# Proof audit, pass 1

PR [#33752](https://git.cafe/pingdotgg/t3code/pull/33752), branch `fix/issue-33744`, reviewed head [f157af0066](https://git.cafe/pingdotgg/t3code/commit/f157af0066cd4abc0b1bd76f82414cf47401ac44), actual base [e4d86abca9](https://git.cafe/pingdotgg/t3code/commit/e4d86abca9c0d0ddd8107ea557f2e0c879632cf3). Read-only audit in the supplied worktree. No edits, pushes, or comments. Only this report is uploaded; no runtime model identifiers are included.

## Findings

1. **Missing runtime provenance (F1).** The downloaded before and after transcripts contain only span summaries and counts, without any checkout SHA, dirty-state record, command result, or fixture identity. The PR body attributes them to main [4c361199f4](https://git.cafe/pingdotgg/t3code/commit/4c361199f47f6ea32a2c14835df392640d0f7c63) and fix [1f5a47f677](https://git.cafe/pingdotgg/t3code/commit/1f5a47f6770fe411ab2df03a28d5882ccd149805); that attribution cannot be independently verified from either transcript or the linked driver, which never emits a revision. This fails the requested SHA-in-transcript requirement. Their numbers are internally consistent: six versus three synchronize passes, and three versus one descendant `listPullRequestsByHead` calls after the refresh-after-turn marker. This is an evidence gap, not a contradictory count or a demonstrated code defect.
2. **Missing proof for distinct queue states (F2–F5).** The added test covers joining a queued request behind a full sweep, upgrading false to true, and subsequent true joins. It does not cover a false-only joined batch, a later false request retaining an existing true request, a request arriving during an active per-thread lookup, or independent queued entries for multiple thread IDs. The transcripts cannot distinguish these states: they omit event types, thread IDs, request flags, and lookup completion boundaries. Focused deterministic unit cases are adequate for these rows; separate runtime transcripts for each event type are unnecessary.
3. **Collector limits.** The summarizer's final predicate counts every descendant `GitHubGraphQlAuth.execute`, without filtering `github.operation` or thread ID. All displayed descendant operations in these two files are the intended operation, so this does not invalidate these particular counts. Its turn-end marker is `PullRequestService.refreshAfterTurn`, which runs after terminal events commit; it is not an event/queue trace. The driver disables seeding but does not guarantee a fresh `.t3` database, select or print a checkout revision, or emit a completed-work milestone; it uses a fixed delay. These omissions limit provenance and queue-state claims. No driver was executed in this audit.

## Matrix

`F` means `refresh: false`; `T` means `refresh: true`. Status is **covered** when the existing unit proof, unchanged-path inspection, or required runtime evidence is sufficient for that row. **Missing** identifies the exact absent proof, not a confirmed implementation bug. Event aliases sharing the same handler and flag are collapsed; no separate callback-wiring tests are requested.

