# Proof audit 1: desktop teardown input

Reviewed [#33620](https://git.cafe/pingdotgg/t3code/pull/33620) at [a103cf6](https://github.com/pingdotgg/t3code/commit/a103cf6dffc5c06d386282ba3dd794ce43dac0be), against merge-base [bbdc7dc](https://github.com/pingdotgg/t3code/commit/bbdc7dca320ee4fbc7131498aaffef2fa1eb3d41). Issue: [#33614](https://git.cafe/pingdotgg/t3code/issues/33614). Read-only source and evidence audit; no app, browser, or tests were launched by this auditor.

## Findings

1. **Existing proof is incomplete for the requested real-app gate.** The PR description contains an inline runtime transcript and the complete synthetic probe, rather than a linked recording or standalone real-app transcript. That probe creates a fresh hidden Electron BrowserWindow and installs a replacement listener. It demonstrates Electron's destroyed-window getter failure and the guard's mechanism, but never loads T3 Code, its actual DesktopWindow listener, its quit handler, or its shutdown lifecycle. Its stack is in the probe, not the app.
2. **The sibling listener has unit proof but no runtime proof.** The new regression test drives the actual registered callbacks with a fake destroyed window whose webContents getter throws. It covers a Q key-up and gestureScrollEnd. The description reports failure on main, failure with only the first guard, and 28 passing tests after both guards. The synthetic Electron probe covers only before-input-event. It does not cover gestureScrollBegin or gestureScrollEnd.
3. **Linux can exercise the same hold-to-quit logic.** Both DesktopWindow and QuitHold select Meta on darwin and Control elsewhere. Linux Ctrl+Q reaches the same registered before-input-event callback, settings read, repeat threshold, quit-on-release flag, and quiet-period timer. It is a valid real-app runtime target. It does not reproduce macOS keyboard delivery semantics merely by using Control. Linux opacity differs and is irrelevant to this fix.
4. **No render surface changed.** The production diff is two early returns. Screenshots, responsive layouts, themes, populated databases, provider permutations, and web/mobile captures do not prove this behavior. Required proof is chronological runtime evidence: event sequence, real window destruction, exceptions, and shutdown result. macOS is explicitly `cannot-verify macos` in this VM and is not silently counted as covered.

## Scope derived from code

The listeners are installed once per main window by [DesktopWindow.createWindow](https://github.com/pingdotgg/t3code/blob/a103cf6dffc5c06d386282ba3dd794ce43dac0be/apps/desktop/src/window/DesktopWindow.ts#L378). All main creation paths converge there: createMain/ensureMain; backend-ready/startup; activation/reopening; and menu/snapshot dispatch when a main window must be created. App activation is also reached through lifecycle, web links, and snapshot actions. Existing windows retain the same listeners. The separately created WSL connecting splash, preview guests, popup context-menu windows, and detached DevTools do not receive these changed registrations.

The changed [before-input-event callback](https://github.com/pingdotgg/t3code/blob/a103cf6dffc5c06d386282ba3dd794ce43dac0be/apps/desktop/src/window/DesktopWindow.ts#L678) always calls quitShortcutHandler first. On a live window, it then toggles menu shortcut interception for unmodified Cmd/Ctrl+W and prevents repeated W keydowns. On a destroyed window, the new guard skips all window member access after the quit handler. [QuitHold](https://github.com/pingdotgg/t3code/blob/a103cf6dffc5c06d386282ba3dd794ce43dac0be/apps/desktop/src/window/QuitHold.ts#L40) branches on platform, keyDown/keyUp, Q/modifier/other keys, repeats, modifier flags, settings modes hold/direct/double-click, asynchronous settings resolution, hold duration (1200 ms), quick second press (500 ms), and quiet period (at least 600 ms, extended for slow repeats). Those unchanged modes share the new guard; they do not require separate visual fixtures.

The changed [input-event callback](https://github.com/pingdotgg/t3code/blob/a103cf6dffc5c06d386282ba3dd794ce43dac0be/apps/desktop/src/window/DesktopWindow.ts#L695) sends trackpad begin/end IPC on a live window, ignores other input types, and now returns for every input type after destruction. Existing consumers include history swipe navigation and device-viewer orbit handling; their rendered UI is unchanged. No new RPC, contract, provider, remote connection, permission, or agent-tool behavior exists in this diff.

## Fixture / proof matrix

Every interaction/time row is marked **recording**. For this main-process change, a chronological terminal transcript with input/event instrumentation is an acceptable recording; stills alone are insufficient. Status describes evidence currently in the PR description, not evidence generated by this audit.

