# Proof audit, pass 1 — capture matrix

PR [#29347](https://git.cafe/pingdotgg/t3code/pull/29347), fixing [#29323](https://git.cafe/pingdotgg/t3code/issues/29323).

Read-only review of HEAD [37441e9](https://github.com/pingdotgg/t3code/commit/37441e905194b062345c76d81caacd00d77ef5e5), branch `fix/issue-29323`, against the supplied merge-base [701e13c](https://github.com/pingdotgg/t3code/commit/701e13cebb040d8433cd9aefb803ddd0d58c41d6). Both objects exist; the merge-base of these two pinned objects is the supplied base. The local `main` ref is stale and is not the comparison source. Current GitCafe PR metadata confirms this head/base. Do not substitute the author's earlier runtime revisions for these pins.

## Findings first

1. **Mobile is unaffected; no mobile captures are needed.** Its PlatformConnectionSource emits `Stream.empty`; persisted targets cannot be PrimaryConnectionTarget; mobile migration and pairing create bearer/relay targets (SSH provision is unsupported). Merely providing PrimaryEnvironmentAuth with no bearer does not create a primary. Mobile Connectivity comes from expo-network getNetworkStateAsync/addNetworkStateListener, resampled on AppState active. It maps isConnected false/true/other to offline/online/unknown; it does not use navigator.onLine or isInternetReachable. The new supervisor condition is therefore false on every mobile target.
2. **Desktop's managed primary is affected.** Electron uses the web connection platform and its navigator.onLine/window online/offline source. The primary bootstrap's HTTP/WS endpoints become PrimaryConnectionTarget. Secondary local/WSL backends become BearerConnectionTarget and do not receive the exemption. Desktop with its local environment disabled has no primary. An Electron primary capture is required; a browser with a fabricated desktopBridge is only a labelled harness substitute.
3. **The four PR-body rows are an initial subset.** They omit discovered-primary transport failure/recovery, setup-time changes, and actual Electron evidence. The author also used a different before revision and an older after revision for the fresh-install row. Re-record the mandatory rows at the pinned base/head. This pass claims no existing capture or test-run proof.
4. **Separate offline report from unavailable transport.** For the bug reproduction, force navigator.onLine false while leaving page/auth/descriptor/HTTP/WS reachable. Browser-wide offline emulation can prevent registration and exercise a different path. A real network loss after registration is a distinct row. Do not reload an unreachable remote origin and call a browser error page proof of this supervisor.
5. **Primary diagnosis is not the Settings Details panel.** ConnectionsSettings filters primary targets out of SavedBackendListRow; only saved rows own ConnectionDiagnosisSummary/Panel. The primary's actual failure headline is rendered by the chat composer banner. Settings > Sharing & access exposes primary Permissions; provider settings and project creation also change availability when the primary connects.
6. **A recording plus transport/state evidence is necessary.** A final connected still cannot distinguish successful startup from a delayed retry, verify a health probe, or show a silent socket replacement. Raw NetworkChanged is emitted only when the *normalized intent* changes. Thus online -> offline emits a raw-offline probe signal, but unknown -> offline and repeated offline can collapse to no signal. The real web platform normally starts online/offline, so the unknown boundary is a harness guard.
7. **Two setup boundaries must not be overclaimed.** At this head, a raw offline signal during establishment interrupts the in-progress attempt, then primary unknown allows a new attempt. An online signal during a stalled attempt is consumed without restarting it; the attempt can wait for setup/sync timeout and then backoff. These are code observations, not verified runtime regressions or requirements silently added to the PR. Rows H1/H2 expose them for the lead's correctness review.

## Capture conventions and minimum

All rows start **pending capture**, unless marked excluded/code-only. READY means the fixture is specified, not that evidence exists. Every time/interaction-dependent row is marked **recording**; stills are supplementary only.

