# Final independent proof audit — pass 3

**SUFFICIENT for the scoped server-preview close behavior.** All four priority full-app omissions from pass 2 are now supported by raw running-app evidence. This is a proof-sufficiency verdict, not correctness approval, exhaustive fault coverage, or a merge recommendation. Independent code-review A and B remain **ABSENT**.

Reviewed [#23537](https://git.cafe/pingdotgg/t3code/pulls/23537) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/23537)), branch `fix/issue-23513`, exact head [3926acc0d4](https://git.cafe/pingdotgg/t3code/commit/3926acc0d4d70d95a5e8747bfacec032a0253ebd), against local `origin/main` [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121fe65669d5d43d011b48cd3027a4108). Worktree `/home/ubuntu/wt/pr-23537` is clean at that head. No remote refresh or PR-state polling was performed; these are the supplied exact revision and existing base ref.

## Basis and independent inspection

Read the complete final diff: `ServerBrowser.ts` and `ServerBrowser.test.ts`, 139 insertions / four deletions. Followed `dropTab`, its dialog listener, page close/crash listeners, context removal, idle sweep, automation close, manager event consumer, WebSocket handler, and manager close publication. Production blob is `e212e495fd6f3415eb8ef11d841bf1242d33c82f`. The diff adds graceful beforeunload close, closing-time guard acceptance, delayed isolated-context disposal, pending-dialog bypass, and a configured five-second fallback attempt. No rendering changes: visual matrix is empty.

Read both prior audits, original before/after transcripts and events, the original and independently repeated service-harness transcripts and script, and the new full-app report. Inspected `capture.mjs`, successful raw transcript, both failed capture attempts, cleanup record, and checksum manifest directly from `fullapp-evidence.tar.gz`. All six archive member hashes match the manifest. Archived transcript/report are byte-identical to `fullapp-transcript.jsonl` / `fullapp-report.md`. The manifest is an integrity check, not independent execution attestation.

The successful transcript contains 678 JSONL rows, eight successful assertions, four preview.open requests and four preview.close requests with matching Success responses. It records the exact requested head and clean status before/after. The script actually spawns `node apps/server/src/bin.ts serve --base-dir .../fullapp/state`, authenticates through the real bearer-to-WebSocket-ticket HTTP endpoint, and opens `/ws` with `wsTicket`. Production `ws.ts:2907` calls `previewManager.close`; the manager publishes `closed`, and the real ServerBrowser consumer reaches `dropTab`. Close RPC completion alone is not treated as physical page completion.

The fresh T3 home contains a launcher wrapper that forwards Chrome arguments and adds loopback CDP debugging. External CDP installs the fixture and observes actual app-owned targets. It does not close a target, answer a dialog, dispose a context, or replace production services. Actual close/disposal commands come from production Playwright protocol diagnostics. This satisfies full-running-server-app proof; it does not claim client UI interaction or provider MCP integration. The ephemeral thread ID is a preview namespace, not an agent session.

No runtime or tests were repeated in pass 3. Pass 2 already independently reproduced the real production-service harness: nine passing assertions, no failure, real Chromium and forwarded observation wrappers. That remains supporting independent reproduction, distinct from the new full-app capture. Mock tests are corroboration only and do not fill runtime gaps.

## Final affected-row matrix

“Sufficient” below means the stated observation, within its qualifications. Before/after runtime for the reproduced listener regression is reused from pass 1. Guard and cleanup rows establish after-state postconditions; there is no claim that every preservation/fault case was independently run on base or failed there.

