Findings: none against the required F06–F11 proof package. All six minimum rows are sufficient on both pinned revisions. The F10/F11 directory-creation and stdout diagnostic changes are real, accurately disclosed in the evidence index, and consistent with the code. F06/F07 have no observed behavior change; F07 retains only the disclosed asynchronous log-drain ordering difference.

Read-only proof audit for [#28256](https://git.cafe/pingdotgg/t3code/pull/28256), branch `fix/issue-28229`, after [ec84567fce](https://github.com/pingdotgg/t3code/commit/ec84567fce5a41ff1022e7feb289351029111f35) versus before [15fe283272](https://github.com/pingdotgg/t3code/commit/15fe2832727893cbdd2214383f9f971474849695). Every delivered transcript prints the exact full expected SHA and correct expanded checkout/CLI/base-dir argv. Both checkout HEADs remain pinned and clean. GitCafe PR metadata confirms the requested source/base OIDs.

| Row | Fixture | Status | Observed evidence |
| --- | --- | --- | --- |
| F06 | Legacy live PID | SUFFICIENT before + after | Both refuse on stderr, exit 1; R byte-identical; L/cwd absent. [F06-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4ec3c8b05bb62e52/F06-before.txt); [F06-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0c8a76f192785e2a/F06-after.txt); [F06.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0a4dbda5f3d8fbc1/F06.diff) |
| F07 | Live lock-aware owner | SUFFICIENT before + after | Both refuse B on stderr, exit 1; A alive, R unchanged, L busy, cwd absent; B uses a different port; A later SIGTERM → 130. [F07-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/12ac6cf4f612ed88/F07-before.txt); [F07-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4da7abb5619f1d2b/F07-after.txt); [F07.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8069eaa11a82fa92/F07.diff) |
| F08 | Crash / reused live PID / released L | SUFFICIENT before + after | Before refuses B, exit 1. After B listens, publishes new PID/ownerId and holds original L inode; SIGTERM → 130. A SIGKILL → -9 is reaped before the next namespace; unrelated PID 2 remains alive until recorded cleanup. [F08-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a389755983f1b938/F08-before.txt); [F08-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c9de4d32e419502c/F08-after.txt); [F08.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1c696d1213d7c51/F08.diff) |
| F09 | Missing L | SUFFICIENT before + after | Before refuses, exit 1. After labelled real helper returns false without creating L; CLI then creates L, listens and publishes new R; SIGTERM → 130; R removed and L free after cleanup. [F09-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/572be33bd0c5b575/F09-before.txt); [F09-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ed45cc825fc97fee/F09-after.txt); [F09.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d0add9a3d3f8f34/F09.diff) |
| F10 | Corrupt L | SUFFICIENT before + after | Before friendly refusal; after ServerOwnershipError on stdout at BEGIN EXCLUSIVE, exit 1. Probe query errcode 26; after cwd created; R and L inode/mode/hash unchanged. [F10-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ed3b65884c68f4bb/F10-before.txt); [F10-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b1b208eb4eeb0583/F10-after.txt); [F10.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0ba17972f5c81fea/F10.diff) |
| F11 | Permission denied L | SUFFICIENT before + after | Genuine uid 1000 denial while L mode 000; independent constructor errcode 14. Before friendly refusal; after acquisition ServerOwnershipError on stdout, exit 1; after cwd created. R/inode/mode unchanged during invocation; same empty-file hash verified after cleanup and mode restoration. [F11-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/adf859123675523c/F11-before.txt); [F11-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1f707a1c9c50b094/F11-after.txt); [F11.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8b944857ce8a5d1a/F11.diff) |
| F01 | Fresh/blank runtime | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F02 | Invalid/unreadable runtime | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F03 | Nonpositive PID | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F04 | Own PID | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F05 | Dead PID | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F12 | Desktop bypass | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F13 | Supervised/headless bypass | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F14 | Config-only CLI callers | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F15 | Ownership fallback / masked runtime | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F16 | Start/probe/acquire race/release | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |
| F17 | Synthetic SQLite faults | OPTIONAL / UNVERIFIED | No dedicated before/after runtime capture; correctly disclosed outside the agreed minimum. |

Read every delivered transcript in full (1,634 lines total) and all six diffs. Regenerated all 12 normalized files and six `diff -u` outputs byte-for-byte; verified all 69 recorded artifact SHA-256 values and all 47 runtime snapshot hashes. Reconstructed all separate stdout/stderr streams exactly from transcript lines. Checked per-run lock inode preservation, explicit wait results, completed independent probes before target launches, and absence of recorded host children. No wrong checkout, missing launch/cleanup step, misleading outcome, bind/module/base-dir failure, leftover child, or probe held across a target launch was found.

Inspected the complete pinned three-file diff plus preflight, registration, acquisition and error paths. Directory creation occurs after preflight but before lifetime acquisition, explaining F10/F11. Their failing acquisition cannot publish a new runtime record; the transcripts preserve original R/L state and contain no Listening line. The optional matrix entries remain proposed/labelled boundaries, not additional execution claims. No native macOS/Windows/network-filesystem coverage or full test/CI audit is asserted here.

Rebuilt F09-after using copied uploaded drivers with only the scratch-root relocation. The full rerun transcript matches the delivered one byte-for-byte after applying the unchanged normalizer and relocating the scratch prefix; the resulting diff is empty. Driver exit 0; B SIGTERM → 130; unrelated child SIGTERM → -15; all eight recorded rerun PIDs, including helper/probe/driver PIDs, are absent. No process was killed by pattern.

[F09-after.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5aea058b8ade05e5/F09-after.txt)
[F09-rebuild-comparison.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4f7519e94278a17c/F09-rebuild-comparison.txt)
[mechanical-audit.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d47ab66d96662fb3/mechanical-audit.json)
[cleanup-and-provenance.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1786f7d8cbb81c0e/cleanup-and-provenance.json)
[uploaded-artifact-validation.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3d53a53fb871bf7f/uploaded-artifact-validation.json)
[proof-audit-2-support-v2.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9fbadadaaced0ee7/proof-audit-2-support-v2.tar.gz)

All 26 public artifact/index downloads match their supplied local copies, including the uploaded driver and support archive. The new support archive contains copied drivers, raw rerun streams/transcript, normalized full transcripts, the empty rebuild diff, recomputed per-row diffs, provenance, cleanup, and audit results. Generated server state and credentials are excluded. No checkout or forge edits, pushes, comments, browsers, provider turns, or further sub-agents. All new work stays under `/tmp/lead-28256-r1/proof-audit-2/20261102T233447.172353Z-audit/`. Free disk remains 16 GB. Completed within the 45-minute budget.

FRICTION:
tool | Python urllib received HTTP 403 for public artifact downloads; curl validated all 26 URLs successfully | Use curl for this artifact host.
tool | ghdrop rejected a direct upload of the empty, successful rebuild diff | Put the empty diff in the support archive and upload a textual comparison result.

VERDICT: SUFFICIENT