# Issue 24096: read-only proof audit, pass 2

VERDICT: SUFFICIENT for the exact ordinary delegated-question attention bug on the demonstrated web/Codex path, under the corrected async policy. INSUFFICIENT for the full focused matrix or a claim that every affected surface/integration is verified. This is evidence acceptance, not merge approval or an independently rebuilt release certification.

Audited 2026-10-25, within the 20-minute budget. No source edits, checkouts, installs, new tests, server/browser/device starts, database writes, forge operations, pushes, merges or watches. Only scratch audit artifacts under `/tmp` and the requested public report upload were produced. Source was clean on entry and rechecked clean before completion.

## Scope and provenance

- Checkout HEAD is [fa25715dd2](https://git.cafe/pingdotgg/t3code/commit/fa25715dd22f36b375cb5a4fb4613b6d17d8ac6e), full SHA `fa25715dd22f36b375cb5a4fb4613b6d17d8ac6e`. Its commit timestamp is 06:35:48 UTC, before proposed captures. Base/merge-base is [c79ef8c454](https://git.cafe/pingdotgg/t3code/commit/c79ef8c454e1268ff79da5a9dcb74572e86f7861), full SHA `c79ef8c454e1268ff79da5a9dcb74572e86f7861`.
- Read the complete five-file diff: +128/-8. It adds the optional secret discriminator, marks ordinary and secret summaries, changes shared ancestor/list derivation, and adds focused assertions. No provider, notification-delivery, card, navigation or Electron bridge implementation changed.
- The [delivered evidence report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5bdffe3ceeee0a12/evidence-report.md) was downloaded with curl and is byte-identical to its local public copy. Every entry in the public `checksums.sha256` passed. Artifact hashes establish package integrity, not a cryptographic binding between screenshots and an executable.
- Proposed commands and sanitized runtime provenance name the exact HEAD/base. Vite startup is recorded; desktop packaging log exists; focused logs report 11 shared tests passing and 2 projection tests passing/42 skipped. These are delivered execution results, not tests independently rerun by this auditor. Projection assertions cover both SQL shells and `threadShellFromProjection` for ordinary false and secret true.
- Baseline handoff, pending snapshot, original recording and source history agree that the accepted first base lifecycle finished before concurrent edits/restarts. Accepted base window is 06:29:09–06:30:32; the later mixed-source own-question control is excluded. The earlier idle toast is corroboration, not proposed-build positive proof.
- **Independent rebuild gap:** no independent build/start or reproduction was performed, as requested. The web evidence is a source-served development run supported by commands, logs, runtime traces and matching source behavior; there is no independently hashed served-bundle attestation. Desktop pack success does not certify web/native delivery.

## Inspection method and inventory

Inspected all 25 delivered public PNGs, including all eight amplified/threshold diffs, using newly generated labeled 640px-wide contact sheets, plus the supplied inspection sheets and focused original images. All five delivered MP4s were independently decoded end-to-end with ffmpeg (exit 0), then visually inspected via independently extracted contact sheets sampled every 12 seconds. This is sampled visual review, not a claim to have watched every frame in real time. Durations: base async 80.37s, proposed async 86.00s, blocking/interrupted-idle 200.34s, resume/idle/controls 159.25s, async completed-parent 174.84s. Checked exact positive-toast stills separately; read runtime events, applied shell transitions and alert trace to resolve transitions between sampled frames. Also inspected the local Electron result/still: it is the disconnected app, not an attention demonstration.

All four threshold images reproduce exactly as a threshold applied to each RGB channel independently (`channel >24`). Parent/card amplification reproduces as contrast x4; blocking boundary/resume amplification reproduces as brightness x4. The report's phrase “max RGB channel difference >24” is inaccurate: that would create a monochrome any-channel mask. This is a diff-method label mismatch, not fabricated content. Diff images contain prompt/title/sidebar/time/population changes and must not be read as isolated pixel regression proof.

## Corrected policy and source findings

[Shared derivation at the audited HEAD](https://git.cafe/pingdotgg/t3code/blob/fa25715dd22f36b375cb5a4fb4613b6d17d8ac6e/packages/client-runtime/src/state/threadShell.ts) first excludes ended/non-subagent/provider-native/auth-refresh cases. Command requests become approval. A nonblocking user-input request is hidden while the **child** is preparing/starting/running, irrespective of parent state. Ordinary `secret:false` questions are additionally hidden while the **direct parent** is working or latest status queued. Otherwise a live child's question escalates. Both ancestor attention and descendant input lists use this predicate. Recursive propagation retains approval precedence and cycle protection.

