# Proof audit, pass 1

The existing runtime evidence for [#33263](https://git.cafe/pingdotgg/t3code/pull/33263) covers **R1 only**. Add timestamped server transcripts for **R2, R4, R5, R6, R7, R8**. R3 and R9 are controls; P1 is optional hosted-forge/client integration evidence. Their absent runtime captures do not block this narrowly scoped server cache fix. This is a proof-coverage verdict, not a merge-readiness verdict or a claim that the implementation is defective.

Reviewed the requested head [456327574c](https://git.cafe/pingdotgg/t3code/commit/456327574c52ad1c7624083bb97eaf382edd1732), branch `fix/issue-33256`, against main [4c361199f4](https://git.cafe/pingdotgg/t3code/commit/4c361199f47f6ea32a2c14835df392640d0f7c63), using the full triple-dot diff. The production change is limited to the local-only branch of `VcsStatusBroadcaster.refreshStatus`; the other changed file is its test module. Inspected the PR body, its inlined driver, comments/review metadata, callers, stream consumers, and relevant cache/read paths. No new server, client, test run, edit to a checkout, push, or PR comment was made for this pass.

The existing before/after SHAs remain valid for R1. The broadcaster, its tests, GitManager, GitWorkflowService, VCS contracts, relevant clients, and turn-finalization observer are unchanged between the captured fix [33cb900503](https://git.cafe/pingdotgg/t3code/commit/33cb9005036fc80b97bb50dbf51132d09e8ec91b) and the requested head. The relevant broadcaster/workflow/manager code on the before baseline [c6ca605630](https://git.cafe/pingdotgg/t3code/commit/c6ca6056309904f89b90b6055d797973be0a0939) also matches current main. Intervening shared-git changes concern branch-list deduplication, and the RPC changes concern provider model discovery; neither changes this evidence path. **Do not recapture R1 solely because main was merged.** Label the existing evidence with its actual SHAs; capture missing rows on the requested head, with matching before runs when demonstrating the regression.

GitCafe's stored PR metadata still names the earlier head [0b756033f5](https://git.cafe/pingdotgg/t3code/commit/0b756033f55321387aafac797221a9049b7df5df). A read-only `git ls-remote origin` confirmed the branch and main at the requested SHAs above. Stored checks/reviews were not treated as current-head verification.

