# Issue 7409 — recovery proof matrix, pass 1

Read-only audit of `/home/ubuntu/wt/issue-7409`, 2026-10-22. Base: `49e97d48f9742ba4c5ab79efc618fbf9066523ec`; inspected HEAD: `a7cdb1390bcb70f11e219058ddc1c0c4b4e4778f`, plus uncommitted changes in GitWorkflowService.ts, VcsStatusBroadcaster.ts and VcsStatusBroadcaster.test.ts. Implementation agent owns those changes. This audit did not edit the checkout, launch server/browser, run tests, or validate captures. Prior matrix: `/tmp/issue-7409-proof-pass1/matrix.md`.

Scope is server subscription/HEAD observation and coherent branch/local/remote publication. No visual component, client contract or provider adapter changed. Preserve affected data paths without treating every unchanged presentation as another visual fixture. Evidence below is REQUIRED or UNVERIFIED, never a claim of completed proof.

## Minimal visible fixture matrix

| ID | Fixture and script | Required evidence | What it establishes |
|---|---|---|---|
| C — core | Existing deterministic regular repo; same stopped-thread/draft state on base/fix. Keep integrated terminal focused; switch main to seeded long feature ref without refresh, blur or navigation; then reverse. Use the same agreed schedule on both builds. Show composer branch and details branch together where layout allows. | Four cells: **1440 light, 1440 dark, 390 light, 390 dark**. Matching base/fix recordings in each cell, with aligned still pairs at initial state and a fixed post-checkout time before baseline focus recovery. Export two diff images per compared pair as specified below. Include observed update latency. | Real terminal reproduction, focused live update, reverse update, responsive truncation and theme rendering. Narrow layout can open details at a declared point in the same recording; no separate layout family. Lead already owns real-app before/after capture. |
| L — linked checkout and actions | Existing linked fixture: untracked -> tracked -> untracked. Keep details visible, open Git actions and commit/Changes views in a fixed sequence without submitting. Switch sibling/root checkout as isolation control. A dirty-file/detached transition and non-repo selection can be appended to this same sequence. | One 1440 light base/fix recording, paired stills of distinct changed states, two diffs per pair. Record actual detached fallback labels rather than assuming every label says Detached HEAD. | Per-worktree HEAD path; upstream/action/count/totals refresh; reversal; no sibling leakage; detached/no-repo handling. No repetition across themes/widths: those layouts are unchanged and C supplies the requested four cells. If any appended transition is not captured, explicitly mark its visible behavior UNVERIFIED and retain its service test. |
| P — branch-specific PR metadata, conditional | PR-bearing branch -> no-upstream/no-PR branch -> back; old-branch stopped thread visible and explicit linked-PR control. | Only if deterministic PR metadata is available: append a 1440 light sequence to L, with matched recording/stills/diffs. Otherwise **UNVERIFIED visually**, with atomicity established by focused service tests. | Live detected PR/counts follow checkout; explicit link and retained terminal PR are independent retention policies. A no-remote fixture cannot demonstrate this. Do not provision a forge account or expand product coverage merely to obtain this capture. |

C is mandatory. L is one compact supplementary family, not independent captures for each panel. P is a declared evidence boundary, not a reason to stall core recovery. Interaction/timing claims require recordings; screenshots alone cannot establish promptness or absence of transient mixed metadata. Do not require the old matrix's 60-second recording schedule if the lead's matching schedule already demonstrates baseline failure before focus and fixed delivery: record baseline observation duration, command completion, update and any deliberate focus recovery. The previous <=2s target was proposed, not a source-derived product guarantee; report actual latency and any agreed acceptance target separately.

