# Final evidence audit PASS3 — [#24270](https://git.cafe/pingdotgg/t3code/pulls/24270)

AUDIT: PASS

Audited head: [031cc6ed7d](https://git.cafe/pingdotgg/t3code/commit/031cc6ed7dd7e1cc9a6c3b8e16f1a2e12d38840c). Base/merge-base: [d14ace8233](https://git.cafe/pingdotgg/t3code/commit/d14ace8233ad3cf7856b6b834824f888240d67a1). Full scoped PR diff: **7 files, +798/-96**. Current tests: **10 cases in 1 file**. Working tree clean. The seven scoped files are byte-for-byte unchanged between the reviewed retention fix [a23bf91eef](https://git.cafe/pingdotgg/t3code/commit/a23bf91eef2a0e6cb8b3262c4741e87e483a94e3) and the integrated head.

Read-only evidence audit of the body draft, final validation log, prior evidence audit, current test assertions, retention implementation and test configuration. No source/PR edits, push, merge, rebase, branch deletion, watcher, installation, native launch, browser, remote machine or live userdata access occurred in this pass. Only this requested report was written. All shell work used /home/ubuntu/wt/pr-24270 on fs-16; requested report inputs/output live in /tmp.

## Draft precision verdict

The current appendix correctly supersedes historical baseline wording, obsolete test counts and iPhone attribution. The original body MUST remain exactly as instructed by the user. PASS2's request to delete or rewrite those historical lines is withdrawn under that explicit instruction. This pass did not retrieve an authoritative original-body copy or independently byte-compare it; preservation is a parent responsibility, and no draft edit was made here.

The appendix accurately states immutable environment/workspace-keyed state, visit-scoped requests, restoration/revalidation, structured missing-root reset versus transient preservation, eight-workspace retention, coordinated 64-path pruning for inactive workspaces, active visible-listing retention, and hook-lifetime limits. Departures apply the cap to expanded paths as well as directory cache metadata. Native captures are explicitly UNVERIFIED and nonblocking under the user's scope. The current draft distinguishes synthetic production-transformed logic from native execution and real transport. Identical leaf paths and real file modifications are correctly disclosed as unverified.

FINAL_AUDIT_LINK, FINAL_LOG_LINK and FINAL_AUDIT_VERDICT are intentional publication placeholders for the parent to fill after upload. They are the only required publication follow-up identified here. Failing-first counts and review outcomes remain attributed historical phase reports, not independently rerun evidence. Round 4 MERGE/MERGE is supplied by the parent; this evidence audit does not independently re-review those rounds.

## Refreshed synthetic fixture matrix

A = /first, B = /second; E1 = first, E2 = second with the same cwd. Both targets share src and use distinct first.ts/second.ts leaves. These are React DOM/jsdom fixtures, not a native device matrix. Before-source descriptions below retain PASS2's analysis; this pass did not rerun baselines.

