# Proof audit, pass 1 — fixture matrix

PR [#33064](https://git.cafe/pingdotgg/t3code/pull/33064) ([GitHub mirror #33064](https://github.com/pingdotgg/t3code/pull/33064)). Read-only code-derived audit; no captures exist or are claimed.

## Findings first

1. **Proof is insufficient.** The source routes three reveal entry points through the new helper, but Linux cannot demonstrate the central claim: a Windows file is selected by Electron with the same outcome, faster. Actual Windows stock/replacement-manager/WSL/path/error recordings remain `cannot-verify windows`. Linux recordings must not stand in for those rows.
2. **Entry-point outcomes differ.** ChatMarkdown hides reveal unless remote-open resolution is complete, local-exec, authorized, and reveal capability is advertised. OpenInPicker only attempts native reveal for its local-exec file-manager action with `revealFileManager=true`; its menu chooses a preference before the toolbar primary button opens it. fileContextMenu advertises reveal based on server capability, and in remote mode still asks the server to reveal. A no-operate-scope chat/picker action is blocked; a context-menu action skips IPC and reaches the server authorization rejection. Do not claim every decline sends an RPC.
3. **No new layout was introduced.** Proof should show a click/keyboard action together with IPC/RPC/process observations. A still of an unchanged menu does not establish routing, selection, absence of duplicate launches, error behavior, or speed. Every behavioral row below requires a **recording**, including negative outcomes.
4. **Observability needs more than an xdg-open stub.** Linux reveal first tries `gdbus ... FileManager1.ShowItems` and only falls back to a parent-directory `xdg-open`. Discovery requires a graphical session and a nonempty `xdg-mime query default inode/directory` result. Without controlling these, a missing xdg-open log does not establish a failed reveal or a native reveal. Stub outputs prove invocation, not a real file-manager window.
5. **Revision evidence is not interchangeable.** The requested worktree is clean at local head [93a2245059](https://github.com/pingdotgg/t3code/commit/93a2245059f7b9c2555269b24d168dbadc68b3c3), merge-base [4c361199f4](https://github.com/pingdotgg/t3code/commit/4c361199f47f6ea32a2c14835df392640d0f7c63). The local merge may not yet be available through its forge link. GitCafe currently reports remote head [58a91cbe61](https://github.com/pingdotgg/t3code/commit/58a91cbe610a166359a03676b7d7c1d9073e87bf), the first parent of the requested merge commit. Its 30 successful checks and bot reviews are not checks of the local merged head. The five changed runtime implementation files are byte-identical between that parent and the requested head; source links below use that published parent. No refs were refreshed or changed.

No concrete runtime regression was established in this structural pass. This is a proof-coverage verdict, not merge approval. No tests, app runs, Windows calls, or speed measurements were performed. `git diff --check origin/main...HEAD` passed.

## Scope and source inventory

Inspected all 12 changed files in `git diff origin/main...HEAD`, plus relevant callers, remote-open resolution, path resolution, file-manager discovery/launch, authorization and shortcut code. Read changed handlers and their relevant rendering branches, concentrating the capture matrix on file-reveal behavior rather than unrelated markdown widgets.

Changed transport path: [DesktopBridge optional method](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/packages/contracts/src/ipc.ts), [preload](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/desktop/src/preload.ts), [channel](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/desktop/src/ipc/channels.ts), [handler registration](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/desktop/src/ipc/DesktopIpcHandlers.ts), [window handler](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/desktop/src/ipc/methods/window.ts), [shared renderer helper](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/remoteOpen.ts). Changed tests: [window tests](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/desktop/src/ipc/methods/window.test.ts), [DesktopApp tests](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/desktop/src/app/DesktopApp.test.ts), [remoteOpen tests](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/remoteOpen.test.ts).

### ChatMarkdown render paths

Source: [ChatMarkdown](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/ChatMarkdown.tsx), reveal handler near local lines 637–662; chip callback near 880. [MarkdownFileLink](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/MarkdownFileLink.tsx) owns the menu/error presentation.

