# Proof audit, pass 1: server runtime fixture matrix

PR [#25999](https://git.cafe/pingdotgg/t3code/pull/25999), branch `fix/issue-17225`.
Reviewed head [7a90b56](https://git.cafe/pingdotgg/t3code/commit/7a90b56c54a924d63d91c40e3eecd96d048c1da4), against merge-base [36d4d71](https://git.cafe/pingdotgg/t3code/commit/36d4d711b79c73eb33131944f73ea4a8c6156484).

## Findings first

1. **Evidence gap, blocks a sufficient proof verdict:** the existing [runtime transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/50c959fdcca3bd86/runtime.txt) contains only `stat`, `.install-complete`, and `t3 --version` for a manually prepared launcher directory. It does not execute the changed BootService install, status, swap, fallback, or uninstall paths. Keep it as supplementary packaging evidence; it satisfies none of the minimum rows below.
2. The [red transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a25bf9c66e860f2a/red.txt) demonstrates the versioned-path regression. The [green transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6f174cd16d11969d/green-final.txt) reports 55 passing tests at the immediately preceding code revision; the diff from that revision to the requested head changes only documentation. These support the tests, but do not replace runtime captures. The new test runner always rejects `cp -c` and fabricates a partial destination, so those tests cover the fallback, not the successful clone-command branch.
3. **Platform limit:** a Linux driver can execute the real service logic and real filesystem operations with a forced darwin manager. It cannot prove launchctl behavior, TCC grant persistence, APFS cloning, or survival of a running signed Mach-O. Those claims remain explicitly `cannot-verify macos`.
4. **No rendered UI exists in this diff.** Web/desktop/mobile layouts, themes, widths, loading states and provider adapters do not create fixtures here. The captures are ordered runtime transcripts. This is a proof audit, not a new implementation review; no new confirmed product defect is asserted.
5. Remote update commit leaves an older launcher/unit on main as well. The existing review withdrew that as a regression. Include C04 as a characterization control, not a demand to republish during remote commit.

## Reachability and branches derived from source

Source: [bootService.ts](https://git.cafe/pingdotgg/t3code/blob/7a90b56c54a924d63d91c40e3eecd96d048c1da4/apps/server/src/cloud/bootService.ts), [service CLI](https://git.cafe/pingdotgg/t3code/blob/7a90b56c54a924d63d91c40e3eecd96d048c1da4/apps/server/src/cli/service.ts), [update CLI](https://git.cafe/pingdotgg/t3code/blob/7a90b56c54a924d63d91c40e3eecd96d048c1da4/apps/server/src/cli/update.ts), [uninstall CLI](https://git.cafe/pingdotgg/t3code/blob/7a90b56c54a924d63d91c40e3eecd96d048c1da4/apps/server/src/cli/uninstall.ts), [service launcher](https://git.cafe/pingdotgg/t3code/blob/7a90b56c54a924d63d91c40e3eecd96d048c1da4/apps/server/src/serviceLauncher.ts).

