# Issue 16442 proof audit — pass 1

Scope: `/home/ubuntu/wt/issue-16442`, branch `fix/issue-16442`, full diff `044f07257c..62a69a6d960fa9f7a2ac930ed27b946cb481a78b`. Read-only source audit; no tests, browser, server, edits, pushes, or delegation performed. This document is a capture specification, not completed evidence.

## Exception decision

Do not use an empty matrix. All five changed files are server/provider/test code and no render source changed. However, the worktree AGENTS.md exception is specifically “A server-only fix with no visible surface ships the test plus a short runtime transcript.” This fix changes visible running/completed/interrupted state, command state, Stop availability, and subagent idle settlement. No changed render source is not sufficient to establish no visible surface. The focused red test and runtime transcript remain required alongside the minimal lifecycle recordings below. No static appearance row is necessary: there is no layout, theme, typography, or other static rendering change.

## Full diff evidence mapping

| Changed file | Effect | Proof rows |
| --- | --- | --- |
| apps/server/scripts/acp-mock-agent.ts | Publish real command PIDs before end_turn; new end_turn fixture flag; publication handshake for non-detached command | A, B; runtime transcript |
| apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.test.ts | Real-process command survives reply then Stop interrupts and removes both PIDs; pending command permits completion and subagent batch idles | A–D; focused red/green test logs |
| apps/server/src/orchestration-v2/Adapters/AntigravityAdapterV2.ts | Track in-progress execute tools; recognize completed/failed execute updates; defer settlement; hard process-group Stop | A–C, E |
| apps/server/src/provider/acp/AntigravityAcpSupport.ts | Own detached runtime process group with host platform implementation | A, B, E; PID transcript |
| packages/provider-acp/src/server/adapter.ts | Idle-on-completion flavors do not let synthetic subagent status block deferred settlement; command/hydration/report checks still precede exemption | D; targeted adapter test |

## Capture matrix

Each temporal/interaction row requires a short recording, with matched before/after recordings for the regression rows A and B. A still alone cannot establish elapsed sequence or process teardown. Minimum per row: real web client at 1280×800, one named theme consistently used across baseline and head (use lead’s existing theme; record its actual name). Theme and viewport expansion is unnecessary because no render source changed. Record commit, fixture/run identity and theme in an accompanying public-safe transcript, not secrets or pairing URLs.

| Row | Real app path / fixture | Sequence and observable expectation | Minimum evidence | Status |
| --- | --- | --- | --- | --- |
| A | Project → Antigravity thread → composer → send; mock flags T3_ACP_ANTIGRAVITY=1, T3_ACP_EMIT_RUNNING_COMMAND_THEN_HANG=1, T3_ACP_RUNNING_COMMAND_END_TURN=1, unique T3_ACP_RUNNING_COMMAND_PID_PATH | Observe command running, correlate protocol end_turn, show run stays running and Stop remains available; click Stop; show interrupted. Correlate both recorded command PIDs disappearing after Stop. Before must show premature settlement/Stop failure rather than only a final screenshot. | Before/after recording; timestamped protocol/projection/PID transcript. 1280×800, one named theme. | Lead reports before reproduced and head behavior verified; formal capture pending. |
| B | Same thread/composer, running-command fixture without END_TURN flag; Stop while provider prompt remains active | Show command/run active, click Stop, show interrupted and both command PIDs gone. Distinct from Stop after end_turn. | Before/after recording plus PID/runtime transcript. 1280×800, same named theme. | Lead reports before active-Stop failure; head active-prompt capture not supplied. |
| C | Antigravity thread with execute inProgress → completed or failed update after end_turn | Run initially stays running; incoming terminal command update allows run to settle, removes Stop, and preserves completed/failed command status. Covers both extraction terminal branches; use two fixture variants within the recording or document unsupported variant and rely on focused protocol test. | Recording of transition plus protocol transcript. 1280×800, same named theme. | Pending; new test does not cover natural command terminal updates. |
| D | Antigravity thread with pending execute command and synthetic start_subagent batch; fixture equivalent to new second test | end_turn completes run without hanging on pending command or synthetic subagent; subagent settles idle. | Recording of completion/idle transition where fixture can be injected through real app; focused adapter test is authoritative for exact event statuses. 1280×800, same named theme. | Test source inspected; not executed; real-app fixture availability unconfirmed. |
| E | Same Antigravity thread after Stop, send another harmless prompt | Runtime restarts/resumes successfully; new turn can complete, no old command PID resurrects, no stuck Stop state. | Recording, can append to A or B; runtime transcript. 1280×800, same named theme. | Pending. |

## Surfaces and entry points

Web chat Stop and keyboard interrupt share ChatView.onInterrupt; desktop wraps this web client, so the web recording is representative of unchanged render paths. Mobile has separate ThreadRouteScreen/ThreadDetailScreen/ThreadComposer Stop paths and consumes the same server lifecycle; it is affected semantically, but no separate mobile capture is required for this server-only diff absent evidence of client-specific projection divergence. A remote web client uses the same projected run status and typed interrupt command; capture may use the lead’s current isolated local or remote connection, recording which. No Settings, command-palette, contracts, new RPC, or rendering changes occur in the diff. Only Antigravity enables the new flavor options; the shared subagent exemption also affects any existing idle-on-completion flavor, so identify those during focused test selection rather than assuming all ACP providers changed.

## Seed and capture procedure for lead

1. Keep existing isolated worktree server and seeded data. Do not refresh DB or run tests while the broad watcher is active. Do not modify the live ~/.t3/userdata database.
2. If a fresh seed is actually needed, stop only the tracked owned server PID first, run vp run migrate-dev-db into worktree .t3, then restart the isolated server. Copy data, never symlink; do not set VITE_HTTP_URL/VITE_WS_URL.
3. Reuse lead’s safe Antigravity mock provider and real project/thread. Give each run a unique PID file outside the checkout. Record fixture flags and commit; omit tokens, auth settings, pairing URLs and unrelated conversations from public artifacts.
4. Capture baseline and head separately against identical fixture semantics. Never replay a fixture against the live install. For A, correlate end_turn with projected running state before clicking the actual Stop control. For B, click while prompt remains active. Record command PIDs before and after without killing unrelated processes.
5. After server is stopped, preserve focused baseline failing and head passing test output with exact command/commit and failure assertion. The new first test should fail on baseline for the lifecycle assertion, not a fixture/import error. No test execution occurred in this audit.
6. Upload safe recordings and runtime/red-green transcripts with ghdrop; embed before/after evidence in the owning PR when authorized. This matrix itself supplies no completion claim.

## Current evidence and friction

Lead-provided report (not independently observed here): baseline reproduced in real web 1280×800 for end_turn and active Stop failures; head end_turn kept run running with Stop; clicking Stop produced interrupted and PIDs 468229/468230 disappeared. Treat as a reported runtime observation until formal artifacts are attached.

FRICTION: Empty-matrix exception does not apply under the worktree’s literal “no visible surface” criterion; visible lifecycle/Stop changes require temporal proof despite unchanged render source.
FRICTION: Formal before/after recordings, named theme, and red/green logs were not supplied to this auditor; readiness is not proven.
FRICTION: No tests run because lead’s active broad watcher can restart on generated cache; obtain red/green proof after stopping the owned server.
FRICTION: Natural completed/failed command updates and post-Stop follow-up are not covered by the two newly added tests; rows C/E need evidence or an explicit scoped waiver.
FRICTION: Pending-command/subagent fixture is injected at adapter level in the new test; an equivalent real-app capture fixture is not established. Do not claim row D complete from source inspection.