Production direct caller inventory (all feed the same renderer):

| Caller | Data/presentation differences relevant to reachability | Collapsed fixtures |
| --- | --- | --- |
| [TimelineAssistantRows](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/TimelineAssistantRows.tsx) | assistant text; thread + cwd; streaming/settled; line-break choice | A01, A15 |
| [TimelineUserMessageRow](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/TimelineUserMessageRow.tsx) | empty text returns null; otherwise thread + cwd, lineBreaks, raw HTML disabled | A01, A20 |
| [TimelineWorkEntryRow](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/TimelineWorkEntryRow.tsx) | expanded details have thread/cwd and streaming; inline collapsed reasoning has cwd but no environment/thread | A01, A15, A20 |
| [TimelineWorkGroupRows](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/TimelineWorkGroupRows.tsx) | inline thought previews; plugins and no environment/thread | A20 |
| [ComposerPendingUserInputPanel](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/ComposerPendingUserInputPanel.tsx) | expanded question body, thread/cwd | A01-equivalent |
| [UserMessageContextChips](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/UserMessageContextChips.tsx) | nonempty review comment text; thread/cwd; raw HTML disabled, lineBreaks; optional fenced diff has no file chip inside fence | A01, A20 |
| [ProposedPlanCard](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/ProposedPlanCard.tsx) | collapsed preview/full markdown, thread or explicit environment; headings and fold overlay | A01-equivalent, A20 |
| [V2ItemInspector](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/V2ItemInspector.tsx) | nonempty reasoning text, source thread and cwd | A01-equivalent |
| [FileMarkdownPreview](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/files/FileMarkdownPreview.tsx) | thread/cwd, imageBaseDir based on preview file directory, task edits, mutation refresh | A01 |
| [PullRequestMarkdown](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/pullRequest/PullRequestMarkdown.tsx) | markdown/image segments; explicit environment with/without thread, extra plugins, source-control media | A01-equivalent, A20 |
| [WorkflowOpeningBlock](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/WorkflowOpeningBlock.tsx), [AttachmentFilePreview](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/files/AttachmentFilePreview.tsx), [NotebookPreview](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/files/NotebookPreview.tsx), [composerContextPresentation](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/composerContextPresentation.tsx) | no thread/environment, cwd undefined; script/code, rendered attachment, markdown cell, nonempty comment respectively | A20 |

Branch inventory and reduction:

- `threadRef.environmentId` overrides explicit environment; neither gives null. Shell actions need operate scope, nonnull environment, resolved remote state and local-exec. Reveal additionally needs advertised capability plus file-manager in available editors. Label comes from reveal kind, or server OS when kind absent (including WSL wording). See A09/A13/A14/A15/A20/A21.
- File chips come from recognized anchors, recognized inline code, or local non-media image syntax. A filename label renders a chip; a descriptive label adds text before the chip. Relative/basename paths can require an async workspace search; ambiguous/no match retains the original path, repeated workspace prefix may require metadata lookup; absolute paths and file URIs normalize through host-path resolution. Line/column belong to editor/copy targets, not the reveal path. Duplicate basenames add parent suffixes; long labels wrap/truncate through existing chip layout. See A01, A26.
- Chip primary action is panel/media/editor/browser depending on thread, path, file kind and preview scope; modifier-click opens editor. Reveal is a separate context-menu choice, not normal left click. Without a primary action a button opens options; otherwise an anchor does. Menu supports pointer or keyboard position, copy relative/full paths, cancellation; failures show `Unable to reveal file`, interrupted results do not. See A01/A20/A23/A25/A26.
- Outer renderer: inline span/block div; empty/nonempty text; settled/cache versus streaming split blocks, or incremental fence parser; lineBreaks on/off; raw HTML parsed/literal; extra plugins; task edit callback; math setting; theme, width and className. These select existing rendering only. File-chip reveal callback is shared across them, so A01 + A15 + A20 + A27 represent them without the full unrelated markdown cross-product.
- Other output categories (external/thread/PR/citation/context links, images/audio/video/media errors and loading, code/shell/math/mermaid, headings/tasks/artifacts) do not enter the new reveal handler unless converted to a file chip. They are control inputs in A26; no new per-media loading/error matrix is warranted for this change.

### OpenInPicker render paths

Source: [OpenInPicker](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/OpenInPicker.tsx), local lines 245–286. Its only production JSX callers are [FilePreviewPanel](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/files/FilePreviewPanel.tsx) and [ThreadDetailsPanel](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/ThreadDetailsPanel.tsx).

