# Proof audit PASS2 — issue 23507

**Findings first:** No contradiction of the reported fix found. The 8 delivered still pairs and 4 recording pairs support personal Claude skills-dir discovery, selection, refresh, and fresh/active-steer native dispatch. Independent replay from the committed filesystem fixture at the requested head recovered the full V1 desktop-light still with **only a small AA/color delta: 588 pixels (0.057421875%), zero pixels above 16/255**. The affected menu and composer match exactly. Exceptional filesystem branches and native/remote surfaces remain unverified, as detailed below; they are not silently counted as passes.

**VERDICT: SUFFICIENT for the reported omission bug and the requested independent capture replay.** This is not certification of every conditional filesystem branch or native/remote client. No confirmed implementation bug or material visual regression was found in this proof audit. The evidence index needs the explicit UI recipe below; the parent will add it. No repository edits were made by this audit.

Reviewed [#23507](https://git.cafe/pingdotgg/t3code/issues/23507), branch `fix/issue-23507`, clean head [396d43d148](https://git.cafe/pingdotgg/t3code/commit/396d43d148bbf201b1264d80fcd70eab1669d4f5), before [ff525478e2](https://git.cafe/pingdotgg/t3code/commit/ff525478e2). Full head: `396d43d148bbf201b1264d80fcd70eab1669d4f5`. Scope: proof audit, not a separate merge-readiness/CI audit. No PR was created or modified.

Sources: [delivered index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d23efb3aae30f7f8/evidence-index.md), [original matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/77fbf63b6672a083/proof-audit-pass-1.md), [curated bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/330a115ef204324c/issue-23507-evidence.zip). Audited local artifacts against bundle entries: no mismatches among the 76 entries. Verified SHA labels in index/final metadata against local git; still/recording provenance is supplied metadata, not a burned-in commit watermark. Final head predates final after captures. Only discovery, its tests, and three fixture files differ from the requested before revision; no renderer/style/transport change explains unrelated layout changes.

## Still rows

Inspected all before/after images and both diff forms. Independently recomputed RGB absolute differences for every pair, checked changed-pixel counts, and verified each delivered zero-diff and threshold-overlay image byte-for-pixel against its prescribed algorithm. Zero image is absolute RGB difference amplified 8×; threshold image paints max-channel differences >16/255 magenta over after. No alignment, crop, ignored region, or AA exclusion in these full-image counts.

| Row | Status | Zero pixels / percent | >16 pixels / percent | What else changed / visual assessment |
|---|---|---:|---:|---|
| V1 1440 dark | PASS | 42,839 / 4.18350% | 4,679 / 0.45693% | Empty popup becomes Manual/Review/No Description; Review highlighted, actual description and Personal Skill badge. Differences confined to popup. |
| V1 1440 light | PASS | 42,179 / 4.11904% | 4,203 / 0.41045% | Same. Popup background, shadow, text and highlight all included in counts. |
| V1 390 dark | PASS | 111,359 / 8.45782% | 14,619 / 1.11033% | Same semantic change; long names/descriptions truncate, badges remain readable. |
| V1 390 light | PASS | 111,421 / 8.46253% | 12,838 / 0.97506% | Same narrow layout behavior. |
| V2 1440 dark | PASS | 33,858 / 3.30645% | 4,813 / 0.47002% | No matching command becomes three /skill: rows; Manual highlighted; Personal badges. Preceding Please unchanged. |
| V2 1440 light | PASS | 33,245 / 3.24658% | 3,820 / 0.37305% | Same. |
| V2 390 dark | PASS | 93,981 / 7.13794% | 19,076 / 1.44884% | Same narrow truncation; also small blue submit-button texture difference, disclosed in index. No changed button geometry or meaning. |
| V2 390 light | PASS | 94,025 / 7.14128% | 10,733 / 0.81518% | Same narrow menu change, no additional material region. |

The index's “all visible differences” descriptions agree with images and code. No unrelated history/topbar/theme/layout changes occur in the matched delivered still pairs. Desktop output is resampled 1280×800 despite CSS 1440×900; narrow output is 780×1688 for CSS 390×844. These sizes are correctly disclosed.

