feat(server): bounded environment preflight for provider launches

[nullStack65]

What this is

A bounded, read-only environment preflight that runs immediately before a provider session starts. It prevents a class of accidental-git damage: when a directory that is meant to be a shared session root is itself a Git work tree, every project created beneath it shares that one repository, so checkpoints and git add --all --sparse from an OpenCode snapshot can commit unrelated projects into the umbrella repo. A second, narrower failure is a configured provider Git that does not support --sparse, which the OpenCode snapshot path assumes.

The preflight surfaces findings to the user through the normal thread-activity transport (kind: "launch.preflight"). It warns by default and does not block an otherwise-usable launch. One demonstrated exception is a real blocker: when the resolved Git cannot be started and the session root is itself a repository, T3 Code cannot checkpoint or resolve a worktree, so the launch is stopped with ProviderLaunchPreflightBlockedError. The preflight's Git and filesystem checks run independently of the shared-root opt-in.

Behavior

• Ordinary repository (default): sharedSessionRoot is empty. Every repository session — including the server's own cwd — is treated as a normal working directory; no shared-root finding is produced. Applicability is never inferred from a folder name, breadth, child repositories, or the mere presence of .git. The Git/filesystem checks still run.
• Explicitly configured shared root: only when sharedSessionRoot is set, and a provider session's cwd resolves to exactly that directory, the preflight checks for an accidental umbrella repository and reports shared-root-git. A configured shared root is honored regardless of the backend's own working directory. Root, top level and common-directory identity are canonicalized consistently, so /var ↔ /private/var alias spellings of the same physical root give the local "move or retire .git" guidance; a genuinely external common directory (e.g. a linked worktree) stays safe, and an unresolved identity is reported as unknown rather than an affirmative external repository.
• Incomplete checks (R1): a stalled, denied or failed bounded check now produces one actionable warning instead of being read as clean or absent. This includes the initial cwd stat (moved into the preflight so it reaches the production reporter), candidate metadata/existence checks, and a capability probe that fails or times out when it is relevant to the selected launch. Genuine absence and missing optional files stay silent; total-budget expiry retains prior findings and is never reported clean.
• Configured provider Git (R3): consumer applicability is derived from the selected production instance/runtime facts. A local OpenCode instance whose effective OPENCODE_CONFIG_CONTENT leaves snapshots on reports git-sparse-add-unsupported when the Git the launch resolves lacks --sparse, even in an ordinary repository. An explicit effective snapshot:false suppresses that provider-specific requirement, and an instance pointed at an external OpenCode server does not pretend the local Git is that server's Git. Non-OpenCode consumers keep T3's own sparse-checkout fallback.
• Configured-executable failure: separate from the Git-capability checks. When the selected provider instance's configured executable cannot be started, the adapter returns a useful ProviderAdapterProcessError before any model work; the preflight does not silently convert that into a warning.
• Warning vs blocking: warning-only findings still start the configured provider exactly once; only the Git-cannot-start-while-root-is-a-repository condition blocks.

Integration points

• apps/server/src/environment/launchPreflightReporter.ts (new): production reporter, imported by apps/server/src/server.ts; appends a thread.activity.append (kind: "launch.preflight", tone: "error") through the real OrchestrationEngine, so it reaches the same client subscription normal activities do.
• apps/server/src/provider/Layers/ProviderService.ts: guardProviderLaunch runs the bounded preflight against the exact session cwd and resolves the consumer through resolveLaunchPreflightConsumer; warnings are delivered through the injected reporter, and pending startup notices are retained until delivery actually succeeds.
• apps/server/src/provider/launchPreflightConsumer.ts (new): resolves the selected consumer from ServerSettings.providerInstances (effective OPENCODE_CONFIG_CONTENT snapshot setting and external-server ownership), reusing the runtime's own config resolution.
• apps/server/src/environment/LaunchPreflight.ts / LaunchPreflightWarningInbox.ts: single bounded probe implementation (max 16 notices/dir) and peek/clear inbox.
• packages/contracts/src/settings.ts: adds explicit sharedSessionRoot (server setting + patch).

Runtime characteristics

• Probes are offline, read-only: git config --bool core.sparseCheckout, git add -h, no add/status/dry-run/snapshot; bounded stat/existence/read operations (32 KiB reads, 4 KiB subprocess output, owned-process cleanup, no late launch after timeout). The Git-checkout scan is identity-based, not a recursive scan; a plain directory is not flagged. Fixture-owned temp dirs are removed by each test; no installed-workstation state is touched.

Current cloud candidate

• Head: 56b4bc9af53996a73d326a46373d9bb491a8fce6
• Integrated main: 08dbb72de3b9adabb8f4d796accea4f1db6ec139
• Verified source/test-merge tree: 05b1021435a52b3a7b25f6f1a365cf046b1a5995
• Normal CI: Check, general Test, Server1/2/3, Rust, ReleaseSmoke and native fingerprint checks passed.
• Server typecheck, targeted format/lint and four default-cwd controls pass locally. Distinct automated GPT-6 Luna feature/integration review has no blocking finding; no human vote is claimed.
• New and recovered launches resolve adapter-default cwd before preflight, then pass the same cwd to the adapter. Host checkpoint Git is distinct from provider snapshot Git.

Evidence provenance

The underlying implementation and its focused suites (A1 applicability, A2 final-environment fixture, A3 backend delivery through a real OrchestrationEngine subscription + real dummy provider, E4 missing-executable/recovery) are V5 author evidence — see the V5 RESULT.

P1 RESULT independently published the candidate and demonstrated authenticated production WebSocket delivery. Its untracked smoke is now committed as apps/server/integration/envchkP1WireAcceptance.integration.test.ts and rerun on the corrected head 29a4cdcdc: the corrected alias-aware shared-root-git warning, one successful dummy start, and the configured-executable error were all observed over the real authenticated orchestration.subscribeThread.

ENVCHK:E6 repaired R1–R3 (incomplete-check warnings, consistent identity handling, production-derived consumer) with focused failure-path and healthy controls. See the ENVCHK:E6 RESULT comment on this PR for exact commands, exits and timings.

Not claimed without execution: native Windows qualification (A4) and actual browser/rendered-client rendering remain UNVERIFIED. The production authenticated subscription (not DOM rendering) is the accepted delivery boundary.

Rollback

Unsetting sharedSessionRoot disables only the shared-root classification; the Git and filesystem preflight still runs. The complete rollback is a source/binary revert of these commits, which restores prior behavior. Additive and opt-in for the shared-root check; no migration and no destructive filesystem operation.

Model / harness

Current cloud delivery: GPT-6.1 Sol owner with native GPT-6 Luna implementation and independent technical review. Earlier author evidence below remains historical.

Dependency and cleanup provenance (ENVCHK:E7)

• apps/server now declares jsonc-parser@^3.3.1 as a direct runtime dependency (previously only transitive) and parses OPENCODE_CONFIG_CONTENT with it; the feature's ad-hoc regex helper and its shared exports were removed. packages/shared/src/schemaJson.ts is back to its pre-feature form.
• The wire acceptance teardown now confirms the captured server and captured fixture-owned stub PIDs have exited within a bounded window before removing fixture state, fails clearly while preserving state on timeout, and includes a forced-failure regression.
• Historical E7 head: d3f205d13d228f0c6a4987bbcd7e20ecbda965ac; historical base: 419f7574010c066a56974fc9e3ac0709a08efb33.

Release acceptance

PR20 owns shared release/runtime qualification using this lane's exact eventual merged source. Exercise fresh synthetic roots, warning-only launch exactly once with authenticated launch.preflight delivery, configured-executable failure before model work, host/provider Git separation, unstartable host Git blocking repository launches, omitted-cwd new/recovery defaults, bounded read-only probes, and captured fixture-owned process exit before cleanup. Current native Mac/Windows artifact acceptance and installation are unclaimed. Rollback is compatible version/config reversal; this feature introduces no database migration.

[nullStack65]

ENVCHK:P1 RESULT

Verdicts: publication PASS; authenticated production WebSocket delivery PASS; browser rendering UNVERIFIED; native Windows UNVERIFIED; live installation NOT PERFORMED (out of scope). No source change was required; the published candidate is untouched.

Exact identity

• Source PR: feat(server): bounded environment preflight for provider launches #11 (draft, base main).
• Remote head: af3b9c4c613e8f5aaf14ec1f0446e496f6dde0fc (git ls-remote and gh pr view headRefOid agree).
• Base: f5d3fc66016d54a16fd8872321d7722d4457526e.
• Original V5 commit preserved unrewritten; branch create only. Base→head patch sha256 = d41fe16d952da748974fb87a8254908a19b1345601815f5af51cad93e8f35fa0 (matches V5).
• Predecessors preserved per git worktree list: envchk-e2 c1ece3d08, envchk-e3 f46269f71, envchk-e4 ae8ecca34.
• New isolated resident worktree for this smoke: /Users/businessaccount/w-t3/envchk-p1 (detached at af3b9c4c6), common dir /Users/businessaccount/t3-fork-build/.git.

What changed beyond publication

Nothing in the repository or the published ref. The only new artifact is one untracked test in the isolated worktree, apps/server/integration/envchkP1WireAcceptance.integration.test.ts. It is not committed and not pushed; the exact candidate under review is unchanged. No demonstrated in-scope defect was found, so no repair commit was warranted.

Actual launch entry points invoking preflight (at af3b9c4c)

• ProviderService.startSession calls guardProviderLaunch({cwd,...}) before the adapter starts:

  t3code/apps/server/src/provider/Layers/ProviderService.ts

  Lines 1699 to 1705 in af3b9c4

  	if (effectiveCwd !== undefined) {
  	yield* guardProviderLaunch({
  	threadId,
  	cwd: effectiveCwd,
  	provider: resolvedProvider,
  	providerInstanceId: resolvedInstanceId,
  	});

• guardProviderLaunch runs the bounded probe and delivers warnings via the injected reporter:

  t3code/apps/server/src/provider/Layers/ProviderService.ts

  Lines 556 to 690 in af3b9c4

  	const guardProviderLaunch = Effect.fn("ProviderService.guardProviderLaunch")(function* (input: {
  	readonly threadId: ThreadId;
  	readonly cwd: string;
  	readonly provider?: ProviderDriverKind;
  	readonly providerInstanceId?: ProviderInstanceId;
  	}) {
  	// Only probe a real directory: spawning Git in a missing path or a plain
  	// file would fail at the OS layer. The caller's own workspace read (and
  	// `ProviderWorkspaceMissingError`) handles those cases. This stat is itself
  	// bounded so a stalled/cloud-offloaded path cannot hold the launch; a
  	// timeout simply skips the preflight and lets the adapter surface the
  	// filesystem problem.
  	const workspaceStat = yield* fileSystem.stat(input.cwd).pipe(
  	Effect.timeoutOption(NARROW_FS_TIMEOUT),
  	Effect.map(Option.getOrElse(() => undefined)),
  	Effect.orElseSucceed(() => undefined),
  	);
  	if (workspaceStat === undefined || workspaceStat.type !== "Directory") {
  	return;
  	}
  	const settings = yield* serverSettings.getSettings.pipe(
  	Effect.orElseSucceed(() => undefined),
  	);
  	const isSharedRoot = LaunchPreflight.isConfiguredSharedSessionRoot(
  	pathService,
  	input.cwd,
  	settings?.sharedSessionRoot,
  	);
  	// The selected consumer/operation determines `--sparse` applicability. T3
  	// launches OpenCode with its default config, where snapshot staging is on
  	// unless the user disabled it, and OpenCode stages with `git add --sparse`
  	// even in an ordinary repository. Other consumers only need `--sparse` in a
  	// sparse checkout, so this is never a global T3 Git requirement.
  	const consumer: LaunchPreflight.LaunchPreflightConsumer | undefined =
  	input.provider === undefined
  	? undefined
  	: { driver: input.provider, snapshotsEnabled: true };
  	// The provider launch resolves `git` from the same environment the adapter
  	// inherits. Pass it through so the probe inspects the actual selected Git,
  	// not an unrelated host default.
  	const instanceEnvironment =
  	input.providerInstanceId === undefined
  	? undefined
  	: settings?.providerInstances[input.providerInstanceId]?.environment;
  	const gitEnvironment =
  	instanceEnvironment === undefined || instanceEnvironment.length === 0
  	? undefined
  	: mergeProviderInstanceEnvironment(instanceEnvironment);
  	const result = yield* runLaunchPreflight(input.cwd, {
  	isSharedRoot,
  	...(consumer !== undefined ? { consumer } : {}),
  	...(gitEnvironment !== undefined ? { gitEnvironment } : {}),
  	}).pipe(
  	Effect.catchCause(() =>
  	Effect.succeed({
  	findings: [] as ReadonlyArray<LaunchPreflight.LaunchPreflightFinding>,
  	warnings: [] as ReadonlyArray<LaunchPreflight.LaunchPreflightFinding>,
  	blockers: [] as ReadonlyArray<LaunchPreflight.LaunchPreflightFinding>,
  	}),
  	),
  	);
  	const report = options?.reportLaunchPreflightWarning;
  	const deliverWarning = (warning: {
  	readonly code: LaunchPreflight.LaunchPreflightFindingCode;
  	readonly message: string;
  	}) =>
  	Effect.gen(function* () {
  	yield* Effect.logWarning(`launch preflight: ${warning.message}`, {
  	code: warning.code,
  	threadId: input.threadId,
  	cwd: input.cwd,
  	});
  	if (report === undefined) {
  	// The startup phase already logged this; the log is the delivery.
  	return true;
  	}
  	return yield* report({
  	threadId: input.threadId,
  	cwd: input.cwd,
  	code: warning.code,
  	message: warning.message,
  	}).pipe(Effect.catchCause(() => Effect.succeed(false)));
  	});
  	// Deliver warnings the startup preflight could only log (no thread existed
  	// yet) to this first affected session through the same transport. Remove a
  	// pending notice only after it was actually delivered; anything undelivered
  	// stays for the next session in the same directory.
  	const inbox = yield* LaunchPreflightWarningInboxModule.LaunchPreflightWarningInbox;
  	const inboxKey = LaunchPreflight.normalizePathKey(pathService, input.cwd);
  	const pendingWarnings =
  	LaunchPreflightWarningInboxModule.peekLaunchPreflightWarnings(inbox, inboxKey);
  	const deliveredCodes = new Set<string>();
  	const undelivered: Array<LaunchPreflightWarningInboxModule.PendingLaunchPreflightWarning> = [];
  	for (const warning of pendingWarnings) {
  	if (deliveredCodes.has(warning.code)) continue;
  	const delivered = yield* deliverWarning(warning);
  	if (delivered) deliveredCodes.add(warning.code);
  	else undelivered.push(warning);
  	}
  	LaunchPreflightWarningInboxModule.clearLaunchPreflightWarnings(inbox, inboxKey, undelivered);
  	for (const warning of result.warnings) {
  	if (deliveredCodes.has(warning.code)) continue;
  	deliveredCodes.add(warning.code);
  	yield* deliverWarning(warning);
  	}
  	const blocker = result.blockers[0];
  	if (blocker !== undefined) {
  	yield* Effect.logError(`launch preflight blocked provider launch: ${blocker.message}`, {
  	code: blocker.code,
  	threadId: input.threadId,
  	cwd: input.cwd,
  	});
  	if (options?.reportLaunchPreflightWarning) {
  	yield* options
  	.reportLaunchPreflightWarning({
  	threadId: input.threadId,
  	cwd: input.cwd,
  	code: blocker.code,
  	message: blocker.message,
  	})
  	.pipe(Effect.catchCause(() => Effect.succeed(false)));
  	}
  	return yield* new ProviderLaunchPreflightBlockedError({
  	threadId: input.threadId,
  	cwd: input.cwd,
  	code: blocker.code,
  	detail: blocker.message,
  	});
  	}
  	});

