# Retention remedial evidence Issue [#14743](https://git.cafe/pingdotgg/t3code/issues/14743), reused PR [#22208](https://github.com/pingdotgg/t3code/pull/22208). This is an append-only evidence addendum. Original valid assets remain under `/tmp/issue-14743-capture`; metadata corrections are separate in the [revision 6 index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8107ac2ca811d774/index.md). No push, forge comment, PR edit, or watch was performed. The app-owned PR link was registered. Final local fixture-tooling commit: [30734756fc](https://github.com/pingdotgg/t3code/commit/30734756fcc3424fc3cb1350235c7a190182f170) (unpublished). Captures began from f2b6b046814decf1fb936a281a44063648841942 with the fixture edits represented by this commit; the commit happened during packaging, not before every capture. Production and the reviewed browser test remain byte-identical to both d28e64cfc1a2d17f12681a22b6487fbc05023821 and 48078090831c4628e8ad5ebd8b31fbe4c3254dbd. `production-equivalence.json` gives all three hashes. No production source was edited. 184 selected checkpoints, 31 new raw segments, eight supplemental aggregate addenda (four after suites and four baseline component-only core chapters). Existing eight bundles are preserved. All new segments have UTC recording starts. `new-action-index.md` indexes checkpoints against each raw segment; aggregate chapter JSON supplies offsets. These are capture-request completion offsets, not frame-exact timestamps. Raw transitions are retained. No old metadata was rewritten. ## New proof - **R1:** 16 bounded real-app caller windows, I/S/B/L × 1440/390 × light/dark. Clear journal before each caller. Enable has zero `server.updateSettings` requests. Delete now is framed disabled while draft is open; it is framed enabled only after a matching success acknowledgement and `server.getSettings` readback of30. Readback includes all four cleanup keys, worktree policy and project overrides; other effective rules are null/false. Each caller ends with an acknowledged null and null readback. Delete now was never executed. `bounded-R1-windows.json` contains only IDs/tags/patches/times/matched acknowledgements/readbacks. The earliest null seed is the fresh isolated settings fixture; later null seeds are confirmed by the previous caller's readback. - **R4:** actual keyboard Tab traversal from edited30 through the control to its switch, then Space Off. Independent fresh drafts receive real pointer clicks on the days text and the outer retention row gap; input focus remains. Explicit outside button focus then cancels with zero settings writes. Real Storage route in all four combinations. Focus/key/pointer event timestamps are in the checkpoint manifest. - **R5:** real route clear→outside blur→Off/no write, then recovery30 in all four combinations. A separately labeled NumberField wrapper logs the actual library callback: `next:null`, `event:focusout`, related target `Outside focus target`; final Off, zero callback writes. The wrapper forwards directly to the unchanged extracted control handler. It is instrumentation, not a production change. - **R7/R10:** actual useUpdateScopedSettings/useRunScopedPlan bodies, actual planner and persistScopedSettingsPatch aggregation, a verbatim SettingsScopeContext declaration exposed by the generated module, and actual ToastProvider. Only server-command execution and permission lookup are controlled boundaries; the writable permission lookup returns true. Hold8, fail→false→Off plus actual error toast, retry30→success. After a draft opens, disconnect the selected environment in context: actual unavailable plan→false/warning, zero command requests. Two connected targets: request A30 succeeds/publishes30, B30 fails; actual runner returns false and mixed-result toast while displayed A retains30 and B remains null. All four combinations. This is controlled command-boundary proof, not transport/disk persistence. - **R8:** request1=8 held; repeat Enter and blur leaves exactly one request. Explicitly focus and edit input30; Enter during saving alone does not commit, so actual edited-input outside blur produces request2=30. The script asserts request2 exists BEFORE rejecting1. On30 survives old failure; existing request2 is then acknowledged and publishes30. All four combinations. Unknown/settled IDs are rejected before any acknowledgement log or publication; unknown999 was checked with unchanged log length. - **R11:** choose the actual RetentionControl div by contained switch and input; assert its React props own pointerdown/up/leave/cancel/blur handlers. Dispatch pointerdown and one release path, then programmatically focus the uniquely named outer button without another pointer event. Up/cancel use matching DOM events; React pointer-leave is exercised through pointerout with an outside relatedTarget. Each ends Off with no writes. Logs include release, focus/relatedTarget and composition events. Composing Enter/Escape leave On8/no write; normal Escape cancels. All four combinations. These are explicitly synthetic event harness chapters, not physical-device claims. - **Project follow-up:** a real registered disposable project, Custom policy, theme class asserted immediately before each screenshot. 