# Issue 24459 — proof audit pass1 update

Scope: `/home/ubuntu/wt/issue-24459`, branch `fix/issue-24459`, [f519f17bd0](https://git.cafe/pingdotgg/t3code/commit/f519f17bd07b75dbe8de81f536427f0013a11139), compared with [eea9895368](https://git.cafe/pingdotgg/t3code/commit/eea989536849e5b5049987ee24318b5a77326542). Complete final 17-file diff read, including every test/mock addition. Both revisions checked locally; head worktree clean before artifact creation. This is proof planning, not a correctness verdict. No tests, servers, browsers, native sessions, captures, agents, MCP mutations, or forge writes were run. Only synthetic plan/scripts outside the worktree were written and uploaded as requested. All final-head outcomes below remain UNVERIFIED.

Supersedes [initial matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/45d25448a22058e0/matrix.md). Prior lead observation: base display-name search found nothing; interim head showed selectable `Issue 24459 Project Model`. This is reported context, not final-head or full-matrix evidence. Use NAME search `Issue 24459` (or `Issue24459` only if the actual fixture name contains that contiguous text); current fixture has spaces. Never use slug search in the picker. `uni/medium-gpt` is a target/model ID, not a supported picker search query.

## Final affected paths

| Final path/change | Minimal proof rows |
|---|---|
| OpenCode v2 location catalog, shared full-entry conversion, `modelsForCwd`, cache/invalidation | D1–D5 |
| Registry models-only refresh for unselected providers, pending snapshot, concurrent full scan, target instance filter | D2–D4, R1–R4 |
| Optional wire snapshot models; exact-cwd resolver, preserved machine catalog/identity fallback | D1, D5, V2/V5 |
| Web ChatView effective environment and worktree/root cwd feeds models, options, selection/handoff | V1–V3 |
| Native existing composer and settings session cwd | V4–V6 |
| NEW final native NewTaskFlowProvider scoped config + refresh before thread exists | V4, V5 |
| NEW final settings Manage hidden rebuild uses scoped models; new-task route supplies cwd | V6, both route owners |
| MCP capabilities and delegate/create target catalog loads; recovery reloads caller-scoped models | R1–R4 |
| Driver interface/re-export and maintenance/mock additions | Covered by focused boundary checks; no extra screenshot fixture |

## Fixtures and minimal visual matrix

A = `/tmp/issue-24459-project`; its OpenCode config adds `uni/medium-gpt`, name `Issue 24459 Project Model`, group `Issue 24459 Project Provider`. O = enabled, installed, healthy OpenCode instance using `/tmp/issue-24459-tools/node_modules/.bin/opencode` (installed version 2.1.4 per user). N = another configured healthy provider selected initially. Do not insert the target slug into T3 custom models. M = actual provider host cwd outside A/config ancestors, with no A-only model. B = `/tmp/issue-24459-neutral`, outside A and with M's catalog. W = actual app-bound worktree thread whose effective cwd has B's catalog; prove its cwd, do not merely rename a root thread. Neutral selections for absence checks prevent synthetic fallback rows from being mistaken for catalog entries.

Each required cell means **both base and final head**, same data/action/viewport/theme/scroll/selection/zoom, recorded from the same checkpoints. Do not repeat only one baseline light clip as in the old plan. Desktop shares web rendering; Electron shell/IPC unchanged, so no extra desktop matrix. No other provider adapter has a workspace catalog implementation changed; retain N machine behavior as the control. Local/remote use the same scoped wire contract; native remote connection is the remote consumer proof. No tunnel-specific change. No new user docs required.

| Row | Interaction chapter / observable result | Web 1440×900 light/dark | Web 390×844 light/dark | Native EAS iOS light/dark |
|---|---|---|---|---|
| V1 | A neutral unsent draft, N selected: open picker, display-name search, select O project model, close/reopen. Show group/name, selected label and actual available options; machine model retained | both revisions | both revisions | covered V4 |
| V2 | A → neutral B → A; A root → W → root. Show target absent from actual B/W catalog and restored in A, neutral selection for absence | both revisions | both revisions | covered V5 |
| V3 | Existing O A thread: button picker and configured command/keybinding; current label/options, handoff label if pending handoff fixture exists. Switching lock obeyed | both revisions | both revisions | covered V4/V6 |
| V4 | Native **new task before creating any thread**, N initially selected: select A, enter model settings, name search/select O target, return/reopen. Also existing A thread composer/settings route; show selected option/descriptors and locked existing-thread state | N/A | N/A | both revisions |
| V5 | Native new-task project selector A → B → A with neutral model; existing root A ↔ W thread. Show refresh on new-task entry/project change, no prior composer needed to prewarm it | N/A | N/A | both revisions |
| V6 | Native Manage hidden, **new-task and existing-thread session owners**: target visible in A, hide → regular list omits → Manage hidden still lists scoped target → unhide → regular list restored. Enter B/W and prove no leaked target. Locked session must preserve provider lock | N/A | N/A | both revisions |

