# Issue 17392 — PASS2 read-only proof audit

CORE PROOF VALID. No core-blocking retake found. Full requested matrix remains INSUFFICIENT. No source edit, push, forge write, merge, server launch or server stop. Existing Electron CDP19392 alone was used for the reproduction. Synthetic report/derived evidence written outside the worktree. PR not open at assignment; no forge state queried.

Audited [PASS1 matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a1941017fd2dfcdd/issue-17392-pass1-final-matrix.md) and [corrected delivered index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/783fa7153c8320a5/issue-17392-final-index.md). Downloaded every linked still/diff and both recordings. The 40 uploaded PNGs match the local accepted artifacts byte for byte. Opened all 16 raw captures and all 16 raw diffs visually, not merely their existence or sheets. Independently recomputed every Diff0 and DiffT exactly, including reported threshold counts. Both MP4s decoded successfully and were visually inspected as timestamped one-second frame sequences across their complete durations (38.000s and 62.333s); this is sampled visual inspection, not real-time playback or proof of subsecond transitions.

## Revision and environment checks

Worktree HEAD is [c43ee8d22a](https://git.cafe/pingdotgg/t3code/commit/c43ee8d22a3b07fb4267e83b0ecfb36c99039da1). Source review base is [d53873b6a4](https://git.cafe/pingdotgg/t3code/commit/d53873b6a4799e87afd63c8d288ef0089f5a3748). Actual before bundle is [a46f80ee28](https://git.cafe/pingdotgg/t3code/commit/a46f80ee28d9b498bb8b407c8b60bd4e93bbe2e3), not that review base. Checked relevant extracted source-map contents against Git: ChatMarkdown, shared markdownImages, mediaSource and shared state/assets exactly match their respective before/final revisions. The live renderer loads t3code-dev://app/assets/index-C4Yb62Br.js; final source maps contain the hostOnly guard and propagation. This validates relevant bundled source, not a claim that the complete executable is cryptographically reproduced from a clean tree.

Retained processes match supplied PIDs: Electron960624 (44.9.3 install path), backend961181, Xvfb960619, static14622 PID962591, HTTP14623 PID962592, remote14620 PID944389. No process stopped. Live renderer is DPR1. Local report.png exists, remote docs/report.png is missing, remote present.png exists. Existing endpoint trace contains two hostOnly:true requests to14620 and no14621 requests in its observed window. Primary's separate endpoint/control checks remain primary-reported evidence; this audit did not repeat their action script.

The eight-file source delta against review base is five production files and three test files, as PASS1 describes. Source inspection found no additional core defect. Intervening actual-before→review-base includes 16 files, including web composer/model/open-in/accessibility and mobile navigation/feed work. Captures also differ in UI state. Therefore full-frame diffs cannot be attributed solely to this patch.

## Row accounting

| Row | Audit result | Exact limit |
|---|---|---|
|1 Remote missing relative, user + assistant, Q|PASS core visual behavior|All four pairs show RED before → unavailable after in both roles. Wide workspace-card differences and narrow media flow changes are visible. Finite endpoint trace supports remote-only requests, not universal absence of retry.|
|2 Remote present relative|PARTIAL / authored sizing UNVERIFIED|Control sheets retain GREEN standalone/inline and flow. Recording literally displays malformed sizing syntax; it cannot establish authored dimensions.|
|3 Absolute POSIX + file URL|PASS captured controls|Both remain RED in wide/light and narrow/dark sheets; endpoint attribution additionally checked by primary. No Windows runtime claim.|
|4 Direct + blocked/root grammar|PASS within matrix scope|Cyan HTTP and unavailable blocked source remain in sheets. No-thread/root remainder is source/test proof, not runtime. Base recording's direct source is unavailable and is not the cyan sheet fixture; do not generalize direct success from that recording.|
|5 Nested/outside document|PASS captured paths and visible behavior|Nested GREEN and parent BLUE stay in the same positions. Extra outside pair shows RED → unavailable and BLUE retained but pushed down by placeholder height. Extra pair does not substitute for row6.|
|6 Plain web + local-primary|UNVERIFIED required web pair|No valid plain-web before/after bootstrap/capture. Local-primary source-only is allowed by matrix, but does not fill the missing web pair.|
|7 Gallery/actions|PARTIAL / action results UNVERIFIED|Base GREEN open/next to absolute RED/close visible; final GREEN gallery briefly opens and then reloads. No matched script, clipboard outcome, Open File result or resolved-target hyperlink comparison.|
|8 Video|UNVERIFIED|No relative embedded missing/present playback/pause or absolute/fileURL/resolved override comparison. Image gallery recording is not video evidence.|
|9 Lifecycle|PARTIAL / matched baseline UNVERIFIED|Final shows unavailable → reload → GREEN → reload → unavailable, with no RED in sampled sequence. No valid matched base lifecycle. No automatic file refresh/reconnect claim.|
|10 Contract/platform/cache|PASS source/test scope, runtime limits retained|Focused test log reports3files/22tests, not rerun here. Read final diff: relative provenance, hostOnly guard, same joined paths and explicit override behavior align with PASS1. The new asset test exercises not-found plus primed absolute/local cache separation, not every failure tag or native platform.|

