# Proof audit pass 2 — issue [#15927](https://git.cafe/pingdotgg/t3code/issues/15927)

## Findings first

**Useful, concrete minimum proof exists; the full prescribed evidence is INSUFFICIENT.** Four final corrected-head Chromium keyboard select-all/copy/native-paste cells independently compare exactly with the canonical 11,752-character, 226-statement SQL. The 390 dark partial-selection artifact independently matches source offsets 48–620 (572 characters) after scrolling to 5928 with mounted rows 101–227. This establishes full-source copying and persistence of a released partial selection through eviction in the tested web path. It does not establish held autoscroll, clean paired base behavior, all callers, ownership regressions, newline branches, or native desktop behavior. No new confirmed code blocker was found. The two code MERGE reports are compatible with this evidence verdict; they did not certify matrix completion.

1. **Controlled before/after proof remains missing.** Resumed base gestures are contaminated by the update toast and must not be counted as clean reproductions, despite saved 100-statement pastes. Original before-copy is historical evidence, not a fresh independent replay. Wide stills change source-panel width from 539 to 359 CSS pixels; narrow widths remain 342.195. Pixel maps therefore cannot establish visual non-regression or attribute changes to this fix.
2. **Held drag remains a named gap on final head and narrow layout.** Earlier wide held-down artifacts at the original implementation are useful supporting evidence. Reverse paste is 11,751 characters, exactly the canonical source without its terminal LF, appropriate to an endpoint at the last text character. Neither supplies final-head/narrow held-autoscroll proof. Partial drag, release, scrollBy, copy is a different claim and passes that narrower claim only.
3. **Clipboard ownership/data boundaries are incompletely exercised.** No qualifying final real-app editable-focus, two-preview ownership, context-menu, CRLF/CR/mixed/blank/Unicode, caret/Shift, cancellation, replacement/remount or repeated lifecycle captures were supplied. Fixture existence and reviewer helper diagnostics do not turn these into runtime passes.
4. **Independent rebuild/replay is missing.** No browser/server operation or rebuild was performed. No preview tools are exposed in this audit's tool catalog; no competing-server determination was needed because no launch was attempted. The final instruction expressly requests no new browser/rebuild data. This is a limitation, not a pass or code defect.

## Revision and scope attestation

Initial checkout was clean at full SHA `6130ec96280212aff1fbe6de23ec8ea6bc0b7c43`; merge base with origin/main was `ed9b7ca9c53843ea1e6b466bf7d52928d10e7db0`. Complete target diff: three files, +473/−2. The ReadOnlySourcePreview base blob is identical at old base [b5a226e49c](https://git.cafe/pingdotgg/t3code/commit/b5a226e49c) and new base [ed9b7ca9c5](https://git.cafe/pingdotgg/t3code/commit/ed9b7ca9c5): `b35143fd3657532f675d5645073c05148f547ed8`.

The two production files have no diff from reviewed [1bd91fd7c9](https://git.cafe/pingdotgg/t3code/commit/1bd91fd7c9) through captured [6130ec9628](https://git.cafe/pingdotgg/t3code/commit/6130ec9628). [34bbb6257f](https://git.cafe/pingdotgg/t3code/commit/34bbb6257f) merged main; 6130 added only the fixture generator. During this audit HEAD advanced to [a073960a3d](https://git.cafe/pingdotgg/t3code/commit/a073960a3d); inspected delta is only mechanical Node namespace imports/formatting in that generator. No production selection change. Target verdict remains pinned to captured 6130; this audit made no checkout edits.

Read the full hook, renderer integration and fixture diff, both `/tmp/15927-round2-{codex,claudeAgent}.md`, earlier resumed reports, matrix, and final evidence REPORT. The hook caches lazy linear UTF-16 line indexing, preserves directed source offsets, projects them onto mounted rows, handles document pointer/focus/key/copy ownership and removes listeners. The caller postRender remains composed first. Text follows Pierre's rendered file rather than pending props. Protected getRenderedFile is a pinned-dependency compatibility boundary, not an observed crash. Reviewer delayed-worker/JSDOM/helper timings are supporting diagnostics, not native integration proof. Claude's optional scroller-self-focus nit remains unverified in the real layout and is not elevated to a blocker here.

No CSS, dependency, server, provider, wire contract, permissions, persistence or native-mobile implementation changed. Shared web read-only Files/attachment/review.diff/element-context callers are affected; writable editor and rendered content have separate implementations. Desktop embeds web; native React Native does not import this component. No additional policy gate or forge operation was introduced.

## Artifact qualification and independent checks

Accepted final family: `resumed-final-6130ec9628-{1440,390}-{light,dark}.{json,png,mp4}`. Each JSON has `copy.prevented=true`; both copy text and native-pasted textarea value equal regenerated canonical source, including final LF. Final source click uses row locators after notification dismissal per evidence REPORT. Initial viewport is 1440×720 or 390×720 and scrollTop 0. The light theme's empty class versus dark class agrees with stills. Native keys and temporary scratch textarea are the evidence agent's method; this auditor did not rerun native input.

