# Refined proof matrix — issue 16542

Read-only refinement of [#16542](https://git.cafe/pingdotgg/t3code/issues/16542), diff origin/main...HEAD in /home/ubuntu/wt/issue-16542 at [5f983b4e2c](https://git.cafe/pingdotgg/t3code/commit/5f983b4e2c1fcd87ac44ea5424c251e4825bcbaf). Original contract: /tmp/issue-16542-proof-pass1.md. This document reduces equivalent interactions, not distinct affected behavior. Evidence remains in progress; this is a resume contract, not proof approval or a claim that recordings were visually reviewed. No browsers, tests, repo edits, forge mutations, or delegation performed.

Production scope is one non-rendering hook/tracker change: remember href plus nullable history index; track index-only changes; invalidate index when a utility visit is at/before the remembered index; close via go(-stepsBack) when positive, otherwise navigate retained href or root. The utility predicate is unchanged. The two actual exit consumers are shared SidebarUtilityMenu Back and Settings parent Escape. Usage/PR Escape uses a different unchanged one-step history hook. No provider, RPC, mobile-native or permission behavior changed.

## Mandatory capture contract

For EVERY affected row A1–A8, run paired base/head segments in D-L 1440x900 light, D-D 1440x900 dark, N-L 390x844 light, N-D 390x844 dark. Retain all four profiles; no theme/width waiver. Every interaction segment, including compatibility interactions if exercised, requires a recording on each revision. Separate variants may share a recording only with explicit reset boundaries and action timestamps. Do not multiply every exit by every route: the exit implementation is established by A1/A2; other rows vary history state with one representative exit.

Use fresh browser documents for independent module-state resets, identical committed synthetic seeds, actual app UI and legitimate history actions. Record URL including search/hash, index, visible destination, drawer state, errors and checkpoints. After a valid-anchor close record Back, Forward and further Forward: head closes existing B, Back A, Forward B, further Forward may revisit utility. This fix does not delete utility entries. For fallback rows log the actual resulting stack; do not apply the valid-anchor oracle after truncation.

Retain original paired screenshots, zero-threshold amplified diffs and >16/255 channel diffs, counts/percentages, alpha treatment and visible-difference inventory. Freeze display time before initial render; match viewport, screenshot pixel dimensions, DPR, fonts and actual theme. Record exact SHAs, seed/script hashes, profile, action offsets and recording duration. Only synthetic sanitized evidence is public.

## Smallest complete affected-path matrix

A/B are distinct stopped synthetic main-thread routes. U is a utility route. Each row below is affected; each listed distinct variant remains required. Compatibility-only subchecks are explicitly identified rather than silently promoted to extra affected rows.

| ID | Required interaction and distinct state | Oracle and why separate | Original rows absorbed |
|---|---|---|---|
| A1 | A -> B -> Settings -> shared Back; narrow uses real drawer. | Positive one-step traversal returns existing B; Back A, Forward B, further Forward Settings. Exercises shared exit plus drawer-close integration. | 01; shared-exit portions of 15/17 |
| A2 | A -> B -> single-project Settings -> unconsumed page Escape, drawer closed. | Same traversal through the second actual consumer; scope must survive entry. Escape consumption belongs to C1 below. | 02; Escape integration in 15 |
| A3 | A -> B -> Settings; section replace -> search/hash replace -> nested detail; push scope changes twice; shared Back. | Preserve anchor across replace and multi-entry push; close skips all intermediate utility entries. Include cross-utility Usage -> Settings in this segment if reachable, otherwise separate reset segment. One nested Settings parent, not one row per panel or both exits per mutation. | 03/04/08; nested and scoped parts of 16 |
| A4 | A -> B -> Usage -> shared Back; separately A -> B -> Pull Requests -> shared Back; separately project alias /projects/P -> scoped Settings replace redirect -> shared Back. | Three concrete route/mount contracts remain distinct segments, although identical predicate/hook arithmetic. Exact return B and A/B sequence for each. PR data/filter rendering is compatibility-only, not needed to prove history on its mounted error/empty page. | 05/06/07 |
| A5 | Cold Settings idx0 -> A idx1 -> Back Settings idx0 -> push Usage idx1 (deletes A) -> Settings idx2 -> close. | Utility index below remembered index invalidates it; retain href A and navigate there, never stale-index Usage. Actual truncation fallback is distinct from traversal. Record resulting Back/Forward honestly. | 12; fallback portion of 18 |
| A6 | Equality invalidation: remember main A at i; legitimate replace to utility at i -> close. Also observe conservative invalidation on reaching an older utility before any truncating push, then close. | Utility index == remembered index and utility index < remembered index both clear only index. Conservative fallback can occur before deletion; do not claim global utility skipping. If no actual UI path yields equality, keep equality UNVERIFIED at actual-app level and require focused lower-level proof, never fabricated UI. | 12 equality; 18 conservative invalidation |
| A7 | A -> B -> Settings -> Back B -> Back A -> Forward B -> Forward Settings -> close. Add legitimate same-href main visit at a different index if app permits. | Main visits refresh href AND index; revalidation restores traversal after invalidation. Same-href index-only dependency needs focused lower-level coverage if UI deduplicates; ordinary A/B navigation does not prove it. Record post-close Back A. | 13; revalidation portion of 18; relevant 17 traversal |
| A8 | Fresh authenticated utility document with no main visit -> close (root fallback); separately reload on B -> enter Settings -> close. Add retained nontrivial main href (environment/search/hash) -> Settings -> close, using legitimate route state. | Null anchor differs from null index (A5/A6); reload initialization differs from module retention; exact href/index restoration must preserve destination identity. Root/draft/thread are equivalent nonutility storage inputs; one nontrivial representative suffices, others C4. Cold Settings/Usage/PR/project aliases share null-anchor branch; record Settings representative, map mount/redirect evidence through A4. | 11/14; reload portion of 17 |

