# Proof audit, pass 1

Findings first:

1. **The change has a visible surface. A runtime transcript alone is insufficient.** The server writes ended span exits to its local trace file; Trace Diagnostics derives failure totals, latest failures, common failure groups, and failures per span name. Settings → Diagnostics renders those fields. The fix changes a red nonzero failure count and populated failure tables into a zero count and empty tables in a clean fixture. Web and desktop share this page. Native mobile Diagnostics only renders startup crashes; it does not render these server trace tables.
2. **Missing head-specific proof:** the added regression test covers no-remote status and required-remote `fetchRefCommit`, but the PR body's probe is a description, not an attached reproducible runtime transcript. This pass inspected the test and code; it did not rerun tests or capture the app. Capture the real page before and after, and link the raw runtime evidence. The matrix below defines the minimum evidence rather than requesting a new test for every caller.
3. **The brief's evidence inventory is stale.** A PR comment dated 2026-11-10 already links a transcript, two screenshots and a GIF for the pre-merge parent [6f5d96b](https://github.com/pingdotgg/t3code/commit/6f5d96b5233f4123e8fc79c7240936e8e2944514). These are candidate prior evidence, not artifacts validated by this pass. They do not establish the exact merged head. The source file also changed between that parent and the requested head, so do not silently relabel those captures. This pass does not claim there are no linked captures.
4. **Push reaches the changed lookup too.** Its error text and destination logic are unchanged, but `resolvePushRemoteName` calls this resolver after both push overrides are absent. Expected missing-remote child-span noise disappears there as well. Also, old trace files are retained: an upgrade stops new false failures; it does not erase historical ones. A fresh trace fixture and a retained-history fixture have different expected totals.

Scope: [#32905](https://git.cafe/pingdotgg/t3code/pull/32905), requested and forge-confirmed head [3d4b2607cd](https://github.com/pingdotgg/t3code/commit/3d4b2607cdb18e74f7db35a9059d0315606932fe). Current local `origin/main`, observed forge base, and actual merge-base all resolve to [bcee0f5d28](https://github.com/pingdotgg/t3code/commit/bcee0f5d2872ba193c66ed9ba979bbe424f89ff9). The brief's older [e11c2fdca7](https://github.com/pingdotgg/t3code/commit/e11c2fdca7d1e67b0a9ada3bdbd87314efa78557) is an allowed historical before revision, not the present merge-base. The actual PR diff has two files: 21 insertions/14 deletions in the driver and 39 test insertions.

## Fixture matrix

A **recording** is required whenever proof depends on an action or time. Harness rows use an ordered, labelled runtime transcript (the textual equivalent of a recording), not a still or a mocked UI. All status assertions below mean successful operation results plus span outcomes, not merely an unchanged screenshot. “Reviewed control” means source-inspected, not execution-verified. There is no requirement to duplicate the same regression test at every call site.

