# R3 audit reconciliation into the release candidate

Actual Claude Opus 5 and Grok Heavy independently returned ACCEPT WITH LIMITS for exact 0.0.0-prototype.3. Both read the eight supplied files without reported truncation and did not execute tests. Those verdicts do not cover the new release version, question tree or native binding.

Claude identified low-severity weaknesses despite accepting the trusted-host scope. The separate 0.1.0 candidate replaces an optimizable version assertion with an unconditional guard; versions snapshots and evaluator reports; rejects proposal/review identity reuse and active immediate supersession by identity/revision even with a wrong digest; distinguishes future-assessment/not-yet-valid/expired; and adds direct import-order, cross-proposal, duplicate, time, size/depth/container and actor-list tests. The R3 bytes remain untouched.

Documentation now says active review pins are scoped to the exact proposal revision, reference coherence covers all roles including evidence, withdrawn entries reveal pins only, strings are bounded to 4096 code points, and disposal cannot leave dangling internal references. No tombstone mechanism was invented. Claude's characterization of 128 as a strict lifetime limit is too broad: code checks existing+incoming count, not a lifetime counter. It becomes a growth ceiling when history is retained indefinitely. A reference-closed host removal may reduce the count but remains outside this reference and may be prohibited by actual custody policy; no disposal method or automatic migration is claimed.

Grok classified these as optional strengthening/host limits and suggested snapshot-wide coherence and walking supplied supersession ancestry. The candidate adopts version binding. Snapshot-wide one-revision-per-ID is not imposed because active/withdrawn sets may legitimately retain different historical revisions; cross-context truth remains host-owned. Walking only supplied active records cannot discover omitted intermediate records, and the immediate-target check already rejects a supplied edge. The transitive deactivation duty remains explicit; no completeness guarantee is invented.

The final candidate adds a separately tested native storage binding and 24 explicit question routes. Local checks, host duties and deferred policy/classification/custody mechanisms are distinguished in the tree. A new frozen full-package audit is required before publication; this reconciliation is Codex synthesis, not an external-provider verdict.