Accepted partial family: `resumed-final-partial-scroll.{json,mp4}`. Native selection before scroll, expected substring, copy event and native paste agree exactly; independently located substring at offset 48, length 572. Recording frames show selection before the scroll and rows around 149 afterward. Tool scrollBy is explicitly not physical wheel/trackpad and not held autoscroll.

Independently extracted and inspected temporal frames of the final recordings, including the beginning of the partial selection. They show source interaction, selection, eviction and/or the oracle overlay; they do not visually display a readable 11,752-character plaintext equality assertion. Exact equality comes from full saved JSON native-paste values, not pixels or a selection length. A 1.5–1.7-second select-all recording cannot prove a held gesture or a large-file performance run. No protected selection state was mutated according to the final handoff; reading diagnostic state is not native proof by itself.

Rejected as successful final proof: `resumed-fixed-*` (toast covered coordinate click; copy not prevented), original `after-390-*` and `narrow-probe` (100-row copy or empty event/chrome paste), and `resumed-head-390-*` failures. They remain preserved and are not silently overwritten. Do not infer loaded revision solely from a filename or timestamp. Corrected final names, contemporaneous capture handoff and unchanged production diff support provenance, but this auditor has no independent live served-module/rebuild attestation.

Fixture generator rerun outside worktree; all 15 generated manifest entries exactly equal `/tmp/issue15927-fixtures/manifest.json`. Independently hashed all files against three supplied manifests: no mismatch. Canonical SHA256 is `662374c3ebd1e1d0ccd1401768cb7491e0a971aee703a7db50b81d6283da5fd7`. A/B fixtures have equal name-length/text-length shape and distinct contents. The script supplies inputs, not executed browser regression tests. Diff whitespace check passed; no full-suite checks or new committed tests were run by this auditor.

## Pixel thresholds and what else changed

Recomputed max absolute RGB-channel difference for each pixel, changed iff delta > threshold, without mask/crop/registration. Every count exactly matches pixel-diffs.json.

| Viewport/theme | Raster | Threshold 0 | Threshold 16 |
|---|---|---|---|
| 1440 light | 1280×640 | 202269 / 819200 (24.691%) | 66554 (8.1243%) |
| 1440 dark | 1280×640 | 211120 / 819200 (25.7715%) | 62012 (7.5698%) |
| 390 light | 780×1440 | 207215 / 1123200 (18.4486%) | 57703 (5.1374%) |
| 390 dark | 780×1440 | 217936 / 1123200 (19.4031%) | 25995 (2.3144%) |

These are actual raster sizes, not CSS viewport sizes. Before includes an update notification; after dismisses it. Wide panel narrowing changes line wraps and number of visible rows. Sidebar/composer/time state may differ. Head/base ports differ but use the same isolated backend/seed according to REPORT. None of these visible changes is explained as a product design change from this diff. Maps are diagnostic, not a threshold-based pass. All four before/after pairs exist but do not meet equal-geometry/clean-before requirements.

## Complete 39-row disposition

PASS means the entire row's stated oracle is met. PARTIAL means only the explicitly named subset is supported. GAP means required runtime evidence is missing; static plausibility is not a pass. Every original row is retained below; no Cartesian expansion is demanded.

