# PASS2 proof audit — preview snapshot takeover

No blocking proof findings. The mandatory server evidence is sufficient at final replacement [b7fddd87](https://git.cafe/pingdotgg/t3code/commit/b7fddd87a69bb9f868bfd54928aaf4ae881c9432), and an independent real-service A1 rebuild is byte-identical to the delivered AFTER PNG. This is a proof verdict, not blanket merge approval or certification of native attachments.

Original [#20924](https://git.cafe/pingdotgg/t3code/pulls/20924), also [#20924](https://github.com/pingdotgg/t3code/pull/20924), still reports original fork head [5afb4d04](https://github.com/watashiwaaniket/t3code/commit/5afb4d04daaf16553b94e2c33e7732ddbb88ce20). The replacement reviewed here is local `takeover/pr-20924`, full SHA `b7fddd87a69bb9f868bfd54928aaf4ae881c9432`. Do not confuse its proof with checks on the original PR head.

Actual captured BEFORE remains [c4fa4629](https://git.cafe/pingdotgg/t3code/commit/c4fa4629eb645b95aae2beef56c70f705b736049). I independently confirmed the entire preview subtree has an empty diff between that revision and current base [8bcef34f](https://git.cafe/pingdotgg/t3code/commit/8bcef34f16ca2a08aa19c35dd64b71290bd4412f). I did not relabel the baseline captures.

[Final evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bad72bff7bffab76/evidence-index.md) downloaded successfully with curl and matches the local final index SHA-256 `1812baaf6eec098e44f4f2c6af81c636b547f27e87700a88cc31dda4c1dac74b`. [Evidence bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e0f8be5e36c4248b/evidence-bundle.tar.gz). All 273 asset-manifest entries match local public files in size and SHA-256; the 272-entry earlier SHA manifest also has no mismatches.

| Row | Status | Independent visual judgement |
|---|---|---|
| A1 / blur / 1440 light | Sufficient | BEFORE mirrors blue into the right glass and loses the stripe boundary; AFTER restores red, softened stripes and correct geometry like headed reference. Independently rebuilt through fresh real service: exact bytes, 0/910,080 changed pixels. |
| A2 / blur / 1440 dark | Sufficient | Dark compositing preserved; red right half, yellow boundary and blurred diagonal texture agree with reference. |
| A3 / blur / 390 light | Sufficient control | All three images match; unchanged narrow composition and blur. |
| A4 / blur / 390 dark | Sufficient control | All three images match; dark narrow composition retained. |
| A5 / blur / 1280 light | Sufficient | Original reproduction width clearly fixes mirrored backdrop; 1280x800 output retained; actual edge softness agrees with reference. |
| A6a / blur / 640 light | Sufficient control | Exact unshrunk threshold, 1280x1600; all three match. |
| A6b / blur / 641 light | Sufficient | Shrink branch enters, 1280x1598. No new duplication or displaced composition; nonzero border/text/stripe resampling acknowledged. Baseline here does not exhibit the gross wide-row defect. |
| A7 / blur / 1440 dark / scroll600 + 125% | Sufficient with disclosed existing reset issue | Scroll labels and fixed glass behave coherently. AFTER zoom fills 1280x711 and agrees with reference; BEFORE is genuinely 1600x889 with wrong backdrop/padding, retained raw and visibly labelled when normalized. All internal video frames inspected. |
| C1 / plain / 1440 light | Sufficient regression control | Geometry, colors and labels preserved. Native text crop and diagonal edges show resampling differences, not zero diff: 99,213 pixels at threshold0; 46,846 over10; mean RGB delta1.1814. |
| C2 / plain / 390 dark | Sufficient control | All three images match; text and geometry unchanged. |
| C3 / immediate recording stop | Sufficient | Both MP4s decode their single 1440x800 frame, ~0.0333s. First frame shows correct red/blue glass page; no absent seed frame. |
| C4 / viewer + recording + snapshots + reconnect | Sufficient with timing limitation | Real Browser viewer frames continue through scroll/zoom/snapshots; after reload both recover correct content after a blank interval. No mirror/flash visible in sampled viewer frames. This is not a claim of seamless reconnect or exclusion of every unsampled one-frame transient. |
| X1 / XML / 1280 light | Sufficient | Final snapshot succeeds and shows complete XML tree, 1280x800, matching reference composition. Text-edge resampling differs. Source uses XHTML-namespaced canvas and real XML regression test; intermediate broken replacement is not relabelled as baseline. |
| N1 / native display attachment | Intentionally unverified; outside required server pass | No genuine attachment. Server-owned DPR2 pages do not prove the `renderScale: display` branch. No new desktop/mobile claim. |

Coverage is 12/12 required rows, 13 scenarios including the 640/641 subcases; N1 remains conditional and excluded from the sufficient server verdict.

## What I opened and checked

I opened all 229 delivered public PNGs through ten labelled inventory sheets, then inspected every row's larger triplet plus all six diff views. I separately inspected native A1 blur, C1 text and X1 XML crops and the rebuilt A1 image/diff. This includes raw and normalized captures, settled duplicates, references, viewer initial/zoom/reconnected stills, auxiliary scroll/final stills, and review sheets. Contact sheets were used for duplicate/overview coverage, not as a substitute for inspecting the visible anomalies.