- Preview uses compact toolbar, file absolute path and isFile, shortcut flag, and `revealFileManager = !isFolder && (data != null || error != null) && shellRevealInFileManager`. Read errors still enable reveal; loading/folders do not. Breadcrumb/path/attachment/host-file access gates can remove the toolbar. A non-primary environment with local-exec also hides it. See A02/A16–A19/A22.
- Details uses panel layout, git cwd, default `revealFileManager=false`, default `openInCwdIsFile=false`, configurable shortcut; its visibility also depends on details density and open-in setting. It is a control: opening a directory, not native reveal (A24).
- Props: `presentation=toolbar|menu`, `displayMode=toolbar|panel`, compact on/off, enableShortcut on/off, `openInCwd` null/empty/nonempty, file/directory, reveal flag on/off, available editors empty/one/many, preferred editor null/matching/invalid fallback. `presentation=menu` has immediate item actions + submenu rather than toolbar preference selection; no production caller currently sets it, so A28 is a labelled harness, not a claimed real route.
- Remote modes: local-exec uses server editors and checks operate scope; remote-links uses locally probed remote-capable editors and SSH URL, not file-manager reveal; remote-unavailable shows `No SSH route to <label>`. Remote hint absent/seen and missing/long environment label change menu text only. macOS/Windows/Linux navigator platform changes file-manager icon/label and brand styling. Shortcuts appear only where configured; background threads suppress the marked button. Counts, label lengths, panel/compact and width are represented by A21/A24/A27/A28.
- Toolbar dropdown picks a preference only; primary click executes, then announces on success. Menu presentation executes immediately. Successful native reveal stores the file-manager preference; false/rejection/missing method falls back to the original mutation and stores the preference. No spinner or new error UI is added. See A02/A07/A08/A23/H01.
- [Favorite-editor command](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/OpenInPickerShortcut.ts) clicks the last marked enabled primary button; key repeat is ignored. Without a usable marked button the existing fallback opens the thread cwd without reveal. Command registration is shared with the shortcut dispatcher; no new Settings action or dedicated reveal command is introduced. See A02/A10/A12/A24.

### fileContextMenu render paths

Source: [fileContextMenu](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/fileContextMenu.ts), local lines 90–172.

- Callers: [FileBrowserPanel](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/files/FileBrowserPanel.tsx) builds app items into its tree menu, then activates selected item; [TimelineAssistantRows changed-files card](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/chat/TimelineAssistantRows.tsx) uses show/activate with workspace + repository root; [DiffPanel](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/web/src/components/DiffPanel.tsx) resolves the clicked diff file title, then uses show/activate with workspace + repository root. See A03–A05.
- Target shape: environment null/non-null, relative versus absolute filePath, workspaceRoot missing/present, optional repositoryRoot and workspace prefix remapping. Unresolvable path gives no items; null environment blocks activation. Menu needs local API; cancellation does nothing. See A05/A25.
- Items: `Open` when file-manager exists; reveal when nonnull environment + server reveal capability + file-manager; open-with submenu excludes file-manager and exists for one/many other editors. No config/empty editor list gives no corresponding items. Reveal label comes from server kind or OS. No operate-scope UI filter is added here. See A11/A21/A25.
- Only reveal + local-exec enters helper. Open and editor actions retain existing mutation payload without reveal; invalid editor action returns. Remote reveal retains server behavior. Failure toast title is `Unable to reveal file`, `Could not open file` or editor-specific. Pointer/keyboard menu anchors differ, not command semantics. See A03/A11/A13/A14/A23/A25.

### Handler and helper branches

- Renderer scope false → false without IPC; absent window bridge or absent optional method → false; throw/rejected Promise → false; result must be exactly boolean true (false/undefined/null/other values fall back). True → success with zero server reveal calls. A06–A12/H01/H02.
- IPC payload must decode as string and result as boolean. Non-Windows OR path failing `/^[A-Za-z]:[\\/]/` → false without registry subprocess or Electron reveal. This excludes POSIX, relative, drive-relative, UNC, WSL UNC, extended-length/device paths and file URI strings at the IPC boundary. Recognized markdown file URIs should have been resolved before this boundary. H03/W04/W05.
- Eligible Windows path → spawn absolute reg.exe using SYSTEMROOT, else windir, else `C:\Windows`; query `HKCR\Directory\shell /ve`; consume stdout plus exit concurrently. Exit 0 plus case-insensitive `REG_SZ` followed by `none` at line end accepts; missing/malformed/blank/non-stock/nonzero declines. Errors or two-second timeout decline. No cached probe: every eligible invocation queries again. W01–W03/W06–W09.
- Accepted → normalize all forward slashes to backslashes, call `shell.showItemInFolder`, return true. A thrown Electron call rejects the IPC and renderer falls back. A void native return is not OS selection confirmation. W01/W10.

