# PASS3 independent proof audit

**VERDICT: SUFFICIENT for the bounded evidence claims below. No required repair remains.** This is an evidence verdict, not an implementation review or merge authorization. The original matrix's optional unchanged controls remain explicitly narrowed; this is not a claim that every original matrix cell was filmed.

Audited [#22226](https://git.cafe/pingdotgg/t3code/pulls/22226), mirrored [#22226](https://github.com/pingdotgg/t3code/pull/22226), macodev00, `cursor/clone-file-manager-12647`, target `main`. Head [6c0099b88e](https://git.cafe/pingdotgg/t3code/commit/6c0099b88ee0285f64aa73236f8b6a35422e2947) (`6c0099b88ee0285f64aa73236f8b6a35422e2947`); before [4f651cb10d](https://git.cafe/pingdotgg/t3code/commit/4f651cb10d2a885be82748e22a280eeef591200f) (`4f651cb10d2a885be82748e22a280eeef591200f`). Worktree `/home/ubuntu/wt/pr-22226` remains clean at the requested head.

Read the [original matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6a8a6f2773ab3932/matrix.md), [original index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56851d1054fee505/index.md), [PASS2](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9abeffda93453648/audit.md), and [repair index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1b525e24c5664d8e/repair-index.md), including renderer, narration, request/disk manifests and external mobile fixture sources. PASS2's same-head independent real clone and pixel comparison remain applicable. PASS3 independently decoded all ten repair movies, inspected 53 timestamped frames/contact-sheet cells plus full readable error/recovery frames, recomputed the new diffs, checked disk, source identity and public movie bytes. No new browser, device, build or runtime was needed.

## Final row accounting

“Sufficient” always carries the claim limits in this table. “Narrowed” preserves an optional unchanged omission rather than silently passing it.

| Row | Final status | Evidence and remaining limit |
|---|---|---|
| A1 | Sufficient | Original dark pair plus repaired continuous light pair: URL → confirm → Open in Files → empty picked before, cloned repo/main after. One base project.create; one head projectClone.start to picked/repo. Git/README agree. PASS2 independent head reproduction retained. |
| A2 | Sufficient | Original same-name repo/ request, recording and disk; direct repo, no repo/repo. Synthetic picker. |
| A3 | Sufficient | Original Linux Repo/repo case plus repaired trailing picked/ movie reaching repo/main; exact picked/repo request and Git/README. |
| A4 | Sufficient, synthetic path claim | Windows-configured command capture proves case-insensitive same-name and parent behavior. Disk deliberately denied. Light recording substitution retained; no native Windows success or denial-toast visibility claim. |
| A5 | Sufficient, textual | Imported helper gives /repo and drive-root child; no filesystem-root write. |
| A6 | Sufficient, bounded control | Original null/reject zero mutation counts and valid retry's one clone plus disk. Recording retry ends loading; common A1 supplies settled appearance. No native cancellation/timing claim. |
| A7 | Sufficient, bounded control | One deferred picker, zero pending mutations, one clone after release. Final appearance shared with A1; no native latency claim. |
| A8 | Sufficient, synthetic routing | Both UNC spellings map to exact Linux destinations with real clones; localhost movie reaches composer. Dollar variant's ending is textual/disk plus common appearance, not a separate settled film. |
| A9 | Sufficient, client rejection branch | Matched A-confirm/B-UNC base/head interaction: base permission fallback versus exact new head mismatch error; one picker each, zero clone/project mutations. B has no transport/session; successful base addition into B is NOT proved or required for this narrowed guard-order claim. |
| A10 | Sufficient, bounded unchanged control | Original visible unmapped-distro error, zero mutation, valid retry request/disk. Retry film ends loading; A8 supplies matching-route appearance. |
| A11 | Narrowed | Primary wsl:Ubuntu picker target evidenced by A8/A10; unchanged secondary bootstrap control omitted. |
| A12 | Sufficient | Repaired continuous legacy movie reaches repo/main; cloneRepository precedes project.create at returned cwd; disk passes. Tracking=false is a client capability fixture. |
| A13 | Sufficient, disclosed old notification | Original immediate/legacy errors and recovery plus repaired accepted-then-failed tracked clone and fresh successful clone. Second composer shows main and disk passes. First project's failure notification remains; it names the missing first remote, not recovery. |
| A14 | Sufficient, client-cache guards | Three separate repaired movies show both correct permission errors and correct disconnected error without stale permission toast. Each has one picker and zero mutations. No authoritative server-policy revocation or physical transport-disconnect claim. |
| A15 | Narrowed | Ordinary folder used for backdrop; dedicated unchanged normal/WSL add-folder control omitted. |
| A16 | Sufficient, browser control | Original plain web dark1440×900/light390×844: in-app clone, no desktop footer, composer ending. Same-name navigation variant omitted. Responsive browser proof. |
| A17 | Narrowed | Direct URL covers common confirm; unchanged lookup-provider entry omitted. |
| M1 | Sufficient, static iOS only | Plain mobile VERIFIED on actual iOS static fixture, real native destination components, light/dark402×874 normalized1x. Path, Clone project and folder browser visible; no desktop picker.393×852 substituted explicitly. No integrated clone/animation or Android-specific claim. |
| M2 | Narrowed | Controlled no-grants/empty/disconnected native variants omitted. Earlier unavailable diagnostic does not satisfy them. |
| M3 | Sufficient, static logic | Delivered focused log:2 files,10 tests passed; iOS-configured mocked logic prevents directory/project after either scope revocation. No native interaction inference. |

