# Final bounded proof audit: round-4 repairs and final-head staleness

**Evidence is insufficient for the final gate. M1 is missing and the merged final HEAD has no certified capture set.** The new repairs do satisfy the previously specified minimum web/runtime proof for R2–R5 on the premerge revision, within the limits below. This is a proof audit, not an assertion of a newly found code defect or approval to merge.

Replacement [#24583](https://github.com/pingdotgg/t3code/pull/24583), original [#19570](https://git.cafe/pingdotgg/t3code/pulls/19570). Read-only checkout: `/home/ubuntu/wt/pr-19570`. Evidence comparison is exclusively base [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b) to premerge [e810a33cf8](https://github.com/pingdotgg/t3code/commit/e810a33cf8114e5c4e76eeffe8ea299ef8466b71).

## Final-head STALENESS — blocking

Git now reports final HEAD [dbecd5d7e9](https://github.com/pingdotgg/t3code/commit/dbecd5d7e99fe2db6080efabf873c7a775b57603), parents premerge e810a33cf8 and new main [453bf01d20](https://github.com/pingdotgg/t3code/commit/453bf01d2068758fac79f9aa74099b2e85bbc719). Checkout is clean. The merge changes 246 paths relative to the captured head, including native ThreadRouteScreen/floating-working-control, ThreadFeed, web timeline positioning/following, and shared connection driver/cache/models. A clean merge cannot establish unchanged integrated rendering or timing. None of the delivered premerge captures, source-load records, masks or clips is relabeled as final-head proof. The user's reported 41 passing sync tests are not independently rerun or treated as visual/native proof here.

**Minimum remaining for the final gate:** actual native M1 chapters on the final revision, plus provenance-linked final-head verification of affected integrated recovery/history/session/disposal and layout behavior. Retain the accepted premerge work as historical proof and use source comparison to choose final-head retests; do not blindly repeat the old Cartesian matrix. This audit does not certify which final-head tests can be skipped.

## Row decisions

| Row | Premerge disposition | Exact credit and remaining limits |
|---|---|---|
| R1 | Sufficient, carried | Prior accepted replay/fallback/recovery/reconnect/reload proof retained; not newly recaptured. Final-head application is stale. |
| R2 | Minimum repaired | Two matching-title 1440/light apply-failed and replacement-session-recovered pairs; retained cached prompt; actual replacement input resumes cursor 87, head becomes ready, base stays unrecovered. All seven old title-mismatched comparisons remain withdrawn/rejected. This fulfills the prior allowed alternative of one clean complete protocol chapter mapped to existing four-layout status proof. It does not create seven replacement pairs. |
| R3 | Minimum repaired | Four fresh 1440/light/dark empty syncing/recovered pairs, stable repeats, append-only loads preceding each gate, trace/video linkage. Old overwritten timing is not reconstructed or retrospectively certified; the old unstable dark duplicate gets no credit. Earlier valid narrow/empty state proof is carried. |
| R4 bounded | Minimum repaired | Actual cold HTTP snapshot 10 unique items; warm resume 112 fails and cursorless fallback retains bounded/compact/completion flags and history metadata. Actual Load earlier expands 10→30 unique IDs, cursor advances item22→item02, hasMore remains true, expanded becomes true. Held 1440/light plus recovered and Load earlier in all four layouts cover distinct history rendering. |
| R4 full/legacy | Minimum branch proof repaired, limited | Actual full HTTP/socket snapshot contains 31 unique items, no progressive metadata, cursor null/hasMore false. The external upstream shim suppresses bounded and compact support, while completion-marker support remains true. This proves the full-snapshot branch against a modern server under disclosed emulation. Installed legacy-server integration is still unverified. Prior legacy=false/no-marker chapter remains separate carried proof. Rejected held full/sidebar-drift and earlier falsely named bounded-as-full attempts receive no credit. |
| R5 resume race | Minimum repaired | Old resumed Die classified before buffered delivery; replacement socket makeInput occurs before old failure release; release leads to fresh cursorless snapshot and ready. Three matched 1440/light pairs plus ordered trace/video. |
| R5 terminal race | Minimum repaired, head-only | Resume Die enters fallback; terminal fallback Die is buffered across replacement makeInput; releasing old failure causes immediate next cursorless attempt and ready. Base cannot enter this fallback branch, so no terminal base/head comparison exists or is claimed. Failed status can briefly persist during transition; no zero-transient-error claim. |
| R5 disposal/isolation | Minimum repaired | Actual Stream.onExit Interrupt-only exit occurs before old held snapshot release; B stays isolated after release; explicit A revisit creates fresh subscription. Separate matched warm-disposal chapter covers both revisions with four zero-delta pairs. Initial tapCause-only proof and hover/sidebar-drift controls are superseded. |
| C1 | Sufficient, carried/source collapse | Expected typed failure retry and authorization failure map to existing shared sync/ready/failed renderer states. No distinct Electron change or direct new desktop capture is claimed. Final-head application is stale. |
| M1 | **Missing** | No actual native base/head failed cached-content pill, non-button/non-press behavior, successful recovery, existing actionable connection control, or creation/connection/content precedence capture. A 390px web view cannot satisfy native consumers or accessibility. Native build pending; no native proof delivered for this pass. |
| FINAL-HEAD | **Stale / uncertified** | All delivered evidence targets premerge e810a33cf8, not merged dbecd5d7e9. R1–R5/C1 cannot be promoted to final-head certification. |

