# Issue 9239 — independent proof audit, pass 2

No new confirmed product defect. The final Linux `basic_text` guard addresses the round-3 plaintext-save regression. The delivered evidence supports the bounded GNOME/libsecret result, including old-ciphertext compatibility, responsive locked startup, explicit unlock/reload, save/restart, qualified cancellation recovery, and legacy bearer migration. It does not establish cross-platform acceptance or normal empty-state add-computer setup.

Audited corrected [fdee11371a](https://git.cafe/pingdotgg/t3code/commit/fdee11371a81e2132cf2a24e7a133e4cade7a8b7) against baseline [044f07257c](https://git.cafe/pingdotgg/t3code/commit/044f07257c9684ae4543bd1e1ebf9c394e9e3830), using the [original matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fbc28b49f8f903d6/issue9239-pass1-proof-matrix.md) and [delivered corrected-head report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/faafded99c4b0d37/corrected-head-evidence-report.md). This was a proof audit and targeted guard check, not a fourth full source review. No implementation edits, push, PR/forge writes, or changes to delivered captures.

## Findings and limits

- No blocking mismatch found in the claimed bounded Linux results. A suspected black-frame restart gap was resolved by inspecting the timeline: connected results appear before the windows close, rather than underneath the final caption. Save/restart is visible at 124–128s; legacy restart at 96–104s.
- N2 is PARTIAL: empty onboarding is recorded on both builds, but normal add-computer setup followed by persistence/restart remains UNVERIFIED. The requester explicitly permits this to remain an unverified row in the PR body. The independent seeded-catalog run below does not fill that wizard gap.
- Native macOS, Windows, KWallet, Niri, and Wayland remain UNVERIFIED. Linux Xvfb/Openbox with a real GNOME keyring is not GNOME Shell/Wayland coverage. Native async-false/sync-true fallback and native both-unavailable branch combinations remain UNVERIFIED. Mocked fallback tests are not native proof.
- Cancellation is qualified, not automatic recovery: the first unlock/reload and restart sample remained Still connecting, with a fresh native prompt. A separate later native unlock, cold restart, and explicit renderer reload connected the original target without bearer credential re-entry. Both outcomes must remain in the PR description.
- SSH and no-token legacy records establish migrated shapes only. Bearer authentication succeeds; the deliberately invalid SSH fixture reconnects and the unauthenticated no-token fixture fails, as disclosed.

## Row audit

Times are recording offsets; captions were cross-checked against sampled decoded frames, retained observations, and capture scripts. See the delivered report for each linked recording and paired artifact.

| Matrix row / affected path | Status | Evidence checked |
|---|---|---|
| N1 locked startup / old catalog | SUPPORTED, bounded GNOME | Baseline locked recording: native prompt and splash at 44.8/67.2s; main query times out after 10.018s. Corrected continuous run: pending prompt at 52–68s; main query console timer 26ms, resize 64ms, native menu 212ms. Separate settled-menu recording begins menu action at 41.5s. Ciphertext retained while pending. |
| N1 unlock, read, save, restart | SUPPORTED | Unlock at 67.8s, explicit reload at 74.4s, authenticated Sync fixture target at 80–84s; bridge save at 87.1s; persisted Corrected async fixture connected at 124–128s. Sanitized bridge observations confirm one credential. Independent reproduction below also passes. Baseline can read corrected ciphertext per retained compatibility transcript; no new baseline re-read was run by this auditor. |
| N2 empty path | PARTIAL / setup UNVERIFIED | Head empty recording: light wide 45.6s, narrow attempt 49.3s, dark wide 52.9s, narrow attempt 57.2s. Fresh settled baseline counterparts begin 39.6/49.2/58.8/68.7s. No normal add-computer wizard save/restart recording. |
| N3 cancellation | SUPPORTED WITH QUALIFICATION | Cancel 42.9s; external unlock/reload 49.5s; first restart 60.3s. Later prompt visible at 106s; no recovery claim from that sample. Separate recovery-confirmation clip visibly connects at 24.9/37.35/46s after native unlock, cold restart and explicit reload. Original ciphertext preservation and recovered credential count support continuity. |
| N4 legacy migration | SUPPORTED for bearer; shapes only otherwise | Baseline migration/restart recordings show the same fixture inventory. Corrected migration visible at 44–48s, reload 52–60s, restart 96–104s. Bearer Connected, no-token Connection failed, SSH Reconnecting. Three target/profile shapes and one credential observed. |
| N6 basic_text existing catalog | SUPPORTED refusal | Native backend basic_text, async=true/sync=false. At 17.14s read is actual null; at 17.27s independent save is actual false, not inspector exception. Before/after catalog hash identical. Earlier unsafe head evidence is not used. |
| N6 basic_text pristine | SUPPORTED refusal | Readiness-checked replacement run, native async=true/sync=false; actual read null, save false, no catalog created, observations around 48.06s. Early no-window exception sample is excluded. |
| N5 other OS / N6 alternatives | UNVERIFIED | Native Mac/Windows/KWallet/Niri/Wayland and actual fallback branch coverage unavailable; no Linux inference. |

## SHA, dimensions, themes, and differences

Both checkout HEADs match the stated full SHAs. Recomputed desktop main-bundle SHA-256 matches the delivered fingerprints: baseline `57a61ad969808a59b16ebcfb86aa565cdf5d97f032092421df90806680897d92` (5,474,884 bytes); corrected head `9838ed54702140be5fb12a482248ed04f1d85c01c0f8c74de315a916343c6a2b` (5,475,491 bytes). The corrected bundle contains the final basic_text guard. Paired stills reuse identical server/web assets; they are not independently rebuilt historical web bundles.

