# Proof audit, pass 1: queue ordering

[PR #25697](https://git.cafe/pingdotgg/t3code/pull/25697), branch [fix/issue-25644](https://git.cafe/pingdotgg/t3code/tree/fix/issue-25644).

Pinned AFTER: [2c6faf415b](https://git.cafe/pingdotgg/t3code/commit/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e). Pinned BEFORE/merge-base: [3d369d5596](https://git.cafe/pingdotgg/t3code/commit/3d369d55968b09861bf61ba8ebb2eeb6f02973ba). The supplied checkout HEAD and ancestry were verified. This is a source-derived proof specification; no new runtime captures exist. Historical artifacts are not accepted as current paired evidence.

## Findings first

1. **Proof is incomplete, not contradicted by this source pass.** The added runtime regression drives the real orchestrator and checks computed delivery order, rejection of moving a completion, and move-back. It does not record actual starting transitions, native steering, the real MCP boundary, goal normalization, compaction skip, or projection rebuild. Passing that test alone cannot satisfy the requested transcripts. No new confirmed implementation defect is asserted by this proof-only audit.
2. **The compaction branch is a distinct path at this head.** It runs before the native-goal branch, sets the selected run's position to 1, and preserves its existing marker. The shared normalization then clears markers on other ordinary queued runs. Consequently a marked selected ordinary message OR goal stays ahead of completions during compaction skip, whereas promoting that goal into an ordinary active turn clears its own marker. R07 explicitly covers this asymmetry; do not apply R05's expected selected-marker reset to R07. This is a code-derived expectation, not captured behavior.
3. **Goal normalization deliberately overrides prior reorder priority.** The PR's maintainer reply explicitly explains completion → goal → other ordinary ordering. R05/R06 preserve that contract, including clearing a true marker when the normalized numeric position does not change. The older bot request to preserve every priority marker conflicts with this stated intent.
4. **There is no changed render component or layout branch.** Shared client workflow filters both delegated completions and notifications out of visible queue rows. Web/desktop and mobile render ordinary rows with their existing position sort and controls; neither reads the new marker. Their Send now/steer actions can enter the server paths, but screenshots cannot expose the critical completion-relative order. No viewport, theme, platform, empty/loading/error, text-length, attachment, collapsed-count, or optimistic-row capture multiplier is justified. Transcripts replace those dimensions.
5. **Stored forge metadata is behind the requested revision.** GitCafe reported head [1d23f502f5](https://git.cafe/pingdotgg/t3code/commit/1d23f502f5bb1f311d4ce8094a1f9c6dc6136d4a), not the pinned checkout. Its CI/reviews are context, not verification of the requested head. The matrix uses the pinned local diff exclusively.

