# Proof audit pass 2

Findings:

1. **P2 — R11 is a real reachable behavior, not an impossible synthetic payload.** With a pending native `ContextOverflowError`, the exact `/compact` path emits a completed `Context compacted` item before the new finalizer converts completion into overflow failure. This is the interaction between [adapter.ts:2029](https://git.cafe/pingdotgg/t3code/blob/dd3b029f5325ae8e67ca89f37c426bdbe92449e6/packages/provider-opencode/src/server/adapter.ts#L2029) and its existing summarize-success item emission at [adapter.ts:3262](https://git.cafe/pingdotgg/t3code/blob/dd3b029f5325ae8e67ca89f37c426bdbe92449e6/packages/provider-opencode/src/server/adapter.ts#L3262). The delivered `R11-after.ndjson`, fixture `UNIT R11-compact-overflow`, and `R11-outcome.diff` show it correctly. Avoid claiming compaction succeeded when pending overflow will make this settlement fail.

   OpenCode 1.18.18 does publish `session.compacted` after an actually successful compaction, but an HTTP summarize result of `true` does **not** mean that happened. Its [compaction processor](https://github.com/anomalyco/opencode/blob/v1.18.18/packages/opencode/src/session/compaction.ts#L423) returns `stop` on summary overflow without publishing the event; the [summarize HTTP handler](https://github.com/anomalyco/opencode/blob/v1.18.18/packages/opencode/src/server/routes/instance/httpapi/handlers/session.ts) runs the prompt loop and then returns `true` without inspecting the failed assistant result.

   Independently reproduced using real OpenCode 1.18.18, its real SDK and a fake HTTP model. Both versions seed a healthy first turn, then issue exact `/compact`; the model returns a summary context overflow. The controlled-delivery wrapper waits to expose the real summarize result until the adapter has consumed the real error, and holds subsequent real SSE delivery until summarize settles. No native events or RPC results are fabricated. This controls **both SDK result delivery and subsequent SSE delivery**; the historical action note saying “hold only SSE ... leave HTTP unchanged” means the underlying HTTP response was unchanged, not that its delivery to the adapter was ungated.

   Baseline `20261029T012729-before-R11`: real HTTP `data:true` at seq117; native overflow seq118; failed compact turn seq123, failureItemOrdinal201; no compaction item. Head `20261029T012155-after-R11`: real HTTP `data:true` seq117; native overflow seq118; completed compaction item seq126 ordinal201; failed compact turn seq130, failureItemOrdinal202. Both consume native idle, have no native `session.compacted`, and use distinct seed/compact provider-turn IDs. This establishes real protocol reachability under controlled delivery, not a claim about its frequency in ordinary clients.

   Ungated negative controls also preserve an adjacent **pre-existing** race: both baseline `20261029T012650-before-R11` and head `20261029T012541-after-R11` receive summarize success before consuming the overflow, emit a completed compact turn, and only then consume the error. Do not attribute that older race to this PR. The initial head run `20261029T012053-after-R11` reused an attempt ID across seed and compact; it is superseded by the corrected distinct-generation runs and is retained only as preliminary raw evidence.

2. **P3 — R14's change inventory is incomplete.** [what-else-changed.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bc5d611783743015/what-else-changed.md) and the draft Evidence section claim every observed normalized difference is listed. Their R14 account omits that `UNIT R14-provider-id-legacy-idle` now retains the `Provider-assigned receipt` assistant item on the original turn and moves `failureItemOrdinal` **101→102**. These changes are explicit in [R14-outcome.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/27fa884c4359b863/R14-outcome.diff). Add them to the inventory. The captures themselves are sufficient; no new capture is needed for this editorial correction. The final insufficiency below is limited to this contradicted completeness claim.

All 30 delivered row transcripts and all 15 diffs were read, including every constituent fixture/event in their ordered reading view; exact repeated objects were represented by references and successive entity snapshots by field deltas. The full pinned production/test diff, capture drivers, matrix, index, environment/limits, draft Evidence section, change inventory, and archived assertion/audit logs were checked. Structural checks supplemented that reading: all 62 fixture bodies equal their archived raw recordings; both SHA headers agree in every fixture; all 15 normalized diffs rebuild exactly; outcomes equal emitted terminal streams, with no duplicate terminal per provider turn.