| Row | Named fixture / data | Diff effect and expected result | How to seed / drive | Minimum evidence | Status at pass 1 |
| --- | --- | --- | --- | --- | --- |
| O | Origin wins: committed `main`, `feature` one commit ahead; remotes `alpha` and `origin` point to distinct local bare repos | Unchanged control. Resolver returns `origin`, even though another name sorts first; lookup span succeeds. Configure the selected remote HEAD if checking comparison-base selection. | Labelled driver harness with real local Git repositories; public resolver, then status/base resolution. The app can also add this fixture, but it provides no extra distinct UI layout. | Recommended control transcript with baseline/head data; no additional required app capture. Can share one transcript with R/F/E/P. | Reviewed control; no head runtime artifact inspected. |
| R | No origin: first only `upstream`; then `alpha` plus `upstream` | Unchanged control. Resolver returns the first name in Git's output, not an assumed `origin`; lookup span succeeds. The single non-origin variant covers the named requirement, the two-name variant distinguishes ordering. | Same real-Git harness; point distinct names at local bare repos and print raw `git remote` output beside selected name. | Recommended control transcript; no additional required app capture. | Reviewed control; prior comment reports an `upstream` push on the older head, not this complete current-head selection fixture. |
| N | Local-only status, initially clean trace history: committed `main`; `feature` one real commit ahead; no remotes, no upstream, no explicit comparison-base override | **Affected, primary reproduction.** Before: successful status but failed `resolvePrimaryRemoteName` span(s), growing failure counts/groups on repeated full status refreshes. After: same usable local status/Changes result, lookup span succeeds; no newly failed lookup spans. In an otherwise clean log: `Failures = 0`, empty Latest/Most Common Failures, `resolvePrimaryRemoteName` still present with zero failures in Top Span Names. | Primary agent adds the real repository to an isolated app environment; open a project/thread to establish VCS subscriptions; use authenticated `vcs.refreshStatus({cwd, localOnly:false})` twice with responses awaited. View local Changes, then `/settings/diagnostics` for that environment and click `Refresh trace diagnostics` after trace flush. Use the real server tracer, never hand-written trace JSON. | **Real-app recording before and after**, 1440×1000, dark theme, web (also covers desktop's shared Diagnostics content); show refresh → loaded result and enough scrolling to expose count, Latest/Most Common Failures, Top Span Names. Pair with a short raw runtime transcript showing revision, successful status fields, lookup success/failure counts before/after each refresh. | Regression assertion exists and was inspected; red/green is reported in PR body. Body probe is unlinked. Older-head screenshot/GIF links exist but were not validated here. **Missing exact-head integrated proof and attached runtime transcript.** |
| B | Optional base fallbacks / lookup bypasses: N with no explicit base, then valid explicit local base; unknown branch name; detached or unborn HEAD | **Affected only if lookup executes.** No-base status/review/Changes falls back to local candidates without a failed lookup span. Invalid branch resolution returns null. Valid explicit-base resolution may return before the lookup. Detached or non-repository short circuits need not execute it. Unborn repo has no usable comparison commit. Do not call zero observed lookups proof of this fix. | N's app flow covers the ordinary no-base path; harness can call branch/worktree-base resolution and record return values. Use a separate unborn repo if demonstrating that short circuit; never require feature-ahead behavior without a commit. | No additional visual combination required. Fold one local-base success assertion into N's transcript; label bypass cases as reviewed controls. | Core recovery paths inspected. N covers representative fallback; bypass branches do not require another recording. |
