# Final proof matrix — pass 1 delta v3, [#18465](https://git.cafe/pingdotgg/t3code/pulls/18465)

This is a finalized capture specification and read-only source audit, **not executed visual proof, a completed browser audit, or a merge verdict**. No server, browser, repository edit, checkout, push, comment, or watch was performed. This delta pass performed source inspection only; prior Node probes and seed syntax checks are historical evidence identified below. The user has already explicitly authorized future headed Chromium/Xvfb/ffmpeg capture; no separate capture permission is needed. This pass intentionally performs no capture.

Target: [#18465 on GitCafe](https://git.cafe/pingdotgg/t3code/pulls/18465), [#18465 on GitHub](https://github.com/pingdotgg/t3code/pull/18465). Original: [OSSystems/t3code branch](https://github.com/OSSystems/t3code/tree/fix/offline-launch-keeps-connect-envs), [10b6f65b08](https://github.com/OSSystems/t3code/commit/10b6f65b086f70b4d6b250cea5a693d479fbe335), full SHA `10b6f65b086f70b4d6b250cea5a693d479fbe335`.


## Authoritative v3 delta — supersedes conflicting historical expectations below

Read-only source delta audited at full head `65637ec020438e9bf200645d36910374f3870279` against previous after [8c3f2e14e2](https://github.com/pingdotgg/t3code/commit/8c3f2e14e2269e1a0c75deb4b48eea1304eedbc8), plus full production diff against pinned before. HEAD matched and worktree was clean at inspection; mergebase remains pinned before. This is the r5/source remediation delta, not a new browser run. No standalone artifact named r5diff was found; the exact Git revision diff was read directly.

The guard was already correct. ManagedRelayAuthProvider mounts outside AppAtomRegistryProvider; its old useAtomCommand consumed the default RegistryContext while AppRoot's routed UI reads appAtomRegistry. Supplied remediation telemetry reports persisted target count 2 while the app retained five catalog entries/rendered relay ghosts with advancing Date and no registry interception. Those ghosts are genuine preexisting behavior, not timing instability to suppress. The new explicit registry dispatch fixes live cleanup without adding a renderer, layout, auth branch or transport. Its focused test now asserts that registry argument; tests were not run here.

**D below means persisted deletion, with a distinct live milestone.** On BEFORE, persist D can coexist with live ghosts until reload. Record both, retain that genuine before result, and then show reload hydration. Do not force a registry rebind, reseed, suppress rows, freeze transition time, or wait for an invented pre-reload deletion. On AFTER, A3–A7/V1 must show live relay-only removal and mixed direct-only survival once the real cleanup command settles, continuously before reload, then persisted/reloaded agreement. Immediate in-flight frames are not the settled milestone. Reload alone cannot pass after live cleanup. Cold authoritative no-session and only-relay empty-state chapters follow the same rule. A4's final unresolved-to-signed-in path preserves; the before unresolved phase may already persist deletion and show ghosts.

**Correct actual SDK provenance, supplied addendum (not independently rerun):** intercepted standard-browser Clerk 6.40.0 + simulated navigator offline → loaded/degraded/client_init/no session; navigator online + unreachable environment/client → loaded/ready/no-ID/no session. These are the measured pairings. Actual SDK does not mean live Clerk service or browser-native offline. Complementary ready/no-ID, degraded/client_init and cold degraded/no-ID harness cases are allowed, explicitly labeled. Source-only cookie/JWT fallback analysis is not executed JWT proof; rename the harness case “signed-in hook + placeholder control.” Actual bootstrap401 remains loading/not-loaded and preserves; valid no-session200 ready/client_real deletes. Actual live service, OAuth/account switching, Connect transport, and signed-in SDK refresh401 → sign-out remain unverified and must be disclosed.

**Inventory stays exactly eight combined recordings:** before/after × 1440×1000/390×844 × light/dark. A1–A8/V1 remain chapters in those cells; no new renderer or concrete missing behavior warrants more recordings or restored V2–V5 tours. Old-head after media cannot certify this head's live-removal correction. Existing before evidence may remain if its exact SHA, chapters, truthful provenance and continuous milestones are valid; no requirement to recapture a genuine ghost away. Concurrent capture agent owns `/tmp/ev-18465`; this pass writes only the separate v3 matrix and does not alter its files. Pass2 must check final-head manifest/build identity and settled live UI + IDB, not infer success from this source audit.