## Paths and data that determine the fixtures

- **Entry point:** [BranchToolbarBranchSelector.tsx](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/web/src/components/BranchToolbarBranchSelector.tsx#L512) sends `vcs.refreshStatus { cwd, localOnly: true }` when the menu transitions to open. Its imperative open method reaches the same handler through [BranchToolbar.tsx](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/web/src/components/BranchToolbar.tsx#L657) and the [composer branch shortcut](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/web/src/components/chat/composerShortcuts.ts#L32). The caller ignores the RPC return value. No separate Settings or command-palette local-only caller was found.
- **Transport:** [shared command and stream state](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/packages/client-runtime/src/state/vcs.ts#L315) route to the environment; the [RPC contract](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/packages/contracts/src/rpc.ts#L1508) accepts optional `localOnly`; the [server handler](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/ws.ts#L3153) defaults it to false and forwards it. Local, remote/relay, and tunnel connections execute the same destination-environment method. No protocol or authorization change creates another fixture.
- **Clients:** web and desktop use this same web renderer. [Mobile git refresh](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/mobile/src/state/use-selected-thread-git-actions.ts#L117) and shared mount/reconnect revalidation omit `localOnly`, so they use the unchanged full-refresh path. Mobile still consumes the same stream and can observe a cache affected by a web/desktop client in the same environment. Its [git summary](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/mobile/src/features/threads/ThreadGitControls.tsx#L45) displays PR/ahead/behind state. No native-only local-only caller or Electron IPC variant exists.
- **Other service callers:** websocket mutation follow-ups and `WorktreeMcpService` call full `refreshStatus(cwd)`, not local-only. [RunFinalizationService](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/orchestration-v2/RunFinalizationService.ts#L102) refreshes local status, then starts `refreshPullRequestStatus` only for a non-default named branch matching the thread and a compatible active run. Providers and scheduled work converge on this observer; no provider-specific cache branch needs duplication.
- **Cache shapes:** no cwd entry; a local entry with absent remote (`remote: null`); a remote wrapper `{ branch, fingerprint, value: null }` meaning an actual null remote result; and a wrapper whose value is `{ hasUpstream, aheadCount, behindCount, aheadOfDefaultCount?, pr }`. In the last shape, `pr: null` is **not** `value: null`. Positive PRs and the open/closed/merged/draft variants all travel in that same remote object. Local status contains repository/primary-remote flags, nullable `refName`, working-tree data and optional branch totals. The branch key can be a named branch or null for detached/non-repository status.
- **Changed decision:** [local-only refresh](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L536) no longer samples previous state, invalidates remote status, obtains the remote write lock, or writes a synthetic null-valued remote wrapper when the branch changed or no remote was cached. [Local cache update](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L300) still clears a mismatched branch's remote and publishes `remoteUpdated: null` before `localUpdated`. Same-branch remote state stays intact. A local-only RPC may validly return default remote fields while no remote read has completed.
- **Readers:** [getStatus](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L384) reads when the remote wrapper is absent; [turn-end PR refresh](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L565) skips a nonexistent cwd or a null-valued wrapper, but reads an existing cwd with absent remote; [subscriptions](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L746) start their first poll immediately only when the wrapper is absent. `includeRemote: false` observes without starting a poll. Existing pollers are retained rather than restarted for additional subscribers. [readRemoteStatus](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L443) checks the branch before/after I/O and discards a switched-branch result; every actual read already invalidates the lower remote cache.
- **Time:** [interval-zero handling](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/server/src/vcs/VcsStatusBroadcaster.ts#L591) permits the needed initial read with `refreshUpstream: false`, then skips periodic reads. Turn-end reads also use `refreshUpstream: false`. Zero therefore needs its own initial-subscription fixture; the same zero setting can cover turn-end recovery without duplicating that fixture at 30 seconds.
- **Visible consequence:** the [shared stream reducer](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/packages/shared/src/git.ts#L315) converts a null remote into no upstream, zero divergence/default-ahead counts and no PR. It preserves remote fields for a `localUpdated` event and replaces them for `remoteUpdated`. Thus a synthetic null event can remove branch-derived PR status and alter push/pull/create-PR availability. The [web PR badge](https://git.cafe/pingdotgg/t3code/blob/456327574c52ad1c7624083bb97eaf382edd1732/apps/web/src/components/BranchToolbarBranchSelector.tsx#L540) also has linked-PR sources that can mask this defect. There is no separately changed layout or client presentation branch.

## Fixture matrix

Every row below is **recording**: the proof depends on action order or timing. A timestamped server RPC/event transcript counts as a recording. Status describes existing runtime evidence in the PR body, not whether a unit test exists. Controls and the optional integration row are explicitly outside the minimum set.

Use synthetic branches A and B with distinguishable tracked divergence, e.g. A ahead 1/behind 0 and B ahead 2/behind 1. Preseed remote-tracking refs before interval-zero runs. Include `aheadOfDefaultCount` when logging the full remote payload; its numeric variants do not select another branch in this fix. Positive PR payloads need a hosted-forge fixture (P1); local-bare-remote rows deliberately use `pr: null`.

