# Proof audit pass 2 — issue 27402

Read-only source/proof review, begun 2026-10-30 08:15 UTC, finished within the 45-minute budget. No source edits, installs, pushes, forge comments, PR, or checkout changes. A dev server and real Codex GPT-6-Astra / Medium seed turn were used as authorized.

## Findings

1. Capture-head equivalence is contradicted. The requested path-limited diff from capture commit 8f66a27e8d to merge head 1b1acc1bc9 is not empty: 39 files, 613 insertions, 179 deletions. The two iframe components themselves differ only in lint comments, but packages/shared/src/htmlRender.ts also changed: BASE_CSS now sets box-sizing:border-box;padding:8px on html. This is a shared rendering dependency and changes the fixture's inset and height. The old captures cannot establish pixel equivalence at the merge head. Source command output is preserved in provenance.txt.

2. The independent R4 rebuild at merge head does not match after-R4-final.png. At identical stated browser/viewport/theme settings, the rebuilt frame is 87px high versus the delivered 80px and its contents are inset by the new 8px gutter. The neutral paste target moves with the frame. Of 1,024,000 pixels, 37,129 differ at zero threshold and 18,790 differ above max RGB delta 16/255 (max delta 240; zero-threshold bbox x42,y49,x693,y423). Additional static text rasterization differences are visible; the total is not attributed solely to padding. The geometric difference is clearly beyond anti-aliasing. Clipboard behavior still passes: real Copy, copied status, actual Ctrl+V, exact echo hello-27402. Two settled rebuild PNGs are pixel-identical.

3. Delivered R1-final-diff0.png / diff16.png, R2-final-diff0.png / diff16.png, and R3-final-diff0.png / diff16.png include unrelated Worked for 19s versus 35s pixels. evidence.md discloses this correctly, but the audit brief explicitly disqualifies unrelated diff noise. R2-dialog is free of this particular noise. Recapture with controlled surrounding content is needed under that rule.

4. before-R1.mp4 around 3.0 seconds clips the second line of the new error text at the old iframe height. It expands by the following sampled state around 3.5 seconds; the settled final capture is readable. This is an artifact-quality failure under the brief's strict no-clipped-frame rule, not evidence of a clipboard-fix regression.

## Row results

| Row | Status for submitted merge head | Observed coverage |
| --- | --- | --- |
| R1 | INSUFFICIENT | Both real-app recordings show idle, Copy, failure/copied, and sentinel/exact unsent paste. Duration noise, brief before-recording clipping, and stale rendering dependency remain. |
| R2 | INSUFFICIENT | Both real dialogs open, start idle, receive the actual page Copy click, close, and paste exact/sentinel into the unsent composer. Both dialog and final pairs exist; final pair has duration noise and captures predate the wrapper change. |
| R3 | INSUFFICIENT | Correctly labelled panel-state harness; clicked page Copy in right panel, not toolbar Copy contents. Both outcomes and unsent paste are shown. Duration noise and stale rendering dependency remain. |
| R4 | INSUFFICIENT for merge-head proof | Historical component harness clearly labels that no Connect invite, redemption, session, guest route or guest CSP is verified. This expected limitation is correctly disclosed and is not a finding. Independent merge-head rebuild has non-AA pixel differences. |

## Inspection coverage

Opened all 10 delivered before/after stills, all 10 delivered threshold diff images, all five comparison sheets, and all eight delivered filmstrips. Independently decoded each complete MP4 into a 2fps sequence and visually inspected every resulting contact sheet, including idle/click/status/paste/open/close segments. This is sampled visual inspection, not a claim to have inspected every encoded frame. All videos are H.264, 2880x1800, with no audio track; narration is the written timestamp table. Observed narration matches the steps. Settled captures have no duplicated/ghosted elements, stale overlays, loading skeletons, blank/unrendered text, or wrong viewport/theme. The dialog's large unused area is expected from the intentionally short fixture. The blue cursor ring marks clicks rather than app loading.