Thus a completed parent with a working async child is not a missing escalation. “Waiting on subagent” with Show/Stop is a background-work banner, not “Subagent needs input.” Blocking ordinary questions escalate when no parent turn is working/queued. Latest queued overrides waiting activity, as the actual trace demonstrates; it is not an unconditional waiting-activity escalation guarantee while another parent turn is queued.

One compatibility qualification: the early nonblocking-child branch does not inspect `secret`. An old-server request with `blocking:false`, omitted `secret`, and a working child is hidden; tests explicitly expect that. Current secret projection always supplies `blocking:true, secret:true`, which does escalate. Therefore the broad statement “all unmarked old-server questions escalate as before” is too strong for that async shape. This does not contradict the requested ordinary-async policy, but full conservative unknown-secret compatibility must not be claimed. A recapture cannot prove a contrary result from this source.

## Row status

| Focused-matrix row | Status | Evidence supported / remaining limit |
|---|---|---|
| 1. Ordinary real lifecycle | PASS, core | Base running parent shows Input/banner; proposed running/queued parent stays Working while actual async request and pending A/B child card survive. Runtime request resolves to A and child acknowledges/completes. Server summaries carry false/false. Initial proposed negative predates notification enablement, so it proves status/card behavior, not notifications. |
| 2. Unresolved boundary / reverse | PASS, corrected core | Actual blocking request with live response capability remains pending across running/queued suppression → unqueued waiting/completed escalation → resumed suppression → A response/clear. Async completed-parent/working-child suppression separately demonstrated for over two minutes. Tiny initial stopped/request interval in clean idle retry was batched and is not independently resolved by that retry. |
| 3. Human-only positive controls | PARTIAL; attention controls pass | Actual secret true/blocking true and command approval while parent working produce Input/Approval toast and live-region text. Approval banner opens correct pending Decline/Approve card. Secret was cancelled as child finished: no retained secret pending-card/navigation/lifecycle proof. Mixed ordinary/approval count/priority runtime scenario absent. |
| 4. Background attention | PARTIAL | Focused visible Settings observer, blocking Input positive, secret Input positive and approval positive corroborate negative ordinary windows. Own-request toast is delayed until waiting/completion, not immediate at request creation. Repeated alert snapshots are persistent DOM text, not multiple deliveries. Dedicated unchanged-tick/first-load/dedup counts are not proven. OS permission denied; no OS notification, click, badge or sound evidence. |
| 5. Snooze / grouping | PARTIAL, central wake gap | Real one-hour snooze persists and parent moves to Snoozed; subsequent user message clears/wakes it. It does not establish attention-driven early wake, continued snooze across ordinary arrival, attention-based snooze blocking or resulting inbox/settled membership. Timed expiry also unverified. |
| 6. Child access / retention | PASS ordinary and approval; PARTIAL overall | Genuine ordinary pending A/B cards during suppression and blocking card after escalation, correct identity/breadcrumbs, later accepted response. Approval pending card captured. Secret pending card absent; no claim of secret submission or approval completion. |
| 7. Native consumer smoke | UNVERIFIED | Narrow/dark web is web. Infra report records unavailable device access and HTTP 403 native EAS artifacts. No actual native list/strip/card/snooze capture; no iOS/Android integration claim. |
| 8. Electron delivery smoke | UNVERIFIED | Actual built Electron launches with desktopBridge true but shows disconnected environment. Keyring-backed pairing blocked shared-server connection. No Electron parent status/banner, OS delivery/badge/click/audio proof. |

Core acceptance does not imply every subclause of rows 3–8 passed. The literal historical matrix predates the corrected async policy and is not an execution record.

