# Proof audit, pass 1

Reviewed [#33469](https://git.cafe/pingdotgg/t3code/pull/33469), head [827879efad](https://git.cafe/pingdotgg/t3code/commit/827879efad8208e630355089e9dcc4e47461d691), against main [ad989057ba](https://git.cafe/pingdotgg/t3code/commit/ad989057ba3b9298d40969689229f4feef1c9872). Read-only review in the supplied checkout; no code changes, server launches, provider turns, pushes, or comments. Test coverage below is from inspecting test bodies, not a new test run.

## Findings

1. **The existing before/after runtime pair covers F01. Do not recapture it.** The before transcript reports a completed restarted wake, generation 1 still reserved, A claimed, and late B pending with no successor. The after transcript reports a superseded initial wake attempt, a completed `steering_restart` attempt, completed run 3, A and B delivered, `nextGeneration: 3`, and `delivery: null`. Its message order is consistent with the claimed late-sibling sequence. These are timestamped final state dumps with sequence descriptions, rather than event-by-event traces; they establish the reported end states, but do not expose the intermediate clear/reserve transition.
2. **Four additional recordings form the minimum practical capture set: F03, F04, F06, F07.** F03 already has a focused integration test for reservation and offer, but its continuation queue is mocked: it does not establish that the successor wake starts and settles. F04 exercises the other command explicitly added to the after-commit condition. F06 and F07 are the native-steer and ordinary-run controls. F02 is already a focused test and shares the late-sibling outcome with F01 and the implicit-restart capability branch with F03; it needs no additional minimum recording. F05 shares those branches with F01/F04.
3. **No contradictory runtime evidence found.** Missing proof is not a confirmed implementation defect. The remaining missing rows below are supplemental branch/harness coverage, not requests to recapture every unchanged guard or to expand the fix. They identify limits honestly instead of crediting the two new tests with cases they do not execute.
4. **The old evidence is still relevant at this head.** Local comparisons show no changes under `apps/server/src/orchestration-v2` between captured fix [d78c9c10a1](https://git.cafe/pingdotgg/t3code/commit/d78c9c10a1) and the reviewed head, or between captured main [7a328c47ca](https://git.cafe/pingdotgg/t3code/commit/7a328c47ca) and the observed main base. Only the orchestrator and its steering integration test differ against that base.

Existing evidence: [before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7806335172046681/issue-33454-runtime-before-main.txt), [after transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/417c40ebdf164af5/issue-33454-runtime-after-fix.txt). All seven linked uploads were downloaded into separate newly created directories and read as untrusted data. None was executed.

## Fixture matrix

Notation: P is the spawning/source run; W is the currently running completion wake. Initially P has an open cohort, `nextGeneration=2`, and delivery D1 `{generation:1,messageId:M1,taskIds:[A]}`. W's `userMessageId=M1`, M1 owns P/generation 1, and A is claimed. B is an app-owned sibling belonging to P. A “restart” means a new attempt of W, not a new run. “New wake” means a separate run. All rows are **recording**: use timestamped server-state/event transcripts or a labelled deterministic harness transcript; stills are inapplicable.

`Δ` = behavior newly reached/changed by this diff; `M` = moved acceptance logic, behavior intended unchanged; `C` = unchanged surrounding control. “Minimum” marks the basis of independent captures; the other rows expose additional combinations without requiring a Cartesian product of recordings.

