# Proof audit pass 1 — runtime fixture matrix

PR [#26601](https://git.cafe/pingdotgg/t3code/pull/26601), branch `fix/issue-26577`.

Required comparison: before [30eb7e7bb1](https://git.cafe/pingdotgg/t3code/commit/30eb7e7bb1ef103fdd6f54081b6a4acf66b3ee4c) (`30eb7e7bb1ef103fdd6f54081b6a4acf66b3ee4c`) versus after [3c6d27fa7c](https://git.cafe/pingdotgg/t3code/commit/3c6d27fa7c98ab98a23463891452f761aedbdea8) (`3c6d27fa7c98ab98a23463891452f761aedbdea8`). Both local checkout HEAD and GitCafe PR metadata match the required after SHA. The merge-base of this head and the PR's observed base is the stipulated before SHA. Do not substitute the newer local `main` ref. The lockfile blob is identical at these two revisions.

## Findings first

1. **Evidence blocker: revision mismatch.** The published [prior runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7ffa72768a19877b/runtime-transcript.txt) names older before/after revisions. Its 8,017–8,051 ms versus 2,012–2,022 ms holder results and 7,773 ms versus 1,760 ms queue results are useful reproduction leads, not proof for this comparison. No new captures were run during this pass.
2. **Coverage gap: interruption is not an actual timeout/pool test.** The added test at [GitVcsDriverCore.test.ts:1005](https://git.cafe/pingdotgg/t3code/blob/3c6d27fa7c98ab98a23463891452f761aedbdea8/apps/server/src/vcs/GitVcsDriverCore.test.ts#L1005) waits for `trapped`, calls `Fiber.interrupt`, and checks a marker. It does not set a short `timeoutMs`, exhaust eight permits, assert the timeout error, or queue `createWorktree`. Retain its red/green proof and add the real-driver transcript below. No implementation change requested.
3. **Coverage gap: scope cleanup also follows normal exits.** Installed `@effect/platform-node-shared` 4.0.5 finalizes nonzero exits, and referenced detached POSIX groups even after exit zero. The claim that normally exiting commands never reach cleanup is too broad. A normal leaf should be unchanged; an exited leader with a SIGTERM-ignoring descendant is a distinct affected state (R08). The vendored spawner differs slightly from the installed source, so captures must report the installed version and use real NodeServices.
4. **Coverage gap: original worktree error is earlier than checkout.** The prior driver requests `newRefName: feature-x` when that branch already exists. Failure comes from `createWorktree.createBranch`, before `git worktree add`. Reproduce that exact issue shape and include a fresh, successful worktree as a separate variant of R02.
5. **Background fetch is a parity control.** Its old override was already 1,000 ms. It bypasses the shared eight-permit pool, uses a separate four-worker semaphore, has a 300,000 ms safety timeout, and a 5,000 ms caller wait that must not cancel its writer. The old override removal needs parity evidence, not a claimed speed improvement.
6. **Limits must remain explicit.** A prompt SIGTERM handler can remove a real Git lock; SIGKILL cannot promise lock cleanup. An unkillable kernel task is outside this repair. Windows already uses `taskkill /T /F`, has no POSIX graceful-lock guarantee, and the new regression test skips Windows. No Windows runtime or macOS verification is claimed here.

This is a server-only change. Viewport, theme, width, responsive layout, and screenshots are **N/A**. Below, **recording means a timestamped runtime transcript**, including process/marker/error events, not a still image or a required video. All time- or interaction-dependent rows are labelled recording. R01 is the focused red/green test log. All statuses are **PENDING** because pass 1 derives fixtures before capture.

