# Final proof audit pass 2 — repaired R2

**VERDICT: SUFFICIENT. No remaining required proof gaps.**

This is the combined evidence verdict for replacement [#24592](https://github.com/pingdotgg/t3code/pull/24592), taking over original [#20884](https://github.com/pingdotgg/t3code/pull/20884). It adjudicates the sole outstanding finding in the [prior independent audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fac350cfee511f7c/pass2-report.md): an actual pending input form must survive navigation and remain answerable through the UI. The new appendix satisfies that finding in all four Q combinations.

Acceptance remains the [final three-row matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/238bfe0a4a00944d/final-matrix.md). Retain the [original full final index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/062764f804fadec7/index-final.md) and its independently audited R1, multiple-ID/manual-close R2, and R3 chapters. Combine it with the [R2 repair appendix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4788368ef8a38331/r2-index.md); neither supersedes the other's coverage. This fresh pass does not claim to have re-inspected all original recordings.

## Revision contract

Before [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b); after [3b6219c922](https://github.com/pingdotgg/t3code/commit/3b6219c922023fefca4a94a7887298dd8e4f36d7). GitCafe read-only metadata confirms the replacement's same head, branch `takeover/pr-20884`, head repository `pingdotgg/t3code`, target `main`, and comparison base [843f4e3529](https://github.com/pingdotgg/t3code/commit/843f4e35292391897089535e8f1af59b322e70f8). Independently checked that the initial baseline→comparison-base diff contains no `apps/web` changes. Inspected the complete two-file final delta against that comparison base; no source edits were made.

## Combined row status

Each cell below is a paired before→after requirement, not merely one screenshot.

| Q | R1 keyboard + separately rearmed sidebar | R2 attention + multiple IDs/manual close + pending UI | R3 effective promoted draft |
|---|---|---|---|
|1440×900 light|SUFFICIENT — prior independent audit retained|SUFFICIENT — prior lifecycle chapter plus fresh repair verified|SUFFICIENT — prior labeled boundary fixture retained|
|1440×900 dark|SUFFICIENT — prior independent audit retained|SUFFICIENT — prior lifecycle chapter plus fresh repair verified|SUFFICIENT — prior labeled boundary fixture retained|
|390×844 light|SUFFICIENT — prior independent audit retained|SUFFICIENT — prior lifecycle chapter plus fresh repair verified|SUFFICIENT — prior labeled boundary fixture retained|
|390×844 dark|SUFFICIENT — prior independent audit retained|SUFFICIENT — prior lifecycle chapter plus fresh repair verified|SUFFICIENT — prior labeled boundary fixture retained|

R1 retains both keyboard and ordinary sidebar opening with independent B and non-resurrection. Original R2 retains three A notifications, manual dismissal of one, and selective removal of all remaining A IDs while B survives. R3 retains the expressly allowed promotion/route-timing fixture; it is not represented as a natural unmodified promotion-timing run. The pending-form repair is additional R2 coverage, not a replacement for its multiple-ID chapter.

## Fresh R2 inspection

Opened all 24 appendix primary stills through labeled sheets, all 12 paired images and all 24 raw difference images through comparison sheets, with full-resolution unresolved desktop frames and desktop pending-difference detail. Checked every primary's exact dimensions and every byte-identical 500ms twin. Independently recomputed both raw difference encodings from the actual primary PNGs; all supplied difference images match exactly. Downloaded the public archive and verified all 100 accepted PNG/video/manifest members byte-for-byte against the local audit inputs.

Independently extracted and visually inspected all eight continuous recordings as chronological half-second frame strips, plus four close transition frames around each actual UI answer. This is sampled visual inspection, not a claim of uninterrupted real-time playback of every frame. Full strips preserve the display; the additional answer-detail strips use explicitly labeled inspection crops. Original proof images and recordings remain unmodified.

