# Final proof audit pass 4

**VERDICT: SUFFICIENT for the amended historical web proof matrix: all 16 configuration pairs / 32 General and Providers rows.** No outstanding acceptance row is INSUFFICIENT. This verdict includes the actual independent live rebuild and all final repaired selections. Native mobile remains explicitly unverified under the accepted exception; desktop-shell and MCP surfaces are not inferred from web evidence.

GitHub [#25526](https://github.com/pingdotgg/t3code/pull/25526), GitCafe [#25528](https://git.cafe/pingdotgg/t3code/pulls/25528). Before [dd5b540](https://git.cafe/pingdotgg/t3code/commit/dd5b5401e1f240f4314af29edf431369d182f386), audited head [8fbfc33](https://git.cafe/pingdotgg/t3code/commit/8fbfc33c1ac503048ca2983564318bc29143086a).

Read the original pass-1 matrix, matrix amendment, pass-3 audit, final index, executable kit, machine selection and per-pair written maps. Final selection: [INDEX-repaired](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a10d4563433ad2e/INDEX-repaired.md), [PR-EVIDENCE.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/214e43e9a3435dae/PR-EVIDENCE.json), [paired evidence table](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c7e890b0572290cd/PR-EVIDENCE.md).

## Mandatory live rebuild — performed first

Independently executed the public recapture kit against the exact clean head before undertaking the broad offline audit. The downloaded public kit is byte-identical to the delivered local archive, SHA256 `a6b19b65cf133ec81e56894e0a05f4d0bbcb670b637a1d619d102d847a1dfb4e`. Configured only temporary kit paths, ports, session names and the one requested scenario. No production file changed.

Fresh named agent-browser sessions, isolated real primary and secondary servers, explicit `/tmp/ev-25526/audit4/kit/primary` and `secondary` homes, `--no-seed` / `T3CODE_DEV_SEED=0`, actual CLI pairing and Connections UI pairing. The primary stayed healthy; only the real secondary session endpoint was delayed by the kit proxy. No mocked response, fabricated grant, atom replacement or browser-clock acceleration. No access of any kind to `~/.t3/userdata`.

Actual invocation after temporary configuration:

```sh
AGENT_BROWSER_BIN=/home/ubuntu/.npm/_npx/6de2aa2fded2970c/node_modules/.bin/agent-browser python /tmp/ev-25526/audit4/kit/run-interactions.py live-exact R1 providers
```

Primary command: `vp run dev --no-seed --home-dir /tmp/ev-25526/audit4/kit/primary --port 7531`. Secondary: `node apps/server/src/bin.ts serve --base-dir /tmp/ev-25526/audit4/kit/secondary --port 7532 --host 127.0.0.1`. Read actual Vite port7227 from dev-runner output; adjusted temporary kit from its expected7327. Discovered real server IDs instead of transplanting live data.

Browser: agent-browser0.39.4, Google Chrome for Testing156.0.8078.47, DPR1,1440×900, light theme, reduced motion, loaded fonts, matching masks and scroll. Own names `audit4-25526-1440-light-general` and `audit4exact-25526-1440-light-general`. Actual selected R1 Providers pending7 showed mounted Settings, Initial/waiting=true/hasValue=false and the intended permission-loading placeholder. Its duplicate was identical across500ms. The request then succeeded; enabled setting toggled false and restored true, with real server projection and persisted-setting readback both matching.

**Pixel result: accepted head versus independent live head: Diff0=0 pixels, Diff8(max channel>8)=0 pixels, maximum channel delta=0.** Accepted file `after-repair-interactions/R1/1440-light-providers/pending7.png`; rebuilt file `audit4/kit/live-exact/R1/1440-light-providers/pending7.png`.

The first own attempt used proxy7533 rather than accepted7433:70 changed pixels,68 over8, confined to the port digit. This was fixture text, not antialiasing, and was rejected. Repeated with actual proxy7433 and a fresh named browser; the exact result above closes that finding. Existing isolated fixture homes were reused for this repeat, as authorized.

![Accepted head at left, independent live rebuild in middle, amplified zero-threshold difference at right](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/00b9f5424730d145/live-rebuild-proof.png)

[Independent continuous native recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6203e2fb3506917f/continuous.webm). This own video was decoded and its permission-loading sample opened; complete-flow assertions additionally come from the actual runner/state/request/persistence artifacts. Audio is not required.