| ID / named fixture | Required data and expected observation | Diff impact / appropriate proof | Real-app drive | Existing linked transcripts and unit coverage | Status |
|---|---|---|---|---|---|
| F0 — Event entry classes | One active, unarchived thread with project, resolvable origin, and branch. `thread.created`, `thread.unarchived`, `thread.metadata-updated` enqueue F. `thread.unsettled`, `checkpoint.captured`, and `run.updated` with `completed`, `failed`, `cancelled`, or `interrupted` enqueue T. | Every listed event now uses the shared keyed enqueue. Flag selection and terminal-status predicate are unchanged. Shared-handler unit proof plus source inspection is adequate; no transcript per alias. | Create through CLI/RPC; `orchestration.dispatchCommand` with `thread.unarchive`, `thread.metadata.update`, or `thread.unsettle` (`reason: user`). Replay produces checkpoints and completed terminal events. Failure/cancellation/interruption require a corresponding provider/run outcome; domain events themselves are not client RPC commands. | Current unit exercises metadata, two checkpoints, completed run; existing idle/child cases exercise standalone checkpoint refresh. Transcript driver exercises a new thread and Replay completion but summaries do not label event aliases. Aliases are source-equivalent unchanged wiring. | covered |
| F1 — Queued finished-turn batch, including upgrade | Hold a startup sweep's branch lookup; enqueue one thread's metadata F, checkpoint T, checkpoint T, completed-run T before releasing it. Expect exactly `[F sweep, T thread]`, with a real run reducing repeated post-turn host queries. | Central changed behavior. Deterministic regression test **plus one short before/after runtime transcript** required. | Linked driver runs one Replay turn against a throwaway repository with a GitHub origin and a new branch. Exact queued ordering requires a controlled lookup gate; the unit supplies it. | Unit at lines 184–280 proves exact call count, F→T upgrade, T→T joins, and drain. All 12 focused tests pass. Linked summaries report 3→1 post-marker host queries, but **neither contains a SHA**, so the requested main-before/fix provenance is absent. | missing — runtime provenance |
| F2 — Queued non-refresh-only batch | Same blocked worker; two metadata/unarchive/create-class requests for the same branch-bearing thread, all F. Release and drain: one queued lookup remains F. | Changed join branch. A unit case is sufficient; no additional runtime capture required. | Send repeated metadata RPC commands while a prior lookup is held; normal timing alone is nondeterministic. Existing linked driver sends no controlled F-only burst. | No such unit case or labelled runtime sequence. The central test upgrades its first F before processing, so it cannot show a joined F batch remains non-refreshing. | missing — unit proof |
| F3 — Refresh retained when a non-refresh joins later | While blocked, queue checkpoint/unsettle T, then metadata F for the same thread. Expect one T lookup, not a downgrade. | Changed merge rule. A unit variant of the queued-batch case is sufficient. | Replay completion followed by metadata RPC while the queue is blocked; lookup gate needed to prove ordering. | Unit covers F→T and T→T, not T→F. Summaries contain no flags or event order. | missing — unit proof |
| F4 — Request during lookup and subsequent reuse | Begin a **threadId-specific** lookup and hold it; change host/branch state, enqueue another event for that ID, optionally a second joining event; release and drain. Expect one follow-up lookup using fresh state, with a later independent event also accepted after completion. | Changed deletion at lookup start; essential distinction from queued joining. A deterministic service unit using Deferred gates and changing mock results is sufficient. Failure of the first lookup can be a variant of the same cleanup invariant. | Metadata/unsettle RPC or a second Replay turn during a held first thread lookup. The app can reach it, but there is no public “hold discovery” RPC; use a controlled backend/host fixture. | No targeted test. Central test holds **threadId null** sweep, which has no keyed entry to delete, so it cannot catch deleting a keyed entry too late or never deleting it. The single-turn summaries do not mark an event inside an active lookup. | missing — unit proof |
| F5 — Independent threads | Two branch-bearing thread IDs A/B with queued bursts behind one blocked worker. Use distinct branches, and optionally two IDs sharing a branch. Expect one keyed request per ID, with independent refresh flags; do not accidentally coalesce all IDs or by branch. | New Map key/isolation behavior. One focused multi-thread unit is sufficient. | Start two Replay threads or issue metadata/unsettle RPCs for each while a third lookup blocks the worker. Existing driver creates only one thread. | Existing parent/child test checks sweep filtering then a later child refresh; it never has two keyed thread requests pending together. No multi-thread transcript. | missing — unit proof |
| F6 — Startup/backfill sweep coexists with keyed queue | `threadId: null`, F, `backfill: true`; include active and settled branch-bearing roots and a settled root missing its automatic PR. Sweep enumerates eligible groups, seeds pending backfill, and does not absorb or erase separately queued thread work. | Sweep bypasses new map; deletion guards null. No change to snapshot filtering, five-attempt backfill accounting, grouping, or dispatch guards. Existing tests and source inspection adequate; no new transcript required. | Start an isolated server with copied/seeded active and settled shells. Enqueue thread activity while the startup lookup runs. Linked fresh-database driver does not deliberately seed settled backfill. | Central unit proves a running null sweep followed by the joined thread request. Existing settled-worktree table proves startup lookup of settled shells. Retry accounting is unchanged, not newly claimed as tested. Summaries start after project creation and do not identify a null request. | covered — unit and unchanged-path inspection |
| F7 — Periodic full sweep / headless / delegated child | `threadId: null`, F without `backfill`; connected-client policy permits periodic sweep. No-client policy skips it; sweeps omit subagent children while child-specific refresh still works. Pending backfill can expand the snapshot. | Scheduling, policy, grouping, and pending-backfill path are unchanged; null requests bypass the keyed helper. Existing unit proof sufficient. | Leave an isolated server running with a client activity lease and eligible roots; repeat without lease; use a seeded child. Periodic clock advancement is deterministic only in unit tests. | Existing idle test advances ten minutes and sees no new lookup. Parent/child test observes startup and one periodic sweep of parent only, then child T lookup. Linked driver waits only briefly and proves no periodic/backfill sequence. | covered — unit and unchanged-path inspection |
| F8 — Ignored events / nonterminal runs | `run.updated` outside the four terminal statuses, and unrelated events, produce no new lookup. | Predicate/default path unchanged. Source inspection adequate; no new callback-wiring test or transcript required. | Start a Replay run and observe queued/running states; other thread activity emits unrelated events. | Linked summaries do not identify statuses. Unchanged switch fallthrough is directly inspectable; this is a scope control, not a new regression scenario. | covered — unchanged path |

