# Evidence-only independent proof audit, pass 1 — final diff

PR [#23519](https://git.cafe/pingdotgg/t3code/pulls/23519), head [cc2ac609ee](https://git.cafe/pingdotgg/t3code/commit/cc2ac609ee308e128c9e3065b4ac95500d157d8c). Read-only checkout `/home/ubuntu/wt/pr-23519`; all new working artifacts `/tmp/pr23519-audit`. No capture, server, browser, test suite, implementation, commit, comment, body edit, watch or polling. Committed generators were executed with `python3 -B`, writing only below the scratch directory. This is evidence sufficiency, not another code review.

## Authority and scope

Read current PR description through `cafe pr view 23519`; observed head matches requested head. Local `main` is stale at [07d38b8d17](https://git.cafe/pingdotgg/t3code/commit/07d38b8d17167c8d17fba1184dbe13a307fada74). Correct main comparison is merge-base HEAD/origin/main = PR observed base [43879d9702](https://git.cafe/pingdotgg/t3code/commit/43879d970204eb28092d098deb4c842a22a9ab75). No fetch or checkout mutation was needed. Full diff saved as `full.diff`: 12 paths, 1102 additions/17 deletions.

Surface follows changed product paths, **web only**: `apps/web/src/components/{AppSidebarLayout.tsx,Sidebar.tsx,LegacySidebar.tsx,sidebar/routeReveal.ts}`; regression tests `Sidebar.logic.test.ts`. `knip.jsonc` and six files under `scripts/fixtures/issue-16534/` do not introduce another product surface. Responsive 390 is web. No native-client, Electron-shell, provider-adapter, relay or tunnel matrix is introduced by this diff.

Inputs: [previous matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1984cc8ca701ed75/issue-16534-proof-matrix-final.md), [previous independent audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bf80b9c94663cb39/issue-16534-proof-pass2-final.md), [capture index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/80148a9fc10431ad/capture-index-recovered.md). Downloaded and read as documentary evidence. This pass did not independently decode/reinspect the old images/videos; visual findings below are attributed to the prior independent audit, not newly claimed pixel inspection.

The prior 0/48 complete-set verdict is accurate at set granularity, **not a request to redo all captured chapters**. Keep sufficient chapters and fill gaps. A later commit does not invalidate an unchanged successful branch.

## Exact source reconciliation

- Compared old capture baseline [a12d6ed942](https://git.cafe/pingdotgg/t3code/commit/a12d6ed9428d8e64d76ca86d178abbf564b57cee) to current merge-base: AppSidebarLayout, both sidebars and Sidebar.logic are byte-identical. Old baseline product behavior remains applicable; whole-page unrelated-input equivalence still needs its manifest.
- Compared prior final product [1c7322e0ec](https://git.cafe/pingdotgg/t3code/commit/1c7322e0ecba4a7301a170b576157984e88548b7) to current head: AppSidebarLayout and routeReveal are unchanged. Only two product changes remain: new Sidebar waits during nonempty search and requires an actual active DOM row before completing; LegacySidebar no longer offers overflow when its only beyond-preview row is the retained active row.
- New/sidebar old success chapters with empty query and an actual row take the same successful widening/scroll path. Legacy ordinary preview6 with 8 eligible rows still has overflow, and sorted union/visible-order logic is unchanged since prior final. Those chapters can be product-equivalent, with original attribution retained.
- Old search evidence cannot prove new deferral/clear semantics. Old legacy preview6+8 does not exercise the single-extra boundary. These need final product runtime proof.
- Fixture seed.py, transcript.py, plain.json and README are unchanged since fixture [8bc79af8d5](https://git.cafe/pingdotgg/t3code/commit/8bc79af8d5a027940dc140a46e4580ed98ff2598). bootstrap.js and replay.js changed. Product-equivalence is not proof of the final fixture transport, gating, clock or sequence behavior.
- Knip entry declarations have no visual state. Existing tooling checks are adequate documentary verification; no screenshot or new visual row.