- Compare base/head with the same synthetic workspace, browser data, theme, route, viewport and driver. Put revision, fixture ID, transport-fault mode and timestamps in the transcript. Before/after must each be clearly labelled. Avoid real conversation contents, credentials, pairing URLs, and identifying machine names in public uploads.
- `L` = 1440 x 900 CSS pixels, fixed built-in dark theme, 100% zoom. `N` = 390 x 844 CSS pixels, same dark theme. Desktop L means renderer content viewport, record actual measured size if the shell cannot set it exactly.
- **Minimum visual set:** L x dark x W1,W2,W3,W4,W5,W8,W9,W10,D1; N x dark x W6; L x dark x H3 as a labelled harness if its blocked state cannot be produced after real registration. W8-W10 are separate scene checkpoints but may share the W1/W5 recordings, so they need no additional server runs. W7/H1/H2/H4 are behavioral branches whose rendered connecting/connected scenes are already covered; keep focused state/protocol transcripts and mark any optional video as recording. No screenshots of a fake status dashboard count as real-app evidence.
- No styling, theme predicate or CSS breakpoint changed. One fixed theme suffices; a light-theme duplicate is optional. N covers the changed, potentially long banner headline/action layout. No Cartesian product of project counts, providers, display scale, OS, or themes is warranted for this supervisor-only change.
- All proposed automation is for the capturer. This audit started no server/browser/device and created no native client build. Obtain the project's required browser/computer-use authorization before capture if the lead has not already done so.