## Every prior affected row retained, with equivalent layouts collapsed

| Prior affected row | Minimal disposition |
|---|---|
| ChatView/composer branch selector, draft local mode | C; one draft-local observation in the same sequence if core uses a persisted thread. Otherwise draft-local rendering UNVERIFIED. |
| ThreadDetailsPanel branch toolbar and GitActionsControl | C/L; same status through a second layout, no separate theme matrix. |
| GitActionsControl commit view | L open-only observation; shares status/actions, no commit/push/PR execution. |
| Sidebar variants and ThreadStatusIndicators; passive-only subscription | Sidebar may remain visible in C/L. Passive delivery and watcher lifetime are service tests S2, not a separate external-terminal video. Unseen sidebar variants UNVERIFIED visually. |
| Detected PR hook/dialog; explicit and terminal PR retention | P conditional; service stream coherence S4 does not claim dialog rendering. Uncaptured dialog/retention states UNVERIFIED visually. |
| DiffPanel and non-repo gate | L appended states; no separate screenshot family. Missing states UNVERIFIED visually; S1/S3 cover server behavior only. |
| Command palette/keybinding/sourceControlActions | Same shared status/action inputs; inspect one action menu in L. Palette/keybinding execution UNVERIFIED, not mandatory independent footage for unchanged entry points. |
| Desktop | Shared web rendering covered by C/L; native Electron focus/shell **UNVERIFIED**. No native-desktop capture requirement added by this server-only fix. |
| Mobile thread header/ThreadGitControls | Shared stream semantics tested; native rendering/update **UNVERIFIED**. 390 is responsive web, not native mobile proof. |
| Mobile overview/branches/commit sheets | Same server data; each native-only presentation **UNVERIFIED**. Do not require N1/N2 for this recovery pass. |
| Mobile review menu and new-task current branch | **UNVERIFIED** native behavior. Draft future-worktree base selection is an unchanged client policy, not a new server fixture; do not infer it from current-checkout updates. |
| Settings/providers/scheduled tasks/MCP | No changed entry point or provider protocol. Source-derived out of scope for additional fixtures. Auto-fetch/background policy remains in S3/S5. |
| Remote/relay/tunnel, reconnect and two environments | Existing environment-scoped transport unchanged. C/L prove only captured connection mode. Others **UNVERIFIED end-to-end**; cwd event isolation and fresh subscription belong in S2. No mandatory remote/tunnel capture expansion. |

## Necessary service proof, proportional to changed behavior

Use focused VcsStatusBroadcaster tests and GitWorkflowService helper tests; no repo-wide checks. Service tests must synchronize with Deferred/events/TestClock and await observable completion, not arbitrary sleeps. Rows identify proof obligations; they are not claims all are currently implemented or passing.

| ID | Necessary behavior | Inspected source/test status |
|---|---|---|
| S1 HEAD location and delivery | Real regular and linked repo `headPath` resolves their own HEAD; non-repo returns null. Directory watcher survives atomic HEAD.lock rename and successive forward/reverse replacements; irrelevant directory events do not refresh. Startup waits until watch is ready before initial status read. | Helper uses absolute `rev-parse --git-path HEAD`. Existing terminal-checkout test exercises real fs rename with synthetic workflow status and no clock advance; it does **not** exercise real linked Git path resolution. Need helper/integration assertion or L manifest plus targeted helper proof for that claim. |
| S2 subscription lifecycle | includeRemote:false still receives checkout updates; one normalized cwd watch shared; last unsubscribe releases it; resubscribe works; different cwd events isolated. Startup failure/non-repo cannot block initial snapshot. Checkout at subscription startup not lost. | Sharing test counts headPath calls with null watch path: useful registry proof, **not actual running watcher cleanup**. Terminal rename test uses default remote demand. Dedicated passive delivery/startup/failure/lifecycle assertions remain unverified in this read-only pass. |
| S3 remote cache variants | No remote cached, cached remote null, and nonnull remote: checkout refreshes local branch; healthy watch works with auto-fetch disabled; watcher read requests refreshUpstream:false and does not fetch/auto-pull. Detached ref/null and non-repo do not hang. | Rename test checks refreshUpstream:false for nonnull cached remote. Other branches need focused assertions; screenshots cannot prove no fetch. |
| S4 race/coherence | Poll and watcher share serialization; branch change during remote read retries without publishing mixed PR/counts; branch change before local read likewise; exhausted retries bounded and later settled HEAD recovers. On local failure, same-branch remote updates allowed, new-branch remote withheld; later refresh recovers. Initial read/explicit refresh/older poll cannot overwrite newer cache. | Present tests include poll external checkout, checkout during remote read, local failure/recovery, initial read vs explicit refresh and older poll vs turn-end refresh. Uncommitted race changes still under implementation review; passing status and exact final tree unknown. Tests should inspect reconstructed client states, not only final cache. Branch equality sampling alone is not evidence against all rapid A->B->A interleavings: bound the claim to tested schedules. |
| S5 periodic behavior | Background poll catches branch change coherently when allowed; unchanged branch publishes appropriate remote-only event; local totals refreshed when counts change; existing automatic-pull enabled/disabled policy preserved; watch failure fallback is conditional on remote demand/settings/background policy. | Existing poll and auto-pull tests provide starting coverage. No promise of polling for passive-only, disabled automatic fetch or disallowed background policy. Validate relevant existing tests plus new cases, not every product surface. |