## Seeding and evidence contract

All paths below are **future capture instructions**, not completed steps. The audit did not write app state or run a fixture.

**S (real app seed):** In a new timestamped run directory beneath `/tmp/lead-33064-r1/proof-audit-1/`, create a disposable git project with `src/a.ts`, `other/a.ts`, `nested/docs/guide.md`, `my project/a,b.ts`, a long Unicode filename, a directory, and a deliberately missing file. Add project through the isolated app UI; create a thread with the UI or app RPC. Navigate to `/<environmentId>/<threadId>`. Send a user message containing the markdown below; user messages render the same changed ChatMarkdown file callback, so this needs no paid turn. Open files through the file chip or file browser; show Details for directory-open controls. For an assistant/streaming representative use the existing free Replay dev fixture; arbitrary streaming markdown needs the labelled driver in A15, since changing the prompt does not change Replay's recorded response. To seed changed-files/diff callers use a synthetic checkpoint/turn created through app commands/Replay, or a coherent stopped fixture matching the existing schemas. If using direct projections for visible rows, label the seeding and do not claim it validates event sourcing. No live developer data is needed.

Suggested message input: `[src/a.ts](src/a.ts#L2)`, `[Read this](src/a.ts)`, inline code `` `src/a.ts:2:3` ``, `[a.ts](other/a.ts)`, `![Document](nested/docs/guide.md)`, an absolute POSIX path, a normalized file URI, and a long Unicode path. Windows counterparts substitute an actual drive-letter workspace. A rendered markdown preview with `imageBaseDir` tests document-relative links separately from chat cwd-relative links.

**P (isolated Linux process harness):** Start the real Linux server with a task-local PATH prefix. Stub `xdg-mime query default inode/directory` to report a disposable `.desktop` handler; set a graphical-session DISPLAY. Stub `gdbus` to log argv and return success for ShowItems (selection-request branch), then separately return nonzero to force the fallback; stub `xdg-open` to log argv and exit. Log each argv element losslessly (JSON), invocation count and scenario id, and wait for the actual log/trace event rather than guessing with sleeps. Existing launcher behavior is [here](https://github.com/pingdotgg/t3code/blob/58a91cbe610a166359a03676b7d7c1d9073e87bf/apps/server/src/process/externalLauncher.ts). Do not confuse these stubs with a real Linux file manager. Optional real file-manager window footage adds actual selection proof for Linux only. Stub editor binaries separately if needed. Use a fresh server process/config discovery for capability variants rather than relying on its 60-second discovery cache.

**T (trace):** Record action id, target environment/path, renderer reveal bridge invocation/result/error, `desktop:reveal-item-in-folder` main invocation/result, outbound/received `shell.openInEditor` payload and result, and P log or real file-manager result. A dev-only external driver may passively attach to the Electron renderer/main to observe IPC and WS frames without modifying source. If injection changes the bridge, scope, remote state, data timing or result, the recording is explicitly a **labelled harness**, never a stock-app or Windows capture. Preserve raw traces; redact secrets before uploading. A normal server log may not expose the RPC payload; verify tracing first rather than infer it from silence. Observe exactly one intended operation, and no extra operation after completion or a second event-loop turn. No real agent calls are necessary.

**G (scope/connection fixtures):** Use the app's auth CLI `auth pairing create` or `auth session issue` with isolated home and explicit repeated `--scope` values (the list replaces defaults), then pair a separate client. Include read scopes needed to display files and omit `orchestration:operate` and legacy/grant scopes that imply it. Use Connections UI/RPC for an isolated secondary environment; distinguish local/loopback primary, desktop-owned WSL primary, SSH/direct/relay/tunnel remote profile, and remote with no advertised SSH route. Do not edit auth database rows. If the Linux setup cannot provide a real second environment with those connection states, mark the row as a labelled state harness rather than silently changing environment metadata.

**H (labelled harness):** An external driver or the existing browser/component test renderer can set a missing method, failing bridge, held Promise, synthetic server config/remote state, or unused picker prop. Keep its driver and output in a fresh run directory in this scratch root; do not add a route or edit the checkout. A screen mounted by a harness must be labelled on-screen and in its filename. H is only renderer/contract proof. It cannot satisfy any W row.

