# Proof audit pass 1

PR: [#12524](https://git.cafe/pingdotgg/t3code/pulls/12524) / [#12524](https://github.com/pingdotgg/t3code/pull/12524)

Rendering/review environment: Linux VM; no native macOS, AppKit, CoreGraphics, osascript, or native Device Hub session. No browser/server started. No runtime screenshots or recordings collected. All affected macOS rows are UNVERIFIED, not blocked. Tests do not substitute for runtime captures.

Before: origin/main [3cc31ed](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b).
After: takeover/pr-12524 [f1ad4b2](https://github.com/pingdotgg/t3code/commit/f1ad4b2523d3f6501519c55f1a768ca92a929dd6).
Original proposal: rashidgg/t3code fix/snapshot-device-hub-window-lookup [4f5fba9](https://github.com/rashidgg/t3code/commit/4f5fba971e1c93b33bee0acbf1283c8e78b89b08).

## Scope and findings

Read complete base-to-head diff, original implementation diff, both production callers, capture backend, shortcut dispatch, Settings verification, accessibility PID consumer, platform guards, and new test fixtures. No concrete code defect found against the requested specification: positive PID remains authoritative; nonpositive PID uses exact nonempty app name; returned processId is the selected window owner PID. Returning owner PID preserves positive-PID behavior because selection already requires equality.

Changed paths:
- apps/desktop/src/snapShot/ActiveWindow.ts:58,67-81: macOS selection/metadata only.
- apps/desktop/src/snapShot/ActiveWindow.test.ts:1-116: new VM fixtures, three passing tests. Combined invalid-PID fixture covers unrelated owner, nonzero layer, offscreen window, helper-name mismatch, and first matching window; separate empty-name and positive-PID-authority fixtures. No native renderer or UI markup changes.

## Fixture and capture matrix

Every row M1-M8 requires native macOS desktop. Capture both before and after unless stated. Record lookup inputs/results (frontmost PID/name, ordered candidate IDs/PIDs/names/layers/visibility, chosen ID and owner PID) alongside visible evidence; screenshots alone cannot prove PID identity. Controlled native fixtures are needed for rare/exclusion cases; mocked VM fixtures alone are insufficient.

| ID | Fixture / conditional case | Required observable evidence | Medium | Runtime status |
|---|---|---|---|---|
| M1 | Actual Device Hub frontmost with NSWorkspace PID -1; exact nonempty name and eligible layer-zero window | Invoke configured global snapshot shortcut with Device Hub focused. Before fails to find window; after captures Device Hub pixels and correct title/bounds/owner PID, reveals T3 and delivers attachment. Show completion and absence of stale error. | Before/after recording + final attachment capture + native identity trace | UNVERIFIED |
| M2 | Positive PID; earlier same-name window owned by another PID; matching-PID window has different owner name | Both versions choose matching PID, never name fallback. Capture correct pixels and unchanged app metadata. Include valid PID with empty localized app name: owner-name fallback remains. | Before/after captures + native identity trace; recording if trigger shown | UNVERIFIED |
| M3 | Invalid PID (-1, and 0 boundary) with empty app name; also nonempty app name with only prefix/suffix/case-different or empty owner names | No fallback match, no wrong attachment; normal capture reports window-unavailable. Exact equality excludes Device Hub Helper and case variants. | Before/after failure captures + native identity trace; recording for trigger/error sequence | UNVERIFIED |
| M4 | Invalid PID, exact-name candidates offscreen or nonzero layer, then two eligible exact-name windows | Ignore excluded candidates; select first on-screen layer-zero match in CG list order; metadata PID is that selected owner. If only excluded candidates exist, no match. | Before/after captures + ordered native identity trace | UNVERIFIED |
| M5 | Device Hub invalid PID, accessibility inclusion enabled versus disabled | Capture image in both settings; enabled path uses selected positive owner PID for accessibility and associates context with captured window; disabled path omits context. Graceful lack of accessible controls is not proof of wrong PID. | Before/after recording covering toggle and capture + resulting attachment/context capture + PID trace | UNVERIFIED |
| M6 | Settings capture setup, permissions granted: Test capture and continue; optional delayed native focus to Device Hub after click if a controlled native harness permits | Exercise independent setup caller, verify success/progression after capture, temporary test image discarded and no composer attachment. Ordinary T3-focused positive PID checks regression; controlled Device Hub focus checks fallback here. | Before/after recording of Settings action and result + native identity trace | UNVERIFIED |
| M7 | Settings verification with no eligible window (nil frontmost or invalid-PID nonmatch); denied capture permission when a window is found | Missing lookup produces find-window error; capture denial produces capture-window error and stays in setup. No false success or phantom attachment. These are existing error paths newly reached/passed by fallback. | Before/after recording of action/error/progression + lookup/capture trace | UNVERIFIED |
| M8 | Actual Device Hub via alternate configured shortcut registration: modifier pair versus ordinary accelerator | Both dispatch to same capture service; no stale focus selection, duplicate attachment, or reveal before capture. Animation enabled in main M1 run; no separate visual-style matrix required. | Before/after recording; may share M1 session | UNVERIFIED |