The implementation agent should report exact focused test command/results and final tree identity. No need for UI-render tests that mirror props or unrelated provider/mutation tests.

## Capture and diff contract

Use existing `scripts/fixtures/issue-7409/{data.json,seed.py}`; do not demand another fixture framework. Record fixture data hash/manifest, Git IDs, initial branch/tracking, settings, view state, revision and working-tree patch identity. Final capture must identify the three uncommitted files' exact patch or final commit; HEAD alone does not identify the tested fix.

For each aligned base/fix still pair produce exactly the required **two diagnostic images**: (1) Diff0, any nonzero channel delta, displayed with a declared amplification mapping; (2) DiffT, max channel delta >8, threshold declared. Report counts/percent for both. Preserve the two raw stills; full frame is required, crops optional. This collapses the prior redundant separate raw/amplified Diff0 output without losing the zero-threshold measurement. If the lead already agreed another two-image convention, label it explicitly rather than silently changing it.

Match viewport height (record actual value), DPR, zoom, theme, seed, focus, panels, scroll and script schedule. Freeze presentation time only if needed; never freeze event delivery/monotonic timers. Declare masks/alignment; never mask affected regions. Explain every changed region, including expected branch text/truncation/action/count differences and terminal/caret/timing noise. Unexplained differences are friction, not automatically regressions. No new visual component means no requirement that fixed and baseline post-checkout screenshots be pixel-identical: the corrected status is the intended difference.

## FRICTION

- No runtime evidence or tests executed/reviewed here. This is the minimal proof assignment, not a passing verdict.
- Source snapshot is moving: three uncommitted server/test files were inspected while implementation agent checks them. Final race implementation and test outcome must be reconciled with capture identity.
- Existing fixtures provide regular/no-remote, linked remote/tracked/untracked, and non-repo projects with stopped synthetic threads. They do not seed branch-specific PR metadata, dirty/detached state, draft state, nonzero ahead/behind, or native/remote clients. These require small declared setup steps if claimed; absence is explicitly unverified rather than implied by the fixture name.
- The current tracked fixture starts at its upstream tip (zero ahead/behind). Nonzero-count behavior requires a deterministic extra commit/ref adjustment or S4/S5 service proof; no new visual family needed.
- Native desktop/mobile, alternate connection modes, unseen palette/dialog/sidebar layouts and conditional PR visuals remain UNVERIFIED; none justifies multiplying unrelated product captures for this server fix.
- Current watch test and sharing test have narrower proofs than their names may suggest (synthetic workflow status; registry calls with null HEAD). Actual passive delivery/readiness/failure and linked helper resolution need evidence as assigned above.
- Lead's real-app C captures and implementation agent's focused tests are pending inputs. Accept/reject fix proof only after those are attached; do not describe pass 1 planning as completed validation.