# PASS3 proof audit

The supplemental evidence closes all previously missing rows for the scoped observable web policy. This is evidence sufficiency, not approval of a merge, current CI, real external model execution, or native surfaces.

Audited [#19687](https://git.cafe/pingdotgg/t3code/pulls/19687), [GitHub mirror #19687](https://github.com/pingdotgg/t3code/pull/19687). Local checkout is clean at [271e7b6f](https://github.com/pingdotgg/t3code/commit/271e7b6f110b5817e70bba16c46a91b2475ccf09); baseline [952921f](https://github.com/pingdotgg/t3code/commit/952921f39acd7793187e2b14650f1cbc447f483d). GitCafe still reports original [798ab31](https://github.com/pingdotgg/t3code/commit/798ab3170850b0224e03fb695ab0ed86953b798b), so the local final-head audit must not be described as proof of a published replacement head. No edits, pushes, comments, watch, browser launch, or server launch were performed. Own files are under `/tmp/to-19687-proof3`.

## Integrity and visual inspection

All 98 entries in the supplemental manifest match local SHA-256 and size. The downloaded manifest is byte-identical. Independently downloaded the public evidence-r2.tar.gz and checked every manifest entry inside it: 98 match, zero failures. Bundle SHA-256: `cbc8ac9626da793266bf53a0dca99477a9ee1a79c44ffc6506d840ec583e240b`.

Opened all 13 new PNGs in labeled contact sheets. Decoded every one of the seven new recordings and opened 39 sampled frames, including route completion and focused Favorites timestamps. This is meaningful-timestamp sampling, not every-frame playback. Read matrix, video metadata, snapshots, action/timestamp logs, cleanup, fixture scripts and provenance README. The action log retains failed attempts before successful retries, rather than concealing them.

## Findings

A is repaired: final attached source has a ready bound session, true capability, completed run. A-selection.mp4 shows the target selected around 00:40–00:44, with handoff-pending indicator and target composer label, then restoration of source. Its before/after-selection projections are byte-identical, consistent with a draft-only selection.

C is valid injected client-policy evidence. A-attached-true-projection.json and C-false-returned-projection.json differ at exactly one value: supportsProviderSwitchingViaHandoff true→false. The effective React projection retains the same thread, active provider-thread, source instance, session binding, ready status, completed run and false capability. It is not byte-identical to the RPC response: dates are decoded to epochMilliseconds, some update/visit bookkeeping is omitted, and assistant item text is not duplicated in the effective item representation. Those representation differences do not invalidate the policy precondition.

Crucially, “returned” here means the local proxy's rewritten RPC response, not an upstream server negotiation. The proxy also removes subscribeThread afterSequence/cursor so the client loads the fixture rather than stale cached true state. C Favorites replays the original attached A projection with the false bit after restart. Both real UI paths block the target, but neither establishes a real adapter negotiating false or server dispatch rejecting it. This limitation must remain beside the claim.

R is repaired using actual message.dispatch with defer_start after server startup. A read-only query of the isolated synthetic database confirms accepted dispatches at 00:53:17.042Z and 01:05:05.334Z and run.created events. The first shutdown cancellation is at 01:01:11.220Z, after the first capture; the second is at 01:07:11.294Z, after the Favorites capture. Thus these captures have a live preparing run and zero sessions, not a recovered cancelled fixture. Preparing is explicitly an active status in the unchanged shared predicate. They do not prove a running provider turn.

P2, P3, P4 and P5 now finish actual target selection and show the closed picker/changed composer. P4 proves the configured supported Alt+1 web numbered-jump binding, not default desktop Ctrl+number. P5 genuinely enters Favorites and clicks the target favorite; the earlier failed empty-fill route is recovered by reopening the picker. Blocked C/R Favorites have an actual environment favorite configured, but no target candidate; Alt+1 leaves source selected. The accompanying row matrix gives individual timestamps and links.

Read-only event inspection also confirms the new source's accepted provider-session.detach and provider-session.detached event at 01:00:58.373Z. P-detached-source-projection has completed source history, zero sessions, retained active source association and null native ref. Native-ref removal remains an explicitly disclosed stopped-server projection-only fixture; no natural null-ref lifecycle is claimed.

## Carried evidence and scope

[PASS2](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/54f44bcec351710d/audit.md) already verified the original 121 hashes, 44 images, five recordings, actual history delivery to the target transport, and an independent final-head picker rebuild. I read that audit and retain its scoped findings; I did not repeat its rebuild or full target send. New fixtures require no product code or artifact change and have inspectable scripts, matching captures and effective policy state. A second rebuild adds no missing proof here.

Seeded 1440/390 light/dark pairs are UI comparison evidence, not eight event-backed handoffs. Actual source turn/detach/target delivery uses deterministic protocol peers, not external subscriptions/model comprehension. Native mobile remains unverified with Device access off; responsive web is not native. Electron shell/default desktop shortcuts remain unverified. No distinct Settings or command-palette handoff route is claimed. Cancelled-only history remains accepted without context where no eligible source exists; PASS1's contrary requirement is withdrawn.

The shared helper still checks source id, app-thread ownership and source provider instance; attached-session authority, active-run guard, empty-history and imported-history exceptions are unchanged. Reported 61 tests/four files and scoped format/lint/typecheck were not rerun in this proof-only audit.

## Appended draft-body claim check

Read `/tmp/to-19687-pr-body.md`; assessed only Takeover/Evidence and the appended verification log as requested. Behavioral claims are supported with their stated qualifications: actual detach plus stopped-server null-ref fixture, target transport marker, seeded pairs, session true versus injected false, preparing/no-session and missing-source controls, complete listed picker routes, and unverified native surfaces. No behavioral overclaim found in those scoped rows.

Two wording corrections before publication: replace “Rebuilt on current main” with “Rebuilt on the pinned main revision”; replace “temporary worktrees/state removed after auditing” with “retained evidence/state remains available for audit” unless cleanup is actually completed before publication. The worktrees and isolated state still exist at audit time; only process cleanup is verified. The replacement-PR CI sentence is forward-looking, not independently established CI evidence. Test/reviewer counts remain parent-reported. Fill FINAL_AUDIT with this published audit and matrix. The historical description is not revalidated by this appended-claims review.

## Cleanup and friction

Capture cleanup reports remaining=[] and portCheck=[]. Independently checked all captured PIDs: none present. No listeners on 8133, 8233 or 19207. My ffmpeg decode commands completed; I started no persistent processes. Checkout remains clean.

FRICTION category | happened | prevention
--- | --- | ---
capability provenance | False capability required response interception and Favorites projection replay | Keep explicit client-policy fixture label and effective-client state check; never call this real negotiation.
fixture lifecycle | Deferred runs are cancelled on shutdown | Create after startup and correlate capture against event/receipt timestamps; preparing is sufficient for active-run policy scope.
cache | Cached projection initially retained true session capability | Force fresh subscription in the disclosed fixture and inspect actual React state.
picker automation | Empty fill left filtering active; first Favorites route failed | Reopen picker, enter actual Favorites and assert changed composer label.
shortcuts | Default numbered shortcut is desktop-only | Show effective opt-in web binding and limit claim to it.
isolation | Copied synthetic project still points at prior synthetic workspace | Remap workspace roots before future rebuild; do not describe this as a separate fully isolated workspace root.
cleanup claims | Draft prematurely says worktrees/state removed | Report stopped processes separately from retained evidence/state and clean up only when authorized.
audit schema | Legacy-named v2 event tables were empty | Use current orchestration_events/command_receipts tables and query exact thread ids read-only.

VERDICT: SUFFICIENT