## Complete affected-path inventory

- [Reorder](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/Orchestrator.ts#L9651): rejects missing/nonqueued moving IDs; rejects moving a delegated completion or notification; null anchor appends; nonnull anchor inserts before a queued run, including a completion; invalid/self anchor rejects. It normalizes all queue positions, finds the final delegated completion, marks every noncompletion before it, clears old true markers after it or when no completions remain, and emits on a marker-only change. Missing/false are equivalent for equality; an unmarked nonpriority payload need not acquire a field. Automatic runs remain unmarked. Optional nodeId emission is unchanged.
- [Delivery comparator](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/QueuedRunOrder.ts#L3): queued status only; delegated-completion OR exactly-true marker is the priority class; position falls back to ordinal, and ordinal breaks position ties. Notifications alone are not comparator-priority completions, though moving/promoting them is forbidden. All production callers: nextQueuedRun at Orchestrator line 806, reorder at 9659, normalization at 11802, queue.resume/queued-run.start's usage-limit selection at 13328, and MCP list at handlers line 273. nextQueuedRun feeds default startNextQueuedRun and default failQueuedRunStart. startNextQueuedRun is reached after committed commands, terminal events, and resumeQueuedRuns recovery; explicitly selected queued-run.start bypasses default selection. R01/R02/R09 prove default selection and explicit selection. Default failure attribution uses the same selector; its unchanged error handling does not justify an extra deliberately malformed-identity capture.
- [Promote](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/Orchestrator.ts#L9442): inactive thread, missing/nonqueued run, missing message/node/attempt, and automatic-message guards precede compaction skip, native goal, and ordinary steer. Compaction skip preserves the selected marker; native goal writes false; ordinary steer cancels the queued run/node/attempt and dispatches steer/restart. Goal stopping depends on a live target, goal state, maintenance status, and whether Stop was already requested. Existing error and adapter-capability branches are unchanged; these do not require separate proof rows.
- [Normalization helper](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/Orchestrator.ts#L11787): excludes selected run and delegated completions, positions other ordinary runs at 2..n, clears true markers even at unchanged positions, then either returns without interruption or attempts the target interrupt. Callers are promote's compaction and goal branches, plus [incoming message.dispatch](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/Orchestrator.ts#L6187) only when a native goal stops active work. Explicit queue-only goal input and a goal-clear with no driving goal do not take the incoming normalization path. R05/R06/R07 distinguish all three callers.
- [Contract](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/packages/contracts/src/orchestrationV2.ts#L676): optional boolean on a full run payload; run.created/run.updated, JSON event codecs, projection payload JSON, snapshots/detail transport carry it. [Projection persistence](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/ProjectionStore.ts#L1997) serializes the schema. Missing remains valid; true and explicit false must survive replay/rebuild. R04 covers this without calling an in-memory rebuild a process restart.
- [MCP](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/mcp/toolkits/thread/handlers.ts#L265): actual tool is t3_queue with list/read/reorder/promote_to_steer actions, not separate historical tool names. list returns items {queuedRunId,text,truncated} and nextCursor, sorted with the changed helper. queuePosition/marker are not tool fields: print them separately as diagnostic projection/event data. reorder/promote map to the real service via ThreadManagementService.dispatch. A successful write returns sequence; dispatch failure maps to orchestration_error with cause text. R01/R08 include the boundary; R05/R07 may call promote through the same handler.
- Clients: [shared workflow](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/packages/client-runtime/src/state/threadWorkflows.ts#L115) → [web QueuedRunsControl](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/web/src/components/chat/QueuedRunsControl.tsx#L113) in ChatView, including steerNext/editLatest keyboard handlers; desktop wraps this web surface. Shared thread-detail workflow → [mobile ThreadQueueControl](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/mobile/src/features/threads/ThreadQueueControl.tsx#L125), including Resume, Send now/steer, edit, cancel. [Client commands](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/packages/client-runtime/src/operations/commands.ts#L1025) dispatch the same resume/promote service commands. No Settings, palette, or additional client reorder implementation reads the marker.
- Queue ordering is provider-independent. Native goals require Codex/Claude goal support; other adapters keep ordinary-message semantics. This head also includes Kiro alongside Cursor/Grok/OpenCode/Antigravity; no adapter changes. Compaction skipping and native steering retain their capability rules. Local/remote/relay/tunnel all reach destination-environment orchestration; no network-origin branch or permission change is introduced. Scheduled tasks use the same message dispatch path, with unchanged goal parsing/hold rules. No doc change is needed for this proof specification.

## Shared seed and transcript contract

Notation: A is the active blocking run; C1/C2/C3 (or C) are real queued delegated-completion messages; U/V/W are ordinary messages; G is a supported native /goal command; N is a notification. q is persisted queuePosition; flag is queuedAheadOfCompletions. Unless stated otherwise, markers start absent, q follows the initial listed order, and queueHeld is false. Arrows/lists below mean effective delivery order, not raw projection insertion order.

H = explicitly labelled harness capture: real orchestrator/runtime, event sink, projection store and isolated in-memory SQLite, registered stub provider, synthetic data and controlled terminal events; no real model execution. Reuse the setup patterns of [runtimeLayer's added regression](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/runtimeLayer.test.ts#L6614). Create A through thread.create and message.dispatch(start_immediately), ordinary queue entries through message.dispatch(queue_after_active). For each C generation, explicitly seed its owner's open delegatedCompletion delivery record with matching messageId/generation/taskIds, then dispatch an agent/server message with matching delegatedCompletion metadata. Merely labelling text 'completion' does not exercise this code. For goals, compaction and steering, reuse the registered fake session, provider event Queue, and worker-drain pattern in [SteeringCompletion.integration](https://git.cafe/pingdotgg/t3code/blob/2c6faf415b46d5494a480590e4a3a1f45b6c4b4e/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1596).

Public route P is also possible on an isolated server via authenticated orchestration RPC and t3_queue, provided actual queued delegated completions already exist. There is no client route/setting that exposes hidden completions, and no public RPC to inject q/flag/invalid identity. H is the reproducible minimum for all rows here; R04/R09 require labelled EventSink injection. Bind the real MCP toolkit handler, invocation context, access layer, and real ThreadManagementService where requested; do not substitute a hand-written queueEntry formatter or a fake dispatch service.