| ID / named fixture | Data and sequence | Observable state outcome | Diff / minimum | Proof kind | Status | Real-app seed or labelled harness |
|---|---|---|---|---|---|---|
| F01 / direct explicit restart, late sibling | P settled; B still running at `message.dispatch(restart_active)`; finish restarted W, then B. Native steering may be supported. | At restart A becomes delivered, D1 clears without incrementing `nextGeneration`. Later B claims D2/gen 2; a successor wake starts and eventually B is delivered, delivery null, nextGeneration 3. | Δ / **yes, already captured** | recording | **covered by existing transcript**; late implicit variant also has T1 | Fresh dev DB; two delegated children, hold W and B separately; `t3_thread_send(mode:"restart")`; release W then B. Existing pair is sufficient for this row. |
| F02 / direct implicit restart, late sibling | Same ownership/timing as F01, but no active steering and interrupt-restart supported; ordinary `steer_active`, not forced restart. | Same cohort/task outcome as F01; steer is a restart attempt. T1 ends at D2 reserved/B claimed, not successor completion. | Δ / no, F01 + F03 cover independent branches | recording | **covered by test only**: T1 | Use a supported Cursor/ACP-style parent and `t3_thread_send(mode:"steer")`. T1 seeds remote tasks and drives real orchestration/effect-worker dispatch with a capability-controlled adapter. |
| F03 / direct implicit restart, sibling already pending | P settled; B completes while W still owns D1; B is terminal/pending. No active steering; interrupt-restart supported. Send direct steer. | A delivered; B claimed in D2/gen 2 immediately; nextGeneration 3. Commit triggers an offer. B's wake queues while W is active, then starts and settles after W; no manual send/resume required in the unheld fixture. | Δ / **yes, recording missing** | recording | **covered by test only**: T2 proves D2 and offered identity; it mocks the continuation consumer | Same two-child gated seed; release B before steering W. Use incapable-of-active-steering parent so the successor route is deterministic. Record B pending before steer, claim and offer after commit, queued successor, start, and terminal settlement. |
| F04 / promote queued message, sibling already pending | F03 plus a normal queued message Q. Promote Q into W with `queued-message.promote-to-steer`; no active steering. | Q's queued run/attempt/node cancel and its message moves into W; W restarts. A delivered, B claimed/gen 2, nextGeneration 3. The promotion's own commit must offer the next wake, which starts after W and settles B. | Δ / **yes, recording missing** | recording | **missing**; T3 proves promotion/restart on an ordinary run, not wake settlement or successor offering | `t3_thread_send(mode:"queue")`, then `t3_queue(action:"promote_to_steer",queuedRunId:Q,targetRunId:W)`. Release B before promotion; capture queue cancellation as well as delivery/wake states. |
| F05 / promote queued message, late sibling | F04 with B still running at promotion; release it after restarted W completes. | Promotion/restart as F04; D1 clears/A delivered with no immediate D2 offer. B later reserves gen 2 and wakes P. | Δ / no, F01 + F04 cover independent branches | recording | **missing** as a combined fixture | Same MCP queue/promote driver, releasing B after W. Can be folded into a later wake in the F04 run; no separate minimum capture required. |
| F06 / native active steer of an existing wake | W owns D1; native active steering supported; no forced restart, incompatible selection change, or unsupported attachments. B finishes behind W. | Steer appends to the existing turn; W keeps M1 and the same attempt. Restart-time acceptance is not called: D1/A remain reserved/claimed until normal W finalization, which delivers A and reserves/offers gen 2 for B. | C, essential contrast to Δ / **yes, recording missing** | recording | **missing**; T4 exercises native mailbox acceptance into an ordinary run, not a user steer into an existing wake | Codex parent; same held wake; `t3_thread_send(mode:"steer")`; finish B then W. Record unchanged original input/attempt before W terminal and successor settlement afterward. |
| F07 / ordinary non-wake run restart | Running input has no delegated-completion ownership; force restart or use restart-only capability. | Normal attempt supersession/input replacement; helper guard is a no-op. No task delivery changes, invented generation, or extra completion wake. Any existing unrelated cohort must be preserved. | Δ guard / **yes, recording missing** | recording | **covered by test only** for ordinary restart: T3/T5; existing-cohort preservation not asserted there | Start an ordinary held turn, restart it, finish it, dump runs/tasks before and after. An existing cohort is a useful extra assertion, not required to invent malformed state. |
| F08 / restart twice after first acceptance | F03/F04 has reserved D2. Restart W again after its input has become ordinary steering text, before D2 settles. | Second restart must not accept/clear D2 or redeliver A; D2 stays gen 2 and B reaches one accepted delivery. | Δ interaction / no | recording | **missing** | Extend F03/F04 with another restart after observing the restarted provider turn running. Preserve and compare D2 identity across it; count successor runs/messages. |
| F09 / next generation offered into a running native-capable turn | F03 ownership and B pending, but native steering is supported; restart is explicit. Continuation processing occurs after restarted W is running. | Same immediate D2/gen 2 reservation. Its automatic completion message may be natively steered into restarted W, accepted there, and B delivered without a separate successor run. If processing occurs while W is starting or waiting, it instead queues a separate wake. Both routes must retain one generation/delivery identity. | Δ interaction / no | recording | **missing** for this combined fixture; T4 covers the existing mailbox path separately | Real RPC/MCP seed is possible; record whichever route actually occurs, without asserting that every gen 2 requires run 3. A labelled harness must gate continuation consumption to demonstrate both schedules deterministically. |
| F10 / mailbox acceptance, no eligible sibling | Native automatic D1 steer is accepted; no other eligible pending terminal task. | A claimed→delivered, observedByRunId null; delivery null; nextGeneration unchanged. `notification.delivery.accept` keeps its after-commit offer scan, which creates no additional wake here. | M / no | recording | **covered by test only**: T4 (`after delivery` mailbox case) | On native non-tool-interrupting steering, let A finish while P is running. Successful effect-worker steer issues `notification.delivery.accept`. Label T4 if using the deterministic adapter. |
