# Proof audit 1 — runtime fixture matrix

PR [#28431](https://git.cafe/pingdotgg/t3code/pull/28431), branch `fix/issue-28416`.
Before: [575579d68a](https://github.com/pingdotgg/t3code/commit/575579d68ac4bae09f8426a345d4a3eac1e90c67).
After: [796cfdf664](https://github.com/pingdotgg/t3code/commit/796cfdf664f87bf46a6b202976c50c22158b83b0).
Read-only audit of `/home/ubuntu/wt/pr-28431`; local HEAD and PR head agree. No code edits, commands against live state, servers, browsers, or capture runs were performed. This is a fixture specification, not a claim that a row passed.

## Findings first

1. **Proof is incomplete at this pass.** The PR description has historical inline process-pool timings, but its After is intermediate [37534d72a5](https://github.com/pingdotgg/t3code/commit/37534d72a5), rather than the requested head. It contains no paired finalization/next-turn transcript. Treat these as background, not accepted captures for this round. Fresh paired runtime recordings must identify the exact requested revisions.
2. **Two claims require independent evidence.** A fast checkpoint git command under forge saturation proves the semaphore change. It does not prove that `finalize` or the thread's queued next turn returns/starts before an in-flight PR lookup finishes. Rows F01 and Q01 cover that separately.
3. **A no-op lookup can give false proof.** The real broadcaster requires cached local state, must not have a cached remote entry whose entire value is null, and must allow background scope work. The observer additionally requires a non-null, non-default checked-out ref, an existing thread on that ref, and no different active run. Log a real fake-CLI START handshake; observer return alone is insufficient. A remote status object with `pr: null` is different from an entirely null remote status.
4. **Replacement/lifetime proof is missing.** The new replacement test calls refresh twice with the same run id, proving replacement per call, not the distinct-newer-turn sequence. Capture distinct run ids, same-cwd interruption, different-cwd independence, and observer-scope shutdown. These are proof gaps, not confirmed implementation bugs. The map key is the raw cwd string, not thread id or normalized realpath; do not claim alias deduplication or chronological run-id comparison.
5. **No UI proof is applicable.** Only server code and server tests change. Each timing/order row below is a `recording`: a timestamped, event-labelled text transcript. No viewport, theme, screenshot, or video matrix is required.