Additional FRICTION: **REGISTRY-BOUNDARY** — prior matrix treated cleanup as unchanged; it now changes live UI, not the route-removal algorithm. **BEFORE-GHOST** — expected diagnostic evidence, not a passing after result or a reason to manufacture stability. **SDK-PROVENANCE** — swap the old environment/state pairings to measured outcomes. **HEAD-STALE** — replace old after SHA throughout and obtain new-head after evidence. **LIMITS** — media/capture completion, live service and refresh401 remain unverified. No repo edits, server, browser, tests, push, comment or watch in this pass; only local matrix writing and authorized public upload.

## Pinned revisions and complete scope

Read-only checkout `/home/ubuntu/wt/pr-18465`, branch `takeover/pr-18465`, clean when inspected.

- Before: [76da264a0c](https://github.com/pingdotgg/t3code/commit/76da264a0ccaeff5fa88bcb5cfada1be6ae320c4), full SHA `76da264a0ccaeff5fa88bcb5cfada1be6ae320c4`. This is the requested main snapshot and verified mergebase with after; the historical v2 report recorded local main at `07d38b8d17167c8d17fba1184dbe13a307fada74` (not rechecked here). Do not substitute moving main.
- After: [65637ec020](https://github.com/pingdotgg/t3code/commit/65637ec020438e9bf200645d36910374f3870279), full SHA `65637ec020438e9bf200645d36910374f3870279`.
- Supersedes [prior draft](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a8b23ed4ed523d3a/to-18465-matrix.md), which inspected [2f0715672a](https://github.com/pingdotgg/t3code/commit/2f0715672a8b4264763be9f392256411076b2609). Old after captures cannot stand in for final after.

The full pinned before...after diff was read in this delta: exactly three files, +201/-11. [managedAuth.tsx](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/cloud/managedAuth.tsx) +27/-11; [managedAuth.browser.test.tsx](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/cloud/managedAuth.browser.test.tsx) +173; [vite.config.ts](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/vite.config.ts#L305) +1 adds managedAuth to the existing `t3code/no-rpc-permission-bypass` raw-client-access lint allowlist. That allowlist is lint configuration, not an access grant or runtime permission change.

Production change: first signed-out-looking boot remains unresolved until `Boolean(clerk.client?.id) && clerk.client.id !== "client_init"`. There is **no Clerk status prerequisite**. `useSyncExternalStore` subscribes only through `clerk.addListener`; the status-event subscription is removed. Once an account has been observed, loss of that account still triggers cleanup without resolved-client evidence. `!isLoaded` still exits early. Cleanup now explicitly dispatches `runAtomCommand(appAtomRegistry, environmentCatalog.removeRelayEnvironments, undefined, { reportFailure: false, reportDefect: false })`. Token reset, activation ordering, token acquisition, RPC access checks, and the route-removal algorithm are unchanged. The provider still returns `children` directly: no new layout, loading gate, banner, dialog, or child render branch.

Delta from [4deb386fa8](https://github.com/pingdotgg/t3code/commit/4deb386fa8e66ef78ce8a2b4322dd43e06d5f67c): the old ready-plus-ID assumption was wrong. Reviewer A reproduced degraded/`client_init` → real no-session client hydration → still degraded/`client_real`, with resource listeners firing. The previous guard would preserve indefinitely on that path. Final code excludes the placeholder ID and accepts real client hydration regardless of status. Installed Clerk 6.40.0 has **two** `client_init` constructions in its session-cookie fallback: one with no usable JWT and zero sessions, and one populated from JWT session claims. Offline-null fetches can instead leave an id-less client. Both placeholder and id-less states are unresolved; do not equate a truthy ID alone with API confirmation.

A non-placeholder client ID is this implementation's evidence of resolved initial resources, not an attestation of a fresh network response on every notification. Reviewer A's reproduction is supplied provenance, not independently rerun in this delta pass; actual browser outcomes remain capture requirements.

## Minimum evidence set

Use **Connections settings plus actual catalog persistence**, without sidebar/palette/discovery tours. This is the shortest observable path from the provider's cleanup decision to retained or removed saved routes. Show mixed routes expanded at relevant milestones. Direct-only and primary controls share the same screen.