## Independent final artifact checks

- Decoded291 selected checkpoint/stability pairs, including new interactions, tooltip and repairs: all pixel-identical duplicates, correct geometry/media/fonts and expected state. This is582 source/stability images. New sourceSHA fields match the exact designated side wherever present; older retained captures use the historical ownership qualification below.
- Recomputed120 before/after comparisons, all240 supplied Diff0/Diff8 images exact. Formula: absolute RGB difference amplified8× with saturation; Diff8 zeros a pixel unless its maximum channel difference exceeds8. All32 consumer source/diff sheets were opened and looked at, rather than treating file presence as inspection.
- 37 comparisons are exactly zero. Seven additional comparisons differ only by one channel level, consistent with edge antialiasing: R3/1440/light/General retry4,retry5,terminal (486 pixels each); R3/1440/light/Providers terminal (3); R3/1440/dark/Providers terminal (1); R3/390/light/General retry3 (3); R3/390/dark/General retry4 (1). All have Diff8=0. The eight R2/R4 healthy General comparisons are exact zero.
- All40 unique selected videos were probed and decoded. Opened all40 timestamped contact sheets: beginning,2/6/9/14/16-second samples,20-second intervals, final tail, plus every machine-map checkpoint time. Native5fps dimensions match. Inspection is sampled footage, not every-frame viewing. Source/diff sheets are reduced overview sheets; numerical comparison is full resolution. Shared General/Providers videos are disclosed shared episodes, not independent extra recordings.
- Independently reconstructed64 side/request ledgers from actual loader starts and request logs. Baseline one attempt ends about6s. Recovery head starts0/~6s and delivers about14s. Exhaustion head starts0/~6/~18/~42/~90s, ends150.018–150.112s, with no sixth measured attempt. Bootstrap/lifecycle cancellations were excluded using measured loader origin, not counted as retries. Published ledgers agree.
- 32 success-setting persistence readbacks (16 consumers × toggled/restored) match both actual persisted isolated settings and server config projection. Required R1 disabled tooltip proof is present for both widths/themes.
- Fetched all254 unique public path/URL references from the machine selection and checked bytes against their local selected files: no hash mismatch. Identical-file deduplication can give a URL a different checkpoint filename; content is correct. Public kit fetched and verified separately. Four matched final archives contain1,362 artifact members: each matches local bytes and archive manifest size/SHA256; the four additional manifest members parse and validate their full lists.

## Every final row

R1=cold delayed recovery; R2=real cached Success followed by explicit runtime stale refresh; R3=cold exhaustion; R4=warm exhaustion. Each row includes both exact revisions, matched viewport/theme/scroll, stable checkpoint pair(s), paired diff arithmetic and inspected video/written map. “Comparisons” counts delivered before/after checkpoint comparisons for that consumer. SUFFICIENT has the common historical provenance and surface limitations stated in this report.