## Fixture matrix

| ID / named fixture | Surface, target and required data | Seed / route / driver | Before -> after; visual checkpoints | Diff impact | Minimum capture (viewport x theme x row) | Pass-1 status |
|---|---|---|---|---|---|---|
| W1 — cached workspace, false offline at reload | Server-served web; primary; completed onboarding; 1 stopped thread with cached shell/history in a project; short synthetic host label | Authenticate while online, visit the stopped thread and await live shell; retain that browser profile/cache; install report-only false getter before reload; reopen `/<environmentId>/<threadId>` | Base: offline banner, device-offline headline; click Reconnect and show it still cannot open `/ws`. Head: opens app `/ws`, shell live, no unavailable banner. Do not pretend to click a vanished head-side Reconnect | Yes, startup intent, primary diagnosis and retry outcome | **L x dark x W1; recording**, reload through settled shell, base Reconnect interaction; include `/ws` attempt/open counts | READY — real app, pending |
| W2 — fresh workspace, false offline at boot | Server-served web primary; fresh client settings (`onboardingCompletedAt=null`); fresh server provenance; zero projects/threads OR only newly-created cwd bootstrap project and unused bootstrap thread | Isolated unseeded dev home (`T3CODE_DEV_SEED=0` / `--no-seed`); normal fresh cwd-bootstrap may create the sole project/thread; fresh paired browser profile, false getter before app boot; `/` | Base: gate pending, then after 4s Still connecting / could not confirm workspace / Reload. Head: live config + snapshot + welcome provenance resolves gate, normally `/welcome` wizard for fresh data. Record actual wizard/app decision; do not force completion to make a fresh run look like W1 | Yes; first-run empty/fresh branch | **L x dark x W2; recording**, start through >4s on base and resolved gate on head. The zero/sole-bootstrap counts collapse to the same visual wizard; capture one and state which | READY — real app, pending |
| W3 — online control | Web primary; same populated data/profile as W1 | Report getter true; ordinary stopped thread route and reload | Both connect; no banner. Confirm app `/ws` established and shell live; differences confined to checkout-specific data are not UI regressions | No normalization; required control | **L x dark x W3; recording**, startup through live shell | READY — real app, pending |
| W4 — false offline event, healthy session | Web primary; short host label; connected stopped thread; primary probe supported and responds | Start true, await live; set false getter and dispatch window offline event without cutting transport; then restore true and dispatch online | Both retain healthy connection; head stores unknown instead of offline. Show no banner/socket replacement, raw offline-triggered probe and successful reply. State/trace is necessary because healthy pixels are unchanged | Yes, live intent; raw health signal preserved | **L x dark x W4; recording** of event, probe completion and restored online; one connected still is insufficient | READY — real app with report-only driver, pending |
| W5 — discovered primary cannot connect | Web primary; W1 cache/completed onboarding; primary descriptor/auth succeeded; controllable `/ws` failure after registration | In a synthetic browser fault driver keep auth + `/.well-known/t3/environment` working, fail/close app `/ws` attempts; set false report before supervisor starts or before closing the existing session. Keep app resources available. Restore `/ws` while leaving report false | Base parks offline and blames device. Head attempts, retains actual transport failure, reconnects with backoff; banner appears after 2s reconnect grace, names server rather than device, and no Reconnect button while reconnecting. Once transport is restored, automatic retry connects while report is still false. Record at least one failed attempt and later retry, not just final success | Yes; true-unavailable tradeoff, backoff, diagnosis, recovery while false | **L x dark x W5; recording** including pre-grace, post-grace, failure, next attempt, recovery; collect retryAt/attempt/phase and WS log | READY — real app with selective transport fault driver, pending |
| W6 — narrow, long failure label | Responsive web primary; W5 cache/failure; synthetic long label e.g. `Development workstation in the upstairs office`; long transport detail | Same driver as W5, use N viewport and long environment label in isolated settings; open stopped thread | Compare offline vs reconnecting banner and headline wrapping, banner action presence/absence and composer width; show retry recovery with no stale banner | Yes; changed text/phase/action layout at narrow width | **N x dark x W6; recording**; extract before/after stills only as supplements | READY — real app with driver, pending |