1440 light, 1440 dark and390 dark now record Off→draft8→General→loaded Storage Off. This supplies the missing loaded return sequence and head dark-theme evidence. It does not repair the missing/mislabeled baseline project dark assets. ## New whole-surface comparisons Twelve exact-source **component** pairs: Off, enable divergence, committed30 output × four width/theme combinations. Baseline is22840ab943; after control is extracted verbatim from d28e64cfc1. Same null seed, callback-success mode, explicit input focus/replacement avoids the old830 concatenation. `new-pixel-manifest.csv` gives full saved-image diff0 and max-channel>16 counts, bounding boxes and concrete visible differences. Original saved images and both diff maps are included; no masks, registration or crops were applied. Labeled before-left/after-right sheets are supplemental. These new pairs are NOT new real-app baseline persistence comparisons. The existing real-app evidence and its metadata correction retain their original scope. Baseline draft-only checkpoints remain unreachable; no baseline draft was manufactured. After's enable screenshot shows focused8 with ring/caret and authoritative null/empty journal, while baseline immediately shows authoritative8/request1=8 and switch focus. Fixture heading/source glyphs, UTC request text, values, log heights and whitespace also differ. Committed outputs both show30/outside focus; before logs8 then30, after logs30 twice from Enter then saved blur. There is no global duplicate-suppression claim. Fine glyph-edge attribution remains unresolved. The prior replay's28 threshold caret pixels are a concrete capture-timing difference, not AA. New screenshots await fonts and two animation frames but do not claim deterministic caret phase or pixel identity. No timing difference is waived as a production regression or as harmless AA. ## Environment and tooling Collaborative T3 preview, incognito Chromium, en-US, UTC, DPR2, unchanged browser zoom, default reduced-motion policy, explicit light/dark class. CSS1440×1000 and390×844. Saved desktop screenshots are1280×889; narrow screenshots780×1688. Raw recordings retain their native dimensions; supplemental aggregate desktop videos scale the full surface to1440×1000, narrow videos retain780×1688, then add a72px chapter header. No image-diff measurement uses the video scaling. Fresh `/tmp/issue-14743-remedial-home`, all effective cleanup rules null/false, no managed cleanup worktrees or old artifacts seeded. Disposable registered project. Auto-registration also created the server workspace record, with no managed worktrees. No live database was used. Existing primary integrated persistence proof and reported tests were not rerun. Fixture generation and browser interactions are the focused validation; the commit formatter passed. `tooling/` contains exact generated modules, suite scripts, source-equivalence report and packaging scripts. The hook body from useRunScopedPlan onward is byte-identical; runtime imports point to controlled boundaries/generated context, while actual planner/persistence and toast modules are imported. The context runtime declaration and hook bodies are copied verbatim; this is an exposed test binding, not a new production export. `r5-instrument.py` was applied only after the other component chapters; its wrapper does not alter RetentionControl's extracted body. ## Remaining limits - No new real-app baseline/head paired screenshots; the12 new pairs are labeled component proof. - Baseline project dark captures remain missing/mislabeled, and old unequal seeds/invalid Enter interactions stay invalid as revision6 states. - Whole-surface counts are exact measurements, not exhaustive attribution of every changed pixel. Fine glyph/caret timing remains open. - New project chapters repair draft lifetime/theme/loaded return only, not a new full project save/reload matrix. Existing valid project persistence remains separate evidence. - Harness outcomes do not establish arbitrary transport reorder guarantees, real server failure persistence, native mobile, or standalone Electron behavior. ## FRICTION - Preview initially closed; preview_open succeeded. Pairing's `Projects` text wait timed out, but authentication subsequently completed and the real Storage route loaded. No alternate browser was used. Background401 requests occurred around navigation; real-app request/ack/readback proof was captured after successful auth. - A whitespace key was rejected by preview_press; corrected to `Space` and recaptured. An initial Delete-now framing click on the Cleanup heading canceled the draft; replaced by scroll-only framing and recaptured. A readback initially raced the switch's deferred null command; final script awaits the matching null acknowledgement before readback. Abandoned captures are not selected in the new manifest. - Clicking Refresh log in the first runner pass blurred a saved field and issued extra writes. Final runner captures use reactive log refresh without that click. Saved30 blur can still emit another30 in actual/component sequences; documented, not called a duplicate-guard failure. - The first pointer draft used a click outside, which could supply an incidental leave release. Final