# Proof audit, pass 1 — local commit review

Reviewed [#19941](https://git.cafe/pingdotgg/t3code/pull/19941), fork [Bil0000/t3code](https://github.com/Bil0000/t3code), branch [t3/discussion-6924-pr](https://github.com/Bil0000/t3code/tree/t3/discussion-6924-pr), pinned head [b77e8bf](https://git.cafe/pingdotgg/t3code/commit/b77e8bfac9d1c160e935838246d3136ce4c78a7b), against merge-base [e34067e](https://git.cafe/pingdotgg/t3code/commit/e34067edef2eba03c1e40bca7d2b2d933ae12b85). Audit date: 2026-10-29 UTC. Read-only source audit; no clients, captures, tests, edits to the worktree, pushes, comments, or provider configuration performed. Other agents' uncommitted test edits were excluded by reading the pinned Git objects. All evidence statuses below begin MISSING; historical PR evidence is not credited in this pass.

## Findings first

1. **The previous matrix contains contradicted expectations.** At this head an invalid selected commit does **not** automatically return to Changes. With no cached patch, the commit selection remains and the query error appears above “No patch available for this selection.” Use O07 to observe this; do not demand the earlier P22 automatic fallback. The only selection reconciliation effect here handles disappearing *turns*. [Selected-patch handling](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/DiffPanel.tsx#L1240).
2. **Only the populated commit list is frozen while its submenu is open.** `openCommitMenu` snapshots rows; `commitDescriptions.descriptions` remains live, so secondary lines can appear and increase row heights while the submenu is open. A list that was null when opened can arrive without reopening. Record E03/E04, including scroll position and focus; do not claim descriptions wait until reopen. [Menu and description rendering](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/DiffPanel.tsx#L858).
3. **Unavailable plain links have several distinct destinations.** On web, Browser preference `app` uses ordinary preview opening; `system` produces the “This commit is not in the thread's workspace” toast with a user-activated Open link action. A desktop-delivered unavailable link continues through the coordinator's Browser/scratch-thread path, avoiding a default-browser loop. An unavailable GitHub PR-commit link first tries the PR resolver. E13–E15 must remain separate. [Web routing](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/lib/openPullRequestLink.ts#L181), [desktop fallback](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/desktop/DesktopWebLinkCoordinator.tsx#L167).
4. **Real layout and native scope matter.** The sole production DiffPanel caller passes `mode="embedded"`; outer tabs provide inline/sheet/maximized and desktop chrome. At 390px web viewport the normal sheet is about 343px wide (88vw), narrower than a 390px header harness. Native mobile deliberately filters commit sources and does not normally request one. E11 needs the real web sheet; E17 needs a labelled native **commit-only** response harness, or an explicit missing status. A mixed response with Changes selected is only a regression control: the existing native menu already enumerates known source kinds, so absence of a Commits menu item alone does not prove the new filter. A phone-sized web browser cannot prove E17.
5. **No visual verdict is possible yet.** This audit supplies a minimum capture set and optional extensions, not a merge-readiness approval. No new code defect is asserted from source-only geometry. In particular, the revised SHA hit target needs real hover/focus/click proof at narrow panel widths. The pinned head's forge snapshot reported 31 successful checks and no pending/failing checks; these are not visual evidence.

## Capture contract and minimum set

**Capture E01–E18 first.** Optional O rows are an inventory of distinct extra branches, not a requirement to exhaust a Cartesian product. All listed rows depend on opening, selecting, hovering, scrolling, asynchronous delivery, or another action and therefore require a **recording**; a still alone is insufficient. Extract a readable poster for E01, E07 and E11 as supplemental evidence. Several rows can share one recording, with row IDs and chapter timestamps. Do not add setup per row when a reusable fixture or a gated response can show it.

| Geometry code | Exact viewport, panel, platform, theme |
|---|---|
| W/d or W/l | Real web client, 1440×900, normal embedded Diff in 540px inline right panel; dark or light. Keep sidebar and browser scale fixed. |
| W360/d | Same 1440×900 web viewport, resize the actual panel to 360px; dark. Record measured content/header width. |
| N/l | Real web client, 390×844, light; normal right sheet, approximately 343px wide at 100% scale. Do not replace it with a full-width isolated header. |
| D/d | Actual Electron desktop client, 1440×900, dark, normal panel at approximately 540px; record OS and actual content size. An IPC mock in Chromium is labelled a bridge harness, not desktop. |
| M/d | One native platform, iOS **or** Android, phone portrait, dark; record actual device/OS/logical viewport, font scale and safe area. Prefer an already healthy authorized client. Second native platform is O19. |

Minimum theme repetition is only E01 and E07 at W/d **and** W/l; E11 supplies narrow/light, desktop is dark, native is dark. Do not multiply every loading/error row by both themes. Keep each recording at normal readable speed, include the starting surface and resulting destination, and preserve synthetic hrefs and nonsecret request traces. For before/after comparisons use the specified merge-base and head with the same Git fixture, theme, font scale and viewport; main has no Commits source, so label its ordinary Changes menu/patch as the baseline rather than faking a main commit picker.