Minimum package: 4 web variants × 2 revisions = 8 recordings, plus 2 native themes × 2 revisions = 4 recordings; 12 total, chapters combine rows. Native is a real EAS iOS app, not narrow web. Prefer 390 logical points; record actual device dimensions/scale. If only 402 is available label 402 and leave exact-390 unmet, never rescale to claim it. No native 1440/tablet requirement. If baseline cannot select/hide an undiscovered target, record that failure at the matching step and mark downstream checkpoints unreachable; do not seed a custom model to force apparent parity. Shared checkpoints remain directly comparable.

Every recording must show actual interaction and elapsed waiting, identify revision/build, renderer, viewport/theme, project/effective cwd, initial selected provider and cold/warm state. Timestamp captions or synchronized narration must announce search/select/reopen/navigation/hide/unhide and catalog arrival. Include original pauses/errors; stills or edited montages cannot prove timing or refresh. Do not send a turn to the unreachable inference endpoint.

### Settled stills: diff0 and threshold

For each distinct visible checkpoint in each required cell, retain three chronological PNGs ≥500ms apart after interactions/loading finish, minimum 1s total window. Keep raw unmasked images. Run adjacent pair comparisons with [compare-stills.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/86825427c238b07a/compare-stills.py). It requires Pillow and emits exact changed-pixel count / `diff0` plus threshold ratio: max RGB channel difference >16 in at most 0.1% of pixels. Both metrics must be reported, not substituted. Two adjacent `diff0=true` results prove exact settle; when native status bar/cursor prevents exact equality, report exact failure plus threshold results and inspect/localize changed regions. Threshold alone is a disclosed weaker settle claim, never relabel it diff0. A spinner in a tiny region is not settled merely because it passes the ratio. No masking/resizing/cropping away relevant content. Failed settle means keep the recording and mark the still provisional.

Compare base/head checkpoint stills separately with the same script/dimensions; cross-revision diff0 is descriptive, not expected for changed catalog content. Inspect both images and label Before/After. Save the metrics, UTC timestamps and screenshot-tool requests alongside each pair. Ratios are a declared audit tolerance, not an implementation latency/performance guarantee.

## Runtime/data branches — focused transcripts, no inference

| Row | Minimum observable proof | Existing final test coverage / remaining need |
|---|---|---|
| D1 | Real O CLI project catalog includes target; machine/B catalog omits it. Wire machine models unchanged, A snapshot carries full catalog; exact A resolution shows it. Same-slug renamed/options entry must replace full entry, not only add slug | Driver project-v-other + registry wire roundtrip + resolver tests exist. Same-slug metadata/options replacement not specifically established by these additions; focused replay required |
| D2 | N-selected refresh reads O **models only**, no O skill/command scan; O models-only snapshot remains pending. Selecting O still starts full scan | Registry `scans a project's own models while another provider is selected` covers these deterministic assertions |
| D3 | Hold full O scan with Deferred; concurrent getProvidersForCwd(A) returns A catalog before release, B remains machine; target N limits reads and never waits on unrelated O | Same registry test covers pending-full-scan/catalog isolation/instance filtering. It uses a stub modelsForCwd; it does NOT prove OpenCode cache coalescing |
| D4 | Driver concurrent same-cwd models-only/full reads share one catalog load; warm success within 5 minutes makes no new request; TTL expiry and explicit invalidation reread; unreadable retry suppressed within 30 seconds and retried afterwards; eventual healthy recovery | Driver added tests show successful warm reuse and failure cooldown/retry. Need focused fake-clock/Deferred transcripts for success expiry, invalidation, genuine concurrent coalescing and failure→healthy recovery. Count `/api/model` settling requests separately from logical loads; no sleeps/polling in tests |
| D5 | Equal/full-entry equality omits override; no/null/unmatched cwd retains machine provider identity; empty/unreadable catalog falls back; disabled/error/not-installed/v1 do not query v2 project catalog | Other-project equal omission, unreadable fallback and resolver no/null/unmatched covered in part. Focused branch assertions for empty/disabled/error/v1 and whole-entry metadata equality needed. Success empty catalog is Option.some and uses success TTL; do not claim every empty result retries after 30s |

