# Proof audit pass 1 — fixture matrix

Scope: /home/ubuntu/wt/issue-16179, base bb7783e295, head 459dcae8b94d3df5641df217635e3ec4e57ecb6f. Read-only source audit; evidence specification, NOT a record of executed verification. No PR. Lead owns existing localhost:7478 app. No browser, server, capture, code edit, push, comment, or merge performed by this reviewer. Artifact lives outside checkout.

## Derived change surface

Only apps/web/src/components/usage/UsagePage.tsx changes:
- Wide header at lines 416–434: conditionally unmount Usage period ToggleGroup on Limits, replacing disabled control.
- Compact header at lines 469–494: conditionally unmount Usage period Select on Limits, replacing disabled control.
- Selected-environment Limits body at lines 521–547: explanatory paragraph inserted above existing UsageLimitsSection.

Callers: routes/usage.tsx mounts this page at authenticated /usage. SidebarChrome handleUsageClick and CommandPalette usage.open converge there; navigation shortcut also reaches that route. Keybindings Settings configures the same usage metric/period commands, not a separate renderer. WorkspacePageHeader adds Electron drag/native-control layout. Header uses @4xl/usage-header container breakpoint (not viewport); date range uses @7xl. Verify the active control family rather than assuming 1440 always means wide. UsageLimitsSection filters presentations and delegates to UsageLimitsPooled; its cards/notices/Cursor prompt/external links are unchanged. Native mobile UsageRouteScreen already places period control only in the non-Limits branch: excluded. Composer limit popovers, providers, wire contracts, server behavior and scheduled tasks are unchanged.

## Evidence rules

Affected = A (direct diff), adjacent = R (regression guard). All pending for pass 2.
Core grid G = 1440×900 light, 1440×900 dark, 390×844 light, 390×844 dark, browser zoom 100%, same sidebar state and fixture. Capture entire viewport with header and first body content. 390 is responsive WEB, not native mobile. Use actual light/dark settings, not color inversion. Record viewport, theme, selected environment/provider, metric/window and head with filenames or evidence index. Redact private account labels before public upload.

Minimum static evidence: rows 1–3 each in G (12 after screenshots); row 1 also before at base in G (4 before screenshots), with same fixture/sidebar. Label Before/After. Minimum interaction evidence: one short recording per G configuration (4 recordings), combining rows 4–6. A still is insufficient for state transitions, refresh completion or keyboard behavior. Extra conditional rows use the representative configurations specified below; do not cross-product all provider internals.

