# Proof audit pass 1

PR: [#19414](https://github.com/pingdotgg/t3code/pull/19414)
Scope: [fef851bee0](https://github.com/pingdotgg/t3code/commit/fef851bee0) → [cdc28c82a5](https://github.com/pingdotgg/t3code/commit/cdc28c82a5).
Read-only audit; no tests, browser, server, captures, or repository edits performed. Test outcomes below are supplied by the lead, not independently executed here.

## Render fixture matrix

Empty: zero affected render paths. No web, desktop, mobile, client-runtime, renderer, styling, layout, or animation files change. The optional contract marker carries server state; no new client rendering consumes it. Removal of the server budget failure changes which existing state appears, not its renderer.

Affected visual rows: none. Required stills: none. Required recordings: none. No provider × client × connection-mode visual expansion is justified. User explicitly permits server-only proof as a red test plus real runtime transcript.

## Behavioral proof coverage

| Changed behavior | Evidence available | Remaining requirement |
| --- | --- | --- |
| Near-full same-thread Codex; dispatch deferred start, interrupt before provider starts, then Continue | Real main transcript: first completed at 39,761/41,800; second preparing then interrupted with no startedAt; third fails with insufficient handoff allowance. New focused integration test reported red on main and green at head. | Required: one real Codex transcript on this head using the same trigger, showing Continue reaches the provider and completes without the handoff-budget error. |
| Over-budget history is retained as ready/deferred rather than marked delivered; current input stays intact | Delivery unit test serializes and decodes the optional marker; Codex integration test asserts exact Continue input and no injected history. | Include handoff ID, status, deferred marker, history identity, and delivery state in the head transcript/projection. Verify interrupted run has no provider turn, not merely null startedAt. |
| Later low-budget turns retry selection without allocating duplicate recovery records | Integration test repeats an ordinary turn, asserts exact current input and unchanged handoff collection. | Existing focused automated proof is sufficient; no additional real-provider repetition is a merge gate. |
| Compaction allows eventual delivery; deferred clears only after confirmed delivery; no replay on next turn | Integration test compacts, observes reduced usage, delivers same handoff ID with missed text exactly once, then asserts next request contains no replay. | Existing focused automated proof is sufficient; real compaction/delivery extension is useful but optional. |
| Marker survives serialization and uncertain sends/native replacement | Unit cases cover native and inline delivery, JSON round trip, ambiguous acknowledgement, replacement native ID, and deferred clearing on confirmed delivery. | No required restart, network-fault, or native-replacement runtime experiment. JSON round trip is not a claimed process-restart test. |
| Replacement-thread low-budget path and failure-message cleanup | Updated integration expectations and provider failure test; lead reports 93 scoped tests pass. | Retain scoped test output with head identification. No separate provider fleet runtime matrix required. |

## Minimum sufficient current-head runtime transcript

Use an isolated dev environment and a real Codex adapter, recording exact head SHA, model/options and context-window configuration. Reuse the existing driver approach; do not run against live userdata. Browser interaction is not necessary for this server proof.

1. Complete an initial real provider turn with telemetry that leaves insufficient handoff allowance. Exact token counts need not match main, but record usage/window and demonstrate the budget branch was exercised.
2. Dispatch a distinctive missed message with defer_start; interrupt it before provider start. Record run/attempt/provider-thread IDs and absence of a provider turn for that attempt.
3. Dispatch Continue on the same provider thread. Record the real provider turn and terminal completion, with no insufficient-context failure. Record the current request intact at the provider boundary if available; an assistant answer alone cannot establish exact prompt contents.
4. Read back the persisted handoff projection/event: same missed-message history retained, ready status, deferred=true, no confirmed delivery for it. This distinguishes genuine deferral from a run that happened to have enough budget or silently dropped history.

One such sequence is sufficient alongside the reported red/green regression and lifecycle tests. No obligatory repeated real-provider runs, server restart, compaction, eventual-delivery transcript, screenshots, or video. If extending the runtime trace voluntarily, keep budget low for one additional request and show unchanged handoff IDs/count, then compact and show confirmed delivery/marker clearing and no replay on the next ordinary request. Do not claim eventual real-provider delivery from the minimum trace alone.

## Evidence inspected

- [Main runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/992f81b8a1551036/runtime.log): confirms the failure sequence; contains no current-head success proof or handoff projection.
- [Reproduction driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2858d7802dbfc9fd/repro.mjs): real authenticated RPC into the dev server; configures Codex context limits, creates a thread, dispatches/interupts the deferred run, and dispatches Continue. Its log omits handoff state and provider-turn absence; add those to the head proof. Driver source was inspected, never executed by this auditor.
- Changed tests and implementation inspected locally, along with checkout AGENTS.md. Both independent code-review MERGE decisions and 93 passing scoped tests are lead-supplied context.

## Friction

FRICTION scope|Renderer matrix requested for a server-only change|Keep matrix empty and require state/transcript evidence, avoiding unnecessary browser/capture work.

FRICTION evidence|Supplied runtime log is the main failure only|Pair it with one head success trace rather than repeating the entire provider/client matrix.

FRICTION transport|One evidence fetch failed with DNS resolution error|A single bounded retry fetched the driver successfully; no browser fallback needed.

## Verdict

PROOF INCOMPLETE at pass 1: code/test coverage is proportionate, but the supplied real runtime evidence only proves main fails. Accept proof once the minimum current-head transcript above is supplied. No visual evidence gate and no additional automated-test demand. This is a proof verdict, not a reversal of the independent code reviewers’ MERGE recommendations.