# Evidence-only proof audit pass 3

Target [#23216](https://github.com/pingdotgg/t3code/pull/23216) / [#23204](https://git.cafe/pingdotgg/t3code/pulls/23204). Clean current head [8ac56474a3](https://git.cafe/pingdotgg/t3code/commit/8ac56474a31b840c4b149d58730a0a34cf98e3df), merge-base [b5a226e49c](https://git.cafe/pingdotgg/t3code/commit/b5a226e49c52ecab4ddc2d678a7012d97e651a6a). Read-only audit; scratch `/tmp/pr-23216-proof3`.

## Findings first

1. **RECONSTRUCTION is now SUFFICIENT.** A fresh database initialized/migrated by the exact-head application and seeded by the unchanged committed script/JSON reproduces the NEW supplied after reference with **0 pixels different at threshold0, 0 at max absolute RGB channel difference >16, maximum channel difference0**. Full frame1280×889; no alignment, masks, resizing, pixel edits, presentation DOM rewrites or CSS overrides. This closes the sole pass-2 proof gap under the explicitly revised brief. It does not identify the historical font or claim identity with historical screenshots.
2. **The supplied controlled pair is internally consistent.** Independently recomputed **9,486 Diff0 / 4,610 DiffT>16**. Actual before/after and both derived diff images inspected. Visible changes are restored single tildes/removal of accidental user strikes, resulting first-user bubble width and content horizontal movement, and the lower visible legacy-user prose. Header, assistant control, code/composer and floating scroll control are unchanged. No unexplained delta remains in this pair; fresh after versus supplied after has no delta of any kind.
3. **Code readiness remains FIX_FIRST separately.** The unchanged default-home symlink isolation guard finding is retained from both code reviews and pass2. No unsafe reproducer was rerun and no code changed. Proof sufficiency grants no merge-readiness verdict.

## Diff-derived coverage and corrected final matrix

The full final diff is eight files/333 insertions: three production files, two test files, three requested committed fixture/seeder files. `UserMessageBody` is shared by ordinary/collapsible and automation rows; it selects the user-only GFM option. Shared user find extraction applies the same option. Assistant/default parsing is unchanged. Fixture coverage includes normal paragraphs, quotes, lists, tables, literal single tilde, double-tilde control, links/bold, inline chips, raw HTML text, both fence forms, hidden-tail collapse/reveal, scheduled-task fold, and legacy/structured-context exclusions. Static theme/width combinations and interaction branches follow the accepted canonical/supplemental matrix below. No new provider, transport, contract, desktop or native-mobile implementation path is introduced.

Reuse is deliberate: [pass2](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/416ceff4e6153702/report.md) already independently verified89 canonical plus47 supplemental checksums, source hashes, stopped SQLite exports and sampled actual media. This pass inherits those accepted results as directed and adds one independent reconstruction, rather than claiming a fresh media-wide audit. [Canonical index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6e11b99922250484/index.md), [supplemental index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8135f9e665d88aca/index.md).

| Row | Final disposition | Evidence |
|---|---|---|
| S1-L1440 | SUFFICIENT, reuse | Before/after, Diff0×8 and >16;9604/4578 |
| S1-D1440 | SUFFICIENT history, reuse | Original pair9732/4702; historical effective font unknown |
| S1-L390 | SUFFICIENT, reuse | Before/after and diffs292159/82547; wrapping/reflow disclosed |
| S1-D390 | SUFFICIENT, reuse | Before/after and diffs268487/79269 |
| S1-D1440 pinned | SUFFICIENT | Newly delivered before/after9486/4610; independent after0/0 |
| I1 | SUFFICIENT, reuse | Narrated before/after dark1440/light390 expand/collapse, chips/HTML/fences/tail |
| I2 | SUFFICIENT, reuse | Narrated before/after find raw path, solo, old, highlight/navigation/close/reopen |
| I3 | SUFFICIENT, reuse | Narrated hidden-tail reveal and manual reversal |
| I4 | SUFFICIENT, reuse | Narrated automation fold/unfold and search reveal; explicit supplement |
| I5 | SUFFICIENT, reuse | Legacy prose/exclusions; genuine structured context supplied in M2 |
| R1 | SUFFICIENT, reuse | Both normal/progressive authenticated read-RPC transcripts |
| C1 | SUFFICIENT, reuse | Assistant single-tilde and double-tilde/fenced-literal controls |
| M1 | SUFFICIENT, reuse | Narrated real rich composer→submit→durable reload, clean supplement, exact stored source |
| M2 | SUFFICIENT, reuse | Narrated actual terminal selection/Add to chat/chip→submit→find; corrected nonempty marker baseline |
| M3 Electron | OUTSIDE SCOPE | Explicit scope decision; no desktop changed paths; no launch |
| P1 plain mobile | ACCEPTED | Maintainer EAS iOS provenance; no additional native surface required |
| RECONSTRUCTION | SUFFICIENT | Fresh committed-fixture after matches new reference exactly0/0 |

No outstanding proof rows. Historical font remains unidentified, and historical narrated chapter timestamps retain the approximate-boundary qualifications documented in pass2. Neither is represented as newly resolved historical metadata. Interaction/time evidence remains the accepted narrated before/after recordings, not this static reconstruction.