selected captures use explicit outside `.focus()` after exactly the targeted release path. React leave uses pointerout; DOM pointerleave alone is not claimed to invoke the React handler. - A metadata write attempted delete/add for the same apply_patch target and was rejected; final metadata was written to a fresh external file. No evidence was lost. - New fixture tooling committed locally only. All generated worktree HTML/TSX and the disposable home were removed. Only owned retained server session65477 was stopped, owned preview tab closed, ports7763/15803 have no listeners, and worktree is clean. Original and remedial evidence remain in `/tmp` for audit. - Uploads use the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md); no forge write or watcher was started. ## Public addendum downloads - [after-remedial-1440-dark.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9300c0971036446d/after-remedial-1440-dark.mp4) - [after-remedial-1440-light.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5d6510bff2101659/after-remedial-1440-light.mp4) - [after-remedial-390-dark.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0707347a3363f0ad/after-remedial-390-dark.mp4) - [after-remedial-390-light.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/31a3b1833ff8424a/after-remedial-390-light.mp4) - [before-remedial-1440-dark.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f63e8c7b8133643c/before-remedial-1440-dark.mp4) - [before-remedial-1440-light.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/286015eff2b38573/before-remedial-1440-light.mp4) - [before-remedial-390-dark.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8b2f18ae2425ca2e/before-remedial-390-dark.mp4) - [before-remedial-390-light.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dcecd958467ae234/before-remedial-390-light.mp4) - [after-1440-dark-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4fc391241c29f9eb/after-1440-dark-stills.zip) - [after-1440-light-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7ac7af6947786c05/after-1440-light-stills.zip) - [after-390-dark-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/86b3dc78d711244a/after-390-dark-stills.zip) - [after-390-light-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2d4e9d05bfeae2f7/after-390-light-stills.zip) - [before-1440-dark-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9af569b874ca258d/before-1440-dark-stills.zip) - [before-1440-light-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0094530ee7610181/before-1440-light-stills.zip) - [before-390-dark-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1c998fe47706bdaf/before-390-dark-stills.zip) - [before-390-light-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cc9de71ab4849366/before-390-light-stills.zip) - [tooling-stills.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9f5fc0f64fdd894b/tooling-stills.zip) - [raw-after-1440-dark.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/70033ba01a1ce756/raw-after-1440-dark.zip) - [raw-after-1440-light.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/786bb09a581e0e3e/raw-after-1440-light.zip) - [raw-after-390-dark.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d298a2bb445eb91d/raw-after-390-dark.zip) - [raw-after-390-light.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/92df7644a7c58549/raw-after-390-light.zip) - [raw-before-1440-dark.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a3c6a3b2a1a5e9c2/raw-before-1440-dark.zip) - [raw-before-1440-light.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cd215845fd74c8bf/raw-before-1440-light.zip) - [raw-before-390-dark.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9cd3bd9c9bb6ade7/raw-before-390-dark.zip) - [raw-before-390-light.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c4387abbd44a2b58/raw-before-390-light.zip) - [remedial-manifest-tooling-diffs.zip](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d5fe10c709998bf/remedial-manifest-tooling-diffs.zip) - [bounded-R1-windows.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/37eff7e41bd18efd/bounded-R1-windows.json) - [new-action-index.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/358ecb8cf7cee112/new-action-index.md) - [new-pixel-manifest.csv](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5d29da63c08eb0f0/new-pixel-manifest.csv) - [new-capture-manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f1b4377301f54dcc/new-capture-manifest.json) ![Baseline on the left immediately saves8; after on the right opens focused8 with authoritative null and no request](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/515ac45d25c0e909/pair-1440-light-core-enable-divergence-before-after.png) - [offline-oracle-validation.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1d61a6d7cd808eae/offline-oracle-validation.json) - [production-equivalence.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/44ddd7fb00c1eb22/production-equivalence.json) - [source-equivalence.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/91ec8bfb3627ba00/source-equivalence.json) - [Immutable artifact SHA256 manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c47c001fc643cb2c/sha256.json) (excludes this mutable index and upload ledgers).