# Final product proof audit — fresh pass 2 round

2026-10-23 UTC. Evidence-only review of [#21727](https://github.com/pingdotgg/t3code/pull/21727), original [yordis branch](https://github.com/yordis/t3code/tree/yordis/fix-model-picker-reopens-last-tab). Only product checkout inspected: `/home/ubuntu/wt/pr-21727`, replacement head [ddb8df4ab5](https://github.com/pingdotgg/t3code/commit/ddb8df4ab57a37ae145983eb18fba44d3345019a), affected-file baseline [71a283aed2](https://github.com/pingdotgg/t3code/commit/71a283aed253f23be1860a31d4ea48f1c06e0b1c). This judges evidence sufficiency for the pinned replacement, not current CI or the original fork head's merge readiness.

## Findings

1. **M2's blocking proof gap is filled.** Independently downloaded and decoded both new recordings. Before remains Personal after genuine initial delivery; after changes Personal → Favorites without a user choice. Explicit Personal before delivery remains Personal in both. Delivery visibly fills the favorite star. All four held/delivered states last at least three seconds. The explicit click precedes release in the action traces. Same search-input object remains connected across release in all four trace observations; there is no close/remount between these states.
2. **The transition is genuine cached-to-live configuration, not fabricated loading.** Inspected the published M2 driver, cache reader, proxy, separate RPC client, action traces and network trace. Empty Favorites is first set through `server.updateSettings`, then observed in the app's read-only IndexedDB config store with Personal/Work ready. Browser disconnect precedes the separate client's nonempty-Favorites update. Warm reload mounts from that cached configuration while actual upstream initial config is held. The proxy queues the original WebSocket buffers and sends the same buffers on release; it does not build replacement config. All 12 recorded held/released frame pairs hash-match, including rehearsal connections. Final after connections are 46 and 50; final before connections are 58 and 62. Each has an initial config containing the same two nonempty Favorites and ready Personal/Work. Their sequence-1 hashes agree at capture, hold and release. Server config delivery takes roughly 3–4 seconds after RPC; matching by an arbitrary <3-second window would incorrectly omit three final connections.
3. **M4's numbered supplement is valid web evidence.** Actual home `keybindings.json` supplies `ctrl+1/2` with `when:modelPickerOpen`; no desktop API is installed or spoofed. Fresh extracted frames visibly show Ctrl+2 beside Work's long model, then its full name on the selected trigger. Before reopens Favorites; after reopens Work. Favorites then visibly contains Personal Atlas at Ctrl+1 and Work Atlas at Ctrl+2; the latter becomes selected and after stores Favorites. The DOM snapshot's option traversal order sometimes differs from physical row order; visible labels and the resulting selected row establish the correct target. Stored keys are absent throughout baseline and become `"work"`, then `"favorites"`, after.
4. **Publication corrections verified independently: 151/151.** Fetched the supplied public evidence and manifest with curl; each is byte-identical to its revised local counterpart. Re-fetched all 151 manifest artifact URLs with curl and computed SHA256: every hash matches. This includes the replacement `publish.py`, corrected matrix, new videos/raw videos/traces, and all four threshold images. Public evidence, manifest, matrix opening pins, version script and all six before/after affected-file hashes agree with the requested commits. Baseline remains only the three affected files overlaid on the after checkout, not a whole historical installation. [Fresh fetch/hash results](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3046765428ef10d8/hash-results.json).
5. **Previous valid proof is carried intact.** All eight original G1–G4 video files and all eight before/after stills match the prior audit downloads byte-for-byte. Raw/amplified still differences, fixture settings, provider fixtures, core capture driver, guards, version overlay script and source hashes remain unchanged. Among 89 artifacts comparable with prior audit files, seven changed: G3 chapter JSONs add timing qualifications/frame evidence without replacing snapshots or state; after-G3 VTT corrects cues; startup script adds synthetic preflight; replay instructions and publisher expand; old loading network log retains its original bytes as a prefix with an appended release entry. M2's new pair supersedes the old loading attempt; G2 remains valid M3 evidence. No unexplained replacement of previously accepted visual proof was found.
6. **No new blocking capture gap.** Frame decoding independently reproduces every stated M2 stable range at 12 fps. All four narrated video streams hash-identically to their raw recordings. Actual AAC audio correlates with the retained synthesized speech at the stated cue offsets, and its text matches the depicted actions; no unsupported transition is narrated as a success. M4's first two speech clips overlap briefly, accounting for their lower individual correlations (~0.90); the rest are ~0.99998 or higher. The old approximate G3 clocks are now qualified and corrected in the narrative. A minor residual remains: after-G3 VTT's final cue ends at 10.300s, beyond the 10.166667s video by ~0.13s. This does not alter or hide a required state. [Independent video checks](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9c71fd1b9a6c13e5/independent-video-checks.json), [threshold/audio checks](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4e80da8f06a9c6e7/detail-checks.json).

7. **Concurrent checkout movement discovered at final verification.** The initial check returned the requested head. The final check returned clean [f6403f4ce9](https://github.com/pingdotgg/t3code/commit/f6403f4ce946f6fad70673451446948a8f71a69f); reflog records a merge of `origin/main` at 07:06:40 UTC during this pass. This audit did not perform it. The seven changed paths are outside the three affected picker files; their diff against the pinned head is empty. Public captures and publication SHAs still refer correctly to the requested pinned head, but they are not a full verification of this newer merge. The verdict below applies strictly to the requested pinned evidence. No checkout reset or source mutation was attempted.

