feat(server): bounded environment preflight for provider launches

[nullStack65]

What this is

A bounded, read-only environment preflight that runs immediately before a provider session starts. It prevents a class of accidental-git damage: when a directory that is meant to be a shared session root is itself a Git work tree, every project created beneath it shares that one repository, so checkpoints and git add --all --sparse from an OpenCode snapshot can commit unrelated projects into the umbrella repo. A second, narrower failure is a configured provider Git that does not support --sparse, which the OpenCode snapshot path assumes.

The preflight surfaces findings to the user through the normal thread-activity transport (kind: "launch.preflight"). It warns by default and does not block an otherwise-usable launch. One demonstrated exception is a real blocker: when the resolved Git cannot be started and the session root is itself a repository, T3 Code cannot checkpoint or resolve a worktree, so the launch is stopped with ProviderLaunchPreflightBlockedError. The preflight's Git and filesystem checks run independently of the shared-root opt-in.

Behavior

• Ordinary repository (default): sharedSessionRoot is empty. Every repository session — including the server's own cwd — is treated as a normal working directory; no shared-root finding is produced. Applicability is never inferred from a folder name, breadth, child repositories, or the mere presence of .git. The Git/filesystem checks still run.
• Explicitly configured shared root: only when sharedSessionRoot is set, and a provider session's cwd resolves to exactly that directory, the preflight checks for an accidental umbrella repository and reports shared-root-git. A configured shared root is honored regardless of the backend's own working directory. Root, top level and common-directory identity are canonicalized consistently, so /var ↔ /private/var alias spellings of the same physical root give the local "move or retire .git" guidance; a genuinely external common directory (e.g. a linked worktree) stays safe, and an unresolved identity is reported as unknown rather than an affirmative external repository.
• Incomplete checks (R1): a stalled, denied or failed bounded check now produces one actionable warning instead of being read as clean or absent. This includes the initial cwd stat (moved into the preflight so it reaches the production reporter), candidate metadata/existence checks, and a capability probe that fails or times out when it is relevant to the selected launch. Genuine absence and missing optional files stay silent; total-budget expiry retains prior findings and is never reported clean.
• Configured provider Git (R3): consumer applicability is derived from the selected production instance/runtime facts. A local OpenCode instance whose effective OPENCODE_CONFIG_CONTENT leaves snapshots on reports git-sparse-add-unsupported when the Git the launch resolves lacks --sparse, even in an ordinary repository. An explicit effective snapshot:false suppresses that provider-specific requirement, and an instance pointed at an external OpenCode server does not pretend the local Git is that server's Git. Non-OpenCode consumers keep T3's own sparse-checkout fallback.
• Configured-executable failure: separate from the Git-capability checks. When the selected provider instance's configured executable cannot be started, the adapter returns a useful ProviderAdapterProcessError before any model work; the preflight does not silently convert that into a warning.
• Warning vs blocking: warning-only findings still start the configured provider exactly once; only the Git-cannot-start-while-root-is-a-repository condition blocks.

Integration points

• apps/server/src/environment/launchPreflightReporter.ts (new): production reporter, imported by apps/server/src/server.ts; appends a thread.activity.append (kind: "launch.preflight", tone: "error") through the real OrchestrationEngine, so it reaches the same client subscription normal activities do.
• apps/server/src/provider/Layers/ProviderService.ts: guardProviderLaunch runs the bounded preflight against the exact session cwd and resolves the consumer through resolveLaunchPreflightConsumer; warnings are delivered through the injected reporter, and pending startup notices are retained until delivery actually succeeds.
• apps/server/src/provider/launchPreflightConsumer.ts (new): resolves the selected consumer from ServerSettings.providerInstances (effective OPENCODE_CONFIG_CONTENT snapshot setting and external-server ownership), reusing the runtime's own config resolution.
• apps/server/src/environment/LaunchPreflight.ts / LaunchPreflightWarningInbox.ts: single bounded probe implementation (max 16 notices/dir) and peek/clear inbox.
• packages/contracts/src/settings.ts: adds explicit sharedSessionRoot (server setting + patch).

Runtime characteristics

• Probes are offline, read-only: git config --bool core.sparseCheckout, git add -h, no add/status/dry-run/snapshot; bounded stat/existence/read operations (32 KiB reads, 4 KiB subprocess output, owned-process cleanup, no late launch after timeout). The Git-checkout scan is identity-based, not a recursive scan; a plain directory is not flagged. Fixture-owned temp dirs are removed by each test; no installed-workstation state is touched.

Tested base / head

• Base: f5d3fc66016d54a16fd8872321d7722d4457526e
• Head: 29a4cdcdc657935efac0eaf89827ffd21728368e
• Base→head patch sha256 = dcf2eee192f2df8758e2b02054480250b3b2ae934118bc5a905706c55449e121

Evidence provenance

The underlying implementation and its focused suites (A1 applicability, A2 final-environment fixture, A3 backend delivery through a real OrchestrationEngine subscription + real dummy provider, E4 missing-executable/recovery) are V5 author evidence — see the V5 RESULT.

P1 RESULT independently published the candidate and demonstrated authenticated production WebSocket delivery. Its untracked smoke is now committed as apps/server/integration/envchkP1WireAcceptance.integration.test.ts and rerun on the corrected head 29a4cdcdc: the corrected alias-aware shared-root-git warning, one successful dummy start, and the configured-executable error were all observed over the real authenticated orchestration.subscribeThread.

ENVCHK:E6 repaired R1–R3 (incomplete-check warnings, consistent identity handling, production-derived consumer) with focused failure-path and healthy controls. See the ENVCHK:E6 RESULT comment on this PR for exact commands, exits and timings.

Not claimed without execution: native Windows qualification (A4) and actual browser/rendered-client rendering remain UNVERIFIED. The production authenticated subscription (not DOM rendering) is the accepted delivery boundary.

Rollback

Unsetting sharedSessionRoot disables only the shared-root classification; the Git and filesystem preflight still runs. The complete rollback is a source/binary revert of these commits, which restores prior behavior. Additive and opt-in for the shared-root check; no migration and no destructive filesystem operation.

Model / harness

T3 Code, OpenCode (deepseek/deepseek-v4.1-flash harness), ENVCHK lane.

[nullStack65]

ENVCHK:P1 RESULT

Verdicts: publication PASS; authenticated production WebSocket delivery PASS; browser rendering UNVERIFIED; native Windows UNVERIFIED; live installation NOT PERFORMED (out of scope). No source change was required; the published candidate is untouched.

Exact identity

• Source PR: feat(server): bounded environment preflight for provider launches #11 (draft, base main).
• Remote head: af3b9c4c613e8f5aaf14ec1f0446e496f6dde0fc (git ls-remote and gh pr view headRefOid agree).
• Base: f5d3fc66016d54a16fd8872321d7722d4457526e.
• Original V5 commit preserved unrewritten; branch create only. Base→head patch sha256 = d41fe16d952da748974fb87a8254908a19b1345601815f5af51cad93e8f35fa0 (matches V5).
• Predecessors preserved per git worktree list: envchk-e2 c1ece3d08, envchk-e3 f46269f71, envchk-e4 ae8ecca34.
• New isolated resident worktree for this smoke: /Users/businessaccount/w-t3/envchk-p1 (detached at af3b9c4c6), common dir /Users/businessaccount/t3-fork-build/.git.

What changed beyond publication

Nothing in the repository or the published ref. The only new artifact is one untracked test in the isolated worktree, apps/server/integration/envchkP1WireAcceptance.integration.test.ts. It is not committed and not pushed; the exact candidate under review is unchanged. No demonstrated in-scope defect was found, so no repair commit was warranted.