- `BootService.make/layer`: Linux selects systemd with versioned runtime paths. Darwin with HOME and UID selects launchd and stable launcher paths. Empty HOME, missing darwin UID and unsupported platforms select no manager. Architecture controls archive choice, not the new destination. Use a custom T3 home containing spaces and XML-sensitive characters in at least one darwin lifecycle capture; verify the parsed program remains the actual path.
- Callers of install: `service install`, deprecated `service update`, onboarding reconciliation, and `t3 update` through a target-version BootService layer. Reconciliation skips an already-current service; direct `BootService.install()` republishes even at the same version. Update may request activation or stage with `start:false`. Systemd inside-service activation hands off before publishing; launchd does not take that branch.
- Install ordering: ensure/validate versioned runtime; stop an installed service if starting; refuse pending update or unapproved downgrade; write restart marker and target state; recheck state for `start:false` on installed service; publish launcher on darwin only; write unit; optionally activate and clear marker. Error recovery attempts to restart an existing service. Guards before publish must not replace the launcher.
- Copy: successful `cp -c -pR` skips `fs.copy`; process failure/nonzero exit removes partial destination and falls back to real `fs.copy`; fallback failure exits through staging cleanup. Copy timeout is ten minutes; capture the configured timeout, not a ten-minute wait.
- Publish: unique staging directory, whole runtime copy; no previous launcher versus replacement; old-directory rename failure; next-directory rename failure with optional rollback; rollback failure is ignored; staging removal always runs and its errors are ignored. Only the two renames are uninterruptible. Cooperatively interrupted copy, interrupted swap, overlapping installs and abrupt process death are different cases; no claim that uninterruptible Effect code survives SIGKILL or power loss.
- Status: unsupported; supported without unit; installed with exact rendered unit (PATH normalized on launchd), both runtime entries and matching readable sentinels, matching parsed state, no pending update and no restart marker. Any failed predicate makes `current:false`. Missing entry, missing/unreadable sentinel and other-version sentinel exercise the added launcher predicate. A valid launcher cannot hide a broken versioned source runtime. `installedVersion` comes from service state, not the launcher sentinel.
- Uninstall callers: `service uninstall` and full `t3 uninstall`. With a unit: deactivate, remove unit, remove exact `launcher` and `launcher.next-*` entries, leave other siblings, finalize. Without a unit: return false before cleanup. Directory listing failure is swallowed; matching entry removal failure is reported. Systemd does not remove launcher directories. Restart and maintenance methods do not publish; use restart after staged update to clear its marker.

## Capture contract and seeding recipes

Every new run belongs in a fresh timestamped subdirectory of `/tmp/lead-25999-r1/proof-audit-1/`. Preserve driver source and all raw logs. Do not modify the lead worktree or real HOME/T3 home. No dev server, browser, production service manager, or live database is needed for this matrix.

**A — real-service driver on Linux.** Run from an `apps/server` module context with the installed dependencies. Import the real `BootService.make` or `BootService.layer`, provide NodeServices, a ConfigProvider with HOME pointing inside the run directory, HostProcess platform/UID/architecture/executable services, an HttpClient that rejects unexpected downloads, and a ProcessRunner wrapper. Delegate validation (`t3 --version`) and the actual copy command to the real process runner; intercept only launchctl/systemctl/loginctl/systemd-run into an ordered command log with explicit fake results. Seed complete native Linux release runtime directories A and B with their real release versions and `.install-complete`; forcing `darwin` changes manager selection while the preseed prevents a macOS download. Do not claim the ELF runtime is a macOS binary. Seed all required assets, not just `t3`.

For before/after, use source snapshots from each specified git revision under scratch (for example read-only `git archive` extraction of the server source; link its server dependency directory to the existing server dependency directory). Use each snapshot's real BootService module and unchanged dependencies, with the same driver and equivalent isolated input. This creates scratch source fixtures, not another Git worktree. Do not copy the implementation into the driver. Use real release versions for A/B; `1.2.3`/`1.2.4` below are illustrative only.

**B — labelled fault/coordination harness.** Same real service layer and real filesystem as A, with narrowly wrapped FileSystem or ProcessRunner operations to inject a named failure or Deferred barrier. A shell-script runtime fixture is acceptable for these rows only when explicitly labelled synthetic. Log injected operation, error, barrier entry/release and Fiber outcome. A simulated successful clone command must actually copy the complete directory before returning success; it is not APFS proof. Existing test arrangements are useful templates, but do not run a reimplemented publish algorithm.

**C — CLI/caller control.** Exercise the real reconciliation/update caller when feasible, with terminal/network/service-manager boundaries faked and disclosed. If only the BootService layer is driven, mark caller skipping and prompt choices as source-traced, not executed. Onboarding and the deprecated alias share reconciliation and do not need separate copies of all lifecycle fixtures. Full uninstall should use a fake confirmation response and an isolated owned install; direct `service.uninstall` suffices for the changed helper, but does not prove full CLI deletion.

