# Independent proof audit — pass 2

**VERDICT: INSUFFICIENT under the requested full-app proof condition.** The newly missing priority rows now have credible, independently reproduced production-service harness evidence with real Chromium. They still have no full HTTP/WebSocket application capture. This is an evidence verdict, not a code-correctness or merge verdict.

PR [#23537](https://git.cafe/pingdotgg/t3code/pulls/23537), head [3926acc0d4](https://git.cafe/pingdotgg/t3code/commit/3926acc0d4d70d95a5e8747bfacec032a0253ebd), branch `fix/issue-23513`. Local `origin/main` is [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121fe65669d5d43d011b48cd3027a4108). Read-only evidence audit performed 2026-10-22 UTC in `/home/ubuntu/wt/pr-23537`. Complete final diff inspected: two files, 139 insertions and four deletions. No code, PR, comment, review, merge, push, watch, or PR polling actions. App-owned PR linking was required by the harness and performed; linked state reports watching=false.

## Evidence classification and identity

Read `audit-pass1.md`, original before/after transcripts and final events, and all five new runtime deliverables including raw JSONL and capture/reproduction source. Checked changed production control flow and callers for matrix completeness. Existing ancestor production and test blob identities are sufficient and reused; no repeated baseline/guard/beacon run was needed. Final production blob is `e212e495fd6f3415eb8ef11d841bf1242d33c82f`; final test blob is `e41a80d66f5049cb6f3e66a7e52150ffbcfcc107`.

Three evidence classes remain separate:

- Existing full-app narrated captures: isolated dev app and production preview stream/commands, listener delivery, activated guards, isolated frozen eventual cleanup. Their limits from pass 1 remain unchanged.
- New production-service harness: real ServerBrowser/Contexts/Broker/Manager layers, real headless Chromium/CDP/pages/timers; static environment/executable injection, production test-config helper, direct Playwright fixture installation. No HTTP/WebSocket app or client UI is started. Context/page observation wrappers forward real calls unchanged. This is substantial runtime evidence, but it cannot establish application transport/session integration.
- Mock unit tests: model beforeunload, guard acceptance, deferred page close and fake-clock boundary. These do not prove Chromium behavior or full-app execution. This pass did not rerun them, lint, or typecheck.

No changed visual path: pixel proof, screenshots, mobile viewport, and native desktop UI captures are inapplicable. Native desktop close remains its separate branch; no new desktop behavior is claimed. Remote/local clients and agents reach the same server lifecycle, but service calls alone do not prove those entry paths in the running application.

## Complete affected runtime matrix

| Row | Actual evidence checked | Assessment under full-app condition |
| --- | --- | --- |
| Baseline listener-only isolated, unactivated/activated | Existing before transcript: pagehide/visibilitychange receipts, missing beforeunload | Reuse sufficient scoped baseline. Broader issue omission claim not established. |
| Fixed listener-only isolated, no activation | Existing final transcript/events: successful repeated all-three receipt run, first attempt incomplete | Reuse sufficient positive full-app example; universal delivery/reliability remains unproven. |
| Activated unsaved-changes guard, shared | Existing full-app production stream activation and successful close with receipts | Reuse sufficient behavioral guard outcome; direct accept-call instrumentation absent. |
| Activated unsaved-changes guard, isolated | Existing full-app stream activation, close and receipts | Reuse sufficient normal outcome; does not prove ordering. |
| Dialog already pending when close starts | New JSONL confirms real pending confirm via broker status; close uses runBeforeUnload=false, real page closes with no answer; reproduced | Harness row satisfied; **full-app row still missing**. Confirm is a representative pending-dialog branch, not exhaustive alert/prompt proof. |
| Finite delayed graceful unload, isolated context ordering | New JSONL and reproduction: synchronous finite handler; page/context open during work; page close before context close | Harness row satisfied; **full-app row still missing**. No claim about awaiting arbitrary asynchronous unload work. |
| Frozen renderer, isolated | Existing full-app close returns in 85ms; renderer remains immediately, absent at six-second observation | Reuse sufficient prompt-return/eventual cleanup; no exact deadline proof. |
| Shared context/sibling preservation, pending target | New real same-context sibling evaluates after target closes; reproduced | Harness row satisfied; **full-app row still missing**. Shared guard outcome alone did not establish sibling survival. |
| Shared context/sibling preservation, frozen fallback | New real frozen target, unconditional fallback, target disappearance and responsive sibling before/after; reproduced | Harness row satisfied; **full-app row still missing**. Shows fallback independently of isolated-context teardown. |
| Grace boundary / fallback timing | Raw first/repeated runs show fallback attempts at 5002.431/5003.928ms after initial close | Real harness timing samples support configured grace before attempt; exact full-app timing remains unobserved. No guaranteed five-second completion bound. |
| Timer cancellation after normal close | Fake-clock coverage; finite page has no fallback before overall scope ends, more than five seconds after initial close in both captures | Consistent with cancellation, but no timer schedule/cancel observation. Explicit runtime cancellation proof still absent. Do not infer it from silence alone. |
| Ordinary shared page with no unload listener | Sibling's normal close at end of harness completes without fallback | Harness coverage present; ordinary full-app no-listener close row not separately narrated. Secondary gap. |
| Already externally closed page / idempotent cleanup | Real CDP Target.closeTarget; close event, production close on isClosed=true, repeated manager.close return, sibling alive; reproduced | Harness external-close coverage present, **full-app external-close row missing**. Not crash proof. |
| Crash cleanup | Common changed dropTab path from crash listener inspected; no actual crash capture | Runtime row absent; secondary coverage gap. |
| Initial graceful-close rejection and unconditional retry | External-close run logs second close on already-closed page, but no rejection reason or controlled initial fault | Controlled fault row absent at both harness and full-app levels. Do not promote external cleanup to transport-fault proof. |
| Other dropTab entry triggers (manager close, idle expiry, explicit automation close, context removal) | Shared helper and callers inspected; manager close exercised, existing app close reused | No separate narrated idle-expiry/context-removal capture. Common-path reuse supports lifecycle logic, not complete trigger-integration proof. These are secondary integration gaps if complete trigger coverage is required. |

