# Reproduce issue 13239 runtime evidence

Use a Linux x86_64 host with the real user manager reachable, Linger=yes, and the existing t3code.service enabled and active. **Do not change manager state to obtain these conditions. Stop when any production status gate fails.** The real unit may be the parent runtime: never install/reload/start/stop/restart/enable it. Do not execute printed recovery advice.

The attached capture program creates only synthetic files under an owned temporary root. The status service is the real implementation, with real ProcessRunner, NodeServices, and FetchHttpClient layers. No functions, output, subprocesses, or host arguments are mocked. The synthetic pinned runtime file is a nonexecutable sentinel, never launched. Synthetic unit text is rendered from BootService.renderBootServiceUnit and pinnedRuntimePaths; it is never loaded into systemd. Status intentionally combines isolated filesystem checks with read-only probes of the existing real unit, not a running synthetic service.

Prepare an owned `mktemp -d` directory, export no global HOME/PATH changes, and extract exact `git archive` copies into its base/ and head/ children. Revisions are base [8d3b061121](https://git.cafe/pingdotgg/t3code/commit/8d3b061121fe65669d5d43d011b48cd3027a4108) and head [dd9793b9dc](https://git.cafe/pingdotgg/t3code/commit/dd9793b9dca694d5303dbc35ed90a146af4d9272). No worktree registration is needed. Link installed dependencies into these disposable copies only. The captured run linked this task checkout's root/apps/packages node_modules; unchanged shared workspace packages resolve from that checkout. The complete revision diff touches only five apps/server files, so those linked workspace sources have no base/head implementation difference. No source implementation was patched.

Use the actual installed Node 26.12.1 executable (not the Vite `node` shim). Keep PATH exactly inherited. In this VM the real Node path was `/home/ubuntu/.local/share/vite-plus/js_runtime/node/26.12.1/bin/node`.

For each copy, build with command-local HOME=<root>/build-home, T3CODE_HOME=<root>/build-t3, T3CODE_PACK_EXE=1; cwd=<root>/<revision>/apps/server; invoke that real Node with the installed `vite-plus/dist/pack-bin.js` entry. This is the repository's existing pack/exe configuration, including its Node-version guard and SEA settings. Both native builds completed successfully, creating dist-exe/bin.mjs and dist-exe/t3. No browser/client build, server startup, runtime install, archive download, or systemd repair is required. The repository executable import checker returned [] for both generated bundles. The binary finds already-installed native dependencies through the linked server node_modules. This is a development executable layout, not proof of release archive installation.

Build friction: the `scripts/cli.ts build-exe` wrapper initially could not resolve typescript-legacy in installed dependencies. An owned root node_modules overlay linked that alias to the already-installed TypeScript 6.0.3 package. The wrapper then selected Node 24.22.1 through Vite's shim under isolated HOME and failed the native Node-version guard. Invoking the same pack tool directly with actual Node 26.12.1 succeeded. No PATH edits or source edits were used. Final captures below use the real Node executable directly and a fresh HOME; preliminary shim captures are excluded.

Save the fixture below as `<root>/<revision>/apps/server/evidence-fixture.ts` in each disposable copy (imports intentionally resolve beside the copied implementation). Save capture.py outside source and invoke `python3 -u capture.py <root> <absolute-real-node>`. It seeds and checks production status before each execution form, also checks real CLI status for that artifact, captures stdout/stderr/exit and execve traces, and compares every fixture file's SHA-256 before/after each no-op. It aborts on a failed gate or changed fixture. It never calls BootService.install itself. Read the traces before publishing; only the four read-only manager probes are permitted as CLI child processes. The bootstrap `seed` operation is a fixture write, not installation.

After reviewing and uploading sanitized results, remove the entire owned root and any pointer file you created. Stop only processes you started, by their captured PIDs. Never clean other temporary directories, dependency stores, worktrees, or live T3 data.