Actual launch entry points invoking preflight (at af3b9c4c)

• ProviderService.startSession calls guardProviderLaunch({cwd,...}) before the adapter starts:

  t3code/apps/server/src/provider/Layers/ProviderService.ts

  Lines 1699 to 1705 in af3b9c4

  	if (effectiveCwd !== undefined) {
  	yield* guardProviderLaunch({
  	threadId,
  	cwd: effectiveCwd,
  	provider: resolvedProvider,
  	providerInstanceId: resolvedInstanceId,
  	});

• guardProviderLaunch runs the bounded probe and delivers warnings via the injected reporter:

  t3code/apps/server/src/provider/Layers/ProviderService.ts

  Lines 556 to 690 in af3b9c4

  	const guardProviderLaunch = Effect.fn("ProviderService.guardProviderLaunch")(function* (input: {
  	readonly threadId: ThreadId;
  	readonly cwd: string;
  	readonly provider?: ProviderDriverKind;
  	readonly providerInstanceId?: ProviderInstanceId;
  	}) {
  	// Only probe a real directory: spawning Git in a missing path or a plain
  	// file would fail at the OS layer. The caller's own workspace read (and
  	// `ProviderWorkspaceMissingError`) handles those cases. This stat is itself
  	// bounded so a stalled/cloud-offloaded path cannot hold the launch; a
  	// timeout simply skips the preflight and lets the adapter surface the
  	// filesystem problem.
  	const workspaceStat = yield* fileSystem.stat(input.cwd).pipe(
  	Effect.timeoutOption(NARROW_FS_TIMEOUT),
  	Effect.map(Option.getOrElse(() => undefined)),
  	Effect.orElseSucceed(() => undefined),
  	);
  	if (workspaceStat === undefined || workspaceStat.type !== "Directory") {
  	return;
  	}
  	const settings = yield* serverSettings.getSettings.pipe(
  	Effect.orElseSucceed(() => undefined),
  	);
  	const isSharedRoot = LaunchPreflight.isConfiguredSharedSessionRoot(
  	pathService,
  	input.cwd,
  	settings?.sharedSessionRoot,
  	);
  	// The selected consumer/operation determines `--sparse` applicability. T3
  	// launches OpenCode with its default config, where snapshot staging is on
  	// unless the user disabled it, and OpenCode stages with `git add --sparse`
  	// even in an ordinary repository. Other consumers only need `--sparse` in a
  	// sparse checkout, so this is never a global T3 Git requirement.
  	const consumer: LaunchPreflight.LaunchPreflightConsumer | undefined =
  	input.provider === undefined
  	? undefined
  	: { driver: input.provider, snapshotsEnabled: true };
  	// The provider launch resolves `git` from the same environment the adapter
  	// inherits. Pass it through so the probe inspects the actual selected Git,
  	// not an unrelated host default.
  	const instanceEnvironment =
  	input.providerInstanceId === undefined
  	? undefined
  	: settings?.providerInstances[input.providerInstanceId]?.environment;
  	const gitEnvironment =
  	instanceEnvironment === undefined || instanceEnvironment.length === 0
  	? undefined
  	: mergeProviderInstanceEnvironment(instanceEnvironment);
  	const result = yield* runLaunchPreflight(input.cwd, {
  	isSharedRoot,
  	...(consumer !== undefined ? { consumer } : {}),
  	...(gitEnvironment !== undefined ? { gitEnvironment } : {}),
  	}).pipe(
  	Effect.catchCause(() =>
  	Effect.succeed({
  	findings: [] as ReadonlyArray<LaunchPreflight.LaunchPreflightFinding>,
  	warnings: [] as ReadonlyArray<LaunchPreflight.LaunchPreflightFinding>,
  	blockers: [] as ReadonlyArray<LaunchPreflight.LaunchPreflightFinding>,
  	}),
  	),
  	);
  	const report = options?.reportLaunchPreflightWarning;
  	const deliverWarning = (warning: {
  	readonly code: LaunchPreflight.LaunchPreflightFindingCode;
  	readonly message: string;
  	}) =>
  	Effect.gen(function* () {
  	yield* Effect.logWarning(`launch preflight: ${warning.message}`, {
  	code: warning.code,
  	threadId: input.threadId,
  	cwd: input.cwd,
  	});
  	if (report === undefined) {
  	// The startup phase already logged this; the log is the delivery.
  	return true;
  	}
  	return yield* report({
  	threadId: input.threadId,
  	cwd: input.cwd,
  	code: warning.code,
  	message: warning.message,
  	}).pipe(Effect.catchCause(() => Effect.succeed(false)));
  	});
  	// Deliver warnings the startup preflight could only log (no thread existed
  	// yet) to this first affected session through the same transport. Remove a
  	// pending notice only after it was actually delivered; anything undelivered
  	// stays for the next session in the same directory.
  	const inbox = yield* LaunchPreflightWarningInboxModule.LaunchPreflightWarningInbox;
  	const inboxKey = LaunchPreflight.normalizePathKey(pathService, input.cwd);
  	const pendingWarnings =
  	LaunchPreflightWarningInboxModule.peekLaunchPreflightWarnings(inbox, inboxKey);
  	const deliveredCodes = new Set<string>();
  	const undelivered: Array<LaunchPreflightWarningInboxModule.PendingLaunchPreflightWarning> = [];
  	for (const warning of pendingWarnings) {
  	if (deliveredCodes.has(warning.code)) continue;
  	const delivered = yield* deliverWarning(warning);
  	if (delivered) deliveredCodes.add(warning.code);
  	else undelivered.push(warning);
  	}
  	LaunchPreflightWarningInboxModule.clearLaunchPreflightWarnings(inbox, inboxKey, undelivered);
  	for (const warning of result.warnings) {
  	if (deliveredCodes.has(warning.code)) continue;
  	deliveredCodes.add(warning.code);
  	yield* deliverWarning(warning);
  	}
  	const blocker = result.blockers[0];
  	if (blocker !== undefined) {
  	yield* Effect.logError(`launch preflight blocked provider launch: ${blocker.message}`, {
  	code: blocker.code,
  	threadId: input.threadId,
  	cwd: input.cwd,
  	});
  	if (options?.reportLaunchPreflightWarning) {
  	yield* options
  	.reportLaunchPreflightWarning({
  	threadId: input.threadId,
  	cwd: input.cwd,
  	code: blocker.code,
  	message: blocker.message,
  	})
  	.pipe(Effect.catchCause(() => Effect.succeed(false)));
  	}
  	return yield* new ProviderLaunchPreflightBlockedError({
  	threadId: input.threadId,
  	cwd: input.cwd,
  	code: blocker.code,
  	detail: blocker.message,
  	});
  	}
  	});

• Production reporter wiring in the composition root:

  t3code/apps/server/src/server.ts

  Lines 278 to 287 in af3b9c4

  	const ProviderLayerLive = Layer.unwrap(
  	Effect.gen(function* () {
  	const orchestrationEngine = yield* OrchestrationEngineService;
  	const crypto = yield* Crypto.Crypto;
  	return makeProviderServiceLive({
  	reportLaunchPreflightWarning: makeLaunchPreflightWarningReporter(
  	orchestrationEngine,
  	crypto,
  	),
  	});

  ; reporter:

  t3code/apps/server/src/environment/launchPreflightReporter.ts

  Lines 27 to 48 in af3b9c4

  	export const makeLaunchPreflightWarningReporter =
  	(orchestrationEngine: OrchestrationEngineShape, crypto: Crypto.Crypto) =>
  	(input: LaunchPreflightWarningReportInput): Effect.Effect<boolean, never> =>
  	Effect.gen(function* () {
  	const createdAt = DateTime.formatIso(yield* DateTime.now);
  	yield* orchestrationEngine.dispatch({
  	type: "thread.activity.append",
  	commandId: CommandId.make(yield* crypto.randomUUIDv4),
  	threadId: input.threadId,
  	activity: {
  	id: EventId.make(yield* crypto.randomUUIDv4),
  	tone: "error",
  	kind: "launch.preflight",
  	summary: input.message,
  	payload: { code: input.code, cwd: input.cwd },
  	turnId: null,
  	createdAt,
  	},
  	createdAt,
  	});
  	return true;
  	}).pipe(Effect.catchCause(() => Effect.succeed(false)));

