Captured **6 / 6 requested rows** for [#26186](https://git.cafe/pingdotgg/t3code/pull/26186): P01, P02, P03, P04, P05, P07. All 20 required variants pass on each revision; 3 optional P06 controls also pass on each revision. P06 remains UNVERIFIED as a complete row because digest failure was not injected. These are local-revision captures, not validation of the older remote PR head.

Environment: **PostgreSQL 17.11**, `postgres:17` at `postgres@sha256:b8faeff7712663c2773a190181e1246e37e364b887611c04658c28b44e2408fe`; **Node v26.12.1**; **Docker 29.1.3**; **Linux 6.1.102 x86_64 GNU/Linux**, machine fs-20. Before [f120c51134](https://git.cafe/pingdotgg/t3code/commit/f120c51134c6b5f20b42f51cda84e3e6da681a5f); after [2102cdbc8d](https://git.cafe/pingdotgg/t3code/commit/2102cdbc8d5fd3f66c3b9d524c4456b80ba59ccf).

| Row | Expected | Before | After | Status and reason |
|---|---|---|---|---|
| P01 | Real ordinary managed link commits reservation before Cloudflare; user lock released; stored identity drives subsequent calls. | Three links succeed; fourth Exceeded(3,3). Each first CF list sees its committed tunnel-less reservation at T. Every CF call can acquire the user's advisory transaction lock from another pool. | Same observed order and link results, through real withCapacity/reserve. | PASS: real EnvironmentLinker → provider → real PG layers. Combined event sequence records reserve return, capacity return, then list/create/recordTunnel/config/DNS/token/ready, followed by real link upsert and credential creation. |
| P02 | Recovery at quota excludes self; reuse ready; released-ready, wrong-origin, missing tunnel fall back; over-quota rejects before reuse. | Ready does get/getToken only; all 3 fallback variants return HTTP 200 with full provision. First CF sees stored old timestamp. Over-quota HTTP 500 internal_error/upstream_unavailable; no reserve execution or CF. | Same caller outcomes; first CF sees reservation timestamp refreshed to T, including ready reuse. | PASS: five real recovery HTTP fixtures, real recoverEnvironmentTunnelRecord, real environment credential authentication and signed recovery proofs. |
| P03 | Preserve typed quota error, skip reserve/CF; link and recovery HTTP mappings; pending fourth request denied after fix. | Provider/recovery service preserve Exceeded(3,3); HTTP link 403 environment_link_limit_exceeded(maxTunnels=3), recovery 500 internal_error/upstream_unavailable; zero reserve executions/CF on quota rejection. Three pending failed provisions do not count: fourth reserves then fails at ensure-tunnel; 4 rows. | Same over-quota errors and HTTP mappings; three pending failed provisions count: fourth Exceeded(3,3), zero additional reserve executions/CF, 3 rows. | PASS: five fixtures cover provider, real linker + link handler, recovery service + recovery handler, and S01's fourth pending request. |
| P04 | Real load/count failures and new lock/transaction failures map to check-tunnel-limit with requested identity/cause; zero CF; rollback and retry. | Restricted-role override/allocation/link SELECT errors map to check-tunnel-limit with load-limit/count-tunnels causes. No capacity lock/transaction boundary exists, so targeted lock/BEGIN/COMMIT injections are not invoked and full provision succeeds. | All three permission-denied cases plus labelled lock SqlError, labelled BEGIN SqlError, and actual deferred-trigger COMMIT rejection map to check-tunnel-limit; requested hostname/name and cause preserved; zero CF, zero persisted rows; normal retry succeeds. | PASS: 6 variants. Fault proxy applies only to limit-service DB boundary, retaining the identical underlying PgClient for real allocations. COMMIT rejection has SQLSTATE 23514. This proves classification and no early provider I/O, not ambiguous network-commit recovery. |
| P05 | Real reservation persistence failure maps to reserve-allocation, preserving cause and requested identity; no CF; no committed row. | Role lacks allocation INSERT: reserve-allocation → ManagedEndpointAllocationPersistenceError(reserve,database-request); requested hostname/name present; zero CF/rows; restored grant retry succeeds. | Identical stage and cause inside the real capacity transaction; zero CF/rows; restored grant retry succeeds. | PASS: real restricted-role SQL failure, independent persisted snapshot, successful retry. |
| P07 | CF failure before/after recordTunnel leaves committed reservation. Recent N/V count after; after 15 minutes N expires, V without link keeps counting. | Failures at ensure-tunnel/configure-tunnel persist N/V allocations; both allow quota probes while recent, at T+15m and T+15m+1ms because no link exists. | Both deny recent probes with Exceeded(1,1); at exact T+15m and T+15m+1ms tunnel-less allows, recorded live tunnel still denies. Both rows remain stored. | PASS: 2 real provider failure fixtures, actual DB snapshots, override 1 and real limit probes without reservation side effects; clock pinned, no sleeps. |
| P06 (optional) | Preconditions stop before limits/reserve; publish-only bypasses provisioning; digest failure maps to derive-environment-hash. | Non-loopback, missing config, and real publish-only linker controls pass. | Same 3 controls pass. | UNVERIFIED as a complete optional row: digest failure was not injected. |

