# Issue 15974 — read-only proof audit, pass 2

Core proof is sufficient for the limited claim: on the supplied Android installation, plain bottom-right New thread restores the saved unsent text instead of presenting an empty composer. It is not a full matrix pass, an ordering proof, or a merge-readiness review. Missing fixture cases must remain explicitly UNVERIFIED in any PR description.

## Scope and provenance

Audited `/home/ubuntu/t3code` at [1dd0ed5542](https://git.cafe/pingdotgg/t3code/commit/1dd0ed554202da054664a06968f0a038e5cc6717), against [3de45c6254](https://git.cafe/pingdotgg/t3code/commit/3de45c6254). HEAD matches; worktree clean before and after. The diff is 60 insertions in `apps/mobile/src/features/threads/NewTaskDraftScreen.tsx`. Read the entire diff and relevant candidate filtering, content eligibility, and openDraft implementation. No repository modifications, checkout, subagents, tests, forge calls, push, merge, or watch.

Read the [public evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a2df7c66fb5ce4e4/issue-15974-evidence.md), local evidence index, and `/tmp/issue-15974-matrix.md`. Public index equals local bytes. Downloaded all 44 linked artifacts; each equals its corresponding local file byte for byte. Integrity results: [artifact-integrity.txt](/tmp/issue-15974-pass2/artifact-integrity.txt). This establishes that the reviewed local assets are the delivered public assets, not merely similarly named substitutes.

Reused only `agent-device --session issue-15974`. Existing listeners remain on backend 13773 and Metro 8081; their process working directories are this checkout's `apps/server` and `apps/mobile`. No install, relaunch, pairing, new server, or new device. Existing app is `com.t3tools.t3code.dev`; observed environment fs-17, project server, branch fix/issue-15974. The lead's baseline revision attribution and changed-bundle cold-relaunch attribution remain inherited provenance. Pass 2 independently verifies checkout and Metro location plus reproduced behavior, but does not manufacture an embedded bundle SHA or claim to independently rebuild the historical baseline. A cryptographic installed-bundle revision attestation is outside this proof.

## Every delivered visual inspected

Opened all 28 uploaded PNGs: six timestamped video contact sheets; before-light-valid and before-dark stills; after-light/dark stills and both settled mates; explicit-control and retarget-control stills and their settled mates; four baseline terminal video frames; both comparison canvases; and all six zero-threshold, threshold-16, and amplified diff images. The six delivered MP4s were probed and inspected through their full-duration contact sheets, including near-terminal samples. Also generated and opened independent Linux ffmpeg sheets centered around telemetry actions, with pre-action and post-action frames. These supplement rather than replace the delivered overview sheets. No audio streams exist; the narration is the evidence index's timestamp table, not spoken commentary in the videos.

Independent action sheets are under `/tmp/issue-15974-pass2/`: `before-light-valid-actions.png`, `before-dark-actions.png`, `after-light-actions.png`, `after-dark-actions.png`, `controls-actions.png`, and `retarget-actions.png`. All video streams are native 1080×2424. Sampling is visual action/result review, not a frame-by-frame performance audit.

| Delivered recording | Independent observation versus index narration |
|---|---|
| before-light-valid, 15.58 s | Empty composer initially; synthetic text appears; list shows two same-text drafts; bottom-right tap at 13.315 s leads to empty Ask anything composer. Matches the core before claim. |
| before-dark, 13.33 s | Begins in light, changes to dark, text appears, list shows three same-text drafts. FAB tap at 9.665 s leads to empty dark composer by roughly 10.4–12 s. The main result is dark; the whole clip is not dark. |
| after-dark, 24.49 s | Starts on stopped empty thread; Navigate up, then FAB at 9.044 s restores text. Back and repeated FAB at 22.311 s restores it again. Matches. |
| after-light, 35.10 s | Same stopped-thread/list/FAB sequence, with taps at 13.498 and 31.294 s. Both settle on restored text. Intermediate frames are transitional; terminal stills support the settled claim. Matches. |
| controls, 96.27 s | Same-project picker return retains prompt; third explicit draft gets distinct marker; plain FAB opens original prompt despite marker edited last; explicit marker row reopens its own content; original text is restored before final FAB. Matches, without establishing creation chronology. |
| retarget, 50.03 s | Extra marker survives server → No project → server, then marker removed. Matches limited active-content preservation, not foreign-project selection or collision proof. |

