Proof audit pass 2 for [#24658](https://git.cafe/pingdotgg/t3code/pull/24658), read-only. Candidate [adf56b5b8a2e](https://github.com/pingdotgg/t3code/commit/adf56b5b8a2ee2f003aa53e705604cc0e26dead3), baseline [36d4d711b79c](https://github.com/pingdotgg/t3code/commit/36d4d711b79c73eb33131944f73ea4a8c6156484).

**Findings**

1. **R2 is INSUFFICIENT: unrelated address and document identity changes dominate both diff images.** `R2-Diff0.png` highlights 10,296 pixels and `R2-DiffT.png` highlights 5,716 pixels. These are the different localhost asset port/capability address and random document UUID, rather than a change made by this PR. Both fixtures are visibly Light as expected, and the recording/menu/request support explicit Light, but the user's explicit clean-diff requirement excludes these comparisons. The Evidence section discloses the noise accurately; its R2 PASS conclusion still exceeds this audit's acceptance rule.

2. **R3 is INSUFFICIENT: both diff images highlight only an unrelated random document UUID.** `R3-Diff0.png`: 8,451 pixels; `R3-DiffT.png`: 3,750. Terminal opening, the System request/snapshot, and the labelled mocked attachment transcript support the mechanism. They do not turn an unrelated visual difference into valid comparison evidence. Both pages correctly remain Light on the native-Light headless renderer.

3. **R5 is INSUFFICIENT: document UUID noise remains in A/B/C comparisons.** The clearest case is B, whose intended appearance is unchanged: `R5-B-Diff0.png` highlights 8,374 pixels and `R5-B-DiffT.png` highlights 4,182, all from the independently generated UUID. A/C include the expected appearance difference plus unrelated UUID differences. The recordings do support retained tab/document identities within each build and Dark → Light → Dark default reads. They do not satisfy the required clean before/after comparison. R5-B stills honestly show the first loaded state; persistence is in the recording, not those stills.

4. **Additional wide replay has a reproducibility delta beyond anti-aliasing.** Replaying the supplied R1 driver on fresh synthetic state produced `now` in the sidebar where the delivered wide captures show `3m`. Streamed text also rasterized differently. Against delivered `R1-1440-light-after.png`, 47,419 pixels differ at >0 and 10,133 at >16; against Dark viewer, 47,417 / 10,135. These differences are recorded in `run-20261027T161251Z/reproduction-pixel-delta.json` and `headline/replay-diff-R1-1440-*-after.png`. This is capture nondeterminism, not an asserted PR regression. The required single-capture reproduction is satisfied independently by the narrow R1 captures, each matching exactly. I do not claim the wide captures replay pixel-identically.

For R2/R3/R5, recapture paired comparisons with stable displayed per-row fixture tokens and comparable visible asset addressing while preserving the real opening paths. Keep actual tab/document identity in receipts or recordings. Do not hide unrelated changes with masks, crops, or altered application behavior.

| Row | Status | Evidence assessment |
|---|---|---|
| R1 | SUFFICIENT | Four before/after conditions: 1440×1000 and 390×844, Light and Dark viewer. Correct new SHAs; expected Light → Dark streamed page, readable probe, same born tab. All four delivered pairs have zero changed pixels outside the streamed viewport. Recording actions match the textual timestamp narration. Independent 390×844 replays match both delivered candidate themes exactly. Additional wide replay limitation is finding 4. |
| R2 | INSUFFICIENT | Real Files → scheme.html → Open file in preview browser path and explicit Light are supported. Both settled diff images contain unrelated address/UUID changes, finding 1. |
| R3 | INSUFFICIENT | Real terminal URL path and explicit System are supported. Both settled diff images contain unrelated UUID changes, finding 2. Exact-head test transcript supplies the scoped initial-reset mechanism support, without claiming a native-Dark host or live OS switching. |
| R4 | SUFFICIENT under the expressly allowed exception; visible child remains UNVERIFIED | Both builds visibly make the opener Dark, then adopt a popup into the same Idle/Recently used presentation. Settled before/after images are identical: zero changed pixels at both thresholds. Candidate snapshot carries Dark while baseline omits it; the focused Light/Dark popup tests support copying. The nine-file diff does not change the Idle presentation path. The Evidence section explicitly disclaims visible child appearance and window.opener proof. This is honest inherited-snapshot proof with an identical pre-existing presentation gap, not a claim of a visible Dark child. |
| R5 | INSUFFICIENT | Recordings show disabled Settings readbacks Dark → Light → Dark and A/B persistence, with candidate A/C Dark and B Light. UUID noise invalidates the required paired diffs, finding 3. |