| F11 / mailbox acceptance batches live-parent siblings | P is live; D1 accepted; multiple app-owned terminal pending siblings with `completionWake:"always"`. | A delivered; all eligible siblings claimed in one D2 with gen 2; nextGeneration increments once; acceptance offers the reserved delivery. | M / no | recording | **covered by test only**: T6 (state/batching assertions) | Gate mailbox acceptance while B/C finish, then release acceptance. Exact effect-worker timing is most practical in labelled T6-style harness; ordinary MCP calls cannot pause an in-flight native acceptance. |
| F12 / settled source admits settled_only | P is non-live (including waiting/terminal); another continuation may be running. B is terminal/pending with `completionWake:"settled_only"`. Accept D1. | B qualifies based on P's liveness, not another run's; D2/gen 2 is reserved and B claimed. | M, also reachable from Δ restart / no | recording | **covered by test only**: T7 | Driver may use RPC task requests with explicit completionWake and source-run lifecycle; deterministic T7 seeds cancelled P plus running continuation and sends acceptance. |
| F13 / mixed eligibility and accepted-task states | Beside accepted claimed A, include accepted already delivered/acknowledged/disposed tasks; other-run and provider-native tasks; nonterminal pending tasks; nonpending terminal tasks; live-P settled_only B; eligible always C. Terminal variants are completed/failed/cancelled/interrupted. | Only eligible pending app-owned tasks of P are newly claimed; only accepted IDs still claimed become delivered. Others retain state/observedByRunId. Live-P settled_only stays pending; settled-P variant admits it. If an accepted ID is already pending and eligible, pending membership wins and it is re-claimed. | M, reused by Δ / no | recording | **missing** as a mixed-state acceptance harness; T6/T7 cover positive subsets only | Legal subsets can be seeded with RPC/MCP tasks and acknowledged results. Inconsistent overlap/nonterminal ownership variants require a labelled event-sink integration fixture, not direct edits to a running DB. Test both empty and nonempty eligible sets. |
| F14 / stale or unrelated ownership | Input absent/nondelegated; referenced P absent; P has no cohort; stopped/disposed cohort; null delivery; different message ID; generation mismatch. | Helper returns undefined with no delivery/task changes. Acceptance command emits unchanged thread metadata and has no cohort-only merge target; restart caller continues ordinary restart without metadata fallback. | M guards, newly relied on by Δ / no | recording | **covered by test only** for representative stale/no-op outcomes: T6 repeat-old acceptance and T4 duplicate acceptance; absent ownership also T3/T5. Individual malformed operands are not all separately tested. | Replay an old acceptance through RPC after D2 supersedes D1, or accept an ordinary message. Missing-reference/inconsistent-shape variants need a labelled event-sink harness. One no-op outcome class; do not multiply runtime recordings for each OR operand. |
| F15 / inactive thread suppresses next claim | Valid accepted D1, otherwise eligible B, but thread archived or deleted before acceptance executes. | A's claimed delivery settles; eligible set is forced empty; delivery null and nextGeneration unchanged; B is not claimed/offered. Restart/promotion may reject earlier if thread is inactive. | M / no | recording | **missing** as an acceptance fixture | RPC can archive/delete around an in-flight delivery; exact ordering needs a labelled harness holding acceptance until the lifecycle mutation commits. No ordinary public operation creates a missing/invalid thread reference intentionally. |
| F16 / steer cannot reach restart acceptance | Completed provider turn; starting/nonrunning/stopped target; missing execution/session state; maintenance or goal text; unsupported steering/restart or rejected selection transition. | Depending on existing intake policy, preserve as queued/new follow-up, stop for a separate command, or reject before commit. No restart-time settlement/claim occurs on the rejected path. | C / no | recording | **covered by test only**, representative controls: T8 and policy tests; malformed execution/session variants not individually proven | MCP sends after turn completion/Stop or against a provider without restart; RPC can target a stale ID. Missing internal execution/session invariants and exact races need labelled harness variants. |
| F17 / duplicate offer and consumer suppression | New claim causes a thread-wide offer scan; an offered delivery already has a persisted message, is stale, or its cohort is stopped/disposed. Replay a command/request. | Consumer identity/current-generation checks prevent duplicate dispatch; stopped/disposed deliveries do not revive. Receipt replay does not repeat new settlement. A valid unaccepted persisted mailbox steer can be recovered with the same identity. | C interacting with Δ offer / no | recording | **covered by test only** for consumer/recovery identity: T9; the full multi-cohort scan interaction is not tested there | Repeat RPC commandId/clientRequestId, reconnect/restart isolated dev state, or label T9. For deterministic concurrent scans and two independent cohorts, use a labelled harness; record message/attempt counts, not offer count alone. |
| F18 / offer has no deliverable destination | A claim-triggered scan sees another row with missing/nonopen/empty delivery, archived/deleted thread, already-dispatched message, or no provider-thread destination. | Offer helper skips that row; valid other cohort reservations remain unchanged. The current accept may still have committed its task/generation changes. | C interacting with Δ offer / no | recording | **missing** as a combined scan fixture | Lifecycle/persisted-message cases can occur via RPC; missing destination/empty delivery need a labelled projection/event-sink harness. No need to corrupt an app DB for a capture. |
| F19 / wake owns a second cohort | W itself delegated C while carrying the incoming M1 ownership for P. Restart W, with B pending for P and C pending/running for W. | Accept settles P/A and reserves only P's eligible siblings; W's own cohort/task ownership survives its attempt restart. After-commit scan can offer multiple valid reservations without mixing task IDs or generations. | Δ interaction / no | recording | **missing** for restart; the existing Stop-both-cohorts test proves different behavior and is not credited | Extend the real two-child seed so W delegates C before steering, or use a labelled integration harness with distinct P/W cohorts. |