## Shared capture protocol

- Run each required row at both pinned revisions. Every run must print the full SHA, OS, Node/Git and installed Effect platform versions, driver SHA-256, input options, wall-clock origin, and monotonic event timestamps. Keep one timestamped run directory per attempt under the lead's scratch root. Upload the exact driver and raw logs.
- Use **GitVcsDriver.layer + NodeServices.layer + ServerConfig.layerTest**, with a fresh synthetic committed repository and an isolated worktree directory. Call its `execute`/public methods. A shell running git directly does not prove the driver fix. Do not accidentally use `layerVcs`, `makeVcsDriverShape`, or the separate `VcsProcess` path.
- Use real git shell aliases or a local executable hook/helper. The simulated hostile process is synthetic, but the GitVcsDriver and process spawner must be real. Mark any replacement of the spawner, timeout clock, or platform as **HARNESS**; it cannot substitute for a native runtime row.
- For readiness use stdout/stderr line callbacks, Deferred/Queue events, and fixture IPC. Do not copy the prior driver's arbitrary 300 ms delay. Saturation requires **eight observed READY events**, not eight requested fibers. Log acquisition/start independently of request time: the timeout is inside the semaphore and does not bound time queued for a permit.
- All timing numbers below are **planned acceptance bands**, not measured results. Runtime transcripts may measure elapsed time; do not add wall-clock assertions, polling, retries, or enlarged timeouts to committed tests. Use the repository's focused test command. A dead process group can include zombies; report leader exit and zero *live non-zombie* descendants separately from raw group existence.
- Use bounded 8,000 ms hostile fixtures (40,000 ms for the 31,000 ms timeout, 310,000 ms for background safety timeout) so baseline runs finish. Log READY only after installing SIGTERM behavior. A post-return `marker absent` alone is insufficient if the child could create it later: record process death or retain observation through the fixture's natural completion checkpoint. Track only processes spawned by the driver.
- Timing resolution: the configured escalation is **1,000 ms**, not a hard end-to-end deadline. POSIX spawner cleanup may also spend a final **1,000 ms** on the process group after SIGKILL. For a 1,000 ms timeout expect roughly 2,000 ms; accept 1,900–3,500 ms with the actual SIGTERM/SIGKILL/exit events. A slower loaded run needs explanation from events, not silent widening. Prompt termination should have no fixed extra 1,000 ms.

## Minimum required fixture matrix

Each row includes every named variant. Pair each variant at before × after. One driver invocation/log can cover multiple rows if its event labels unambiguously identify each variant. The minimum set is **R01–R15**, with native Linux/POSIX evidence for R01–R14 and native Windows evidence for R15. No viewport × theme product applies.

