# Issue 3714 proof audit, pass 2

No blocking findings. The final diff and supplied behavioral evidence are sufficient for this server-only diagnostic fix under the requested proof rule. This is proof acceptance, not a claim that every transport or native host was exercised.

Issue: [#3714](https://git.cafe/pingdotgg/t3code/issues/3714). Audited 2026-10-22 UTC by gpt-6.1-sol through the Codex harness.

Reviewed clean branch fix/issue-3714 at [707d3a9487](https://git.cafe/pingdotgg/t3code/commit/707d3a9487988f69f6f0e16666142b8835d85c2c), against [3b95e7831b](https://git.cafe/pingdotgg/t3code/commit/3b95e7831b11b17627dff16843bc087bfca397ec). Read the worktree AGENTS.md and independently inspected the complete final diff and relevant callers. No repository edits, tests launched, browser, dev server, subagents, forge commands, push or PR. Only this requested temporary report and public upload are produced. Existing implementation review verdicts were not substituted for this inspection.

## Row-status ledger

Visual matrix: **EMPTY, 0/0 rows**. No affected capture. No rendered path changed, so before/after captures, pixel diffs and capture rebuilds are inapplicable. The fixture screenshot omitted from the runtime JSON is not claimed as visual proof.

| Behavioral row | Status | Evidence and limits |
| --- | --- | --- |
| Immutable candidate and scope | PASS | HEAD and clean status verified locally; five files, 113 insertions, 4 deletions. Full base-to-final diff inspected; git diff --check passes. |
| Unchanged regression fixtures | PASS | Both current committed test hashes match the bundled copies and both red/green log headers. Base: 2 failed, 40 passed, exit 1. HEAD: 42 passed, exit 0. Failures are exact diagnostic/forwarding assertions, not browser setup failures. |
| Missing CSS and missing role locator | PASS | Exact-base/final real-service transcripts show 15000ms timeout, target count 0, preserved timeout tag, unchanged bad-click count, and final target-specific text with fresh-snapshot advice. |
| Existing hidden and disabled targets | PASS | Both count 1; exercise scroll waiting and locator.click waiting respectively. Final text describes an element still matching after timeout and warns that the action may have occurred. No bad-click side effect in these stable fixtures. |
| Working controls and recovery | PASS | Working CSS before/after failure, fresh aria-ref and coordinate clicks; final working counter 4, badClicks 0. Disabled-to-enabled auto-wait increments once. Same tab/connection remains usable. |
| Dispatched click followed by navigation timeout | PASS, bounded fallback | Runtime records one slow navigation request and persisted dispatched=yes. Post-timeout count cannot complete during pending navigation, so original locator.click timeout is preserved. Recovery succeeds. This does not prove the count-success branch after dispatched navigation; source wording remains truthful there. |
| Rejected or hanging diagnostic count | PASS, controlled probes | Separate fault driver invokes actual helper with injected page/locator faults. Original error identity retained; one count attempt; hanging count returns after about 251ms. Source bounds the race at 250ms and clears its timer. These are not real-browser failure transcripts. |
| Coordinates and other errors | PASS | Coordinate success in runtime, original coordinate error in controlled probe. Ref lookup remains outside the new catch; non-timeout errors pass through unchanged. Existing green suite covers ambiguity, stale/foreign refs and dialog completion. Button/count options and dialog cleanup remain unchanged in extracted clickTarget. |
| Trusted server timeout and compatibility | PASS | Actual broker probe forwards non-click waitFor reason capped at 500 chars; legacy-host reason absent; one request each. Existing server/non-server execution-error tests pass. No-response generic error/no replay path is unchanged and source-inspected. |
| Optional reason contract | PASS | Optional string, old exact generic summary retained without reason; final encode/decode round-trip retains reason. Does not claim a live mixed-version deployment test. |
| Current desktop attachment | SOURCE VERIFIED; runtime UNVERIFIED | ServerBrowser.connectDesktop connects the desktop page; createTab selects it; runOperation(click) calls the same ServerBrowserPage.click; broker registration uses preferred server-browser identity. Current desktop does not categorically bypass this helper. Native attachment was not run. |
| MCP HTTP envelope | UNVERIFIED, disclosed | Pinned runtime is broker.invoke -> real ServerBrowser stream -> page helper -> actual T3-pinned Chromium. isError is the driver's mapping, not an observed MCP envelope. Handler source delegates click to the broker; no final-host HTTP transport run is claimed. |

## Evidence provenance and claim truth

Inspected the local evidence report, raw base/final runtime JSONL, red/green assertion logs, both drivers, controlled compatibility JSONL and checksum manifest. Every SHA256SUMS entry verifies. Independently hashed current ServerBrowserPage.test.ts as 3f3ddd419250f1b4ce62931200c42da0874113ed42f88e2e6ae23457d0d93478 and PreviewAutomationBroker.test.ts as 4af3b8a748440817dda660f5138fd76430544266148df2e907ae0d9a2a3ebc18, matching both evidence runs. Chose the expressly permitted hash recheck rather than another browser test run.

