# PASS2 proof audit — findings first

**Evidence is insufficient for the requested recorded proof, rather than evidence of an implementation defect.** The core behavior is independently reproducible. Required repairs are concentrated in A1 light continuity, A9, A12 and A14; A3's final trailing-slash case and A13's asynchronous recovery also lack the recorded settled ending requested by the matrix.

1. **A9: the changed WSL mismatch guard has no filmed error or before comparison.** All 22 decoded frames of the 3.364s head recording show the destination palette/background, with no mismatch toast. Its JSON records the exact expected error and zero mutations, so the routing assertion has textual evidence. It does not establish the claimed visible error. There is no base WSL mismatch recording. A1's ordinary-folder base cannot represent this separate changed rejection branch. Repair with one matched base/head mismatch interaction, A confirming clone while UNC maps B, retaining the full toast/result and request counts. A synthetic B with no transport is adequate for the UI guard claim, provided that limitation remains explicit.
2. **The capture pipeline stopped before several final renders.** A12's 7.595s legacy recording ends on `Loading folders...`, despite JSON recording cloneRepository followed by project.create. Both core light2 flow recordings also end on the loading destination palette. Their outcome companion clips genuinely show the settled states, but leave a gap across the interaction. A3's final picked/ case and A13-async's fresh recovery likewise end on the palette. JSON/disk prove successful operations; they cannot supply the missing visual transition. Keep recording until the decoded export, not merely a DOM snapshot, contains the settled result.
3. **A14 movies do not show their claimed results.** All 71 source-permission frames and all 20 orchestration-permission frames lack the new unavailable toast. All 17 disconnected frames show the earlier “Clone unavailable” permission toast, not “Environment unavailable / fs-04 is not connected.” JSON includes the correct messages and zero mutation arrays, but the disconnected movie is visually contaminated by the preceding case. Repair each newly reachable picker-to-submit guard capture after dismissing earlier notifications; retain permission/connection state and zero counts. These are client-cache simulations, not server-policy revocation or transport-disconnect proofs.
4. **Optional gaps are correctly narrowable.** Missing A11 secondary bootstrap, dedicated A15 add-folder/WSL control, A16 same-name in-app variant, A17 lookup-provider entry, and controlled M2 variants are unchanged paths. They should remain disclosed, but are not merge-proof blockers for this web-picker change. Do not expand this to all providers, themes, operating systems, or native mobile interactions.

## Row status

“Partial” means a specified proof component is absent; it does not mean the behavior failed. “Narrowed” means an unchanged optional control is intentionally omitted. All bridge/Windows/WSL browser claims are synthetic application-routing claims.