## Interaction rows — actual recordings

Reviewed decoded frames at narrated action times and transition boundaries, with raw recordings, SRT, step JSON, snapshot phases and dispatch logs as cross-checks. These rows are supported by recordings, not substituted stills. Captions are on-screen narration, not audio. Narration often precedes the visible action by a fraction of a second; assess the transition, not a single initial frame.

| Row | Status | Actual evidence and limitations |
|---|---|---|
| R1 1440 light before/after | PASS | Before has no selectable row. After keyboard Enter inserts Review chip, undo reopens query, click inserts chip after Please, removal retains prose, leading slash works, Escape dismisses and query reopens. Click result is visible around 5.3s, after its 4.027s narrated instruction. |
| R1 390 dark before/after | PASS | Same sequence at narrow width; inserted chip and Please remain visible, removal returns to Please, leading/mid-message slash and Escape/reopen visible. Badge truncation is acceptable and disclosed. |
| R2 1440 light before/after | PASS | Slash visibility on→off→on; dollar retained off; disabled inventory eventually absent after real workspace refresh; re-enabled dollar/slash restored once. Machine refresh alone leaves stale workspace data and is correctly identified. After is two joined segments, disclosed in video/index; no claim of uninterrupted five-minute wait. Before ends with canonical slash query absent. |
| R3 1440 light before/after | PASS | Fresh sends and actual active steer shown. First after steer attempt lands after completion and is honestly retained as fresh control. Subsequent working/Stop state and persisted Steer message establish actual active steering. Observer log confirms native final text block. |
| Negative control | PASS for dispatch | Agent-only and disabled-plugin inputs remain literal dollar text in outbound logs; cached chip appearance is not misrepresented as dispatch authority. This extra video is raw, not one of the four narrated matched pairs. |

Before dispatch has **3** nonempty entries; after has **6**. Before fresh/steer at 09:49:14.079Z/.498Z preserve literal `$demo-tools:review`. After actual fresh/steer at 10:08:33.485Z/.348Z share PID 445653, preserve preceding requests, and each end in a separate `/demo-tools:review` block. Persisted `turn-item.updated` at 10:08:34.288Z explicitly carries `inputIntent:steer`. Last two after entries retain literal agent-only/disabled mentions. The final observer uses `NodeFS.appendFileSync` outside its JSON-parse catch; supplied final-head smoke is nonempty. No faulty intermediate observer logs are submitted.

## Conditional and surface accountability

PASS means supported by the delivered observations. PARTIAL means the named branch remains unverified. No new proof was captured to fill these rows.

