VANTA_DESKTOP_AUDIT_... renders as VANTADESKTOPAUDIT_.... The shared underscore-emphasis regex affects user and assistant bubbles, threatening file names, environment variables, IDs, hashes, and exact-output work.
The official proof waits 150 seconds for already-corrupted rendered text and does not dump raw response, rendered messages, provider, root, approval, or errors. A separate diagnostic proved the provider and isolated root work.
One volatile React draft follows session changes and disappears on reload. Drafts need project + session scope, persistence, and explicit keep/discard/move behavior.
The app is validly signed but Gatekeeper rejects it as Unnotarized Developer ID. The published notarized 0.9.2 CI artifact is separate from the changed local candidate.
The same screen can show gpt-5.5 and No model. Both can be technically true, but the interface does not explain the two layers.
Keyboard, roles, focus, contrast, zoom, and reduced motion have coverage. Automated axe scans and a physical VoiceOver flow do not.
Geometry tests do not catch every visual regression. The app is about 548 MB on disk, and no cold-start, memory, CPU, or package-size threshold is enforced.
Telegram passed live connect/poll/disconnect, but no complete inbound-message to agent-response round trip was executed. Twenty-one other channels correctly report not configured.
The operator explicitly parked x402, yet @x402/core and @x402/evm remain direct dependencies and are present in the packaged app.
The roadmap reports 1,247 shipped and 11 parked cards. None currently represents message fidelity, draft ownership, or live-proof diagnostics.
| Framework | Result |
|---|---|
| Bias blind spot | Roadmap completion creates an incentive to confuse shipped cards with current defect absence. |
| Calibration | Executed, fixture/code-path, and unverified claims were separated. |
| Chesterton's fence | Preserve the documented purpose of runtime, inspector, and dormant boundaries before removing them. |
| Consider the opposite | The core app is coherent; targeted trust repairs beat another shell rewrite. |
| Curse of knowledge | Tools 141, MCP 0, gateway, kernel, provider model, and runtime model assume internal vocabulary. |
| Dunning-Kruger | No unexecuted claim is made for screen readers, all providers, or every connector. |
| Falsification | The underscore marker disproved exact-render fidelity. |
| Inversion | Trust fails through text mutation, wrong-task drafts, ambiguous model state, and blocked releases. |
| Johari window | Fresh-context human and physical assistive-technology feedback remain absent. |
| Ladder of inference | Old broken-shell screenshots were not treated as current behavior; a fresh launch replaced that assumption with direct evidence. |
| Outside view | Packaging, auth drift, external setup, and state recovery are typical late failures and remain priority proof areas. |
| Premortem | Likely launch incidents are corrupted identifiers, wrong-task execution, Gatekeeper rejection, and connector delivery failure. |
| Red team | Electron isolation is strong; package/dependency surface and proof gaps remain. |
| Steelman | The requested Codex/Hermes foundations already exist and should be preserved. |
| Survivorship bias | Fixtures and configured Telegram are visible; unconfigured accounts, offline drafts, AT, and changed release candidates are not. |
| Unknown unknowns | Draft scope, dual-model terms, package composition, release binding, budgets, and provider drift surfaced. |