## Fixture seeder and production status gate

```typescript
import * as Effect from "effect/Effect";
import * as NodeServices from "@effect/platform-node/NodeServices";
import { FetchHttpClient } from "effect/http";
import * as Boot from "./src/cloud/bootService.ts";
import * as Runner from "./src/processRunner.ts";
import { pinnedRuntimePaths } from "./src/cloud/pinnedRuntime.ts";
import * as Path from "effect/Path";
import fs from "node:fs";
import path from "node:path";
import pkg from "./package.json" with { type: "json" };
const baseDir=process.env.T3CODE_HOME;
if (!baseDir?.startsWith(process.env.EVIDENCE_ROOT+"/")) throw Error("outside fixture");
const logsDir=path.join(baseDir,"userdata","logs");
const unitPath=path.join(process.env.HOME,".config/systemd/user/t3code.service");
const program=Effect.gen(function*(){
 const p=yield* Path.Path;
 const runtime=pinnedRuntimePaths(p,baseDir,pkg.version,process.platform);
 if(process.argv[2]==="seed") {
  fs.mkdirSync(path.dirname(unitPath),{recursive:true});
  fs.mkdirSync(runtime.versionDir,{recursive:true});
  fs.writeFileSync(runtime.entryPath,"synthetic runtime sentinel; never execute\n");
  fs.writeFileSync(runtime.sentinelPath,pkg.version+"\n");
  fs.writeFileSync(path.join(baseDir,"runtime/service-state.json"),JSON.stringify({protocol:3,activeVersion:pkg.version}));
  fs.writeFileSync(unitPath,Boot.renderBootServiceUnit({program:[runtime.entryPath,"__service-launcher"],baseDir,logPath:path.join(logsDir,"boot-service.log"),unitPath}));
 }
 const service=yield* Boot.make({baseDir,logsDir,cliVersion:pkg.version});
 const status=yield* service.status;
 console.log(JSON.stringify(status));
 if(!status.installed || !status.current || status.problems?.length) throw Error("STOP: status gate failed");
});
await Effect.runPromise(program.pipe(Effect.provide(Runner.layer),Effect.provide(FetchHttpClient.layer),Effect.provide(NodeServices.layer)));

```

## Capture program

```python
import pathlib,subprocess,os,json,hashlib,shlex,sys
r=pathlib.Path(sys.argv[1]).resolve()
node=sys.argv[2]
env=os.environ.copy(); env.update(HOME=str(r/'capture/home'),T3CODE_HOME=str(r/'capture/t3'),EVIDENCE_ROOT=str(r)); env.pop('T3CODE_NPM_LAUNCHER_PATH',None)
assert env['PATH']==os.environ['PATH']
rows=[]
def run(label,args,trace=False):
 cmd=['/usr/bin/strace','-f','-s','4096','-e','trace=execve','-o',str(r/(label+'.trace')),*args] if trace else args
 p=subprocess.run(cmd,env=env,cwd=r,capture_output=True,text=True)
 rows.append(dict(label=label,command=shlex.join(args),exit=p.returncode,stdout=p.stdout,stderr=p.stderr))
 (r/'capture-results.json').write_text(json.dumps(rows,indent=2))
 print(label,p.returncode,p.stdout,p.stderr,flush=True)
 if p.returncode: raise SystemExit('STOP: command failed')
 return p.stdout
def hashes():
 return {str(p.relative_to(r/'capture')):hashlib.sha256(p.read_bytes()).hexdigest() for p in (r/'capture').rglob('*') if p.is_file()}
for rev in ['base','head']:
 status=json.loads(run(rev+'-seed-gate',[node,str(r/rev/'apps/server/evidence-fixture.ts'),'seed'],True))
 assert status['installed'] and status['current'] and status['problems']==[]
 for n in [1,2,3]:
  run(rev+'-preflight-'+str(n),[node,str(r/rev/'apps/server/src/bin.ts'),'__service-preflight','--database-path',str(r/'missing.sqlite'),'--launcher-protocol',str(n)])
 for form,cli in [('script',[node,str(r/rev/'apps/server/src/bin.ts')]),('standalone',[str(r/rev/'apps/server/dist-exe/t3')])]:
  status=json.loads(run(rev+'-'+form+'-status-gate',[node,str(r/rev/'apps/server/evidence-fixture.ts')],True))
  assert status['installed'] and status['current'] and status['problems']==[]
  out=run(rev+'-'+form+'-cli-status',[*cli,'service','status','--base-dir',str(r/'capture/t3')],True)
  assert 'Status: installed · t3@0.1.1' in out
  for op in ['install','update']:
   before=hashes()
   run(rev+'-'+form+'-'+op,[*cli,'service',op,'--base-dir',str(r/'capture/t3')],True)
   after=hashes();rows[-1].update(fixtureBefore=before,fixtureAfter=after,unchanged=before==after)
   (r/'capture-results.json').write_text(json.dumps(rows,indent=2))
   assert before==after,'STOP: fixture changed'

```