Use natural terminal events, not Stop, to release A in normal delivery fixtures. Stop disposes the active run's current delegated-completion cohort. For goal/compaction/steering fixtures that must retain C, give C a finished historical owner P distinct from active A; keep the matching cohort seed visible. Do not silently cancel C and assert it was outranked. Holds must be injected with A's terminal state together so no auto promotion races the seed; run.interrupt(holdQueue=true) is not an equivalent seed.

Run the same driver and command sequence once at BEFORE and once at AFTER. A baseline rejection is a logged expected observation and must not abort the rest of that fixture; print its resulting queue and promotions. New true-marker states are organically unreachable before the fix: print the rejected precondition and baseline continuation rather than fabricating a marker, patching BEFORE, or silently skipping the row. Each variant uses fresh isolated state; new runs write to new timestamped directories.

Each transcript prints revision, fixture/variant, seed commands/injections, inputs, MCP outputs/errors, persisted run q/flag/status and run.updated event payloads, plus ordered run IDs actually transitioning to starting. Subscribe before release with a deterministic barrier; await persisted events/Deferred/Queue and drain effects where needed. No sleeps, polling, retries, or elapsed-time assertions. Assert one starting/running run at a time, each expected start once, no skipped IDs, and final empty queue for full-drain variants. A helper-sorted list alone is not promotion proof. Provider effects may be stubbed/controlled, but never claim stub delivery is real provider/model execution.

## Minimum capture matrix: nine named transcript groups

All rows are affected behavior or a directly required preservation guard. Every row is **recording**: ordered runtime transcripts, not screenshots. Multiple named variants may share the same before/after log pair; nine groups do not require nine files. Status is **MISSING — no captures yet** for every row.

