# Evidence index — issue 25621

Worktree: /home/ubuntu/wt/issue-25621
Head: d487d6cb5e. Base: 0604547a3a.

Visual matrix: rows 0/0. Server-only SQL change with no changed render paths; no images or recordings required.

| Proof | Artifact | Observation |
| --- | --- | --- |
| Pass 1 matrix | [Matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6e6456d872c48cdc/proof-audit-pass1-matrix.md) | Empty visual matrix; query coverage and audit limits recorded. |
| Red regression | [test-red.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ec20a78fb4a31a74/test-red.log) | Shell snapshot regression fails with too many SQL variables; 1 failed, 46 skipped. |
| Fixture reproduction | [seed.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/16a1cf26faa9ff21/seed.py) | Clones an app-created thread to produce 32767 threads in isolated development state. |
| Runtime before | [runtime-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0c5e5f779aed004a/runtime-before.txt) | Base fails startup at 32767 threads with too many SQL variables; 32766-thread control recovers and loads. Fixture restored to 32767. |
| Runtime after | [runtime-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b7711df88b1c70f8/runtime-after.txt) | Same 32767-thread fixture completes startup recovery; selected verbatim startup/recovery/shell HTTP 200 records. |
| Authenticated HTTP result | [http-probe.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/134219bbc3f9fc98/http-probe.json) | Same-origin browser fetch with protocol 2 returns status 200, threadCount 32767, response text length 50363446. |

## Scope and limits

The lead ran the real development app before and after. This evidence-capture step inspected supplied artifacts, selected safe lines, and uploaded evidence only; it did not rerun tests, start a server/browser, edit source, or write to a forge.

Startup recovery plus the authenticated HTTP shell response prove the shared server fix at the reproduced boundary. Browser rendering at this scale was not asserted. No desktop/mobile rendering or performance claim is made. The initial preview evaluation timed out at 15 seconds; the asynchronous probe completed and was retrieved later. The response length is recorded as supplied, without a bytes-unit claim.

The red test is supplied evidence, not independently rerun here; the pass 1 matrix records its provenance limitation. The before transcript records the base, and http-probe.json records the after head. Raw runtime logs contain pairing credentials and were never uploaded. The after transcript contains selected relevant verbatim lines, followed by clearly labeled probe data and scope notes.

## FRICTION

category|problem|prevention
credential hygiene|Raw runtime-after.log contains pairing tokens|Upload only allowlisted startup/recovery/HTTP status lines; never upload the raw log.
probe tooling|Initial preview evaluation timed out before the large response completed|Use an asynchronous probe and retrieve its completed result; keep HTTP success separate from rendering claims.
proof scope|A successful large shell response does not establish client rendering at that scale|Explicitly limit conclusions to startup recovery and the shared server HTTP response.