Telemetry taps and visible destinations agree. Long holds reflect tool inspection and are not latency measurements. Baseline and after clips have different starting screens, but share the relevant list → bottom-right New thread → composer action. Light baseline has two draft rows, dark baseline and after have three. They are adequate for the single restoration behavior, not a matched multi-draft ordering experiment. No earlier non-valid baseline files were used as evidence.

## Matrix adjudication

| Row | Accepted observation | Still explicitly UNVERIFIED |
|---|---|---|
| M1 | Narrow core restoration in both themes; repeat entry; visible intended server/fs-17; no observed send. | Complete M1: uniquely identified creation-ordered A/B, newer empty C, foreign decoys, storage identity/duplicate count. Same-text drafts cannot prove ordering or which exact key resumed. |
| M2 | None. | Attachment-only and newer whitespace/settings fixture; actual attachment access. |
| M3 | None. | Empty second project, foreign-project and environment decoys/collision. No project is not a second real project. |
| M4 | Existing same-project picker return preserves text; stopped P1 thread → plain entry works. | Initial no-intended-project picker, different-project thread, delayed hydration and typing before hydration. Cold launch remains lead context, not pass2 observation. |
| M5 | Marker survives server → No project → server. | A second actual project with competing draft; broader retarget guarantees. |
| C1 | Distinct explicitly selected draft retains marker while plain entry opens another prompt. | Actual older-by-creation identity, queued-task editing. The word older in the marker is not a timestamp. |
| C2 | None. | Share payload, explicit branch route, clone exclusion. Visible current branch does not exercise explicit branch entry. |
| C3 | Source shares newTask handler. | Runtime command palette and hardware shortcut. |

Source agrees that ordering uses stamped creation time, eligibility is trimmed text OR attachment, and candidates match environment AND project. Those facts explain intended behavior but do not convert missing runtime rows into passes. No web/desktop/iOS/tablet/provider/connection-mode sweep is claimed or required for this bounded Android proof. Full-matrix sufficiency: NO. Reported single-behavior sufficiency: YES.

## Visible difference truth and pixel audit

Independently recomputed every published pair count. Both comparison canvases contain the exact unscaled source images below the label band. Every supplied threshold mask and amplified diff exactly matches a fresh computation from raw stills. [Recomputed statistics](/tmp/issue-15974-pass2/recomputed-stats.json).

| Pair | Pixels >0 | Pixels >16 |
|---|---:|---:|
| Light before versus after | 180,160 | 70,441 |
| Dark before versus after | 180,273 | 169,074 |
| After light stable pair | 0 | 0 |
| After dark stable pair | 0 | 0 |
| Explicit stable pair | 0 | 0 |
| Retarget stable pair | 0 | 0 |
| Light baseline video-frame pair | 0 | 0 |
| Dark baseline video-frame pair | 16 | 0 |

All whole frames contain 2,617,920 pixels. Dark baseline video-pair maximum channel difference is 1. Those extracted compressed frames are not paired raw baseline screenshots. Pass 2 verifies equality/counts, not independently the historical 500 ms screenshot spacing.

The before/after change includes text restoration, a taller composer, expanded model/reasoning label, changed Send appearance, and upward movement of branch row and hero. Clock and cellular status pixels also differ. The evidence correctly avoids claiming that only the prompt changed. Send appearance alone does not prove its disabled property; no Send action was exercised.