| W7 — connected host becomes genuinely unreachable | Web primary over a remote origin OR selective app-transport failure after live registration; same cached stopped thread | Pair/load while reachable; only after primary is registered and live, drop host transport and emit offline. Preserve loaded page. Restore transport and emit online; do not reload an unreachable page | Healthy connection -> 3s offline health-probe timeout/session loss -> head retries instead of parking; real reachability recovery returns live. W5 already covers the visually identical reconnecting/banner state. Remote route silence has a different timer from loopback | Yes after session loss; healthy probe pixels unchanged | No extra visual capture beyond W4/W5; **recording** (outside the minimum visual set). Required state/protocol transcript for genuine-loss claim; do not label a selective WS-only fault as device-wide offline | READY — real remote app or accurately labelled fault driver, pending behavior evidence |
| W8 — primary Permissions open | Web primary; W1 reachable transport + false report; authenticated session with ordinary standard scopes | Settings > Sharing & access, `/settings/access`; expand primary Permissions. Also visit through Settings navigation/keybinding entry, not only direct URL | Base disconnected/unavailable permission message vs head connected allowed/not-granted scope list. The list has the existing sm two-column layout, with no schema/style change. Primary local environment switch is not a reconnect control | Yes, session readiness | **L x dark x W8; recording**; may be a checkpoint in W1/W5 run | READY — real app, pending |
| W9 — provider settings becomes reachable | Web primary; W1 cache/completed onboarding; known provider config; same false report; no credentials need be changed | `/settings/providers` with primary environment scope selected; also navigate via Settings/command palette. Keep provider configuration constant and idle | Base unavailable/waiting placeholder vs head actual provider settings once session/config is ready. Current route is scoped; do not require unscoped device tabs here. Empty/no-provider configuration is acceptable if identical on both sides | Yes, connection-gated content; provider adapters themselves unchanged | **L x dark x W9; recording**; co-record in W1/W5 | READY — real app, pending |
| W10 — project actions see the primary | Web primary; W1 data plus optional saved remote environment to force the environment chooser; read/source-control scopes sufficient; use disposable directories if committing an action | Open command palette via its configured shortcut, then Add Project; demonstrate primary is offered and folder browsing works. Sidebar Add Project reaches the same flow. For Add to another machine, seed a remote-owned project with repositoryIdentity and no primary copy, open its Run on/Add to another machine control; no clone must be executed | Base primary absent from eligible connected targets; head primary offered/usable. One vs >1 target can skip/show chooser: force >1 to capture explicit row. Do not claim a disabled primary item where the code filters it out. Check shortcut/sidebar entry as checkpoints in the same recording | Yes, connected-target eligibility; no new command/keybinding | **L x dark x W10; recording**; co-record with W1; additional remote-project checkpoint if that existing entry is exercised | READY — real app plus paired second environment, pending |
| D1 — actual Electron primary, false offline | Electron renderer with enabled managed primary bootstrap, reachable loopback server; W1-style cached stopped thread; primary backend, not WSL secondary | In isolated Electron dev state use the existing desktop bootstrap/bridge; install report override before renderer boot using approved desktop automation. Open stopped thread; reload false; then flip true -> false live and restore true | Same primary correction as W1 and healthy event behavior as W4, with actual Electron shell/auth/loopback endpoints. Shared web gate logic makes fresh desktop equivalent to W2; a second fresh desktop run is optional. A browser bridge stub is a harness only | Yes, explicitly affected client | **L x dark x D1; recording** boot + event; actual measured renderer viewport in manifest | READY — real Electron required, pending; platform availability not probed in pass 1 |
| H1 — offline signal during establishment | Primary; desired=true; deterministic suspended preparing/opening/synchronizing stage; raw starts online | No app RPC reliably pauses these internal stages. Use labelled supervisor harness with Deferred-controlled driver stage; send offline once, release replacement attempt; sample each stage as parameterized behavior cases | This head interrupts the current establishment on raw offline, then starts again because stored network is unknown. All three internal stages render connecting (stage is not a distinct user layout). No permanent offline park; show attempt cancellation/restart counts rather than inferring continuity from final connection | Yes, later changes during setup; not covered by startup/connected-only tests | No extra scene beyond W5; **recording** (outside the minimum visual set), labelled harness. Required focused event/state transcript for setup-continuity claim | READY — labelled harness, pending behavior evidence |
