# Proof audit, pass 1

Findings first:

1. **The existing 11 requested after cases are supported, but they are not the full code-derived matrix.** Keep R1/R2/R3/R6/R7/R10/R12/R14/C1/C4/A1 and the recording-continuation evidence. Missing minimum rows are **R4, R8, R9, Z1, C2, C5, C6, A2, P1**; P1 has partial unit/setup evidence only. These are proof gaps, not findings that those behaviors fail.
2. **The visible known limit needs its own row.** The PR discloses a wrongly positioned recording marker when a stationary pointer sits over a newly loaded cross-site iframe before hover is established. C4 establishes hover before input, so it does not prove this limit or support an unconditional “no misplaced marker” claim. C5 should show the actual limit and navigation outcome; a before comparison is needed if calling it unchanged.
3. **The current recordings do not demonstrate a recording freeze.** C1 and its repeat save p1 and the blue ripple. The saved late-change probe includes the injected text at PTS 7.476 s. Native static-page output is sparse; duration alone is not proof of freezing.
4. **Scope remains Linux X11.** Wayland, macOS, Windows, extra guest-focus/lifecycle combinations, malformed IPC, and non-mouse pointer variants remain unverified as listed below. Do not silently convert acknowledged platform limits into tested claims. These supplemental rows do not add to the minimum X11 capture set.

Audited [#33276](https://git.cafe/pingdotgg/t3code/pull/33276) at [a543452f18](https://git.cafe/pingdotgg/t3code/commit/a543452f18c1650f99476e17704cb3e5db3d1300). Read-only source/evidence audit in `/home/user/wt/pr-33276`; no app run, code edits, tests, pushes, or PR comments. Captures are at [385579457a](https://git.cafe/pingdotgg/t3code/commit/385579457add6399b53fc79cfc2f01309346250d), before at [934c7f8d8e](https://git.cafe/pingdotgg/t3code/commit/934c7f8d8e7a012aa55be9c0b17498979040fe02). `git diff 385579457a HEAD -- apps/desktop/src/preview` is empty, so those captures apply to the current implementation. The source worktree remained clean.

## Code-derived behavior boundary and callers

- **Manager:** [`Manager.ts:1432`](https://git.cafe/pingdotgg/t3code/blob/a543452f18c1650f99476e17704cb3e5db3d1300/apps/desktop/src/preview/Manager.ts#L1432) binds `before-mouse-event` to each registered webview. `registerWebviewUnlocked → attachListeners → install` installs it; the scope finalizer removes it. The handler returns for non-thumb buttons or non-down/up phases; otherwise it prevents the native event, divides DIP x/y by guest zoom, sends down/up plus numeric button 3/4, and navigates only on up and only if that direction has history. No platform, focus, picker, or recording predicate changes navigation. Old `preview:mouse-navigate` producer/consumer are removed. New payload tests are at [`Manager.test.ts:745`](https://git.cafe/pingdotgg/t3code/blob/a543452f18c1650f99476e17704cb3e5db3d1300/apps/desktop/src/preview/Manager.test.ts#L745).
- **Preload:** [`PickPreload.ts:206`](https://git.cafe/pingdotgg/t3code/blob/a543452f18c1650f99476e17704cb3e5db3d1300/apps/desktop/src/preview/PickPreload.ts#L206) is the sole replay consumer. A hovered `iframe`, `frame`, `object`, or `embed` takes the same early-return branch; iframe is the minimum representative. Otherwise only down/up and numeric coordinates/button pass validation. Down emits human pointer input; both phases call the optional recording cursor. `RECORDING_CURSOR_CHANNEL` installs the cursor only while recording and disposes it on stop; option false/default versus true changes decoration output. Frame-hover true and false must both be represented. Parent preload is main-frame only because [`DesktopWindow.ts:555`](https://git.cafe/pingdotgg/t3code/blob/a543452f18c1650f99476e17704cb3e5db3d1300/apps/desktop/src/window/DesktopWindow.ts#L555) disables subframe Node integration. Same-origin/cross-site are both represented in the baseline because their Electron widget/process paths differ.
- **RecordingCursor:** [`RecordingCursor.ts:159`](https://git.cafe/pingdotgg/t3code/blob/a543452f18c1650f99476e17704cb3e5db3d1300/apps/desktop/src/preview/RecordingCursor.ts#L159) exposes `press`, called by that IPC receiver and by native `pointerDown` and `pointerUp`; `pointercancel` shares `pointerUp`. Native touch returns without calling it; mouse and pen share the non-touch path. Down moves the human cursor unless controller is agent; up does not reposition it. Pointer decoration is gated by `showMousePresses`, sets/clears held state, and affects move and clear behavior. Human and none have the same press drawing behavior; agent is a distinct harness-only seed in this source. Key-label branches, voice, annotation tool internals, theme, popover layering and agent-move animation are not altered by this diff and do not multiply this fixture set.
- **Host callers/surfaces:** [`ElectronBrowserHost.tsx:132`](https://git.cafe/pingdotgg/t3code/blob/a543452f18c1650f99476e17704cb3e5db3d1300/apps/web/src/browser/ElectronBrowserHost.tsx#L132) renders desktop and natively rendered local-server sessions through `HostedBrowserWebview`; its did-attach/dom-ready effect calls the desktop preload bridge, IPC method, then Manager registration. The same guest code serves these native sessions. Standalone web/mobile/server-rendered remote browser surfaces do not load this Electron preload or listener. Browser toolbar/menu/keybinding Back/Forward calls the unchanged service operations; the native mouse path is the changed entry point. No provider adapter, wire schema, or agent-facing tool text changes. Popups are separate WebContents and not registered Browser-tab guests.