Current invariant: only a different observed nonnull resolved row key authorizes scope widening. Each mounted sidebar owes a scroll of a visible eligible row, even at the same key. Transient null is ignored. Search keeps debt pending. Completed reveal must not snap again on unrelated changes. An unobserved A→B→A excursion is not a newly observed key. New/sidebar child routes use resolved ancestor row; legacy uses its own raw scoped route. Do not impose new ancestor behavior on legacy.

## Shared capture contract

Configurations: **WL=1440×900/light; WD=1440×900/dark; NL=390×844/light; ND=390×844/dark**, all CSS pixels, DPR2, zoom1. Freeze Date at `2026-10-22T00:00:00.000Z` before module evaluation; keep timers/performance.now native. Fixed locale/timezone, fonts/readiness, reduced-motion/animation policy, sidebar width, initial scope, project/list order, search, expansion, visits, keybindings and network settings must match per pair. Verify actual rendered theme, not filenames.

Every interaction, history, remount, arrival, keyboard or no-resnap row needs narrated BEFORE/AFTER recordings at those four configurations. Timestamped text narration plus original video is sufficient; endpoint stills alone are not. Drawer-only chapters apply NL/ND. Show closed-drawer main route and reopened list at endpoints. Do not claim a query survived a remount when the local search input actually reset.

Static endpoint rows need matched whole-surface stills, diff0 and diffT. Extract checkpoints from interaction recordings rather than repeat the scenario. Full-resolution wide stills are 2880×1800; narrow 780×1688. Disclose MP4 extraction timestamp/PTS/compression; capped/resized preview images are corroboration only. For delta D=abs(RGBbefore−RGBafter): retain raw gain1, **diff0=clamp(8D)** with no threshold; **diffT=white iff max(D)>8/255**, black otherwise. Composite alpha identically, record changed pixel counts/percent/bounds, explain every visible difference; no masks/crops/upscaling or automatic tolerance acceptance.

For scroll claims record pre/post target and scroll-container bounds, scrollTop and main-page position. Target must start wholly out of view using deterministic spacer rows, not a changed viewport height. For exactly-once/no-resnap, visibly scroll away after success and trigger a real menu/data change while route is unchanged. Do not equate one visible endpoint to one scroll invocation.

## Reusable ledger: preserve these rather than repeat for SHA alone

R = reusable product-equivalent endpoint/chapter within its stated limits; C = corroboration only; X = reject that attributed claim. These are chapter dispositions, never whole-set acceptance. Retain exact old recording timestamp/build/fixture identity from the supplied index/audit. Old facts do not magically gain final fixture attribution.