| Row | Verdict | Verified / unverified branches | Materiality to reported omission bug |
|---|---|---|---|
| F1 | PASS | Named personal wrapper, no registry/default-on baseline, lexical symlink skill path, metadata and no wrapper alias/duplicate. | Core defect directly proved, including independent replay. |
| F2 | PASS | Explicit false, explicit true over manifest-off, absent override, manifest-on sibling; disappearance/restoration shown. | Material enablement behavior proved. |
| F3 corrected | PARTIAL | Missing/malformed/nameless manifests, ordinary nonplugin directory, hidden plugin rejected. Missing/unreadable entire skills parent unverified. | Exceptional directory failure is not the reported nested-plugin omission; fallback is explicit in code. No runtime claim for it. |
| F4 corrected | PARTIAL / stale expectations removed | Root SKILL.md wrappers remain ordinary; registry root fallback preserved. Declared-empty root suppression not isolated by README-only fixture. | Personal root fallback in the original plan is stale: adoption skips root SKILL.md folders. Remaining registry suppression is unchanged helper behavior, not core bug. |
| F5 | PARTIAL | String/array directory roots, default additive, direct single-skill directories and first-root dedupe proved. Literal manifest path to SKILL.md file and registry/personal canonical collision not isolated. | These are additional root/precedence shapes; baseline discovery does not rely on them. Do not claim direct-file support from directory evidence. |
| F6 | PARTIAL | Out-of-tree lexical/absolute roots, escaping symlink, missing root omitted; valid siblings and default child symlink retained. realPath failures untested; in-tree declared symlink attribution masked by same-name dedupe. | Exceptional resolution/attribution gaps; no observed unsafe adoption or baseline failure. No unsupported failure injection demanded. |
| F7 | PASS for seeded scopes; limited helper coverage | User/managed→user, applicable project/local→project, disabled/invalid/unmatched absent; registry fallback and malformed-registry personal adoption proved. No helper-shape × scope crossproduct. | Relevant registry regression controls proved; crossproduct not needed for unchanged shared helper. |
| F8 | PARTIAL | Description/fallback/manual/agent-only flags, invalid/colon namespace, malformed/unreadable file omission and ordinary user root preserved. Separate ordinary project skill not seeded. | Material menu/dispatch filtering proved; ordinary project compatibility remains unexecuted, existing scanner unchanged. |
| F9 | PARTIAL | Actual provider and initialized-workspace snapshots, workspace precedence and genuine refresh completion proved. Pure no-cwd service invocation not isolated: “machine” snapshots include project entries. | Main composer/refresh path proved; do not infer pure no-cwd coverage from these Settings observations. |
| F10 | PASS | Fresh and active-steer native command plus disabled and agent-only negative controls. | Material adapter callers directly proved. |
| Web entry points | PASS | Dollar, leading/mid-message slash, Settings gate, keyboard/click, chip removal, Escape/reopen, submit and steer. | Relevant paths covered. No new palette/editor/keybinding surface introduced. |
| Desktop shell | UNVERIFIED execution | Same web inventory/render path structurally applies; no Electron IPC/shell changes. | No native Electron proof claimed; not material to this server discovery reproduction. |
| Native iOS/Android | UNVERIFIED | Separate composer UI not executed. 390 web is responsive web only. | Affected server data reaches mobile, but native acceptance remains unproved; not necessary to certify this web reproduction. |
| Remote / relay / tunnel | UNVERIFIED | No connection-mode execution. Inventory is server-owned and existing typed transport unchanged. | No remote proof claimed; no new origin/transport behavior introduced. |
| Other providers | NOT APPLICABLE | Only Claude discovery changes. | No invented six-provider matrix required. |

Corrected F3/F4 expectations agree with final code: valid manifest.name is required, colon names are rejected, a folder containing root SKILL.md stays ordinary, and installed-registry fallback remains. The original plan's missing-name folder fallback and personal root adoption are not acceptance criteria at this head.

## Independent replay — recovered

One affected target: **after V1, CSS 1440×900, light**, delivered 1280×800. Linux Chrome 154, DPR2, zoom1, root16px, body16px/24px system font, scroll0, frozen still date 2026-10-22T09:40:00Z. Real app, actual provider filesystem discovery; no injected menu/RPC/inventory/render data.

Final whole-image comparison against delivered `evidence/after/V1-1440-light.png`:

- Zero threshold: **588 / 1,024,000 pixels = 0.057421875%**.
- Max-channel >16/255: **0 pixels = 0%**.
- Bounding box (right/bottom exclusive): **[11,10,37,36]**, confined to top-left sidebar-control rasterization/background.
- The affected popup and composer match exactly. No registration, crop or ignored region in headline comparison.
- **Full replay recovered with only AA/color delta. No substantive non-AA delta finding.** Threshold alone does not prove AA; localization to the tiny control with matching geometry/content supports that classification.

Earlier diagnostic replay of the original retained thread was contaminated by the subsequent dispatch history and provider-update toast: 217,294 zero pixels / 22,609 >16 pixels. That is superseded by the clean new-thread replay, not evidence against the fix. Original thread was never rewritten, rewound, or submitted to during this audit.

### Exact UI recipe missing from the original index

The committed filesystem seeder/data recreate provider state. They do not create the visual thread, title, history, panel state or dismissed toast. Reusing a thread after R3 will not reproduce the earlier still. Add this explicit real-app setup to the index; no repository edit is required by this audit.

