# Read-only proof audit — pass 2 full-surface correction

**VERDICT: SUFFICIENT** for the specified surrogate-safety scope, preserving ASCII/BMP truncation behavior. No blocking proof defect found. The whole-surface omission is corrected.

Target: [#13413](https://git.cafe/pingdotgg/t3code/pulls/13413) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/13413)), only `/home/ubuntu/wt/pr-13413`, branch `takeover/pr-13413`. Reviewed head [95c8f6b](https://github.com/pingdotgg/t3code/commit/95c8f6b2250479002501e44ac03560d1ba747a90), full SHA `95c8f6b2250479002501e44ac03560d1ba747a90`, against confirmed merge-base [7fd2e09](https://github.com/pingdotgg/t3code/commit/7fd2e09e381a61f427da09dd7a8f2c9c1558fe59), full SHA `7fd2e09e381a61f427da09dd7a8f2c9c1558fe59`. Clean at start and finish. Complete diff remains two shared String files, 31 insertions/1 deletion.

[Corrected evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f873df0b2e33f13f/evidence-index.md) · [Acceptance matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b6fad5004504bd62/matrix.md) · [Prior independent runtime audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a07c54c2fa442dfb/audit-report.md).

## Visual inspection, not structural inference

Opened and visually inspected ALL nine final images: before.png, after.png, before-after.png, Diff0.png, DiffT.png, before-frame1.png, before-frame2.png, after-frame1.png, after-frame2.png. Then downloaded all nine public PNGs afresh and verified byte equality with those inspected local images.

The six full sources/settled frames are native 1440×1000. Both states visibly render the complete app viewport: sidebar, project/header, normal “What should we build in server?” main empty state, composer, model/permission controls, branch row and bottom sidebar controls. The large dark main background is the normal rendered empty state, not an unrendered blank. No splash, error overlay, loading shell, clipped composer or other rendering defect is visible. Before visibly shows the broken glyph and suffix; after removes that glyph and retains three literal dots. Both ages read 9m. Dark theme, dimensions, sidebar boundary and text styling agree between states.

The composite labels identify Before/base helper 7fd2e09 and After/replacement helper 95c8f6b, explicitly saying “same replacement app runtime.” This correctly describes caller-output seeding; it does not claim a base application build. Panels contain the entire sources without scaling or cropping. Diff0 visually isolates the broken glyph/suffix region; DiffT marks the same region in magenta. Neither shows unrelated differences.

Independent calculations, not copied counts:

- Exactly **123** RGB-changed pixels across the entire 1440×1000 viewport; bounds `[403,138,427,151)` (24×13).
- Threshold maximum channel >16: **103** pixels. All differences lie in the glyph/dots region. Every pixel outside it, including the complete main pane, is identical.
- Before frame1 = frame2 = selected before source; after frame1 = frame2 = selected after source, byte-for-byte.
- Recomputed absolute RGB difference ×8 matches Diff0 exactly. Recomputed >16 magenta mask matches DiffT exactly.
- Composite dimensions 1440×2100; source panels at y45 and y1100 equal the sources exactly.
- All nine published SHA-256 values match the local images; public downloads match those same files.

Metadata and capture-driver inspection agree with 1440×1000 viewport, DPR1, dark theme, reduced motion, loaded fonts, fixed time, matching 14px/20px product font, and 614px title span with clientWidth=scrollWidth. Before DOM metadata retains 49 ASCII units, U+D83D, three U+002E; after retains 49 ASCII units and three U+002E. Seed driver correctly preserves the escaped surrogate in JSON payload instead of treating the normalized UTF-8 title column as authoritative. Historical browser/OS claims are metadata, not facts recoverable from pixels alone.

![Before (top), base helper; after (bottom), replacement helper — complete rendered 1440×1000 app viewports](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b4eeb38935c1e092/before-after.png)

## Matrix coverage

| Rows | Evidence assessed in this correction audit | Result |
|---|---|---|
| H1–H4 | Complete helper/test diff inspected; focused test rerun passes 1 file/3 tests. Generator rerun checks split, exact-fit, ASCII/BMP, trim, empty, zero and tiny boundaries. | SUFFICIENT |
| H5 | Generator rerun preserves existing lone-high/lone-low input behavior. This helper prevents new pair splits; it does not repair malformed input. | SUFFICIENT |
| T1 | Actual deriveThreadTitleSeed generator rerun; full corrected real-app before/after visual proof; prior independent fresh runtime reconstruction retained as expressly authorized. | SUFFICIENT |
| T2–T3 | Actual file/fallback branches rerun, including File prefix and boundary counts. | SUFFICIENT |
| T4 | Actual image/default branches rerun as unchanged controls. | SUFFICIENT |
| P1 | Actual plan builder plus helper rerun, including Implement prefix and boundary. | SUFFICIENT |
| M1 | 200-unit helper fixture rerun; source confirms compact/expanded/command consumers. No native UI capture claimed. | SUFFICIENT |
| R1 | Full real web sidebar proof visually inspected; suffix visible with no CSS overflow concealment. Desktop/mobile consumer coverage remains source-based, as matrix permits. | SUFFICIENT |
| U1 | Complete diff and listed caller paths inspected; no provider/contract/transport changes. No unrelated surface capture required by matrix. | SUFFICIENT |

Generator rerun: 13 helper/plan checks, 5 actual caller checks, 51 cut checks passed. Fresh fixtures.json equals the correction fixture byte-for-byte. Focused `vp test run packages/shared/src/String.test.ts` passed. No repo-wide checks run.

## FRICTION and limits

- Prior crop-only acceptance missed the explicit whole-surface requirement. It is supplementary runtime evidence only; acceptance here depends on this fresh visual inspection of the corrected full app sources, composite and diffs.
- This pass reused the prior documented independent fresh real-app reconstruction with zero sidebar delta, as the request expressly permits. It did not start a browser/server or independently recapture the new full frame. The correction uses an unselected sidebar row; the prior reconstruction used selected styling, explaining 123 versus prior 125 changed pixels. No cross-round full-frame equality is claimed.
- These captures prove rendering of actual caller outputs in the same replacement runtime. They do not prove send/provider/persistence flows, a base runtime build, native clients, or remote/relay/tunnel operation. That scope matches the matrix.
- Node emitted its experimental stripTypeScriptTypes warning; all generator checks and focused tests passed. No tool failure blocked this audit.
- This is proof sufficiency at the pinned replacement head, not CI or final merge-readiness certification. A later main merge changes SHA; the lead must verify the helper remains identical. This audit does not certify an unseen future merge result.
- No repository edit, commit, push, forge comment, watcher, delegation, live ~/.t3 read, browser/server launch or provider turn. Scratch only `/tmp/ev-13413-audit3`; existing correction artifacts read-only. App PR registration performed; public report upload authorized.

**VERDICT: SUFFICIENT — H1–H5, T1–T4, P1, M1, R1, U1.**

Report uploaded using the ghdrop skill. Model/harness: GPT-6.1-Sol through Codex in T3 Code.