# Evidence index — issue 25639

Scope: [#25639](https://git.cafe/pingdotgg/t3code/issues/25639), no PR yet. Supplied base 977a18823c; final head d00eeb840a7487dd6bce437f330adac5d33b1995. Read-only capture in /home/ubuntu/wt/issue-25639. No worktree edits, commits, pushes, tests added, server launches, browser launches, or subagents.

## Visual evidence

Captured 0/0 visual rows. The [audited matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/282279e02e674b3e/issue-25639-proof-audit-pass1.md) is empty: no rendering changes; screenshots are not needed.

## Primary proof, preserved

- [Red regression test](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1dab09808399ae27/red-test.txt): 1 failed / 23 passed on original baseline; about:blank wrongly classified parse/https:.
- [Green focused test output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/75e213edbeafb7a4/green-tests.txt): 24 passed. This log does not independently identify its tested head.
- [Primary before/after runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5aa0d5fc3e378650/runtime-transcript.md), unchanged: real isolated dev-server preview.open RPC on fs-24/Linux, chrome-headless-shell 156.0.8078.70. about:blank changes from parse/https: to unsupported-protocol/about:. Omitted URL returns a successful Idle blank tab before and after.
- [Primary RPC reproduction driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fd3adb8f1673ca8c/rpc-repro.js), unchanged and credential-free.

The runtime comparison originally used base 4034b5f6b5 and head 49ad3bf500de6ffaf32b96f74b12da7af06ffe57. `git diff --exit-code` confirms BOTH changed files (preview.ts and preview.test.ts) are identical between original base and supplied base, and between original head and final head. Commands and outcomes are recorded in the supplemental transcript.

## Supplemental breadth evidence

[Actual function-probe outputs and equivalence checks](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0bde0fb98ec9a0ec/supplemental-transcript.md) and [probe driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/758dcf2078e0d569/normalize-probe.mjs).

Executed directly from owning packages/shared on fs-24, Linux x86_64, Node v26.12.1, final head. These are supplemental function probes, NOT real-app runtime proof or added automated tests.

| Input | Actual result |
|---|---|
| `about:blank` | unsupported-protocol, about:, inputLength 11 |
| `ABOUT:blank` | unsupported-protocol, about:, inputLength 11 |
| `  about:blank  ` | unsupported-protocol, about:, inputLength 15 |
| `mailto:a@b.c` | unsupported-protocol, mailto:, inputLength 12 |
| `ftp:21` | unsupported-protocol, ftp:, inputLength 6 |
| `https://example.com/path?q=1` | `https://example.com/path?q=1` |
| `localhost:3000` | `http://localhost:3000/` |
| `devbox:8080` | `https://devbox:8080/` |
| `example.com:8080` | `https://example.com:8080/` |

What else changed: the guard consistently rejects known non-web schemes before default HTTPS prefixing, including mailto/ftp inputs previously susceptible to web host/credentials interpretation. Samples cover case, surrounding whitespace, additional known schemes, and preserved web/host-port normalization; they do not enumerate every scheme.

## Unverified and limits

Native desktop and mobile clients were not launched. No new real-app runtime was collected during this capture. The primary transcript summarizes observations rather than supplying raw RPC frames, and its driver resolves the first socket message rather than explicitly filtering request id/type. Existing primary proof remains the red regression plus before/after runtime transcript; supplemental function probes do not replace it. Broader check claims in the primary PR draft were not rerun here.

## FRICTION

- Matrix fetched successfully using a Mozilla User-Agent (prior audit reported default-agent 403).
- No blockers or prohibited actions needed. No credentials uploaded.
- Capture artifacts created outside the worktree; only this capture's temporary files are cleaned after upload. Primary artifacts remain untouched.