Every affected row A1–A7 and V1 requires before AND after × **1440×1000 and 390×844 CSS px** × **light and dark**: eight cells per row. Include A8's unchanged controls as chapters in these same cells, with no additional visual inventory. Chromium web, Linux/Xvfb, DPR 1, no desktopBridge, fixed palette, extensions off. Width 390 is responsive web, not native mobile. Record actual browser/version, do not assume one installed now.

**Exactly eight combined recordings total**: one combined, chaptered recording per revision/width/theme cell. C1–C3 below are chapter groups, not a requirement for separate files. Keep resets as labeled chapters/cuts inside those eight deliverables; do not multiply the required files. New contexts between independent scenarios may appear as clearly labeled cuts; continuous transitions, cleanup ordering and reload must not be cut across the milestone being proved. Label resets so a fresh seed cannot masquerade as persistence. Use headed Chromium with ffmpeg x11grab as in the draft; record viewport and recorder settings. All interaction rows require recordings. Optional before/after stills extracted from these recordings aid review but add no mandatory cases.

Record a sanitized telemetry sidecar for each chapter: actual SDK/harness lane, online flag, status, client ID or absence, hook loaded/signed-in/user, managed account, cleanup start/finish, and pre/settled/reloaded catalog target IDs and routes. No token or cookie values. UI screenshots alone cannot prove account isolation, token reset or IndexedDB persistence. Await state/transaction milestones rather than guessed sleeps.

## Final behavioral matrix

Expected outcomes below are source-derived until captured. P = preserve the seeded relay and direct routes; D = remove relay routes, delete relay-only environments, keep mixed direct route and direct-only control. Neither P nor D implies a working connection.

| Row | Trigger / required chapter | Before → final after expectation | Smallest proof / provenance | Group |
|---|---|---|---|---|
| A1 | Fresh actual SDK boot with simulated navigator offline; Clerk fetches fail; observed loaded/degraded, no session, **client_init**. Complementary ready/no-ID boot is HARNESS AUTH STATE | D → P; managed session null in both | Connections + expanded mixed routes + IDB after settlement and reload while still in the same offline condition. Record actual SDK state and requests; do not inject `ready` and call it actual offline SDK proof | C1 |
| A2 | Fresh actual SDK boot, navigator online, unreachable Clerk; observed loaded/**ready/no-ID**, no account. Complementary degraded/client_init and cold degraded/no-ID are HARNESS AUTH STATE | D → P while unresolved. A degraded **real non-placeholder ID** is authoritative and deletes in both; status is not a prerequisite | Same view/catalog checks as A1. Report observed SDK state; error/not-loaded belongs to A8. Include both installed SDK placeholder variants as source/fixture controls, without claiming the JWT-populated variant is signed out. Harness degraded logic must be labeled if real degraded provenance is unavailable | C1 |
| A3 | HARNESS ready/no-ID → ready/real-ID/zero sessions; HARNESS degraded/client_init → degraded/client_real/zero sessions, **resource-listener-only notification, no auth rerender/remount**. Separate authoritative cold no-session real-ID boot, ready and degraded | Both eventually persist D; before may retain live ghost rows until reload, after must remove them live after cleanup settles. Before already persisted deletion in the unresolved loaded phase; after defers until real client hydration. Cold real-ID/no-session deletes in both regardless of status. Repeated resource notifications do not repeat cleanup | Expand mixed routes before hydration: after goes two routes → direct only. Fresh only-relay cold chapter reaches no-saved-remotes. Record unchanged status/auth-hook values and resource callback delivery. Status-only changes with no ID or client_init preserve on final after (before already deleted) and are a negative control, not a recovery path; real-ID status-only changes add no cleanup | C1 |
| A4 | Offline unresolved boot → signed-in A; loading/no-account and cold signed-in A controls | Before may have already D, final preserves through unresolved boot and activates A without cleanup. Cold A and initial unloaded state preserve in both | Retained saved rows, persisted routes and managed account timeline. Do not require discovery or tunnel success. Deterministic signed-in transition may be HARNESS AUTH STATE; recovery from actual A1 must be clearly marked at lane handoff | C1 |
| A5 | Observed A → explicit signed-out state; separate observed A → refresh HTTP401 → actual SDK hook becomes loaded/signed out | Persist D in both after account loss; before live ghosts are accepted as the preexisting defect, after must settle to live D before reload; managed session null, existing token-reset path unchanged | Real catalog removal, mixed-direct survival and reload. Repeat notification is no-op. Refresh401 only proves SDK sign-out if hook transition is observed; harness sign-out is provider-only coverage, not evidence of SDK401 behavior | C2 |
| A6 | Observed A → B with cleanup deliberately held/released | Both deactivate A, wait for cleanup, activate B after completion; stale A must not reactivate. Before can retain live ghosts despite persisted D; after must settle to live D before B activation/reload | Same Connections view plus managed-account and cleanup milestone telemetry; instrument/gate the real cleanup completion, never replace removal with a no-op mock. Fresh seeded context for this chapter. Loading interlude and rapid A/B cancellation are nonvisual controls sharing this fixture, not extra product tours | C2 |
| A7 | Observed A → loaded/degraded signed-out-looking state → ready signed out; same-account degraded/ready signed-in A control | Persist D in both upon observed-account loss, even if degraded/no-ID; before live ghosts are expected preexisting behavior, after live D is required after settlement. Later confirmation does not repeat cleanup. Same signed-in A must not clean routes | Separate chapter/timeline from cold A2; reuse deletion view. A → unloaded → loaded signed out does nothing while unloaded and cleans when loaded. Do not describe final guard as preserving all degraded states | C2 |
| A8 | Cold bootstrap HTTP401; separate valid no-session client HTTP200 | Actual error/not-loaded bootstrap preserves in both; status401 alone proves neither loaded nor cleanup. Valid non-placeholder client-ID/no-session deletes as A3, even if degraded | Real SDK lane must report actual status and catalog. Blank/loading/error UI is boot evidence, not signed-out deletion evidence. Share C3 recording space with cold A3 reference; do not fabricate SDK outcomes | C3 |
| V1 | Shared presentation of all above: enabled relay-only, disabled relay-only, disabled mixed direct/relay, disabled direct-only, long label; only-relay empty state | Presence/routes differ in A1/A2 and now live cleanup A3–A7: before can show ghosts with persisted deletion, after must show settled removal; styling and actions unchanged | Connections screen at required widths/themes, expanded mixed route detail, focus/scroll needed to inspect it, and reload. No permissions/diagnostics/menu/tooltip/update/removal/drag tours unless necessary to expose actual route state | C1–C3 |

