# Fresh Android proof audit, final supplementary round

Findings first: M4 remains INSUFFICIENT. Paired successful host-resource fullscreen open/play/pause/close/reopen and actual temporary URI-null retained-player proof are absent. The rejected resource sequence never visibly reopened; brief transport removal did not establish URI loss. No implementation defect is established by these evidence gaps. Required matrix controls cannot be waived.

Reviewed takeover [#21088](https://git.cafe/pingdotgg/t3code/pulls/21088), after [0b086662f3](https://github.com/pingdotgg/t3code/commit/0b086662f350c79b19295e6ceec12169a6422bdf), base [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). Original submission is provenance, not the baseline. Read all seven changed files at the specified worktree; web execution intentionally not repeated. [Original matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f9332811fb7d41b7/matrix.md), [original Android evidence](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0565bbefa861b2e9/index.md).

| Row | Status | Evidence and limits |
|---|---|---|
| M1 | PASS, independently reconstructed | Clean paired denied inline stills, complete existing pairing explanation after, disabled native button with name+reason instead of misleading Play. Image explanation unchanged. |
| M2 | PASS | Paired native fullscreen stills and recordings show actual resource link open, unavailable tap, close, reopen, close. Save/share disabled without URI. |
| M3 | PASS | Original generic inline/empty-label plus new paired generic fullscreen pass. Paired continuous offline flows show generic fullscreen, then actual failed-connection thread banner, then backend recovery. No pairing explanation leaks into generic failures. |
| M4 | INSUFFICIENT | Paired direct-ready play/pause/resume pass. Paired unsent local-draft loading→decoded, close and reopen pass. Successful host-resource fullscreen has after-only playback/pause; no accepted paired resource-reopen. Actual-null retained state remains unproved. |
| M5 | SOURCE-COLLAPSED | Accepted scoped collapse upheld. PR generic placeholder passes unavailable without detail; compact preview uses shared modal. Workspace null URI remains loading because caller supplies no unavailable. No new file/PR navigation claim. |
| I1/I2 | UNVERIFIED, permitted exception | iOS simulator not available on Linux VMs. Source checks missing-file-access after disconnected precedence, but Android does not prove native iOS alert/dismissal. |
| W1–W7 | OUTSIDE THIS PASS | Separate final web verdict preserved. |

Independent original pixel counts agree: M1 17,529/16,778; M2 17,499/16,746; M3 inline 16,043/13,948 changed pixels at amplitude>0/>20. All six original 500ms stability pairs are exactly0 at both thresholds. New generic and disconnected fullscreen B/A are each2,689/2,152; all four500ms stability pairs exactly0. Its difference is confined to small generic text raster/position change, with no permission wording. Opened all accepted paired originals/stability stills, amplified differences and threshold20 masks. No blank, spinner, clipping or stale overlay accepted as a still.

Independently decoded recordings into one-second frames and opened every sheet; examined the rejected resource close/reopen region at5fps. Original M2 interactions pass. Rejected after-direct narration reversed pause/resume: it advanced during Pause and froze during Resume. New before/after-direct-ready recordings13.400/13.354833s replace that candidate: fixed timecode/play glyph holds, then motion/pause glyph resumes. Local-ready51.029067/41.1341s proves loading, decoded playback, close to unsent draft, reopen and second playback. Final captioned local recordings additionally contain the second close back to unsent draft (before43s, after41s); original raw after tail ends earlier. Final baseline local recording excludes incidental Detached HEAD sheet. Rejected before-local cold-splash recording is excluded. Driver timestamps are not substituted for observed actions.

[Final supplementary index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5ba9b940feb59b58/index.md) inspected with all six final captioned recordings decoded into one-second frames and every sheet opened, in addition to raw recordings. Captions describe the observed sequences; action/transition boundaries have small timing overlap, and the direct clip naturally reaches its six-second endpoint after resume. No endpoint freeze is counted as a new pause. Final after-offline raw70.435689s shows fullscreen through36s, actual failed-connection banner37–63s, recovery64s onward. This proves disconnected cause, not URI-null retention.

Independent M1 reconstruction completed after explicit device handoff. Opened the actual Host file access thread under the denied grant, waited for complete content, captured two frames500ms apart and native accessibility XML. Fullframe against accepted m1-after.png: **0 pixels above0 and0 above20; no crop, translation or alignment applied**. Independent stability also0/0. This fresh result differs from the earlier auditor's one-pixel-shift reconstruction; it does not revise that earlier measurement. Native disabled node says “Denied video. Video unavailable. This connection cannot read host files. Pair again with a new link to view it.” Device released promptly at approximately01:08; no later device commands.

![Independent after — complete denied-video and unchanged image explanation](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8329c071ce9f8931/m1-independent-after.png)

[Raw pixel counts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ae26679b32c4313b/m1-independent-pixels.json), [amplified raw difference](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7e7b9c0616622353/m1-independent-diff.png), [threshold20 mask](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c1c51d0ecd57d858/m1-independent-threshold20.png). All were opened; black difference images reflect exact matches, not blank app captures.

The actual app is com.t3tools.t3code.dev on Android16/API36 Pixel7,1080×2400, density420, fontscale1, light, clock12:00. Same compatible native APK SHA25667361553898afe31f82af90ac53ef88f2df5f0a2557bff904b067285eb07ba0c independently matches local build. Both original and supplementary four-file baseline/after SHA256 provenance matches exact git blobs. At00:59:48 sources were exact requested HEAD and git clean. After device release the lead merged main, producing [67aef9c072](https://github.com/pingdotgg/t3code/commit/67aef9c072b104207461ea89f6415d7ab9944c5a). Independently verified all four mobile file hashes still match captured replacement provenance; current git status clean. This audit covers the specified replacement patch, not a new full review of merged main. No provider, contract, server, persistence, dependency or desktop IPC changes. Loaded-player implementation is unchanged; proof gaps above remain required controls despite that fact.

FRICTION tool: audit scratch script named inspect.py shadowed Python's inspect module; renamed and reran successfully. Initial guessed component paths were corrected with rg --files. No finding depends on those failed commands.
FRICTION infra: cold loading and native timing caused rejected blank/splash and mismatched scripted sequences. Only observed accepted footage counted.
FRICTION brief: device ownership respected until explicit release; no device commands before handoff. Exact restoration checked before reconstruction.
FRICTION infra: iOS unavailable on Linux; explicit permitted exception retained.
FRICTION policy: read-only production audit; no source edits, pushes, comments, watch, merge, browser, live userdata or shared-service shutdown. External audit artifacts only; no credentials published.

VERDICT: INSUFFICIENT M4 paired host-resource fullscreen/reopen and actual URI-null retained-player control