| Row | Status | Actual evidence and precise limitation |
|---|---|---|
| A1 | Partial; core behavior passes | Dark base/head full flow, canonical dark/light before/after stills, requests and disk agree: base adds picked; head clones picked/repo. Independent head reproduction passes. Light2 movies end at loading palette; separate outcome movies do not preserve continuous light interaction. |
| A2 | Sufficient for path claim | A2-A3 movie, exact request and Git/README disk manifest show same-name repo/ cloned directly. No native dialog claim. |
| A3 | Partial, trailing-case recording ending | Case-sensitive Repo/repo and picked/repo requests/disk pass. Last picked/ case ends on confirm palette, rather than its settled result. Earlier cases provide shared behavior context. |
| A4 | Sufficient, bounded synthetic claim | Windows platform fixture captures C:\Proof\Repo and C:\Proof\repo at command boundary and deliberately denies disk. Movie is light, not the matrix's suggested dark Windows control. No style change or native Windows success is inferred; no extra theme Cartesian required. Denial toast is in JSON, not the movie's final visible state. |
| A5 | Sufficient textual proof | Exact helper import: / → /repo; C:\ → C:\repo. No root disk write. |
| A6 | Sufficient counts; bounded control | Two null-valued picker calls (cancel/reject fixture), zero reject-phase mutations, then one real clone request and Git/README. Movie ends at loading. Final retry appearance is represented by A1; cancellation handling itself is unchanged. No independent native cancellation/timing claim. |
| A7 | Sufficient counts; bounded control | Pending transcript has one deferred picker call, zero mutations; final transcript has one clone. Movie ends loading. Shared A1 supplies settled appearance; no native latency measurement. |
| A8 | Sufficient synthetic routing | Both UNC spellings have exact mapped destination requests and real Linux disk clones. localhost movie reaches repo composer; dollar movie stops loading. Same-name dollar request/disk establish its parameterized path case; no separate OS/transport or timing claim accepted. |
| A9 | Required gap | Head JSON error/counts pass; all recorded frames omit the mismatch toast. Base mismatch comparison missing. This is a distinct affected rejection branch. |
| A10 | Sufficient error control; narrowed recovery ending | Unmapped-distro error is visible in movie; zero count and successful mapped retry in JSON/disk. Recovery movie ends loading; existing unmapped branch is unchanged and matching route is represented by A8. |
| A11 | Narrowed | WSL-only-primary picker target wsl:Ubuntu evidenced by A8/A10. Secondary desktop-local bootstrap not captured; resolver unchanged. |
| A12 | Required recording gap | Legacy request ordering and real cloned disk pass. Movie ends loading, not success. Newly reached legacy picker path needs its settled recording. No redundant legacy base is required. |
| A13 | Partial asynchronous recovery | Immediate tracked and rejected legacy errors are visible; their final movies reach composer. Async movie visibly shows failed project with Retry/Remove, but fresh valid recovery ends on palette. JSON records a second start; it is not a filmed settled recovery. |
| A14 | Required visible-state gaps | Both permission removals/disconnected state plus zero mutations are textual. Source/orchestration movies omit new toast; disconnected movie shows stale permission toast. No authoritative server revocation claim. |
| A15 | Narrowed | Ordinary folder used to seed backdrop. Dedicated normal/WSL local-folder recordings absent. Those fallthrough branches are unchanged and new branches return only in clone-confirm. |
| A16 | Sufficient bounded control | Plain-web dark1440×900 and light390×844 movies/stills show in-app clone and no file-manager footer. Last frames reach composer. Same-name browser-navigation variant omitted; existing helper unchanged. Browser responsive proof only. |
| A17 | Narrowed | Direct URL exercised; configured lookup-provider entry omitted. Lookup supplies the same confirm remote/name/environment and is unchanged. |
| M1 | Sufficient with disclosed viewport substitution | **Plain mobile verified on iOS static fixture only**, real native destination components, light/dark402×874 normalized1x. Path /proof/picked/repo, Clone project, folder list and no desktop picker visible. Requested393×852 unavailable. No integrated clone or animation claim. |
| M2 | Optional unchanged gap | Missing controlled no-grants, empty-environment and disconnected-environment native static states. Earlier unavailable diagnostic is not any of these controlled cases. |
| M3 | Sufficient static logic proof | Existing iOS-configured test fixture checks initially missing project-create permission and retained callback after revoking each of two scopes: no directory/project. Delivered focused log: 2 files,10 tests pass. Native components are mocked; no native interaction/animation inference. |

## Scope, revisions and representative before proof

Audited [#22226](https://git.cafe/pingdotgg/t3code/pulls/22226), mirrored [#22226](https://github.com/pingdotgg/t3code/pull/22226), author macodev00, branch cursor/clone-file-manager-12647, target main. Worktree HEAD is [6c0099b88e](https://git.cafe/pingdotgg/t3code/commit/6c0099b88ee0285f64aa73236f8b6a35422e2947); actual merge-base against origin/main is [4f651cb10d](https://git.cafe/pingdotgg/t3code/commit/4f651cb10d2a885be82748e22a280eeef591200f). Full SHAs: 6c0099b88ee0285f64aa73236f8b6a35422e2947 and 4f651cb10d2a885be82748e22a280eeef591200f.

Complete diff: only [web CommandPalette](https://git.cafe/pingdotgg/t3code/src/commit/6c0099b88ee0285f64aa73236f8b6a35422e2947/apps/web/src/components/CommandPalette.tsx), [shared project helper](https://git.cafe/pingdotgg/t3code/src/commit/6c0099b88ee0285f64aa73236f8b6a35422e2947/packages/client-runtime/src/operations/projects.ts), and its tests,70 insertions. No apps/mobile diff. Mobile uses getCloneDestinationBrowsePath/getCloneDestinationPath; it never calls the new getCloneDestinationForPickedFolder. No contracts, provider adapter, server, styles or Electron IPC diff. This was scope tracing only, not implementation review.

The base runtime's CommandPalette, shared projects helper and mobile destination source byte-match git-show at the stated base. Head worktree stayed clean. Base uses symlinked head workspace dependencies; the sole changed runtime dependency is the additive helper unused by base, so this does not invalidate the representative base behavior. Base Vite bind was externally changed to127.0.0.1; this is a capture-environment change, not product evidence.

