# Issue 17418 proof audit, pass 2

Proof audit only; no fourth code review. Read-only worktree: `/home/ubuntu/wt/issue-17418`. No source edits, tests, new server, fixture writes, PR operations, or delegation. Final evidence includes the lead's later final-head recording. All findings below are evidence limitations, not reproduced implementation defects.

## Findings, in priority order

1. **Central acceptance remains unproven (D5+D6+V8).** There is no actual read-only/operate authorization RPC transcript correlated with hook counts, provenance-bearing provider-stream payloads and updated-client automatic refresh. The [runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/283f7af259547666/runtime.txt) reports `hookRuns=0` and `handoffs=0` even for operate positive controls. Thus health/read-only zero counts do not establish hook suppression, and 30-second configured delay returning in 510ms does not establish timeout handling. Ordinary successful app command execution cannot repair this separate probe fixture attachment failure.
2. **Final-head happy-path execution is now supported, with limits.** Independently inspected frames from the [53.437-second final recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b0676e8ea1bd143d/mcp-launch-client-3a95819c80-b7a1-46f0-8113-0d5b38fffbec-fwd-3a358988b2745838ca4-52d36dc4-9b42-43b7-9754-23379ca70ded-mp4.mp4): `/hand` offers one fixture row and description; pointer selection inserts `/handoffs`; the existing responses remain unchanged during insertion; separate send creates a new user command and a new `HANDOFFS_FIXTURE_OK` response. The long idle period is not a successful first locator interaction. Lead attests recording began 20:20:32 UTC on final head; video has 2560×1600 pixels, consistent with reported 1280×800 CSS/DPR2. This supports final execution, not a fresh snapshot, SDK initialization ordering, scope correctness, cache transition, keyboard selection on final head, or same-name skill collision. Exact insertion trailing whitespace is reported by the lead; pixels alone cannot establish the invisible space.
3. **Timeout, concurrency, preservation, compatibility and native integration remain unverified.** Committed focused tests exist for several modelled branches; source inspection is not their execution, and SDK mocks do not prove real installed initialization order. No runtime authorization/in-flight/late-publication, stale+fresh preservation, deadline/abort/recovery, old-client decoder, Electron, iOS, Android, or remote/tunnel evidence closes those rows. Electron is optional in the corrected minimum; native omissions remain explicit coverage gaps.
4. **Pixel-diff arithmetic is valid, comparison control is weak.** Recomputed both published diff images from the top 800 pixels of the two 1050-pixel-wide halves of the published pair: exact equality for `min(abs(RGB_before-RGB_after)*4,255)` and for each channel `abs(delta)>24 ? 255 : 0`. Threshold zero retains every nonzero channel difference; 293,578/840,000 pixels (~34.95%) differ. No masks were applied. Changed chat history, checkpoint cards, sidebar/surface-panel geometry and timing dominate the diff, so it is diagnostic evidence rather than a controlled pixel-regression pass. The narrow light/dark images visibly obscure the composer with the surface panel; do not mark them passing or treat responsive Chromium as native evidence.
5. **Provenance and matrix correction must remain explicit.** Disk HEAD is [a21e53d575](https://git.cafe/pingdotgg/t3code/commit/a21e53d575), clean, full SHA `a21e53d57584e2aa88105dcb5abdfaf5008ee098`; merge parents are [7bc11a5927](https://git.cafe/pingdotgg/t3code/commit/7bc11a5927) and supplied base [22840ab943](https://git.cafe/pingdotgg/t3code/commit/22840ab943). Base→head has 12 files, +428/−39 and no web/mobile/desktop source diff. The local `main` ref and its merge base with head are [fa68107b8b](https://git.cafe/pingdotgg/t3code/commit/fa68107b8b318b0f0d818bd410100a3a5e9c2c70), not the supplied base; no fetch was performed. Original baseline recording uses the [e54e71d725](https://git.cafe/pingdotgg/t3code/commit/e54e71d725) ClaudeProvider runtime source swapped into an older running implementation, not a complete immutable base build. Interim video/stills cannot be relabelled final. Also, the earlier matrix's “full publications omit hooksSkipped” wording is outdated: final Claude snapshot explicitly carries `hooksSkipped:false`; accepting false is the applicable provenance expectation. It is not itself a new defect finding.

## Evidence checked

- [Evidence manifest r2](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b30c696b29330316/issue-17418-evidence-r2.md) and [corrected proof matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bc258279a56e4569/issue-17418-proof-audit-pass1-delta.md). Applied corrected capture minimum: one real desktop web configuration, optional Electron, explicit native omissions. Four full width/theme runs are not required by that corrected minimum.
- [Baseline recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cba1d1ca00bef021/before-e54e71d725-cropped.mp4), duration 5.747s including container timing: missing fixture menu row, full-command send, new marker response. [Interim recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fc5a99e039310c24/after-03bd4fbf94-cropped.mp4), duration 90s: sampled interaction/execution/menu frames and reconnect ending; supports interim behavior only.
- [Published before/after](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bf2d8a767adcb8e5/before-after-1440-light.png), [threshold-zero diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4d2a671b5d5b84ca/diff-threshold-0-amplified-4x.png), [threshold-24 diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3cb0d444c3b0f45d/diff-threshold-24.png), both desktop stills and both obscured narrow stills downloaded and inspected.
- Final settled menu is readable, selected row and description visible, no clipping at the reported desktop configuration:

