# Proof audit recovery, pass 2

Issue [#15721](https://github.com/pingdotgg/t3code/issues/15721). Verdict: **proof incomplete; do not sign off the matrix**. There is useful historical behavioral evidence, but no delivered interaction recordings or matched visual pairs. This is an evidence verdict, not a finding that the implementation fails or a complete merge-readiness/code audit.

Reviewed read-only checkout `/home/ubuntu/wt/issue-15721` at [08386cb000](https://github.com/pingdotgg/t3code/commit/08386cb0007ff37e94fb97a3382afcf1440d8d0a). Working tree was clean. Independently compared blob IDs: all 13 files changed by the original fix from [b5a226e49c](https://github.com/pingdotgg/t3code/commit/b5a226e49c52ecab4ddc2d678a7012d97e651a6a) to [7e36552671](https://github.com/pingdotgg/t3code/commit/7e36552671188db360dc88a89ac70d20f527b84a) are identical at current HEAD. HEAD also contains unrelated changes; these were not audited. Identical fix files make historical evidence relevant, but do not establish integration behavior at the newer HEAD.

## Evidence inspected and limits

- `/tmp/issue-15721-matrix-final.md`: requirements and prior source review, not delivered runtime proof.
- `/tmp/issue-15721-before.txt`: historical Local and separate-worktree first-send reproductions with empty durable `pullRequests` while branch PR exists. Chromium 1280×800; no matching visual before half.
- `/tmp/issue-15721-primary-after.json`: historical PR-detail/worktree first send, provider OK without tools, linked collection and reload reported; durable array contains exactly one fixture link. Revision is the earlier fix, 1280×800 light. Useful supplementary C2 evidence, not a matched capture or fresh observation.
- `/tmp/issue-15721-proof/public`: recursively inspected; contains only `recovered-runtime-summary.json`, no video or image. Parsed the full summary. It explicitly identifies itself as recovered prior-round data, not fresh runtime/recording proof, and excludes presentation fixtures. This pass inspected the summary, not its underlying SQLite snapshots/private wire records.
- `/tmp/issue-15721-evidence-recovery.md`: documents interrupted recovery, missing captures, historical sessions, and presentation-fixture caveat. Its statements do not establish completed captures or current server state.

Public fixture is [#23113](https://github.com/pingdotgg/t3code/pull/23113). Branch-derived PR presence alone is not evidence of durable thread linkage. `source: manual` in the after JSON does not by itself distinguish automatic client linkage from an explicit link; the no-tools account is supplementary provenance, not independent causal proof.

## Interaction and visual rows

“Partial” below means supplementary historical data exists; the required recording row still does not pass. No row is promoted to PASS from code, matrix requirements, or a prepared presentation state.

| Row | Honest status | Evidence and remaining gap |
|---|---|---|
| C1 chat checkout / Local | PARTIAL; recording MISSING | Before transcript records missing durable link. Recovered after database summary includes a Local branch with one link, but does not map the full caller/reload/settings/first-send sequence. Draft retention and visible collection sequence unproved. |
| C2 PR detail / worktree | PARTIAL; recording MISSING | Primary after JSON reports no-tools first send, one durable link and reload; before transcript supports defect. No matched recording, second ordinary turn/cardinality proof, or full matched fixture conditions. |
| C3 thread-details task handoff | MISSING caller proof | Unattributed linked worktree rows cannot prove this entry point, task prompt retention or checkout sequence. No caller recording. |
| C4 prompt-link confirmation | PARTIAL; recording MISSING | `after-c4` snapshot summary contains one linked worktree thread. Label and stored state do not prove explicit confirmation, navigation, prompt retention or causal sequence. No matched before/after caller proof. |
| C5 link rejection | PARTIAL; recording MISSING | Recovered wire summary records launch, same-target link and rejected-link request. Does not show successful launch receipt, rendered warning, usable turn or all required final-state assertions. No before/after recording. |
| C6 fanout all-success | PARTIAL; recording MISSING | Summary has two scoped launches, two distinct-target links and successful launch/link receipts. Links appear before listed launch receipts; this summary alone cannot establish callback timing relative to acknowledgement. No per-target UI/reload recording. |
| C6 fanout partial failure | PARTIAL; recording MISSING | Summary has two launches, one rejected start and one link to other target. No surviving-target success/link receipt, exhaustive absence proof for failed target, recovery UI or uncertain-start retry demonstration. |
| V1 1440×900 light | MISSING | No matched still pair or transition recording. |
| V1 1440×900 dark | MISSING | No matched still pair or transition recording. |
| V1 390×844 light | MISSING | No matched still pair or transition recording. |
| V1 390×844 dark | MISSING | No matched still pair or transition recording. |