| F | No remote, operation requires one: N; call `fetchRefCommit({cwd,ref:'refs/pull/1/head'})` and `fetchRefIntoBranch({cwd,ref:'refs/pull/1/head',branch:'proof'})` | **Affected span ownership, unchanged failure result.** Both return the same no-remote `GitCommandError`, operation `GitVcsDriver.resolvePrimaryRemoteName`, detail `No git remote is configured for this repository.` Before child lookup also fails; after child succeeds and enclosing fetch operation fails. No fetch command should run without a selected remote. | **Labelled harness transcript.** A normal no-remote PR checkout may fail provider discovery before reaching these methods, so an app error from that path is not proof of this resolver. Direct driver calls with the production driver and recording tracer reach the exact branch. | Ordered harness transcript for both methods, baseline/head, with error and failed span names. Fold a known real failure into N-after's Diagnostics capture if feasible to show nonempty failure tables still work. No invented app checkout capture. | Existing focused test proves the `fetchRefCommit` assertions in source; reported execution is not independently rerun. `fetchRefIntoBranch` is source-inspected only. **Runtime transcript incomplete.** |
| E | Genuine `git remote` failure: origin lookup returns absence, listing remotes exits nonzero with a Git error | Unchanged negative control. `findPrimaryRemoteName` must fail its `resolvePrimaryRemoteName` span, not return null. An outer optional caller may recover, but the real Git failure remains diagnostic evidence; required callers fail too. This differs from successful `git remote` with empty stdout. | **Labelled harness transcript** using a command-spawner fixture that fails only the exact `git remote` command, permitting `remote get-url` and other commands. Or use real driver on a non-repository directory for public resolver, recording actual Git exit and error operation. The non-repository directory is unsuitable as an app status reproduction because status can short-circuit before the resolver. | Harness transcript showing actual failed command, typed error, lookup failed span. A real-app injected-error recording is optional; do not pass a fabricated Diagnostics page as production evidence. | Error propagation verified in source; **no runtime negative-control artifact inspected.** |
| P | Push fallback and override: N with positive local delta; no `branch.feature.pushRemote`, no `remote.pushDefault`; then an explicit/configured publish remote | **Affected child-span noise only on fallback.** No-remote positive-delta push retains `Cannot push because no git remote is configured for this repository.` and the push parent failure, while the expected missing-remote lookup child succeeds. An up-to-date local-only branch can skip push; therefore require a positive delta to reproduce the rejection. Explicit/configured overrides bypass this lookup in push-destination resolution, though preliminary status can still invoke base lookup. | Public driver harness for deterministic error/parent span; same local bare-remote fixtures cover successful destination and overrides without hosted credentials. An authenticated app RPC can exercise the push path if available; a disabled menu item does not exercise it. | Recommended control transcript in the same batch; no independent app visual required. | Reviewed control; older-head comment reports push rejection and non-origin success. Current-head execution not claimed. |
| H | Retained history / mixed failures: after producing N on baseline, keep its trace files and run head; include one genuine unrelated failure | **Affected incremental counts, unchanged history retention.** Existing false-failure rows remain, as do genuine failures. New no-remote status calls must not increase the lookup failure count. With unrelated failures the total need not be zero and failure tables remain populated. | Use only isolated dev state; carry baseline trace files into a copy for head, or compare per-span counts within the same controlled history. Refresh Diagnostics after each awaited status action and sink flush. Never delete or modify live install traces. | **Recording** if this row is exercised. Optional extension of the main recording, not another required viewport/theme product. Show before/after counts, not a lone populated after still. | History behavior source-inspected; optional additional capture. Do not mark N failed merely because a retained-history environment has nonzero totals. |

