Proof audit for [#32520](https://git.cafe/pingdotgg/t3code/pull/32520), head [5ff188ef57](https://github.com/pingdotgg/t3code/commit/5ff188ef57475170e29a0c57fd97b018202bd713), against merge-base [e5b0718a8a](https://github.com/pingdotgg/t3code/commit/e5b0718a8a297823920d1bf3a7d5cbacd57263ea).

The existing proof is **insufficient for four affected fixture groups: F8, F9, F10 and P3**. These need only supplemental timed harness recordings/transcripts and an awareness transcript. The reporter scenario, steering, terminal replacement, and no-successor release already have usable evidence; do not recapture them.

Findings:

- R1–R3 remain valid for their observed states. Every recorded real-app shell has `settledOverride=null`. The later change in [5e31e6c283](https://github.com/pingdotgg/t3code/commit/5e31e6c28385b0e60fe93bb234c93bd74b5e154b) changes settled awareness only, so it cannot reach those observed states. The notification coordinator, gate and monitor predicate are unchanged between those capture revisions and the audited head. Main-merged projection read optimizations do not change the classifier blocks under audit.
- The later settlement change has **no runtime capture**. R3 proves an unsettled held completion projects `running`; it does not prove the same thread disappears after settlement, or returns after unsettlement. Its tests encode the desired behavior, but are not a runtime transcript.
- No existing recording enters a disconnected/cached shell during a live grace timer. Existing logic/browser tests cover pause/restart and successor cancellation; the recordings do not. Grace cancellation on archive/stop/removal/disposal is likewise not demonstrated by an existing timed artifact.
- The first Evidence.md index says F4 was lost. That statement is superseded by the PR body's direct F4 before/after links. The after recording visibly reports release at 10.003 s, unchanged re-emit at 12.003 s, and notification at 15.005 s. Its harness uses the production coordinator, gate, shell presentation and monitor predicate with synthetic shell snapshots, real timers, and peripheral state adapters. Treat it as a labelled harness, not a real provider/server trace.
- R1's seven baseline alerts and one after alert are verified against the indexed recorder logs, not interpreted as one alert per persisted run. R2 independently exposes the initial user completion, steered completion and terminal command completion that R1-after coalesced away. Sound evidence counts Web Audio starts; the videos contain no audio track. No artifact establishes native OS presentation, relay publication, APNs delivery or a physical Live Activity.

Source-derived paths and fixture collapse:

- [startThreadNotifications](https://github.com/pingdotgg/t3code/blob/5ff188ef57475170e29a0c57fd97b018202bd713/apps/web/src/components/ThreadNotificationCoordinator.tsx) is installed once by app initialization and serves web plus the desktop web shell, for every connected environment. It renders no layout itself. Shell observations and subagent/delegation updates feed the gate; cached/disconnected snapshots pause it; environment removal/settings disablement/unsubscribe clear it. Parent-owned subagent rows are skipped. The presentation outlets remain sound, focused-background-thread in-app toast, and unfocused browser/Electron Notification plus badge/click navigation.
- [The gate](https://github.com/pingdotgg/t3code/blob/5ff188ef57475170e29a0c57fd97b018202bd713/apps/web/src/components/ThreadNotificationCoordinator.logic.ts) splits first sight/archived/stopped, attention requests, completed-vs-active, null/old-vs-fresh completion times, ordinary-vs-progress completion, same-vs-new completion during grace, pause/resume, removal and clear. These produce the temporal fixtures below. Preparing/starting/running/waiting, empty lists, failed/limited/input/approval/guest-request states, silent runs and duplicate handled completions retain their existing outputs; no new layout capture is needed for each status.
- [ProjectionStore](https://github.com/pingdotgg/t3code/blob/5ff188ef57475170e29a0c57fd97b018202bd713/apps/server/src/orchestration-v2/ProjectionStore.ts) supplies the optional field via both `threadShellFromProjection` and SQL shells, including an older blocking usage-limit run selected instead of the newest run, and forwards it into awareness snapshots. Progress `updated` from background_task/command/monitor is true; absent notification, other outcomes (completed/failed/cancelled/unknown), other sources, delegated completion and a same-run user steer are false. SQL preserves legacy command/subagent encodings. These source variants collapse to F1/F2/F6 by output; the existing classifier test table distinguishes source encoding, SQL and in-memory construction. Do not demand a separate UI recording per encoding.
- [monitorHoldsWakeCompletion](https://github.com/pingdotgg/t3code/blob/5ff188ef57475170e29a0c57fd97b018202bd713/packages/shared/src/orchestrationV2PendingBackgroundWork.ts) tests wake=true and existence of at least one monitor. One/two/many monitors, or monitors mixed with commands, have the same output until the last monitor leaves. Commands alone or an absent/empty roster do not hold. The optional field omitted by an older server follows the existing false branch. No names, text lengths, count-based layout, loading skeleton, theme or width branch was added.
- [projectThreadAwarenessV2](https://github.com/pingdotgg/t3code/blob/5ff188ef57475170e29a0c57fd97b018202bd713/packages/shared/src/agentAwareness.ts) is consumed by the relay's publish snapshot and active-thread selection. It adds held completed wakes to `running`, and removes settled completed wakes unless other background work independently holds completion. Runtime/child requests outrank completion; a truly active run remains visible. Native mobile receives the server relay/push result; it does not run the web notification coordinator. No provider adapter changed: any adapter producing the same notification/roster shape reaches the same predicate. A real Claude Monitor is already exercised; other providers need no duplicated UI matrix.

