# Proof audit pass 2 — issue 23378

Findings: no proof-blocking defect. One nonblocking precision correction: the index's 20.6/24.5/40.6/42.0/99.0 s UI transition markers identify the first authenticated shell, initially displaying “What should we work on?”, not the fully populated seeded project view. Later decoded frames and final stills do display the synthetic project/thread and primary environment. These timings should be labeled “authenticated shell”; the row outcomes remain proven. The sensitive auth timing change still carries NEEDS_JULIUS; this proof verdict is not merge authorization.

[Issue #23378](https://git.cafe/pingdotgg/t3code/issues/23378). Reviewed base [e54e71d725](https://git.cafe/pingdotgg/t3code/commit/e54e71d725b6eef166ee9b85137c09e051cff342) → head [e38f845adb](https://git.cafe/pingdotgg/t3code/commit/e38f845adbb6399e28436ce1c62cc1568f81c9f6), branch fix/issue-23378. Verified full local SHAs, clean source, complete diff, issue body, caller/error path, index, pass1 matrix, archive and actual recordings/stills. The change after [c3dd6959fb](https://git.cafe/pingdotgg/t3code/commit/c3dd6959fbe2a3392c685871f9ca2c2113845d0c) adds only the committed seeder; production implementation and tests are unchanged. Keeping that seeder is explicitly required, not an unresolved scratch-file finding.

Started 2026-10-22 19:46:12 UTC; hard deadline 20:06:12 UTC. Completed runtime/inspection work before 19:49 UTC; report published within deadline. No source changes, commit, push, PR or forge write. Only one authorized desktop/dev-server run was started; no browser automation or extra worktree.

## Row status

1. PASS — healthy base/head. Inspected decoded recording frames from launch through settled project view. Auth spans succeed in 36.182706 and 56.177764 ms; neither recording has a fatal marker. First shell at 20.6/24.5 s, populated fixture later. Full final 1920×1080 RGB stills are identical: 0/2,073,600 pixels differ, threshold >16 also 0. No compulsory 60 s delay.
2. PASS — matched 30 s stall base/head. At video 25 s, decoded base shows exact fetch-session-state HTTP 500 fatal and head shows splash. Independently rescanned all frames at the supplied fatal/authenticated markers: base fatal 21.3–40.5 s, first shell 40.6 s; head no fatal, shell 42.0 s, populated fixture later. Base's first bearer fails at 15007.946337 ms, then a second succeeds. Head has one successful bearer at 22275.292753 ms. No click is in this runner path. Base also recovers automatically after resume; no permanent-failure claim is justified or needed.
3. PASS — head exhaustion and visible Reload recovery. Actual frames show splash, fatal at 65.7–85.3 video seconds, Reload transition back to splash, then shell at 99.0 s and populated fixture later. Auth first fails at 60013.950176 ms. Timing records stop at ready and resume ready+85.262 s, click on the visible Reload app button 105 ms later at (830,444). Accepted raw log contains exactly one main-window creation, supporting same Electron process. Owned watch build was frozen for this row. This proves successful recovery with the Reload interaction; it does not establish that Reload was necessary for eventual recovery.
4. PASS — deterministic regression/control. Inspected published red-base/green-head transcript: same head test on base fails only the new 30 s case with 15 s TimeoutError; three controls pass. Independently reran head command `vp test run apps/desktop/src/backend/DesktopLocalEnvironmentAuth.test.ts`: 4/4 pass, exit 0, 7.64 s. Deferred/TestClock test has no wall-clock sleep. Did not rerun base or edit its source in pass2.

Missing required rows: none. One light desktop viewport is adequate because no render/layout path changed. Original macOS 26.6.2/MacBook Air M4/nightly build and underlying SQLite/event-loop cause remain unverified. Linux shared Electron auth timeout/recovery is what is proven. Standalone web/mobile/remote auth do not execute the changed desktop-local service.

