T0-E1 independent runtime evidence

Live probes

Probe	Independent result
Active-role conflict	A school-admin active session with inactive assigned platform role successfully reset GT-T2 user 104. This is a real S0 failure; state was restored.
Direct RPC mutation	Teacher attachment create through /web/dataset/call_kw yielded 403 response object and exact-name DB count stayed 0.
Must-change API	Protected /api/dashboard/stats denied while scola_must_change_password=true.
Must-change RPC	Same account read res.users through /web/dataset/call_kw, returning its own row. This violates the required no-normal-RPC authority property.
Core tenant read	GT-T1 school admin read GT-T2 partner id 138 through native res.partner.search_read; response contained company 22.
Core Scola student API	T2 disposable student was created and removed; T1 /api/v1/core/students/search returned no T2 row and admin detail returned not-found.
Optional API flags false	principal/performance, executive/finance/summary, executive/tuition, and principal/leave returned feature-disabled; executive academic routes returned capability-denied.
Native reset/signup	/web/reset_password 404; /web/signup?token=bad 200; auth_signup.invitation_scope=b2c.
Token concurrency	Two simultaneous confirm requests with one token: exactly one success and one invalid; token consumed once; password restored.
Route denominator	1,715 extracted, 1,678 protected, 34 public, 3 internal, 0 unknown/ambiguous; checker passed.

Evidence limitations

The E1 tenant JSON contains an earlier failed relation case and later reruns, but the final 27/27 subset still has no valid T2 partner/RPC probe. The 19-case credential matrix records no audit-row assertion and labels rapid sequential requests as concurrent. The validator mutation suite is synthetic and does not validate evidence-case IDs, runtime backend identity, Golden module state, or served URL identity.

Cleanup

The disposable T2 student/partner and temporary role/password changes were removed/restored. No application source was changed. FE implementation evidence files and the pre-existing recon XLSX remain as working-tree items from before this audit.