## Evidence v2 — B1/N1 retakes

Captured **5 / 5 matrix rows**, all with the real Android app. **Only B1 and N1 are replaced here; accepted U1, S1 and C1 narration/table entries are copied unchanged from the first index.** No unexpected rendered UI change observed. Target: [#25730](https://github.com/pingdotgg/t3code/pull/25730), supplied GitCafe counterpart [#25731](https://git.cafe/pingdotgg/t3code/pull/25731); local head [bbb9042e92](https://git.cafe/pingdotgg/t3code/commit/bbb9042e92b21c2341a392677bbb9715468359d7) (not pushed by this capture task).

**Environment:** 2026-10-28 UTC; agent-device 0.21.32 / shared Simlock pool; Pixel 9 portrait (sdk_gphone64_x86_64), Android 16 / API 36; 1080 × 2424 px; DPR 2.625 (~411.43 × 923.43 dp); font scale 1.0/default medium; light theme. Retakes use detached matching base/head checkouts and official cached APKs. Metro runs on 8081 from the matching checkout in each retake; original accepted rows retain their original setup. One unchanged head backend on loopback port 15734 backs both retakes, with a new explicit fresh scratch home and T3CODE_DEV_SEED=0. No advertised alternate HTTP/public/relay route, static fixture, provider turn or real user data. [environment.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/aceb8d1f2100834b/environment.txt)

**Clock limitation:** OS clock could not be frozen through the available tool. Status-bar time is masked consistently in all exported frames. A synthetic default thread and its age appear briefly during N1 startup; no relative-time UI comparison is claimed. Timing below is approximate video time; exact UTC protocol milestones are in transcripts. Android screenrecord is variable-frame-rate and ends at its last changed frame; exports preserve presentation timing at 15 fps and hold the last frame for 3 seconds. No outcome is fabricated.

**Retake order:** head pairing setup with regenerated root A installed → N1 removal/relaunch/retry → reinstall root A → B1 on base APK. The pool lease was closed/reopened from the base checkout so both installs could use the exact requested `vp run mobile:install android --session ca25730r2 --metro http://fs-13.tail131df4.ts.net:8081` command from their matching checkouts. User-store installation was reverified on the fresh B1 lease. Original accepted U1/S1/C1 recordings and their capture-order context remain unchanged.

**Native provenance:** base [71ba6b374c](https://git.cafe/pingdotgg/t3code/commit/71ba6b374c0b0181130c0cc3b3d5aaa3387ada67) versus head [bbb9042e92](https://git.cafe/pingdotgg/t3code/commit/bbb9042e92b21c2341a392677bbb9715468359d7). [native-artifact-proof.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1f9374cc97c962e0/native-artifact-proof.txt) records APK hashes, fingerprints, merged manifest network attributes and resolved resource. Head uses system + user anchors and cleartext=true, without debug-overrides; source plugin writes the main resource unconditionally. These are development-APK captures plus policy inspection, not a production-device recording.

**B1 — steps above recording** (record start ~01:45:19 UTC, 2026-10-28; native fingerprint `ed36a9cc9856c84a322bb71e6d67744f0a00877d`): 00:00 fresh private HTTPS pairing form; ~00:01 submit; **00:03** network failure; ~00:21 expand sheet; **00:24–00:27** read the complete network error above the gesture bar, with the same unobstructed state retained afterward. One contiguous take. TLS alert: **01:45:22.152 UTC**. Root A installed only in User store, separately shown in the supporting still.

| row | build | SHA | recording | transcript | result |
| --- | --- | --- | --- | --- | --- |
| B1 | base APK | [71ba6b374c](https://git.cafe/pingdotgg/t3code/commit/71ba6b374c0b0181130c0cc3b3d5aaa3387ada67) | [B1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/96916b0ce8bf4116/B1.mp4) | [B1-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/24e0b890c6f08ae7/B1-transcript.txt) | PASS — user CA installed, base rejects before HTTPS discovery; complete error unobstructed for ≥2 s; no synchronization. |


**U1 — steps above recording** (start 00:54:52 UTC, 2026-10-28; native fingerprint `0b110f6b762ef37e6f8d41fced4244ec904ac21a`): 00:02 submit fresh private HTTPS pairing; ~00:06 WSS generation 4/Connected; 00:29 open synthetic project (1 checkout); ~00:42 force-close socket at 00:55:34.570 UTC; ~00:43–00:53 app retries while proxy returns 503; rename project via authenticated RPC during outage; ~00:53 restore at 00:55:44.892; ~00:55 automatic new ticket and WSS generation 5; ~01:09 live renamed project visible. No Retry button used.

| row | build | SHA | recording | transcript | result |
| --- | --- | --- | --- | --- | --- |
| U1 | head APK | [bbb9042e92](https://git.cafe/pingdotgg/t3code/commit/bbb9042e92b21c2341a392677bbb9715468359d7) | [U1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6f026b7184e6f008/U1.mp4) | [U1-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/39a639bde01f7541/U1-transcript.txt) | PASS — HTTPS + WSS 101 + live read; forced socket close → automatic recovery, new ticket/upgrade and fresh read. |