| Scenario | Viewport/theme | Consumer | Comparisons | Verdict / written steps and paired recordings |
|---|---|---|---:|---|
| R1 | 1440 light | General | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/47661ba8273f7197/R1-1440-light.md) |
| R1 | 1440 light | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/47661ba8273f7197/R1-1440-light.md) |
| R1 | 1440 dark | General | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/073f96be36edadd2/R1-1440-dark.md) |
| R1 | 1440 dark | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/073f96be36edadd2/R1-1440-dark.md) |
| R1 | 390 light | General | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5b8da5df3700acef/R1-390-light.md) |
| R1 | 390 light | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5b8da5df3700acef/R1-390-light.md) |
| R1 | 390 dark | General | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3e6f385cbabc0ba4/R1-390-dark.md) |
| R1 | 390 dark | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3e6f385cbabc0ba4/R1-390-dark.md) |
| R2 | 1440 light | General | 3 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/57a4aada09cc6da7/R2-1440-light.md) |
| R2 | 1440 light | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/57a4aada09cc6da7/R2-1440-light.md) |
| R2 | 1440 dark | General | 3 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/da7aab4d122c8d7d/R2-1440-dark.md) |
| R2 | 1440 dark | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/da7aab4d122c8d7d/R2-1440-dark.md) |
| R2 | 390 light | General | 3 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/55ec851d6332d391/R2-390-light.md) |
| R2 | 390 light | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/55ec851d6332d391/R2-390-light.md) |
| R2 | 390 dark | General | 3 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a27b19ab77a3521a/R2-390-dark.md) |
| R2 | 390 dark | Providers | 2 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a27b19ab77a3521a/R2-390-dark.md) |
| R3 | 1440 light | General | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd44b94156a1c002/R3-1440-light.md) |
| R3 | 1440 light | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd44b94156a1c002/R3-1440-light.md) |
| R3 | 1440 dark | General | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dfce5f7ffed159da/R3-1440-dark.md) |
| R3 | 1440 dark | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dfce5f7ffed159da/R3-1440-dark.md) |
| R3 | 390 light | General | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/34252a1ea9d9e9be/R3-390-light.md) |
| R3 | 390 light | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/34252a1ea9d9e9be/R3-390-light.md) |
| R3 | 390 dark | General | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0b33eb17a068e7de/R3-390-dark.md) |
| R3 | 390 dark | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0b33eb17a068e7de/R3-390-dark.md) |
| R4 | 1440 light | General | 6 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/34d97a84885a7762/R4-1440-light.md) |
| R4 | 1440 light | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/34d97a84885a7762/R4-1440-light.md) |
| R4 | 1440 dark | General | 6 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a46abfd2e409d09/R4-1440-dark.md) |
| R4 | 1440 dark | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a46abfd2e409d09/R4-1440-dark.md) |
| R4 | 390 light | General | 6 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/754d6e992809e748/R4-390-light.md) |
| R4 | 390 light | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/754d6e992809e748/R4-390-light.md) |
| R4 | 390 dark | General | 6 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a9317839b2442af6/R4-390-dark.md) |
| R4 | 390 dark | Providers | 5 | [SUFFICIENT](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a9317839b2442af6/R4-390-dark.md) |

## Closure of prior findings

1. R1 dark desktop Providers restored instability: replaced, true duplicate stability independently confirmed. All five previously incomplete configurations now satisfy final stability, including four baseline Providers pending repairs and both R4 desktop Providers retry5 pending observations. The latter are actual warm waiting Success, not substituted terminal Failure.
2. Persistence: closed by actual persisted-file plus server-projection readbacks after disable and restore, not merely DOM checkbox observations.
3. Disabled tooltip: required R1 proof closed. Matching baseline/head screenshots, timestamps and decoded samples show the tooltip.
4. Written steps:16 paired documents place written state/step timestamps above paired recordings, distinguishing video-zero from request-zero, with interaction steps. Machine maps match the decoded selected samples. Four *extra* baseline tooltip times in R2/R3 JSON are not repeated in written tables; these are outside the required R1 tooltip proof and do not omit a required milestone. Kept explicitly in the timing audit as a nonblocking editorial limitation. Silent recordings are accepted.
5. Known incomplete rows: all repaired as described above; all selected points independently checked, including toggled/restored. Original rejected unstable takes are not used to satisfy rows.
6. Source ownership: new launch/switch records bind source/head/clean state, retained owned PIDs and cwd. Historical qualification remains below; no retrospective process attestation is invented.
7. Actual independent rebuild: closed by the exact pixel result, actual executable public kit, real pairing/network/state/persistence and own released resources.

R3 desktop-light terminal continuation is explicitly disclosed and accepted: driver received SIGTERM after General terminal and first Providers terminal still; same browser context and continuous native recorder stayed alive. Providers terminal duplicate was continued in that same episode and recorder stopped cleanly. No browser/server restart or injected state. Actual request attempt5 ended150.021s. Written map distinguishes General terminal around155.6s and Providers terminal around184.8s in video time; this is not claimed as an uninterrupted driver run or a new episode.

## What changed visually, and what did not

Cold General remains read-only while pending and enables after real success. Cold Providers replaces baseline's limited-permission banner/cards with a permission-loading placeholder. Warm head retains real cached Success and controls/cards across retry; baseline loses permission after its timeout. Terminal denial converges again. Large placeholder/banner/card/dimming differences are the intended behavior, not AA. There is no unexplained visible product difference in the inspected sheets.

Provider enable/restore causes real provider status invalidation/probing; resulting status text/card changes remain in recordings and are disclosed. Stable selected stills are required independently of that legitimate motion. Presentation masks disable animation/transitions/caret and normalize unrelated relative ages only. Repaired selected pairs use the same fixed-width Checked-age mask on both sides; retained earlier pairs use their matched original text-node age mask. Permission controls and meaningful permission text are not masked. Matched General scroll and pre-interaction Provider status were inspected.