| Row / fixture | Runtime evidence checked | Final row verdict |
| --- | --- | --- |
| Baseline isolated listener, with/without activation | Existing before transcript: pagehide and visibilitychange receipts, missing beforeunload in both app attempts; installed-host tool run corroborates | **Sufficient scoped before baseline.** Broader issue allegation that all lifecycle events disappear was not reproduced. |
| Fixed isolated listener without activation | Existing after transcript/events: repeated run receives all three; first attempt receives only pagehide. Touched production/test blobs identical at ancestor capture and final head | **Sufficient positive after example**, reused. Universal delivery/reliability remains unproven. |
| Activated unsaved-changes guard, shared | Existing real app production stream activation, all three receipts and close Success | **Sufficient observed guarded-close outcome**, reused. Direct dialog.accept instrumentation is absent. |
| Activated guard, isolated | Existing real app stream activation, all three receipts and close Success | **Sufficient observed isolated guarded-close outcome**, reused. Ordering is separately proved below. |
| Dialog pending before close, shared | Full-app lines 367–383: confirm observed before request; production Target.closeTarget for that same target; targetDestroyed; sibling responds; no dialog-answer operation | **Sufficient full-app proof. Priority gap closed.** Confirm represents the pending-dialog branch; alert/prompt variants are not individually exercised. |
| Finite delayed unload, isolated context ordering | Full-app lines 630–651: distinct incognito context, finite handler start/end, context present during handler, target detach/destruction before production context-disposal command, then context absent | **Sufficient full-app ordering proof. Priority gap closed.** Finite synchronous work only, not arbitrary async unload promises. |
| Frozen isolated renderer | Existing app transcript: close returns in 85ms; renderer immediately present and absent at six-second observation | **Sufficient prompt-return/eventual-cleanup example**, reused. No exact deadline established. |
| Shared sibling survives pending-target close | Same actual browserContextId; same sibling variable evaluates after targetDestroyed, full-app lines 259, 367–383 | **Sufficient full-app preservation proof. Priority gap closed.** |
| Shared sibling survives frozen fallback | Same actual context; sibling evaluates during freeze after RPC return and after target destruction; full-app lines 491–512 | **Sufficient full-app fallback/preservation proof. Priority gap closed.** Context teardown cannot explain target removal while sibling survives. |
| Five-second fallback attempt | Actual production Page.close and later Target.closeTarget for frozen target; full-app lines 497/506. Prior independent harness observes 5003.928ms between close calls | **Sufficient for configured grace and observed fallback**, not exact timer scheduling or a completion bound. |
| Explicit timer cancellation after normal close | Fake-clock test checks zero timers; no production timer schedule/cancel instrumentation. No fallback recorded for normally closed isolated target | **Runtime cancellation proof absent; lower-priority limit.** Absence of a diagnostic command does not itself prove clearTimeout ran. |
| Ordinary shared page without unload listener | Full-app sibling cleanup lines 653–661: graceful Page.close, target destruction and successful RPC | **Sufficient ordinary full-app close example.** |
| Already externally closed page / idempotent cleanup | Prior independently reproduced harness externally closes target, observes real close event, manager.close again, and responsive sibling | **Sufficient service-level example; full-app external-close row absent.** Secondary integration gap, not crash proof. |
| Actual renderer crash cleanup | Source close/crash common helper inspected; no actual crash capture | **Runtime absent; lower-priority gap.** No crash guarantee established. |
| Initial graceful-close rejection and unconditional retry | Source catch/retry visible; no controlled initial rejection in either capture | **Runtime absent; lower-priority fault gap.** External-close behavior and frozen fallback are not substitutes. |
| Idle expiry, context removal, explicit agent-automation close trigger integration | Common helper/callers inspected. App RPC/manager event route exercised; service harness exercises broker open and manager close | **Separate trigger captures absent.** No exhaustive trigger, provider-MCP, desktop, mobile, relay/tunnel, or client-entry-path claim. |

## Raw ordering and claim boundaries

Pending confirm target is `873587797FF930A2321E847251EF028F`; it shares context `C8635E175738EA918B4BB8FC544DD461` with sibling `36E0A675FE82C521C6E3226D601FD325`. Confirm is externally observed at 12512.820ms. Close request is 12513.098ms; production Target.closeTarget is 12517.511ms; RPC return is 12519.173ms (6.076ms latency); targetDestroyed is 12521.664ms; sibling assertion is 12523.655ms. Production receives the dialog notification and then chooses unconditional target close. No Page.handleJavaScriptDialog is present. This establishes the pending-dialog behavior beyond a modeled branch assertion.