All six delivered MP4s were independently decoded: BEFORE C3=1 frame, A7/C4=14, viewer=432; AFTER C3=1, A7/C4=13, viewer=475. I inspected every internal frame and the supplied viewer samples (~0.48s cadence, 37 before/41 after). These show the same sequence with different tool latency. The visible reload gap and enlarged post-reset page occur on both revisions. The reset label returns100%, but no post-reset runtime metrics exist; the persistent125% interpretation is image-based inference. No invented successful reset assertion.

I independently recomputed all39 pairwise comparisons from raw images, including the labelled zoom normalization, and verified all78 delivered threshold0 RGB differences amplified4x and max-channel>10 masks exactly. Black at threshold10 means <=10, not equality. [Independent diff validation](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/aeecb5b904134e6f/independent-diff-validation.json).

Actual blur was checked beyond coarse color probes: the stripe edges and yellow-band softness in AFTER agree visually with matching headed Chromium156.0.8078.70 references. Additional red-channel10–90% center-boundary probes give18px in both AFTER/reference for A1/A2 and20px for A5. Remaining reference diffs are chiefly resampled outlines/text/edges; this is not a byte-equality claim for shrunk rows.

## Independent rebuild through the actual app

I launched the unchanged final checkout with `T3CODE_DEV_SEED=0 vp run dev --home-dir /tmp/ev-20924-proof --no-seed`; actual ports were server15092/web7052. I downloaded the public generator, verified SHA-256 `1abdeee1085e1e3bd5b5280b756bb2f67d9e370410bb374442c36cb86c4eb82d`, regenerated pages into the proof directory, and verified blur HTML SHA-256 `ed09a32441a194dced6c6c46caf2bd7f99eb0550b21d67f43744bbd5353853db`. A retained Python HTTP server served that directory on18625.

Using the collaborative Browser as a paired client, I added the synthetic pages project through the real app and launched one narrowly scoped actual provider turn. Its normal thread-bound MCP called status/open/resize/appearance/navigate/evaluate/snapshot(save=true) on this fresh server. No capture helper imports or substitute screenshot harness were used. The provider closed its fixture tab after capture and completed. Nonsecret [full tool responses and metrics](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/91164257ef60dcff/rebuild-result.json) retain the actual snapshot paths below the proof home.

A1 measured innerWidth1440, innerHeight800, DPR2, scroll0, explicit light media, after fonts.ready+600ms. `fc-match sans-serif` independently reports `LiberationMono-Regular.ttf: Liberation Mono Regular`, matching the capturer; the fixture uses the same18px sans-serif body and16px root. The exact PNG byte match includes the text rendering.

[Rebuild pixel delta](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c2304b3278acbce8/rebuild-delta.json): 1280x711, threshold0=0, threshold10=0, max-channel=0, mean RGB=0. Both rebuilt and delivered PNG SHA-256 are `4ca703b5d19696d6a0daa113ef6b5bbf79b6c03a9e5be0e7d5a6dcce5423351f`. The second rebuilt capture500ms later is byte-identical.

![Independently rebuilt A1 AFTER: correct blurred blue left and red right](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/783c6ba8d607d6b1/rebuilt-A1.png)

![Rebuilt A1 versus delivered AFTER: threshold0 difference amplified4x, entirely black](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/aae1f6a9822de3c5/rebuilt-A1-delivered-diff-x4.png)

## Source, tests and limits

Read the complete four-file final preview diff and affected capture/recording/viewer callers. Snapshot now captures full PNG then shrinks in an isolated-world XHTML canvas; recording-seed/viewer callers retain full-size JPEG behavior. XML namespace fix and real XML regression test are present. No client, contract, provider or desktop/mobile change is inferred.

The retained final-tests.log reports46/46 scoped tests at this worktree. I did not rerun tests or equate checks on original fork head with validation of replacement HEAD. Baseline main-red is intentional regression proof, not an outstanding replacement failure. Proof sufficiency does not certify unrelated CI.

Server MCP exposes no reduced-motion input. The fixture has no animation/transitions/subresources, and settled captures500ms apart match, so static settled-frame proof is valid; reduced-motion media compliance was not independently exercised. Headed references explicitly use reduce.

No source edits, commits, pushes, ref changes, PR comments, watches, or live-userdata access were performed by this audit. The existing PR was registered with this audit thread as required by the harness; it is not watched. Only synthetic fresh-app project/thread state and proof files were written. The collaborative outer tab, fixture HTTP session87252 and dev session79221 were closed/stopped by their retained session handles. `ss` reports no listeners on15092/7052/18625. Final checkout remains clean at the exact supplied replacement HEAD. Proof artifacts remain under `/tmp/ev-20924-proof` for lead cleanup.

| FRICTION category | event | prevention |
|---|---|---|
| Provenance | Original PR metadata still points at fork head while replacement is local | Name all actual SHAs and bind proof to final checkout, never relabel baseline or CI |
| Browser startup | Fresh client briefly showed splash while Vite compiled | Wait for real app state before creating synthetic project; no helper substitution |
| Fonts | A structurally correct rebuild could use different text metrics | Verify generator/page hashes, fontconfig and runtime geometry; require pixel comparison |
| Public retrieval | Python urllib received403 for final index; curl succeeded and hash matched | Use working public transport and verify downloaded bytes; do not call upload missing from one client error |
| Coverage | Reduced-motion setting and native attachment unavailable | Disclose both limits; distinguish settled static proof from unsupported branch coverage |
| Lifecycle | Other servers share the machine | Stop only retained own sessions; verify own ports closed; preserve scratch results |

Audit by GPT-6.1-Sol in Codex; independent fresh-server transport used the app's GPT-6-Astra/Codex provider turn.

VERDICT: SUFFICIENT