The runtime driver imports the real services from its supplied revision root and obtains HEAD via git. It uses isolated temporary state, fixture environment identity, real manager/config/desktop-unavailable channel and the installed Chrome for Testing headless shell 154.0.8037.92. It does not mock the browser or broker host. Recorded revision identities match the requested base and final HEAD. These are supplied execution artifacts verified for consistency, not executions independently repeated by this auditor. The lead's live MCP symptom transcript has UNKNOWN host SHA and remains symptom-only evidence.

Pass 1's dirty implementation and differing-fixture concerns are resolved by final committed source and identical final test bytes on base and HEAD. Pass 1's request for an actual MCP transport transcript is narrowed by the explicitly supplied server-only acceptance rule: real app-service runtime is sufficient here, with HTTP/native transport limits retained rather than silently relabeled as tested.

The prior misleading never-clickable claim is fixed in production text at final HEAD. Both diagnostics qualify the observation as after timeout. The existing-target message expressly warns that the click may have happened. The missing-target message does not assert absence throughout the wait. The page test title still uses older shorthand, but its exact assertion checks the truthful final message; this is not a functional or proof blocker.

## Fallback, compatibility, and other changes

The normal click path and auto-wait run first. Only a named-target TimeoutError triggers post-timeout count. Reject/hang preserves the original cause; coordinates and non-timeout failures are preserved. The 250ms diagnostic bound fits within the broker's existing 1000ms host grace, without a new preflight or normal-success round trip. The underlying Playwright count may remain pending after the race; the new helper adds no mutation, retry or replay.

Broker reason forwarding applies to all server-browser timeouts, not just click, and is capped at 500 characters. Legacy untrusted-host reasons intentionally remain hidden. The execution-error branch merely reuses the same capped server-only helper. The contract adds an optional field, preserving old no-reason behavior. Count ambiguity does not cause a new click: the existing strict click rejects first.

Other changed content consists of the two focused regression tests. No client rendering, desktop shell, mobile UI, provider adapters, scheduling, authentication/routing, documentation, dependency or generated-asset changes. No Settings/palette/keybinding screenshot or reverse-state rows apply. Shared service behavior is provider-independent; no per-provider or connection-mode Cartesian test matrix is justified.

## Remaining unverified

- Final MCP HTTP serialization/envelope and the running lead host's loaded SHA.
- Native Electron attachment and the originally reported older desktop build.
- Mobile-native, remote/relay/tunnel, multi-environment and live mixed-version deployment paths.
- This audit did not rerun lint/typecheck, tests or browser runtime. The evidence report claims only its two scoped executed test files; no new lint/typecheck success is inferred.

These remain explicit coverage boundaries, not missing screenshots or blockers under the agreed server-only proof scope.

## FRICTION

- Provenance: pass 1 reviewed dirty code; resolved by clean final HEAD and final-fixture hash matching. Unknown live-host SHA remains isolated from exact-base/final proof.
- Transport/platform: real-service integration is available; MCP HTTP and native Electron remain unverified. Current desktop shared-helper source is confirmed, avoiding the unsupported bypass claim.
- Timing: pending navigation prevents diagnostic count; bounded original-error fallback demonstrated without adding a timing-dependent regression test.
- Tooling: one shell search used a nonexistent glob and a broad /tmp listing encountered protected directories; subsequent explicit source reads supplied the needed evidence. No audit blocker.
- Scope: no browsers or servers launched, no repeated integrated pass, no forge access or edits; no visual evidence demands for a server diagnostic.

[Evidence report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b28448685f5ce988/issue-3714-evidence-report.md), [bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4cac4edad7d783fd/issue-3714-evidence.tar.gz), [red/green log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/86502e8708635da4/tests-red-green.txt), [base runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f3cb64d56eece7b0/runtime-base.jsonl), [final runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0fb5cd74e29997f8/runtime-fix.jsonl).

VERDICT: SUFFICIENT