# Proof audit pass 2, round 3 — WEB

Read-only audit for [#21088](https://git.cafe/pingdotgg/t3code/pulls/21088), also [#21088](https://github.com/pingdotgg/t3code/pull/21088). Fixed comparison: replacement [0b086662f3](https://git.cafe/pingdotgg/t3code/commit/0b086662f350c79b19295e6ceec12169a6422bdf) against baseline [3cc31ed27c](https://git.cafe/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). This is a WEB proof verdict for those revisions, not approval of a future integration result or a native verdict.

Inputs: [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f9332811fb7d41b7/matrix.md), [previous audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6b909f7048493ffd/audit-pass2-web.md), [core index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4b05c271b533e02c/index.md), [supplement](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ee685c17f533d13c/index.md), [supplement archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/964c5776514601cc/web-supplement-round2.tar.gz). Public supplement index matches local bytes; downloaded public archive SHA256 matches `4b8c4b81d0b4710e5acd4d07892584cd245f7152eb7dcd9472d42e5da6a3be88`.

## Required WEB rows

| Row | Status | Evidence and limits |
|---|---|---|
| W1 denied host video | PASS | Core B/A at 1440×900 and 390×900, light/dark. After explains the existing missing-file-access reason, removes futile Retry, retains label. Text wraps without clipping. Real destination-scope denial over loopback; not OS permission failure or synthetic denial. Independent reconstruction below is pixel-identical. |
| W2 reachable video | PASS | Core four size/theme pairs, direct URL and signed host asset visibly advance beyond 2s, direct pauses before host advances, host pauses at end. No pairing warning. Stills unchanged. Driver invokes actual video play/pause methods; native-control mouse clicks are not claimed. |
| W3 denied image | PASS | Core four pairs retain image wording and explanation; image and surrounding regions have no changed pixels. Shared derivation does not introduce a video label into image failures. |
| W4 generic failure and empty label | PASS | Core four pairs show generic wording, Retry retained, empty label has no dangling separator; retry recording returns to controlled generic missing-file failure. No pairing claim. |
| W5 source-control fallback | PASS, repaired | Supplement four size/theme pairs, eight B/A recordings: fallback fixture visibly plays past 2s, then pauses; no missing-file-access explanation. Normal PR Summary → PullRequestMarkdown → ChatMarkdownAssetImage video path. Browser injects existing generic signing Failure into the github-media asset atom and serves valid MP4 fallback bytes. This is disclosed whole-app fixture injection, not evidence that source-control assets receive real filesystem denial. |
| W6 file shell | PASS | Core paired file panel shows generic unavailable text, Retry/Open in browser; state-driven close/reopen. No new unavailableDetail supplied. |
| W6 PR shell | PASS, repaired | Supplement paired 1440 light normal PR Summary shell shows generic failure, Retry/Open original, close and reopen. Synthetic existing snapshot cache and normal panel-store entry are disclosed. Background activity failure belongs to nonexistent synthetic repository, not a new video error. No mouse-click PR-link route claim. |
| W6 expanded dialog / failed onOpen callers | SOURCE COLLAPSE, not visually verified | ExpandedVideo supplies label/sourceFailed/onRetry but neither onOpen nor unavailableDetail: same generic changed text branch covered by W4/W6. TimelineUserMessageRow supplies onOpen: `failed && !onOpen` is false, so the new text/join/ignore span cannot render there. Its thumbnail status/overlay is unchanged. These do not require another affected-render grid under the permitted collapse. |
| W7 thread find | PASS, repaired | Supplement denied-label and Generic video queries highlight authored headings plus failed-player labels before; only authored headings after. Enter navigates to authored matches. CSS highlight reports corroborate removal of the extra inactive range. Counters remain 1/1 because canonical indexing already excludes media labels. Video unavailable remains 0/0 on both: a zero-result control, not sole evidence of the fix. Core explanation query remains 0/0; Horizon lantern authored control stays 1/1 and navigates in both revisions. |

No mandatory affected WEB row remains missing. Android M1–M5 are PENDING independent audit/capture and were not inspected here. iOS I1–I2 remain UNVERIFIED under the explicit Linux/no-iOS-simulator exception. A narrow web viewport does not prove Android or iOS.

## OPEN / LOOK and narration

Opened and visually inspected all 42 accepted main stills through 21 full-app B/A pairs, and all 42 delivered difference images (core sheets freshly generated from accepted originals, supplemental sheets checked against independent recomputation). Stable duplicates independently match originals. Did not use stale original core inspection collages as accepted captures.

Independently decoded eight timestamps from each of all 36 captioned recordings (20 core + 16 supplement), opened every resulting frame sheet, and inspected one uncropped desktop frame from every corresponding raw recording. Also sampled the end of every W2 recording and reviewed supplemental producer sheets and the eight-timestamp denied-search sheets. Playback frames move rather than showing static posters; search highlights, authored navigation, panel closing and reopening agree with visible captions and driver order. W5 final frames show paused native controls at about 2.6s. Core W2 end frames settle around 2.5s. Some controls fade, so hidden controls alone are not used to infer playing state.

No accepted still is blank, a spinner, ghost overlay, wrong viewport, or a stale open panel. The 390 PR panel intentionally occupies most of the viewport; background content behind it is not a cropped media proof. Video/text content being judged is fully visible. The caption bars are intentional narration, not stale tooltips. W6 PR briefly remounts a dark video surface while reopening and then reaches generic failure; this is a transition, not its accepted still. No claim of frame-by-frame absence of all transient loading is made.

