# Independent proof audit — pass 1

PR [#23537](https://git.cafe/pingdotgg/t3code/pulls/23537), head [3926acc0d4](https://git.cafe/pingdotgg/t3code/commit/3926acc0d4d70d95a5e8747bfacec032a0253ebd), branch `fix/issue-23513`, against local `origin/main` at [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121fe65669d5d43d011b48cd3027a4108). Read-only proof audit; no implementation, new runtime runs, comments, description edits, pushes, watches, or polling.

## Evidence identity and scope

Read the complete two-file final diff and surrounding close, dialog, context-selection, manager-close, idle-close, and page-close/crash paths. Live GitCafe metadata agrees with the requested head and supplied `pr.json`. The final diff changes server lifecycle/cleanup only; visual matrix is empty. Desktop-native behavior, viewport variations, mobile layouts, and screenshots are not required proof for this change.

All six public description artifacts were fetched and byte-compared with their local copies: identical. Sources: [before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9c6ca77dee2f15c9/before.txt), [after transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1a9b22aa4b9e2aba/final-runtime.txt), [events](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/347ec4c42aba00bf/final-events.json), [fixture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b388e3800d0e1bf3/fixture.py), [red tests](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c564923c4e3080e0/red-run.txt), [green tests](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3921b92833bad1ee/green-run-final.txt).

The runtime transcript names ancestor [2fe77f4048](https://git.cafe/pingdotgg/t3code/commit/2fe77f4048), rather than final merge head. This is sufficient transferable evidence for the touched behavior: `ServerBrowser.ts` blob is `e212e495fd6f3415eb8ef11d841bf1242d33c82f` at both revisions; test blob is `e41a80d66f5049cb6f3e66a7e52150ffbcfcc107` at both. Do not rerun the already-covered cases merely to change the transcript's SHA label. The merge did bring other base changes, so this is file identity, not a claim that the entire runtime tree was identical.

## Server runtime fixture matrix

Every lifecycle/time row below requires narrated runtime evidence. Mock tests support branch behavior but do not fill a missing runtime row. Existing environment: fs-14 Linux x86_64, isolated dev data, product-native headless server preview, 1280×800, scale 2 for after evidence, no device emulation. No new runtime was performed in this audit.

| Row / fixture state | Required observation | Existing narrated runtime proof | Assessment / remaining proof |
| --- | --- | --- | --- |
| Baseline listener-only page, isolated, unactivated and activated | Close succeeds; identify actual missing lifecycle event | Before attempts 1 and 3: pagehide + visibilitychange received, no beforeunload; installed-host tool attempt 2 corroborates | Sufficient baseline for the reproduced beforeunload omission. Does not reproduce the issue's broader claim. No repeat needed. |
| Fixed listener-only page, isolated, no activation | beforeunload can execute on close without activation | After repeated plain-incognito attempt: all three receipts at 10:03:31.557–.572; close Success .616 | Sufficient positive reproduction of fix. First plain attempt received only pagehide: reliability/universal delivery remains unproven and must remain qualified. No repeat necessary for the current qualified claim. |
| Activated unsaved-changes guard, shared profile | Closing guard must not strand tab; lifecycle handlers can finish | After shared-profile guard: production stream mouse activation, three receipts 10:01:05.695–.755, close Success .780 | Sufficient observed guarded-close success. No dialog-event log directly proves accept(), but completion under the stated activated guard is useful behavioral evidence. Do not redo. |
| Activated unsaved-changes guard, isolated | Same guard behavior while context disposal applies | After incognito guard: three receipts 10:01:37.111–.140, close Success .232 | Sufficient normal guarded-close outcome in isolated context. No repeat needed. Does not independently establish page/context event ordering. |
| Existing dialog BEFORE close (alert/confirm/prompt or already-pending beforeunload) | Close bypasses blocked graceful unload and actually closes page without waiting for dialog action | None. Existing pending-dialog test resolves a confirm explicitly; it does not close with it pending | Missing runtime branch proof for `runBeforeUnload: false`. Minimum: open a real pending confirm/alert, confirm pending status, invoke close without resolving, narrate return latency and actual page disappearance. Shared profile plus a surviving sibling best excludes context teardown masking failure. Do not require lifecycle beacons from a blocked/forced page. |
| Delayed graceful unload in isolated context | Context remains alive until page close, then is disposed | Guard/plain receipts show successful lifecycle delivery; mock `unloadGate` test asserts deferred context close | Missing direct runtime ordering proof. Minimum: narrated server-side page-close/context-close observations around a deliberately delayed but finite unload; record context open while page still open and context disposal after page close. Beacon receipts alone cannot establish this ordering. Avoid assuming arbitrary async beforeunload work is awaited by Chromium. |
| Frozen isolated renderer | Close command returns promptly; renderer eventually removed | After frozen row: freeze-start, increasing CPU ticks, close 85ms, renderer exists immediately after, absent at six-second observation | Sufficient prompt-return + eventual cleanup proof. No rerun for those claims. Does not prove exact five-second cutoff or a hard five-second completion deadline. |
| Grace-period boundary / timer cleanup | Fallback is not premature; nominal five-second scheduling; normal close cancels fallback | Frozen runtime only samples immediately and at six seconds. Fake-clock test proves open at 4,999ms, forced close at 5,000ms, zero timers afterward | Exact runtime timing/cancellation not established. If retained as runtime claims, add narrated timestamped page-close and fallback scheduling/cancellation observations; otherwise describe five seconds as configured grace before force-close attempt, and keep the existing coarse six-second observation. No need to rerun frozen case for eventual cleanup. |
| Shared-profile isolation during close / fallback | Closing target does not dispose shared context or sibling page | Shared guard exercises shared branch, but no sibling survival observation; frozen runtime is isolated only | Missing runtime proof of shared-context preservation, especially fallback independent of isolated-context close. Efficient follow-up: use shared context with sibling, close pending-dialog target then frozen target, verify sibling still responds and targets disappear. This strengthens the changed cleanup branch; no full Cartesian matrix needed. |
| Ordinary close with no listeners; page already externally closed/crashed | Cleanup remains benign, no stranded tab/context | No narrated runtime row; source uses same dropTab, isClosed branch, and idempotent map removal | Secondary regression coverage gap, not evidence of a defect. One external-close/crash narrated check can cover already-gone cleanup if a complete branch matrix is required. Plain no-listener close is lower priority than rows above. |
| Graceful close rejects / force-close retry | Fallback actually closes on an initial close rejection | No real fault transcript; `.catch(() => page.close())` is visible in source | Fault-path runtime proof absent. Lower priority; requires a controlled transport/runtime fault rather than extrapolating from frozen-page success. Not a claim already established by the linked transcript. |

