# Proof audit, pass 2

PR [#22208](https://git.cafe/pingdotgg/t3code/pull/22208), head [c26f661943](https://git.cafe/pingdotgg/t3code/commit/c26f661943871dc2f537faa7e6a8b070264154f9).
Read-only independent audit in a detached checkout; no production edits, commits, pushes or comments.

## Findings

1. **M05 contradicts the matrix and current PR description.** The description says a stepper click saves the first age; matrix M05 expects activation then + to commit 9 and - to commit 7. The delivered after recording and [transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d826f97fa124d009/M05-WL-after.json) instead show null authoritative state and disabled Delete now after each first-age stepper/key action, with the write occurring only at the extra Enter/external-focus step. For example, increase readback at 13.64s is null; the 9 write is at 14.933s. Saved-rule stepping does immediately save 31. The current implementation explicitly holds first-age stepping. Revise the claim/expectation to the intended behavior, or supply matching implementation and proof. This is a contradicted proof claim, not an inference that delayed stepping is itself wrong.
2. **M17 comparisons contain unrelated changes.** `M17-WL-mixed-artifacts-diff0.png` and `M17-WL-mixed-artifacts-diffT8.png` light up only the blurred environment badges in the left sidebar, while the settings content itself is identical. The index acknowledges badge color/order and cleanup-summary destination-order variation. Disclosure is accurate, but the brief explicitly excludes diffs lit by non-PR changes. Recapture with deterministic environment identity/order on both sides. [Diff0](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/01bcf13eb5f74971/M17-WL-mixed-artifacts-diff0.png), [DiffT8](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f0b269e3d98b5fff/M17-WL-mixed-artifacts-diffT8.png).
3. **M14/M15 retain a previous-state overlay in later checkpoints.** `M14-fault-harness-ND-after-retry30.png` shows successful 30 with the previous first-save failure toast still covering the artifact label/description; the WL retry and before retry also retain that toast. `M15-fault-harness-WL-after-off-pending.png` still displays the earlier edit-45 failure toast while the new Off request is merely held. These are real production toasts, not rendering artifacts; nevertheless the brief explicitly disqualifies stale overlays from previous states. Capture the later checkpoint after dismissing that earlier toast. Failure checkpoint toasts themselves are appropriate. [M14 retry](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/490d91ba04b40073/M14-fault-harness-ND-after-retry30.png), [M15 pending](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f9585da76d359164/M15-fault-harness-WL-after-off-pending.png).
4. **M06 remains incomplete.** Ordinary Escape and synthetic composing Enter/keyCode 229 are captured, but composing Escape dismisses Settings and there is no paired post-composition ordinary-cancel proof. The capturer correctly lists this gap. The ordinary baseline Escape still `M06-WL-before-escape-true.png` also exposes the background project menu, which should be normalized for a clean cancellation comparison.
5. **M16 does not establish the replacement-prop branch.** The final authoritative readback is 60 while `M16-WL-after-external60.png` visibly remains 45. Its transcript label “external60 replaces local45” is therefore unsupported. The capturer correctly marks the row unverified. The draft-reset conditional comes from main unchanged: this is not proof of a PR regression. [Frame](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b6592a8f042567aa/M16-WL-after-external60.png).
6. **M19 has no paired unavailable-plan warning/false/Off proof.** The failed context-harness attempt does not fill that row.
7. **The PR body still presents the previous F-row evidence round and earlier revisions.** Replace that active evidence section with the supplied M-row index, final-equivalence note, current count and remaining gaps. Its old “stepper click” claim is contradicted as above. I audited the new supplied package, not the superseded evidence archive linked by the stale body.

## Row decisions

| Row | Status | Proof assessment |
|---|---|---|
| M01 | SUFFICIENT | All four callers, both pages, Off/saved, WL/WD/NL/ND; zero and 3,650 visible. |
| M02 | SUFFICIENT | All four WL callers plus one/page in other cells; null/zero writes on activation, one 8 write on Enter, exact-state reload. |
| M03 | SUFFICIENT | Edited 30, explicitly retyped 8, custom-global worktree destination and reload. |
| M04 | SUFFICIENT | Pointer/keyboard external blur saves; internal switch focus holds draft; untouched external blur cancels. |
| M05 | INSUFFICIENT | Captures establish delayed first-age stepping; matrix/PR claim immediate commit. |
| M06 | INSUFFICIENT | Composing Escape/post-composition cancellation missing; background-menu comparison contamination. |
| M07 | SUFFICIENT | Pointer, keyboard and actual touch event order; edited/untouched cancellation makes zero writes. |
| M08 | SUFFICIENT | Outside click/Tab, page, close/reopen, scope and Advanced exits; null readbacks and no revived drafts. |
| M09 | SUFFICIENT | Empty/partial invalid draft and saved values, held-age invalid edit; no stale age/null writes. |
| M10 | SUFFICIENT | Saved 45/re-entry, exact reload, local edited age then Off without intermediate write, settled zero Off. |
| M11 | SUFFICIENT | Ordinary 0→1, 30.6→31, 9999→3,650; settled zero/max clamp and exact reload. |
| M12 | SUFFICIENT | Actual project/checkout Custom destinations, 30/0, cancel, Inherit/Off, global/non-target readback, scoped Maintenance absence. |
| M13 | SUFFICIENT | Labelled hold-before-apply, pending same-age dedup, real release and exact reload. |
| M14 | INSUFFICIENT | Failure/retry persistence proved; later success still contains earlier failure overlay. |
| M15 | INSUFFICIENT | Edit/Off failures and final restoration proved; Off-pending still contains earlier edit-failure overlay. |
| M16 | INSUFFICIENT | Server 60 is proved; displayed input reset from local 45 is not. |
| M17 | INSUFFICIENT | Real remote-connected second disposable environment, convergence and both partial outcomes proved; unrelated identity/order pixels invalidate comparisons. |
| M18 | SUFFICIENT | Real serial dispatch of 30/60/30, first failure preserves newer submission; pending Off omits 1; stale failure preserves 45; Escape dismissal/reopened completion. |
| M19 | INSUFFICIENT | No paired unavailable-plan harness proof. |
| M20 | SOURCE ONLY | Unchanged gates deliberately excluded from the minimum. |
| M21 | SUFFICIENT | Actual Linux Electron shell 1280×900: focus, Enter, Escape retains Settings, saved Off. |

