Proof audit pass 2 — [#25688](https://git.cafe/pingdotgg/t3code/pull/25688)

Findings

1. U3 is INSUFFICIENT on both platforms under the requested capture standard. `android-before-2026-10-27T15-56-25.330293+00-00/U3-android-before.png` has a completely blank browser content area. `ios-before-2026-10-27T16-05-51.967625+00-00/U3-ios-before.png` shows the old “Preview proof / Local HTTP fixture” content below `https://mailto:a@b.c/`, with a large blank band and different vertical placement. Sampled before recordings retain these same blank/stale surfaces. The evidence section’s “before shows the failed navigation surface” claim is contradicted by the iOS image and is not visually established on Android. After recordings do show fill, submit, alert, dismissal, retained local URL and local fixture. The stale/blank before captures must be replaced; their existence does not establish sufficient paired visual proof.

2. U4 is INSUFFICIENT under the explicit prohibition on diffs containing unrelated changes. `U4-about-diff0.png`, `U4-about-diff5pct.png`, `U4-mailto-diff0.png`, and `U4-mailto-diff5pct.png` include unrelated terminal output/cursor changes. The selected about pair contains one `true` invocation before versus three after; the mailto pair contains two versus four. The “what else changed” disclosure is directionally correct but understates this as one extra invocation. The recordings support the actual functional outcomes (changed about toast; base mailto browser versus head error toast), and the 1280×800/light dimensions match. Reset terminal state consistently and recapture the pair to meet the requested standard.

3. All four DiffT images use a 5% luminance threshold, not the stated “5% channel threshold.” Recomputed luminance masks match every pixel; maximum-channel masks disagree at 583 pixels for U4-about, 1,067 for U4-mailto, 25 for Android, and 75 for iOS. Diff0 matches exact nonzero absolute RGB difference. Two diffs exist for each visual fixture; correct the method description or regenerate with the specified channel rule.

4. Coverage gaps remain: R8 lacks blob, chrome, file, sms, ssh, view-source, ws, and wss representatives; R9 lacks environment-port execution; H1 lacks history-store/migration execution; H2 lacks Electron IPC or a labelled service-harness result. The evidence section acknowledges these limits. Shared-file equivalence establishes normalization implementation equivalence only, and does not fill the missing callers.

All paths above are relative to `/tmp/lead-25688-r2/capture/`.

![Selected before captures show blank/stale content; Electron diff highlights unrelated terminal output](/tmp/lead-25688-r2/audit2/proof-problems.png)

| Row | Status | Basis |
|---|---|---|
| R1 | SUFFICIENT | Paired RPC classification/length errors; empty session lists before and after. |
| R2 | SUFFICIENT | Paired navigate errors; owned non-server session unchanged. |
| R3 | SUFFICIENT | Paired real MCP open errors; no added tab. |
| R4 | SUFFICIENT | Both URL shapes; paired MCP errors and unchanged owned-tab status. |
| R5 | SUFFICIENT | RPC Idle and MCP null-URL omitted-input successes on both revisions. |
| R6 | SUFFICIENT | Both inputs via RPC and MCP: base normalized network attempt; head normalization rejection. |
| R7 | SUFFICIENT | Ordered viewer control/input/status; about rejected in both, mailto navigates only on base. |
| R8 | INSUFFICIENT | Partial function probe; eight scheme representatives absent. |
| R9 | INSUFFICIENT (partial) | HTTP GET and Success on both; normalization controls present; environment-port absent. |
| U1 | EXEMPT | Unchanged control; matrix requires no capture. |
| U2 | EXEMPT | Unchanged control; matrix requires no capture. |
| U3 | INSUFFICIENT | Blank Android and stale iOS before surfaces. |
| U4 | INSUFFICIENT | Unrelated terminal changes in both full-frame diff pairs. |
| U5 | EXEMPT | Unchanged control; matrix requires no capture. |
| H1 | INSUFFICIENT | Normalizer probe only; no history caller proof. |
| H2 | INSUFFICIENT | Normalizer probe only; no IPC/outer error proof. |

Verification coverage: reviewed the complete two-file PR diff, evidence section, matrix, capture metadata, driver and step logs; opened all 33 PNG files, including all 18 selected stills/diffs, directly or in labelled contact sheets. Extracted and inspected frames from all six selected recordings with ffmpeg (desktop trigger/toast/editor/outcome; native initial/input/submit/outcome/dismissal). The narrated sequence matches those recordings, with the capture defects above. Native video dimensions are Android 1080×2424 and iOS 1206×2622 (3× the 402×874 normalized stills); desktop is 1280×800. All selected captures are light. Column SHA labels and runtime metadata match base [36d4d711b79c](https://git.cafe/pingdotgg/t3code/commit/36d4d711b79c73eb33131944f73ea4a8c6156484) and head [2075a09038](https://git.cafe/pingdotgg/t3code/commit/2075a0903833cee1a33dd087f7029ff6e3d1f85f); checkout HEAD/merge-base and shared-module hashes independently match. Every required-row JSON frame in the raw logs appears verbatim in the assembled transcript. Rebuild skipped for budget as requested. No browser/client launch, edits, pushes, or comments; scratch only in audit2.

FRICTION:
category | what happened | what would have avoided it
artifact access | Three selected public artifact fetches returned HTTP 403; local evidence used | Readable local manifest with uploaded-file hashes
artifact provenance | Root U4-before files differ from final timestamp-directory files; root copies do not reproduce final diffs | One manifest mapping each public URL to exact local path and SHA-256

VERDICT: INSUFFICIENT R8, R9 (environment-port), U3 (Android+iOS), U4, H1, H2