# Proof audit pass 1

Verdict: proof incomplete. The server-only/no-visible-surface exception does not apply: saving visibly changes controls, and the reproduced failure closes the dialog and disconnects the client. No rendering source changed, but the behavior has a visible surface. This is a proof-only assessment, not a replacement for the two supplied MERGE code reviews.

PR: [#18129](https://git.cafe/pingdotgg/t3code/pulls/18129).
Final HEAD: [adf0b49ede](https://git.cafe/pingdotgg/t3code/commit/adf0b49ede31d6f29354ae78df7eed90e7a9ee04).
Compared against local origin/main [defb7e6e6b](https://git.cafe/pingdotgg/t3code/commit/defb7e6e6b87d03259745367214db13060fb322b), using the merge-base diff. Main was merged into the branch; this is not evidence the PR landed. No fetch/live forge-state read performed.

Final diff: RpcAuthorization.ts and RpcAuthorization.test.ts only (33 additions, 1 deletion). Validate the already-decoded SettingsUpdate type; one RpcTest regression supplies a Duration with settings-write scope. Both files are unchanged from runtime-tested candidate [a1adf8aac9](https://git.cafe/pingdotgg/t3code/commit/a1adf8aac9). git diff --check passed. Checkout remained clean.

## Fixture matrix

Use one selected writable environment, isolated settings, balanced initial profile, connected client. Widths are CSS pixels; document height and scroll where necessary. Each row requires a matched baseline/candidate pair. Current status describes supplied evidence, not a new product failure.

| ID | Surface/state | Width | Theme | Status |
|---|---|---:|---|---|
| G-1440-light | General profile summary after custom override | 1440 | light | Missing matched before/after pair |
| G-1440-dark | General profile summary after custom override | 1440 | dark | Missing matched before/after pair |
| G-390-light | General profile summary after custom override | 390 | light | Missing matched before/after pair |
| G-390-dark | General profile summary after custom override | 390 | dark | Missing matched before/after pair |
| A-1440-light | Advanced dialog: lock pause off, idle interval 120 seconds | 1440 | light | Missing matched before/after pair |
| A-1440-dark | Advanced dialog: lock pause off, idle interval 120 seconds | 1440 | dark | Missing matched before/after pair |
| A-390-light | Advanced dialog: lock pause off, idle interval 120 seconds | 390 | light | Missing matched before/after pair |
| A-390-dark | Advanced dialog: lock pause off, idle interval 120 seconds | 390 | dark | Missing matched before/after pair |
| S-1440-light | Source control: Git fetch interval 60 seconds | 1440 | light | Missing matched before/after pair |
| S-1440-dark | Source control: Git fetch interval 60 seconds | 1440 | dark | Missing matched before/after pair |
| S-390-light | Source control: Git fetch interval 60 seconds | 390 | light | Missing matched before/after pair |
| S-390-dark | Source control: Git fetch interval 60 seconds | 390 | dark | Missing matched before/after pair |
| P-1440-light | Providers Advanced: health interval 60 seconds | 1440 | light | Missing matched before/after pair |
| P-1440-dark | Providers Advanced: health interval 60 seconds | 1440 | dark | Missing matched before/after pair |
| P-390-light | Providers Advanced: health interval 60 seconds | 390 | light | Missing matched before/after pair |
| P-390-dark | Providers Advanced: health interval 60 seconds | 390 | dark | Missing matched before/after pair |

## Interaction rows: recordings

Record each flow continuously, including baseline failure where applicable and candidate success. Stills cannot establish dialog/connection continuity. Settings autosave; Done only closes the dialog. Do not claim continuity for an unobserved fixed duration.

