PR #28386 real dev verification, Linux, 2026-11-01
main: 8b74a69019 (github/main)
head: f043fb6def45f54aa4cf8f59c0ed32c293c7d7ba

Startup:
  git worktree add ../main github/main
  (cd ../main && timeout 600 vp i)
  T3CODE_DEV_SEED=0 setsid nohup vp run dev > /tmp/main-dev.log 2>&1 &
  main: web 8693, server 16733, isolated /home/user/main/.t3
  stopped main by its captured process-group PID 27666 before starting PR
  git switch -c fix/audit-m048 f043fb6def45f54aa4cf8f59c0ed32c293c7d7ba
  timeout 600 vp i
  T3CODE_HOME=/home/user/t3code/.t3 T3CODE_DEV_SEED=0 setsid nohup vp run dev > /tmp/dev.log 2>&1 &
  PR: web 5733, server 13773, isolated /home/user/t3code/.t3

Client/provider:
  repo-dependency Playwright 1.60.0, executable /usr/bin/google-chrome
  created project through Add project > Local folder > /home/user/t3code
  two threads per checkout, created through the web composer
  Codex gpt-6.1-sol, Low, real local proxy
  prompts: Reply exactly PANEL-A-READY / PANEL-B-READY. Do not use tools or change files.
  all four real turns completed with the requested responses
  opened Diff and Browser through actual panel controls
  navigated browser to the local dev app and clicked Float preview over chat
  no mocked provider, fixture data, injected store state, or direct DB writes

Observation (read-only):
  JSON.parse(localStorage.getItem("t3code:right-panel-state:v2")).state
  JSON.parse(localStorage.getItem("t3code:diff-panel-state:v1")).state
  (await import("/src/previewMiniPlayerStore.ts")).usePreviewMiniPlayerStore.getState().byThreadKey

main live delete A, header thread menu > Delete > Confirm:
  before {"right":true,"diff":true,"baseRef":true,"mini":true}
  after  {"right":true,"diff":true,"baseRef":true,"mini":true}
  BUG REPRODUCED: all entries retained after thread disappears

PR cancel deletion:
  all stores unchanged: true

PR live delete A, same UI flow:
  before {"right":true,"diff":true,"baseRef":true,"mini":true}
  after  {"right":false,"diff":false,"baseRef":false,"mini":false}
  B right-panel unchanged: true
  B diff unchanged: true
  B baseRef unchanged: true

PR archive B, Settings > Archive > Unarchive:
  archive keeps all stores: true
  unarchive keeps all stores: true

PR archived delete B, Settings > Archive > right-click B > Delete > Confirm:
  before {"right":true,"diff":true,"baseRef":true,"mini":true}
  after  {"right":false,"diff":false,"baseRef":false,"mini":false}

Reload after both deletions:
  {"right":{"byThreadKey":{},"threadPanelVisibilityByThreadKey":{}},"diff":{"byThreadKey":{},"branchBaseRefByThreadKey":{}},"mini":{}}

Blacksmith checks on the exact PR head:
  cd apps/web && vp test run src/hooks/useThreadActions.permissions.test.ts
    PASS 36/36
  vp run check:changed 54c5f25249961a1aa0b61932329092eadbd9d6fc
    PASS format, lint, knip x2, typecheck (web and scripts), 63 tests, compiler check
  the remote source snapshot needed a depth-2 fetch to restore merge-base history
  GitCafe reported 31 successful CI checks, 0 pending, 0 failing

Unverified:
  native desktop shell and iOS/Android clients (Linux web verification only)
  multi-select deletion, remote/relay/tunnel and second-client permission revocation
  device-backed mini-player (browser-backed mini-player exercised)
  deletes initiated by another client, MCP, side chat, or project force-removal are explicitly outside this PR scope

Result: VERIFIED AS-IS. No source edits, commits, or pushes.