No blocking proof findings in the supplied current-revision evidence package. All 48 matrix rows have sufficient recordings within the matrix’s required/control scope: 43 paired rows and five explicitly permitted head-only rows. Both Diff0 and DiffT were inspected for every row.

Publication follow-up: the live [PR #21046](https://git.cafe/pingdotgg/t3code/pull/21046) description read at the start of this audit still contains the historical Evidence table for [975b3dc5](https://git.cafe/pingdotgg/t3code/commit/975b3dc56850d8a22dc90462219e53be95d8dcf7) → [8be315bd](https://git.cafe/pingdotgg/t3code/commit/8be315bd6f5d17a028c7adcdd907401730d8a53f), environment fs-38. Publish the supplied [replacement Evidence section](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/19911e24be4eaea2/Evidence.md), which has the requested current SHAs and fs-35 environment. This verdict applies to that supplied replacement and its bundle; it does not relabel the historical PR-body captures as current runs. No PR edit/comment was made.

Audited head [bb35b94111](https://git.cafe/pingdotgg/t3code/commit/bb35b941115a0a9f818e8512eebe67c29ee68355) against merge-base [5211acfe95](https://git.cafe/pingdotgg/t3code/commit/5211acfe95a0c6d82a60e2524b5e46b47fe67a3e), read-only in `/home/ubuntu/wt/pr-21046`. Audit began 2026-10-28 18:04:43 UTC, completed within the 60-minute budget. The four changed files and their production call paths were read alongside the [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a3afdc367092dea0/matrix.md), index, all three sheets, scripts, row recordings and comparison artifacts. This is a proof audit, not a fresh full code/CI/platform review.

Every selected recording was read, including full event payloads, nulls, duplicate events, intermediate old-local/null-remote states, reconnects, call options, gate acknowledgements, result/error values and assertions. Repeated dictionaries were displayed through lossless interning to make identical payloads inspectable. All 96 delivered comparison artifacts were verified against their canonical before/head content and their complete changed subtrees inspected. Head-only artifacts display actual observations and explicit absence reasons rather than a fabricated base or timeout. Viewport/theme/DPR/fonts and pixel deltas are n/a for these server protocol/service recordings.

Independent checks: all 1,179 bundled checksum entries match. All 192 canonical before/head Diff0/DiffT projections were recomputed from the row raw recordings with zero mismatches; all 3,193 row records match their full raw source records. All row session provenance and recorded revisions match the pinned pair. All 28 real-server before/after narrations were cross-checked: 236 stated timestamps exist in their recordings, and all 18 narrated checkpoint local-event ID lists match the actual events. The directly downloaded linked scripts, matrix and sheets are byte-identical to the bundle; the linked index adds only its bundle link. All 174 head assertions in the full raw sessions pass (165 belong to the selected row sessions; nine additional assertions are in the supplementary P12 session). An independent replay of all 447 stream/reconnect states produced zero reducer mismatches; the reducer blob is identical at both pinned commits. This replay read 3,399 raw records, including the 44-record new-method P20 session; the supplied replay’s 3,355 record count excludes P20, which has no stream states.

The earlier proof defects were checked directly. P07.b narration names local event 290, which follows mutation 284 and precedes checkpoint 291; the remote clear is event 288. No inferred early event is substituted for a received event. Comparisons preserve each observer and each service/upstream channel order while ignoring cross-channel total arrival order; revision/label/provenance noise remains outside canonical comparisons. Base regression failures are actual observed values. New-stage P10.d, scheduler P18.a–d and reader P20.a–c are explicitly head-only; old trigger timeouts are excluded. Each row has two distinct comparisons. The “what else changed” list agrees with the split writes, remote clears/repeated nulls, probes, rereads, recovery and pull gating observed in recordings and source.