| H2 — network returns during stalled primary setup | Primary starts raw offline -> normalized unknown; first prepare/open never completes, next would succeed | Labelled Deferred-controlled supervisor harness; emit online during first stalled attempt and observe whether it is interrupted. Test setup timeout separately from synchronization timeout, using TestClock and event barriers | Base has no attempt until online. Head has already attempted; online currently does not restart it, so a stalled first attempt can wait its timeout and then backoff. Do not claim immediate recovery from an online event at this head. Same connecting/reconnecting scenes as W5 | Newly reachable sequencing case; possible correctness concern for lead | No extra visual scene; **recording** (outside the minimum visual set), labelled harness; preserve state/driver transcript for lead review | READY — labelled harness, pending behavior evidence |
| H3 — primary blocked after discovery, false report | Primary desired=true; cached W1-style environment; driver returns ConnectionBlockedError(authentication/configuration/permission), long-safe synthetic detail; no unsupported compatibility rejection | Auth/bootstrap rejection before registration is NOT this fixture. If a real post-registration blocked primary cannot be produced, label a harness that drives the real supervisor + existing banner/presentation with a controlled driver. Do not fabricate a new production Settings Details route | Base parks offline/device diagnosis; head reaches blocked/error, actual failure headline, error-toned offline banner, Reconnect action. Retry after fixing fault reconnects. Authentication/configuration/permission all share error layout; capture one representative and identify it | Yes; blocked is newly reachable instead of offline; subtype changes copy, not renderer structure | **L x dark x H3; recording**, labelled harness if needed; Reconnect/recovery interaction | READY — real app if feasible, otherwise labelled harness, pending |
| H4 — unknown/deduplicated report and inactive intent | Synthetic primary with initial network unknown or desired=false; matching non-primary controls | Harness only: unknown -> offline, repeated offline, offline -> online; disconnect/reconnect desired intent through supervisor methods | Primary offline normalizes to unknown; unknown -> offline/repeated offline may emit no NetworkChanged because normalized value is unchanged. desired=false remains available; online/unknown pass through; explicit connect still uses normalized intent. No additional visual layout beyond existing available/connecting/connected | Normalization boundary; no app platform seed for unknown in normal browser | No visual capture required; **recording** (outside the minimum visual set), labelled harness. Prefer focused state/probe-count transcript | READY — labelled harness, pending behavior evidence |
| G1 — non-primary offline controls | Separate BearerConnectionTarget, RelayConnectionTarget, SshConnectionTarget; include Electron secondary local bearer, and mixed LAN/relay route entry whose root is non-primary | Add/pair targets normally or use existing supervisor tests with each _tag; set initial offline, then online; live-session event is a separate healthy-probe control | Both still wait while offline initially and connect when online; live healthy session retains pre-existing health-probe behavior. Primary exemption is based on supervisor entry target tag, not loopback URL or active route. No changed target/layout behavior | No, guard group | No new visual captures. Existing focused tests/transcripts suffice; **recording** for any optional event/recovery capture | EXCLUDED from minimum visual set — unchanged |
| X1 — native mobile all rows | iOS/Android; all real targets are bearer/relay (persisted SSH is unsupported), never primary | Platform registrations empty; persisted schema excludes primary; expo-network isConnected source | Same network gate and mobile notices/diagnosis on both revisions; JS engine sharing alone does not make primary branch reachable | No | None; no mobile captures/dev build/device lease | EXCLUDED — justified by code |
| X2 — hosted web / primary-disabled desktop / guest | Hosted static app, desktop local environment disabled, or guest page | Hosted/disabled platform source empty; guest connection runtime deliberately not built | No primary supervisor to which exemption applies; saved remote targets unchanged | No | None | EXCLUDED — justified by code |
| X3 — transport fails before registration / settings hydration error | Browser cannot load page, auth, or environment descriptor; or local settings hydration fails | Fully offline cold remote load / denied auth / failed descriptor / settings persistence fault | Browser error, auth gate, missing-primary discovery or Could not read settings recovery lies outside changed supervisor. Do not use it as W2/W5/H3 proof | No changed supervisor reached | None | EXCLUDED — boundary documented |