Minimum required capture set: two native macOS sessions (before and after), each with three recordings: (1) Device Hub trigger, both shortcut forms, attachment delivery and accessibility on/off; (2) Settings successful verification plus failure/no-match/permission result; (3) controlled native selection fixtures M2-M4 with outcomes and identity traces. Export stills of successful attachment, positive-PID control, exclusion/no-match outcome, and Settings result from those recordings. Combine rows in recordings rather than make a Cartesian product. Every matrix row must have its result explicitly labeled. Native PID -1 frontmost-app runtime remains unverified at ActiveWindow.ts:55-71; selected owner PID at :79. No unrelated widths/themes, mobile, or browser-only visual captures required.

## Caller and platform coverage

- Normal capture: DesktopSnapShot.ts:473-489 calls activeWindow(platform), then captureMacWindowSnapshot; missing match throws window-unavailable. MacSnapShot.ts:17-29 uses the selected CG window ID for screencapture; :56-67 handles sizing and display name. DesktopSnapShot.ts:536-558 forwards selected owner PID to accessibility; SnapShotAccessibility.ts:102-108,123-144 uses App.byPid then existing fallback/window matching.
- Capture trigger: DesktopSnapShot.ts:1167-1169,1296-1316 register modifier-pair/accelerator callbacks; :1005-1033 commits ready/failed capture results. These interactions need recordings, not static screenshots alone.
- Independent Settings caller: SnapShotSettings.tsx:337-353 invokes setupSnapShot("test-mac-capture"); SnapShotSetupDialog.tsx:439-449 names Test capture and continue. DesktopSnapShot.ts:1364-1414 checks macOS, looks up foreground window, captures temporary image, and reports distinct find-window/capture-window failures. It does not persist a normal attachment.
- Guards: ActiveWindow.ts:138-141 selects JXA only for darwin, existing Win32 API only for win32, undefined otherwise. Windows foreground implementation :120-135 is unchanged. Windows capture is outside this patch's native proof scope.
- Linux: DesktopSnapShot.ts:286-290 selects portal on Wayland and unavailable on X11; :473-475 invokes activeWindow only for direct mode; :500-529 runs separate Linux capture/portal logic. Changed macOS code does not run on Linux. Unchanged Linux capture is outside scope; no Linux runtime capture requested or performed.
- Web desktop wrapper Settings participates through existing bridge; standalone web and mobile have no changed renderer or native lookup. No provider/contracts/server logic changed. No separate command-palette capture caller was found in inspected current source; textual Linux guidance is not evidence of a new affected entry point.

## Validation and coverage

vp test run apps/desktop/src/snapShot/ActiveWindow.test.ts: PASS, 1 file / 3 tests. Mocked script selection verified; native runtime coverage 0/8 macOS rows. No tests added or modified by audit. No repo-wide checks. Worktree clean before and after review.

FRICTION: Native macOS and Device Hub unavailable on this Linux VM; no native capture evidence can be produced here. This is an explicitly accepted unverified item, not an audit blocker. No browser/server needed. PR registered with the T3 thread as required by harness; no forge mutation, comment, watch, edit, commit, or push. Only scratch artifact written under /tmp/to-12524 and publicly uploaded using ghdrop.