# Proof audit pass 1 — issue23104

**SUFFICIENT** for the bounded claim: native OpenCode 2.1.2 fork/fork-of-fork copied usage is counted once by the fixed reader and integrated web Usage view. This is proof auditing, not another code review or a claim of billed live-model verification. Wider viewport/theme captures remain separate evidence-agent work.

Worktree: `/home/ubuntu/wt/issue-23104`; branch `fix/issue-23104`.
Exact head: `77a99086b929fe2024990efaa77b6e2e33825131`.
Exact base: `968dd51704441138559a3fe9c348719f2b11e0c6`.
Read worktree AGENTS.md. Head matched and working tree was clean at inspection.

| Proof | Before / baseline | After / observation | Interpretation |
|---|---|---|---|
| Actual integrated web Usage, same final three-copy native DB; 1280×800, light, sidebar hidden, OpenCode / Tokens / 30 days | **Before:** ![Before: actual Usage view shows 4.50K processed tokens, three sessions, $0.03](/tmp/triage-23104/before-main-no-sidebar.png) 4,500 = 3,000 uncached + 900 cached + 600 output; $0.03; 3 sessions. | **After:** ![After: actual Usage view shows 1.50K processed tokens, one session, $0.01](/tmp/triage-23104/after-fix-no-sidebar.png) 1,500 = 1,000 uncached + 300 cached + 200 output; $0.01; 1 session. | Two history copies removed: −3,000 processed tokens, −$0.02, −2 contributing sessions (two-thirds). Same filters and fixture; chart auto-scale changes. These are supplied real app stills inspected with view_image, not browser reconstructions. |
| Native API fixture and reader | `reader-main.json` is the earlier **two-copy** stage: 2 records, 2,600 input (includes cache) + 400 output, $0.02, no reader error. | Final **three-copy** `reader-fixed.json`: 1 record, 1,000 uncached + 300 cached + 200 output, $0.01, error=false. Read-only immutable SQL independently confirmed final DB has 3 assistant rows, changed IDs, seq=2, identical time_created=1792619988284 and identical payloads; quick_check=ok. | Do not present the two-copy reader baseline as the three-copy UI baseline. Native import/fork/fork-of-fork/location-switch APIs are actual; usage values and model name were synthetic imported records, not a billed live model request. |
| Native boundary/seq assumption | Source/fork/continuation exports show explicit through-boundary parent chain and new copied IDs. | `seq-proof.log` records native interleaved user/assistant/idle/user/assistant seq 1–5 preserved through fork, including idle seq=3. | Supports native 2.1 lineage/boundary/seq identity, rather than payload equality. Legacy V1 message-table and JSON behavior unchanged. Missing ancestors or boundary metadata may still overcount. |
| Regression and scope checks | `red.log`: actual 1 failure / 6 passes; failure is copied fork usage counted separately, not infrastructure. | This audit independently ran focused usage.test.ts: **8/8 pass**; three changed files lint: exit 0; provider-opencode package typecheck: exit 0 (suggestions only). Both supplied round-1 reviews say MERGE; their verdicts are context, not a substitute for proof. | Confirms regression protection and scoped validation at exact head; no repo-wide checks. |

Procedure and provenance: inspected reproduction.txt, both reader JSONs, source-export.json, fork-export.json, continuation-export.json, seq-proof.log, red.log, tc.log, and both review-r1 reports. Inspected the two original PNGs through view_image. Opened only the stable backup using SQLite URI `mode=ro&immutable=1`; checked integrity, session parent/boundary metadata, and assistant rows. Computed SHA-256 locally. Native reproduction described in reproduction.txt imported one synthetic assistant response into isolated @opencode/cli 2.1.2 state, invoked fork, then fork-of-fork and directory move; the primary agent captured the actual web Usage view before and after refreshing the fixed server against the same final data. This audit did not repeat API calls or launch a browser/server.

Independent validation commands (repository-local vp because global vp was absent):
- `node_modules/.bin/vp test run packages/provider-opencode/src/server/usage.test.ts` — exit 0, 8 passed, 12.52s.
- `node_modules/.bin/vp lint packages/provider-opencode/src/server/usage.ts packages/provider-opencode/src/server/usage.test.ts packages/provider-opencode/src/server/usage.fixture.ts` — exit 0.
- From packages/provider-opencode: `../../node_modules/.bin/vp run typecheck` — exit 0, existing Effect suggestions, no errors.

SHA-256, verified:
- Stable native DB backup `/tmp/triage-23104/recorded-opencode.db`: `94df498297598a39fbe14a4c83953c60dac162f976f94c07116fb70b383066e1`.
- Before `/tmp/triage-23104/before-main-no-sidebar.png`: `74f0cad0e93385c7fc51301bb282c788d382ae9e69dc538f649f3fbefd235996`.
- After `/tmp/triage-23104/after-fix-no-sidebar.png`: `85e2fbb22a1a4dc91884c9b9e999b30e00fe2b823625dc03a207ebc48dff5e0b`.

Limits: web exercised by the primary agent and evidenced here by stills; desktop, mobile, remote, relay/tunnel, and billed real-model requests are unverified. No independent performance benchmark. Full 1440/390 light/dark captures are not part of this pass. Screenshots alone cannot cryptographically establish capture-time code/data provenance; their totals agree with the recorded procedure, stable DB, reader outputs and focused tests. Synthetic cost is reported fixture cost, not an invoice or pricing calculation. Missing ancestry/boundary can overcount; this does not establish universal historical-fork recovery. No code edits, commits, pushes, forge actions, delegation, dev servers, browser automation, or publication performed. Only this requested local audit artifact was written.