## Fixture matrix

All rows depend on interaction or time and are **recording**; stills only corroborate them. “Minimum = Yes” means a capture is part of the focused X11 proof set, not that it needs its own file. “Minimum = No” records supplemental/nonvisual/platform coverage without requesting a new screenshot for internal guard logic. Status refers to actual linked evidence, not inferred runtime success.

| Row | Named fixture / data and behavior | Diff affected path | Minimum capture | Medium | Real-app seed or labelled harness | Status |
|---|---|---|---|---|---|---|
| R1 | Plain main-frame Back; history available; recording off | Manager + preload | Yes | recording | Real app: host A → B; guest p1 → p2; click/hover plain p2; native button 8 down/up. | covered [after-R1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ab6a78d4a992cd27/after-R1.mp4) — B remains; p2 → p1 at ~1.9 s. [Before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2e5550cb09d93f1e/before-R1.mp4) also stays B and reaches p1; this is a regression control, not the X11 repro. |
| R2 | Same-origin iframe Back; iframe focused; recording off | Manager iframe interception | Yes | recording | Real app: same history; click iframe #same at p2, then button 8. | covered [after-R2.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9e2035e8f4ef08a7/after-R2.mp4) — B/p2 → B/p1. [Before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f96186d57d285388/before-R2.mp4) switches to A and hides the Browser panel; retained guest remains p2. |
| R3 | Cross-site iframe Back; iframe focused; recording off | Manager cross-process iframe interception | Yes | recording | Real app: p2 iframe #cross uses localhost while parent uses 127.0.0.1; click iframe, button 8. | covered [after-R3.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/29356488d8383d1b/after-R3.mp4) — B/p2 → B/p1. [Before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cb3b032eec7f70ab/before-R3.mp4) switches to A; settled stills agree. |
| R6 | Hovered child-frame Forward; forward history available | Manager Forward branch; preload frame guard | Yes | recording | Real app: p1f → p2 → Back to p1f; click cross-site iframe on p1f; button 9. | covered [after-R6.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/929ee1d92c37aebf/after-R6.mp4) — B/p1f → B/p2; forward flag true → false. This represents the hovered-frame Forward path, not main-frame replay. |
| R7 | Back at start of guest history, hovered iframe | Manager canGoBack=false; preload frame guard | Yes | recording | Real app: fresh guest loaded directly at p2, no previous entry; host can go Back; click #same; button 8. | covered [after-R7.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/17bf51d7dbf86bb1/after-R7.mp4) — B/p2 stays fixed with back=false. [Before](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dc3fcd4609acb51a/before-R7.mp4) switches host to A. |
| R10 | Composer focused; pointer over plain guest; Back | Manager chooses event guest independently of keyboard focus | Yes | recording | Real app: A → B; guest p1 → p2; focus composer, move to plain guest without clicking, button 8. | covered [after-R10.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6e9fa7c628387e81/after-R10.mp4) — B remains and guest reaches p1; composer caret is visible after navigation. [Transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bbe3ed2b1d274da8/after-transcript.txt) additionally confirms composer=true before/after. |
| R12 | Back over host chat, outside guest | Unaffected boundary control | Yes | recording | Real app: same histories; click host chat, press button 8 over chat. | covered [after-R12.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/efcf1372df7d99cf/after-R12.mp4) — host B → A; retained guest remains p2. Do not interpret the intended hidden Browser panel as a blank rendering defect. |
| R14 | Back held, then released, recording off | Manager phase=down versus up | Yes | recording | Real app: p1 → p2; button 8 down for ~1 s; up inside guest. | covered [after-R14.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a902d686210c4469/after-R14.mp4) — p2 persists through hold (~1.80–2.82 s), then p1 appears once after release. Only one earlier guest entry exists; this is not a duplicate-listener stress test. |
| C1 | Recording on, Show mouse presses on, plain Back | Preload replay + RecordingCursor.press down/up | Yes | recording | Real app: start Browser recording with showMousePresses=true; p2 plain point (150,140); button 8; stop/save. | covered [after-C1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/08c02de3c2fb9be1/after-C1.mp4) — host stays B and live guest reaches p1. [Saved recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e8bfd91a2e3051cc/after-C1-guest.mp4) visibly contains correctly placed blue ripple and p1; [before saved recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5852fcb29701aed0/before-C1-guest.mp4) preserves that behavior. C1 manifest logs down/up at (150,140); not proof of human-controller state. |
