# Proof audit pass 2 follow-up

**VERDICT: SUFFICIENT — rows 1, 2, 3, 4, 5, 6.** No remaining material gap in the bounded pass1 matrix. This supersedes the prior pass2 evidence verdict, not the separate code reviews. The decision combines original matched visible-path evidence, new focused protocol tests, and unique-session retention/reload evidence; it does not require a recording for each protocol-only branch.

Read-only audit on 2026-10-24, within the requested 20-minute budget. Source head initially [46255debff](https://git.cafe/pingdotgg/t3code/commit/46255debff441f80bf169625a2076299bd1ccd45), finally [a459583c71](https://git.cafe/pingdotgg/t3code/commit/a459583c71f7edee50f5ec0724db712f771398ed). The merge incorporated [6e79211743](https://git.cafe/pingdotgg/t3code/commit/6e79211743). Both audited files remain byte-identical to the initial head; their Git blobs are 483e12e25b1e4162b32acf6b95f8f6f55a0f5a24 and bcb704427b5bc3c847875b6a56e3b178560f3378. Diff against current main contains only ClaudeAdapterV2.ts and ClaudeAdapterV2.test.ts. Worktree clean at handback.

No code edits, browser/computer use, new servers, lifecycle changes, forge writes, or cleanup. Only requested scratch report/check artifacts and authorized ghdrop uploads were written. Existing servers and evidence retained.

## Row decisions

| Row | Verdict | Closing evidence |
|---|---|---|
| 1 paragraph/turn boundaries and tail | SUFFICIENT | Reuse the previously verified four width/theme configurations, both modes, recordings and 68 same-pair comparisons. Representative desktop paragraph and narrow dark turn captures inspected again. New paragraph projection contains exactly two completed paragraphs while streaming and excludes unfinished tail; turn projection has no assistant before snapshot. |
| 2 corrected/repeated/empty snapshots | SUFFICIENT | Three table cases at test lines 3450–3554 cover matching/corrected/empty snapshot, repeat the same UUID, and repeat result text. Assertions require exactly two streaming updates plus one completed update, a single message ID/createdAt, single item ID/ordinal, correct final text and running/running/completed status. New real-app projections preserve paragraph identity/createdAt and item identity/ordinal through correction. Both modes retain canonical text once, including nonempty buffered text under an empty snapshot, after reload and another fixture thread. |
| 3 blocks/thinking/tool/new message | SUFFICIENT | Original visible ordering chapters remain valid point-in-time proof. Unique-session replay closes retention: both modes have five exact canonical assistant texts and ordered user/assistant/reasoning/assistant/tool/assistant/assistant/assistant/checkpoint items, all completed. Per-block snapshots share the first native message ID; a new message resets wire index to zero. Mixed streamed-plus-snapshot-only text remains explicitly a compatibility fixture, not ordinary SDK grouping. |
| 4 cancel and terminal settlement | SUFFICIENT | Existing actual UI Stop recordings cover both modes/four configurations, retained partial text, cleared pending state, and a clean subsequent turn. New table at lines 3557–3659 tests result, error result, query exit without snapshot and interruption before the coalescer emits. The interrupt case makes no TestClock advance and asserts zero assistant emissions before Stop, then the exact buffered text settled, streaming false, completed assistant item and interrupted run. Other cases assert completed/failed outcomes respectively. This closes the timing gap without falsely describing the older 1100ms-wait UI clips as pre-coalescer cancellation. |
| 5 snapshot/result compatibility | SUFFICIENT | Original clean snapshot-only follow-up plus new result-only, empty-snapshot/nonempty-result and entirely-empty tables at lines 3662–3754 require exact assistant counts/text and settled flags. The added empty-block + empty-snapshot fallback regression and fix are directly exercised. Final-head real-app paragraph supplement produces one exact nonempty assistant, no phantom, completed run, exact reload projection. No separate four-config fallback capture is necessary. |
| 6 protocol invariants | SUFFICIENT | New quiet-stream table sends empty block start/stop, unknown-index text delta and parent-tool child text start/delta, then requires only the intended fallback or no assistant. Existing thinking tests cover completed/interrupted reasoning, child suppression, distinct ordinals, completion and no assistant leakage. Existing child/workflow/tool coverage and original structured fixture remain applicable. All Claude/Codex tests passed in this audit. |

## Independent verification

Executed `vp test run apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts` at the initial head: **298/298 pass**, 2 files, 23.84s. [Own test log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f56ed8fa8dc0fdb5/followup-tests.log). After the main merge, the lead supplied the [300/300 Claude/Codex/filter test log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8504f5a3e3be0a1c/issue-17270-final-tests.log); downloaded and inspected it: 3 files pass, 31.76s. The 300-test run is supplied execution evidence, not a second run by this auditor. Two fresh MERGE code reviews are lead-supplied context, not substitutes for the assertions below.

