# Server settings and session scanner: evidence sheet
Linux x86_64, VM fs-35, kernel 6.1.102; package-selected Node v24.22.1 for S rows and v26.12.1 for O/A rows (direct and vp exec agree on both revisions); Vite+ 1.4.0 / Vitest v5.0.5, default forks pool, verbose reporter. Harness fixtures only; no rendered UI. Browser/device emulation, DPR, font scaling, viewport, theme, screenshots, diff thresholds and frozen clock: N/A. The existing tests seed their own scoped synthetic temporary files; no production database was read or seeded.
P=passed, F=failed, S=skipped, —=test belongs to another package and is not registered in this row. Normal rows clear NODE_OPTIONS; EPERM rows require the downloaded preload, SHA-256 `e364864529ef79a816183b75d210f52b7fc134bc220b318de3dcaddf93cecdde`. Raw transcript headers contain the actual SHA, cwd, UTC, runtime, NODE_OPTIONS, preload hash and exact command; each ends with its exit code. Test stdout/stderr are complete and unedited.
| Row / raw transcript | SHA | EPERM preload | P/F/S | S1 | S2 | S3 | O1 | O2 | A1 | A2 | E1 | E2 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| [S-P-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8e9e31c62c50fae9/S-P-N.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | no | 100/0/0 | P | P | P | — | — | — | — | P | P |
| [S-P-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0aa6f43efd9a394/S-P-E.txt) | [e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | yes | 95/3/2 | F | F | F | — | — | — | — | S | S |
| [S-H-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/41dbdaef03519a0c/S-H-N.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | no | 100/0/0 | P | P | P | — | — | — | — | P | P |
| [S-H-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9697f43078ebc8a8/S-H-E.txt) | [bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | yes | 95/0/5 | S | S | S | — | — | — | — | S | S |
## Before / after pairs
| Capability; viewport/theme N/A | Before / SHA | After / SHA | Per-test outcome diff (Diff0) | DiffT |
|---|---|---|---|---|
| Normal | [S-P-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8e9e31c62c50fae9/S-P-N.txt)
[e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | [S-H-N](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/41dbdaef03519a0c/S-H-N.txt)
[bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | No test status changes | N/A: transcript outcomes, no pixels |
| EPERM | [S-P-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c0aa6f43efd9a394/S-P-E.txt)
[e9236274a3](https://git.cafe/pingdotgg/t3code/commit/e9236274a3a6e0c731a7df4092db1e686f039068) | [S-H-E](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9697f43078ebc8a8/S-H-E.txt)
[bfd52848f9](https://git.cafe/pingdotgg/t3code/commit/bfd52848f9c02add53ab87e4a7dff31aae12b745) | S1: F → S; S2: F → S; S3: F → S | N/A: transcript outcomes, no pixels |
## Parent EPERM stack excerpts
Excerpts below quote each failed test's EPERM cause and stack. The linked raw transcript preserves the entire failure, including the outer Effect error and source frames.