The exact priority full-app omissions are pending-dialog close, finite delayed isolated page/context ordering, pending shared sibling survival, and frozen shared sibling survival. New external-close and timing samples also remain harness-only. The lower-priority fault, crash, explicit timer-cancel and unexercised trigger observations must remain disclosed; they are missing evidence, not confirmed defects.

## Raw capture claim verification and independent reproduction

Original new report times match JSONL: pending status 850.929; false beforeunload option 852.012; target close 854.915; sibling check 857.684. Delayed start/end 1048.273/2848.516; page close 2849.695; context close call/event 2849.971/2855.512. Frozen initial/fallback calls 3023.775/8026.206; target close 8034.213; sibling check 8042.127. External target closes 8128.480; sibling check 8132.762. No failure or false assertion appears. The script confirms absence of explicit dialog answer; the production dialog listener retains pending confirm instead of accepting it. Report language accurately discloses service scope and fault/timer limits.

Independently invoked the supplied unmodified `bash /tmp/pr23537-evidence/runtime-reproduce.sh` from the requested worktree. It runs the complete compact harness, so all four new scenarios repeated rather than just one. Node v26.12.1, Linux x64, same final head/blob, installed headless Chromium path pinned to 154.0.8037.92, explicit sandbox opt-out as supplied. Successful process exit; all nine behavioral assertions true. No full app or UI opened.

| Observation | Original run | Independent run | Delta / implication |
| --- | --- | --- | --- |
| Pending close command latency | 2.187ms | 3.348ms | +1.160ms; returns before actual close in both |
| Pending request to actual page close | 3.747ms | 5.694ms | +1.947ms; no dialog answer, sibling survives |
| Finite handler console start to end | 1800.243ms | 1803.408ms | +3.165ms observation variation; synchronous 1800ms fixture |
| Page close to context.close call | 0.276ms | 0.477ms | Same required order |
| Page close to context close event | 5.817ms | 9.713ms | Same required order |
| Frozen graceful to force-close call | 5002.431ms | 5003.928ms | +1.497ms; attempt scheduling sample, not completion deadline |
| Frozen graceful call to page close | 5010.438ms | 5018.036ms | +7.598ms; sibling remains responsive |

Independent capture UTC 10:33:48.799–10:33:57.513; monotonic scope.closed at 8746.008ms. Original scope.closed at 8197.374ms; +548.634ms total includes startup and fixture overhead, not a lifecycle regression inference. Raw values include instrumentation/transport overhead.

[Independent raw transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/38fc34e24dc0d9a2/runtime-transcript-repeated.jsonl). [Cleanup verification](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2b70a57becda1f3d/audit-pass2-cleanup.json). [Original capture report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bde3450218670963/runtime-report.md). [Original raw capture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/64274713c649572a/runtime-transcript.jsonl).

## Independent A/B code-review gap — separate

Independent code-review A: ABSENT in supplied evidence. Independent code-review B: ABSENT in supplied evidence. Pass 1 and this pass are proof audits, not independent correctness reviews. The runtime capturer explicitly disclaims a review verdict. Previously recorded Macroscope marker-only approval is separate bot metadata, not a substantive independent A/B review report. No review conclusions are invented here; this pass did not request reviewers or perform a new PR-state poll.

## FRICTION and cleanup

No reproduction failure. The supplied script requires a currently absent scratch directory/symlink and successful completion for its rm cleanup; both prerequisites held. Its failure trap kills only the captured harness PID, so failure would warrant additional owned-browser cleanup; that failure path was not exercised. Current capture completed production scope finalization/context close; captured PID 2247692 is absent, fixture port 45877 refuses connections (111), scratch runtime directory is absent, and worktree is clean. Deliverables remain in `/tmp/pr23537-evidence` for the lead. No live data, credentials, .env, or customer data were copied or uploaded. No image evidence is needed. Used the ghdrop skill for the explicitly requested public evidence upload.

**VERDICT INSUFFICIENT:** service-level missing-row proof is now strong and reproducible, but the four named priority rows still lack the stipulated full-app capture. Lower-priority missing observations and independent A/B code reviews remain separate disclosed gaps.