# Proof audit pass 2b — issue 24302

Audit began 2026-10-24 11:18:03 UTC; hard stop 11:38:03 UTC. Read-only proof review; no source edits, checkout changes, commits, pushes, forge writes, server starts/stops, or new tests. Existing code-review approvals and 56 green tests are reported context, not rerun or re-reviewed here.

Compared base [27e0c684c5](https://git.cafe/pingdotgg/t3code/commit/27e0c684c585f955252d65f06206dd11a143bff5) and head [14d89dd239](https://git.cafe/pingdotgg/t3code/commit/14d89dd239d449d01442e55db127a3a2ecc5f889). Scope is the original matrix only.

Inputs: [original matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d5b4409a4783a391/issue-24302-proof-audit-pass1.md), [prior audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3e23b0d63f0ee02e/issue-24302-proof-audit-2a.md), [real-Kimi repair index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e81fc4c8cc5cc9e8/index.md), [T1 index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e8cfe61fa976654e/index.md).

## Row results

| Original row | Status | Evidence/remaining condition |
|---|---|---|
| K1/K2 1440 light | PASS | Stable stills; correct initial/cancel/retry/footer states; corrected public narration verified |
| K1/K2 1440 dark | PASS | Same; independent row-specific media inspection |
| K1/K2 390 light | PASS | Correct narrow wizard, controls visible; corrected public narration verified |
| K1/K2 390 dark | PASS | Same |
| K3 1440 light | PASS | Replacement matched-scroll/stability pair and continuous lifecycle |
| K3 1440 dark | PASS | Replacement matched-scroll/stability pair and continuous lifecycle |
| K3 390 light | PASS | Correct saved-settings entry; stable pair; corrected public narration verified |
| K3 390 dark | PASS | Same, plus independent reconstruction matches layout |
| T1 synthetic 1440 light | PASS with stated scope limits | Four attempts, typed input, explicit RPC resize, process cancellation/stale rejection, held verification failure/exit7/separate success |
| K4 real account completion | UNVERIFIED | No real account authorization completed |
| P1 Windows | UNVERIFIED | Linux only |
| C1 native mobile | UNVERIFIED | Responsive web only |
| C2 Electron runtime | UNVERIFIED | Shared web rendering only |

UNVERIFIED scope rows are explicit limits, not newly required retakes. All nine required web/synthetic pairs pass within the disclosed scope.

## Real-Kimi visual checks

Every delivered original repair still and diff was opened, including the rejected desktop K3 candidates. Duplicate stability frames were independently compared as raw decoded RGB pixels. All 16 diff masks reproduce exactly using max-channel delta >0 and >16; neither threshold is a pass percentage. No image registration, crop, mask, or postprocessing was applied by this auditor.

| Pair | Changed pixels >0 | Changed pixels >16 | Raw stability before/after |
|---|---:|---:|---|
| K1 1440 dark | 357954 | 16422 | 0 / 0 |
| K1 1440 light | 361374 | 63168 | 0 / 0 |
| K1 390 dark | 800947 | 64779 | 0 / 0 |
| K1 390 light | 767605 | 69486 | 0 / 0 |
| K3 1440 dark, rejected original | 223467 | 36221 | 0 / 0; scroll64/80 |
| K3 1440 light, rejected original | 122599 | 14081 | 498 / 407; scroll64/80 |
| K3 390 dark | 596727 | 92539 | 0 / 0 |
| K3 390 light | 536840 | 96234 | 0 / 0 |

Original raw stability gaps are 632–1216 ms, all above 500 ms. Desktop K3 light instability is a single vertical strip at x226: before498 changed pixels (497 >16), after407 (115 >16). It cannot be dismissed as antialiasing. Equal Account anchors did not cure unequal absolute page scroll64/80. Those two pairs were correctly withheld from the published index and need replacement.

The six other pairs show the intended Account prompt/terminal on head and prolonged loading on base. Narrow K3 uses the saved-provider entry, correcting the prior wrong-entry evidence. No terminal ghosting, stale spinner, clipped Cancel control, or unrelated old terminal was apparent in these stills or sampled frames. Diff regions include the terminal, status/buttons, wizard recentering and height, and downstream Runtime layout shifts caused by the terminal. Wizard background provider state can subscribe to the same flow. These are relevant consequences of the displayed flow. Subtle surface differences explain a large >0 count; >16 retains the actual text/layout changes. No claim that all changed pixels are the terminal alone.

Controls: CSS1440×900 or390×844, DPR2, zoom1, Linux Chrome154. Desktop exported stills1280×800 are uniform8/9 CSS scale; narrow780×1688 are2×CSS. This export scaling is disclosed rather than called native-resolution desktop pixels. Themes match. Fonts were awaited, but no separate terminal-font-face readiness measurement was collected. Frozen Date applies only to still acquisition, following real >=36s observations. The clock, checked-relative labels, cursor, animation, transition and backdrop-filter controls are capture CSS/JS interventions; they do not certify native default animation or translucent appearance. K1 uses actual glass100 plus backdrop-filter disabled on both sides. K3 uses glass80. No expansion to default translucency is required by the matrix, and no pixel masking is accepted as evidence.