These eight rows partition the changed tracker/close semantics and the real consumers. A4 intentionally retains distinct route segments; A5/A6/A7/A8 intentionally retain branch and lifecycle differences. This is a behavioral matrix, not eight videos: distinct variants need their own clearly reset segments in all four profiles.

## Compatibility-only dispositions — all original rows accounted for

No original row is silently dropped. Absorption is justified by unchanged entry/render semantics plus identical hook state, not by convenience. Unexercised compatibility paths must be labeled unverified; they are not new affected-path gates for this 30-line runtime change.

| Original | Disposition and equivalence boundary |
|---|---|
| 01 | A1. |
| 02 | A2. |
| 03 | A3 retains replace/hash and nested detail; repeating both Back/Escape after every mutation is redundant once A1/A2 establish consumers. |
| 04 | A3 retains pushed scopes/multi-step traversal; project/machine/checkout labels are C4 render variants when URL history operation is identical. |
| 05 | A4 Usage segment; URL-bearing filter changes are covered by A3 push/replace semantics once actual navigation operation is mapped. Data/filter UI is C4. |
| 06 | A4 PR segment; populated list/filter/detail data is C4, because runtime fix reads only href/index and renders no PR state. Mounted error state proves route close only, not successful PR loading. |
| 07 | A4 alias segment; equivalent context-menu/palette/thread/ChatView links to same alias and search contract are C3. |
| 08 | A3 retains cross-utility mount transition. PR -> Settings adds no tracker branch beyond A4 PR and A3 cross-utility; repeating each exit is redundant. |
| 09 | C1: search Escape clears first, overlay consumes first, X clears; unchanged event consumption, not a third exit implementation. Subsequent unconsumed Escape is A2. |
| 10 | C2: Usage/PR Escape uses unchanged useNavigateBack, independent of changed close hook. No requirement to make it skip utilities. |
| 11 | A8 null-anchor branch; direct entry/reload aliases and route mounts map to A4. Extra cold-entry permutations are C4, not different fallback logic. |
| 12 | A5 actual truncation and A6 equality retained explicitly. |
| 13 | A7 index refresh/revalidation, including same-href dependency; extra repeated visits with identical href/index state collapse. |
| 14 | A8 retains exact destination identity; root/new/draft/linked-thread rendering variants are C4 because tracker treats every nonutility href identically. |
| 15 | Narrow drawer closure retained A1 and page Escape A2 in all profiles; legacy/collapsed desktop renderers are C4, same shared menu and tracker. No claim of native mobile coverage. |
| 16 | C3: palette, settings shortcut, composer/provider, Git, tasks, notices are unchanged entry triggers. Map their destination and push/replace/search contract to A1/A3/A4. A different history operation would reopen an affected segment; unavailable triggers remain unverified. |
| 17 | Raw Back/Forward without close is C2; tracker refresh and reload portions retained A7/A8. Platform key/menu dispatch is C5. |
| 18 | A6 conservative invalidation and A7 revalidation retained, separate from A5 deletion. Original description's Back B -> Back A visits MAIN A, so it refreshes the remembered entry rather than invalidating on a utility. Use an older UTILITY route to demonstrate actual conservative null-index invalidation. |

C1=Escape interception/clear; C2=unchanged raw history/default Escape; C3=unchanged entry links; C4=unchanged render/data permutations; C5=native desktop and remote deployment dispatch. Compatibility interactions still need recordings when claimed verified; source-equivalence classification alone is not an executed interaction claim.