Minimum capture product: **one viewport × one theme × N × two revisions = two real-app recordings**; stills may supplement but cannot prove repeated refresh behavior. Capture ready states and the action-to-result transition. One short labelled transcript must cover N/F/E and can cheaply include unchanged controls O/R/P; source-only bypass rows B do not demand more tests. H is optional, but its expected behavior must be respected whenever a reused trace directory is used. The real-failure branch may be demonstrated by F/E harness output; this pass does not demand a third app recording just to duplicate the error assertion.

## Complete direct-caller inventory

All callers of the public resolver share O/R/N/E selection behavior when reached. The `findPrimaryRemoteName` helper is called only by the public wrapper. The wrapper is exported through the driver and forwarded by `ServerSourceControlHost`; it adds no span. Below, “recover” means the caller intentionally catches the typed error, not that genuine Git errors become successful child spans.

| Caller at reviewed head | Entry / branch and fate | Fixture mapping |
| --- | --- | --- |
| [Core: `resolvePushRemoteName`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.ts#L1773) | After branch push override and global push default are absent, recover to null. Used by `resolvePushDestination`, `resolvePushTarget`, `pushCurrentBranch`. | O/R/P; N/E shared selection |
| [Core: `resolveBaseBranchForNoUpstream`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.ts#L1884) | After explicit base checks, recover to null and conventional local candidates. Reached by status ahead counts, review/Changes merge-base selection, push comparison. | N/B |
| [Core: `resolveBranchBase`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.ts#L3905) | Only when ref verification fails; recover to null; feeds `resolveBranchName` and worktree base selection. | B |
| [Core: `fetchRefIntoBranch`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.ts#L4478) | Requires remote; error propagates in `GitVcsDriver.fetchRefIntoBranch`. | F |
| [Core: `fetchRefCommit`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.ts#L4511) | Requires remote; error propagates in `GitVcsDriver.fetchRefCommit`. | F |
| [GitManager: `configurePullRequestHeadUpstreamBase`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/git/GitManager.ts#L917) | No head repository metadata and not cross-repository; remote required for tracking fetch/upstream. | F; harness if provider discovery prevents entry |
| [GitManager: `materializePullRequestHeadBranchBase`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/git/GitManager.ts#L1015) | No head repository metadata; failed PR-ref fetch can fall back for open, same-repository PR, then remote required. Closed/cross-repository cases rethrow earlier cause. | F |
| [GitManager: `readRemoteStatus`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/git/GitManager.ts#L1408) | Merged PR + known head + missing default branch; recover default to null, then conventional base check. | N/B; upstream/provider metadata branches are unchanged |
| [GitManager: `resolvePrBase`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/git/GitManager.ts#L2035) | After configured/upstream/provider bases miss; recover remote default to null, then `main`. | B |
| [GitManager: `resolveBaseRangeRef`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/git/GitManager.ts#L2098) | Fully qualified refs bypass lookup; otherwise recover missing remote to original base branch. Used in commit/range preparation. | B |
| [MCP: `resolveScheduledTaskBaseRef`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/mcp/OrchestratorMcpService.ts#L1894) | Recover null, try local main/master, finally main. Bound-to-thread root strategy bypasses this worktree-base selection. | B; service harness avoids actually scheduling agent work |
| [StorageCleanup: worktree eligibility](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/storageCleanup.ts#L994) | Separate initial `git remote` empty output bypasses resolver. If nonempty, requires selected remote; a concurrent removal can yield the no-remote error. No cleanup execution needed to audit it. | O/R; B bypass; F-shaped concurrent absence |
| [GitCafe provider: `resolveTarget`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/source-control-gitcafe/src/server/GitCafeSourceControlProvider.ts#L220) | Explicit parsed repository/context URL can bypass. Without repository, map lookup error to provider error; with repository, recover null and use default host. | F/B |
| [GitHub provider: `checkoutPullRequest` / `baseRemote`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/source-control-github/src/server/GitHubSourceControlProvider.ts#L716) | Prefer matching known remote, else public resolver; required when fallback is evaluated. Other PR/fork branches can supply their own remote. | O/R/F; known-remote bypass B |
| [Bitbucket API: `resolveCheckoutRemote`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/source-control-bitbucket/src/server/BitbucketApi.ts#L886) | Same-repository branch without context remote; recover null, then provider's existing remote-creation/selection path. Cross-repository branch bypasses this lookup. | B |
| [Cursor Origin provider: `checkoutChangeRequest`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/source-control-cursor-origin/src/server/OriginSourceControlProvider.ts#L313) | Missing context remote requires resolver for CLI remote argument. | F |
| [Cursor Origin CLI: `resolveRepository`](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/source-control-cursor-origin/src/server/OriginCli.ts#L441) | Context remote URL bypasses; otherwise recover null and return provider-specific missing-remote error. | F/B |

No other production direct call sites were found by repository-wide `rg`. GitLab and Azure DevOps have no direct call to this resolver. Agent runtime providers do not select this remote; a paid agent turn is unnecessary. Scheduled-task selection already calls the same server driver. Contracts and return schemas are unchanged.

## Render paths and collapsed branches

The changed lookup preserves the span name `resolvePrimaryRemoteName`; the success-with-null happens inside that span, while `filterOrFail` is outside. A real command failure remains inside. Evidence source: [driver implementation](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.ts#L1747), [focused regression](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/vcs/GitVcsDriverCore.test.ts#L4005).