| C4 | Recording on, presses on, iframe actually :hover | Preload frame-guard early return | Yes | recording | Real app: click/move into #cross before button 8; record/save. | covered [after-C4.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/104de8fc623ef07a/after-C4.mp4) — B/p2 → B/p1. Every frame of [saved recording](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/791b3d2e5484969a/after-C4-guest.mp4) has no misplaced marker; saved p1 exists. Applies after pointer movement establishes hover. |
| A1 | Picker active; navigable Back over iframe | Interception in presence of picker overlay | Yes | recording | Real app: p1 → p2; activate Annotate preview; hover #cross; button 8. | covered [after-A1.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/11b65950cd32b772/after-A1.mp4) — picker toolbar and outline precede input, B stays and p1 replaces p2, toolbar/outline disappear; no visible error. Does not prove picker survival when navigation is impossible. |
| C1L | Recording survives navigation and later content change | Replay/navigation integration; time-dependent output | Yes | recording | Real app plus labelled probe: record plain Back, then inject synthetic text into p1 five seconds after navigation. | covered [after-C1-continuation.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0e04acb2ce090083/after-C1-continuation.mp4) — late text appears live; [saved probe](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7aed68a2f9ebc338/after-C1-continuation-guest.mp4) includes it in its final frame (PTS 7.476 s). [C1 repeat](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/97db26e3e002eabf/after-C1-repeat-guest.mp4) and [left-click Browser Back control](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2df51533a39f3afb/after-C1Chrome-guest.mp4) also save p1. No current-head freeze is demonstrated. |
| R4 | Plain main-frame Forward, recording/presses on | Manager button=forward; preload numeric button=4 replay | Yes | recording | Real app: p1 → p2 → p1, pointer over plain content; record native button 9. Can combine with Z1. | missing — R6 skips replay because its iframe is hovered; no existing clip shows a main-frame Forward press marker or human replay. |
| R8 | Forward at end of guest history; plain and hovered-frame representatives | Manager canGoForward=false | Yes | recording | Real app: give host a forward entry (e.g. A → B → A, visible owner A); guest directly at p2 with no forward history; button 9 over plain content and iframe. Show both histories/readout. | missing — all published Forward input is R6 with canGoForward=true; unit test also hard-codes true. Host needs a forward entry so fallback would be observable. |
| R9 | Plain Back at history start; human replay and controller lifetime | Manager canGoBack=false + preload HUMAN_INPUT on down only | Yes | recording | Real app: fresh p2/no Back; recording+presses on; subscribe desktopBridge.preview.onStateChange and display controller timeline with point; down/hold/up at plain point, then wait for normal human → none state. Can combine with C6/P1. | missing — R7 skips replay in iframe. C1 proves decoration events but does not observe HUMAN_INPUT delivery, down-only ownership, or human → none. No navigation should conceal the observation. |
| Z1 | Non-unit guest zoom, correctly positioned replay | Manager DIP-to-CSS division + visible recording position | Yes | recording | Real app: set guest zoom via Browser zoom controls or desktop bridge to 1.5 or 2; record native plain Forward/Back at a known marked CSS target. Read out getZoomFactor and target coordinates; compare saved marker position. Can share R4 clip. | missing — all media uses default zoom. Manager test asserts 10/2=5 on a mock; it cannot prove the units Electron delivers or saved-marker placement. |
| C2 | Recording active, Show mouse presses off; then recording stopped | RecordingCursor present with option=false; then preload optional cursor=null | Yes | recording | Real app: explicitly disable Show mouse presses, start recording; plain thumb press at known point; save and verify cursor/no ripple; stop recording, press again and confirm no recording cursor/decoration remains. | missing — C1/C4 explicitly enable presses. Recording-off R1 cannot exercise an installed cursor with showMousePresses=false or post-stop disposal. |
| C5 | Pointer stationary over cross-site iframe across load; :hover absent | Preload guard false although input is frame-local; declared limitation | Yes | recording | Real app: record at p2 with cross-site iframe beneath resting pointer; reload/navigate without any mousemove; externally observe iframe:hover=false, then native thumb Back. Capture saved output and navigation. Pair before/after if calling this an unchanged limit. | missing — every published C4 run moves/clicks inside the frame first. PR text acknowledges a wrong-position marker in this state, but no linked capture demonstrates the limit, its extent, or unaffected navigation. |
| C6 | Replayed thumb hold with movement and leave/blur; presses on | RecordingCursor pointerHeld, move coalescing, up/clear after replay | Yes | recording | Real app: no-history plain p2 avoids navigation; record down → move → up, then another down → leave/blur → release; show events and saved output through marker clear. Can share R9. | missing — R14 has recording off; C1 is a stationary ~100 ms press. No clip drives held movement or clear after a replayed press. |