## Visual details and narration corrections

Core narrow diffs are concentrated on media and consequent text/bubble flow; neither core narrow capture shows local RED after. Wide row1 removes the Workspace card; controls change sidebar256→208, elapsed labels, focus and scroll overlay. Narrow controls retain all sentinel colors but differ in scrollbar/copy/timestamp/scroll overlay. Nested differences include background chat placement and file controls, not GREEN/BLUE placement. Outside pair includes composer/layout changes. All these differences are disclosed and none establishes a patch regression by itself. Strict frozen-clock parity was not achieved. The zero-threshold diffs include low-level background differences; thresholded diffs are not proof of exact pixel parity.

Recording notes need timestamp correction, not retake for the core claim. Base GREEN gallery appears around3–11s, absolute RED around12–13s, closes around14s, second RED gallery around28–36s, closes by37s. Final reload begins around11s, GREEN appears around16s, gallery is visible around38–39s, second reload around40s, and unavailable is visible around45s through the end. Existing notes' final gallery28–31s/removal32s/unavailable42s are materially early. Approximate action timing is sufficient once corrected; do not claim the action outcome occurred at the old timestamps. No narration proves the external filesystem mutation itself; it is supported by the driver/account plus observed reload/result.

## Independent reproduction

Downloaded clean-drivers-fixtures.zip equals the supplied local ZIP. Extracted only to /tmp/issue-17392-pass2/drivers. Used its cdp.py and capture.py, adapted outside the repository to select only390/dark and write a new output name. Navigated the existing renderer to the supplied core remote-thread route; reused existing synthetic fixture state, without changing source/seeds/database. Matched390×940/DPR1, dark/reduced motion, fonts ready and native window capture. Two captures500ms apart had AE0. Original fixture drivers are helpers, not a complete clean-environment bootstrap; the ZIP lacks sentinel binary generation/auth/environment provisioning. Reproduction demonstrated from retained state, not from a blank machine.

Against delivered final r1-390-dark: **15/366600 pixels differ; maximum channel delta2/255; zero pixels exceed8/255**. Both roles remain unavailable. This is strong reproduction of the affected capture and no core retake blocker. The difference is too small to change the claim; it is not exact byte/pixel identity.

![Rebuilt final core capture, 390×940 dark](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/204894a45a149309/rebuild-r1-390-dark.png)

[Reproduction absolute diff amplified4×](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ca5819992194e638/rebuild-diff.png)

## Smallest honest PR claim

“In Electron, relative Markdown image embeds in a remote thread no longer display a same-path local image when the owning host cannot resolve it. Synthetic user/assistant captures show local RED before and unavailable after at1440/390 in light/dark; present remote images and explicit absolute/file-URL controls retain their captured behavior. Final reload evidence returns missing→present→missing correctly. Evidence is PARTIAL: authored sizing, plain-web comparison, several action outcomes, video playback/overrides and matched baseline lifecycle remain unverified.”

Do not claim complete matrix, pixel-only patch isolation, every relative hyperlink being host-only, matched lifecycle/action regression coverage, automatic refresh, reconnect, native mobile or Windows runtime validation. No core retake is required for that narrow claim. Correct recording timestamps before using narrated steps as evidence.

## FRICTION

Web opener could not access uploaded Markdown; curl retrieved it. Python urllib got403; curl downloaded all artifacts successfully. Initial source-map scan matched the bootstrap map and then a web assets filename collision; corrected scan verified the shared production sources exactly. No source/build discrepancy remained. Existing runtime made the requested capture reproducible, but archive alone is not a full fixture installer. Browser profile/servers were not created or stopped. Runtime is left on the reproduced390-dark core thread for lead cleanup.

## VERDICT: INSUFFICIENT

Full matrix is missing required row6, row8 and portions of rows2,7,9. **CORE PROOF VALID; no material core-proof issue and no core-blocking retake identified.** This verdict concerns evidence completeness, not a confirmed code defect or merge authorization.