# Tooltip proof audit — pass 3

Read-only supplemental audit of [#11558](https://git.cafe/pingdotgg/t3code/pulls/11558) ([mirror #11558](https://github.com/pingdotgg/t3code/pull/11558)). Findings concern the proof contract; a missing pass is not automatically a production regression.

1. **P1 error-entry retention is not demonstrated.** Both source variants open the correct URL tooltip then lose it on crossing; no competing PreviewCard is present. Success renders the real PreviewCard with no tooltip. The controlled PreviewCard root owns `open`; `showUrlTooltip` depends on it, so its trigger-leave close can defeat the nested Tooltip's hover retention. This is baseline behavior, not a confirmed new regression. The maintainer clarified that the spec is file-path retention, not universal tooltip retention: this is an accepted unchanged exception, disclosed rather than counted as a retention PASS. The supplied evaluation honestly marks `errorEntry=false`.
2. **M1 cancellation is overclaimed by the automatic assertion.** `afterCancel=null` only checks the tooltip. Both leave stills show a Save image / Copy image menu on the chat background after Escape also closed the surrounding media dialog. Menu suppression/right-click/Shift+F10/reopen are shown, but the stills do not prove the menu was canceled. This is on both sides; no new regression is established. A scoped claim of tooltip suppression is supported; clean menu cancellation is not.
3. **Pixel comparisons retain unrelated changes.** G1H1 desktop and M1 differ in timeline scroll/media placement and the synthetic stopped-thread banner. F3 entry differs in timestamp footer. Even the separate same-trigger F3 comparison has branch-banner/Scroll-to-end/footer changes, despite identical popup geometry. These are not effects of the two production hunks. No accepted still is an empty ghost/loading fixture; narrow drawer overlays and synthetic banners are identifiable app state. Do not claim only tooltip pixels changed.
4. **Harness provenance limits real-route claims.** F2/C1/E1/G1Footer use an explicitly labeled production-component mount; P1 additionally replaces `useEnvironmentQuery` with controlled error/success values. No mock is credited as a real app route. The glass footer activation callback is absent in the actual sidebar caller, which renders `<ThreadPullRequestsMiniList pullRequests={...}/>` without `onOpenPullRequest`; items therefore render divs, not anchors. Its harness adds a supported callback combination that no actual newly changed sidebar route currently supplies. That combination is legitimately unseedable as a real-sidebar link, but is supplemental component evidence, not a real-sidebar activation pass.

Reviewed replacement [3490923](https://github.com/pingdotgg/t3code/commit/3490923fb6c723fb50139d7184173ba18f4ee444), base [eea9895](https://github.com/pingdotgg/t3code/commit/eea989536849e5b5049987ee24318b5a77326542), original [170a9cc](https://github.com/soupslurpr/t3code/commit/170a9cc4a6d4786d780123489a4ff1bd7bbaa604). Production scope is exactly shared popup `pointer-events-auto` plus the DOM-containment guard excluding React-bubbled portaled scrolls. The only other change is 52 lines of focused Markdown browser tests. No other production behavior/source changed.

Both tooltip snapshots independently byte-match `git show` at their pins: before SHA-256 `21a0bb262e60917f81372d6ea7aab3d8889a7517837a04af833e4c877d3319fc`, after `80c5237b1cb9a74933f0684748cb75953501d326df4362a2ba43900ea19ab4b3`. Baseline is CDP response interception reversing exactly the guard and class in Vite's transformed final module; it is component A/B on final surrounding app, not a whole-checkout baseline. `intercept.py` asserts both replacement strings exist and otherwise continues the request on failure, so hit logs plus measured `pe=none` are relevant provenance. `before-transformed.js` is a stale Vite 403 Restricted HTML probe, not the executed baseline module; exclude it from source proof. No source file checkout is needed or performed by this audit.

