# Deleted-worktree recovery: executed server proof

PR [#18359](https://git.cafe/pingdotgg/t3code/pulls/18359). Captured 2026-10-26 UTC. Runtime rows: **5/5**. Required test lanes T1–T4 covered by the 34-test suite and branch-listing source inspection; optional T5 breadth not expanded.

Server head: [394f9be](https://git.cafe/pingdotgg/t3code/commit/394f9be427e329ba0d353d3d6c879fe7dee7e939). Main service: [dd5b540](https://git.cafe/pingdotgg/t3code/commit/dd5b5401e1f240f4314af29edf431369d182f386). Checkout `/home/ubuntu/wt/pr-18359`, branch `takeover/18359-deleted-worktree`.

## Exact red/green proof

Command both times: `vp test run apps/server/src/orchestration-v2/ProviderTurnStartService.test.ts`.
Red: only ProviderTurnStartService.ts substituted from origin/main; branch tests, testkit and Git driver retained. **2 failed, 32 passed, exit 1**. Failures are assertions at test lines 852 (branch recovery) and 926 (typed retry failure), not setup failures. This does not claim the retained-branch subcase independently fails on main.
Green: exact branch service restored in finally; **34 passed, exit 0**. Service byte comparison and clean git status verified afterward. Full logs accompany this transcript.

## Isolated runtime

Start command: `vp run dev:server --no-seed --home-dir /tmp/ev-18359`. Actual dev-runner serverPort=15571, webPort=7531; server-only execution, no web process. HTTP origin `http://127.0.0.1:15571`. Runtime PID 2105176, dev-runner PID 2104890. Managed root derives from explicit baseDir: `/tmp/ev-18359/worktrees`. Project P=`/tmp/ev-18359-fixture/project`; W=`/tmp/ev-18359/worktrees/project/restore`.
Real provider `codex`, model `gpt-6.1-sol`, native protocol `codex.app-server`. Native initialize userAgent reports T3 Code/0.163.0 (Ubuntu 24.4.0; x86_64). Native conversation `01a179fa-0a0b-7d42-90cf-465d9c3753c5`.
[18359 isolated proof](t3-thread://v1/mcp:2981d4ac-1873-45cd-a149-5bc3c6c02a3c), project `d84b1349-74a8-45b4-b57b-ff58c4fc0e99`. Same server/thread throughout. Original baseline established native conversation at ordinal 1. A preliminary capture had a post-turn snapshot race; the authoritative sequential capture below repeats the complete R0–R4 matrix at ordinals 4–8. Earlier preliminary runs remain in isolated history.

CLI project registration: `node apps/server/src/bin.ts project add /tmp/ev-18359-fixture/project --base-dir /tmp/ev-18359`.
CLI new-worktree launch rejects an existing branch, so baseline provisioning used the supported MCP t3_thread_launch existing_worktree strategy via launch.mts after real Git created W. No DB writes, auth config changes, mode changes or provider substitutes. Ephemeral CLI sessions are issued/revoked through the same supported auth service as the CLI.

Each row uses `node apps/server/src/bin.ts thread send <same-thread-id> <read-only-row-prompt> --base-dir /tmp/ev-18359 --wait --json`; exact argv/stdout/stderr is retained in runtime-trace.json. The CLI awaits durable terminal state through t3_thread_wait. The sequential driver waits for command exit and completes each snapshot before mutating Git for the next row. No sleeps establish success.

## Fixture tips

- A = `a3a18cfa40202946fb9566b622a6737e43d7e3de`
- T = `a2818b8f25d83d678c089cd617a8ffff56729e96`
- C = `c1f511cc4e9da68b20a3334089f814c7f9e8f1a9`

A: main/base.txt=`base\n`. T: feature/restore adds thread.txt=`thread work\n`. C: project-current adds project.txt=`new project code\n`. T != C. Throughout: refs/tags/feature/restore=C, refs/tags/project-current=T. No remotes configured. Tags never move.

| Row | Run ordinal | Durable result | W HEAD/files | New native turn/start | New provider-session events |
|---|---:|---|---|---:|---:|
| R0 | 4 | completed | T: base + thread; project absent | 1 | 1 |
| R1 | 5 | completed | T: base + thread; project absent | 1 | 1 |
| R2 | 6 | completed | C: base + project; thread absent | 1 | 1 |
| R3 | 7 | failed | absent | 0 | 0 |
| R4 | 8 | completed | C: base + project; thread absent | 1 | 1 |

### R0

Run `run:thread:mcp%3A2981d4ac-1873-45cd-a149-5bc3c6c02a3c:ordinal:4`
Attempt `run-attempt:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A4:attempt:1`
Root node `node:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A4:root`
Requested 2026-10-26T20:51:23.644Z; started 2026-10-26T20:51:23.725Z; terminal 2026-10-26T20:51:38.442Z. CLI exit 0.
W existed before the turn, at T with exact expected files. No recreateMissingWorktree span ran. Read-only real Codex completed at W/T.
Ordered service spans (start ns → end ns):
- RunExecutionService.startRootRun: 1793047883733551485 → 1793047883800261262

### R1

Run `run:thread:mcp%3A2981d4ac-1873-45cd-a149-5bc3c6c02a3c:ordinal:5`
Attempt `run-attempt:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A5:attempt:1`
Root node `node:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A5:root`
Requested 2026-10-26T20:51:44.425Z; started 2026-10-26T20:51:44.634Z; terminal 2026-10-26T20:51:53.429Z. CLI exit 0.
Deleted W only, leaving stale registration and refs/heads/feature/restore=T. Recovery pruned and recreated W; branch remained T. P stayed project-current/C. Exact files and tag refs match the oracle.
Ordered service spans (start ns → end ns):
- ProviderTurnStartService.recreateMissingWorktree: 1793047904467201391 → 1793047904610613516
- RunExecutionService.startRootRun: 1793047904645100849 → 1793047904704639016

