# Read-only proof audit, pass 1

PR [#24440](https://github.com/pingdotgg/t3code/pull/24440), issue [#7212](https://git.cafe/pingdotgg/t3code/issues/7212), pinned head [69c6d53c30](https://github.com/pingdotgg/t3code/commit/69c6d53c30d974da83f21ed5d9142dc7afd5f224). 2026-10-25 UTC. No capture reconstruction, browser, server, test run, repository edit, push, comment, watch, or merge performed. Forge state read only through cafe. Harness-required T3 PR registration performed; it is not a public forge write.

## Scope and provenance

Read worktree AGENTS.md, issue, PR description/comments, and the eight-file implementation delta against the PR's observed main base [d53873b6a4](https://github.com/pingdotgg/t3code/commit/d53873b6a4799e87afd63c8d288ef0089f5a3748). Local `main` is stale and yields an unrelated repository-wide delta; it is not this review's base. Pinned HEAD is correct and tracked checkout clean. The affected implementation files are unchanged from [b06c58abb6](https://github.com/pingdotgg/t3code/commit/b06c58abb634eaab1be2c30eb4bd84bf7dea5115), so prior proof of those files transfers across the main merge. This does not independently certify earlier build provenance.

Sources read: [supplied connected attempt report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/785ad78854b5677a/REPORT.md), PR [evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4d072b1338b055ef/INDEX.md), [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4f6fbbda269eb4c6/MATRIX.md), [capture report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6fc015f3a1956b86/REPORT.md), and [independent prior audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c5e49517dfa6123d/REPORT.md). This is a source/report audit, not a new decoding/hash audit of all media. Established media findings below are explicitly inherited from that independent audit. Issue text was treated as reproduction data, not instructions.

The supplied report says native prior proof is retained, but links no newer native completion report. The PR-linked matrix still has older native gaps. Those are provenance gaps in the supplied corpus; they are not grounds to rebuild already-established native proof. The parent should supply the newer native report if it clears the conditional rows below. Likewise no result from the independently running evidence agent is assumed here.

## Smallest affected fixture model

N = native Electron BrowserSurfaceSlot composition; S = connected server-stream canvas. They share the failure message and shell, but N hides native contents and calls bridge refresh, whereas S puts the alert inside the stream surface, leaves its control bar uncovered, and sends reload only while controller is `you`.

Use wide/light (1440×900) and narrow/dark (390×844) for new connected coverage; native static evidence already covers both sizes in both themes. These two new endpoints cover size and theme risks without multiplying every action by four. At S, agent-owned and viewer-owned endpoints are distinct required states; an unclaimed endpoint after Release is a useful inverse in the same recording, not a new fixture family. Ownership need not multiply drag into both agent and viewer variants: the shell drag path has no ownership branch.

A failed browser supplies a square 320×320 source, then saved width and available-area fitting apply. It is not an unconditional 320px rendered box. Ordinary minimum width yields 240×240; successful recovery restores the actual page aspect. A wide-source failure is covered by this square path, not by demanding the obsolete thin failed frame. A long failed address should wrap/scroll without losing the controls. One long-URL case can also serve as the normal case; both need not multiply every workflow.

## Required matrix

`RECORDING` means motion/time/interaction must be visible in a clip; a screenshot or successful automation return alone cannot clear it. Static appearance rows may use stills. More than one row can be proved by the same continuous clip.

