# Proof audit PASS 2 — issue 16447

Read-only audit, 2026-10-22 UTC. Findings precede the row table. No repository changes, pushes, comments, merges, server stops, or database seeding were performed. A read-only sandbox pairing token was minted for the recapture attempt. Browser verification used the [test-t3-app skill](/home/ubuntu/t3code/.agents/skills/test-t3-app/SKILL.md).

## Findings

1. **The complete requested proof matrix is insufficient.** D outside-window release/recovery, settled endpoint previous/next clicks, and invariant cross-drag behavior remain unproved. N20/N8 have differing content/scroll states and do not establish exact fade timing or clean no-jump recovery. Z is a labelled geometry supplement, not a capture of the actual Full setting. C does not establish the required text drag beneath its two-item preview. M does not exercise coarse-pointer hiding. These are evidence gaps, not newly demonstrated implementation bugs.
2. **The required independent rebuild and pixel comparison did not complete.** My new preview tab reached `/pair`; a freshly minted sandbox read-only token did not produce an authenticated thread view. `preview_wait_for` returned `Preview automation waitFor timed out after 15000ms.` A subsequent preview evaluation stalled until the turn was interrupted. Lead assistance was requested. No screenshot of the affected state was rebuilt, so there is no honest recapture pixel delta or AA-only claim to report. The tab did independently report Chrome 154.0.0.0, Linux x86_64, DPR 2, 1440×900 CSS, fine pointer true, root font 16px, and fonts loaded. These environment measurements alone do not satisfy the recapture requirement.
3. **Primary selection/link proof is supported by the delivered records, with an audit limit.** Literal Wide light/dark use paragraph 41 on both sides. Recorded DOM results identify BEFORE `Inspect` in a preview span and AFTER `Selectable` in the assistant paragraph, with link-hit arrays empty BEFORE and containing the synthetic paragraph-41 URL AFTER. The capture routine installs a capturing listener that prevents external navigation only after the actual target resolves to the reference link; it does not retarget clicks. The inspected light video contact sheets are consistent with the preview-owned versus paragraph-owned selection and subsequent scroll differences. I did not independently watch every video frame or visually inspect every affected capture; this report must not be represented as an exhaustive frame-by-frame visual sign-off.
4. **Diff assets are real, but not all pairs are controlled comparisons.** All 317 manifest assets exist locally. The manifest contains 114 screenshot entries, 10 current recordings, 67 pairs, and 39 separately labelled historical assets. I independently recomputed all 67 zero-threshold ×8 diff images exactly. The package implementation uses absolute per-channel RGB delta, saturating ×8 amplification, and a strict maximum-channel delta **>16** mask. Threshold 16 is a sensitivity cutoff, not proof that remaining differences are antialiasing. Selection highlight, focus rings, preview visibility, scroll/content changes, supplement labels/padding/wrapping, and video compression are non-AA sources of difference. Large N/Z/C deltas cannot be dismissed as AA or used as clean layout invariance proof.
5. **Revision and scope check pass.** The checkout was clean at [366ec74cf8](https://git.cafe/pingdotgg/t3code/commit/366ec74cf818a8b0ccd032d115e2f6d353f61245), and `git merge-base HEAD origin/main` returned [3b95e7831b](https://git.cafe/pingdotgg/t3code/commit/3b95e7831b11b17627dff16843bc087bfca397ec). Those match the requested revisions. Captured BEFORE revision identity is attributed to the supplied manifest/report and serialized checkout history; a screenshot does not itself cryptographically prove its source SHA. Old-base artifacts are explicitly historical and must not substitute for this comparison.
6. **The full four-file diff matches the described implementation.** `TimelineMinimap.tsx` fixes rail width to `hitStripWidth`, removes preview-target exemptions and preview mousemove propagation handling, and makes the overlapping preview pointer-inert. `MessagesTimeline.logic.ts` removes only the unused expanded-width helper/constant. The committed Python/JSON fixture supplies deterministic 80/2/1/0-user projection threads with synthetic prose, markdown, links, reasoning rows, blank-user fallback, and absent assistant coverage. The committed seed is explicitly required by the task and is not rejected as scratch. It deletes sandbox projection rows and requires an already migrated worktree database; it was read, not executed against the running server. Its docstring requires the server stopped, but does not mechanically enforce that precondition. This is a reproduction constraint, not a reason to modify the repository during this audit.
7. **“What else changed” is appropriately qualified, not a zero-regression guarantee.** Its listed focus-ring narrowing, preview disappearance, replacement of preview selection with paragraph selection, scroll/content variation, geometry labels/wrapping, and snapshot/compression variability match the implementation and capture routines. It explicitly disclaims zero unrelated pixel change across all interaction frames. The statement that the evidence worker stopped its final server is historical handoff information: the lead has since restarted and owns the final-head server. No MP4 image embeds remain in the local delivered report checked during this audit; videos are plain links.