**W (real Windows only):** Run the actual desktop build and actual local Windows server, real drive-letter file/directory, real registry state and Explorer/replacement manager. No Linux platform override, fake reg.exe, fake Explorer or mocked Electron can substitute. This task has Linux VMs only; all W rows remain `cannot-verify windows`. macOS real Finder outcome is also unavailable here; Linux non-Windows early return covers the changed platform branch, not Finder itself.

## Fixture matrix

Legend: **Y** = directly traverses a changed branch; **Y/control** = new gating or bypass must preserve the old outcome; **N/control** = unchanged render/operation used to prove scope. Each list inside a row is a required sub-run of one equivalence class, not an assertion that one click covers every entry point. M = markdown menu, P = preview picker, C = file context menu. Main/base means requested merge-base [4c361199f4](https://github.com/pingdotgg/t3code/commit/4c361199f47f6ea32a2c14835df392640d0f7c63), not a moving remote tip.

Capture coordinates: **D = 1440×1000, dark, 100% zoom** on Linux web or Electron Xvfb. **N = 900×800, light, 100% zoom**. **WD = 1440×1000, dark, actual Windows**. All rows below are `recording` (or recording required but unavailable), because each oracle depends on interaction, async completion, or timing. Appearance controls can be included in the same recording. Compare base/head for each runnable affected row; base naturally has no new IPC. Trace labels and counts matter more than additional theme combinations.