R2/R4 are precisely **runtime-triggered stale revalidation**, not a claim about navigation remount or a shipped refresh button. Real Success is retained in the browser registry, aged31 real seconds, then existing `appAtomRegistry.refresh(environmentSession.sessionStateAtom(realEnvironmentId))` invokes the real loader/endpoint. No mocked grants, atom result replacement, or clock acceleration. Cold rows genuinely have no previous Success.

## Historical source qualification and limits

Retained `before-proof`/`after-proof` and `after-repair2` metadata lacks direct sourceSHA. Original baseline startup log was overwritten. Historical-source-ownership correctly uses retained original head dev-runner output, checkout intervals/reflog and cleanup PID/cwd corroboration; that is weaker than per-frame launch attestation. New head launch21:55:30, baseline switch/launch22:17:55/22:18:05 and final head switch22:29:13 plus later launch/PID observation22:31:17 strengthen repair ownership. Some final repair capture started before that last observation; its sourceSHA, switch chronology and absence of another checkout corroborate it. This is an honest historical association, not a claim every retained frame carries a contemporaneous process-source attestation. The exact live rebuild independently corroborates one affected head checkpoint; it does not retroactively attest every older process. Under this historical-audit scope that qualification does not leave a behavior row insufficient.

390px Chromium is narrow web, not native mobile. Native mobile is unverified under the accepted exception; Electron shell/IPC and MCP behavior were not verified or extrapolated. This is a proof audit using prior code-review results, not a new comprehensive code review.

Existing default-schedule fail-before/pass-after transcript remains accepted:6/12/24/48/60 schedule. No production tests were added or rerun. Prior pass3 numerical/visual work was available, but final selections were independently decoded/recomputed again rather than accepted solely by presence or old filenames.

## Friction, ownership, and final state

Prior two preview calls requested1440 but yielded1280×800/DPR2 and lacked continuous recording; the user explicitly authorized native agent-browser fallback. This pass used that fallback directly. Temporary kit needed actual web-port adjustment and matching proxy port as disclosed. Public downloads initially hit urllib403 and transient DNS/timeouts; curl plus retry of failed downloads produced all254 verified matches. No production defect is inferred from that transport friction.

Every own PID/process group was retained at spawn. Only those groups were stopped; named browsers closed. Primary3141313, secondary3141314, final proxy3146996 are gone; own ports7531/7532/7433/7227 have no listeners. Earlier own proxy3141315 was stopped before rebinding7433. `released.json` records exact clean head and empty status. No source checkout was changed. No production edits, commits, pushes, PR writes, watches, child agents, live-home reads/writes/copies, or preview save operations occurred. Temporary capture scripts and uploads are PR-only artifacts under the user's explicit exception; none were committed.

Lead reported external merge at22:27:31UTC to [024e593](https://git.cafe/pingdotgg/t3code/commit/024e593a635670a01187da6607508eceb88c0da0), not performed by lead/auditor. Independently confirmed empty diff from audited head to that commit for `session.ts` and `environmentHttpAuth.test.ts`; no main checkout/update. Final read-only `cafe pr status` reports merged, exact head,38 successful contexts/0 pending/0 failing (includes post-merge cleanup contexts beyond the earlier31). Existing code-review MERGE/MERGE is prior reported state, not a new review issued here.

[Independent numerical ledgers, row verdicts, scripts, all32 source/diff overview sheets, all40 video contact sheets, public byte hashes, source qualification and own release proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/571ee1e6d8bb87f3/audit4-support.zip).

Audit model/harness: gpt-6.1-sol through Codex in T3 Code. Browser harness: agent-browser0.39.4 / Chromium156 native recording; numerical inspection: Pillow/NumPy/FFmpeg. Completed within the25-minute hard budget.

**VERDICT: SUFFICIENT —32/32 scoped historical proof rows; independent live head rebuild exact0 pixels.**

PR [#25528](https://git.cafe/pingdotgg/t3code/pulls/25528) / [#25526](https://github.com/pingdotgg/t3code/pull/25526), head [8fbfc33](https://git.cafe/pingdotgg/t3code/commit/8fbfc33c1ac503048ca2983564318bc29143086a), merged; checks38 successful,0 pending/failing; reviews MERGE/MERGE previously reported, not refreshed.