# Evidence redo for model picker tab memory

Target: [#21727](https://github.com/pingdotgg/t3code/pull/21727), original [yordis branch](https://github.com/yordis/t3code/tree/yordis/fix-model-picker-reopens-last-tab).
Before affected files: [71a283aed2](https://github.com/pingdotgg/t3code/commit/71a283aed253f23be1860a31d4ea48f1c06e0b1c). After: [ddb8df4ab5](https://github.com/pingdotgg/t3code/commit/ddb8df4ab57a37ae145983eb18fba44d3345019a). One installed checkout; only the three affected files temporarily overlaid for baseline, restored afterward. No product implementation edits, commits, push, or watch.

## M2: genuine cached-to-initial-live lifecycle

The auditor's proposed route worked without an alternate lifecycle. Production server.updateSettings first sets Favorites empty. The browser receives the production config and persists it in IndexedDB's server-config store. A read-only inspection verifies empty Favorites and ready Personal/Work synthetic catalogs. The proxy then disconnects the browser and gates genuine server frames. A separate Node WebSocket RPC client, using only this evidence session's auth, sets Favorites to the two real synthetic model references. The browser reloads warm from its unchanged production cache while the genuine initial config frame is held.

The picker mounts Personal from the cached empty Favorites state. In the no-choice variant, releasing the byte-identical initial frame makes after switch to Favorites. Before stays Personal. In the explicit-choice variant the script clicks Personal before releasing initial config; both versions stay Personal. The favorite star fills after delivery, so delivery is visibly distinct from the cached state even when the tab stays Personal. There are no star mutations in either M2 variant.

A read-only reference to the search input checks the mounted picker identity: the same input object remains connected across each release. No client atoms, component props, response payloads, or desktop APIs are edited. The only client storage reset is the documented tab-memory key. The proxy logs original initial config Favorites/readiness, held-frame SHA256 and released-frame SHA256; every released frame matches. Both cache and live settings are the app's own persisted/service-produced values.

Frame analysis decodes every physical video frame at 12fps. Selection is measured from blue stripe pixels and delivery from orange favorite-star pixels; contact sheets were visually inspected. Before: held Personal 4.75–8.50, delivered Personal 8.58–12.17; explicit held Personal 24.00–31.00, delivered Personal 31.08–34.75. After: held Personal 4.25–8.00; delivered Favorites 8.33–11.67; explicit held Personal 23.08–30.00, delivered Personal 30.08–33.75. The 8.08–8.25 after frames are delivery/layout transition, not a held-state claim. These boundaries are video content measurements at 1/12-second precision. Explicit click cues are approximate; JSON records the actual action order and connected input identity.

Both paired recordings use the same script and synthetic production services, actual Chromium on Xvfb, and ffmpeg x11grab. Each contains both variants with at least three-second holds. Spoken narration is synthesized afterward and muxed with stream-copy video; validation proves raw and narrated video streams are identical. Raw recordings are retained and published. VTT files carry matching narration. No reconstructed UI or visual annotation is inserted into the recordings.

## M4: numbered visible-list behavior

The actual synthetic home's keybindings.json config sets ctrl+1/2 -> modelPicker.jump.1/2 with when:modelPickerOpen. The app loads them through its normal keybindings service, and rows visibly render Ctrl+1 and Ctrl+2. The same before/after script presses Control+2 on Work: row2 selects Atlas Long Context Research Preview belonging to Work. After remount restores Work and key work; before remount falls back Favorites and key stays absent. Then Control+2 on Favorites selects its row2, Work's Atlas; after remembers Favorites. The visible list, selected model/trigger, and storage observations agree. Original configs are restored after shutdown. This is responsive web with supported custom bindings, not a desktop simulation.

## Existing proof retained and publication corrections

M1, M3, M5–M7 and S1–S4 retain the prior audit's proven recordings/stills. M2's old G2 loading attempt is superseded; G2 remains the M3 star control. M4 keeps G1 additive/Enter/provider-navigation coverage plus the new numbered-pick pair. S3's independent replay was pixel-identical. Four threshold masks are explicit independent-audit supplements; Diff0 is raw absolute RGB difference, amplified is saturated 8x, and DiffT is max-channel >8/255 binary mask. No crop/alignment/masking was used for measurements. Above-threshold differences are confined to the picker region. Trigger/layout are held constant; selected stripe, account/model text, row highlighting, stars and popup height follow the restored tab/list. This two-row fixture does not overflow, so no fade is claimed.

Original chapter clocks are approximate unless measured from frames. After G3 ordinary empty-query Work remount is visible at 3.1–3.7, not the old 4.07 cue; additive Work remount is about 5.8, before explicit Personal around 6.1. Raw DOM observation times remain in JSON with a qualification; corrected frame evidence is stored separately. Matrix SHAs are corrected. Publication hashes are compared to each public fetch, and changed artifacts receive fresh immutable URLs, including publish.py.

## Scope and FRICTION

Only web code is affected; desktop wraps web but no native desktop claim is made. Mobile images are 390px responsive web, not React Native. No contract/server/adapter product changes exist. Synthetic discovery exercises production adapters without paid turns. Both homes were inspected and prewritten before any redo server launch: default real providers disabled; enabled binaries and homes confined to /tmp/ev-21727. This redo never read, copied, opened, or migrated any real DB or ~/.t3/userdata.

- An already-listening evidence worktree server was found on port14680; its saved port-owner PID/cwd was verified and stopped before launching the redo.
- Browser-page RPC from the proxy origin was rejected; the final driver uses a separate synthetic Node RPC client, as required by the route.
- Returning a DOM object from the read-only identity inspection exceeded CDP serialization depth; the corrected inspection retains only the reference and returns a boolean. Failed attempts were replaced.
- Cache persistence has a ten-second pacing window. The final script waits for an observed empty cached Favorites value before disconnecting; it does not assume an elapsed delay proves cache state.
- Custom keybindings were initially installed between variants during rehearsal. The final paired recordings both start with the same supported config and visible shortcut labels.
- Raw startup logs contain private evidence-session pairing tokens and are excluded from uploads. Homes, browser profiles, DBs, secrets and RPC auth are excluded. Synthetic fixture configuration, sanitized logs, scripts, traces and captures are public.
- Disk remained about9GB free, above the5GB cutoff; no basic shell stall exceeded two minutes. All evidence process owners were tracked and stopped. Pinned after source is restored and git status is clean.

No new tests were required for an evidence-only task. The independent audit recorded 31/31 focused providerInstances tests passing on this head. No repo-wide checks ran.

Model: GPT-6.1-sol. Harness: Codex through T3 Code.