure | Yes; REQ; paired | Warm A/613; switch local/actual branch to B before full refresh; its remote read fails | Head publishes remote clear then B local and retains B/null after typed failure; base can keep stale A cache. This differs from same-branch dirty failure. | H workflow failure with passive stream and final reconnect; app HTTP failure is not equivalent. |
| P10.c initial local scan failure | Yes; REQ; paired | H full refresh; localStatus fails before upstream | Head fails with zero owned remote reads and no false successful local event; base can start remote before discovering local failure. | H local failure at first scan, call counters. |
| P10.d branch-probe/read-reconciliation error variants | New read stages; REQ head observations; paired only where trigger exists | Independent failureAt=pre-probe, post-probe, mismatch-reconciliation. Dirty local already captured; no pull | Canonical typed error and last valid local remain; do not accept remote candidate after failed probe/reconciliation. Base has no probe stages: those variants head-only, reason explicit; common local-reconciliation error can be paired if reached. | H stage-specific Deferred/typed failure; no deterministic app stage gate. P20 covers actual reader error construction. |
| P11 fetch moves diff base | Yes; REQ; paired | Fetch enabled, autoPull false, feature branch; early totals=1 insertion; fetch moves base so final totals=5 in H (or exact known B graph totals) | Head early local totals1 while held, then totals5 local event and RPC/cache; base publishes post-fetch totals only. Final totals exact, no stale freeze. | B actual full RPC if driving real fetch; H labelled fetch mutation acceptable for exact gates. |
| P12.a scheduled changed counts | Changed callee; REQ; paired | Warm cache + active subscriber, nonzero interval, policy allow; actual scheduled tick. Separate variants ahead, behind, aheadOfDefault change (one at a time); first absent remote covered by P01.b | One tick remote read; changed count triggers local scan and correct local/remote publication. Do not substitute explicit refresh for timer path. | H active stream + TestClock.adjust to actual interval; B real timer is possible but less controlled. |
| P12.b scheduled identical / PR-only | Changed callee; REQ; paired | Actual next tick: (b1) same whole payload; (b2) same counts, changed PR title/state | b1 zero publications/local rescans when branch cache compatible; b2 only remote change, no count-driven local rescan. Retain full fingerprint fields. | H timer, each variant separately labelled. |
| P12.c scheduled held A→B | Yes; REQ; paired | Actual tick begins A, held read captures A; checkout B; unchanged counts to prevent old count-trigger scan | Head refreshes B local and discards A, B/null snapshot; base can retain A cache. No assertion of local scan *before* held tick lookup. | H timer + Deferred; independent actualBranch from cached local. |
| P12.d scheduled B read with stale cached A local | Yes; REQ; paired | Before tick actualBranch already B; both probes B; cached local A; B response/counts equal A counts but PR B | Head refreshes local B because cached branch differs, accepts B response; base can keep stale A local paired with B remote. Distinct from probe-before/after mismatch. | H independent branch/local state; no local refresh before timer. |
| P13 demand/fetch/policy controls | Unchanged; CONTROL not-required | Separate variants passive-only; fetch-off initial+later tick; policy-denied initial+later tick; two active aliases→one→zero with passive remaining; realPath failure fallback | Initial active lookup still occurs; ordinary disabled/denied ticks skipped; normalized cwd shares one poller, original demand keys checked; only last active unsubscribe stops it. No changed claim depends on full lifecycle recapture. | H TestClock/realPath adapter; real symlink alias in optional R/B. |
| P14 backoff controls | Unchanged; CONTROL not-required | Separate typed failure then recovery; defect then recovery; held tick interruption | Local remains usable; delay=max(configured, min(30s×2^(n−1),15min)), failure count resets on success; interrupt cancels without retry. | H TestClock and captured warning fields; not real-time wait. |
| P15.a auto-pull success, held second read | Yes; REQ; paired | Clean/default A main, policy true, fetch on, upstream true, ahead0/behind2; pull changes local totals, hold second remote | Exactly one pull; head publishes pulled local before second remote release; final behind0 and exact pulled totals. Base delays that publication. | B + controlled post-pull provider read if controllable; H deterministic alternative, labelled fake pull. |
| P15.b checkout during post-pull read | Yes; REQ; paired | P15.a, second read captures A then actualBranch changes B while held | Head refreshes B and rejects A second response, result/reconnect B/null/zero counts; exactly one pull. | H independent branch/remote snapshot; real app checkout possible but precise gate uses H. |
| P16.a partial pull mutation then failure | Changed reconciliation; REQ; paired | Pull marks local dirty then typed failure, branch remains A | Reconcile latest dirty local, retain only compatible A remote; stream/result/cache exact. Head uses split writes; don't require base failure if both recover. | H injected partial mutation, real app cannot guarantee failure-after-mutation. |
| P16.b post-pull remote read fails | Changed reconciliation; REQ; paired | Pull succeeds/mutates local; second remote read fails | Latest local retained/published, compatible original remote allowed, recorded failure/recovery outcome; no stale local. | H failure specifically second remote read. |