## Complete caller/render-path inventory, scaled to this diff

There is **no changed React/native component or prop declaration**. The two edited production sites initialize supervisor intent and update it from Connectivity. The test edits add startup-primary and live-socket guards, and move two old offline fixtures to relay/LAN. Rendering depends on state, so the relevant paths are:

- **Direct caller and inputs:** [EnvironmentRegistry.createServiceScope](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/registry.ts#L361) is the only production caller of `EnvironmentSupervisor.make`. It supplies entry target/profile/routes, initiallyDesired = enabled && compatible, Connectivity, driver and wakeups. There are direct calls in supervisor tests, not UI callers. Target tag (primary versus bearer/relay/SSH), initial/later raw network (online/offline/unknown), desired, stage, outcome, retained failure, attempt/generation and retry deadline are the changed behavior's complete input axes. Loopback/LAN versus remote changes silent-socket timing, not the exemption.
- **Published shapes:** [catalog stateAtom](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/state/connections.ts#L131) reads supervisor changes; [connectionProjectionPhase](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/model.ts#L229) maps connecting to synchronizing, connected to ready, and available/offline/backoff/blocked to disconnected. [presentConnectionState](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/presentation.ts#L38) presents first connecting, reconnecting (attempt >1 or retained failure), connected, offline, available, blocked error or unsupported. Registry-wide raw network remains offline: this PR normalizes per-supervisor intent only.
- **Root/onboarding caller:** [RootRouteBranch -> FirstRunGate](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/routes/__root.tsx#L196) supplies authenticated/hosted flags and children. [FirstRunGate](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/onboarding/FirstRunGate.tsx#L67) branches on hydration, completed onboarding, catalog readiness, live primary/config/welcome provenance, cached/live workspace evidence, project/thread counts 0/1/>1, whether a sole bootstrap thread is unused, path / vs direct settings, pending/app/wizard and 4s stalled state. W1 covers completed/populated app, W2 covers the visually identical zero/sole-bootstrap fresh wizard, W3 online control, W5 stalled/failure. An uncompleted one-project/one-used-thread workspace must resolve app after authority arrives; it is a data variant of W1, not another final layout. Settings-read-failed/retrying UI is X3. Reload is the stalled recovery interaction. Existing >1 workspace evidence can render app before fresh-install authority, which is why a populated database must not stand in for W2.
- **Chat caller:** [ChatView -> useSystemComposerBanners](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/ChatView.tsx#L1274) supplies active environment, cached/unavailable state, thread environment, server config, multi-environment/automatic selection and update state. [composer banner branches](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/chat/useSystemComposerBanners.tsx#L103) suppresses connecting/reconnecting for a 2s grace or running server update; otherwise warning/offline vs warning/reconnecting vs error branches change title, diagnosis and Reconnect action. Primary can never show Disconnect server even after the existing 20s delay. Reconnect is only shown when not reconnecting and dispatches retryNow (or enables an off entry); it probes a live session. Long labels and failure detail affect wrapping (W6). Cached content versus no cache matters to whether a thread/banner can render at all. Server update banners, auto-balancing and provider-run state are fixed idle/off for this audit, since their layout logic did not change.
- **Diagnosis callers:** [useConnectionDiagnosis](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/settings/ConnectionDiagnosisDetails.tsx#L29) feeds both SavedBackendListRow and ConnectionDiagnosisHeadline. The headline's only production caller is the composer hook. The summary/panel's only production caller is [SavedBackendListRow](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/settings/SavedEnvironmentRows.tsx#L114); [ConnectionsSettings saved-environment filter](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/settings/ConnectionsSettings.tsx#L173) excludes primary. Thus collapsed/expanded details, attempts/countdown, hop/step/fact lengths, trace IDs, Copy diagnostics, Retry now and Add direct route are unchanged non-primary layouts (G1); they must not be multiplied into primary screenshot requirements. For a primary, normalization removes the device-offline diagnosis and allows actual failure location to win (W5/H3).
- **Settings/availability callers:** [ConnectionsSettings primary settings](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/settings/ConnectionsSettings.tsx#L1030) is reached through /settings/access (access view) and /settings/connections (saved-environments view). Primary Permissions gets connected from presentation, changing disconnected fallback vs authenticated allowed/not-granted list (W8); pending/error/rejected session branches are unchanged but can become transient during connection. [SettingsProvidersRoute](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/routes/_chat.settings.providers.tsx#L8) and [provider access placeholders](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/settings/ProviderSettingsPanel.tsx#L247) choose missing/loading/unavailable/error/ready provider content from connection/session/config. Scoped current route omits device tabs; the reusable unscoped panel shows tabs only for nontrivial multiple/non-primary options and attaches status dots/tooltips. Fix options/scopes/provider counts in W9; no provider-adapter behavior changed.
- **Command/selector callers:** [command palette project environment options](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/components/CommandPalette.tsx#L561) filters to eligible connected environments before rendering, shared by Add Project/New Project/source browsing. Shortcut and sidebar invoke that command flow; no independent supervisor path exists. [useAddProjectTargets](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/hooks/useAddProjectTargets.ts#L16) additionally requires source-control scope, a repository identity and project absence to offer Add to another machine through BranchToolbar. `BranchToolbarEnvironmentSelector` also has locked/no-handler, auto-balance, 1/>1 environment and Add-machine branches; this PR only changes eligible data/session availability, so W10 fixes the control to explicit multiple-target selection and existing unrelated selector modes need no new captures. Sidebar cached shell/snapshots can remain visible while disconnected; they do not prove a live connection without the protocol/shell transcript.

## Platform evidence

- Mobile absence: [empty platform registration source](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/mobile/src/connection/platform.ts#L242), [PersistedConnectionTarget union](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/model.ts#L50), [persisted catalog schema](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/platform/storageDocument.ts#L22), [legacy mobile migration](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/mobile/src/connection/migration.ts#L42), and [pairing registrations](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/onboarding.ts#L118). Its network implementation is [expo-network mapping and listeners](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/mobile/src/connection/platform.ts#L33).
- Web and desktop Connectivity: [navigator/window network source](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/connection/platform.ts#L68). Desktop selection: [desktop bootstrap resolution](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/environments/primary/target.ts#L239); target construction: [loadPrimaryConnectionRegistration](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/connection/platform.ts#L423); non-primary desktop local construction: [loadSecondaryConnectionRegistration](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/connection/platform.ts#L442). Hosted/disabled source: [platform source guard](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/connection/platform.ts#L624); guest exclusion: [guest runtime guard](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/apps/web/src/connection/runtime.ts#L76).
- Supervisor boundaries: [initial normalization](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/supervisor.ts#L289), [later normalization and deduplication](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/supervisor.ts#L1157), [setup interruption](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/supervisor.ts#L565), [probe timeout policy](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/supervisor.ts#L633), [offline/backoff/blocked run loop](https://github.com/pingdotgg/t3code/blob/37441e905194b062345c76d81caacd00d77ef5e5/packages/client-runtime/src/connection/supervisor.ts#L1040). Loopback/LAN uses the 500ms host/silent-socket check; remote silence is held at least 2500ms; offline health-probe timeout is 3s. Setup timeout is per-route 15s plus 75s per route that reaches synchronization; do not promise a universal 15s recovery.