## Caller and branch ledger

- [dispatchSteerIntoRun](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L5070) has exactly two callers: direct [message dispatch](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L6272) and [queued-message promotion](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L10138). The active-steering branch returns before acceptance. Explicit restart, no native steering, attachments requiring restart, and selection changes that must apply immediately all converge on interrupt-restart, subject to capability validation. Selection handling branches into same-session restart, replacement session/resume, or provider handoff; those do not change which old message/cohort is accepted. Model changes that apply only on the next turn do not themselves force restart. The new settlement uses the pre-replacement input M1, not the incoming steer message. F01–F09/F16 cover these observable distinctions without repeating the whole provider-selection feature.
- [acceptDelegatedCompletionDelivery](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L1585) is called by restart dispatch and [dispatchNotificationAccepted](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L13413). Guard miss has no helper events; valid acceptance computes eligibility, allocates one message only for a nonempty set, marks pending IDs claimed before considering accepted claimed IDs delivered, skips other tasks, and emits P's cohort with null delivery or one next generation. Local childThreadId versus remoteChild, provider identity, result text, and sibling ordering do not affect this selection; app-owned origin, source run, delivery state, terminal status, wake policy, and P/thread lifecycle do. Allocation/message-count errors reject the enclosing command; event/effect transaction atomicity is existing infrastructure, not a new runtime fixture request.
- Successful `provider-turn.steer` effects call notification acceptance only for messages with delegated-completion metadata ([EffectWorker](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/EffectWorker.ts#L230)). An ordinary user steer does not acknowledge the wake by that route. Native steering that loses the completion race falls back to its existing follow-up/requeue path (T8), rather than pretending the message landed.
- The new [after-commit branch](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L14127) scans on notification acceptance unconditionally, or on direct dispatch/promotion only if committed events include a `subagent.updated` with claimed delivery. No pending siblings means only delivered updates and no new scan from a restart. A claim is not proof of a new run: [offer filtering](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L1501), consumer generation checks, native mailbox routing, queue holds, and active/starting turn state determine subsequent delivery. The scan is thread-wide, which motivates F17–F19.
- Normal terminal [finalization](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/Orchestrator.ts#L13268) is unchanged. Restart replaces the input so finalization now sees ordinary steering text and returns; settlement must already have happened. Cancellation without this restart uses its separate pending/disposal logic and is not evidence for the new path. No migration repairs previously stranded cohorts.

