PR: https://git.cafe/pingdotgg/t3code/pulls/24556
main: 9c6429d74b (github/main fetched 2026-10-28)
head: e0a8dd53ded809d63ce23c6373e4085d7d02a803

Both checkouts: vp i; background vp run dev with isolated .t3 homes, no seed.
Playwright from repo dependencies, /usr/bin/google-chrome.
Created verification-repo project through the UI, selected Codex gpt-6.1-sol,
attached apps/web/public/apple-touch-icon.png, submitted an image-description request.
Both real provider turns identified the T3 image and returned ATTACHMENT VERIFIED.

Observed actual HTTP responses and searched whole server.trace.ndjson for each issued token:
                         main                     PR head
signed upload POST       204, token occurs 3x      204, token occurs 0x
signed asset GET         200, token occurs 3x      200, token occurs 0x

PR neighboring checks:
asset HEAD: 200, 0 body bytes, image/png
asset GET with query string: 200, 113787 bytes, image/png
SHA-256 matches source: 4943ac41cc004f826c95d6da34e0b04c387cf54982fc424ba3da8b68dc4598db
invalid asset token GET: 404
invalid upload token POST: 404
/api/assets-other/file.png: 404, HTTP span still recorded
/.well-known/t3/environment: 200, HTTP spans still recorded
reloaded thread: stored attachment renders, expanded preview opens and closes
plain Codex follow-up: PLAIN TURN VERIFIED
Tokens remain absent after neighboring checks and preview reloads.

blacksmith-check run --id <task-box> "vp i && vp test run apps/server/src/http.test.ts"
Test Files  1 passed (1)
Tests       24 passed (24)

No code changes. Existing CI: 28 successful, 0 failing, 0 pending.
A 25-second CPU overload occurred during initial PR startup; recovered before verification.
Unverified: native desktop/mobile, external OTLP collector, remote relay/tunnel,
other providers. Debug HTTP request logs are separate from traces and retain paths.