Independent rebuild used the delivered, reviewed `driver.mjs`, `seed.mjs`, mock and preload unchanged against the pinned head, with `T3CODE_DEV_SEED=0` and `vp run dev --no-seed --home-dir` pointing to a fresh timestamped scratch home under this audit’s step directory. No checkout `.t3` or live home was used. Run: `2026-10-28T18-05-41-454Z-after`. Environment exactly matches: Node v26.12.1 / git 2.43.0 / Linux 6.1.102 x86_64 GNU/Linux / fs-35; typed Effect WsRpcGroup over loopback WebSocket, JSON, loopback GraphQL mock; automatic fetch disabled; no renderer. P07.a’s Diff0 delta against the delivered head capture is empty: three observers, six events, zero omitted/additional/reordered events or changed payload values. All 14 real-server rows driven by the same run also match delivered Diff0 exactly. Runtime/server/cleanup logs and comparison JSON are attached in the independent rebuild archive. The spawned dev runner and its verified port owners were stopped; both owned ports had no listeners afterward.

The following table is row-by-row. “SUFFICIENT (head-only)” uses the matrix’s explicit permission. Optional controls establish their recorded cases; P14’s first-failure/recovery/interruption capture is not evidence of every exponential-backoff step or its 15-minute cap, and no changed-path conclusion relies on that unrequired exhaustive control. Simulated fetch/pull and controlled error adapters are labelled as such; the real-server rows use genuine Git and a mocked provider HTTP boundary. No live-provider, browser, desktop or mobile result is asserted.