**M — real macOS only.** Requires an isolated macOS user service and Developer ID-signed versions with the same designated requirement. Do not perform this from the Linux VM and do not infer it from fake launchctl. Requires separate authorization/environment access.

For every checkpoint print: revision SHA, fixture ID and provenance; real versus intercepted commands/arguments/exit status; install options and returned plan/error; full plist ProgramArguments or systemd ExecStart; sorted runtime tree with modes, regular-file/symlink type and sentinels; hashes of source/copied executable and another runtime asset; service-state and restart marker; structured `status` output. Include raw failures, not only PASS summaries. Assert normalized stable paths across distinct run roots. For failure rows, print the old binary hash, expected prior state and marker before/after. Do not assert `current:true` after a failed publish: state/marker are written before publishing.

`recording` means an ordered transcript with precondition, operation(s), intermediate milestones when relevant, and final state; isolated final outputs are insufficient. Static status fixtures can be snapshots, but may be bundled as checkpoints in a recording. No video is needed for these server-only transcripts.

## Fixture matrix

Status is the state at pass 1: no requested real-code runtime captures exist yet. “Minimum” identifies the capture set required for the Linux proof gate; optional controls are explicitly distinguished. Rows may share one transcript if every named checkpoint and assertion is present.

| ID | Named fixture and seeded data | Diff effect / minimum | Medium and seed | Required observation | Pass-1 status |
| --- | --- | --- | --- | --- | --- |
| D01 | Darwin first install: no plist/launcher; complete runtime A; `start:true` | Changed / yes | recording A, before + after | Before names versions/A/t3; after names launcher/t3 with `__service-launcher`; complete assets/modes/sentinel A; enable/bootstrap log; marker cleared; current true | MISSING |
| D02 | Legacy migration: seed actual base-generated versioned plist/state A, then head install B | Changed / yes | recording A, base-seeded then head | One move from versions/A/t3 to launcher/t3, version B complete, current true; existing grants require one further approval only checked in M02 | MISSING |
| D03 | Fixed-path version update: install A then B in each revision | Changed / yes | recording A, before + after | Base program changes A to B; head program stays identical; copied content/sentinel become B; no `.next-*`; old open file descriptor still reads A | MISSING |
| D04 | Same-version reinstall/repair: current A; then launcher absent or stale A-minus-one while source/state stay A | Changed / yes | recording A + C, before + after | Current CLI reconciliation skips; damaged head status false causes same-version repair, launcher A/current true; direct layer reinstall is a separately labelled republish | MISSING |
| D05 | Installed A staged to B with `start:false`, then restart | Changed / yes | recording A, before + after | New launcher B at fixed path without stop/bootstrap during stage; service.env unchanged; restart marker and current false until restart; restart clears marker/current true | MISSING |
| D06 | First install with `start:false`, no unit/launcher | Changed / optional API branch | recording A | Publishes complete launcher and plist, no manager activation, restart pending/current false; later restart works | NOT CAPTURED, optional |
| D07 | Healthy installed A, launcher/t3 removed while source/state/unit intact | Changed / yes | snapshot A at both revisions | Head installed true, installedVersion A, current false; base ignores extraneous launcher damage | MISSING |
| D08 | Healthy installed A, launcher sentinel absent or made unreadable via explicit read fault | Changed / yes | snapshot A; unreadable variant B | Same installedVersion, current false; no status crash; report absent and read-error subcases distinctly | MISSING |
| D09 | Healthy installed A, launcher sentinel B or malformed version text | Changed / yes | snapshot A, before + after | Current false despite valid source/state A; whitespace around exact A remains accepted; reinstall repairs sentinel | MISSING |
| D10 | Healthy launcher A but versioned source entry or source sentinel absent/mismatched | Predicate refactor / yes | snapshot A, before + after | Both versions remain not current; valid copied launcher cannot hide source damage | MISSING |
| D11 | Successful clone-command result during first publish and replacement | New branch / yes | recording B; actual command only on macOS | Command exactly `cp -c -pR source destination`, ten-minute timeout; complete copy; no fs.copy fallback. Linux success simulation explicitly labelled harness | MISSING, harness |
| D12 | Clone-command nonzero after partial destination; also runner-level error | New branch / yes | recording A for real GNU rejection; B for partial/error variants | Actual fallback removes destination before fs.copy, no nested source/partial t3 retained, complete assets/modes; output records each result | MISSING, mixed real/harness |
| D13 | Clone attempt fails and fallback copy fails after partial work, old A present | New branch / yes | recording B | Install error; old launcher hashes intact; staging removed; marker/current false visible; no new unit publication | MISSING, harness |
| D14 | First publish next-to-launcher rename fails, no previous launcher | New branch / yes | recording B | Install error, no rollback rename, no unit published, staging removed; marker/state documented | MISSING, harness |