## Source/caller inventory and branch collapse

- [VcsProcess](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/vcs/VcsProcess.ts#L350): the global semaphore remains 8. New order is optional keyed permit -> shared non-git permit (4) -> global permit (8) -> process execution. Non-streaming checkpoint git returns through the earlier retry branch, bypassing the keyed/shared wrapper as before. Other git bypasses only the new non-git wrapper. Exact string `command === "git"` decides; executable aliases/absolute paths are non-git if passed directly.
- All four production consumers of the VcsProcess service: [GitVcsDriver](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/vcs/GitVcsDriver.ts#L521) (`gitCommand`/driver `execute`, repository/branch/status/diff/checkpoint operations, plus direct streamed checkpoint `ls-files`); [WorkspaceEntries](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/workspace/WorkspaceEntries.ts#L397) (`list` check-ignore and `listIgnoredFiles`, both git); [SourceControlDiscovery](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/sourceControl/SourceControlDiscovery.ts#L73) (`git --version` and unimplemented `jj --version` probe); [ServerSourceControlHost](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/sourceControl/ServerSourceControlHost.ts#L38) (forwards `process.run` unchanged to provider packages).
- Host consumers: [GitHubCredentials](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-github/src/server/GitHubCredentials.ts#L148) invokes gh auth with `{key:"gh",limit:4}`; [GitHubSourceControlProvider](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-github/src/server/GitHubSourceControlProvider.ts#L233) wraps version/auth discovery with the same key, and repository resolution uses unkeyed git; [githubStackRebase](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-github/src/server/githubStackRebase.ts#L76) uses git. [GitLabCli](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-gitlab/src/server/GitLabCli.ts#L423) runs unkeyed glab; [AzureDevOpsCli](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-azure-devops/src/server/AzureDevOpsCli.ts#L366) runs unkeyed az; [ForgejoCli](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-forgejo/src/server/ForgejoCli.ts#L212) executes unkeyed tea/fj and git during repository resolution. [ForgejoSourceControlProvider](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-forgejo/src/server/ForgejoSourceControlProvider.ts#L65) uses git/tea/fj discovery and git/tea checkout. [GitCafeCredentials](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-gitcafe/src/server/GitCafeCredentials.ts#L101) runs an unkeyed cafe credential helper; [GitCafeSourceControlProvider](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts#L101) runs cafe discovery. Shared [discovery helpers](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/packages/source-control-core/src/server/discovery.ts#L242) forward version/auth commands. HTTP API calls themselves bypass VcsProcess: do not describe a synthetic `cafe pulls list` or `gh pulls list` load as a real PR-provider invocation. Bitbucket has no process run path here.
- [RunFinalizationService](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/orchestration-v2/RunFinalizationService.ts#L57) has one production `finalize` caller: [EffectWorker checkpoint.capture](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/orchestration-v2/EffectWorker.ts#L479). It awaits capture, checkpoint-context lookup, and observer local/workspace work; missing cwd skips observer work; capture/context errors propagate, observer typed errors are logged and swallowed. One thread's outbox work is serialized, so a pending capture delays its next provider-turn.start.
- Observer `refresh` has one production caller, the above finalize method. The separate `refreshAfterTurn` is called by [RunExecutionService](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/orchestration-v2/RunExecutionService.ts#L885), cached per root-run start and invoked on terminal handling. It forwards to PullRequestService cache invalidation and is unchanged. The observer's default is a no-op when no override is installed; production [server wiring](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/server.ts#L521) installs layerObserver. Runtime layer and replay harness provide the finalization service; tests call both methods directly.
- Observer conditional inventory: both local/workspace effects run concurrently and are awaited; `refName === null`; `isDefaultRef`; missing thread; `thread.branch !== local.refName`; `activeRunId !== null && activeRunId !== input.runId`; eligible PR request success/failure; map key absent/present/same cwd/different cwd; scope open/closed. A guard-skipped refresh does not cancel an existing map entry.
- Unchanged VcsProcess sub-branches are covered as controls, not expanded into a new platform/error matrix: git-only metrics and whitelisted/other operations; ProcessRunner argument forwarding/defaults; stdin/spawnCwd/env/streaming; timeout/output-limit/read/stdin/spawn failures; missing exit code; allowed/disallowed nonzero exit; classifier authentication/rate-limit/custom/fallback and git lock detail/retryability; Darwin checkpoint full/batch-fsync fallback vs other platform/operation/command/error/allowed-nonzero; checkpoint retry enabled only for git + known capture operation + absent onStdoutChunk. V08/V10 retain these distinctions without demanding unrelated new captures.

## Driving the real code

**R (real process layer):** scratch driver executed from the selected revision's `apps/server`, importing that revision's real VcsProcess layer with NodeServices. Use a throwaway git repo and fake executables placed first on PATH. Fake forge commands should be one Node process each with START/END/INTERRUPT events and controllable gates, not a shell with untracked `sleep` grandchildren. Real git `rev-parse HEAD` uses the throwaway repo. For global git saturation only, a deliberately fake git executable may gate requests: label that row as a harness capture, not a checkpoint disk-write measurement.

**H (labelled service harness):** import the real RunFinalizationService layer and layerObserver. Supply controlled ProjectionStore, CheckpointCapture, WorkspaceEntries and PullRequestService dependencies. Prefer also the real VcsStatusBroadcaster layer, supplying a controlled GitWorkflowService whose remoteStatus calls the real VcsProcess fake CLI; NodeServices FileSystem and enabled BackgroundPolicy complete its needs. Initial localStatus must describe `feature`, non-default. Keep the layer scope alive after finalize returns; release lookup later. Logging mock checkpoint completion is a harness marker, not proof that a real checkpoint was durably written. A stub broadcaster is acceptable for pure guard rows, but cannot establish remote-lock/process cancellation or cache publication. These layers have no direct public finalize/observer RPC; a full isolated server/turn can exercise them indirectly, but is not needed for this bounded proof.