| A2 | Picker active at history end; thumb press does not dismiss/select | Interception with picker but no navigation teardown | Yes | recording | Real app: fresh p2/no Back; activate picker, thumb Back over plain content then iframe; verify toolbar remains usable and a subsequent ordinary select/cancel works. Can append to R8 clip. | missing — A1 only proves teardown caused by successful document navigation. |
| P1 | Ordinary native mouse down/up, primary/secondary/middle; recording presses on | Manager non-thumb return + refactored native RecordingCursor callers | Yes | recording | Real app: synthetic page with visible click counter and link/context target; record ordinary left/right/middle interactions without unintended history navigation; show saved ordinary press decoration. Can share R9/C6 no-history clip. | insufficient — driver setup uses left clicks while recording is off; C1Chrome is a left click on host Browser chrome, outside the changed guest cursor. Manager test covers only callback pass-through for left/right, not ordinary guest recording output. |
| F2 | Another guest owns focus while pointer is over this guest | Per-WebContents routing; multiple guest instances | No | recording | Real app only if layout presents two native guests concurrently; focus one, hover the other and thumb-navigate. Otherwise labelled two-webview Electron harness; do not pretend two hidden tabs are two visible guests. | missing — R10 covers host composer focus; no capture has another guest focused. Supplemental to minimum because the changed handler has no focus predicate and R10 covers focus independence. |
| L1 | Repeated register/dom-ready; replace/close guest; single release with 3-entry history | Manager install/off and removed legacy IPC registration | No | recording | Real app: p0 → p1 → p2; reload/register, Back once to p1; close/recreate and repeat. Listener attach/off counts require labelled Electron harness. | insufficient — existing driver closes/recreates guests and dom-ready registration runs on navigation, but one-step histories cannot expose double navigation; no capture/log counts listener detachment. Supplemental lifecycle proof. |
| H1 | Non-press mouse event for thumb button; other/absent button | New beforeMouse type/button guard returns | No | recording | Cannot create every malformed Electron callback through app UI. Labelled callback harness: mouseMove/mouseWheel/other phases and left/right/middle/undefined button; assert not prevented, no replay/navigation. | insufficient — changed Manager test exercises left/right down/up only. This is a nonvisual callback contract; no screenshot requested, and no new visual capture is needed for the minimum set. |
| H2 | Malformed replay phase or nonnumeric x/y/button | New preload IPC validation returns | No | recording | No normal UI seed: Manager is the sole producer and sends valid fields. Labelled preload/IPC harness, not a native-input proof. | missing — no linked harness transcript. Nonvisual internal-input rejection is outside the minimum capture set. |
| H3 | RecordingCursor.press with controller=agent versus human/none | press → moveHuman agent early return; marker emission independent | No | recording | Human/none occur in real app; agent branch needs labelled cursor/IPC harness. In this source Manager initializes none and only writes human/none; no production path setting this field to agent was found. | missing — existing media does not label controller state. Agent case must not be advertised as real-app seeded. Supplemental branch, not an instruction to start a paid agent turn. |
| P2 | Touch ignored; pen/non-touch uses helper; pointercancel uses up | Native RecordingCursor caller variants | No | recording | Real app touch/pen hardware or trusted CDP input if available; otherwise explicitly labelled DOM/cursor harness. Exercise down/up/cancel with recording+presses on. | missing — no touch, pen, or cancel capture. Their conditions are preserved verbatim by the refactor; supplemental to the ordinary mouse P1 capture. |
| W1 | GNOME Wayland, plain-content native thumb press | Same changed listener, different native input backend; reporter path | No | recording | Requires actual GNOME Wayland desktop and native thumb input; seed R1/R4/R8 there. Xvfb is not a substitute. | missing — PR explicitly says cannot-verify Wayland. Keep that limitation; X11 frames do not verify the reporter’s backend. Outside the minimum X11 capture set. |
| M1 | macOS desktop thumb input | Same changed listener, platform input backend | No | recording | Requires macOS desktop/native thumb input and isolated data; seed plain+iframe histories. | missing — explicitly cannot-verify macos; no platform-specific mouse branch in the diff. Outside the minimum X11 set. |
| W2 | Windows desktop thumb input | Same changed listener, platform input backend | No | recording | Requires Windows desktop/native thumb input and isolated data; seed plain+iframe histories. | missing — explicitly cannot-verify windows; no platform-specific mouse branch in the diff. Outside the minimum X11 set. |

