# Proof audit, pass 2 after recapture

No remaining blocking proof findings. The five prior rejected rows P01, P02, P03, P04 and P07 are resolved under the lead's matrix-minimum rule. This is a proof audit, not a fresh code/CI approval or a claim that optional controls were fully tested.

PR [#29141](https://git.cafe/pingdotgg/t3code/pull/29141) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/29141)). Captured head [a5c3df8b21](https://git.cafe/pingdotgg/t3code/commit/a5c3df8b2124ce221e4162332eaffa6090779812), merge-base [30654b3e91](https://git.cafe/pingdotgg/t3code/commit/30654b3e91a51937d1dba18fc83af19d8003f5ca). The supplied checkout was clean at the capture head. The later merge-only branch head is not a finding.

Audited the proposed [revised Evidence section](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b4d0ce126c90ed6e/evidence-section-r2.md), [appendix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1bd51b82e909ea0f/evidence-appendix.md), [capture report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e2123e401cdf731a/capture-report-r2.md), [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8d8f04f9a742555d/pr-29141-proof-matrix-pass1.md), and [authoritative invocations](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/625f804637ec9892/invocations-r2-authoritative.md). The proposed section has not been posted by this audit.

## Findings re-check

- **P01 resolved.** Actual-Hermes anchor is retained with its 30s/14s latency limitation explicitly disclosed. The replacement protocol-replay comparisons have matching Worked for 13s labels. Their differences are confined to the recovered page and displacement of the final reply. Both masks are present at each delivered viewport/theme. The independent replay below matches the delivered head frame exactly.
- **P02 resolved.** The terminal stills now have matching neutral pointer/hover state. The six new failed/error/stopped inspector excerpts begin with settled, readable content. I inspected their initial, held and closing frames; the prior overlapping layout frame is absent. Failed/error excerpts close; stopped close is explicitly unverified. Original live-phase clips are separate and retain their original real durations.
- **P03 resolved.** The recaptured title, prompt, provider label/initials and final reply match the exact uploaded seedHarness/registerProofProvider calls. The protocol source and publish/reference maps support the A/repeated-A/structured-B/no-match-C/ambiguous-D classes. The head sequence retains one A and displays B; separate C/D excerpts hold readable output without invented panels. The early browser clock settling is disclosed and is not used as a pixel comparison.
- **P04 resolved.** Native thread-list badges are now visible. Independently decoded raw HEVC and H264 frames at 20/22/24/27/33/55/75/85s show Working → Waiting → concurrent Working → Waiting with tracked child → Input → Approval → Input → Waiting. Web recordings show both wait names and nonwaiting controls alongside live labels. Supplemental web/native clips show exit. Arrival-sensitive approval/input behavior also appears on base and is correctly disclosed; unconditional approval-over-input is not claimed.
- **P07 resolved.** The original long-title/wrapping input is restored. Head settles dark around 3.5s; base has a light iframe at 4s and is dark by 5s. The declared settled wide capture follows the 8s wait, and the subsequent narrow view is dark and readable. Settled wide and narrow before/after masks are zero. The transient is explicitly disclosed as pre-existing; base deliberately uses the canonical tool name as a viewer control.

No new capture contradicts the narrowed claims. Navigation/loading/theme-transition frames were inspected as transitions, not accepted as settled proof. Supplemental P03/P05/P06 video duration/sidebar differences are disclosed and are not pixel-isolation comparisons. P08's newly precise 9.5–10.5s settled-viewer wording matches its recording.

## Row table

| Row | Status | Evidence and limits |
|---|---|---|
| P01 | SUFFICIENT | Real-provider anchor plus controlled base/head W/light pair; additional 1440/390 light/dark comparisons. Two masks per controlled pair. Independent replay: zero delta. |
| P02 | SUFFICIENT | Base/head W/light terminal stills and masks; live phases/disclosure plus six settled terminal inspector excerpts. Stopped close remains unverified. |
| P03 | SUFFICIENT | Head W/light exact-seeder sequence and readable C/D inspectors; base sequence supplied. Synthetic ACP fixture is explicitly labelled. |
| P04 | SUFFICIENT | Head W/light and native I/dark badge recordings, request precedence and separate exits; base web controls supplied. Native actual geometry 402×874 is disclosed. |
| P05 | SUFFICIENT | Accepted head web/iOS matching, running, terminal controls and child open/return retained. New base/head web anchors show generic activity versus suppression while the card remains. |
| P06 | SUFFICIENT | Accepted head native-ACP child shows canonical work labels and no root fallback. New base/head anchors expose foreign versus canonical summary after disclosure around 19–20s, then return. Synthetic driver is explicit. |
| P07 | SUFFICIENT | Head dark/narrow recording retains the responsive page; canonical base viewer control, settled wide/narrow masks, truthful transient disclosure. |
| P08 | SUFFICIENT | Accepted actual-Hermes iOS feed → open → settled viewer 9.5–10.5s → back. No native base comparison claimed. |
| P09 | SUFFICIENT | Accepted Android light still shows inline page and canonical labels. Raster1080×2424; logical geometry/DPR/font scale remain unmeasured and disclosed. |
| P10 | UNVERIFIED, accepted exception | No T3 Connect; connect_unavailable transcript is correctly not represented as a guest capture. |
| C01 | PARTIAL, outside minimum | Full metadata/malformed/unknown boundaries unverified; no full-coverage claim. |
| C02 | UNVERIFIED, outside minimum | Historical persisted-item migration comparison absent; no migration claimed. |
| C03 | PARTIAL, outside minimum | Canonical base viewer control supplied; other-provider/scheduled/relay equivalence unverified. |
| Q01 | UNVERIFIED, optional | Asset/network/retry/process-death stress absent and disclosed. |
| Q02 | PARTIAL, optional | P08 open/back covered; full document-action branches unverified. |
| Q03 | PARTIAL, optional | P07 representative width/theme covered; full sizing/overflow stress unverified. |

