# Proof audit pass 2

VERDICT: INSUFFICIENT A1–A8 under the mandatory capture contract. A1/A2 have useful paired behavioral evidence, independently rebuilt on head for A1; they still fail strict capture-profile/clock requirements. A3–A8 additionally have missing affected variants. This is evidence insufficiency, not a newly established implementation defect or a ready-to-land recommendation.

Audited [#16542](https://git.cafe/pingdotgg/t3code/issues/16542), read-only worktree /home/ubuntu/wt/issue-16542, exact head [5f983b4e2c](https://git.cafe/pingdotgg/t3code/commit/5f983b4e2c1fcd87ac44ea5424c251e4825bcbaf). Contracts: /tmp/issue-16542-proof-resume-matrix.md and /tmp/issue-16542-proof-pass1.md. Authoritative [published index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6f6eb17ca784f11f/index.md) and manifest-final.json supersede embedded archive manifests. No repository edits, push, comments, delegation, or extra server. Audit artifacts only were written under /tmp. test-t3-app and ghdrop skills used.

## Findings and row dispositions

- A1: Original row01 has 4-profile base/head Back segments with the expected distinction: baseline closes by pushing B, and Back returns Settings; head closes existing B, and Back returns A. Head further Forward revisits Settings, which is expected. Independent fresh-tab head reconstruction passed below. Narrow drawer integration has capture-script evidence, not an independent narrow rebuild or exhaustive visual inspection. Strict profile gate remains open.
- A2: Original row02 has 4-profile paired scoped Settings Escape evidence. Scope pushes index to4, close returns B2, Back A1, Forward B2. This establishes the second consumer behavior in captured logs; no independent Escape rebuild was done. Strict profile gate remains open.
- A3: Original rows03/04 collectively cover section replace, search result, nested licenses and two scope pushes. They are separate reset segments; do not imply one combined segment was run. Cross-utility Usage→Settings is missing. Search checkpoint hrefs inspected are /settings/general without a hash; explicit hash-bearing replace is not demonstrated by those logs despite the index's “replace/hash” wording. Need actual hash evidence or a supported-operation explanation and explicitly unverified disposition. INCOMPLETE.
- A4: Usage and mounted PR error-state close segments are paired in four profiles. They do not establish populated PR rendering, which is compatibility-only. Project alias→scoped Settings replace redirect lacks paired four-profile evidence; isolated inherited after-only alias is excluded from publication. INCOMPLETE.
- A5: No paired actual-app forward-history truncation/fallback captures. Existing focused harness truncation test is not a recording or actual-app proof. INCOMPLETE.
- A6: No actual-app equality or older-utility conservative invalidation evidence. Equality may require focused lower-level proof if no legitimate app path exists; current two harness tests do not explicitly establish equality. Do not substitute ordinary MAIN A/B visits, which refresh anchors. INCOMPLETE.
- A7: One after-only desktop-light ordinary MAIN history-refresh segment exists. No baseline/all-profile pairing, legitimate same-href/different-index proof or focused index-only invariant proof. Ordinary main refresh is not utility-index invalidation. INCOMPLETE.
- A8: No paired fresh/null-anchor root fallback, reload-on-B initialization or nontrivial retained main href/search/hash identity segments. INCOMPLETE.

Native macOS/Electron key/menu/window integration remains UNVERIFIED and must be handed to Julius as a separate mandatory native check before any readiness assertion. Native mobile, remote/tunnel canonical flow, legacy/collapsed sidebar, intercepted Escape, unchanged Usage/PR Escape, alternate entries and populated PR compatibility remain unverified. Responsive narrow web is not native mobile. This audit does not waive these requirements or call the draft ready.

## Independent rebuild performed

Used test-t3-app and the existing localhost8458 server, an own fresh collaborative Browser tab, private normal pairing, and the committed issue-16542.mjs seeder. Seeder returned A/B/C successfully; it is idempotent, so this reused the existing isolated synthetic state rather than rebuilding an empty database. No live database was accessed. Then ran the committed issue-16542-capture.mjs canonical helper as audit-head/D-L/row01/back. Recording and six checkpoint PNGs were retained separately under /tmp/issue-16542-evidence/audit-head-D-L-row01-back.*; existing delivered evidence was preserved.