| ID | Affected | Fixture / relevant state and path | Expected proof | Evidence required |
|---|---|---|---|---|
| 1 | A: both header branches + paragraph | Limits, ≥1 selected connected environment, ≥1 genuine live-limit pool. At 1440 arrange normal sidebar so wide ToggleGroup family is active; at 390 compact Select family. | No Usage period control or dead gap; metric and refresh remain usable; explanation appears once above limits, readable contrast and wrapping without horizontal overflow; no historical date label. Existing cards remain visible. | Before/after screenshots in G. Baseline has disabled period and no explanation. |
| 2 | A/R: wide and compact false branches | Cost with nonzero historical data, 7 days. | Period remains visible/enabled and shows 7 days; no Limits paragraph; cost content and refresh fit. Wide date label only if @7xl container condition is met. | After screenshot in G. Can be a settled endpoint of recording, but deliver screenshot separately. |
| 3 | A/R: same false branches, second metric | Tokens with nonzero historical data, Past 24h. | Period remains visible/enabled with Past 24h; no Limits paragraph; hourly token content renders. | After screenshot in G. |
| 4 | A/R: mount/unmount + retained state | Cost → choose 7 days → Limits → Tokens → Cost; inspect each period option (Past 24h, 7, 30, 90 days), choose 90 → Limits → back; reload once on Limits then return to history. | Period disappears only on Limits, returns with previous selection; Limits explanation appears/disappears correctly; all four options reachable; metric and window preferences survive reload; no popup left floating or stale selected value. | RECORDING in G, can share clip with 5–6. Show compact metric and period popup open at 390, toggles at wide. |
| 5 | A/R: keyboard/focus interaction | Keyboard navigate metric/period/refresh; use actual configured usage.cost/tokens/limits and period shortcuts. Select 7 days, enter Limits, send period-day shortcut, return to Cost. | Hidden period absent from tab sequence/accessibility tree; refresh reachable, no focus trap; period shortcut on Limits does not mutate retained 7 days; metric shortcut restores control. Popup/dialog shortcut suppression remains intact (one representative check). | RECORDING in G; supplement with DOM/accessibility assertion for absence of Usage period (not merely disabled/visually hidden). Use resolved keybindings, do not assume default keys. |
| 6 | R: time/refresh during changed layout | On Limits click Refresh limits and await actual completion, then Cost refresh. Include automatic entry refresh if observable. | Explanation and absent period stable throughout; busy refresh disables then recovers; history still has period. No double-submit or header shift/overflow. Do not demand data values change if provider reports same snapshot. | RECORDING in G, combine with 4–5. If backend finishes too fast to show busy state, log observed outcome; do not manufacture latency with sleeps or edit provider state. |
| 7 | A: paragraph's outer guard | Limits, deselect all environments in environment menu; then restore selection. Also no configured environments if available via safe isolated fixture. | With configured-but-unselected: “Select an environment to see limits.” With none configured: “Connect an environment to see limits.” Explanation absent in both; period remains absent; restoring selection restores explanation. | Representative 390 light screenshot of deselected state + short RECORDING of deselect/restore (may append G clip); no-config branch source-confirmed if unavailable, explicitly mark uncaptured. |
| 8 | A: paragraph over empty child | Limits, selected environment, hide all providers using filter (or genuine environment with no limits and no external links/notices/Cursor prompt). | Explanation remains above “No provider on the selected environments reports subscription limits.” Header period absent; no collision or excessive layout gap. | 390 dark screenshot; filter/restore RECORDING can append row 4. Provider filtering is reversible. |
| 9 | A: paragraph over varied child content | Selected environment with a genuine provider notice, external usage link, or Cursor enable prompt if existing fixture supplies it. | Explanation remains separate/readable above existing content, including wrapped copy at 390; prompt/link not obscured. No new paragraph for historical metrics. | Representative 390 light screenshot if available. Do not enable keychain or create accounts just to populate this small change; mark unavailable variant/source-only. No need every provider × theme. |
| 10 | A/R: responsive boundary and desktop shell | Resize around actual @4xl header container threshold on Limits and Cost; compare sidebar expanded/collapsed. Desktop uses same page with Electron titlebar insets. | Exactly one metric/refresh family visible; period zero on Limits, one on Cost; controls do not clip at boundary or native controls. New paragraph wraps cleanly. | Short RECORDING crossing boundary, either theme; desktop representative 1440 screenshot if native client is already available, otherwise disclose web-only evidence. No new desktop server required. |
| 11 | R: entry points / connection modes | Reach /usage via sidebar, palette, configured usage.open shortcut; remote/relay client reuses same render path. | Same saved metric/window and paragraph visibility from each entry; no alternate renderer missed. | Fold navigation into one existing recording; source audit is sufficient for remote transport because no request/schema/origin changes. Do not provision relay/tunnel for this patch. |

## Real app seeding and provenance

Lead should document what localhost:7478 is actually connected to, its worktree/head, and isolated T3 home. This audit has NOT inspected the running app or asserted its data is seeded. Reuse the lead's already-running app; do not stop it to reseed. If it lacks suitable fixtures, coordinate with lead rather than starting another server.

For a future clean run, with the dev server stopped, repo-supported `vp run migrate-dev-db` makes a read-only snapshot of ~/.t3/userdata/statev2.sqlite into worktree .t3/userdata/statev2.sqlite, retaining recent stopped project/thread history and removing pending work/tasks/auth. Never run against live userdata, never symlink it. That database alone is NOT proof of populated Usage: historical totals come from provider transcript scanning/usage cache through usageSummary; live Limits come from environment provider presentations/account limit sources. Use an existing authenticated environment with diagnostics-read access, genuine provider history and current limit data; report provider source and whether values are live, cached, empty or unavailable. Copy secrets/settings only when required and never publish them. No need to create a billable turn for this UI patch. Preferences are browser-local (t3code:usage-page-preferences:v1), default Limits/30 days; set fixtures through UI and record saved starting state. No fake DOM text, screenshot-only mocks or patched RPC responses passed off as real app data.

## Pass 2 handoff and FRICTION

Pass 1 source coverage is complete; delivered visual evidence remains unverified/pending. Pass 2 must map actual artifact URLs to these row IDs, check head/fixture provenance, inspect the 4 size/theme combinations, and watch recordings rather than accepting still frames for interaction/time rows.

FRICTION:
- App seed/head/auth/data availability deliberately unverified: reviewer was forbidden browser/capture/server actions. Lead must supply provenance and real evidence.
- 1440 viewport alone does not establish wide render path: header container width and sidebar determine @4xl; record actual family. Add boundary clip rather than a large breakpoint matrix.
- Native desktop, no-config environment, notice/Cursor/link variants may not be available in current seed. Disclose gaps, source-confirm unchanged child paths, and avoid provisioning accounts or broad fixture machinery for this change.
- A database snapshot cannot create real subscription limits or transcript totals. Empty data is useful for row 8 but cannot replace row 1's populated fixture or rows 2–3 historical data.
- No source-level correctness defect found in this narrow change. This is not visual sign-off or a claim that runtime checks passed.