## Independent reconstruction evidence

Fresh real `/tmp/pr-23216-proof3/run/.t3` under an empty non-Git parent was migrated from scratch, stopped, then seeded with the committed final script and both committed JSON inputs. Five messages. No previous capture home was mutated or copied. Exact-head archive `/tmp/pr-23216-proof2/source` reused with installed dependencies; all eight changed source files compared byte-for-byte with final git objects again. No provider turn was needed. These projection fixtures prove rendering, not orchestration/event replay.

Owned native preview fresh incognito tab, supported Settings setter selecting Arial interface/composer and Liberation Mono code, theme system with native dark appearance. CSS1440×1000, DPR2, scale1, Chrome154/Linux/UTC. Interface16/prompt14/code13, smoothing true; zero document FontFace entries. All eight installed Liberation font binaries match supplied SHA256s. fc-match resolves Arial regular/bold/italic/bold-italic to matching LiberationSans faces; code to LiberationMono. Canvas measurements, every paragraph/code rectangle and every other field in fresh metadata equal supplied after-metadata.json exactly.

Delivered freeze/layout script, SPA remount after Date freeze2026-10-21T12:00Z, real panel toggles closed, BODY focus, no tooltip, two tables, F2 collapsed/F3 folded, scroll100→0 then settled, pointer(2,500). Real Scroll to end rect671.6484375/794/96.703125/24, opacity1. Native saved screenshot copied unchanged into scratch. No browser fallback or global font/config installation.

[Metrics](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1b3646266fe24127/rebuild-metrics.json), [Diff0×8](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bda25303698a1fd4/rebuild-diff0-x8.png), [DiffT>16](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/71f0c5c2e6ab2dbc/rebuild-diffT16.png), [fresh metadata](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/27afd787bb03d000/after-metadata.json), [source/font integrity](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/18b7b18f978056c6/integrity.json). [Delivered recipe](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1ecd7ebc148a082c/recipe.md) and [bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b960854fc93b9b75/pinned-font-reference.tar.gz).

Reference after:

![Supplied current-VM pinned-font after reference](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/886fbeff9cb59338/after-dark-1440.png)

Independent rebuilt after:

![Fresh independent final-head capture, pixel-identical to supplied reference](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/926690eb078065a4/rebuilt-after-dark-1440.png)

## Categorized FRICTION and cleanup

- AUTH/STARTUP, resolved: initial text wait timed out15000ms after successful pairing because root did not yet display expected fixture text. Explicit fixture navigation and timeline wait succeeded. No alternate browser.
- TOOL, resolved: initial multi-pattern fc-match invocation returned empty fields; separate calls corrected it. Broad scratch search produced noisy/truncated output; focused diff reads completed the source inspection.
- PROCESS SAFETY, deviation: initial migration launch did not persist its PID at spawn. Its exact unique runner arguments were used to recover the PID tree before SIGINT; this deviated from the strict spawn-captured-PID rule. No unrelated process was signaled. Restart explicitly persisted its PID at spawn; cleanup used that PID. Both owned trees are stopped. This procedural deviation does not alter image evidence.
- ENVIRONMENT, closed proof gate: explicit known installed fonts and reproducible new reference avoid any claim to recover the old fallback. No font/config installs.
- SAFETY, separate code issue: known seeder guard remains FIX_FIRST unchanged.

Both owned server sessions stopped, all12 recorded PIDs absent; ports6425/14465 closed. Owned preview tab closed. Stopped scratch retained for lead cleanup, including fresh home (not uploaded because it contains auth/local state). No code edits/commits/pushes/comments/PR descriptions/merges/watches/polling. Both PRs registered through required app tools; inventory confirms watching=false. No forge CLI/API PR reads in this pass. Last-known pending checks: no current check snapshot supplied or established here; unknown, deliberately not refreshed. This proof verdict is not CI clearance.

Skills: [test-t3-app](/home/ubuntu/t3code/.agents/skills/test-t3-app/SKILL.md), [ghdrop](/home/ubuntu/.codex/skills/ghdrop/SKILL.md). GPT-6.1 Sol / Codex through native T3 preview. Completed within30minutes.

VERDICT: SUFFICIENT