# Proof audit pass 2 — [#25360](https://git.cafe/pingdotgg/t3code/pull/25360)

## Findings first

**The supplied replacement proof package is sufficient for the pass-1 minimum at [d7a0e4276e](https://git.cafe/pingdotgg/t3code/commit/d7a0e4276ebe6dd2b9e7dbc0539f5dfb91d18943) against [5b15cfc1e8](https://git.cafe/pingdotgg/t3code/commit/5b15cfc1e8f37f33b1a7e25d02248da7d999f062).** No required settled capture has a duplicated element, stale overlay, loading placeholder, clipped result text, wrong viewport/theme, or unexplained application difference. Every required recording's visible result agrees with its narrated steps and supporting state transcript. No implementation defect is asserted by this proof audit.

**Publication gap:** the PR description read at audit start still presents the previous revision's Evidence section, including columns headed [4e493b1492](https://git.cafe/pingdotgg/t3code/commit/4e493b1492c295475e5c4d1b971677b1bd305960) and [7aa0dca2b0](https://git.cafe/pingdotgg/t3code/commit/7aa0dca2b039200c9d06c200c36b64c2cdd06bf5), older environment information and historical verification claims. Those are not proof of the supplied pinned head. Replace that obsolete material with the supplied [ready Evidence section](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4424dcdc02430565/ready-evidence.md), whose columns and links identify the correct head/base. The verdict here evaluates that supplied replacement and its [index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2a05e522a207eb9e/evidence-index.md); it does not certify the older PR-body package, current CI/reviews, or a later merge of main. I made no PR edit or comment.

The independent rebuild initially had extra Android 3G/signal pixels. Matching native radio/demo settings removed that mismatch. The final full native image differs by **six pixels, maximum channel delta 1**, all on the bottom Android navigation handle. There is **zero application-surface delta and zero pixels above 16**. No non-antialiasing mismatch remains. This normalization is documented below and in the uploaded replay notes.

## Required rows

All rows use Pixel 9, Android 16/API36 x86_64, portrait1080×2424, light, Hermes/React Native, logical411.428571×923.428571, DPR2.625, fontScale0.9399999976158142. R01–R06/H01 have native animations off; accepted H02 has animations on, as explicitly disclosed. R01 has matched base/head first and repeat pairs. Other rows are head-only under the supplied matrix and require no fabricated baseline/diff pair.

| Row | Status | Evidence inspected and result |
|---|---|---|
| R01 | SUFFICIENT | [Base recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/95a2e52f57f1b790/R01-before-light.mp4) opens blank on both plain re-entries; [head recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0328cc2fb44173a/R01-after-light.mp4) restores P1-RESUME on both. [Cold continuation](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5f0695a0fb1c9b7f/R01-after-persisted-final.mp4) relaunches, chooses P1, and ends in the visible P1 composer with P1-RESUME. The actual last decoded frame was checked, not inferred from Home's Unsent row. Both still pairs and all four diff images are clean and correctly labelled. Independent rebuild passes below. |
| R02 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ec30612c969fca64/R02-after-light.mp4), R02-P2.png and R02-after-light.png show P2-ONLY under Proof P2, then distinct P1-DECOY under Proof P1. Transcript identifies the targeted published route and P1 fallback. No foreign P1 content is claimed as a P2 restore. |
| R03 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a1eb2739bee1051e/R03-after-light.mp4) and all three stills show the actual project picker, P2 selection/restoration, editing CURRENT-KEPT, and retargeting to Proof P1 without losing CURRENT-KEPT. Final accepted capture is connected and has no stale picker/keyboard overlay. |
| R04 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/668c34f1a01dbf70/R04-after-light.mp4) visibly starts with newer NEWER-B and older OLDER-A rows, taps the real OLDER-A row, then shows OLDER-A in the composer. Final still is readable and clean. |
| R05 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f5dc107caaba72d0/R05-after-light.mp4) uses the labelled explicit branch route, shows branch preparation, then settles with proof-seed and empty Ask anything composer. The accepted still is the settled result, not the transient Switching branch screen. |
| R06 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c59ee4518e0716ab/R06-after-light.mp4), both stills and CDP observations establish the real StackActions.push, covered explicit A route and distinct C route. A holds new-task:mvr4w2k3-yuhbimvz; C selects older free B new-task:mvr4vv0l-o2gc05fu. C displays FREE-B, edits C-EDITED, and Back visibly restores A-HELD. The last decoded frame independently confirms A-HELD. The final Promise-metadata observer is correctly disclaimed and is not used as a binding assertion. |
| H01 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a8664948d39cf85a/H01-after-light.mp4), before/after stills and gate/CDP events show loaded=false while the real editor accepts CURRENT-BEFORE-LOAD, release at20:31:22.234173 UTC, loaded notification at20:31:22.635340, then loaded=true with the same current key/text. OLDER-SAVED appears separately after load. No UI-blocking sleep or injected composer content substitutes for this transition. |
| H02 | SUFFICIENT | [Recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fbfc124fbc61ef72/H02-after-light.mp4), both stills and gate/CDP events show genuine DocumentsUI selection of proof-red-circle.png. Failed early picker commands are explicitly marked; successful selection is visible later. Inline text is removed through the real editor before release. Current key new-task:mvr5j095-s9t27cwl, exactly empty text, attachment id and8503-byte SHA256 remain identical across loaded=false→true. The pre-release capture shows the intentional100% upload badge; the accepted post-release capture has a clean red-circle thumbnail and no upload badge. Release20:44:21.708281 UTC precedes loaded20:44:22.453736. No blank thumbnail or older-text swap occurs in the accepted retake. |


