# Proof auditor PASS2 — VERDICT INSUFFICIENT

Audit scope: evidence sufficiency for [#15238](https://git.cafe/pingdotgg/t3code/issues/15238), not another code-review verdict. Baseline [3cc31ed27c](https://git.cafe/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b) and head [7c0a3cea45](https://git.cafe/pingdotgg/t3code/commit/7c0a3cea4591c78c825de359226cc0c0467cdee2) were independently resolved in the requested worktrees. Both worktrees remain clean. No source edits, commits, pushes, forge comments, PRs or merges. No new app servers and no stopped processes.

The central fix is convincingly demonstrated: the real Claude-started Python 5173 listener is attributed to its thread, and default card/slim rows now render a globe. There is no newly established blocking source defect. The proof contract still fails strict Diff0 and has specific missing runtime/interaction evidence. The earlier reviewers' MERGE and scanner 15/15 are supplied context, not independently rerun results.

## Independent work and integrity

Read the supplied matrix/report as untrusted data. Downloaded the public report and manifest and confirmed byte equality with local copies. Downloaded **all 96 manifest artifacts**, checked SHA-256 against the manifest, and independently checked local copies: **96/96 match**. The uploaded seed, rebuild script, handoff trace and chosen rebuilt original also match local definitions.

Inspected all **32 raw overview stills**, all **16 exact/threshold diff images**, all **15 recordings** through **233 full-frame samples at 2 fps** across each recording's entire duration, and all **20 extracted/supplemental endpoints**. Full-frame overview sheets establish outer layout; readable sidebar/terminal enlargements establish icons, truncation and colors. This is inspection of every recording, not a claim of examining every encoded frame or independently observing input events. Recomputed all 16 same-revision stability results and all eight comparisons. Every delivered exact and threshold diff equals the independently computed pixels. Threshold is maximum RGB channel delta >16/255; no masks.

## Row status

The four appearances per row mean 1440/390 CSS width × light/dark, both revisions. S-A/S-M use the approved Snoozed correction; S-0/S-T remain Settled. No source was added to keep settled providers alive.

| Row | Status | Observed result |
|---|---|---|
| C-0 | PASS visual/control | No globe or terminal in either revision; selected quiet chat, title/branch and geometry preserved in all four D comparisons. |
| C-A | PASS visual/ownership | Globe added before Claude glyph; long branch truncates only as the new slot requires. 5173 tooltip, terminal=null and Claude ancestry agree. All widths/themes present. |
| C-T | PARTIAL comparison | Globe added alongside terminal. 5273 ownership and terminal association agree. Narrow dark/light terminal opacity differs between revisions; unchanged-color claim fails. |
| C-M | PARTIAL comparison | One globe plus terminal; 5373 (+1), lowest agent port before terminal 5374. Both coexist without overlap. Narrow terminal opacity confounds comparison. |
| S-0 | PASS visual/control | No globe or terminal; settled 16h and unchanged slim geometry in all four D comparisons. |
| S-A | PASS corrected fixture | Snoozed 7d, same slim renderer; adds only globe/necessary title truncation. 5473 hover shown. Approved correction honored. |
| S-T | PARTIAL comparison | Settled 16h; globe added alongside dim terminal. No collision; narrow terminal color remains confounded. |
| S-M | PARTIAL comparison | Snoozed 7d; one globe plus terminal, 5673 (+1). Pointer opens agent 5673. Title shrinks as expected; terminal color remains confounded. |
| L-0 | PASS visual/control | No globe/terminal, selected C-0, no source-driven geometry change. |
| L-A | PASS visual/ownership | Globe added; necessary C-A text truncation. 5173 hover present; real Claude ownership confirmed. |
| L-T | PARTIAL comparison | Existing globe and terminal positions preserved; 5273 opens. Dark 390 terminal brightness differs; light 390 terminal is unchanged. |
| L-M | PARTIAL comparison | Geometry preserved. Base tooltip/target 5374; head tooltip 5373 (+1), narrow pointer opens 5373. Dark 390 terminal brightness differs. |

All 16 compositions use the stated route, quiet selected C-0, fonts loaded, frozen displayed clock 2026-10-25T12:00Z and DPR2. D metadata retains eight row bounds; L metadata records zero default-row test IDs because legacy has different markup, but all four legacy rows are visibly present. Desktop capture is 1280×889 pixels from 1440×1000 CSS; narrow capture is 780×2000 from 390×1000 CSS. This is narrow web, not native mobile.