## Seeding and capture handoff details

1. Use only lead-owned isolated dev state and the pinned checkouts. W1 seed can be made through the app: create a synthetic project/thread, keep it stopped, finish onboarding, await shell/history cache, then reuse that browser profile for report-only reload. Do not run a server against the real T3 home, do not modify this review worktree, and do not touch another lead's dev process. Fresh W2 needs a new dev home and browser profile, not the cached W1 data. If manually seeding settings in an isolated browser, use the app's `persistClientSettingsPatch`/`updateClientSettings` API from the existing module rather than guessing storage keys; wait for hydration/persistence before reload. Change host labels through the isolated environment settings API/UI.
2. Install a report-only init script before the app boot (or equivalent approved browser facility):

```js
window.__proofOnline = false;
Object.defineProperty(Navigator.prototype, "onLine", {
  configurable: true,
  get() { return window.__proofOnline; },
});
```

For event fixtures, after the connection milestone, set `window.__proofOnline` then dispatch `window.dispatchEvent(new Event("offline"))` or `online`. For boot fixtures inject before scripts run; changing the getter after the supervisor reads initial status is not startup proof. Preserve normal online transport for W1-W4. The driver's WS log must filter app URL pathname `/ws`; do not count Vite HMR sockets. Record socket attempted/opened/closed and server/probe milestones where needed. Pure screenshots cannot prove `network: unknown`, attempt count, probe completion or generation.
3. W5/W6 use a browser/network driver capable of selectively failing the app `/ws` while still passing auth/descriptor/static assets. A driver that can only report offline cannot generate this row. Hold failure through the reconnect grace and at least one retry, then release it with report still false. Log actual injected fault and actual error classification, not a made-up server headline. H3 needs a genuine typed post-registration blocked failure; do not relabel a transient WS failure as blocked. A labelled supervisor/component harness is the honest fallback for unseedable internal stages or typed errors.
4. State-only harnesses use the actual supervisor with fake Connectivity, Deferred-controlled driver/session effects, TestClock and persisted/stream milestone barriers; do not add sleeps/poll loops or increase test timeouts. They live under a new timestamped directory in this scratch root, and do not edit the checkout. Existing supervisor test harness shapes are references, not a pre-existing capture UI. H1/H2/H4 require behavior evidence if the lead makes claims about them; they add no distinct minimum visual scene.
5. W8-W10 use real routes and configured shortcuts. On before, record unavailable or absent target and leave it at that; do not invent an interaction with a control that is absent. On head demonstrate availability with an idle harmless browse/session read, not a running provider turn or clone. Record named checkpoints, so the lead can match screenshots to each row even when multiple rows share a video.
6. Desktop D1 needs actual Electron. If unavailable to the capturer, report D1 missing; do not mark it covered by web. Mobile is intentionally excluded; no permission/device/build step is needed for it. Local served web (loopback or reachable remote origin) is affected; hosted app pairing and saved relay/bearer/SSH connections are G1/X2.
7. Write each capture run to a new timestamped directory under `/tmp/lead-29347-r1/proof-audit-1/`, keep raw logs/evidence until uploaded, and upload public-safe videos/images/manifest with ghdrop. Stop only PIDs captured at spawn. Publish no credentials/pairing links or real workspace contents.

## Review coverage and limits

Read the full two-file diff, complete supervisor control flow, sole production caller, platform constructors and persistence boundaries, mobile migration/pairing and Connectivity, desktop target selection and secondary registrations, shared state/presentation/diagnosis, first-run decisions, composer banner, Settings primary/saved routing, provider and command/selector availability paths. Read PR description, linked issue, comments/reviews and current check summary (41 successful at this head; conflict observation pending/stale). This is a code-derived fixture audit, not a merge-readiness approval. No tests, browsers, servers, screenshots, recordings, native clients or remote machines were run. No worktree edits, pushes or PR comments were made. No started long-lived processes remain.

FRICTION: none

VERDICT: SUFFICIENT