Minimum display matrix: **one readable 1440×900 dark browser recording for each needed timed client harness**, matching existing evidence. Light theme, 390px width, long titles, and OS-specific screenshots do not exercise changed logic. Awareness fixtures need a sanitized chronological server/projector transcript, no viewport. All temporal/interaction rows below are labelled **recording**; a timestamped event transcript may accompany or substitute for a server-only recording, while a still is insufficient. No new frontend layout exists.

| Row | Fixture and required data / expectation | Affected; minimum proof | Real-app seed or harness route | Existing status and later-code reach |
|---|---|---|---|---|
| F1 | Ordinary user completion; wake=false with command+monitor pending. Non-progress sources/outcomes and omitted wake field share its immediate-completion output. | Allowed-completion control; recording. | Fresh thread composer, linked six-line driver; Notification permission granted, Notifications with sound, unfocused document. Classifier source variants use the existing backend table rather than more UI runs. | **Covered** by [R2-after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9af45017b85f9e7a/r2-after-settled.mp4), initial alert at 15:01:25.249. Later settlement code cannot reach this unsettled notification path. |
| F2 | Several completed progress wakes while at least one monitor remains; command+monitor and monitor-only roster; no alert/audio on progress. One or many monitors is the same `.some` branch. | Changed; recording. | Same real composer workload: six lines at five-second intervals, native Monitor 60 s, no background_wait. | **Covered** by [R1-before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fa938020ae991ffb/r1-before.mp4) / [R1-after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c864a750862f3146/r1-after.mp4) and recorder logs. Five observed baseline progress alerts versus zero after. Later settlement code cannot reach these unsettled states. |
| F4 | Held progress completion loses its last monitor; no successor; unchanged snapshot during grace; exactly one alert after 5 s. A progress completion first observed with no monitor takes the same release/gate branch. | Changed; recording, real timers. | Natural provider termination usually queues a final wake, so use the existing labelled production-coordinator harness: completed at 5 s, roster removed 10 s, re-emit 12 s, observe through 25 s. Empty/command-only rosters are equivalent for the monitor predicate. | **Covered** by [F4-before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a9602fadc2e41c6e/f4-before.mp4) / [F4-after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/263664723a6f14a1/f4-after.mp4). After alerts at 1.004 s and 15.005 s; no reset at 12 s. Later changed awareness code is outside this path. |
| F5 | Roster removal starts grace; terminal successor starts before its deadline; only terminal completion alerts, no later duplicate. This also represents another fresh run replacing a pending wake completion. | Changed; recording. | Same real Monitor driver; continue beyond two grace windows after final completion. | **Covered** by R1-after: release 14:56:29.203, successor 14:56:29.495, sole alert 14:56:32.105, observed until 14:57:16.867. R2 also shows Command finished and Monitor stopped alerts. Later settlement code cannot reach these unsettled states. |
| F6 | User steers a follow-up into the active progress wake; classifier changes to false while monitor remains; immediate completion alert. | Changed classifier exclusion; recording. | R2 composer action is **Steer message** during active wake; persisted user message must share that run id. | **Covered** by R2-after and [steering attachment](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7bebdf45ca3d8bb3/r2-steering-attachment.json): steer 15:01:29.323, alert 15:01:34.289. Later settlement code cannot reach this path. |
| F8 | Disconnect during grace; stay stale beyond 5 s; reconnect to the same completed wake; no offline alert, one alert 5 s after fresh confirmation, unchanged updates do not restart it. | Changed pause/restart path; **recording**. | Real app: disconnect only the isolated dev environment. For deterministic timing, extend labelled coordinator harness with `live → cached → live` shell transitions. | **MISSING.** Existing F4 stays live. Logic test covers pause/restart, but no existing recording/transcript shows it. Capture head only with exact transition and Notification timestamps. |