Read and reran the retention assertion script: **49/49**. Independently recomputed its substantive claims from raw saved projections rather than relying on boolean transcripts:

- Final/reload/after-other-thread/readiness-checked-reload selected projections are exactly equal on base and head, in both modes. Selected fields include message ownership, IDs, text, createdAt and streaming, plus item ownership, IDs, types, order/status and run status. These are selected projections, not a claim that every database field or node was serialized into these JSON files.
- Head assistant texts are exactly the authoritative corrected prose, code block, new-message text, snapshot-only remainder and buffered empty-snapshot text, each once. Reasoning/tool placement and item completion agree with ready expanded screenshots.
- Message identities do not intersect among paragraph, turn and subsequent snapshot-only fixture threads on either side. Three distinct native session UUIDs; namespaced native message/tool/snapshot/frame IDs. Base/head frame payloads match for all 23/23/3 scenario frames except environment-local init cwd.
- Fixed-fallback final/reload projections are equal, contain exactly the expected nonempty text, no empty assistant, no streaming and completed items/run. Independently recomputed **5/5** checks.
- All 33 inventory files in the authoritative new manifest match their SHA256 values. Downloaded public manifest equals local JSON. The earlier 284-file verified inventory still matches all saved hashes, preserving the prior audit's exact recomputation of all 136 threshold images from 68 accepted pairs; no duplicate full diff rebuild was performed.

[Independent check results](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/23d76530a89b3fe9/followup-independent-check.json), [independent check script](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b06846570a0944a2/followup-independent-check.py), [rerun 49-assertion transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e34617ed5223050e/followup-retention-recheck.json). Raw data: [retention report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/47246fb7ac3d6c6d/followup-report.md), [authoritative manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e503afa4ee52ae49/manifest-authoritative.json), [drivers/projections/logs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e32bce12e49bd29e/drivers-projections-logs-final.tar.gz), [fixed fallback bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2da45d927f6585b7/fallback-drivers-projections-logs.tar.gz).

## Capture and source limits

Inspected original representative screenshot/threshold/Stop-window sheets, prior rebuild comparison, new base/head video sample sheets, four ready reload replacements in the comparison, and final fallback screenshot. Fully decoded the two new retention recordings and fixed fallback recording: all exit 0. Base/head retention decode logs have no warnings; fallback repeats disclosed nonmonotonic DTS warnings from the null muxer. Sampled sheets and ready captures are not frame-by-frame playback. Eight splash reload captures and interrupted attempts remain rejected; they do not establish visible retention.

The uninterrupted accepted retention run used adapter SHA256 2c99d08c18ada6214f0632241cbab655cc6319b69e227f327f53753702650072, restart count 13 at both ends. Its test-only commit transition did not alter adapter bytes. The four ready reload replacements and fallback supplement used final fixed hash 518aef2a42c9bc3f5e7f9eedf7a76ec8f8ed0f9754f54e67c025964425b385d2; fallback restart count 18 at both ends. This is retention across the source update plus a focused new final-fix run, not an uninterrupted final-head recapture of all scenarios.

Rechecked the existing independent rebuild images and pixel arithmetic: **942 changed pixels unmasked / 748 above16**, comprising elapsed 120, thinking-label animation 178, Stop pulse 644; **zero changed pixels outside those regions**, including zero observed content/font/antialiasing delta. No new browser rebuild was needed.

Original four configurations prove point-in-time visual behavior only because the old fixture IDs collided across threads. Retention is established separately by one 1440×900 light responsive-web configuration, both modes. Fixed-fallback supplement is head paragraph-only. Responsive 390 remains web, not native mobile. No native/desktop IPC/transport or unrelated provider claim is added. Live-provider Before/After links are qualitative, not pixel-matched, and were not independently watched in this pass; they do not block matched fixture proof.

![Baseline left, head right after another fixture thread and ready reload; paragraph above, turn below](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2108af6ce1d57858/ready-reload-comparison.png)

## PR body claim check

Read `/tmp/issue-17270-pr-body.md`; intentional PROOF_AUDIT_PENDING placeholder excluded. No material proof overclaim. Tighten two sentences before publication: scope the 1280×800 raster cap to desktop captures (narrow is780×1800), and explicitly distinguish both-mode retention from head paragraph-only fixed-fallback coverage. Render the currently bare GitHub/GitCafe issue references as clickable Markdown links. This audit did not independently validate the historical 90-test/typecheck or live-provider timing claims; retain those only with the lead's corresponding evidence.

## FRICTION

| Category | Observation | Handling |
|---|---|---|
| Fixture isolation | Original IDs collided across runs. | Preserve original point-in-time evidence; independently verify unique-session cross-thread retention. |
| Capture readiness | Eight new reload frames show splash; earlier runs restarted. | Exclude them; use ready expanded replacements and stable-hash/restart bounds. |
| Source timing | Main merge occurred after own 298-test run. | Verify exact adapter/test blob equality; inspect supplied post-merge300-test log; no redundant browser rebuild. |
| Artifact retrieval | Python urllib received HTTP403. | Downloaded same public manifest with curl; JSON equals local. No missing evidence. |
| VFR recording | Fallback null decode warns about DTS. | Exit0, warning retained; screenshot and exact projections establish final output. |

VERDICT: SUFFICIENT 1,2,3,4,5,6. Remaining material rows: none.