## Independent verification performed

Inputs: [new index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b6acf351e865f28f/index.md), [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/816c774dda0ab6a0/matrix.md), [previous audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d638d207584cd9e5/audit.md). Downloaded all three new delivery archives and independently matched their published SHA256 values. Local retained files match the public archive members, not merely their filenames.

Recomputed every one of the 23 candidate pairs using full-frame RGB maximum-channel differences at >0 and >16, and compared every mask array and reported count. All match exactly. All 46 base/head sides have byte-identical 500ms settlement repeats. No crop or exclusion mask is used. Opened all 23 comparison sheets and a complete inventory of 167 non-settlement originals/masks, including rejected/setup attempts, in 28 generated sheets. Repeat images are exact duplicates, verified rather than redundantly visually inspected.

Ten retained served module response bodies (five files per side) have inline source-map sourcesContent exactly equal to git show at the requested premerge/base SHAs. All 90 append-only load entries hash correctly; all five relevant loads precede each of the 46 candidate still gates, whose image hashes match the trace. These are retained loaded-response observations, stronger than a declared commit label. They are not a fresh independent browser execution or proof that the entire application/server binary equals that commit. Base uses external Vite response substitution for the five changed modules; head responses are exact unmodified served sources. Faults/holds are injected at the RPC stream boundary. Actual app state processing, routing, socket replacement and real server snapshot/history responses are exercised, with a synthetic fixture database.

All 13 newly delivered clips fully decode independently without ffmpeg errors. Opened all supplied sample/gate sheets, then independently extracted 144 frames (five-second samples plus frames around all 55 recorded gates) into a fresh directory and opened all 20 resulting sheets. Trace steps, recording epoch/offsets, state transitions and UI chapters agree at sampled/gated observations. Clips are silent; the linked timestamped step traces provide written narrative. This is not exhaustive every-frame playback or a measurement of production network latency. Intentional fault holds, resize/theme changes and setup overlays are visible and are not credited as clean comparison gates.

Representative independent pixel checks (RGB>0 / max-channel>16): R2 failed 22079/1314; R2 recovered 22083/1168; R3 syncing light 144/0 and dark 0/0; R3 recovered light 24999/2952 and dark 29101/2818. All four matched disposal comparisons and bounded held state are 0/0. Full per-pair results, gate/source timing, scripts and opened inspection sheets are in the [independent verification artifact](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6633ed25cf2461d7/round4-audit-verification.tar.gz).

