# Issue 17392 — PASS1 final proof matrix

Read-only source audit. Final [c43ee8d22a](https://git.cafe/pingdotgg/t3code/commit/c43ee8d22a3b07fb4267e83b0ecfb36c99039da1), base [d53873b6a4](https://git.cafe/pingdotgg/t3code/commit/d53873b6a4799e87afd63c8d288ef0089f5a3748). Worktree `/home/ubuntu/wt/issue-17392`. PR not open. Before bundle reported as [a46f80ee28](https://git.cafe/pingdotgg/t3code/commit/a46f80ee28); do not label that bundle d53873b6a4. Relevant media-path files have no patch changes in mobile or web actions relative to origin/main. No repository edits, tests, browser/server/capture, push, forge writes, or merge performed. Existing untracked `.t3-desktop/` left alone. Only this synthetic planning artifact was written outside the worktree and uploaded.

## Finding and scope

No confirmed defect found in the final eight-file diff (five production files, three test files). This is source proof, not runtime or visual proof. Prior matrix's relative-path workaround and broad changed-render-path claims are obsolete.

The classifier keeps the exact existing joined path and adds `relative:true` only on the authored-relative branch. ChatMarkdown and shared resolveMediaSource copy that provenance to optional `media-file.hostOnly:true`. Asset fallback stops on this flag after the owning environment's request fails. Servers ignore the flag. No path rewriting was added: nested-document bases, outside-workspace paths, Windows/cross-drive paths, decoding, references, MIME detection and fragments retain existing behavior.

Visible delta requires all of: Electron local fallback environment exists; thread belongs to another environment; authored-relative media reaches flagged resource; remote authorization fails with AssetWorkspaceAssetNotFoundError, AssetWorkspaceAssetInspectionError or AssetWorkspaceContextNotFoundError; an eligible absolute media path could otherwise succeed locally. Base may show the local sentinel; final must retain remote failure. Remote success returns before the new guard. Other errors never qualified for fallback. Missing file on both hosts has no necessary visual delta.

Absolute paths and file URLs are unflagged controls and retain fallback. An explicit `resolvedFilePath` overrides classification without provenance, preserving existing behavior even if the original source string was relative. Do not claim every relative hyperlink becomes host-only.

## Caller and branch inventory

- Web ChatMarkdown image/video embed WorkspaceFile branch: affected flag propagation; classify against `imageBaseDir ?? cwd`. User and assistant use this common branch. File Markdown and other wrappers share it; no independent rendering rewrite.
- Web ChatMarkdown Direct and source-control-media branches: unchanged resources/rendering. Blocked/no-thread paths: unchanged fallback UI. Attachments and direct ChatMarkdownAssetImage tool resources do not acquire a flag automatically.
- Shared resolveMediaSource: authored-relative + thread => flagged media-file; no thread => existing unavailable; direct => existing URI; blocked/unsupported MIME => null; explicit resolvedFilePath => unflagged media-file. ExpandedImagePreview consumes this helper; ChatMarkdown action calls that supply a resolved target retain the override branch.
- Work-log resolveViewedImageAsset classifies then supplies resolvedFilePath: unchanged resource, including tool-output consumers in TimelineWorkEntryRow/V2ItemInspector and mobile viewed images.
- Mobile resolveMobileMarkdownMediaSource consumes the shared helper: relative thread image/video resources can gain metadata, but paths stay absolute and identical to base. Its no-thread draft-workspace-file conversion is unchanged. Consumers: native/useMarkdownImageSource; features/files/FileMarkdownPreview; lib/markdownMedia image/video preview/actions. ThreadFeed's manually constructed image resource does not add the flag. PDF resource construction in markdownMedia is unchanged. Captured/direct policies are unchanged.
- Shared asset atoms: web supplies localMediaEnvironment only in Electron; plain web resolves it to null; mobile supplies none. Therefore native/mobile and plain web have no changed fallback appearance. Electron same-environment requests also never qualified for local retry.

## Small fixture matrix (10 rows)

Use synthetic sentinels: local RED, owning remote GREEN, workspace-root BLUE for document-base distinction. Separate missing/present filenames. Do not expose real user content or pairing credentials. Runtime setup from earlier audit is supplied context, not re-observed here. Q = widths 1440 and 390, light and dark; record actual height/scale. 390 Electron/web is not native proof. A = changed behavior; M = metadata-only unless the fallback preconditions hold; C = unchanged control.

