# Proof audit pass 1: snapshot dimension read

Scope: [#19220](https://git.cafe/pingdotgg/t3code/issues/19220), branch `fix/issue-19220`, [b8955af5cf](https://git.cafe/pingdotgg/t3code/commit/b8955af5cf9e6bb785baab9ad2161dd642b56063) against [70e5e384da](https://git.cafe/pingdotgg/t3code/commit/70e5e384da). Read-only audit; no tracked edits, server, browser, captures, push, public comments, remote machines, or account changes.

## Finding

No visible matrix exists for this diff. Only DesktopSnapShot.ts and its test change. The desktop main-process helper replaces nativeImage.createFromBuffer(png).getSize() with readImageDimensions(png); no renderer, contract, settings, output bytes, flash, animation, or navigation changes. A red regression test plus a real Electron CPU-operation transcript is appropriate. Screenshots cannot establish removal of the redundant decode. If later claiming visible shortcut responsiveness, use a recording; no such claim is established here.

## Minimum runtime fixture matrix

| Fixture / conditional | Affected? | Expected result | Required proof / current gap |
| --- | --- | --- | --- |
| Valid complete PNG 1440x900, accessibility on, identity present; use logical bounds 720x450 | Yes | New reader and native baseline both return 1440x900; logical bounds do not override pixels; zero extra native decode in fixed sizing path | Electron 44.4.5/Xvfb transcript; explicit reader/native/expected equality; timing separately. Existing comparison log has fixture and timing but lacks reader-result assertion. |
| Valid complete PNG 2560x1600, accessibility on, identity present; logical bounds 1280x800 | Yes | Both return 2560x1600; zero extra native decode | Same transcript and explicit equality. Existing comparison log covers fixture/timing with same assertion gap. |
| Unreadable dimensions: empty, truncated/unsupported bytes, or zero-sized PNG header; logical bounds 700.6x519.4 | Yes, defensive fallback | Reader returns null; helper returns 701x519 without native decode | Runtime transcript exercising the actual helper or clearly identified exact helper extraction; not a production capture simulation. Fallback runtime proof not found. |
| Same null dimension input, logical bounds 0x-2 | Yes, fallback clamp | 1x1, zero native decode | Small companion assertion in same transcript; no visual capture. Not yet evidenced. |
| Accessibility disabled, or identity absent (including Linux metadata with no truthy processId / generic desktopCapturer selection) | Unaffected: helper bypassed | No dimension read / accessibility pool read due to unchanged caller gate | Source audit sufficient for this performance diff; service fixture optional, no UI row. |

Valid PNGs must have complete IHDR/IDAT/IEND and be decodable by Electron; a 24-byte header is insufficient runtime fidelity. Use synthetic content only. A corrupt payload with a readable nonzero IHDR can now yield header dimensions where native decoding formerly failed; header parsing is not image validation. Upstream paths produce PNGs; do not claim identical validation of arbitrary corrupt images. Other supported reader formats are not capture inputs and need no new runtime matrix rows.

## Callers, platforms, and rendering inventory

Single helper caller: captureSource, conditional on accessibleIdentity && snapShotIncludeAccessibility. Fallback selects active.bounds first, otherwise accessibleIdentity.bounds. active identity uses platform-adjusted flash bounds for accessibility; the fallback selection remains unchanged. prepareCapture -> captureSource -> persistCapture is shared by service capture and shortcut capture. Shortcut suppression, cooldown, enabled setting, mutex, failure handling, and permission gates remain unchanged.