The capture driver uses native XTest mouse selection and actual Ctrl+C/Ctrl+V; DOM ranges locate glyph bounds rather than install a selection. F2's selection and paste exactly match `/tmp/t3-tooltip-fixture/src/fallback.ts` in both widths; trigger tag is BUTTON and both full/relative copy items are present. C1 copies the complete long branch value via its real production handler in both widths. N2 uses a real unsent attachment preview outside the timeline, shows Copied, pastes fixture contents, transfers to word-wrap and dismisses via Escape. Its paste contains attachment-chip text as well as file contents; this is not an exact plain-text clipboard equality proof. M1 uses the real expanded image MediaActions, not a Markdown image chip.

F2's unavailable-capability button branch is genuinely distinct; `hasPrimaryAction` depends on editor/browser/media callbacks and `threadRef && panelPath`. Its harness removes all primary actions without replacing component handlers. Main chat generally has panel capability; a read-only PR Markdown surface could reach this branch when shell/browser grants are absent, so this is component-branch proof, not proof the combination is globally impossible to seed. C1/E1 are real production PR controls with synthetic props because the isolated fixture has no retrievable PR detail metadata; this is a practical fixture limitation, not proof those real routes are impossible. The supplied C1 provider reproduces production delay=150/closeDelay=150/timeout=400. P1's query mock isolates overlay coupling and cannot certify query or network integration.

| Row | Pass-3 assessment / equivalence |
|---|---|
| F1 | Prior pass-2 four-mode native path selection/copy/leave PASS retained; prior independent 0-pixel repeat retained. No new all-mode claim. |
| F2 | Component harness PASS at 1440×900 and 390×844 light: genuine fallback button, entry, exact native selection/copy/paste, leave, click/context menus and cancel; zero unintended callback count. Real fallback route not exercised. |
| F3 | Real timeline desktop/narrow: correct long identity initially on both sides, baseline loses on entry; after horizontal scrollLeft 0→240 retains. Unfocused timeline scroll with popup :hover true immediately before closes after actual 80px movement. Final retake establishes activeElement and visible correct popup before and after actual 55px focused scroll on both widths and both pins, followed by blur/dismissal. An earlier desktop take closed and is superseded; keyboard modality/focus targeting was corrected before final capture. 480px popup at x=5 exceeds 390px viewport on both sides. |
| F4 | Source-equivalent unchanged action selection and sibling trigger/popup separation; F2 supplies actual menu smoke. Editor/media/browser/directory destinations not individually run. |
| N1 | Prior four-mode hover/focus/Escape/leave PASS retained; destination unchanged in source, navigation not claimed. |
| N2 | Real outside-timeline dynamic button PASS for entry, actual action, Copied label, native paste containing contents, adjacent transfer, leave/Escape. No exact plain-text clipboard equality claim. |
| G1 | Real sidebar hover and correct sibling transfer at both widths after retake; prior dark/light hover evidence retained. Genuine footer anchor activation PASS only in separately labeled callback-combination harness. Actual sidebar footer has no link. Glass selection remains unverified, never counted as PASS. |
| G2 | Existing PR badge explicitly already pointer-events-auto; effective popup hit testing unchanged and outside timeline guard. No new runtime list/scroll claim. |
| G3 | Same default/glass primitives; content-state transition represented by N2, competing overlay by M1/E1/P1. No updater/release installation pass. |
| C1 | Production-component harness PASS desktop/narrow wrapping, full trigger copy/native paste, Copied and leave under 150ms provider. Configured delay confirmed by code; recordings do not measure an exact 150ms close latency. |
| C2 | Same wrapping code shell as C1, no new event model; no direct diagnostics/changed-file test. |
| M1 | Real MediaActions entry, right-click/Shift+F10 suppression and reopen PASS. Clean cancel remains unverified: menu persists in leave still on both sides. |
| P1 | Labeled production component + query stub: correct error tooltip opens but entry fails on both pins; leave/Escape close, success PreviewCard/exclusion PASS. Accepted unchanged exception under the clarified file-path scope; not a new regression or retention pass. |
| H1 | Real snooze menu suppresses popup, cancel/reopen works; native sortable drag translates row with data-trigger-disabled and no popup. Neighbor control works desktop/narrow. Disabled/hidden roots/stale-review labels source-equivalent, not directly run. |
| E1 | Component harness PASS actual disabled span wrapper (callback 0), nested production Tooltip/Menu trigger, menu dismiss/reopen, no stray tooltip. Real PR route not exercised. |
| L1 | Same collision/positioner code; narrow C1 wrapping + H1 cleanup representative. Pre-existing F3 clipping disclosed. Electron native-titlebar placement not run. |
| A1 | Plain default path labels share N2 primitive, C1 wrapping and F2 trigger/menu separation; composer/tree/breadcrumb contexts not independently tested. |
| Z1 | Label-only usage/settings/welcome/provider/task variants collapse by N2/C1/E1 event shape; no blanket runtime pass. |