• Production reporter wiring in the composition root:

  t3code/apps/server/src/server.ts

  Lines 278 to 287 in af3b9c4

  	const ProviderLayerLive = Layer.unwrap(
  	Effect.gen(function* () {
  	const orchestrationEngine = yield* OrchestrationEngineService;
  	const crypto = yield* Crypto.Crypto;
  	return makeProviderServiceLive({
  	reportLaunchPreflightWarning: makeLaunchPreflightWarningReporter(
  	orchestrationEngine,
  	crypto,
  	),
  	});

  ; reporter:

  t3code/apps/server/src/environment/launchPreflightReporter.ts

  Lines 27 to 48 in af3b9c4

  	export const makeLaunchPreflightWarningReporter =
  	(orchestrationEngine: OrchestrationEngineShape, crypto: Crypto.Crypto) =>
  	(input: LaunchPreflightWarningReportInput): Effect.Effect<boolean, never> =>
  	Effect.gen(function* () {
  	const createdAt = DateTime.formatIso(yield* DateTime.now);
  	yield* orchestrationEngine.dispatch({
  	type: "thread.activity.append",
  	commandId: CommandId.make(yield* crypto.randomUUIDv4),
  	threadId: input.threadId,
  	activity: {
  	id: EventId.make(yield* crypto.randomUUIDv4),
  	tone: "error",
  	kind: "launch.preflight",
  	summary: input.message,
  	payload: { code: input.code, cwd: input.cwd },
  	turnId: null,
  	createdAt,
  	},
  	createdAt,
  	});
  	return true;
  	}).pipe(Effect.catchCause(() => Effect.succeed(false)));

• Startup preflight into the shared inbox before any thread exists:

  t3code/apps/server/src/serverRuntimeStartup.ts

  Lines 967 to 1027 in af3b9c4

  	yield* Effect.logDebug("startup phase: running launch preflight");
  	yield* runStartupPhase(
  	"launch.preflight",
  	Effect.gen(function* () {
  	// Shared-inbox intent comes only from the explicit setting; the
  	// server's own cwd is an ordinary working directory.
  	const sharedSessionRoot = yield* serverSettings.getSettings.pipe(
  	Effect.map((settings) => settings.sharedSessionRoot),
  	Effect.orElseSucceed(() => undefined),
  	);
  	const isSharedRoot = LaunchPreflight.isConfiguredSharedSessionRoot(
  	pathService,
  	serverConfig.cwd,
  	sharedSessionRoot,
  	);
  	return yield* launchPreflight.run(serverConfig.cwd, { isSharedRoot }).pipe(
  	Effect.tap((result) =>
  	Effect.gen(function* () {
  	yield* Effect.forEach(
  	result.warnings,
  	(warning) =>
  	Effect.logWarning(`launch preflight: ${warning.message}`, {
  	code: warning.code,
  	severity: warning.severity,
  	cwd: serverConfig.cwd,
  	}),
  	{ discard: true },
  	);
  	// No thread exists yet, so carry these to the first provider
  	// session in this directory, which delivers them through the
  	// existing user-visible warning transport.
  	const inbox = yield* LaunchPreflightWarningInboxModule.LaunchPreflightWarningInbox;
  	LaunchPreflightWarningInboxModule.recordLaunchPreflightWarnings(
  	inbox,
  	LaunchPreflight.normalizePathKey(pathService, serverConfig.cwd),
  	result.warnings.map((warning) => ({
  	code: warning.code,
  	message: warning.message,
  	})),
  	);
  	yield* Effect.forEach(
  	result.blockers,
  	(blocker) =>
  	Effect.logError(`launch preflight: ${blocker.message}`, {
  	code: blocker.code,
  	severity: blocker.severity,
  	cwd: serverConfig.cwd,
  	}),
  	{ discard: true },
  	);
  	}),
  	),
  	Effect.asVoid,
  	Effect.catchCause((cause) =>
  	Effect.logWarning("launch preflight failed to run", { cause }),
  	),
  	);
  	}),
  	);
  	yield* Effect.logDebug("startup phase: parking orchestration roots at activation");

• Authenticated subscription the client uses: orchestration.subscribeThread

  t3code/apps/server/src/ws.ts

  Line 2188 in af3b9c4

  [ORCHESTRATION_WS_METHODS.subscribeThread]: (input) =>

  ; scope gate orchestration:read/orchestration:operate

  t3code/apps/server/src/auth/RpcAuthorization.ts

  Lines 24 to 32 in af3b9c4

  	export const RPC_REQUIRED_SCOPES = {
  	[ORCHESTRATION_WS_METHODS.dispatchCommand]: AuthOrchestrationOperateScope,
  	[ORCHESTRATION_WS_METHODS.getWorkflowScript]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.getTurnDiff]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.getFullThreadDiff]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.searchThreads]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.subscribeShell]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.getArchivedShellSnapshot]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.subscribeThread]: AuthOrchestrationReadScope,

Method (separate from V5's receipts)

The smoke uses the actual supported server entry point — node src/bin.ts serve --bootstrap-fd … --base-dir <temp> --port <loopback> --host 127.0.0.1 <fixture-root> — with an isolated baseDir, a real settings.json (sharedSessionRoot = fixture git root, providers.grok.binaryPath = <fake ACP wrapper>, plus a grok-missing instance pointing at a nonexistent binary), supported desktop-bootstrap authentication exchanged for a session cookie at /api/auth/browser-session, and the repo's real Effect WsRpcGroup client over ws://127.0.0.1:<port>/ws. The dummy provider is the repo's acp-mock-agent.ts behind writeFakeCli. Offline, bounded, no model calls, no installed-workstation state touched. The server process is killed by captured PID; temp fixtures are removed.

Commands / exits / bounded timings (this session, measured 2026-09-28):

• npx pnpm@11.10.0 install --frozen-lockfile → exit 0 (~39 s, worktree setup).
• npx vp test run integration/envchkP1WireAcceptance.integration.test.ts → exit 0, wall 11.7 s, test duration 9.19 s (final clean run).
• npx vp lint integration/envchkP1WireAcceptance.integration.test.ts → exit 0.
• Post-run: no src/bin.ts serve processes remain; no envchk-p1-* temp dirs remain.

Observed over the authenticated production WebSocket (exact, sanitized)

• Pre-thread finding: server startup logged launch preflight: … for the configured shared root before the project/thread were created (startupPreflightLogged = true), i.e. the shared-inbox path ran first.
• Wire warning received as thread.activity-appended, activity.kind = "launch.preflight", tone = "error", payload = {code:"shared-root-git", cwd:<fixture-root>}, summary exactly:

  The shared session root is itself a Git repository (top-level ). Projects beneath it would share that repository. Its Git identity points at a different repository; no change to this root is implied.

• Warning-only launch: the dummy provider session started exactly once (agent --always-approve stdio invoked 1×; the --version/inspect --json lines are registry health probes, not session starts). thread.session-set reached a usable session and a turn.plan.updated activity plus assistant messages were delivered — no provider.turn.start.failed on this thread.
• Configured-executable failure reaching the same interface: the grok-missing thread's thread.session-set reached status:"error" with lastError = Failed to spawn ACP process for command: <fake-dir>/not-a-real-grok, and a thread.activity-appended of kind:"provider.turn.start.failed" with the same detail — both over the authenticated subscription, before any model work.

Rollback

Close PR #11 and delete envchk/v5-acceptance-20260928; the change is additive and opt-in (sharedSessionRoot unset restores prior behavior). No migration, no destructive filesystem operation, no installed state affected.

Concrete remaining work (not this assignment)

1. Manager independent full-diff review of the published candidate.
2. Native Windows qualification of packages/shared/src/shell.ts (A4) by an operator with a native channel.
3. Actual browser/rendered-client confirmation (this smoke verified wire delivery to a client subscription, not DOM rendering).
4. Qualified landing and bounded rollout, owned by the manager; MACFIX/STALL/ENV-1 feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10/release feat(release): fork release pipeline with fork update isolation #5 scopes untouched.

Status: candidate published and unmodified; authenticated wire delivery of the preflight warning, of a single successful dummy start, and of the configured-executable failure independently demonstrated; browser rendering and native Windows remain UNVERIFIED.

[nullStack65]

ENVCHK:MANAGER

P1 accepted for publication/wire delivery; three concrete source repairs before final qualification

Reviewed PR #11 and all 19 changed-file patches at exact head af3b9c4, with maintained main still f5d3fc6. A narrow independent helper reviewed LaunchPreflight.ts and its tests; the manager reviewed the remaining integration, startup, reporter/inbox, settings, shared resolver, and affected tests, plus the relevant provider runtime configuration paths. This is source review, not a manager rerun of Mac/Windows suites.

P1 RESULT materially closes the missing production-wire evidence: actual node src/bin.ts serve, isolated configuration and supported desktop-bootstrap authentication, real authenticated orchestration.subscribeThread, a real shared-root finding, one successful dummy session, and a missing configured executable surfaced as a session error/activity. Reported final smoke: 11.7 s wall, 9.19 s test, exit 0. Credit this evidence; do not repeat an authentication investigation or restart the implementation.

The original acceptance allowed the production subscription OR rendered client. P1 meets that delivery boundary. DOM/browser rendering remains unobserved, but no separate browser-only gate or agent is added.

The smoke test is currently untracked at:
/Users/businessaccount/w-t3/envchk-p1/apps/server/integration/envchkP1WireAcceptance.integration.test.ts.
Preserve it as repeatable source with the next narrow repair. The initial af3b9c4 commit remains attributable.

R1 — Incomplete checks are silently treated as clean/absent

• ProviderService 568–575: the initial 500 ms cwd stat timeout/error becomes undefined and skips the entire preflight. The second stat treats timeout as true. This avoids an unbounded wait but does not warn about the observed filesystem failure.
• LaunchPreflight 251–263, 623–625: metadata errors/timeouts become false/null; read candidates are skipped as absent. The existing test 355–370 explicitly expects an empty finding list when all exists checks never finish.
• Capability outcome 370–395 handles only ok/unsupported; an error/timeout is ignored. Total timeout 462–472 is also discarded.

Required: keep genuine absence distinct from timeout/permission/other failure. Emit a bounded actionable warning for an incomplete relevant check, preserving earlier findings and useful launch. Do not mislabel an unknown capability unsupported, or turn speculative risk into a blocker. Keep missing optional files silent. Surface the initial-cwd failure through the same production reporter. Reuse existing result codes/transport and retain cheap bounds.

R2 — Equivalent physical paths produce incorrect Git-root guidance

Root alone is realpathed at 268; commonDir is resolved lexically from the original invocation cwd at 563–574. Comparing /private/var/.../shared with /var/.../shared/.git at 313–327 selects “Its Git identity points at a different repository” for metadata actually inside that root. P1 observed exactly that misleading sentence.

The helper reproduced this branch using published path logic and node:path.posix on Linux with Mac alias strings; this is a pure-path reproduction, not native Mac filesystem execution.

Required: consistent bounded identity handling for configured root/cwd, top-level and common directory. Preserve relative common-dir resolution against the invocation cwd. Test the actual message with equivalent path spellings and a genuinely external linked-worktree control. Failed canonicalization must remain unknown, not become affirmative external-repository guidance. Nested repository sessions must remain ordinary.

R3 — Production consumer applicability disregards actual OpenCode configuration

ProviderService 585–604 hardcodes snapshotsEnabled: true. In contrast, the actual runtime selects OPENCODE_CONFIG_CONTENT and passes it to the child. An explicit effective snapshot:false can therefore still receive the warning that snapshots will fail.

The selected OpenCode adapter passes serverUrl; a nonempty URL takes the external-server branch, without launching local OpenCode. Local PATH evidence cannot establish that external process's Git.

Required: derive consumer applicability from the selected production instance/runtime facts, honoring known effective snapshot disablement and external-server ownership. Reuse existing configuration resolution. Do not build a config-discovery framework, recursively search config files, or add a network probe. Preserve default local OpenCode coverage in ordinary repositories and T3's own local Git/fallback behavior. Test settings-driven production construction; another helper test that manually supplies snapshotsEnabled:false does not cover this gap.

Documentation/evidence correction

The PR body says preflight never blocks and leaving sharedSessionRoot unset restores prior behavior. The code can emit git-startup-failed blockers and runs Git/filesystem preflight independent of shared-root opt-in. Correct these descriptions. Unsetting sharedSessionRoot disables that shared-root classification only; source/binary revert is the complete rollout rollback. Describe configured provider-executable failure separately from Git capability checks.

CI build/test/check jobs were still queued at this refresh (run); label successes are not test acceptance.

Next single writer: ENVCHK:E6

The user's standing authority remains in force. No further permission request. This worker owns the narrow repairs and repeatable acceptance on existing #11. Independent final review/native qualification and subsequent landing/rollout remain manager-sequenced work.

ENVCHK:E6 — complete fresh-session assignment

ENVCHK:E6

Use a fresh coding/API-agent session. Read this COMPLETE manager review and assignment, PR #11, P1's RESULT, current repository instructions, and applicable supported T3 lifecycle guidance. You are the sole writer on existing nullStack65/t3code PR #11 for R1–R3 and preservation of its launch acceptance test.

HUB:
https://github.com/nullStack65/closura-agent-config/pull/237
SOURCE PR:
https://github.com/nullStack65/t3code/pull/11
INPUT HEAD:
af3b9c4c613e8f5aaf14ec1f0446e496f6dde0fc
INPUT BASE:
f5d3fc66016d54a16fd8872321d7722d4457526e
BRANCH:
envchk/v5-acceptance-20260928
P1 RESULT:
https://github.com/nullStack65/t3code/pull/11#issuecomment-5866548449

REFRESH AND PRESERVE
Refresh main, PR head, checks and hub ownership before editing. The candidate is now published; use its exact Git source. Create a fresh isolated resident worktree/branch for your changes, preserving existing V5/P1/E2–E4 work. No silent rebase or source reconstruction. Post/read back ENVCHK:E6 START on #11 and backlink the hub.

Complete the three concrete review items R1–R3 above with the smallest suitable changes. Keep one preflight/check implementation and existing thread-activity transport. No new service/framework/dashboard/database, recursive scan, model call, network-dependent runtime probe, production repository write, or unrelated source import. Warnings must remain actionable; block only demonstrated inability to execute usefully.