## Essential fixture matrix

Every row is affected by the diff, either as new UI or as an existing renderer/entry path receiving the new commit source. Status is the state **now**, before capture.

| ID | Impact | Named fixture / data needed | Minimum viewport × theme × row / evidence | How to seed and drive; visible checkpoint | Status |
|---|---|---|---|---|---|
| E01 | New UI | **Warm linked menu, dense/long content**: 12+ branch commits; short and 160–300-character Unicode subjects; recent/old dates; first ten descriptions including one near 80 characters; recognized remote. | W/d + W/l; **recording**, menu poster. | R-rich + G-real or explicitly G-stub. Leave foreground chat with Diff closed until warmup completes, then open source picker → Commits. Show subject/secondary line truncation, SHA/date column, long-text tooltip, hover/keyboard focus and selected background after revisiting. SHA action is a sibling of the selection radio; no visible checkmark is promised by the menu primitive. | MISSING — real app; any text stub labelled. |
| E02 | New UI | **Compact local-only menu and selected commit**: one commit, short subject, valid full SHA/date, no recognized repository identity; no generated descriptions. | W/d; **recording**. | R-local + G-disabled. Open menu, focus row, select it. Both row and selected-header SHA are plain text with no source action. No description spinner/error/toast; local diff remains usable. Covers the shortest one-line/no-link geometry. | MISSING — real app. |
| E03 | New UI | **Cold branch-list loading**: file access granted; no cached list; branch-list RPC held. | W/d; **recording**. | H-list gate in actual DiffPanel. Open Commits → “Loading commits...” → release populated list while still open. Rows must appear; include the first description request in trace, since late arrival is separately handled by row observation. | MISSING — labelled query harness. |
| E04 | New UI/async | **Cold descriptions become live rows**: 12+ already listed commits; first ten descriptions pending, then succeeding; populated list refresh adds a new first commit. | W/d; **recording**. | H-description + H-list gates. Open subject-only list, release descriptions while open; show new second lines and resulting row geometry. Release refreshed list separately: existing populated row order stays fixed until close/reopen. Scroll to the tenth row to trigger the next ≤10-SHA batch; show those descriptions. Log batch/request counts to distinguish stability from an observer loop. | MISSING — labelled timing harness; real provider supplement allowed. |
| E05 | New UI | **Empty branch comparison**: `{commits:[],truncated:false}`, repository and file access ready. | W/d; **recording**. | R-empty: choose comparison base equal to HEAD, then open Commits. Show disabled “No commits on this branch.” This is an empty list, distinct from an empty selected commit. | MISSING — real app. |
| E06 | New UI | **Cold commit-list error**: no cached rows; useful query error text. | W/d; **recording**. | H-list typed failure, or stale explicit base only in a disposable repo. Open submenu → disabled error message; restore valid response and reopen. Check long error containment. This is not the selected-preview error O07. | MISSING — real app or labelled fault harness. |
| E07 | New UI | **Selected linked regular commit, crowded header**: resolved long subject, recognized remote, multi-file patch, both additions/deletions, preferably large totals. | W/d + W/l + W360/d; **recording**, header poster. | R-rich. Select actual menu row. Subject truncates, adjacent 7-character SHA stays readable/clickable, base selector disappears, counts/control icons remain usable. Hover SHA for URL tooltip, focus and activate subject selector versus SHA independently; SHA opens the code host through ordinary link handling, not local reselection. Use in-app Browser preference to make destination visible. Reopen menu to show selected background. | MISSING — real app. |
| E08 | New UI | **Selected commit preview pending**: selection exists but no preview/subject cached. | W/d; **recording**. | H-preview gate after an actual row selection. Header uses “Commit” plus SHA; body has “Loading commit...” status/skeleton. Release to E07; no previous commit subject/patch may be presented as the new selection. | MISSING — labelled query harness. |
| E09 | New source | **Empty selected diff**: valid whitespace-only commit, with a separate empty commit available as a control. | W/d; **recording**. | R-rich. Select whitespace-only commit; hide/show whitespace using real toolbar control. Empty state says “No net changes in this selection”; normal patch returns when changes are shown. Totals/file-dependent controls follow data. Empty commit can reuse this layout without a separate required shot. | MISSING — real app. |
| E10 | New source | **Large selected merge commit, lazy per-file reads**: two parents; ≥6 text files; aggregate patch >120,000 bytes; a later commit/dirty edit changes the same files differently. | W/d; **recording** plus SHA/parent/request transcript. | R-heavy. Select the merge commit, load initial files, scroll/load more, reveal a later file through tree, expand hunk context. Show actual first-parent old contents and selected-SHA new contents, not current working files. Totals include all files; metadata-backed lazy mode does not use the incomplete-preview banner. Trace per-file requests with `commitSha` and contents requests with commit source/parent/head. | MISSING — real Git app fixture. |
