# Proof audit, pass 1 — desktop preview reattachment

Findings:

1. **Proof is incomplete for three changed behaviors:** bounded timeout followed by a late attach (F07), closing a session during the wait (F08), and the actual extra `resized` event on new open (F09, including F12's payload assertions). These are evidence gaps, not confirmed implementation defects. The linked before run cannot prove the new retry loop terminates on timeout or close. The linked after runs do not contain event payloads or a close-during-wait sequence.
2. **The existing recovery recordings are valid historical evidence.** The [before transcript][before] demonstrates the reported failure; the [ordinary after transcript][after] demonstrates a live renderer reacting to the first announcement; the [early-call transcript][early] demonstrates eight announcements at approximately one-second intervals and successful desktop recovery after several are missed. Rejecting all three only because they predate the local head would be unjustified.
3. **No mandatory blanket recapture solely for the SHA change.** Exact source comparisons found `desktopRenders`, `setUpTab`, `ensureTab`/`findTab`, and `mirrorManagerEvent` unchanged between the early-call revision and the reviewed head, and between the old before revision and the current merge-base. Manager, DesktopBrowserChannel, the preview event consumers, desktop webview host/runtime code, relevant preview contracts, preview IPC, dependency manifests and lockfile also have no intervening changes in the compared paths. The inherited production change in ServerBrowser alters visibility reporting and default tab selection, not the explicit-tab UA/URL recovery assertions in the transcripts. A fresh paired run is useful for provenance, but not itself a missing behavioral fixture. New missing captures should run on the reviewed head; a new before capture, if made, should run on the merge-base.
4. **No desktop screen recording is required.** This is a server timing/protocol change without a rendered surface change. A timestamped real-app transcript is the recording: correlate reload, request, announcement, attachment, fallback/close, session lists, and UA/URL results by thread/tab/request identity. Video alone cannot prove which browser the agent drives, unchanged snapshot payloads, or absence of a runaway publisher. No new tests or runtime captures were executed in this pass.

Scope: [#33666][pr] in [pingdotgg/t3code][repo], branch [fix/issue-33649][branch], reviewed local head [f404c5fb33][head] (not yet pushed at audit time), against `origin/main`; merge-base [73fb49d0b3][base]. The forge still reports pushed head [6fe2b28ccc][pushed], with 43 successful checks and no pending/failing checks. Those checks and the posted reviews are not evidence from the unpushed local head. The issue is [#33649][issue]. The worktree was read-only throughout the source review; the requested matrix and copies of the linked evidence are in the designated scratch directory.

## Paths and collapse rule

There is **one direct caller** of `desktopRenders`: [setUpTab][setup]. The creation chain is `ensureTab -> createTab -> setUpTab`. Every route into it was traced:

- Agent `open` creates via `openTab`; explicit reuse and ordinary tab operations reach `findTab` (`requireTab` for the latter). Automation `status` only reads the existing backend map and does not itself reconstruct a tab. Calls without an explicit tab select from the existing map; use explicit IDs for a reload reproduction.
- `attachViewer -> findTab` reaches the same creation path for a streamed web/mobile/remote viewer.
- The manager's `opened` event mirror reaches `ensureTab` for a server-runtime session when it has no automation owner, or when an owned tab is already reserved/existing. It deliberately skips unreserved owned sessions. `openTab` reserves before publishing so its event mirror and caller share creation.
- Desktop `attached` events reconnect a missing backend via `ensureTab`; desktop `detached` events drop the old desktop connection without closing the manager session. This is why an explicit agent call after reload can reconstruct it.
- Popup adoption also calls `openTab`, but its adopted page short-circuits `desktopRenders` entirely.
- `ensureTab` returns an existing backend or a single existing pending promise. Concurrent operations and attach notifications therefore share one recovery attempt per thread/tab. They do not each need a separate retry loop fixture.

The changed gate is [ServerBrowser.ts, desktopRenders][gate]: channel unavailable or snapshot already headless skips the desktop wait. Otherwise `isAttached` skips announcements when already attached; an unattached tab forks immediate and then spaced announcements inside the scope of the existing 10-second attachment wait. [awaitAttached][await] subscribes before checking its attached set, so an attach before subscription is not lost. Scope completion interrupts the publisher before desktop connection/setup continues. A false wait result follows the existing `markHeadless`/server-page path. An error from connecting an attached desktop propagates through setup cleanup; it does not select the timeout fallback.