| ID / fixture | Diff effect; runtime path | Seed / driver action | Capture form | Exact distinguishing observations / acceptance targets | Status |
|---|---|---|---|---|---|
| **R01 — existing regression** | Changed; explicit interruption, pooled default timeout; POSIX only | Focus only `kills a timed-out git command that ignores SIGTERM`. For baseline, carry the identical head regression test into a capturer-owned test-only overlay or external harness with resolved baseline imports; record that overlay and keep baseline production code untouched. | **Red/green test run** | Exactly 1 selected test per revision. Before: assertion fails with marker `true` after the 3,000 ms fixture finishes. After: passes with marker `false` after interruption. A zero-test run or a Windows skip is not red/green. Run from apps/server with `GIT_CONFIG_GLOBAL=/dev/null vp test run src/vcs/GitVcsDriverCore.test.ts -t 'kills a timed-out git command that ignores SIGTERM'`. | PENDING |
| **R02 — exhausted pool, actual timeout, queued worktree** | Changed; <=30,000 ms pool; timeout cleanup releases permits | Eight real `execute` aliases ignore TERM and naturally end at 8,000 ms; `timeoutMs: 1000`. After all eight READY events, queue public `createWorktree`. Variant A: `feature-x` already exists + `newRefName: feature-x` as in prior driver. Variant B: absent `newRefName: feature-y`, explicit fresh path, no submodules. First run each worktree request alone for control. | **recording — real-driver before/after transcript** | Eight active and ninth queued. All eight report `GitCommandError.detail === 'Git command timed out.'`. Before holder lifetimes about 8,000 ms (>=7,500); after 1,900–3,500 ms, with 1,000 ms grace. Log worktree request at q after holders launch; queue wait approximately 8,000−q before, 2,000−q after (allow final group wait up to 1,000). At q<=500 ms, target >=7,000 ms before and <3,500 ms after. A keeps `reason=branch_already_exists`, actual operation `createWorktree.createBranch`; B succeeds, path exists, branch/worktree registration correct. Solo control target <1,000 ms, record actual. After recovery, eight fresh probes complete: no retained permits. | PENDING |
| **R03 — pool boundary and bypass** | Selection unchanged; verifies fixture really enters the affected semaphore | Eight READY holders with each option variant: `timeoutMs` omitted, `30000`, `31000`, `null`. Submit a ninth short probe. Interrupt holders after the ninth request is registered; no need to wait 30 s in this row. Count starts with native spawner delegation/fixture events, not a fake handle. | **recording — real driver** | Omitted and 30,000: exactly 8 holder starts; ninth cannot start until one holder finalizes. 31,000 and null: holders bypass pool; ninth starts while all 8 remain alive (9 active commands). Recovered probe count 1/1 for every variant on both revisions. TimeoutMs null must remain distinct from omitted. | PENDING |
| **R04 — long finite command timeout** | Changed; >30,000 ms bypass path, same shared spawn | One TERM-ignoring real alias, timeout 31,000 ms, natural completion 40,000 ms. A short pooled probe runs while it is alive. | **recording — real driver** | Probe completes before holder, proving bypass. Before holder about 40,000 ms (>=39,500); after target 31,900–33,500 ms with TERM near 31,000 and KILL near 32,000. Error remains `Git command timed out.`; zero live hostile processes after return. Models worktree add/remove 300,000 ms, clone/review fetch, storage cleanup, and long commit deadlines without requiring each command's full duration. | PENDING |
| **R05 — cancellation, pooled and unbounded** | Changed; explicit interruption independent of timeout wrapper | Two variants: default/30,000 ms and null. READY hostile alias, then interrupt owning fiber or scope; fixture would end at 8,000 ms. | **recording — real driver** | Report interrupt-request time and completed Fiber.interrupt separately. Before waits until natural completion (~8,000 ms minus request delay). After interruption finalizes in ~1,000 ms (900–2,500 ms including group wait), returns interrupted Exit, zero live descendants and no later marker. Default releases shared permit; null remains bypassed. R01 alone does not cover null. | PENDING |