| ID / named fixture | Diff affects | Required input / real seed or harness | Interaction and observable oracle | Minimum capture | Pass-1 status |
| --- | --- | --- | --- | --- | --- |
| A01 Markdown recognized file chips | Y | S: relative/absolute, filename/descriptive labels, inline-code path + line/column, local non-media image syntax; duplicate basenames, long Unicode; chat + nested rendered markdown | Right-click each representation, reveal; keyboard context menu once. T: resolved absolute path with no line suffix; Linux IPC false then one RPC `{cwd:path,editor:"file-manager",reveal:true}`; P logs correct URI/parent | D, desktop, recording; cover each distinct chip shape in one clip | pending recording |
| A02 Settled preview, preferred file-manager | Y | S: primary-env file read success; advertised reveal; FM available; preference initially other editor, then FM | Dropdown selects FM without opening; primary click reveals; repeat via favorite-editor shortcut. T: false IPC then one reveal RPC per activation, preference retained and success announcement | D, desktop, recording | pending recording |
| A03 File-browser context reveal | Y | S: file tree with workspace-relative file; P both ShowItems-success and fallback sub-runs | Pointer menu and keyboard menu → reveal; target resolves correctly; T + P; no duplicate launch | D, desktop, recording | pending recording |
| A04 Changed-files-card reveal | Y | S: stopped turn with changed file + checkpoint; root/subdir workspace | Right-click actual changed-file row → reveal; T + P path is workspace file, not repo-prefix duplication | D, desktop, recording | pending recording |
| A05 Diff-header reveal | Y | S: actual diff with two files; workspaceRoot != repositoryRoot case | Right-click each file header title → reveal; T + P shows clicked file, correct workspace remap | D, desktop, recording | pending recording |
| A06 Plain web, no desktopBridge | Y | S + P; real browser at loopback origin, all M/P/C | Reveal through each entry: no bridge/IPC; one authorized server reveal RPC each, correct URI/parent | D, web, recording | pending recording |
| A07 Older desktop missing optional method | Y | Actual old shell loading current web if available; otherwise H removes only new method and retains desktop identity | M/P/C reveal; optional call is absent, no exception UI, one server reveal each | D, labelled compatibility harness unless actual old build, recording | pending harness recording |
| A08 Broken IPC / bridge rejection | Y | H: method throws synchronously, rejects asynchronously, or current preload has no main handler; separate sub-runs | M/P/C reveal → exactly one server fallback each, no unhandled rejection or duplicate launch | D, labelled harness, recording | pending harness recording |
| A09 Read-only markdown | Y/control | S + G: show files, omit operate scope | Open markdown chip menu; reveal/editor action absent, no IPC or reveal RPC; copy/preview still usable as permitted | D, desktop, recording | pending recording |
| A10 Read-only picker | Y/control | S + G: preview and Details controls without operate | Primary and choose-editor disabled; shortcut cannot reveal; no IPC or reveal RPC | D, desktop, recording | pending recording |
| A11 Read-only context menu | Y | S + G: reveal still advertised by config | C → reveal; helper makes zero IPC calls; server `shell.openInEditor` is rejected by operate authorization, no launcher call, error toast | D, desktop, recording | pending recording |
| A12 Permission revoked with retained interaction | Y | H or real G grant change: menu already open / shortcut retained; explicitly synchronize session update before activation | M/P/C activation after revocation: no native reveal; M fails/hides, P refuses, C server rejects; do not infer this from initial disabled state | D, labelled harness if grant transition injected, recording | pending recording or labelled harness |
| A13 Remote route available | Y/control | G: real secondary SSH/direct remote with advertised route, then relay/tunnel profile equivalence; scoped correctly; FM + remote editor | M no host reveal; P remote editor opens SSH URL, FM not offered; C reveal goes to destination server, zero local native IPC. Track target environment; remote hint first/seen | D, desktop, recording; H if no real second environment | pending recording or labelled harness |
| A14 Remote route unavailable | Y/control | G: remote target with no SSH alias or advertised targets | M no reveal; P disabled + No SSH route label; C still server reveal. No native IPC | D, desktop, recording; H if state injected | pending recording or labelled harness |
| A15 Unresolved → resolved / streaming | Y/control | H: hold presentation resolution then publish local/remote; streaming markdown last block and stable earlier chip | Before resolution M hides shell actions; after local resolution reveal works, remote stays hidden. P/C default to local-exec while unresolved: record actual state/scope order, flag any local IPC to a remote Windows path; reveal while text streams must keep correct target | D, labelled state/timing harness, recording | pending harness recording; unresolved reachability not established |
| A16 Preview loading → settled file/folder | Y/control | S with slow file read; H required to hold it deterministically. Include folder read discovering isNotFile | Before settle FM ordinary open with no reveal and zero new IPC; file success enables reveal; folder stays ordinary open. Correct path per phase | D, labelled timing harness if response held, recording | pending recording or labelled harness |
| A17 Preview read error / missing file | Y | S: missing/unreadable file with stable error, breadcrumb + absolute path retained | FM action still requests reveal after read error; trace exact missing target and resulting error/outcome. Linux fallback alone does not establish Windows missing-file behavior | D, desktop, recording | pending recording |
| A18 Host-file access pending / denied | N/control | S + G or H: missing filesystem read permission, pending access then explicit denial | Access spinner → denial text; no preview picker mounted, hence no new IPC. Each access screen visible | D, recording; H if delay injected | pending recording or labelled harness |
| A19 Preview picker absent | N/control | S: rendered attachment (no host path); pathless preview; non-primary local-exec environment, separate sub-runs | No open-in picker under the respective breadcrumb/environment gate, no reveal trigger; ordinary navigation intact | D, recording | pending recording |
| A20 Markdown no shell context / no file chip | N/control | S: no environment/thread (attachment/notebook/inline thought); empty text; no cwd with only relative links; normal code/external link | No reveal command or IPC; chips with no primary action are options buttons where applicable; null/empty body remains empty. Explicit environment without thread is separately exercised in H if needed | D, recording; labelled renderer harness for inaccessible caller shape | pending recording or labelled harness |
| A21 Capability and editor counts | Y/control | S with fresh P discovery variants, H for synthetic counts: no config, empty editors, FM-only, other-editor-only, FM + many; capability absent/false/true; kind absent vs explicit; long labels | M/C reveal only when capability + FM; P available editors/pref/empty-state correct, reveal flag only when enabled. Record late discovery updating menus; no phantom native call | D, labelled config harness for artificial variants, recording | pending recording or labelled harness |
