# Proof audit pass 1 — issue 24812

Scope: read-only source/proof review; no captures, runtime execution, source edits, pushes, comments, watches, or PR creation. Read checkout AGENTS.md. Full diff reviewed against main merge-base 5398be0d44ef06fb1646d8ad54b81b5613a03193 at HEAD 381080517e4932f3ff4c59f719ad9d0d6717e0e9. Only CdpRelay.ts and CdpRelay.test.ts differ. Those files are identical to pre-main-merge fix 3a919cbba96435aa080f19c04159d76cf26424a5.

## Decision: visual fixture matrix is empty

The explicit internal-protocol exception applies. The desktop relay resets the shared native Runtime domain before the first page Runtime.enable on each relay connection. No visible render surface, component, styling, snapshot rendering algorithm, or UI interaction was changed. Recovery of automation snapshot availability is observable protocol behavior, not a new visual state requiring before/after images or recordings. Visual fixture rows: zero. Recording rows: zero. Do not manufacture UI evidence.

Call paths reviewed: DesktopBrowserHost.relayFor shares the manager-owned debugger; release and announceAll discard the relay without detaching the debugger; the next command creates a fresh connection. ServerBrowserContexts.connectDesktopPage connects Playwright over CDP. ServerBrowser.executeTabOperation(snapshot) calls ServerBrowserPage.snapshot with renderScale="display" for desktop. That snapshot combines Playwright evaluation/ARIA context access and native screenshot/metrics. Headless web pages take the separate persistent/shared browser path. No contracts or client render paths changed.

## Protocol fixture table (not a visual matrix)

| Case | Required observation | Existing evidence / remaining requirement | Recording |
|---|---|---|---|
| First page Runtime.enable, native Runtime disabled | Native disable completes before enable; default context reaches synthetic page session; first actual snapshot succeeds | Added regression checks first context; supplied runtime round 1 passes | None: internal protocol |
| New relay, same guest and still-attached debugger, Runtime already enabled | Reconnect receives default context; actual snapshot succeeds without native debugger detach, page reload, replacement guest, or retry workaround | Added test checks second context; supplied baseline round 2 fails while raw native evaluation succeeds; exact-head runtime success required | None: internal protocol |
| Repeated page enable in same connection, including an extra synthetic page session | Only one disable per connection; subsequent enables still forward; all synthetic page aliases map to native main page | Code uses shared memoized runtimeReset; not explicitly covered by added regression; focused deterministic protocol assertion required for full branch coverage | None: internal protocol |
| Disable pending / concurrent page enables | Every enable waits for the same disable; no premature enable or second reset | Promise ordering visible in source; not explicitly tested; deterministic deferred-send assertion covers this without timing waits | None: internal protocol |
| Native Runtime.disable rejects | Catch permits Runtime.enable to run and preserves enable success/error result routing; no claimed guarantee that native contexts recover after a failed reset | Not explicitly tested; inject rejection in protocol fixture | None: internal protocol |
| Native Runtime.enable rejects | Existing relay error reply keeps command id and session id | Generic receive error mapping unchanged; focused assertion if claiming complete changed-path coverage | None: internal protocol |
| Child frame/worker Runtime.enable | Original params and real child session forwarded, no main-page reset | Branch excluded by child check; existing test covers child DOM forwarding and resume, not child Runtime.enable; focused assertion closes gap | None: internal protocol |
| Other commands, browser/root sessions, main-page runIfWaitingForDebugger | Existing dispatch, passthrough, and page-resume bypass remain unchanged | Existing relay tests cover routing, extra page aliases, resume, events, downloads; full focused file should pass | None: internal protocol |

Rows retain protocol distinctions; they are not collapsed by screenshot similarity. The first two rows are the minimum bug proof. Remaining rows are changed-branch safeguards, not a demand for extra Electron runs or UI captures.