[Manager.announce][announce] reads the **current** session under its existing synchronized mutation, republishes it as `resized`, increments the global revision, and gives the event a new `createdAt`. It preserves the snapshot, its `updatedAt`, ownership/profile/render settings and manager session; it includes no destructive resize `request`. Missing sessions return a lookup error, swallowed by this caller. Closing does **not** explicitly cancel `awaitAttached`; unsuccessful retry calls can continue until the original bounded wait ends.

The fixture matrix collapses operation names, providers and connection transports when they use these identical paths. Desktop with its primary local server is the affected host. Standalone web servers and remote environments without desktop channel FDs use F01; web/mobile viewers of a desktop-hosted server share F10/F12. No changed provider adapters, RPC schema, UI entry points or tunnel routing warrant independent copies of the recovery fixture. The existing desktop/main-process channel remains available during a renderer reload; renderer availability and channel availability are different conditions.

## Fixture matrix

`recording` means a timestamped real-app transcript/log, including for optional controls. `Mandatory` identifies the minimum capture set, not a demand for one separate file per row. `Source-covered` is deliberately not a claim of runtime execution. Historical coverage applies only to the observations actually present in the linked file.

| ID / fixture | Input data and sequence | Distinct expected behavior / interactions | Diff affected? | Proof / minimum capture | Real-app drive | Status |
|---|---|---|---|---|---|---|
| F00 — existing backend | Existing live server-runtime tab in thread A; explicit evaluate or open-with-reuse; no detach | `ensureTab` returns cached backend; no new setup, attachment wait or announce | No; upstream short-circuit | recording; optional control, can be folded into F05/F06 | Agent preview calls or automation RPC before reload | Source-covered; pre-reload evaluations in before/ordinary after are historical controls |
| F01 — no desktop channel | Server started without desktop browser channel FDs; server-runtime tab; either headless bit | Immediate false from gate; ordinary server browser page; no announces or desktop wait; no desktop-driven `markHeadless` | No; preserved outer gate | recording; exempt from minimum captures | Isolated server/web startup, then preview open/evaluate and trace | Source-covered; no dedicated linked real-app capture |
| F02 — already headless | Desktop channel available; snapshot `headless:true`; backend must be recreated | Skip wait and announce despite channel availability; stay on server page. Existing `markHeadless` is idempotent; do not steal back a late desktop tab | No; preserved outer gate | recording; optional; fold into F07 | F07 plus a second call demonstrates stable headless routing. A cold reconstruction with an already-headless snapshot is not deterministically exposed by public RPC: the backend is normally cached and a server restart discards manager sessions. Use a service fixture to force that exact gate input | Source-covered; before transcript's later call shows stable headless UA/blank URL, but is not a current retry-timeout test |
| F03 — desktop already attached | Non-headless snapshot; desktop attached before `isAttached`; missing backend or foreground-thread reload | New guard returns true: no announce; attach wait resolves immediately, connect to Electron. A foreground reload does not need an event to discover its visible thread | Yes, new guard; outcome preserved | recording; optional control; F06 sibling/reattach traces may supply it | Leave window on A for reload, or invoke after desktop attached event; log isAttached/await result | Source-covered; before has foreground-reload control; early transcript has two subsequent 0-ms attachment waits. Neither proves a separately correlated guard trace |
| F04 — attach races the publisher/wait | Probe says unattached, attach occurs before first publish or after publish but before await subscription | May emit zero or one initial announce depending on scheduling; attached-set recheck prevents a lost attach and unnecessary full timeout; scope ends the loop | Yes, new probe/fork boundary; existing wait is race-safe | recording if observed; optional boundary fixture; deterministic precise ordering is better proved at channel/service layer | CDP-gated renderer resume plus separate automation RPC can produce the race; linked CDP driver cannot deterministically force this sub-millisecond ordering without additional instrumentation. A lucky timing run must log the actual order | Source-covered; no linked ordered-race capture; not a separate minimum requirement |
| F05 — first announcement reaches ready renderer | A has 3 explicit tabs (`?t=1..3`, `open:false`, `reuseExistingTab:false`); window on B/draft; reload; call after renderer event subscriber is ready | Announce discovers A, thread sync lists its sessions, desktop remounts tabs; target attaches before second tick; Electron UA and original URL; no headless fallback | Yes | recording; **Mandatory, historical capture satisfies core row** | Linux desktop under Xvfb via headless-desktop; CDP reload/navigation, then explicit agent evaluate or automation RPC | **Covered historically** by ordinary after: 927-ms attach, target plus siblings on Electron/original URLs. Before provides contrasting 10-second wait/fallback |
| F06 — renderer misses early announcements | Same A/B fixture; explicit target call lands during renderer reload; receiver absent for first announcement(s), returns before 10 seconds | Repeated announcements at about 1 second recover without another agent open; attach ends retry scope; all 3 tabs remain Electron with original URLs; sibling discovery/attached callbacks share setup correctly | Yes; central retry fix | recording; **Mandatory, historical capture satisfies core row** | CDP reload while an independently scheduled agent call/RPC is about to run; gate renderer startup longer if natural reload is too fast | **Covered historically** by early transcript: call ~4.6 seconds after reload, 8 announcements, 7372-ms attach wait, all 3 Electron/original URLs, no markHeadless |