No fresh independent browser reproduction was started this pass, following the final-head steering and bounded audit scope. The prior independent R2 result remains **0 differing pixels**, carried only. There is **no new independent recapture delta**; do not call the absence of a new run zero. The prior CDP/display collision attempt remains excluded.

## Source coverage and justified collapses

Read the complete 12-path premerge diff. The shared [threads runtime](https://github.com/pingdotgg/t3code/blob/e810a33cf8114e5c4e76eeffe8ea299ef8466b71/packages/client-runtime/src/state/threads.ts) changes resumed-Die classification, forceSnapshot lifetime, terminal failed-session identity and interruption handling. Consequently bounded/full fallback and each race/disposal ordering require their own protocol chapter, now supplied. Theme/viewport/provider do not branch those protocol decisions, so they do not require duplicate race movies in every styling combination.

Web [threadSync](https://github.com/pingdotgg/t3code/blob/e810a33cf8114e5c4e76eeffe8ea299ef8466b71/apps/web/src/threadSync.ts) keeps missing shell and deleted/live controls returning null. The changed entities error atom, ChatView failed phase/loading ownership and ComposerActivityStatus failed icon/alert share the renderer across protocol chapters. Existing four-layout failed/sync/ready proof plus the new empty and history layouts covers those affected presentations. Genuine empty/no-detail behavior is kept distinct. Settings, palette and keybindings navigate to the same consumer; passive recovery adds no new entry control. No changed premerge Electron shell/IPC, provider adapters, server or contracts justify extra independent fixture families. This does not certify remote/relay/tunnel integration.

Observed pixel changes include sync banner removal; failed alert/icon/text; composer border/shadow/antialias changes; small send-button spinner phase/AA pixels; empty text vertical shift; narrow history/timeline shifts; Load earlier scroll/composer/scrollbar positions. These are retained in full masks, including sub-threshold changes. New selected R2 titles match; rejected unrelated title/sidebar/hover differences are not hidden or accepted.

Native ThreadRouteScreen, ThreadDetailScreen, floating-working-status and floating-working-control are separate changed consumers. They include creation-error precedence, delayed status, connection-first behavior, approval/input suppression, and conditional onPress/button accessibility. They cannot collapse into the web proof. This is why M1 remains a blocking row even before the merge.

## FRICTION and scope

- **PROVENANCE / BLOCKING:** final head advanced by merge; all captures are premerge and remain labeled so.
- **NATIVE / MISSING:** native build/capture is a separate pending task; no delivered M1 proof is credited.
- **HARNESS / LIMIT:** synthetic RPC faults and legacy boundary shim establish controlled branches, not installed legacy compatibility or reproduction of every production interruption.
- **MEDIA / LIMIT:** silent clips with written timestamped steps; full decode plus extracted-frame inspection, not exhaustive frame review.
- **INDEPENDENT / LIMIT:** no new browser run; prior valid zero-pixel reproduction is carried, prior collision run rejected.
- **FETCH / RECOVERED:** Python URL fetch returned HTTP403; curl downloaded archives and hashes verified. No evidence omitted because of this.

No source edits, commits, pushes, PR comments/body edits, watchers, live userdata access, or new dev/browser processes. No tests rerun. Only audit scratch files were written outside the checkout. The replacement PR is linked to this thread and unwatched. Audit by GPT-6.1-sol through Codex; public report uploaded with ghdrop.

Premerge example only — BASE left / e810a33cf8 middle / RGB>0 mask right:

![Premerge matched-title recovery comparison, base left and premerge head middle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e48f57fb4696a653/R2-repair-apply-session-recovered-1440-light.jpg)

VERDICT: INSUFFICIENT M1, FINAL-HEAD (R1–R5/C1 stale).