| Row | Existing evidence to retain | Limits / exact remaining obligation |
|---|---|---|
| R1 F1 history/palette/link | WL/NL baseline+head N1/N4 chapters; final four-config changed-route widen endpoints. Empty query + existing active row is equivalent. | Matching-scope, selection clearing, measured offscreen, manual-scope/no-resnap and click chapters remain missing. WD/ND baseline named dark is actually light: cannot reuse as dark pair. |
| R2 F2 same-route guards | Prior final four-config manual B→Settings Back retains B; visible remount and cold direct-load widen. NL/ND drawer hidden/visible reopen endpoints; independently rebuilt NL guard. Layout/helper byte-equal. | Repeated return, matching scope, measured quiet, palette Settings, different final route while unmounted, implementation toggle remain missing. Preserve sufficient hidden/visible/direct chapters; do not repeat solely for head SHA. |
| R3 F3 shelves | NL baseline/head pinned/working/snoozed/settled endpoints; WD/ND head endpoints are useful one-sided C. | Final fixture parity/delayed transformed-field proof is separate. Missing WL indexing, other matched baselines and expanded out-of-tail settled/count/uniqueness. |
| R4 F4 arrival | NL supplemental `released-confirmed` proves later new-row arrival for old replay; prior WD/NL/ND new/legacy head endpoints are C. | Initial NL `released` still has B/no arrival (X for released success). Old replay cannot certify final protocol. Keep endpoints as historical product corroboration. |
| R5 F5 lineage | NL child/root and fork base/head endpoints; WD/ND head endpoints C. | Same-root manual-B grandchild/sibling with actual main route and storage journal missing; remaining base/configs missing. No claim drawer-obscured main pane proves child route. |
| R6 F6 search | Prior NL typed B8 query/results is useful initial-state C. PR's 1280×800/light/native-clock final search-clear video is corroboration. | Old `query-retained-A1` shows placeholder/full list: X. 1280 video is not frozen-clock matched four-config proof. Final retained-query→clear row M6 required. |
| R7 F7 union | WL/NL ordinary preview6 union/removal/more-less/sixth/seventh endpoints; successful empty-query legacy path equivalent. WD/ND head endpoints C. | Wide-light B expansion differs, so full-page strict pairing not accepted until inputs accounted for. Preview8/null/offscreen callers/quiet/click missing. Single-extra M13 is new. |
| R8 F8 collapsed | WL wide baseline/head active-only and expanded endpoints; WD head and NL/ND head C. | Preexisting insertion remains useful static guard. Complete measured offscreen history and narrow baseline absent. |
| R9 F9 legacy remount | Existing four-config Settings-return endpoints (dark before invalid), plus final NL Settings/drawer supplement. | Keep observed chapters; repeated/palette/different-route/quiet and matched drawer proof incomplete. |
| R10 F10 ordering | Final NL retained-order and hardware previous/next endpoints C. | Missing hint/jump7/range proof and paired other configs; no need to capture internal prewarm algorithm. |
| R11 F11 status | Existing A1-visible/expanded pictures C only. | `status-hidden` starts with A1 already retained, not B8-active hidden-priority state: not reusable as F11 precondition. Full resolved-summary sequence missing. |
| R12 F12 grouped | ND head actual A/B two-project group plus separate Spacer is C for correct fixture endpoint. | NL three-project trial is X for intended grouping. Missing paired group union/collapse/hints/order/scroll. |

Cross-cutting rejects: all 36 old baseline facts labelled dark actually render light; keep their actual light identity but not dark pairs. Reject the original stale provenance entry for overwritten `head-390-dark-N2-same-route-hidden.png`; only its later corrected-guards identity matches current bytes. Diffs recomputed by prior audit remain arithmetically useful for their actual bytes; a correct diff does not repair theme/storage/provenance mismatch. Missing historical reset journal is not supplied by today's deterministic seed.

Do not automatically recapture a valid after side when repairing a before side: first recover its exact input journal and match it. If equal inputs cannot be established, retain it as C and record only the unresolved paired chapter. Do not publish a complete-set percentage based on artifact count.

## Missing final matrix: chapter-level work order

All rows below require WL/WD/NL/ND unless a configuration or artifact kind is expressly restricted. Merge chapters into continuous per-build/config videos; there is no requirement for one file per row. Reuse the preceding ledger; “missing” below does not erase already sufficient endpoints. F1–F12 preserve the earlier 48 scenario-set denominator, with corrected F6; M13 adds four boundary runs rather than silently counting them under an unmodified F7. Protocol witnesses P1–P6 are not extra product surfaces or an artificial Cartesian expansion of 48.

