# Proof audit PASS2

**Findings:** no blocking evidence gap or code defect found in the requested scope. The real withdrawal behavior is sufficiently demonstrated, and the PASS1 minimum matrix is complete. No new fixture is needed.

Reviewed clean checkout `/home/ubuntu/wt/issue-24690`, base [c79ef8c454](https://git.cafe/pingdotgg/t3code/commit/c79ef8c454e1268ff79da5a9dcb74572e86f7861) → exact head [8625d7af75](https://git.cafe/pingdotgg/t3code/commit/8625d7af75e47f140be2bfbb9c3cd462ae6766bc). Runtime revision mapping is the capturer's explicit provenance record, corroborated by the retained clean head and isolated server startup record; this audit did not recreate either runtime.

**Small evidence clarification:** the shortened baseline is a 59.250-second convenience edit. Its variable-frame-rate source has no new frame at exactly second 225 (the next is 229.940); PTS rebasing changes the boundary hold. Do not treat derivative timestamps as an exact wall-clock mapping. The supplied 251.804767-second unedited original already supplies the authoritative temporal proof. Clarify the derivative caption if precise timing is discussed; no recapture is necessary.

| Row | Status | Direct evidence and limits |
|---|---|---|
| C1 | PASS | Base 1440×900 CSS, dark, 2880×1800 recording. Successful output and completed turn coexist with stale card/sidebar Approval. Pointer reaches Approve, then card clears and “Answer delivery not confirmed” appears. Saved event history and five matching adapter failure spans correlate the single response to the obsolete native request. Both original and shortened videos inspected. |
| C2 | PASS | Head same wide dimensions/theme. Actual card and sidebar Approval are visible at video PTS 16.722333; at 16.858133 card is absent and sidebar says Working. Output 0 and completion follow. Loading screen at roughly 34–35s, followed by the same completed thread and absent card, establishes real reload persistence. History is expanded later in the recording. |
| C3 | PASS | 390×844 CSS light / 780×1688 raster. Same base thread, output 0, stale actions, composer; file predates the response. Terminal still only. |
| C4 | PASS | Same narrow dimensions/theme, actual head thread, output 0, ordinary composer, no actionable approval. Different answer/title/scroll are real run differences. Terminal still only; no native-mobile claim. |
| W | PASS | Independent read-only SQL reproduces pending event 158 → cancelled 162; matching approval node/item events 157/159 → 161/163. All three terminal timestamps equal 06:36:32.583Z. Matching native Bash tool completes at .758Z with output 0; run completes 06:36:37.032Z. Persisted projections are cancelled and pending count is 0. Exact command/native tool correlate with the actual CLI result and bypassPermissions hook session. |
| U | PASS, deterministic | Focused adapter test verifies deny and no withdrawal re-emission after a user cancel. New ingestor tests verify committed accept and decline-with-feedback survive separate provider node/request/item cancellation writes. These are protocol tests, not a claimed real U interaction. |

**Independent checks:** all four added regression cases passed. The entire ProviderEventIngestor test file then passed 30/30 (including two of those four); diff whitespace check passed. Full five-file diff inspected: adapter, EventSink, ingestor, and two existing test files, +342/−23; no client rendering or contract code changed. The EventSink guard checks cancellation against the current request inside the transaction and protects request, node, and item even when emitted separately. The adapter Deferred guard alone would not cover an answer committed before outbox delivery; the new persisted-projection tests cover that gap. Existing shared pending-request/shell filters consume only pending requests.

**Artifact inspection:** all 32 supplied PNGs were inspected directly or, for extracted video frames, through their labeled contact sheets with critical frames inspected at full size. This includes all ten terminal captures, six difference images, fourteen extracted frames and two sheets. Independently extracted additional contact sheets/frames from all three actual MP4s, including every recorded head frame around withdrawal. The eight direct screenshots and two original recordings are byte-identical to their retained T3 capture paths. Selected sanitized transcript payloads match both saved raw event exports; head also matches the retained database. Repeated tool blocks in the CLI export include API-request echoes, not repeated execution: each actual session contains one fixture tool use/result.

**Strict compliance:** C1–C4, W and U meet the supplied PASS1 minimum. This is not proof of cross-run visual equivalence or compliance with a broader pixel/OS-emulation/rebuild template. Independently recomputed diff0 is 49.576% narrow and 21.295% tool-downscaled wide, descriptive only. diffT compares two terminal snapshots within each run: wide 0 pixels; narrow 62 pixels in each, bbox `(50,1409)–(52,1440)`, the caret. Narrow snapshots are not identical. CSS animation suppression is not OS prefers-reduced-motion emulation. Wide direct snapshots are 1280×800 tool-downscaled rasters, distinct from the 2880×1800 recording frames.

**Rebuild not performed.** Starting a browser/server was expressly excluded, and the primary already performed the integrated pass. This prevents claiming an independent runtime reproduction; it does not undermine the protocol-proof conclusion from actual recordings, correlated persisted state, and passing deterministic tests. The removed baseline database prevents a fresh base SQL export; retained raw events, CLI transcript, failure spans and original recording remain mutually consistent. Native mobile, Electron shell, remote/tunnel and notifications remain code-traced or unverified, as scoped in PASS1.

**FRICTION**

| Category | Happened | Prevention |
|---|---|---|
| Sparse video sampling | Initial integer-second sheets missed the briefly painted head card. | Inspect actual frame PTS around the correlated withdrawal; no slower hook needed. |
| Pixel interpretation | Real model text/scroll differs; narrow caret changes 62 pixels. | Keep cross-run diff0 descriptive and within-run diffT separate; retain nonzero counts. |
| Derivative timing | VFR trimming rebases a sparse boundary and yields 59.250s. | Cite unedited original for temporal correlation; label derivative as a convenience edit. |
| Audit diagnostics | One seek exceeded shortened duration; first SQL query used the wrong request key. | Read ffprobe duration and SQLite schema first; corrected both without touching source/state. |

Source and database remained unchanged; only audit artifacts were written under `/tmp`. No browser/server, delegation, push, PR, merge, or watcher started. Only this sanitized report is uploaded, using the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md); no settings, secrets, raw traces or unrelated histories are included.

VERDICT: SUFFICIENT — no missing rows in the supplied minimum matrix.