## Row-by-row coverage

All desktop rows below use 1440×900 CSS and fine pointer according to delivered environment records; desktop snapshot PNGs are 1280×800 downscales, video frames 2880×1800. Video-derived primary light keyframes are 1440×900. Both revisions are the linked final-head/base pair above.

| Row | Before/after captures and widths/themes | Audit result and unresolved requirement |
|---|---|---|
| Literal Wide primary | WPD light and dark pairs; actual timeline 1184/content 1088, g=48/h=36; idle, first/middle/last, footprint, selection, link, focus/blur snapshots and video steps | Core selection/link result supported by DOM records and light contact sheets. Snapshot action lag is disclosed. Full temporal invariance is not established by snapshots. No independent final-head recapture completed. |
| P Comfortable | PD light and dark pairs; persistent h=40; paragraph 41, first/middle/last, footprint, selection, link, wheel | Supplemental core result supported by recorded outcomes. Later wheel/keyboard/drag states differ and are not pixel-invariance proof. Whole-row no-jump/selection-across-area requirements overlap incomplete D. |
| D | Included in WPD/PD both themes; message-to-rail and rail-to-message drag calls, focus, arrows, Home/End, Space/Enter, blur, intentional rail click | **Incomplete.** Tool success is not proof of correct drag outcome. Automation can scroll targets. Outside-window recovery unavailable; endpoint disabled samples were unsettled; previous/next endpoint clicks/recovery not fully shown. |
| N20 | NZC light pair, labelled real-app CSS geometry g=32/h=20, nonpersistent, neighbor pointer style auto; active/released/focus | **Incomplete.** Supplement is labelled, but before/after scroll/content mismatch defeats clean pixel comparison. Exact 150ms fade and cross-drag invariant/recovery are unproved. |
| N8 | NZC light pair, labelled CSS geometry g=20/h=8, nonpersistent, neighbor pointer style none; active/released/focus | **Incomplete.** Same mismatch and timing/drag limitations as N20. Style inspection supports geometry classification, not every interaction assertion. |
| Z | NZC light pair, labelled h=0 supplement; residual g=6; pointer-inert rail/neighbors and focused state | **Incomplete.** Does not capture actual Full preference. Scroll/content mismatch; required selection/link/wheel guard is not independently established by the geometry states. |
| C2 | NZC light pair, Comfortable; 8px two-item rail, blank first user/no assistant, short second/final assistant; first/last and keyboard steps | **Incomplete.** Required underlying text drag is not established. Source fixture supports fallback content; paired screenshots are not proof of drag behavior. |
| C1/C0 | NZC light absence keyframes, one/zero user threads | Representative absence controls delivered. No additional interaction recording required by matrix. These do not fill C2's gap. |
| M fine-pointer | 390×844 CSS light/dark paired stills, PNG 780×1688, g=12/h=0, DOM display:block and pointer-inert rail | Valid fine-pointer narrow control by supplied measurements, not a coarse-pointer result. |
| M coarse-pointer | No coarse capture or emulation | **Missing.** No claim that the media-query hiding path was exercised is justified. |
| Independent rebuild | Attempted own matching-environment Browser tab at final HEAD | **Missing.** Pairing did not complete; no affected screenshot or measured delivered-versus-rebuilt pixel delta. |

## Recording and pixel audit limits

The 10 current recordings are five before/after pairs: WPD light/dark, PD light/dark, and NZC light. Manifest durations respectively are BEFORE/AFTER WPD light 29.542933/12.453267s, WPD dark 12.001167/11.589467s, PD light 12.117100/30.686700s, PD dark 13.715800/10.712200s, NZC light 52.254433/33.540733s. Step names and order match the saved capture routine. Report timestamps are offsets from recording acknowledgement, not guaranteed compositor frame times; recording `createdAt` is an end artifact timestamp and should not be mistaken for start. Light primary semantic keyframes use separately selected video times. Dark primary has recordings and snapshot pairs, but no equivalent separately normalized video-keyframe set in the delivered package.

All pairs include before, after, zero-threshold ×8, and strict >16 outputs. Their existence and arithmetic are distinct from whether the source states are sufficiently synchronized. The original numerical recomputation process did not finish before the interruption; the resumed zero-threshold recomputation did finish. The resumed independent threshold check also completed: all 67 strict >16 mask images and both zero/threshold pixel counts match exactly. Public URL reachability/content was not independently fetched for every asset; local existence is verified. No exhaustive visual inspection of all 114 screenshots is claimed.

## FRICTION

| category | happened | avoided |
|---|---|---|
| Browser startup | `preview_status` unavailable; `preview_open` succeeded with a new owned tab | No alternate automation installed or used |
| Pairing | Fresh sandbox read-only token did not yield an authenticated thread; wait timed out; lead assistance requested | No secret requested in chat, no live userdata access, no published pairing URL |
| Browser stall/interruption | Later preview evaluation remained pending until interruption | No invented successful recapture or pixel delta |
| Compute | Initial NumPy batch did not return a completed result; resumed Pillow zero-diff check completed | No inference of success from an unfinished process |
| Running server | Lead-owned final server remained running | No stop, restart, seeding, or direct database writes |
| Evidence quality | Downscaled snapshots, temporal lag, mismatched geometry comparisons, missing coarse/outside-window tools | No AA-only or complete-matrix claim |
| Scope | Four committed files read, including explicitly requested fixture | No edits, push, forge comment, PR, or merge |

VERDICT: INSUFFICIENT D N20 N8 Z C2 M-coarse independent-recapture