| Scenario | Baseline limitation | Final proof | Limit |
| --- | --- | --- | --- |
| Immutable snapshots | Render-local mutable collections and forced renders. | Earlier loading/loaded snapshots remain unchanged after subsequent updates. | Hook method actions, no native row presses. |
| A → B → A and B view changes | No retained per-target expansion/selection history. | Two parameterized cases cover cwd and environment-only switches, request envelope, clean B state, distinct entries, independent selection/expansion and restoration in both directions. | Shared src directory; identical leaf-path collisions and real file edits unverified. |
| Same cwd across environments | No environment-keyed retained view cache. | Environment-only variant verifies routing/isolation/restoration; source key is JSON [environmentId,cwd]. | Query/transport mocked; no local/remote/relay/tunnel execution. |
| Late directory success/failure after A → B → A | No retained visit-state model. | Deferred stale success/failure cannot overwrite current entries/error/loading; current completion settles. | No dedicated refresh-vs-refresh or root/search race test; real cancellation unverified. |
| Delete and recreate directory tree | No explicit retained-history reconciliation. | Truncated empty root preserves history; authoritative empty root clears descendants, expansion and selection; restored src has no old descendants. | Synthetic root response, not a real filesystem deletion or isolated nested-parent deletion race. |
| Missing workspace and transient failure | No structured missing-root history reset. | Two cases cover return and typed workspace_root_not_found with previous success; transient error preserves history, typed missing root clears it, subsequent successful response starts clean. | Production query wrapper is compiled, but AsyncResult and error are synthetic, not RPC-decoded. |
| Selection reveal and keyed browser remount | Browser-local expansion could re-expand on remount. | Two collapse/delete cases exercise compiled hook/browser effects, ancestor reveal, collapse across B → A keyed remount, and selected-path removal. | Hook stays mounted; native views/list stubs. No full hook/navigation-unmount persistence. |
| Active retention, departure pruning and workspace eviction | No bounded retained workspace history. | One case expands 66 parent/child pairs plus src: exactly 133 requests, 133 loaded and expanded paths while active, pending false. After departure/return, union of loaded and expanded paths is ≤64, evicted parents retain no children, earlier active snapshot remains 133, selected path retained. Return loads settle and rerender adds no requests. Eight other workspaces evict A, returning blank view state. | Deterministic counts/effect settling, not native CPU/timing evidence. Selected path is separate from the directory-path pruning budget. Old evicted history is intentionally discarded. |

The final eviction case replaces PASS2's former 65-loaded/33-expanded collapsed-history description. Those old exact counts are not final-head assertions. Active visible listings are preserved; departure uses preserveVisible=false to cap even expanded paths.

## Validation and counts

Accepted final evidence: /tmp/pr-24270-final-validation.log, at the integrated head above. No test rerun was necessary for this evidence-only pass.

- From apps/mobile: vp test run --project react src/features/files/useFileTreeEntries.test.tsx — PASS, 1 file / 10 cases, FOCUSED_TEST_EXIT=0.
- From apps/mobile: vp run typecheck — PASS, TYPECHECK_EXIT=0.
- From apps/mobile: targeted vp lint and vp fmt --check on all seven changed files — PASS, LINT_EXIT=0 and FORMAT_EXIT=0.
- Scoped git diff --check — PASS, DIFF_CHECK_EXIT=0. Log and fresh inspection show clean working tree and no integration changes to the seven reviewed files.
- Test configuration uses Expo production iOS transform with React Compiler support. Hook, query wrapper and browser logic run in React DOM/jsdom with native components and query/transport mocked. This is not an Android/iOS build or device run.
- Android/iOS native flows: UNVERIFIED, explicitly allowed. Android tooling absence is accepted from prior evidence; iOS unavailable on Linux. No tooling re-probe, install, remote fallback or launch performed.

## Surface coverage

Mobile tree route, directory route and navigator pane use hook-owned state; route/pane selection and reveal are within scope. Web/desktop have independent implementations and restoration parity is not established here. Contracts, server and provider adapters are unchanged. Agent/MCP capabilities and scheduled tasks are unaffected. Switching back, collapse, removal and recovery receive synthetic proof, bounded by retained-cache and mounted-hook lifetime. Real connection modes and native navigation remain unverified. No documentation change is required for this state correctness fix.

## Friction and boundaries

- Local main is stale. An initial main...HEAD stat was noisy and immediately discarded; all substantive final counts use origin/main...HEAD at the confirmed merge-base. No repo-wide checks ran.
- A search for nested apps/mobile AGENTS.md returned no matches; root local AGENTS.md was read.
- No auth, secrets, permissions, approvals, runtime, interaction, sandbox, trust or MCP-surface hard stop encountered. PR linking and final listing succeeded; watching=false. No forge CLI or credentials were needed.
- Artifacts inspected contain synthetic paths, commands, commit identifiers and check output; no credentials or live userdata were observed. Parent owns upload, placeholder replacement, preservation of the original body, any PR update and normal push. This pass makes no claim that the local integrated head has already been pushed.