**Q (labelled queue harness):** adapt the existing [RunFinalizationQueue test scaffolding](https://github.com/pingdotgg/t3code/blob/796cfdf664f87bf46a6b202976c50c22158b83b0/apps/server/src/orchestration-v2/RunFinalizationQueue.test.ts) in scratch: real in-memory SQLite EffectOutbox, EffectWorker layerExecutor/worker, real finalize/observer, controlled capture/projections, and provider start records an event. Enqueue checkpoint.capture then provider-turn.start for the same thread; drain the worker and inspect persisted statuses. The provider start marker is a harness capture, not a real provider CLI turn.

A scratch script outside the package cannot assume bare Effect imports resolve just because cwd is apps/server. One option is `node --input-type=module < /tmp/lead-28431-r1b/<capture-step>/driver.mjs` from apps/server: stdin imports resolve there. Verify module resolution/runtime first. Baseline source must come from the exact baseline revision, in a capturer-owned checkout/export arranged by the lead; never switch or edit the lead's worktree. Keep all scripts, logs and each new timestamped run directory under the one lead scratch root.

## Fixture matrix

`required` means part of the minimum capture set. `control` means enumerated but a new recording is not required for this change; source/test coverage is sufficient unless a capture contradicts it. Timing-dependent rows are explicitly `recording` even when optional. Every required recording is paired Before/After. Multiple rows may be sections of one recording; the matrix does not require one file per row.