## Existing evidence inspection and resume priority

Snapshot inspected while capture owner was active: 57 recording files; 56 complete recorded JSON segments covering original 01 Back, 02 Escape, 03 Back+Escape, 04 Back, 05 Back, 06 Back across both revisions and all four labeled profiles. Original 07 has only after/D-L complete recorded segment; original 08 has partial after/D-L JSON with no complete/recording at inspection. Counts may increase after this snapshot. JSON complete flags are capture-script assertions, not this audit's video verification.

Canonical D-L logs demonstrate baseline indices 2 -> 3 -> close 4 -> Back 3 -> Forward 4 -> further Forward 4, versus head 2 -> 3 -> close 2 -> Back 1 -> Forward 2 -> further Forward 3. This supports intended history behavior. Existing original 03 already exercises both consumers beyond the minimal need; retain those artifacts. Original 04 currently covers project then all-project scopes, not every machine/checkout label. Original 06 renders 'Could not load pull requests / The tool this host is read through is not installed or set up'; count route-close proof, not populated-list compatibility proof.

Resume: finish A4 alias profiles/pairs, A3 cross-utility, then A5/A6/A7/A8. Do not spend remaining capture time multiplying unchanged entry links or populating PR data before branch/lifecycle coverage. A1/A2 and A3/A4 existing logs are promising, subject to provenance and capture-profile corrections below.

Evidence limitations that prevent claiming original contract completion:

- D-L logs report viewport 1440x900 and DPR2, while sampled after-D-L-row01-back-initial-b.png header is 1280x800; narrow pixel-diff records total 1,316,640 pixels, matching 780x1688, rather than DPR1 390x844. Reconcile screenshot/recording dimensions with viewport and DPR. Do not call labeled profiles fully satisfied from filenames.
- Clock freeze happens after initial app load in committed capture script. Pixel inventory shows relative ages changing 2m -> 19m and 4m -> 21m on unchanged main route. Freeze before render or explain/recapture drift; no zero-diff claim for these checkpoints.
- Recording metadata says video/mp4 but files are named .webm. Preserve originals and publish with correct media type/extension; verify durations and decoding before approval. No video playback performed here.
- Sample logs identify revisions only as 'before'/'after'; bind each artifact to exact runtime SHA and script/seed hash in final manifest. Current inspected HEAD includes fixtures beyond original proof's older runtime SHA.
- No complete evidence observed for actual truncation, equality/conservative invalidation, same-href index changes, cold/null anchor and reload/exact-href lifecycle rows. Existing two harness tests cover canonical traversal and truncation only; they do not establish all these branches.
- Native macOS/Electron key/menu/window integration, native iOS/Android, remote/tunnel canonical flow, legacy/collapsed sidebar, intercepted Escape, unchanged Usage/PR Escape, alternate feature-entry links, populated PR UI and non-thread render variants are unverified here. Responsive narrow web is not native mobile. Providers/server/contracts unchanged: no provider-by-transport Cartesian matrix is warranted.

## Fixture decision

The user explicitly requires committed seeding script and fixture data so auditors can rebuild state from SHA. Keep them: that instruction overrides the generic scratch-artifact default. Synthetic thread.create 'full-access' fixture data does not itself change permission defaults, execution grants or MCP behavior; do not classify it as a production security change without an actual semantic path. No additional sensitive-data finding is asserted by this audit.

## FRICTION

- Original 18-row contract mixed affected branches with unchanged entry links and data/render permutations, multiplying identical hook behavior. The disposition ledger accounts for every original row and preserves distinct history states.
- Original row18 mislabeled main-route traversal as invalidation. Main visits refresh the anchor; utility visits at/before its index invalidate it. Keep these separate in capture scripts.
- Evidence directory is actively changing. This audit reports a point-in-time inventory, not missing-file failures against ongoing work.
- Profile labels, actual image geometry, DPR and pre-render clock differ. Preserve navigation evidence while correcting capture provenance; do not silently waive the original contract.
- A broad markdown read produced excessive diff-inventory output; subsequent inspection used structured per-segment JSON summaries. No repo changes or browser activity resulted.