All four final light/dark, wide/narrow pairs were independently recomputed from their retained source images: 0 nonzero RGB pixels, maximum channel difference 0, and 0 pixels above >8/255, out of 1,440,000 pixels each. Delivered Diff0 and threshold/DiffT images are 1440×1000 and entirely black, consistent with that calculation. Gain-8 images do not replace Diff0. All 28 media/report URLs in the delivered report fetched successfully with curl GET; the initial urllib HEAD probe returned 403 and was not treated as missing media.

The entire framebuffer is 1440×1000 at scale 1. Requested wide 1440×1000 produces actual native outer/content 1439×999 under Openbox. Requested narrow 390×780 produces actual 840×780 because of the existing desktop minimum. This is an honestly labeled constrained desktop capture, not 390px or mobile coverage. Light/dark observations and decoded frames agree; no crop or minimum-width override was used.

## Auditor's independent committed-fixture reproduction

After capturer-stop confirmation, used the retained driver in a fresh private D-Bus/Xvfb :102 session, copied only isolated capture config/keyring and disposable target state, and invoked the committed `apps/desktop/scripts/seed-keyring-repro.mjs` against the real baseline main inspector. Seeder exited 0, selected gnome_libsecret, and wrote the synchronous encrypted catalog. No live ~/.t3 state was opened or copied.

Then launched corrected HEAD with the keyring locked: real native unlock prompt found and main process responsive. Native unlock plus explicit renderer reload connected the seeded authenticated target. Actual desktop bridge saved the Corrected async fixture label with one credential. Full cold restart reconnected and retained the label and credential. Captured the same light 1439×999 native window on the 1440×1000 framebuffer at scale 1.

Compared independent-save-restart.png with delivered p2-save-restart.png, without alignment, masking, cropping, or rescaling:

| Metric | Result |
|---|---:|
| Nonzero RGB pixels | 49 / 1,440,000 |
| Pixels with max channel difference >8/255 | 45 / 1,440,000 (0.003125%) |
| Maximum channel difference | 139 / 255 |
| Bounding rectangle of all differences | x=534..540, y=588..596 (7×9px) |

Visual inspection identifies the sole difference as the local backend URL's final port digit: delivered 3775, independent 3774. The layout, theme, saved label, connected target, chrome, and remaining pixels match. This independently rebuilds an affected capture from the committed seeder rather than recomputing only delivered images. Its recording, image, Diff0, DiffT and private measurements remain local; only this sanitized audit report is uploaded.

A final controlled recapture matched the delivered local port. After verifying 3774, 3775, 4788 and 9339 had no listeners, started an owned loopback listener on 3774 so the unchanged desktop port search selected 3775. Reused the independently seeded/saved catalog, same isolated keyring/config, corrected bundle, theme and bounds. The documented driver is `/tmp/issue9239-audit-pass2/recapture-matched-port.py`. The resulting independent-save-restart-matched-port.png is pixel-identical to the delivered p2-save-restart.png: **0 nonzero RGB pixels, 0 pixels above >8/255, maximum channel difference 0**, over the entire 1440×1000 image. Thus the first 49-pixel delta was exactly the port digit, not antialiasing or unexplained layout variation. The owned port reservation, desktop, target, keyring and display were stopped; no capture-port listener remains.

## Final guard and verification

The helper first awaits async availability, then excludes Linux basic_text from the async path. Availability falls back to the original sync check, which refuses that backend; encrypt/decrypt also avoid the async plaintext route. Native existing/pristine refusal observations align with this correction. Secure GNOME async read/save/restart remains functional in both delivered and independent evidence. No new regression was confirmed within this scope; this is not a claim about the unverified platforms or branch combinations.

Auditor reran `vp test run apps/desktop/src/electron/ElectronSafeStorage.test.ts apps/desktop/src/app/DesktopConnectionCatalogStore.test.ts`: 2 files, 9 tests passed. No repo-wide checks. Credential-sensitive acceptance remains Julius's gate; no tokens, catalog contents, or raw measurement/console logs are published here.

## Cleanup and retained scratch

All auditor-spawned native process groups were stopped and waited. Final listener inspection found none on 3774, 3775, 4788, or 9339. The unrelated 3773 listener was left untouched. Worktree remains clean at the audited head.

Own scratch for cleanup: `/tmp/issue9239-audit-pass2/` (audit report, decoded contact sheets/frames, derived differences, safe metrics, private copied config/keyring/target/seeded home, recapture.py, private recapture log/measurements, recording, matched-port driver/capture/differences, and process-exit records); `/tmp/issue9239-original-matrix.md`. Treat the audit directory as private; never upload it wholesale. Original `/tmp/issue9239-evidence/` and `/tmp/issue9239-base/` were retained and not cleaned or modified by the audit.

FRICTION launch-handoff|Waited for capturer completion confirmation before native launch|After confirmation, reproduced independently in private copied state and stopped owned groups.
FRICTION singleton-copy|Initial private config copy encountered stale Electron Singleton socket/links|No native process had started; excluded Singleton artifacts and retried the isolated copy.
FRICTION caption-timing|Final inspection captions overlap window shutdown|Inspected the earlier connected frames; no false missing-result finding retained.
FRICTION public-probe|urllib HEAD returned 403|Verified all 28 URLs with curl GET instead.
FRICTION capture-width|390px request constrained to native 840px minimum|Actual dimensions retained; no mobile or 390px pass claimed.
FRICTION remaining-coverage|Normal empty setup, Mac/Windows/KWallet/Niri/Wayland and native fallback combinations unverified|Keep these explicit in PR body; bounded Linux verdict does not waive cross-platform acceptance.

VERDICT: SUFFICIENT for the requested bounded Linux proof audit and final basic_text correction; the explicitly permitted unverified rows above remain unverified.