| D15 | Replacement old-launcher-to-previous rename fails | New branch / yes | recording B | Install error; old launcher A remains complete; no next promotion/rollback; staging removed | MISSING, harness |
| D16 | Replacement next-to-launcher rename fails after old A moved aside; rollback succeeds | New branch / yes | recording B | Log old move, promotion error, restore; old hashes/sentinel restored; staging gone; error retained and status/marker shown | MISSING, harness |
| D17 | Cooperative interruption during copy and between the two swap renames | New temporal behavior / yes | recording B using Deferred barriers, no sleeps | Copy interruption leaves old A; mid-swap interruption waits until uninterruptible swap completes; final program exists/executable; log Fiber exit plus state/unit/marker, not only existence | MISSING, harness |
| D18 | Two updates overlap: B copied, C partially copied, release B then C | New temporal behavior / yes | recording B using Deferred barriers | Distinct staging paths; final program/assets/sentinel correspond to one complete version; capture both install exits, state/marker and any current false result; never claim both installs necessarily succeed | MISSING, harness |
| D19 | Publishing succeeds but launchctl bootstrap fails; then retry | Changed adjacent behavior / yes | recording B | Complete fixed launcher remains; install error and restart pending/current false; retry activates and clears pending/current true | MISSING, harness |
| D20 | Uninstall installed A with exact launcher, multiple launcher.next-* leftovers, and similarly named unrelated siblings | New cleanup / yes | recording A, before + after | Bootout before unit removal; launcher and all next-* removed; versions and unrelated siblings remain; return true/status not installed; second uninstall false | MISSING |
| D21 | Uninstall with no plist but launcher/staging leftovers (e.g. abrupt failed first install) | Cleanup early-return boundary / yes | recording A with seeded leftovers | Returns false and leaves leftovers: cleanup only runs when a unit exists. Capture this limit; do not describe uninstall as unconditional orphan recovery | MISSING |
| D22 | Cleanup failures: staging removal fails; runtime directory listing fails; matching entry removal fails | New error branches / optional characterization | recording B with named isolated faults | Staging failure ignored and leftover visible; readdir failure ignored; entry-remove failure surfaces after unit removal. Never report unconditional cleanup success | NOT CAPTURED, optional |
| D23 | Promotion fails and rollback rename also fails | New error branch / optional characterization | recording B | Preserve raw two-error sequence and resulting launcher/staging tree; rollback error is ignored and final cleanup may remove previous copy. Do not claim recovery under arbitrary double failure | NOT CAPTURED, optional |
| C01 | Linux first install, A-to-B update, staged update/restart, status and uninstall; seeded sentinel launcher sibling | systemd control / yes | recording A, before + after | ExecStart remains versions/<v>/t3; no cp/launcher publish; Linux status ignores launcher sibling; uninstall leaves it untouched; service lifecycle/markers unchanged | MISSING, control |
| C02 | Linux installed service, inside-service `start:true` update | handoff control / yes | recording B, before + after | systemd-run handoff uses versioned executable; returns handedOff before state/unit changes; no launcher/cp work | MISSING, control harness |
| C03 | No manager: unsupported platform, empty HOME, or darwin UID absent; supported manager with no unit | unchanged selectors / optional | snapshots A/B | Unsupported status false and install/uninstall unsupported; supported absent unit installed false/current false, no launcher checks | SOURCE-TRACED, optional |
| C04 | Remote launcher commits B while launcher/plist still A, then same-version service repair | preserved status behavior / optional | recording B, before + after | `current:false` in both revisions until CLI repair; head later republishes B at fixed path. Seed state only if labelled characterization, not actual remote-update capture | SOURCE-TRACED, optional |
| C05 | Installed service with pending update, refused downgrade, concurrently overwritten state, changed PATH, mismatched unit or invalid state | guards/status controls / optional | recording B; normalized PATH snapshot A | Guards before publish leave launcher unchanged; pending/invalid/mismatched status false; PATH-only launchd difference remains current. Unchanged restart/withStopped guards retain existing coverage | SOURCE-TRACED, optional |
| M01 | Actual launchctl install/migration/update/restart/uninstall with signed runtimes; loaded versus unloaded job | Real OS integration / macOS-only | recording M | Actual ProgramArguments and launchctl job/PIDs; real successful restart and cleanup; no fake manager results | cannot-verify macos |
| M02 | Grant Full Disk Access to fixed signed A, update to signed B; include staged update while old launcher runs and protected-folder agent access | Core user outcome / macOS-only | recording M, before + after | Same designated requirement; fixed path; no renewed approval/duplicate entry; protected-folder read succeeds; old signed process survives swap. Legacy migration separately needs one regrant | cannot-verify macos |
| M03 | APFS clone success, plus actual non-clone/copy fallback environment if available | Real filesystem optimization / macOS-only | recording M | Native cp exit, copied asset/mode/signature checks and reliable clone evidence; logical du/file size alone does not prove shared extents | cannot-verify macos |