![Final head, desktop light: /hand offers /handoffs with fixture description](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c75a1da643bb1387/browser-screenshot-localhost-mvjzjv9r-7577eb32.png)

## Independent reconstruction / FRICTION / cleanup

Opened only my own preview tab `tab_p_bf668abb-8096-43ae-a6fb-6bbafa6583de` against existing port 7753 and the documented fixture thread. It reached `/pair`; console error: `HTTP Authentication failed; no valid credentials available`. No reusable dev token was present in the existing backend process environment. Did not consume another tab's link, mint credentials, start/restart a server, or edit fixture/source. Reconstruction is BLOCKED by absent pairing in this tab, not PASS. No more browser attempts after the lead's stop instruction.

Read the committed `scripts/seed-claude-handoffs-fixture.ts` and existing sandbox fixture: register `handoffs` from session.start, description `Issue 17418 fixture command`, marker `HANDOFFS_FIXTURE_OK`. Did not rerun the writer against a running server. This confirms reproducible fixture source, not fresh runtime discovery.

Evidence downloaded and frame/diff working files are outside the worktree under `/tmp/17418-audit`; report is `/tmp/issue-17418-proof-audit-pass2.md`. No owned server/probe/recording process remains. Worktree status was clean at audit checks. Leave shared lead state and processes untouched. Closed my audit preview tab at completion. Final worktree status remains clean at the requested SHA. No PR was linked/watched/modified by this child, per explicit instruction.

Tool friction: web open could not access artifact URLs; curl succeeded. Python urllib received HTTP 403; curl succeeded. Sampling exactly at an interim video's EOF produced no frame; omitted EOF and inspected preceding frames. None was treated as product failure.

## Row status (all rows, corrected minimum)

- V1 — PARTIAL overall; final-head discovery/description, pointer insertion and separate execution PASS for one desktop-light web flow. Base defect supported with runtime-source-swap provenance. Fresh discovery, final keyboard selection and final dismiss/reopen not established.
- V2 — UNVERIFIED: no correlated fresh/in-flight/warm/stale hook/RPC count transitions; retyping alone is insufficient.
- V3 — PARTIAL: interim prefix/position/compact coverage reported/visible in evidence; no provider/cwd switching or collision/hide-skill execution proof; no final integrated coverage of all branches.
- V4 — PASS for corrected minimum's one normal desktop-light settled menu on final head. Interim desktop dark exists. Narrow images unusable; final dark/narrow unverified and not required as four-run cross-product.
- V5 — UNVERIFIED: reconnect is not controlled hook timeout/recovery; no correlated editable fallback/recovery recording.
- V6 — UNVERIFIED, OPTIONAL regression coverage: Electron shell not run.
- V7 — UNVERIFIED: iOS and Android, native themes, remote/tunnel path not run.
- V8 — UNVERIFIED: no read-only complete publication → automatic operate RPC → full stream/menu execution correlation within TTL; ordinary V1 does not substitute.
- D1 — UNVERIFIED as full row: zero-hook runtime negative case has failed positive control; focused health/usage/MCP/no-tools/abort executions absent from supplied evidence.
- D2 — PARTIAL only through successful app fixture use; separate actual workspace probe positive control failed. No real delayed registration/init-barrier, usage separation, effective instance environment or cleanup transcript.
- D3 — UNVERIFIED: disabled/no-cwd/error branches not executed as proof; corrected hook-enabled settled fallback expectation applies.
- D4 — PARTIAL: one handoffs menu row and preserved description; no focused parser/dedupe/collision/hide-skill test execution proof.
- D5 — UNVERIFIED: no actual scope-bearing read/operate RPC/default-context transcript; service booleans do not prove authorization.
- D6 — UNVERIFIED: no actual payload/provenance/count/checkedAt cache sequence. Committed registry test source is not runtime proof.
- D7 — UNVERIFIED: no executed complete precedence matrix/barriers or RPC overlap/late-publication transcript. Partial committed test source does not close this.
- D8 — UNVERIFIED: no actual stale/fresh read-only full-inventory preservation and other-instance invalidation transcript; stale modelled test exists but no execution evidence supplied here.
- D9 — UNVERIFIED: delayed hook did not run; no deadline/abort/count/no-storm/recovery proof. Mocked TestClock test source is not real hook evidence.
- D10 — UNVERIFIED: versions reported (Linux, Claude 2.1.303, SDK 0.3.276), but no functioning delayed-hook positive control/real init barrier and health separation transcript.
- D11 — UNVERIFIED: no actual previous-client decoder result, absent/true/false round-trip execution or payload transcript. Shared helper test source alone does not prove compatibility; final full provenance is false rather than omitted.

VERDICT INSUFFICIENT — missing/partial required rows: V1 (fresh/final keyboard/reopen), V2, V3, V5, V7, V8, D1–D11. V6 is unverified optional coverage. Central blockers remain D5+D6+V8, plus real timeout/initialization proof D9+D10. Final-head V1 execution and minimal V4 are now supported; they do not close the remaining rows.