| Row | Named fixture and input | Diff affected? | Proof form / observable result | How to seed or drive | Existing status |
| --- | --- | --- | --- | --- | --- |
| R1 | Real Linux T3 app, Confirm quit = Hold; Ctrl+Q initial down, repeats beyond 1200 ms, then Q release; also quiet-period expiry before trailing Q release | Yes: actual route to teardown in before-input-event | **recording**: real-app terminal transcript or video plus main-process log. Show shortcut received, mode resolved, hold armed, quit via release or timer, process exit/error-dialog state. A successful quit without proof of a late callback is a smoke check, not regression reproduction. Compare base/head where timing reproduces; use R2 for deterministic differential if natural timing does not reproduce. | Run actual base/head desktop builds under headless-desktop/Xvfb using distinct isolated state directories. Set the desktop Quit shortcut behavior to Hold or seed its isolated client-settings.json with confirmQuit=hold before launch. Focus the main window and deliver native Ctrl/Q down/repeats/up; log timing and shutdown. No project/thread data required. | **MISSING**: PR probe does not launch T3 or hold a shortcut. Linux reachability is established by source only. |
| R2 | Actual registered before-input-event listener, main window destroyed, trailing Q keyUp; optional modifier keyUp/ordinary key control | Yes: first added guard | **recording**: deterministic base/head main-process transcript. Base throws Object has been destroyed at the app's setIgnoreMenuShortcuts access; head still invokes quit handling but avoids destroyed-window access and completes without that exception. | **Labelled real-app harness capture** if natural delivery cannot force this timing: attach a main-process driver to the real T3 app, retain the main window's WebContents/listener before destruction, destroy the window, then force the late event/callback. Identify forced dispatch and any paused exit explicitly. Invoke the app's installed callback, never copy its implementation into a new listener. | **PARTIAL**: unit test covers fake-window Q keyUp; synthetic Electron transcript demonstrates getter failure with a replacement listener. No real-app callback/runtime capture. |
| R3 | Actual registered input-event listener after main-window destruction; gestureScrollBegin and gestureScrollEnd | Yes: second added guard; both send branches | **recording**: base/head main-process transcript. Both inputs throw on base when accessing the destroyed window; head ignores both, sends no IPC, and does not throw. | **Labelled real-app harness capture**: retain the actual listener/WebContents before destruction as in R2, then inject both gesture event types. Do not require physical trackpad hardware in Xvfb. | **PARTIAL**: unit test covers fake-window gestureScrollEnd only. No runtime probe for this listener; begin branch is supported by guard placement, not a capture. |
| R4 | Live main-window keyboard controls: Ctrl+W initial down/repeat/up; plain W, other key, Alt/Shift-modified W; normal shortcut dispatch with DevTools focus as applicable | No changed live behavior; guard-false control | **recording** or focused behavior-test transcript: setIgnoreMenuShortcuts true only for the matching W modifier; only repeated matching W keydown is prevented; initial W reaches renderer; other/native shortcuts remain usable. | Same isolated app. One tab/terminal is enough if demonstrating close behavior. Existing unit fixture directly drives callback and inspects prevention/menu interception; this is appropriate supporting proof. DevTools focus can be a smoke control, not a new viewport fixture. | **PARTIAL SUPPORTING PROOF**: existing DesktopWindow test checks Cmd+W repeat/initial, absent modifier, and non-W menu reset; no runtime capture. Not a separate required visual gate. |
| R5 | Live main window: gestureScrollBegin, gestureScrollEnd, unrelated input-event type | No changed live behavior; guard-false and no-op controls | **recording** or focused behavior-test transcript: begin/end still send their respective IPC channels, unrelated type sends neither; no exception. | Same R3 real-app harness before destruction, observing actual outgoing sends or preload subscriptions. A physical gesture or history navigation UI is unnecessary for testing this guard. | **NOT SHOWN** in PR body. Can be folded into R3 as its live control; no separate UI capture required. |
| R6 | macOS real desktop, Confirm quit = Hold, held Cmd+Q with trailing Q up during destruction | Yes: original reported platform and timing | **recording** plus main-process log on macOS, if available; show same pre-fix exception / post-fix absence. Linux evidence must retain its Linux label. | Native macOS T3 app and Cmd+Q input. This VM cannot seed the macOS platform or its native keyboard semantics. | **CANNOT-VERIFY MACOS**, already disclosed by PR. Linux R1/R2 substitute for mechanism/path proof, not native macOS timing proof. |

## Minimum additional capture set

- **Viewport × theme × row:** one ordinary desktop size and one theme suffice; dimensions/theme do not affect the guarded main-process branches. No before/after stills needed.
- **One paired base/head real-app runtime transcript** can combine R2 and R3, with R4/R5 live controls before destruction. It must identify commit, Electron/OS, actual T3 entry point, event sequence, forced-dispatch method, destruction state, pre-fix exceptions, post-fix results, and final process outcome. Log each case independently so the first base exception does not prevent the second listener from being exercised. Mark injected late events as harness evidence.
- **One head real-app hold-to-quit transcript** for R1, preferably including both release and quiet-period routes in fresh app runs. Preserve uncertainty if the natural teardown race does not reproduce. A video may supplement it but cannot replace the main-process evidence. macOS remains the explicitly labelled limitation R6.
- Existing PR unit evidence is useful and should remain. A synthetic replacement listener is not a substitute for the app runtime rows. No need to multiply captures by direct/double-click, loading/error, local/remote backend, provider, theme, width, or project count: those do not alter the new predicates.

At audit time GitCafe reported the requested head, 41 successful checks, no pending/failing checks, a Macroscope approval and no actionable CodeRabbit findings. These support code health but do not fill the runtime proof gaps. No independent test rerun was needed to derive this matrix.

FRICTION: none

VERDICT: INSUFFICIENT R1 real-app hold-to-quit, R2 actual-listener runtime differential, R3 actual input-event runtime differential