In every before/after run:

- A receives a fresh actual provider `user_input` request while C is selected. B completes separately and has a live notification.
- The exact same request ID remains blocking, with the same active A run and no completion timestamp, on C and after ordinary sidebar navigation to A. All eight requests are distinct between runs. The 390-wide recordings show the real sidebar sheet.
- A's actual question, Continue and Wait choices, and input composer are visible after navigation. Before retains A's attention toast; after removes A's toast. B remains visible in both revisions. The form itself is unchanged outside the removed-toast area.
- The driver clicks the actual enabled Continue option. Extracted transition frames show its selected checkmark, then the form disappears and the answered transcript/completion appears. The final persisted A state is completed, with no active run or pending request. B remains live. The driver contains no scratch response RPC; inspection of the driver and actual provider protocol fixture supports the UI sequence.

Checkpoint times are the end of primary/twin collection; inspect roughly 0.5 seconds earlier for primary image correspondence.

|Q|C pending before / after|A unresolved before / after|UI completed before / after|
|---|---|---|---|
|1440 light|3.964 / 3.829s|6.944 / 7.017s|10.634 / 10.396s|
|1440 dark|4.279 / 4.006s|7.238 / 7.158s|10.619 / 10.550s|
|390 light|4.395 / 4.205s|7.921 / 7.608s|10.044 / 9.826s|
|390 dark|4.219 / 4.206s|7.633 / 7.629s|10.146 / 9.711s|

## Independent real-app rebuild and pixels

Ran exactly `R2_CAPTURE_LABEL=r2-independent-after bash /tmp/ev-20884/capture-r2.sh after 390 light` against the pinned after SHA. It completed on the first attempt without script changes, using a fresh empty synthetic home, `--no-seed`, headed Chromium 148, Xvfb, ffmpeg and the deterministic native Codex protocol provider through the real server/adapter. No live userdata was read, seeded or written.

All three rebuilt primary states — C pending, A opened unresolved, and completed via UI — match the delivered after images at **0 differing pixels, 0 pixels above16, maximum channel delta0**, over the full 390×844 viewport with no mask. The independent manifest has no errors; its own request survives navigation and completes after the UI answer.

![Delivered after left; independent after rebuild right — unresolved form and B, pixel-identical](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/13efd5fc32942892/independent-opened-pair.png)

[Independent validation and pixel statistics](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0f42c431c5f0d4db/independent-validation.json). [Inspection archive: extracted chronological strips, answer details, validation scripts, independent manifest and recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/84da1800d0b388b5/audit-inspection.tar.gz).

Across all 12 appendix before/after comparisons, there is no unrelated pixel difference. Mobile C-pending pairs are identical. Desktop C-pending residuals are confined to B's Open thread button, inclusive x1301–1382/y106–129: light1773 differing pixels /1436 above16/max22; dark1772/1439/max23. The hover explanation remains an inference; the actual bounding box and raw images independently establish its limited extent. It is not used to excuse any other difference. Opened/completed differences are confined to the removed A toast and its shadow, revealing underlying project controls on desktop or status/transcript on mobile. Question/options/composer outside that area match exactly; B's retained toast matches in those states.

## Friction, limits and release

No rebuild friction occurred. The recipe retains the disclosed three-second bootstrap settle from the prior repair; this pass does not establish a more precise readiness condition. Ordinary hover expands the toast stack and pauses normal expiry, allowing both labels and B survival to be inspected. This proves selective dismissal under that disclosed interaction, not an unhovered timeout scenario.

My first independent video extractor requested one final half-second sample beyond an encoded recording's end and received no image. The scratch extractor now skips empty terminal samples; all eight strips regenerated. No recording or product change was needed. Encoded 20fps end granularity does not remove any primary frame or UI transition.

This is responsive web proof on Linux, with synthetic native-protocol provider inputs. Native mobile, Electron OS delivery, hosted-model behavior and remote/tunnel permutations are outside the unchanged matrix. No product tests were rerun in this evidence pass. GitCafe reports30/30 successful checks on the exact head, but its stored conflict observation is stale and current conflict readiness is pending; this proof verdict grants no merge authorization and is not a new merge-readiness approval.

All capture-owned process groups stopped through the recipe's retained-PID cleanup. Final inspection confirms no listeners on8339/16379/18888, no display188 lock, and clean `takeover/pr-20884` at the exact after SHA. Extractors exited. Both PRs are linked to this thread and neither is watched. No product code edits, commits, pushes, comments, PR-body edits, or watch changes occurred. Only scratch artifacts and public audit uploads were created.

**Exact remaining required gaps: none. VERDICT: SUFFICIENT.**