# Simlock TTL proof — manual server run

The server code is unmodified on each commit. The synthetic HTTP gateway fixture implements a five-minute lease deadline, refuses renewal bodies requesting more than 300000 ms with HTTP 400, returns HTTP 404 after expiry, and extends the deadline on accepted renewals. Its agent-device RPC responses provide a synthetic iPhone, not a real simulator. T3 uses its real pinned agent-device CLI and real wall clock.

For each checkout, install dependencies with `vp i`. Create an isolated T3 home with fresh userdata/settings.json:

```json
{"enableDeviceSupport":true,"simlockDeviceHostsEnabled":true,"simlockDeviceHosts":[{"kind":"simlock","id":"proof","label":"Five minute gateway","gatewayUrl":"http://127.0.0.1:19471","agentToken":"synthetic-proof-token","maxLeases":1,"maxLeaseMinutes":60}]}
```

Use separate ports and homes for each side. Start `node gateway.mjs <gateway-port>` and `T3CODE_DEV_SEED=0 node apps/server/src/bin.ts serve --port <server-port> --host 127.0.0.1 --base-dir <isolated-home>`. T3 installs agent-device 0.21.36 on first open; this run preinstalled that exact npm package into each isolated home's standard tool cache with the normal version sentinel.

Issue a local credential with `node apps/server/src/bin.ts auth session issue --base-dir <isolated-home> --token-only`, writing stdout to a private token file. Do not publish that file or startup logs.

Copy proof-driver.ts to apps/server in each checkout (so package imports resolve), then run from that directory:

```
node proof-driver.ts <server-origin> <private-token-file> <gateway-origin> <commit-sha> <runtime-json-file>
```

The driver creates a synthetic project and thread with no model turn, lists devices, opens the synthetic iPhone through device.open, subscribes to subscribeDeviceState, and queries device.list every 30 seconds for 6.5 real minutes. It records gateway renewal events and closes the session at the end. Existing synthetic project data is reused on rerun. During setup, agent-device may allocate more than once; the deadline starts at the last allocation.

before-runtime.json and after-runtime.json are the captured, sanitized RPC transcripts. The .cast files preserve the actual output timing. The MP4 files are clearly labeled 15x playback of that recorded output, rendered by render-evidence.py; the PNG files show the final 6.5-minute observation. These are backend output captures, not screenshots of the Device panel.

The driver used no test framework, TestClock, mock ProcessRunner, or modified T3 source. No real provider turn ran.