# PASS 1 — backend functional proof matrix

Scope: [#22661](https://git.cafe/pingdotgg/t3code/pull/22661), only [#22656](https://git.cafe/pingdotgg/t3code/issues/22656). Read-only audit; no source edits, tests added/executed, browser, server startup, captures, or forge writes. Matrix publication is explicitly authorized.

Before: [4f651cb10d](https://git.cafe/pingdotgg/t3code/commit/4f651cb10d2a885be82748e22a280eeef591200f). After: [b2c65dcc8a](https://git.cafe/pingdotgg/t3code/commit/b2c65dcc8a92f1e97fa5ef235419d2e00ed07fca). Local merge-base matches the stated base; worktree and live PR head match the stated head. Branch: `fix/issue-22656`.

## Findings first

1. Current PR description contradicts the head: “Missing both locations | Schema error | Schema error” must become before error / after decoded with empty recent for running/completed. The opening explanation also incorrectly generalizes migrated `metadata.recent` to all native 2.1.2 compactions; the natural native fixture has no metadata. Do not publish these stale claims unchanged.
2. `dev-server-after-proof.json` names earlier head `85b023d151`. It demonstrates real legacy rollback with succeeded outbox and rolled_back run, but is not exact-head evidence for b2. Reuse only with an explicit prior-head label and code-equivalence explanation, or refresh at b2.
3. HTTP success logs contain only `decoded 5` / `decoded 90`, without revision/time/source hashes. Scripts show the intended production service import and real HTTP endpoint, but mutable source paths alone do not attest the revision executed. Add a manifest associating each result with exact source hash, fixture hash, command, exit status, OpenCode/client versions, and timestamp. The copied baseline service DOES hash-identically match the supplied base (`22f09e55d95dd076520984703147536dbf28c77a0a424688134b1561a8ca5add`).
4. `final-focused-tests.log` reports six tests and predates b2's eight history cases plus authorization. It cannot certify the final test inventory. Existing test source is valid coverage design; an exact-head result is still required for a passing execution claim.
5. During inspection, `native-dev-rollback.log` became available: it declares full b2 head, succeeded rollback outbox on first attempt with no last_error, plus matching OpenCode stage/commit records. This closes the previously pending native rollback milestone at the log level. A final-history observation remains useful to substantiate the retained/deleted-message boundary, rather than merely successful execution.

## Why no visual capture matrix

Only `packages/provider-opencode/src/server/v2/OpenCode2Client.ts` and its test change. No changed UI components, callers of changed render components, layout branches, styles, themes, widths, or client navigation exist. The observable contract is HTTP decoding and provider rollback. Pixel diffs, two diff images, viewport sizes, and light/dark themes cannot distinguish missing-field normalization, cursor preservation, schema errors, or persisted effect success; each is N/A. Web, Electron, iOS, and Android consume the same server outcome; there is no distinct changed render path to capture on any of them. Remote/relay/tunnel also use this server-side provider HTTP adapter, so no origin or client transport change is claimed. No screenshots are required. Label synthetic response cases as HTTP harness fixtures, never UI fixtures.

## Functional paths and minimal fixtures

The production client wrapper applies to every request, but changes bodies only for GET + status 200 + matching `/api/session/<id>/message` URL (including query/fragment delimiter). `message.list` callers in v2 adapter: reconnect backfill (descending, limit 50), rollback and fork user-message discovery (limit 100), readThreadSnapshot / post-rollback snapshot (ascending, limit 100), and custom-command boundary discovery (descending, limit 1). `paginate` follows next cursor and removes order on subsequent pages. SSE/event handling and other provider implementations are unchanged.

All rows require before/after semantic observations; unchanged rows must remain equivalent, not necessarily byte-identical because eligible pages are reserialized. No auditor-run capture is implied by this plan.

