# Proof audit pass 2 — evidence-only round 5

PR [#23647](https://git.cafe/pingdotgg/t3code/pulls/23647). Head [31019fac0f](https://github.com/pingdotgg/t3code/commit/31019fac0f9d55584cfae7e66c6b13ab938ca451); re-derived merge-base [f054d1b801](https://github.com/pingdotgg/t3code/commit/f054d1b8018721bd997d99cbb918a7b17bf098a4). Remote branch still matched the requested head at the final capture check. No code edits, tests, reviews, commits, pushes, merges, comments, assignments or PR watching. One installed worktree was checked out at each SHA; the desktop code difference is a comment. The served renderer module was saved at both SHAs: the new explanation is absent at the merge-base and present at head. Round-1 captures retain their original provenance; they were downloaded rather than recreated.

## Row-by-row coverage

| Row | Before evidence | After evidence | Finding |
|---|---|---|---|
| R1a | Round-1 Add-dialog stills, merge-base | Round-1 stills + independent round-5 head recapture | Raw pairing 500 becomes the explanation naming the old build and 0.1.1. Original paired variants are 1440/light and 390/dark, not four theme-by-width combinations. |
| R1b | Round-1 59.4s recording + stills, merge-base | New 97.2s head recording, Settings Details still, offline banner | Saved environment starts connected; real released old replacement starts before the matching server stops. Attempt 2 remains stable from about 13–81s, explanation is exposed between 24–30s, and offline + Reconnect is visible at 93s. No claim that the banner itself contains both versions. |
| R2 | New 48.2s merge-base recording, still, timed steps; 5 pairing 500 requests | New 48.8s head recording, still, timed steps; 4 pairing 500 requests | Descriptor is 0.1.1 on both sides. Transient remote-unavailable, retry countdown and attempts advancing to 5. |
| R3a | New 48.3s merge-base recording, still, timed steps; 5 pairing 502 requests | New 48.3s head recording, still, timed steps; 5 pairing 502 requests | Descriptor is the old build. Both sides keep retrying, reaching attempt 5. |
| R3b | New 48.3s merge-base recording, still, timed steps; 5 pairing socket closes | New 48.2s head recording, still, timed steps; 5 pairing socket closes | No HTTP status prefix; both sides keep retrying, reaching attempt 5. This replaces reliance on an unrelated ensure timeout. |
| R4 | Unchanged, excluded in pass 1 | Excluded | Cancellation/already-blocked path is outside the requested UI captures. No new test or review was performed. |
| R5 | Round-1 51.6s merge-base recording: Retry now at 18.3s, Connected at 23.9s | New 50.9s head recording: old server stopped at 0s, matching server listening at 5s, Retry now at 10s, Connected at 14s, banner cleared at 51s | Real old and matching builds; same isolated HOME and environment ID. Recovery proves explicit Retry now without disabling/re-enabling the environment. Automatic focus-wake recovery was not separately exercised. |
| R6 | Excluded in pass 1 | Excluded | Different-environment/no-token branches are outside the requested capture rows. |

Coverage: 6 captured rows / 8 matrix rows; R4 and R6 remain explicit exclusions. All requested missing rows are captured. The six control clips use a deterministic HTTP fixture behind a real SSH tunnel; the desktop runs its normal pairing-token minting code. They are not represented as failures from a real released server. R1a/R1b/R5 use the real released old executable from npm and the matching head source runner. No provider turn was launched. Plain browser and mobile are N/A for the desktop-only SSH path; no separate plain-web success is claimed.

## Independent head rebuild and visual deltas

I rebuilt and captured R1a myself at head, against the real old release. The full 1440×900 light recapture shows the same version/restart explanation. Host label changes from fs-29 to fs-36. At max-channel threshold >16/255, the unaligned full-frame delta from the original head still is 145 / 1,296,000 pixels (0.0112%). The fresh empty fixture replaces round 1's seeded fixture; pixel equivalence is not claimed. Original narrow stills are 390×844; their lower alert is cropped, so they prove that visible narrow layout, not full visibility of every line or the Add button.

