# Proof audit pass 1 — issue 21219

Issue: [#21219](https://git.cafe/pingdotgg/t3code/issues/21219)
Branch: fix/issue-21219
Head: 597823c8ad18a4870c39d834e907b5ef56476e4e
Base: b5a226e49c
Reviewed complete four-file diff, worktree AGENTS.md, before-runtime.txt, and red-test.txt. Read-only source/evidence audit; no tests, capture, server, browser, forge operations, or repository edits performed. No PR exists. Lead retains server 16663/web 8623/session 30992.

## Applicability and visual fixture matrix

The operational brief and worktree AGENTS.md agree: a server-only fix with no visible surface uses a failing test plus a short runtime transcript. All production changes are ACP server-side protocol/adapter changes; the fourth file is a server test. No changed component, render path, CSS, client contract, navigation, settings, keybinding, or command-palette implementation exists in this diff. Existing clients consume the resulting failure through unchanged rendering. Do not manufacture rows for those unchanged components.

| Fixture | Changed render path | Branch / interaction | Required visual evidence |
| --- | --- | --- | --- |

Zero visual fixture rows. No screenshots or recordings required. If scope later adds a visual interaction or time-dependent row, that row requires a recording, not a still image.

## Complete diff coverage

- effect-acp/client.ts: idle state notification resolves the pending prompt Deferred; now preserves optional error alongside stopReason, usage, and metadata. Completion removes the session's map entry. Both installed notification handlers and buffered-notification dispatch use this path.
- effect-acp/compat.ts: PromptResponse adds optional nullable V2.Error. No client-wire contract or rendering changes.
- provider-acp/server/adapter.ts: extracts existing agent-work failure mapping into idleFailure; retains error code/message/data and provider-flavor classification, with generic fallback. The existing followsAgentWorkState settlement uses it. The newly fixed non-following prompt result branch now finalizes error as failed before success/background-work handling.
- AcpRegistryAdapterV2.test.ts: replay helper accepts agentId; two new acplause cases disable continuations and deliver accepted v2 prompt then idle/error, with structured error and with omitted error.

Callers: registry ACP providers, Grok ACP, and Antigravity share makeAcpAdapterV2. Registry promptFailure classification and Grok's classifier can receive this shared error path; Antigravity can use the generic fallback. Claude registry mode follows agent work only when flavor opts in, continuations exist, and negotiated protocol is v2. Other cases use prompt-result settlement. Codex and other independent non-ACP adapters are outside the changed path. Web/desktop/mobile and local/remote/tunnel receive the same server terminal outcome; no separate visual fixtures are warranted.

## Evidence inspected and limits

Baseline transcript documents real acplause v0.202610.0, protocol v2 accepted prompt, then idle/error with -32000 / Missing Authentication header / auth 401. T3 incorrectly persists completed. A new-thread reproduction and handoff after Codex are reported. It includes a compact persisted row, but is a narrative transcript rather than a full raw event stream.

Red report identifies the two added cases, base revision, test-only commit, expected completed-versus-failed assertion, 14 other passing cases, and lint. This supports the intended red behavior, but is a delegated summary, not raw runner output. No green or fixed runtime evidence was supplied to this pass.

The added assertion consumes the first turn.terminal and checks status/message. It does not count all terminal events, prove exactly once, assert error data/classification, or test controls in the non-following acplause branch. Existing Claude tests cover related success, failure, background interaction, child handoff, and Stop behavior, but use a distinct settlement mode. No implementation defect established by this proof audit; proof remains incomplete pending pass 2.

## Pass 2 requirements (runtime/protocol coverage, not visual fixtures)

1. Identify exact tested head, command, versions and isolated state; provide green output for both added regression cases and relevant existing ACP tests. Prefer raw red/green runner output alongside the existing red summary. No broad suite required by this audit.
2. Repeat real acplause accepted-prompt reproduction through the lead-owned environment. Transcript must correlate native session/turn, prompt acceptance, idle/error and adapter/persisted terminal. Expect failed, the useful Missing Authentication header message, and no completed terminal. Repeat original provider-handoff route if claiming that baseline route fixed.
3. Error without details: v2 accepted prompt then idle stopReason:error with error omitted must produce failed with a nonempty fallback. Nullable error is accepted by the type; explicitly exercise null or justify coverage via the same nullish fallback. Preserve code/message/data through protocol conversion and verify useful flavor classification where applicable; do not expose arbitrary error payloads or credentials in published evidence.
4. Success control in the same non-following mode: accepted prompt then idle end_turn remains completed, without failure. Omitted stopReason still defaults to end_turn. Preserve usage/metadata when supplied. A controlled replay may prove protocol-only variants; label it as replay rather than a real-provider observation.
5. Cancellation control in that mode: cancelled idle without user interruption remains cancelled; user Stop remains interrupted when context.interrupted is set. Neither becomes failed or completed. Existing following-mode Claude refused-Stop/retry coverage should stay green after the shared helper extraction.
6. Following-agent-work control: existing Claude success/error cases stay green, including background request/child continuation behavior and failure detail mapping. This checks that extracting idleFailure did not change the previously correct branch.
7. Exactly once: for error, success and cancellation, collect terminal events through a deterministic replay marker, drained worker, or completed protocol boundary and assert exactly one terminal for the correlated provider turn. Include duplicate/late idle delivery or competing completion paths and verify no second terminal or late completed overwrite. Checking the first terminal or one final database row alone is insufficient. No sleeps, elapsed-time assertions, timeout-based proof, or polling.
8. Include a concise event/persistence transcript from the integrated server path for the target failure; tests/replays may supply the synthetic no-details and control branches. Distinguish adapter terminal status from persisted/UI status, especially cancelled versus interrupted.

Pass 2 acceptance: two regression cases green; target real runtime fails correctly; success/cancellation controls retain their semantics; exactly-once proof supplied; unchanged following-mode controls green. No browser/capture requirement unless scope changes.

## FRICTION

brief: docs/EVIDENCE.md is absent in /home/ubuntu/t3code-ops; used the explicitly supplied operational rule and matching worktree AGENTS.md. No additional visual requirements inferred.