| ID / fixture | Inputs and data | Diff effect; Before -> After expectation | Drive / capture type | Minimum / pass-1 status |
|---|---|---|---|---|
| V01 — below/at non-git cap | One service instance; non-git count 1 and 4, no key; scratch repo; normal exits. Representative tea; fj/glab/az/cafe/jj/absolute executable names take the same branch. | No waiting introduced while total non-git demand <=4 and global slots free; all calls return their output. | R; **recording**, START/END ids and active count. Can be the first four arrivals in V03, with a single-call control. | required C1; **MISSING** |
| V02 — new cap boundary | Same instance; 5-8 unkeyed non-git requests, gate holds actual processes. | Before can start 5-8; After starts 4 and the fifth waits outside the global pool. | R; **recording**; count actual START events, not merely requested fibers. V03 supplies this boundary if it logs the first wave and queued requests. | required C1, subsumed by V03; **MISSING** |
| V03 — unkeyed forge saturation / git reserve | 12 gated tea calls; issue 4 checkpoint-labelled git rev-parse requests after forge START handshakes; optional ordinary git status too. Repeat fj/glab/az/cafe only for adapter/executable smoke, not a new limiter behavior. | Before 8 forge processes can fill pool and git waits for release; After max 4 forge processes and all 4 git requests can complete while forge remains gated. Total forge throughput falls 8 -> 4; log waves through all 12 completions. | R; **recording**; real VcsProcess and git. Synthetic fake forge commands are process scheduling fixtures, not live forge integration. | required C1, tea representative; **MISSING** |
| V04 — gh keyed control | 12 gh requests, each `{key:"gh",limit:4}`; same service; checkpoint git while gh is gated. | Before and After gh peak <=4 and git completes before gh release. Key is supplied by caller; the literal name gh does not create a cap by itself. | R; **recording**; use authentic input shape of credential/discovery callers, fake non-secret output. | required C1; **MISSING** |
| V05 — mixed CLIs share one cap | 4 keyed gh + >=4 unkeyed tea, two cwd/host values, one service; submit git after actual starts. | Before mixture may occupy all 8 global permits; After combined non-git peak <=4 across commands/cwds, git still progresses. This distinguishes a shared cap from per-command/per-cwd caps. | R; **recording**; log command, key, cwd, request and actual START counters. | required C1; **MISSING** |
| V06 — git-only global boundary | 8 then 9 gated git requests, ordinary operation, no key; no forge. | Unchanged: 8 can run, ninth waits; git did not inherit the four-slot cap. | R with fake git gate, explicitly **harness recording**; real VcsProcess, synthetic subprocess behavior. | required C1; **MISSING** |
| V07 — custom keys / first limit | Non-git key K limit 2 then conflicting 6; separate key J; fresh service with limit 6; gh without concurrency. Git with an ordinary operation + key also allowed by public input. | Existing per-key first-seen limit remains; After effective non-git concurrency is min(key limit,4,global availability), keys share new cap; bare gh is just unkeyed non-git. Git optional key still applies outside capture fast path. | Real VcsProcess via R; **harness recording** if captured (synthetic keys have no production caller beyond gh/4). | control, new cap covered V02/V05; **SOURCE ONLY** |
| V08 — checkpoint/stream/retry paths | git capture operation with/without onStdoutChunk; ordinary git operation; retryable lock exit vs permanent error; optional supplied key. | Unchanged: nonstream capture uses global + max two retries at spaced schedule and bypasses optional key; streamed capture and ordinary git use generic/keyed path without that retry. Darwin fsync special case remains unchanged. | R for generic success; mocked ProcessRunner/platform harness for exact retry/fsync branches. Timing/retry capture is **recording**. Existing tests supply controls; no new cross-platform requirement. | control; **SOURCE ONLY** |
| V09 — permit recovery | Saturate four non-git slots; interrupt one running request and one queued request; separately have one process timeout/nonzero/spawn-fail; then submit replacement forge + git. | Both revisions release global/keyed permits; After must also release new non-git permits, including interruption while queued. Replacement starts, no phantom slot leak or surviving child. | R; **recording** with actual fake-child exit/interruption and successor START; use controlled short timeout only in scratch. | required C1; **MISSING** |
| V10 — process contract/error controls | env/spawnCwd/stdin/output callback; allowNonZeroExit true/false; null code; output modes/truncation/invalid UTF8; timeout/read/stdin/spawn failures; built-in/custom classifiers; platform/fsync variants. | RunUnbounded/spawn behavior unchanged; new limiter wraps these paths without changing output/error contracts. No new per-option proof matrix needed. | Existing VcsProcess tests/source; synthetic ProcessRunner for impossible OS/error states. Any timeout/order demonstration would be **harness recording**. | control; **SOURCE ONLY** |
| F01 — slow eligible lookup / eventual success | H scope stays open; matching cwd/scope/thread branch feature; local non-default; activeRunId null, then repeat with equal completed R1; forge gated; cached local and background enabled. | Before finalize awaits remote lookup; After checkpoint marker + local/workspace refresh complete, finalize returns while CLI still running, then lookup can finish/publish once released. Both accepted activeRun shapes must request lookup. | H preferably real broadcaster + VcsProcess; **harness recording**; include CLI START, finalize RETURN, later CLI END/status publication. Direct observer alone cannot prove finalize return. | required C2; **MISSING** |
| F02 — awaited prerequisites | Gate checkpoint execute, then independently workspace refresh and local refresh; valid eligible thread. | Both revisions: no refresh before checkpoint finishes; workspace/local run concurrently; observer/finalize still wait for BOTH. Only remote PR lookup becomes detached. | H; **harness recording** using Deferred handshakes/release order and call counts. | required C2; **MISSING** |
| F03 — null ref | local.refName null (nonrepo/detached equivalent), isDefaultRef false; otherwise eligible projection. | Unchanged short-circuit before getThreadShell/PR lookup. No fake forge process starts. | H guard harness, count dependency calls; static event transcript, not timing-dependent. | required C2; **MISSING** |
| F04 — default ref | local main with isDefaultRef true, existing thread on main. | Unchanged short-circuit before thread/PR lookup; workspace/local still complete. | H guard harness; static event transcript. | required C2; **MISSING** |
