Proof audit, pass 2: [#24568](https://git.cafe/pingdotgg/t3code/pull/24568)

1. **E1 — INSUFFICIENT for the specified web witness.** `E1-E2-after.png` and its settle partner contain both `#42: checks failed` and the later `#42: checks passed`. They are an E2 required-pass view, not the required failure-phase view. Neither shows `Tests (#12)` or `aaaaaaa`. This is a state/claim gap, not a broken rendering. The ordered E1 runtime proof is good: native scheduled sweeps, one committed failure, an exact inert-provider receipt, and subsequent duplicate reads without another wake. Supply a paired failure-phase still; do not claim expanded native payload text. The current notification renderer has no payload detail to expand, so the original expanded-native-text requirement would need to be explicitly narrowed to the committed-event/provider transcript.

2. **E3 — INSUFFICIENT for the specified C-pass still.** `E3-final-before.png`, `E3-final-after.png`, and both settle partners were captured after unwatch cleanup. Neither side shows the watch bar. AFTER shows six historical summary notifications, with no visible C/head identifier. This cannot serve as the requested still of the watched C-pass phase. The runtime record does establish the unchanged watch identity, rerun, new C head, fresh C wake, and duplicate suppression before cleanup. Capture the paired view before unwatch; retain the exact C text in the runtime record. The composer difference is real and fully declared in the “what else changed” list, rather than an unexplained diff artifact.

3. **E5 — sufficient evidence, contradicted current PR-body claims.** The cold BEFORE hover has the title/state/repository/author/age card; AFTER has only the URL tooltip. Raw subprocesses show AFTER invokes PR show followed by denied policy acquisition. This contradicts the current body's broad statements “link previews use the existing lightweight preview extension and skip checks,” “previews remain readable,” and “link previews now use one metadata read and skip policies/iterations.” Narrow these to the `pullRequests.preview` RPC/provider method and applicable guarded-click resolution. The ordinary ChatMarkdown hover calls detail: [hover query](https://github.com/pingdotgg/t3code/blob/e13265440a44b51116f9c3427b50c3d0e2c3ca1e/apps/web/src/components/pullRequest/PullRequestLinkPreview.tsx#L52), [ChatMarkdown caller without fallback](https://github.com/pingdotgg/t3code/blob/e13265440a44b51116f9c3427b50c3d0e2c3ca1e/apps/web/src/components/ChatMarkdown.tsx#L1274). “No render paths changed” is true about the diff's files; it does not establish unchanged hover behavior. Likewise the verification-log conclusion that no client capture is required cannot be used to dismiss this observed regression. No guarded click applies to this plain URL; no live navigation was claimed.

4. **H1/H2 metadata correction.** The reused sheets and prior `environment.json` label the runtime Node 24.22.1. Both bundled raw runtime logs identify the executing Node as **v26.12.1**, including the executable path. Correct or distinguish packaging-host Node from replay-process Node. The accepted harness behavior remains inspectable and sufficient at its stated limited scope; this discrepancy does not require repeating its combinatorics.

| Row | Status | Audited evidence and limit |
| --- | --- | --- |
| E1 | **INSUFFICIENT** | Scheduled running → failure → duplicate reads; one exact committed wake/provider receipt. Failure-only native still and expanded-native text absent; selected still is later E2. |
| E2 | **SUFFICIENT** | Actual pages skip0/100; equal-name IDs12/13; required-pending blocks pass; required-pass with advisory pending; optional completion; duplicates. AFTER notification totals 1→1→2→2→3→3, BEFORE zero. Paired required-pass still is valid. Full counts/head text proven by JSONL, not native summary labels. |
| E3 | **INSUFFICIENT** | Runtime totals 3→4→5→5→6→6, BEFORE zero; stale show A vs latest iteration C, C watch/text/receipt and stable identities confirmed. Selected still is after cleanup, outside the required watched C-pass state. |
| E4 | **SUFFICIENT** | Separate PR43: failure → malformed later page → recovery. All watch fields and message IDs preserved; one failure only. Fresh PR44 preview succeeds with show-only read; strict detail actually invokes denied policy and returns typed error. Independent real-server rebuild matches after normalization. |
| E5 | **SUFFICIENT** | Both cold-hover recordings and before/after stills faithfully show the regression. Neutral → hover → card/tooltip → held state matches the narrated steps. The regression is not an evidence failure. |
| H1 | **SUFFICIENT, labelled harness** | Strict decoding/status/filter/name/page/cap/truncation/error/fallback coverage inspected in raw logs and drivers. 58/58 prior bundle hashes match. Correct runtime Node label. Production rate classification remains excluded. |
| H2 | **SUFFICIENT, labelled harness** | Raw R4/P2 records show empty/all-filtered same-head preservation, unseen empty head at logical +16min without invented timeout, and nullable/failed-iteration fallback. Correct runtime Node label. No new real-time wait or browser/device matrix needed. |