| F07 — timeout, then late desktop return | Non-headless existing A tab; channel remains available; keep renderer unable to subscribe/attach beyond 10-second wait; resume after fallback | Announces repeat only within wait; false result leads to existing markHeadless and server page. Resume must not make a second native page compete with the headless session; subsequent calls stay on server. Keep logging beyond two scheduled ticks after wait completion | Yes; retry lifetime on negative path | recording; **Mandatory; capture on reviewed head**. Existing main failure is not proof of retry cleanup | Pause/gate the reloaded renderer via CDP while separate agent/RPC drives target; desktop main/server keep running. Resume after trace shows fallback, inspect manager list and UA/URL twice | **MISSING**. Existing fallback test uses a channel double returning false immediately; it does not exercise a real 10-second retry scope |
| F08 — close during recovery wait | Existing A tab is detached; independent call is waiting; close that exact manager session before attach | No successful snapshot publishes after close, no resurrection or surviving page. Missing-session announce errors are ignored until bounded wait ends; pending setup closes its resources and does not publish a live tab. Do not require immediate interruption, which this code does not implement | Yes; new repeated lookup/error interaction | recording; **Mandatory; capture on reviewed head** | Use separate authenticated `preview.close` server RPC while renderer is gated and target call waits. Agent preview_close and t3_preview_close for server-runtime tabs both go through broker resolution and can wait behind the same pending setup, so they are not a reliable close-during-wait trigger | **MISSING** from all transcripts and the new regression test |
| F09 — fresh open emits unchanged resized | New agent tab, no backend/desktop attachment; initial opened event; hold first attach until initial announce, but complete it before second tick | Normal open sends an extra `resized` with existing snapshot and no request; one announcement for this controlled timing, no duplicate tab, navigation preserved. This is conditional: already-attached race can skip it, slow creation can cause more than one | Yes; existing open routes now enter publisher | recording; **Mandatory; capture on reviewed head**, combine payload checks from F12 | Agent preview_open with reuseExistingTab:false/open:false; separate RPC subscribes to preview events before open; CDP/desktop trace correlates create/attach. Existing CDP driver alone does not subscribe to server events | **PARTIAL / MISSING event proof**. Ordinary after shows three announce spans during initial opens but no opened/resized payloads, revision or event-count proof |
| F10 — overlapping callers and other threads | Two calls on same pending tab, optionally viewer attach or open-reuse; sibling tabs in A; unrelated tab in B; explicit IDs and session ownership | One pending creation/publisher per key; correct target only, other thread not reassigned; attach-triggered reconnect shares pending promise. Viewer uses same resulting desktop connection or fallback. No provider-specific branch | Exposed to new events; pending-map/key logic unchanged | recording; optional interaction control. Fold into F06 if convenient; no per-operation/per-provider capture multiplication | Concurrent automation RPC/agent calls and stream viewer connection; CDP window on B; log thread/tab IDs | Source-covered deduplication and scoping; early transcript covers sequential sibling recovery, not concurrent requests or independent-thread preservation |
| F11 — adopted popup / non-server runtime | Adopted popup with real existing page; or explicit desktop/undefined-runtime target | Adoption bypasses desktopRenders and uses adopted page; existing headless marking when appropriate is unchanged. A non-server session does not reach findTab reconstruction; explicit automation target is rejected by existing open logic | No; short-circuit/exclusion | recording; optional baseline control, exempt from minimum | Page window.open from a controlled page; desktop-runtime session via preview.open RPC; explicit automation open-reuse | Source-covered; existing tests cover explicit desktop targets and popup behavior; no linked popup recording |
| F12 — snapshot and consumers | Announce while session has known URL/title/profile/owner/viewport/zoom; optionally adjust/report navigation while wait remains active; web/desktop/mobile subscribe | Event uses current snapshot, not captured old input; preserve snapshot updatedAt and contents at publish, advance event revision and refresh event createdAt (not necessarily a strictly later millisecond). No resize request means no cookie/cache clear or hard reload. Web/mobile upsert snapshot; desktop discovers background A; resized does not select a different active tab in an already-populated web thread | Yes; new method reuses existing event kind | recording for live interaction; **minimum payload assertions in F09**, no separate native-mobile/browser film required. Source reasoning covers unchanged consumer implementations | Record subscribePreviewEvents plus preview.list; use preview.adjust RPC for an optional intervening settings update (client reportStatus cannot overwrite a server-controlled tab); passive remote subscriber can be web/mobile without opening another desktop | Source-covered implementation; **payload recording missing with F09**. New test counts thread events and desktop connections; does not assert these fields |
| F13 — attach succeeds, connection fails / repeated detach | Attach before deadline but endpoint/CDP fails, or desktop later detaches again | Retry scope already ended at wait completion; connect error cleans up/propagates rather than selecting timeout fallback. A later detach drops connection; a later explicit call may begin a fresh bounded attempt | No new error policy; new publisher must share scope | recording; optional lifecycle/error control | CDP close/crash the recreated webview at the connection boundary; another reload for repeat cycle. Exact endpoint-failure boundary needs instrumentation for determinism | Source-covered scope and setup cleanup; no linked ordered-error capture; not a minimum fixture |