Run existing focused files using [pass2-commands.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6917357b6386e6ae/pass2-commands.sh) `tests`. Save full command, revision, stdout/stderr, exit code, test names and UTC start/end. Their presence in this audit is not a passing report. Keep any supplemental proof harness outside checkout and identify it as an external replay; no repo-wide checks or evidence-script commits. If Vite module resolution requires a temporary include/config, keep it outside the worktree and document the exact invocation. No new tests were authored/executed here.

### MCP/service boundary matrix

Capabilities may be obtained from a genuine fixture-bound MCP session in pass2 if already available, but **no real agent/child/top-level thread launch is needed**. For delegate/create use the actual OrchestratorMcpService methods in a focused replay with real validation and mock capture of downstream dispatch/creation; do not start effect workers/providers. These are service-runtime catalog validation transcripts, not live MCP transport or inference proof. Label the distinction. Do not call this audit thread's capabilities and assume it belongs to A.

| Row | Required transcript/assertions |
|---|---|
| R1 capabilities | A parent selected N: full no-search result plus display-name search `Issue 24459`; O has target and real option descriptors. Default catalog is capped; omission alone is not failure. Repeat actual W caller, B caller, no parent, project-not-found and project-lookup-error fallback; assert effective cwd/worktree precedence and machine fallback. Use model ID for output/targets only |
| R2 delegate_task validation | Real service delegateTask with active scoped fixture parent and explicit O target/model: A accepted; capture resolved instance/model/options in downstream delegated_task.request, no provider invocation. B and W with nonempty machine catalog reject `model_unavailable` before dispatch. Exercise implicit parent instance and driver-only selection as resolution branches, options inheritance/overrides retained |
| R3 create_threads validation | Independently invoke real service createThreads with same A/B/W matrix, capture downstream resolved target/creation command via mocked boundary. A accepts scoped target; B/W reject it. No real top-level threads created. Reuse the fixture, not delegate result as a substitute for this caller |
| R4 recovery and cwd | For **both** R2 and R3 start explicit O as unavailable, refreshInstance makes it healthy, then assert getProvidersForCwd reloads **same parent cwd** before target resolution and scoped target accepted in A / rejected in B. Record ordered calls and target instance filter for delegation; createThreads loads all catalogs. Keep missing/failed project fallback cases deterministic, never corrupt live state |

Existing added MCP test covers scoped capabilities via a pre-populated registry mock and a worktree parent. It does not itself prove live registry discovery, project-root lookup, delegate/create scoped-model acceptance/rejection or refreshed scoped reload. Existing generic provider selection/options tests are controls, not replacements for R2–R4. No inference endpoint repair or agent completion is required for the stated catalog-validation claim. Service tests cannot be advertised as live MCP transport proof.

Transcript metadata: source revision, UTC times, fixture/config hash, binary version if used, environment/project/thread/run IDs where real (explicit synthetic IDs in replay), actual cwd and parent selection, snapshot timestamps, method/tool name + input + structured output/error, call ordering/counts, stable unique request IDs. Strip credentials, pairing URLs and headers; retain model IDs/options and errors. No private real-data uploads.

## Pass2 rebuild and seed instructions

Artifacts (review before executing; generated but unexecuted): [synthetic A/B seed](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/445ac428f91bd3d0/seed-fixtures.py), [revision-checked targeted tests/dev commands](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6917357b6386e6ae/pass2-commands.sh), [still comparator](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/86825427c238b07a/compare-stills.py). Download outside checkout; no committed evidence scripts. Seed refuses to overwrite a different A config and never writes databases/auth/settings. It does not manufacture B/W catalogs or application history; verify those separately.

