# Proof audit pass 1 — issue 19992

Issue: [#19992](https://git.cafe/pingdotgg/t3code/issues/19992)
Base: [a46f80ee28](https://git.cafe/pingdotgg/t3code/commit/a46f80ee28)
Head: [0f25149cef](https://git.cafe/pingdotgg/t3code/commit/0f25149cef3af3bac891efc80426b357caf580e4)
Scope: complete two-file diff, assistantStreaming.ts and assistantStreaming.test.ts; sole production caller RunExecutionService.ts (filter construction at line 1273, invocation before ingestion at line 1364). Read-only review; no source changes, servers, browsers, forge comments, pushes, or PR creation.

## Changed render fixture matrix: EMPTY (0 rows)

| Changed render path | Inputs | Branches | Interaction | Recording required |
| --- | --- | --- | --- | --- |

The table intentionally has no data rows. Only server parsing/filter state and tests change. No client component, renderer, contract, UI entry point, setting semantics, styling, or interaction changes. Existing delivery timing/boundary rules remain the intended behavior. Server CPU work is not a changed render interaction; no screenshots or recordings are required. Web, desktop, mobile, remote, relay, and tunnel all consume the same existing server events. This classification does not waive runtime proof.

## Server coverage inventory (not render fixtures)

| Path / input | Branches inspected | Expected invariant / evidence |
| --- | --- | --- |
| RunExecutionService accepted provider events | Project-resolved streaming mode; per-subscription filter; filter before ingestNormalized | Shared provider/client path; no new transport or client branch |
| message.updated assistant; turn_item.updated assistant_message/reasoning | Event-type and message-id keyed state; unrelated events pass through; running assistant node suppressed | Same event shape and text boundaries; new regression test directly exercises message.updated only; real-app after proof should exercise turn_item.updated as observed before |
| Streaming append | Prefix extends previous text; completed line, partial line, empty/no-new-boundary update | Reuse lineStart/newlineSearchFrom, fence/title state, partial indentation/content offsets; retain scan even without delivery |
| Replacement/truncation | Non-prefix input restarts scan | Existing delivered text/time gate retained; replacement regression test passes |
| Markdown boundaries | Opening/closing backtick or tilde fences; marker length, indent, info string; blank lines; ATX/bold section titles; list lookahead | Same parsing predicates; complete lines parsed once on append; partial list whitespace scan resumes; no partial fence delivery |
| Throttling and modes | Previous delivery <400ms skips; unchanged/empty ready text suppresses; turn mode suppresses streaming | Existing delivery policy preserved; scan catches up after skipped updates |
| Completion and identity | Non-streaming event clears keyed state and passes full text; separate event kinds/IDs retain independent state | Final full output preserved; filter lifetime remains provider-event subscription |
| Exported splitBufferedAssistantText | Fresh scan on each direct call | Public one-shot semantics preserved; production caller uses stateful filter |

## Evidence assessed

- [Before runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9a83a4b729af09df/reproduction.txt) read. Real composer/provider fenced stream, confirmed dev-server inspector: 345 splitter calls, 14,745,856 cumulative input characters for 13,778 new characters; no boundary delivered while fence open. CPU measured separately was modest; breakpoint duration is not CPU time. Raw profiles were removed, so these are transcript-reported measurements.
- Before transcript records deterministic red test: 81,800 newline searches against <1,600 for 400 appends.
- This pass ran vp test run apps/server/src/orchestration-v2/assistantStreaming.test.ts at head: 1 file / 4 tests passed. It did not rerun the base red test or independently measure the reported 803 searches.
- Parent brief reports head 803 searches, 47 focused tests passing, two independent MERGE reviews, and output-equivalence runs of 1.2M and 800k random updates. These are supplied evidence, not newly reproduced by this pass.
- Prefix validation text.startsWith(previous.text) remains O(previous text length). Output slicing/comparison and replacement rescans also remain. Do not claim strict constant per-update work or elimination of all quadratic aggregate work. The supported improvement is avoiding repeated completed-line parsing and repeated partial-line scanning on append.

## Smallest required AFTER runtime transcript (still outstanding)

One actual app/composer/provider run at this head, in paragraph mode, producing a long fenced multiline reply is sufficient; reuse the before prompt/provider where practical. A recording is unnecessary because no render behavior changes.

Record:
1. Head, isolated environment, responseStreamingMode, provider/model, actual event kind (prefer turn_item.updated as in before), and confirmed server PID/worktree used for inspector attachment. Redact auth, tokens, and unrelated conversation data.
2. At least three consecutive growing updates inside the same still-open fence with no delivered boundary: incoming length, previous text length, prior/new lineStart and newlineSearchFrom, and openFence state. Demonstrate each next newline search starts at the previous scanned length rather than zero, and old completed lines are not reparsed. Count completed-line parses/newline searches over that sample against newly appended lines plus one failed newline search per scanned update; include initial scan separately. A bounded conditional inspector/logpoint sample is enough; avoid profiling the breakpoint pauses as CPU.
3. Fence closure advances the ready boundary through its terminating newline, and final non-streaming event passes the full output. Confirm expected text/order and no leaked unfinished fenced content. Remove temporary instrumentation afterward.
4. State the limit explicitly: scan work resumes incrementally, but prefix validation remains O(n). No wall-clock CPU improvement claim is required. If claimed, obtain a separate non-breakpoint profile with comparable workload.

No need to repeat every Markdown branch or every client/provider in a runtime capture: focused deterministic tests/equivalence cover those semantics; the runtime transcript establishes that the real ingestion path uses the retained scanner.

## Friction

| Category | What | Avoidance |
| --- | --- | --- |
| Evidence gap | Only BEFORE real-app transcript supplied; after test counts alone do not prove live retained scan state | Capture one short real-stream inspector transcript at head with resumed offsets, bounded parsing counts, closure and completion |
| Claim scope | Issue expectation says roughly constant work; startsWith still checks growing prefix | Describe incremental line parsing; retain explicit O(n) prefix caveat; do not equate search count with total CPU |
| Proof mismatch | Generic UI screenshot/recording demand would fabricate changed render behavior | Publish empty render matrix; use red test plus runtime transcript |

Verdict: PASS for server-only / empty-render-matrix classification; no new source-level proof blocker found. Overall proof remains INCOMPLETE pending the AFTER runtime transcript above. No merge action or unconditional merge-readiness verdict is issued by this proof-only pass.