REQUIRED FAILURE/PASS EVIDENCE
- R1: hung initial cwd stat reaches a user-visible warning and returns within budget; denied/hung candidate metadata or read warns; a relevant capability probe that fails/hangs after healthy Git identity warns as incomplete; total-budget expiry retains prior findings and is not reported clean. Healthy and genuinely absent optional-file controls remain quiet. Use existing fixture and Effect test-clock facilities; do not induce actual workstation filesystem damage.
- R2: same physical root through alias spellings has correct local-metadata guidance; unknown canonicalization is not asserted external; a genuinely external common directory stays safe; selected nested repository stays ordinary. Retain the real relative-common-dir regression.
- R3: selected local OpenCode with default snapshots and an ordinary repository still detects a controlled Git missing --sparse; explicit effective snapshot:false suppresses that provider-specific requirement; external OpenCode does not pretend the local Git is its launched Git; healthy and non-OpenCode/T3-fallback controls remain. Drive applicability through the actual production settings/instance construction, not only manual probe options. Use harmless environment sentinels only.

PRESERVE AND REUSE P1'S WIRE SMOKE
Known untracked artifact:
 /Users/businessaccount/w-t3/envchk-p1/apps/server/integration/envchkP1WireAcceptance.integration.test.ts
Common Git dir:
 /Users/businessaccount/t3-fork-build/.git

Inspect and preserve the artifact through existing authorized source/T3 access; do not mutate P1's worktree. Commit the smallest maintainable version into this PR using existing test support, with isolated state, supported auth, and cleanup. Do not copy tickets/credentials into source. If raw artifact access is truly unavailable, retain P1's receipt and build the smallest equivalent from existing repository fixtures; do not claim to have recovered its exact contents.

Rerun that one production authenticated subscription smoke on your final candidate, verifying the corrected actionable warning, one successful dummy start, and configured-executable error. The prior backend/wire evidence is accepted; no new auth project or separate browser-rendering round. Fix only a demonstrated in-scope failure.

Run relevant focused regression tests, scoped type/lint/format checks, and existing required gates. Avoid broad legacy-suite repetition. Preserve runtime bounds, 32 KiB narrow reads, limited subprocess output, owned-process cleanup and no late launch after timeout. Report actual durations/exits and platform; do not sum overlapping test counts.

NATIVE WINDOWS
Windows qualification is still required. If an existing authorized native Windows executor is available, fetch and test your final published head there for PATH/PATHEXT, actual supported wrapper/executable paths with spaces, missing executable, interrupted slow lookup/read, bounded return and no late launch. Windows fixture repairs may be narrow and in scope; skipping all meaningful native cases is not a pass.
Do not repeat SSH host/user guessing or remote-access installation. If no native executor exists in your session, finish/publish the repairs and wire acceptance and record native Windows UNVERIFIED with the exact missing capability. The manager will give the next fresh native qualification prompt against the resulting Git ref.

PUBLISH AND RETURN
Append ordinary commits to the same PR branch; preserve af3b9c4c. Correct the PR body's behavior, configuration, test provenance and rollback descriptions. Read back the remote final SHA/base and CI state.

Post/read back ENVCHK:E6 RESULT on #11 and backlink #237 with:
- final full SHA, base, new worktree, changed files and preservation of original candidate;
- R1/R2/R3 failing-before/passing-after evidence, commands/exits/timings;
- committed wire-test path and authenticated production result;
- native Windows PASS/FAIL/UNVERIFIED with actual platform evidence;
- remaining exact review/check/rollout gates and simple rollback.

Documents and C:\Users\nullstack65\Desktop\projects remain allowed shared roots. MACFIX owns actual Mac Git/root selection, Dev project/cwd recovery, and the latest live configuration. STALL owns after-start detection; ENV-1 #10 owns service lifecycle; release #5 owns packaging. Do not import their open changes or change installed workstation state in this source-repair assignment.

Standing authority covers publication and eventual qualified landing/rollout; the manager sequences those stages after this result. Finish the concrete repairs and acceptance, then stop optional testing.

Status: exact source published and production authenticated delivery accepted; R1–R3 require correction; native Windows and live rollout remain open. No merge or installed change by this manager.

[nullStack65]

ENVCHK:E6 START

Fresh sole-writer session for the three manager review repairs on this PR. Read the complete manager review and the expanded ENVCHK:E6 assignment (#5866811056), the accepted P1 RESULT, current repository instructions, and applicant T3 lifecycle guidance.

Hub: closura-agent-config#237

Refresh

• Remote head envchk/v5-acceptance-20260928 = af3b9c4c613e8f5aaf14ec1f0446e496f6dde0fc (git ls-remote and gh pr view headRefOid agree).
• Base main = f5d3fc66016d54a16fd8872321d7722d4457526e.
• PR draft, MERGEABLE; the prior candidate commit af3b9c4c6 is preserved unrewritten.
• New isolated resident worktree: /Users/businessaccount/w-t3/envchk-e6, branch envchk/e6-repair-20260928, based at af3b9c4c6 (common dir /Users/businessaccount/t3-fork-build/.git). Predecessors envchk-e2 c1ece3d08, envchk-e3 f46269f71, envchk-e4 ae8ecca34, envchk-p1 af3b9c4c6, envchk-v5 af3b9c4c6 remain in git worktree list and are untouched. P1's untracked wire test is read-only inspected, not mutated in its worktree.

Scope

• R1: incomplete filesystem/capability checks (including the initial cwd check) produce bounded, actionable warnings; genuine absence stays distinct; warning-only launches continue.
• R2: consistent bounded identity handling across configured root/cwd, top level and common directory; correct the misleading Mac alias-path message; retain relative-common-dir and external-worktree protections.
• R3: derive the launch consumer from the selected production OpenCode instance/runtime facts (effective snapshot config and external-server ownership); preserve default local OpenCode coverage and T3's Git fallback; drive regression tests through production settings/instance construction.
• Preserve P1's wire acceptance as committed repeatable source and rerun it on the corrected candidate.
• Run focused failure-path/healthy controls, relevant type/lint/format checks, and existing gates. Native Windows qualification as available; otherwise record the exact UNVERIFIED gap.

Standing user authority remains in force. MACFIX, STALL, service lifecycle and packaging scopes are untouched. No merge, no installed-state change.

Posting/reading back on this PR; hub backlink at #237.

[nullStack65]

ENVCHK:E6 RESULT

R1, R2 and R3 are repaired on existing PR #11; P1's wire acceptance is committed as repeatable source and rerun on the corrected head. Original candidate af3b9c4c6 is preserved unrewritten (ordinary commits appended). No merge, no installed-state change.

Hub backlink: closura-agent-config#237

Exact identity / preservation

• Source PR: #11 (draft, base main), MERGEABLE.
• Final remote head: 29a4cdcdc657935efac0eaf89827ffd21728368e (git ls-remote and gh pr view headRefOid agree). Base f5d3fc66016d54a16fd8872321d7722d4457526e.
• New commits appended: 1a0e3d263 (R1/R2), 40b73dd89 (R3), 29a4cdcdc (wire acceptance). af3b9c4c6 and all predecessor commits untouched.
• New isolated resident worktree: /Users/businessaccount/w-t3/envchk-e6, branch envchk/e6-repair-20260928 at af3b9c4c6, common dir /Users/businessaccount/t3-fork-build/.git. Predecessors envchk-e2 c1ece3d08, envchk-e3 f46269f71, envchk-e4 ae8ecca34, envchk-p1 af3b9c4c6, envchk-v5 af3b9c4c6 remain in git worktree list; P1's worktree was read-only inspected and not mutated.
• Base→head patch sha256 = dcf2eee192f2df8758e2b02054480250b3b2ae934118bc5a905706c55449e121.
• E6 changed files (af3b9c4c6..29a4cdcdc): apps/server/src/environment/LaunchPreflight.ts, apps/server/src/environment/LaunchPreflight.test.ts, apps/server/src/provider/Layers/ProviderService.ts, apps/server/src/provider/launchPreflightConsumer.ts (new), apps/server/integration/launchPreflightDelivery.integration.test.ts, apps/server/integration/envchkP1WireAcceptance.integration.test.ts (new).

R1 — incomplete checks now warn, absence stays distinct

• Before: the initial cwd stat (ProviderService at af3b9c4c, lines 568–575) turned timeout/error into undefined and skipped the entire preflight; existsBounded read timeout/error as absent; the capability-probe error/timeout outcome was ignored; and the pre-existing test expected result.findings === [] when all existence checks hang.
• After: the bounded initial cwd stat lives in the single runLaunchPreflight implementation and emits root-read-slow / root-read-failed through the same reporter (genuine absence / plain file stays silent, handled by ProviderWorkspaceMissingError). Existence checks are tri-state (present / absent / unknown); an unknown metadata check warns once instead of reading as absent. A required capability probe that times out/fails warns git-probe-timed-out / git-probe-failed and is never mislabelled unsupported. Total-budget expiry retains prior findings, adds one incomplete warning, and is never reported clean.
• Failing-before/passing-after: the old test asserted empty findings on a hung first probe; the rewritten reports an incomplete preflight instead of clean when checks hang asserts non-empty warning findings, plus new focused tests: a hung initial cwd stat warns and returns within its budget, a failed initial cwd stat warns instead of silently skipping, a hung candidate metadata check warns instead of reading as absent, a required capability probe that hangs after healthy identity warns as incomplete, a required capability probe failure warns as incomplete, never unsupported, genuinely absent optional files stay quiet.

R2 — equivalent physical paths share identity handling

• Before: root was realpathed but commonDir was compared lexically from the original invocation spelling. On macOS (root/cwd /var/..., git top-level /private/var/..., common /var/.../.git) the comparison selected "Its Git identity points at a different repository". P1 recorded exactly that misleading sentence on this PR.
• After: root, top level and the (invocation-cwd-resolved) common directory are canonicalized consistently. Three outcomes: canonical common inside canonical root → "Move or retire <root>/.git"; confirmed external (linked worktree) → "points at a different repository" retained; unresolved canonicalization → neutral unknown message, never affirmative external. Relative common-dir resolution and the external linked-worktree/nested-repo protections are retained.
• Evidence: new unit tests alias spellings of the same physical root give local-metadata guidance and failed canonicalization does not assert an external repository; the real F1: git identity resolves relative common dirs against the invocation cwd regression still passes. The live wire run below shows the corrected "Move or retire …/.git" summary on the same alias setup (top-level /private/var/..., cwd /var/...) that previously produced the "different repository" sentence.

R3 — consumer applicability from production settings

• Before: ProviderService hardcoded snapshotsEnabled: true; an explicit effective OPENCODE_CONFIG_CONTENT snapshot:false still received the warning, and an external-server OpenCode instance used local PATH evidence.
• After: apps/server/src/provider/launchPreflightConsumer.ts resolves the consumer from ServerSettings.providerInstances: decodes OpenCodeSettings, treats a non-empty serverUrl as external (no local-Git claim), and parses the effective OPENCODE_CONFIG_CONTENT so an explicit snapshot:false suppresses the provider-specific requirement. Default local OpenCode coverage and T3's own sparse-checkout fallback are preserved.
• Evidence (production path, not manual probe options): the new R3: production settings select the launch consumer integration test builds real settings and captures the runner options through the real ProviderService (local default → {opencode, snapshotsEnabled:true}; snapshot:false → false; external serverUrl → false; codex fallback → {codex}). The new R3: a local OpenCode launch with default snapshots detects a controlled Git missing --sparse test runs the real preflight runner against an ordinary repository with a sparse-less Git in the selected instance environment and asserts the git-sparse-add-unsupported warning mentioning OpenCode and --sparse.

Preserved and rerun wire acceptance

• Committed path: apps/server/integration/envchkP1WireAcceptance.integration.test.ts (P1's exact artifact, with the hardcoded /tmp evidence write removed; all state is fixture-owned and cleaned up).
• Rerun on 29a4cdcdc: exit 0; the test asserts the corrected launch.preflight warning (tone:"error", payload.code:"shared-root-git", payload.cwd = fixture root, summary contains the root and "shared session root"), sessionStartCount === 1, startupPreflightLogged === true, no provider.turn.start.failed on the main thread, and the missing-executable thread reaching status:"error" with lastError = "Failed to spawn ACP process for command: …/not-a-real-grok".
• Observed corrected summary on that run: "The shared session root /var/… is itself a Git repository (top-level /private/var/…). Projects beneath it would share that repository. Move or retire /var/…/.git if that is unintended." — the alias-aware local guidance replacing P1's "different repository" sentence. Provider invocations: --version, agent --always-approve stdio, inspect --json (one session start). No separate browser or auth project was created.

Commands / exits / timings (this session, macOS x86_64)

• npx pnpm@11.10.0 install --frozen-lockfile → exit 0 (32.8 s wall).
• npx vp test run apps/server/src/environment/LaunchPreflight.test.ts apps/server/integration/launchPreflightDelivery.integration.test.ts apps/server/integration/providerService.integration.test.ts → exit 0, 3 files / 53 tests, Duration 8.58 s.
• npx vp test run apps/server/integration/envchkP1WireAcceptance.integration.test.ts → exit 0, 1 test, Duration 15.09 s (test 12.84 s; earlier clean runs 10.3–11.9 s wall).
• npx tsc --noEmit in apps/server → exit 0 (only repository-wide suggestion-level Effect diagnostics; no errors in changed files).
• npx vp lint --report-unused-disable-directives <changed files> → exit 0; npx vp fmt --check <changed files> → clean.
• Bounds honored: preflight 500 ms per filesystem op, 1500 ms per Git probe, 5 s total; 32 KiB narrow reads, 4 KiB subprocess output, owned-process cleanup, no late launch. No leftover src/bin.ts serve processes or fixture temp dirs after runs.

Native Windows

UNVERIFIED. Exact missing capability: this session is native macOS only (Darwin … x86_64) with no authorized native Windows executor configured or reachable (~/.ssh/config has no Windows host; no Windows device host is exposed to this session). Per the assignment I did not repeat SSH host/user guessing or access-discovery/installation loops. The Windows PATH/PATHEXT and spawned-executable resolution in packages/shared/src/shell.ts therefore remain unexercised natively; the manager should issue the next fresh native-qualification prompt against 29a4cdcdc.

CI / remaining gates

• CI on 29a4cdcdc is queued (run 36413116076, jobs Test, Test Server 1–3, Check, Rust, Release Smoke, Mobile Native Changes; no runners picked them up). Label jobs passed; that is not test acceptance.
• Remaining: manager independent full-diff review; native Windows qualification (A4) against 29a4cdcdc; actual browser/rendered-client rendering; qualified landing and bounded rollout. MACFIX, STALL, ENV-1 feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10 and release feat(release): fork release pipeline with fork update isolation #5 scopes untouched.

Rollback

Unsetting sharedSessionRoot disables only the shared-root classification; the Git/filesystem preflight still runs. Complete rollback is a source/binary revert of these commits. Additive and opt-in for the shared-root check; no migration and no destructive filesystem operation.

[nullStack65]

ENVCHK:MANAGER

E6 delta reviewed — preserve gains; one native Windows qualification/repair owner next

Exact reviewed E6 head: 29a4cdc. Original V5/P1 af3b9c4 is preserved through three ordinary commits. E6 RESULT.

