Findings first:

1. **The replacement evidence is sufficient for this one-prop change.** No implementation defect or visual defect was found in the retained, settled comparisons. All eight required named rows have before/after media on the required platforms/themes. The labels use base [79f1fad](https://github.com/pingdotgg/t3code/commit/79f1fadfc6020b820d541ca4691d2feebb15dd1b) and head [2dc4772](https://github.com/pingdotgg/t3code/commit/2dc4772467a109a390af202e8d8ece29495d2c97). The independent Android light rebuild has **zero changed pixels** against the delivered capture.
2. **R4/R6 do not prove a controlled visible pending interval.** The recordings show successful cold-load endpoints, actual image-error fallback, replacement with different registry glyphs, recovery after failure, and removal of the URL on the mounted row. They do not show the initial cold-load fallback visibly held and then released: loading can finish before scrolling reveals it. Nor do they prove delayed-B behavior. I explicitly judge these controlled-delay subcases to be **a matrix requirement beyond what this diff needs**, rather than a blocking gap: this diff only forwards the URL to an unchanged production helper, and real native success/error plus mounted replacement/removal are covered on Android and iOS. Preserve the limitation; do not describe pending as visually verified.
3. **The current PR body still presents superseded evidence.** Its original light/dark Diff0 files include clock, signal and card-edge differences unrelated to this PR. Those original comparisons are insufficient under the present clean-diff rule and are not credited for the new gate. Their “what else changed” paragraph accurately discloses the noise. The supplied replacement Evidence section fixes this with clean comparisons, iOS coverage and explicit limits, but was not yet pasted into the PR when read. Its public scripts likewise are linked in the supplied replacement section, not the current PR body. This is a presentation handoff, not a missing replacement capture.
4. **Busy video excerpts are not settled endpoint proof.** For example, `android-after-video-stage3.png`, `android-after-video-stage4.png`, `android-after-video-stage5.png`, `ios-after-video-stage3.png` and `ios-after-video-stage5.png` include the genuine refresh spinner. The corresponding before excerpts also contain busy frames. I do not credit those frames as settled proof. The separately settled endpoint pairs are clean, and all four complete recordings end with the spinner gone. The timestamp narration correctly names the selected glyph/state, and the reproduction guide explicitly calls the excerpts recording samples rather than settled stills. No row depends solely on a spinner frame.

Audit scope: read-only proof pass 2 for [#28135](https://git.cafe/pingdotgg/t3code/pull/28135), [GitHub mirror](https://github.com/pingdotgg/t3code/pull/28135). The checkout is clean at the requested head. Its complete diff only adds `iconUrl={provider.iconUrl}` at the Settings Providers call to `ProviderIcon`; the helper, image callbacks, row key and layout are unchanged. GitCafe reported 39 successful checks and an approving Macroscope review at this head; those are metadata, not visual proof. No edits, pushes, comments or tests were made/run. This is not a current-main merge-readiness audit.

**Row accounting**

A = Pixel 9 Android 16/API 36, 411.4286×923.4286 dp, DPR 2.625, 1080×2424 px. I = iPhone 17 Pro iOS 27.2, 402×874 pt, DPR 3, 1206×2622 px. L/D = resolved light/dark. Both use large OS text category, measured fontScale 1.0 and bundled DMSans. “Context” is not an independent gate; unverified context is not counted as captured.