| P16.c reconciliation local read fails | Changed reconciliation; REQ; paired | Pull attempted; reconciliation local read fails after pull/remote failure | Final effect fails; no fabricated successful stale local publication. Prior already-published local state retained. | H stage-indexed failure, assert event tail rather than empty stream globally. |
| P16.pre local eligibility read fails | Indirect; CONTROL not-required | Remote passes pull gates; localStatus fails before pullAttempted becomes true | Warning/catch returns no-pull; zero pull calls. Record any later count-driven local reconciliation separately. | H local read failure at eligibility stage; unchanged catch policy. |
| P16.d failed pull changes branch | Yes; REQ; paired | Pull partially mutates + switches A→B then fails; reconciliation local succeeds | Head rejects old A remote, B/null; base may mix old A remote with B. Exactly one attempted pull. | H controlled mutation/failure. |
| P17.a new auto-pull branch gate | Yes; REQ; paired | Remote read completes for A; pause policy evaluation before local pull eligibility check; switch actual local to B, keep repo/default/clean true; remote upstream/ahead0/behind2 and policy true | Base pulls B once using A read; head zero pulls. **Do not require head to publish B here:** final result can remain cached A until a later local refresh; this gate itself only prevents the pull. | H policy Deferred gate; deterministic stage unavailable via app RPC. |
| P17.b old exclusions | Unchanged; CONTROL not-required | One-at-a-time remote null / no-upstream / ahead>0 / behind0 / policy false / nonrepo / nondefault / dirty; plus fetch-off full refresh and missing-PR-only | Zero pulls for each execution; fetch-off and missing-PR-only remote options stay no-fetch. These cannot stand in for P17.a. | H table-driven gates; R settings can drive fetch-off; no mandatory recapture. |
| P18.a–d post-cache-write response races | Yes; REQ; **head-only** | Separate executions getStatus, full refresh, autoPull success, autoPull failure; S switches and refreshes B just after remote write, before response reread | All four return B/null and zero counts from consistent latest cache; prove trigger reached and local refresh finished. Base full-cache writers do not end the targeted updateCachedRemoteStatus span, so this exact tracer trigger does not exist there. Timeouts are not before evidence. | S labelled scheduler harness. Both comparison artifacts say NOT_COMPARABLE_TO_BASE; no public deterministic app seed. |
| P19.a no local / cached-null skip | Changed gate; REQ; paired | Separate a1 empty cache; a2 loaded local with cached remote wrapper value=null | Both skip lookup, return null and leave cache; remote absence must not be conflated with wrapper value=null. | H direct refreshPullRequestStatus, no RPC. |
| P19.b local + absent remote | Yes; REQ; paired | Load local passively but no remote, or after P07 discard leaves remote absent | Head eligible for no-fetch missing-PR lookup; base skips absent remote. Assert exact `{refreshUpstream:false,refreshMissingPullRequest:true}`. | H local snapshot then direct missing-PR method; app matching turn could trigger it. |
| P19.c object PR-null / existing PR | Changed read path; REQ; paired | Separate c1 remote object with pr=null; c2 object with PR613 | Service invokes reader with same exact no-fetch/missing-PR options in both; actual GitManager may cache existing PR. Compatible state remains. | H to observe options/counts; real turn is indirect trigger only. |
| P19.d policy deny→allow after discard | Yes; REQ; paired | Local B/absent remote after discard; deny then allow background scope | Denied: zero reads. Allowed: head discovers B/614/count2 and persists it. Base absent-cache eligibility differs. Poller original-cwd any-allow policy variant optional control. | H controlled BackgroundPolicy; invoke missing-PR directly. |
| P19.e in-flight missing-PR A→B | Yes; REQ; paired | Start eligible missing-PR reader on A; hold; switch B; release; follow with permitted B lookup | Head discards A, B/null then recovers B/614. Never label a full refresh as this row. | H direct missing-PR reader gate. |
| P19.f finalization guards | Unchanged; CONTROL not-required | Separate null/default branch; thread missing/mismatched branch; newer activeRunId; matching branch/run or no active run | Always local refresh; excluded paths no missing-PR call, matching calls it. Scheduled/provider turns share observer. | Labelled RunFinalizationObserver harness; a real completed matching thread is possible but unnecessary. |
| P20.a exact attached identities | New method; REQ; **head-only** | Separate real Git normal release; tag also release; literal branch heads/release | currentBranch exactly release/release/heads/release, never heads/heads/release or ambiguous tag. Method absent at base; P07 supplies paired integration proof. | C real Git direct method, no RPC. |
| P20.b normal null/unborn states | New method; REQ; **head-only** | Separate nonrepo; detached HEAD (exit1); unborn symbolic branch; controlled successful empty stdout | null / null / exact unborn branch / null respectively. Empty stdout is adapter-only, not claimed as a natural Git repo state. | C real Git first three, labelled GitCommand adapter for empty stdout. |
| P20.c unexpected exit / process / detection errors | New method; REQ; **head-only** | Separate exit128 after successful repo detect; null exit if supported by command adapter; process-spawn failure; registry detect failure | Unexpected exit constructs GitCommandError with operation=GitWorkflowService.currentBranch, command=git symbolic-ref, argumentCount3 and lengths; null exit omits exitCode. Spawn failure propagates typed command failure; detect failure maps GitManagerError. No false null success. | C real corrupt-HEAD-after-detection for128; labelled command/registry injections otherwise. P10.d proves caller handling. |