| Surface / path | Classification | Proof requirement / uncovered surface |
| --- | --- | --- |
| macOS direct capture, active window | Affected when accessibility enabled | Same PNG sizing logic; native OS capture and accessibility integration not exercised by Linux/Xvfb. No additional UI capture required. |
| Windows direct region capture, active window (including scaling) | Affected when accessibility enabled | Same sizing logic; Windows capture/DIP/accessibility integration unverified here. Existing scaling tests are separate from native runtime proof. |
| Linux capture backend with window processId: GNOME, KDE, Niri, Hyprland / other supported backend | Affected when accessibility enabled | Same helper independent of backend; Linux mock regression exercises service path. Real compositor/AT-SPI capture integration unverified. |
| Linux capture without processId; desktopCapturer fallback without active identity | Unaffected | Caller skips helper. No image-size operation to benchmark. |
| Unsupported platform, disabled capture, failed acquisition | Unaffected | Returns before helper; no new proof/capture. |
| Desktop shortcut and command/IPC entry invoking capture | Converge on affected service | Real shortcut/accessibility end-to-end explicitly UNVERIFIED. App launch after libsecret dev install is launch-only proof. |
| Existing image display, attachment coordinator, feedback flash/animation, settings / command palette UI | Render code unchanged | No visible matrix; no screenshots. If proving perceived timing or interaction later, record the real flow. |
| Web hosted/local, mobile, server, providers, MCP/scheduler, local/relay/tunnel | Unaffected by desktop-local helper | No changed contract, shared client behavior, transport, provider adapter, or remote dimension operation. No capture rows. |
| Native decodes in MacSnapShot, RegionSnapShot, linuxCaptureSession, preview/context-menu paths | Unchanged | Do not assert zero native decoding for the entire capture; only the redundant sizing decode is removed. |

## Evidence status and handoff instructions

Supplied handoff reports: independent Sol and Opus reviewers MERGE/no blockers; red [3177e331d9](https://git.cafe/pingdotgg/t3code/commit/3177e331d9e2f1a7f83430597f66f0ba47d8c16c) fails decode count 1 vs expected 0; green 50/50, lint/format and desktop typecheck pass. These checks were not rerun in this audit. The new source test independently shows valid 1400x1040 PNG against 700x520 logical bounds, accessibility request and persisted metadata dimensions, unchanged written PNG, and zero createFromBuffer calls.

Inspected local reporter scripts and transcripts: one 2560x1600 baseline log reports 134.506103 ms median redundant decode. A separate two-size comparison reports 46.655234 ms (1440x900) and 37.128250 ms (2560x1600), with header-read averages approximately 0.000343 and 0.000098 ms respectively. Different loaded-VM runs are not directly comparable; do not promise a fixed speedup or end-to-end latency improvement. Existing scripts do not print Electron version or assert the reader result, so Electron 44.4.5/Xvfb provenance remains supplied context rather than independently verified from those transcripts.

Evidence agent: retain the red-test failure and green result; extend the out-of-repo reporter to print Electron/Node/platform/Xvfb provenance and fixture dimensions/byte lengths. For BOTH complete PNG fixtures, explicitly assert deep equality of readImageDimensions(png), nativeImage.createFromBuffer(png).getSize(), and expected dimensions. Exercise the actual fixed sizing helper (or documented exact extraction) for fallback rounding and minimum-one clamping. Keep native baseline decoding outside the measured fixed path; state zero redundant sizing decodes, not zero total capture decodes. Record iteration count, warmups and median decode timing separately from repeated header-read averages. Upload a sanitized runtime transcript alongside this matrix. Do not start desktop capture, record a screen, or claim real shortcut/accessibility e2e under this audit authorization. Real e2e remains an uncovered optional integration surface requiring separate authorization/work, not a visual proof blocker for this diff.

## FRICTION

| category | problem | prevention |
| --- | --- | --- |
| Proof fidelity | Reporter times reader but does not assert its returned dimensions | Assert reader/native/expected equality for both complete PNGs. |
| Attribution | 134.5 ms single loaded-VM result could be presented as universal or end-to-end | Label runtime, fixture, warmups/sample count, statistic and machine-load limitation; separate runs. |
| Coverage | App launch mistaken for capture shortcut/accessibility integration | Label launch-only; keep real shortcut/accessibility e2e explicitly unverified. |
| Scope | Generic frontend matrices would invent unrelated screenshot requirements | Derive rows from single helper/caller gate; runtime transcript for CPU operation; recording only for actual visual interaction/timing claims. |
| Publication | Public artifact may leak local data | Matrix contains only synthetic fixture descriptions, public code references and aggregate metrics; no tokens, cookies, credentials, pairing links, customer data or raw app logs. Inspect before upload. |