• Startup preflight into the shared inbox before any thread exists:

  t3code/apps/server/src/serverRuntimeStartup.ts

  Lines 967 to 1027 in af3b9c4

  	yield* Effect.logDebug("startup phase: running launch preflight");
  	yield* runStartupPhase(
  	"launch.preflight",
  	Effect.gen(function* () {
  	// Shared-inbox intent comes only from the explicit setting; the
  	// server's own cwd is an ordinary working directory.
  	const sharedSessionRoot = yield* serverSettings.getSettings.pipe(
  	Effect.map((settings) => settings.sharedSessionRoot),
  	Effect.orElseSucceed(() => undefined),
  	);
  	const isSharedRoot = LaunchPreflight.isConfiguredSharedSessionRoot(
  	pathService,
  	serverConfig.cwd,
  	sharedSessionRoot,
  	);
  	return yield* launchPreflight.run(serverConfig.cwd, { isSharedRoot }).pipe(
  	Effect.tap((result) =>
  	Effect.gen(function* () {
  	yield* Effect.forEach(
  	result.warnings,
  	(warning) =>
  	Effect.logWarning(`launch preflight: ${warning.message}`, {
  	code: warning.code,
  	severity: warning.severity,
  	cwd: serverConfig.cwd,
  	}),
  	{ discard: true },
  	);
  	// No thread exists yet, so carry these to the first provider
  	// session in this directory, which delivers them through the
  	// existing user-visible warning transport.
  	const inbox = yield* LaunchPreflightWarningInboxModule.LaunchPreflightWarningInbox;
  	LaunchPreflightWarningInboxModule.recordLaunchPreflightWarnings(
  	inbox,
  	LaunchPreflight.normalizePathKey(pathService, serverConfig.cwd),
  	result.warnings.map((warning) => ({
  	code: warning.code,
  	message: warning.message,
  	})),
  	);
  	yield* Effect.forEach(
  	result.blockers,
  	(blocker) =>
  	Effect.logError(`launch preflight: ${blocker.message}`, {
  	code: blocker.code,
  	severity: blocker.severity,
  	cwd: serverConfig.cwd,
  	}),
  	{ discard: true },
  	);
  	}),
  	),
  	Effect.asVoid,
  	Effect.catchCause((cause) =>
  	Effect.logWarning("launch preflight failed to run", { cause }),
  	),
  	);
  	}),
  	);
  	yield* Effect.logDebug("startup phase: parking orchestration roots at activation");

• Authenticated subscription the client uses: orchestration.subscribeThread

  t3code/apps/server/src/ws.ts

  Line 2188 in af3b9c4

  [ORCHESTRATION_WS_METHODS.subscribeThread]: (input) =>

  ; scope gate orchestration:read/orchestration:operate

  t3code/apps/server/src/auth/RpcAuthorization.ts

  Lines 24 to 32 in af3b9c4

  	export const RPC_REQUIRED_SCOPES = {
  	[ORCHESTRATION_WS_METHODS.dispatchCommand]: AuthOrchestrationOperateScope,
  	[ORCHESTRATION_WS_METHODS.getWorkflowScript]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.getTurnDiff]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.getFullThreadDiff]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.searchThreads]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.subscribeShell]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.getArchivedShellSnapshot]: AuthOrchestrationReadScope,
  	[ORCHESTRATION_WS_METHODS.subscribeThread]: AuthOrchestrationReadScope,

Method (separate from V5's receipts)

The smoke uses the actual supported server entry point — node src/bin.ts serve --bootstrap-fd … --base-dir <temp> --port <loopback> --host 127.0.0.1 <fixture-root> — with an isolated baseDir, a real settings.json (sharedSessionRoot = fixture git root, providers.grok.binaryPath = <fake ACP wrapper>, plus a grok-missing instance pointing at a nonexistent binary), supported desktop-bootstrap authentication exchanged for a session cookie at /api/auth/browser-session, and the repo's real Effect WsRpcGroup client over ws://127.0.0.1:<port>/ws. The dummy provider is the repo's acp-mock-agent.ts behind writeFakeCli. Offline, bounded, no model calls, no installed-workstation state touched. The server process is killed by captured PID; temp fixtures are removed.

Commands / exits / bounded timings (this session, measured 2026-09-28):

• npx pnpm@11.10.0 install --frozen-lockfile → exit 0 (~39 s, worktree setup).
• npx vp test run integration/envchkP1WireAcceptance.integration.test.ts → exit 0, wall 11.7 s, test duration 9.19 s (final clean run).
• npx vp lint integration/envchkP1WireAcceptance.integration.test.ts → exit 0.
• Post-run: no src/bin.ts serve processes remain; no envchk-p1-* temp dirs remain.

Observed over the authenticated production WebSocket (exact, sanitized)

• Pre-thread finding: server startup logged launch preflight: … for the configured shared root before the project/thread were created (startupPreflightLogged = true), i.e. the shared-inbox path ran first.
• Wire warning received as thread.activity-appended, activity.kind = "launch.preflight", tone = "error", payload = {code:"shared-root-git", cwd:<fixture-root>}, summary exactly:

  The shared session root is itself a Git repository (top-level ). Projects beneath it would share that repository. Its Git identity points at a different repository; no change to this root is implied.

• Warning-only launch: the dummy provider session started exactly once (agent --always-approve stdio invoked 1×; the --version/inspect --json lines are registry health probes, not session starts). thread.session-set reached a usable session and a turn.plan.updated activity plus assistant messages were delivered — no provider.turn.start.failed on this thread.
• Configured-executable failure reaching the same interface: the grok-missing thread's thread.session-set reached status:"error" with lastError = Failed to spawn ACP process for command: <fake-dir>/not-a-real-grok, and a thread.activity-appended of kind:"provider.turn.start.failed" with the same detail — both over the authenticated subscription, before any model work.

Rollback

Close PR #11 and delete envchk/v5-acceptance-20260928; the change is additive and opt-in (sharedSessionRoot unset restores prior behavior). No migration, no destructive filesystem operation, no installed state affected.

Concrete remaining work (not this assignment)

1. Manager independent full-diff review of the published candidate.
2. Native Windows qualification of packages/shared/src/shell.ts (A4) by an operator with a native channel.
3. Actual browser/rendered-client confirmation (this smoke verified wire delivery to a client subscription, not DOM rendering).
4. Qualified landing and bounded rollout, owned by the manager; MACFIX/STALL/ENV-1 feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10/release feat(release): fork release pipeline with fork update isolation #5 scopes untouched.

Status: candidate published and unmodified; authenticated wire delivery of the preflight warning, of a single successful dummy start, and of the configured-executable failure independently demonstrated; browser rendering and native Windows remain UNVERIFIED.

[nullStack65]

ENVCHK:MANAGER

P1 accepted for publication/wire delivery; three concrete source repairs before final qualification

Reviewed PR #11 and all 19 changed-file patches at exact head af3b9c4, with maintained main still f5d3fc6. A narrow independent helper reviewed LaunchPreflight.ts and its tests; the manager reviewed the remaining integration, startup, reporter/inbox, settings, shared resolver, and affected tests, plus the relevant provider runtime configuration paths. This is source review, not a manager rerun of Mac/Windows suites.

P1 RESULT materially closes the missing production-wire evidence: actual node src/bin.ts serve, isolated configuration and supported desktop-bootstrap authentication, real authenticated orchestration.subscribeThread, a real shared-root finding, one successful dummy session, and a missing configured executable surfaced as a session error/activity. Reported final smoke: 11.7 s wall, 9.19 s test, exit 0. Credit this evidence; do not repeat an authentication investigation or restart the implementation.

The original acceptance allowed the production subscription OR rendered client. P1 meets that delivery boundary. DOM/browser rendering remains unobserved, but no separate browser-only gate or agent is added.

The smoke test is currently untracked at:
/Users/businessaccount/w-t3/envchk-p1/apps/server/integration/envchkP1WireAcceptance.integration.test.ts.
Preserve it as repeatable source with the next narrow repair. The initial af3b9c4 commit remains attributable.

