# Final independent proof audit — takeover18465

**SUFFICIENT for the affected web provider/catalog scope A1–A8 and V1 at the captured head.** This is not a live Clerk/Connect integration verdict, a native-client verdict, or exhaustive eight-cell coverage of unchanged supplemental nonvisual controls. No missing affected row is counted as sufficient.

Audited [#18465](https://git.cafe/pingdotgg/t3code/pulls/18465), replacement draft [#24642](https://github.com/pingdotgg/t3code/pull/24642). Before [76da264a0c](https://github.com/pingdotgg/t3code/commit/76da264a0ccaeff5fa88bcb5cfada1be6ae320c4), full `76da264a0ccaeff5fa88bcb5cfada1be6ae320c4`; after [65637ec020](https://github.com/pingdotgg/t3code/commit/65637ec020438e9bf200645d36910374f3870279), full `65637ec020438e9bf200645d36910374f3870279`. Read-only checkout stayed pinned and clean during replay. Later main merges require scoped blob equivalence; no later merged head is certified here.

[Authoritative matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d52023f7f7618610/to-18465-matrix-final-v3.md), [final capture index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b8e276e1020d8650/index.md), [corrected manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/599be970dd6b310d/manifest.json), [corrected public replay bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/32ed3e8cbc1cd835/replay-completion.tar.gz).

Each table cell means **BEFORE and AFTER** at that width/theme, judged against their distinct expected behavior. S = sufficient within the stated provider/harness/intercepted-SDK scope. BEFORE settled relay ghosts are genuine original behavior and accepted diagnostic evidence, not successful cleanup. AFTER must remove them live before reload.

|Row|1440 light B/A|1440 dark B/A|390 light B/A|390 dark B/A|Observed proof and bound|
|---|---|---|---|---|---|
|A1 offline unresolved|S|S|S|S|Actual intercepted SDK simulated offline observed loaded/degraded/client_init; AFTER retains five targets through reload without reseeding. Complementary ready/no-ID is labeled HARNESS. BEFORE deletion/reload loss reproduced.|
|A2 online unreachable / placeholder|S|S|S|S|Actual intercepted SDK online-unreachable loaded/ready/no-ID; labeled degraded/client_init and cold degraded/no-ID harness controls. No invented SDK pairing. Signed-in placeholder supplement bound below.|
|A3 authoritative initial resources|S|S|S|S|Ready/no-ID and degraded/client_init hydrate by resource notification only to real ID, unchanged status/hooks. AFTER settles live to two direct targets, mixed relay removed; repeat notification does not repeat cleanup. Cold ready only-relay empties live; reload agrees. Cold degraded real ID also cleans.|
|A4 unresolved to A / unloaded boot|S|S|S|S|AFTER preserves routes and activates A; fresh unloaded state preserves. BEFORE unresolved phase can already delete persistence.|
|A5 observed sign-out|S|S|S|S|Explicit provider sign-out removes relays live on AFTER, direct controls survive; reload agrees. Real signed-in SDK refresh401 is unverified and is not inferred from bootstrap401.|
|A6 account switch|S|S|S|S|Real removal runs with completion held: account null, direct-only live catalog, cleanup started/not completed; release activates B after completion. BEFORE ghosts distinct. Loading/rapid controls are nonvisual; duplicate-count bound below.|
|A7 observed-account loss|S|S|S|S|Same signed-in A through degraded/ready preserves. Observed A loss loaded/degraded removes even without resolved ID. Unloaded interlude preserves until loaded loss.|
|A8 bootstrap401 versus no-session200|S|S|S|S|401 observed loading/not-loaded preserves; boot logo is not signed-out proof. Real no-session200 resolves ready/client_real and cleans. Appended clean SDK endpoint excludes earlier toast frames.|
|V1 shared Connections presentation|S|S|S|S|Enabled/disabled relay-only, disabled mixed/direct-only, long label, expanded routes and only-relay empty state inspected. 390 is responsive Chromium web, not native mobile.|

Unchanged nonvisual supplements are executed on **three BEFORE cells and four AFTER cells**. BEFORE390dark signed-in-hook+placeholder and rapid-cancellation duplicates were not captured and are **not certified**. Matrix A6 explicitly calls loading/rapid cancellation nonvisual controls, not extra width/theme tours. Account/cancellation precedence has no viewport/theme branch; the changed actual live cleanup is covered by the held switch in all eight cells. Signed-in-hook precedence is unchanged and its placeholder control is not JWT execution. Thus the missing duplicate does not remove an affected transition from this bounded verdict. A claim that these two supplements were captured in all eight cells would be INSUFFICIENT.