Every published before/after still pair has two diff images: threshold 0 amplifies any nonzero RGB-channel change to full magenta, and threshold 16 shows magenta when max(|Rdiff|, |Gdiff|, |Bdiff|)>16 on the 0–255 scale. Black means below/equal threshold. No registration, cropping or masking is applied. Eight before/after pairs plus the independent after/after recapture pair are covered. Metrics are in diff-metrics.json. Control screenshots differ in retry timing, scroll position and row height; those diffs do not claim pixel-identical controls. The Settings comparison also changes machine label and local port.

## PR-body claim audit and corrections

- The author's historical “Not checked” paragraph and round-1 missing cells / “Unverified” log are superseded by round 5; the author text is preserved.
- The actual Settings summary remains “T3 Code on fs-36 did not answer”; the version/restart explanation is inside expanded Details. Pass-1 matrix wording suggesting it appears in the unexpanded row is too broad.
- The banner proves offline + Reconnect, and does not display the version explanation. R1b proves the blocked retry loop stops during the observed interval; it does not prove an infinite absence of retries.
- “Both widths and themes” means the two published combinations 1440/light and 390/dark. Do not read it as all four Cartesian combinations. The wide Add still proves the complete explanation; the narrow crop does not.
- “Nothing outside the error text and banner” is narrowed to the visible meaningful changes in the four original pairs at threshold 16. Zero-threshold images also expose antialiasing/raster differences. New Settings/control pairs have explicitly described fixture/timing differences.
- R5 proves explicit Retry now after the remote restart, not an unobserved automatic focus wake. The old server had to stop before the head server could acquire ownership; the accepted clip narrates that gap. The earlier failed/corrupt R5 attempt is excluded.
- Details' “Host version” remains the last connected 0.1.1 while the error correctly names the old running version. This existing stale diagnostic is visible and disclosed; no code change was made.
- Prior test/review results in the author's text and round 1 are historical statements, not new execution results. They were not rerun or re-reviewed in this evidence-only round. No new auth-acceptance or cancellation proof is claimed.

## Artifact integrity and operational exceptions

All eight new published recordings were fully decoded with ffmpeg and produced zero decode errors. Timed sidecars were checked against their 48–97s video durations; HTTP transcripts were filtered to each accepted control recording interval and contain request metadata only, never tokens. Driver hashes, capture hashes, SHAs, served-source hashes and recorded port-owner PIDs are preserved in the evidence package. Discarded fixture attempts (401 session state, interrupted SSH, corrupt video) are excluded from published captures and accepted HTTP logs.

Two instruction breaches must be disclosed. First, the initial dev runner automatically began reading/copying the live T3 database before seeding was disabled. I stopped it immediately, deleted that aborted sandbox copy, and restarted with T3CODE_DEV_SEED=0. All published new captures use the subsequent fresh synthetic state; no database is uploaded and no data from the aborted seed is used in the new captures. Second, the first failed R5 recorder's PID was captured in its shell variable but not persisted; I recovered the orphan PID through a process listing and sent SIGINT after checking its cwd. That violated the requested PID-discovery rule. Subsequent recorder PIDs were persisted, and servers were stopped through recorded sessions/port-owner PIDs with cwd checks.

FRICTION: environment | missing xdotool and libsecret-1-dev; installed their dependencies | preinstalled desktop capture prerequisites. Infrastructure | long-lived SSH listener terminated; a recorder exit code stopped a script, and an orphan corrupted an earlier R5 file | persist every child PID, tolerate recorder SIGINT exit, isolate output names, refresh long-lived sessions. Guardrail | automatic dev seeding violated the no-read/copy constraint | set T3CODE_DEV_SEED=0 before the first launch. Load was low; rounded free disk stayed at least 10 GB during capture.

VERDICT: SUFFICIENT