MERGE — no concrete bugs or blockers found in the requested evidence-only scope.

Reviewed head d2c97fc5a884c85144ddc884bbe3efb7c9343b5d against b72740852ffb5ab727e1ae7c042d9e89533bc341 in /home/ubuntu/wt/pr-19799. The checkout HEAD matches the requested head and the worktree was clean. Applied the pr-audit review guidance within the user's stricter local-only constraints.

Evidence:
- GitVcsDriverCore.ts:819–914: the production diff only guards line-buffer accumulation, line decoding, and emission with the captured onLine callback. The returned text, byte counter, truncation decision, error outputLength, stream consumption, and primary TextDecoder remain outside those guards.
- Callback registration after command start: executeRaw passes input.progress?.onStdoutLine and onStderrLine by value at lines 993–1007. collectOutput already captured those values before this change; mutating the progress object afterward cannot register a callback with an existing collector. The readonly progress contract and inspected production callers provide no late-registration mechanism. Commit, checkout, submodule, and clone callbacks are supplied before execution.
- One stream without a callback: stdout and stderr each receive an independent collector and independent byte limit. Skipping stdout's line buffer cannot affect stderr's callbacks, bytes, truncation, or errors (and conversely). Clone deliberately supplies only stderr callbacks, including continued delivery after truncation; that path retains its line decoder.
- UTF-8/NUL chunk splits: the primary decoder still decodes every retained byte using streaming decoding, then flushes at EOF or at truncation exactly as before. NUL is preserved in returned text and is not a line separator. Splitting a multibyte character at the byte cap can still produce a replacement character, as before. Callback-enabled decoding and flushing are unchanged. The added tests cover one-byte UTF-8/NUL chunks and byte-limit rejection/truncation without callbacks, but were not executed.
- Callers without callbacks: runGitStdout and runGitStdoutWithOptions consume result.stdout; nonzero-exit classification consumes stderr.text; worktree-list conversion consumes result.stdout. lineBuffer is private and has no consumer except emitCompleteLines. No inspected caller relies on its existence without a callback.

Verification limits: source/diff/caller inspection only; no tests, installs, network, forge operations, or databases. Known current-main conflicts were not assessed or resolved. This verdict concerns the pinned diff, not current CI or landing readiness against main.
VERDICT: MERGE