| **R06 — cooperative SIGTERM and real lock cleanup** | Graceful path preserved; one-second policy must not become immediate SIGKILL | Synthetic committed repo with edited tracked file. Real `git commit -a` with a controlled pre-commit hook that emits READY while the commit holds its Git index lock and exits promptly on TERM. Use a 1,000 ms deadline; repeat via explicit interruption. Confirm actual lock existence before signal; do not merely create a fake lock then claim native Git cleanup. | **recording — real driver + filesystem events** | Before/after: real index.lock observed 1 before cancellation, 0 after; TERM seen, no KILL of a still-live Git process, completion near timeout with <750 ms cleanup overhead on unloaded host. Subsequent real commit succeeds, 0 stale index/config/ref lock files. Log all actual lock paths. If Git version does not hold index.lock at the selected milestone, redesign fixture rather than silently accepting it. Forced hostile aliases in R02/R05 have no guarantee of removing their own locks. | PENDING |
| **R07 — normal completion / exit errors** | Leaf behavior unchanged; guards against one-second absolute runtime cap | Real aliases complete at 3,000 ms with exit 0, and exit 17 with allowNonZeroExit true/false. Exercise finite 10,000 ms, finite 31,000 ms, and null; a fast real status/config read covers ordinary output. | **recording — real driver** | Both revisions: 3,000 ms operations survive beyond 1,000 ms, finish ~3,000–4,000 ms, no live process gets forced early. Exit 0 returns original stdout/stderr; allowed 17 returns exitCode 17; disallowed 17 becomes structured error with exitCode 17. No fixed 1,000 ms penalty after leaf exit; eight fresh probes complete. Short ordinary calls control against added cleanup latency. | PENDING |
| **R08 — leader exits, descendant survives** | Changed cleanup after *normal* leader exit; zero/nonzero branches | Real git alias starts a TERM-ignoring child in the same POSIX group, redirects child's inherited pipes to files/null, records child PID/READY, then shell/git leader exits 0; repeat exit 17 with allowNonZeroExit true/false. Child would write marker at 8,000 ms. | **recording — real driver + child lifecycle** | Before finalization returns after roughly 1,000 ms but child can remain alive and later writes marker. After TERM then KILL near 1,000 ms, zero live children; no marker at natural completion checkpoint. Preserve leader exitCode and error mapping. Capture actual whether git permits the proposed descendant setup; otherwise label replacement executable as HARNESS. This row falsifies the overbroad claim that normal exits never finalize. | PENDING |
| **R09 — output error triggers scoped cleanup** | Changed; cleanup from failure other than timeout/explicit cancel | Real alias installs TERM-ignore, emits >128 stdout bytes after READY, continues alive until 8,000 ms. `maxOutputBytes:128`, appendTruncationMarker false, timeout null. Control: appendTruncationMarker true and normal completion. | **recording — real driver** | Before overflow failure waits for natural exit (~8,000 ms); after returns ~1,000–2,500 ms after overflow with same output-exceeded error, 0 live descendants. Control drains output, returns success after 3,000 ms, stdoutTruncated true; no premature cancellation. This represents collectOutput/stdin/stream failure-driven finalization, not an extra UI state. | PENDING |
| **R10 — background fetch outlives five-second caller** | Unchanged parity; separately scoped fetch, four-worker pool | Synthetic local origin and tracked branch; controlled git transport/helper blocks fetch for 8,000 ms then finishes successfully. Call `statusDetailsRemote(cwd,{refreshUpstream:true})`; a second caller joins same remote/common-dir fetch. Native spawner observation may log the real command/options. | **recording — real driver background path** | Both revisions: exactly 1 fetch for same key, caller stops waiting around 5,000 ms (target 4,900–6,000 plus measured setup); fetch still alive at caller return and completes around 8,000 ms. No TERM at 5,000 ms. Captured options: timeout 300,000; before forceKillAfter 1,000 ms, after equivalent 1 second. Use fresh service/cache per pair so cache hits do not hide fetch. | PENDING |