## Trace milestones checked

- Ordinary async: request created 06:38:18.668, resolved 06:39:24.679. Child message confirms A at 06:40:00.298. Parent working/queued plus actual pending false/false summary and visible A/B card distinguish this from a fabricated shell-only negative.
- Blocking: request object created 06:40:49.891; 06:40:49.897 is its persistence/event time, not the same field. Parent latest queued/activity waiting at samples 06:42:23.106 and 06:42:27.450 remains suppressed because a queued parent turn exists. Final unqueued waiting event seq993 occurs 06:42:32.819; completed event seq998 occurs 06:42:32.840. Shell samples seq995/999 arrive 06:42:32.967/06:42:33.450. Input toast/live announcement is observed 06:42:32.905. This supports attention at the waiting boundary but not a frame-perfect ordering before the 21ms provider completion event. Resume sample 06:43:37.761 clears ancestor input with the same child request pending; resolution 06:44:20.487 removes it.
- Async stopped-parent: parent completed events seq1601 (06:51:39.027) and seq1634 (06:51:44.017) precede the long pending interval. Child request created 06:51:40.915. Parent completed/no activity sample seq1635 is 06:51:44.551, with child still running false/false. Recording and still show background-work banner without human question banner. Child waiting event seq1658 at 06:53:47.360 produces Input toast 06:53:47.552; child completed sample seq1670 at 06:53:48.173 then excludes it from ancestor request derivation. A toast may remain visible after its originating attention edge disappears. Later parent response resolves request 06:54:10.867; persisted child/parent completion by 06:54:15.132 supports the ending beyond the recording's final answer-start frames.

The delivered narrative sometimes calls shell-sample timestamps “completed” times. Above distinguishes persisted event timestamps from sampled application times; that correction needs no rerun.

## Exact recapture, only if extending claims

No new test or recapture is required to accept the demonstrated core ordinary-question fix. These are the smallest missing observations if a broader claim is desired, not a request to redo the matrix:

- Secret retention: keep an actual disposable secret request pending with parent working; open its child through the banner and capture correct identity plus the pending secret form before child completion cancels it. No real secret entry is necessary.
- Attention snooze: snooze the already-running parent before child request arrival, retain pending ordinary request, record it staying snoozed, then let an unqueued parent finish with a live blocking child and capture effective wake/inbox membership and blocked Snooze availability. Record applied request/snooze fields at each boundary. Current user-message wake cannot substitute.
- OS/audio/Electron: complete isolated environment pairing in the actual built Electron app; permit notifications, unlock sound, observe ordinary negative then blocking/approval positive while unfocused, badge/click/focus-clear. Current disconnected launch and silent browser MP4 do not support these claims.
- Native: obtain a compatible current-source native client after resolving artifact access, then record live ordinary suppression and blocking stopped-parent escalation, child navigation/pending card and applicable snooze control on one actual native platform. Neither EAS availability nor phone-width web counts.
- Narrow web: delivered dark 390px still proves a reachable Open question banner with truncation. A narrow pending-card navigation claim would need a short click-through capture ending on that form; the supplied full-width card alone does not establish narrow card rendering.
- Diff mismatch: simply relabel the existing thresholds “per-channel >24” and distinguish contrast/brightness amplification, or regenerate the intended max-channel masks from the existing stills. No app recapture needed.

## FRICTION

- Web reader could not open the artifact URL; curl succeeded and byte comparison passed.
- MP4 full decoding succeeded but ffmpeg's null muxer emitted repeated non-monotonic DTS warnings. Sampled frames are readable; media timestamps are not used as millisecond-accurate server chronology.
- 100ms shell sampling and batched transport cannot resolve tiny intermediate states. Persisted events, shell receipt and DOM mutation clocks must remain distinct.
- Base run's later watcher restarts/mixed-source control are excluded. Proposed first notification-negative preceded enablement; later enabled controls carry that proof.
- Native artifact 403/device access and Electron keyring pairing are supplied-record limitations, not independently retried in this read-only pass. No workaround or new runtime was launched.
- No independent rebuild or served-bundle hash; all acceptance is limited to consistency of delivered evidence, repository state and source inspection.

VERDICT: SUFFICIENT — exact core web/Codex ordinary-question attention behavior, including corrected nonblocking-child policy and blocking waiting/completed/resume boundary. INSUFFICIENT — complete focused matrix, conservative async unknown-secret compatibility guarantee, or all-client/OS delivery certification.

Report prepared with GPT-6.1-Sol through the Codex harness. Public report uploaded using the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md).