The ordinary A1 pair adequately represents pre-change add-folder behavior for the helper's casing, separators, cancellation retry, and legacy dispatch variants: base did not invoke that helper or submit clone there. Requiring a separate base for every such parameter is unnecessary. It does **not** represent WSL cross-environment mismatch, whose distinct modified guard needs the A9 pair. No base mobile matrix is required for this diff.

## Pixels, visual claims and what else changed

All canonical core images are1440×900 CSS-normalized pixels, decoded from2880×1800 Chrome154/Linux native-preview recordings, DPR2, zoom/visualViewport.scale1; dark/light separately. Early1280×800 A1 PNGs are supplementary. Narrow plain web is390×844 CSS, DPR2; native iOS is402×874 normalized1x, default font scale.

Both supplied amplified diffs recompute **byte-exactly** as clamp(abs(baseRGB-headRGB)×8). Both threshold16 masks mark exactly max(abs RGB)>16 (hot pink RGB255,0,120). Dark:25,699 nonzero pixels and9,905 >16. Light:111,370 nonzero and30,882 >16. No masks, registration or AA tolerance were applied. They are valid outcome diffs, not a “no other changes” proof.

Accepted visual claims: confirm palette retains the same controls; core settles from picked/PD to repo/RO and repo/main; light base offers Initialize Git while cloned head offers Git branch/Commit/Changes. The empty-project “or start without a project” hint disappears in the cloned outcome. Light base composer is about16px lower and lacks the head's Current checkout/main footer; these accompany empty-folder versus Git-project state. Dark base momentarily shows disabled/stale Git widgets despite its empty directory; do not treat those widgets as evidence of a clone. Filesystem/request proof decides that claim. Head focus/caret and pointer positions differ. Model remains GPT-6-Astra / Medium / Full access in canonical pairs.

Other capture differences: independent destination namespaces, environment/project/thread IDs and auth homes; source sidebar age labels; collapsed sidebar for canonical outcomes; provider-update notification in head light2, dismissed for outcome companion; transient provider-status warning in A6/A7; prior failed-clone notification retained during async recovery; OS clock changes in native stills; codec/antialias raster differences. No provider turn, update installation, real OS folder dialog, native Windows filesystem, WSL transport, integrated native clone, performance latency or animation claim is established.

The narration gives approximate media times and separate UTC request times, not synchronized measured latency. Dark before/after show the same interaction with different action pacing. Light2 is narrated as through-settled but decoded exports do not contain that ending; companions are separately recorded states. The same-interaction timing requirement therefore remains incomplete, even though settled light stills are valid.

## Independent head rebuild

Reused the authorized isolated head server web6467/backend14507. Opened own native preview tab with reuseExistingTab=false, tab_5_74d9395d-ceba-4485-8dd8-f554f40af1d4, default profile. No other tab controlled. Linked external seed.sh was copied with only its mktemp output root relocated below /tmp/pr-22226-proof/pass2; linked picker-runtime-stub.js used unchanged after bootstrap. Fresh source/remote/picked root: /tmp/pr-22226-proof/pass2/fixture.nJ7ZuY. README contents match exactly (“Proof fixture” plus newline); cloned Git exists and picked itself is not Git. No tracked fixture is required under the user's read-only constraint.

Actual action: Git URL → fresh local bare remote → Continue → type common displayed core destination → Open in Files. Picker returned the independent fresh picked path. One projectClone.start at08:06:46.846Z to picked/repo, no separate project.create request, then actual repo/main composer. Normal UI dismissed pre-existing notifications and collapsed sidebar. Final outcome frame is0.4s of a separate clean outcome recording; the longer retained flow includes setup notifications and is not the comparison source.

Renderer matches delivered: Chrome154.0.0.0 Linux x86_64,1440×900 CSS, DPR2, scale1, dark, fonts loaded; body16px/24px and heading30px/36px system font stack (-apple-system,BlinkMacSystemFont,Segoe UI,system-ui,sans-serif), reduced-motion=false. Browser desktop UA, no mobile emulation. Frame decoded with output-side seek and default ffmpeg scale to1440×900; no crop/mask/retouch.

Full-image recapture versus delivered head:60,872/1,296,000 pixels nonzero (4.697%);268 >16 (0.02068%); mean absolute channel delta0.12409/255; max246. Of the268 >16: pointer box148, caret box36, send-button box40, breadcrumb box14,30 elsewhere. No observed model/name/path label or layout difference. Low-level widespread differences are consistent with codec/AA rasterization; cursor/caret account for most strong changes. This is not pixel identity, nor does a small delta validate other matrix rows.