| E11 | New UI | **Narrow real web sheet**: same long menu/selected linked header as E01/E07, full controls and totals. | N/l; **recording**, menu + header posters. | R-rich, resize actual client. Open sheet/menu, hover or keyboard-focus tooltip where supported, select commit, focus/click SHA and selector separately, close/reopen. Popup must fit/flip within viewport; title must not displace SHA or controls. Include maximize/unmaximize if exposed; this is web, not native. | MISSING — real app. |
| E12 | New routing | **Matching workspace link → commit Diff**: full reachable ancestor SHA; matching discovered identity; real thread/worktree; plain native commit href, query/fragment retained. | W/d + D/d; **recording**. | L-success, D for desktop-delivered URL. Start with Browser/PR/file surface or closed panel; click thread Markdown anchor on web and deliver bridge URL on desktop. Validate then show correct selected commit. At least one run uses a worktree whose HEAD differs from project root. Include normal versus Ctrl/middle/Shift/Alt gestures and setting-off control using the same anchor; these must not trigger local commit lookup. Platform-specific Meta can be a labelled synthetic event, not claimed macOS proof. | MISSING — real web and desktop; bridge simulation labelled separately. |
| E13 | New routing | **Unavailable GitHub PR commit → PR view**: matching repo, full missing SHA, `/pull/<n>/commits/<sha>`; configured readable PR. | W/d + D/d; **recording**. | L-PR; same web click and desktop delivery. After lookup fails or returns no matching source, open the original PR in the thread's PR panel; no empty commit Diff flash. If PR data is stubbed, label it. This route is GitHub-specific; other host native commit routes do not magically have this fallback. | MISSING — real clients, optional labelled PR-data stub. |
| E14 | New routing | **Unavailable plain link → Browser**: matching repo, missing full SHA, harmless query/fragment, Browser preference `app`. | W/d + D/d; **recording**. | L-missing. Web follows ordinary in-app link behavior. Desktop-delivered URL uses coordinator Browser path: reuse an already active Browser, otherwise create/open scratch thread Browser. Capture actual target URL and thread destination; do not expect an OS-browser handoff or loop. Desktop ordinary fallback is not governed by the web toast branch. | MISSING — real clients. |
| E15 | New UI/routing | **Unavailable plain web link → actionable toast**: same missing-SHA href; Browser preference `system`; no desktop bridge. | W/d; **recording**. | L-missing. After validation show info toast “This commit is not in the thread's workspace”. No automatic popup; activate “Open link” and verify original href including query/fragment. If the automation prevents external navigation, record the prevented native request/URL and label that limitation. | MISSING — real web; popup gate labelled if used. |
| E16 | Changed transitions | **Return from commit to existing sources**: named custom base, ≥2 commits, dirty tracked file, two ready checkpoint turns, recorded file-change tool call. | W/d; **recording**. | R-rich + T history. Commit → Changes retains custom comparison; Uncommitted → Latest turn → older Turn → tool-call diff → commit. Base selector belongs only to Changes, titles/patches/collapse state identify each source. Close/reopen Diff once with keybinding, refresh and reload to check persisted selection/base. Briefly exercise split/stacked, wrap, tree and collapse on the commit. Do not require clicking an already-selected radio to deselect; direct Changes is the guaranteed exit. | MISSING — real app; synthetic history explicitly labelled. |
| E17 | Changed native data | **Native commit-only source is filtered**: one valid nonempty commit source, no branch/working-tree/turn sources, settled; stored selection null or stale `git:commit`. | M/d; **recording** plus injected-response/selected-section transcript. | M native response harness around actual useReviewSections/ReviewSheet. Supply the commit-only response; after filtering, no sections/selection remain and ordinary empty Review appears instead of displaying that commit patch. Record exact input so empty backend data cannot masquerade as filter proof. Native menu absence alone is insufficient; it already enumerates only known source kinds. Mixed-source regression control is O20. | MISSING — labelled native harness; no phone-web substitute. |
| E18 | New UI | **Capped commit list footer**: 101+ commits beyond chosen base, 100 returned, `truncated:true`. | W/d; **recording**, bottom-of-list checkpoint. | R-many. Scroll submenu to bottom, retain SHA/date column, show “Showing latest 100 commits”. Request transcript/manifest confirms only 100 returned. First/next description batch behavior can share E04's reel. Exactly-100 no-footer control is O01, not a separate mandatory setup. | MISSING — real Git app fixture. |

