# Headless proof for thread worktree and branch reconciliation

Target: [#15989](https://github.com/pingdotgg/t3code/pull/15989), head branch fix/v2-follow-worktree-drift. Comparison base: [34c5a6d4](https://github.com/pingdotgg/t3code/commit/34c5a6d4461ff7be2c1a059c3c51c3496c1e14df). Exact publication head: [42590b7bf7](https://github.com/pingdotgg/t3code/commit/42590b7bf76f32d574c4aa2f84a410706ed5d009).

This is authored output from disposable fixtures. All 19 PR source hashes were checked unchanged after live verification. No raw settings, tokens, provider logs or private project data are included. No browser or native-client rendering claim is made.

## Before → after

Main leaves branch/worktree metadata stale after Claude's native move. The rebuilt service tests use actual Git repositories, SQLite event ingestion, Orchestrator, EffectOutbox, worker drain, checkpoint capture and RuntimePolicy, with Deferred milestones instead of sleeps. They prove old-checkout capture before metadata follow, and destination scope/routing before a promoted queued successor starts.

The fourth review found an instance-wide session regression in the rebuild. Actual Codex P1 → settle P1 → P2 reproduced it before the guard: native cwd/file was P2 but finalization persisted P1 as the thread checkout and checkpoint scope. The current-source repetition passes:

| Observation | Before capability guard | Current source |
| --- | --- | --- |
| Session cwd | P1 | P1 |
| Shared bindings | Only P2 | Only P2 |
| Native cwd/file | P2 | P2 |
| P2 thread worktree | P1, wrong | null, project P2 |
| P2 thread branch | main, wrong adoption | null |
| P2 checkpoint scope | P1, wrong | P2 |

SQL confirms exactly one Codex binding, P2, after P1 is settled. Capability and sharing checks exclude ambiguous session location. Branch reconciliation is independent.

The linked-root control rejects a retained observation after the project is repointed from R1 to linked R2 of the same Git repository. The failed-Enter recovery control executes A's real reusable failure with no checkpoint effect, then successful B in the same session with no new native hook; C must start in the moved checkout. The old per-run timestamp gate produced 643 passes and one failure. Native source-checkout provenance makes all 645 pass while keeping the linked-root control passing. Status/release timestamps do not manufacture provenance. Failed provider recovery is service/adapter proof, not a forced live provider error.

A later CodeRabbit finding identified a different lifecycle: failed A moved to W, but B opened a fresh Claude query process at requested R and inherited W/sourceR from the dead process. A real adapter lifecycle control uses separate process message queues, SDK failed/success result frames, and public startTurn with a model change that requires replacement. Before the fix, replacement omitted both the R/no-source reset and a repeated native Enter W update; live-process reuse passed. After the successful-open reconciliation, both variants pass. Resetting occurs after open succeeds and before turn handling, and explicitly clears source provenance. Reusing the live process retains the original W/sourceR observation. A shared constant also preserves the exact workspace-change detach reason across producer and projection stores.

The process-replacement failure is dynamically verified at the SDK adapter boundary, rather than by forcing a live Claude failure. Policy-change and process-exit reopening share the reviewed successful-open path; no separate live failure claim is made.

## Actual current-source providers

Thirteen actual Claude turns completed against the isolated server and real CLI/SDK:

1. Native Enter plus queued successor at the destination.
2. In-place branch switch plus queued successor on the adopted branch.
3. Native Exit(remove) plus queued successor at the project root.
4. Shell cd src, native Enter and Exit(keep): factual cwd returns to repo/src while thread metadata returns to its selected project root.
5. Another native Enter writes a cwd marker; projects.readFile using the projected checkout returns that exact marker; Exit(keep) returns correctly.
6. Native Enter, actual backend stop/restart, then native Exit(keep): resumed session and final metadata return correctly.
7. Repoint project R1 to linked R2, confirmed by actual matching Git common directories, then complete another turn without native movement. Thread remains null worktree/branch with checkpoint scope R2. The reused provider still runs at R1/src, an existing lifetime limitation; its old native source differs from R2 and is ignored.

| Queued step | Metadata sequence | Successor running sequence |
| --- | --- | --- |
| Enter | 65 | 69 |
| Branch | 144 | 147 |
| Exit(remove) | 228 | 232 |

Sequences come from the subscribed durable event stream; later compaction can remove obsolete events. Final assertions read persisted projection/scope after capture, not merely an earlier run-terminal notification. Actual Codex isolation passes as above. Owned backends 953328 and 960157 were stopped.

## Checks and review

- Ten suites: original 658 → final 645 registered cases, all passing serially, no skips. All 637 baseline cases and 2,271 baseline assertion sites retained. Eight PR cases exercise the integrated behaviors; no new one-off test file. Current total assertion sites: 2,350.
- Server/contracts/provider-core typechecks pass. All 19 PR TypeScript files pass scoped lint/format and whitespace checks; four existing lint warnings remain.
- Earlier parallel background-steering timeouts remain unexplained; serial checks pass.
- Ten fresh dual whole-PR review rounds; both final reviewers returned no findings. Earlier rounds fixed queued ordering/provider identity, subdirectory normalization, explicit handoff precedence, multiplex-session cwd adoption, linked-root repoint and failed-turn recovery. The final round returned no findings after the fresh-query reset and shared detach-reason constant.

## Human verification and limits

Native location follow is Claude Git Enter/Exit; other providers retain branch follow only. Legacy sessions without source provenance fail closed until a fresh native move. A server restart between a failed move and catch-up loses source provenance; this flow is not claimed fixed. Repointing does not rebind an unchanged live session. Failed Exit(remove), concurrent cross-thread adoption and external checkout during branch naming retain the limits described in the PR.

An explicit MCP handoff previously retained its destination after manual queue resume; current integrated tests preserve handoff revocation and source ordering. Automatic continuation still hits main's planned-release failure and holds the queue, addressed separately by [#15203](https://github.com/pingdotgg/t3code/pull/15203). An alternate Claude-instance first query can fail with a duplicate native session ID; a root-only control reproduces it in unchanged base code. Neither issue is claimed fixed here.

Live OpenCode, alternate accounts, native client rendering, macOS, Windows, iOS, Android and Electron desktop were not verified. CI on the exact publication head and human approval remain separate gates.

Implementation: GPT-6.1 Sol through Codex in T3 Code. Tests: GPT-6 Astra through Codex. Reviews: Claude Opus 5.5 through Claude Code and GPT-6 Sol through Codex.