1. Confirm requested clean head. With the isolated server stopped, run `node apps/server/src/provider/testing/ClaudeSkills.fixture.mjs /tmp/issue-23507 enabled`. Existing inventory fixtures may remain: `$demo` filters them out. Use the supplied private isolated provider configuration; never upload it.
2. Start `CLAUDE_CONFIG_DIR=/tmp/issue-23507/claude vp run dev` in `/home/ubuntu/wt/issue-23507`; retain the session and read actual ports. This run used web7393/server15433 and worktree `.t3`, never live T3 state.
3. Open the T3 preview and pair through the normal startup pairing flow. If navigating a hash link leaves the existing Pair page unchanged, paste that fresh startup token into Pairing token and click Continue. Keep tokens private.
4. Open the existing server project rooted at `/home/ubuntu/wt/issue-23507/apps/server`. Use breadcrumb **New thread in server** to create a NEW draft with **Current checkout**, `fix/issue-23507`, **Claude Opus 5.5**, **Medium**, **Full access**. Do not reuse or edit the original proof thread.
5. Type exactly `Reply only OK. Do not use tools or change files.` in Message and submit with Enter. Await actual assistant `OK` and completion of the turn (Stop generation/working state gone). One user message and one assistant reply only; do not run a skill in this fixture turn.
6. Automatic title was `Identify Thread Subject` in this replay. Open its breadcrumb Thread actions, choose **Rename thread**, replace Thread title with `Reply OK`, press Enter.
7. Click **Dismiss notification** on the Claude update toast if present. Do not install an update. Collapse the **thread details panel** and **main sidebar** with their real buttons. Confirm sidebar state collapsed; avoid Ctrl+B in the rich-text composer because it formats bold.
8. Set preview CSS viewport 1440×900 and light appearance. Type `$demo` in Message, press ArrowDown once to highlight **Review** (Manual is initially selected). Do not press Enter or submit this query.
9. After setup/turn completion, freeze Date/new Date/Date.now to `2026-10-22T09:40:00Z` for this still only. Scroll timeline and page to0; move pointer off controls. No menu, RPC or React-state injection. Verify actual UA/DPR/font/viewport and highlighted row.
10. Save one preview snapshot, compare RGB directly to delivered after V1 desktop-light image. Restore the real clock. For other delivered grid cells the controls are CSS390×844 or1440×900, light/dark; this audit independently replayed only the required single affected cell.

New sandbox thread retained in isolated state: `f70b2d6b-f1e6-4afb-a798-cca3be044086`. It contains only the authorized benign exchange and an unsent `$demo` query. No original thread mutation or file rewind. Local replay images and diff/stat files are under `/tmp/issue-23507/pass2/new-thread-replay-*`; they are independent audit artifacts, not replacement evidence rows.

## Cleanup and FRICTION

All own server sessions **52690, 29058, 67063** stopped by retained session Ctrl+C, each exit130. All audit preview tabs closed. `ss -H -ltnp` showed no listeners on **7393,15433,5803,13843** after final teardown. Worktree remains clean at requested head. No repository edit, push, comment, PR, merge, auth/settings upload, live DB write, menu/RPC injection, or replacement capture for missing conditional rows. Only authorized isolated fixture/UI/server state and local audit artifacts were written. No repo-wide checks run.

FRICTION category|what|avoid

- fixture|retained proof thread accumulates later dispatch turns|create a new same-workspace thread with the exact one-message exchange before independent still replay; keep original immutable
- fixture|committed filesystem fixture omits visual thread/title/panels/toast setup|include the explicit UI recipe above in index; do not imply the seeder alone recreates a screenshot
- pairing|fresh tab redirected to Pair, hash-only navigation did not complete pairing|use the real Pair form with the fresh startup token; await authenticated destination before dependent controls
- controls|Ctrl+B in rich-text composer toggles bold|use actual Toggle main sidebar button and verify collapsed state
- capture|provider update toast and panel state contaminate replay|dismiss via actual UI before freezing still clock; verify dimensions and selected row before final capture
- refresh|machine refresh leaves workspace TTL cached|wait for actual workspace refresh evidence, as R2 does
- analysis|seeking beyond final video frame can leave an earlier extraction file untouched|use unique outputs/check frame existence, inspect a valid timestamp before alleging narration mismatch; the tentative R2 caption objection was withdrawn after direct frame verification
- cleanup|server/browser restarts can leave ports or tabs behind|track each session/tab, stop only those, verify listeners absent

Final verdict: **SUFFICIENT** for the reported bug, with the unverified exceptional/native/remote rows above explicitly retained as gaps. Full independent replay recovered; no evidence correction is needed for the delivered affected menu capture beyond adding the missing UI recipe and this audit link.