## Optional distinct branches — do not consume the core budget first

These rows are also affected paths or regression controls; each has its own missing status. They must stay disclosed as unverified if not captured. Choosing the minimum set is not a claim these branches were verified.

| ID | Impact | Named fixture and data / why distinct | Viewport × theme / evidence | Real seed or labelled harness / expected checkpoint | Status |
|---|---|---|---|---|---|
| O01 | New UI boundary | **Exactly 100, not truncated**; same scrolling geometry as E18 but no footer. | W/d; **recording**. | R-many branch phase with exactly 100 beyond base; `{truncated:false}`. | MISSING — optional real app. |
| O02 | New UI | **Cached rows plus list refresh error**; rows coexist with disabled error footer. | W/d; **recording**. | H-list success → reopen/refresh failure. Error precedence overrides truncation/footer, not existing rows. | MISSING — optional labelled harness. |
| O03 | New UI + shared body | **File access checking**; session/grant unresolved, no rows. | W/d; **recording**. | H-grant gate. Menu “Checking file access...”, body checking skeleton, grant then normal rows. | MISSING — optional labelled harness. |
| O04 | New UI + shared body | **File read denied**; ready connection lacks filesystem:read. | W/d; **recording**. | Real restricted isolated session or H-grant. Menu/body show explicit access error or default “This connection cannot read local diffs.” Denying only operate scope instead yields E02's subject-only generation behavior. | MISSING — optional real session or harness. |
| O05 | New async behavior | **Description batch failure and reopen retry**; no special error UI. | W/d; **recording** plus request counts. | H-description failure leaves subject-only rows; no immediate observer retry loop; close/reopen retries missing descriptions, succeeds. Scroll later failed batch to retry it after reopening. | MISSING — optional labelled harness. |
| O06 | New async behavior | **Background/model/identity transitions**; foreground chat → Settings/Usage, switch thread/cwd/effective model, missing operate grant. | W/d; **recording** plus request counts. | Real navigation plus H-generation. New warmup stops when background/ineligible; no promise of cancelling already-running work. Model/thread/cwd scope change must not reuse old secondary lines; successful provider families share one visual shape. | MISSING — optional mixed real/harness. |
| O07 | New source | **Selected commit now invalid / missing parent / query failure**; selected SHA retained, no cached patch. | W/d; **recording**. | Disposable branch switch or depth-1 clone boundary; alternatively H-preview GitCommandError. Error paragraph + no-patch state and fallback title/SHA remain; manually choose Changes to recover. Generic errors use same layout. No automatic fallback at this head. | MISSING — optional real Git or harness. |
| O08 | New source | **Selected source missing in successful preview**; response sources empty or no commit source, no error. | W/d; **recording**. | H-preview success without commit source. Fallback header + “No patch available for this selection.” Unlike E09, no resolved empty patch. Link validation uses this as unavailable and falls back instead. | MISSING — optional labelled harness. |
| O09 | New UI | **Subject absent even after ready preview**; real empty commit message, valid nonempty patch. | W/d; **recording**. | R empty-message Git commit (`--allow-empty-message`); header trigger “Commit”, section title “Commit <short SHA>”. Menu subject itself can be blank; do not invent fallback row text. No description case exposes its smallest height. | MISSING — optional real app. |
| O10 | New source | **Root commit**; reachable from HEAD, often outside branch-list range. | W/d; **recording** plus parent transcript. | L-success link to root SHA; diff against empty tree, all root files additions. Do not fabricate root into merge-base..HEAD list. | MISSING — optional real app. |
| O11 | New source | **Lazy file error, retry**; one per-file RPC fails while other files are loaded. | W/d; **recording**. | E10 + H one file failure → retry action → correct selected-commit file. Request keeps commit SHA. | MISSING — optional labelled fault injection. |
| O12 | New source | **File partial (>1 MiB), metadata present**; partial-file status/tooltips. | W/d; **recording**. | Real huge text file in selected commit; show partial notice, totals, context loading. | MISSING — optional real app. |
| O13 | New source, harness-only shape | **Truncated preview without file metadata**; incomplete-preview banner. | W/d; **recording**. | H-preview `truncated:true, files:undefined`. Real driver normally includes files and uses E10 lazy path. | MISSING — optional labelled harness. |
| O14 | New source, harness-only shape | **Raw unparseable nonempty patch**; parser reason + preformatted patch. | W/d; **recording**. | H-preview with invalid/unparseable patch and no lazy metadata. Exercise wrap; inherited renderer receives new source. | MISSING — optional labelled harness. |
| O15 | New routing race | **Late lookup loses to newer user action**; old valid/unavailable request resolves after panel action, source change or second link. | W/d; **recording** plus gated request order. | H-preview: click A → explicitly choose another panel/diff or click B → resolve A last. Old request cannot steal selection or trigger stale fallback/toast. | MISSING — optional labelled harness. |
| O16 | Routing regression controls | **Other repo / host / port / no thread / invalid or short SHA / settings off**; no local interception. | W/d; **recording** plus request count. | L-controls; ordinary link behavior, or ordinary PR resolver for PR-shaped URLs. Same repo exists in another environment is not local ownership proof. Exercise a standalone PR Markdown body and a rendered attachment with no thread. These inputs collapse to the existing ordinary destinations, not separate screenshots per hostname. | MISSING — optional controls; setting/modifier minimum already E12. |
| O17 | New parsing/routing | **Other URL families and Enterprise host**; same resulting Diff layout as E12. | W/d; **recording** plus table of href → matched identity → requested cwd. | Provider table below; real discovered identity or explicitly H-identity. Include self-hosted arbitrary GitHub hostname and port on desktop if available. Not a new visual shot for each provider. | MISSING — optional provider-route extension. |
| O18 | Changed desktop routing | **Desktop launch/draft/no real thread, local disabled, discovery pending**. | D/d; **recording**. | D bridge/OS URL, H-discovery gates where needed. Native PR URL without thread opens standalone PR page; plain commit uses Browser/scratch thread; ordinary URLs do not wait for discovery. Local-disabled mode must not await nonexistent local discovery. Pairing/prompt links remain their earlier special branches. | MISSING — optional desktop or labelled bridge harness. |
| O19 | Changed native data | **Second native platform**. | Other iOS/Android phone, dark; **recording**. | Repeat E17 on second native client if already available. | MISSING — optional native harness. |
| O20 | Native retention control | **Native mixed retained sources**; branch-range + working-tree + commit + ready turn; valid noncommit selection or stale stored commit selection. | M/d; **recording**. | M supplies mixed response; Changes/Uncommitted/turn remain usable. A stale commit selection resolves to Changes, or first remaining turn/working-tree if Changes absent. This is a retention control; absence of Commits in the menu alone does not prove filtering. | MISSING — optional native harness. |
| O21 | Changed native data | **Native commit-only loading**; no branch-range source yet. | M/d; **recording**. | M sets loading flag; filter plus loading creates Changes placeholder/skeleton, no commit item. Release to mixed O20. | MISSING — optional native harness. |
| O22 | Shared controls/new source | **Boundary/maximized/shared interaction controls**. | Web 981→980 and 641→639 widths, dark; **recording**. | Real resize/maximize plus E07. Sheet boundary 980px, responsive primitive density at 640px, branch refs container threshold 20rem; file tree reveals/expands, copy path/context menu, preferred file/editor open, find reveal, annotation uses commit section title/draft target. These are inherited controls reached with new source. | MISSING — optional real app. |
| O23 | Changed shared-hook entry | **HTML-document bridge and non-timeline Markdown**. | W/d; **recording**. | Actual HTML-render attachment with real threadRef, recent iframe user activation and synthetic commit anchor; or FileMarkdownPreview/PR body with threadRef. Without threadRef, local commit handling is unavailable. Reuses E12 or E14 destination, no new visual geometry. | MISSING — optional real app or labelled document harness. |