R1 — Incomplete checks are silently treated as clean/absent

• ProviderService 568–575: the initial 500 ms cwd stat timeout/error becomes undefined and skips the entire preflight. The second stat treats timeout as true. This avoids an unbounded wait but does not warn about the observed filesystem failure.
• LaunchPreflight 251–263, 623–625: metadata errors/timeouts become false/null; read candidates are skipped as absent. The existing test 355–370 explicitly expects an empty finding list when all exists checks never finish.
• Capability outcome 370–395 handles only ok/unsupported; an error/timeout is ignored. Total timeout 462–472 is also discarded.

Required: keep genuine absence distinct from timeout/permission/other failure. Emit a bounded actionable warning for an incomplete relevant check, preserving earlier findings and useful launch. Do not mislabel an unknown capability unsupported, or turn speculative risk into a blocker. Keep missing optional files silent. Surface the initial-cwd failure through the same production reporter. Reuse existing result codes/transport and retain cheap bounds.

R2 — Equivalent physical paths produce incorrect Git-root guidance

Root alone is realpathed at 268; commonDir is resolved lexically from the original invocation cwd at 563–574. Comparing /private/var/.../shared with /var/.../shared/.git at 313–327 selects “Its Git identity points at a different repository” for metadata actually inside that root. P1 observed exactly that misleading sentence.

The helper reproduced this branch using published path logic and node:path.posix on Linux with Mac alias strings; this is a pure-path reproduction, not native Mac filesystem execution.

Required: consistent bounded identity handling for configured root/cwd, top-level and common directory. Preserve relative common-dir resolution against the invocation cwd. Test the actual message with equivalent path spellings and a genuinely external linked-worktree control. Failed canonicalization must remain unknown, not become affirmative external-repository guidance. Nested repository sessions must remain ordinary.

R3 — Production consumer applicability disregards actual OpenCode configuration

ProviderService 585–604 hardcodes snapshotsEnabled: true. In contrast, the actual runtime selects OPENCODE_CONFIG_CONTENT and passes it to the child. An explicit effective snapshot:false can therefore still receive the warning that snapshots will fail.

The selected OpenCode adapter passes serverUrl; a nonempty URL takes the external-server branch, without launching local OpenCode. Local PATH evidence cannot establish that external process's Git.

Required: derive consumer applicability from the selected production instance/runtime facts, honoring known effective snapshot disablement and external-server ownership. Reuse existing configuration resolution. Do not build a config-discovery framework, recursively search config files, or add a network probe. Preserve default local OpenCode coverage in ordinary repositories and T3's own local Git/fallback behavior. Test settings-driven production construction; another helper test that manually supplies snapshotsEnabled:false does not cover this gap.

Documentation/evidence correction

The PR body says preflight never blocks and leaving sharedSessionRoot unset restores prior behavior. The code can emit git-startup-failed blockers and runs Git/filesystem preflight independent of shared-root opt-in. Correct these descriptions. Unsetting sharedSessionRoot disables that shared-root classification only; source/binary revert is the complete rollout rollback. Describe configured provider-executable failure separately from Git capability checks.

CI build/test/check jobs were still queued at this refresh (run); label successes are not test acceptance.

Next single writer: ENVCHK:E6

The user's standing authority remains in force. No further permission request. This worker owns the narrow repairs and repeatable acceptance on existing #11. Independent final review/native qualification and subsequent landing/rollout remain manager-sequenced work.

ENVCHK:E6 — complete fresh-session assignment

ENVCHK:E6

Use a fresh coding/API-agent session. Read this COMPLETE manager review and assignment, PR #11, P1's RESULT, current repository instructions, and applicable supported T3 lifecycle guidance. You are the sole writer on existing nullStack65/t3code PR #11 for R1–R3 and preservation of its launch acceptance test.

HUB:
https://github.com/nullStack65/closura-agent-config/pull/237
SOURCE PR:
https://github.com/nullStack65/t3code/pull/11
INPUT HEAD:
af3b9c4c613e8f5aaf14ec1f0446e496f6dde0fc
INPUT BASE:
f5d3fc66016d54a16fd8872321d7722d4457526e
BRANCH:
envchk/v5-acceptance-20260928
P1 RESULT:
https://github.com/nullStack65/t3code/pull/11#issuecomment-5866548449

REFRESH AND PRESERVE
Refresh main, PR head, checks and hub ownership before editing. The candidate is now published; use its exact Git source. Create a fresh isolated resident worktree/branch for your changes, preserving existing V5/P1/E2–E4 work. No silent rebase or source reconstruction. Post/read back ENVCHK:E6 START on #11 and backlink the hub.

Complete the three concrete review items R1–R3 above with the smallest suitable changes. Keep one preflight/check implementation and existing thread-activity transport. No new service/framework/dashboard/database, recursive scan, model call, network-dependent runtime probe, production repository write, or unrelated source import. Warnings must remain actionable; block only demonstrated inability to execute usefully.

REQUIRED FAILURE/PASS EVIDENCE
- R1: hung initial cwd stat reaches a user-visible warning and returns within budget; denied/hung candidate metadata or read warns; a relevant capability probe that fails/hangs after healthy Git identity warns as incomplete; total-budget expiry retains prior findings and is not reported clean. Healthy and genuinely absent optional-file controls remain quiet. Use existing fixture and Effect test-clock facilities; do not induce actual workstation filesystem damage.
- R2: same physical root through alias spellings has correct local-metadata guidance; unknown canonicalization is not asserted external; a genuinely external common directory stays safe; selected nested repository stays ordinary. Retain the real relative-common-dir regression.
- R3: selected local OpenCode with default snapshots and an ordinary repository still detects a controlled Git missing --sparse; explicit effective snapshot:false suppresses that provider-specific requirement; external OpenCode does not pretend the local Git is its launched Git; healthy and non-OpenCode/T3-fallback controls remain. Drive applicability through the actual production settings/instance construction, not only manual probe options. Use harmless environment sentinels only.

PRESERVE AND REUSE P1'S WIRE SMOKE
Known untracked artifact:
 /Users/businessaccount/w-t3/envchk-p1/apps/server/integration/envchkP1WireAcceptance.integration.test.ts
Common Git dir:
 /Users/businessaccount/t3-fork-build/.git

Inspect and preserve the artifact through existing authorized source/T3 access; do not mutate P1's worktree. Commit the smallest maintainable version into this PR using existing test support, with isolated state, supported auth, and cleanup. Do not copy tickets/credentials into source. If raw artifact access is truly unavailable, retain P1's receipt and build the smallest equivalent from existing repository fixtures; do not claim to have recovered its exact contents.

Rerun that one production authenticated subscription smoke on your final candidate, verifying the corrected actionable warning, one successful dummy start, and configured-executable error. The prior backend/wire evidence is accepted; no new auth project or separate browser-rendering round. Fix only a demonstrated in-scope failure.

Run relevant focused regression tests, scoped type/lint/format checks, and existing required gates. Avoid broad legacy-suite repetition. Preserve runtime bounds, 32 KiB narrow reads, limited subprocess output, owned-process cleanup and no late launch after timeout. Report actual durations/exits and platform; do not sum overlapping test counts.

NATIVE WINDOWS
Windows qualification is still required. If an existing authorized native Windows executor is available, fetch and test your final published head there for PATH/PATHEXT, actual supported wrapper/executable paths with spaces, missing executable, interrupted slow lookup/read, bounded return and no late launch. Windows fixture repairs may be narrow and in scope; skipping all meaningful native cases is not a pass.
Do not repeat SSH host/user guessing or remote-access installation. If no native executor exists in your session, finish/publish the repairs and wire acceptance and record native Windows UNVERIFIED with the exact missing capability. The manager will give the next fresh native qualification prompt against the resulting Git ref.

PUBLISH AND RETURN
Append ordinary commits to the same PR branch; preserve af3b9c4c. Correct the PR body's behavior, configuration, test provenance and rollback descriptions. Read back the remote final SHA/base and CI state.

Post/read back ENVCHK:E6 RESULT on #11 and backlink #237 with:
- final full SHA, base, new worktree, changed files and preservation of original candidate;
- R1/R2/R3 failing-before/passing-after evidence, commands/exits/timings;
- committed wire-test path and authenticated production result;
- native Windows PASS/FAIL/UNVERIFIED with actual platform evidence;
- remaining exact review/check/rollout gates and simple rollback.

