# Independent final proof audit, pass 2

**Verdict: SUFFICIENT** for the affected Linux server protocol matrix of PR [#23396](https://git.cafe/pingdotgg/t3code/pulls/23396) ([GitHub mirror #23396](https://github.com/pingdotgg/t3code/pull/23396)). No proof blocker remains. This is an evidence verdict, not a new code-review round, merge authorization, or claim that the original desktop issue was reproduced.

Exact head: `f6e8762257a73c882f405c0067de17b8bbca5c1e` ([f6e8762257](https://git.cafe/pingdotgg/t3code/commit/f6e8762257a73c882f405c0067de17b8bbca5c1e)); branch `fix/issue-22402`. Recorded base: `3b95e7831b11b17627dff16843bc087bfca397ec` ([3b95e7831b](https://git.cafe/pingdotgg/t3code/commit/3b95e7831b11b17627dff16843bc087bfca397ec)). Inspected the complete six-file diff directly against that base, not current main. Work was confined to `/home/ubuntu/wt/pr-23396`, with external artifacts under `/tmp/pr-23396-evidence/audit2`.

## Evidence examined and independent validation

Read the prior matrix first, original PR description JSON, baseline/final reports and complete runtime transcripts, supplemental recovery report/transcript, setup/cleanup transcripts, fixture/scripts, verification record, and supplied final-head test log. Checked raw request/response envelopes instead of relying on row summaries. The diff changes three diagnostic getters and adds three tests; accepted inputs, schemas, routing and guards do not change. Read the URL and selector getters, browser open/reuse path, and relevant broker/page callers. Independently confirmed zero baseline-to-recorded-base drift in the relevant shared URL code, preview contracts, server preview directory, broker and toolkit paths. The older baseline SHA therefore remains valid evidence for these paths.

[B/F baseline transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d6a43fe87bc0bf53/issue-22402-baseline-runtime.json), [F final-head transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/35f48f8f70e30fd8/issue-22402-final-runtime.json), [R recovery transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bf5adae6e8ec35cd/recovery-transcript.json), [recovery report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c24c6795fc936ec2/report.md), [prior matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4cd31a7b35b7f03a/matrix.md).

## Every matrix row

IDs below are JSON-RPC request IDs in the linked transcripts. All cited MCP calls return HTTP 200; diagnostic failures have `result.isError:true`, not transport failures.

| Row | Actual evidence checked against diff | Verdict |
| --- | --- | --- |
| U1 | B/F 3: same rejected about:blank request; final adds accepted HTTP(s)/schemeless forms and new-tab-qualified omission guidance. Complete error envelopes preserved. | SUFFICIENT |
| U2 | B/F 4: URL omitted with reuseExistingTab:false; available, owned new tab, null URL. Proves new blank-tab path only. | SUFFICIENT |
| U3 | B appRpc/F rpc: authenticated preview.open failure preserves PreviewInvalidUrlError tag, reason=parse, length=11, protocol=https:. Final decoded getter and nested normalization cause contain new qualified advice. Wire Exit failure frames checked. | SUFFICIENT |
| L1 | B/F 5: malformed locator '['; final adds latest-snapshot aria-ref, role/text and CSS field advice. Independently reproduced at exact head; complete result envelope equals F 5 byte-for-byte as parsed JSON. | SUFFICIENT |
| S1 | B/F 6: malformed selector '['; final gives CSS and locator alternatives. | SUFFICIENT |
| N1 | B/F 7: rejected navigation URL propagates changed normalization guidance, explicitly scoped to preview_open for blank-tab advice. | SUFFICIENT |
| P1 | B/F 8–10 and synthetic RPC records: synthetic markers absent from complete returned MCP envelopes and RPC result/message/wire frames. No privacy claim about logs, history or heap. | SUFFICIENT |
| T1 | B/F 11: valid-looking CSS locator on blank page yields identical 1000ms timeout. Does not count as successful selector recovery. | SUFFICIENT |
| M1 | R 3–4: explicit HTTP fixture URL, owned tab, actual loaded title and four zero counters read from page. | SUFFICIENT |
| M2 | R 5–6: schemeless loopback host:port normalizes to HTTP; same tab, loaded expected title and zero counters. | SUFFICIENT |
| M3 | R 7–9: URL omitted with explicit tab and then default current tab; same tab/nonblank URL/title preserved, with page readback. | SUFFICIENT |
| M4 | R 10–11: CSS selector #css-target click succeeds; only cssTarget changes from 0 to 1. | SUFFICIENT |
| M5 | R 12 snapshot → immediately R 13 aria-ref click → R 14 readback. Ref target ref t3-b641ec84-2-e3 is actually in that snapshot; no intervening snapshot/navigation/dialog; only refTarget additionally becomes 1. | SUFFICIENT |
| M6 | R 15 internal:role button selector and R 16 text selector succeed; R 17 confirms expected URL/title and all four counters exactly 1. Unique fixture buttons and their inline counter handlers inspected. | SUFFICIENT |
| D1 | Original macOS desktop CSS-expression variant remains unverified. Existing Linux baseline originalIssueCss times out; no claim of final-head desktop reproduction or successful original-expression recovery. Outside mandatory changed server-diagnostic proof. | UNVERIFIED, nonblocking |

Visual matrix: **0**. Pixels N/A: protocol diagnostic content changes only. Mobile navigation, responsive layouts and Electron shell visuals do not add applicable rows. This proof does not assert success across those independent runtimes.