## Repair frame findings

Times below are sampled media times, not measured interaction latency. All ten movies independently probe as2880×1800. Inspection decodes used output-side ffmpeg seek and scale1440×900; full error frames were readable. No edit/stitch is reported by the capture operator; the inspected sequences are consistent with continuous captures, not a forensic guarantee about file history.

| Movie / duration | Independently observed sequence |
|---|---|
| A9 head64.110s | Environment selector at1s; confirm at50/56s; exact “Clone failed / Choose a folder in the environment the repository is cloned into.” at58/61s; expired by63s. Long setup hold is retained. |
| A9 base12.844s | Same A/B selector1s, URL4s, confirm then “Cannot add project / This connection cannot add projects.”6/9s; expired11.8s. |
| A12 legacy11.739s | Source1s, confirm/picker3s, repo composer5s, main settled10.7s. |
| A14 source10.135s | Source1s, confirm4s, correct Clone unavailable permission message5/8s, expired9s. |
| A14 orchestration9.990s | Same sequence; correct permission message5/8s, expired9s. |
| A14 disconnected11.063s | Source1s, confirm4s, “Environment unavailable / fs-04 is not connected.”5/8s; expired10s. No stale permission toast. |
| Light base11.091s | Source1s, loading destination3s, empty picked composer4/6/10s with Initialize Git and start-without-project hint. |
| Light head10.267s | Source1s, confirm/picker3s, repo composer4s, main settled6/9s. |
| A3 trailing11.066s | Source1s, confirm3s, transient loading4s, repo/main6/10s. Capturer's approximate4s settled narration is slightly early; no missing ending. |
| A13 recovery20.490s | Source1s, missing-remote pending4s, failed-project banner with Retry/Remove6/8s, new flow11s, valid confirm14s, recovered repo/main15/19s. Separate first-failure notification remains. |

The A9 narration calls the opening URL entry, but the1s decoded frame is still environment selection. These small narration offsets do not change the recorded outcomes. A13's long stderr is ellipsized in the toast; the missing-remote cause is readable and the transcript retains the full text. No claim that fresh recovery removed the failed project or used its Retry button: it creates a second project through a fresh valid flow.

### Why A9 does not need connected B for this verdict

Both revisions use the same local bare remote, primary A confirmation, synthetic B catalog/bootstrap mapping and returned `\\wsl.localhost\Ubuntu\proof\picked`. Head visibly rejects with the distinct changed message before dispatch; base visibly follows the old add-project path far enough to hit the existing permission fallback. Both record zero mutations, not zero wire traffic: head includes a harmless subscribeProjectClones request. This distinguishes the changed rejection branch from ordinary A1 and closes PASS2's exact requested UI-guard comparison. It does not establish successful pre-change cross-environment creation, B filesystem behavior, native WSL transport, or authoritative server enforcement. A connected authorized B would be needed only to make those additional claims.

### Revisions, renderers and fixtures

Complete saved diff byte-matches current git diff: exactly3 files,70 insertions, web CommandPalette/shared helper/helper tests. Each of those files byte-matches git-show in head and extracted base. The extracted iOS AddProjectScreen also byte-matches head. No mobile, server, contract, provider, style or Electron IPC diff. This verifies scope/provenance, not implementation correctness. Base still uses head workspace dependencies; additive changed helper is unused by base, as PASS2 established.