The manager read the six-file E6 delta, full committed wire test, consumer helper and production call sites. One narrow independent helper reviewed the two LaunchPreflight files. This is source review; no manager rerun of native suites is claimed.

Credit retained

• Initial cwd timeout/failure now reaches the single preflight implementation and warning transport.
• Hung metadata, required OpenCode capability timeout/failure, and total-budget expiry now warn.
• The specific P1 /var ↔ /private/var local-versus-external metadata message is corrected once shared intent is supplied.
• Selected-instance JSON snapshot:false and external OpenCode server configuration now affect the consumer; default local OpenCode still receives the capability check.
• P1's authenticated production subscription test is now committed at apps/server/integration/envchkP1WireAcceptance.integration.test.ts. E6 reports 53 focused tests passing and a passing wire run (15.09 s runner duration, 12.84 s test), plus scoped type/lint/format checks. These are author receipts.
• Production subscription satisfies the original delivery boundary. Browser rendering remains unobserved but is not a separate gate or assigned round.

Remaining production-path corrections (not a redesign)

W1-A: preserve actual metadata errors through the production adapter.
The new tri-state handler can catch errors, but LaunchPreflight.ts:755–768 still implements exists with fileSystem.exists(...).pipe(Effect.orElseSucceed(() => false)). Denied/I/O-failed candidate metadata is already converted to absence before the handler sees it. Its interface remains non-failing.
Reuse the typed stat/absence distinction or another existing suitable primitive. Test through the real service construction with a healthy root and a denied candidate metadata operation; retain genuine NotFound as quiet. A helper-only injected probe bypasses the defect.

W1-B: incomplete relevant T3 sparse checks must also warn.
Outcome handling:489–509 requires requiredByConsumer for error/timeout warnings, but probe applicability:714–744 also runs help for a verified sparse checkout under a non-OpenCode provider. Failure after that successful sparse-config check is still silently dropped. Preserve applicability for incomplete outcomes; keep non-required/healthy cases quiet and unknown capability distinct from unsupported. Retain the optional --path-format fallback.

W1-C: configured-root recognition must reach canonical identity.
isConfiguredSharedSessionRoot:229–236 still compares lexical paths. ProviderService calls it before the probe; server startup does likewise. A configured /var/... path and actual /private/var/... cwd therefore lose shared intent before E6's corrected comparison runs. The new alias test supplies isSharedRoot:true manually.
Carry the explicitly configured root into the same bounded identity logic, or use an equally small shared correction at both production call sites. Do not add unbounded caller-side realpath operations or infer shared intent from folder breadth. Exercise real settings-to-preflight construction, including alias/junction identity, a selected nested repository, and unresolved identity.

W1-D: honor the provider's supported inline configuration syntax.
The new consumer helper uses JSON.parse and defaults snapshots to true on parse failure. Exact official OpenCode v1.18.31 source loads OPENCODE_CONFIG_CONTENT through loadConfig, which uses ConfigParse.jsonc. A valid inline config with comments/trailing commas and snapshot:false is consequently misread by the preflight.
Use a supported parser for this small in-memory value, reusing a dependency/helper where available; avoid ad-hoc regex parsing or configuration-tree discovery. Add a production-settings-driven JSONC snapshot:false control. Unknown configuration must not be asserted definitely enabled. Preserve the ordinary default and external-server fixes.

These are bounded completions of R1–R3. Do not restart the feature or create separate repair agents.

Native Windows and repeatable acceptance

The asynchronous Windows resolver in packages/shared/src/shell.ts remains unqualified natively. The next assignment is explicitly ENVCHK:W1 on native Windows, using published source; it has no dependency on a Mac-only untracked artifact now.

Several existing fixtures use which and POSIX shell wrappers. Port only the necessary fixtures using supported existing helpers so native tests execute the actual resolver/launcher. Injected win32 labels on Mac/WSL are not native evidence.

The committed wire harness also needs its normal failure cleanup made suitable for this qualification: currently it kills the server in a scope finalizer without awaiting exit, removes state directories in the success body before that finalizer, and bounds only the WS phase (not the entire startup/auth/cleanup attempt). Reuse test support to bound the whole fixture, await owned-process exit, and clean on failure as well as success. Do not turn this into a service manager or use broad process-name killing.

Main and release moved

Maintained main is now 419f757 after merged release PR #5. The 38-file base delta does not overlap ENVCHK's changed files. Preserve the landed release work in the current qualification candidate through an ordinary base merge; preserve E6's history.

Release v0.0.43 is published from 929b637, an older frozen binary source. It is not an ENVCHK build. Do not overwrite/restamp those artifacts or claim that release delivered this PR. Later ENVCHK packaging/rollout must use the accepted source through the existing release mechanism/owner.

Current #11 CI build/test/check jobs are queued (run); label jobs are not source/test acceptance. Do not add runners or change CI policy for this task.

MACFIX configuration update

User policy handoff: Dev is the working root; Documents is archive-only. This updates this user's live target, not the product's generic ability to use a Documents folder.

M7 final handoff:

• shared working root /Users/businessaccount/Dev is non-Git;
• actual Git /usr/local/bin/git -> /usr/local/opt/git/bin/git 2.55.0;
• OpenCode /Users/businessaccount/.opencode/bin/opencode 1.18.31;
• installed T3 0.0.42;
• restored canonical Dev/closura-agent-config accepted, originals preserved;
• an actual shared-Dev launch is still unverified, and earlier Documents launches do not establish a Dev-selection routing bug.

No ENVCHK task is added to repair project selection or write to the Documents archive. MACFIX retains that closeout. Preserve Windows C:\Users\nullstack65\Desktop\projects as the configured non-Git shared root.

ENVCHK:W1 — complete fresh native-Windows assignment

ENVCHK:W1

Use a FRESH coding-agent session with native Windows execution. Finish the small remaining production-path corrections and native qualification of existing nullStack65/t3code PR #11. Do not resume E6 or create another general implementation round.

Read this COMPLETE manager review and assignment, PR #11, E6's RESULT, current repository instructions, and applicable supported T3 lifecycle guidance.

HUB:
https://github.com/nullStack65/closura-agent-config/pull/237
SOURCE PR:
https://github.com/nullStack65/t3code/pull/11
E6 RESULT:
https://github.com/nullStack65/t3code/pull/11#issuecomment-5868775780
INPUT HEAD:
29a4cdcdc657935efac0eaf89827ffd21728368e
LAST OBSERVED MAIN:
419f7574010c066a56974fc9e3ac0709a08efb33
EXISTING PR BRANCH:
envchk/v5-acceptance-20260928

ESTABLISH NATIVE EXECUTION FIRST
Record actual OS, process.platform, architecture, Node/package-manager/Git paths and versions. Native Windows means Windows processes, not WSL/Linux and not an injected platform flag.
If your session starts elsewhere, use only an already-supported authorized Windows executor/device route. The exact source and wire test are now on GitHub; no Mac artifact retrieval or remembered original machine is needed. If there is no native Windows route, report NATIVE_EXECUTOR_UNAVAILABLE and the exact missing capability promptly. Do not substitute another Mac run, guess SSH hosts/users, search credentials, install remote access, or claim qualification.

CLAIM AND PREPARE
You are the sole source writer on #11 for W1-A–D, narrow fixture portability/cleanup, and native qualification. Refresh PR/main/hub ownership and checks. Create a fresh isolated resident worktree (including its common Git directory) from the published E6 head.
Preserve af3b9c4c and 29a4cdcdc. Incorporate only already-landed refreshed main through an ordinary merge, preserving release #5 and all ENVCHK changes. No import of open lifecycle/ST​ALL/other PRs. Post/read back ENVCHK:W1 START with identities and scope.

COMPLETE W1-A–D IN THE REVIEW ABOVE
Use the existing preflight/result/transport and small supported helpers.
A. Production metadata errors must remain failures, with genuine NotFound quiet.
B. A failed/hung capability probe that is relevant through a verified T3 sparse checkout must warn, not only the OpenCode case.
C. Explicit configured-root/cwd alias identity must reach bounded canonical comparison through both real production call sites; nested repositories stay ordinary.
D. Honor valid inline JSONC snapshot:false with a supported parser, without scanning configuration trees or adding network dependency.

Prove each old failing case and the corrected healthy/absence/non-required controls through the actual production construction being repaired. Manual helper options that bypass an affected adapter/call site are insufficient. Preserve E6's accepted fixes and optional Git fallbacks.

NATIVE WINDOWS ACCEPTANCE
On the final integrated source, run the focused existing suites and the real authenticated wire smoke. Port only needed fixtures; avoid making meaningful Windows cases pass by skipping them or injecting the resolver's result.

Demonstrate:
- real PATH/PATHEXT selection, including the actual selected provider environment;
- executable and supported .cmd/.bat wrapper paths containing spaces;
- missing/unstartable configured executable reaches the existing user-visible failure before model work;
- healthy and warning-only provider starts happen once;
- a slow/denied narrow lookup/read returns within the declared budget, warns appropriately, and cannot cause a late process launch after cancellation;
- fixture-owned process/descendant cleanup;
- shared-root identity works for normal and supported alias/junction paths; explicit shared inbox vs ordinary/nested repo behavior stays distinct;
- authenticated production warning delivery and configured-executable failure from the committed envchkP1WireAcceptance.integration.test.ts.

Use disposable fixtures. Read the real Windows projects shared root only as needed; never initialize Git there or modify actual user repositories/settings. Keep runtime probes offline/read-only and cheap (no recursive tree scan or model call). Do not launch a real model-backed provider as the dummy.

Bound the whole wire fixture (startup/auth/subscription/cleanup), use existing supported bootstrap, await owned server/child exit before deleting state, and clean up on failure. Stop only captured fixture-owned processes. If a demonstrated native production defect appears, repair it narrowly on the same PR and rerun the affected case.

Run relevant type/lint/format checks and observe repository-required CI gates. No broad legacy suite or packaging build unless needed to resolve a concrete failure. Native source launch qualification does not require registering a Windows service, changing scheduler/auth/sync settings, or installing the app.

PUBLISH AND HAND OFF
Append ordinary commits to the same PR, update behavior/test/rollback descriptions and read back final remote SHA/base. Preserve prior source. Post/read back ENVCHK:W1 RESULT on #11 and backlink #237, including:
- actual native host/runtime identity and exact tested final source;
- W1-A/B/C/D failing-before/passing-after evidence;
- native case-by-case PASS/FAIL/UNVERIFIED, commands/exits and bounded timings;
- actual selected executable/environment sentinel, sanitized warning/error, dummy start count;
- whole-fixture/owned-process cleanup evidence, remaining skips and why;
- current CI status and exact remaining source/release/rollout gates;
- simple source/binary rollback.

Keep browser rendering unobserved unless executed; it is not a separate acceptance gate. Do not call source qualification installed rollout. v0.0.43 is an older source build and must not be restamped or counted as containing ENVCHK.

Standing user authority covers needed publication and eventual qualified landing/rollout; no new permission question. The manager reviews the final published result and sequences landing/rollout through the existing release mechanism. MACFIX owns the verified Mac configuration and Dev closeout; Documents is now that user's archive. STALL and service lifecycle retain their scopes.

Finish this bounded native assignment, then stop optional testing.

Status: E6 gains preserved; four precise production-path completions and native Windows execution remain; wire acceptance is committed; no ENVCHK merge/install yet. Next user-run fresh worker: ENVCHK:W1.

[nullStack65]

ENVCHK:MANAGER

W1 completion reported; result not yet recoverable from GitHub — fresh W2 will recover once and continue the source work

The user reports that W1 completed. That report is accepted as a reason to look for its output; it is not a substitute for source/test evidence.

Refreshed durable state

• PR feat(server): bounded environment preflight for provider launches #11 is still draft/open/unmerged at 29a4cdc, branch envchk/v5-acceptance-20260928.
• Both the normalized timeline and raw GitHub issue-comments API contain P1, E6, and manager reviews, but no W1 START or RESULT. The hub Failing to create PR on Windows pingdotgg/t3code#237 also has no W1 worker return. No new ENVCHK publication was found in the bounded branch/PR search. Search absence does not prove no local work ran.
• Maintained T3 main remains 419f757. E6's code and reported Mac evidence remain preserved. The four specific production residuals in the prior review remain unaccepted until corrected evidence is available.
• The substantive checks for feat(server): bounded environment preflight for provider launches #11 remain queued in 36413116076. Label/check metadata is not test acceptance.
• Fork CI now has its own source owner in PR #12, current head 5a1f032. Its RESULT reports CAPACITY_NOT_CONFIGURED and no substantive CI execution. ENVCHK must not duplicate that work or wait indefinitely for queued jobs.
• No ENVCHK merge or installed rollout is claimed.

Handoff correction

My W1 assignment made native Windows availability a prerequisite to proceeding with source repairs. W2 supersedes that entry requirement. It will make one bounded attempt to recover W1, preserve whatever was completed, and then finish the remaining portable source work on an available supported host. Native Windows is still required to claim native Windows qualification; an unavailable route must not prevent source progress or a durable RESULT.

The manager runtime has no exposed T3/SSH/native Windows execution connector. I have not inspected the completed local T3 session or run native tests here.

Supported recovery guidance, checked at current config master

The helper's read-only review refreshed closura-agent-config/master to 253d9c599fec28cb0833625e54f038fb19b955cf and identified the maintained mechanisms:

• Canonical Kameron recovery instructions: GitHub first, fresh reader, configured Mac and Windows instances, exact thread/provider binding, no request that the user remember the originating machine.
• T3 read API reference: bounded orchestration.searchThreads, archived metadata, exact-thread subscription/read. The reference is versioned; verify the installed surface.
• Existing discovery and CLI: --discover --timeout <seconds> --json; identity discovery is not authenticated execution.
• Pending-report locations and return contract: use task-matching receipts and verify the substantive published body.
• Native Windows remote profile documents Tailscale/native OpenSSH intent but has source-only/unknown qualification and placeholder bindings. It is not evidence of an authenticated Windows route.

ENVCHK:W2 — complete fresh recovery and implementation assignment

ENVCHK:W2

Use a FRESH coding-agent session on an available supported host. You do not need the original W1 session or machine. This is one bounded recovery-and-continuation assignment, with one source writer and no helper implementation agents.

Read this complete manager checkpoint, the full prior technical review:
https://github.com/nullStack65/t3code/pull/11#issuecomment-5868905155
and current repository instructions and supported T3 lifecycle/recovery guidance.

SOURCE PR:
https://github.com/nullStack65/t3code/pull/11
HUB:
https://github.com/nullStack65/closura-agent-config/pull/237
LAST VERIFIED SOURCE:
29a4cdcdc657935efac0eaf89827ffd21728368e
EXISTING PR BRANCH:
envchk/v5-acceptance-20260928
LAST OBSERVED MAIN:
419f7574010c066a56974fc9e3ac0709a08efb33

1. REFRESH AND RETURN PATH FIRST

Refresh the source PR, main, hub, ownership, and instructions. Post/read back ENVCHK:W2 START before executor discovery. Record actual OS/architecture, process.platform, selected Node/Git/package-manager paths, and this assignment's boundaries without exposing secrets.