C1 = unresolved boot, resource-only hydration at unchanged ready/degraded status, authoritative cold/recovery controls; C2 = observed account loss/switch controls; C3 = bootstrap401 distinct from resolved signed-out and refresh401. Chapters can share visible end states; event and catalog assertions cannot be silently merged. A1/A2 change unresolved-boot persistence. The new registry dispatch also corrects live cleanup in A3–A7/V1. A3 prevents permanent preservation; A4–A8 retain their auth semantics, with live cleanup now corrected where deletion occurs.

## Explicit disposition of every draft row / reel

| Draft item | Final disposition and reason |
|---|---|
| A1 | Retained; actual simulated-offline degraded/client_init preserves on after; complementary ready/no-ID is labeled harness |
| A2 | Retained; actual online-unreachable ready/no-ID preserves on after; degraded harness controls and error/not-loaded remain distinct |
| A3 | Retained and corrected to resource-only hydration at unchanged ready or degraded status. Obsolete degraded/real-ID → ready status-only recovery is removed: real ID already resolves while degraded. Status-only placeholder/no-ID is a short negative control in the same chapter |
| A4 | Retained as a short Connections/managed-account recovery chapter; discovery screenshots removed because activation does not prove discovery connectivity |
| A5 | Retained; explicit sign-out and refresh401 remain distinct, actual SDK vs harness labels mandatory |
| A6 | Retained ordering chapter; rapid switches/loading are nonvisual controls, not extra width/theme tours |
| A7 | Retained; final code still cleans after an observed account, including degraded account loss |
| A8 | Retained unchanged bootstrap401 control; never substitute it for authoritative no-session or refresh401 |
| V1 | Retained as shared Connections presentation; removed diagnosis/retry, permissions/overflow/hover tours because their handlers/render conditions did not change and do not distinguish cleanup |
| V2 / C4 default sidebar + selected chat/banner | Removed from mandatory captures. Indirect catalog/cache consumer, no modified renderer. Connections plus real IDB proves the changed persistence decision without inventing thread fixtures. No claim of visually verified cached-thread continuity, banner timing or navigation fallback |
| V3 / C4 legacy sidebar | Removed. Alternate unchanged renderer adds no distinct proof of provider cleanup. Native/mobile drawer behavior and legacy styling are not claimed verified |
| V4 / C5 palette and Settings scope | Removed. Same persisted catalog feeds unchanged consumers; palette searches, scope choices and reconnect notices do not add an independent auth decision. No claim these downstream flows were exercised |
| V5 / C6 Connect discovery/dialog | Removed. Session/discovery rendering is unchanged; requires substantial synthetic relay fixtures while adding no proof of actual saved-route persistence beyond Connections. No claim of live discovery, Add/Add-route behavior or tunnel connectivity |
| C1/C2/C3 auth reels | Retained as chapter groups, folded into one recording per required cell; avoids multiplying files without removing logical coverage |
| C4/C5/C6 reels and cache fixture work | Removed with V2–V5; 48-recording draft becomes eight combined recordings. Shell/thread cache construction is no longer a prerequisite; no cache-preservation claim is made from empty stores |