Browser repairs are Chrome154/Linux, CSS1440×900 DPR2 scale1 light, loaded system fonts16px/24px, synthetic postbootstrap desktop bridge. Actual Linux Git operations execute behind the bridge fixture. WSL/Windows claims remain application routing/path claims. Cached tracking capability and A14 grant/connection mutations are explicit fixtures. No OS dialog is filmed.

Mobile sources are the linked external [state fixture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/108073ac8597e428/ios-fixture-state.ts), [entry](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/52a0046dcf030ed5/ios-fixture-final-entry.tsx), and [configuration](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/14e692cf3890171c/ios-fixture-config.json). They mount real native components but replace state/RPC and forbid writes. Connected presentation is fixed; mode alone would not establish every M2 state. External-only recovery excluded unrelated terminal native autolink after GhosttyKit failure and hid splash; no screen implementation change. Actual light/dark static destination stills were re-inspected. Plain mobile is VERIFIED iOS STATIC FIXTURE ONLY.

### Pixels, disk, counts and publication

61 repair-manifest SHA256 entries match, zero mismatches. All10 public repair movies downloaded successfully and byte-match the independently decoded local files. Four successful repair destinations each contain .git plus README exactly `Proof fixture\n`; base picked is empty, not Git. Request counts match the final table; legacy has one cloneRepository then one project.create, tracked happy paths one start, A13 two distinct starts/destinations/remote URLs.

New light stills1440×900 recompute byte-exactly as absolute RGB delta×8/clamp and max-channel delta>16 hot-pink mask:108,814 nonzero pixels,30,307 above16. No mask/alignment/AA tolerance. Intended differences include picked→repo, empty-project hint/Initialize Git→current checkout/main/Git controls and composer position. Incidental differences include starting backdrop, sidebar age, independent IDs/paths, pointer/caret and codec rasterization. These are valid outcome diffs, not pixel-identity or performance proof. PASS2's independent head comparison remains268 pixels>16, mostly cursor/caret/raster; it does not prove other rows.

Independent machine-readable results: [verification](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/92203f411acb4f10/verification.json), [source identity](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/754de26e8cf41dea/source-identity.json), [video metadata](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0c3938e70179102c/independent-video-metadata.json). Decoded PASS3 frames/sheets retained under `/tmp/pr-22226-proof/pass3`.

Before — repaired continuous light outcome:

![Before: empty picked project](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6d2636583d9001b0/core-base-light-final.png)

After — repaired continuous light outcome:

![After: cloned repo with main checkout](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ef292fa0d3dc5154/core-head-light-final.png)

## FRICTION

| Category | Happened | Prevention |
|---|---|---|
| Artifact layout | Repair manifests live under repair/, not root beside repair-index.md. | Resolve linked artifact paths narrowly before reading; avoid recursive inventory of extracted runtimes. |
| Prior export synchronization | Original films ended before visible outcome. | Repairs retain decoded success endings and multiple error frames3s apart; validate exported media, not just DOM. |
| Synthetic B | No transport/session causes base permission fallback. | Bound conclusion to client guard ordering; require connected B only for successful cross-environment claims. |
| Notification contamination | Original A14 had stale toast; A13 still carries first failed project notification. | Separate A14 cases; retain and attribute A13 notification using missing remote plus distinct request/project IDs. |
| Narration granularity | A9 opening and A3 settled onset are approximate. | Use exact timestamped decoded frames as authority; make no latency claim. |
| Native fixture recovery | Requested viewport unavailable and unrelated terminal build failed in original capture. | Disclose402×874 and external-only recovery; preserve static iOS label and optional M2 omissions. |

No code/branch/ref changes, implementation review, PR edits/comments, watches, CI polling, agents, browser/device interaction or shared-runtime shutdown. Existing head/base/Metro runtimes retained. PR registered with thread and confirmed linked with watching=false. Evidence uploaded using the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md).

**VERDICT: SUFFICIENT. Required gaps: none within the bounded claims.** Optional omissions remain A11 secondary, A15 dedicated controls, A16 same-name, A17 lookup and M2 controlled native states. Broader native picker/Windows/WSL transport, integrated native clone and authoritative revocation claims are outside this evidence, not certified.