Native Windows unavailability is not a reason to omit START/RESULT or stop the portable source work. If publishing itself is unavailable, report that exact failure and preserve a concrete return artifact; never claim a posted/read-back result that does not exist.

2. RECOVER W1 ONCE, WITHOUT RESUMING IT

Make one bounded recovery pass, at most ten minutes, using existing supported mechanisms. GitHub first, then the configured Mac and Windows T3 instances accessible through existing authorized routes.

Search ENVCHK:W1, the exact PR URL, and the distinctive assignment within the dispatch-to-completion interval (approximately 2026-09-28 11:29Z to 12:56Z). Pair content search with title/archive metadata. A later thread quoting W1 is not automatically the original worker. Bind candidates to actual instance/profile/data root, exact thread, provider session, project/cwd/worktree and activity.

Prefer the installed supported search/read/export API. Use version-appropriate read-only persisted-state fallback only where maintained guidance supports it. If T3 history is incomplete, inspect the exact provider session identified by its recorded resume cursor; check only task-matching pending report_receipt records and any recorded pending-dir override.

Read the completed output and preserve any commits, patches, test receipts, or worktree evidence. Do not resume, interrupt, settle, delete, or otherwise mutate the old session. Do not dump whole session databases, scan broad folder trees, guess hosts/accounts, search credentials, or install remote access.

Report each configured instance as matched, no retained match, unavailable, or not needed after verified recovery. If no recoverable result appears within the bounded pass, record the exact limit and continue from published source. Do not ask the user which machine ran W1.

If evidence shows a writer is actually still active on #11, avoid source collision: publish the exact ownership/state evidence and a concrete handoff instead of overwriting its work.

3. PRESERVE WORK AND FINISH ONLY THE MISSING SOURCE REPAIRS

If W1 already completed a repair, inspect and reuse it; do not recreate it merely because its RESULT was missing.

Create a fresh isolated resident worktree, including a resident common Git directory. Start from refreshed published source and preserve verified recoverable W1 changes with attribution. Preserve af3b9c4c and 29a4cdcdc ancestry. Incorporate only already-landed refreshed main by ordinary merge. Do not import open #10 lifecycle, #12 CI, STALL, or other unrelated PRs.

Complete the four narrowly defined production corrections from the prior review:
A. Preserve metadata/access failures through the actual production adapter while keeping genuine NotFound quiet.
B. Warn on failed/hung capability checks relevant through verified T3 sparse-checkout applicability, including non-OpenCode consumers.
C. Carry explicit configured-root versus actual-cwd physical identity through both production callers inside the existing bounded preflight. Keep nested ordinary repositories distinct and unresolved identity neutral.
D. Honor valid inline JSONC snapshot:false with a supported parser and no configuration-tree scan.

Demonstrate the old failing cases and repaired healthy/absence/non-required controls through the real production construction being repaired. Preserve accepted E6 behavior, optional Git fallbacks, consumer/environment selection, messages, and limits.

Repair only the necessary portability and whole-fixture startup/authentication/cleanup bounds of the committed authenticated launch test. Await fixture-owned processes before deleting their state, and clean up on failure.

4. TEST ON THE ACTUAL AVAILABLE HOST; QUALIFY WINDOWS IF AVAILABLE

Run the relevant focused suites, committed authenticated launch/subscription acceptance, and scoped type/lint/format checks on the final candidate. Record actual commands, exits, source SHA, platform, elapsed times, and skips.

If an existing authorized native Windows execution route is available, execute the prior review's complete native matrix: PATH/PATHEXT and selected provider environment, exe/cmd/bat paths with spaces, missing/unstartable executable, healthy/warning launch exactly once, bounded denied/slow operations, no late launch after cancellation, alias/junction and nested-repository behavior, and owned-process cleanup. Native means actual Windows processes, not WSL or injected flags.

If native Windows is unavailable, finish and publish the portable repairs and actual-host evidence anyway. Mark native Windows UNVERIFIED with the exact missing capability and preserved runnable tests; do not fabricate a native result or require another identical recovery round.

Use disposable fixtures and dummy providers, no model calls, no recursive scans or repository writes from runtime probes. Preserve the user's real Windows projects root. Generic Documents support remains allowed; this user's Mac Documents is archive-only and Dev is the working root. Do not alter installed apps, service configuration, sync, repositories, or agents outside owned test fixtures.

5. PUBLISH A SUBSTANTIVE RESULT AND STOP

Append ordinary commits to the same source PR without force pushing. Refresh before publication, verify remote head/base, update behavior/test/rollback descriptions, and post/read back ENVCHK:W2 RESULT on #11 with a hub backlink.

Include:
- W1 recovery disposition and exact thread/provider/worktree identity if recovered.
- Reused versus newly completed work.
- Final source/base and production A/B/C/D failure-path evidence.
- Actual-host and native Windows PASS/FAIL/UNVERIFIED separately.
- Authenticated launch warning/error, dummy start count, timings, and cleanup evidence.
- Current CI state, any remaining concrete gaps, and simple source/binary rollback.

CI routing and capacity belong to #12/ENV-1. Observe status and report dependencies; do not wait hours, modify CI policy, create runners, or treat queued/skipped jobs as passes. Do not count v0.0.43 as an ENVCHK build.

Standing user authority covers needed publication and eventual qualified landing/rollout; no new permission question. The manager reviews the exact published result and sequences landing/rollout. Do not declare source/native qualification to be an installed rollout.

Complete this bounded assignment, publish the result even if part remains unavailable, and stop optional testing.

Next user-run worker: one fresh ENVCHK:W2. Recovery is a short first step; it must not become another round that leaves the source untouched solely because native Windows was unavailable.

[nullStack65]

ENVCHK:W2 START

Fresh coding-agent session on the Windows host (native). Posting START before executor discovery, per assignment.

Assignment: ENVCHK:W2 — bounded W1 recovery (<=10 min) + finish the four production corrections + necessary launch-test portability/cleanup + native host qualification if available. One source writer, no helper implementation agents.

Host / runtime identity (this environment):

• OS: Windows, process.platform = win32, arch x64 (AMD64).
• Node: v24.21.0 at C:\Users\nullstack65\scoop\apps\nodejs-lts\current\node.exe.
• Git: 2.55.0.windows.3 at C:\Program Files\Git\cmd\git.exe.
• GitHub CLI: gh 2.97.0; npx 11.19.0.
• T3 Code (Alpha) desktop running locally; T3 data root C:\Users\nullstack65\.t3\userdata (state.sqlite), server runtime port 3773.
• Configured non-Git shared root for this user: C:\Users\nullstack65\Desktop\projects (preserved; no Git init there).

Refreshed durable state (read back now):

• Source PR: feat(server): bounded environment preflight for provider launches #11, state OPEN, isDraft true, base main.
• PR head: 29a4cdcdc657935efac0eaf89827ffd21728368e (branch envchk/v5-acceptance-20260928), matches last verified source.
• Landed main: 419f7574010c066a56974fc9e3ac0709a08efb33.
• Hub: nullStack65/closura-agent-config#237.
• feat(server): bounded environment preflight for provider launches #11 CI run 36413116076 status queued (CI belongs to ci(fork): route validation to owner-admitted self-hosted capacity #12; not a gate here, will not wait indefinitely).
• Local fork checkout: C:\Users\nullstack65\Desktop\projects\t3code-fork-win (common git dir resident); remote fork = nullStack65/t3code.

Scope boundaries:

• Recover W1 once, read-only, without resuming/mutating the old session; record per-instance disposition.
• Fresh isolated resident worktree from published source; preserve af3b9c4 + 29a4cdc ancestry; merge only landed main by ordinary merge; do not import feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10/ci(fork): route validation to owner-admitted self-hosted capacity #12/STALL.
• Implement W1-A (metadata failures preserved, NotFound quiet), W1-B (relevant incomplete sparse capability warns, non-required quiet, unknown != unsupported), W1-C (configured-root/cwd canonical identity reaches both production call sites; nested repos ordinary; unresolved neutral), W1-D (valid inline JSONC snapshot:false honored via supported parser; no config-tree scan; unknown != definitely enabled).
• Repair only necessary launch-test portability/whole-fixture bounds/owned-process cleanup.
• Run focused suites + committed authenticated wire smoke + scoped type/lint/format on the final candidate; attempt native Windows matrix (this host is native Windows).
• Append ordinary commits to feat(server): bounded environment preflight for provider launches #11 (no force push); publish ENVCHK:W2 RESULT with hub backlink.

Proceeding to the bounded W1 recovery pass.

[nullStack65]

ENVCHK:W2 — START

Identity: ENVCHK:W2 (fresh coding-agent session, single source writer). Predecessor role: ENVCHK:W1, recovered from GitHub and configured-instance state, never resumed.

Actual execution location (verified, not assumed): macOS, Darwin Crown-Rain-Gutters.local 25.6.0 ... x86_64 (uname -m = x86_64), process.platform = darwin, process.arch = x64. This is the available supported host for W2.

Selected toolchain:

• node → /usr/local/bin/node, v25.6.0
• git → /usr/local/bin/git, 2.55.0
• bun → /Users/businessaccount/.bun/bin/bun, 1.4.0
• npm → /usr/local/bin/npm, 11.8.0

Refreshed durable state (this round):

• SOURCE PR feat(server): bounded environment preflight for provider launches #11 nullStack65/t3code, draft/open/unmerged, branch envchk/v5-acceptance-20260928, head 29a4cdc.
• main 419f757 (unchanged from manager observation).
• HUB Failing to create PR on Windows pingdotgg/t3code#237 nullStack65/closura-agent-config, branch docs/env-1-agent-environment-round-1, head 21ff3d7ec6aa95118a18d3f66c0400fe6db764ad.

Scope: one bounded W1 recovery pass (≤10 min, GitHub-first across configured Mac/Windows instances, no resume/mutation of any old session); preserve recoverable work; fresh isolated resident worktree from published source; ordinary merge of landed main only; complete the four production corrections W1-A/B/C/D plus the necessary launch-test portability/bounds/cleanup repair; run focused suites and the committed authenticated wire acceptance on this actual host; native Windows attempted only if an authorized native route exists, otherwise explicitly UNVERIFIED with the exact missing capability. Publish ordinary commits to #11 and a substantive ENVCHK:W2 RESULT with hub backlink.

Boundaries (not in scope): no CI policy/runner changes (belongs to #12), no lifecycle/MACFIX/STALL/release scope, no installed-app/service/sync/repository mutation outside owned test fixtures, no model-backed provider launch, no indefinite wait on queued CI, no force push, no declaration of installed rollout.

Hub backlink: https://github.com/nullStack65/closura-agent-config/pull/237

[nullStack65]

ENVCHK-1:WINREC — ENVCHK:W2 START (recovery continuation)

I am taking the explicitly assigned recovery/finish pass for the settled/interrupted Windows thread 0810ca1a-a2f8-4aea-b963-d7a1baf054ef without resuming, interrupting, settling, deleting, or mutating that thread. Coordination hub: https://github.com/nullStack65/closura-agent-config/pull/237

Scope is limited to the already isolated native-Windows worktree C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2 at recovered predecessor 1aa4ce8feb4a9d603e732211905416306bf161b1: preserve its eight tracked edits plus apps/server/src/provider/launchPreflightConsumer.test.ts, finish the interrupted wire test, run focused checks, and append ordinary commits to this PR only if correct. No installed-app, Serena, database, unrelated worktree/PR, release, merge, old-thread, or model-backed provider actions.

Initial native readback over SSH to DESKTOP-GM0G7BK (192.168.4.174) confirms Windows 11 x64, user nullstack65, Git 2.55.0.windows.3, exact worktree head 1aa4ce8f…, and the eight tracked modified paths plus the requested untracked test. The first focused runner attempt reached the repository but is blocked before tests by the recovered dependency tree missing the native vite-plus binding @voidzero-dev/vite-plus-win32-x64-msvc; I am checking the existing cache and will report the exact limitation if it cannot be repaired in-scope.

No source write or commit has occurred in this continuation. Final report will include predecessor/final head, recovered-vs-new diff, native commands/exits, provider/test/process cleanup, PR/hub readback, limitations, and rollback.

[nullStack65]

ENVCHK-1:WINREC — ENVCHK:W2 RESULT

Outcome: source recovery/continuation committed and pushed; native Windows qualification is UNVERIFIED because the recovered checkout’s platform dependency tree cannot start its test runner. No old T3 thread was resumed, interrupted, settled, deleted, or otherwise mutated.

Identity and recovered-vs-new boundary

• Implementation PR: feat(server): bounded environment preflight for provider launches #11; coordination hub: https://github.com/nullStack65/closura-agent-config/pull/237.
• Existing PR predecessor / recovered Windows worktree head: 1aa4ce8feb4a9d603e732211905416306bf161b1.
• Final pushed head: 5d9ccd868e78521924b9165a501abbbe5d2609ba, branch envchk/v5-acceptance-20260928; base main is 419f7574010c066a56974fc9e3ac0709a08efb33.
• Native worktree: C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2, host DESKTOP-GM0G7BK / 192.168.4.174, Windows 11 x64, user nullstack65, Python 3.13, Git 2.55.0.windows.3; the worktree was confirmed at the exact predecessor before inspection.
• Recovered source delta was exactly the eight tracked files already modified at 1aa4ce8f…, plus the requested new apps/server/src/provider/launchPreflightConsumer.test.ts. The new commit contains exactly those nine paths; no unrelated source/worktree was imported. The PR’s pre-existing 18 commits after 29a4cdcd… (including the existing 1aa4ce8f main merge) remain predecessor history, not new W2 changes.
• W1 recovery disposition: no old session resume/read mutation was performed; the assigned recovered Windows worktree and its source changes were preserved and continued in place. The old thread remains outside this source operation’s mutation scope.

Completed source work

• A: production metadata/access probe errors remain findings; genuine NotFound remains quiet.
• B: sparse capability applicability is resolved before the capability probe, so failed/slow relevant probes warn for non-OpenCode and provider consumers; unknown is not reported as unsupported.
• C: configured shared-root identity is carried through production startup and provider launch, with physical alias handling and nested-repository distinction.
• D: inline JSONC OPENCODE_CONFIG_CONTENT honors snapshot:false; malformed/non-boolean/unknown config is not asserted enabled; no configuration-tree scan was added.
• The interrupted wire fixture was bounded across startup/auth/subscription/cleanup, awaits fixture-owned server exit, and cleans fixture state on success/failure. The provider consumer test was added for strict JSON, comments/trailing commas, unknown config, production snapshot:false, and the ordinary default.