| ID | Fixture / equivalence class | Scope | Expected base → final | Minimum evidence |
|---|---|---|---|---|
| 1 | Remote thread; relative image missing remotely, matching eligible absolute path RED locally; user + assistant | A | Local RED → existing unavailable/alt UI; final only remote authorization | Q before/after: 8 stills total, both roles legible in each. Record endpoint/resource trace separately; a still alone cannot prove no retry. |
| 2 | Relative image present remotely GREEN; standalone/inline/authored sizing | M | GREEN → GREEN, same destination, dimensions and flow | Co-frame control sheet at 1440 light + 390 dark, before/after. No separate Q product. |
| 3 | Explicit absolute POSIX path and file URL; remote absent, local RED | C | RED → RED with existing local fallback | Same control sheet as 2/4. Test both spellings; no claimed new path behavior. |
| 4 | Direct synthetic data/HTTP image; blocked unsupported/tilde source; unresolved root/no thread | C | Direct stays direct; blocked/unavailable stays so | Direct + blocked on same control sheet; source/harness suffices for remaining grammar. Rows 2–4 together: 4 stills total. |
| 5 | Nested docs/readme.md embeds report.png and ../report.png; include outside-workspace document base if already seeded | M / A only under row 1 conditions | Same joined/resolved destinations: nested GREEN and root BLUE remain so. Relative outside-root is still flagged; it does not become a new resolution algorithm | One 390 dark before/after pair (2 stills); co-frame nested/outside when legible. Use contract trace for additional bases. |
| 6 | Plain web remote thread: missing + present relative media; Electron local-primary thread | M / C | Web unavailable/GREEN unchanged; local-primary unchanged | Plain-web 390 dark before/after pair (2 stills), both states co-framed. Local-primary source-only or include existing sheet, no mandatory extra capture. |
| 7 | Image open/close/gallery, copy path/authored Markdown, Open File; compare present/missing embed and media hyperlink with resolved target | A/M/C by route | Flagged embed cannot produce local RED after remote failure. Resolved-target hyperlink/actions preserve base path/reference/fallback; present image opens and closes normally | Before/after recording required for any interaction claim. Show observable action result or label unverified; unchanged source code is not interaction proof. Combine with 8/9. |
| 8 | Relative embedded video missing/present remotely; video/image hyperlink with explicit resolvedFilePath; absolute/file URL video control | A embed; C override | Missing relative embed loses desktop fallback; remote-present playback and explicit override fallback unchanged | Recording: load/play/pause/open/close as applicable. Contrast embedded versus resolved hyperlink. No extra width/theme unless narrow controls materially differ. |
| 9 | Fresh authorization missing → present → missing; close/reopen or reload; reconnect only if actually exercised | A lifecycle | Final missing stays unavailable, present GREEN, refreshed missing unavailable again; no stale local RED accepted as proof | Combined before/after recording. Show real refresh/authorization milestone, not just elapsed waiting. Do not claim automatic mutation refresh or reconnect from a still. |
| 10 | Contract-only/platform/error/cache classes: POSIX/Windows roots, dot/parent/backslash/encoded punctuation/fragment, outside-root/cross-drive; eligible failure tags vs access error; same-host/no-local; mobile draft/captured/PDF; tool/attachment/source-control | M or C as inventory above | Paths/reference semantics unchanged; relative flag isolates fallback and query identity; absolute/fileURL/override remain unflagged. Access failure stays failure. Mobile appearance unchanged | Source/test inspection or labelled resolver/asset trace; no required screenshots, native build, Windows runtime or transport Cartesian product. Existing test checks remote-only relative failures after priming equivalent absolute local successes, including outside-root and another drive. |

## Capture minimum and claims

Baseline: **10 fixture rows; 16 stills + 2 recordings**. Eight core stills, four combined control stills, two nested/outside-document stills, two plain-web stills. One before and one final recording can combine rows 7–9 if legible. Split recordings only for clarity or a materially different narrow action interface. This matches the capture agent's stated core/control/nested/web/lifecycle work; no duplicate capture assignment is implied.

Do not multiply unchanged path spellings, providers, themes or native platforms into additional visual requirements. A present nested document's flag is a contract change with no appearance change. Native mobile may receive hostOnly through shared resolution, but has no desktop retry and no mandatory changed-appearance capture. A hyperlink's authored-relative spelling is insufficient to predict its behavior: record whether resolvedFilePath was supplied. Missing embeds and unavailable controls may have identical after pictures for different reasons.

The before bundle is a46f80ee28, whereas code review base is d53873b6a4. Label captures with actual revision and disclose intervening unrelated main changes; do not attribute those changes to this patch. Verify the final executable/bundle is c43ee8d22a before claiming final evidence. Fixture drivers/reproduction recipes are upload-only, never committed (explicit user override).

## FRICTION

- No final-head capture evidence was inspected or produced here; capture completion remains with the separate capture agent.
- No tests were executed. Tests were inspected; the new focused asset test covers not-found, absolute local fallback and remote-only relative failure/cache separation, not every error tag or native runtime.
- Prior matrix's statement that relative resources stay relative is false for this final diff: resources retain existing joined paths and carry provenance metadata. Its mobile absolute-override workaround account is also obsolete; current mobile helper simply delegates to shared resolution before its draft conversion.
- Existing before bundle differs from the source-audit base; capture labels must make that explicit.
- No confirmed code defect; no merge readiness or visual pass claimed. PR not open; no forge state was read or written.