| **R11 — background safety deadline** | Unchanged parity; removed only old forceKillAfterMs caller | R10 setup with TERM-ignore helper naturally completing after 310,000 ms. Observe background fetch directly through real driver instrumentation, not the early-return status caller. | **recording — real driver** | Both revisions: TERM near 300,000 ms, KILL near 301,000 ms; background fetch finalized target 300,900–302,500 ms, failure/cooldown recorded; zero live helper. One subsequent different remote/key can use freed fetch slot. Native wall clock run is ~5 minutes. A TestClock-shortened version is labelled HARNESS and cannot claim this native elapsed-time proof. | PENDING |
| **R12 — background scope interruption / four fetch slots** | Unchanged parity; service-scope lifetime | Four distinct remote/common-dir keys start hostile background fetches, fifth is queued. Interrupt caller only first (writer must continue), then close owning GitVcsDriver service scope. Keep observation outside closing scope. | **recording — real driver** | Four active fetches, fifth no READY before slot release. Caller interrupt kills 0 fetches. Service-scope close TERM/KILLs all 4, completion ~1,000–2,500 ms after close on both revisions, 0 live helpers; queued fifth never starts after shutdown. Short pooled git probe remains independent of four fetch slots. | PENDING |
| **R13 — cancellation while queued** | Unchanged control; no process spawned/no permit leak | Eight READY pooled holders; enqueue ninth request with unique child marker and interrupt it before releasing holders. Then recover holders. | **recording — real driver** | Ninth spawn/READY/marker count exactly 0 on both revisions; its interrupt completes before holders finish. Afterwards eight new probes can start and finish, verifying no permit was consumed by a cancelled waiter. No timeout error should be attributed to the never-started process. Can share R02/R03 run if separately logged. | PENDING |
| **R14 — shared-config writer serialization releases** | Changed when lock owner is hostile; serialized outside eight-permit pool | Same common Git directory via two linked worktrees; prime repository-path cache. First direct execute uses writesSharedConfig true, timeout 1,000 ms, TERM-ignore alias natural 8,000 ms. Queue a real writeConfigValue through second worktree after first READY. | **recording — real driver** | One writer active per gitCommonDir. Before second writer waits roughly 8,000−q ms; after roughly 2,000−q ms (allow final group wait). Second writer then succeeds and actual config key/value is readable. Report config.lock existence; do not assert SIGKILL cleans a lock owned by hostile helper. Same common-dir lock releases on explicit interruption as in R05. | PENDING |
| **R15 — Windows taskkill parity** | Policy option changed; native taskkill behavior expected unchanged | Native Windows host with these pinned checkouts; real GitVcsDriver + Git for Windows. Hanging hook/helper with a live leader and a child, timeout 1,000 ms and explicit-interruption variants; normal 3,000 ms leaf control. Include one saturated 8-holder/queued worktree variant. | **recording — native Windows real driver** | Log actual taskkill invocation `/pid <captured PID> /T /F`; 1 leader + child both gone, correct timeout/interrupted Exit, eight permits reusable, queued worktree proceeds before 8,000 ms natural finish. No required POSIX TERM→1,000ms→KILL ordering: Windows force-kills on first taskkill, commonly near 1,000 ms for timeout and promptly for interruption. Record exact elapsed values for both revisions; normal 3,000 ms control survives. Linux override of HostProcess.Platform is HARNESS, not native Windows proof. This Linux audit cannot supply this capture. | PENDING — native Windows required |