| Row | Status | Inspected observation |
|---|---|---|
| P01.a | SUFFICIENT | Passive initial local/null snapshot; zero owned upstream reads. |
| P01.b | SUFFICIENT | Active initial lookup held; local snapshot precedes release, then PR613. Initial lookup still occurs with fetch disabled. |
| P01.c | SUFFICIENT | Warm A reconnect matches cache; B/null and B/614 reconnects also inspected in P07/P08 continuous recordings. |
| P02 | SUFFICIENT | Dirty +1/-0 local event 53 precedes held checkpoint 57; refresh RPC remains pending. Settled totals agree. |
| P03 | SUFFICIENT | Dirty event 90 while both refreshes pending; second upstream lookup starts only after first release. |
| P04.a | SUFFICIENT | Queued localOnly publishes dirty event 128 while both RPCs pending; owns zero upstream reads. |
| P04.b | SUFFICIENT | Unlocked same-branch localOnly retains PR613 and owns zero remote reads; both comparisons identical. |
| P04.c | SUFFICIENT | Cold localOnly owns zero remote reads; additional head remoteUpdated:null is preserved. |
| P05.a | SUFFICIENT | Direct local refresh clears remote before B local; no upstream read; reconnect B/null. |
| P05.b | SUFFICIENT | Same-branch dirty local refresh preserves compatible PR; no upstream read. |
| P06 | SUFFICIENT | Separate no-flight checkout/localOnly case: remote clear before B, including repeated null; later B/614 recovery. |
| P07.a | SUFFICIENT | Held A result after checkout to literal heads/release: base B/613/count1, head B/null/zero counts. Independently rebuilt exactly. |
| P07.b | SUFFICIENT | Actual received events 288 (remote null), 290 (B local) precede checkpoint 291 while both RPCs pending; late A discarded. |
| P08.a | SUFFICIENT | Next permitted lookup returns PR614/aheadOfDefault2 on B, stream/result/reconnect consistent. |
| P08.b | SUFFICIENT | Repeated identical refresh adds zero update events; result/reconnect remain B/614. |
| P09.a | SUFFICIENT | Cold getStatus plus intervening B local refresh: head returns latest B/null; base overwrites with captured A. |
| P09.b | SUFFICIENT | Initial remote writer serializes queued full refresh; initial head result B/null, later writer B/614. |
| P10.a | SUFFICIENT | Actual mock HTTP503 is absorbed at provider boundary; head early dirty local and compatible last-known PR613 survive. |
| P10.b | SUFFICIENT | Typed workflow remote failure propagates; head dirty local already published and retained with compatible old PR. |
| P10.b2 | SUFFICIENT | Branch B published before held workflow failure; head retains B/null, base retains stale A. |
| P10.c | SUFFICIENT | Initial local scan failure: head zero upstream reads and no fabricated local publication; base starts one read. |
| P10.d | SUFFICIENT (head-only) | All three new stages independently fail: pre-probe, post-probe, mismatch reconciliation. Typed errors and last valid cache recorded. |
| P11 | SUFFICIENT | Simulated fetch moves comparison base: head early totals1, then totals5; final result correct on both. |
| P12.a | SUFFICIENT | Actual scheduled ticks, separate ahead/behind/aheadOfDefault variants; each count change triggers one local scan. |
| P12.b | SUFFICIENT | Actual identical tick has no publication/rescan; PR-only title/state change publishes remote only. |
| P12.c | SUFFICIENT | Held scheduled A tick then independent B switch: head probes A/B, reconciles B and discards A. |
| P12.d | SUFFICIENT | Both probes B with cached local A and unchanged counts: head reconciles B then accepts PR614; base mixes A local/B remote. |
| P13 | SUFFICIENT | Five optional controls inspected: demand lifecycle, fetch off, deny, passive only, realPath failure fallback. |
| P14 | SUFFICIENT | Optional control: first typed/defect failures each wait 30s, recover/reset, then held work is interrupted without retries. |
| P15.a | SUFFICIENT | Exactly one simulated pull; head publishes pulled totals6 while second upstream read is held; final behind0. |
| P15.b | SUFFICIENT | Second post-pull read captures A then branch B: head final B/null/zero counts; exactly one pull. |
| P16.a | SUFFICIENT | Partial pull mutation then failure reconciles dirty local on both; head split publication preserves compatible old remote. |
| P16.b | SUFFICIENT | Second upstream read fails after pull mutation; head publishes/retains latest local and compatible original remote. |
| P16.c | SUFFICIENT | Reconciliation local failure propagates typed error; no fabricated stale success event. |
| P16.pre | SUFFICIENT | Eligibility local read fails before pullAttempted; zero pulls and previous cache retained. |
| P16.d | SUFFICIENT | Failed pull switches to B: head clears A remote before dirty B local; final B/null, one attempted pull. |
| P17.a | SUFFICIENT | Policy gate acknowledges pending A read, then B local satisfies other pull conditions: base pulls once, head zero. Head cached A limit explicit. |
| P17.b | SUFFICIENT | All ten exclusion variants inspected; zero pulls, fetch-off and missing-PR options stay no-fetch. |
| P18.a-d | SUFFICIENT (head-only) | All four scheduler triggers reached and B local refresh completed; getStatus, refreshStatus, autoPull success/failure return B/null/zero counts. |
| P19.a | SUFFICIENT | No local and cached-null wrapper separately skip upstream lookup on both. |
| P19.b | SUFFICIENT | Local plus absent remote: head owns one lookup with exact no-fetch/missing-PR options; base skips. |
| P19.c | SUFFICIENT | Object with PR null and existing PR separately invoke reader with exact options; compatible cache preserved. |
| P19.d | SUFFICIENT | Policy deny owns zero reads; allow after discard discovers/persists B/614/count2. |
| P19.e | SUFFICIENT | Actual missing-PR method holds A, switches B, discards A then recovers B; no full-refresh substitute. |
| P19.f | SUFFICIENT | Seven unchanged finalization guard variants inspected through production observer; always local refresh, only eligible cases request PR. |
| P20.a | SUFFICIENT (head-only) | Real Git: release, release with same-named tag, literal heads/release return exact attached identities. |
| P20.b | SUFFICIENT (head-only) | Real nonrepo/detached/unborn states plus labelled empty-stdout adapter yield null/null/unborn/topic/null. |
| P20.c | SUFFICIENT (head-only) | Real unexpected exit128 plus labelled spawn/null-exit/detection failures yield canonical typed errors, including omitted exitCode for null. |

The current-revision package is sufficient for the declared server-only proof. The PR-body publication follow-up above remains for the lead. No source edits, commits, pushes, comments, extra worktrees, device leases or browser sessions were created. The lead’s checkout and scratch parent are preserved. This step’s scratch is removed after uploading this report and the independent rebuild archive. Disk remained at 16 GB free.

Used skills: [pr-audit](/home/ubuntu/.codex/skills/pr-audit/SKILL.md), [cafe-cli](/home/ubuntu/.codex/skills/cafe-cli/SKILL.md), [cafe-pr](/home/ubuntu/.codex/skills/cafe-pr/SKILL.md), [ghdrop](/home/ubuntu/.codex/skills/ghdrop/SKILL.md). Reviewer: Codex gpt-6.1-sol high through the Codex harness in T3 Code.

FRICTION: none
VERDICT: SUFFICIENT