# Proof audit pass 2

VERDICT: SUFFICIENT

Sufficient for the Android fix, with A3 explicitly deferred/unverified. This is an evidence verdict, not a checks-passed or merge verdict. No PR exists in this audit.

Reviewed head [d3de380d](https://git.cafe/pingdotgg/t3code/commit/d3de380d7a5f39986844467f53b2da9165e834ee) against base [bfc7177f](https://git.cafe/pingdotgg/t3code/commit/bfc7177f9f54b0a4b9d3571d30723a51cd4b31bd). HEAD and actual merge base independently confirmed; worktree clean before and after. Full three-file diff inspected. The change makes inboxVersion a compiler-visible observe argument; placement/timer/classification/styles are unchanged in this diff. Android compiler excerpts agree, though their revision labels and capture provenance are supplied attestations, not an independently reconstructed bundle-to-commit chain.

## Row status

| Row | Status | Observed proof and limits |
|---|---|---|
| B1 | Reproduced, qualified static-tail evidence | Raw frames show ordinary real prompt, running thread, navigation to Home and Working expansion before completion, then Done still under Working. Last changed frames: Done at 49.718667 s, 07:37 clock at 50.028544 s. Raw duration 50.338422 s does not continuously encode the prolonged post-grace interval. Separate stills show the same stuck state; local capture mtimes are 07:37:02.618 and 07:37:31.143. They are pixel-identical, so the later time rests on capture metadata/transcript rather than an image clock displaying seconds. Persisted completion 07:36:59.533 independently matches the delivered transcript. Accept as video plus later still corroboration, not uninterrupted 31-second post-completion video. |
| A1 | Pass: Android phone Home | Running → Done still on Working at raw PTS 50.570967 → returned above older control, Working absent at 52.558133. Difference 1.987166 s is consistent with grace. Clock still reads 07:42 at return and changes to 07:43 at 53.445444; minute rollover does not explain return. One target remains, control below, stable through later frames, no tap/navigation across the decisive interval. Persisted completion 07:42:56.512 matches transcript. |
| A2 | Pass: Android tablet sidebar transition; reselection loaded-content proof is transcript-only | Actual landscape split sidebar beside target conversation. Working (1) establishes collapsed state from the header implementation; selected target remains beneath it, covering the retained-selected branch. Running → Done at 63.621722 s; header disappears/reorder begins by 65.466689, stable correct order by 65.702767. No completion-interval interaction; later control selection occurs around 88 s. Persisted completion 07:45:16.776 matches transcript. Final raw frame at 103.591644 and A2-last show New thread selected with a blank/loading conversation pane. They do not visually prove reloaded content. Later accessibility excerpt claims selected target and all three prompt/Done groups; retain that qualification. |
| A3 | UNVERIFIED / deferred | Cached iOS install is reported successful after retries, but device controls timed out. Only iPad home-screen status image delivered, no T3 sidebar transition. Neither install success nor this screenshot is an iOS runtime pass. Does not block an explicitly scoped Android fix. |

All raw video dimensions independently match the index: B1/A1 1080×2424 portrait, A2 2560×1600 landscape; visible appearance light. Native development client/compiler evidence, not release-build proof. Exact model names/fingerprints and historical base checkout/cache restart are capture attestations; screen pixels alone cannot authenticate those details. Server projection rows independently read using SQLite mode=ro match all three requested/completed timestamps and ordinal identities. Legacy event records also contain three run-created/run-attempt-created groups. No synchronized millisecond wall-clock overlay links every video PTS to server UTC; avoid precise server-to-pixel latency claims.

## Inspection coverage

Inspected every delivered raw and narrated recording with ffmpeg-derived frames spanning each timeline, plus exact transition/final frames; all delivered stills, contact sheets, before/after/difference composite and the two subsequently delivered amplified/threshold diffs. Read narration text and generation script, telemetry, run JSONs, completion/selection transcripts, capture recipe, compiler excerpts and local index/matrix. Narrated copies have synthetic speech and revision strips; raw clips remain the primary visual proof. No observed fabricated UI, exposed credential/pairing token, persistent duplicate/ghost row, or undisclosed iOS pass. Temporary overlap during tablet reorder is visible; stable frames contain one target. Setup connection error and blank-load stills are real failures disclosed as setup friction. A2's blank final pane must remain disclosed.

Pixel differences include intended row order/header removal, clock and status-bar differences. The compared head conversation has an additional real turn and the client/Metro were restarted. Black areas in contact sheets are unused grid cells; ghosted text in absolute difference images is subtraction of displaced rows. Neither demonstrates a runtime ghost. No claim that nothing else changed is supported or made.

Unverified runtime rows/conditions to retain in a future PR: iOS; hidden nonselected collapsed card; Working off/on; preference loading; search/ranking/scoping; pinned/settled/snoozed/removal; approval/input/subagent/plan/guest/error/resume boundaries; alternate theme/orientation/foldable; release build; other providers; relay/tunnel; web/Electron; agent/MCP. Their unchanged/source-only rationale in pass 1 remains appropriate, but they are not device passes. Compiler regression test not rerun here. Primary's check:changed outcome remains outside this audit; no competing checks started.

## Friction

| category | what | avoidance |
|---|---|---|
| Capture | B1 static tail omitted by encoder; later still has minute-only image clock | Describe combined video/still proof; retain timestamps; future capture can include synchronized clock/event markers without claiming current clip contains them. |
| Final state | Tablet reselection ends with blank/loading timeline | Keep post-grace transition pass separate from transcript-only loaded-content confirmation; future recording should continue until content appears. |
| Provenance/timing | Revision/compiler excerpts attested; PTS, telemetry and UTC lack a documented common clock origin | Preserve exact SHA/bundle records and synchronized capture start metadata in future captures; current evidence supports behavior, not exact network latency. |
| Device pool | iOS cached install worked, controls timed out; phone lease/instrumentation friction | Mark A3 unverified, preserve failure detail, defer iOS without blocking Android scope. |
| Startup/selectors | Android Metro connection refused/blank setup, tablet early reconnect and stale selector | Wait for ready native UI and refresh selectors before the decisive run; the delivered decisive intervals are after recovery. |
| Reproducibility | Not rebuilt in this pass | B1 recipe switches the shared checkout while primary checks are using it, violating this pass's read-only constraints; all capture sessions were closed and recipe requires fresh interactive pairing/selectors. No pretend reproduction or competing checks. |

No repository edits, tests/builds/check:changed, servers, devices, subagents, forge commands/writes, pushes, merges, or watches performed. Audit-derived frames/report are only under /tmp.