## Audit capture artifacts

[recapture-head-dark-result.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0e3cc758e5f01d58/recapture-head-dark-result.png)
[recapture-diff0-amplified8.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d2fd81e052e09bb/recapture-diff0-amplified8.png)
[recapture-diff16.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2e4c6d4ce2e587ac/recapture-diff16.png)
[recapture-manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7aca8c4c5e8c267d/recapture-manifest.json)
[recapture-pixel-delta.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d33d89c2d921d63f/recapture-pixel-delta.json)
[recapture-outcome.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b5a27ea80c57d224/recapture-outcome.mp4)
[A9-all-toast.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5e7f7528a3d6296f/A9-all-toast.png)
[A12-last.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4ac39f152c93d151/A12-last.png)
[core-head-light2-last.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3deda407cb1982b1/core-head-light2-last.png)

These are external audit artifacts. A9-all-toast is a diagnostic contact sheet of all22 notification-region frames, not an original presentation screenshot. A12-last and core-head-light2-last are decoded end-frame diagnostics.

## Prioritized repair checklist

1. Film A9 base/head with identical synthetic A/B catalog and UNC choice; retain exact mismatch toast at head, base destination outcome, all destination-environment mutation counts.
2. Recapture A14 three cases separately, dismiss stale toasts first, and keep the export through the correct new error plus zero writes.
3. Extend A12 through actual legacy settled success. Extend light A1 before/head continuously through their settled results; keep existing canonical stills/diffs if unchanged.
4. Extend A3 trailing-case and A13 async-recovery movies to the settled state. Update narration with decoded media timestamps and identify every incidental visual change; do not replace motion proof with JSON snapshots.
5. Optional only: A11 secondary bootstrap, A15 normal/WSL add-folder, A17 lookup-provider, A16 same-name in-app. Optional M2 specifically needs connected/no-grants, empty catalog, and disconnected selected environment native fixture variants. The published fixture's useEnvironmentPresentation always reports ready/connected and server-config map remains populated; changing fixture.mode alone is not a complete disconnected/empty fixture. Make those external state inputs consistent before capturing. Preserve M1's accurate “iOS static fixture only” label and402×874 substitution.

## Verification and friction

92 local final-hash entries matched with zero mismatches.28 delivered movies decoded; inspected sampled sequences, final frames and all decoded notification-region frames for A9/A14. Diff arithmetic independently recomputed. Public curl downloads of canonical head PNG, A9/A12 movies, both final iOS stills, manifest and final iOS entry matched local bytes. Some additional link fetches hit transient DNS failure; these were not declared broken assets. Original Python HTTP client returned403; curl succeeded for the audited assets. Tests were inspected as delivered evidence, not rerun. No CI read, implementation review, branch/ref change, tracked edit, PR comment/edit, watch/poll or server shutdown performed. PR registered with thread; no watch created.

FRICTION category | happened | prevention
---|---|---
export synchronization | DOM result preceded encoded final frames in several delivered clips | check decoded last frame and hold the actual outcome in the continuous recording before export
state contamination | disconnected A14 clip retained earlier permission toast | dismiss prior case notifications; one case per recording
preview dimensions | still exporter caps1280 although CSS1440 | use full2880×1800 recordings; validate raster and CSS sizes; normalize2:1 explicitly
browser authentication | new audit profile was unpaired | mint isolated-home one-time token privately, use pairing form; omit credentials from reports
browser locators | sidebar has a hidden duplicate trigger | inspect snapshot/visibility and target visible trigger; do not use first match blindly
artifact network | Python403 and intermittent curl DNS failure | use configured curl/ghdrop transport; report fetch limits separately from asset truth
native fixture | requested viewport unavailable; initial build GhosttyKit failure; earlier state wiring incorrect | retain actual402×874 native label, external-only disclosed terminal-autolink recovery, and consistent fixture inputs; no integrated-mobile inference

All shared head/base/Metro servers retained. Audit tab remains on reproduced repo composer. No new native simulator session or native build was started by PASS2; supplied iOS stills were audited as actual static fixture evidence.

VERDICT: INSUFFICIENT A1(light continuous ending), A3(trailing-case ending), A9(before/head visible mismatch), A12(settled legacy recording), A13(async recovery ending), A14(correct visible permission/disconnection outcomes).