# Issue 19530 proof audit, pass 2

Evidence verdict: INSUFFICIENT A4–A13. This is an evidence audit only, not another code review or a request to expand implementation.

Audited [#19553](https://git.cafe/pingdotgg/t3code/pulls/19553), also [#19553](https://github.com/pingdotgg/t3code/pull/19553), for [#19530](https://github.com/pingdotgg/t3code/issues/19530). Local HEAD and current GitCafe headOid both equal [d78da18a46](https://github.com/pingdotgg/t3code/commit/d78da18a463e2a0d05f4efef51f6bfcbd027034f). BEFORE resolves to [bb7783e295](https://github.com/pingdotgg/t3code/commit/bb7783e295506ad423f527ed28a019836e331e8c). The pass-1 matrix's older AFTER commit is superseded. Historical capture SHA attribution is the capturer's declared provenance; image pixels do not independently attest a build commit.

[Final immutable delivery index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ed1eb9e40be3aeb8/index-public.md). All 14 standardized narrated recordings, comparisons.json, stability-final.json, capture-helper.js and manifest-final.json were fetched from its public URLs and SHA-256 matched the inspected local bytes. Earlier indices with missing BEFORE recordings are superseded. Items marked LOCAL ONLY remain local evidence, not public proof.

## Findings and per-row status

| Row | Evidence status | Exact limitation / result |
|---|---|---|
| A1 | Covered primary behavior, four width/theme pairs | BEFORE row +2/-1 versus hidden panel +1/-0; AFTER row/panel +1/-0. Opening recorded; original narrow unsettled stills replaced by stable retakes. Strict network-idle telemetry absent. |
| A2 | Covered primary behavior, four pairs | Actual alternate selected; AFTER row +0/-0 and panel no net changes; return to main/Automatic shown. BEFORE mismatch retained. Narrow selector labels are crowded; selection is established by menu interaction and zero-result endpoint. |
| A3 | Covered primary behavior, four pairs | AFTER hidden → shown → hidden gives 1/0 → 2/1 → 1/0; BEFORE row stays 2/1. Narrow BEFORE remount resets local panel override, so exact click count differs; this is disclosed rather than identical-action proof. Saved-setting preservation is not separately proved here. |
| A4 | PARTIAL, four pairs | Alternate close/reopen shown. Missing other right-panel surface, navigation away/back, and Uncommitted-to-remembered-branch reopen sequence. |
| A5 | INCOMPLETE | BEFORE 1440 light only; no matched AFTER, reload, or other three variants. Saved fallback/session precedence/reload contract unproved. |
| A6 | INCOMPLETE | BEFORE 1440 light only; no matched AFTER or other variants. Real idle second-thread seed exists, but session sharing and per-thread base behavior are not proved on final head. |
| A7 | INCOMPLETE | BEFORE external-write/focus only, 1440 light. No final-head match, real workspaceMutationId operation, status-identical custom-base mutation, or in-flight ordering. Injected focus is disclosed. |
| A8 | MISSING | No deterministic no-data pending/error/retry fixture. Normal opening cannot substitute. |
| A9 | MISSING | No stale-data pending/error/recovery recording. Reported unit tests are not visual proof. |
| A10 | MISSING | No isolated non-admin checking/deny/regrant sequence. Admin fixture cannot prove it. |
| A11 | INCOMPLETE | BEFORE 1440 light only. Shown Uncommitted first yielded no net changes; explicit Refresh retake yielded +2/-1. No matched final-head sequence or other variants. Do not classify transient BEFORE behavior as an AFTER regression. |
| A12 | MISSING | No genuine completed checkpoint or labeled harness substitution. Idle thread is insufficient; no provider turn was run. |
| A13 | MISSING | No omitted-files, authoritative empty-files, missing-source or truncated-complete-stats response-shape proof. Ordinary current-server captures cover only ordinary responses. |
| G1 | Outside visual minimum | Source/unit guards were not re-reviewed in this evidence-only pass. |
| G2 | Partial guard coverage | Real 1920×1080 light/dark inline captures/recordings; no explicit compact/essential density proof. Toolbar hover shading is visible. |

These are proof gaps, not newly established source defects. No expanded implementation or fourth code-review round is requested.

## What was actually opened and checked

Opened every standardized endpoint through the nine BEFORE, nineteen final and five supplement contact sheets; inspected all delivered diff images at both thresholds through those sheets. Stable duplicate a/b files were checked computationally; unstable a files were opened in supplements. Opened the five additional exploratory PNGs through a new sheet. All 14 standardized narrated videos and the superseded exploratory video were opened as decoded sampled storyboards; standardized final frames were decoded separately where four-second sheets miss ending actions (including both G2 dark endpoints and narrow hidden endpoints). This is sampled visual inspection, not continuous playback or frame-by-frame review. Raw and narrated standardized files decoded fully; raw null-mux output reported non-monotonic DTS warnings, narrated output decoded without errors. Written burned-in narration and timestamp index exist; no spoken audio. Some captions summarize multiple actions and are not individual click timestamps.