## Complete render/caller inventory and branch collapse

Source inventory at the pinned head; references are code provenance, not a claim of runtime verification.

| Changed component / helper | Production callers and props | All layout/state/interaction branches relevant to the diff; where covered |
|---|---|---|
| [DiffPanel](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/DiffPanel.tsx) | Sole JSX caller [RightPanelSurfaceContent](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/chat/RightPanelSurfaceContent.tsx#L104), diff surface only, lazy/Suspense, keyed by scoped thread, `mode=embedded`, `visible`, `workspaceMutationId`, `composerDraftTarget`. Hosted by ChatView → ChatRightPanel → RightPanelTabs. | Open/activate via panel controls, Diff shortcut and existing turn/file/tool-call entry points, or commit link. Only visible panel queries list; mutation/manual refresh/show revalidate diff. Draft target affects annotation destination. Declared inline/sheet/sidebar DiffPanel modes have no production caller here: any such capture is a component harness. Outer sheet ≤980px, resizable inline ≥360/default540, maximized full width; desktop native chrome belongs to outer tabs. E07/E11/E12/E16, O22. |
| DiffPanel header/source menu | Selection variants branch, unstaged, turn, tool-call, new commit. Branch base remembered while in commit/unstaged/turn/tool-call. | Commit trigger subject or fallback “Commit”; separate SHA anchor if projectCommitUrl succeeds, else plain text. Full subject only in menu tooltip, SHA URL tooltip; checked background/hover/focus. Stats if files; refresh if Git selection/cwd; collapse and tree if files. Base combobox only for branch with resolved base: Automatic, local/remote/both refs, search/no matches and remote switch are existing controls. Commit removes that block. E02/E07/E08/E16; O09/O22. |
| DiffPanel Commits submenu | `{commits:[{sha,subject,committedAt}],truncated}` from branchCommitsQuery or non-null open snapshot; live descriptions map. | Counts 0 / 1 / several / 100 / capped100; subject empty/short/long ≤300; no/short/near80 description; relative dates; source URL present/absent. Selection and SHA are sibling controls. Row truncation; right tooltip max-w80; scroll max-h80/max-w96. Footer precedence: error → access pending/denied → data null/loading → empty → truncated count → none. Cached rows can coexist with error/access message. Populated rows freeze on open; descriptions do not. E01–E06/E18; O01–O05/O09. |
| DiffPanel body + [useReviewFilePatches](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/diffs/useReviewFilePatches.ts) | Hook called only by DiffPanel. New commit source: `id/headRef=sha`, `baseRef=firstParent`, optional commitSubject, diff, files, diffHash, truncated. | Initial skeleton; error without renderable patch; resolved empty diff vs absent patch; parsed files vs raw; truncated with metadata → lazy files, without metadata → banner; 4 initial files then groups of4, pending/error/partial/retry. Source metadata drives totals. Existing split/stacked, wrap, whitespace, tree, collapse, per-file copy/open/context menu, hunk context/find reveal, review annotations reuse new source. Per-file patch input adds commitSha, full contents loader uses commit parent/head. E07–E10/E16; O07–O14/O22. |
| DiffPanel inherited body guards | Same caller, route-thread shell/git status/file access/checkpoint data. | No active thread → “Select a thread…” (component harness only; caller needs real ref). Nonrepo unless tool-call → unavailable message. Selected turn/no completed summaries → “No completed turns yet.” Git selection/read pending → checking skeleton; denied → explanation. Tool-call recorded-content-without-diff, omitted files and checkpoint loading/truncated states remain unchanged. No new required still of each unchanged guard. O03/O04/O22; existing sources in E16. |
| [ChatView warmup](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/ChatView.tsx#L1576) + [useCommitDescriptionWarmup](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/diffs/useCommitDescriptionWarmup.ts) | ChatView's sole JSX owner is ThreadRouteView (server thread, draft, promotion/unlisted-thread readiness), under BackgroundThreadContext in chat layout. Warmup hook only ChatView. | Requires real thread/cwd, connected env, repo/settings/project, operate permission, foreground and modelKey not null. Closed Diff does not disable warmup. Base/mutation/model change request identity; only newest10 prepared. Background Settings/Usage suppresses new work. No DOM/spinner of its own. E01/E04 plus method transcript; O06. |
| [useCommitDescriptions](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/diffs/useCommitDescriptions.ts) | Only DiffPanel. Scope is env/thread/cwd/full effective modelKey when permission allows. | First batch on open; row0 handles late list; each tenth observed row requests next10. Description response adds live lines; failure is silent; requested set suppresses repeats until reopened; reopening retries first batch, later observers retry later batches. Scope transition must not show stale map. Server cache is repo/SHA/model, max512, so menu closure does not imply cold generation. E01/E03/E04, O05/O06. |
| [useOpenChangeRequestLink / useOpenPrLink](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/lib/openPullRequestLink.ts) | Direct: ChatMarkdown, BrowserDocumentFrame, DesktopWebLinkCoordinator; wrapper useOpenPrLink consumers: BranchToolbarBranchSelector, ChatComposer, MessagesTimeline, ThreadPullRequestsPanel, SidebarThreadRow. DiffPanel SHA now uses useOpenLink directly. | Preference off/ctrl/meta/middle bypass; commit Shift/Alt bypass too. Needs real thread/project, matching provider/repository/authority, full SHA; uses thread.worktreePath else project root. Force read preview before selection; matching commit head source → Diff; unavailable → PR resolver → callback/browser/toast. No thread uses ordinary PR/global path. Newer user panel action or diff selection suppresses late result. No separate layout per PR-only wrapper button. E12–E15, O15–O18/O23. |
| [DesktopWebLinkCoordinator](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/desktop/DesktopWebLinkCoordinator.tsx) | Root route once; requires desktopBridge.webLinks, readiness/primary config unless local disabled. Returns null. | Subscribe/ready bridge, queue links; pairing and prompt-link routes precede forge handling. Recognized PR/commit URLs await projectsSettled unless local disabled. Real active server thread passes commit target including known Enterprise provider. Success Diff; unavailable PR thread/standalone resolver; plain Browser reuse or scratch-thread Browser. No active thread/draft cannot select local commit. Existing file URLs need local HTTP and ordinary error toasts remain unchanged. E12–E14; O18. |
| [mobile buildReviewSectionItems](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/mobile/src/features/review/reviewModel.ts#L514) | Sole production caller useReviewSections → ReviewSheet → ReviewHeader/source menu, native Review diff data/prewarming. | Filters kind=commit before building git items. Mixed sources retain turns/branch/working-tree (O20); commit-only settled yields no Git item (E17); loading without branch inserts Changes placeholder. Stale selection resolves Changes then first remaining item then null. Normal mobile request has no commitSha, so no new mobile commit picker or commit-link interception is introduced. iOS/Android share filter, separate native presentations. E17; O19–O21. The known-kind source menu already omits commit items before this filter, so mixed-menu absence alone is not discriminating evidence. |
| Settings/source-control helpers | settingsSearch only adds `commit` keyword to existing Diffs “Open pull requests in T3 Code”; no settings component layout change. projectCommitUrl called in DiffPanel row/header. Source-control definitions parse/generate host URLs. | Settings navigation itself is the E12 setting-off control. Shared protected command requires operate scope; branch/preview/contents need filesystem:read. Contract adds source kind; clients receive same typed shapes. URL family differences affect routing, not menu layout. E02/E12; O17. No screenshot per provider adapter or schema field. |