Execution uses one throwaway Postgres 17 container and a fresh database for each variant. Every database receives all 13 migrations from its own checkout; checksums match. The same harness bytes, complete SQL seeds (including the synthetic public key), and pinned clock were verified across revisions. Each provider's limits and allocations share one PgClient, so the after reservation actually participates in the capacity transaction. The observer uses a separately constructed pool with its own transaction context and logs PostgreSQL backend PIDs. Every Cloudflare stub call queries committed allocations and attempts the same user advisory lock in a separate observer transaction.

Cloudflare tunnel and DNS service boundaries are labelled stubs. **No Cloudflare resources were created.** Provider, limits, allocations, linker, links, credentials, tokens, proof replay, recovery function and HTTP error mappings execute actual checkout code. The link HTTP handler receives a synthetic authenticated client principal because real Clerk authentication requires an account; Clerk verification itself is unverified and is outside the quota row. Recovery uses the actual environment credential authentication layer and real JWT verification. Unrelated HTTP services are unused placeholders that throw if invoked. Configuration, signed proofs and SQL seeds are synthetic. No live T3 database, browser, or dev server was used.

No behavioral difference beyond the round-1 “what else changed” list was found. This capture adds provider-level observations of known changes: reservation refresh before ready reuse, pending failed provisions consuming quota, tunnel-less versus recorded-tunnel aging, and new lock/transaction failures wrapped at check-tunnel-limit. HTTP quota mappings and ordinary successful-link limits remain unchanged. Generated credential IDs, trace IDs, database names and PIDs differ as runtime metadata; SQL seed rows do not.

The final paired captures are the runs beginning at 04:20 UTC. Earlier timestamped runs are diagnostic harness iterations and are not the supplied evidence. `verification-provider.json` independently parses the final transcripts/results and checks shared seeds, clocks, migration/harness hashes, committed-row/lock observations, requested row coverage and provider outcomes. `diff-provider.txt` is the complete unified before/after transcript diff, with no normalization or omitted sections.

Cleanup: tracked container `88194d78ee640651d0dcd74c459105beeb7a11cc27af08575acb44eef2249375` stopped and removed with its volume. Both detached worktrees were clean before removal. Removal and absence are recorded in cleanup-provider.txt. No source edits, commits, pushes, PR comments, or changes to the lead's read-only checkout were made.

FRICTION:
tool | Node createRequire cannot resolve the contracts package's import-only relay export; the scratch harness now imports that source by absolute file URL | Resolve import-only workspace exports as ESM.
model | Diagnostic HTTP runs lacked the pinned Clock in their independent handler runtime; initial transaction fault injection also reached unrelated allocation transactions | Provide the clock explicitly and confine the labelled fault to the limits boundary; both revisions were rerun successfully after correction.