Recomputed all 39 comparison records from source PNGs: pixel counts agree at threshold 0 and maximum-channel difference >16/255. Diff0 is absolute RGB difference amplified ×8; Diff16 is a magenta binary mask. No alignment or masking. Desktop exports are resampled 1280×800 (1440×900 CSS) and 1280×720 (1920×1080 CSS); narrow exports are 780×1688 (390×844 CSS at DPR2). Recordings retain 2880×1800 / 3840×2160 / 780×1688, consistent with DPR2. Themes visibly agree. Contact-sheet text is small; full captures and decoded endpoint frames were used to resolve important totals/content. No claim of native mobile or Electron verification.

Visible differences accounted for: hidden row 2/1→1/0; alternate and its closed/reopened row 2/1→0/0. Desktop shown endpoints are pixel-identical. Narrow settled panel-only endpoints are identical except four low-amplitude pixels at x547,y131–134 in light hidden-again (none above16). G2 includes row totals and toolbar hover/refresh shading: 382/25 changed pixels in light, 379/24 dark at thresholds0/16. Original narrow a/b settling and supplemental sidebar repaint/relative-time drift are not accepted as stable diffs. 21 of 96 a/b checks differ, mostly supplemental BEFORE scenarios; three AFTER pairs differ (two initial narrow A1s and 19 pixels in G2 light). Stable retakes support primary endpoints, not missing rows. Two matching frames 500ms apart establish pixel stability, not network idle.

Fixture inspected independently: clean feature worktree; main ref 02f5eec59f6cb9a850b2772d9b0a65383a4db92e; feature/alternate b6dee0c3fcdd2edc69bae00c2e9e21759c7d19c1; file bytes match published seed. Full driver is a helper plus narrated manual UI sequence, not a standalone replay script.

## Independent real-app rebuild and cleanup

Started final-head app with vp run dev, isolated /home/ubuntu/wt/issue-19530/.t3, retained terminal session41468. Used T3 preview tab tab_4_422de850-28fd-42a7-a853-d1aa75a46917 at 1440×900 CSS, DPR2, light. Reused supplied real fixture, paired privately, selected Comparison fixture, collapsed sidebar, opened Changes. Row and panel each showed +1/-0; expanded sample.txt showed unchanged whitespace line and added line only. This corroborates one A1 AFTER capture; it does not fill other matrix cells. Defaults initially collapsed file content and clicking filename opened a file surface, corrected by closing it and using Expand sample.txt. No response injection or source edit.

Audit scratch: /tmp/issue-19530-audit-pass2/. Capturer evidence: /tmp/issue-19530-evidence/. Disposable seed: /tmp/issue-19530-repo/. Isolated runtime: /home/ubuntu/wt/issue-19530/.t3/. BEFORE worktree /tmp/issue-19530-before already removed by capturer. Do not remove shared worktree or live ~/.t3/userdata. Audit browser screenshots are retained under /home/ubuntu/.t3/userdata/browser-artifacts/ as app-owned exported artifacts, not server state. No scratch committed. Source git status clean. Own runner PID811613 identified through the captured server's process ancestry and terminated with SIGTERM; both ports6396 and14436 were verified without listeners after shutdown. No pattern kill. No merge, source edit, push, PR comment or watch. PR registered to thread with watching=false.

Independent AFTER reproduction, row and panel totals:

![AFTER final-head A1 row and panel both show plus one minus zero](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/44161dd1b56e221a/browser-screenshot-localhost-mvmcoi86-be3d33ee.png)

Independent AFTER reproduction, expanded filtered patch:

![AFTER final-head A1 patch highlights only the added line](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a6455747665ac082/browser-screenshot-localhost-mvmcq993-59f329f2.png)

## FRICTION

- coverage | A4 navigation and A5–A13 final fixtures missing | Retain explicit incomplete rows; accept or schedule separate proof work without widening implementation.
- stability | Initial narrow frames settle and G2 hover shading persists | Use stable retakes and move pointer before endpoint capture; retain original differences.
- delivery | Immutable early index listed incomplete uploads | Use final immutable index and byte-match published evidence; local-only is not public proof.
- reproducibility | Published helper is not a full replay driver | Preserve exact seed/settings/action sequence; report manual reproduction limits.
- browser | Fragment navigation did not auto-complete pairing in audit tab | Enter existing private token in app pairing form; never publish it.
- transport | Python urllib fetch returned403 while curl succeeded | Use curl for bounded public-byte verification; all selected final URLs matched.

VERDICT: INSUFFICIENT A4–A13