M2 stable measured intervals, in seconds:

| Variant | Before held → delivered | After held → delivered |
|---|---|---|
| No choice | Personal, empty stars 4.75–8.50 → Personal, filled star 8.583–12.167 | Personal, empty stars 4.25–8.00 → Favorites, filled stars 8.333–11.667 |
| Explicit Personal | Personal, empty stars 24.00–31.00 → Personal, filled star 31.083–34.75 | Personal, empty stars 23.083–30.00 → Personal, filled star 30.083–33.75 |

After 8.083–8.25 is a delivered/layout transition, not part of the held-state range. Original full-frame layout also settles after reconnect; “unchanged frames” means unchanged held/released network bytes, not pixel-identical screens. The excerpt below is an audit crop from each freshly downloaded video at 9.0s, labeled before/after; it illustrates the delivered no-choice difference, not an independent live replay.

![Before: delivered config leaves Personal selected. After: delivered config selects Favorites. Both at 9.0 seconds.](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/32abd2cbdd4b2ad2/M2-delivered-before-after.png)

## Row proof

The previous audit's ten valid rows and independently rebuilt pixel-identical S3 result are reused as authorized. Original captures were not replayed through another server. Fresh work covers M2, numbered M4, carry-forward integrity and publication corrections.

| Row | Status | Proof |
|---|---|---|
| M1 | Proven, retained | Unchanged G1: real Work pick, browse/Escape, reload, Favorites pick; correct tab memory rather than owning-account memory. |
| M2 | Proven, new | Both genuine initial-delivery variants, both versions; measured ranges above, unchanged upstream buffers, cached-empty config and same mounted input traces. |
| M3 | Proven, retained | Unchanged G2: first star keeps Personal; last unstar keeps Favorites; remount recalculates; no preference write. Old attempted loading chapter is superseded. |
| M4 | Proven, retained + new | Unchanged G1 additive pointer/Shift-Enter, Enter and provider navigation; new visible Ctrl+2 Work/Favorites picks. Work holds before 1.417–5.25, after 1.417–5.333; remount before Favorites 6.25–14.417, after Work 6.417–10.50; final Favorites after 15.583–20.667. Trigger and selected Work Atlas row confirm both targets. |
| M5 | Proven, retained; timing qualified | Unchanged G3 ordinary/additive cross-account search preserves Work; whitespace saves Personal. Correct after empty-query remount 3.1–3.7s; additive remount ~5.8s before explicit Personal ~6.1s. |
| M6 | Proven, retained | Unchanged G4 ready, unavailable/unreachable, setup-reachable, disabled/missing and empty-Favorites fallback. |
| M7 | Proven, retained | Unchanged G4 forced lock/setup/retained-unavailable states, implicit/explicit write guard, forced star and incompatible-driver guard. Prior disclosed concatenated real X11 baseline segment remains unchanged. |
| S1 | Proven, retained + mask verified | 1440×900 light, DPR1; 25,424 pixels >8/255, bbox [406,536,736,669). Published mask independently reproduces exactly. |
| S2 | Proven, retained + mask verified | 1440×900 dark, DPR1; 25,434 pixels, same bbox; mask exact. |
| S3 | Proven, retained independent replay | 390×844 light responsive web, DPR1; 25,399 pixels, bbox [34,511,364,644); mask exact. Prior independent rebuilt after image had zero differing pixels and is reused. |
| S4 | Proven, retained + mask verified | 390×844 dark responsive web, DPR1; 25,407 pixels, same mobile bbox; mask exact. |

What else changed visually in the original still pairs: selected sidebar stripe, Favorites-versus-Work model/account text and rows, stars/highlights and popup height. Surrounding layout and Atlas trigger remain fixed. The long model is visible; these stills do not claim it was the selected trigger. Diff0 is absolute RGB difference; amplified is saturated 8×; DiffT is a binary max-channel >8/255 mask. Threshold differences remain inside the picker. The short list does not overflow; no fade is claimed. Four threshold images retain the independent audit's provenance and are now explicitly included in the public manifest and evidence links.

## FRICTION

- Historical discovery caveat remains: an earlier capture launched before synthetic settings, and native discovery access was not traced. Therefore an absolute historical “no access to ANY real DB” claim remains uncertifiable. There is **no evidence establishing an actual real-database read**. This final pass never read/copied/opened a real DB or `~/.t3/userdata`; no server or browser was started.
- Some after cache/network diagnostics show null model identifiers because the reader used an `id` field where these serialized models use `slug`; later cache reads use the corrected reader. This is a diagnostic-field limitation, not an empty catalog: ready status, actual visible models, empty cached Favorites, nonempty genuine initial Favorites and byte hashes are independently present. Do not treat those null diagnostic entries as complete model-ID provenance.
- Source/provenance logs support a genuine capture; artifact hashes do not cryptographically prove which process rendered a video. The prior independent S3 replay adds runtime corroboration and was not rerun here. Prior 31/31 focused providerInstances tests are reused; no new tests or repo-wide checks were needed for this evidence-only round.
- Minor editorial residue: ~0.13s final after-G3 VTT overrun and brief overlapping opening numbered narration. Neither leaves an actual matrix row missing. Old chapter times remain approximate unless explicitly frame-measured.
- My first frame-analysis script was named `inspect.py`, shadowing Python's standard library and causing a local import failure. Renamed it and reran successfully; the failed attempt made no product changes. No shell stall exceeded two minutes. Free disk stayed ~8.9GB, above the 5GB stop limit.
- Product scope is web, including responsive web. Custom web bindings exercise production shortcut handling; no native desktop/mobile verification is claimed. Product-default authorization is accepted. Final git status is clean, but HEAD moved externally as detailed above. I made no product edits, commits, pushes, comments, watches, real-data access, browser or server. Only audit files and public evidence uploads were written; the PR was registered with this thread.

Model: GPT-6.1-sol. Harness: Codex through T3 Code.

VERDICT: SUFFICIENT