## Pixels and what else changed

Independently recomputed all 21 B/A pairs without masks: max absolute RGB channel delta >0 and >16/255, x8 RGB amplification on #181818. Every delivered diff image exactly matches this formula. Every accepted original has a pixel-identical stable duplicate.

| Pair group | >0 pixels | >16 pixels |
|---|---:|---:|
| W1/W3 1440 dark | 7,887 | 4,378 |
| W1/W3 1440 light | 7,949 | 4,468 |
| W1/W3 390 dark | 8,480 | 4,532 |
| W1/W3 390 light | 8,538 | 4,641 |
| W2/W4/W6-file, all nine pairs | 0 each | 0 each |
| W5 1440 dark | 2 | 0 |
| Other three W5 pairs | 0 each | 0 each |
| W6 PR | 0 | 0 |
| W7 denied-label | 8,951 | 5,547 |
| W7 generic-label | 1,760 | 1,760 |
| W7 zero-result | 0 | 0 |

The W5 dark two pixels have max delta 1/255 at bbox [321,878,322,880], a composer shadow corner. The supplement correctly discloses this instead of claiming zero. W7 generic-label differences are confined to [663,216,773,232], precisely the removed failed-label highlight. Denied-label differences combine expected label highlight removal, new explanation and Retry removal. No image, authored heading, sidebar, composer, or unrelated meaningful layout drift was found beyond that disclosed two-pixel shadow. “What else changed” agrees with the accepted captures.

## Provenance and independent rebuild

Both supplemental before/after production web file hashes independently match git-show at their stated SHAs. Temporary baseline used only the two production web render files; those are the entire production web change. This is adequate web comparison provenance, not a full native baseline. Current worktree HEAD remains replacement; all web sources match HEAD. Four mobile files were already temporarily modified by the independent mobile capture work and were left untouched.

Rebuilt W1/W3 390×900 light using a fresh separate headed Chromium 148.0.7778.96 context on an owned Xvfb, DPR1, same isolated backend/Vite/fixture state, existing scoped cookie, fixed Date 2026-10-24T12:00Z, reduced motion and fonts ready. No reseeding, credential minting, source swapping, or server lifecycle changes. Two frames 600ms apart match. Rebuilt screenshot versus delivered after: **0 / 351,000 changed pixels at both >0 and >16, bbox null**. Both alerts contain the exact explanation; Retry count 0. Owned browser/Xvfb and blank preview tab closed.

![Independent headed rebuild of denied video and image at 390px light](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4a38276ac37024ea/rebuild.png)

[rebuild.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9849ef7e84643d90/rebuild.mjs) · [check.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e76ea7a42b73ec6e/check.py) · [frames.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ec9f7f8c75c39d21/frames.py) · [recomputed.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dac34f3082a493ea/recomputed.json) · [provenance.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7bc0b7da83cd6caa/provenance.json) · [rebuild-delta.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f18cc71a04c5d794/rebuild-delta.json) · [video-manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4b9db5d13a913b8c/video-manifest.json)

## Uncovered routes and integration boundary

Uncaptured interaction controls remain: mouse-driven file/PR entry, expanded-dialog open/close, failed-onOpen thumbnail activation, copy/original action execution, explicit fragment/authored-size variants, loading/transient renewal/retained playback variants, Electron shell, actual relay/tunnel transport, multi-environment switching. They are not claimed verified. Source confirms the changed text is confined to failed-without-onOpen; loaded/loading/thumbnail branches stay separate, and only exact missing-file-access without fallback suppresses Retry. Image-only callers share the unchanged image detail result. No new provider, wire contract, Settings/command palette/keybinding, or desktop IPC path was added.

**Current-main caveat:** the brief's statement that none of the seven paths differs from baseline is not true for the current local [07d38b8d17](https://git.cafe/pingdotgg/t3code/commit/07d38b8d17167c8d17fba1184dbe13a307fada74) main ref. Three web paths differ: browser test, ChatMarkdownMedia, MediaVideoPlayer. The player includes playback-source changes unrelated to this fixed comparison, and the media file has substantial restructuring. This audit does not certify a final rebase/merge onto that main. The requested head-versus-baseline WEB evidence remains sufficient; integration verification belongs after integrating. No fetch, source swap, or merge performed.

No edits to source, push, PR comments, watches, native operations, live userdata access, or committed scratch. Scripts and audit outputs live outside the worktree and are publicly uploaded as requested. PR registration was checked; no monitoring was enabled. Work performed through Codex, gpt-6.1-sol.

## FRICTION

| category | happened | prevention |
|---|---|---|
| tool | One ffmpeg raw-frame extraction rejected `.6` duration | Changed to `0.6`; reran successfully, all 36 recordings decoded |
| tool | One source lookup used old FilePreviewPanel path | Located and inspected actual components/files/FilePreviewPanel.tsx |
| tool | Python urllib got HTTP 403 for public index | Curl succeeded; downloaded index and archive match local bytes/hash |
| brief | Current local main contradicts “none of seven paths changed” premise | Keep this verdict pinned to the requested SHAs; verify final integration separately |
| infra | Independent mobile capture has temporary source changes in worktree | Confirm web files match requested HEAD; do not restore or interfere with mobile work |

WEB only; Android pending independently, iOS explicitly unverified on Linux.

VERDICT: SUFFICIENT