# PASS2 proof audit — detached provider handoff

Audit of [#19687](https://git.cafe/pingdotgg/t3code/pulls/19687), [GitHub mirror #19687](https://github.com/pingdotgg/t3code/pull/19687). Read-only repository scope: `/home/ubuntu/wt/pr-19687`. No repository edits, commits, pushes, comments, or watchers. Own outputs: `/tmp/to-19687-proof2`.

Before: [952921f](https://github.com/pingdotgg/t3code/commit/952921f39acd7793187e2b14650f1cbc447f483d). After: [271e7b6f](https://github.com/pingdotgg/t3code/commit/271e7b6f110b5817e70bba16c46a91b2475ccf09). The after commit incorporates main; this audit does not claim the PR itself is merged. Original supplied head [798ab31](https://github.com/pingdotgg/t3code/commit/798ab3170850b0224e03fb695ab0ed86953b798b) exists locally. Final production diff against the merge commit's main parent only removes `nativeThreadRef !== null` and updates its explanatory comment; source id, app-thread ownership, source instance, attached-session authority, active-run, imported-history, and empty-history branches remain.

## Integrity and inspection

Round-1 manifest generated `2026-10-25T00:45:23.507823+00:00`: all 121 listed asset hashes match local files. Opened all 44 PNG assets in six labeled contact sheets, including every source still, pair, raw diff, highlighted diff, final flow screenshot, and control screenshot. Independently recomputed all eight raw pixel diffs; every diff matches exactly and paired dimensions agree. There are visible upstream/sidebar/timestamp differences, so the pixel changes cannot all be attributed to this PR.

Opened all five recordings by extracting and visually inspecting frames every ten seconds, the final frame, and additional interaction timestamps. These inspections are represented in `opened-stills.json`, the video sheets, and focused sheets in the audit directory. It is a sampled video audit, not a claim to have manually watched every encoded frame.

## Round-1 row results

| Row | Audit result | Evidence and limits |
|---|---|---|
| A attached capability true | Partial | Baseline before-sequence source completed and target selection succeeds about 45–55s. Final clean-sequence creates/completes source but does not exercise attached picker before detach. Needs final attached-true picker control. |
| P1 pointer | Supported | Baseline before-blocked-routes and still action log explicitly find disabled target and attempt `button.click()`; source remains selected. Final clean-sequence 40–49s searches/selects target, then H sends. Separate independent rebuild confirms selectable target on final head. |
| P2 keyboard opener | Opener supported; selection-route proof partial | Round-1 resolved Ctrl+Shift+M opens/closes picker before and after; screenshots show state. It does not finish keyboard target navigation/Enter on final head. Do not claim complete keyboard-only handoff. |
| P3 previous/next provider | Navigation supported; selection-route proof partial | Baseline 52–60s remains source/empty blocked target; final 229–237s navigates source/target provider lists. No separate committed target selection after that navigation in the grouped script. |
| P4 numbered jump | Unverified | After grouped script stops before jump. Baseline Ctrl+1 has no target candidate and, more fundamentally, default numbered model jumps are disabled on web. Must install/show an effective explicit web binding or run desktop; keypress alone is not proof. |
| P5 search | Supported | Clean final sequence 42–49s target search/selection; baseline 61–72s target search returns no models. |
| P5 Favorites | Unverified | Target favoriting succeeds, but `find role button --name Favorites --exact` fails; no Favorites selection follows. |
| H saved history reaches target | Supported with fixture qualification | Source and target runs complete in clean-handoff projection. Actual Claude user input at `00:33:13.105Z` contains the historical marker; follow-up says only `Report the marker from our saved conversation.` Target peer checks received input before echoing marker. |
| C attached capability false | Not proved | Captured returned projection has zero sessions. Screenshot actually offers the target, consistent with detached fallback. This is an invalid negative fixture. |
| R active without session | Not proved | Captured run status is cancelled, not active. Startup recovery has invalidated fixture; screenshot offering target cannot establish active-run guard. |
| S missing source association | Supported UI-only control | Returned projection activeProviderThreadId is null, completed nonempty native run exists, sessions empty. Screenshot/recording target is locked. This projection-only control proves picker gating, not server dispatch behavior. |
| N cancelled/rolled-back-only | Corrected source reasoning; no runtime claim | Server source eligibility is completed/failed/interrupted; without one, provider switch can proceed with no handoff context. Pass1's detached-idle N block expectation is withdrawn. Do not recapture as a negative. |
| M native mobile | Accepted infrastructure gap | Device access explicitly OFF. Responsive 390px web is not native proof. No alternative native automation attempted. |

## Behavioral proof versus seeded pictures

The clean sequence uses real application commands and synthetic provider protocol peers. Read-only inspection of the copied isolated database confirms accepted `provider-session.detach` at `00:32:33.841Z`, persisted `provider-session.detached`, subsequent provider switch/context-transfer/context-handoff events at `00:33:12.479Z`, and completed source and target runs. `clean-event-proof.json` and `clean-event-milestones.json` record selected metadata without protocol credentials.