| Row / named fixture | Cache, branch, interval and interaction | Diff effect and user-visible expectation | Real-app seed / required timestamped evidence | Minimum? | Existing PR-body evidence / status |
|---|---|---|---|---|---|
| **R1 cold-subscribe** — recording | Fresh cwd, no remote read, stable named branch A, 30 s. Local-only RPC completes, then first remote-enabled subscription. | Direct fix: leave remote absent; subscription reads immediately. Upstream/ahead data appear promptly instead of waiting for the poll interval. | Existing synthetic git repo + local bare remote, A one commit ahead. Log RPC, snapshot, and subsequent remote event before 30 s. | **Yes** | **covered**. Before baseline records null snapshot and no remote update in its 8 s window. After records `hasUpstream: true, aheadCount: 1, behindCount: 0, pr: null` 451 ms after subscribing. This proves bounded observation, not a measured full 30 s delay or a positive PR lookup. Actual captured SHAs remain valid. |
| **R2 cold-turn-end-zero** — recording | Fresh cwd; local-only RPC creates local cache without a remote read. Interval 0; passive stream only. Finish an eligible turn on A. | Direct fix: absent remote must not trip the null-value early return in `refreshPullRequestStatus`. Upstream/divergence recover on completion despite no automatic poll. | Synthetic repo/bare remote; set and log `server.updateSettings { patch: { automaticGitFetchInterval: 0 } }`. Use a free replay turn in an isolated dev server, thread branch A matching the checkout. Log local-only RPC, passive snapshot, turn/finalization milestone and remote update. Do not call a full refresh first. | **Yes** | **missing** runtime. The new cold PR-refresh unit test exercises the service path with a mocked remote payload; the body transcript never finishes a turn. |
| **R3 warm-same-branch** — recording | Cached non-null remote for A, no read in flight; edit worktree and local-only refresh on A. Payload variants: actual PR vs `pr: null`, tracked vs no upstream, positive vs zero counts. | Steady-state control: preserve cached remote exactly while local fields update; do not emit a synthetic clear or force a new remote read. | After R1, issue another local-only RPC with a local edit and log passive events/final snapshot. Bare remote supplies `pr: null`; positive PR variant requires P1. These field variants share the same cache branch and need no separate captures. | No; existing behavior and focused unit test suffice. Cheap to append to another run. | **missing** runtime, optional. Existing same-branch test preserves a PR and ahead 2/behind 3. R1 does not reopen after warming the cache. |
| **R4 branch-switch-subscribe** — recording | Warm A remote; stop all remote-enabled subscriptions; switch externally to distinct named branch B; local-only refresh; then a fresh remote-enabled subscription at 30 s. | Direct fix: drop A's remote, publish a clear to any passive observer, leave B remote absent so the new subscription reads immediately. Never label A's remote as B's; B's counts replace defaults promptly. | Bare remote with A/B tracked refs and distinct divergence. Keep a passive observer to log clear then local branch update. After switching, local-only RPC, then start the sole active poller and log B's remote. An already-running poller would test a different cadence. | **Yes** | **missing** runtime. Existing terminal-switch test proves clear/local event order and a later `getStatus` load; it does not supply this real-server subscription transcript. |
| **R5 branch-switch-turn-end-zero** — recording | Warm A remote, no active poller, interval 0. External switch to B, local-only refresh, eligible B turn finishes; passive stream remains. | Direct fix: B's absent remote permits turn-end reading, rather than remaining synthetic-null indefinitely. A's badge/counts clear and B's data are published. | Same two-branch synthetic repo; seed B tracking refs before disabling fetch. Bind the replay thread to B so the finalizer does not skip on branch mismatch/default branch/active-run checks. Log initial A data, switch, local-only clear/local events, completed turn and B remote update. | **Yes** | **missing** runtime. New branch-switch PR-refresh unit test covers the mocked service outcome. R1 neither switches branches nor runs finalization. |
| **R6 first-read-overlap** — recording | No cached remote for A; first subscription remote read is already in flight; same-branch local-only refresh overlaps it; interval 30 s. | Direct race fix from removing the remote write lock/synthetic write: remote result survives completion. No later null event may erase the just-read PR/upstream/counts. | Bare remote with gated upload-pack for its first fetch (or an isolated forwarding git wrapper); gate logs read-start and explicit release. Start subscription, wait for gate, edit worktree, send local-only RPC, observe local update, release read, then log remote event, RPC settlement and a fresh passive snapshot. On the before side do not await RPC settlement before release: it waits for the remote lock. | **Yes** | **missing** runtime. New overlap unit test uses Deferred gates and checks PR survival. Existing driver awaits local-only completion before subscribing, so it cannot cover overlap. |
| **R7 switched-in-flight-read** — recording | A remote read is in flight; switch to B during it and run local-only refresh. Release A read; after old subscription ends, subscribe on B with no retained poller. | Affected combination of branch mismatch and removed lock. Discard the old read; do not restore A or install a fake no-remote result that prevents B's next read. Clear when A was cached; B ultimately gets its own data. | Gate an A poll before completion, switch externally, log local-only B refresh, release and settle old read, then end that active subscription and open B's new one. A/B distinguishable counts certify final ownership. Bare remote is enough; no hosted PR required. | **Yes** | **missing** runtime. Existing in-flight branch-switch unit test was updated to allow a fresh new-branch read; R1 has no concurrency or branch switch. |
| **R8 cold-subscribe-zero** — recording | Fresh cwd, no remote read, interval explicitly 0. Local-only RPC then first remote-enabled subscription on A. | Direct fix plus distinct scheduler branch: perform the needed initial remote status read without upstream fetch; do not treat zero as disabling initial status or rely on a later periodic repair. | Clone R1's synthetic fixture with tracking refs already populated. Log successful settings update to 0, local-only RPC, snapshot and immediate populated remote event. Git command tracing can certify no `fetch`; proving the unchanged absence of later polls is optional, not a demand for a long idle video. | **Yes** | **missing** runtime. Existing transcript explicitly uses the default 30 s. The added regression tests also use the default fixture interval. |
| **R9 genuine-null / non-repository** — recording | Actual remote read on a non-git directory caches `{ branch: null, value: null }`; local-only refresh stays on null branch. Detached/no-remote git repos instead may produce a non-null status object with `pr: null`. | Control for data semantics: retain an actual null result and no-repo UI; do not confuse it with the absent remote needed for recovery. Detached/no-upstream object cases fold into R3 because the change only compares branch identity and wrapper presence. | Empty synthetic directory, initial active subscription then passive observation/local-only RPC. Do not directly inject the old erroneous wrapper into the fixed server. Genuine null is producible; a bogus null wrapper for a normal repository is the bug, not a supported seed API. | No; no distinct visible regression fixed here. | **missing** runtime, optional. Existing bare-remote repo is a real repo with a non-null remote object and `pr: null`, not this shape. |
| **P1 positive PR / real-client integration** — recording | A hosted GitHub remote with a real discoverable PR for the selected branch, authenticated lookup, and no linked-PR fallback masking the branch badge. Reuse R6 or R5 rather than inventing another cache case. | Shows actual PR status survives/recovers and the web toolbar consumes it; could additionally show divergence-dependent git controls. Same server payload path as required rows. | Local bare remote alone cannot produce a GitHub PR. Needs an existing authorized GitHub-hosted fixture/branch with a PR; none was established by the supplied evidence. Prefer read-only reuse, not creating or publishing a fixture PR for this audit. If available, record positive PR metadata over RPC and optionally the client menu/badge flow. | No additional server scenario; optional integration confidence. | **missing** runtime/client evidence and explicitly acknowledged in the body. Mocked workflow tests prove PR payload/cache handling, not a live GitHub lookup. Not producible using only the supplied local-bare fixture. |