### R2

Run `run:thread:mcp%3A2981d4ac-1873-45cd-a149-5bc3c6c02a3c:ordinal:6`
Attempt `run-attempt:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A6:attempt:1`
Root node `node:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A6:root`
Requested 2026-10-26T20:51:59.578Z; started 2026-10-26T20:52:00.136Z; terminal 2026-10-26T20:52:08.660Z. CLI exit 0.
Deleted W, pruned registration, deleted refs/heads/feature/restore. P remained project-current/C. Recovery created the missing branch at C; exact base/project files, thread absent.
Ordered service spans (start ns → end ns):
- ProviderTurnStartService.recreateMissingWorktree: 1793047919641074783 → 1793047920098380581
- RunExecutionService.startRootRun: 1793047920148799855 → 1793047920208414575

### R3

Run `run:thread:mcp%3A2981d4ac-1873-45cd-a149-5bc3c6c02a3c:ordinal:7`
Attempt `run-attempt:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A7:attempt:1`
Root node `node:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A7:root`
Requested 2026-10-26T20:52:15.690Z; started None; terminal 2026-10-26T20:52:18.340Z. CLI exit 1.
Deleted W, pruned, deleted branch; detached P at C. W and refs/heads/feature/restore stayed absent; crossed tags remained. Run, attempt and root node all failed with null startedAt. Zero native thread/start, thread/resume or turn/start; zero provider-session events, zero provider-turn events, zero CodexAdapterV2.openSession or RunExecutionService.startRootRun spans in this run interval. Existing idle Codex process was not counted as a start.
Durable error item `turn-item:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A7:signal:worktree-recreate-failure`; event sequence 258, event id `event:thread:mcp%3A2981d4ac-1873-45cd-a149-5bc3c6c02a3c:4fb479e5-a5f3-4a22-9189-adfe3276bd7d`.
Title: `Couldn't recreate thread workspace`; class `provider_error`.
Message: `Could not recreate branch 'feature/restore' at /tmp/ev-18359/worktrees/project/restore: the project workspace has no current branch to start it from (detached HEAD?).`.
Ordered service spans (start ns → end ns):
- ProviderTurnStartService.recreateMissingWorktree: 1793047935736836828 → 1793047935952162736
- ProviderTurnStartService.recreateMissingWorktree: 1793047936075935103 → 1793047936280574254
- ProviderTurnStartService.recreateMissingWorktree: 1793047936499069240 → 1793047936695901601
- ProviderTurnStartService.recreateMissingWorktree: 1793047937112613886 → 1793047937325800119
- ProviderTurnStartService.recreateMissingWorktree: 1793047938145007217 → 1793047938339229569

### R4

Run `run:thread:mcp%3A2981d4ac-1873-45cd-a149-5bc3c6c02a3c:ordinal:8`
Attempt `run-attempt:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A8:attempt:1`
Root node `node:run:run%3Athread%3Amcp%253A2981d4ac-1873-45cd-a149-5bc3c6c02a3c%3Aordinal%3A8:root`
Requested 2026-10-26T20:52:24.133Z; started 2026-10-26T20:52:24.783Z; terminal 2026-10-26T20:52:34.346Z. CLI exit 0.
Switched P back to project-current/C, changed no thread metadata and did not restart server. Fresh ordinal 8 completed at W/C with exact files. Ordinal 7 remains failed with its durable error in the post-R4 event/projection history.
Ordered service spans (start ns → end ns):
- ProviderTurnStartService.recreateMissingWorktree: 1793047944233741200 → 1793047944757048294
- RunExecutionService.startRootRun: 1793047944800897076 → 1793047945069127702

Exact before/after fully-qualified branch/tag refs, worktree porcelain, P/W HEAD and file contents, durable events and IDs are in runtime-trace.json. Native summary is a whitelist extraction retaining timestamps, methods, IDs, cwd/model and identity; provider configuration and credentials are omitted. Server spans retain correlation IDs and timing. Checkpoint scopes/refs were created by the server after completed turns; branches and tracked files did not change during read-only provider turns. Deletion recovery makes no claim about uncommitted data.

## Cleanup and limitations

SIGTERM sent to recorded dev-runner PID 2104890. Its recorded process tree exited, including server, watcher and Codex children. Verification: zero live recorded descendants; port 15571 unbound. The first background launch exited before startup and had no surviving process. Test and CLI processes exited. Checkout remains clean at the original head; no commits, pushes, comments or PR watches. Scratch isolated home, fixture and evidence remain for lead audit. No live userdata reads, migration, browsers, images or videos.

Gaps: none in required R0–R4 or retained red/green proof. T5 optional typed failures beyond create are not separately injected. Existing 32 tests and T1 injection are suite evidence, not a claim of 32 separate runtime experiments.

## FRICTION

- CLI | new worktree launch rejects an existing branch | use supported existing_worktree MCP launch for a pre-created real Git fixture.
- capture | preliminary post-turn snapshot raced the next mutation | repeat full matrix under one sequential subprocess driver, snapshot before advancing.
- event storage | orchestration_v2_events is empty in this runtime | capture authoritative orchestration_events plus V2 projections by thread.
- tooling | external MCP script initially lacked NetService | provide the same NodeServices + Net layer as binCli.
- isolation | default seeding could read live state | explicit --no-seed and fresh --home-dir; no migration.