All columns use baseline 1cf14a498f and capture head 8f66a27e8d correctly. Baseline is the capture commit's merge base. Minimum matrix is 1440x900 CSS px, dark; no light/narrow requirement was omitted. PNGs are the disclosed 1280x800 tool downsample, videos retain DPR2 dimensions. No native Electron/mobile verification is claimed. Code's only fix behavior at capture commit is clipboard-write iframe permission in both owner and guest components.

Recomputed both threshold diffs pixel-for-pixel for every pair; delivered diff images match their generators and metrics. Counts (nonzero / >16): R1-final 15027/8518; R2-dialog 9098/6766; R2-final 15027/8518; R3-final 10518/7869; R4-final 33972/27969. The reported before-inline 92px versus after80px, consequent 12px label/done shifts, and turn-duration difference match the images and code. The new head's 8px wrapper gutter is absent from that historical what-else-changed list because it postdates those captures.

## Rebuild procedure and limits

Ran T3CODE_DEV_SEED=0 vp run dev from /home/ubuntu/wt/issue-27402, with no checkout change. Used existing isolated worktree .t3 state; never wrote to live home state directly. Web port7369/server15409. Downloaded uploaded seed/capture drivers and both harnesses into this scratch directory. Seeded the exact fixture through a real agent turn, served by the actual head server with CSP sandbox allow-scripts allow-forms allow-popups allow-downloads. Browser iframe allow remains clipboard-write. No browser security disablement or child-specific policy grant.

Rendering environment: Chromium156.0.0.0 on Linux x86_64, T3 preview fs-39, 1440x900 CSS px, dark, DPR2, no device emulation, 100% font scaling/browser zoom, normal context clipboard-write grant, top-page clock fixed to 2026-10-30T08:00:00Z. Fonts loaded. Reduced-motion unavailable as in delivered environment. Browser confirmation saved via rebuild-results.json; actual harness iframe width728/height87. The real asset has 7641 bytes and SHA256 e1e18339157b3b6db9e02002a677e2ae6f0ddd1cf891401cf6f8a37b19411057; exact fixture body is unchanged. A model-supplied doctype/meta wrapper and the server's new BASE_CSS account for asset nonidentity; no script logic was substituted.

Seed-driver's final wait requested120000ms, beyond preview's60000ms cap, after already submitting. Continued waiting for that existing turn rather than resubmitting. The seed driver revisited an existing proof thread rather than a blank thread; new fixture was independently published. Adapted open-panel harness's iframe selection to exact title Clipboard proof 27402 because an older fixture preceded it. R4 component harness script itself was unchanged. The covering harness left older underlying page accessibility entries, causing two exploratory capture clicks to target an offscreen Copy. For the successful run hid only the fully covered #root (display:none, aria-hidden/inert); its pixels were already behind the fixed opaque harness. Ran uploaded captureOwner unchanged for R4 into a new timestamped directory. This preserves the measured target component, asset URL, clipboard logic, layout, and sandbox. Failed exploratory recording retained separately; it is not accepted proof.

Successful recording timeline is in rebuild-results.json; final still and probe are in run-20261030T0823. Rebuild comparison has delivered capture upper left, current-head rebuild upper right, zero-threshold diff below left, >16 diff below right. Pixel deltas use whole PNGs with no masks, crops or transforms.

## Cleanup and friction

Owned tab closed. The turn interruption ended the owned exec session and dev processes; verified both owned listening ports clear and all captured PIDs absent. No emulator/lease/worktree was created. Lead worktree, existing .t3 state, and scratch parent retained. Code status clean. Credentials/startup pairing URL removed from published server log. Own scratch removed only after uploading this archive and rebuild evidence. No test suite rerun; lead owns check:changed.

FRICTION:
- brief | handoff asserted no touched-file changes and equivalent head rendering, contradicted by path diff and shared HTML gutter | validate capture provenance across rendering dependencies before handoff.
- tool | seed driver's 120000ms wait exceeds preview's 60000ms cap after submission | cap waits and resume the submitted turn.
- tool | bounded accessibility snapshot plus underlying covered proof thread selected offscreen Copy twice | scope capture locators to the harness, or hide covered app from accessibility before capture.

VERDICT: INSUFFICIENT R1, R2, R3, R4