# PASS — final evidence audit, pass 3

PR [#24334](https://git.cafe/pingdotgg/t3code/pulls/24334). Verdict applies to evidence captured at [9c717508](https://git.cafe/pingdotgg/t3code/commit/9c71750875834ff8c03623dca6f6fd0830685aa8), against baseline [27e0c684](https://git.cafe/pingdotgg/t3code/commit/27e0c684c585f955252d65f06206dd11a143bff5). No blocking behavior, privacy, matrix, or media-integrity findings.

## Behavior and privacy

Visually inspected all 128 HEAD sampled frames (16 sequences, frames 0–7), then all 128 BASE sampled frames, using in-memory sheets generated from the originals. All HEAD sequences show an active compaction row in samples 0–3 and its finished divider in samples 4–7. No sample shows active and finished compaction rows together. Manual, on-return, and expiry HEAD sequences suppress the command bubble and compaction-only Working/Thinking scaffolding. Finished count is 899K → 19K. Idle and automatic-expiry labels distinguish the sources. Narrow expiry labels wrap but remain visible. Midturn preserves the ordinary prompt and Working state; after the boundary, its Thinking indicator remains appropriate to the held ordinary run.

For every HEAD manifest, joined the completed compaction item to its owning run in the after-state record: the owning run is still running. All 12 explicit-command sequences hold terminal; all four midturn sequences hold post. On-return additionally retains its separately queued continuation; its last run being queued does not contradict the compaction run being running. Checked ready-marker session, prompt UUID, and phase against the recorded gates.

Read only the isolated /tmp/ev-24334 database in SQLite mode=ro to verify actual request provenance: manual /compact is user/web; all four on-return /compact requests are user/web with idleCompaction=onReturn; all four expiry requests are agent/server with idleCompaction=beforeCacheExpires and canonical idle-compact message IDs. Their dispatch times precede persisted cache expiry by 119.976, 119.990, 119.986, and 119.982 seconds, with 300000 ms seed TTL. This supports the real timer path rather than manually dispatched expiry captures. The replacement on-return dark/390 thread is the one referenced by its final manifest and has the required onReturn request and terminal-held states.

All visual samples contain synthetic EV fixture content, fixture titles, and synthetic project context. No visible credential, pairing URL, account details, or personal conversation was found. Disabled built-ins and enabled evClaude/evReturn/evExpiry were confirmed in isolated settings. Manifest credential-pattern checks also passed. Raw manifests contain local paths and internal identifiers; this verdict does not imply publishing all raw metadata is necessary.

## Independent matrix and integrity checks

- Exact Cartesian coverage: four sources × two themes × two CSS widths × two endpoint states × two revisions = 64 stills; 16 streams per revision, 32 total.
- Physical derived outputs: 64 PNG stills, 32 MP4 clips, 32 diff PNGs, 32 labeled comparison PNGs. Final report has no skipped records.
- All 256 original sample hashes match derived report hashes. Every raw endpoint and derived endpoint is byte-identical to its corresponding frame 0 or 7.
- All 128 BASE sample hashes match the older BASE directory; normalized manifests differ only in relocated frame paths. No superseded HEAD evidence was used.
- All 32 clips independently ffprobed: nine packets; first eight presentation times follow measured sample deltas, final sample held one second, endpoint repeat contributes one millisecond. Durations range 4.395–6.673 seconds. Release lies between samples 3 and 4 in every manifest.
- Decoded all 288 video packets and compared each to its expected source sample. Maximum mean absolute RGB channel difference was 0.883648, consistent with declared lossy H.264. Pixel dimensions include declared odd-height padding; no evidence of replaced sequence content.
- Recomputed all 32 RGB absolute diffs byte-for-byte, without masking, thresholding, alignment, or normalization. Independently checked changed-pixel counts and exact preservation of BASE/HEAD screenshot regions below each composite’s 64px label band.
- CSS desktop 1440×1000 uses 1280×889 original PNGs; CSS narrow 390×844 uses 780×1688 PNGs. DSF=2 is recorded for all HEAD streams. Theme appearance was verified visually, including manifests whose browser.theme string is empty.

## Provenance and limits

At audit entry, /home/ubuntu/wt/pr-24334 HEAD was exactly 9c71750875834ff8c03623dca6f6fd0830685aa8 and git status --porcelain was empty. All 16 HEAD manifests declare that SHA and fixture SHA256 e4f7d0bc153fe402a9c48fa109d4499510643a34adc338d8dd24c9042d05192d; the current fixture independently hashes to that value. Capture-time clean-git status is NOT embedded in those manifests, despite the brief’s description. This is a provenance bookkeeping limitation; the audit confirms cleanliness at entry, not an independently authenticated history of capture-time cleanliness. Likewise manual-light-1440 records reconnect=true, but this read-only audit did not replay navigation or independently verify a browser action trace.

The checkout advanced during the audit to merge commit [7ab6cddc](https://git.cafe/pingdotgg/t3code/commit/7ab6cddc292ec4eff6287bae3a12f3e4d835c880), with 9c717508 as first parent. Its delta is confined to McpHttpServer.ts and core.test.ts analytics changes; the compaction UI/fixture evidence remains pinned to 9c717508. This is not a fresh whole-source approval of the merge commit.

Eight screenshot samples cannot exclude behavior between samples. Endpoint states mean compaction-item completion, not necessarily whole-run completion. Terminal holding intentionally differs from baseline timing; comparisons include dynamic sidebar/timer/panel changes and are not isolated regression scores. Original PNGs are authoritative; videos are lossy. On-return uses synthetic stale usage prerequisites, and fixture counts/content are synthetic. Native apps, OS notifications, native resume-question behavior, and failure/no-count visuals remain unverified here; no claim is made about independently rerunning their logic tests. The legacy baseline’s first manifest lacks after-state metadata, so its endpoint semantics were assessed from pixels rather than an invented persisted record.

No source, evidence, settings, or database writes; no push, review/comment, browser/server launch, real-userdata access, or other-machine access. The only filesystem artifact written by this audit is this report. PR registration was performed through the app-owned linking tool as required by harness instructions. Audit performed with GPT-6.1-sol through the Codex harness.