# Issue 24416 — shell runtime evidence

Evidence captured 2026-10-24 on fs-06, Ubuntu 24.04.5 x86_64, Linux 6.1.102, /bin/sh=dash, setsid util-linux 2.39.3, functional /dev/fuse and /usr/bin/fusermount. Core dumps disabled (RLIMIT_CORE=0). All state is under /tmp/issue-24416; no live userdata was used. No browser, UI, provider turn, repo source edit, commit, push, PR operation, public comment, merge, delegation or watch was performed by this evidence task.

## Exact scope and provenance

Changed launcher rendered by importing renderCliShim from source 0e05de5f8d21474571644f2819d3ebf27f317681. Base renderer: 6e792117436662208bf2b6eb71ee8d0d88817e43. Runtime artifact: supplied official T3-Code-0.1.2-x86_64.AppImage, SHA256 cf01e2d167eff9d01c4c1004d31b2c0da9e2522cc94262e41644d1cb15dfdb5c. The actual runtime reports t3 v0.1.2. This is the changed launcher running the released packaged runtime, NOT a rebuilt full desktop at head. Rendered t3-after SHA256 0bd4d6aa30ea2e9b7ee3202296931a1047e7ab2e402e2bb09d6f6b1d1c17a341.

The shared checkout later moved to c3e066d39d392f83fd1a390d5dc5da6d42da358a externally. git diff 0e05de5f8d HEAD for DesktopCliShim.ts and DesktopCliShim.test.ts was empty; the captured renderer/tests and initial provenance remain 0e05de5f8d. Working tree was clean at final inspection.

Production scope: only AppImage mounter session isolation with setsid and adding HUP to traps. Test changes accompany it. No UI changed. Visual fixture matrix: empty (zero rows), as required by proof audit pass 1.

## Results

- Red: exact head regression test file paired with base renderer in scratch, without changing checkout. 2 failed / 4 passed: TERM and HUP both fail `expected 'unmounted' to be 'mounted'`. Command and scratch reconstruction are in reproduce.sh.
- Green: `vp test run apps/desktop/src/app/DesktopCliShim.test.ts` at 0e05de5f8d: 6/6 passed. These deterministic tests prove delayed-server ordering.
- Existing baseline: nine true FUSE group-TERM attempts all printed Bus error. Earlier extraction attempts are excluded. [Public baseline transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b2900fece111db26/before-transcript.txt).
- R1: all nine new group-TERM attempts reached HTTP 200 on 127.0.0.1:45817; each launcher exited 130, no Bus error, server and mounter gone, FUSE mount and launcher workspace gone. Actual mounter PID/PPID/PGID/SID, mountinfo and server executable maps are recorded for every run. Mounter PGID/SID differ from launcher/server. This proves genuine FUSE use, not extraction. Runtime samples sometimes observe server disappearance while mount is still present; some miss that brief interval. No universal ordering claim is made from sampling; delayed ordering is established by deterministic tests.
- R2: one group-SIGHUP run reached HTTP 200, launcher exited 130, no Bus error; server, mounter, FUSE mount and launcher workspace disappeared. The released server prints `Hangup`, so this is expected signal termination, not a claim of graceful server HUP handling. One startup Claude probe survived the initial 200ms post-exit check and was terminated by the driver's tracked-PID cleanup. Therefore full descendant self-cleanup for HUP is NOT claimed. Final verification confirms it is gone.
- R3: one truthful foreground Ctrl-C run: PTY controlling terminal, actual tcgetpgrp equals launcher's group, byte 0x03 sent to terminal. HTTP 200 beforehand, launcher 130, no Bus error, no remaining tracked processes or mounts. Not a background subprocess with ignored SIGINT.
- R4: one normal mounted `--version`: output `t3 v0.1.2`, exit 0, real FUSE observed, mount/mounter/workspace removed.
- R5: one real extraction fallback with setsid available and fusermount/fusermount3 omitted from controlled PATH: actual --appimage-extract process and squashfs-root server command observed, no FUSE mount, `t3 v0.1.2`, exit 0, extraction workspace removed.
- R6: one real extraction fallback with setsid omitted and other helper commands available: actual --appimage-extract observed, no FUSE mount, `t3 v0.1.2`, exit 0, extraction workspace removed. Sampling missed the brief extracted CLI command line; its execution is inferred from the version output and launcher control flow.

