PR #24706 verification on Linux Boat VM, 2026-10-30
main: 6575ce3250; PR: 18f4de3e6f3f44477d986fcc009ce01cb8eaa156
Installed dependencies with vp i in /home/user/main and /home/user/t3code.
Ran one background vp run dev at a time, isolated .t3 state and real Chrome/Playwright.
Real Gitea 1.25.1, HTTPS localhost:3443, private repository, tea 0.16.0 login.
Project and Codex gpt-6.1-sol thread created through the web client on each head.
PR-head provider read README.md using a tool and returned its heading in the client.
Main: description, list and comment each rendered Image unavailable.
PR: all three private images loaded via signed /api/assets URLs; previews open/close.
Anonymous private attachment GET -> 404.
Signed asset GET -> 200 image/png, 110287 bytes, identical to uploaded screenshot.
SHA256 2668f97880f6be674b1ec365a54e7c4da5ce727915d997c5919455abffa4bcf5
Range bytes=0-31 -> 206, Content-Range bytes 0-31/110287, 32 bytes.
Literal code preserved relative markdown. Attachment link resolves to the Gitea origin.
Normal repository link preserves its original destination.
Blacksmith: 54 existing tests passed in 4 files:
  apps/web/src/components/pullRequest/pullRequestMarkdown.logic.test.ts
  packages/source-control-forgejo/src/shared/definition.test.ts
  packages/source-control-forgejo/src/server/forgejoMediaFetch.test.ts
  packages/source-control-forgejo/src/server/ForgejoSourceControlProvider.test.ts
CI: 29 successful, 0 failing, 0 pending on tested PR head.
Observed one transient asset 502 after 30 seconds on a second browser context; reload recovered.
Repository background fetch initially lacked credentials; configured its local tea git helper.
No source edits, commits or pushes made.
Not exercised: native mobile, packaged desktop, remote relay/tunnel, fj OAuth, HTTP origins,
external object storage and live redirect behavior. Native mobile timing findings remain unverified.