# Issue 14296 server-only evidence index

Reviewed/tested head: aa382ab02f0d11761a24eef5f673368546b52e8c.
Baseline: 3b95e7831b11b17627dff16843bc087bfca397ec.
Workspace: /home/ubuntu/wt/issue-14296, branch fix/issue-14296.
This evidence validates that reviewed head. The lead subsequently advanced the branch; final merge-SHA validation is lead-owned.

## Scope and capture exception

Full base-to-head diff read: four files, 139 insertions, 5 deletions. Production files are ForgejoPullRequestProvider.ts and forgejoPullRequestJson.ts; other changes are the two test files below. No visual paths changed. Render fixture matrix: []; 0/0 applicable fixtures. No screenshots or recordings are needed under the user's explicit server-only exception: red tests plus real server runtime transcript replace captures.
[Full proof matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7b48e4e1b7bca59a/issue14296-proof-matrix-pass1.md).

## Focused green execution

Command, from the workspace root:

```
vp test run apps/server/src/pullRequest/PullRequestService.test.ts packages/source-control-forgejo/src/server/ForgejoSourceControlProvider.test.ts
```

Executed 2026-10-22 08:15:43 UTC at the reviewed head. Two test files passed; 108 tests passed; exit code 0; duration 34.90s. Log records full head and base SHAs.
[Head-specific green log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/84aa32fd03beeae0/issue14296-green-output.txt).

Assertions include enabled true, disabled false, and absent-setting false request bodies with selected squash method; repository read API error causes failed action and zero writes (no POST); protected deletion POST error reconciles merged:true to success, and merged:false retains failure. These are provider mocks, including those located in the service test file, not full RPC tests.

## Before and after observations

Lead-owned real T3 web PR-detail Merge/Confirm flows against local Forgejo 14.0.5 and tea 0.16.0 on Linux:

- Before at baseline, enabled flag: merged/closed pull request, but source-before branch survives: defect reproduced. [Baseline runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e3f731b4fdb49f04/issue14296-before-runtime.txt).
- Before disabled flag: local transcript /tmp/issue14296-disabled-before-runtime.txt shows merged/closed pull request with disabled-before branch retained.
- Red log: two failing assertions expose missing delete_branch_after_merge:true and an impermissible merge write following repository read failure. [Red output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/31d3d6760da7ff4e/issue14296-red-output.txt). The supplied log itself lacks an independently recorded commit SHA/command; baseline attribution comes from the lead's handoff, not this log. No new red run was performed here.
- After at reviewed head, enabled: local pull 3 merged/closed, enabled-after branch HTTP 404.
- After protected: local pull 4 merged/closed; Forgejo POST merge returned 403, followed by successful GETs; T3 UI settled to Merged; protected-after branch remains protected and present.
- After disabled: local pull 5 merged/closed, disabled-after branch remains; lead confirms UI Merged.

[Final runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/357d5d83daef6681/issue14296-after-runtime.txt).

## Limits and handoff

Unreadable reconciliation recovery (GET failure/invalid/truncated response retaining the original POST error) was not executed; reviewer characterized it as nonblocking. No temporary mock probe was added. Invalid/truncated repository settings, nonboolean setting, omitted merge method, and disabled/absent POST-error paths were not separately exercised in this evidence step; do not infer full matrix acceptance for these from 108 green tests. Runtime transcripts prove outcomes, not exact enabled/disabled request bodies; focused mocks prove those bodies. Both independent reviews reported MERGE per lead handoff, not independently re-run here.

No repository edits, commits, pushes, forge writes, PR creation/polling, server startup, browser, or simulator actions by this evidence step. Only /tmp evidence artifacts and their authorized ghdrop uploads. No other implementation changes by this step. Final merge-SHA tests belong to the lead.

FRICTION
category|what|avoidance
scope|No render changes; visual captures would not demonstrate server behavior|Explicit server-only exception and empty matrix 0/0; use red/green tests and real runtime transcript.
provenance|Supplied red log lacks its own SHA/command|State lead attribution explicitly; head-specific green log embeds full SHAs and exact command.
coverage|Unreadable recovery error-preservation and other matrix edge paths lack execution evidence here|Declare limits explicitly; do not claim these branches tested.
concurrency|Lead advanced branch after reviewed-head tests|Keep evidence bound to aa382ab02f; lead validates final merge SHA.