| ID | Fixture / seed and scope | Affected? | Before → after requirement | Current evidence / status |
| --- | --- | --- | --- | --- |
| N1 | Real OpenCode 2.1.2 isolated free-model conversation, manually compacted; completed compaction lacks recent and metadata; GET actual session history | Yes | Base service fails missing recent; head service decodes all five messages, fills empty recent, retains order/IDs/cursor | `native-history.json`, `http-native-base-service.log` failure at data[3].recent, `http-native-after.log` decoded 5; baseline hash verified, head execution manifest needed |
| N2 | HTTP harness valid running and completed native compactions with metadata.keepID and no recent | Yes | Both fail before; both decode after with recent empty; keepID must not be copied into recent | Two committed cases; exact-head execution result needed |
| N3 | HTTP harness valid running and completed compactions without metadata (same normalization branch as N1) | Yes | Both fail before; both decode after with recent empty | Two committed cases, N1 provides real completed shape; exact-head execution result needed |
| L1 | Real OpenCode server imports 89 synthetic messages + completed compaction with metadata.recent, missing top-level recent | Yes | Base missing recent at index 89; head decodes 90 and uses exact metadata string, not keepID | `history.json`, `http-client-before.log`, `http-service-after.log`; before uses generated client rather than copied base service; qualify this, add provenance |
| L2 | HTTP harness running/completed metadata.recent string, including empty string | Yes | Decode after with exact string; present empty string stays empty | Completed nonempty committed case; running/empty are explicit equivalence requirements, source-reviewed, no new tests requested |
| P1 | HTTP harness running/completed valid top-level recent; metadata absent or conflicting | No semantic change | Top-level string wins unchanged; do not overwrite with metadata/empty | Running top-level committed case; completed/conflict branch source-reviewed |
| V1 | HTTP harness present invalid top-level recent (number, null, object) with valid metadata fallback available | No semantic change | Both retain downstream ClientError / SchemaError at recent; no rescue of present malformed values | Number committed case; remaining shapes follow property-presence branch, source-reviewed |
| V2 | HTTP harness invalid reason, invalid status, missing required non-recent fields, invalid non-compaction message | No relaxation | Still schema errors at invalid fields; missing recent must not hide other validation failures | Invalid reason committed case; other branches source-reviewed |
| M1 | HTTP harness missing recent with metadata null/non-object/recent nonstring | Yes | Running/completed uses empty recent; metadata is not validated as a separate legacy schema guarantee | Source branch `isLegacyMetadata` false → empty; do not claim malformed metadata itself must fail if generated schema permits it |
| U1 | HTTP harness pending/failed compactions, ordinary user/assistant/synthetic/idle, empty history page | No semantic change | No inserted recent outside running/completed compactions; valid pages still decode; message order and count retained | Source-reviewed; no runtime claim yet |
| U2 | HTTP harness eligible page with cursor.next/previous, unknown envelope keys, multi-page mixed history | Envelope reserialized | Preserve envelope/cursor and semantic values; pagination reaches target without skips/duplicates; asc/desc/limit1 URL queries still match | Real fixture cursors present; no delivered multi-page result, existing paginate unchanged |
| G1 | HTTP harness POST same path, GET unrelated path/suffix, non-200 history response, transport failure | No semantic change | Original response/error path untouched; auth still Basic, no change to destination/base URL | Guard/source-reviewed, authorization test exists; no new execution claim |
| G2 | HTTP harness malformed JSON, missing/non-array data, malformed cursor | No relaxation | Unrecognized page passes cached body to downstream decoder and still fails there; recognized page with malformed cursor still fails; no swallowed body/transport error | Source-reviewed only |
| H1 | HTTP harness eligible page with Content-Length and other headers | Transport adjustment | Remove stale content-length after rewriting; preserve other headers/status; response remains decodable | Source-reviewed only |
| R1 | Real dev T3 server + naturally compacted native OpenCode session; rollback through normal command/service to thread start or known checkpoint | Yes, downstream recovery | Before history decode prevents revert; after rollback outbox succeeds, OpenCode stage then commit occur, no decode failure; verify final native/T3 retained boundary | `native-dev-rollback.log` full b2 + succeeded effect + matching stage/commit; final retained-history assertion not supplied |
| R2 | Real dev server + imported 90-message legacy session; rollback to first turn | Yes, downstream recovery | Same decode failure before; after rollback effect succeeds and target run rolled_back; verify intended retained boundary | `dev-server-after-proof.json` succeeds but identifies prior head; refresh/qualify, final native boundary not supplied |

## Evidence delivery requirements for lead / capturer

Minimum live set is N1 and L1 before/after through actual HTTP, plus R1 and R2 real dev rollback. The harness/equivalence rows cover transient running states, invalid input, and unchanged branches without needing repeated free-model sessions or UI automation. Reuse existing committed tests; this pass requires no implementation or new tests. Source-reviewed equivalence rows may be explicitly labelled as such instead of falsely claiming executed fixtures. If pagination or preserved cursor is claimed as experimentally proven, include U2 evidence rather than just decoded message counts.

Each delivered evidence column must say full base/head SHA, actual production module hash, OpenCode 2.1.2 and bundled client 2.0.28, fixture hash, endpoint method/path/status, command and exit status, timestamp, expected/observed error or decoded IDs/count/recent/cursor. A raw generated-client baseline is supporting evidence; actual-base-service baseline is stronger. Show final persisted rollback effect plus actual provider stage/commit and final retained-message boundary. Do not treat an accepted command receipt as completed rollback. Do not imply thread-start rollback proves every checkpoint position.

Approved seeding routes: existing isolated OpenCode server on 42256 with imported legacy fixture and natural free-model native session; existing isolated T3 dev server on 16515 (web 8475) using normal import/turn/rollback service flow. This auditor did not contact, mutate, start, or stop either. Native transient running/invalid/guard cases are labelled HTTP harness fixtures derived from the committed transport test, not claims about a naturally generated session.

Publish only reviewed, sanitized extracts and the manifest/matrix. Never upload raw `dev.log`, `opencode-server.log`, credentials, XDG database, or entire temp directory. This upload contains only the matrix; no logs or conversation bodies are included.

## Pass 1 result

Fixture derivation is complete and backend-scaled; there are zero applicable pixel/viewports/themes. This is an evidence-readiness verdict, not a merge/code-review decision or a completed PASS 2. Remaining gaps are exact-head provenance/results, final rollback boundary assertions, and contradicted PR claims. Native successful execution is now present in the supplied log; legacy successful execution is prior-head evidence.

VERDICT: INSUFFICIENT exact-head HTTP/test provenance, legacy rollback attribution, final retained-history assertions, contradicted PR claims