| ID / web path / fixture | Exact missing chapters and endpoint expectations | Artifact / reuse |
|---|---|---|
| M1 F1 `Sidebar.tsx` / spacers | Back excluded A→All; Forward B; manually B same route remains B; All/offscreen reveal; matching A no widen; selected B clears when widening; visible-click control; after success scroll-away + menu/data no snap. Palette and rendered link callers retained where sufficient. | Narrated pairs; reuse R1 chapters; measured controls missing all configs. |
| M2 F2 `AppSidebarLayout.tsx`, `Sidebar.tsx`, `routeReveal.ts` / spacers | Settings button and palette; repeat Forward/Back; same-route matching-scope mount scroll; hidden manual B persists; different final route while unmounted widens/reveals; toggle legacy/new same route preserves manual scope; quiet after visible mount. NL/ND closed/open drawer endpoints. | Narrated pairs for missing chapters only; retain R2 hidden/visible/direct and correct drawer chapters. |
| M3 F3 `Sidebar.tsx` / shelf variants | Pinned; collapsed working (enabled), snoozed and settled route reveal; expanded settled target older than initial tail remains unique after scope reset, count/control correct. | Static matched shelf endpoints plus interaction recordings for route/reset/expand. Reuse R3 valid endpoints; final transport obligation P2/P4 separately. |
| M4 F4 both sidebars / all+delay, archived, orphan | Route before absent A1→explicit release→actual reducer row→scroll, legacy beyond preview; completed same observed A then remount with A absent→release, visible case scrolls without new widen; hidden B case preserves B. After success scroll away + later data no snap. Navigate archived A1, orphan A9, missing key and log actual resolved route/ref; no invented row/scope clearing. | Narrated pairs. Old missing link resolving a draft is not a missing-row success. Old release C retained, final replay P3/P4 required. |
| M5 F5 `Sidebar.tsx` / lineage | Different-row→real child route reveals A1 root; set B manually, grandchild then sibling same root must not widen; fork uses own row and can widen. Show actual main target, not just root row. | Narrated pairs; reuse R5 child/fork chapters where route is proved. |
| M6 F6 `Sidebar.tsx`, `routeReveal.ts` / spacers | **Corrected final expectation:** B scope + query matching B8 excluding A; Back/real route to A while same sidebar remains mounted: query/results retained and reveal deferred (no premature scope clearing). Clear query: widen if pending scope excludes eligible A, normal row appears and scrolls. With All/matching scope: clear still scrolls owed offscreen A. After success manual scroll + clear/retype/unrelated rerender does not repay completed debt. Include null/new-thread→valid key; ignore transient null during Settings return. At narrow use hardware history while drawer stays mounted; prove query text rather than relying on caption. | New final-product narrated pairs all4. 1280 video corroborates only. **Supersedes old F6 “do not require scroll solely on clear.”** Also prove late row after normal list returns if absent, not completion on missing DOM. |
| M7 F7 `LegacySidebar.tsx` / plain + spacers | Ordinary preview6+8 union/removal/more-less and boundary6/7 retain existing evidence. Missing preview8=no overflow; actual null removes old retained row; offscreen palette/link with measured bounds; ordinary click and manual-scroll/menu no snap. | Narrated missing chapters, static endpoint stills; R7 ordinary union reusable. |
| M8 F8 `LegacySidebar.tsx` / spacers | Collapsed A insertion/header wholly offscreen; Back A8→Forward B8→Back; nearest scroll, one active row only, no preview spill, expand/collapse; inactive B stays collapsed. | Narrated pairs; existing active-only/expanded stills retained R8. |
| M9 F9 `AppSidebarLayout.tsx`, `LegacySidebar.tsx` / spacers | Repeated same-route Settings return with past-cut A1, palette Settings, different final route while unmounted, quiet after manual scroll. NL/ND drawer same-route close/open with main endpoints. | Narrated missing pairs; R9 retained. |
| M10 F10 `LegacySidebar.tsx` / plain | A first, A8…A3 + A1 seventh then B; show actual configured hint modifier/labels, jump7→A1; reset; previous/next boundary recalculates when leaving retained A1 removes it; Shift A3→A1 guard selected IDs/count (full eligible range may include hidden A2). | Narrated pairs, hardware keyboard narrow. R10 traversal C retained. Prewarm internals source-only. |
| M11 F11 `LegacySidebar.tsx` / status | Start B8 active, A collapsed-to-preview with A1 uniquely highest hidden priority and A2 distinct lower; record actual resolved summary/header. Back A1: A1 status moves onto row, remaining hidden summary resolves from A2. More/less then Forward B restores summary; header aggregate remains stable. | Narrated pairs plus static status endpoint stills. No usable R11 hidden precondition. Do not assume input `failed`/`completed` text equals final resolved labels. |
| M12 F12 `LegacySidebar.tsx` / all+repository group | Actual A/B group only, separate Spacer; from outside group route to member beyond preview→single sorted retained row, More control, group jump/hint order and scroll; logical group collapse/expand preserves active-only row. | Narrated pairs plus grouped static stills; ND fixture endpoint R12 retained. |
| M13 new F7-boundary `LegacySidebar.tsx` / **plain, preview7, exactly8 eligible A** | A1 is eighth, only row beyond7. On B8: A has7 preview + Show more (A1 hidden). Back A1: all8 sorted once and **no empty Show more**. Forward B8 restores Show more. Control: preview6 has another hidden A2, so active A1 retained + nonempty More remains; preview8 no overflow. Verify hint/jump8 is A1 in sole-extra state and order changes on leaving. | New final-product narrated pairs all4; static B-active/A-active still+diff0/diffT from recording. Existing preview6+8 cannot substitute. No new generator or seven-row custom fixture needed. |

