# PASS2 proof audit — issue 23661

## Findings first

1. **Required lifecycle proof is incomplete.** C4 has no final CSS390 light timeout; C5 has neither editing/clear/resubmit nor overlapping cross-route sends/stale completion; C6 has no original-draft restoration/manual recovery. These are explicit minimum-pack requirements, not waived by two code-review MERGE verdicts. C8 approval and question cancellation are also unverified: neither was seeded, and no evidence establishes that safe seeding is impossible. Keep both gaps open.
2. **Pixel isolation is insufficient.** The delivered pack contains one threshold diff, no zero-delta amplified diff, and no diffs for C1/C2. I generated and inspected both diff forms for all three available pairs. They contain substantial non-AA content changes across timeline, historical git summaries, sidebar and lifecycle state. These pairs support behavior comparisons, but cannot establish unchanged styling or assign all pixel changes to this fix. No identical DB snapshot was used. The doubled edges in these diffs are subtraction of different content/positions, not evidence of a ghost in the live app.
3. **Input and provenance have limits.** C1's report says repeated Enter; the video shows retained text and eventual single queued dispatch, but the driver logs RPC traffic, not keydown events. Repeated identical Enter presses are visually silent, so the repetition count is operator-attested rather than independently reconstructible. The supplied stale-module hashes document the rejected run, not a fresh normal-URL hash after restart. Current checkout, overlays, restart time and observed deadline behavior support final provenance, but no per-recording source/bundle attestation exists. Do not upgrade this to byte-for-byte served-module verification.
4. **Cross-surface/transport coverage remains bounded.** Native iOS/Android, Electron renderer, relay/tunnel, other providers, attachment bookkeeping, failure/blocker lifecycle, and receipt/late-commit behavior are not established by this capture pack. Outgoing suppression never forwards FIRST; it proves a client no-answer path, not server receipt followed by a missing answer.

## Scope and exact revision

Read-only audit of [#23661](https://git.cafe/pingdotgg/t3code/issues/23661), no PR. HEAD is [887f485adf](https://git.cafe/pingdotgg/t3code/commit/887f485adfe71413ecc10fd59e74255b878b7c08), branch `fix/issue-23661`, worktree `/home/ubuntu/wt/issue-23661`, clean before and after audit. Base [fef851bee0](https://git.cafe/pingdotgg/t3code/commit/fef851bee0). No edits in worktree, tests, server actions, browser mutation, commit switches, pushes, comments or merges. Scratch derivations and this upload are outside worktree.

Read local handoff, matrix, protocol, driver, all nine valid per-run JSON files, summary ledger, stale-module proof, restart record, diff script/metrics, and production source diff. Matrix was written at [cfb3ad9a0f](https://git.cafe/pingdotgg/t3code/commit/cfb3ad9a0f654bbd400f9b4c09a370cf4ec18a2c); final adds per-thread running-send generation tracking and settles exceptions before rethrow. Therefore matrix text saying exceptions bypass settlement is obsolete at final. The A4 integration requirement remains applicable and missing.

Inspected every valid recording using independently extracted contact sheets: start, 2/5/9/11/13/16 seconds and endpoint; long recordings additionally 30/60/90/118/120/122/125 seconds. Opened every valid supplied PNG in an image inventory, inspected original-scale overlay crops and final timeout error/toast crops, and opened all derived pair/diff inspection sheets. This is sampled visual review, not exhaustive frame-by-frame playback. INVALID stale-module footage was neither opened nor used as positive proof.

## Row decisions

| Row | Decision | Artifact assessment |
|---|---|---|
| C1 / A1, 1440 light | Behavioral outcome supported | Base/final A1 recordings show SECOND retained while FIRST waits. Final request23 success at 11.474s, SECOND request24 at 11.732s, once, `queue_after_active`; both replies appear at endpoint. Base only one message dispatch. Final 31.061s, base 22.079s. |
| C1 / A2 repeated Enter | Partial | Single SECOND dispatch supported; exact repeated-key interaction is report-attested, absent from driver event ledger. |
| C2 / A1, 390 dark | Behavioral outcome supported | Base 25.178s/final34.371s. Final FIRST request32 success10.822s, SECOND request33 at11.218s once as queue_after_active. Composer and send controls remain visible at CSS390x844. Both replies appear. |
| C3 / A5, 1440 dark | Behavioral outcome supported | Base132.501s still pending beyond120s; final140.094s shows explicit error and unsent toast around122s, SECOND retained and send control released. One suppressed request, no forward or additional message request. |
| C4 / A5, 390 light | INSUFFICIENT | Valid134.892s base only. Final typing failed before a request was intercepted; no usable final artifact. |
| C5 / A3 edit/clear/resubmit | INSUFFICIENT | No recordings of the independent reset branches or pre-dispatch upload/dock editing. |
| C5 / A4 navigation/stale completion | INSUFFICIENT | No overlapping A/B sends; final per-thread-generation change has no integrated capture. |
| C6 / A6 restore/manual recovery | INSUFFICIENT | No unanswered FIRST with empty composer, restored snapshot and controlled manual resend. SECOND-preservation does not substitute. |
| C7 / P1 promotion | Final behavior supported; baseline unverified |33.085s final-only: launch47 forwarded once at11.292s, answer11.444s, SECOND dispatch51 at12.414s once as queue_after_active. Draft promotes and both replies appear. No base improvement claim. |
| C7 / P1 launch timeout | Final behavior supported |146.946s final-only: suppressed launch60 at1.273s, error+toast around122s, SECOND remains, no message dispatch/launch retry. Not post-ack worktree-preparation timeout proof. |
| C8 / A12 approval | INSUFFICIENT | No real pending approval UI/response race capture; no safe-seed impossibility demonstrated. |
| C8 / A12 question | INSUFFICIENT | No real pending question UI/response race capture; no safe-seed impossibility demonstrated. |
| A7 comparator/bookkeeping | UNVERIFIED | No attachment metadata, model/context mutation capture. Helper coverage not audited as executed proof. |
| A8 modes/other callers | Partial | Ordinary auto-to-queue supported in C1/C2/P1. Explicit modes, resume, multi-model, direct annotation, plan and other callers not verified here. |
| A9 rejection/blockers | UNVERIFIED | Timeout failure only; rejection/disconnect/recovery/setup unblock lifecycle absent. |
| A10 late commit/transport | UNVERIFIED | Suppression proves no-answer only. No received-but-unanswered/late commit test result inspected or rerun. |
| M1 native iOS/Android | UNVERIFIED | Responsive Chromium390 is web, not native. Neither native client tested. |
| E1 Electron | UNVERIFIED | Shared renderer source only; no Electron recording. |
| R1 connections/providers | Partial local web only | One local Chromium/Codex environment. Remote/relay/tunnel and other providers unverified. |

