# PR #23690 proof audit, pass 2

Head `b2948332e2` (~/wt/pr-23690, clean), merge-base `60b35a1ee0`. Driver hashes in `capture/drivers.sha256` all verify OK.

## 1. Matrix rows vs SHA
| Row | Now | Proof @ SHA |
|---|---|---|
| 1, 26, 27 | UNVERIFIABLE (Windows, macOS TCC) | n/a; FIFO stand-in only |
| 2 memo hit, 22 memo timing | PROVEN (runtime) | R3 @ head (2115/83/69 ms, 0 execs scans 2–3); rerun here matches. No test asserts it |
| 3, 8, 9, 10, 12, 13, 15, 18, 19 | PROVEN | tests @ head (57/57) |
| 4 cat non-zero (missing config) | PROVEN | R1 `noconfig` @ head = @ merge-base |
| 5 timeout path | PROVEN | 4 FIFO tests @ head; fail @ merge-base (tests-mergebase.log) |
| 6/21 >1 MiB | PROVEN as a regression | R2 @ head and @ merge-base: `late` origin lost on head (`remoteKey:null`) |
| 7 spawn error | PROVEN | R5 @ head only (no before needed); side effect: linked worktree becomes a candidate |
| 11 garbage pointer | PROVEN | R1 `garbage` parity |
| 14 real empty commondir | PARTIAL (same branch as blocked case) | not in R1 |
| 16 dedupe | PROVEN (runtime) | R4 @ head: 1 exec of `shared.git/config`; test 3 does not prove it |
| 17 regular-file cwd | PROVEN | R1 parity |
| 20 identity parity | PROVEN for listed kinds | R1 @ both SHAs, `diff` exit 0 |
| 23 well-known | PROVEN | body RT @ a5920956c4 and R6 @ head (200, 4 ms) |
| 24 fs route | PARTIAL→PROVEN-ish | R6: static handler 503 in 1.5 ms; it does stat checks, not a file read |
| 25 no leftover cat | PROVEN | R6 `ps -eo` table, 0 cat children of server pid |

Wrong-SHA flags: none. Body RT is @ ed3f965e07/a5920956c4 (allowed). R6 transcript has no `rev-parse` line; SHA is pinned only by server cwd `~/wt/pr-23690` (= head, clean). The 40-hex `841285d83a…` in r6-transcript is a dev-session cookie name, not a commit.

## 2. Rerun (R3/R4 @ head)
`r3r4-audit2.sh` = capture driver with only `C=` pointed at audit2 (same `scan.ts`). Scan ms 2134/86/80 vs capture 2115/83/69. Exec counts identical: scan 1 7 cat (fifo-repo config 1, shared config 1), scans 2–3 5 cat (0 and 0). Both FIFOs removed by explicit path. Transcript: `r3r4-rerun.txt`.

## 3. Body claims needing correction
1. "A scan with blocked files waits about one deadline per phase": only up to 16 blocked unique files per phase; in general ceil(N/16) deadlines per phase. Same wording in the code comment at `GIT_FILE_READ_CONCURRENCY`.
2. "remembered by the scanner service": the memo lasts the server's lifetime, is shared across WS connections, and never expires or retries (R6 conn3/3b). A TCC prompt that is later granted, or a fixed FIFO, keeps the remote hidden until restart.
3. "Failed reads … the same as main's orElseSucceed('')": new behaviour. A slow but finite read (>2 s, e.g. NFS) now yields "" and is memoized permanently; main waited and got the content.
4. "Unchanged git identity semantics": false for configs >1 MiB with origin past 1 MiB (R2: cat exits 0, truncated prefix parsed, remote lost). Also differs when `cat` is missing from PATH (R5: pointer cwds become `git:null`, so linked worktrees are listed).
5. "1 MiB cap": correct, but the body should say an over-cap config is parsed from its first 1 MiB, not dropped.
6. Test 3 "within 4 s" / "~2 s": the test bounds wall-clock time (4 s timeoutOption). It cannot detect missing dedupe (concurrency 16 masks it). "~2 s" is not in tests-head.log (non-verbose); R3 scan 1 ≈ 2.1 s is consistent.
7. Runtime table "No `cat` left running": the body shows no ps output; R6 supplies it at head.