13/20 required rows sufficient under the brief; M20 excluded. This is proof acceptance, not a merge verdict.

## Visual and structural inspection

I visually opened all 40 delivered contact sheets, including every Before/After/Diff0/DiffT8 cell for all 133 paired checkpoints. I inspected all 56 recordings through 76 action-aligned filmstrips covering all 415 narrated steps (1,999.86 seconds of source video); this was frame inspection rather than continuous video playback. The audit archive preserves those filmstrips. Some sampled action frames fall during intentional reloads; those transient frames were not treated as settled checkpoint proof.

I additionally opened these individual original full-resolution images: M17-WL before/after mixed-artifacts and its two diffs; M14-fault-harness-ND after retry30; M15-fault-harness-WL after off-pending; M16-WL after external60; M06-WL before/after escape-true; M17-ND after partial-B; M18-fault-harness-WL after queued-final; M21-EL after escape; and the independently rebuilt M02 NL activation.

All 133 pairs have matching before/after dimensions: 92 at 1440×1000, 37 at 390×844, 4 at 1280×900. I independently recomputed all 266 diffs: exact absolute RGB delta amplified ×32 at threshold zero; max-channel delta strictly greater than 8/255 masked and amplified ×8. Every delivered diff matched exactly; 42 pairs are pixel-identical. Theme/viewport/clock/locale/DPR metadata agrees within each pair. No masks, registration or crops were used.

All before manifests pin [5d91ab1117](https://git.cafe/pingdotgg/t3code/commit/5d91ab1117ad51ef1288a94717d85c70e7af09fe). Settings production code at [f4f0f1aa21](https://git.cafe/pingdotgg/t3code/commit/f4f0f1aa2151058e1eb420c8619da87e5fa5874f) is byte-identical to the audited head. Older [d49890f43f](https://git.cafe/pingdotgg/t3code/commit/d49890f43f8e7266d1e4416add562fa6c99157e2) captures are M01/M02/M03/M04/M06/M08/M11/M13/M16. Those paths do not paste into a held draft or invoke saved-rule Off, so the two later production changes do not invalidate their rendering. Rows exercising saved Off, failure restoration, invalid held input and race behavior are captured at f4f0f1aa21. The M06/M16 gaps remain independent of revision validity.

## Independent reconstruction

Rebuilt M02 NL artifacts-activated at c26f661943 using the uploaded driver, changing only the scratch root, Playwright dependency path, after-server port and recorded SHA. Isolated T3CODE_DEV_SEED=0 server; no live T3 data accessed. Same environment: Linux x86_64 fs-36, Playwright 1.60.0 headless Chromium, disable-gpu, en-US/UTC, DPR 1, zoom/font scaling 100%, reduced motion, 390×844 light, frozen 2026-10-27T06:30:00Z. The settled image is exactly equal to delivered `M02-NL-after-artifacts-activated.png`: **0 changed pixels, 0 pixels above 8, maximum channel delta 0**. The archive contains rebuilt PNG/transcript/driver and pixel-audit data.

## Cleanup and forge snapshot

The detached checkout stayed clean. The isolated dev server was stopped through its tracked session; its two ports are closed. The recorded browser PID has exited. Own worktree and scratch are removed before handback; lead-owned paths untouched. Only redacted logs are archived; authentication files are excluded. Latest read-only GitCafe status: same audited head, 28/28 checks successful; review decisions were not separately fetched in this proof audit. No forge mutations.

FRICTION:
infra | Intermittent DNS failures interrupted parallel evidence downloads; all 720 listed files were ultimately fetched using retries and a resolved-address fallback. | Reliable resolver access for the evidence host.
tool | Built-in Browser reported unavailable; opening about:blank/unsafe local port failed. The explicitly requested reconstruction used the uploaded Playwright driver. | A working Browser panel or a documented driver-only audit path.
runbook | Uploaded driver hard-codes its old worktree dependency path, scratch root and ports. | Accept these as driver parameters.
tool | No native video playback was available; all recordings were inspected through action-aligned extracted frames. | A video-inspection tool with timestamp navigation.

VERDICT: INSUFFICIENT M05 M06 M14 M15 M16 M17 M19