## Independent reproduction

I chose the expressly permitted P01 protocol-replay option. At the exact capture head I started `T3CODE_DEV_SEED=0 vp run dev --home-dir <own timestamped scratch>/t3-home` in the supplied worktree. The database was fresh and isolated. I used the uploaded seed-driver.js, seed-replay.js, acp-replay-shim.py and recorded Hermes trace; the only source substitutions were scratch-root paths. Invocation: `await seedReplay('head', 'P01', 'proof-p01-replay')`. The shim publishes through the actual thread-scoped MCP transport and emits text-only tool output without rawOutput.

Rendering environment matched the supplied line: Linux x64 fs-36, Chrome156.0.0.0 preview, DPR2, no device emulation, CSS1440×900, root font16px, loaded fonts, light theme, frozen browser Date1793666400000, both side panels hidden, neutral pointer x1/y500. Preview returned1280×800 PNGs. Two independently requested frames matched each other and the delivered [P01-after-1440x900-light.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b8a8887c61c3c538/P01-after-1440x900-light.png).

**Pixel delta: 0 /1,024,000 pixels at Diff0 and 0 at DiffT16, bounding box null.** There is no non-antialiasing delta; there is no antialiasing delta either. The reconstruction did not use a delivered image as input.

P03's seeder/metadata correspondence was separately inspected against the uploaded authoritative scripts and recaptured frames; I did not independently run that second fixture, since the brief requires one reproduction and explicitly allows P01.

## Inspection coverage

Opened all94 downloaded PNGs, including stills, masks and supplied contact sheets. Independently decoded all43 linked MP4 files, including playback copies and carried-forward recordings, using ffprobe presentation timestamps and ffmpeg frame-index selection of the last decoded frame at/before each sampled time. Inspected all61 audit review pages and full-size frames for the repaired inspectors, P03 controls, native badge states and P07 theme/width milestones. Added exact22s/24s native samples to avoid substituting a nearby sampled state. The complete sampling manifests identify actual held PTS for sparse videos. Superseded/discarded attempts are not passing evidence.

Independently recomputed all22 delivered Diff0/DiffT16 masks across11 pairs: P01 six pairs (1280/light, 1440/light+dark, 390/light+dark, crop), P02 terminal, P07 four viewer-control pairs. Every delivered mask matches its stated max-channel>0 or >16 threshold and whitened-before compositing exactly. All P07 settled pairs are zero. P01/P02 changed regions match the intended code effects; no unrelated latency/hover pixels light the replacement masks.

Read the two-file diff and relevant parser/caller paths. Nine production lines normalize only matching lowercase renamed T3 server names and known tools; the remaining27 lines are focused tests. Root recovery and native-child non-recovery limits in the revised evidence agree with those caller paths. No repository-wide checks were run for this read-only proof task.

Cleanup completed before handoff: own preview tab closed; own server/Vite listener PIDs were confirmed by port and worktree cwd, terminated, and the spawn session exited143. Ports6290/14330 are clear. Supplied worktree remains clean and untouched. No native device, emulator or lease was started by this audit. Disk available18GB. Only the audit's scratch subdirectory is removed after public archival; the parent scratch and both lead worktrees are retained. Auth-bearing state/raw logs are excluded from public artifacts; sanitized reproduction logs are retained instead.

## Retained audit artifacts

Decoded frames, all sampling manifests, review pages, scripts and sanitized replay logs: [archive part 1](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b066116bad106e59/proof-audit-3-artifacts-1.zip), [archive part 2](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0aeafa0ea6c50db9/proof-audit-3-artifacts-2.zip), [archive part 3](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/164aaeeafdc7af9b/proof-audit-3-artifacts-3.zip).

Independent reproduction [pixel-delta result](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/05f2274327d9a4f2/replay-delta.json): Diff0=0, DiffT16=0.

![Independently rebuilt P01 head at1440×900/light; zero-pixel delta against the delivered capture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/befa5f77af5cb409/replay-1.png)

FRICTION:
tool | Python urllib received403 downloading public evidence; curl succeeded | Use curl for these immutable artifact URLs.
tool | Sparse HEVC extraction dropped duplicate-timestamp frames under default VFR behavior; re-extracted with fps_mode passthrough and exact frame indices | Use presentation timestamps plus passthrough for sparse native recordings.
tool | Preview evaluate rejected an expression with surrounding whitespace; trimming succeeded | Trim evaluation expressions before submission.

VERDICT: SUFFICIENT