## Desktop K3 replacement

[Replacement index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a1def21c1363332e/index.md) supersedes both rejected desktop K3 rows above. Independently downloaded all30 public objects and verified every hash against the immutable public manifest and local files. All four selected raw pairs are exact0 at>0 and>16, with gaps813/1211/816/883ms (light before/after, dark before/after). Capture logs retain rejected light attempts instead of hiding instability. Both sides absolute scroll80. Account y344base/y360head follows the actual extra readiness line, not CSS alignment.

All replacement stills/diffs were opened. Recomputed diff0/diff16: light152999/20071; dark167692/17987; all four magenta masks exact. The terminal, Account controls, downstream Runtime shifts and genuine readiness explanation account for the salient differences. No clipping/ghosting/wrong-entry/stale spinner was apparent. I decoded516 replacement recording samples at2fps and viewed159 timeline frames across all four, plus caption-strip crops and all four delivered timeline images. New captions explicitly announce Retry before clicking it; fresh prompts/starting state and final inactive Retry are held visibly. Same sampled-inspection limits apply. These two rows PASS.

## Recording inspection and narration

All16 original real-Kimi recordings were decoded at2fps (1734 frames). I visually inspected506 selected timeline frames across every clip: one-second detail near the first10s and last18s, middle observation context, and last available frame. This is sampled inspection, not full playback or every-frame certification; brief transitions can be missed. First prompt/loading, >=35s observation, cancellation, inactive Retry, fresh retry, second cancellation, and final held inactive state were checked against action logs. Wizard footer disabled-active/enabled-inactive is recorded. Real Kimi terminal input acceptance remains unverified, as explicitly permitted with T1 covering synthetic input.

A narration defect remains in the original clips: caption “inactive Retry is visible after cancellation” persists through the next active retry. For example [K1-390-light-after.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d3c18db5f1652634/K1-390-light-after.mp4) at about52s shows a fresh device prompt beneath that inactive-state caption. The lifecycle is visible, but this caption does not describe the current interaction. The delivered caption-only candidates replace this with “Cancel, then retry; buttons and terminal show current state.” I opened a before/after caption crop from every one of12 clips. Bounds stay strictly inside the original caption: desktop[0,1744,2880,56], narrow[0,1604,780,84], leaving original boundary rows intact. I independently decoded every frame of all12 and verified exact PTS plus exact Y/U/V outside the rectangle during repair, and exact whole frames otherwise. No splice, speed change or app masking was found in these comparisons. Narrative content now passes.

The first candidate exports drop original color metadata: original pc/BT.709 matrix/BT.709 primaries/sRGB transfer becomes pc/unknown/unknown/unknown. Despite PyAV's reported RGB identity, independent FFmpeg PNG decoding at20s in K1-390-light-after changes55267 RGB pixels, maximum channel delta7, outside any repaired interval. This is a presentation metadata defect in evidence, not a product defect. Minimal fix: remux preserving original color tags, then republish hashes and verify RGB with metadata-aware decoding. No app retake needed. Desktop replacement clips already contain correct Retry narration.

Color tags were subsequently restored locally. My independent system-FFmpeg check of two samples per clip (20s whole frame plus repaired-interval midpoint above the original caption boundary) now yields exact RGB equality for all12 clips, zero tolerance. The exhaustive PTS/YUV comparisons apply to the same unchanged decoded frame samples; remux metadata correction does not require new runtime evidence. All12 corrected public video objects have now been independently downloaded and hash-match local final files. The exhaustive system-FFmpeg verification log records all12 passing; my independent two-sample-per-clip checks also pass. Final [caption index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1dd87218b89a3157/index.md) arrived before the hard stop. All20 linked corrected objects independently downloaded and hash-match their local final files. All12 video SHA256s match the final public manifest. The126-member public replay ZIP includes restore_tags.py and the documented postprocess → restore tags → system-FFmpeg RGB/app verification sequence. Superseded color-tag exports are excluded. Final caption publication PASS.

## T1 synthetic typed-terminal evidence

T1 passes its original synthetic scope, with the following explicit qualifications. It is actual saved Provider Account UI driven by a typed fixture, not a real Kimi account. Both exact SHAs are checked at start/end. Before47.3619s and final replacement head53.6853s are complete continuous recordings; the discarded truncated head take is excluded.

I inspected every2fps sample of both raw videos (95 before +107 after) and of both narrated exports, plus selected full-resolution frames and all supplementary success/diff images. The caption band lies outside app pixels. Four attempts are visible on each side: native keyboard SAFE+Enter with appended output; authenticated resize101×31 printed in the real terminal; Cancel followed by inactive Retry, captured process gone, stale-flow RPC rejection and unchanged input events; distinct retry; exit0 held fresh ACP verification then explicit verification failure; exit7 failure with retry; separate exit0 held verification then held Signed in with terminal absent. Logs distinguish login/verification PIDs. No authenticate RPC shortcut.

