# Proof audit pass 2 — final evidence rerun

## Findings first

No remaining required proof gap or new production defect established. The prior S1 fresh-final-head blocker is closed by a new real-app turn, independently checked against the isolated database projection and durable event. The incorrect dark-theme label and stale PR description are corrected. This is proof sufficiency for the scoped matrix, not merge readiness or certification of every platform.

The primary owns the new app execution; this reviewer independently inspected its downloaded evidence and read-only persisted records. The independent committed-fixture native CLI reproduction and 32-test run from the preceding pass remain applicable at the identical head; they were not needlessly repeated. No browser authentication retry was needed.

## Row status

| Row | Status | Proof and limits |
|---|---|---|
| S1 before | PASS, historical | Prior inspected base transcript: two completed OpenCode turns lack context, cumulative input12000/cache1000/output32; same-thread Codex control is distinguished. Base was not rerun. |
| S1 final after | PASS | Fresh thread `a6b583e8-550b-4129-be52-ee24b26aec69`, completed 2026-10-21T09:26:14.583Z. Supplied final transcript exactly equals the independently extracted persisted provider-turn object, including IDs and timestamps. Durable provider-turn.updated at 09:26:14.627Z carries the same payload. Context12032/max128000/input12000/cache1000/output32/reasoning0. |
| S2 ready catalog / last step | PASS | Prior independent 32/32 adapter suite at this same final head; committed test sends two steps and asserts last-step12032/max202752 rather than a sum. |
| S3 pending catalog / last step | PASS | Parameterized test holds catalog gate pending through terminal event, asserts used12032/max=null, then releases gate. Completion does not wait on catalog. |
| S4 supporting ownership / terminal paths | PASS within matrix scope | Existing ownership, duplicate, other-prompt, completed/failed/unavailable cumulative cases retained. No dedicated failed/interrupted context or catalog-rejection/timeout assertion is claimed. |
| V1 before / Codex control | Optional historical corroboration accepted | Prior inspected before image and runtime labels retained; light UI. Control is not the fix. Images cannot independently establish their source SHA. |
| V2 known-ceiling meter | Optional corroboration accepted | New supplied final-head PNG independently opened: light UI, Local stub reply, 9.4%, 12k/128k, Compact context, no cost/processed rows. Closed/open older images remain historical. No pixel-equivalence claim. |
| V3 unknown ceiling | N/A visual proof | Runtime S3 proves null ceiling; unchanged renderer has count-only branch. No app screenshot claimed. |
| V4 hidden / placeholder | N/A visual proof | Existing setting/loading/capability branches unchanged; no interaction claim. |
| V5 overloaded / compaction variants | N/A visual proof | Existing color/action/disabled-reason branches unchanged; no compaction execution claim. |
| V6 surfaces/layout/theme | N/A additional visual proof | No renderer changed. Desktop shares web; no native-mobile meter consumer found in prior source audit. Other platforms and connection modes not executed. |
| R1 committed reproducer | PASS | Committed prepare/serve/config/wrapper/seeding/extraction instructions; independent fresh real OpenCode1.18.18 CLI reproduction at final head already yielded exact native tokens. New primary app turn used generated final-fixture wrapper and stub18999; inspected config points there, and request log records both title-model and selected-model requests. |

## Identity, scope and provenance

Reviewed [#22761](https://git.cafe/pingdotgg/t3code/pull/22761), mirrored [#22761](https://github.com/pingdotgg/t3code/pull/22761), clean `/home/ubuntu/wt/issue-8388`, branch fix/issue-8388. Local and GitCafe heads agree:

- Before [7ffc3bb7e8](https://git.cafe/pingdotgg/t3code/commit/7ffc3bb7e80d88327a06d667e4be1bdef85329d3): `7ffc3bb7e80d88327a06d667e4be1bdef85329d3`.
- Final [70a0684ec4](https://git.cafe/pingdotgg/t3code/commit/70a0684ec444fbe91a7233edccd6592b43a59b1d): `70a0684ec444fbe91a7233edccd6592b43a59b1d`.
- Historical after [e85525de29](https://git.cafe/pingdotgg/t3code/commit/e85525de299e3a480e4f0be5769da84c737d7a24) and fixture-addition [8f3b87d9a3](https://git.cafe/pingdotgg/t3code/commit/8f3b87d9a3b92b5446424df3d1fe17a11010d1d7) are historical, not final-head runs. Production adapter diff between e855 and final is empty.

Pinned-base diff remains four files, 349 insertions/five deletions: adapter, adapter tests, committed runtime fixture, and knip entry. No frontend/CSS/contracts/desktop/mobile changes. Pass1's two-file inventory described its earlier head; final inventory supersedes it.