## Minimum capture set and provenance

Minimum behavioral set: **F05 + F06 + F07 + F08 + F09**, with F12's payload checks in F09. Existing F05/F06 recordings can be retained after the source-equivalence check above. **Only three additional real-app sequences are required by this audit:** F07, F08 and F09/F12. They may share one isolated app session and transcript with clearly delimited timestamps, provided each starts with the required state and logs sufficient identity/provenance. Optional controls are not additional merge blockers.

Every new recording should identify checked-out commit, dirty-tree status, app/server build roots, isolated T3 home, reload/call/close/resume times, thread/tab/request identities, event sequence/revision, attach/fallback times, tool outcome and final manager list. Retain raw supporting logs; redact credentials and pairing URLs. Use an explicit tab ID so inherited default-selection behavior cannot change the fixture. For the timeout and close rows, preserve the post-completion log interval, rather than merely quoting the last announcement.

| Linked artifact | What it satisfies | What it does not establish | Recapture decision |
|---|---|---|---|
| [Before transcript][before], [ad989057ba][oldbase] | F05 before signature: background reload, first explicit call waits 10000 ms, markHeadless, later headless Chrome/blank URL; siblings survive; foreground-reload control | New retry stop conditions; early-call repeated-announcement fix; close handling; extra event payload | **No mandatory recapture** for this explicit-tab failure assertion: relevant path equals merge-base. If a new paired before is requested, use [73fb49d0b3][base] and reproduce ordinary/early timing with the same driver |
| [Ordinary after transcript][after], [7d3098599f][once] | F05 success when renderer is ready: first announce, 927-ms attachment, correct UA/URLs on 3 tabs; partial F09 initial-open announce spans | Repeating-loop behavior when first event is lost; F07/F08; event payload/count assertions | **No mandatory recapture for F05**, whose successful prefix is still implemented. This send-once revision must never stand in for F06. A current F09 recording is required because this file lacks the protocol observations |
| [Early-call transcript][early], [f490238474][retry] | F06 repeated-announce recovery: 8 roughly spaced publishes, 7372-ms attach, 3 correct Electron/URL results; no markHeadless in the reported trace | Never-attach or close-during-wait cleanup; unchanged event payloads; exact same-tab concurrent operations | **No mandatory recapture for F06** after checking path equivalence. New negative-path and event captures must use [f404c5fb33][head]. A new F06 on head is optional provenance tightening, not a SHA-only blocker |
| [CDP driver][driver] | Means to select the Electron renderer, eval/click/type/reload and timestamp reload; screenshot utility exists but is unnecessary for this fix | It is not a scenario recording or self-contained reproduction: it does not create agents/tabs, synchronize call timing, collect preview events, correlate trace IDs, assert results, or force missed/late attach ordering | No recapture concept for this script. Extend a companion scenario/RPC logger for missing fixtures; keep the actual app/desktop channel in the loop |