## Additional surfaces and equivalence decisions

- **UI (not minimum):** “Preparing workspace” is a real user-visible orchestration state; a paired client recording could demonstrate R02 via a synthetic project and a worktree thread launch. It requires an isolated server seeded with synthetic project/thread records, eight hostile calls in that *same server process*, and a normal thread launch through RPC so the module-level semaphore is actually shared. An external driver has a different semaphore and cannot induce the UI wait. No rendered code changes, so this is optional corroboration; the required short runtime transcript is sufficient for the server-only fix. Do not open a browser without explicit authorization.
- **macOS (recommended, not an additional semantic minimum):** repeat R01/R02/R06 on native macOS to corroborate the same POSIX group path. Report absent coverage; do not infer macOS measurements from Linux. No remote machine has been contacted by this audit.
- **Provider/client/connection mode:** Codex/Claude/Cursor/Grok/OpenCode/Antigravity do not choose this git spawn policy. Web/desktop/mobile, local/relay/tunnel, command palette/MCP/scheduled callers converge on server services. No client contract changes or theme/width variants. Distinct OS process spawners remain relevant.
- **No new process spawned:** missing executable, invalid cwd, option-like/ref guards, nonrepo resolution, and shared-config lock wait all precede the changed spawn option. R13 covers cancellation before acquire; startup failures need no new red/green fixture for this option change. They are not evidence of successful force killing.
- **Data shapes:** branch already exists vs fresh successful branch is in R02; missing/unborn HEAD, empty output, null upstream, detached HEAD, status caches, no origin, ref-list paging, submodules none/recursive/failure, and truncated output do not create another spawn policy. Their actual subprocesses map to the timeout/error classes above; R09 distinguishes output truncation mode. Skip upstream fetch with refreshUpstream false/no tracked upstream is unchanged and spawns zero background fetches.
- **Lock limits:** index/ref/config/packed-ref locks are Git-owned filesystem state. R06 proves graceful cleanup with a real lock. Forced SIGKILL may leave any of these; log actual remaining files. Do not turn a synthetic lock into a claim of guaranteed cleanup. Kernel uninterruptible sleep is an explicit uncaptured limitation, not a missing reproducible row.