## Exact stability failures — small still defects, not major bad frames

11/16 same-revision pairs are exactly equal. Five fail, independently reproduced from decoded RGB pixels:

| Composition (both `-1.png` and `-2.png`) | Changed pixels | Half-open bounds | Max channel delta | Diagnosis |
|---|---:|---|---:|---|
| [base-D-1440-light-1.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c52045ae55620242/base-D-1440-light-1.png) / [base-D-1440-light-2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1b9db6d58464ad4d/base-D-1440-light-2.png) | 510 | [226, 0, 227, 889] | 2 | One output-pixel-wide sidebar boundary at x226; no row/timeline displacement. |
| [base-L-1440-dark-1.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/901bf898164ca4cb/base-L-1440-dark-1.png) / [base-L-1440-dark-2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b13cacd28f11e1e8/base-L-1440-dark-2.png) | 76 | [12, 11, 36, 35] | 8 | Legacy toggle halo; no row/timeline displacement. |
| [base-L-1440-light-1.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e0e42b93edd7fcdc/base-L-1440-light-1.png) / [base-L-1440-light-2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b4050ffbfbfc9a0e/base-L-1440-light-2.png) | 381 | [226, 0, 227, 889] | 8 | One output-pixel-wide sidebar boundary at x226; no row/timeline displacement. |
| [head-D-1440-light-1.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f87fcb691942ae85/head-D-1440-light-1.png) / [head-D-1440-light-2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cbf6bbfdbb689a27/head-D-1440-light-2.png) | 510 | [226, 0, 227, 889] | 2 | One output-pixel-wide sidebar boundary at x226; no row/timeline displacement. |
| [head-L-1440-light-1.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ed90ddcf32ace51e/head-L-1440-light-1.png) / [head-L-1440-light-2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9a2bc57501a07f21/head-L-1440-light-2.png) | 758 | [226, 0, 227, 889] | 55 | One output-pixel-wide sidebar boundary at x226; no row/timeline displacement. |

These cannot be called Diff0, including the two max-delta-2 failures. The head legacy light boundary reaches delta55, so calling all five merely imperceptible low-color noise would overstate the evidence. There is still no large layout drift in those pairs. The exact compositor cause is not established. Boundary/hover/transition painting is a capture-environment hypothesis, not a proved source regression. Crop or threshold masks would not satisfy this contract.

Cross-revision terminal differences are separate: `diff-D-390-dark-exact.png`, `diff-D-390-light-exact.png`, and `diff-L-390-dark-exact.png` contain terminal glyph brightness changes at unchanged glyph positions. Both D threshold companions and the L dark threshold companion retain them. L light narrow has only the expected new agent globe/truncation. The raw enlargements show opacity-like differences, not a changed terminal shape. Source `ThreadStatusIndicators.tsx` has identical terminal classes in both revisions (`text-teal-600 dark:text-teal-300/90`) and a 2s pulse whose opacity ranges from 1 to .5. Its `synchronizeTerminalPulse` resets animation startTime on animationstart. A pending start event/compositor flush is a plausible confound despite logged currentTime0, but the original metadata lacks playState/computed opacity to prove the cause. Do not certify terminal colors unchanged from these pairs. A separate exact rebuild below shows source rendering is reproducible.

All eight cross-revision diffs were inspected. D desktop diffs are confined to new globes and necessary nearby branch/title truncation. D narrow adds those changes plus the terminal brightness confound. L desktop adds C-A globe/truncation plus the small edge/halo artifacts. L narrow adds C-A globe/truncation; dark also has terminal brightness changes. Row-0 controls remain free of a globe. No clipping, icon collision, shifted selected chat or unrelated timeline change was found in the settled overviews.