| F9 | Disconnect during grace; next live snapshot has a new running/completed successor; old pending completion never alerts, successor alerts normally. | Changed pause/cancel path; **recording**. | Same harness, distinct thread/run/completion ids. Remain cached past old deadline, then feed successor running and completed, observe past another grace. | **MISSING.** R1 has a successor but no disconnect. Browser test has this scenario; existing recordings do not. Capture head only. |
| F10 | Revoke an armed grace: archive or mark stopped; remove thread (`retain`); remove environment/disable all outlets/unsubscribe (`clear`). No delayed alert or later unarchive/re-add replay. | Changed timer lifetime; **recording**, preferably one compact harness with separate cases and timestamps. | Drive isolated shell/thread arrays; archive/stop through thread actions, disable notifications **and** in-app notifications for clear. Deterministic harness can call production coordinator cleanup and update its source atoms; label it synthetic. | **MISSING.** Existing gate tests cover removal/clear and ordinary archived/stopped suppression, but no recording demonstrates cancellation of an already armed timer. A single trace can cover these cancellation branches. |
| P1 | Completed progress wake + non-awaited monitor, unsettled; awareness remains non-null `running`. Mixed command+monitor has the same phase. | Changed push input; recording/server transcript. | Same real native Monitor workload; read isolated dev DB read-only with `getAgentAwarenessSnapshot`, project through production helper; export sanitized fields only. | **Covered** by [R3 server transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/98f1a880dce8f5b7/r3-server-awareness.jsonl), held run 8 at 14:59:11.894, and [before projector transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0b89f3c4f3d14fe1/r3-before-projected.json). Later settlement code is gated off. |
| P2 | Last monitor leaves: completed wake becomes `completed`; terminal successor also finishes `completed`. | Changed phase release; recording/server transcript. | Same workload and awareness instrumentation. | **Covered** by [R3 recorder](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/58927b78b5dbd1bd/r3-after-recorder.json): at 14:59:18.811 completed wake=true, roster=[], projected completed; R3 server transcript then shows terminal run 9 completed. Later settlement code is gated off. |
| P3 | Settle the completed held wake: `running → null`; unsettle: `null → running`. Controls: settled genuinely active run, awaited monitor/other completion-holding task, and pending input/approval must remain visible. | **Later changed behavior; chronological server/projector recording/transcript.** | Real app: settle/unsettle the held dev thread via its normal action/RPC, read awareness before/after. To avoid provider timing, a labelled production-projector harness with real captured shell plus explicit `settledOverride` transitions is sufficient; include the control shapes in the same sanitized transcript. | **MISSING.** R3 has only `settledOverride=null`; F4 does not project awareness. Capture pre-[5e31e6c283](https://github.com/pingdotgg/t3code/commit/5e31e6c28385b0e60fe93bb234c93bd74b5e154b) versus head, or at minimum head with explicit expected null and reverse-state controls. |

Untouched presentation branches do not expand the minimum capture set: modes Off/Notifications/Sound/Both and in-app enabled, active thread versus another focused thread, foreground versus unfocused/hidden document, denied/absent Notification API, hidden tags, notification click/Open thread, Windows requireInteraction and badge adapters. The shared gate evidence covers the changed admission decision. Existing evidence does not claim delivery through each outlet/platform. Per-environment gates and `(environmentId, threadId)` notification identities are unchanged; local, linked and tunnel connections consume the same shells. Missing connections during a timer are specifically F8/F9, not a reason to demand a screenshot for every transport.

Audit method: read-only code/diff, classifier and timer test source, existing recorder JSON/run listings/server transcripts, harness source, recording metadata and sampled recording frames. No new tests, provider turns, dev servers, devices, edits, pushes or comments. Tests were inspected, not rerun. No contradiction was found in the captured notification counts. All supplemental proof can remain synthetic and incur no provider turn.

AI-assisted; verified with the tests and tools listed above.