Changed adapter tracks newest accumulated owned step separately from cumulative billing; background provider.list has a five-second timeout/ignored failure. Terminal context is emitted only with a step; optional model ceiling uses the trimmed provider/model key. No later catalog-driven refresh or historical backfill is claimed. OpenCode2 and other adapters are unchanged.

Unchanged indirect render path: ChatView latestProviderTurnTokenUsage / deriveLatestContextWindowSnapshot → ChatComposer legacy setting gate → ComposerFooterControls → ContextWindowMeter. No new Settings, palette or keybinding render path. Existing null-ceiling, loading, disabled action, fallback and compaction branches are outside this server-only diff. Visual difference sheets are N/A under this matrix.

## Exact semantic comparison and fresh-run corroboration

[Final evidence](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/126a437d9e50e492/final-evidence.md), [fresh transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/158a3ae66b78330f/final-runtime.json), [stub requests](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9288a4bf205e862b/final-stub.log).

Independent read-only extraction used the committed t3-sqlite-state query helper (`readonly` for query), `.t3/userdata/statev2.sqlite`, selecting payload_json from orchestration_v2_projection_provider_turns by the fresh thread ID. The transcript's entire turn object is parsed-JSON equal to that row. Querying orchestration_events by stream_id finds 52 fresh lifecycle events, including request/run/provider/message/terminal/checkpoint progression. Its terminal provider-turn payload independently corroborates projection values. The separate orchestration_v2_events table has no matching rows; the durable records are in orchestration_events.

[Independent extraction](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/09d4e1ac0b95234c/persisted.json), [terminal usage event](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7a0fa3b0ab7e0adb/usage-event.json), [exact semantic comparison](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c5ffb4846c5e4470/semantic-comparison.json).

Historical after versus fresh after: status, every numeric context field and every cumulative usage field compare exactly after excluding identity and timestamps. Historical updatedAt=09:00:39.853Z; fresh updatedAt=09:26:14.583Z. Before versus fresh: context changes from absent to the stated object; cumulative usage remains input12000/cache1000/output32. This is exact semantic equality/delta, not bytes or pixels.

Independent native rebuild from the preceding pass used the committed fixture at this same head, generated audit-fixture, real CLI1.18.18 and owned stub18999. Native tokens were exactly total12032/input11000/output32/reasoning0/cache read1000/write0. Arithmetic: input11000+cache1000=12000; used12000+output32=12032. Runtime ceiling128000 and harness ceiling202752 are intentionally different fixtures. See [prior independent native transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/450056a0771c52d8/cli.jsonl) and [32-test output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/95ef76898bbd60e5/tests.log).

The new app used existing isolated project /tmp/issue-8388/project with generated wrapper /tmp/issue-8388/final-fixture/opencode. Wrapper explicitly selects generated config and isolated XDG directories; config contains only OpenRouter, local dummy key, localhost18999 and context128000. Stub log shows streamed title-model google/gemini-nano-banana-2.1 and selected z-ai/glm-5.3-flash requests. This is sufficient corroboration of committed-fixture integration, not a claim that this reviewer personally drove the browser. Server8609/16649 and Chrome154/Linux/DPR2 metadata are primary-supplied; PNG itself establishes 1280×800 raster and visible light theme.

![Final-head lead capture: light UI, context 9.4%, 12k/128k](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a16f6c8199656f82/browser-screenshot-localhost-mvhwr3so-897dd5c7.png)

What else changed in the capture: fresh thread/title, timestamps/sidebar ordering and popover state. Fixture changes versus temporary reference: Node replaces Python, unused control provider removed, isolated XDG layout, configurable port, OPENCODE_BIN fallback and shell-quoted paths. Prior portability smoke checked default port, apostrophe/literal shell paths and argument preservation using /bin/echo. No pixel delta was calculated or inferred from source equality.

The PR's additional 22 replay tests, base-negative test demonstration and changed-file lint claims are primary-reported validation; this evidence rerun does not independently certify those separate runs. They are supplementary, not required matrix rows. The scoped adapter test proof and exact runtime comparison satisfy the required matrix. Typecheck log inspected contains suggestions, not error diagnostics.

## Limits and friction

Real OpenRouter account/network, Windows desktop/Electron, Android/iOS, remote/relay/tunnel remain unverified and explicitly disclosed. Historical turns are not backfilled. Original before remains a supplied primary capture. No new source changes, pushes, forge comments, auth changes, servers or browsers in this rerun; existing primary processes left alone. Prior owned reviewer stub was stopped in the preceding pass.

Initial urllib downloads received HTTP403; retry with normal browser User-Agent succeeded. GitCafe singular pull URL registration was rejected; explicit host/repository/number succeeded and final thread listing confirms the sole relevant PR link. Forge reads used cafe. Checkout remains clean. Public report/evidence uploads used the ghdrop skill. No unrelated issues/PRs touched.

VERDICT: SUFFICIENT