The [new regression test][test] supplies behavior-focused automated evidence for late renderer recovery, with a stand-in renderer subscribing after waiting begins and ignoring another event before attaching. The existing headless fallback test covers routing on a false result, not expiration of the new publisher. This pass inspected those tests but did not execute them or independently verify the PR body's claimed main-fail/head-pass runs.

Audit covered the full three-file diff, relevant callers, session mutation/event ordering, attachment channel, desktop discovery/webview host, web/mobile event consumers, existing tests, PR metadata/check/review state, issue, four linked artifacts, and historical/current source equivalence. Finished within the 45-minute budget. No worktree edits, pushes, comments, app launches, test runs or evidence deletion were performed. A helper help invocation briefly entered its Xvfb wrapper and exited; no desktop client was launched.

[repo]: https://git.cafe/pingdotgg/t3code
[pr]: https://git.cafe/pingdotgg/t3code/pull/33666
[issue]: https://git.cafe/pingdotgg/t3code/issues/33649
[branch]: https://git.cafe/pingdotgg/t3code/tree/fix/issue-33649
[head]: https://git.cafe/pingdotgg/t3code/commit/f404c5fb33c683ad9e1a00b5983e88259d91ea68
[base]: https://git.cafe/pingdotgg/t3code/commit/73fb49d0b3a61bff74aebc362fc6c17d6c0d39be
[pushed]: https://git.cafe/pingdotgg/t3code/commit/6fe2b28ccc7ac59ea714d6051f2e1363d7cd7476
[oldbase]: https://git.cafe/pingdotgg/t3code/commit/ad989057ba3b9298d40969689229f4feef1c9872
[once]: https://git.cafe/pingdotgg/t3code/commit/7d3098599faa7677f4d89e3e040b7f506608e149
[retry]: https://git.cafe/pingdotgg/t3code/commit/f49023847418568579e01205a490794c20f5cd7d
[gate]: https://git.cafe/pingdotgg/t3code/blob/6fe2b28ccc7ac59ea714d6051f2e1363d7cd7476/apps/server/src/preview/ServerBrowser.ts#L766
[setup]: https://git.cafe/pingdotgg/t3code/blob/6fe2b28ccc7ac59ea714d6051f2e1363d7cd7476/apps/server/src/preview/ServerBrowser.ts#L816
[await]: https://git.cafe/pingdotgg/t3code/blob/6fe2b28ccc7ac59ea714d6051f2e1363d7cd7476/apps/server/src/preview/DesktopBrowserChannel.ts#L208
[announce]: https://git.cafe/pingdotgg/t3code/blob/6fe2b28ccc7ac59ea714d6051f2e1363d7cd7476/apps/server/src/preview/Manager.ts#L305
[test]: https://git.cafe/pingdotgg/t3code/blob/6fe2b28ccc7ac59ea714d6051f2e1363d7cd7476/apps/server/src/preview/ServerBrowser.test.ts#L658
[before]: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2f68e0afc9c51f8c/repro-transcript-main.txt
[after]: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/629e953b113e4d80/repro-transcript-fix.txt
[early]: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f1c79a6f7d3c0ab2/repro-transcript-fix-early-call.txt
[driver]: https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/62e4179d0b4dc80e/repro-cdp-driver.mjs

FRICTION:
- tool | Web reader could not access the four attachments; Python urllib received HTTP 403. curl with a browser user-agent fetched all four successfully. | A documented curl download command or directly available raw artifact copies would avoid the fetch detour.
- tool | headless-desktop has no --help handling and interpreted that argument as the command to execute; its wrapper exited with status 2. Source inspection established the intended Xvfb usage. | Document that it takes a command, or implement a non-launching help flag.

VERDICT: INSUFFICIENT F07, F08, F09/F12