| F05 — missing thread | feature local, getThreadShell returns null. | Unchanged no PR lookup after thread fetch. | H guard harness; static event transcript. | required C2; **MISSING** |
| F06 — other checkout | local other vs thread feature; include thread.branch null as same mismatch branch. | Unchanged no PR lookup. Thread-on-branch check, not project identity, decides. | H guard harness; static event transcript. | required C2; **MISSING** |
| F07 — newer active run | input R1, matching feature branch, thread.activeRunId R2 != R1. | Unchanged suppresses new lookup. A guard-skipped refresh also does not replace/cancel a pre-existing lookup. Use one static no-existing case; optional in-flight case proves non-cancellation. | H; static guard transcript; in-flight non-cancellation variant is **harness recording**. | required C2 static case; **MISSING** |
| F08 — newer turn replaces running lookup | Same exact cwd; first eligible input R1, then distinct R2 after thread activeRunId becomes null or R2; first remote read holds real broadcaster cwd lock and fake process gate. | Before first finalize/observer call blocks and second remote lookup queues behind lock; After first returns, second accepted call interrupts old map fiber/process, acquires released lock and completes fresh lookup; no stale first publication. | H + real broadcaster/VcsProcess; **harness recording**. Fork first call on Before so second can be submitted; log actual R1 START before R2 refresh. A stub broadcaster proves only map interruption. | required C3; **MISSING** |
| F09 — repeated refresh / rejected replacement | Same cwd and same R1 repeated; alternatively second refresh rejected by F03-F07. | After any accepted refresh replaces current map entry even with same run id; no chronological run-id comparison. Rejected refresh leaves existing entry alone. Before has no map replacement. | H; **harness recording** if captured; existing same-run replacement test covers part. | control, accepted replacement covered F08; **SOURCE ONLY** |
| F10 — different cwd independence | Two canonical scratch repos A/B; eligible threads/runs; A lookup gated when B finishes a turn. | Before independently forked refreshes can coexist; After map entries coexist and B neither cancels A nor waits for its map entry. Global non-git cap still applies. | H; **harness recording**; log two CLI starts and A remains live until its own release; do not use symlink aliases. | required C3; **MISSING** |
| F11 — caller completion vs scope shutdown | Eligible slow lookup actually started; let finalize caller finish; keep observer layer scope open, then close it before releasing fake CLI. | Before caller remains blocked while lookup active; After lookup survives caller completion but layer scope close interrupts it and cleans its process/lock. Scope close must finish without gate release. No later cache publication. | H + real broadcaster/VcsProcess; **harness recording**; capture scope OPEN/CLOSE and child EXIT/INTERRUPT. Before close cancels the still-running scoped caller; label difference. | required C3; **MISSING** |
| F12 — async lookup fails then recovers | First eligible gated lookup returns typed GitManagerServiceError; later accepted lookup succeeds; same cwd. | Both revisions log the existing warning and can refresh again; After finalize already returned before failure, so no unhandled failure/blocked next call. Old failed map entry must not suppress successor. | H; **harness recording**. Mock typed dependency failure acceptable; label it. Preserve logger warning and second successful lookup in transcript. | required C2; **MISSING** |
| F13 — workspace/local/projection refresh error | Workspace refresh fails, local refresh fails, or getThreadShell fails after valid local; capture already succeeded. | Unchanged refresh wraps as RunFinalizationRefreshError; finalize logs/swallows it and returns. No remote lookup. | H static typed-error transcript if captured; existing post-checkpoint workspace-error/queue tests + source are controls. | control; **SOURCE ONLY** |
| F14 — capture/context/cwd paths | Capture execute fails; checkpoint-context lookup fails; scope id absent/no cwd; normal matching scope. | Unchanged: capture error -> capture-checkpoint error and no context/observer; context error -> refresh-workspace error; missing cwd -> success without observer. Checkpoint failures continue to block queued next-turn work. | H / existing queue harness; error and missing-cwd cases static transcript; queue waiting variant is **harness recording**. | control; **SOURCE ONLY** |
| F15 — other observer entry/default | Call refreshAfterTurn(projectId); finalize with no layerObserver override. | Unchanged direct PullRequestService invalidation forwarding; default observer no-ops. No new detached PR behavior for these paths. | H labelled forwarding/default harness if captured; source inventory sufficient. | control; **SOURCE ONLY** |
| F16 — broadcaster no-op/cache safety | Valid observer guards but broadcaster cached entire remote value null or background work disabled; separately missing local when broadcaster called directly, and object `{pr:null,...}` discovery; branch changes during lookup. | Broadcaster rules unchanged: cached null/disabled background can skip forge; non-null remote object with missing PR can refresh; branch-change stale result is discarded. Backgrounding must not be mistaken for permission to force a full refresh/reset backoff. | Real broadcaster with controlled workflow (existing broadcaster tests); no-op rows static, in-flight branch change is **harness recording**. These are driver preconditions/controls, not an expanded feature request. | control; **SOURCE ONLY** |
| Q01 — next turn actually unblocks | Real queue/executor/finalize/observer harness; checkpoint.capture then provider-turn.start same thread; valid feature branch; slow fake forge; in-memory DB only. | Before capture remains running and next start pending until remote release. After capture becomes succeeded and next provider-start marker occurs while remote gate still held; eventual remote finish/failure does not rerun capture. | Q; **harness recording**. Use persisted outbox statuses + drain/Deferred milestones, not an elapsed-time guess or just observer return. | required C4; **MISSING** |
| S01 — client/provider/connection scope | Server-only diff, same environment service layers; all client surfaces and agent providers feed common orchestration path. | No render/client/transport/contract change. Local/remote/tunnel do not alter these semaphore/observer branches. Live forge adapter compatibility is outside a fake-CLI scheduling proof. | Source review; no browser/video/UI capture. | exempt; **NOT APPLICABLE** |