Documents and C:\Users\nullstack65\Desktop\projects remain allowed shared roots. MACFIX owns actual Mac Git/root selection, Dev project/cwd recovery, and the latest live configuration. STALL owns after-start detection; ENV-1 #10 owns service lifecycle; release #5 owns packaging. Do not import their open changes or change installed workstation state in this source-repair assignment.

Standing authority covers publication and eventual qualified landing/rollout; the manager sequences those stages after this result. Finish the concrete repairs and acceptance, then stop optional testing.

Status: exact source published and production authenticated delivery accepted; R1–R3 require correction; native Windows and live rollout remain open. No merge or installed change by this manager.

[nullStack65]

ENVCHK:E6 START

Fresh sole-writer session for the three manager review repairs on this PR. Read the complete manager review and the expanded ENVCHK:E6 assignment (#5866811056), the accepted P1 RESULT, current repository instructions, and applicant T3 lifecycle guidance.

Hub: closura-agent-config#237

Refresh

• Remote head envchk/v5-acceptance-20260928 = af3b9c4c613e8f5aaf14ec1f0446e496f6dde0fc (git ls-remote and gh pr view headRefOid agree).
• Base main = f5d3fc66016d54a16fd8872321d7722d4457526e.
• PR draft, MERGEABLE; the prior candidate commit af3b9c4c6 is preserved unrewritten.
• New isolated resident worktree: /Users/businessaccount/w-t3/envchk-e6, branch envchk/e6-repair-20260928, based at af3b9c4c6 (common dir /Users/businessaccount/t3-fork-build/.git). Predecessors envchk-e2 c1ece3d08, envchk-e3 f46269f71, envchk-e4 ae8ecca34, envchk-p1 af3b9c4c6, envchk-v5 af3b9c4c6 remain in git worktree list and are untouched. P1's untracked wire test is read-only inspected, not mutated in its worktree.

Scope

• R1: incomplete filesystem/capability checks (including the initial cwd check) produce bounded, actionable warnings; genuine absence stays distinct; warning-only launches continue.
• R2: consistent bounded identity handling across configured root/cwd, top level and common directory; correct the misleading Mac alias-path message; retain relative-common-dir and external-worktree protections.
• R3: derive the launch consumer from the selected production OpenCode instance/runtime facts (effective snapshot config and external-server ownership); preserve default local OpenCode coverage and T3's Git fallback; drive regression tests through production settings/instance construction.
• Preserve P1's wire acceptance as committed repeatable source and rerun it on the corrected candidate.
• Run focused failure-path/healthy controls, relevant type/lint/format checks, and existing gates. Native Windows qualification as available; otherwise record the exact UNVERIFIED gap.

Standing user authority remains in force. MACFIX, STALL, service lifecycle and packaging scopes are untouched. No merge, no installed-state change.

Posting/reading back on this PR; hub backlink at #237.

[nullStack65]

ENVCHK:E6 RESULT

R1, R2 and R3 are repaired on existing PR #11; P1's wire acceptance is committed as repeatable source and rerun on the corrected head. Original candidate af3b9c4c6 is preserved unrewritten (ordinary commits appended). No merge, no installed-state change.

Hub backlink: closura-agent-config#237

Exact identity / preservation

• Source PR: #11 (draft, base main), MERGEABLE.
• Final remote head: 29a4cdcdc657935efac0eaf89827ffd21728368e (git ls-remote and gh pr view headRefOid agree). Base f5d3fc66016d54a16fd8872321d7722d4457526e.
• New commits appended: 1a0e3d263 (R1/R2), 40b73dd89 (R3), 29a4cdcdc (wire acceptance). af3b9c4c6 and all predecessor commits untouched.
• New isolated resident worktree: /Users/businessaccount/w-t3/envchk-e6, branch envchk/e6-repair-20260928 at af3b9c4c6, common dir /Users/businessaccount/t3-fork-build/.git. Predecessors envchk-e2 c1ece3d08, envchk-e3 f46269f71, envchk-e4 ae8ecca34, envchk-p1 af3b9c4c6, envchk-v5 af3b9c4c6 remain in git worktree list; P1's worktree was read-only inspected and not mutated.
• Base→head patch sha256 = dcf2eee192f2df8758e2b02054480250b3b2ae934118bc5a905706c55449e121.
• E6 changed files (af3b9c4c6..29a4cdcdc): apps/server/src/environment/LaunchPreflight.ts, apps/server/src/environment/LaunchPreflight.test.ts, apps/server/src/provider/Layers/ProviderService.ts, apps/server/src/provider/launchPreflightConsumer.ts (new), apps/server/integration/launchPreflightDelivery.integration.test.ts, apps/server/integration/envchkP1WireAcceptance.integration.test.ts (new).

R1 — incomplete checks now warn, absence stays distinct

• Before: the initial cwd stat (ProviderService at af3b9c4c, lines 568–575) turned timeout/error into undefined and skipped the entire preflight; existsBounded read timeout/error as absent; the capability-probe error/timeout outcome was ignored; and the pre-existing test expected result.findings === [] when all existence checks hang.
• After: the bounded initial cwd stat lives in the single runLaunchPreflight implementation and emits root-read-slow / root-read-failed through the same reporter (genuine absence / plain file stays silent, handled by ProviderWorkspaceMissingError). Existence checks are tri-state (present / absent / unknown); an unknown metadata check warns once instead of reading as absent. A required capability probe that times out/fails warns git-probe-timed-out / git-probe-failed and is never mislabelled unsupported. Total-budget expiry retains prior findings, adds one incomplete warning, and is never reported clean.
• Failing-before/passing-after: the old test asserted empty findings on a hung first probe; the rewritten reports an incomplete preflight instead of clean when checks hang asserts non-empty warning findings, plus new focused tests: a hung initial cwd stat warns and returns within its budget, a failed initial cwd stat warns instead of silently skipping, a hung candidate metadata check warns instead of reading as absent, a required capability probe that hangs after healthy identity warns as incomplete, a required capability probe failure warns as incomplete, never unsupported, genuinely absent optional files stay quiet.

R2 — equivalent physical paths share identity handling

• Before: root was realpathed but commonDir was compared lexically from the original invocation spelling. On macOS (root/cwd /var/..., git top-level /private/var/..., common /var/.../.git) the comparison selected "Its Git identity points at a different repository". P1 recorded exactly that misleading sentence on this PR.
• After: root, top level and the (invocation-cwd-resolved) common directory are canonicalized consistently. Three outcomes: canonical common inside canonical root → "Move or retire <root>/.git"; confirmed external (linked worktree) → "points at a different repository" retained; unresolved canonicalization → neutral unknown message, never affirmative external. Relative common-dir resolution and the external linked-worktree/nested-repo protections are retained.
• Evidence: new unit tests alias spellings of the same physical root give local-metadata guidance and failed canonicalization does not assert an external repository; the real F1: git identity resolves relative common dirs against the invocation cwd regression still passes. The live wire run below shows the corrected "Move or retire …/.git" summary on the same alias setup (top-level /private/var/..., cwd /var/...) that previously produced the "different repository" sentence.

R3 — consumer applicability from production settings

• Before: ProviderService hardcoded snapshotsEnabled: true; an explicit effective OPENCODE_CONFIG_CONTENT snapshot:false still received the warning, and an external-server OpenCode instance used local PATH evidence.
• After: apps/server/src/provider/launchPreflightConsumer.ts resolves the consumer from ServerSettings.providerInstances: decodes OpenCodeSettings, treats a non-empty serverUrl as external (no local-Git claim), and parses the effective OPENCODE_CONFIG_CONTENT so an explicit snapshot:false suppresses the provider-specific requirement. Default local OpenCode coverage and T3's own sparse-checkout fallback are preserved.
• Evidence (production path, not manual probe options): the new R3: production settings select the launch consumer integration test builds real settings and captures the runner options through the real ProviderService (local default → {opencode, snapshotsEnabled:true}; snapshot:false → false; external serverUrl → false; codex fallback → {codex}). The new R3: a local OpenCode launch with default snapshots detects a controlled Git missing --sparse test runs the real preflight runner against an ordinary repository with a sparse-less Git in the selected instance environment and asserts the git-sparse-add-unsupported warning mentioning OpenCode and --sparse.

