# Proof audit pass 2 — issue 24547

Findings first: evidence is INSUFFICIENT against the full requested matrix. This is an evidence verdict, not a fourth code review or a claim of a remaining implementation defect. Independent code review is intentionally pending.

Scope: [#24547](https://git.cafe/pingdotgg/t3code/issues/24547), final [a3ebf4e7bd](https://git.cafe/pingdotgg/t3code/commit/a3ebf4e7bde3b2777d4e7380724f17f287d99fe7) versus merge-base [909e4c9482](https://git.cafe/pingdotgg/t3code/commit/909e4c948278afc2b3e1e665075fb1755a13f894). Clean final checkout independently confirmed. No source edits, tests repeated, forge writes, pushes, merges, or server lifecycle actions by this auditor. Only temporary audit artifacts and own preview UI state were written. Pairing used the authorized test-t3-app CLI workflow against isolated worktree state; no credentials are included.

## Findings

1. Pixel gates remain open. diff-report.json records V1 dark header failures at both widths (desktop 0.830–0.837%; responsive 2.034%) and V3 desktop light alias header failure (0.955%), versus <=0.1% at any RGB delta >16. V1 responsive dark ordinary full-frame control is 0.12813%, also over tolerance. Unchanged selected-row/focus, breadcrumb, draft text, and lossy-video noise are documented; these explain partial evidence but cannot be reported as a pass. Top-header crops exclude results and cannot certify unchanged ordinary-result rendering. No result regions were masked from the delivered whole-frame comparisons.
2. Settled proof is partial: capturer reports 28/36 tool PNG pairs exact; eight desktop Files pairs have 3–11 changed pixels at maximum channel delta 1–4. Extracted lossy recording frames are not universally exact. Strict recording-derived diff0 stability therefore is not established. All eight ordinary-control pairs need a consistent state and declared region, with measured residuals within tolerance.
3. D1–D6 contain unproven required assertions (below). The 34-pass focused run and positive runtime fixture do not discharge those obligations. V4 lookup precedence and V5 positive linked-image eligibility are especially absent. No V2/V4/V5 end-to-end, Electron, native mobile, or transport execution claim is supported.
4. Independent capture rebuild is partial, not exact. Own tab on existing localhost:7886, 390x900 light, DPR2, shared fixture, @link shows the same four rows and kind icons. Against after-V1-390-light-alias-a.png: 5,032 exact changed pixels, 4,255 above RGB16 = 0.303062678%, exceeding 0.1%. Amplified diff localizes all changes to send-button appearance: auditor used restricted scopes and the connection cannot change threads. All pixels outside that button match exactly. This is a known permission/environment difference; no whole-frame pass or post-hoc masked acceptance is claimed. Against recording-extracted frame: 157,031 exact and 5,499 threshold pixels (0.391667%), additionally affected by lossy encoding. Exact rebuild requirement remains INSUFFICIENT.

## Inspection and provenance

Inspected all 16 raw recordings through one-second filmstrips; all 36 extracted retained stills through five contact sheets; all 16 raw, 16 amplified8x and 16 threshold diffs through their labeled contact sheets; individual full-size composer examples and independent rebuild residual. Sampling verifies the visible interaction milestones but does not prove every intermediate frame or keyboard event. Combined labeled recordings were produced by the capturer; their complete encoded output was not independently replayed by this auditor. Thus exhaustive every-file playback/inspection remains partial, explicitly not claimed.

Final capture procedure/index names the correct requested base and head, superseding its earlier stale plan. Lead expressly authorized the capture checkout after its own final-head test verification. Capturer states same fixture throughout; watcher reloaded server after revision switch. Desktop native recordings are 2880x1800 for 1440x900 CSS; desktop tool screenshots scale to 1280x800. Responsive recordings/tool screenshots are 780x1800 for 390x900 CSS. Chromium154 Linux, DPR2, zoom1, system font stack resolving to Liberation Mono, fonts.ready awaited. Reduced-motion media emulation unsupported; injected CSS freezes animation/transition/caret/smooth scrolling and does not reach shadow roots.