## Seeding and capture contract

Use a new timestamped run directory and fresh dev home/database for every run, with `T3CODE_DEV_SEED=0`. Drive the server over authenticated RPC/MCP; do not use the live install, browser automation, DB writes, or the downloaded scripts. The linked scripts are reference material only. Write a clean driver from inspected server contracts. Keep credentials out of transcripts/uploads.

Hold B and each wake with driver-controlled gates; release them after observing persisted state/event milestones, rather than inferring ordering from a fixed sleep. The driver can create a project, launch a parent, let it delegate A/B, send/restart/queue via `t3_thread_send`, and promote via `t3_queue`. A supported parent without active steering is necessary for deterministic F03/F04 successor queuing; Cursor and standard ACP/Grok paths share that capability class, while capability exceptions must be read from the actual session. If no such provider can run in the capture environment, label the substitute as a harness, use the real continuation consumer, and do not call it real-provider runtime proof.

At each milestone record UTC timestamp and event sequence; P and W run IDs/status/input IDs; W attempt IDs/reasons/statuses; P cohort disposition/nextGeneration/delivery identity/task IDs; A/B delivery states/observedByRunId; and queued/started/terminal wake run counts. For F03/F04, include **before steer**, **after restart commit**, **successor queued or mailbox route**, and **successor finished**. For a native mailbox route, count one accepted completion message without demanding an extra run. For F06 capture retained M1/attempt before terminal. For F07 compare the absence or preservation of cohort state.

Only the minimum rows require new captures now: **F03, F04, F06, F07**. F01 is already supplied. The supplement rows identify uncovered edge combinations; their presence is not a demand for unrelated new implementation or a full provider-by-provider capture campaign. Web, desktop, mobile, relay and scheduled/MCP entry points share this server state machine; no client render path or screenshot applies, and adapter capability classes are the meaningful provider dimension.

## Test references

- T1: [late sibling after restarted wake](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1410). Uses app-owned remote-task records, capability-controlled restart, real dispatch, effect-worker drain, and persisted-event waits. Asserts A delivered and B claimed/gen 2; does not start/finish B's successor.
- T2: [sibling already finished behind wake](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1476). Asserts A delivered, B claimed/gen 2 and last continuation offer identity; `ProviderContinuationRequests.take` is `Effect.never`.
- T3: [promoted message restart](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1671), ordinary input/model-switch case.
- T4: [steering/mailbox completion-race table](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L40), especially `mailbox=true,timing="after delivery"`, including duplicate acceptance and explicit later acknowledgement.
- T5: [image requiring restart despite native text steering](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1031).
- T6: [acceptance batches pending siblings](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts#L471), including old-message repeat.
- T7: [settled_only sibling after spawning run ends](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts#L564). Also [acceptance read/commit race](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/DelegatedCompletionDelivery.test.ts#L1058) preserves unrelated finalized fields through the notification path's existing cohort-only merge.
- T8: [late steer follow-up](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1079), [unsupported steering queues](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1146), [promotion after Stop](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/SteeringCompletion.integration.test.ts#L1720), and [dispatch capability policy](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/CommandPolicy.test.ts#L167).
- T9: [continuation identity/recovery tests](https://git.cafe/pingdotgg/t3code/blob/827879efad8208e630355089e9dcc4e47461d691/apps/server/src/orchestration-v2/ProviderContinuationService.test.ts#L110), including persisted-message suppression, stale generation, stopped/disposed cohorts, and request exactly-once cases. These test consumer behavior; they are not a complete multi-cohort orchestrator recording.

Coverage completed: full two-file diff, both steering callers, capability selection and native mailbox routing, acceptance helper guards/selection/update branches, after-commit trigger and offer/consumer suppression, terminal finalization, all seven linked evidence files, and relevant existing test bodies. No new runtime or tests executed; no implementation-bug verdict is claimed. The 45-minute limit was not exhausted.