## Minimum capture package

- **C1 — process scheduling recording:** paired revisions, sections V01-V06 and V09. V02 is subsumed by a fully instrumented V03. Only one unkeyed CLI name is necessary to prove the shared non-git branch; tea is the representative. Optional cheap smoke variants fj/glab/az/cafe/jj add executable/adapter confidence but do not count as distinct limiter behaviors. A single mixed gh+tea fixture is necessary in addition to separate loads. A recording must show both the git wait and aggregate forge peak/waves, making the throughput tradeoff visible.
- **C2 — finalization/guards recording:** paired F01-F07 and F12, all in one scripted case bundle. Guard-only rows can be static sections of this text recording. F01 includes null/equal activeRunId variants; F02 independently gates each still-awaited prerequisite.
- **C3 — fiber lifecycle recording:** paired F08, F10, F11. Use actual distinct run ids for replacement, exact same cwd for cancellation, distinct cwd for independence, and explicit layer-scope close. Include actual fake-process interruption/exit when claiming cancellation reaches the CLI.
- **C4 — queued-next-turn recording:** paired Q01, labelled as a queue/service harness. This makes the PR title's next-turn claim observable. It can share the C2/C3 file, but must retain its own case id and persisted queue statuses.

Each recording needs UTC time + monotonic offset, full source SHA, driver/fake-CLI content (or immutable attachment plus hashes), Node/OS versions, cwd/command/key/request ids, actual START/END/INTERRUPT events, active/peak counters, gate releases, return markers and results. Use milestones/handshakes, not a fixed 200 ms pause as the only evidence that load started. Record queued requests as well as spawned children. A bounded watchdog may stop a broken scratch scenario, but its firing is failure evidence, not a pass. Keep observer scope open until the late completion case is captured. Clean up only tracked children/PIDs.

Do not upload tokens, inherited environment values, real user data, reusable dev credentials, or pairing URLs. Use fake non-secret auth outputs and scratch repository identity. Preserve raw logs and driver sources until uploaded. Pair exact requested revisions, not a reimplementation of the old semaphore in a custom class. No video is needed: all observable changes are headless event ordering, concurrency, and wait ownership.

## Pass-1 disposition

Required captures absent: V01, V02 (subsumed by V03), V03, V04, V05, V06, V09, F01, F02, F03, F04, F05, F06, F07, F08, F10, F11, F12, Q01.
Controls enumerated/source-reviewed: V07, V08, V10, F09, F13, F14, F15, F16. S01 exempt. No tests were run; test assertions were inspected only. No merge-readiness verdict or implementation-defect claim is made by this proof audit.

FRICTION: none
VERDICT: INSUFFICIENT V01-V06, V09, F01-F08, F10-F12, Q01 need captures