The eight-recording scope remains valid after the registry correction. This is scope reduction, not a declaration that downstream consumers cannot be affected. Persistence has downstream consequences; this one-branch fix does not introduce new render paths in those consumers. Expand only if execution exposes a distinct regression that Connections/IDB cannot resolve.

## Caller / surface boundary audit

[main.tsx](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/main.tsx) selects [BrowserManagedAuthShell](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/components/clerk/BrowserManagedAuthShell.tsx) only for configured browser managed auth; it wraps the same application children in ClerkProvider and this provider. Missing cloud configuration skips the changed path and is not valid fix evidence. Electron selects its own shell; native mobile has separate auth. No Electron/mobile/provider adapter/contract/style changes: no OS/provider/native tours or agent turns required. Local and remote browser access use this same shell; no origin/transport logic changed. This plan verifies local browser catalog behavior, not hosted deployment or live relay transport.

[environmentCatalog](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/connection/catalog.ts) delegates through shared connection commands to [registry.removeRelayEnvironments](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/packages/client-runtime/src/connection/registry.ts#L980): select entries containing any relay route (including disabled entries), remove that route; retain other routes. [ConnectionsSettings](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/components/settings/ConnectionsSettings.tsx), saved rows and route details are representative direct observers. Primary/direct-only survive; loss of a relay route does not always mean environment deletion. No create-project, permissions, clone, update, preview, PR, account-profile, wizard or connected-provider tour distinguishes this guard. Reverse behavior is A3/A5/A6: eventual cleanup and account transition remain covered.

## Seed and reproducible capture prerequisites

Prior pass read the full draft and `/tmp/to-18465-seed-pass1.js` and syntax checked the seed with `node --check`. Seed is carried forward as public synthetic data; not regenerated, reuploaded, or revalidated in this delta. SHA256 `0f1d12cd2eb9e99d3c7242025289dc2570c6b70219e15149be17931841a7272f`. It is **not a capture driver**, not browser-exercised and not app-codec-roundtripped in this pass.

[Web storage](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/connection/storage.ts) uses actual IndexedDB `t3code:connection-runtime`, database version 4, object store `catalog`, key `document`, value **JSON string**. Other stores `shell`, `thread`, `server-config`, `vcs-refs` are created empty. Document schema version is independently 1. [ConnectionCatalogDocument](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/packages/client-runtime/src/platform/storageDocument.ts) uses targets, profiles, credentials, remoteDpopTokens, disabledEnvironmentIds, optional githubRoutingPermissions. Multiple targets with the same environmentId are routes, not nested route arrays. Primary is not a persisted target.

Seed modes: `mixed` = enabled relay-only + disabled relay-only + disabled mixed relay/direct + disabled direct-only, long label; `only-relay` = enabled relay-only for actual empty saved-remotes state; `empty` = fresh control. Credentials/tokens/grants empty. Direct profiles use loopback port 1, disabled, and prove survival only, not connectivity/authentication. No real user data or live credentials are needed.

