Issue 17490 — REAL isolated Linux/systemd runtime AFTER proof, 2026-10-22 UTC
Built source: 00024c7f87dd842a0184500d39f5a42856178bd6 (base 70e5e384da).
A=0.1.1, B=0.1.2, C=0.1.3. Same fixed source; package version injected for each SEA build.
Integration HEAD: 0df1ba9eaefa23c18c535514cbf0ece4a67aae75.
The integration merge changed none of the four production files involved in this fix (git diff --exit-code confirmed). These are proofs of binaries built at 00024c7f87, not a post-merge rebuild.
Isolated account: triage17490 (uid1001), HOME=/home/triage17490,
T3CODE_HOME=/home/triage17490/.t3, XDG_RUNTIME_DIR=/run/user/1001.
No ubuntu ~/.t3 accessed. No browser. No implementation/test edits, commits, or forge comments.

Build: PATH=/tmp/17490-tools/node-v26.8.2-linux-x64/bin:<worktree>/node_modules/.bin:$PATH
node apps/server/scripts/cli.ts build-exe
Built A/B/C with apps/server/package.json temporarily versioned, restoring original bytes in finally after EACH build. Final package version 0.1.1; git status clean.
Each executable is a real Node SEA, accompanied by existing isolated runtime-external node_modules.
Real checksum-verified archives served on http://127.0.0.1:17491/v<VERSION>/t3-<VERSION>-linux-x64.tar.gz with SHA256SUMS.
Mock release transport only; actual app installer, service launcher, update RPC, and server were used.
The prior isolated versions were moved to /home/triage17490/17490-before/versions while the service was stopped, so no old cached runtime could bypass the fixed archives.

$ sudo -n -u triage17490 env XDG_RUNTIME_DIR=/run/user/1001 T3CODE_HOME=/home/triage17490/.t3 T3CODE_RELEASE_BASE_URL=http://127.0.0.1:17491 /tmp/17490-fixed/t3-0.1.1 service install --allow-downgrade
Updated T3 Code service with t3@0.1.1.
Logs: /home/triage17490/.t3/userdata/logs/boot-service.log
$ cat /home/triage17490/.t3/runtime/service-state.json
{"protocol":3,"activeVersion":"0.1.1","launcherVersion":"0.1.1"}
$ systemctl --user show t3code.service --property=ExecStart --property=ActiveState
ExecStart=/home/triage17490/.t3/runtime/versions/0.1.1/t3 __service-launcher
ActiveState=active
$ GET /.well-known/t3/environment
HTTP 200; serverVersion=0.1.1; serverSelfUpdate=boot-service

RPC client: real authenticated WebSocket ws://127.0.0.1:17490/ws?orchestrationProtocol=2.
Envelope {_tag:"Request",id:"1",tag:<method>,payload:<input>,headers:[]}.
Privately issued scoped bearer credential is omitted. Never printed or uploaded.
$ node /tmp/17490-fixed/rpc.cjs server.updateServer '{"targetVersion":"0.1.2"}'
{"_tag":"Exit","requestId":"1","exit":{"_tag":"Success","value":{"targetVersion":"0.1.2","method":"boot-service","updateId":"1be2d19d-9507-44ab-8332-b4ca0f83c509"}}}
$ wait for descriptor B, inspect state, server.probe
HTTP 200; serverVersion=0.1.2; orchestrationProtocolVersion=2
state={"protocol":3,"activeVersion":"0.1.2","launcherVersion":"0.1.1","update":{"id":"1be2d19d-9507-44ab-8332-b4ca0f83c509","fromVersion":"0.1.1","targetVersion":"0.1.2","status":"committed"}}
server.probe: Exit Success {}
$ node /tmp/17490-fixed/rpc.cjs server.updateServer '{"targetVersion":"0.1.3"}'
{"_tag":"Exit","requestId":"1","exit":{"_tag":"Success","value":{"targetVersion":"0.1.3","method":"boot-service","updateId":"497c9bbf-bdd4-4c93-8a37-d2ce54cb12c4"}}}