**N1 — steps above recording** (removal take start ~01:33:19 UTC; retry take start ~01:36:01 UTC, 2026-10-28; native fingerprint `0b110f6b762ef37e6f8d41fced4244ec904ac21a`): **00:02** clean User store with root A present; **00:18** clean certificate/fingerprint view; ~00:31 Uninstall; **00:32** clean confirmation, then remove; **00:36** clean empty User store; **00:46** app relaunch logo. **Explicit cut at 00:50** omits raw 00:50–01:15 startup loading; **00:52** resumes on the loaded app showing Reconnecting to fs-13. **Explicit cut at 01:05** starts the separate contiguous saved-route retry take; ~01:07 manual reconnect in progress; **01:10** settled network rejection/offline diagnostics, held through **01:19**. Correlated certificate-unknown alerts: **01:36:04.500, 01:36:07.402, 01:36:10.125 UTC**. No blank or ghosted frame at narrated settled checkpoints. Cached New thread is not live evidence.

| row | build | SHA | recording | transcript | result |
| --- | --- | --- | --- | --- | --- |
| N1 | head APK | [bbb9042e92](https://git.cafe/pingdotgg/t3code/commit/bbb9042e92b21c2341a392677bbb9715468359d7) | [N1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0a93afd9c12bd8d2/N1.mp4) | [N1-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2522c2e06ae374bb/N1-transcript.txt) | PASS — valid saved credential, regenerated root A removed, app relaunched, same private endpoint rejected on explicit retry. WSS rejection independently unexercised because HTTPS preflight fails. |


**S1 — steps above recording** (start 00:44:23 UTC, 2026-10-28; native fingerprint `0b110f6b762ef37e6f8d41fced4244ec904ac21a`): 00:01 submit fresh public HTTPS pairing; ~00:05 WSS 101/Connected; ~00:16 inspect public system-trusted route In use; server-side rename at 00:44:46.654 UTC; ~01:02 open project and read System trust canary. Root A remains absent after N1.

| row | build | SHA | recording | transcript | result |
| --- | --- | --- | --- | --- | --- |
| S1 | head APK | [bbb9042e92](https://git.cafe/pingdotgg/t3code/commit/bbb9042e92b21c2341a392677bbb9715468359d7) | [S1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4122ef00f204fa20/S1.mp4) | [S1-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0566eaab122118e/S1-transcript.txt) | PASS — public HTTPS + WSS + live server canary. Saved private route is inactive and untrusted; active public route is proved by transcript. |

**C1 — steps above recording** (start 00:47:48 UTC, 2026-10-28; native fingerprint `0b110f6b762ef37e6f8d41fced4244ec904ac21a`): 00:01 submit explicit direct http:// endpoint; ~00:04 WS 101/Connected and HTTP route 1 of 1; server-side rename at 00:47:58.250 UTC; ~00:24 new title appears in Settings; ~00:41 project read shows Cleartext/1 checkout. No TLS redirect.

| row | build | SHA | recording | transcript | result |
| --- | --- | --- | --- | --- | --- |
| C1 | head APK | [bbb9042e92](https://git.cafe/pingdotgg/t3code/commit/bbb9042e92b21c2341a392677bbb9715468359d7) | [C1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f34f244bdef90134/C1.mp4) | [C1-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6841cd2ff2b8e495/C1-transcript.txt) | PASS — direct HTTP + plain WS 101 + live read; no alternate TLS route. |

**Before / After outcome still** — settled source pairs matched byte-for-byte with screenshots more than 500 ms apart; all exported stills and recording review contact sheets opened and inspected. Different connection outcomes are not a pixel-diff fixture.

![B1-vs-U1-v2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ca9c2e7e9fc04579/B1-vs-U1-v2.png)

**What else changed visibly:**

- Root A and its leaf were regenerated for these B1/N1 retakes because the original private keys had been deleted. The new root/leaf are consistent across both retakes and successful N1 head setup; accepted U1 still uses the original root/leaf. This is a disclosed certificate/key/date/fingerprint difference, not an identical-certificate replay. [certificate-proof.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/026eaeab8c201dad/certificate-proof.txt) and public [android-ca-proof.crt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f97a3a9b558a6493/android-ca-proof.crt).
- B1’s sheet is expanded farther so the full error clears the gesture area. N1 now shows expanded environment diagnostics after the explicit retry. These presentation/navigation states differ from the original rejected captures.
- No unexpected styling/layout change observed. The comparison intentionally shows different unchanged screens: B1 retains Add environment over the unconnected Chats background; U1 has navigated to Settings → environment detail after successful pairing.
- Consequently the header/back/search controls, dimmed background, QR/instructions/address/code/error fields on B1 and connection label/URL/save/reconnect/remove controls, route/permissions/version sections and selected Settings tab on U1 differ. These are navigation and connection-state differences, not a UI-source change.
- Successful rows show the same synthetic project with deliberately changed canary suffixes/initials (Reconnected, System trust, Cleartext) and one checkout. N1 may retain a cached synthetic New thread and its age after relaunch.
- Endpoint text differs by fixture: private HTTPS, public HTTPS and direct HTTP. Pairing codes are redacted where visible; the top 80 px containing OS time is masked in every export. No other captured visible differences identified.