| ID | Disposition | Supported subset / exact remaining gap |
|---|---|---|
| P01 | PARTIAL | Real read-only Files panel source tested; opened via panel-store action. Files UI, chat link, reveal-line link and reveal callback runtime smoke missing. |
| P02 | GAP | Truncated delivery/banner and exact delivered-prefix clipboard not captured. |
| P03 | GAP | Draft/sent text attachment entry points and SQL/plain/code source smoke missing. |
| P04 | GAP | Markdown/HTML/CSV/TSV source switch, copy and switch-back ownership missing. |
| P05 | GAP | Composer nonempty review.diff literal +/- clipboard missing. |
| P06 | GAP | Sent HTML/CSS simultaneous previews and second-preview ownership missing. |
| P07 | GAP | Writable/editor/rendered/media/FileDiff/plain-pre negative controls not run. |
| D01 | PASS | Canonical LF 226 statements and full suffix/final LF copied/pasted exactly in all four final cells. |
| D02 | GAP | CRLF complete/partial event text runtime missing; generated fixture/helper diagnostics only. |
| D03 | GAP | Lone CR/mixed newline partial clipboard runtime missing. |
| D04 | GAP | No/multiple trailing newline and blank-line native clipboard runtime missing. |
| D05 | GAP | Empty/single-line/astral/combining/RTL/tab/token-span runtime missing. |
| D06 | GAP | Long-line wrap on/off, horizontal scroll and wrapped-row pointer mapping missing. |
| D07 | GAP | Large-source repeated-scroll app performance diagnostic missing; scanner timings alone insufficient. |
| I01 | PARTIAL | Top keyboard select-all/native copy/paste exact. Middle/bottom and native context-menu copy missing. |
| I02 | PARTIAL | Forward partial drag rows 1–12 exact. Backward within-row, double/triple click and blank endpoints missing. |
| I03 | PARTIAL | Historical original-head wide held-down paste files exact; final-head and narrow held-down through eviction missing. |
| I04 | PARTIAL | Historical reverse paste matches expected source minus terminal LF. Final-head upward/reversal-through-anchor integration missing. |
| I05 | PARTIAL | Final released partial selection survives scrollBy with both endpoints evicted. Physical wheel/trackpad, scrollbar and offscreen return missing. |
| I06 | GAP | Offscreen Shift-click and caret-browsing extend/collapse runtime missing. |
| I07 | GAP | Fresh primary collapse/replacement with no resurrected copy runtime missing. |
| I08 | GAP | Pointercancel/outside release/window blur lifecycle captures missing. |
| I09 | GAP | Real composer/search/input/textarea/contenteditable select-all/copy ownership missing; reviewer JSDOM focus diagnostic only. |
| I10 | GAP | Outside text, offscreen source, toolbar/menu focus ownership runtime missing. |
| I11 | GAP | Two mounted preview focus/context-menu non-primary interaction missing. |
| I12 | GAP | Close/reopen/thread/file/source toggle/repeated unmount ownership runtime missing. |
| T01 | PARTIAL | Reviewer real-Pierre delayed-worker nonvirtualized harness supports old/new drawn-source ordering; app virtualizer same-name/length recording missing. |
| T02 | PARTIAL | Reviewer harness supports clearing old selection at drawn replacement; pending partial+virtualized-scroll integration missing. |
| T03 | GAP | Different-length/name replacement and theme-key remount lifecycle recording missing. |
| T04 | GAP | Same-text theme/wrap selection persistence and clamped-range invariants runtime missing. |
| T05 | GAP | Absent clipboardData/range/shadow API and listener cleanup diagnostic recording missing. |
| V01 | PARTIAL | 1440 light final select-all exact; still pair exists. Clean equal-geometry base and paired final held gesture missing. |
| V02 | PARTIAL | 1440 dark final select-all exact; still pair exists. Clean equal-geometry base and paired final held gesture missing. |
| V03 | PARTIAL | 390 light final select-all exact; still pair exists. Toast-free base and narrow held gesture missing. |
| V04 | PARTIAL | 390 dark final select-all exact; still pair and partial eviction exist. Toast-free base and narrow held gesture missing. |
| B01 | PARTIAL | Local Chrome 154 on Linux artifact evidence. Remote/relay connection smoke missing. |
| B02 | GAP / routed | Native Electron Linux/Windows Ctrl and macOS Cmd/context-menu missing. Headless environment limitation accepted; remains unverified. |
| B03 | GAP | Safari/WebKit signature/direction and supported Firefox fallback runtime missing. |
| B04 | PASS (scope only) | Native React Native excludes modified web component. Narrow web remains affected; no native-mobile runtime claim. |

Count: 39 rows = 2 full passes (one scope-only), 13 partial, 24 gaps. Partial rows still have prescribed gaps. Generated fixtures do not increase execution coverage. Accepted tool/platform routing for narrow held input and native desktop explains missing proof; it does not manufacture PASS.

## Packaging and practical minimum

Final handoff `/tmp/issue-15927-evidence/REPORT.md` is candidly PARTIAL and agrees with inspected artifacts. `upload-urls.json` supplies public evidence links. [Qualified evidence archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/98ba21e2ea66a4e6/qualified-evidence.zip) was supplied by the lead; this auditor inspected local constituent evidence, not independently downloaded/rehashed the archive or verified every remote URL.

For a bounded draft handoff, useful minimum already achieved: unchanged reviewed code, four exact final web select-all/native-paste oracles, one exact partial eviction oracle, reproducible 15 fixtures, and explicit preservation of contaminated/older failures. This justifies presenting the demonstrated behavior with caveats. It does not establish merge readiness under the full matrix. Highest-value next proof is a clean controlled base replay, final narrow held-anchor eviction, editable/two-preview ownership, representative CRLF/backward/blank slice and native desktop routing. Remaining matrix obligations are explicitly listed rather than silently waived. This auditor did not create or publish a PR, and no triage-policy assessment was added.

## FRICTION

No independent rebuild or native interaction was available/performed. Tool catalog exposes no preview browser tools; latest instruction removed any expectation of new browser data. Existing running servers were left untouched. Evidence and HEAD changed concurrently; initial requested SHA and later fixture-only change are distinguished. REPORT/URLs arrived during the audit and were incorporated. Video inspection used offline ffmpeg frame extraction, not browser/server operations. Only this report and temporary fixture/frame artifacts outside the checkout were written. No forge writes, comments, pushes or edits.

VERDICT: INSUFFICIENT clean controlled base, final/narrow held autoscroll, newline/data and ownership/lifecycle/caller coverage, native desktop/cross-browser/remote proof, and independent rebuild remain missing; exact row-level gaps above.