$ systemctl --user stop t3code.service
$ systemctl --user show t3code.service --property=ActiveState --property=MainPID --property=ExecStart
MainPID=0
ExecStart={ path=/home/triage17490/.t3/runtime/versions/0.1.1/t3 ; argv[]=/home/triage17490/.t3/runtime/versions/0.1.1/t3 __service-launcher ; ignore_errors=no ; start_time=[Thu 2026-10-22 01:48:38 UTC] ; stop_time=[Thu 2026-10-22 01:50:54 UTC] ; pid=316863 ; code=exited ; status=0 }
ActiveState=inactive
$ create completed cleanup-control runtime 0.1.0 from the prior isolated A fixture (never executed)
$ touch -d "2 hours ago" .../versions/{0.1.0,0.1.1,0.1.2,0.1.3}/.install-complete
$ cat runtime/service-state.json
{
  "protocol": 3,
  "activeVersion": "0.1.3",
  "launcherVersion": "0.1.1",
  "update": {
    "id": "497c9bbf-bdd4-4c93-8a37-d2ce54cb12c4",
    "fromVersion": "0.1.2",
    "targetVersion": "0.1.3",
    "status": "committed"
  }
}
$ production prunePinnedRuntimes({baseDir:"/home/triage17490/.t3",keep:["0.1.3"]}); references omitted; service stopped; uid=1001
$ sudo -n env HOME=/home/triage17490 T3CODE_HOME=/home/triage17490/.t3 /tmp/17490-tools/node-v26.8.2-linux-x64/bin/node /tmp/17490-fixed/prune.mjs
cleanup uid=1001
{"removed":["0.1.0"]}
$ assert cleanup deleted 0.1.0 and retained A/B/C
0.1.1
0.1.2
0.1.3
$ fixed CLI A service restart (starts the stopped unit)
Restarted the T3 Code service on t3@0.1.3.
{"endpoint": "/.well-known/t3/environment", "httpStatus": 200, "serverVersion": "0.1.3", "orchestrationProtocolVersion": 2}
{"_tag":"Exit","requestId":"1","exit":{"_tag":"Success","value":{}}}
$ systemctl --user show t3code.service --property=ActiveState --property=SubState --property=MainPID --property=ExecStart
MainPID=326301
ExecStart={ path=/home/triage17490/.t3/runtime/versions/0.1.1/t3 ; argv[]=/home/triage17490/.t3/runtime/versions/0.1.1/t3 __service-launcher ; ignore_errors=no ; start_time=[Thu 2026-10-22 01:51:00 UTC] ; stop_time=[n/a] ; pid=326301 ; code=(null) ; status=0/0 }
ActiveState=active
SubState=running
$ cat runtime/service-state.json
{
  "protocol": 3,
  "activeVersion": "0.1.3",
  "launcherVersion": "0.1.1",
  "update": {
    "id": "497c9bbf-bdd4-4c93-8a37-d2ce54cb12c4",
    "fromVersion": "0.1.2",
    "targetVersion": "0.1.3",
    "status": "committed"
  }
}

Exact cleanup implementation invoked (imports production function; no mocked services):
import * as Effect from '/home/ubuntu/wt/issue-17490/apps/server/node_modules/effect/dist/Effect.js';
import * as NodeServices from '/home/ubuntu/wt/issue-17490/apps/server/node_modules/@effect/platform-node/dist/NodeServices.js';
import * as ProcessRunner from '/home/ubuntu/wt/issue-17490/apps/server/src/processRunner.ts';
import {prunePinnedRuntimes} from '/home/ubuntu/wt/issue-17490/apps/server/src/cloud/pinnedRuntime.ts';
process.setgid(1001); process.setuid(1001);
console.log('cleanup uid='+process.getuid());
const removed=await Effect.runPromise(prunePinnedRuntimes({baseDir:'/home/triage17490/.t3',keep:['0.1.3']}).pipe(Effect.provide(ProcessRunner.layer),Effect.provide(NodeServices.layer)));
console.log(JSON.stringify({removed}));

Exact control/aging/deletion verification commands:
sudo -n -u triage17490 bash -c 'mkdir /home/triage17490/.t3/runtime/versions/0.1.0; cp /home/triage17490/17490-before/versions/0.1.1/t3 /home/triage17490/.t3/runtime/versions/0.1.0/t3; printf "0.1.0\n" > /home/triage17490/.t3/runtime/versions/0.1.0/.install-complete'
sudo -n -u triage17490 touch -d '2 hours ago' /home/triage17490/.t3/runtime/versions/{0.1.0,0.1.1,0.1.2,0.1.3}/.install-complete
sudo -n -u triage17490 bash -c 'test ! -e /home/triage17490/.t3/runtime/versions/0.1.0; for v in 0.1.1 0.1.2 0.1.3; do test -x /home/triage17490/.t3/runtime/versions/$v/t3; done'
The production pruner selects/renames the unreferenced version then recursively deletes it; no direct rm of A/B/C/control was substituted for production cleanup.
Only C was passed in keep; no unit references were supplied, no T3 launcher was running. State preserves A (launcher), B (fromVersion), C (active/target). All sentinels were older than the one-hour grace.

Teardown:
systemctl --user stop t3code.service
kill <captured release-server PID 314751>
Removed the added loopback T3CODE_RELEASE_BASE_URL line from isolated service.env.
MainPID=0
ActiveState=inactive
SubState=dead

No listeners remained on 17490/17491. Service left stopped; fixed runtime/state remain for inspection. Prior fixtures preserved under isolated account's 17490-before.

Prior focused tests (separate from runtime proof): base red had three intended failures (launcher persistence, install state, prune retention); fixed green 63/63 across three files. Logs retained separately.
Migration requirement: reinstall using fixed CLI AND restart into fixed launcher before relying on state-based retention. An old running launcher can drop launcherVersion on its next write; remote update alone does not retrofit it.
Unverified: macOS launchd and Windows behavior; legacy-launcher migration beyond this documented reinstall/restart; no browser/UI proof was required (server-only proof matrix []).
FRICTION: tool host stalled ~70 minutes during C build. Existing build was inspected, not duplicated; completed C reused. First isolated install attempt inherited inaccessible ubuntu checkout cwd and failed before install; rerun from /tmp succeeded. Initial SEA probe needed the external node_modules tree beside the binary. No remaining runtime blocker.