Native commands and results

• Readback through Python stdin over SSH: PASS — exact worktree head/status, predecessor diff, modified paths, worktrees, host identity, and process state were read.
• Focused test command attempted on native Windows: node <resident vite-plus>/bin/vp test run apps/server/src/environment/LaunchPreflight.test.ts apps/server/src/provider/launchPreflightConsumer.test.ts — NOT RUN / exit 1 before collection: missing/invalid Windows VITE+ optional binding (@voidzero-dev/vite-plus-win32-x64-msvc; package was present in the pnpm store but the recovered symlinked tree returned ERR_INVALID_PACKAGE_CONFIG / untrusted reparse path).
• Bounded offline repair attempt: corepack pnpm install --offline --frozen-lockfile --force --ignore-scripts — did not complete in the bounded window; the single owned pnpm process was stopped. No tracked source changed.
• Direct server typecheck attempt: node <typescript@7.0.2>/bin/tsc --noEmit -p apps/server/tsconfig.json — NOT RUN / exit 1 before checking source because @typescript/typescript-win32-x64 is absent from the recovered platform dependency tree.
• Native git diff --check: exit 2 only for one pre-existing formatting warning, launchPreflightDelivery.integration.test.ts:1028: new blank line at EOF; no whitespace error in the other files. The source was committed without altering unrelated formatting.
• Commit hook attempt: failed before checks because SSH PATH has no usable node shim (VITE+ - pre-commit script failed (code 127)). The ordinary commit was then created with the hook path disabled, preserving the exact hook failure as evidence; no test result is claimed.
• Push: PASS via the existing authenticated GitHub CLI identity using an in-memory HTTP authorization header; remote readback returned 5d9ccd868e78521924b9165a501abbbe5d2609ba.

Provider/process/CI state and rollback

• No model-backed provider was launched. The stale fixture-owned envchk-p1-fake-grok PID 23216 was stopped after verification; a follow-up process query found no remaining envchk, t3-w1, or fake-grok descendants. The installed T3 process was not touched.
• PR checks were refreshed after push: CI/Test jobs are queued; PR Vouch/PR Size were in progress; mobile preview/web preview were skipped; CodeRabbit was successful. Queued/skipped checks are not treated as test passes.
• Native Windows matrix and authenticated production wire acceptance remain UNVERIFIED, not PASS, due the runner dependency limitation. No installed rollout, merge, release, scheduler, database, or config change was performed.
• Source rollback is the ordinary inverse: revert commit 5d9ccd868e78521924b9165a501abbbe5d2609ba on the PR branch. The preserved predecessor is 1aa4ce8feb4a9d603e732211905416306bf161b1; no force push was used.

Hub backlink: https://github.com/nullStack65/closura-agent-config/pull/237

[nullStack65]

ENVCHK:E7 — RESULT

Outcome: E7-1 and E7-2 are implemented, verified on the actual host, committed, and pushed with no force. Native Windows remains UNVERIFIED (exact missing capability below). No merge, install, packaging, CI/runner, callback/controller/service/queue, credential, or T3-database change was made, and no model/subagent/fallback was invoked.

• PR: feat(server): bounded environment preflight for provider launches #11 · Hub: https://github.com/nullStack65/closura-agent-config/pull/237
• START (read back OK): feat(server): bounded environment preflight for provider launches #11 (comment)

Exact source identity

• Base / maintained main: 419f7574010c066a56974fc9e3ac0709a08efb33 (unchanged; no merge needed)
• Input head / previous remote head: 28209dcb66ecb641f300d8304aceef7f44f62973 (remote re-read = input head before push; no divergence)
• Final pushed head: d3f205d13d228f0c6a4987bbcd7e20ecbda965ac (origin/envchk/v5-acceptance-20260928, fast-forward 28209dcb6..d3f205d13)
• Commits: dfb1e8e3a (E7-1) → d3f205d13 (E7-2). No force push.

E7-1 — maintained JSONC parser

• Inspected the direct dependency graph: no jsonc/json5 parser was directly available in packages/shared or apps/server (main has none); jsonc-parser@3.3.1 existed only transitively.
• Added jsonc-parser@^3.3.1 as a direct runtime dependency of apps/server, the narrow package whose launchPreflightConsumer.ts imports it. Lockfile importer updated normally; registry entry already present at 3.3.1.
• Consumer now uses jsonc-parser parse(content, errors, { allowTrailingComma: true }); a non-empty error list yields undefined (unknown), never a best-effort partial read.
• Removed the feature's ad-hoc regex helpers stripJsonComments / parseLenientJsonUnknown; packages/shared/src/schemaJson.ts is back to its pre-feature form. No hand-written replacement parser, no config discovery, no network reads.
• Semantics preserved: explicit snapshot:false → false; explicit true or valid object omitting snapshot → true; malformed / non-object / non-boolean → undefined; external OpenCode server → snapshotsEnabled:false (no local-Git assertion).

Edge coverage added/passing (launchPreflightConsumer.test.ts, 6 tests): strict JSON, line // and block /* */ comments, trailing commas, in-string //, /* */, ,, ], }, escaped quotes and a trailing escaped backslash, malformed input ({"snapshot": , [], top-level string, {"snapshot":"off"}, trailing garbage, unterminated block comment), production ProviderService JSONC snapshot:false through the real start-session path (launchPreflightDelivery.integration.test.ts case 2b), and the external-server branch.

E7-2 — cleanup proves owned exit before state removal

• apps/server/integration/envchkP1WireAcceptance.integration.test.ts cleanup now: terminate the captured server and await its real exit event; then terminate the exact recorded fixture-owned stub PIDs and poll until each is confirmed gone (kill(pid, 0) → ESRCH), all bounded (10 s).
• Fixture state is removed only after every owned process is confirmed exited. A termination/confirmation timeout throws ENVCHK fixture cleanup failed; preserving fixture state for diagnosis: … and leaves the directories in place. Cleanup stays idempotent/memoized so resource release and ensuring share one run, on success and failure.
• Ownership safety: only the captured server handle and PIDs read from the fixture's own pid log; no name/pattern matching, no installed T3/provider termination, no daemon/service manager.
• New focused regression, normal + forced timeout: a real captured stub is killed and confirmed gone before state removal; a captured PID whose signal never reports exit fails cleanly and the fixture directories are asserted still present; the deliberately-stuck process is then really killed so the test leaks nothing.

Cleanup proof: after the wire run and the regression, observed 0 leftover fake-grok-envchk-p1-stub.mjs processes and 0 leftover envchk-p1-* / envchk-e7-* fixture directories.

Gates actually run (macOS 26.6.2 build 25G83, Darwin 25.6.0, x86_64; Node v25.6.0, pnpm 11.10.0, git 2.55.0)

• Focused A/B/C/D: vp test run apps/server/src/environment/LaunchPreflight.test.ts apps/server/src/provider/launchPreflightConsumer.test.ts → 2 files / 47 tests passed, 9.58 s.
• Production delivery/provider: vp test run apps/server/integration/launchPreflightDelivery.integration.test.ts apps/server/integration/providerService.integration.test.ts → 2 files / 23 tests passed, 5.88 s.
• Authenticated wire + E7 cleanup regression: vp test run apps/server/integration/envchkP1WireAcceptance.integration.test.ts → 1 file / 2 tests passed, 10.71 s / 11.51 s; real desktop bootstrap → /api/auth/browser-session cookie → authenticated /ws subscription, dummy grok start exactly once, preflight warning delivered, missing-executable failure observed.
• Combined final run (all five files, committed content): 5 files / 72 tests passed, 12.46 s.
• apps/server typecheck: 0 error TS; no diagnostics in any changed file. (tsc exits 1 only from pre-existing warning TS377033 in the untouched launchPreflightDelivery/providerService integration files plus suggestion-level diagnostics, same as the accepted W2 state.)
• packages/shared typecheck: exit 0, 0 error TS.
• vp fmt --check on changed files: clean.
• vp lint --report-unused-disable-directives on changed files: exit 0 (only the file's pre-existing require-yield warnings, plus the two new tests written in the same Effect.gen style).

Native Windows — UNVERIFIED (not fabricated)

• This host is native macOS (process.platform=darwin, x64). No authorized native Windows execution route is available from it; per the assignment I did not repeat broad SSH/Tailscale guessing or install remote access.
• Exact missing capability: an authenticated native Windows execution host with a runnable platform dependency tree (the earlier Windows worktree could not load @voidzero-dev/vite-plus-win32-x64-msvc / @typescript/typescript-win32-x64). The native matrix (PATH/PATHEXT, .exe/.cmd/.bat with spaces, unstartable executable, healthy/warning launch once, bounded denied/slow ops + no late launch, shared-root vs nested repo, real junction alias, authenticated delivery, owned cleanup success + forced failure) is NOT RUN on Windows.
• No native Windows qualification is claimed.

Current CI state (owned by #12 / ENV-1; observed only)

On d3f205d13: Test, Test Server 1–3, Rust, Release Smoke, Mobile Native Changes, Native fingerprint diff, Collect PR targets, Prepare PR size config are pending/queued; web/EAS previews skipping. Pending checks are not counted as passes. No runner/variable/workflow change and no indefinite wait.

Remaining gates

1. Manager source review/acceptance of d3f205d13.
2. CI completion on the new head (owned by ci(fork): route validation to owner-admitted self-hosted capacity #12/ENV-1).
3. Native Windows qualification — still the only platform gate (UNVERIFIED).
4. Release/merge and any installed rollout are release-machinery decisions; no rollout is claimed.
5. Pre-existing, ENVCHK-unrelated full apps/server failures and lint warnings were not expanded into.

Rollback

Source-only; no installed state changed. Ordinary inverse: git revert d3f205d13 dfb1e8e3a (then remove jsonc-parser from apps/server/package.json and restore the parser) or reset envchk/v5-acceptance-20260928 to the preserved input head 28209dcb6. No force push was used.

Hub backlink: https://github.com/nullStack65/closura-agent-config/pull/237

[nullStack65]

ENVCHK:E7 INDEPENDENT REVIEW RESULT

Verdict: PASS — the two E7 corrections satisfy the manager's E7-1/E7-2 requirements and preserve accepted W2 behavior.

Exact reviewed head: d3f205d13d228f0c6a4987bbcd7e20ecbda965ac

• Local HEAD == origin/envchk/v5-acceptance-20260928 == PR feat(server): bounded environment preflight for provider launches #11 headRefOid (all d3f205d1…).
• Input head before E7: 28209dcb66ecb641f300d8304aceef7f44f62973.
• Maintained base/main: 419f7574010c066a56974fc9e3ac0709a08efb33 (== origin/main; git merge-base HEAD origin/main == main).
• Worktree clean before and after review (0 changed paths).
• Commits: E7-1 dfb1e8e3a, E7-2 d3f205d13. Combined diff = 6 files, all in scope: apps/server/package.json, pnpm-lock.yaml, apps/server/src/provider/launchPreflightConsumer.ts (+ its test), packages/shared/src/schemaJson.ts, apps/server/integration/envchkP1WireAcceptance.integration.test.ts.

Coordination hub: https://github.com/nullStack65/closura-agent-config/pull/237

Findings (ordered by severity)

1. Medium — Windows-only qualification gate, not a defect on POSIX. defaultOwnedProcessSignal.isAlive (apps/server/integration/envchkP1WireAcceptance.integration.test.ts:221-231) treats every process.kill(pid, 0) error other than ESRCH as "still alive". On Windows a just-terminated process can briefly surface EPERM/lingering handle, which could poll to the 10 s bound and fail cleanup. This is conservative (it never reports clean without proof), but it could make the final Windows gate flaky. Unverified here — native Windows not executed.
2. Low — Windows-only qualification gate. writeFakeCli POSIX launcher execs the node stub (one pid covers the agent), but the Windows .cmd shim (apps/server/src/testUtils/fakeCli.ts:48-57) runs node as a child, so the recorded stub pid is the node process and not the cmd.exe parent. The recorded-pid kill still covers the mock agent; the shell parent is a residual. Qualification gate only.
3. Low / informational. jsonc-parser is declared ^3.3.1 in apps/server while apps/web pins 3.3.1; both resolve 3.3.1 (single lock resolution, identical symlink). Cosmetic only.

No blocking findings.

E7-1 — maintained JSONC parser

• Direct dependency added to the narrow package that imports it (apps/server/package.json:33); lockfile importer block added normally and the jsonc-parser@3.3.1 registry/resolution entries already exist and are consistent. apps/server/node_modules/jsonc-parser is a real symlink to 3.3.1 (no undeclared-transitive reliance).
• packages/shared/src/schemaJson.ts is now byte-identical to base main (git diff 419f7574… d3f205d1… -- packages/shared/src/schemaJson.ts is empty) — the W2-introduced stripJsonComments/parseLenientJsonUnknown were removed. parseLenientJsonGetter keeps the pre-existing inline stripping and is still the legitimate caller for fromLenientJson; no repo caller of the removed exports remains.
• Parser probe against the exact test strings confirmed the wrapper's semantics: any recorded ParseError → undefined; snapshot:false→false; true/omitted→true; non-object/non-boolean/malformed→undefined; in-string //, /* */, , ] } ,, escaped quotes, trailing escaped backslash, line/block comments, and trailing commas all behave correctly. Truncated ({"snapshot":), trailing garbage, and unterminated block comment all report errors and are treated as unknown.
• External-server branch (serverUrl non-empty → snapshotsEnabled:false) and the production OPENCODE_CONFIG_CONTENT JSONC→false path are exercised by launchPreflightDelivery.integration.test.ts (cases 2b/2c/3) and still pass.

E7-2 — cleanup proves owned exit before state removal

• Only the captured server child and the exact pids read from the fixture's own pid log are touched (process.kill exact pid / child.kill). No name/pattern matching, no installed T3/provider termination, no service manager.
• Ordering is correct: terminate+confirm the server first (so it cannot respawn stubs), then terminate+confirm the exact recorded stub pids, and only then rm fixture state. Any confirmation/termination failure is collected and thrown as ENVCHK fixture cleanup failed; preserving fixture state for diagnosis: … before deletion.
• Bounded on both sides (CLEANUP_TIMEOUT_MS = 10_000; server confirmation via the real exit event with a rejecting timeout; pid confirmation via kill(pid,0) polling). Timeout/kill/error settle exactly once, and the exit listener is registered synchronously after the initial exit check, so no missed-event race is reported as clean.
• Finalization is memoized (teardownPromise ??=), so the resource release and the ensuring guard share one run; success replays success, failure replays the same failure.
• The forced-failure regression injects a signal that never reports exit, asserts a real Error containing preserving fixture state, asserts the fixture directories are still present, then really kills the stuck child and removes state — meaningful and leaves no residue.

Commands actually run and outcomes (focused, non-mutating; native Intel macOS, Darwin, Node v25.6.0)

• git rev-parse HEAD; git status --porcelain → d3f205d1…; empty.
• gh pr view 11 … --json headRefOid → d3f205d13d228f0c6a4987bbcd7e20ecbda965ac.
• git ls-remote origin refs/heads/envchk/v5-acceptance-20260928 → d3f205d1…; refs/heads/main → 419f7574….
• Node probe of jsonc-parser@3.3.1 over the exact edge cases → matches all asserted semantics.
• vp test run apps/server/src/provider/launchPreflightConsumer.test.ts packages/shared/src/schemaJson.test.ts → 2 files / 18 tests passed.
• vp test run apps/server/integration/envchkP1WireAcceptance.integration.test.ts → 1 file / 2 tests passed (auth wire smoke + E7 cleanup normal/forced-timeout regression).
• vp test run apps/server/integration/launchPreflightDelivery.integration.test.ts → 1 file / 8 tests passed.
• npx tsc --noEmit in apps/server → 0 error TS; in packages/shared → 0 error TS.
• Post-run residue: worktree clean; 0 envchk-* temp dirs; pgrep for mock/stub processes → none.