The real render chain is [server observability](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/observability/Observability.ts#L40) → [local span serializer](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/shared/src/observability.ts#L609) → [TraceDiagnostics aggregator](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/diagnostics/TraceDiagnostics.ts#L244) → [RPC handler](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/server/src/ws.ts#L2728) → [shared client query](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/packages/client-runtime/src/state/server.ts#L1305) → [Diagnostics route](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/web/src/routes/_chat.settings.diagnostics.tsx#L5) / [page](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/web/src/components/settings/DiagnosticsSettings.tsx#L1050).

Data-sensitive render branches: `failureCount > 0` selects danger tone; `latestFailures.length > 0` and `commonFailures.length > 0` select tables vs empty text; group counts grow with repetitions; Top Span Names renders both count and failure count. The helper's successful span is retained, so it can still appear in Top Span Names and Slowest Spans. The top-name/slowest lists cap at 10 and latest failures cap at 20: isolate activity so unrelated traffic cannot hide the target. Unrelated log/process/resource panels, slow-span timing and exact durations are not acceptance criteria.

Loading (`data === null`/pending), refreshing with retained data, unreadable/partially readable trace files, permission denied, no selected environment, cause-text expansion, relative timestamps, log-folder action and telemetry export all retain their existing code. N records the refresh interaction; no extra failure-loading fixture is needed for this server-only semantic change. Empty vs populated and zero vs positive are covered by N/F/E/H. One failure and repeated instances share layout but repetitions prove count growth/stability. Long cause text and many unrelated names do not change the branch under review. Theme and width use existing shared table styles; no CSS, responsive rules, theme branches or native-shell branches changed. Therefore no light/dark × narrow/wide cross product is justified. One wide dark web client is the minimum visual proof, and the same server semantics apply for local, remote and tunnel-connected clients when the correct environment is selected. Native mobile's [Diagnostics screen](https://github.com/pingdotgg/t3code/blob/3d4b2607cdb18e74f7db35a9059d0315606932fe/apps/mobile/src/features/diagnostics/SettingsDiagnosticsRouteScreen.tsx#L82) has no trace-failure rendering to capture.

## Primary-agent capture handoff

Run one isolated server at a time, with distinct baseline/head trace histories for N. Prefer current main baseline above to minimize unrelated version differences. Add the same real local-only fixture through the app. Use normal authenticated RPC or UI; await each response. `vcs.refreshStatus` invalidates workflow caches and performs a full read when `localOnly:false`; repeated cached reads can falsely look clean. The Diagnostics refresh itself only reads trace files and does not exercise repository status. Trigger VCS refresh first, then let the trace sink flush (default batch window 200 ms) and refresh Diagnostics. Synchronize on the flush or observable persisted result rather than inventing a delay-based test. Never promise an exact number of resolver invocations: high-level status can call it more than once. Assert successful invocation count is nonzero and the number of failed lookup spans does not grow on head.

Record revision, Git fixture state, RPC success/status fields, span outcomes, Diagnostics field counts and trace file identity in a small sanitized transcript. For F/E print both outer exit and child span outcome; catching an error at the outer level must not hide a real failed child. Do not seed fabricated JSON traces as proof of the fix, and do not use the live install's state. Primary agent owns the integrated app pass; this read-only sub-agent started no server, no agent turn, and no browser session.

This pass created only this report in its designated scratch directory and made no worktree changes, pushes, PR edits or comments. Tests and prior linked artifacts were not independently executed/validated. Disk check remained well above the 5 GB limit.

FRICTION: brief | The brief says no captures are linked, but the current PR has older-head screenshot/GIF/transcript links; its named merge-base also predates the current merge-base | Refresh the evidence inventory and distinguish historical before revisions from the current merge-base before issuing pass 1.

VERDICT: INSUFFICIENT N F E (missing exact-head integrated recording/runtime proof; required-fetch transcript incomplete; genuine git-error runtime control unverified)