## Independent asset checks

All 21 public links in the delivered uploads list were fetched with curl and SHA-256 matched to local artifacts, including all five recordings, stills, diffs, transcript, archive and index. Every archived entry also byte-matches its local copy, and archived/local seeder byte-matches the committed seeder.

Recomputed RGB pixel counts, with no masks/exclusions:

- Healthy: diff0 0; max-channel >16 count 0.
- Stall at video 25 s: diff0 1,943,084; >16 count 132,721.
- Fatal → Reload final: diff0 1,543,895; >16 count 86,083.

Reconstructed both absolute RGB ×8 saturated diff and binary threshold images for every pair: all six delivered diff artifacts match exactly (0 mismatched pixels). Visually inspected their full-surface contact sheet as well as original full-size settled frames. Video marker rescan independently reproduced every delivered transition range. Marker onset is shell onset, not populated-fixture completion.

## Independent capture rebuild

Ran the HEAD-COMMITTED `scripts/issue-23378/seed-evidence.py` against a private offline copy at `/tmp/issue-23378-pass2-evidence/fixture-home`. Fixture has one synthetic project and one stopped thread, zero copied conversations. Used existing branch-migrated isolated schema, preserving its migration markers; no live state read/write was needed. Same Electron 44.9.3 wrapper flags, Linux Xvfb 1920×1080 light, real auth, backend 21738 and web 13698. Runner copied verbatim except output directory changed to prevent overwriting delivered artifacts; label audit-head-stall30, stall argument 30. No product hooks or mocked auth.

Runtime transcript: backend ready launch+33.206 s; verified owned backend PID 1636165 SIGSTOP at +33.253 s; recording +33.263 s; SIGCONT +63.499 s (ready+30.293 s); single main-window launch; final still +98.868 s (ready+65.662 s); cleanup +108.112 s. Auth succeeds once in 23660.035752 ms. Rebuilt video has no fatal marker, shell begins at video 38.6 s; final fixture is settled.

EXACT REBUILT PIXEL DELTA against delivered `head-stall30-final.png`: diff0 0/2,073,600; >16 count 0; maximum channel delta 0; mean absolute channel delta 0.0. This is a lossless root screenshot comparison, not a comparison of lossy video frames. Rebuilt still, recording, timing and JSON metrics remain under `/tmp/issue-23378-pass2-evidence`.

## Cleanup and FRICTION

All tracked runner PIDs and outer Xvfb/DBus processes are absent; no keyring with the owned display remains. Ports 21738/13698 have no listeners. Generated run-home credentials/state removed. No extra worktree created. Source remains clean at exact head. Disk stayed at reported 12 GB available, above 5 GB hard stop.

FRICTION categories:

- Fixture/schema — prior incomplete fixture run was discarded; accepted committed seeder now includes required thread metadata. Independent reseed and full capture succeeded. Shared schema markers 68–70 are explicitly reported as unknown/skipped by both revisions, not concealed.
- Cold renderer — earlier splash-only stills discarded. Accepted final captures and independently rebuilt final show settled synthetic content. Shell-marker versus seeded-content wording correction recorded above.
- Development watcher — discarded exhaustion log independently confirms two main-window launches. Accepted replacement confirms one; pausing the owned watcher avoids invalidating the long row. No watcher pause needed in independent short rebuild.
- Base behavior — fatal is transient here, followed by automatic recovery. Both recording and written index preserve this limitation.
- Tooling/network — Python urllib public downloads returned HTTP 403; curl successfully fetched and verified all files. No installation or alternate browser needed.
- Publishing/privacy — public artifacts matched delivered bytes; only this synthetic-data audit report is uploaded in pass2, no raw startup logs/credentials.
- Platform — original macOS build/cause unverified, explicitly scoped; not a missing row in pass1's minimal shared-timeout matrix.
- Authorization — NEEDS_JULIUS remains outstanding for sensitive auth timing; committed seeder retention is already authorized and is not a defect.

VERDICT: SUFFICIENT