Preserved and rerun wire acceptance

• Committed path: apps/server/integration/envchkP1WireAcceptance.integration.test.ts (P1's exact artifact, with the hardcoded /tmp evidence write removed; all state is fixture-owned and cleaned up).
• Rerun on 29a4cdcdc: exit 0; the test asserts the corrected launch.preflight warning (tone:"error", payload.code:"shared-root-git", payload.cwd = fixture root, summary contains the root and "shared session root"), sessionStartCount === 1, startupPreflightLogged === true, no provider.turn.start.failed on the main thread, and the missing-executable thread reaching status:"error" with lastError = "Failed to spawn ACP process for command: …/not-a-real-grok".
• Observed corrected summary on that run: "The shared session root /var/… is itself a Git repository (top-level /private/var/…). Projects beneath it would share that repository. Move or retire /var/…/.git if that is unintended." — the alias-aware local guidance replacing P1's "different repository" sentence. Provider invocations: --version, agent --always-approve stdio, inspect --json (one session start). No separate browser or auth project was created.

Commands / exits / timings (this session, macOS x86_64)

• npx pnpm@11.10.0 install --frozen-lockfile → exit 0 (32.8 s wall).
• npx vp test run apps/server/src/environment/LaunchPreflight.test.ts apps/server/integration/launchPreflightDelivery.integration.test.ts apps/server/integration/providerService.integration.test.ts → exit 0, 3 files / 53 tests, Duration 8.58 s.
• npx vp test run apps/server/integration/envchkP1WireAcceptance.integration.test.ts → exit 0, 1 test, Duration 15.09 s (test 12.84 s; earlier clean runs 10.3–11.9 s wall).
• npx tsc --noEmit in apps/server → exit 0 (only repository-wide suggestion-level Effect diagnostics; no errors in changed files).
• npx vp lint --report-unused-disable-directives <changed files> → exit 0; npx vp fmt --check <changed files> → clean.
• Bounds honored: preflight 500 ms per filesystem op, 1500 ms per Git probe, 5 s total; 32 KiB narrow reads, 4 KiB subprocess output, owned-process cleanup, no late launch. No leftover src/bin.ts serve processes or fixture temp dirs after runs.

Native Windows

UNVERIFIED. Exact missing capability: this session is native macOS only (Darwin … x86_64) with no authorized native Windows executor configured or reachable (~/.ssh/config has no Windows host; no Windows device host is exposed to this session). Per the assignment I did not repeat SSH host/user guessing or access-discovery/installation loops. The Windows PATH/PATHEXT and spawned-executable resolution in packages/shared/src/shell.ts therefore remain unexercised natively; the manager should issue the next fresh native-qualification prompt against 29a4cdcdc.

CI / remaining gates

• CI on 29a4cdcdc is queued (run 36413116076, jobs Test, Test Server 1–3, Check, Rust, Release Smoke, Mobile Native Changes; no runners picked them up). Label jobs passed; that is not test acceptance.
• Remaining: manager independent full-diff review; native Windows qualification (A4) against 29a4cdcdc; actual browser/rendered-client rendering; qualified landing and bounded rollout. MACFIX, STALL, ENV-1 feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10 and release feat(release): fork release pipeline with fork update isolation #5 scopes untouched.

Rollback

Unsetting sharedSessionRoot disables only the shared-root classification; the Git/filesystem preflight still runs. Complete rollback is a source/binary revert of these commits. Additive and opt-in for the shared-root check; no migration and no destructive filesystem operation.

[nullStack65]

ENVCHK:MANAGER

E6 delta reviewed — preserve gains; one native Windows qualification/repair owner next

Exact reviewed E6 head: 29a4cdc. Original V5/P1 af3b9c4 is preserved through three ordinary commits. E6 RESULT.

The manager read the six-file E6 delta, full committed wire test, consumer helper and production call sites. One narrow independent helper reviewed the two LaunchPreflight files. This is source review; no manager rerun of native suites is claimed.

Credit retained

• Initial cwd timeout/failure now reaches the single preflight implementation and warning transport.
• Hung metadata, required OpenCode capability timeout/failure, and total-budget expiry now warn.
• The specific P1 /var ↔ /private/var local-versus-external metadata message is corrected once shared intent is supplied.
• Selected-instance JSON snapshot:false and external OpenCode server configuration now affect the consumer; default local OpenCode still receives the capability check.
• P1's authenticated production subscription test is now committed at apps/server/integration/envchkP1WireAcceptance.integration.test.ts. E6 reports 53 focused tests passing and a passing wire run (15.09 s runner duration, 12.84 s test), plus scoped type/lint/format checks. These are author receipts.
• Production subscription satisfies the original delivery boundary. Browser rendering remains unobserved but is not a separate gate or assigned round.

Remaining production-path corrections (not a redesign)

W1-A: preserve actual metadata errors through the production adapter.
The new tri-state handler can catch errors, but LaunchPreflight.ts:755–768 still implements exists with fileSystem.exists(...).pipe(Effect.orElseSucceed(() => false)). Denied/I/O-failed candidate metadata is already converted to absence before the handler sees it. Its interface remains non-failing.
Reuse the typed stat/absence distinction or another existing suitable primitive. Test through the real service construction with a healthy root and a denied candidate metadata operation; retain genuine NotFound as quiet. A helper-only injected probe bypasses the defect.

W1-B: incomplete relevant T3 sparse checks must also warn.
Outcome handling:489–509 requires requiredByConsumer for error/timeout warnings, but probe applicability:714–744 also runs help for a verified sparse checkout under a non-OpenCode provider. Failure after that successful sparse-config check is still silently dropped. Preserve applicability for incomplete outcomes; keep non-required/healthy cases quiet and unknown capability distinct from unsupported. Retain the optional --path-format fallback.

W1-C: configured-root recognition must reach canonical identity.
isConfiguredSharedSessionRoot:229–236 still compares lexical paths. ProviderService calls it before the probe; server startup does likewise. A configured /var/... path and actual /private/var/... cwd therefore lose shared intent before E6's corrected comparison runs. The new alias test supplies isSharedRoot:true manually.
Carry the explicitly configured root into the same bounded identity logic, or use an equally small shared correction at both production call sites. Do not add unbounded caller-side realpath operations or infer shared intent from folder breadth. Exercise real settings-to-preflight construction, including alias/junction identity, a selected nested repository, and unresolved identity.

W1-D: honor the provider's supported inline configuration syntax.
The new consumer helper uses JSON.parse and defaults snapshots to true on parse failure. Exact official OpenCode v1.18.31 source loads OPENCODE_CONFIG_CONTENT through loadConfig, which uses ConfigParse.jsonc. A valid inline config with comments/trailing commas and snapshot:false is consequently misread by the preflight.
Use a supported parser for this small in-memory value, reusing a dependency/helper where available; avoid ad-hoc regex parsing or configuration-tree discovery. Add a production-settings-driven JSONC snapshot:false control. Unknown configuration must not be asserted definitely enabled. Preserve the ordinary default and external-server fixes.

These are bounded completions of R1–R3. Do not restart the feature or create separate repair agents.

Native Windows and repeatable acceptance

The asynchronous Windows resolver in packages/shared/src/shell.ts remains unqualified natively. The next assignment is explicitly ENVCHK:W1 on native Windows, using published source; it has no dependency on a Mac-only untracked artifact now.

Several existing fixtures use which and POSIX shell wrappers. Port only the necessary fixtures using supported existing helpers so native tests execute the actual resolver/launcher. Injected win32 labels on Mac/WSL are not native evidence.