### FAIL src/serverSettings.test.ts > server settings > saves through a symlinked settings file without replacing the link
```text
Caused by: Error: EPERM: operation not permitted, symlink '/tmp/t3-settings-dotfiles-QA2n56/settings.json' -> '/tmp/t3code-server-settings-test-T8b2Jw/userdata/settings.json'
❯ eperm ../../../../../../tmp/lead-25970-r1/evidence-capture-1/no-symlink-preload.cjs:5:17
❯ fs.symlink ../../../../../../tmp/lead-25970-r1/evidence-capture-1/no-symlink-preload.cjs:9:112
❯ Object. ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Effect.js:8409:5
❯ ~effect/Effect/evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:804:38
❯ FiberImpl.runLoop ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:453:97
❯ FiberImpl.evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:402:23
❯ FiberImpl.evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:396:27
❯ ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:808:17
❯ ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Effect.js:8413:9
```
### FAIL src/project/AgentSessionScanner.test.ts > AgentSessionScanner > scan > returns the imported project ID through a realpath alias
```text
Caused by: Error: EPERM: operation not permitted, symlink '/tmp/t3code-workspace-ADnQyV' -> '/tmp/t3code-scanner-links-vxAT6M/workspace-alias'
❯ eperm ../../../../../../tmp/lead-25970-r1/evidence-capture-1/no-symlink-preload.cjs:5:17
❯ fs.symlink ../../../../../../tmp/lead-25970-r1/evidence-capture-1/no-symlink-preload.cjs:9:112
❯ Object. ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Effect.js:8409:5
❯ ~effect/Effect/evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:804:38
❯ FiberImpl.runLoop ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:453:97
❯ FiberImpl.evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:402:23
❯ FiberImpl.evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:396:27
❯ ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:808:17
❯ ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Effect.js:8413:9
```
### FAIL src/project/AgentSessionScanner.test.ts > AgentSessionScanner > scan > excludes sandboxes reached through a symlink into the worktrees dir
```text
Caused by: Error: EPERM: operation not permitted, symlink '/tmp/t3code-scanner-base-iNUFw4/worktrees/t3code/wt-3' -> '/tmp/t3code-scanner-links-M8XQD4/innocent-project'
❯ eperm ../../../../../../tmp/lead-25970-r1/evidence-capture-1/no-symlink-preload.cjs:5:17
❯ fs.symlink ../../../../../../tmp/lead-25970-r1/evidence-capture-1/no-symlink-preload.cjs:9:112
❯ Object. ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Effect.js:8409:5
❯ ~effect/Effect/evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:804:38
❯ FiberImpl.runLoop ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:453:97
❯ FiberImpl.evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:402:23
❯ FiberImpl.evaluate ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:396:27
❯ ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/internal/effect.js:808:17
❯ ../../node_modules/.pnpm/effect@4.0.5/node_modules/effect/dist/Effect.js:8413:9
```
## What else changed
None. Every registered test name was compared between parent and head for both capability modes. Only the newly guarded tests above changed status, from failure to skip under EPERM. Normal runs retained all passes. The existing E1/E2 controls (server sheet) pass normally and skip under EPERM on both revisions.
## Test identifiers
- **S1**: `server settings > saves through a symlinked settings file without replacing the link` (new guard)
- **S2**: `AgentSessionScanner > scan > returns the imported project ID through a realpath alias` (new guard)
- **S3**: `AgentSessionScanner > scan > excludes sandboxes reached through a symlink into the worktrees dir` (new guard)
- **O1**: `readOpenCodeUsage > never follows symlinks in the legacy OpenCode store` (new guard)
- **O2**: `openCodeUsageReader > scans canonical instance roots once, including XDG and home defaults` (new guard)
- **A1**: `acpPermissionDisposition > denies mutations through workspace symlinks that escape the writable roots` (new guard)
- **A2**: `acpPermissionDisposition > allows existing and new files beneath canonical writable roots` (new guard)
- **E1**: `AgentSessionScanner > recentThreads > rechecks claudeAgent snapshot cwd after replacement with symlink alias` (existing control)
- **E2**: `AgentSessionScanner > recentThreads > rechecks codex snapshot cwd after replacement with symlink alias` (existing control)
## Reproduction inputs and drivers
- [capture.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/77fe5bb2049ba082/capture.py)
- [summarize.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8252af32fd724de1/summarize.py)
- [no-symlink-preload.cjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56adb289d60d806e/no-symlink-preload.cjs)
- [proof-matrix.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1898be9d416b985/proof-matrix.md)
- [parent-install.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cce2a2cdabbccb06/parent-install.txt)
- [manifest.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/32ded61b1709336d/manifest.json)
- [observed-outcomes.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dd7373dc2c8339a9/observed-outcomes.json)
## Unverified
W: **cannot-verify windows**. This Linux VM has no native Windows host; fault injection verifies EPERM behavior, not Windows path semantics.