# Supplemental recovery evidence for PR #23396

PR [#23396](https://git.cafe/pingdotgg/t3code/pulls/23396), branch `fix/issue-22402`, exact head [f6e8762257](https://git.cafe/pingdotgg/t3code/commit/f6e8762257a73c882f405c0067de17b8bbca5c1e). Evidence captured 2026-10-22 10:19–10:21 UTC in `/home/ubuntu/wt/pr-23396` on Linux x64. Budget used approximately eight minutes.

Read the [independent matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4cd31a7b35b7f03a/matrix.md) and existing final transcript/report before setup. This supplement covers only missing M1–M6; no changed rejection diagnostic was recaptured. It does not replace the [existing final-head transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/35f48f8f70e30fd8/issue-22402-final-runtime.json).

## Results

- M1 PASS: explicit `http://127.0.0.1:44391/fixture.html` opened an agent-owned tab. A real page read returned the expected title and all four counters at zero.
- M2 PASS: navigating that tab to schemeless `127.0.0.1:44391/fixture.html` yielded the HTTP URL and expected loaded title.
- M3 PASS: `preview_open {tabId,open:false}` without URL preserved the same tab ID, nonblank URL and title. Additional `preview_open {open:false}` preserved that tab as well.
- M4 PASS: `selector:'#css-target'` click incremented only cssTarget to `"1"`.
- M5 PASS: `preview_snapshot {tabId,includeImage:false}` returned the Ref target ref `t3-b641ec84-2-e3`; the immediately following call used `locator:'aria-ref=t3-b641ec84-2-e3'`. No intervening snapshot. refTarget became `"1"`.
- M6 PASS: `locator:'internal:role=button[name="Role target"i]'` and `locator:'text="Text target"'` succeeded. The final page read returned cssTarget/refTarget/roleTarget/textTarget all `"1"`, the expected title, and the same HTTP fixture URL.

All 17 recovery/setup MCP calls (initialize, preview_status, and M1–M6 operations/readbacks) returned HTTP 200 with successful envelopes. An eighteenth, cleanup-only `preview_close` request returned JSON-RPC error -32602 because that MCP tool is absent. Cleanup then succeeded through authenticated app RPC `preview.close` and `run.interrupt`; complete frames are in cleanup-rpc-transcript.json.

## Runtime and provenance

Normal `node_modules/.bin/vp run dev --no-seed` selected backend 16732/web 8692 and worktree-local `.t3`. The fixture was served by an owned loopback Python HTTP server on dynamically allocated port 44391. The actual app server downloaded/used its own server-browser runtime under the isolated worktree. No direct Playwright harness, direct broker/class construction, auth override, caller-guard bypass, live-state writes, or forged MCP capability was used.

The supported pairing credential exchange issued an access token; authenticated app WebSocket RPC created a disposable provider instance/project/thread. An external wrapper forwarded the actual Codex protocol and captured the injected server-issued MCP configuration, holding `turn/start` before model work. The active-run guards remained enabled. All browser proof used actual HTTP JSON-RPC tools/call against this app server's /mcp with that issued authorization. No delegated task was spawned.

The setup transcript retains public requests/responses and RPC wire frames with secret-bearing values redacted. The recovery transcript contains complete MCP request/response envelopes. Raw logs, tokens, injected provider configuration and held turn payload remain private and excluded. A known-secret scan passed for the uploaded files.

Fixture deviation: dataset setters with the literal hyphenated button IDs are invalid DOMStringMap keys. The requested IDs and labels remain unchanged; counters use the equivalent camelCase dataset keys. This fixes the fixture, not product source. Inline click handlers perform the numeric increments; preview_evaluate only observes state.

## Teardown, scope and pending checks

The app tab was closed and disposable run interrupted through app RPC. The runner, fixture server, Codex wrapper/binary and browser descendants were stopped using recorded owned PIDs. Final verification found no live owned process and no listener on 16732, 8692 or 44391. Git status remained clean and HEAD unchanged. verification.json records the process IDs, signals, final SHA and port/status checks.

Only external fixture/scripts/evidence and ignored isolated `.t3` runtime state were created. No source changes, commits, pushes, PR comments/edits/merges, tests, PR watches or check polling occurred. The PR was registered with the current T3 thread; its linked state reports watching:false. No other PR write occurred.

Pending checks: UNKNOWN. Existing supplied snapshots contain no pending-check inventory, and this evidence-only run did not query checks. No current CI-green claim. Desktop original-issue reproduction remains explicitly unverified/nonblocking. Visual matrix: 0 rows; no arbitrary screenshots.

FRICTION: prior external capture scripts were unavailable; reconstructed the documented wrapper/authenticated RPC transport.
FRICTION: ws is installed transitively, not directly resolvable from apps/server; script locates the existing ws@8 package in node_modules/.pnpm.
FRICTION: startup pairing token is in the URL fragment; corrected extraction before exchange.
FRICTION: initial WebSocket setup returned HTTP 426 until using the required `orchestrationProtocol=2` query parameter. The successful pairing access token was reused; no bypass.
FRICTION: matrix's literal hyphenated dataset setter is invalid; equivalent camelCase keys used as described.
FRICTION: preview_close is not an MCP tool at this head; authenticated preview.close RPC completed cleanup.
FRICTION: stopping the dev runner did not stop every descendant; recorded child PIDs were identity-checked and terminated, then independently verified absent/live-free.
FRICTION: a bounded initial temp-file search encountered protected system temp directories; no data there was read or changed.