**Replacement supplemental stills and trust-store controls:**

![B1-outcome.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/49b3724eef17aa12/B1-outcome.png)

![N1-outcome-v2.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/638c74f52a74baa2/N1-outcome-v2.png)

![N1-root-present.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/71fd9ffb3c49665b/N1-root-present.png)

![N1-certificate.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c745ed0f2a6c1e7e/N1-certificate.png)

![N1-root-absent.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c11b0c22eae46da3/N1-root-absent.png)

![B1-root-present-final.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ede38d56efc5d430/B1-root-present-final.png)

![N1-setup-connected.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a88a7624360caf37/N1-setup-connected.png)

Accepted U1/S1/C1 supporting stills remain unchanged: ![U1-outcome.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/36e3576d46b6778c/U1-outcome.png) ![S1-outcome.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/93dbac4b655f6ec6/S1-outcome.png) ![C1-outcome.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/47f5d96d6f4e5429/C1-outcome.png)

**Original capture scripts** (retained for accepted U1/S1/C1; B1/N1 retake drivers are listed separately below):

- [generate-certs.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2d0710d746753568/generate-certs.sh)
- [prepare-public-cert.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/faeff0bf4d6be722/prepare-public-cert.sh)
- [proxy.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/907df202e7c9c9bb/proxy.mjs)
- [http-observer.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7855cda1fba98e35/http-observer.mjs)
- [seed-and-canary.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e54181ede25de8f9/seed-and-canary.mjs)
- [pair-row.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4825b6dc1fedea9c/pair-row.mjs)
- [pair-row.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cef582d8c936d2f6/pair-row.sh)
- [redact-captures.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/386ca9d807b63d4d/redact-captures.py)
- [build-evidence.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ed441f98cbbf19c4/build-evidence.py)
- [write-index.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/588ea78d76d48c2c/write-index.py)

**Original capture artifacts** (including the original root A; regenerated B1/N1 root is linked above): [android-ca-proof.crt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8ba461080763cfdd/android-ca-proof.crt) (public root A only), [render-environment.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2a2e3a3818a74dcf/render-environment.txt), [cleanup.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1edc79d26e253f06/cleanup.txt), [friction.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0e4035b8e8cf08b3/friction.txt).

**Retake scripts and verification artifacts:**

- [generate-certs.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e4265ab7a701a204/generate-certs.sh)
- [proxy.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4bf13b707e4299ee/proxy.mjs)
- [seed-and-canary.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d87e4d69a98e29e5/seed-and-canary.mjs)
- [pair-row.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/107ad5c8d2536b41/pair-row.mjs)
- [redact-captures.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e398c784effc3960/redact-captures.py)
- [export-v2.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/128d1dec48a8e790/export-v2.py)
- [stable-still.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/713fb05fe2e27c70/stable-still.py)
- [device-step.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8910a682e99f214e/device-step.py)
- [review-frames.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ae8935b8f6f6d9f2/review-frames.py)
- [build-transcripts.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3cc7fcc81aee5272/build-transcripts.py)
- [build-stills.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7abaaf29c57ef40c/build-stills.py)
- [write-index-v2.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/113476e8ccb1d2b6/write-index-v2.py)
- [still-stability.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/75ccc51fdc5dd701/still-stability.jsonl)
- [N1-edit-map.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7fcbb2cb1e3da468/N1-edit-map.json)
- [cleanup.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3455f689fb239c46/cleanup.txt)
- [friction.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bc65514abab5931c/friction.txt)

**Unverified matrix rows:** none. Limits: no production-device run; N1 fails at HTTPS before WSS; OS clock not frozen as disclosed; root A/leaf regenerated for B1/N1 only; explicit N1 cuts as narrated. No required recapture is missing.

**Retake FRICTION:**

```text
tool | Android document picker taps on certificate and folders reported success but did not navigate; pool then returned Remote daemon is unavailable | healthy device input and pool gateway
tool | Android record stop initially could not confirm screenrecord PID ownership; same-session retry exported intact 16.2s retry footage | reliable recorder ownership probe; retry record stop before new recording
infra | intermittent pool Remote daemon is unavailable / worker not connected responses during setup | stable pool worker/gateway; one-minute recovery retry
runbook | mobile:install in base checkout refused a device lease owned by the head checkout | closed completed N1 lease, reopened same session name from base checkout, then used requested base mobile:install command
```

Cleanup confirmed: [cleanup.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3455f689fb239c46/cleanup.txt). `agent-device close --session ca25730r2` returned `Closed: ca25730r2`; tracked backend/Metro/proxy processes stopped and listener ports clear; both extra worktrees removed; private keys deleted. Available disk: 18 GB. Existing checkout and original evidence retained unchanged.