# Final proof audit, pass 2

**VERDICT: INSUFFICIENT R2, R3, R4, R5, M1.** Evidence missing; do not certify merge readiness. This is a proof verdict, not a newly discovered code blocker. R3's residual is an audit/provenance linkage limitation, not a demand to repeat all empty-state captures.

Read-only audit of replacement [#24583](https://github.com/pingdotgg/t3code/pull/24583), replacing original [#19570](https://git.cafe/pingdotgg/t3code/pulls/19570). Only checkout `/home/ubuntu/wt/pr-19570`: head [e810a33cf8](https://github.com/pingdotgg/t3code/commit/e810a33cf8114e5c4e76eeffe8ea299ef8466b71), base [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). Final checkout clean. All 12 changed paths read. No source edits, commits, pushes, PR comments/body edits or watchers. No live userdata access. The replacement is registered with this thread and unwatched.

## Findings first

1. **Seven round-2 accepted pairs violate identical fixture data.** Base says `Cached recovery conversation · replay`; head says `Cached recovery conversation`. Three desktop pairs visibly change title/sidebar; four narrow pairs hide the difference through truncation but still have different data. Correct masks do not make these matched fixtures. Exclude these seven from clean-pair credit:
   - `R2-apply-valid-cache-failed`: 390/light, 390/dark, 1440/dark.
   - `R2-apply-valid-cache-session-recovered`: all four combinations.
   The remaining failed 1440/light pair is matched. These are evidence defects, not demonstrated PR regressions. The handoff's “what else changed” list omitted the title differences.
2. **R4 bounded-history and R5 race/disposal/isolation proof remains absent.** A gated snapshot/session replacement proves one path, not buffered failure ordering, real scope disposal, or interrupt cancellation. Unit tests and reviewer MERGE opinions cannot replace these observations.
3. **M1 has no native capture.** The [native follow-up](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0268bc4b226ae51d/native-r2-audit.md) reports development build reached Gradle but produced no APK within the window; cancellation confirmed. Bundle preparation is not native proof. No native accessibility, tap, precedence, or recovery certification.
4. **Fresh independent recapture failed and is excluded.** See FRICTION below. Prior independently recreated R2 remains **0 differing pixels** per the [prior audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/38116deeb7ed1b2a/audit.md). There is **no valid new pixel delta**; it is not zero.

## Row status and exact minimum remaining

“All four” means 1440×900 / 390×844, light / dark. Do not repeat unaffected protocol/style combinations unnecessarily.

| Row | Audited usable proof | Minimum remaining affected proof |
|---|---|---|
| R1 | Sufficient with carried-forward first proof and new real replay, held fallback, recovery, reconnect/reload in all four. Real metadata replay precedes injected Die. | None. |
| R2 | Terminal two-attempt hold, trusted same-scope foreground recovery, and new-session recovery in all four. Alert role/icon and retained message verified. Apply failure/recovery traces show same retained cursor on replacement session; one clean apply-failed pair. | Repair the seven exact fixture comparisons listed above, or explicitly withdraw those comparisons and supply a clean matched apply-error→session-recovery chapter with the shared four-layout state mapping. Do not relabel the current seven as matched. No need to repeat already valid terminal/foreground/session chapters. |
| R3 | Round 2: no-detail first Die/recovery, empty failed/ordinary all four, most syncing/recovered gates. Latest three still pairs independently opened and masks checked: syncing 1440/light and dark; recovered 1440/light. | Finish temporal/per-gate provenance audit of the latest three pairs. Their six new movies were not audited here; original head per-load manifest was overwritten. Retained source content is exact, but original load timing was not reconstructed. No blanket new capture request. Dark recovered retry can share the already captured successful empty recovery presentation; its unstable duplicate receives no credit. |
| R4 | Legacy=false held/recovered 390 light/dark, real snapshot without completion marker. | Bounded recovery preserving flags/history metadata, Load earlier, no duplicates; a full-snapshot fallback protocol chapter. Warm/cold branches must be identified in trace. One shared layout fixture across all four for genuinely different history presentation; protocol flags do not require a new styling Cartesian matrix. Missing legacy desktop duplicates alone are not an additional render-path gap. |
| R5 | Old fallback gated→replacement session remains cursorless→snapshot applies, 1440/light. | Buffered old-resume Die vs new makeInput; buffered terminal snapshot Die vs replacement session; actual A scope disposal while gated, B isolation, old gate release/revisit, interrupt-only cancellation without revival. Retain ordered trace and recording. Existing sync/error/ready four-layout proofs can cover shared status rendering; the missing other three copies of the simple session-change chapter are not independently distinct render paths. |
| C1 | Sufficient as protocol/control chapter mapped to already captured renderer states. Typed expected failure retries cursorless after **251.4ms** in both narrow themes, then recovers; actual authorization Fail makes one subscription, no Die retry. | No distinct missing desktop rendering: expected retry uses the same sync/ready path as R1, authorization the same generic failed path as R2, already covered in all four. Do not claim direct C1 desktop captures exist. |
| M1 | Unverified native. | Actual native base/head failed cached-content pill, no press handler/button accessibility role, successful recovery, existing actionable connection control, creation/connection/content precedence chapters. Native client required; 390 web cannot satisfy this. |