| A22 Preview reveal unavailable | Y/control | S: capability absent/false with settled file; FM available | FM opens ordinarily, RPC omits reveal, zero new IPC. No claim that native acceleration removes existing PowerShell capability discovery | D, desktop, recording | pending recording |
| A23 Server reveal failure | Y | H: helper declines and RPC returns typed failure; real failure if reproducible before subprocess detach. M/P/C sub-runs | One failed RPC, no duplicate; M/C Unable to reveal file, picker command's existing error reporting; no success announcement on failure | D, labelled error harness unless real failure, recording | pending recording or labelled harness |
| A24 Ordinary open and other editors | N/control | S: Details panel FM preferred; preview other editor; visible/no marked shortcut; missing/invalid preferred selection | FM Details opens directory without reveal; preview editor gets exact editor path, no native IPC; primary/keyboard agree, shortcut fallback opens thread cwd. Menu-selection alone is not an activation | D, desktop, recording | pending recording |
| A25 Context target guards / other actions | Y/control | S + H for invalid target/API: rootless relative, absolute without workspace, repository-outside path, null environment, empty items, cancelled menu, unsupported editor | Guarded targets no action; valid absolute resolves; Open/Open with keep non-reveal RPC, reveal cancel makes no IPC/RPC. FileBrowser keyboard anchor and pointer anchor both usable | D, labelled harness for impossible UI targets, recording | pending recording or labelled harness |
| A26 Markdown resolution + non-reveal controls | Y/control | S: basename unique/ambiguous/no match; repeated workspace prefix with existing/missing literal; cwd vs imageBaseDir; host path outside workspace; known media/browser/file links | Reveal uses resolved host file; normal click opens preview/media/browser and modifier click editor; copy paths correct, none invoke new reveal IPC. Await search/metadata, not sleeps | D, desktop, recording; H for deterministic lookup races | pending recording or labelled harness |
| A27 Narrow/light interaction access | N/control | S: A01/A02/A03/A24 with long file label, many editors, long env label; 900px client | Chip menu, compact toolbar, panel label/menu remain reachable; same recorded outcomes. Background thread/shortcut-disabled keeps shortcut off that picker | N, web or desktop, recording | pending recording |
| A28 Unused picker menu presentation | N/control | H: production component with presentation=menu; panel/toolbar display, compact, no/one/many editors, null cwd; no current route supplies presentation=menu | Primary menu/submenu immediately opens chosen editor; disabled guards respected; do not mistake toolbar preference selection for this path | D, labelled component harness, recording | pending harness recording |
| H01 Renderer native-success contract | Y | H only: helper's bridge Promise resolves true; do not set platform=Windows or claim OS reveal. M/P/C and delayed-resolution sub-runs | Exactly one bridge call with path, zero server fallback, picker preference and announcement correct; nothing proceeds before Promise settles | D, labelled renderer-only harness, recording | pending harness recording; cannot satisfy W01 |
| H02 Strict result / delayed false | Y | H only: false/undefined/null/nonboolean result and delayed false; each M/P/C | Only boolean true suppresses fallback; one server request after false settles; no success before completion | D, labelled renderer-only harness, recording | pending harness recording |
| H03 Real Linux IPC guard + schema | Y | Actual Linux Electron IPC: valid POSIX string and drive-letter-looking string, then invalid raw payload via labelled IPC driver | Both strings return false with zero reg.exe/native reveal; invalid payload rejects decoding and helper catches if invoked through it. Confirms registered channel, not just exported handler | D, labelled IPC diagnostic recording | pending recording |
| W01 Stock Windows native selection | Y | W: drive-rooted workspace, stock REG_SZ none, real file; M/P and all C caller surfaces, actual '/' and '\\' paths | Real reg query → native IPC true; correct file selected; no server reveal RPC/PowerShell; before/after base vs head video including click-to-selection time | WD, recording required | cannot-verify windows |
| W02 Replacement manager | Y | W: user-selected nonstock Directory shell verb and installed replacement manager | M/P/C native decline, server reveal uses original registered manager and expected parent; preserve real behavior rather than assuming selection | WD, recording required | cannot-verify windows |
| W03 Absent / malformed registry value | Y | W: absent/empty/non-REG_SZ/custom/case variants, real registry backed up/restored by owner | Probe accepts only stock pattern; otherwise server fallback; actual selection/open outcome matches base | WD, recording required | cannot-verify windows |
| W04 UNC / WSL / device paths | Y | W: Windows desktop + real reachable UNC and WSL paths, POSIX WSL primary, extended/device paths; separate sub-runs | New IPC declines non-drive-rooted paths; original server conversion/manager path retained. Actual Explorer/replacement result recorded | WD, recording required | cannot-verify windows |
| W05 Drive/path edge cases | Y | W: C:/ and lowercase drive, spaces/comma/apostrophe/Unicode, directory and missing file; raw relative and C:relative rejected at IPC | Normalization + intended OS selection/open match base; no implicit line/column or file-URI strings passed to native API | WD, recording required | cannot-verify windows |
| W06 Registry nonzero / spawn failure | Y | W: real lookup failure/unavailable reg.exe under disposable environment | IPC false then server reveal, no dropped action; SYSTEMROOT/windir/fallback path choice verified with actual process trace | WD, recording required | cannot-verify windows |
| W07 Registry probe stalls | Y | W: actual Windows probe delay in isolated diagnostic setup; synthetic delay clearly labelled | Two-second timeout and cleanup → fallback, no hung reveal; latency claim excluded for failure case | WD, recording required | cannot-verify windows |
| W08 Repeated / concurrent reveal | Y | W: two file targets; repeat clicks and change default manager between calls | Each eligible activation probes registry again, no cached manager assumption; trace ordering/counts and final target for each | WD, recording required | cannot-verify windows |
| W09 Windows connection guards | Y | W: local primary including desktop-owned WSL NAT, remote Windows environment, read-only scope | Only eligible local drive-path action can native-reveal; remote and denied outcomes match A09–A14 with real Windows IPC/OS; no wrong-machine reveal | WD, recording required | cannot-verify windows |
| W10 Electron failure / void result | Y | W: actual native failure/no-op condition if reproducible; native exceptions separately diagnosed | Throw → IPC rejection → one server fallback. Native void return alone is insufficient: verify OS result for real missing/inaccessible files; do not fake success | WD, recording required | cannot-verify windows |