## Recording and endpoint audit

| Exact recording | Status | Independent observation |
|---|---|---|
| [base-card-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a93cc6e3efa3d8d4/base-card-1440.mp4) | PASS absence segment | 2.98s; agent/mixed row hover, no default globe; unsupported opening segment correctly omitted. |
| [base-card-390.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4b1b45f2bd8a7efd/base-card-390.mp4) | PASS absence segment | 2.91s; responsive sheet opens; agent/mixed hover, no globe. Keyboard unsupported/absent. |
| [base-slim-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bfb6fefe05da413a/base-slim-1440.mp4) | PASS absence segment | 2.49s; S-A/S-M hover, no globe; no manufactured before control. |
| [base-slim-390.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/82210acc33d23ca8/base-slim-390.mp4) | PASS absence segment | 2.85s; sheet opens; S-A/S-M hover and terminal coexistence. No globe. |
| [base-legacy-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3681e789ffd7e2d5/base-legacy-1440.mp4) | PARTIAL sequence | 14.22s; starts with mixed 5374 already loaded. Hovers 5273/5374, then terminal C-T opens loaded 5273. The initial mixed activation is outside this recording. |
| [base-legacy-390.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2a630f040d047e05/base-legacy-390.mp4) | FAIL loaded endpoint | 32.20s; 5273 then 5374 hover; pointer selects C-M and requests 5374. Connecting persists from about 4s through 31s; final surface is black with a white middle block, not readable fixture content. |
| [head-card-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a569ba5931e0b673/head-card-1440.mp4) | PASS pointer; keyboard claimed | 10.35s; 5173 and 5373 (+1) hover; inactive C-M opens loaded 5373 about 6s; then C-T/5273 loaded about 9s. 1440 keyboard is reported; pixels establish destination change but cannot independently identify the key event. |
| [head-card-390.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e5996048f9214cab/head-card-390.mp4) | PASS pointer; keyboard missing | 7.32s; sheet opens; 5173/5373 (+1) hover; C-M click dismisses sheet and loads fixture around 5s. No terminal drawer. No narrow keyboard segment. |
| [head-slim-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1ffe0ef1ec192885/head-slim-1440.mp4) | PASS pointer | 7.18s; 5473/5673 (+1) hover; inactive S-M opens loaded 5673 around 5.5s. Brief preceding-size Browser frame during opening; final state is correct. |
| [head-slim-390.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ad248422c3bfc5c2/head-slim-390.mp4) | PASS pointer; keyboard missing | 7.50s; sheet opens, 5473/5673 (+1) hover; inactive S-M click dismisses sheet; loaded fixture around 5s. No narrow keyboard segment. |
| [head-legacy-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3df5d34738506f2a/head-legacy-1440.mp4) | PARTIAL sequence | 6.49s; agent 5173 hover, mixed 5373 (+1) hover; terminal C-T opens loaded 5273 about 5.5s. Mixed pointer-open is demonstrated in the 390 counterpart. |
| [head-legacy-390.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/53dcfbd9c85eb5f8/head-legacy-390.mp4) | PASS pointer; keyboard missing | 6.88s; sheet opens, agent/mixed tooltips; C-M click loads fixture around 5s and sheet dismisses. No narrow keyboard segment. |
| [head-lifecycle-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3660173bd1feef95/head-lifecycle-1440.mp4) | PARTIAL data proof | 7.31s; legacy C-A globe visible, then disappears near end while C-T/C-M remain. Visual reverse-state works. No retained stop-command receipt or post-stop discovery payload ties disappearance to unregister rather than another owner-state change. |
| [head-slim-keyboard-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/36cccad2cc1f39a7/head-slim-keyboard-1440.mp4) | PASS visible outcome; input trace absent | 3.73s; Browser closes, S-T activates and 5573 loads. Keyboard is reported but exact input event is not independently encoded in the video. |
| [head-browser-list-1440.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3df697537aaf52e8/head-browser-list-1440.mp4) | FAIL list claim | 1.92s; pane menu over existing 5573 preview, then same loaded page. It never shows the discovered-server list. The separate head-browser-list-endpoint.png does show all eight ports. |

The major bad retained frame is **endpoint-base-legacy-390-2.png**: a black Browser surface with a middle white rectangle, without the fixture heading. Its corresponding video waits about 28s in Connecting. It is not evidence of a loaded baseline endpoint and is qualitatively different from a one-pixel sidebar tint. There is no supplemental loaded baseline narrow legacy still in the delivered set.