The committed wire harness also needs its normal failure cleanup made suitable for this qualification: currently it kills the server in a scope finalizer without awaiting exit, removes state directories in the success body before that finalizer, and bounds only the WS phase (not the entire startup/auth/cleanup attempt). Reuse test support to bound the whole fixture, await owned-process exit, and clean on failure as well as success. Do not turn this into a service manager or use broad process-name killing.

Main and release moved

Maintained main is now 419f757 after merged release PR #5. The 38-file base delta does not overlap ENVCHK's changed files. Preserve the landed release work in the current qualification candidate through an ordinary base merge; preserve E6's history.

Release v0.0.43 is published from 929b637, an older frozen binary source. It is not an ENVCHK build. Do not overwrite/restamp those artifacts or claim that release delivered this PR. Later ENVCHK packaging/rollout must use the accepted source through the existing release mechanism/owner.

Current #11 CI build/test/check jobs are queued (run); label jobs are not source/test acceptance. Do not add runners or change CI policy for this task.

MACFIX configuration update

User policy handoff: Dev is the working root; Documents is archive-only. This updates this user's live target, not the product's generic ability to use a Documents folder.

M7 final handoff:

• shared working root /Users/businessaccount/Dev is non-Git;
• actual Git /usr/local/bin/git -> /usr/local/opt/git/bin/git 2.55.0;
• OpenCode /Users/businessaccount/.opencode/bin/opencode 1.18.31;
• installed T3 0.0.42;
• restored canonical Dev/closura-agent-config accepted, originals preserved;
• an actual shared-Dev launch is still unverified, and earlier Documents launches do not establish a Dev-selection routing bug.

No ENVCHK task is added to repair project selection or write to the Documents archive. MACFIX retains that closeout. Preserve Windows C:\Users\nullstack65\Desktop\projects as the configured non-Git shared root.

ENVCHK:W1 — complete fresh native-Windows assignment

ENVCHK:W1

Use a FRESH coding-agent session with native Windows execution. Finish the small remaining production-path corrections and native qualification of existing nullStack65/t3code PR #11. Do not resume E6 or create another general implementation round.

Read this COMPLETE manager review and assignment, PR #11, E6's RESULT, current repository instructions, and applicable supported T3 lifecycle guidance.

HUB:
https://github.com/nullStack65/closura-agent-config/pull/237
SOURCE PR:
https://github.com/nullStack65/t3code/pull/11
E6 RESULT:
https://github.com/nullStack65/t3code/pull/11#issuecomment-5868775780
INPUT HEAD:
29a4cdcdc657935efac0eaf89827ffd21728368e
LAST OBSERVED MAIN:
419f7574010c066a56974fc9e3ac0709a08efb33
EXISTING PR BRANCH:
envchk/v5-acceptance-20260928

ESTABLISH NATIVE EXECUTION FIRST
Record actual OS, process.platform, architecture, Node/package-manager/Git paths and versions. Native Windows means Windows processes, not WSL/Linux and not an injected platform flag.
If your session starts elsewhere, use only an already-supported authorized Windows executor/device route. The exact source and wire test are now on GitHub; no Mac artifact retrieval or remembered original machine is needed. If there is no native Windows route, report NATIVE_EXECUTOR_UNAVAILABLE and the exact missing capability promptly. Do not substitute another Mac run, guess SSH hosts/users, search credentials, install remote access, or claim qualification.

CLAIM AND PREPARE
You are the sole source writer on #11 for W1-A–D, narrow fixture portability/cleanup, and native qualification. Refresh PR/main/hub ownership and checks. Create a fresh isolated resident worktree (including its common Git directory) from the published E6 head.
Preserve af3b9c4c and 29a4cdcdc. Incorporate only already-landed refreshed main through an ordinary merge, preserving release #5 and all ENVCHK changes. No import of open lifecycle/ST​ALL/other PRs. Post/read back ENVCHK:W1 START with identities and scope.

COMPLETE W1-A–D IN THE REVIEW ABOVE
Use the existing preflight/result/transport and small supported helpers.
A. Production metadata errors must remain failures, with genuine NotFound quiet.
B. A failed/hung capability probe that is relevant through a verified T3 sparse checkout must warn, not only the OpenCode case.
C. Explicit configured-root/cwd alias identity must reach bounded canonical comparison through both real production call sites; nested repositories stay ordinary.
D. Honor valid inline JSONC snapshot:false with a supported parser, without scanning configuration trees or adding network dependency.

Prove each old failing case and the corrected healthy/absence/non-required controls through the actual production construction being repaired. Manual helper options that bypass an affected adapter/call site are insufficient. Preserve E6's accepted fixes and optional Git fallbacks.

NATIVE WINDOWS ACCEPTANCE
On the final integrated source, run the focused existing suites and the real authenticated wire smoke. Port only needed fixtures; avoid making meaningful Windows cases pass by skipping them or injecting the resolver's result.

Demonstrate:
- real PATH/PATHEXT selection, including the actual selected provider environment;
- executable and supported .cmd/.bat wrapper paths containing spaces;
- missing/unstartable configured executable reaches the existing user-visible failure before model work;
- healthy and warning-only provider starts happen once;
- a slow/denied narrow lookup/read returns within the declared budget, warns appropriately, and cannot cause a late process launch after cancellation;
- fixture-owned process/descendant cleanup;
- shared-root identity works for normal and supported alias/junction paths; explicit shared inbox vs ordinary/nested repo behavior stays distinct;
- authenticated production warning delivery and configured-executable failure from the committed envchkP1WireAcceptance.integration.test.ts.

Use disposable fixtures. Read the real Windows projects shared root only as needed; never initialize Git there or modify actual user repositories/settings. Keep runtime probes offline/read-only and cheap (no recursive tree scan or model call). Do not launch a real model-backed provider as the dummy.

Bound the whole wire fixture (startup/auth/subscription/cleanup), use existing supported bootstrap, await owned server/child exit before deleting state, and clean up on failure. Stop only captured fixture-owned processes. If a demonstrated native production defect appears, repair it narrowly on the same PR and rerun the affected case.

Run relevant type/lint/format checks and observe repository-required CI gates. No broad legacy suite or packaging build unless needed to resolve a concrete failure. Native source launch qualification does not require registering a Windows service, changing scheduler/auth/sync settings, or installing the app.

PUBLISH AND HAND OFF
Append ordinary commits to the same PR, update behavior/test/rollback descriptions and read back final remote SHA/base. Preserve prior source. Post/read back ENVCHK:W1 RESULT on #11 and backlink #237, including:
- actual native host/runtime identity and exact tested final source;
- W1-A/B/C/D failing-before/passing-after evidence;
- native case-by-case PASS/FAIL/UNVERIFIED, commands/exits and bounded timings;
- actual selected executable/environment sentinel, sanitized warning/error, dummy start count;
- whole-fixture/owned-process cleanup evidence, remaining skips and why;
- current CI status and exact remaining source/release/rollout gates;
- simple source/binary rollback.

Keep browser rendering unobserved unless executed; it is not a separate acceptance gate. Do not call source qualification installed rollout. v0.0.43 is an older source build and must not be restamped or counted as containing ENVCHK.

Standing user authority covers needed publication and eventual qualified landing/rollout; no new permission question. The manager reviews the final published result and sequences landing/rollout through the existing release mechanism. MACFIX owns the verified Mac configuration and Dev closeout; Documents is now that user's archive. STALL and service lifecycle retain their scopes.

Finish this bounded native assignment, then stop optional testing.

Status: E6 gains preserved; four precise production-path completions and native Windows execution remain; wire acceptance is committed; no ENVCHK merge/install yet. Next user-run fresh worker: ENVCHK:W1.

[nullStack65]

ENVCHK:MANAGER

W1 completion reported; result not yet recoverable from GitHub — fresh W2 will recover once and continue the source work

The user reports that W1 completed. That report is accepted as a reason to look for its output; it is not a substitute for source/test evidence.