## Final fixture protocol matrix — runtime proof, not product invalidation

The PR cites 47 external VM/shared-reducer checks. Useful protocol checks, but not evidence that the injected final bytes work through the real application's HTTP/WebSocket client. No need to replay every old product chapter merely because these bytes changed. These witness chapters can be folded into M3/M4/M6 and the capture preflight.

| ID | Real-app witness / exact missing evidence | Scope and reuse |
|---|---|---|
| P1 disabled passthrough | Final bootstrap+replay injected, `{enabled:false}`; genuine cold HTTP shell and shell subscription. No triage filtering, held delay, shelf/status transformation or inserted offset. Compare normalized real shell facts before/after decoder, not raw credential-bearing envelopes. UI synthetic row/title/route consistent; no provider start. | Once per actual HTTP/WS startup path, per compared build where fixture is used. No separate four-theme video suite: common preflight with a static row/control suffices. Prior no-replay smoke is product C, not final disabled-wrapper proof. |
| P2 enabled transport parity | Fresh snapshot via `/api/orchestration/shell` and genuine WS shell snapshot; same option set gives same synthetic eligible IDs, shelf/status fields, lineage policy and snapshot identity. Thread subscription data must not be mistaken for shell subscription. Include lineage on/off and settled added rows in structured endpoint journal. | Runtime transport witness both paths; visual shelf/lineage chapters still all4 through M3/M5. A VM envelope test does not replace this. |
| P3 delay + sequence continuity | Hold A1, verify absent in decoded client shell; establish genuine later shell sequence before release; explicit `__sidebarReplay.release()`→A1 accepted; then another genuine server event must also be accepted with matching subscription identity and insertion offset. Capture original vs delivered sequence/request identity in **sanitized** metadata, row appearance plus later harmless synthetic update; no later update dropped. | Final replay needed for both HTTP-seeded and WS-snapshot-seeded delay paths. M4 both sidebars/all4 supplies visual arrival; transport metadata need not multiply across themes. A frame arriving on wire without decoded-client change is insufficient. |
| P4 delayed transformed fields | Delay with `shelf:'working'` (enabled setting) and a separate `status:true` case; transformed A1 remains absent until release, then retains working/status fields and correct visual classification. Settled/snoozed/pinned cold fields checked P2/M3; no invented provider process. | Fold into M3/M4/M11, preserve original row provenance. Old transform-before-delay differed and cannot prove final delayed shelf/status. |
| P5 clock | Actual final bootstrap pre-module: epoch1792627200000, `Date.now()`, `new Date()`, callable `Date()` string agree; explicit-date construction, parse/UTC, Date instance remain native-compatible; readyState/loading and injection/module ordering journal; timers/performance advance normally. | Every build/config preflight captures clock/theme metadata, no independent user journey retake. Earlier frozen class bytes do not certify new callable Proxy; old frozen visual endpoints remain product C/R. |
| P6 subscription lifetime/envelope | Genuine client reconnect/resubscribe, then delay/release addressed to current shell subscription; later real event accepted. Retain active transport envelope shape (object/array/NDJSON) in sanitized journal. | One runtime reconnect witness per real transport mode. Do not create a separate browser matrix for hypothetical envelopes not emitted by this app; external 47 checks cover additional parser shapes. Old protocol captures do not certify this. |

