# Proof-audit pass 1 — issue 15063

Issue: [#15063](https://git.cafe/pingdotgg/t3code/issues/15063). Proposed PR not created.
Read-only audit of complete diff [b5a226e49c](https://git.cafe/pingdotgg/t3code/commit/b5a226e49c) → [25589e9002](https://git.cafe/pingdotgg/t3code/commit/25589e9002), branch `fix/issue-15063`, checkout `/home/ubuntu/wt/issue-15063`.

Scope: 13 added production lines replacing one return in shared `resolvePendingHandoff`, plus one test and fixture fields. No renderer, wire schema, delivery logic, or historical endpoint resolver changed. This is a proof plan, not completed capture evidence. No browser/server, edits inside checkout, pushes, or comments performed.

## Changed render paths

- Web: `ChatView.tsx:2484` chooses draft model selection, falling back to thread selection; enabled/available provider gate → shared helper → `ChatView.tsx:3284` timeline footer → `V2LifecycleRow.tsx:586` HandoffRow with pending label. A remembered timeline belonging to another thread suppresses the footer while switching. Pending row precedes the existing status line.
- Mobile: `use-thread-composer-state.ts:312` checks model availability → helper → `ThreadRouteScreen.tsx:901` → ThreadDetailScreen → `ThreadFeed.tsx:2942` ListFooterComponent → ThreadHandoffDivider. Source/provider endpoints are Pressables with account alerts.
- Both existing persisted handoff rows use unchanged `resolveHandoffEndpoints`; they matter only as the next-turn transition destination. New source endpoints intentionally omit model; do not claim the fork model is displayed. Destination retains current selection model.
- Web endpoints expose hover/focus tooltips, account badges, icons, provider colors and truncation. Mobile endpoints expose press alerts, badges/icons, one-line labels and wrapping. No new Settings, palette, keybinding, MCP or scheduled-task entry point. Merge actions already exist in web Lineage and mobile thread route. No transport changes: reuse one isolated environment across web and iOS; duplicating local/tunnel/relay fixtures adds no branch coverage.

## Minimal capture matrix

Every affected web row below requires BEFORE at base and AFTER at head, with identical seed, at **1440 and 390 CSS px**, **light and dark** (four variants per revision). Recordings include the settled pending frame. Stills are permitted only for row D, which is static. Use the same viewport height per pair and retain composer plus last timeline item in view. A recording can cover several checkpoints without separate files.

| Fixture | Affected? / data and purpose | Real-app seeding strategy | Web capture and acceptance | EAS iOS proof |
|---|---|---|---|---|
| A — single merge lifecycle | Yes; one pending merge_back targeting parent, non-null source provider; last started non-rolled-back run and usable unchanged selection; same Codex instance, GPT-6.1-Sol example | Copy real stopped-thread data into isolated T3 home using supported migration; finish one parent turn, fork, finish fork turn, invoke Lineage merge back. Never rely on migration to preserve pending work. On parent hover/focus endpoints, switch away/back, then send next prompt. | **Recording**, all four variants, both revisions: merge navigation → immediate pending footer (base lacks it) → tooltip/focus → navigate away/back with no foreign-thread footer → send → pending disappears when transfer consumed and persisted handoff takes over, no stale duplicate. Source says provider/account, destination model; inspect status line and composer overlap at 390. Consumed is hidden only when no independent selection handoff remains. | Static same pending frame at native iPhone size, light/dark, where EAS fixture available. Lifecycle/press alert requires **recording** if exercised; static alone cannot verify consumption or interactions. Currently unverified. |
| B — multiple pending / badges / width | Yes; two distinct fork sources targeting same parent; source endpoints have no model; repeat same provider first, then distinct configured provider | Fork parent twice; finish and merge both without sending in parent. Same-provider pair is real and intentionally retained by helper. For distinct variant run second fork under another enabled provider. Give source account a long display name and configure sibling account of same driver for badge coverage. Re-merge one fork after another completed fork turn to exercise superseded filtering. | **Recording**, all four variants, both revisions: one → two pending sources, same-provider duplicates persist across rerender, mixed-provider list, re-merge replaces superseded transfer without adding a third. Check commas, arrow, wrapping/truncation, account tooltip, badge/color. Do **not** demand successful send: server currently rejects consumption from multiple fork source IDs. | Static same-provider duplicate and mixed-provider pending checkpoints, native iPhone, light/dark. If account press or replacement exercised, **recording** required. Currently unverified. |
| C — destination / precedence | Yes in compatible/no-restart selections; incompatible selections are unchanged controls | Use A pending parent. Change same-instance model on provider allowing in-place change; then another instance with same driver + defined equal continuation group; then incompatible driver/group, and same-instance model requiring new native thread when available; finally restore original selection. Use actual provider catalog capabilities, not assumed provider brand behavior. | **Recording**, all four variants, both revisions: compatible branches keep merge provider-only sources and live destination model/account; incompatible branches retain preexisting last-run full model source (early-return precedence), restore returns merge preview. Disabled/unavailable destination hides preview and reenabling restores it. Exercise only capability configurations actually available; unavailable configurations move to labeled data harness below. | Static compatible pending checkpoint light/dark. Selection/account interaction needs **recording** if claimed verified. Currently unverified. |
| D — source/provider and model fallback | Yes; source instance absent from current config, destination known/usable; target model slug absent from catalog but still selectable under actual app rules | Seed A, then remove fork source account while retaining separate usable parent destination. Choose a supported custom destination model slug absent from supplied catalog if UI permits. If removal/custom slug cannot be produced safely in isolated app, use labeled projection/config harness, never present as integrated app proof. | **Stills**, all four variants, both revisions. Source falls back to raw instance ID/icon without inventing model; destination unknown model falls back to slug. For known model use A/C. Long source label covered B. No hover, configuration-change sequence or press claim from stills. | EAS static fixture light/dark where seed available; label harness if projection/config injected. Currently unverified. |

This is four visual fixtures, not a provider-by-model product. A and C can share the same seeded thread; B reuses that parent but is captured before any send. D reuses A with isolated configuration. Static iOS fixtures cover only appearance; optional interaction proof cannot be replaced by stills.

