# Proof audit pass 1 — issue 24278

PR: [#24356](https://git.cafe/pingdotgg/t3code/pulls/24356)
Issue: [#24278](https://git.cafe/pingdotgg/t3code/issues/24278)
Audited complete local diff: `27e0c684c585f955252d65f06206dd11a143bff5..ebc9dbbd003f0c0bc2f4b09f506512b31d9dc95d`.
Four files; 58 insertions, 5 deletions. Read-only source/proof audit; no tests rerun, captures, browsers, servers, edits to repository, comments, pushes, or monitoring.

## Evidence matrix

```json
[]
```

The server-only/no-visible-surface rule applies. This is an MCP timeout diagnostic correction. No web, desktop renderer, mobile, CSS, visual component, or render path changes. Existing navigation waits and timeout budgets stay unchanged. The tool caller receives a corrected structured timeout and message; that diagnostic is not a changed visual surface requiring a capture. No render-path capture machinery is needed.

## Affected paths derived from the diff

| Changed file | Changed behavior / affected execution path |
| --- | --- |
| `apps/server/src/mcp/PreviewAutomationBroker.ts` | Remote `PreviewAutomationTimeoutError` classification reads positive integer `detail.timeoutMs`, caps it at the broker request budget, and otherwise retains the previous budget fallback. Shared remote error classification can also receive errors from other preview hosts; their behavior changes only when they supply valid timeout detail. |
| `apps/server/src/preview/ServerBrowserPage.ts` | `toOperationError` optionally attaches the actual operation timeout to Playwright TimeoutError; existing typed operation errors and interruption classification remain preserved. |
| `apps/server/src/preview/ServerBrowser.ts` | Initial server-tab navigation (`goto`, and conditional reload for adopted/desktop PDF navigation) wraps failure with the fixed 15000ms navigation limit. Existing-tab `preview_open` navigation and explicit awaited `preview_navigate` use the supplied navigation timeout. `readiness:none` returns before the changed catch and is not newly awaited. Error detail travels through `handleRequest` response to broker classification. |
| `apps/server/src/preview/ServerBrowser.test.ts` | Adds broker-to-server-browser regression for fresh `preview_open`, mocked initial Playwright TimeoutError, asserting timeoutMs 15000 and exact caller message. |

Surface scope: callers using the server-browser host share this diagnostic regardless of web/desktop/mobile connection origin or provider. No provider adapters, contracts, client entry points, settings, reverse-state flows, or local/relay/tunnel routing changed. This does not prove separate desktop-host navigation implementation changes; none are present.

## Minimum proof and status

1. Focused regression must fail before the fix for the actual reason: expected timeoutMs 15000, actual 660000; then pass after the fix with message `Preview automation open timed out after 15000ms.` Existing evidence supplied by the lead/PR reports that red failure and green 52/52 across ServerBrowser and PreviewAutomationBroker tests. These runs were not independently rerun in this read-only audit. Keep their command, revision, and output attached to the final proof.
2. Short before/after runtime transcript through the real MCP tool -> broker -> real server-browser Chromium path, using an isolated T3 home and a deterministic navigation that exceeds the existing 15s commit timeout. Record revision, environment, call arguments, caller diagnostic, raw Playwright cause and structured timeoutMs when exposed. Use fresh-tab preview_open with reuseExistingTab:false, matching the reported bug. The after result must report 15000ms rather than 660000ms while retaining the original cause and unchanged navigation limit. Total call duration includes setup and is not required to equal exactly 15s.
3. Before transcript inspected: [before-runtime.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/83a60b29a25b0c6f/before-runtime.txt). It identifies base 27e0c684c585f955252d65f06206dd11a143bff5, real Linux Chromium, isolated worktree state, a localhost response delayed 20s, preview_open reuseExistingTab:false, caller error 660000ms and cause `page.goto: Timeout 15000ms exceeded.` This proves the mismatch; it is a deterministic equivalent, not a cold-Vite-specific capture.
4. After transcript: PENDING, being collected by lead. Proof is not complete until attached and tied to the audited revision (or a confirmed equivalent diff).

Additional changed-branch verification to retain in focused test evidence: reopened/existing-tab open timeout; explicit awaited navigate timeout; broker valid-detail clamp and invalid/missing-detail fallback. These do not create capture rows. They need not each require a separate runtime environment; the minimum runtime reproduction is the fresh-tab bug path above.

## Revision limit

Local HEAD equals the requested ebc9dbbd003f0c0bc2f4b09f506512b31d9dc95d. One GitCafe PR metadata read reports current PR source/head f722b703439e002d251cbc831c772a34eebf66fb. This audit intentionally covers the requested complete local diff, not an assertion that the current PR head is identical. Reconcile revisions before treating this as current-head proof or merge readiness.

## FRICTION

| category | happened | avoidance |
| --- | --- | --- |
| revision identity | PR metadata head differs from requested local audit head | Pin proof artifacts to their exact SHA and compare the final PR diff before acceptance. |
| proof pending | After runtime transcript is still being collected | Attach the real-tool after transcript before calling the proof complete. |
| capture scope | No render path changed; capture matrix has zero rows | Apply server-only rule and use red/green test plus runtime transcript; do not create capture fixtures. |

No code defect finding from this limited proof-scope pass. This is not a full merge-readiness or CI audit.