| ID / fixture / affected path | Setup and exact action | Observable to record | Expected BEFORE | Expected AFTER | Seed / minimum capture / status |
| --- | --- | --- | --- | --- | --- |
| R01 — front insertion, future completion, real agent boundary | A blocks; initial C1,C2,U,V, all unmarked. Real t3_queue reorder U before C1; enqueue C3 afterward. Real list with limit=2/cursors=0,2,4; read U. Release A and then each started run via terminal events. | Success sequence or orchestration_error; actual list pages/cursors; U's q/flag and event payload; complete starting sequence. Include both completion IDs in tool output, not client-filtered rows. | Reorder fails with cause `Queued messages cannot be reordered ahead of automatic completion delivery.`; no priority is created. Pages concatenate C1,C2,C3,U,V; promotions C1,C2,C3,U,V. | Reorder succeeds; U q1=true. Pages concatenate U,C1,C2,C3,V, cursors 2,4,null; promotions U,C1,C2,C3,V. C1/C2/C3 retain relative order. read resolves U's text. | H + actual MCP toolkit/service; P possible with real queue. Paired transcript R01. **MISSING**. |
| R02 — insertion between completions and inheritance through an ordinary anchor | Fresh A; C1,C2,U,V,W, absent flags. Reorder U before C2, then V before U, then enqueue C3. Drain queue after A. | Orders after each command, q and flags for both U and V, complete starting sequence. | First reorder rejects. V-before-U succeeds in ordinary segment; final list/promotions C1,C2,C3,V,U,W. No true flags. | First order C1,U,C2,V,W; then C1,V,U,C2,W. U and V both true; after C3 list/promotions C1,V,U,C2,C3,W. Moving before an ordinary priority entry also grants priority. | H through real reorder commands, MCP if already bound. Paired transcript R02. **MISSING**. |
| R03 — reverse operation and clearing with zero completions | Fresh variants start C1,C2,U,V and attempt U before C1. (a) Move U before V. (b) Move U to null/end. (c) Smaller C,U,V seed: prioritize U, cancel the valid current C delivery, then move U before V at unchanged U q1; enqueue a fresh C2. | Persisted true→false transitions and queue order; marker-only U update in (c); actual promotions after each final state. Log command results even when BEFORE reports a no-op. | Prioritization rejects. (a) Ordinary order remains C1,C2,U,V; this already-normalized reorder rejects `Command produced no domain events.` (b) C1,C2,V,U. (c) No true marker exists; later C2,U,V. | (a) U is cleared to false: C1,C2,U,V. (b) U false at end: C1,C2,V,U. (c) Cancellation alone retains U=true; subsequent reorder emits U=false despite unchanged q1 (lastCompletionIndex=-1). Fresh C2 takes priority; promotions C2,U,V. | H; cancel through real queued-run.cancel with matching cohort metadata. Public equivalent possible. Paired R03(a/b/c), not three visual captures. **MISSING**. |
| R04 — legacy preservation, marker-only creation, persisted true/false | Inject legacy raw positions U=1,C1=2,C2=3 with missing marker; repeat legacy guard with explicit false. First fresh branch drains untouched legacy queue. Second branch reorders U before C1, rebuilds projections, moves U to end, rebuilds again; replay the accepted reorder command ID before proceeding. | Actual untouched legacy starting order; command events and reread projection/JSON before/after rebuild; q unchanged at priority creation; replay receipt/event count. | Untouched legacy promotes C1,C2,U for absent/false. Reorder-before-C rejects and creates no priority; rebuild still completion-first. Baseline cannot replay an accepted priority reorder; record its rejected receipt honestly. | Same untouched legacy promotions. Reorder creates true on U while q stays 1; C1/C2 need no updates. Rebuild retains true and U,C1,C2 order. Accepted replay adds no run updates. Move-back writes explicit false, survives rebuild, and restores C1,C2,U. | H-only legacy q/flag injection through EventSink; real codecs/ProjectionMaintenance rebuild. In-memory rebuild, not process restart. Paired transcript R04 with fresh branches. **MISSING**. |
| R05 — queued goal promotion resets selected and other priority, with/without Stop | A active, C owned by historical P; seed C,U,G. Reorder U before C, then G before U, producing AFTER G=true q1,U=true q2,C q3. Promote G into A via t3_queue promote_to_steer or same real service command. Run (a) G='/goal ship it' and (b) G='/goal clear' with no driving goal. | G's own marker clear, U marker-only clear at unchanged q2, C unchanged, interrupt request/no request, absence of native steer, list and actual starts after controlled release. | First reorder rejects; second can move G before U, leaving C,G,U. Promotion normalizes ordinary q and keeps completion-first. (a) requests Stop; (b) does not. Final promotions C,G,U. No new priority states exist. | Before promotion G,U,C; promotion sets G q1=false and U q2=false even though both q stay unchanged. Final order/promotions C,G,U. (a) requests Stop; (b) waits for A's terminal without interrupting. No native steering in either. | H fake supported Codex goal session; C must not be owned by A. Pair both named variants under R05. **MISSING**. |
| R06 — incoming goal caller and queue-only preservation guard | A active; historical P owns C; seed C,U,V, attempt U-before-C. (a) message.dispatch native '/goal ship it' with deliveryIntent='auto'. (b) Fresh reset, same goal explicitly dispatchMode=queue_after_active with deliveryIntent omitted. Optional no-driving-goal auto-clear shares (b)'s nonnormalizing outcome. | G creation q, U true/false, normalization events and interrupt request, final list/promotions. This must enter message.dispatch, not repeat queued promote. | Priority setup rejects. (a) C,G,U,V, Stop requested. (b) C,U,V,G, no goal-induced Stop. | (a) U is cleared to false, G q1; C,G,U,V with Stop requested, preserving established normalization. (b) No normalization: U stays true; U,C,V,G and no goal-induced Stop. | H with supported native-goal adapter/session, real dispatch; explicit command fields printed. Pair R06(a/b). **MISSING**. |
| R07 — newly present compaction skip preserves selected marker | A is a running '/compact'; C owned by P; seed C,W,S,V. S is ordinary text, then repeat with S='/goal ship it'. Reorder W before C, then S before W; AFTER S=true q1,W=true q2,C q3,V q4. Promote S into compacting A. Add one fresh unmarked-selected control (no priority reorders). | Which branch runs; selected q/flag, W marker-only reset, interrupt request for compaction, zero native steering, persisted queue and starting sequence. | W-before-C rejects; S-before-W succeeds in ordinary segment. Compaction skip sets S q1 but all are unmarked. Completion retains priority: C,S,W,V. Unmarked-selected control also C,S,W,V. | Compaction branch preserves S=true at q1 (even when S is a goal), clears W=true→false at unchanged q2, requests compaction stop; list/promotions S,C,W,V. Unmarked-selected control stays completion-first C,S,W,V. Do not expect R05's selected-marker clear here. | H goalHarness compaction pattern with historical completion owner. Ordinary/goal are parameters of the same fixture; paired R07 plus short control. **MISSING**. |
| R08 — ordinary steer and automatic-move protection | (a) A steerable, C owned by P, initial C,U,V; attempt U-before-C, then real promote_to_steer U into A. (b) Fresh C1,C2,U plus notification N: attempt to reorder C2 before C1, C2 to end, and N before U. | (a) Queued U/node/attempt cancellation, exactly one stub steer delivery of U, remaining list and starts C,V after A ends. (b) Exact error cause and unchanged run records/run-event sequence, via real MCP at least once. | (a) Priority setup rejects; steer still cancels queued U and delivers once, then C,V. (b) All automatic moves reject `Automatic completion deliveries cannot be reordered.` | (a) U's historical true flag may remain on cancelled record, but cannot compete in queued order; exactly one stub steer, remaining C,V. (b) Same prohibition, same no run-domain changes; tool code orchestration_error. A rejected receipt can persist; do not claim whole DB unchanged. | H real fake-provider session plus actual MCP handler for guard; P equivalent possible. Paired R08; existing restart-fallback tests can cover unchanged fallback, no extra provider matrix. **MISSING**. |
| R09 — held default resume and explicit selected start | Seed C,U,V under A, attempt U-before-C. In one EventSink batch terminalize A and set every queued run queueHeld=true. Call resumeQueuedRuns while held. Fresh variants: (a) queue.resume default; (b) queued-run.start(V). Drain terminal events. | No starting while held; list and retained flags; unhold events; actual first and subsequent starting IDs, not recovery count alone. | While held no start. (a) C,U,V. (b) V,C,U: named selection bypasses default, later queue is completion-first. | While held no start, U flag retained. (a) U,C,V. (b) V,U,C: named V still wins; subsequent priority is retained. | H-only exact hold-state injection so completion is not disposed by Stop; real resume/start commands and recovery method. Paired R09(a/b). **MISSING**. |

