AI-assisted; verified with the tests and tools listed above.

No tests were used as evidence. The videos capture the real application and real file delivery.

Revisions: base 9cd7a04797184c92a8f636ae1e918f42c139d850; head 7ad3421fc419469857a905d1901a0c0481a2f54a.
Each revision ran from its own worktree and created its own database with T3CODE_DEV_SEED=0.
Both use the synthetic Secret whitespace proof project and the same scripted ACP agent.
The fixture agent calls the server's real request_secret tool with delivery=file, stats the returned file, and reports only its byte count. No paid model is involved.

Web: vp run dev; Google Chrome 151, Linux, 1280x800, dark theme.
Desktop: separately packed server and Electron application, each launched under headless-desktop with --no-sandbox --disable-gpu --password-store=basic. Electron 44.10.1, Linux, 1280x800, dark theme. Each desktop app has its own backend and isolated state. The development URL targets the worktree's IPv6 loopback Vite listener. Basic password storage was needed because libsecret startup stalled in this environment.
Published videos show the conversation area cropped identically, with environment and revision captions. Browser recordings exclude pairing, navigation and initialization. Desktop recordings capture the rendered Electron page throughout each interaction. No application pixels were edited.

Export WORKTREE, EVIDENCE_DIR and PROJECT_DIR before using the scripts. PROJECT_DIR is a disposable fixture workspace. Run seed-fixture.mjs once per initialized server; set STATE_DIR=.t3/desktop-basic for desktop. The server watches provider settings changes. Complete desktop onboarding with history import deselected.
For browser-driver.mjs also set APP_ORIGIN to the web dev origin. It imports the checkout's playwright-core and uses the installed Google Chrome. Install Playwright's ffmpeg into a scratch PLAYWRIGHT_BROWSERS_PATH for video recording.
For desktop-driver.mjs set CDP_PORT to that Electron app's --remote-debugging-port. It captures the existing Electron page, not a browser imitation.

Each driver repeats these steps:
1. Start a new synthetic thread requesting a single-space secret as a private file.
2. Leave the input empty, press Enter, and verify Save securely remains disabled.
3. Type exactly one ASCII space, wait, and press Enter again. Observe the disabled card on base or the delivered file's 1-byte count on head.
4. Start another synthetic thread requesting the surrounding-space sample.
5. Check the empty field again, then type exactly two spaces, pw, two spaces, and press Enter. Observe 2 bytes on base and 6 on head.
The only conditional branch is waiting for the file count when Save securely is enabled. The typing and Enter actions are identical on both revisions.

Android: the cached native client was prepared successfully and a Pixel 9 was leased. Installation failed with an invalid upload response. The required later retry failed with WORKER_UNREACHABLE because the worker holding the leased device was disconnected from the gateway. The lease was closed. No mobile result is claimed; iOS was not exercised.