R2's raw matrix comparison repair is retained conservatively because its explicitly requested malformed applyItems chapter currently lacks a clean matched recovery pair. It is not a request for another new visual fixture family.

## Source-based collapses

The [shared runtime](https://github.com/pingdotgg/t3code/blob/e810a33cf8114e5c4e76eeffe8ea299ef8466b71/packages/client-runtime/src/state/threads.ts) changes resumed-Die classification, forceSnapshot lifetime, error publication, failed-session identity and interruption handling. Therefore R4 forced bounded/full entry and R5 ordering/disposal cannot be dismissed as untouched behavior. Existing protocol options themselves are unchanged; width/theme do not branch this logic.

[threadSync](https://github.com/pingdotgg/t3code/blob/e810a33cf8114e5c4e76eeffe8ea299ef8466b71/apps/web/src/threadSync.ts) still returns null for missing shell and deleted/live before any new failed label. Draft/no-shell and deleted/live labels are unchanged controls, not new fixture families. ChatView's failed phase and loading/syncing-only timeline presentation are affected; genuinely empty/no-detail chapters remain separate. Settings/palette/keybindings navigate to this same consumer. Desktop has no changed Electron path, so web proves its renderer; no extra Electron capture obligation. No server/contracts/provider-adapter changes; no new provider multiplication or relay/tunnel certification.

Mobile changes are real separate render paths in ThreadRouteScreen, ThreadDetailScreen, floating-working-status and floating-working-control. The failed ready-content connection pill and optional onPress/accessibility behavior cannot collapse into web.

## What was actually inspected and verified

Round 2: **all 78 candidate pairs**, **312 PNG stills** including exact 500ms settlement copies, **156 masks**. Opened every base/head/full-diff pair through 78 independently generated inspection sheets (both thresholds), not only a DOM summary. Settles are byte-identical copies, verified for both sides of every pair. Independently recomputed all RGB max-channel deltas and both mask arrays: every mask and reported count is exact. After fixture exclusions: **71 clean new pairs**, not 78. The prior first 24 pairs remain carried-forward proof, not claimed as freshly recaptured in this pass.

Round-2 loaded-source checks: **610 retained provenance entries**, including repeated loads, rehashed and inline `sourcesContent` compared exactly to `git show` at the stated SHA. This is five distinct changed web/runtime files per side, not 610 distinct modules. Base uses retained Vite transforms; head uses actual Vite responses. Synthetic fault injection is at the RPC stream boundary; no atom/React state substitution is credited. This does not reproduce the original reported production interruption.

All four round-2 MP4s independently fully decoded, exit 0, no ffmpeg errors. Extracted **681 frames** at eight-second intervals and opened all 37 generated contact sheets across the whole recordings; no continuous human-playback claim. Correlated accepted gates with detailed subscription/render/visibility traces. Setup/splash, resizing, sidebar opening, rejected fixture drift and brief host-load overlays exist in movies and receive no accepted-gate credit. No new clipping/overlap anomaly observed in accepted stills.