## Caller inventory and reduction

The changed spawn sits in executeRaw, wrapped by execute. The internal executeGit wrapper always invokes that execute, passes allowNonZeroExit true, and maps exit errors afterwards. runGit, runGitStdout, runGitStdoutWithOptions, executeGitWithStableDiagnostics, executeWorktreeList and dynamic helpers all converge there. Progress/Trace2/stdin/env/output-cap flags change observation or can fail midstream, but not termination policy; R06/R09 cover those cleanup triggers.

| Caller class / source | Relevant operations and shapes | Runtime class / rows |
|---|---|---|
| GitVcsDriverCore read/status/diff/ref methods | status/statusDetails/statusDetailsLocal/statusDetailsRemote; repository paths; config/base/branch resolution; prepareCommitContext/readRangeContext; review diff/contents; listRefs/local branches/worktree paths; remote existence/tracking/base resolution | Default 30,000 ms or explicit 5,000/10,000/15,000/30,000 ms; pooled. R02/R03/R05/R07/R09/R13. |
| GitVcsDriverCore ordinary mutations | initRepo, createRef, switchRef, deleteLocalBranch, renameBranch, pruneWorktrees, pullCurrentBranch (30,000 ms), refreshCheckedOutBranch, ensureRemote, writeConfigValue, createBranch, setBranchUpstream, fetchRefIntoBranch/fetchRefCommit/fetchRemote/fetchWorktreeBaseCommit/fetchRemoteBranch/fetchRemoteTrackingBranch | Default or <=30,000 ms; pooled. Config writers serialize per common dir outside pool. R02/R05/R06/R14. |
| GitVcsDriverCore commit | Stage/reset/add; commit timeout supplied by caller or default, postcommit rev-parse | Default stages pooled; commit can be >30,000. GitManager supplies 600,000 ms. R04/R06/R07. |
| GitVcsDriverCore create/remove worktree | createBranchAt can fail before add; readConfigValue precedes checkout; add/remove 300,000 ms; submodule init/update have default timeout; Windows removeLinkedWorktree delegates extra reads to core execute | Mixed pooled preflight and >30,000 ms checkout/removal. R02/R04/R06/R15. |
| GitVcsDriverCore push | Requested remote; publish upstream; own branch; existing upstream; plain push | All five push subprocess variants explicitly timeout null, while preflight reads/config writes remain pooled. R05/R07/R14. |
| GitVcsDriverCore background status | fetchRemoteForStatus and refreshStatusUpstreamIfStale; same-key coalescing, cached/backoff, distinct remote key, caller timeout, service lifetime | 300,000 ms, separate four-fetch pool; former only forceKillAfterMs=1000 caller. R10/R11/R12. |
| GitManager and GitWorkflowService | Direct execute for recent subjects, refs/remotes, published/unpublished PR inference, tracked changes, hasCommit/hasRefNamed; worktree/commit/push method forwarders | Default or 5,000 ms reads pooled; long commit as above. R02/R04/R05/R07. |
| SourceControlRepositoryService | CloneRepository 120,000 ms default (caller override allowed), publish head check; remotes and publish methods | Clone long/bypass or override-selected pool; normal head check pooled. R03/R04/R05/R07/R09. |
| PullRequestReviewGuideService | Commit/ref reads, check-ref-format, merge-base/diff; fetch and addWorktree 300,000 ms; removeWorktree finalizer | Pooled reads; long fetch/checkout; scope interruption. R04/R05/R07. |
| TriageService | initSource/addSourceRemote/checkSource 10,000; resolveSourceRef 5,000; fetchSource/checkoutSource 600,000; clone fiber service scope | Pooled reads/setup, bypass long clone/checkout, detached caller/service ownership. R03/R04/R05/R07. |
| ManagedProjectFolders | init/add 10,000 ms; commit normal execute | Pooled normal/error/interrupt. R05/R06/R07. |
| storageCleanup + worktreeRemoval | Core execute for status/ignored/ref reads, default branch ls-remote 20,000; cleanupGit 300,000; injected execute forwarded to removeLinkedWorktree | Pooled reads, long cleanup, Windows branch. R04/R05/R07/R15. |
| ServerSourceControlHost → source-control providers | Exposes git.execute unchanged; GitCafe forced PR checkout; GitHub checkoutPullRequest fetch/reset/merge/checkout via runGit; GitHub/GitLab template tree/blob reads | Default 30,000 ms pool. R02/R05/R07/R09. Host process.run calls are separate and excluded. |
| Separate VcsDriver surface in GitVcsDriver.ts | makeVcsDriverShape/layerVcs/checkpoints use gitCommand→VcsProcess.run, not makeGitVcsDriverCore | **Unchanged/out of scope.** Do not use this service as evidence for changed spawn. |

