Proof audit pass 1 — prospective issue 18799
Base: 70e5e384da; head: 47c49b60d9271020bf21323767045d788b9955e6
Scope: complete committed diff; protocol.ts and protocol.test.ts only (+107/-27).

VISUAL FIXTURE MATRIX: []
Affected render paths/callers/conditions/interactions: none.
Web, desktop, mobile, Settings, palette, keybindings: no changed render paths.
Interaction rows: zero; recordings/captures required: zero.
This is a server-side/shared ACP protocol retention fix. Red regression test plus a nonvisual runtime transcript is sufficient proof format.

PROTOCOL PROOF CASES (not visual fixture rows)
1. Retention: unread 40 x 8 MiB and 100 x 1 MiB JSON notifications. Record callback counts, retained suffix IDs/count/serialized line characters and post-GC memory trend on base/head. Budget is 16*1024*1024 UTF-16 line characters, including JSON envelope, not exact heap bytes. 8 MiB payload plus envelope means two do not fit. Synchronize by callback acknowledgements.
2. Newest/oversized: send a >16 Mi-character notification without raw reader, then drain and prove newest survives intact alone. Send a small successor and prove oversized predecessor is evicted. Check exact boundary using total JSON-line length.
3. Count cap: send 40 tiny notifications with no reader; drain exact ordered IDs 9..40. This isolates count from size.
4. Live consumers/accounting: subscribe before sending mixed notifications (including oversized); acknowledge each consumption; assert no loss, duplication, or reordering. Stop reader, refill to budget and restart to prove decrement accounting permits correct fresh retention; repeat drain/refill. Also gate a slow reader through an eviction burst. Direct onNotification callbacks must see all inputs regardless of raw backlog eviction.
5. Cleanup: finish/interrupt connection scope after unread oversized backlog and with blocked reader/pending RPC; show teardown completes with existing termination semantics, pending RPC settles, and disposed connection references can be reclaimed across repeated cycles. Distinguish EOF while transport is retained from scope disposal; this diff adds no queue shutdown on EOF. Do not demand a new EOF stream-completion contract.
6. Routing compatibility within the same transcript/focused suite: session/update (including transformed payload), elicitation completion, extension notification; interleaved request/response and fragmented/coalesced NDJSON; decoded logs still contain messages without internal size wrappers. Both client.raw.notifications and agent.raw.notifications expose the same changed queue.

EXISTING COMMITTED PROOF
Added test sends 32 x 1 MiB, awaits each onNotification, drains through ID32, asserts <=16 MiB of reserialized params, then checks one live notification. Source predicts this fails the base (32 MiB) and passes head; execution not performed in this read-only audit. It does not assert exact retained suffix, oversized newest, tiny-message count cap, sustained live delivery or cleanup. Params length is weaker than full wire-line accounting; test title says bytes but implementation counts characters.

REQUIRED EVIDENCE
Record exact command, base/head SHA, runtime/dependency versions, red assertion on base with identical regression test, green on head, focused relevant protocol/client/agent test results and runtime observations above. Synthetic protocol peer/in-memory harness is enough; no T3 application server or browser needed. Issue measurements are historical claims, not verification of this exact head.

FRICTION
No committed red/green execution transcript or head-specific runtime transcript supplied/produced in this audit. Two untracked retention scripts exist outside the committed diff and are not PR proof. No code edits, test execution, servers, browsers, captures, PR creation or forge writes performed. Only this public plain matrix is uploaded under explicit authorization.