For signal cases the exact command is `/tmp/issue-24416/t3-after serve --base-dir /tmp/issue-24416/case-CASE/state --host 127.0.0.1 --port 45817 --no-browser`, with case-specific TMPDIR and T3CODE_HOME. TERM/HUP use os.killpg(launcher_pid, signal). Server child exit status is not separately waitable because the launcher waits for it; evidence consists of executable maps, disappearance, captured shell diagnostics, adopted descendant statuses where available, and no SIGBUS/Bus error. Exit 130 alone and reconciliation alone are explicitly insufficient.

## Cleanup, limitations and friction

Final cleanup.txt checks all recorded PIDs against /proc and all case mount paths against mountinfo: no live tracked process or owned mount remains. Port 45817 refuses connections. The driver tracks owned descendants, sends cleanup signals to those PIDs only, and unmounts recorded owned paths if needed. No killing by process-name pattern. Scratch assets remain for audit pass 2 and lead cleanup.

The first preliminary TERM run succeeded at lifecycle checks but the initial driver assertion mistakenly required an entirely empty TMPDIR; Chromium/provider scratch directories remain independently of launcher workspace cleanup. It was corrected to check launcher tmp.* and .mount_* paths and the nine repetitions were restarted. Their transcript also retains the subsequent HUP assertion failure for the startup probe, followed by the explicitly continued remaining cases. These are not hidden successful-only selections. The public final driver retains ancillary survivors in results and cleans them in finally. Non-secret provider/Chromium scratch directories remain on disk for lead cleanup; they are not uploaded.

Scratch red-test invocation first hit out-of-root test discovery and dependency-resolution issues; final red proof uses an explicit scratch root/config and scratch dependency links. No tests/source were changed in the repo. A temporary root node_modules/effect symlink was accidentally created during setup and immediately removed; no tracked file was modified.

Unverified: rebuilt head desktop artifact, GUI/web/mobile, macOS/Windows/direct-executable runtime, real SSH disconnect and service manager/cgroup variants, remote/relay/tunnel, provider turns, and SIGKILL behavior. SIGKILL bypasses traps and may leak a mount; no SIGKILL-support claim is made. No UI matrix, screenshots, or browser use applies. The only ancillary runtime issue observed is the released runtime's HUP startup-probe survivor requiring harness cleanup.

Authentication URLs, tokens, QR-code lines and auth-related output are removed from the public transcript. Raw logs/state/databases are not uploaded. Uploads use the [ghdrop skill](/home/ubuntu/.codex/skills/ghdrop/SKILL.md).

## Reproduction and evidence files

Download the driver and reproduce.sh to an isolated scratch directory with the official AppImage. Run reproduce.sh from a dependency-installed checkout at the exact source SHA, passing that scratch directory as its argument. Use an unused 45817 port. It renders via the real exported function, runs green and scratch red tests, and executes all runtime cases with cleanup. Its expected red-test failure is intentional.

- [reproduce.sh](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9ab0d0fbe5759784/reproduce.sh)
- [evidence-driver.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5751e042a98e6208/evidence-driver.py)
- [red-tests.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c58d5a050d7e10ed/red-tests.txt)
- [green-tests.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a70ddd0e9550e349/green-tests.txt)
- [after-transcript.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5c90d87839188cd2/after-transcript.txt)
- [provenance.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4c9a65627f958a51/provenance.txt)
- [cleanup.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/933194f5eff58420/cleanup.txt)
- [Proof audit pass 1](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/36311d280f282abb/proof-audit-pass-1.md)