P3 needs an actual post-release server event. In a fresh synthetic environment, create a disposable empty thread with the app's normal new-thread/creation path (do not send a prompt); if draft creation emits no shell event, use a server-owned synthetic thread created normally and change its title through the normal UI. Record resulting persisted shell sequence and updated title. Do not rely on renaming a projection-only fixture as coherent event-history proof; keep the sentinel outside ordering-critical projects/chapters or reset afterward. Never invent a wire event and call it a real later server event.

## Precise reconstruction and replay procedure (for assigned capturer; not executed here)

1. Use two isolated runtime homes, one per baseline/final build. Start each once to migrate; record real `[dev-runner]` ports and capture owned process IDs; stop only those IDs before SQLite writes. Never use live `~/.t3/userdata`. Do not set VITE_HTTP_URL/VITE_WS_URL. Runtime DB is `<explicit-home>/userdata/statev2.sqlite`. Keep auth/pairing privately outside public artifacts. Baseline product is merge-base43879; apply the **same final fixture bytes** to both builds as external capture inputs, with exact injection hashes; never claim fixture files exist in baseline git.
2. Generate with `python3 -B scripts/fixtures/issue-16534/seed.py --output /tmp/pr23519-audit/<build>-<variant> --variant plain` (or variant below), adding `--legacy` for legacy initial settings. Generator only writes files. Plain=16 threads (A8+B8); spacers=56; all=60 including40 spacers and4 lineage nodes. **all does not mean all shelf/status variants.** Canonical plain digest4238a9588e5c13c22f0678aa7bf8acf6e32392aef7c822defb67c9750e2f117c; all01dc400cf2d1dc7ad412ffdba6ee87849a963fe3c4abab72c241515120f3cb58. Digest in sha256.txt excludes fixture.json trailing newline; archive actual file SHA256 too.
3. With isolated server stopped, run `node apps/server/scripts/t3-sqlite-state.ts exec --base-dir <isolated-home> --file <seed-dir>/<name>.sql` **once per file**, in order: reset-threads; archive-unrelated-threads; hide-v1-threads; hide-unrelated-projects; projects; threads; messages; turn-items; transcript-runs; transcript-messages; transcript-turn-items. Keep helper backups private. This is projection-only rendering/navigation data, not a coherent event log. Start server again; verify only intended projects/threads, zero active provider sessions/tasks, two completed synthetic transcript runs. Use a fresh home/reset snapshot between variants: seed resets thread rows but is not a general cleanup of arbitrary previously created runs, provider sessions or event history.
4. Use `plain` for exact legacy8 boundaries/order; `spacers` for offscreen; `lineage` for A9 child/A10 grandchild/A12 sibling/A11 fork; `archived` for A1 archive; `orphan` routes A9 with missing ancestor. Use `pinned`,`snoozed`,`settled` for stopped projection fields; **working/status variants do not encode those live-looking shell statuses in SQL**, so enable replay options. Settled SQL adds A9…A16, whereas replay settled adds A13…A26; select one explicit recipe and record exact IDs/order, never mix recipes across pair. `all`+`replay.lineage:false` filters A9–A12 for plain shelf tests; plain fixture is safer for exact8.
5. Authenticate privately, then use a same-origin inert HTML document, with no app module graph running. Clear only IndexedDB `t3code:connection-runtime` stores `shell`,`thread`,`vcs-refs` in a completed readwrite transaction; preserve catalog/server-config/auth. Do not clear storage globally. Set `sessionStorage['sidebar-capture-config']=JSON.stringify({storage:...,replay:...})`; archive **only allowlisted synthetic config**, not all storage.
6. `storage` maps localStorage names to objects/raw strings; bootstrap JSON-serializes nonstrings. Put generated fixture.settings object at `t3code:client-settings:v1`, generated fixture.uiState at `t3code:ui-state:v1`. Overrides: legacySidebarEnabled; sidebarThreadPreviewCount6 (7 for M13,8 control); sidebarThreadSortOrder updated_at; sidebarProjectSortOrder manual; sidebarProjectGroupingMode separate; sidebarWorkingShelfEnabled true for working. Explicit shelf keys `t3code:sidebar:{working,snoozed,settled}-expanded` are booleans. Per-chapter local list “Show more” state in legacy is React-local, not an invented persistent expandedThreadListsByProject storage field: set it via real Show more/less after mount.