### Markdown/document caller expansion

The changed hook is reached through these existing renderers; equivalent destinations share fixtures, but missing thread context cannot be inferred from a timeline capture:

- **Real thread context:** ChatMarkdown in TimelineAssistantRows, TimelineUserMessageRow, TimelineWorkEntryRow's expanded ReasoningTraceContent, UserMessageContextChips, V2ItemInspector, ComposerPendingUserInputPanel, ProposedPlanCard (collapsed and expanded), FileMarkdownPreview; PullRequestMarkdown when it receives a threadRef directly or from context. E12/E13 is the representative timeline path; O23 is the non-timeline control.
- **No thread context at these call sites:** TimelineWorkEntryRow's inline reasoning preview, TimelineWorkGroupRows, WorkflowOpeningBlock, composerContextPresentation, AttachmentFilePreview's rendered Markdown, NotebookPreview. These do not gain local commit interception merely because their text is visible in a thread. Standalone PullRequestMarkdown uses synthetic PR panelRef and environmentId, so PR resolver can still work but local commit selection cannot. O16/O23.
- **Document link bridge:** BrowserDocumentFrame is mounted by FilePreviewPanel's workspace document preview without threadRef, and by AttachmentFilePreview with optional threadRef. Its current callback passes meta/ctrl only and requires iframe focus/recent user activation. Test a thread-bound htmlRender attachment for positive local routing; a plain PDF/workspace frame is not interchangeable. O23.
- **PR link wrapper consumers:** BranchToolbarBranchSelector, ChatComposer context chip, MessagesTimeline citation records, ThreadPullRequestsPanel and SidebarThreadRow supply existing PR links/optional explicit target thread. They do not add new commit row geometry; ordinary PR behavior can share E13/E16 regression observations. No extra capture per button.