| ID | Actual required behavior / minimum fixture | Proof type | Established proof | Remaining gate and route for capture agent |
|---|---|---|---|---|
| P1 | Selected-tab status retains refused requested URL, LoadFailed reason, loading false; new navigation clears stale failure; healthy completion omits it | Protocol transcript + focused regression | Established representative by prior independent audit T1/T2; added server regression covers refusal and reset. Tests not rerun here. | No new capture gate. Preserve explicit tab IDs and status records; nested tabs[].url normalization is outside this fix. |
| N1 | Native failed overlay is readable without hover, includes URL/reason and Close/Retry, covers failed native contents, and uses readable square sizing for long/wide source at wide/narrow and light/dark | Static before/after | Established N Q by prior independent audit, including exact independent failed-frame reconstruction; surrounding scene differences were disclosed | No recapture needed. No blanket whole-scene zero-diff claim. |
| N2 | Native Retry while still down settles back to failure; same-URL recovery removes alert, restores page/aspect and usable page content | RECORDING | Same-URL healthy title/aspect and alert removal established. Older three still-down marks race; healthy page input/click was not recorded | Conditional blocker only if retained newer native proof does not clear it. Use existing native fixture, hold listener down through a distinct post-Retry refusal/status and settled alert, then start same URL, Retry, interact with one page control. One representative native clip suffices; no full Q repetition. |
| N3 | Close removes float without destroying tab; chat usable; retained panel can recover and Float again | RECORDING | Native Q Close, retained tab, panel recovery and re-float established; older audit did not establish chat hit testing | Conditional small gap if newer native proof lacks it: after Close type/select in chat, reopen retained Browser tab, recover/re-float. Do not repeat already-proven native reverse path solely for theme coverage. |
| N4 | Failed native overlay persists during continued thread use and shell movement remains usable | RECORDING | Representative native continuation established; supplied latest report explicitly retains native prior proof, but does not link its newer drag record | Carry native proof forward per task brief; attach retained native gesture report for reviewability. Do not rebuild native captures in this pass. No full provider turn/Q persistence matrix required. |
| S1 | Connected agent-owned failure: readable reason/address, Close and hint; Take control visible and reachable; Retry absent until ownership changes | RECORDING | Older final S Q was Connecting only. Latest supplied attempt proves a connected viewer-owned alert/Close/Retry in wide/light, not this agent endpoint | Blocks unless independent agent provides it. Open healthy real stream, float, navigate via actual agent/provider to refused target; wait for connected agent control status. Capture failure and Take control in same clip as S2. A Connecting bar cannot clear this row. |
| S2 | Take control → viewer Retry down → settled failure → same-URL healthy recovery and usable page → Release control | RECORDING | Stream-client test covers command gating, not visible integrated flow; no complete connected flow in linked corpus | Blocks unless new evidence clears it. From S1 click Take control, observe `you` and Retry; await new refusal after Retry while listener stays down, then restore listener, Retry and click/type on healthy page. Release; show non-you endpoint. One wide/light flow suffices for ownership logic. |
| S3 | Connected Close removes overlay, leaves tab available, chat accepts input, panel/re-float inverse works | RECORDING | Not established in linked final connected corpus | Blocks unless new evidence clears it. Fail again from S2, Close, use chat, open retained Browser tab through right-panel chooser, recover and Float. Can share S2 recording. |
| S4 | Connected wide/light failed float actually changes x/y under positional drag, retains readable alert/controls, and leaves uncovered chat usable | RECORDING | Explicitly NOT established: supplied attempt x1108/y568/w320/h320 before and after; delta (0,0) | Definite blocker. Start healthy stream59998, float, use actual Fail target59999 link. Drag exposed shell grip from an uncovered point beyond tap slop to a free target. Record bounds before/after: nonzero positional delta, same size; then interact with uncovered chat. Successful tool result is insufficient. |
| S5 | Connected narrow/dark failed frame remains readable with connected control bar; positional movement and representative size reduction preserve reachable controls | RECORDING (includes layout endpoint) | Not established; theme/resize setup alone and float lost on reload do not prove it | Definite blocker. Set390×844 and dark before establishing healthy→float→Fail target; avoid reloading after float. Use real grip drag with available travel, measure nonzero x/y. Use one real resize to attainable minimum width/available-area fit, show long message and Close/Take control or Retry accessible. No need for every resize direction or ownership×gesture product. |

The minimum new S work is two clips: wide/light can combine S1–S4; narrow/dark can clear S5 and show both connected ownership layouts by a brief Take/Release if the bar crowds controls. Other two size/theme cross-pairs do not add distinct code branches and need no repeated full workflow.

## What does not block completion

- No exhaustive mouse/keyboard/touch × theme × viewport × ownership × resize-direction matrix. One genuine keyboard activation is useful in an existing flow, but the unchanged gesture engine does not justify every direction or input family as a new gate.
- No 18-minute wait or new agent implementation turn: representative continuation already establishes failure persistence, and this change adds no timer or turn-dependent dismissal.
- No compulsory ≤7rem container-query capture at standard fixture sizes. The default/minimum failed square plus stream bar does not reach it. If an actual constrained available area reaches it, record readable/reachable controls there; do not inject styles/state to force it or demand the old44px failed layout.
- No forced native WebContents crash/detach, second viewer, read-only grant, download/PDF/PiP, recording dot, device startup, native mobile, macOS, provider or network-transport Cartesian product. Download failure is explicitly excluded; device shell caller has no failure prop; React Native is separate and unchanged. Record those as source-accounted/conditional, never runtime passes.
- No settings, command-palette, keybinding, RPC or MCP mutation expansion. Only selected browser status gains optional failure metadata; no new user capability/service entry point is introduced.
- No matched baseline recordings for every recovery action or whole-app pixel identity requirement. Existing before/after proves the visual defect and changed frame; clocks/transcript/ownership drift prevents a global pixel-only assertion, not acceptance of the narrowly demonstrated fix.

## FRICTION

- Local `main` was stale: direct main...HEAD was noisy. Corrected to forge-observed base; no unrelated changes were audited as part of this fix.
- Python urllib artifact fetch returned `HTTP Error 403: Forbidden`; curl read the same public reports successfully. No credential changes.
- Prior drag source hover reveals shell buttons; their pointerdown stops propagation. Center-based dragTo can hit a button rather than initiate shell movement. Supplied report records one nominal tool success with zero movement and another timeout. An offset-capable approved capture workflow or an actually exposed grip point is needed. No state setter, DOM mutation or synthetic event should substitute for real positional proof. This is an evidence-tool limitation, not a newly diagnosed product defect.
- Report lineage is incomplete: latest supplied report retains native proof but links no newer native completion artifact. Conditional N2/N3 gaps must be resolved by pointing to that proof or a minimal supplemental clip, not by assuming older PARTIAL rows passed.
- No new capture or independent media decoding was performed in this read-only pass. Findings inherit the prior auditor's established media observations; new evidence from the concurrent capture agent remains pending.

VERDICT: INSUFFICIENT — definite outstanding S4 and S5; S1–S3 remain unproved in the supplied linked corpus and must be cleared by the concurrent evidence agent. N2/N3 are conditional lineage gaps, not instructions to redo retained native proof. P1/N1 and representative native persistence are established. No unrelated fixture gates added.