The full three-file diff (+201/-11) was inspected: managedAuth.tsx +27/-11, focused browser tests +173, existing lint allowlist +1. The guard rejects no-ID/client_init initial uncertainty and has no status prerequisite. Clerk resource subscription is useSyncExternalStore/addListener. Explicit runAtomCommand(appAtomRegistry, ...) fixes the provider outside AppAtomRegistryProvider dispatching through the wrong default registry. Token reset, account activation ordering and route-removal algorithm are unchanged. No renderer, layout, CSS or transport change. Installed Clerk6.40.0 source contains both empty and JWT-populated client_init constructions; that source inspection is not executed JWT evidence.

Independent replay ran after capture ports were closed, against exact head65637ec020, with a fresh isolated no-seed home. The full driver completed through A7 and cold unloaded; no live userdata or registry rebind. Public driver.mjs, matched-driver.mjs and seed.js are byte-identical to executed copies. Server launcher source matches, with only my home path isolated. [Byte verification](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c06d609d39ee81b5/public-replay-verification.json).

Affected live ready-resource cleanup at 1440 dark independently matches the exact source still at **0/1,440,000 pixels above0 and above16**, max-channel delta0, without masking or alteration. Both direct routes remain; no enabled relay remains. [Measured delta](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a7fc3b08db85d443/independent-live-cleanup-pixel-delta.json).

![Independent AFTER live cleanup before reload, direct routes retained](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bfff2158f627ed6a/after-1440x1000-dark-ready-hydrated.png)

The independent unresolved matched capture is honestly nonzero: **89 pixels above0,64 above16,max116**, confined to retry text at x535–619/y575–583 (source7s/attempt3, replay3s/attempt2). This is real nondeterministic text, not antialiasing. No zero claim for that endpoint. [Measured unresolved delta](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e3e0e5f3aec0ade6/independent-pixel-delta.json).

Independent before/after recomputation agrees with all delivered comparison statistics (absolute maximum RGB-channel delta; difference pictures amplified4x):

|Pair|pixels >0|pixels >16|total|
|---|---:|---:|---:|
|1440 light|219939|15757|1440000|
|1440 dark|220315|16358|1440000|
|390 light|42045|11991|329160|
|390 dark|42088|12284|329160|

What else visibly changed: preserved relay rows increase card height/scroll extent, shift direct controls downward, and change visibility/position of Load balancing and Pull request sharing. Threshold0 additionally exposes low-amplitude fill/border differences. Narrow Authorized-clients overlap is present before and after; no new styling fix is claimed.

Inspection inventory: all13 delivered retained BEFORE PNGs; all194 final packaged PNGs (including four comparison panels, both threshold images per pair, route companions, four clean SDK endpoints); all eight combined videos opened through every chapter contact sheet, and all eight independently fully decoded with ffmpeg. Source segments and failed attempts are working material, not extra final recordings. AFTER chapter counts59/57/57/57 match manifest exactly; BEFORE46/44/47/51. All eight are12fps,timebase1/12288, maximum sorted presentation gap0.083334s. AFTER durations1425.5/1547.833333/1654.916667/1804.25s; BEFORE520.666667/505.166667/546.416667/552.25s. Chapters fall within media. Labels distinguish HARNESS from actual intercepted SDK and show revision/cell. Telemetry314 derived milestones has no flagged unexpected outcome; live/catalog/account milestones were inspected independently, not accepted from flags alone.

Public readback succeeded for corrected index, manifest, bundle and all four AFTER videos. Index and manifest equal current local bytes. **All442 manifest entries hash-match their retained BEFORE/current public files; no missing file or mismatch.** Every nonvideo bundle member byte-matches current package. Four downloaded AFTER video hashes match inspected local media. Earlier d64888a78edfa06b manifest and10c8d67e407888b2 bundle are superseded; they cannot certify this final set.

FRICTION: initial public manifest inherited obsolete AFTER file metadata; found independently and corrected before verdict. CPU overload toast-covered stills and boot/reset/onboarding frames are rejected as representative settled proof; clear route companions, clean cold-empty frames and appended real-Dismiss SDK200 endpoints provide accepted alternatives. BEFORE390light first SDK200 timeout lacked hooks and is rejected as cold signed-out proof; subsequent actual ready/client_real reload is valid. BEFORE390dark initial reload boot logo is rejected, later repaired loaded reload is valid. No fake state pairing or hidden image masking. A broad dialog locator caused failed capture attempts; accepted segments use actual dismissal and explicit cuts.

Limits: no live Connect transport, OAuth/live account switching, real signed-in SDK refresh401 or JWT fallback execution. Simulated navigator offline is not native browser offline. This is scoped proof sufficiency, not a full code/CI/merge authorization. Focused tests were read, not rerun by this audit. No repo edit, push, comment, checkout or watch. Own server PIDs2375755/2375771 were cwd-verified and stopped; ports6035/14075 independently confirmed closed, parent notified replay done. PR links registered and checked; replacement remains draft.