## Timing, viewport and transport checks

All nine videos have expected raster dimensions: desktop2880x1800, responsive780x1688. Overlays show CSS1440x900 or390x844, intended base/final short SHA, scenario/theme and advancing elapsed time. Theme appearance matches labels. Final JSON additionally measures CSS dimensions/DPR2; base A1 desktop JSON lacks explicit measurement but overlay and raster agree. The1280x800 desktop still is a downscaled snapshot, not a wrong-CSS-viewport recording. No clipped composer/control or stale overlay found in sampled valid frames; overlays cover a thin header strip only. Long runs' new red error/toast is readable in full-scale crops.

Recomputed Pong counts/max gaps from raw JSON: base A1 desktop5/5064ms; base A1 responsive6/5005ms; base A5 desktop27/5018ms; base A5 responsive27/5010ms; final A1 desktop7/5012ms; final A1 responsive7/5001ms; final A5 desktop28/5013ms; final launch timeout29/5010ms; final promotion6/5002ms. No logged close events in any valid run. Delay forward occurs once, exactly10s after interception. Drop cases have zero forwards. Interrupt/Failure frames for other stream IDs are present in successful scenarios; these are not socket closes or evidence that FIRST failed.

Final timeout request UTC12:00:22.232; launch timeout12:04:47.964. The overlay starts at arm, not request, so ~121.8/121.9s overlays are consistent with a120s request deadline after ~1.3s setup. Final restart record says PID2063612 began11:59:49, before all valid final runs. Handoff attests stable PID; supplied PID file is a point observation, not an independent uptime series. Pong continuity plus uninterrupted sampled screen state supplies the direct in-run evidence. Base response IDs were not recorded, limiting exact acknowledgment correlation; final response IDs and projection ordering are logged.

Driver narrowly matches the next selected dispatch/launch, disarms immediately, preserves control traffic, delays original frame once, or suppresses it entirely. No clock mock/reconnect/replay behavior is in the driver. No invalid restart/stale-module timeout was substituted.

## Pixel checks and what else changed

Delivered threshold20 metric122425/5184000 (2.3616%) is reproducible in concept but uses **luminance of RGB difference**, not maximum channel. It can omit strongly changed single-channel pixels. Audit derivations use max RGB channel: C1 nonzero1196896, >20=76712/5184000 (1.480%); C2 nonzero636915, >20=66018/1316640 (5.014%); C3 nonzero1561254, >20=136370/5184000 (2.631%). Any nonzero delta is amplified8x in a separate RGB image; threshold masks have no AA exemption. These are descriptive counts, not pass/fail tolerances or proof that residuals are AA.

C1 supplied stills are ~11.6s base versus16.1s final; C2 ~20.2s versus16.0s. They intentionally show different lifecycle states. C3 ~124.9s versus121.8s shows pending versus timed-out. Large changes include expected queued/cleared composer, new error/toast and genuine extra historical messages/diff summaries. This is an uncomparable background for strict pixel regression claims. No capture rebuild attempted: one rebuilt final capture cannot recreate the missing identical baseline snapshot or close the remaining lifecycle rows.

Written scope agrees with source: five changed files, production changes only in web hook/logic and shared runtime; no JSX/CSS/native/adapter/server/contract/shell changes. Model/attachment bookkeeping is ignored by content comparison, context arrays compare by identity, auto follow-up becomes queue, generation+route govern settlement, pending requests cancel at drain, and both message branches plus launch receive the answer deadline. No retry is introduced. Historical git-summary differences are synthetic thread history/checkpoint output, not evidence that CSS or unrelated production files changed. Public driver/protocol remain external artifacts, not committed files.

[Original handoff and published captures](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4e98eb7fb49fe92f/report.md). [PASS1 matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f75f9a7dc7f9919f/matrix.md). [PASS2 contact sheets, overlay/error crops, paired zero-amplified and threshold diffs, metrics](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a08800e9188a943f/inspection-artifacts.zip).

## FRICTION

No fresh browser/server/test activity was needed. Inherited stale-module run remains excluded; post-restart behavior supports the deadline but fresh served-module hashes are absent. Identical Enter presses leave no visible event evidence. Shared synthetic history prevents isolated pixel attribution. Missing rows remain missing; code approval and reported tests were not substituted. No PR exists to register. Audit artifacts were created only under `/tmp/issue-23661-pass2`; repository remains clean at exact final HEAD.

VERDICT: INSUFFICIENT C4, C5(A3/A4), C6, C8(approval/question), A7-A10(uncovered branches), M1, E1, R1(remote/relay/tunnel/providers), C1/A2(input provenance), C1-C3(pixel isolation)