PR #27559 real-environment verification, 2026-11-01, Linux Boat VM

main: ce48e45900 (github/main)
original PR: f0a841003d5c4569fbddbcaccd4818249c5a1b87

Installed each checkout with vp i. Ran one background dev server at a time.
main: server 16733, web 8693; PR/fix: server 13773, web 5733.
Used repo Playwright with /usr/bin/google-chrome, real browser-session auth,
and the production /ws Effect RPC protocol. No mocks or seeded fixtures.

Created a project pointing to /home/user/t3code using the running app's t3 CLI.
Started Codex gpt-6.1-sol through t3 thread start, then read its real reply
in the web client: "codex settings baseline ok."

Sent server.updateSettings with a disabled unknown-driver provider instance,
preserving existing providers, whose config was JSON.parse of:
{"nested":{"__proto__":{"polluted":true},"kept":1},"list":[{"__proto__":{"polluted":true},"kept":2}]}
This uses the supported opaque config round-trip path for unknown drivers.

main and original PR both returned Success and retained own __proto__ keys
in nested and list[0]. server.getConfig returned the same retained keys.
Reason: applyServerSettingsPatch replaced the sanitized provider map with
raw patch.providerInstances after deepMerge.

Fix: sanitize rawPatch with deepMerge before special replacement handling.
Extended the existing providerInstances replacement test. It failed before
the fix with both __proto__ keys in Received, then passed after the fix.

Restarted the real dev server with the fix and repeated the same RPC input:
Success, nestedProtoKey=false, arrayProtoKey=false,
roundTripNestedProtoKey=false.
Ordinary output: {"nested":{"kept":1},"list":[{"kept":2}]}.

Neighbor check on main, original PR, and fixed server:
server.updateSettings {patch:{storageCleanup:{worktreeAfterDays:17}}}
returned Success, worktreeAfterDays=17, worktreeKeepWhen sibling preserved.
Restored the prior provider map and cleanup interval after each probe.

Sent a follow-up through t3 thread send --wait --json with Codex gpt-6.1-sol:
{"status":"completed","reply":"codex after sanitized settings ok.","error":null}
Viewed both real assistant replies in the web client.

Blacksmith checks:
- focused replacement test failed before fix (1 failed)
- Struct.test.ts + serverSettings.test.ts after fix: 44 passed
- vp run check:changed against PR base 32ecd71726fe: all passed
  format, lint, both knip passes, affected typechecks, 45 tests in 3 files
The remote snapshot needed its missing shallow ancestry fetched before
check:changed could determine the merge base.

Not exercised: native Electron shell, iOS/Android, other providers, remote
relay/tunnel. Cycles are covered by the existing shared test; JSON WebSocket
inputs cannot represent cycles. This is a server-side fix, with transcript
as the primary evidence. No performance claim or global prototype pollution
claim is made.