## Independent rebuild through the normal UI

Read the externally uploaded [reproduction helper](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f6e2dcf3d4d5c83d/issue-15974-reproduce.py), analysis and contact-sheet scripts. No committed seed script is needed or requested: fixtures already exist in device-local persistence, the external trace expresses the normal UI steps, and the evidence index uploads the scripts. No DB or persistence injection was used.

Attempted the helper unchanged with dark theme and a new `/tmp` prefix. It safely stopped its recording when a snapshot immediately after Navigate up still described the previous thread, so no New thread ref could be found. Retained the failure [log](/tmp/issue-15974-pass2-rebuild.log) and short [attempt recording](/tmp/issue-15974-pass2-rebuild.mp4); inspected that recording too. This is reproducibility friction in the helper, not a failed app assertion.

Using fresh destination snapshots, completed the same steps: select existing stopped New thread row → record → Navigate up → list with three saved drafts → bottom-right New thread → wait for text-field → fresh snapshot confirms exact original prompt, server and fs-17 → two native screenshots → stop recording. Every AgentDevice call used the same session. No Send or text mutation. Rebuilt recording telemetry records Navigate up at 1.102 s and FAB at 13.618 s; restored text is visible by approximately 14.32 s. [Rebuilt video](/tmp/issue-15974-pass2-rebuilt-dark.mp4), [telemetry](/tmp/issue-15974-pass2-rebuilt-dark.gesture-telemetry.json), [action sheet](/tmp/issue-15974-pass2/pass2-rebuilt-dark-actions.png).

Compared delivered after-dark raw still with rebuilt raw still, using absolute RGB channel differences, no alignment or normalization:

| Region | Pixels >0 | Pixels >16 | Maximum channel delta |
|---|---:|---:|---:|
| Whole native frame | 775 | 640 | 235 |
| Status bar, rows 0–99 | 762 | 640 | 235 |
| Remaining rows 100–2423 | 13 | 0 | 1 |
| Two new rebuilt raw stills | 0 | 0 | 0 |

Status clock reads 6:18 in delivered still and 6:30 in rebuild; cellular indicator also differs. The 13 remaining one-level differences are at native y=2388–2397 near the Android navigation handle, with no threshold-16 content difference. Do not report exact whole-frame reproduction. [Rebuild statistics](/tmp/issue-15974-pass2/rebuild-stats.json), [difference mask](/tmp/issue-15974-pass2/rebuild-diff.png).

![Delivered after dark on left; independent UI rebuild on right, including changed status clock](/tmp/issue-15974-pass2/rebuild-comparison.png)

## FRICTION

- Initial skill path lookup used the wrong root; recovered by reading the project skill. Its new-device/setup/teardown defaults were overridden by the user's explicit existing-session constraints.
- Python urllib received HTTP 403 from the public evidence host. Curl with a browser user-agent succeeded; all 44 public artifacts matched local bytes. No public-access failure remains.
- Uploaded helper's immediate snapshot after navigation was stale. Fresh destination snapshots completed the same UI steps; helper was not edited and cannot be advertised as a successful unattended replay.
- Android screenrecord reported 16.1 s encoded duration for a 28.7 s recording window because unchanged frames are omitted. Restored result is encoded and separately captured as stable raw stills; encoded duration is not app response time.
- Historical bundle SHAs remain supplied attribution, not an independently extracted installed revision. Same-text drafts, cardinality mismatch, missing fixtures, and compressed baseline-frame limitations remain explicit above.
- Both pass2 recordings stopped. Existing pooled session, lease, Metro and backend remain open for the lead. App left dark on the restored original draft. No source, fixture text, forge, or lead-owned service changes. Audit artifacts only under `/tmp`; no optional upload performed.

VERDICT: SUFFICIENT for the reported single Android plain-New-thread text-restoration behavior, with inherited historical bundle attribution and the stated limited controls; full matrix ordering/scope/exclusion/hydration cases remain explicitly UNVERIFIED.