The resize is explicit authenticated RPC transport proof. Viewport resizing did not independently emit PTY resize, so responsive terminal resize behavior is unproven. Local ACP base and resolved environments coincide; inherited variables and method override are shown, not three independently separable environment layers. These limitations are stated in the public index, not silently upgraded to proof. No additional tests requested.

CSS1440×900/DPR2, light, scroll190, Account anchor250, raw2880×1800; narrated1440×1010 includes110px external band. Frozen display clock is identical; host/server clocks remain live. UTC-to-video mapping is approximate +0.5s, not calibrated monotonic timing. No latency claim. Supplementary final-state pairs are lossy decoded video frames45/45.5s and49/49.5s: exact0 within-side; cross325719 >0 and1980 >16. They are not substituted for raw browser stability or an isolated UI diff.

Baseline startup log is absent: postcapture PID2283532/start11:08:39/cwd/source were observed while base remained checked out. Head PID2287488/start11:15:46 and sanitized restart/listening/reconnect log establish watcher restart, with head source at both endpoints. This is dev runtime provenance, not an immutable production build.

## Public reconstruction and provenance

Independently downloaded64 real-repair published objects with curl; all bytes match their local counterparts and public manifest SHA256 entries. Independently downloaded13 T1 linked artifacts; all match local bytes, and all11 nonmanifest/self entries in its artifact manifest match. The index is the fourteenth public file. The public replay archive seals52 members; nine key scripts/config/log/provenance files also match local originals byte-for-byte. The earlier public fixture's21 internal manifest hashes match. Public setup/capture drivers and process scripts are available. No private pairing token is part of this report or upload.

Source blob SHA256 values independently recomputed from git match the delivered base/head auth and probe logs. Lockfile, unchanged client-runtime source, and Kimi1.52.0 binary hashes match provenance. Logs observe the correct per-side dev-source checkout and server PID; they are not independently built production bundles. Later watcher restart for T1 is explicitly documented rather than claiming one immutable server process throughout.

Independent reconstruction completed11:27:31–11:28:28 UTC in my own paired T3 preview tab, using the hash-verified public setup/capture drivers verbatim for K3-390-dark-after. Before and after: exact head14d89dd239, clean status, auth/probe digests above; existing server PID2302567/start11:27:12/cwd apps/server stayed unchanged. Setup succeeded against the real existing server; prompt, cancellation, fresh retry and final inactive state were observed. This is the requested independent capture reconstruction on exact dev source, not a new production compilation or baseline rebuild. No server or checkout action was performed by me.

Own raw pair780×1688 is identical at718ms separation. Against delivered K3-390-dark-after.png:1630 changed pixels at>0;1424 at>16. All>16 changes are the fresh device code; 19 additional Runtime-region pixels are below16 and look consistent with edge antialiasing. Header is exactly equal. Layout, terminal wrapping, Account/Cancel and Runtime placement reproduce. The state log records scroll682 before the driver reapplies its Account anchor; delivered log has633 before reanchor. Final raw geometry matches, so these pre-still state values are not misrepresented as final screenshot scroll measurements. No alignment or exclusion was used in full-frame counts. A second still was captured only as this row's stability pair; no other row was captured.

[Independent capture log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/252dd763415d47fa/independent-capture.json) · [pixel counts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/791fb2a75f74458d/independent-stats.json)

![Independent reconstructed head — K3 narrow dark](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fb6430f2bf903bf9/browser-screenshot-localhost-mvmbeyed-1217d0bb.png)

After checkout was released, root reported merging upstream through [2c205d43bf](https://git.cafe/pingdotgg/t3code/commit/2c205d43bf4224823af9776a472216e7b89b8dd5). This report certifies the original base/head captures only; it makes no postmerge capture claim.

## Minimal remaining work

No app recapture is needed. The two desktop retakes and the independent one-row reconstruction are complete. No remaining retakes or publication repairs. The final caption index, manifest and replay bundle were independently retrieved and verified before the hard stop. No new test or source change requested.

The original K1-1440-light-after final inactive state lasts about1s in actual media, despite a longer requested driver hold. That visible final state satisfies the original matrix; no arbitrary3.5s minimum is added. No runtime recapture requested for that disclosure.

## Limits and FRICTION

Real-account completion (K4), Windows (P1), native iOS/Android (C1), and Electron runtime (C2) remain UNVERIFIED. Responsive web captures verify web only. Remote/relay/tunnel and default translucency are not added to this matrix. No synthetic success is represented as real account completion. No full video playback/every-frame check, production build, calibrated clock, or independently separated environment layers is claimed.

FRICTION: urllib downloads returned403; curl retrieved and hash-verified the same public objects successfully. A scratch Python module named inspect shadowed the standard library; renaming it fixed image processing. No repository change was made. Independent capture was held while another authorized agent owned checkout, then completed after explicit release. Caption export color tags were independently checked rather than assuming planar equality meant identical display. Publication uses ghdrop; browser work uses test-t3-app and T3 preview only.

Audit completed within the20-minute budget, before11:38:03 UTC. This is a sufficient bounded proof package for the original web matrix; it does not certify real-account completion, Windows, native mobile, Electron, production builds, or postmerge runtime.

VERDICT: SUFFICIENT