R1 head cursors by (1440 light,1440 dark,390 light,390 dark): S=(50,60,67,42), actual replay=(56,63,74,47), fallback snapshot=(57,64,77,48), reconnect=(59,66,77,48), reload=(59,66,78,50). Later metadata advances explain reconnect/reload greater than snapshot; not a return to S. New R1 phase traces show sync→ready, no failed phase. R2 trusted foreground has genuine trusted hidden→visible events and sessionId 0 retained; third subscription is cursorless. Terminal pre-session gates remain at two attempts. C1 expected retry measured 251.4ms, both attempts after the initial cursor are cursorless.

Latest round-3 supplement: opened all three pairs with both full masks; 12 settlement stills and six masks exact. All ten retained source responses independently match the two commits and published response hashes. Results: recovered 1440/light 24,855 RGB pixels / 2,952 >16; syncing 1440/light 144 / 0; syncing 1440/dark 0 / 0. Sidebar delta zero. Partial overwritten manifest and unaudited new recordings remain explicit limitations. Rejected dark-recovered duplicate not credited.

Actual file lists, hashes, inspection-sheet locations and credit decisions: `inspected-files.json` (468 round-2 still/mask paths), `video-inspection.json` (four movie hashes, 681 extracted frames and opened sheets), `round3-validation.json`, `new-exclusions.json`. `gate-summary.json` retains reduced ordered events; `gate-movie-locations.json` gives every round-2 gate's epoch and recording offset. Full original traces remain in the linked delivery.

## Every visible change

Accepted recovery removes Syncing spinner/label and its banner area; terminal errors replace it with alert icon/text. Composer border, shadow and antialias pixels change with these states, including sub-threshold deltas. Empty-state center text changes vertical position when the timeline stops owning a syncing placeholder. Genuine cold failed phase shows ordinary empty conversation text instead of the loading placeholder, without invented messages. These are attributable to the changed sync-phase/timeline ownership. Small send-button spinner/antialias phase differences are captured in the zero masks and are not hidden or asserted as regressions. The seven title fixture mismatches above are additional unrelated data changes and are excluded, including four visually truncated narrow cases. No “nothing else changed” claim.

## Independent reproduction output and FRICTION

Attempt used uploaded round-2 driver/injector and an isolated copied synthetic fixture home, fresh browser profile, Chromium 1223 headed/Xvfb, DPR1, no device emulation, frozen clock, reduced motion and equal CSS suppression. No live userdata. Commands and results retained in `independent-trace.json`; final one-shot `independent-direct.mjs` failed with **`page.waitForFunction: Timeout 60000ms exceeded`** before the required expected-failure three-subscription gate. No valid new held/recovered capture was produced, so **new independent pixel delta: unavailable**. Prior R2 independent result: **0 pixels**, carried forward only.

The later gap handoff disclosed that both workers used **CDP9231 / X display :231** concurrently. My attempt did not preflight that shared namespace; the observed browser moved to the other worker's 14334 origin. Isolation was not reliable, so all new independent-attempt screenshots are excluded. This may also explain interference with the other capture worker, but causal attribution of its auth loss is not proved. Do not infer a PR bug or an independent success from this attempt. Future recapture needs reserved unique ports/displays and independent pairing. CPU stalls were also observed; not treated as feature behavior.

Stopped own captured process groups (dev, Xvfb, Chromium, driver, controls, ffmpeg). Every recorded PID absent; own 22373/14333/9231 listeners closed. No pattern kills. Private browser/home/cookies/startup logs excluded from publication. Source remains clean. No new tests run; reported 40 sync tests/reviewer MERGE results are supplemental and not recertified here.

Audit produced with GPT-6.1-sol through Codex. Uploaded using the ghdrop skill. Final bounded result: **VERDICT: INSUFFICIENT R2, R3, R4, R5, M1.**