## Envelope, order, SHA and counter proof

Independent validator checked all 12 baseline MCP envelopes, all 12 final MCP envelopes, all 18 supplemental envelopes and all four independent-capture envelopes: matching request/response JSON-RPC IDs and version, exactly result or error, HTTP status, contiguous IDs and monotonically ordered valid timestamps. Final/recovery/independent context SHAs match the exact requested head. SHA-256 file digests are recorded in [validation.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/004b01d9a61d1b7e/validation.json).

R snapshot at 10:20:04.818 UTC is followed by its ref click at 10:20:04.912 UTC and readback at 10:20:04.928 UTC. Page counter sequence is 0000 (R 4,6,8), 1000 (R 11), 1100 (R 14), 1111 (R 17), in css/ref/role/text order. All page reads retain the expected fixture URL/title. The fixture's camelCase dataset keys correctly correspond to the four hyphenated IDs; evaluate requests only read state. Role/text calls have a combined final readback, not individual intermediate reads; distinct unique targets plus final counters establish both actions.

R 18 is a cleanup-only -32602 error for unavailable MCP preview_close, not a recovery failure. Authenticated preview.close RPC and run.interrupt then return Success. Setup and cleanup frame IDs, request tags and ordering were inspected; the supplied cleanup record confirms stopped owned processes and closed ports.

## One independent runtime reproduction

Started normal `node_modules/.bin/vp run dev --no-seed --home-dir /tmp/pr-23396-evidence/audit2/private/t3-home` at the verified head. This is fresh isolated state, separate from both live userdata and the prior capturer's state. Used the external wrapper/setup scripts after inspecting their source, updating only external paths and disposable provider ID. Supported pairing token exchange and authenticated WebSocket RPC created the disposable project/thread/provider; the real Codex subprocess received the app-issued MCP config. The wrapper forwards its actual protocol and holds turn/start before model work; caller/run/auth guards remain enabled.

Actual HTTP MCP initialize → preview_status → preview_open (new blank tab) → preview_click with locator '[' exercised the real server browser and broker. No unit-test substitute, direct error construction, in-process broker invocation or separate Playwright harness. This repeats only the single diagnostic explicitly requested for independence; sufficient M1–M6 captures were not repeated. No fixture HTTP process was needed for malformed-locator rejection on a real blank browser tab.

The independent result equals the supplied F 5 entire `result` object, including content and isError, and differs from B 5 only by the intended guidance addition. JSON-RPC IDs and owned tab IDs naturally differ. [Independent capture](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e6fb1f2e9fa4a39b/recovery-transcript.json) (legacy harness filename; contains only four diagnostic/setup MCP calls). [Public reproducibility bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/164c8a4847930e4a/audit2-evidence.tar.gz) contains scripts, validation and sanitized setup/capture/cleanup envelopes. Its inherited unused fixtureUrl port 0 is harness metadata, not a navigated URL; the actual open request omits URL.

## Tests, CI, teardown and limits

The supplied [final-head test log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/defb45be83247476/final-head-tests.log) shows three files / 53 tests passing, matching the lead's exact-head attestation. The log itself does not embed a SHA. I did not rerun sufficient tests or convert that attestation into independent execution provenance. Earlier red/green logs remain supporting history, not final-head runtime evidence.

No CI query, watch or polling performed. The lead reports its initial snapshot as 29 successful / 0 pending / 0 failing; that is supplied snapshot evidence, not freshly verified current CI. No claim about later check changes.

Closed my tab through authenticated preview.close and interrupted my disposable run; both RPC exits succeeded. Captured descendants from my spawned root and wrapper-issued PID records, checked process start identities, then terminated owned processes only. Final independent verification found no live owned processes and no listeners on my backend/web ports 16732/8692. No fixture server was spawned. Worktree clean; HEAD unchanged; lead worktree retained. No source edits, committed fixtures, commits, pushes, PR comments/edits, merges or code-review rounds. App thread registration was required by the harness; linked PR watching:false. No secrets uploaded; private logs/state/config were excluded and issued access/MCP credentials scanned against all public artifacts.

Blockers: **none within the requested proof scope**. Unverified: original macOS desktop issue variant, other independent runtimes, future CI state.

FRICTION: supplied cleanup example names an absent MCP preview_close; used its documented authenticated preview.close RPC directly, successfully.

FRICTION: the reused harness calls its diagnostic output recovery-transcript.json and retains unused port-0 fixture metadata; actual requests and this report disambiguate them. No recovery recapture occurred.

FRICTION: initial public-artifact secret scan incorrectly treated OAuth token_type='Bearer' as a secret, matching script source. Corrected the scan to actual issued access/MCP credentials. The failed scan prevented bundle creation/upload; corrected scan passed before upload. No credential exposure.

Audit performed by GPT-6.1-Sol through the Codex harness, evidence-only, 2026-10-22 UTC.