I did not run vp check/vp run -r test (repo-wide checks are out of review scope) and did not reproduce the full 72-test combined run.

Implementation RESULT supportability

The E7 RESULT is supportable for E7-1 and E7-2: the focused unit, delivery, and wire suites and both changed-package typechecks pass at the exact committed head, and the E7-2 cleanup regression proves owned-exit-before-state-removal on this host. The only RESULT claim I did not independently reproduce is the full 5-file/72-test aggregate and the Windows matrix.

Native Windows and CI boundaries

• No native Windows execution was performed or claimed. Findings fix(acp): support root session replacement in V2 #1 and fix(server): opt-in fail-closed policy for codex thread resume #2 are Windows-only concerns and remain qualification gates; they cannot be confirmed or dismissed from this host.
• No CI/runners, callbacks/controllers, install, packaging, or T3/provider/DB state were touched. CI routing/capacity remains PR ci(fork): route validation to owner-admitted self-hosted capacity #12/ENV-1 (observed, not taken over).

Remaining gates

1. Native Windows matrix on a fresh checkout with a normal frozen-lockfile install (E7-2 path plus findings fix(acp): support root session replacement in V2 #1/fix(server): opt-in fail-closed policy for codex thread resume #2).
2. CI on the final head.

[nullStack65]

ENVCHK:E7 WINDOWS RESULT — BLOCKED

Verdict: BLOCKED — source is preserved at the independently reviewed final head, but native Windows qualification did not reach test execution because the only filesystem volume lacks safe dependency-install headroom. No Windows PASS is claimed.

• Source PR: feat(server): bounded environment preflight for provider launches #11
• Coordination hub: https://github.com/nullStack65/closura-agent-config/pull/237
• Mac implementation: feat(server): bounded environment preflight for provider launches #11 (comment)
• Independent source review: feat(server): bounded environment preflight for provider launches #11 (comment)

Exact native identity and source

• Host: DESKTOP-GM0G7BK, native Windows 11 build 26200; native T3/OpenCode provider, not WSL and not an injected platform flag.
• Windows T3 thread: 747207bf-a5fc-4db7-bbda-4f796b38b301; provider session: ses_f0a18c539ffeD3w05trq8mrg3T.
• Resident isolated worktree: C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2.
• The clean branch was fetched from fork and fast-forwarded normally from 5d9ccd868e78521924b9165a501abbbe5d2609ba to d3f205d13d228f0c6a4987bbcd7e20ecbda965ac. Local branch and fork/envchk/v5-acceptance-20260928 match; git status --short --branch is clean.
• No source edit, commit, push, force/reset/rebase, merge of PR feat(server): bounded environment preflight for provider launches #11, installed-app change, database write, CI/runner change, or unrelated-worktree change occurred.

Native execution evidence and projection failure

The exact Luna route was accepted by Windows T3, but T3 projected the turn as error after 18 seconds with:

OpenCode accepted the prompt, but T3 Code could not confirm its message or session status.

That T3 error was not treated as the provider outcome. Read-only loopback reconciliation showed the accepted OpenCode session remained busy, emitted assistant messages and real native tool calls, and executed these bounded activities before intervention:

• native hostname / OS / process.platform / arch / Node / Git / pnpm identity;
• clean-head/worktree and repository instruction/comment readback;
• exact fork remote verification, branch-only fetch, ancestry proof and git merge --ff-only to d3f205d13…;
• PATH/PATHEXT and provider-environment readback;
• lockfile/direct-dependency inspection.

The provider therefore was not duplicated or blindly replayed. T3's errored projection remains separate environment evidence; it is not proof that the underlying provider never ran.

Dependency/headroom blocker and controlled safety repair

At the final head, apps/server/node_modules/jsonc-parser was not present in the resident graph, so a supported frozen-lockfile install was required before tests. The first command,

corepack pnpm install --frozen-lockfile --prefer-offline

exited 1 before mutation because pnpm refused a non-TTY module purge. The provider then retried with CI=true; pnpm began recreating the workspace node_modules while C: had only about 1.03 GB free. Free space fell to 384 MB and then 267 MB while the exact captured cmd.exe/Corepack process was still active.

ENVFIX aborted only provider session ses_f0a18c539ffeD3w05trq8mrg3T through its supported loopback API. The exact captured install descendants exited; no process-name/pattern kill was used. The old usable dependency tree had already been purged by pnpm. The newly partial tree was missing both node_modules\.bin\vp.CMD and the required direct apps\server\node_modules\jsonc-parser link, so it had no rollback or test value. ENVFIX removed only the literal generated target:

C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2\node_modules

No pnpm cache/store, source, Git history, another checkout, installed T3, or provider/session history was deleted. The target is reconstructible from the committed pnpm-lock.yaml and retained pnpm store. Source remains clean at d3f205d13…. Final observed free space is about 646 MB. Get-PSDrive -PSProvider FileSystem exposes only C:; no approved alternate volume is available.

What is and is not qualified

• Qualified on real Windows: native route/tool execution, exact source fetch/fast-forward, head/worktree identity, PATH/PATHEXT/provider-environment discovery, and direct dependency/headroom preflight.
• Not run / not qualified: the five-file 72-test aggregate; PATH/PATHEXT .exe/.cmd/.bat matrix; junction alias; authenticated delivery; owned-process cleanup success/forced-timeout cases.
• The independent review's Windows-only concerns—conservative EPERM vs ESRCH liveness and possible .cmd wrapper-parent residue—remain unresolved qualification gates, not accepted findings.
• CI on the final head remains a separate runner-capacity gate owned by ENV-1/PR ci(fork): route validation to owner-admitted self-hosted capacity #12.

Exact blocker and next owner

An operator with existing authority over DESKTOP-GM0G7BK storage must create adequate safe headroom on C: or provide an approved alternate native volume without deleting user history/work. After that, the next ENVCHK owner should run a normal frozen-lockfile install in the same clean isolated worktree and execute the complete native Windows matrix at exact head d3f205d13d228f0c6a4987bbcd7e20ecbda965ac, including the two retained cleanup concerns. Do not weaken RedirectionGuard, rewrite junctions wholesale, use SSH/WSL as the platform proof, or claim qualification from provider dispatch alone.

Rollback/recovery: source needs no rollback; the removed target was only the unusable partial generated dependency tree and is recoverable by supported install once headroom exists.

[nullStack65]

ENVCHK:E7 WINDOWS SUCCESSOR RESULT — BLOCKED

Linked predecessor: #11 (comment)
Environment coordination: https://github.com/nullStack65/closura-agent-config/pull/237

The linked native Windows successor did not pass. It proved that the prior storage blocker is larger than the earlier estimate, then failed closed before any test execution.

• Exact source: d3f205d13d228f0c6a4987bbcd7e20ecbda965ac on envchk/v5-acceptance-20260928; local head, fork remote head and PR head match; worktree remained clean before and after.
• Native host: DESKTOP-GM0G7BK, Windows 11 build 26200, win32/x64, Node v24.21.0, Git 2.55.0.windows.3, pnpm 11.10.0.
• T3 thread: 63f74e57-cca6-4aaa-846b-bd2fb5e2f7b3; T3 turn opencode-turn-7d135a5a-3c94-44a5-b6c8-5d84563e447b; provider session ses_f095abf0bffe0G3uZW6dwgvB5V on opencode-go/gpt-5.6-luna.
• T3 initially projected an error because it could not confirm the accepted OpenCode prompt. Read-only provider reconciliation proved the exact accepted prompt continued, read the linked instructions, and executed native commands. No duplicate worker was launched.
• Preflight passed at 4,305,186,816 free bytes with node_modules absent and the exact clean head. The worker then ran only the mandated corepack pnpm install --frozen-lockfile --prefer-offline.
• The install exhausted the sole C: volume to 0 free bytes and the provider tool aborted. The five-file/72-test aggregate, matrix, type/format/lint checks, PID-liveness concern, .cmd parent/descendant cleanup concern and authenticated delivery checks did not run and are not claimed.

Controlled recovery:

• Only the exact unusable generated C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2\node_modules tree was removed; it contained no accepted test result or unique source work.
• Direct source, Git history, other worktrees, installed T3, T3/OpenCode history and user files were preserved.
• The partial-tree removal alone restored only about 155 MB. The supported pnpm lifecycle command pnpm store prune was then run through the pinned Node/Corepack installation; it reported 17,668 cached files / 341 packages / 3.68 GB pruned.
• Final native readback: 5,084,131,328 free bytes; node_modules absent; source still clean at exact head; provider worker terminal, settled and stopped.

Disposition: the earlier “about 646 MB” blocker is superseded. A normal frozen install can exhaust more than the demonstrated 4.31 GB on this host. The next owner is an operator with existing DESKTOP-GM0G7BK storage authority who can provide a larger stable same-volume safety margin or an approved alternate native volume, then rerun the exact frozen install and full native matrix. The exact sufficient margin is not yet known and is not inferred. No further install retry is safe from the current state. CI also remains queued for the substantive Check/Test/Server/Rust/Release jobs; a fingerprint job is cancelled and a later fingerprint job remains queued.

Local receipts are retained under /Users/businessaccount/Documents/t3-investigation-20260929/execution/: windows-pr11-e7-successor-provider-reconciliation.json, windows-pr11-e7-successor-emergency-cleanup-receipt.json, windows-pnpm-store-prune-receipt.json, and windows-pr11-e7-successor-settlement-receipt.json.

END ENVCHK E7 WINDOWS SUCCESSOR RESULT

[nullStack65]

ENVCHK:E7 WINDOWS RETRY RESULT

Verdict: BLOCKED. This was one native Windows retry at the exact reviewed head; no source, installed T3, provider settings, CI, callback/controller/service/queue, or other repository was changed. Coordination: PR237. Prior blockers: original Windows blocker, immediate predecessor blocker.

Identity and preflight

• Host: DESKTOP-GM0G7BK; Microsoft Windows 11 Home 10.0.26200; win32/x64 (AMD64, Node X64); Node v24.21.0; Git 2.55.0.windows.3; pnpm 11.10.0 through Corepack.
• Branch: envchk/v5-acceptance-20260928; local and fork remote head: d3f205d13d228f0c6a4987bbcd7e20ecbda965ac; git ls-remote https://github.com/nullStack65/t3code.git refs/heads/envchk/v5-acceptance-20260928 matched exactly; worktree was clean before install (git status --short --branch only showed the tracking line; git diff --check clean).
• Initial C: free bytes: 184508375040 (also captured immediately before install as 184503025664); above the 100000000000 requirement. Post-install C: free bytes: 171481223168, still above the threshold. The headroom increase was pre-existing/external; this run did not create it.
• node_modules was absent before install. The failed install left a partial node_modules present; it was not removed or cleaned because cleanup was prohibited after failure. No fixture process or fixture temp state was created.
• Direct dependency is present at apps/server/package.json: jsonc-parser: ^3.3.1; lockfile contains the locked jsonc-parser@3.3.1 entry. No source edit was made.

Install evidence

• Exact command, run once: corepack pnpm install --frozen-lockfile --prefer-offline
• Start: 2026-10-01T05:40:39.9399394-04:00; free before: 184503025664.
• End: 2026-10-01T05:56:24.6870325-04:00; duration: 944680 ms (15m 44.680s); exit: 1; free after: 171481223168.
• Preserved output: lockfile was up to date, resolution skipped, 1828 packages progressed to 1828/1828, then [ERR_PNPM_BROKEN_METADATA_JSON] The operation was aborted due to timeout.
• Per the retry contract, execution stopped before tests and gates. No retry, cleanup, cache deletion, junction rewrite, or workaround was attempted. This was a package-manager metadata timeout, not the prior OpenSSH WinError 448.

Native execution environment captured

• PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL.
• PATH included C:\Program Files\Git\cmd, C:\Program Files\Git\mingw64\bin, and the Node/Corepack locations. Resolved paths included C:\Program Files\Git\cmd\git.exe, C:\Users\nullstack65\scoop\apps\nodejs-lts\current\node.exe, and ...\corepack.cmd. pnpm had no standalone PATH resolution; Corepack was the supported invocation.
• OPENCODE, OPENCODE_CONFIG_CONTENT, and OPENCODE_PID were present; values were not posted.

Matrix and review concerns

• Not run because the required install failed: the exact five-file/72-test native aggregate; changed-package format/lint/type gates; actual executable/wrapper path launches (.exe/.cmd/.bat, including paths with spaces); missing/unstartable executable before model work; healthy and warning-only launch exactly once; bounded denied/slow lookup/read and no late launch after cancellation; shared-root versus ordinary/nested repositories; real Windows junction alias root identity; authenticated production warning/error delivery; fixture success/forced-failure cleanup; and fixture-owned PID/residue proof.
• EPERM-versus-ESRCH conservative liveness false-timeout concern: not independently exercised in this retry; no native disposition can be claimed.
• .cmd owned cmd.exe/node/mock-agent residue concern: not independently exercised in this retry; no wrapper launch occurred, so no captured PID set exists to clean.
• No fixture temp/process residue was created by this retry. The only residue is the partial dependency installation described above.
• Existing authored/Mac/independent authenticated-delivery evidence remains prior evidence, not a native result from this turn. Browser rendering remains unverified.

Current CI and next owner

• At readback, PR11 had Check, Test, Test Server 1/2/3, Rust, Mobile Native Changes, Native fingerprint diff, Release Smoke, and Mobile Native Changes queued/pending; PR-size setup/label checks passed; preview jobs were skipped; CodeRabbit was successful/skipped for draft. CI URL: https://github.com/nullStack65/t3code/actions/runs/36817825224
• Next owner: parent/manager reruns the exact install after the external registry metadata timeout is resolved, then performs the complete native matrix and closes PR11/PR237. Do not settle from this result.

END ENVCHK E7 WINDOWS RETRY RESULT

[nullStack65]

ENVCHK:E7 WINDOWS RESUME RESULT

Verdict: PASS for the bounded native Windows resume and closeout at the exact reviewed head. This turn made no source edit, commit, push, reset, rebase, cache deletion, junction rewrite, installed-T3/provider/database/service mutation, CI change, or retry beyond the one mandated install. Coordination: https://github.com/nullStack65/closura-agent-config/pull/237. Immediate prior retry: #11 (comment).

Identity and prestate

• Host: DESKTOP-GM0G7BK, Microsoft Windows 11 Home 10.0.26200, build 26200; native win32/x64; Node v24.21.0; Git 2.55.0.windows.3; pnpm 11.10.0 via Corepack.
• Branch: envchk/v5-acceptance-20260928; local HEAD, fork head, and PR head all equal d3f205d13d228f0c6a4987bbcd7e20ecbda965ac (d3f205d13d228f0c6a4987bbcd7e20ecbda965ac). Worktree was clean before and after (git diff --check clean).
• Preserved partial tree before install: 1829 node_modules/.pnpm entries; .modules.yaml, .pnpm-workspace-state-v1.json, .bin, and apps/server/node_modules/jsonc-parser absent. Parent retry evidence validated 1801 metadata-cache files / 340246120 bytes / 3602 JSON lines / 0 invalid lines.
• C: free before effect: 194160058368 bytes; required minimum was 150000000000.