Web and Electron share this implementation. Native mobile has no import. Provider adapters, wire contracts, RPC, agent MCP, scheduler and connection-mode transport are unchanged; no cross-provider/transport test is warranted by these two DOM changes.


The finalized [capture index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ce407a750ecd0788/index.md) and [capture report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6da265cf8ab31b17/report.md) were downloaded with curl and byte-compared against local files. The [public archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8ad5a05f5bf40467/ev11558-supplement-public.tar.gz) matches all 468 corresponding local files byte-for-byte. Twelve directly linked F3 desktop/narrow-G1H1 JSON/recordings also match. No stale public artifact was found among those checks. The uploader excludes the stale 403 HTML probes from publication.

Every finalized top-level supplemental PNG (captures and diffs), all 28 raw recordings and all 28 captioned recordings were visually inspected through temporary galleries. Each video was independently decoded with ffmpeg into eight timestamped samples spanning its duration; this is state-sampled inspection, not continuous playback. Final replacement F3 and narrow G1H1 takes were re-inspected after concurrent capture ended. Captions match the recorded attempted actions/times, but do not make unsuccessful P1 entry or M1 cancellation passing results. Final narrow captions are compact and legible; `caption-check.png` is an excluded superseded oversized-caption probe. Raw files remain authoritative where text/status overlays overlap content.

All 14 entry-pair differences were recomputed independently. All 28 delivered threshold-0 RGB×4 and >16 mask PNGs match exactly. Both extra F3 same-trigger pairs were also recomputed: all four diff images match (desktop 27,360 / 3,095; narrow 26,914 / 3,335 pixels). Counts below are changed pixels, not bug counts. All supplemental pairs are light, DPR1, 1440×900 or 390×844; prior F1/N1/G1 evidence supplies the dark/light four-mode coverage. Narrow is fine-pointer responsive web, not touch/native mobile. Per-still stable assertions use two screenshots 500ms apart; source implements exact RGB equality. Original second screenshots are overwritten, so those assertions are source/log evidence, not independently re-compared historical frame pairs. P1 calls the stability helper but discards its return: P1 has no per-still stability result. Missing/false network-idle assertions are not promoted to passes.