Observed complete=true: initial B2 → Settings3 → close B2 → Back A1 → Forward B2 → further Forward Settings3. This independently corroborates the primary integrated transcript and changed traversal behavior. It is one head-only flow, not a paired reconstruction or fulfillment of missing rows. The served Vite hook's inline sourcemap sourcesContent exactly equals the hook at current head; SHA256 558390663b4742290c564d397642a8abb3d2275eeb873a062543289d3b60180c. Current hook has zero diff from inherited after runtime [915e03dc90](https://git.cafe/pingdotgg/t3code/commit/915e03dc905e417359d088dc366cad1afb6bb608). Base hook at origin/main is byte-equivalent to inherited baseline [a12d6ed942](https://git.cafe/pingdotgg/t3code/commit/a12d6ed9428d8e64d76ca86d178abbf564b57cee). That is hook equivalence, not proof that whole inherited app builds were identical to current base/head. No baseline server switch or baseline reconstruction was attempted.

Independent capture reproduced CSS viewport1440×900/DPR2 with still PNG1280×800. Thus geometry discrepancy is repeatable and unresolved; rerunning the helper alone does not correct it. It also patches Date after render and does not cure clock drift. App theme class was empty under requested light emulation; this audit does not claim independently verified actual light styling.

## Geometry, pixels, media, provenance

Independently counted 57 published segments: 56 inherited recordings (28 matched base/head segments) plus one after-only history refresh. Media metadata covers57. All57 recording hashes match authoritative manifest; all418 checkpoint hashes match local originals. All five manifest script/fixture hashes match files on disk. Inherited logs lack embedded exact SHAs; manifest attributes runtime identities to owner-supplied provenance. Hash matching proves artifact integrity against manifest, not contemporaneous runtime identity. New head rebuild strengthens current hook provenance only.

Desktop stills are1280×800, videos2880×1800 with reported1440×900 CSS/DPR2. Narrow stills/videos780×1688 with390×844 CSS/DPR2. Required DPR1/desktop still geometry is unmet. Freeze occurs after initial rendering; labels drift e.g.2m→19m. Exact video action offsets, persisted per-segment errors and exhaustive visual inventory are absent. Media validation reports first/middle/near-end decode for all57; this audit checked hashes and metadata, not independently played all recordings or every frame.

Recomputed every one of204 source PNG pairs using max absolute RGBA delta >0 and >16. All counts match supplied pixel-diffs.json. 84 pairs have zero changed pixels;64 same-href pairs have nonzero pixels,63 also exceed16. No global visual equivalence claim is supported. Diff generator uses saturated8× RGB heatmaps and RGBA threshold masks with no spatial masks/resizing. Counts are mathematically reproducible, but same-route drift and missing exhaustive visual review remain unresolved.

Additional correction: “opaque sources” in published index/manifest inventory is inaccurate. Across408 paired source references,102 have alpha minimum200, all sampled from D-L; observed alpha extrema span200–255. RGBA counting includes alpha and still reproduces, but RGB-only zero heatmaps cannot in general visualize alpha-only differences. Correct the alpha description or recapture/composite with an explicitly stated policy; do not silently treat sources as opaque. No claim is made that alpha caused a particular observed count.

## FRICTION

Fresh tab needed normal pairing; paired privately without publishing credentials. First seed-expression call rejected trailing whitespace, then succeeded after trimming. One broad file listing produced excess output; subsequent inspection used structured summaries. Capture rebuild reproduced the desktop still/viewport discrepancy. Running committed seeder in existing sandbox establishes replayability/idempotency, not clean-room fixture reconstruction. No new captures beyond the bounded canonical rebuild are required by this audit; existing missing proof stays explicit.

Final handoff: draft may accurately describe partial evidence and open gates. This audit supplies no sufficient/ready approval. VERDICT: INSUFFICIENT A1 A2 (strict capture gates), A3 A4 A5 A6 A7 A8 (missing variants plus capture gates). Native desktop verification remains an explicit Julius handoff.