Exactly one install

• Exact command, run once: corepack pnpm install --frozen-lockfile --prefer-offline
• Start: 2026-10-01T06:20:34.6243256-04:00; end: 2026-10-01T06:24:15.5956852-04:00; duration 220971.3596 ms; exit 0.
• Free after: 194060070912 bytes. Lockfile remained frozen/up to date; 1828/1828 packages completed; native esbuild/node-pty postinstall and repository prepare completed.
• Post-install verified .modules.yaml, workspace state, .bin, and apps/server/node_modules/jsonc-parser; the latter resolves to pnpm jsonc-parser@3.3.1.

Tests and gates

• Initial literal vp test run ... command-resolution probe exited nonzero before test launch because vp is not directly on this Windows PATH. The same reviewed command was then run through the installed binary as corepack pnpm exec vp test run ....
• Five-file native aggregate, exact command: corepack pnpm exec vp test run apps/server/src/environment/LaunchPreflight.test.ts apps/server/src/provider/launchPreflightConsumer.test.ts apps/server/integration/launchPreflightDelivery.integration.test.ts apps/server/integration/providerService.integration.test.ts apps/server/integration/envchkP1WireAcceptance.integration.test.ts -> 5 files / 72 tests passed, exit 0, 06:24:46.1926300 to 06:25:11.9194264 -04:00, 25726.7964 ms.
• Server typecheck: corepack pnpm exec tsc --noEmit -p apps/server/tsconfig.json -> exit 1 only for repository-wide suggestion diagnostics; 0 error TS diagnostics, no changed-source type failure, 06:25:45.434... to 06:26:14.6330012, 29199.988 ms.
• Shared typecheck: corepack pnpm exec tsc --noEmit -p packages/shared/tsconfig.json -> exit 0, 06:25:46.2866221 to 06:25:50.7325526, 4445.9305 ms.
• Changed-file format: corepack pnpm exec vp fmt --check apps/server/src/provider/launchPreflightConsumer.ts apps/server/src/provider/launchPreflightConsumer.test.ts apps/server/integration/launchPreflightDelivery.integration.test.ts apps/server/integration/providerService.integration.test.ts apps/server/integration/envchkP1WireAcceptance.integration.test.ts packages/shared/src/schemaJson.ts -> exit 0, all 6 formatted, 3502.971 ms.
• Changed-file lint: same six files with corepack pnpm exec vp lint --report-unused-disable-directives ... -> exit 1 on pre-existing no-global-process-runtime findings in the delivery test and its pre-existing unused import, plus known require-yield warnings; no new changed-source lint finding.

Native matrix and review concerns

• Native PATH/PATHEXT captured: PATHEXT=.COM;.EXE;.BAT;.CMD;...; Git resolved to C:\Program Files\Git\cmd\git.exe, Node to C:\Users\nullstack65\scoop\apps\nodejs-lts\current\node.exe, Corepack to ...\corepack.cmd; OPENCODE, OPENCODE_CONFIG_CONTENT, and OPENCODE_PID were present without posting values.
• Aggregate passed actual healthy/warning-only launch-once, missing executable before model work, denied/slow/hung bounded probes, cancellation/no-late-launch, shared versus ordinary/nested roots, junction/physical alias identity, authenticated warning/error delivery, and fixture success plus forced-failure cleanup.
• Spaced native wrapper probe: real C:\Program Files\Git\cmd\git.exe --version passed; direct .cmd and .bat wrappers under a path containing spaces both exited 0. Captured Node stub PIDs 21196 and 27240 both returned ESRCH on post-exit readback; their fixture directory was removed only afterward. No wrapper-owned cmd.exe/node residue remained from the probe.
• EPERM-versus-ESRCH concern: resolved conservatively on native Windows. A captured terminated sleeper returned ESRCH; cleanup never treats non-ESRCH as gone, so no false clean result is possible.
• Authenticated wire acceptance and normal/forced cleanup passed in the five-file aggregate; no fixture stub process was found afterward. This turn’s temporary envchk-e7-* fixtures were removed. Four envchk-p1-* directories dated 2026-09-29 predate this turn and were preserved as pre-existing diagnostic residue; no matching fixture stub process is running.

CI and remaining limits

• Current CI remains owned by PR12/ENV-1: Check, Test, Test Server 1/2/3, Rust, Release Smoke, Mobile Native Changes, and Native fingerprint diff pending; preview jobs skipped; PR-size setup/labels passed; CodeRabbit skipped/pass for draft. Run: https://github.com/nullStack65/t3code/actions/runs/36817825224
• Browser rendering, full unrelated repository checks, and cleanup of the four pre-existing 2026-09-29 diagnostic directories remain unverified/out of scope. No installed rollout or merge is claimed.
• Next owner: parent/manager to verify this PASS, observe CI, and settle PR11/PR237. Source rollback is ordinary git revert d3f205d13 plus the preceding E7-1 commit if required; no history rewrite used.

Links: PR11 #11 · PR237 https://github.com/nullStack65/closura-agent-config/pull/237

END ENVCHK E7 WINDOWS RESUME RESULT

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.5 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−10 B (−0.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	+20 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+23 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.1 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 08dbb72 · PR result: 56b4bc9 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.1 KiB
• Claude decoded thread snapshot: 114.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[nullStack65]

START — PR11 delivery resumed on d3f205d13d228f0c6a4987bbcd7e20ecbda965ac. Prior source and native Windows evidence retained. Independent Luna review identified provider PATH being used to classify T3 checkpoint Git and unexpected preflight errors disappearing as clean results. Candidate 01bfbfde66fbfcd48c9e61d18a2457a87156a276 separates provider snapshot Git from server VCS Git, warns on unexpected preflight failure, adds behavioral regressions, repairs test lint, and integrates current main 170c0fab996b00750e835c5a9d7ac50fbf167f87 without conflict. Four targeted regressions and focused lint pass; final focused tests/types are running. Publishing normally for exact-head hosted CI; no merge or runtime acceptance claimed.

Model/harness: gpt-6.1-sol delivery owner with bounded native gpt-6-luna verification and independent review.

[nullStack65]

Cloud delivery STATUS / provisional RESULT

Published candidate 5fbf7c2b5c6d64f0293d97fff51330d3c1e017a8 through a guarded nonforce update of this existing branch; candidate tree c2b5fd56aa75af32d4e4f3d79c01ffccf46e84a7 matches the local tree. Exact transferred snapshot 57a461ba / tree 56bb7889 was reconstructed through the GitHub connector and SHA-verified because cloud Git's inherited proxy refuses connections. Snapshot WIP is preserved, not retroactively declared tested. Child snapshot 6d1d2737 contains the HostProcessPlatform test repair already represented in the parent candidate; no duplicate adoption. Candidate includes current main eca73bdf source updates.

Repairs: distinguish provider Git from host checkpoint Git in override/fixture types; correct stale Codex sparse-checkout expectation to use healthy host Git; add focused host/provider capability separation regression; update A1/A2 fixtures to use providerGitEnvironment; remove four unused exports reported by CI. Distinct GPT-6 Luna technical review confirmed these fixes with no blocking defect; this is automated review, not a human vote.

Validation: targeted lint passed; three selected Git separation/control tests passed; cached jsonc-parser3.3.1 was linked and consumer tests passed 6/6. Initial LaunchPreflight run: 37 passed, six subprocess tests failed because this cloud Node runtime returns spawnSync EPERM even with successful child status0/stdout. Delivery integration run: 3 passed, 5 failed under subprocess/runtime limitations. Final server typecheck had no TypeScript error diagnostics but exited1 on Effect diagnostics; it is not recorded as a pass. Normal exact-head CI remains required. Published-head predecessor CI run37616304095 genuinely failed unused exports, two delivery assertions and authenticated wire startup; it was not cancelled/pass.

No Mac/Windows acceptance, installation, production-state effects, new credentials/grants or release success is claimed. PR remains draft until exact-head CI/review is assessed. For PR20 release consumption, qualification must use this lane's exact eventual merged source: fresh synthetic fixture roots; warning-only launch starts exactly once and delivers launch.preflight over authenticated orchestration subscription; missing selected executable errors before model work; unstartable host Git blocks only for repository root; host/provider Git separation; bounded read-only probes and captured fixture-owned process exit before cleanup. Native Mac/Windows artifact acceptance and compatible version/config rollback remain release-owner work, without backups.

Owner/harness: GPT-6.1 Sol cloud task, native GPT-6 Luna implementation and independent review. Durable local STATUS/RESULT are kept under /workspace/work because the prescribed output mount is read-only in this executor. No manager callbacks or human review requests sent.

[nullStack65]

Cloud delivery update: head ce9e90487b7e36172d6916142a2193d5f5b04e67, source tree 78f4328096d84a39a349b1d73f6e6810a8d0dac1, published with an expected-head guarded nonforce update. Local and GitHub tree hashes match. Current main 7a2b41e74f8c28115ef72375d2f6c63332a006b9 was incorporated from 36 exact verified blobs without replacing PR11 changes.

CI on predecessor5fbf7c2 completed: Test, Server2 (including authenticated wire smoke), Server3, Rust, Release Smoke and mobile native detection passed. Check passed unused-code gates then failed formatting in two changed test files; targeted formatter checks now pass. Server1 had exactly three A3 failures because its custom engine test composition omitted the new ThreadPostStartActivity service from current main. The test composition now supplies that layer as production runtime does; distinct Luna review found no duplicate engine or missing dependency. Other preflight assertions were repaired and passed in this CI run.

Current-base server typecheck again has no error TS diagnostics but exits1 on Effect diagnostics, so no local typecheck pass is claimed. Subprocess-dependent A3 cases require normal CI because of the documented cloud EPERM behavior. New-head CI is required before landing; no checks are waived or cancelled.

[nullStack65]

Cloud delivery STATUS: published a97856a17cf3b76409f878e2c6234db5b190c4ef, tree 05b1021435a52b3a7b25f6f1a365cf046b1a5995, matching the local tree. Fresh branch head was reconciled and updated nonforce with expected-head lease. Current main 08dbb72de3b9adabb8f4d796accea4f1db6ec139 source is integrated, preserving Windows service wiring and all OpenCode continuation regressions.

Independent GPT-6 Luna review found omitted-cwd launches bypassing preflight. New and recovered launches now resolve adapter defaults before guard/validation and pass that same cwd to the adapter: Codex/Claude-agent use process cwd, OpenCode uses server-config cwd; providers requiring explicit cwd retain that contract. Four focused default-cwd controls passed, including blocked recovery before adapter start and external OpenCode retaining local root checks while excluding remote provider Git. Full feature review and distinct combined-test review found no blocking defect; this is automated technical review, not a human vote.

CI on predecessor ce9e904 passed general Test, all three Server shards (including authenticated wire acceptance), Rust and Release Smoke. Its Check failed solely on three PR11 Effect.provide warnings; those were fixed by composing layers, without changing severity or waiving checks. Final current-base server typecheck exits0; targeted formatting/lint/diff checks pass. New exact-head normal CI is required before merge.

PR20 release qualification must additionally exercise omitted-cwd new/resumed launches using this lane’s exact eventual merged artifact. Native host acceptance remains separate and unclaimed; prior historical Windows evidence is preserved, not promoted to current-artifact acceptance.

[nullStack65]

Integration correction: a97856a had the correct reviewed tree but did not record current main as ancestry. Normal CI’s merge ref therefore reapplied two current-main test constants, failing Check on duplicate OPENCODE_DRIVER/openCodeInstanceId declarations. The local candidate has exactly one declaration of each; local typecheck/lint were truthful for that tree, but did not qualify the incorrect merge ref.

Published 56b4bc9af53996a73d326a46373d9bb491a8fce6 nonforce with expected-head guard: same verified tree 05b1021435, parents a97856a and current main08dbb72. This records the already-reviewed integration so GitHub’s test merge no longer duplicates additions. Main landing will use ordinary squash to preserve linear main history. New exact-head CI is justified by this concrete merge-result defect; no checks waived or cancelled.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: nullStack65/t3code/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 46828c69-be3f-4f5a-9419-07596ff0c2e1

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nullStack65]

Cloud delivery RESULT — source landed by ordinary squash merge as 404501a06b52fe7cc06d93ec5879ee72e3bf3bfc. GitHub confirms PR merged/closed; current main is that commit. Its single parent is 08dbb72de3b9adabb8f4d796accea4f1db6ec139, preserving linear main history. Landed tree 05b1021435a52b3a7b25f6f1a365cf046b1a5995 exactly matches the independently reviewed local/candidate/test-merge tree.

Exact-head normal CI37630441181 passed Check (format/lint/unused-code/typecheck/build), general Test, all three Server shards, Rust, ReleaseSmoke and mobile fingerprint. No unresolved review threads, human votes fabricated, bypass/admin/settings changes, force push or branch deletion. Separate native GPT-6 Luna feature and integration reviews found no blocking defect. Postmerge checks are being observed; no runtime installation claim.

PR20 release owner: consume exact merged source404501a06. Synthetic qualification must prove warning-only launch starts exactly once and delivers launch.preflight over authenticated orchestration subscription; selected configured executable failure before model work; unstartable host Git blocks only repository-root launches; host/provider Git separation; omitted-cwd new/recovered launches resolve Codex/Claude-agent process cwd and OpenCode server-config cwd, including external server retaining local root checks; bounded read-only probes and captured fixture-owned process exit before cleanup. Use an exact qualified native artifact and existing authorized host connection. Current Mac/Windows artifact acceptance and installation remain unexecuted in this Linux cloud lane; historical Windows evidence remains historical. Version/config rollback has no feature database migration; unset sharedSessionRoot only disables shared-root classification, full rollback is source/binary reversal. No backups or production data mutation.

[nullStack65]

Final cloud STATUS / RESULT: PR11 source delivery complete. Ordinary squash 404501a06b52fe7cc06d93ec5879ee72e3bf3bfc is on main, with single parent08dbb72 and exact independently reviewed tree05b1021435. Premerge CI37630441181 and postmerge main-push CI37632230389 both passed Check, general Test, all three Server shards, Rust and ReleaseSmoke; applicable mobile detection/fingerprint passed, nonapplicable static/preview jobs skipped normally. All landed-commit check runs are completed with success or normal skip; no failures or pending checks. No checks waived, no force/admin merge, no branch deletion or manager callbacks.

PR20 release/runtime acceptance remains distinct from completed source landing: exact source404501a06 and synthetic requirements are in the preceding RESULT comment and PR body. Native current-artifact Mac/Windows acceptance/installation was not executed here; required remaining action is PR20 qualification of its exact release artifact through existing authorized host connections. No unattended wake or operational success is claimed. Durable cloud STATUS/RESULT updated under /workspace/work; prescribed output mount was unavailable/read-only.