## Minimum evidence packaging and exclusions

Capture set = transcript × R01–R09, with the named variants in the table. One before.log and one after.log may contain all nine groups; independent seeds and clear labels are required. R01/R02 must include full real starting sequences. R03/R04/R05/R06/R07/R08/R09 need the specified lifecycle outcomes, not just sorted helper output. Completion protections can be short sections within R01/R08; no standalone error screenshot needed.

Keep the exact reusable driver, raw logs, revision identities, tool/test command lines and exits, and a concise before/after interpretation. Preserve a failing-before/passing-after regression run separately from the resilient transcript driver: a red exit is useful but is not a queue-promotion transcript. If real MCP binding proves infeasible, label service-only coverage and leave the MCP portion of R01/R08 missing rather than synthesizing tool output.

Compared with the old matrix: old R01/R02/R19 → R01; R03 → R02; R04/R05/R22 → R03; R06/R07/R16 → R04; R11/R12 → R05; R13/R14 → R06; new compaction interaction → R07; R09/R15 → R08; R17 → R09. Old R18's malformed-identity failure case is excluded: the changed selector is already exercised by normal promotions/default resume and the failure-handling branch is unchanged. Old R08/R10's unchanged empty/singleton/no-op/stale/self-ID/text-truncation controls are not independent capture requirements. The unchanged comparator missing/null-position and ordinal tie fallbacks are source-audited; no invented runtime scenario is needed solely to mirror those lines. Old R20 is a seed constraint (Stop cohort disposal), not another changed-behavior row. Old R21 is excluded presentation, as explained above.

Coverage: all four changed files and complete pinned diff; all five production delivery-helper callsites and indirect default start/failure callers; goal, compaction and ordinary steer branches; contract/persistence path; shared client selector and web/desktop/mobile entry points. git diff --check passed. No tests, runtime drivers, browsers, servers, providers or emulators were launched by this pass. No edits, pushes, PR comments or reviews were made. This is neither a merge-readiness verdict nor a claim of current CI success.

[Read-only audit inputs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ed6aa00b793fec34/audit-inputs.tar.gz) contain the downloaded historical matrix and public forge reviews/comments used as context; they are not captures. Only this scratch subdirectory was created; it will be removed after upload. The lead's checkout and parent scratch directory remain intact.

FRICTION:
- forge | Stored GitCafe PR metadata reported an older head than the requested local head, so its CI/review state could not establish evidence for this revision | Keep evidence and CI pinned to explicit head SHA; the brief already did so.

VERDICT: INSUFFICIENT <all rows: no captures yet>