These callers were enumerated with `git grep` at the pinned head, not guessed from the prior matrix. Relevant unchanged primitives and hosts: [ChatMarkdown](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/ChatMarkdown.tsx#L663), [BrowserDocumentFrame](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/files/BrowserDocumentFrame.tsx#L212), [PullRequestMarkdown](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/pullRequest/PullRequestMarkdown.tsx#L88), [DiffPanelShell](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/DiffPanelShell.tsx), [ChatRightPanel](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/chat/ChatRightPanel.tsx), [RightPanelSheet](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/web/src/components/RightPanelSheet.tsx).

## Seed recipes — instructions for capturer, not executed here

Use the lead's healthy isolated app if available. All new drivers, logs, Git fixtures and captures for this audit belong in a new timestamped run directory inside `/tmp/lead-19941-r4/proof-audit-1/`; do not delete a previous run. Do not change the audited worktree's history to make fixtures. Add synthetic repositories as projects through the app, then create stopped real threads and navigate to `/<environmentId>/<threadId>` (route `/$environmentId/$threadId`). App-known project/thread ownership is required for review authorization and text generation. No server against live T3 userdata, no live developer agents, no credentials in public artifacts.

**R-rich:** disposable Git repo with root/main, named `fixture-base`, feature branch with 12+ commits, recognized remote for source links, short/long/Unicode subjects and varied committed dates, whitespace-only commit and empty commit, dirty tracked file. Keep a nonsecret manifest of SHAs, parents, exact expected old/new contents and dates. No fetch/push needed to generate URL-shaped remote identity. Use a separate worktree branch with a distinct commit to prove link lookup uses the thread worktree. Server-discovered repository identity is the real path; changing identity only in client state is H-identity, not real discovery proof.

**R-local:** separate no-remote repo, main plus one feature commit beyond an explicit base. Deny generation operate grant or select an unsupported/unavailable generation provider in the isolated environment while file reads remain permitted. **R-empty:** comparison base equals HEAD. **R-many:** 101+ small commits beyond base; use a branch/ref ending one commit earlier for optional exact100 control. **R-heavy:** on a side branch modify at least6 text files for >120,000 bytes aggregate patch, merge non-fast-forward into feature. Record first parent. Make later selected-workspace edits with visibly different text. A single >1,048,576-byte file creates O12. Root selection is easiest via link; a shallow depth1 boundary is a failure fixture, not a root substitute.

**T history:** use already stopped synthetic fixture threads with two ready checkpoints and a recorded file_change tool call, or use the app's normal commands in isolated state. If not readily available, a labelled projection/RPC visual fixture can supply history to actual product components; it is not proof that backend checkpoint creation works. Do not run agents on copied live pending work just to fill a menu.

**G-real:** Settings search “Text generation model”, choose an actually working provider instance/model for the destination environment/effective project (including project override if present); file read and orchestration operate grants required. Foreground chat prepares only newest10 even with Diff closed. The server uses effective textGenerationModelSelection, not necessarily the chat model. Preflight a SHA different from the intended cold capture because preflight warms the cache. A successful real command returns effective modelSelection and descriptions for exactly requested SHAs. Shared fromRunner covers Cursor/Grok/OpenCode/Pi and Codex uses native generation; Muse implements the same operation, ACP/FX report unsupported. There is no new per-provider visual layout. A successful model run in the auditing agent is not proof the isolated app server can run it.

**G-stub:** if a working model is not already available, use a clearly labelled typed command harness returning exact requested SHAs and valid modelSelection with deterministic ≤10-word/≤80-character strings. Preserve real DiffPanel/menu components and list geometry. This proves rendering, not real generation. Do not spend the fixed capture budget on new account setup; mark real provider evidence unverified.

**H:** labelled harness around actual DiffPanel/ChatView and actual router, query/command state and UI primitives. Gate list/description/preview/session responses with explicit driver actions; supply properly typed query errors. No product setting deliberately creates reliable loading/error/race timing, so these states need a controlled response harness or transport interceptor. Persist a request-count/order transcript; visual silence cannot prove suppressed warmup, no observer loop or stale-result rejection. Do not substitute a probe that prints counts for product UI, or a hand-recreated header for E07/E11.

Semantic typed RPC calls (not raw WebSocket wire envelopes):

```json
{"method":"review.getBranchCommits","input":{"cwd":"<fixture>","baseRef":"fixture-base"}}
{"method":"review.getDiffPreview","input":{"cwd":"<fixture>","commitSha":"<full-sha>","ignoreWhitespace":false}}
{"method":"review.generateCommitDescriptions","input":{"cwd":"<fixture>","threadId":"<stopped-thread>","shas":["<full-ancestor-sha>"]}}
```

List result is `{commits:[{sha,subject,committedAt}],truncated}`. Commit preview returns one commit source with headRef/id=SHA, baseRef=first parent (empty tree for root), optional commitSubject, files/totals, diffHash, truncated. Per-file patches use the same commitSha plus `file:{path,previousPath,sourceKind:"commit"}`. Full file contents use `sourceKind:"commit",baseRef:<parent>,headRef:<sha>,changeType,oldPath,newPath`. Requests must target the environment that owns the thread/workspace. A valid hash must be reachable from that workspace's HEAD; a present nonancestor and a shallow commit missing its parent are both unavailable.