What else changed during capture: revision and watcher-driven server reload, draft query/insertion/clearing, selected result/focus, theme, viewport, hidden sidebar, panel state (desktop light Files maximized, dark inline), responsive code explorer hidden for preview, breadcrumb and encoding raster. Alias additions and taller result lists are intentional. No production UI source, fixture contents, provider turn, or native client was changed by this audit. Worktree diff contains only five server workspace implementation/test files.

Independent read-only runtime transcript (independent-rpc.json) confirms eight lexically ordered flat entries, three aliases once with correct kinds, no directory-link recursion; directoryPath listing returns only pkg/src. Empty/nonempty mixed/file/directory searches include/exclude kinds correctly on this fixture; nested lookup succeeds; limit1 truncates; imageOnly rejects TS. Runtime replies are small-fixture observations, not general ranking/boundary proof.

## Row statuses and pending proof gates

- V1: PARTIAL, four before/after variants present, alias/kind/path/insertion milestones visible; pixel stability/control gates remain open. @index intentionally gains index-link.ts and cannot serve as unchanged whole-results control; ordinary @deep was retained but selected-row state differs in some pairs.
- V3: PARTIAL, four pairs show search, nested discovery, index-link.ts target export {} preview and return to ordinary listing; strict settled/control/provenance of every encoded comparison file remains partial.
- V2: PARTIAL service eligibility only; UI not executed or claimed.
- V4: PENDING exact basename/case/ambiguity and repeated-prefix literal-original-exists precedence proof; file-only eligibility alone insufficient. Markdown click not executed or claimed.
- V5: PENDING linked PNG inclusion, directory .png exclusion and filter-before-limit with aliases; TS rejection only. Thumbnail/persistence not executed or claimed.
- D1: PARTIAL root/nested unique target kinds, ancestors and lexical small-fixture list proven; max-entry/boundary/truncated contract pending.
- D2: PARTIAL mixed/file/directory empty/nonempty, duplicate kind correction, limit1, TS image rejection proven; linked PNG, directory .png, normalization/no-match, exact-vs-fuzzy/general merge ranking, boundary and incomplete-index truncation pending.
- D3: PARTIAL ignored/outside, tracked links, .ignore precedence, submodule and whole-name/folder rules tested. No-match fallthrough, nested repository ownership rules, outside-git/git-failure policy, allowed-alias-to-ignored-target, no traversal, sibling-prefix/broken/cycle/.git/special-target exclusions remain incomplete assertions.
- D4: PARTIAL five matcher tests pass including positive/negative adversarial and unclosed-class cases. CRLF/trailing escaped spaces and broader malformed/literal escape controls remain pending; no measured scan performance claim.
- D5: PARTIAL fake-watcher shared scan/cache/replacement and late subscription covered; real fff awaited delivery, explicit refresh, remove/rename/retarget, ignore-file modification, in-flight invalidation and incomplete scan proof pending for search/list.
- D6: PARTIAL 0/25002 paged discovery, nested alias/ancestor and missing directory tolerance covered; empty/short/exact-full termination and duplicate boundary cases pending.
- D7: SUFFICIENT within scoped unchanged construction/content-search/directory-list boundary; 34 passing focused tests accepted from final-head log and lead confirmation. No broader native/content-symlink search claim.

## FRICTION

The matrix URL failed in web reader; curl retrieved it. New own tab needed a fresh restricted isolated grant and full reload before pairing; capturer tab was never operated. Scope difference explains send-button rebuild delta. No server was started/stopped. Upload batch failures are being retried by capturer; this audit does not assert public completeness before the ready marker. Capture/fixture/processing scripts must remain uploaded and uncommitted; final index contains their inventory. Missing assertions are pending proof gates, not unsupported code blockers. An unmerged PR with these gates stated is consistent with this verdict; a blanket proof pass is not.

VERDICT: INSUFFICIENT — V1/V3 pixel and exhaustive artifact inspection gates, exact rebuild, V4/V5 logic gates, D1–D6 remaining assertions, final public artifact completeness.