**Coverage and structural verification**

Opened and visually reviewed all 20 delivered before/after stills, all 20 delivered diff images, all 10 labelled full-resolution sheets, and all 10 uploaded recording contact sheets. Decoded all ten MP4s with ffmpeg, inspected 281 frames sampled at 2 fps across their full durations in 39 contact sheets, and additionally inspected both R2 opening sequences at 25 fps for the first 0.9 seconds. The fast Files selection/open action is visible and agrees with the narration. All ten recordings are 1440×1000. Narration is the accompanying timestamped action tables, not an audio track; R5 additionally has visible fixture-API captions. Actions and held results agree with those tables, allowing normal screencast/25fps timing quantization. Transient loading during an opening is not used as the settled proof; R4's persistent overlay is the specifically disclosed exception.

All sheets and Evidence columns identify baseline 36d4d711b79c and candidate adf56b5b8a2e. The old matrix SHAs are explicitly a pass-1 planning pair, superseded by the user's new pair, not mislabeled capture columns. Settings → Browser → Advanced → Default browser appearance is correctly reflected in the current Evidence section and recordings. The disabled web control is honestly seeded through the production settings API; no enabled Settings click is claimed.

Independently recomputed every delivered diff: each Diff0 (>0 maximum RGB channel delta) and DiffT (>16) matches its delivered image byte-for-byte as decoded RGB. R1's four outside-viewport counts are all zero. The visible “what else changed” list matches the images and the code; its disclosure of noise does not waive the user's clean-diff criterion. No new code defect is asserted by this proof audit.

Read the nine-file pinned diff, protocol summaries, preview.open requests/receipts, Settings readbacks, scripts, reconstruction guide, action log, and exact-head focused test transcript. The latter reports 32 passing tests including initial System reset/no repeated emulation and Light/Dark popup inheritance. This audit did not rerun those tests or perform a full merge-readiness review.

**Independent rebuild**

Used a scratch-only copy of the uploaded `replay-driver.cjs` and `capture-lib.cjs`, changing the scratch root, selecting only the candidate, and stopping after R1. Started exactly one dev server in the candidate worktree with `T3CODE_DEV_SEED=0 vp run dev --home-dir /tmp/lead-24658-r1/proof-audit-2/run-20261027T161251Z/after-home`, plus the supplied fixture on loopback 49173. No live T3 home, origin override, source edit, or provider turn.

Rendering environment: same Linux x86_64 VM; installed Playwright 1.60.0 / headless viewer Chromium 148.0.7778.96, --no-sandbox, DPR 1, 16px root, zoom 1, reduced motion, explicit Light/Dark app appearance, fixed Date 2026-10-27T15:25:00Z with normal timers; app-installed server Google Chrome for Testing headless-shell 156.0.8078.70, GPU disabled, renderer scale factor 2, default profile, Fill viewport, preview zoom 100%. The renderer binary version was independently checked. The replay uses the same dependency/binary and capture setup as the supplied driver. Narrow canvas bounds match the delivery: x47.8125/y129, width342.1875/height715.

`R1-390-light-after.png` and `R1-390-dark-after.png`: **0 / 329,160 pixels changed**, at both thresholds. Rebuilt images, per-capture bounds, protocol state, script, diff JSON, and additional wide deltas remain inside this audit's scratch directory.

**Cleanup**

Stopped the captured launcher PID 234967 and fixture PID 234968. The launcher left listening children, so stopped only confirmed audit-port owners 235053 and 235066 after checking their /proc cwd against the candidate worktree. The remaining owned server/renderer descendants then exited. Playwright closed normally; the audit-owned shared-preview tab was closed. All three owned ports are clear, no tracked owned processes remain, both worktrees have empty git status and unchanged full SHAs. Disk has 20 GB available. See `audit-final-verification.json` and the run's cleanup JSON files. No evidence or raw logs were deleted. No edits, pushes, comments, commits, reset, or checkout occurred in the PR worktrees.

FRICTION:

- infra | Initial curl download failed DNS resolution; IPv4 curl succeeded | Use curl -4 in this environment or repair the resolver path.
- tool | Stopping the captured vp launcher did not terminate its listening children | Use a launcher with process-group forwarding; the supplied port-owner/cwd cleanup fallback resolved this safely.

VERDICT: INSUFFICIENT R2, R3, R5