## Minimum capture set and completeness rules

**Minimum headline claim set:** paired **P02, P03, P04.a, P07.a, P07.b, P08.a, P08.b**, with P01.a/P01.c snapshots embedded. This retains stable group IDs **P02/P03/P04/P07/P08**. Each requires Diff0 and DiffT. This can fit three real-server sessions per revision: own held refresh; queued full/localOnly; collision/checkout/recovery/repeat. Dimensions are n/a × n/a × each named row, on each revision. No screenshot/video viewport grid is required.

**Full changed-path package:** every `REQ` row in the table, including P12 actual ticks and P17.a, plus all four P18 head races and all P20 head reader variants. CORE-only evidence proves the headline behavior, not the entire changed diff. P13, P14, P17.b, P19.f and standalone same-branch/passive controls are not-required; retain their IDs for continuity, but do not spend a capture round proving unchanged controls at the expense of changed rows. P06 may merge into already complete P07.b/P08 recordings only if every P06 checkpoint is actually present; a held-flight case alone is not the no-flight variant.

Each selected fixture manifest declares seed, actual revision, source type, supported comparison sides, gates, preconditions, final oracle, expected base/head delta and artifact links. A later index must list missing subfixtures rather than call an umbrella row complete. A single payload or passing test name does not establish an ordered path. Reuse an older artifact only under its actual revision/provenance, and separately justify whether it is acceptable supplemental evidence; never silently relabel it.

The branch probes compare names at two points. An unobserved A→B→A checkout during one lookup, or a late branch change not followed by a local refresh, is outside a continuous-identity guarantee. P17.a deliberately demonstrates that boundary. No additional general TOCTOU/ABA promise is made by this matrix.

## Delivery, coverage and cleanup

Pass 1 covered the full pinned diff, current service callers, settings/transport boundary, shared reducer and known prior proof gaps. It did not run tests or captures and did not audit the later round's artifacts. The capturer should run the focused broadcaster/GitManager regression checks if needed; green suite counts are separate from fixture proof. No repo-wide checks are requested.

Only this step's `/tmp/lead-21046-r2/audit1` was used for scratch. It is removed after uploading this report. Lead-owned scratch and `/home/ubuntu/wt/pr-21046` remain untouched. No server, emulator, lease or additional worktree was created. Free space stayed at 16 GB during the audit.

FRICTION: none

Pass-1 disposition: READY FOR CAPTURE. Evidence sufficiency remains unassessed for this pinned pair.