# Corrected final fixture matrix — proof audit PASS2

PR [#15386](https://git.cafe/pingdotgg/t3code/pulls/15386), mirror [#15386](https://github.com/pingdotgg/t3code/pull/15386). Audited target [d8a48b84a8](https://github.com/pingdotgg/t3code/commit/d8a48b84a87ce6a59628b2da2a095647a5862618) against [0840bb209c](https://github.com/pingdotgg/t3code/commit/0840bb209c8a503ba74715167e4ae04c4c0e0c19). Original submission is not the capture target. 2026-10-25 UTC.

Scope: real Linux Electron renderer/preload/IPC/service APP FIXTURE. app.isPackaged, appPath, version, APPIMAGE and check/download setup are overridden. Sync failure executes installed electron-updater 6.8.9 BaseUpdater missing-path branch with in-memory downloadedUpdateHelper=null. There is no genuine packaged download/install, signing, elevation, OS handoff or relaunch proof. Success suppresses the OS boundary.

Evidence root `/tmp/ev-15386`; B=`0840bb209c8a503ba74715167e4ae04c4c0e0c19`, A=`d8a48b84a87ce6a59628b2da2a095647a5862618`, E=`A/extra`. Each run has recording.mp4, trace.jsonl, stdout.log and actions.jsonl. The independent replay is `/tmp/audit-15386-pass2/replay3`. PASS2 inspected extracted frames from all 15 distinct recordings (including failed attempts and eight clips) and all 74 evidence PNGs. PNG inventory also encountered 26 dependency/skill/build images, which are not update evidence. Full videos were sampled, with additional frames around updater calls; this is not a claim to have watched every frame.

| Row | Corrected assertion and evidence | Audit result |
|---|---|---|
| S1 | B call1 00:28:58.931: accepted=true/completed=false, state.message=null; global recovery follows. A call1 00:28:57.625: same IPC booleans, typed message/errorContext=install, downloadedVersion=0.1.3/canRetry=true/status=downloaded. pairs/before-sync-first.png versus after-sync-first.png and continuous recordings show confirmation then no toast versus first-request failure toast. | PASS; independently reproduced A call1 at 00:44:26.476. IPC has no failed field. |
| S2 | B call2 00:32:13.649 and A call4 00:32:12.165 arise from independent Settings Install/Confirm. settings-confirm-actual.png, settings-end.png, raw recordings, traces and pairs corroborate. Both finish with Update available / Install, no failure toast; A result carries message. | PASS for unchanged Settings behavior. Hover stills do not visibly establish a tooltip; ordinary downloaded wording is source-supported, not a captured error tooltip. |
| S3 | E actions enable Sidebar (legacy) in real Settings; call1 00:35:44.457 executes sync branch. Video shows legacy layout and failure toast; trace proves typed result and restart. | PASS. legacy-end-immediate.png is too early to prove the toast by itself. |
| A1 | B call3/A call5 return message=null before setImmediate error; each has one DesktopUpdaterReportedError operation=install and backend-ready afterward. Raw/clip video and logs agree. | PASS; async is not turned into synchronous typed failure. |
| A2 | A reuse at 00:32:31.788 emits the saved Error object then a distinct Error. Fixture source establishes object identity. Two background diagnostics, one each; listener baseline 2. Unit test independently asserts same object delivery. | PASS; also independently reproduced at 00:44:26.898/.902. |
| OK1 | B call4/A call6 use controlled success mode, quitAndInstall(true,true), message=null, accepted=true/completed=false, no synthetic failure/recovery. | PASS for suppressed handoff only. |
| OK2 | Genuine packaged download/install/relaunch absent. | OPTIONAL, NOT RUN; no completion claim. |
| R1 | A sync calls1/2/3 at 00:28:57.625, 00:30:31.420, 00:30:55.867 repeat real missing-path failure with retained download and one call per confirmation; A call6 later succeeds at suppressed boundary. | PASS; listeners 3 during calls and baseline 2 later, no stale reservation blocks retry. |
| C1 | A initial Cancel produces no updater call, later confirmed click does. E forced same-tick DOM double click queues sequential confirmations. | PARTIAL/OPTIONAL: cancel verified; full duplicate-confirmation protection and native double-click behavior NOT claimed. |
| T1 | pairs/after-sync-first.png and first-click clip show Could not install update; no false success toast. Download setup emits events directly. | PASS for failure toast; actual download-API informational toast path NOT PROVEN and not required for narrow adapter change. |
| B1 | Real sidebar downloaded label, confirmation, recovery, repeated retry are exercised. Settled state remains downloaded, so ordinary tooltip/label persists despite retained install message. | PASS for real sidebar surface; pass-1 error-tooltip expectation withdrawn. No separate invented banner. |
| M1 | E/native-help-menu.png shows sole Help item Check for Updates. E native-menu trace enumerates menu, real menu item's click callback invokes updates.check; stdout reason=menu at 00:35:21 and 00:35:44 after recovery. | PASS for native menu contents/callback/service wiring; invocation is programmatic native callback, not a physical menu click. No Install item, dialog or Windows/macOS placement claim. |
| D1 | A four sync calls produce exactly four typed diagnostics and zero global diagnostic duplicates for those emissions. Three globals are later same Error, distinct Error, async failure. E three calls produce three typed diagnostics and zero globals. Fields include cause/channel/isSilent/isForceRunAfter. | PASS. Removed reason/exitStatus/NoNewPrivs parser requirements are N/A to final diff. |
| D2 | E call2 throws; call3 emits First then Second synchronous installer error. Typed logs retain thrown/First cause respectively, baseline listeners=2 and markers=false after each, backend restarts. | PASS. Controlled boundary variants, not real OS failures. |
| P1 | Genuine macOS signed packaged installation/architecture paths. | NOT RUN, outside Linux fixture claims. |
| P2 | Genuine Windows NSIS/elevation/relaunch. | NOT RUN, outside Linux fixture claims. |
| X1 | Real local Electron preload/IPC/service transport is exercised, service internal failed stripped by contract encoding. Final production diff only ElectronUpdater.ts; no transport/client changes. | PASS for local IPC and inspection; remote/relay/tunnel/web/mobile runtime NOT claimed. |
| Recovery | E call1/2/3 each has restart=false/install=false, backend exit/new child and backend-ready; subsequent actions work. No direct desktopState.quitting Ref inspection. | PASS; independent replay also confirms markers, restart and usable window. |
| Provenance | Main bundle SHA256 before dd65c6480abf68a877013609107250e6b27369d3cae2bcb9e61857c8c7ecf19c; after 239972159b5873bc57556ccb866a2f3cae3764510d8748f52a6881df309f64d2. Source maps contain exact git-show adapter contents for B/A; normalized common app sources differ only in that adapter. | PASS. Before is reconstructed adapter at B within shared build, not an independently packaged B application. |

No required fixture rows are missing under the explicitly narrowed brief. Optional/platform/download/full-install/duplicate claims above must stay excluded. This matrix supersedes the stale PASS1 API/state/diagnostic expectations.

VERDICT: SUFFICIENT