7. Discover actual environmentId from real shell/catalog. Scope row keys/visits and physical project preference keys are environment-scoped; use app controls or the source key helper, never a guessed fixed `environment-local`. Physical project key is `<environmentId>:/tmp/triage-16534-A` (similarly B/Spacer), not `triage-project-A`. For separate mode, set projectOrder to desired physical keys and projectExpandedById for same keys; log actual group/scope menu value selected by UI. Verify sorted IDs after transcript timestamps, rather than assuming title order. Record selection/visit keys explicitly.
8. Set raw theme preferences before app load: `t3code:theme`=light/dark, `t3code:theme-follow-system`='false', `t3code:theme-appearance-mode`=light/dark. Use a fresh synthetic profile without custom theme halves; verify actual resolved palette, root class/color and screenshot, not just preference strings. Theme-follow-system caused old false dark comparisons.
9. Serve final bootstrap.js then replay.js as classic pre-module scripts in capture-only HTML (or equivalent pre-document injection with byte/hash/order recorded), before every Vite/app module executes. Navigate freshly; never `document.write` over an evaluated graph. The assigned capturer must restore any temporary served HTML exactly afterward; this audit made none of those edits. Confirm P5 clock before accepting capture.
10. Replay config: disabled `{enabled:false}`; normal synthetic shell `{enabled:true,lineage:false}`; lineage `{enabled:true,lineage:true}`; shelf `{enabled:true,lineage:false,shelf:'working'}` or pinned/snoozed/settled; status `{enabled:true,lineage:false,status:true}`; delay adds `delay:true` to the chosen options. Options are read once at preboot; changing sessionStorage after module evaluation does not reconfigure existing wrappers. Final replay wraps **real** fetch/WebSocket frames before real decoder/reducer; do not patch product stores/router to fabricate outcomes. Delay release is `__sidebarReplay.release()`; wait for actual decoded row/bounds, not a timeout or wire-send caption.
11. For mount-owned delay: start configured delay, release once and complete observed A; then keep AppSidebarLayout alive, switch Settings/close drawer, and cause a genuine shell resubscription/snapshot while replay withholds A again. Confirm replaced decoded shell actually lacks A before returning/remounting; release then show mount debt scroll. Keep manual B variant distinct from visible All/matching. If runtime keeps cached A or no fresh snapshot occurs, the precondition is **not established**: log friction; do not force store removal or relabel a pending-route delay as mount-owned. Both HTTP and WS may participate: archive which snapshot/stream supplied each hold.
12. Real routes are `/<environmentId>/<threadId>`; use real palette, history, normal row click and rendered `t3-thread://v1/triage-*` links in A8/B8 transcript. Null/new route `/new` may redirect into `/draft/<id>`; log actual resolved target and scoped ref. Links to missing threads may redirect, which is evidence of that path rather than a missing-row pass. On narrow, close drawer briefly for actual main-route endpoint, reopen and re-establish query/precondition if remount reset it.
13. Grouping: initialize the three synthetic paths as local git repos with the same harmless synthetic origin; no fetch. Set sidebarProjectGroupingMode repository and `sidebarProjectGroupingOverrides['<environmentId>:/tmp/triage-16534-Spacer']='separate'`. Verify A/B logical group and separate Spacer, actual repositoryIdentity and logical expansion key. Do not use project id as grouping override key. Use actual group UI to capture logical collapse/order.
14. Before each chapter record build SHA, fixture hashes, generated SQL/settings/config digest, viewport/DPR/theme, route+resolved row, actual list IDs/uniqueness, initial bounds/scroll, expansion/scope/search/visits and readiness. Stop recording before unallowlisted Settings/account content. At end stop owned processes, restore capture injection, verify worktree unchanged, and upload only reviewed synthetic artifacts.