| ID | Status | Visually supported result / limit |
|---|---|---|
| R1 Registry image | SUFFICIENT | A/I L/D: base ACP glyph becomes the real Copilot glyph; tint/containment readable. |
| R2 No URL/local ACP | SUFFICIENT | A/I L/D: Local ACP remains the identical fallback. |
| R3 Rejected URL | CONTEXT — unverified | No injected invalid-URL fixture; not claimed. |
| R4 Cold load → success | SUFFICIENT for this PR; held pending unverified | A/I L clips show successful cold-load endpoint versus base fallback; real cache-clear/load acknowledgements corroborate. No visible held initial transition is credited; see finding 2. |
| R5 Image failure | SUFFICIENT | A/I L clips and clean still pairs show fallback for the actual missing-agent CDN 404; native state records failed decoding. Backend registry-probe text is not used as image-error proof. |
| R6 Mounted replacement/removal | SUFFICIENT for this PR; delayed B unverified | A/I L: A → 404 → A → Gemini B → 404 → OpenCode C → absent URL; visible glyph follows identity. Helper mount ID remains 1 throughout in head traces. |
| R7 Wrapped title | SUFFICIENT | A/I L: Gemini title occupies three complete lines, with distinct contained icon and wrapped secondary message; no overlap or clipping. |
| R8 Multiple registry rows | SUFFICIENT | A/I L/D: distinct Copilot/Gemini glyphs plus local fallback, correct ordering and isolation. |
| C1 Built-in controls | SUFFICIENT required representatives | Codex/Claude unchanged in A/I L/D; other built-in logos remain unverified context. |
| C2 Known version/no extras | CONTEXT — represented | Codex 0.163.0 and Claude 2.1.303, no advisory/action in new scenes. |
| C3 Unknown version | CONTEXT — historical Android only | Original PR Replay row shows Version unknown; no new iOS fixture. |
| C4 Not installed | CONTEXT — represented | Registry/local rows on A/I in new scenes. |
| C5 Latest suffix | CONTEXT — historical Android only | Original PR shows latest suffixes; disabled in replacement seed, no new cross-platform claim. |
| C6 Update action | CONTEXT — historical Android only | Original PR shows update controls; no action lifecycle tested or claimed. |
| C7 Manual update | CONTEXT — unverified | No fixture. |
| C8 Compatibility message | CONTEXT — unverified | Probe messages do not establish this field. |
| C9 Reason/message | CONTEXT — represented | Wrapped registry/local messages visible; precedence combinations unverified. |
| C10 Failed update | CONTEXT — unverified | No provider-update lifecycle. |
| C11 Other update states | CONTEXT — unverified | No provider-update lifecycle. |
| C12 Refresh | CONTEXT — partial | Real Refresh presses drive the URL-changing sequence; unrelated guards/errors unverified. |
| C13 Enabled counts | CONTEXT — partial | Five enabled rows; zero/one and enable/disable unverified. |
| C14 Section absent | CONTEXT — unverified | No missing-config/outdated-environment fixture. |
| C15 Offline/permissions/busy | CONTEXT — unverified beyond visible refresh | Refresh spinners are visible; no disconnect or scoped-session matrix. |
| C16 Other chrome/interactions | CONTEXT — partial | Visible phone chrome/navigation only; no tablet/foldable/server-update lifecycle claim. |

**What was actually opened and checked**

I opened all 16 retained before/after full-screen stills, all 16 diff masks, all eight static/endpoint comparison sheets, all four recording sheets and their 20 source checkpoint images. I decoded every source-video frame and visually inspected the complete temporal sequence in ordered contact sheets: Android before 81 frames, Android after 94, iOS before 243, iOS after 259, **677 frames total**. I also inspected full-resolution excerpts and the final frames wherever needed to resolve timing or apparent clipping. No audio narration is present: the narration is the written action/timestamp tables. Those actions match the movies and real mounted-state traces. Normal navigation/scroll transitions and busy interaction frames are not treated as settled evidence.

The Android tail initially appeared split in a review montage; isolated full-resolution/cropped inspection showed clean source frames. No duplicated or ghosted row, stale overlay, missing rendered text, unexpected blank content, wrong viewport or wrong theme was found in the credited settled evidence. The iOS space below the card is normal remaining viewport. Its recording header translucency is native chrome, not a stale overlay. iOS stills deliberately use Reduce Transparency/Increase Contrast; both revisions match. Recordings leave those two settings off, as declared.

I separately downloaded the 36 canonical public media assets referenced by the replacement section (32 PNGs, four movies). Every downloaded byte hash matches its local source. All 16 retained stills match their declared final hashes; each raw a/b pair and the corresponding final image have identical decoded RGB pixels. Thus the public links and raw settle sources refer to the inspected evidence. These structural checks supplement visual inspection.