| Row | Status | Checked result |
|---|---|---|
| R1 LIVE | SUFFICIENT | Overflow stays active, real compaction and continuation attach to original turn, one completed/null terminal, ready/null session. Independent head rebuild: zero normalized delta. |
| R2 LIVE | SUFFICIENT | Compaction disabled; overflow failure delayed until idle with original payload/reusable disposition and one terminal across both idle forms. |
| R3 LIVE | SUFFICIENT | Two native overflow errors; head fails at settlement with the second session.error payload, not the later assistant-message error. |
| R4 LIVE | SUFFICIENT | Baseline interrupt rejected after early failure; head abort acknowledged, interrupted/null terminal, ready/null session. |
| R5 UNIT | SUFFICIENT | EOF after pending overflow becomes transport_error/broken; new start rejected after dead stream. |
| R6 UNIT | SUFFICIENT | Settled turn remains settled; late overflow only updates session error; late compacted/idle does not resurrect it. |
| R7 UNIT | SUFFICIENT | Unknown and related-only errors/compaction do not clear the owned pending overflow; owned idle fails with it. |
| R8 UNIT | SUFFICIENT | Missing session ID retains immediate broadcast failure and broken disposition. |
| R9 LIVE+UNIT | SUFFICIENT | Ordinary live APIError and fallback/abort controls unchanged; later ordinary failure wins over pending overflow. |
| R10 UNIT | SUFFICIENT | Real adapter native-child construction/projection exercised with synthetic task events; recovered child completes, uncompacted child fails at idle, root settles independently; no invented child root terminal. |
| R11 UNIT | SUFFICIENT, defect observed | Healthy compact and overflow summarize-settlement captures satisfy the minimum. Completed-compaction-before-failure anomaly is genuine; see finding 1. |
| R12 UNIT | SUFFICIENT | Healthy first/second-turn controls and inactive compaction remain unchanged, completed/null; no resurrection. |
| R13 UNIT | SUFFICIENT | Replacement retains O2; clear then replacement fails O2; final clear completes/null; exactly one terminal. |
| R14 UNIT | INSUFFICIENT inventory; captures sufficient | Early idle held pending receipt/acceptance; reconciliation and legacy idle settle correctly. Required outcomes are captured, but “every difference” prose omits retained assistant item and ordinal101→102. |
| R15 UNIT | SUFFICIENT | Existing generic SDK-failure mapping wins over pending overflow; interrupts remain interrupted/null unless stream failure wins; EOF/summarize race is transport_error/broken with no compaction item. |

Independent R1 run `20261029T011803-after-R1` used detached head [dd3b029f53](https://git.cafe/pingdotgg/t3code/commit/dd3b029f5325ae8e67ca89f37c426bdbe92449e6), OpenCode1.18.18 and Node v26.12.1, with the uploaded LIVE driver/test unchanged apart from output/worktree paths. Test exits0. The delivered and rebuilt normalized outcomes contain 21 records each and are exactly equal; `rebuild-delta.diff` is empty. Base is [e34067edef](https://git.cafe/pingdotgg/t3code/commit/e34067edef2eba03c1e40bca7d2b2d933ae12b85).

Archived log claims also check out: baseline adapter suite34 passed, head36 passed; the two new head tests against baseline source yield1 failed recovery test and1 passed uncompacted guard; synthetic capture cases26/26 per SHA; supplied transcript audit202/202. These are checked supplied logs, not independent reruns of those suites. No browser, orchestration persistence, parent notification, client rendering, OpenCode2, or owned-server cleanup assertion is added.

Supplemental evidence is archived before scratch cleanup: R1 rebuild/raw SSE/model/config/test log, all preliminary and final R11 runs, controlled and natural drivers, integrity/rebuild/cleanup results, and this report. Only generated top-level run files are archived; OpenCode databases, caches, XDG homes and dependencies are excluded. All12 server/model PIDs from6 runs are absent. The only extra checkout is removed at handoff. No PR edits, pushes or comments were made, and the lead checkout was not modified. The main checkout has no tracked changes.

FRICTION:
- model | Initial `vp install` ran from the main checkout after worktree creation; it added4 dependency packages and ran prepare, then installation was repeated in the intended isolated checkout. Main checkout tracked status remains clean; dependency state was not destructively rolled back. | Set the install command's workdir explicitly.
- model | The first supplemental R11 experiment reused the one-turn LIVE helper's attempt ID for two turns; it was discarded as proof and rerun with the uploaded generation-aware helper. | Use the multi-turn helper before adding a seed turn.

VERDICT: INSUFFICIENT R14 (change-inventory completeness claim; captures sufficient)