`endpoint-head-browser-list-1440-2.png` shows an already loaded 5573 page, not a list. The supplementary `head-browser-list-endpoint.png` actually shows 5173, 5273, 5373, 5374, 5473, 5573, 5673 and 5674. Keep that still, correct the recording label/claim, and add the missing baseline list. Head narrow card/slim/legacy pointer recordings really do reach readable deterministic content; they do not need replacement just because the report broadly mentions Connecting endpoints.

Other endpoints inspected: all base card/slim endpoints are their legitimate no-globe hover states; base legacy desktop is loaded 5273; head card desktop and its supplement are loaded 5273; head slim desktop and supplement are loaded 5673; head legacy desktop is loaded 5273; head narrow card/slim/legacy endpoints show loaded content; lifecycle endpoint shows removed C-A globe; slim keyboard endpoint is loaded 5573. These open states were not used as pixel comparisons. Brief Browser sizing/previous-surface frames during head desktop opening are not settled proof frames and do not establish a new product regression.

## Independent rebuild — exact result

Downloaded the uploaded fixture definitions and handoff trace, reviewed them, and rebuilt **one affected composition: head L, 1440 dark**. Used a fresh owned product-native preview tab and the existing head runtime; did not execute the DB seed, launch providers, create fake discovery, modify source or stop/restart runtimes. Reused surviving C fixtures, set legacy=true/workingShelf=false/created_at sort, selected C-0, froze only page Date/Date.now, followed dark system appearance, awaited loaded fonts, paused the two continuous status-pulse animations at currentTime0, cleared composer focus and awaited two animation frames.

The rebuilt capture `rebuild-head-L-1440-dark-blur.png` is **pixel-identical to uploaded head-L-1440-dark-1.png: 0/1,137,920 changed pixels, max delta0, threshold16 count0**. Its own second still `rebuild-head-L-1440-dark-blur2.png`, taken more than 500ms later, is also Diff0. Sidebar including all four rows matched even before blur. The initial unblurred rebuild differed by 1,785 pixels only within the composer at [338,743,993,871]; after removing focus the entire image matched. This positively identifies focus/caret and focus-border state for that preliminary rebuild difference; it is not the diagnosis of the five delivered failures.

Independent current discovery returns real 5173/5273/5373/5374, with agent terminal=null and terminal associations matching the manifest. Current HTTP/ancestry checks: 5173→python3/bash/claude→head backend, 5373 likewise; 5273/5374→python3/bash→head backend; all four HTTP200 with synthetic fixture body. Current S ports 5473/5573/5673/5674 are absent/connection-refused after the evidence owner's archival/lifecycle cleanup. They cannot be rebuilt as live slim fixtures from the current state without lead-owned relaunch. The app runtimes are still alive at base5967/14007 and head5835/13875 with the supplied owning PIDs.

Independent rebuilt still (same pixels as the uploaded head original):

![PASS2 independent head legacy dark rebuild, 1440 CSS px](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7f0f9eceee499eb6/rebuild-head-L-1440-dark-blur.png)

## Source consistency and nonvisual gaps

The changed default card/slim placements and extracted legacy button agree with the captured order, tooltip +1 suffix, lowest-port selection and propagation guards. `portDiscoveryState.ts` explicitly uses `threadId ?? terminal?.threadId`; the contract makes threadId optional. Old payload fallback and explicit-thread precedence are source-confirmed, not runtime-tested. The shared handler preserves interrupted-command suppression and `Unable to open preview` error toast; no failure was induced. Those are valid source-equivalence checks under the matrix, not invented runtime passes.

Claude POSIX registration, ancestor walking, snapshot threadId equality and owned-only probing explain the real Python ownership change. `server.ts` supplies the scanner-backed AgentProcesses layer. ACP runtime registers child.pid and unregisters with its runtime scope, but no real ACP launch/close trace exists. Scanner tests and Claude Linux evidence cannot substitute for it.

`latestRunDiff` unconditionally returns null in BOTH revisions. Nonzero diff-count pressure is therefore impossible through the current real sidebar path without changing source. Record this as an inapplicable proof-plan requirement/lead waiver; do not demand source code solely to manufacture a visual fixture. Long title/branch pressure and terminal/globe coexistence are already present.

Permission-denied globe suppression has source support but no denied-session runtime evidence. Empty-per-thread isolation is visually covered by C-0/S-0 while other servers exist; the initial globally empty discovery snapshot is missing. Head attribution is retained; a separate baseline discovery subscription payload is missing, even though terminal-only legacy behavior and runtime ancestry corroborate its expected shape. Final DB fingerprints are explicitly handoff state, not capture-time snapshots; real action timestamps differ, although displayed labels match. No full persisted-state equivalence should be claimed.

