main: github/main 71646e031a; dev web 8693, server 16733; fresh .t3 state.
UI created project /home/user/t3code and Codex gpt-6.1-sol thread.
request_secret(delivery=file): real pending card, CSS disc masking, no Show secret control.
Saved disposable verification value: 31 characters; provider independently reported SHA-256 bb03c4b1b75822bc8577b42bb3d26c56fde13cfe5b77429a0f25f431117ee9be.
Second request declined through card; provider returned VERIFICATION COMPLETE.
main stopped before PR verification.
PR exact HEAD: 779ec9820d07a8acb425ac51a5e328bedbceefae.
blacksmith-check: vp run check:changed fa31b66bbb2ae5234205a8628a78e038d917202f passed format, lint, knip, web/mobile/scripts typechecks, 7 focused React Compiler tests.
PR: dev web 5733, server 13773; fresh .t3 state, UI-created project and Codex gpt-6.1-sol thread; same prompt and disposable token as main.
Default input type=password; Show secret aria-pressed=false; aria-controls matches input id.
Click Show: type=text, aria-pressed=true, value unchanged. Space on Hide: type=password, value unchanged, zero form submits.
At 390x844: card width=366, document scrollWidth=390; input, Show and Save fit.
Enter on revealed field: saved successfully; Codex shell read private file, reported length=31 and matching SHA-256 bb03c4b1b75822bc8577b42bb3d26c56fde13cfe5b77429a0f25f431117ee9be.
Next request: empty, type=password; Save disabled for empty/whitespace; reload retains pending card and starts masked.
Show/Hide works on next request. Decline while revealed: toggle disabled observed true then false; value never appears in chat; card becomes Declined; provider replies VERIFICATION COMPLETE.
Native mobile, packaged Electron, screen readers, password managers, remote/tunnel and other providers not exercised on this Linux VM.