## Findings and acceptance boundaries

1. **Proof incomplete for the full stated close contract:** the pre-existing-dialog forced-close branch has no runtime transcript; delayed page-before-context disposal is only established by a modeled test. These are the highest-priority missing runtime rows, not confirmed code bugs.
2. **Timing language must stay narrow:** the frozen run establishes 85ms command return and renderer absence at the six-second observation. It does not establish disappearance precisely at five seconds, no premature closure, timer cancellation in a real run, or a guaranteed five-second total completion bound. The production code schedules a force-close attempt at five seconds. The PR description's six-second wording is appropriately narrow; the transcript phrase “Production close bounded5s” is stronger than the observed proof.
3. **Beacon evidence has explicit limits:** all three events were received in the successful rows. Receipt order is not dispatch order; missing receipts do not prove non-dispatch. The first plain attempt is unresolved inconsistent delivery, not proof the change universally fails or that subsequent success establishes reliability. The current description acknowledges this correctly.
4. **Shared cleanup deserves one compact runtime check:** a surviving sibling under pending-dialog and frozen closes would demonstrate shared-context preservation and ensure isolated-context disposal is not the sole explanation of eventual frozen cleanup.
5. **No duplication required:** retain the baseline, successful plain repeat, both activated guard runs, and frozen eventual-cleanup transcript. Add only missing states/observations. No screenshots, native desktop run, client/provider Cartesian matrix, or full regression suite is warranted for this proof pass.

## Tests and independent code review — separate status

Existing artifacts report three expected base failures / 22 skipped, then 26 passing fixed tests. The red artifact predates the fourth frozen-page test; it does not claim a red run for that test. The green artifact has no embedded revision/command beyond Vitest output and is corroborating test evidence, not a runtime transcript. No tests, lint, or typecheck were rerun; lint/typecheck are description claims without linked logs in this evidence set.

**Independent code-review verdict from this pass: ABSENT / NOT PERFORMED.** Reading control flow to derive a proof matrix is not an independent correctness review or merge approval. No independent human/agent review report is supplied among the six evidence artifacts. A single GitCafe review-list snapshot shows Macroscope approvability `approve` at the requested head, with marker-only body; record that bot state separately, not as an independent substantive code-review verdict. This audit makes no merge-readiness verdict and alleges no confirmed implementation defect.

## FRICTION

- Initial Python urllib artifact fetch received HTTP 403 Forbidden. Retried with curl and a browser user-agent; all six fetched successfully and matched local bytes. No artifact access remains blocked.
- Narrated runtime is on an ancestor, but identical touched production/test blobs avoid unnecessary repeat proof.
- Supplied fixture supports listener/guard/freeze cases only; pending-dialog, delayed-unload ordering, and sibling-survival follow-ups need additional fixture behavior or runtime event instrumentation. No such implementation was made here.
- No browser, dev server, live-state writes, runtime polling, PR comments/body edits, or review submissions were used. Only the requested audit artifact was written; app PR linking was performed as required by the harness.