Frozen target `5F989735BA24FBCE121B25DFC80BB413` shares that context. Freeze-start precedes the close request at 12738.870ms. Production graceful command appears at 12745.072ms; RPC returns in 7.556ms; sibling responds at 12747.994ms. Production force-close is observed at 17741.673ms; targetDestroyed at 17746.542ms; sibling responds at 17748.874ms. The script reports 5008.037ms from its pre-close timestamp to post-destruction observation. The diagnostic send-to-send interval is 4996.601ms: stdout/pipe observation timestamps are not precise timer timestamps. It does not prove an early timer firing, exact boundary, or universal five-second completion. Source configures 5000ms before an attempt; prior real harness timing corroborates nominal scheduling.

Delayed target `6EBA9D7AF8575FFFE5EBADBC3CCF6905` uses context `22A06CF55EAB672BE57CFD6D7A99F8AC`, distinct from shared context and selected with profileId incognito. Graceful command is 17968.029ms; handler starts at 17969.491ms; real context enumeration at 17971.836ms still includes it; handler ends at 19771.694ms. Production target detach is 19774.079ms, external targetDestroyed 19777.494ms, production Target.disposeBrowserContext 19777.911ms, and context absence 19781.446ms. Same-target/context mapping plus production command order supports the required page-before-context disposal, not just beacon arrival order.

The legacy runtime artifact's phrase “Production close bounded5s; normal close clears timer” overstates what that transcript alone proves. Treat it as superseded by these qualifications. The supplied PR description already disclaims universal beacons and uses a six-second observation; its five-second language is accepted solely as configured grace before force-close attempt. Neither updating an immutable old artifact nor adding fault/crash/cancellation runs is needed for this scoped verdict. Any claim of exhaustive branch proof, guaranteed timer cancellation in real runtime, universal lifecycle delivery, or a hard completion deadline would remain **INSUFFICIENT** on this evidence.

The new priority rows are postcondition/preservation proof, not additional paired base-regression captures. If the acceptance bar instead requires a literal separate base-and-head run of every row including preservation and fault rows, that stronger bar remains unmet. This verdict uses the scoped acceptance boundaries recorded in passes 1/2 and the requested reuse of already sufficient evidence; it does not relabel source inspection or tests as base runtime.

## Independent reviews, friction, cleanup

Independent A code review: **ABSENT**. Independent B code review: **ABSENT**. The three proof audits and capturer's report supply no such verdicts. Prior marker-only bot approval is not a substantive independent review. No correctness approval or merge-readiness conclusion is implied.

FRICTION: The full-app archive preserves two failed setup attempts: wrong WebSocket query key (`ticket` rather than `wsTicket`), then wrong assumption that omitted profile meant isolated context. Final script corrects those external capture settings; final raw observations pass. Neither failure is evidence of a product regression. The successful server takes about ten seconds after SIGTERM to exit with application interruption code 130, with cleanup completed. No reproduction was needed in this pass. A bounded local search for upload manifests encountered an unrelated protected /tmp directory and found no additional manifest; this did not block artifact inspection or the audit upload.

All recorded server/Chrome PIDs from the three app attempts are independently absent in /proc; fullapp scratch/state is absent. Prior independent harness cleanup is retained. No processes or scratch were created for this pass; only this requested deliverable was written. Worktree remains clean. No code edits, commits, PR edits/comments, push, merge, watch, browser launch, new runtime, tests, or PR polling. Harness-required app PR registration/listing succeeded and reports watching=false. Deliverables are retained for parent cleanup. Upload contains this sanitized audit only, not state, credentials, environment secrets, or customer data.

**VERDICT: SUFFICIENT — no unresolved priority scoped-proof rows. Disclosed unproven rows: real-runtime timer cancellation, controlled initial-close rejection/retry, actual crash cleanup, full-app external-close/idempotence, and separate idle/context-removal/agent-trigger integration. Independent A/B correctness verdicts remain absent.**