The following literal operation inventory is extracted from the core's convergent wrappers. Dynamic operation names (e.g. createBranchAt, resolveRevisionObject, writer helpers) are represented by the class table above, rather than presumed to use a new spawn policy.

```text
GitVcsDriver.branchExists
GitVcsDriver.commit.addAll
GitVcsDriver.commit.addSelected
GitVcsDriver.commit.commit
GitVcsDriver.commit.reset
GitVcsDriver.commit.revParseHead
GitVcsDriver.computeAheadCountAgainstBase
GitVcsDriver.createRef
GitVcsDriver.createWorktree
GitVcsDriver.createWorktree.initSubmodules
GitVcsDriver.createWorktree.updateSubmodules
GitVcsDriver.deleteLocalBranch
GitVcsDriver.ensureRemote.add
GitVcsDriver.ensureRemote.listRemoteUrls
GitVcsDriver.fetchRefCommit
GitVcsDriver.fetchRefIntoBranch
GitVcsDriver.fetchRemote
GitVcsDriver.fetchRemoteBranch.fetch
GitVcsDriver.fetchRemoteBranch.materialize
GitVcsDriver.fetchRemoteForStatus
GitVcsDriver.fetchRemoteTrackingBranch
GitVcsDriver.fetchWorktreeBaseCommit
GitVcsDriver.getReviewDiffFileContents.repositoryRoot
GitVcsDriver.getReviewDiffFileContents.revision
GitVcsDriver.getReviewDiffPreview.patch
GitVcsDriver.getReviewDiffPreview.stat
GitVcsDriver.getReviewDiffPreview.unbornStat
GitVcsDriver.initRepo
GitVcsDriver.listLocalBranchNames
GitVcsDriver.listRefs.defaultRef
GitVcsDriver.listRefs.remoteNames
GitVcsDriver.listRefs.snapshotRefs
GitVcsDriver.listRefs.worktreeList
GitVcsDriver.listRemoteNames
GitVcsDriver.listWorktreePaths
GitVcsDriver.prepareCommitContext.emptyIndex
GitVcsDriver.prepareCommitContext.expandSplitIndex
GitVcsDriver.prepareCommitContext.head
GitVcsDriver.prepareCommitContext.indexPath
GitVcsDriver.prepareCommitContext.readTree
GitVcsDriver.prepareCommitContext.stagedPatch
GitVcsDriver.prepareCommitContext.stagedSummary
GitVcsDriver.pruneWorktrees
GitVcsDriver.pullCurrentBranch.afterSha
GitVcsDriver.pullCurrentBranch.beforeSha
GitVcsDriver.pullCurrentBranch.currentBranch
GitVcsDriver.pullCurrentBranch.currentSha
GitVcsDriver.pullCurrentBranch.mergeRefs
GitVcsDriver.pullCurrentBranch.pull
GitVcsDriver.pushCurrentBranch.publishContainsHead
GitVcsDriver.pushCurrentBranch.push
GitVcsDriver.pushCurrentBranch.pushOwnBranch
GitVcsDriver.pushCurrentBranch.pushUpstream
GitVcsDriver.pushCurrentBranch.pushWithRequestedRemote
GitVcsDriver.pushCurrentBranch.pushWithUpstream
GitVcsDriver.readBranchChangeTotals
GitVcsDriver.readConfigValue
GitVcsDriver.readRangeContext.diffPatch
GitVcsDriver.readRangeContext.diffStat
GitVcsDriver.readRangeContext.log
GitVcsDriver.readUnifiedWorkingTreeReviewDiff.addUntracked
GitVcsDriver.readUnifiedWorkingTreeReviewDiff.expandSplitIndex
GitVcsDriver.readUnifiedWorkingTreeReviewDiff.indexPath
GitVcsDriver.readUnifiedWorkingTreeReviewDiff.stagedDeletions
GitVcsDriver.refreshCheckedOutBranch.isAncestor
GitVcsDriver.refreshCheckedOutBranch.keepPrevious
GitVcsDriver.refreshCheckedOutBranch.move
GitVcsDriver.refreshCheckedOutBranch.status
GitVcsDriver.remoteBranchExists
GitVcsDriver.remoteExists
GitVcsDriver.removeWorktree
GitVcsDriver.renameBranch
GitVcsDriver.resolveBranchName.resolveRef
GitVcsDriver.resolveCommit
GitVcsDriver.resolveComparisonBaseRef
GitVcsDriver.resolveCurrentUpstream
GitVcsDriver.resolveDefaultBranchName
GitVcsDriver.resolvePushRemoteName.branchPushRemote
GitVcsDriver.resolvePushRemoteName.remotePushDefault
GitVcsDriver.resolveRemoteTrackingCommit
GitVcsDriver.resolveRepositoryPaths.commonDir
GitVcsDriver.resolveRepositoryPaths.currentBranch
GitVcsDriver.resolveRepositoryPaths.worktreeRoot
GitVcsDriver.resolveReviewMergeBase
GitVcsDriver.resolveReviewMergeBase.head
GitVcsDriver.resolveTrackedRemoteBaseRef
GitVcsDriver.resolveWorktreeBaseRemote
GitVcsDriver.review.emptyIndex
GitVcsDriver.review.emptyTree
GitVcsDriver.review.listUntracked
GitVcsDriver.setBranchUpstream
GitVcsDriver.statusDetails.defaultBranch
GitVcsDriver.statusDetails.indexPath
GitVcsDriver.statusDetails.numstat
GitVcsDriver.statusDetails.numstat.unborn
GitVcsDriver.statusDetails.numstat.unborn.staged
GitVcsDriver.statusDetails.originExists
GitVcsDriver.statusDetails.status
GitVcsDriver.statusDetailsRemote.branch
GitVcsDriver.statusDetailsRemote.divergence
GitVcsDriver.statusDetailsRemote.unbornBranch
GitVcsDriver.switchRef.checkout
GitVcsDriver.switchRef.currentBranch
GitVcsDriver.switchRef.localInputExists
GitVcsDriver.switchRef.localTrackedBranchTargetExists
GitVcsDriver.switchRef.localTrackingBranch
GitVcsDriver.switchRef.remoteExists
GitVcsDriver.writeConfigValue
```

No tests, runtime captures, browsers, servers, remote machines, or extra worktrees were started in this proof-matrix pass. Worktree remained clean. No edits, pushes, comments or PR-body updates were made.

FRICTION: none

VERDICT: INSUFFICIENT R01–R15 (both pinned revisions; all named variants; native Windows required for R15)