## Minimum acceptance proof

1. Run the named regression `reports the page's default execution context to every connection` from CdpRelay.test.ts on test-only baseline 23c7858311e866f2cc3b1113fb6f826707239824 (production relay unfixed): first connection passes, second expected context assertion fails. Then run the focused CdpRelay.test.ts file on exact final HEAD 381080517e4932f3ff4c59f719ad9d0d6717e0e9 and retain passing output. If using main baseline 5398be0d44ef06fb1646d8ad54b81b5613a03193 instead, apply only the added regression in an isolated disposable fixture, record that test-only modification, and retain the failure. Do not describe baseline's absent test as a regression failure.
2. Real Electron transcript using the supplied driver and actual ServerBrowserPage.snapshot(renderScale="display"): same BrowserWindow/webContents, debugger attached exactly once; round 1 relay+Playwright snapshot succeeds; close Playwright/relay while retaining guest and native debugger; round 2 new relay+Playwright connection uses that same guest. At unfixed baseline raw native Runtime.evaluate succeeds in both rounds, snapshot passes first and times out second. At exact head raw evaluation and snapshot pass both rounds, with expected heading/button accessibility tree and valid nonzero screenshot dimensions. Snapshot image bytes need not be uploaded. No page reload or replacement guest between rounds.
3. Each transcript must state source SHA (and clean/modified status), Electron version, OS/architecture/display mechanism, relevant Playwright version, driver identity/bundle build source, same-guest identity and debugger attachment count. Existing driver logs round results but does not print these provenance/identity facts. Add them to the external runner/transcript metadata, never source scratch. Ensure any bundled relay is rebuilt from the stated SHA: the .cjs driver requires TypeScript and was evidently bundled externally; old probe-bundle.cjs alone is not head proof.

Required source pair: baseline 5398be0d44ef06fb1646d8ad54b81b5613a03193 and head 381080517e4932f3ff4c59f719ad9d0d6717e0e9. The test-only baseline 23c7858311e866f2cc3b1113fb6f826707239824 is also valid for the failing regression and a runtime baseline if explicitly identified. Pre-merge fixed 3a919cbba96435aa080f19c04159d76cf26424a5 demonstrates identical relay code, but final-head provenance should still be explicit. Supplied baseline log does not contain its SHA, so do not silently assign one.

## Evidence reviewed and limits

- Supplied baseline runtime: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a9c857186b2e1d74/runtime.log ; local /tmp/issue-24812/runtime.log read. Round 1 snapshot passes with heading/button and 900x573 image; round 2 native evaluation succeeds and snapshot returns busy timeout.
- Driver: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/21400988e03ca523/probe.cjs ; local /tmp/issue-24812/probe.cjs read. Single debugger attach outside two-round loop and same BrowserWindow retained. Calls actual snapshot with display scale. It exercises actual relay/native debugger/Playwright/snapshot integration, bypassing host/server transport orchestration; do not label it a complete packaged-app end-to-end run.
- Electron 44.9.3 Linux Xvfb is lead-reported environment metadata; log itself does not print version/platform. This audit did not execute the test or runtime.
- Original macOS reporter environment: unverified by this pass; Linux success would not establish macOS verification.
- This VM Linux: baseline behavior observed in provided evidence; exact-head runtime and baseline/head test outputs not supplied to this pass. No independent browser or captures performed.
- Remote/relay/tunnel transport, packaged desktop host release lifecycle, multi-environment operation, native child/worker runtime cases: not runtime-verified here. Transport and UI code unchanged; no extra screenshots required. Web/headless and mobile rendering paths unchanged and outside this relay fix.

Proof verdict: protocol-only exception accepted; supplied baseline is a relevant reproduction, but complete proof cannot be certified until named baseline/head regression outputs and SHA-attributed head runtime transcript are attached. Prior MERGE reviews are reported context, not replacement proof.

FRICTION | path lookup | PreviewManager.ts lookup did not exist; actual owner is preview/Manager.ts | use caller imports and rg before speculative paths
FRICTION | evidence provenance | supplied runtime lacks source SHA and Electron/platform metadata | print build identity and environment at runner start