## Minimum capture set and acceptance

- **D × A01–A26, A28, H01–H03**, with an actual Linux desktop for the changed IPC wiring, a real browser for A06, and clear harness labels where the table requires them. Equivalent variants can share one continuous clip with trace scenario markers. They remain individual row/sub-run obligations. No screenshots alone satisfy these rows.
- **N × A27**, a light/narrow interaction clip; this covers existing responsive labels and popup access without multiplying every behavioral row across themes. OS icons/labels can be inspected as labelled renderer controls; a Windows-looking icon is not Windows runtime evidence.
- **WD × W01–W10** are explicitly missing/unavailable here. W01 must cover all three entry-point families and the three C caller surfaces. Paired base/head recordings must show real selection and include timing for the claimed speedup. No benchmark or milliseconds were inferred from code/comments.
- A real macOS/Finder recording is unavailable; it is outside this Windows-only acceleration's minimum differential proof because the new handler short-circuits identically for all non-Windows platforms. Do not describe Linux as macOS verification.
- Baseline/head UI may be visually identical. Acceptance is exact environment/path, IPC count/result, absence/presence of `shell.openInEditor`, correct `reveal:true` only when intended, correct file-manager request/result, permissions, failure UX, and no extra operation. A mocked bridge true is renderer branch coverage only.
- Providers are unaffected: reveal operates on an existing path and does not depend on the provider; use free Replay or user messages, not separate paid turns per provider. Native mobile has no changed caller/bridge and is out of scope for the differential capture set. Desktop and ordinary web must both be covered; local, remote/relay/tunnel and multi-environment routing are material.

## Existing tests and limits

The added window test uses mocked Electron and process output. It covers one stock Windows drive-path success, macOS decline, WSL UNC decline, custom verb decline, and nonzero registry exit. The added helper test covers scope allowed/denied and true/false bridge result. These are useful source-level coverage, not actual Windows captures; they do not cover every row above, real selection, speed, missing method/bridge, exceptions, timeouts, all context callers, or full renderer success integration. Tests were read, not run in this pass. The pre-existing picker/browser permission tests cover parts of the surrounding controls but do not satisfy runtime recordings.

## Work record and friction

Read-only checkout inspection completed. Only this scratch directory was written. No app/browser/desktop/server process was started, no forge write/comment/push occurred, and no capture was created. Initial free space: 109 GB. No evidence or raw logs were deleted. Budget: 45 minutes maximum; this pass finished well within it.

FRICTION:
forge | GitCafe snapshot still reports the first-parent head, while the assigned local merged head is newer | Refresh the mirror before using CI/review status as proof for the assigned head; this pass stayed pinned to the requested checkout.
infra | Only Linux VMs are available, so actual Windows native selection, registry integration and performance cannot be recorded | An actual Windows desktop capture host is required for W01–W10.

VERDICT: INSUFFICIENT A01–A28 and H01–H03 recordings pending; W01–W10 cannot-verify windows