Totals: **0 of 6 interaction rows fully satisfied; 0 of 12 required before/after recordings delivered; 0 of 4 matched still pairs (0 of 8 stills) delivered.** C6's two subcases are both incomplete. These counts concern the inspected supplied evidence, not a claim to have exhaustively searched the machine.

## Data truth-table rows

| Row | Honest status | Evidence and remaining gap |
|---|---|---|
| D1 draft creation/update/persistence/equality | UNVERIFIED in supplied runtime proof | Prior audit reports partial inspected test coverage; no execution result or complete predicate transcript supplied. |
| D2 checkout ownership/invalidation | UNVERIFIED | No independently varied environment/project/branch/path and hydration truth table. Prior source/test inspection is not execution proof. |
| D3 send gates | PARTIAL | Historical one-link after state and launch/link records support successful cases; missing complete gate, environment targeting, first-send-only and subsequent-turn assertions. |
| D4 asynchronous outcomes | PARTIAL | Primary after report supports reload persistence; rejection wire exists. Warning rendering, command milestone ordering, turn usability and background destination are not fully established. |
| D5 compatibility modes | UNVERIFIED | No current/legacy/unsupported mode truth table or opposite-checkout-mode assertion tied to complete provenance. |
| D6 unchanged negative controls | NOT REVERIFIED; unchanged scope | Not a new screenshot requirement. Existing empty-link rows without mapped actions do not establish negative-control execution. |
| D7 fanout cardinality/recovery | PARTIAL | All-success receipts and partial-failure wire are useful. Attachment/uncertain/pre-start cases, retry guard, rejection isolation, captured URL recovery and completion-order associations remain unproved as a whole. |

No tests were run in this pass. The earlier audit's inspected tests support selected logic cases only; no full D1–D7 pass is claimed. Electron and native mobile remain unexercised. Remote destination correctness is not established merely by local stored links.

## Decision

Retain the before transcript, primary after JSON and recovered summary as supplementary evidence. Do not label the matrix complete or use them as substitutes for interaction recordings. The interrupted capture task left **missing proof**, not failed application behavior. No attempt was made to rebuild nonexistent captures. A later authorized proof run would still need the missing matrix evidence; it was explicitly outside this pass's scope.

## FRICTION

infra|Evidence task interrupted by environment restart after hours; recovery notes document cold-start/pairing delays. No current server state inferred and no lifecycle action taken.
artifact|Public evidence directory contains one recovered JSON summary and no recordings/stills; all required capture deliverables remain missing.
provenance|Runtime evidence is historical at earlier fix revision; byte-identical fix files do not prove integration at current HEAD. Underlying private snapshots/wire logs were not independently reparsed in this pass.
proof|Database rows establish stored state, not caller reachability or rendered feedback. Presentation fixtures excluded. Branch PR and durable link kept distinct.
brief|Three-minute read-only evidence audit honored; no capture, server start, test run, repository edit, forge action or PR creation.
tool|Initial combined diff output was truncated; followed with bounded per-file blob comparison and parsed summary. All 13 original fix files independently confirmed identical.
policy|Only this requested report written outside checkout. No private artifacts copied or uploaded.
model|No delegation or additional model run.