## Capture scope and practical limits

Minimum complete set is **R1, R2, R4, R5, R6, R7, R8**; R1 already exists. Six missing rows can share one driver/log with separately reset cwd/cache fixtures. R2 and R5 deliberately use interval 0, covering turn-end behavior with polling disabled without duplicating the same service decision at 30 seconds. R8 remains separate because the initial-poller zero branch is different. A full-refresh/getStatus call must not repair the cache before the transcript reaches its intended observation; unit tests already exercise the getStatus reader, and it has no standalone status RPC in this path.

Use fresh isolated server state and synthetic repositories, not live userdata or the checked-out project. A real server is required, but no UI is needed to capture these server-only scenarios. Gate concurrency on an observed I/O start and explicit release, not guessed delays. Keep logs of settings, branch/ref state, RPC actions/results, stream events and gate milestones. Inspect final state through passive `subscribeVcsStatus { includeRemote: false }` so observation does not start a repairing poll. The gate is a synthetic transport delay, not a mocked VCS service; log that fact. Terminate only the server/gate processes the capturer started, using tracked PIDs.

For R2/R5 there is no direct websocket method named `refreshPullRequestStatus`. Drive a real eligible turn through RPC or CLI and observe finalization, using the free Replay provider in isolated source dev mode. The existing plain `serve` driver needs this addition; its two current calls alone cannot reach the turn-end reader. Replay provisioning is documented by the repository's testing guidance. Ensure no mount/reconnect/full refresh or active poll prepopulates/repairs the cache first. If an eligible replay turn cannot be arranged, mark that row unproduced rather than relabeling another subscription run as turn-end proof.

A real-client capture adds **consumer/presentation integration evidence**: the actual menu action issues the command, the displayed branch badge reads the expected source, and git controls reflect the stream. It adds no distinct changed UI state machine for this PR and does not replace any missing server ordering fixture. A still image cannot prove survival across an overlap; use a short recording if doing that optional capture. Avoid linked/current-thread PR metadata that would keep a badge visible even when branch status is lost. No screenshot requirement is added for unchanged web, desktop or mobile rendering.

All fixture instructions and proposed payloads are synthetic; the uploaded audit contains no credentials, customer data, live thread data, or runtime model identifiers. Coverage derivation completed within the requested 45-minute budget. Existing test results are attributed to the PR body and source inspection, not represented as a fresh test run.

FRICTION: forge | GitCafe PR snapshot names an older head while origin names the requested merged head; remote refs supplied the revision truth for this audit. | A synchronized PR metadata snapshot would avoid the discrepancy.

VERDICT: INSUFFICIENT R2, R4, R5, R6, R7, R8