## Collapsed data/conditional fixtures (no additional visual cartesian product)

Run through real seeded projection snapshots when obtainable; otherwise a **labeled helper/projection harness**. These are logic assertions, not screenshots proving the app. Existing unit tests cover several old branches, but the new test only asserts destination and consumed disappearance, not source filtering/multiplicity.

| Named data fixture | Cases / expected output | Seeding boundary |
|---|---|---|
| G1 — timeline/run/selection guards | null/undefined projection; empty visibleTurnItems; no started run; rolled-back newest run; null selection → null where no eligible run/selection. A window containing only tool rows still qualifies. Latest started non-rolled-back model governs precedence. | Empty/new thread and disabled destination can be real; exact paged window and rollback/run combinations use existing fixture harness if unavailable. Pending merge on an empty/no-run parent is not naturally reachable through normal fork workflow; do not expand UI setup for it. |
| G2 — exact transfer predicate | Include only type=merge_back, status=pending, targetThreadId=current thread, sourceProviderInstanceId non-null. Exclude fork/provider_handoff/subagent_spawn/subagent_result; resolved_native/resolved_portable/failed/consumed/superseded; foreign target; null source. Transfer error text, target provider, target run, source model are not consulted by helper. | A consumed transition and B superseded transfer are real. Foreign-target/null-source/non-merge combinations use labeled schema-valid projection fixtures; normal merge command stamps non-null source provider. Keep full valid contract fields, not unsafe partial fixtures for capture setup. |
| G3 — precedence and endpoint arrays | NeedsHandoff=true wins even with pending merges: same provider requiresNewThreadForModelChange=true + changed model, or different instances without compatible defined group and same driver. Else return all qualifying sources in projection order, including duplicate same instance; destination exactly selection. No matches → null. Compatible account overlays and same-provider no-restart model changes retain merge preview. | A/B/C real seeds; capability branches absent in installed catalog use helper fixtures. Provider-agnostic algorithm: Codex/Claude/Cursor/Grok/OpenCode/Antigravity need no duplicate screenshots; select capability shapes, validate configured branding in B. |

## Evidence upload matrix

| Artifact family | Required upload slots | Current state |
|---|---|---|
| Web A/B/C | For each fixture: base/head × 1440/390 × light/dark **recording**. B may combine duplicate/mixed/superseded checkpoints; C may combine supported selection guards. | Pending later capture pass; no evidence yet |
| Web D | base/head × 1440/390 × light/dark **still**; label harness if needed | Pending later capture pass |
| EAS iOS A/B/C/D | base/head native iPhone static checkpoints × light/dark, where fixture available; B has duplicate and mixed checkpoints. Upload recordings additionally for any claimed press/transition behavior. | All unverified: this read-only pass forbids browser/server and did not discover/provision an EAS session. Availability remains unknown, not established impossible. |
| Data G1/G2/G3 | Focused test/runtime output with input-case labels; no fabricated visual evidence | Proposed follow-up; no tests executed in this pass |
| Android / native Desktop | No available target; Desktop shares web rendering but Electron integration is unverified | Explicitly unverified; no parity claim |

Use ghdrop for each later public artifact; assign URLs to fixture, revision, viewport, theme, and checkpoint. Do not upload copied conversations, credentials, environment/pairing tokens or customer data. Use synthetic harmless prompt text inside real app workflows.

## Review cautions

1. Multiple forks of one provider generate identical `${instanceId}:${model ?? ""}` React keys in both renderers because every new source model is omitted. B must check stable count/order across rerenders; code has a concrete duplicate-key risk, not yet demonstrated visual failure. Different fork model names cannot disambiguate because helper does not know them.
2. Existing handoff precedence intentionally omits merge sources during incompatible provider/model selection. C documents actual implementation, not a promise to show combined contexts. Confirm product expectation before treating that as a defect.
3. Server permits creation of multiple pending fork sources but refuses sending with more than one source thread. B must not imply all listed contexts will successfully be delivered together. This is preexisting server behavior, not scope for this helper fix.

## FRICTION

- No capture evidence expected in pass 1; this is not a blocker or a reason to reject the change.
- Read-only restrictions prevent integrated seed/capture execution. iOS EAS availability has not been checked; every native checkpoint stays explicitly unverified until the capture owner tries it. Android/Desktop unavailable by brief.
- Provider capabilities and removal/custom-model UI may prevent some real-app seeds; only those exact cases may use clearly labeled harness proof.
- No PR exists to link or comment on. Matrix upload is the only authorized publication.

## Result

Fixture derivation complete: four visual fixtures plus three compact data families cover changed callers, branch guards, provider/model shapes, multiplicity, consumed/superseded transitions, width/theme, and endpoint interactions. Capture proof remains pending; no capture-based pass/fail verdict is made.