Reduced-motion emulation was unavailable; the accepted substitute is disclosed live recordings plus paused continuous WAAPI for stills. No reduced-motion claim is required or made. Native mobile, Electron shell, remote/tunnel and Windows descendant attribution remain disclosed scope limits; this audit does not invent additional mandatory surface captures.

## Minimal dispatcher repair list

1. **Strict still gate:** replace only the five failed same-revision compositions listed above with two unmasked full stills at least500ms apart that decode identically. For terminal-color confounds, recapture matching base/head D390 dark/light and L390 dark with verified paused playState/currentTime AND computed opacity, after animationstart/finite transitions and compositor frames settle. This is at most11 compositions, not a 16-composition restart. Regenerate the six affected base/head diff pairs (12 diff files) and update hashes/metadata; retain the already valid two comparison pairs.
2. **Missing narrow keyboard gate:** retain a short 390 dark keyboard activation for head card, slim and legacy with destination thread, requested port, loaded content and no terminal drawer/rename/drag. Include baseline legacy keyboard in its repaired 390 sequence as required by the original matrix; baseline card/slim have no button. Prefer an action trace identifying Enter/Space. Existing head narrow pointer recordings pass and can stay.
3. **Baseline/empty-state gate:** retain baseline discovered-server list plus its actual discovery payload, and the globally empty discovery snapshot. Replace/extend base-legacy-390 to a readable loaded 5374 endpoint. The head list supplement already passes as a still; relabel the misleading list recording or append a real list segment.
4. **Runtime provider gate / permission limit:** retain one real ACP-backed owned listener attribution plus close/unregister removal trace. For permission suppression, a real preview:operate-denied session would need the listener still in discovery and globe absent on default and legacy. The original matrix expressly permits reporting permission unverified if no such session is available; retain that disclosure or capture the scoped session, rather than inventing a mandatory new auth setup. These are focused snapshots/transcripts, without a new theme/width matrix.
5. **Lifecycle/integrity closure:** attach the typed stop/session-close receipt and resulting discovery-removal payload to the existing C-A disappearance video (or replace that short segment if receipts were not retained). Bind repaired captures to capture-time scoped state/discovery and exact revisions. Rewrite claims around the actual surviving files, and explicitly waive nonzero diff counts as unreachable without source changes.

No source repair is requested by this audit. These gates concern evidence; source reviewers may still consider the implementation mergeable. Diff0 cannot be waived silently. Reduced-motion substitute and Snoozed correction are already accepted and are not remaining gates.

## Friction, ownership and scratch

Skills used: [test-t3-app](/home/ubuntu/t3code/.agents/skills/test-t3-app/SKILL.md) and [ghdrop](/home/ubuntu/.codex/skills/ghdrop/SKILL.md). Product-native preview only. One owned tab: `tab_3_ce3092fc-b4b7-4278-bdff-ae6f7fc12a2b`, left on head C-0 in legacy dark with paused animations for inspection. The tab remains available; parent may close it. Isolated client setting legacySidebarEnabled was set true for the rebuild; no source or DB projection writes. Pairing required a newly minted isolated one-time token plus explicit Continue; navigating the token fragment alone did not authenticate. Tokens are excluded from every audit artifact.

Initial NumPy import was shadowed by a scratch script named inspect.py; renamed it audit_media.py. urllib downloads returned403; curl fetched the same public artifacts successfully. A 15s preview wait timed out while still unpaired; corrected by submitting the pairing form. No browser fallback was used. Native desktop screenshot downscaling is retained in all comparisons. No reduced-motion tool was invented.

Scratch: `/tmp/issue-15238-pass2/` contains report, integrity/pixel JSON, frame samples/contact sheets, downloaded public artifacts and rebuild script/stills. Product-native screenshot copies also exist under `/home/ubuntu/.t3/userdata/browser-artifacts/` (browser-owned artifacts only; no database touched). No committed scratch. All servers/processes belong to the lead; sessions25161/60815 were not accessed or stopped. No PR was watched. Model/harness: gpt-6.1-sol, Codex through T3 Code.