Future runner must:

1. Arrange isolated before/after served sources at the exact pinned SHAs without editing this checkout. No server or alternate build prepared here. Record absolute source/build identity and identical config. Use isolated `/tmp` T3 home, no live userdata/secrets/profiles or migration; leave VITE_HTTP_URL/VITE_WS_URL unset and read actual ports. Validate runner flags against the checked-in scripts before use.
2. Enable browser managed shell using synthetic valid development publishable key, JWT template and secure relay public config satisfying [publicConfig](https://github.com/pingdotgg/t3code/blob/65637ec020438e9bf200645d36910374f3870279/apps/web/src/cloud/publicConfig.ts). Prove shell mounted. Intercept/abort external SDK/relay requests; no live account required. Production live keys reject loopback. Do not upload private config.
3. Fresh browser context for each independent scenario/cell. On the exact origin, intercept a blank same-origin bootstrap document, evaluate the seed function and await its IndexedDB transaction before importing app JS. Then navigate to `/settings/connections`. Reject existing catalog rather than overwrite. Never reseed on reload: doing so manufactures persistence. Decode/roundtrip the seeded document with the actual app codec during capture preparation, verify initial catalog accepted before auth settles. localStorage environment arrays/raw-object IDB writes are invalid; localStorage for theme preference is legitimate.
4. Actual SDK lane: installed Clerk, intercepted script/environment/client requests, observed navigator/loaded/status/client/session. Use the corrected measured pairings above. Permit app assets while offline; disabling all traffic before app load is not a usable offline-launch fixture. Record whether navigator offline is browser-native/emulated; a JS-only override is simulated navigator state and must be labeled. Online network failure requires navigator online. The measured offline/degraded, online/ready-no-ID and A8 bootstrap behavior must be reported as observed, not inferred from an HTTP code. Node bootstrap fixtures are leads, not proven standard-browser fixtures.
5. HARNESS AUTH STATE lane is allowed for deterministic provider transitions, including observed A/B and deferred cleanup. Replace only Clerk interface/state/event source; retain app renderer, registry, command and IndexedDB. Label every chapter and artifact. Existing repository tests mock removal/runtime, so their assertions cannot demonstrate actual persistence. Resource callbacks must be independently exercisable without remount or forced auth rerender, including unchanged degraded status; status-only changes must not manufacture resolution. Repeat notifications and same-account changes are milestone controls, not new UI tours.
6. Establish observed A before a refresh401. If a valid real signed-in SDK fixture is unavailable, run a labeled provider sign-out chapter and leave **SDK refresh401 → sign-out unverified**. Do not pass an injected hook state off as SDK refresh behavior. Likewise A/B harness auth does not establish account switching against Clerk's live service. No tunnel/DPoP success, token/access policy changes or live Connect validation is claimed.
7. Apply explicit light/dark and required dimensions. Inspect UI + settled/reloaded IDB, continuously record transitions and route-detail interaction. No new thread/project/cache fixture is necessary. Do not start provider turns.

## Evidence provenance and pass 2 acceptance

Historical v2 work: clean branch/head verification; full pinned before...after diff and incremental diff from [4deb386fa8](https://github.com/pingdotgg/t3code/commit/4deb386fa8e66ef78ce8a2b4322dd43e06d5f67c) read; installed SDK fallback source inspected. No tests or SDK probes rerun, and no browser/server started. Caller/config/storage/cleanup trace and seed syntax checking described elsewhere were prior-pass work, carried forward rather than repeated.

Six added browser tests cover placeholder degraded boot, ready/no-ID boot, resolved sign-out, resource-only hydration while still degraded, observed sign-out and held account switch. The new sixth test changes client_init to client-1, emits resource listeners only, and never calls screen.rerender for that transition; status stays degraded and auth hook values stay signed out/loaded. This specifically addresses the old suite's forced-rerender gap. Tests were source-read, not executed here. The latest delta mocks runAtomCommand rather than useAtomCommand and asserts the exact appAtomRegistry argument. This verifies dispatch selection at the mock boundary, not live removal. They mock removal/runtime, so they still do not prove actual SDK/browser network behavior, IndexedDB persistence or visuals. The other helper-driven transitions explicitly rerender. Do not claim resource-only ready hydration has its own independent test from that helper.

Supplied `/tmp/pr18465-repro/repro.mjs` uses installed Clerk 6.40.0 with `standardBrowser:false`, global mocked fetch and navigator. SHA256 `107a2bf15a7b2f6204d6228f64c166f9fec8b60ab2edcb3afb648016f4c9f4e2`. Prior-pass online rerun: `ready`, loaded true, null session, clientId `client_real`, zero sessions, two fetches. Prior-pass offline rerun: `ready`, loaded true, null session, clientId null, zero sessions, 22 fetches (intermediate loading ticks at 12 and 18 fetches). Both are synthetic Node SDK observations, not app/browser or live-service proof. The older `/tmp/pr18465-repro/out.txt` contains invalid-URL errors and is not a successful result artifact; do not use it as provenance for current outcomes.