## Smallest additional capture plan

Five after recordings can fill the nine minimum gaps; name each segment/phase in the external readout and publish the saved Browser recording wherever decoration is asserted:

1. **R4 + Z1:** plain Forward at non-unit guest zoom, recording and presses on; show native input, zoom, known CSS point, history, and the saved marker at that point. No new before needed for the already demonstrated navigation bug.
2. **R8 + A2:** a guest with no forward history while the host has a forward entry, over plain content and an iframe; then picker on at a history end and demonstrate it remains usable. Keep all relevant toolbar/outline text visible.
3. **R9 + C6 + P1:** no-history plain guest, presses on; observe controller none → human on down → none, hold/move/up and leave/blur/clear, then ordinary guest mouse buttons on a visible event counter/target. Ordinary input must be inside the guest, not Browser chrome. Capture saved decorations as well as the desktop readout.
4. **C2:** recording on with presses explicitly off, followed by stop and another plain thumb press. Show saved output and no stale recording cursor/marker after stop.
5. **C5:** stationary-pointer reload into a cross-site iframe with hover absence observed before the native press. Show the actual declared marker limit and navigation outcome. Add the equivalent before run if asserting this limit is unchanged.

No recapture of the accepted 11 cases is requested. Supplemental F2/L1/H1/H2/H3/P2 are not prerequisites for these five clips; use labelled harness transcripts if pursuing internal callback/IPC branches. W1/M1/W2 need real platform access, not relabelled Xvfb output.

## What was actually inspected

Downloaded all 24 linked MP4s and all linked PNGs, plus manifests, transcripts, fixture pages and drivers. Decoded every video with ffmpeg, extracted every native recording frame, and viewed every native frame in contact sheets. Desktop contact sheets cover pre-input, around input, settled result and end; R14 includes the held interval. Also opened full-size R10 frames, R2/R3 settled before/after stills, the ripple/iframe-marker stills, the before/after composite and amplified diffs. The separate left-click desktop control is supporting evidence, not a substitute for ordinary guest input.

R2/R3 show intentional host-navigation differences on the before side; R12 intentionally navigates the host. Those missing Browser panels are expected outcomes, not rendering blanks. Accepted rows have readable relevant page/toolbar content, consistent 1920×900 app / 1920×1080 capture geometry, no stuck spinner, ghosted duplicate content, clipped relevant text, or stale picker overlay. The external provider-control mask and readout are acknowledged harness additions. They do not cover the content used to prove navigation or markers. Pre-state diffs contain relative-age/build/readout/updater/antialiasing differences; they do not establish a product style regression.

All 24 ffmpeg decodes exited 0. The before-C1 native VFR file reports a duplicate output-muxer DTS (68 >= 68); all 21 extracted frames are readable and include p1/ripple/clear. It is not used for precise cross-run timing and does not invalidate the visible baseline claim. There is no corresponding warning in the after media.

No browser, app server, recorder, device lease or persistent process was started by this audit. Finite extraction/download subprocesses have ended. No files were deleted. All scratch material is under `/tmp/lead-33276-r2/audit-1/`. Disk remained above 5 GB (108 GB available at final inspection).

FRICTION:
- tool | Python urllib downloads returned HTTP 403; curl fetched the same evidence successfully | Use curl for this host.
- tool | System Python has no Pillow; ImageMagick generated the inspection sheets instead | Prefer installed ImageMagick for contact sheets.
- tool | Evidence has before/after script links with identical basenames; the bulk download initially overwrote the after driver with the before driver; re-fetched after driver under a distinct name before evaluating seeds | Store downloads by immutable URL key or unique side-prefixed filename.

VERDICT: INSUFFICIENT R4, R8, R9, Z1, C2, C5, C6, A2, P1