| Pair | Before step times (s) | After step times (s) | Pixels >0 / >16 |
|---|---|---|---|
| C1-1440x900-light | 0.0, 3.249, 5.956 | 0.0, 3.742, 6.708 | 52,436 / 7,348 |
| C1-390x844-light | 0.0, 3.162, 5.549 | 0.0, 3.358, 5.707 | 48,231 / 7,161 |
| E1-1440x900-light | 0.0, 3.234, 4.061 | 0.0, 3.256, 4.093 | 4,215 / 684 |
| F2-1440x900-light | 0.0, 3.278, 6.22, 8.199 | 0.0, 3.706, 8.932, 10.352 | 9,985 / 1,343 |
| F2-390x844-light | 0.0, 3.416, 6.413, 7.738 | 0.0, 3.137, 8.165, 9.477 | 9,985 / 1,343 |
| F3-1440x900-light | 0.0, 3.693, 9.13, 14.257 | 0.0, 3.712, 5.896, 12.002, 17.137 | 22,293 / 6,808 |
| F3-390x844-light | 0.0, 4.619, 11.515, 18.428 | 0.0, 4.631, 7.478, 14.981, 21.893 | 18,289 / 3,307 |
| G1Footer-1440x900-light | 0.001, 2.758, 3.55 | 0.002, 2.793, 3.956 | 53,084 / 11,077 |
| G1Footer-390x844-light | 0.001, 2.692, 3.403 | 0.001, 2.656, 4.164 | 53,084 / 11,077 |
| G1H1-1440x900-light | 0.0, 3.858, 7.558, 12.821, 15.882 | 0.0, 3.726, 5.854, 10.817, 13.561 | 263,457 / 58,694 |
| G1H1-390x844-light | 0.0, 3.442, 5.707, 10.23, 12.854 | 0.0, 3.499, 5.905, 10.386, 12.987 | 63,408 / 18,219 |
| M1-1440x900-light | 0.0, 3.647, 6.131 | 0.0, 3.671, 6.169 | 73,431 / 20,314 |
| N2-1440x900-light | 0.0, 4.309, 9.407 | 0.0, 4.208, 7.942 | 13,847 / 645 |
| P1-1440x900-light | 0.002, 2.838, 5.736 | 0.002, 2.722, 5.632 | 0 / 0 |

Independent reproduction after explicit CDP release used the supplied `capture.record('F3','repro',390,844)` against the retained real route, browser/Xvfb and isolated server. Only outputs were redirected to this audit's temporary directory. The correct long popup retained on entry and horizontal scrollLeft 0→240. Before timeline scroll it was visible and :hover=true; actual scrollTop 1289→1209 closed it. The same mixed hover/focus sequence then had active trigger + visible popup before 1250→1195 scrolling, but lost the popup. This is an honest failure of that repeated sequence, not a claimed full reproduction pass.

A focused diagnostic independently ran both source variants via the same response-interception driver, both widths, pointer parked away before establishing keyboard modality/focus. All four cases had active=true and :focus-visible=true, correct visible popup before and after actual 55px movement (desktop 1149→1094; narrow 1250→1195). Thus keyboard-focused scrolling retains on baseline and final; the mixed hover/focus sequence is sensitive to hover-close state and cannot substantiate a regression or blanket focus promise. The application tracker exemption prevents its own close, not Base UI hover events. Final browser was returned to production after source, narrow/light; no source edits were made.

**Independent entry-frame delta versus delivered F3 narrow/light after: 136,274 / 329,160 pixels at threshold 0; 49,508 at >16; mean absolute RGB 11.7091.** Repro popup y=358.703 vs delivered y=291.703, with changed timeline scroll and missing draft image/banner. This is reproducible affected behavior with non-equivalent full-viewport state, not a pixel-identical repeat. Every repro still independently passed the helper's two screenshots 500ms apart, first attempt. Network idle is false because this repeat had no Override network observer; it is unverified, not a detected network load. The pass-2 F1 zero-pixel reproduction remains valid separately.

Minimal remaining proof work:

