# Evidence for PR [#25970](https://git.cafe/pingdotgg/t3code/pull/25970)

Captured **12/13 matrix rows**: all nine required Linux rows and all three optional normal parent baselines. W remains **cannot-verify windows**. Every affected executable row has its own complete raw test-run transcript. No code, PR body, server, browser or live data changes.

Linux x86_64, VM fs-35, kernel 6.1.102; package-selected Node v24.22.1 for S rows and v26.12.1 for O/A rows (direct and vp exec agree on both revisions); Vite+ 1.4.0 / Vitest v5.0.5, default forks pool, verbose reporter. Harness fixtures only; no rendered UI. Browser/device emulation, DPR, font scaling, viewport, theme, screenshots, diff thresholds and frozen clock: N/A. The existing tests seed their own scoped synthetic temporary files; no production database was read or seeded.

P=passed, F=failed, S=skipped, —=test belongs to another package and is not registered in this row. Normal rows clear NODE_OPTIONS; EPERM rows require the downloaded preload, SHA-256 `e364864529ef79a816183b75d210f52b7fc134bc220b318de3dcaddf93cecdde`. Raw transcript headers contain the actual SHA, cwd, UTC, runtime, NODE_OPTIONS, preload hash and exact command; each ends with its exit code. Test stdout/stderr are complete and unedited.

## Per-row summary

| Row / raw transcript | SHA | EPERM preload | P/F/S | S1 | S2 | S3 | O1 | O2 | A1 | A2 | E1 | E2 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| [S-P-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8e9e31c62c50fae9/S-P-N.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | no | 100/0/0 | P | P | P | — | — | — | — | P | P |
| [S-P-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0aa6f43efd9a394/S-P-E.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | yes | 95/3/2 | F | F | F | — | — | — | — | S | S |
| [S-H-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/41dbdaef03519a0c/S-H-N.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | no | 100/0/0 | P | P | P | — | — | — | — | P | P |
| [S-H-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9697f43078ebc8a8/S-H-E.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | yes | 95/0/5 | S | S | S | — | — | — | — | S | S |
| [O-P-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a59a427dea14392e/O-P-N.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | no | 5/0/0 | — | — | — | P | P | — | — | — | — |
| [O-P-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/981c3b2b1e11b1a9/O-P-E.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | yes | 3/2/0 | — | — | — | F | F | — | — | — | — |
| [O-H-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8fbd9fe27fec7792/O-H-N.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | no | 5/0/0 | — | — | — | P | P | — | — | — | — |
| [O-H-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/723d683a2d8c8696/O-H-E.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | yes | 3/0/2 | — | — | — | S | S | — | — | — | — |
| [A-P-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/85e4d1d71275d317/A-P-N.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | no | 13/0/0 | — | — | — | — | — | P | P | — | — |
| [A-P-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a13f009bbe6aadf2/A-P-E.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | yes | 11/2/0 | — | — | — | — | — | F | F | — | — |
| [A-H-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/faeaabb8752e6a6a/A-H-N.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | no | 13/0/0 | — | — | — | — | — | P | P | — | — |
| [A-H-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ba950066d15dc30f/A-H-E.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | yes | 11/0/2 | — | — | — | — | — | S | S | — | — |

## Evidence sheets

- [Server settings and session scanner](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cc47ccb7c53ef6a4/S-sheet.md)
- [OpenCode usage](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4b0010e17c8ff90a/O-sheet.md)
- [ACP permissions](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1b0ea3fa495a3e77/A-sheet.md)

Each sheet includes Before/After transcript links, revision SHAs, all guarded test statuses, outcome comparisons, and an EPERM stack excerpt for every parent failure. Diff0 means exact per-test outcome comparison; image thresholds are N/A.

## What else changed

None: all 118 unique test names were compared across revisions under both modes. Normal mode: 118 passes on each revision. EPERM mode: parent 109P/7F/2S (three expected nonzero runs), head 109P/0F/9S (all runs exit zero). Only S1/S2/S3/O1/O2/A1/A2 change F → S; E1/E2 remain skipped under EPERM. No other failures, skips, added/missing test names or unhandled errors.

## Test identifiers

- **S1**: `server settings > saves through a symlinked settings file without replacing the link` (new guard)
- **S2**: `AgentSessionScanner > scan > returns the imported project ID through a realpath alias` (new guard)
- **S3**: `AgentSessionScanner > scan > excludes sandboxes reached through a symlink into the worktrees dir` (new guard)
- **O1**: `readOpenCodeUsage > never follows symlinks in the legacy OpenCode store` (new guard)
- **O2**: `openCodeUsageReader > scans canonical instance roots once, including XDG and home defaults` (new guard)
- **A1**: `acpPermissionDisposition > denies mutations through workspace symlinks that escape the writable roots` (new guard)
- **A2**: `acpPermissionDisposition > allows existing and new files beneath canonical writable roots` (new guard)
- **E1**: `AgentSessionScanner > recentThreads > rechecks claudeAgent snapshot cwd after replacement with symlink alias` (existing control)
- **E2**: `AgentSessionScanner > recentThreads > rechecks codex snapshot cwd after replacement with symlink alias` (existing control)

## Reproduction inputs and drivers

- [capture.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/77fe5bb2049ba082/capture.py)
- [summarize.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8252af32fd724de1/summarize.py)
- [no-symlink-preload.cjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56adb289d60d806e/no-symlink-preload.cjs)
- [proof-matrix.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1898be9d416b985/proof-matrix.md)
- [parent-install.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cce2a2cdabbccb06/parent-install.txt)
- [manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/32ded61b1709336d/manifest.json)
- [observed-outcomes.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd7373dc2c8339a9/observed-outcomes.json)

To reproduce: create the detached parent checkout and run `vp install`; leave the supplied head checkout at its exact SHA. Download the preload beside `capture.py`, then run `python3 capture.py`. It creates a fresh timestamped run directory and captures all twelve exact matrix commands. Run `python3 summarize.py /absolute/path/to/run-directory` to validate every row and generate the sheets, or add `--upload` to upload with ghdrop. The fixture seeds are the checked-in test bodies; no separate seed script was needed.

## Unverified rows

- W: **cannot-verify windows** — native Windows with symlink permissions denied is unavailable on this Linux VM. EPERM injection does not establish native Windows behavior. No Linux rows are missing.

FRICTION: infra | Native Windows unavailable, as stated in brief; W cannot run here. | A Windows runner without Developer Mode/elevation would verify W.