The stopped-server removal of native refs is a projection-only fixture adjustment, not a naturally produced no-ref lifecycle event. The saved source turn, detach, and final target dispatch are event-backed; the injected null reference is not. This distinction must appear beside any end-to-end claim. The eight matched still pairs copy synthetic projection rows across baseline/final databases; they are picker/UI proof only and must never be described as eight end-to-end handoffs.

No real Codex or Claude subscription/model execution was verified: deterministic synthetic CLI protocol peers were used. The application server, transports, selection UI, history construction, and target protocol delivery are real. Native mobile and Electron shell remain unverified. No unavailable/non-consuming target variant was exposed; no coverage claim is warranted.

## Independent rebuild

Ran supplied `auditor-rebuild.sh` from a copy under `/tmp/to-19687-proof2/rebuild`. The only script/template change substitutes the temporary root path; head check and launch logic are unchanged. Took a read-only SQLite backup of the isolated synthetic final database into the own root. No live T3 home was read or written. The final checkout remained clean.

Rebuilt the detached completed-source picker artifact at final head. Returned projection: zero sessions, completed source run, active source provider-thread associated with current app thread and codex instance, null nativeThreadRef. Chromium screenshot and accessibility snapshot show selectable `Claude Sonnet 4.6 / Evidence Target`. This is independently rebuilt picker evidence, not an independent repeat of full target delivery.

Own server PID 981526, Xvfb PID 981527, Chromium PID 982512 were retained and stopped. Initial premature server PID 978847 was stopped immediately after parent corrected capture handoff status. All four are absent; own web port is closed. The first launch relied on a cleanup file/free port that was not final confirmation; no browser was launched in that initial attempt.

## Claim discipline

Defensible body statement: "A detached thread with saved completed history and a valid source association can choose a different provider even without its native continuation reference. The shared helper now permits that case while retaining its other guards. An isolated web flow with synthetic Codex/Claude protocol peers delivered saved history to the target; null native reference was injected with the server stopped."

Do not claim all entrypoints, all providers, native mobile, Electron execution, naturally occurring null-ref detach, all pass1 matrix cross-products, active guard runtime proof, capability-false runtime proof, or Favorites/jump verification from round 1. Parent-reported 61 tests across four files plus scoped format/lint/typecheck are not independently rerun by this audit; source tests cover attached authority, running guard, absent association, and null-ref completed source.

## Minimal core recapture still needed after round 1

1. A: final completed source with a returned attached session C=true, select target and show resulting draft label.
2. C: establish a returned session actually bound to source with C=false immediately before picker interaction; show blocked target and unchanged source. Saved history should otherwise qualify.
3. R: maintain an active run with zero returned sessions while server stays running; verify live projection at capture time and attempt target selection. Do not restart a fabricated running projection into recovery.
4. P4: explicitly configure and show an effective numbered-jump binding on web, then select target and show closed picker/changed draft. Default Ctrl+1 on web is not enabled.
5. P5 Favorites: open actual Favorites tab through its observed locator, select favorited target, show changed draft. Include a blocked control if claiming bypass prevention.
6. P2/P3: if claiming complete keyboard/navigation selection routes, finish target selection with Enter/model click after invoking those routes and show draft label. Opening/navigating alone is narrower proof.

FRICTION handoff coordination | stale cleanup report/free port led to premature rebuild launch, stopped immediately on parent update | require explicit final capture-agent handoff and keep copied rebuild state separate.
FRICTION negative fixture | capability-false screenshot had no session and active fixture was recovered to cancelled | assert returned sessions/bindings/run status immediately before interaction.
FRICTION keyboard applicability | default numbered jumps intentionally disabled on web | capture effective custom binding or use authorized desktop shell.
FRICTION route grouping | Favorites locator failure prevented subsequent jump | isolate independent route captures and record result assertions per route.

## Round-2 handoff (preliminary only)

Parent requested a fresh PASS3 for new round-2 files. Preliminary read-only inspection found A has a ready bound source session C=true; R has an event-backed deferred `preparing` run with zero sessions and blocked target search. A/R videos were sampled and their stills opened. Neither is folded into the final PASS2 sufficiency decision. C returned projection contains a ready bound source session C=false, injected by a local transparent WebSocket test proxy; its UI capture was not yet available. PASS3 must classify that as an injected wire fixture, not a native server capability result. Round-2 jump/Favorites and route completion were still pending at handoff.

## Verdict

The narrow production change and core successful detached completed-history path have evidence. Round 1 does not establish the requested core negative controls and every selection route. Accept the mobile infrastructure gap, withdraw the incorrect cancelled/rolled-back N negative, and do not demand all hypothetical pass1 cross-products. Required remaining proof is precisely C=false, R active-without-session, after P4 numbered jump, P5 Favorites, and completed target selection for P2/P3 if claiming those complete routes. A final attached-true control was only partial in round 1; round 2 appears to repair availability but needs PASS3 review.

VERDICT: INSUFFICIENT A(final attached control), C, R, P2(selection), P3(selection), P4(after), P5(Favorites)