| ID | Flow and expected candidate result | Width | Theme | Status |
|---|---|---:|---|---|
| T-1440-light | Open Advanced; lock pause off/on/off; dialog stays open and client connected; Done/reopen/reload retain off | 1440 | light | Missing recording |
| T-1440-dark | Open Advanced; lock pause off/on/off; dialog stays open and client connected; Done/reopen/reload retain off | 1440 | dark | Missing recording |
| T-390-light | Open Advanced; lock pause off/on/off; dialog stays open and client connected; Done/reopen/reload retain off | 390 | light | Missing recording |
| T-390-dark | Open Advanced; lock pause off/on/off; dialog stays open and client connected; Done/reopen/reload retain off | 390 | dark | Missing recording |
| D-1440-light | Edit all four visible duration fields; change shared policy with overrides; verify persistence; Reset all restores defaults without disconnect | 1440 | light | Missing recording |
| D-1440-dark | Edit all four visible duration fields; change shared policy with overrides; verify persistence; Reset all restores defaults without disconnect | 1440 | dark | Missing recording |
| D-390-light | Edit all four visible duration fields; change shared policy with overrides; verify persistence; Reset all restores defaults without disconnect | 390 | light | Missing recording |
| D-390-dark | Edit all four visible duration fields; change shared policy with overrides; verify persistence; Reset all restores defaults without disconnect | 390 | dark | Missing recording |
| F-1440-light | Source control: set Git fetch interval to 60 seconds; reopen/reload; reset to preset without disconnect | 1440 | light | Missing recording |
| F-1440-dark | Source control: set Git fetch interval to 60 seconds; reopen/reload; reset to preset without disconnect | 1440 | dark | Missing recording |
| F-390-light | Source control: set Git fetch interval to 60 seconds; reopen/reload; reset to preset without disconnect | 390 | light | Missing recording |
| F-390-dark | Source control: set Git fetch interval to 60 seconds; reopen/reload; reset to preset without disconnect | 390 | dark | Missing recording |
| H-1440-light | Providers Advanced: set health interval to 60 seconds; reopen/reload; reset to preset without disconnect | 1440 | light | Missing recording |
| H-1440-dark | Providers Advanced: set health interval to 60 seconds; reopen/reload; reset to preset without disconnect | 1440 | dark | Missing recording |
| H-390-light | Providers Advanced: set health interval to 60 seconds; reopen/reload; reset to preset without disconnect | 390 | light | Missing recording |
| H-390-dark | Providers Advanced: set health interval to 60 seconds; reopen/reload; reset to preset without disconnect | 390 | dark | Missing recording |

## Scope decisions

- Web: General, Advanced, Source control, Providers are separate entry points sharing the affected RPC. 390 is responsive web, not native mobile.
- Desktop: same web settings. Reuse visual fixtures; one save/reopen continuity smoke is useful supplementary coverage. No Electron/IPC change.
- Native mobile: no background activity/interval editing controls found in settings routes. No invented capture row; server authorization still applies to mobile settings RPC.
- Providers: health interval is shared configuration; no per-adapter fixture expansion.
- Connection modes: common server RPC fix; no origin/transport changes. Label captured connection mode. One WebSocket check does not independently verify local, relay, and tunnel deployments.
- Permissions: existing focused authorization suite remains relevant. No new permission, contract, provider adapter, scheduler, MCP, command palette, or keybinding implementation changed. Settings search/navigation reaches the same controls.
- Reverse states: toggle back, per-interval reset, Reset all, reopen/reload included.

## Existing minimal evidence

1. [Baseline runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/40e45a1887d7d698/before-runtime.txt) identifies [49e97d48f9](https://git.cafe/pingdotgg/t3code/commit/49e97d48f9742ba4c5ab79efc618fbf9066523ec): balanced read; update Defect/SchemaError Expected number at automaticGitFetchInterval; read remains balanced.
2. /tmp/issue-17233-evidence/after-runtime.txt identifies candidate a1adf8aac9: balanced read; update Success; subsequent read returns custom/base balanced, hostPowerMonitorIdleInterval 120000 and pauseWhenHostLocked false. This proves subsequent RPC readback, not restart durability.
3. Saved scripts /tmp/17233-runtime-proof.mjs and /tmp/17233-runtime-after.mjs contain identical update payloads: five duration fields and four booleans. Successful output omits preset-equivalent overrides, consistent with normalization. Keep sanitized request provenance with transcripts; do not upload scripts with connection credentials.
4. green-tests.txt reports one file / 17 tests passing, exit 0, but names neither file nor SHA. Regression source exists. No baseline red-test transcript was supplied/found in the evidence directory. This audit did not run tests.
5. Existing baseline images are 1280×800 light, not requested 1440/390 coverage. No candidate still or interaction recording supplied.

Baseline: Advanced dialog before toggle.

![Baseline Advanced dialog, 1280×800 light](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4405e4e8b0f200f4/before-advanced-dialog.png)

Baseline: disconnected result.

![Baseline disconnected result after settings update, 1280×800 light](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2b87d0f94d927b08/before-disconnected.png)

Minimum additional causal proof: baseline focused red output and final-HEAD green output with command/SHA; one final-HEAD continuous toggle/save/reopen/reload recording; retain same-request runtime provenance. This establishes core behavior but does not complete the requested 32-row matrix.

No server/browser launch, captures, checkout edits, pushes, or comments in this pass. Only this temporary report/requested upload and app-owned PR registration were created. The full original proof-audit brief was not supplied separately; fixture requirements above follow the task message.

## FRICTION category|what|prevention

scope|Server-only paths can be mistaken for no visible surface|Classify by observable behavior before applying exception.
provenance|Runtime predates final merge; green output lacks file/SHA|Stamp proof with full HEAD, command and sanitized request; collect after integration.
coverage|Only 1280×800 light baseline stills; no candidate/recording|Derive fixture rows before capture; never relabel unmatched assets.
proof|No supplied baseline red-test transcript|Retain the focused failing run before fixing.