# Proof audit pass 2

PR: [#12524](https://git.cafe/pingdotgg/t3code/pulls/12524) / [#12524](https://github.com/pingdotgg/t3code/pull/12524).

Artifact correctness: **SUFFICIENT** for an honest inventory of missing proof. Native capture coverage: **INSUFFICIENT**, 0/8 rows. The explicit dispatcher exception allows a final implementation report with every native row UNVERIFIED; it does not establish native correctness or make missing evidence sufficient. This is a proof/artifact audit, not a new merge approval or comprehensive code review.

## Inputs and identity

Compared the [pass 1 matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/058d2a4020c1f9a2/proof-audit-pass-1.md) and [capture inventory](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/366a7b7a74a2d73d/evidence-capture-inventory.md), including their local copies in /tmp/to-12524. Both public downloads were byte-identical to the local files. Local SHA-256 digests:

- Matrix: `8b7298e5126e152cd83b57497d9294d05db268db756b65ec272cf9f7cad85654`.
- Inventory: `62099c767599b0a11df82fa044b070f41055aba045bc0a0afd9c9beaac3f5b3d`.

Read-only checkout /home/ubuntu/wt/pr-12524 is on takeover/pr-12524 at [f1ad4b2](https://github.com/pingdotgg/t3code/commit/f1ad4b2523d3f6501519c55f1a768ca92a929dd6). Its merge-base with local origin/main is [3cc31ed](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b), matching both artifacts. Original proposal [4f5fba9](https://github.com/rashidgg/t3code/commit/4f5fba971e1c93b33bee0acbf1283c8e78b89b08) exists locally and its lookup diff was inspected. It is a separate original revision, not the replacement baseline. No remote ref refresh was performed; these checks establish the specified local revisions, not a live forge-head claim.

## Row-by-row reconciliation

Each complete fixture/evidence/medium/status row in the inventory is byte-for-byte identical to its counterpart in the matrix. Every row remains UNVERIFIED. Code references below are under apps/desktop/src/snapShot/ at the replacement SHA; they support the required cases, not observed runtime outcomes.

| Row | Matrix versus inventory and source reconciliation | Missing native proof | Status |
|---|---|---|---|
| M1 | Exact row match. ActiveWindow.ts:55-79 reads frontmost identity, selects a window, returns owner PID; DesktopSnapShot.ts:480-489 calls native capture. | Actual Device Hub PID -1 before/after recording, attachment pixels, title/bounds/owner identity, reveal/completion/error outcome. | UNVERIFIED |
| M2 | Exact row match. ActiveWindow.ts:71 keeps positive PID authoritative even when names differ; :78 retains owner-name fallback for empty app name. | Positive-PID competing-owner and empty-app-name native controls, before/after captures and identity traces. | UNVERIFIED |
| M3 | Exact row match. ActiveWindow.ts:71 allows fallback only for nonempty exact app name with nonpositive PID; DesktopSnapShot.ts:481-482 reports missing window. | -1 and zero boundaries, empty names, prefix/suffix/case mismatches, failure sequence and no wrong attachment. | UNVERIFIED |
| M4 | Exact row match. ActiveWindow.ts:59-71 requests on-screen candidates, excludes nonzero layers and returns first match; :79 returns selected owner PID. | Ordered native candidate traces, excluded-only no-match and two-eligible-window captures. | UNVERIFIED |
| M5 | Exact row match. DesktopSnapShot.ts:535-555 propagates selected identity and gates accessibility by setting; SnapShotAccessibility.ts:102-108,123-144 consumes PID and has fallback window matching. | Native accessibility enabled/disabled recordings, image/context association and selected positive PID trace. | UNVERIFIED |
| M6 | Exact row match. DesktopSnapShot.ts:1364-1414 has independent darwin-only scoped temporary test capture. Web SnapShotSettings.tsx:345 and SnapShotSetupDialog.tsx:439-449 call it and gate progression. | Before/after Settings success/progression, temporary-output disposal/no attachment, native identity trace; controlled Device Hub focus if feasible as matrix specifies. | UNVERIFIED |
| M7 | Exact row match. DesktopSnapShot.ts:1388-1394 distinguishes missing lookup; :1402-1409 maps capture failures separately. | Native no-frontmost/nonmatch and permission-denied action/error recordings, remaining in setup and absence of phantom attachment. | UNVERIFIED |
| M8 | Exact row match. DesktopSnapShot.ts:1167-1169 wraps common callback; :1296-1316 registers modifier-pair and accelerator paths. | Actual Device Hub before/after recordings for both registrations, focus/order, no duplicates and attachment/reveal sequence. | UNVERIFIED |

No silent row omission or status promotion found. The inventory preserves the required media for every row; it offers no screenshots, recordings, identity traces or attachment captures as completed proof. The matrix's proposed two-session/three-recording-per-session set is a future requirement, not existing evidence. M1/M8 may share a session as documented. No pixel delta can be reproduced or calculated without before/after images; no zero-delta or visual-parity claim is supported.

## Source consistency and limits

Inspected the complete base-to-replacement diff: only ActiveWindow.ts (10 changed lines) and ActiveWindow.test.ts (116 added lines), 123 insertions and 3 deletions overall. The implementation uses exact-name fallback for nonpositive PID and returns selected owner PID. The original helper-based proposal implements the same selection rule. No concrete contradiction with the artifacts was found in this focused source reconciliation.

The three tests mock child_process and execute the JXA string in node:vm. They cover invalid-PID selection/exclusions, empty-name rejection, and positive-PID authority. They do not supply native proof or cover every native matrix variant. Pass 1 records three passing tests; this audit inspected the fixtures but did not rerun tests or independently reassert that historical execution result.

ActiveWindow.ts:138-141 gates JXA to darwin. DesktopSnapShot.ts:286-289 selects separate Linux portal/unavailable modes, and :473-475 only invokes activeWindow in direct mode. The Settings test rejects non-darwin. No changed renderer/layout/style, standalone web/mobile, provider, contracts or server logic exists in this diff; no unrelated width/theme or Linux capture is needed for this patch's proof matrix. Native AppKit/CoreGraphics behavior and actual Device Hub frontmost identity remain unverified.

Final PR body is described by the dispatcher as planned to show all eight rows UNVERIFIED and link the artifacts. This audit does not certify an unpublished final body. It should retain 0/8, all eight row IDs, the absence of native media, and the distinction between accepted reporting exception and insufficient runtime coverage.

## Procedure and friction

No code edits, tests, pushes, PR comments/edits, browsers, servers, watches or remote-machine access. Worktree status was clean at inspection. Only this report was written outside the checkout and uploaded with ghdrop. Required app-owned PR registration was performed; no forge mutation was performed. No live PR metadata/CI review was needed for this specified-revision artifact audit.

FRICTION: Native macOS/Device Hub is unavailable and all eight native runtime rows lack captures; dispatcher explicitly accepts UNVERIFIED reporting. Initial public-file retrieval returned HTTP 403; retry with a browser User-Agent succeeded and established byte equality for both artifacts. No unresolved artifact-retrieval issue remains.

VERDICT: INSUFFICIENT for native capture coverage; missing rows M1, M2, M3, M4, M5, M6, M7, M8. Artifact correctness: SUFFICIENT.