Visual and recording inspection:

- Opened every one of the 26 bundled PNGs: eight selected before/after stills, eight settle stills, eight diff images, and two delivered video sheets. Decoded both MP4s and inspected all 11 BEFORE and 12 AFTER frames chronologically, including enlarged crops of the entire changing region. The videos are 2560×1800 physical pixels for the approved 1280×900 CSS viewport at DPR2; this is consistent with the capture environment, not a viewport mismatch. They are approximately 6.316 and 6.195 seconds. The narration is in the sheet/driver, not an audio track.
- No duplicated/ghosted element, stale initial popup, spinner/skeleton, accidental text clipping, or unrendered region invalidates the selected stills. The long author is intentionally ellipsized by the component. The empty conversation area in BEFORE is the expected empty-thread state. The grid's unused cells are contact-sheet padding, not blank app frames.
- Recomputed all eight diff images. Every pixel matches the delivered calculation: Diff0 = min(abs(channel delta)×32,255); DiffT16 = 255 where channel delta>16, otherwise 0. Every selected/settle pair has exactly zero different pixels. Distinct changed-pixel counts are E1/E2 2,992; E3 9,030; E4 2,184; E5 53,362.
- The visible-difference list matches the images and code: E1/E2 notification insertion and empty-prompt removal; E3 six notifications, empty-prompt removal and declared composer placeholder change; E4 one failure; E5 removed card, added URL tooltip, and revealed message timestamp/reply controls. No unexplained diff regions were found.
- Every displayed BEFORE/AFTER column uses the requested [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b) / [e13265440a](https://github.com/pingdotgg/t3code/commit/e13265440a44b51116f9c3427b50c3d0e2c3ca1e). Local HEAD and merge-base match the full requested SHAs. Six production-source hashes match exact git objects. All 71 runtime/driver manifest entries and all 58 prior-harness entries verify. Both complete runtime streams are chronologically ordered. Every committed PR-watch wake has an exact provider input receipt.

Independent rebuild:

Used the uploaded setup, executable az fixture, server controller, sweep waiter and RPC driver, adapted only within this scratch directory for its paths, AFTER-only execution, and isolated Python execution. A preliminary timestamped run exercised setup; the comparison uses fresh `run-20261027T144212Z`. No production code edits, direct evaluator substitution, watch-field writes, live database use, migration, or browser was involved.

Environment matches the new runtime captures: fs-29, Linux 6.1.102 x86_64, Node 26.12.1, Vite Plus 1.3.0, `T3CODE_DEV_SEED=0`, fresh isolated home, real server/reactor/RPC, synthetic executable az and inert local provider. The approved server-transcript substitution means no renderer or pixel comparison was used for this rebuild.

Rebuilt E4 established failure, completed malformed-page sweep, same-failure recovery, and cold preview/detail RPC calls. **Zero normalized differences.** Notification counts are 1→1→1; all raw watch fields and actual message IDs remain unchanged across phases; exactly one committed failure and one exact provider receipt. Seven distinct policy argv/exit/result observations and both endpoint outcomes match the delivered artifacts.

Normalization removes run-local watch dates/project IDs, labels wake IDs by order while independently asserting their stability, normalizes the project cwd in the typed error, and compares distinct identical policy reads per phase. Raw call counts and all original raw logs remain available; unrelated seed threads are excluded. The comparison does not claim wall-clock/span timing or incidental background-call counts are identical.

- [Rebuild result](./rebuild-result.json)
- [Delivered normalized observations](./E4-delivered-audit-normalized.json)
- [Rebuilt normalized observations](./E4-rebuilt-audit-normalized.json)
- [Empty normalized diff](./E4-independent-rebuild.diff)
- [Comparison script](./compare-rebuild.py)
- [Raw rebuilt run](./run-20261027T144212Z/after/)
- [Process cleanup verification](./audit-teardown.json)

The proposed Evidence.md accurately discloses E1's mixed-state still, E3's cleanup timing, summary-only native notifications, E5's regression and synthetic Azure scope. “All seven rows addressed” describes supplied artifacts, not sufficient completion of every specified witness. Live Azure remains unexercised; that disclosed limitation is not itself an extra capture requirement here. The approved single viewport/theme is accepted throughout.

All servers started by this audit were stopped using captured process-group IDs. All ten captured groups are gone, both server/web ports are free, the worktree remains clean at the requested head, and root free space is 29 GB. Nothing was pushed, commented, edited in the worktree, or deleted. Audit completed within the 60-minute budget.

FRICTION:
- infra | Initial parallel curl batch had transient artifact-host DNS failures; a retry and the bundled copies resolved them. | Bounded download retry.
- forge | The requested `data.resource.body` field is absent; current CLI returns the body as `data.resource.description`. | Update the documented field or accept both schema shapes.

VERDICT: INSUFFICIENT E1, E3