Every new comparison supplies both Diff0 and Diff8: magenta marks max-channel RGB delta **>0** or **>8**, respectively, on 8-bit channels. I recomputed all 16 masks independently; every delivered mask matches exactly. Changed-pixel counts:

| Pair | Diff0 | Diff8 | What changed |
|---|---:|---:|---|
| Android L | 1465 | 1451 | Copilot and Gemini glyph boxes only |
| Android D | 1470 | 1449 | Copilot and Gemini glyph boxes only |
| iOS L | 2466 | 2098 | Copilot and Gemini glyph boxes only |
| iOS D | 2467 | 2375 | Copilot and Gemini glyph boxes only |
| Android failure | 637 | 630 | Second registry row's Gemini glyph only |
| Android absent URL | 637 | 630 | Second registry row's Gemini glyph only |
| iOS failure | 1057 | 894 | Second registry row's Gemini glyph only |
| iOS absent URL | 1057 | 894 | Second registry row's Gemini glyph only |

This agrees with the supplied “what else changed” list and the code: Copilot's fallback and every surrounding pixel are unchanged in failure/removal comparisons; the still-loadable second registry row legitimately changes. The original PR body's DiffT uses a different, declared 10% fuzz; it is not substituted for the replacement Diff8. Matching displayed live iOS minutes and zero unrelated pixel deltas are adequate clock control here; a literally frozen iOS clock remains unverified and is not claimed.

Representative replacement comparison: **Before**, **After**, **Diff0**, **Diff8** from left to right.

![Android light: before generic ACP glyphs, after distinct registry icons, and the two clean icon-only diff masks](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/aaa809c5a8e957de/android-light-sheet.png)

**Independent rebuild**

Rebuilt `android-after-light-final-v6.png` at the requested head using the downloaded seed-v2 and final live-auth-clock static drivers, with only paths/session/environment IDs/ports adapted. Used pooled Pixel 9 session `proof28135p2`, `agent-device` 0.21.32 and `vp run mobile:install android --session proof28135p2`; native fingerprint `541b3da3e5f7b2ad504aaa6303bdcea8d7194d22`. Started a head server/Metro with `T3CODE_DEV_SEED=0` and a fresh home under this step's timestamped scratch run. No live state was copied. Rendering matched A/L above: animations off, text large/fontScale 1, bundled DMSans, 9:41 normalized clock, exact bottom scroll anchor.

The independent result matches the delivered capture in all **2,617,920 decoded RGB pixels**: Diff0 **0**, Diff8 **0**, maximum channel delta **0**. There is no anti-aliasing or other delta. The driver's own two raw frames also match. [Rebuilt capture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7ca47bbc8dd56a61/android-after-light-final-v6.png), [rebuild Diff0](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/97c3e3be31585bff/rebuild-diff0.png), [rebuild Diff8](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d2f490cabe4c17b4/rebuild-diff8.png), [rendering/provenance metadata](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0cfa73caca4b53ec/rebuild-metadata.json).

[Audit artifacts, adapted drivers, validations, redacted logs and all reviewed video-frame montages](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6a7c560ccf897a0a/audit-artifacts.zip). [Final source recording frames, after each refresh spinner has gone](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a29df0e12a604c16/final-recording-frames.zip). Uploads used the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md); no PR comment/body mutation was performed.

Cleanup: closed the pooled lease; stopped only captured server/Metro process groups (1369296/1369297); confirmed those processes, driver 1374029 and both owned listeners were gone. Removed this step's disposable files after preserving public/sanitized evidence; retained only this report. Kept the lead's worktree, root scratch and capturer files untouched. Worktree stayed clean. Completed within the 45-minute allowance; all required audit work covered, subject to the explicit controlled-delay scope judgment above.

FRICTION:
- tool | First foreground static driver exited 143 without a diagnostic; a detached rerun with a captured PID succeeded. | Run the long native driver through a persistent process from the start.
- runbook | Standalone startup pairing URL printed port 8292 while the dev server listened on 16332; initial RPC was refused. | Use the dev-runner's actual listener/port consistently; the reproduction guide already requires checking actual ports.

- policy | Literal absolute-path scratch deletion was rejected by the execution wrapper; used the brief's explicit Python shutil fallback. | Align wrapper cleanup rules with the permitted scratch workflow.

VERDICT: SUFFICIENT