# Issue 24098 immutable evidence index

[Full results, scope, revision correspondence, unverified scope and FRICTION](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6963b96c65c50bc9/README.md)

- [Red test transcript: 3 expected failures + 1 passing freshness guard](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ba5c00b5fccf978a/red-tests.txt)
- [Green test transcript: 140/140 passed](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dfc17919f4f357c9/green-tests.txt)
- [Before runtime: two warm lookups, five git operations each](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8223d2b28f571a82/before-runtime.json)
- [After runtime: two warm lookups, zero git operations each](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/793e6f07313b9791/after-runtime.json)
- [Revision and test-count provenance](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/34b54c55f96246c2/revision-provenance.json)
- [Test reproduction driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9540e71b261a7a28/run-tests.py)
- [Trace/SQLite extraction driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6c112de54df9923c/extract-runtime.py)
- [SHA256 checksums for corrected package artifacts and README](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/033646f011283148/SHA256SUMS.txt)

Linux, existing lead-owned real server/browser, isolated .t3; evidence agent launched neither. Visual matrix EMPTY []: server-only change; no changed visible surface. No other visible changes. No checkout edits or public forge writes. Runtime verifies saved-PR sync only, while deterministic tests verify branch-only settlement and write/settlement freshness guards. Remote PR publication remains lead-owned; existing [#24099](https://git.cafe/pingdotgg/t3code/pulls/24099) is registered with this thread.

FRICTION: source SHA is not embedded in trace; provenance uses lead reload record, reflog and identical production blob hashes. Production commit actually recorded 10:36:06; final warm samples use 10:37/10:38 within TTL. Trace lacks exact argv; only source-derived command templates supplied. Old remote PR head must be reconciled by lead's publication. Lead's mutation check was not independently repeated. No claims for TTL expiry, universal zero git, branch-only settlement runtime, or client/provider/transport matrix.

Correction: lead-caught environment labeling error fixed to `serverPort=15301 webPort=7261`, browser origin `http://localhost:7261`, in README, both runtime JSON environment fields, and extraction driver. Red sync failure wording now specifies calls with `{refresh:false}` failed to opt out of default terminal fresh confirmation; no explicit `freshGitState` option was passed. No measurement data changed. Unchanged artifacts retain their original URLs.

FRICTION (correction round): Python urllib download returned HTTP 403; curl retrieved all artifacts successfully. The pass2 audit inspecting the old package needs a new round against this index. No audit contact or PR creation performed.

Link revalidation: all nine package artifact links were downloaded and matched local bytes; existing issue/PR links returned HTTP 200. The five inherited short-SHA commit links returned HTTP 404 on read-only HTTP checks; references are preserved, and remote commit-link availability is unverified.