# Desktop TLS trust evidence Evidence-only capture for [#17965](https://git.cafe/pingdotgg/t3code/issues/17965), base [6e79211743](https://git.cafe/pingdotgg/t3code/commit/6e79211743) → head [0b3335b0e4](https://git.cafe/pingdotgg/t3code/commit/0b3335b0e41dc727c444aa287936f91869eeaf6d). Real Linux Electron, whole-Xvfb desktop. No source edits or forge writes. Five grouped before/after movies, with source elapsed timestamps and explicit process-restart cuts: - [G1 — Cancel / Trust](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a782497d37bc420/G1-before-after.mp4) - [G2 — Reload / cache retention / restart](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d06be0ce63c1d874/G2-before-after.mp4) - [G3 — Direct Settings cookies revoke / disk removal / restart](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b7e9103fef24f22c/G3-before-after.mp4) - [G4 — Native server-tab relay cache / cookies revoke](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f83d6b6b3a9d1214/G4-before-after.mp4) - [G5 — Incognito independence / actual restart](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/df9e538a3f8258fb/G5-before-after.mp4) [Exact movie chapters](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b78b1cf45502d7a3/chapters.json) · [UTC interaction transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0a1aa04e65fc48d6/timeline.md) · [Full matrix results and limitations](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/891807241aab6364/coverage-result.md) G1–G5 verified on Linux. Settings G3 executes the direct bridge alongside server cleanup; it does not isolate the routes. G4 separately captures actual native server-tab relay commands/replies. 21 focused tests passed. T1 additional guards, T2 malformed/unreadable-load fallback, T3 concurrency and Windows/macOS runtime remain independently UNVERIFIED as detailed in the result matrix. Before — authority-invalid blocked page: ![Before — base blocks self-signed localhost endpoint](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/64085547290d3639/before-matched.png) After — trusted endpoint loaded after actual restart: ![After — head loads README after persistent-profile restart](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/682d40b6af6076ac/persistent-restart.png) Native warning, light OS theme: ![Linux native certificate warning — light, readable buttons and certificate details](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c21f8c24f12e3457/dialog-final-light.png) Native warning, dark OS theme: ![Linux native certificate warning — dark GTK theme](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/997c7f31293f83bc/dialog-dark.png) Native save failure, real app isolated profile: ![Linux native save-error dialog after safely arranged isolated storage fault](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2a6d575a10171367/T2-save-error.png) [T2 — clean save-failure interaction recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e77367f7c1ab7c8a/T2-save-failure-clean.mp4) · [T2 correction, exact files/hashes, drivers, friction and cleanup](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/05ca8de24ac68709/T2-correction.md). These replace the rejected old T2 still/movie in the historical inventory. App moved/resized before capture to avoid native-warning overlap; final whole-desktop pixels are unedited. T2 sample triples have zero changed pixels at two500ms gaps. G1–G5 remain unchanged. Static samples were pixel-identical at two 500ms gaps. All screenshots/diffs and recording contact sheets were inspected. Exact diff:328404 pixels (15.837384%); threshold maxRGB delta>12/255:54304 (2.618827%). Differences: preview error replaced by README; slight preview background shift; scrollbar; annotate/screenshot/float availability. No changed pixels outside preview region. [Zero-threshold diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56a69bf1dc46c3f1/diff-zero.png) · [12/255-threshold diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/093b4285aed3bb9f/diff-threshold-12.png) · [Machine diff metrics](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b72d5f1a1f1def88/diff-metrics.json) Supporting proof and reproducibility: - [21 focused tests](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d0dab0f496b1d601/focused-tests.log) - [Passive real relay command/reply transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/126a54a93c30f581/relay-transcript.txt) - [Native server-tab route/profile identity](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7224edded902be2f/route-state.txt) - [Final fixture HTTP200 request counters](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c567f813f57efe5a/https-requests.log) - [Navigation response observations, including disclosed failed exploratory attempt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b61386526f22dea1/navigation-requests.jsonl) - [Timestamped UI driver transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6cb8aa93d140973c/actions.jsonl) - [Seed/reproduction steps and bundle fingerprints](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/33bae71dfbdf3ddb/seed-recipe.md) - [Environment, runtime changes and cleanup](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4443a6d7d996d948/environment.txt) - [Scoped build log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/629a48fca5c971e0/head-build.log) - [Original required matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0397907cf0bda88c/proof-matrix-pass1.md) The inherited HTTPS fixture disappeared during extra G2 checking; final G2 uses the same certificate/body with a request-counter header. Failed exploratory requests are disclosed. Temporary profile mode500 was restored to700. Generated head bundle restored; only untracked isolated .t3-desktop remains. All capture-owned runtimes stopped; shared lead web/server retained. Public certificate and every seed/driver are in the inventory; private key excluded. [Complete artifact inventory, all seeds/drivers/raw captures](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8732acaa4176b77e/artifact-links.md) · [SHA256/size manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cc3363510a91deb1/artifact-manifest.json)