**L-success/missing/PR:** seed synthetic Markdown anchors in an actual stopped thread using normal app fixture flow or a labelled message projection fixture. Full href hash, original query/fragment; link text may be subject or short SHA. Start in-app PR preference enabled, Browser preference app with working preview capability/operate grant; use that thread's recognized identity. Reachable ancestor succeeds; all-zero/missing full hash gives unavailable plain path, GitHub PR-commit path adds PR fallback. Existing but nonancestor hash is optional extra validation. A different repo/threadless/short hash skips commit validation and uses ordinary link behavior. H-preview can control fallback if no real readable PR is available; show PR-data stub label.

| Source control family | Native commit route, relative to matching host | Optional recognition edge / seed |
|---|---|---|
| GitHub | `/owner/repo/commit/<full-sha>` and `/owner/repo/pull/<n>/commits/<full-sha>` | Known GitHub identity allows arbitrary Enterprise hostname; .ghe.com and github-labelled hosts recognized generally. Include port control. |
| GitLab | `/group/subgroup/repo/-/commit/<full-sha>` | Nested namespace, self-managed host. |
| Forgejo/Gitea | `/prefix/owner/repo/commit/<full-sha>` | Prefix and explicit port; wrong port must not select workspace. |
| GitCafe | `/owner/repo/commit/<full-sha>` | git.cafe/staging.git.cafe. Its PR-commit-shaped URL is not parsed as local commit by this definition; ordinary PR resolver may still claim it. |
| Bitbucket Cloud | `/owner/repo/commits/<full-sha>` | Plural commits. |
| Azure DevOps | `/org/project/_git/repo/commit/<full-sha>` | Legacy visualstudio canonical identity/self-hosted `_git` prefix. |

Use real discovered identity where available; H-identity variants are explicitly labelled and do not require fetching from every provider. Only full40/full64 hex hashes parse; seven characters are presentation, not accepted input. SHA64 need not get a visual row because the UI still shows seven characters. [Definitions](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/packages/source-control-core/src/shared/definition.ts#L352), [Git source limits/semantics](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/server/src/vcs/GitVcsDriverCore.ts#L3103), [service ownership/model/cache](https://github.com/pingdotgg/t3code/blob/b77e8bfac9d1c160e935838246d3136ce4c78a7b/apps/server/src/review/ReviewService.ts#L147).

**D:** real Electron client attached to isolated fixture environment; deliver URL through OS/default-browser registration or supported desktop bridge. The coordinator listens to `window.desktopBridge.webLinks.onOpen` and setReady. A harness can emit the callback and gate discovery; label it bridge harness. Real desktop header/menu is still needed for platform evidence. No active server-thread route means local commit selection is unavailable. Normal browser DOM clicks and OS-delivered URLs are separate entry points; capture one of each.

**M:** actual native ReviewSheet/useReviewSections with controlled typed preview response. Commit-only settled supplies E17; include a valid, visibly identifiable nonempty patch and log the injected source plus resolved section. Mixed retained sources and commit-only loading supply O20/O21. Ordinary native RPC is `{cwd}` without commitSha, so its real server response cannot seed the new commit filtering branch. Store stale `git:commit` only in labelled harness; show resulting default (Changes, first remaining turn/working-tree, or none). Use an already authorized native client; otherwise explicitly report native evidence missing and do not spend the core web budget on emulator setup.

## Budget-conscious capture grouping and handoff

1. One reusable real-app reel: E01, E02, E05, E07, E09, E16, E18; E01/E07 only get light repeats. One rich repo plus local-only and capped branch variants, no extra provider account setup.
2. One gated actual-component reel: E03, E04, E06, E08; append optional grant/error/race chapters only after core footage is safe.
3. One heavy Git reel: E10, using metadata/request transcript for first-parent and immutable revision semantics.
4. One narrow/light reel: E11. Record actual sheet width and SHA/control hit targets.
5. Web link reel E12–E15, then real desktop E12–E14 using same SHAs. Missing desktop client is a disclosed missing platform, not licence to relabel Chromium as Electron.
6. Native E17 if an already healthy authorized client exists. Label controlled source injection. Optional rows only with remaining time.

For each row, return **CAPTURED real app**, **CAPTURED labelled harness**, **PARTIAL** with precisely missing viewport/theme/subcase, **FAILED** with observed contradiction, or **MISSING** with reason, and URLs/chapter timestamps. Keep raw files/manifests/logs through upload. A single labelled recording can satisfy multiple rows when chapters are individually inspectable. Nothing in pass1 marks a still, old recording, unit test or code inspection as a new capture.

## Coverage and friction

Covered all production changes in the pinned diff, their web render branches/callers, lazy per-file/full-content inputs, source URL definitions, permissions/model prerequisites, desktop delivery and native filtering. Focused tests were read for intended input/transition shapes, not run; no browser/computer use occurred. No broad merge-readiness audit or existing evidence validation is claimed. Disk checks: 25GB available; no deletion performed.

FRICTION:
tool | web.open could not fetch the historical matrix (Internal Error); curl downloaded it successfully | Use direct curl for this ghdrop Markdown URL. No audit row blocked.

VERDICT: INSUFFICIENT E01–E18 recordings required; all optional O01–O23 remain unverified.