## Matrix rows without additional capture obligations

These retain their pass-1 dispositions; inspected assertions are not a claim that tests were executed in this audit.

| Row | Status | Basis |
|---|---|---|
| U01 | UNIT-TEST, inspected | Creation-stamp ordering; whitespace/settings-only filtering. |
| U02 | UNIT-TEST, inspected | Empty-text attachment-only candidate wins over older text. |
| U03 | UNIT-TEST / source-derived variants | No eligible/free candidate returns null; zero/ineligible-only variants use the same selector path. |
| U04 | UNIT-TEST, inspected | Exact environment/project, new-task kind, current and bound-key exclusion. |
| U05 | UNIT-TEST, inspected | Loaded gate, selected route project, once-checked gate. H01/H02 cover real effect/editor integration. |
| U06 | UNIT-TEST, inspected | Draft/branch/clone/share exclusion and worktreePath-only eligibility; R04/R05 add integration. |
| U07 | UNIT-TEST, inspected | Covered route key before flow write, live flow collection, pop/promotion/pruning. R06 adds actual stack/editor integration. |
| U08 | UNIT-TEST, inspected | Existing explicit binding none/open/pending/missing and stamped environment-loading cases. |
| U09 | UNIT-TEST / source, inspected | Picker settlement versus fallback and existing project-selection policy; R03 adds real picker integration. |
| S01 | SOURCE-ONLY | Inactive/null/uncreated-key branches have no added render state. |
| S02 | OPTIONAL, unverified | Model-less environment and scratch-project alternatives. |
| S03 | OPTIONAL, unverified | Long multiline/multiple-attachment and saved-settings layout extension. |
| S04 | SOURCE-ONLY | Route normalization/degenerate values; no runtime normalization-matrix claim. |
| S05 | SOURCE-ONLY | Inherited error/offline/permission/import/submission status surfaces. |
| S06 | OPTIONAL, unverified | Leave/switch-project during held read extension. |
| S07 | SOURCE APPLICABILITY / OPTIONAL | Dark, alternate dimensions, iOS and native entry extensions. No iOS, dark, web or desktop runtime pass is claimed. |

## Visual and recording inspection

I opened all **43 linked PNGs** in the replacement index:18 accepted result stills,4 diff images,19 current/earlier sheets,1 labelled comparison and1 real attachment fixture. The nine older immutable sheet uploads differ from later regenerated sheets of the same recordings; their existence is not substituted for checking the recordings. All10 accepted MP4s were independently decoded. I opened one-second frame grids throughout each clip, then extracted and opened **63 additional frames at narrated action timestamps, gate milestones and actual decoded tails**. These independent extraction grids and inventories are in the [inspection/rebuild archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/02a50ecdb42cbb4f/audit2-inspection-and-rebuild.tar.gz).

Recordings necessarily show navigation/keyboard transitions and startup blank/loading frames. Those frames are not counted as settled result proof. Accepted settled stills and the required result frames are complete and readable. The archive/index explicitly reject the initial Home-only restart, offline/missing-fixture R03 attempts, premature H01 link and blank-thumbnail animation-off H02 attempt. I did not promote those rejected attempts into passes.

The code comparison covers all six changed mobile files. There is no new JSX/style/theme/viewport/native branch in the changed components. Data binding changes composer content and existing send availability. This is consistent with the R01 differences; the supplied current claims do not require an unseen chip, ring, or new geometry.