1. Confirm head/base revisions and stopped task-owned servers. Existing `/tmp/issue-24459-before` is at base with dependencies and configured `.t3` copy; head is configured as well per lead. Preserve both isolated states; do not replace them with live data or blindly rerun migration. The prior reproduction reports live snapshot migration history mismatch. Do not use live `~/.t3/userdata` read-write. If rebuilding from scratch use `vp i`, let that revision migrate its own empty isolated `.t3`, configure actual fixture project/provider via real app settings, then stop before any copying. Never back-port a newer migrated DB into base.
2. Run seed script only in authorized pass2 if needed. Verify actual CLI `--version` and run `opencode models` from A and B/M; discovery is safe without inference. Check global/ancestor config cannot give M/B the A-only model. Keep provider host cwd outside A. The synthetic endpoint is `127.0.0.1:9`; no successful turn is expected. Configure the real O binary path; keep target absent from T3 customModels and initially unhidden.
3. `bash pass2-commands.sh before` or `after` runs the appropriate checkout at `T3CODE_PORT_OFFSET=7`; **one at a time**, stop the captured session before switching. Expected ports are 5740/13780, but actual dev-runner output is authoritative. Capture source/build identity and fresh startup pairing route privately. No VITE_HTTP_URL/VITE_WS_URL. Script does not check/kill the other runtime; operator must confirm it stopped. Never kill by name/path matching.
4. With explicit pass2 browser authorization use native T3 Preview/test-t3-app only: preview_status, preview_open if closed, startup pair once, snapshot/interaction tools in same tab. If unavailable stop web verification; no alternate browser. Rebuild/serve each revision's source, no stale production dist. In real app, retain A, add B and neutral stopped/draft threads; make W through app worktree flow with distinct catalog (A fixture config is untracked and must not be copied into W). Identify actual effective W cwd/catalog. Seed selected/hidden state identically through app commands on each revision. Do not use projection-only SQL to claim catalog/validation behavior.
5. New-task native proof starts cold before existing composer or MCP discovery warms A. Enter new-task flow with N selected, choose A and observe request `(selected instance N, cwd A)` and O snapshot; then B/back A. Key is environment+cwd, not selected model. Capture errors rather than assuming a failed request retries on same-project rerender. Existing native composer entry/typing refresh is another path; slash menu is not required. Settings machine pull-to-refresh is not scoped-cwd proof. Keep cold and warm runs identified.
6. Native EAS iOS: future executor reads eas-simulator Mode C workflow; check availability/auth/help without assuming access. Prepare fingerprint-compatible simulator dev client **before allocating** session. Current development profile has developmentClient but lacks `ios.simulator:true`; use an explicit simulator-compatible dev build/profile outside tracked evidence changes. A Linux host may need EAS build; record build ID/commit/fingerprint and exact source bundle. Do not reuse a release binary to claim live source. Separate fresh Metro bundles for base/head (or restart/reload verified source); same compatible native client only if fingerprints permit. Confirm correct app build and loaded revision before recording.
7. Start named EAS session only in authorized pass2; immediately install/connect Mode C dev client via reachable Metro tunnel. Native backend must reach isolated server via authenticated share/relay route; simulator localhost is not this Linux host. Do not publish pairing or controller tokens. Verify actual device size/theme, record V4–V6, download recordings/stills. On connection failure follow bounded reset once; report second failure, no silent mobile-web substitution. Stop only task-owned sessions/Metro after evidence collection unless user requests retention.
8. Run targeted tests/replays, retain raw transcripts, compare stills and inspect recordings. Publish evidence through ghdrop; embed labeled Before/After images and recordings in pass2 report. A missing row stays explicitly unmet. No forge writes or PR creation are authorized by this plan.

## Changes from prior matrix / FRICTION

- Added native pre-thread new-task discovery and both owners of Manage hidden, including hide/unhide reversal and A/B/worktree isolation.
- Replaced two representative baseline clips with paired before/after for all six requested variants; added exact/threshold settling protocol. Twelve combined recordings, not eight.
- Split registry concurrency from real driver cache coalescing; added model-only request counts, success expiry/invalidation and 30s failure cooldown/recovery requirements.
- Replaced actual delegate/create launches with focused real-service validation replay. Unreachable inference is no blocker for catalog proof; no agents or top-level conversations need start.
- Corrected search to the actual **display name** with spaces; slug search unsupported. Lead's interim success remains context only.
- Unverified: N health, M/B/W config isolation, cold native new-task behavior, EAS entitlement/dev client/exact device width/reachability, all final recordings/stills and executed test outcomes. Existing tests leave R2–R4 and portions of D1/D4/D5 unproved.
- No authorized runtime/capture happened in pass1. Scripts are reviewable future recipes, not executed seed/test/build evidence. Worktree remains unchanged; no forge mutation.