## Revision transfer and dependencies

- `git diff 1f5a47f677 HEAD -- apps/server/src/orchestration-v2/ThreadPullRequestService.ts` is empty. Both objects hash to `4648660ce62b72a9d32649b0ca8a532ea97f1f86`.
- Main-before [4c361199f4](https://git.cafe/pingdotgg/t3code/commit/4c361199f47f6ea32a2c14835df392640d0f7c63) and current base [e4d86abca9](https://git.cafe/pingdotgg/t3code/commit/e4d86abca9c0d0ddd8107ea557f2e0c879632cf3) have identical service blobs, `d84c532d06ecde074e5c7e26cd462541c621e249`. The intervening commit before the fix only adds a test. The proposed behavior is therefore still exactly the same before/fix delta.
- The current test is stronger than the recorded fix revision: it adds the preceding metadata F request and asserts every lookup rather than filtering to refreshes. I ran `vp test run apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts` at the reviewed head: **1 file, 12 tests passed**.
- Main **did** modify nearby dependencies. `GitManager` gains a guard for stacked commit/push/PR actions; `GitVcsDriverCore` refactors push destination resolution. The linked Replay fixture does not invoke those actions. Their branch-PR lookup implementation, cache-refresh rules, and git-read helpers are unchanged.
- Main also changes `VcsStatusBroadcaster.refreshStatus` for `localOnly` reads so they do not clear remote status. This is adjacent shared-cache/status behavior, so it is inaccurate to say every dependency is byte-identical. The changed path does not enqueue ThreadPullRequestService work, change its flags, or change the ordinary remote-refresh path. The unrelated lookup outside synchronize shown in each summary is not evidence of the keyed-worker behavior.
- Orchestrator changes concern queued model selection and delegated-completion delivery; the single uncomplicated Replay completion, event-stream wiring, and RunExecutionService finalization ordering used here are unchanged. DrainableWorker, ProjectionStore, RepositoryIdentityResolver, PullRequestService, activation/background policy, and the GitHub source-control implementation are unchanged across the recorded fix and current head.
- **Transfer conclusion:** earlier runtime evidence is not invalid merely because main was merged. If its before/fix SHA attribution is supplied, it remains applicable to F1's central coalescing result; the merged changes do not require a new screenshot or an entirely new runtime run for that result. Byte identity cannot supply the missing artifact provenance or expand the old run to F2–F5.

## Evidence read

Downloaded with curl and read in full:

- [Before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2b2d113bf60226b3/transcript-before.txt): 14 lines.
- [After transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fc82a088f777e775/transcript-after.txt): 9 lines.
- [Runtime driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0da521d5080236e7/repro-33744.sh): 23 lines.
- [Summarizer](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0412b3fac195613a/summarize-33744.py): 18 lines.

Code anchors: [service queue and dispatch](https://git.cafe/pingdotgg/t3code/blob/f157af0066cd4abc0b1bd76f82414cf47401ac44/apps/server/src/orchestration-v2/ThreadPullRequestService.ts#L349), [regression test](https://git.cafe/pingdotgg/t3code/blob/f157af0066cd4abc0b1bd76f82414cf47401ac44/apps/server/src/orchestration-v2/ThreadPullRequestService.test.ts#L184).

Coverage: full two-file diff, complete service/test, shared worker, relevant callers/contracts, all four evidence artifacts, merged-main lookup dependencies, current metadata and existing review/check snapshot. No app/browser run: server-only change with no render path. No new runtime scenario was run. Scratch and test output remain under `/tmp/lead-33752-r1/audit-1/`; worktree status remained clean. Completed within the 45-minute ceiling.

FRICTION: none

VERDICT: INSUFFICIENT F1 (runtime SHA provenance), F2 (F-only joins), F3 (T→F retention), F4 (in-flight follow-up/reuse), F5 (multiple-thread isolation)