- **P1:** accepted unchanged controlled-preview error exception under the maintainer's clarified file-path scope. No fix or further capture is required. Parent PreviewCard ownership of open explains the closure; do not claim universal tooltip retention.
- **M1:** one desktop pair only, right-click then Shift+F10, explicitly assert BOTH tooltip absent while menu open and menu absent after cancel, then reopen the actual media trigger. Escape currently closes the image dialog while the captured menu remains. No need for another media-format/provider matrix.
- **Visual normalization:** retake settled entry pairs only for F3 desktop/narrow, G1H1 desktop/narrow, M1 and N2, preserving timeline scroll, sidebar/draft attachment, branch-banner and footer-hover state. Keep current interaction clips unless the state change affects a specific assertion. For F3 use the same trigger before crossing; for sidebar narrow use the exposed-space sibling path. This is six pairs of stills, not another all-app recording suite. Harness pairs C1/F2/E1/G1Footer already isolate their tooltip state; P1's zero delta is empty-popup parity, not retention.
- No further F1/N1 four-mode captures, updater fixtures, diagnostics, native-mobile, Electron-titlebar or provider/transport expansion is needed. Glass text selection remains unverified; the real footer is informational and has no activation to test. Do not force DOM selection or add a callback to production to satisfy the earlier mistaken real-footer requirement.

No confirmed new production blocker is established. The narrow sizing issue, P1 closure and observed M1 cancellation state are baseline behavior. Under the clarified file-path scope, P1 does not block. The remaining proof is insufficient because M1 clean cancel is unverified and six normalized visual comparisons remain contaminated.

FRICTION category | what | prevention
---|---|---
Concurrent evidence | recordings and JSON changed during early inspection | wait capture release; re-read final pins/index, re-decode replacement takes, verify archive hashes
Focus | hover-open + programmatic focus sometimes closes on scroll despite activeElement | establish keyboard-only focus with pointer parked away; log :focus-visible and non-null popup
Assertion scope | M1 checks only tooltip null and calls it cancel | assert menu count/visibility separately from tooltip suppression
Visual state | banner/draft/media/timeline/footer state differs between pins and repeat | snapshot explicit UI state before each still; compare stable identical states
Harness scope | unsupported caller combinations can look like real app evidence | visible harness labels, inspect actual imports/props/query stub, state which production route cannot supply the combination
Artifact provenance | stale Vite-403 and oversized-caption probes remained locally | exclude probes; hash archive/direct links against finalized local files
Audit tooling | a temporary script named inspect.py shadowed Python inspect during numpy import | use descriptive script names; renamed before successful independent diff recomputation
Transport | urllib downloads returned 403 while curl succeeded | use curl to verify final public bytes; do not infer artifact absence from the first client

CDP 9158 released to evidence-capture-r3 after audit completion; no audit driver remains running. Retained server 2063373, Vite 2063360, headed Chromium 2014664, Xvfb 2014410, fresh Chromium 2024755 remain available. No process teardown, code/data edits, commits, pushes, forge comments/reviews, watch or live T3 userdata access. Only synthetic browser UI interaction and temporary audit files. Source worktree clean at exact pinned final; PR linked, watching=false. No repo-wide checks or test reruns. Model/harness: GPT-6.1-Sol, Codex through T3 Code.

Supplemental evidence links:

![F3-390x844-light-repro-entry.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ac844b5637a9a4b8/F3-390x844-light-repro-entry.png)
[F3-390x844-light-repro.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9e6aa5c6f3e10712/F3-390x844-light-repro.mp4)
[F3-390x844-light-repro-raw.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/33fc5b8e7f18c627/F3-390x844-light-repro-raw.mp4)
[F3-390x844-light-repro.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d0984c153421e01/F3-390x844-light-repro.json)
[pixel-delta.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9dd1adfc60130f76/pixel-delta.json)
![repro-diff-zero4.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/26c8617e2ae35f1c/repro-diff-zero4.png)
![repro-diff16.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a03c595b82d75d84/repro-diff16.png)
[focus-diagnosis.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/64198d41879b2d6d/focus-diagnosis.json)
[diff-verification.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cea06a2802f92f32/diff-verification.json)
[archive-verification.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dfa6cc9e9d25fa7a/archive-verification.json)
[reproduce.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e102885d09b35b6d/reproduce.py)
[focus_diagnosis.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/631d147b81b0572d/focus_diagnosis.py)

VERDICT: INSUFFICIENT M1,visual-normalization(F3,G1,H1,N2,M1)