This read-only delta created no driver, screenshots, video or browser results. Concurrent capture work and the supplied provenance addendum exist separately; their media were not audited in this pass. Final-head capture acceptance remains outstanding. Live Connect remains **unverified** even when harness application coverage passes.

Keep drivers/fixtures/telemetry/manifest/captures outside repositories, never commit them. Upload the exact runnable capture driver, synthetic SDK/harness fixtures and sanitized manifest **with captures** (reuse the existing public seed link below; do not regenerate or reupload an identical seed) via `ghdrop upload -m`; the seed alone cannot replay this matrix. Each manifest entry needs row/chapter timestamps, full SHA/build source, browser/SDK versions, width/height/DPR/theme, lane, online implementation, seed mode/hash, driver/fixture hashes and public links, auth/cleanup timeline, pre/post/reload routes and recording URL. No credentials, cookies, tokens, authorization headers or live data.

Pass 2 must inspect every required cell, reconcile timestamps with telemetry/IDB, and independently rebuild at least one changed A1/A2 capture with the uploaded driver on final after. Reject missing driver, incomplete cells or mislabelled harness as missing evidence; don't expand to removed product tours to compensate. No unresolved cache fixture blocks this reduced scope because cache continuity is no longer claimed. No PR comment/watch/push is authorized.

## FRICTION

Source fact concerns are explicit below: the prior status-ready prerequisite is obsolete; both SDK fallback placeholders use client_init; offline-null can have no ID; reviewer A’s resource-only hydration reproduction is supplied, not rerun here. No executed visual proof is claimed.

| Category | What | Avoidance |
|---|---|---|
| REVISION | Local main moved; draft after obsolete | Exact pinned before/after SHAs; don't substitute current main or old captures |
| SDK-OFFLINE | Ready can mean empty client after offline-null fetches | Require truthy non-client_init ID, no status prerequisite; record both status and ID; separate SDK/browser from Node/harness |
| LISTENERS | Real client can hydrate while still degraded; old ready guard stalls. New sixth test emits resource listener only | Resource-only hydration at unchanged degraded status, no remount/forced hook update; status-only unresolved negative control |
| AUTH-401 | Bootstrap401, successful no-session200, refresh401 after account differ | Separate chapters and actual hook timeline; no HTTP-only cleanup inference |
| SDK-DEGRADED | Reviewer A supplied degraded/client_init → degraded/client_real reproduction; not independently rerun here. Installed fallback has two client_init variants | Capture actual resource delivery and status; source-read placeholders are verified, browser reproduction remains outstanding |
| CONFIG | Cloudless boot bypasses provider; live key rejects loopback | Synthetic development public config and proof shell mounted |
| PERSISTENCE | Wrong storage/late seed/reseed creates false results | Preboot actual IDB JSON-string transaction, codec validation, no reseed on reload |
| ROUTES | Route removal can retain environment | Mixed/direct controls plus expanded routes and catalog snapshots |
| PROOF-TYPE | Still hides ordering/reload loss | Eight chaptered recordings, continuous milestones and sanitized sidecars |
| LIVE-CONNECT | No real signed-in SDK or tunnel fixture supplied | HARNESS AUTH STATE labels; live Connect and missing SDK401 behavior unverified |
| SCOPE | Indirect consumers inflate one-branch proof | Connections + IDB; explicitly remove C4–C6/V2–V5 with no downstream visual claims |
| REPLAY | Seed alone isn't runnable capture evidence | Publish exact driver/fixtures/manifest alongside captures; pass2 rebuild |

## Uploaded reproducibility artifacts

- [Unchanged IndexedDB seed](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dbc1617afecb3aab/to-18465-seed-pass1.js)
- [Exact supplied Node SDK repro](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a023c7d9114bc470/repro.mjs)
- [Sanitized independently observed Node results](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4e924e3c56b13006/to-18465-sdk-results.txt)

These are public synthetic artifacts. The Node repro is a runnable SDK probe, not the outstanding app capture driver. No screenshots or recordings were created or reviewed in this delta pass; supplied/concurrent capture artifacts are separate.