## Diff verification

Both first and repeat R01 pairs reproduce every delivered diff pixel with the supplied algorithm: maximum absolute RGB-channel delta, threshold0 or strictly>16, no alignment/crop/mask/registration. Diff0 and DiffT16 are compared as entire image arrays, including their faded background, and match exactly.

| Pair | Changed pixels >0 | Changed pixels >16 | Inclusive bounds | Pixels above composer |
|---|---:|---:|---|---:|
| First entry |9061|8742|x159–1029,y2242–2320|0 for y<2190|
| Repeat entry |9061|8742|x159–1029,y2242–2320|0 for y<2190|

First/repeat stills within each side are themselves pixel-identical. The “what else changed” list correctly limits the matched pair to Ask anything→P1-RESUME and disabled→enabled Send/arrow appearance. No header, hero, branch, environment, status-bar or viewport changes light up those delivered diff images.

## Independent rebuild

I created the requested detached checkout, installed dependencies with vp install, obtained the native client through mobile:install, and leased Pixel9 as audit25360r2 through device-pool. Native fingerprint matches99ea899c7ce7c0a13003abaef36c7940e0170bb1. Metro bound on all interfaces at8087; the fresh T3CODE_DEV_SEED=0 dev server used16633, worktree-local state, and synthetic fixture repositories. No live T3 database or copied user state was used.

I reviewed the uploaded scripts as untrusted data and ran Python with -I. The individually uploaded functional seed.mjs/rpc.mjs were used, as the replay notes instruct; redacted archive copies are not runnable substitutes. Adaptations were scratch paths, checkout/session/ports and the fresh environment id. The supplied core.py seed/Back/plain-entry/repeat flow was replayed against the pinned source. Native metrics observed through the live runtime exactly match the rendering line above. Final model was explicitly matched through the real picker to GPT-6.1-Sol/Low; no provider turn was sent.

Initial full-frame delta1051 (>16:970) was caused by extra Android3G/signal icons plus6 one-level handle pixels. Native mobile-data off, airplane on, Wi-Fi on and re-enabling Show demo mode matched the delivered OS status surface. This is a disclosed native configuration change, with no pixel masking. The [rebuild notes](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fa12e3adffbf7779/rebuild-notes.md) preserve those manual steps alongside the scripted run and explain the model-selection adjustment.

Final **native1080×2424** [independent capture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cea488394fce7258/final-R01-after-light.png) versus delivered R01-after-light.png:

- AE0=6 /2617920 pixels; maximum channel delta1.
- AE>16=0. Inclusive bounds x398–400,y2388–2397, on Android's bottom navigation handle.
- Application surface AE0=0. Two final captures more than500ms apart have stability AE0=0.
- [Independent Diff0](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/77e281b7079a7a96/final-diff0.png) and [Diff16](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2e751e625d67925f/final-diff16.png); raw metrics/runtime observation, source drivers, logs with credentials redacted, recording and extracted frames are in the archive. Four principal uploads were downloaded again and SHA256-verified byte-for-byte.

![Left: delivered pinned-head R01. Right: independent rebuild at the same head.](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a225eb57e7f6ef7a/delivered-and-independent-rebuild.png)

## Scope and teardown

This audit started2026-10-27 at20:53 UTC and completed within the60-minute budget. Tests/CI/reviews were not rerun or refreshed; checked-in unit assertions were inspected only. The verdict is limited to the pinned source and supplied replacement proof, not a later merged head. No source edits, commits, pushes, forge comments or PR-body changes occurred; no WIP branch exists.

The device lease was closed. Exact owners of ports16633,8593,8087 were confirmed under the audit checkout and interrupted; all three listeners and captured process/parent IDs were verified absent. The detached audit worktree was removed. Only this audit's own scratch directory is removed after report/upload integrity verification; the lead's checkout and parent scratch directory are preserved. No browser was opened.

FRICTION:
- infra | Intermittent artifact DNS failures and urllib403; curl with a resolved service address retrieved and hash-verified the files | Reliable artifact DNS and a documented curl download path.
- runbook | Native demo clock alone left extra3G/signal icons in the first independent replay; native radio settings plus demo re-enable produced the six-pixel AA-only match | Include radio state in the rendering/replay environment.
- tool | Reopening Android Settings resumed a nested pane; the replay assumed its root, and Demo mode's accessibility tree was unavailable | Make settings setup idempotent; return to System/Developer options and use the inspected screenshot for the two demo controls.
- model | I initially added --host lan to a Metro script that already supplies --lan, and once placed --session after the CDP namespace | Use the package script's existing LAN flag and CDP's global session prefix.

VERDICT: SUFFICIENT