# Issue 15541 proof audit — pass 1

Issue: [#15541](https://git.cafe/pingdotgg/t3code/issues/15541)
Reviewed head: [3e21e3a9](https://git.cafe/pingdotgg/t3code/commit/3e21e3a9d14cd67c4277553a6b08a221f8b23507)
Base: [e54e71d7](https://git.cafe/pingdotgg/t3code/commit/e54e71d725b6eef166ee9b85137c09e051cff342)
Worktree: /home/ubuntu/wt/issue-15541; branch fix/issue-15541.

Read complete two-file diff, worktree AGENTS.md, issue, changed execution path and server callers. Read-only audit: no code edits, tests executed, pushes, forge writes, server starts, or browser use. The requested public artifact upload is the only external write.

## Visual fixture matrix

Matrix: [] (zero rows).

The production diff removes WORKTREE_ADD_TIMEOUT_MS and passes timeoutMs: null only for git worktree add. The other changed file adds a TestClock regression. No render implementation, client contract, layout, theme, viewport condition, label, animation, or interaction implementation changes. Existing UI can observe a successful preparation instead of a timeout, but that is server execution outcome, not a changed render path. The user's explicit server-only exception applies: proof is red regression test plus real-runtime transcript. No UI capture rows are invented.

Changed-render-path/caller/conditional/interaction/viewport/theme capture combinations: none. Viewport and theme: not applicable. Recording-required visual rows: none. A still would not prove a timing/interaction row if one were introduced; none is present in this revision.

## Caller and conditional coverage inventory (not visual rows)

All paths below reach the single changed GitVcsDriverCore.createWorktree operation:

- ThreadLaunchService: new-worktree preparation, including the checkout progress callback, claimed worktree, workspace metadata update, and preparation cancellation race. Root/existing-worktree strategies bypass this creation branch.
- GitWorkflowService -> GitManager.createWorktree -> core: shared creation path, including WebSocket vcsCreateWorktree.
- WorktreeMcpService: agent worktree handoff creation inside interruptible restore.
- GitManager.preparePullRequestThread: creates only when an existing eligible worktree is not reused; calls core directly.
- ProviderTurnStartService: recreates a missing managed worktree with a branch and known project.
- CheckpointRollbackService: recreates a missing managed worktree with a branch and known project before rollback.

Within core, both new-branch and existing-branch argument variants share the changed timeout. Explicit and default worktree paths share it. Checkout progress callback present/absent shares it. Submodule setup and base/comparison ref configuration follow creation and are unchanged. Invalid refs/storage paths fail before it. Worktree removal retains its separate five-minute timeout. executeRaw already interprets null as scoped execution without timeout; both old 300000 and new null bypass the short-command semaphore, so this diff does not change that concurrency gate.

Clients: server behavior is shared by web, desktop, mobile, and agent callers. No client-specific rendering changed. Providers: operation is provider-independent. Local/remote/relay/tunnel: no transport or contract change; the real-app launch transcript is the appropriate integration evidence for this server fix. No viewport/theme sweep or per-provider capture is required.

## Proof requirements and evidence status

1. Regression: existing-module test must fail on the base/main for Git command timed out, then pass at the reviewed head. The added test forks createWorktree, waits for checkout start, advances TestClock six minutes, then releases completion and verifies returned path/ref. This targets the removed five-minute deadline without wall-clock waiting. User reports red on main, green on head, and 162 scoped tests passing. Those results were supplied, not independently rerun in this audit; retain exact command/output and revision attribution with the proof bundle.
2. Before runtime: [runtime-before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/99aeca4807285f72/issue-15541-runtime-before.txt) was read. It identifies base e54e71d7 and real dev app WebSocket orchestration.launchThread. Failure spans last 300013.618156 ms and 300146.603718 ms with Git command timed out. It also documents a tiny-repository 310-second post-checkout hook, failed run/preparation, retry branch_already_exists, and clean orphan worktrees. This proves the real timeout boundary and observed retry consequence; it is not a head-success transcript.
3. After runtime: PENDING, lead-owned. Supply the actual real-app transcript at reviewed head 3e21e3a9 with the executable 310-second post-checkout hook, real launch entry point, start/end or span duration beyond 300000 ms, successful Git worktree creation, persisted thread branch/path, and preparation completion/run continuation rather than timeout. Identify matching fixture and fresh branch/path so stale orphan collisions do not confound the result. A hook longer than five minutes is a valid deterministic boundary fixture; it does not establish throughput or reproduce the original NTFS/concurrent-checkout load.
4. Scope of claim: prevention of the fixed deadline killing a still-running worktree add. The supplied evidence does not prove recovery/adoption of already orphaned branches/worktrees, improved parallel throughput, or a new retry policy; these are not changed by the diff.

## Pass 1 result

Visual proof: not applicable; empty matrix is correct under the explicit exception.
Server regression proof: reported red/green and scoped passes, not independently executed here.
Runtime proof: before reviewed; after pending. Proof package remains incomplete until the lead supplies successful beyond-five-minute real-app evidence at the reviewed head. No implementation recommendations are made.

FRICTION none