## Minimum deliverable bundles

- K1 lifecycle: D01-D05, including real base-to-head legacy migration, and the reconciliation skip/repair distinction. An A-to-B sequence alone does not prove migration from an already-installed base plist.
- K2 static predicate sweep: D07-D10 as separately labelled checkpoints, including both sentinel absence and read failure. Bundle with K1 if useful.
- K3 copy decisions: D11-D13. Successful-clone simulation must say harness; real APFS remains M03.
- K4 publish failures: D14-D16; print marker/state/error as well as restored files.
- K5 coordination: D17-D18, with deterministic barriers and all operation exits.
- K6 activation retry: D19.
- K7 cleanup boundary: D20-D21; explicitly preserve unrelated siblings.
- K8 Linux regression control: C01-C02.

Minimum required rows are D01-D05, D07-D21, C01-C02: 22 rows, which can share these eight transcript bundles. D06, D22-D23, C03-C05 are enumerated branches/controls outside the minimum capture set. M01-M03 must remain labelled cannot-verify until macOS evidence exists; Linux completion cannot convert them to verified.

## Coverage and limits

Inspected all three changed files against the stated merge-base, the complete changed service methods in context, manager selection and rendering, install/status/uninstall callers, CLI update decisions, pinned-runtime validation, and launcher child/update behavior. Read PR metadata, status, relevant review discussion, linked issue description, and all three existing evidence transcripts. No tests or service drivers were run in pass 1. No code edits, pushes, comments, servers or browsers were made. Source worktree was clean when inspected. Initial and final disk checks reported 35 GiB available, above the 5 GiB stop threshold.

FRICTION:
- tool | Web fetch could not open the three evidence URLs; Python urllib received HTTP 403 | Use curl with an explicit browser User-Agent for these public artifact URLs; all three downloads then succeeded.

VERDICT: INSUFFICIENT D01-D05, D07-D21, C01-C02 still need captures; M01-M03 cannot-verify macos