## Sensitive-surface hard stop

No sensitive runtime surface was opened in this pass, so **no observed sensitive leak** is claimed. Capturer must stop the affected recording/upload if a pairing token/URL, auth cookie/authorization header, account secret, private endpoint, real workspace path/transcript or personal Settings/account data appears. Use a fresh synthetic home/profile and allowlisted metadata; reset the scene before resuming. `__sidebarWire` records entire native frames even when replay is disabled: **never upload that raw buffer, complete storage dump, server logs, DB, auth state or pairing links**. Sanitized request IDs/sequence/fixture-only fields can support P1–P6. Hiding nontriage rows in replay does not sanitize underlying wire data. Do not mask an already leaked frame and call the original safe; keep it private and recapture only that affected segment.

## FRICTION and handoff

- FRICTION SOURCE: stale local main would falsely produce3368 changed files. Correct merge-base/observed-base agreement resolves this without fetch. Exact source diff establishes which old product branches remain equivalent.
- FRICTION EVIDENCE: documentary reuse is not fresh visual acceptance. Prior audit reports actual-light dark baselines, contradicted query caption, stale overwritten fact and missing reset journals. Repair only invalid/missing chapters; preserve sufficient old captures with original identities.
- FRICTION FINAL PRODUCT: current PR body accurately calls legacy single-extra browser case unverified. Its search-clear1280/native-clock video is corroboration, not the required pair. Old F6 expectation is superseded by final implementation.
- FRICTION FIXTURE: no committed chapter runner or full storage/replay journals exist. fixture.json is metadata, not an automatically applied runtime reset; scripts inject storage only from explicit capture config. `all` does not seed all special states. Generator reconstruction succeeded in scratch; no DB applied.
- FRICTION PROTOCOL:47 external checks are recorded in PR body, not rerun here; final real-client P1–P6 witnesses remain owed. Mount-delay needs actual shell replacement/removal, not a cached row or forced store mutation.
- FRICTION TOOLING: cafe returned JSON envelope despite ordinary invocation; description was read successfully. ghdrop available. Existing `__pycache__` directory was not changed/removed; generation used -B. No browser/capture attempted, by request.
- FRICTION SCOPE: web only by changed file paths. New proof demand is M6/M13 plus final replay/clock runtime witness; remaining M1–M12 gaps are inherited chapter obligations, not a new general QA expansion.

Verdict: evidence remains insufficient for complete-set acceptance. Reuse R1–R12 within their stated limits; assign capture against missing M1–M13 and P1–P6, not a blanket recapture. Capture owner should return a chapter/config manifest, not a file count. No implementation action requested by this audit.