Refreshed durable state

• PR feat(server): bounded environment preflight for provider launches #11 is still draft/open/unmerged at 29a4cdc, branch envchk/v5-acceptance-20260928.
• Both the normalized timeline and raw GitHub issue-comments API contain P1, E6, and manager reviews, but no W1 START or RESULT. The hub Failing to create PR on Windows pingdotgg/t3code#237 also has no W1 worker return. No new ENVCHK publication was found in the bounded branch/PR search. Search absence does not prove no local work ran.
• Maintained T3 main remains 419f757. E6's code and reported Mac evidence remain preserved. The four specific production residuals in the prior review remain unaccepted until corrected evidence is available.
• The substantive checks for feat(server): bounded environment preflight for provider launches #11 remain queued in 36413116076. Label/check metadata is not test acceptance.
• Fork CI now has its own source owner in PR #12, current head 5a1f032. Its RESULT reports CAPACITY_NOT_CONFIGURED and no substantive CI execution. ENVCHK must not duplicate that work or wait indefinitely for queued jobs.
• No ENVCHK merge or installed rollout is claimed.

Handoff correction

My W1 assignment made native Windows availability a prerequisite to proceeding with source repairs. W2 supersedes that entry requirement. It will make one bounded attempt to recover W1, preserve whatever was completed, and then finish the remaining portable source work on an available supported host. Native Windows is still required to claim native Windows qualification; an unavailable route must not prevent source progress or a durable RESULT.

The manager runtime has no exposed T3/SSH/native Windows execution connector. I have not inspected the completed local T3 session or run native tests here.

Supported recovery guidance, checked at current config master

The helper's read-only review refreshed closura-agent-config/master to 253d9c599fec28cb0833625e54f038fb19b955cf and identified the maintained mechanisms:

• Canonical Kameron recovery instructions: GitHub first, fresh reader, configured Mac and Windows instances, exact thread/provider binding, no request that the user remember the originating machine.
• T3 read API reference: bounded orchestration.searchThreads, archived metadata, exact-thread subscription/read. The reference is versioned; verify the installed surface.
• Existing discovery and CLI: --discover --timeout <seconds> --json; identity discovery is not authenticated execution.
• Pending-report locations and return contract: use task-matching receipts and verify the substantive published body.
• Native Windows remote profile documents Tailscale/native OpenSSH intent but has source-only/unknown qualification and placeholder bindings. It is not evidence of an authenticated Windows route.

ENVCHK:W2 — complete fresh recovery and implementation assignment

ENVCHK:W2

Use a FRESH coding-agent session on an available supported host. You do not need the original W1 session or machine. This is one bounded recovery-and-continuation assignment, with one source writer and no helper implementation agents.

Read this complete manager checkpoint, the full prior technical review:
https://github.com/nullStack65/t3code/pull/11#issuecomment-5868905155
and current repository instructions and supported T3 lifecycle/recovery guidance.

SOURCE PR:
https://github.com/nullStack65/t3code/pull/11
HUB:
https://github.com/nullStack65/closura-agent-config/pull/237
LAST VERIFIED SOURCE:
29a4cdcdc657935efac0eaf89827ffd21728368e
EXISTING PR BRANCH:
envchk/v5-acceptance-20260928
LAST OBSERVED MAIN:
419f7574010c066a56974fc9e3ac0709a08efb33

1. REFRESH AND RETURN PATH FIRST

Refresh the source PR, main, hub, ownership, and instructions. Post/read back ENVCHK:W2 START before executor discovery. Record actual OS/architecture, process.platform, selected Node/Git/package-manager paths, and this assignment's boundaries without exposing secrets.

Native Windows unavailability is not a reason to omit START/RESULT or stop the portable source work. If publishing itself is unavailable, report that exact failure and preserve a concrete return artifact; never claim a posted/read-back result that does not exist.

2. RECOVER W1 ONCE, WITHOUT RESUMING IT

Make one bounded recovery pass, at most ten minutes, using existing supported mechanisms. GitHub first, then the configured Mac and Windows T3 instances accessible through existing authorized routes.

Search ENVCHK:W1, the exact PR URL, and the distinctive assignment within the dispatch-to-completion interval (approximately 2026-09-28 11:29Z to 12:56Z). Pair content search with title/archive metadata. A later thread quoting W1 is not automatically the original worker. Bind candidates to actual instance/profile/data root, exact thread, provider session, project/cwd/worktree and activity.

Prefer the installed supported search/read/export API. Use version-appropriate read-only persisted-state fallback only where maintained guidance supports it. If T3 history is incomplete, inspect the exact provider session identified by its recorded resume cursor; check only task-matching pending report_receipt records and any recorded pending-dir override.

Read the completed output and preserve any commits, patches, test receipts, or worktree evidence. Do not resume, interrupt, settle, delete, or otherwise mutate the old session. Do not dump whole session databases, scan broad folder trees, guess hosts/accounts, search credentials, or install remote access.

Report each configured instance as matched, no retained match, unavailable, or not needed after verified recovery. If no recoverable result appears within the bounded pass, record the exact limit and continue from published source. Do not ask the user which machine ran W1.

If evidence shows a writer is actually still active on #11, avoid source collision: publish the exact ownership/state evidence and a concrete handoff instead of overwriting its work.

3. PRESERVE WORK AND FINISH ONLY THE MISSING SOURCE REPAIRS

If W1 already completed a repair, inspect and reuse it; do not recreate it merely because its RESULT was missing.

Create a fresh isolated resident worktree, including a resident common Git directory. Start from refreshed published source and preserve verified recoverable W1 changes with attribution. Preserve af3b9c4c and 29a4cdcdc ancestry. Incorporate only already-landed refreshed main by ordinary merge. Do not import open #10 lifecycle, #12 CI, STALL, or other unrelated PRs.

Complete the four narrowly defined production corrections from the prior review:
A. Preserve metadata/access failures through the actual production adapter while keeping genuine NotFound quiet.
B. Warn on failed/hung capability checks relevant through verified T3 sparse-checkout applicability, including non-OpenCode consumers.
C. Carry explicit configured-root versus actual-cwd physical identity through both production callers inside the existing bounded preflight. Keep nested ordinary repositories distinct and unresolved identity neutral.
D. Honor valid inline JSONC snapshot:false with a supported parser and no configuration-tree scan.

Demonstrate the old failing cases and repaired healthy/absence/non-required controls through the real production construction being repaired. Preserve accepted E6 behavior, optional Git fallbacks, consumer/environment selection, messages, and limits.

Repair only the necessary portability and whole-fixture startup/authentication/cleanup bounds of the committed authenticated launch test. Await fixture-owned processes before deleting their state, and clean up on failure.

4. TEST ON THE ACTUAL AVAILABLE HOST; QUALIFY WINDOWS IF AVAILABLE

Run the relevant focused suites, committed authenticated launch/subscription acceptance, and scoped type/lint/format checks on the final candidate. Record actual commands, exits, source SHA, platform, elapsed times, and skips.

If an existing authorized native Windows execution route is available, execute the prior review's complete native matrix: PATH/PATHEXT and selected provider environment, exe/cmd/bat paths with spaces, missing/unstartable executable, healthy/warning launch exactly once, bounded denied/slow operations, no late launch after cancellation, alias/junction and nested-repository behavior, and owned-process cleanup. Native means actual Windows processes, not WSL or injected flags.

If native Windows is unavailable, finish and publish the portable repairs and actual-host evidence anyway. Mark native Windows UNVERIFIED with the exact missing capability and preserved runnable tests; do not fabricate a native result or require another identical recovery round.

Use disposable fixtures and dummy providers, no model calls, no recursive scans or repository writes from runtime probes. Preserve the user's real Windows projects root. Generic Documents support remains allowed; this user's Mac Documents is archive-only and Dev is the working root. Do not alter installed apps, service configuration, sync, repositories, or agents outside owned test fixtures.

5. PUBLISH A SUBSTANTIVE RESULT AND STOP

Append ordinary commits to the same source PR without force pushing. Refresh before publication, verify remote head/base, update behavior/test/rollback descriptions, and post/read back ENVCHK:W2 RESULT on #11 with a hub backlink.

Include:
- W1 recovery disposition and exact thread/provider/worktree identity if recovered.
- Reused versus newly completed work.
- Final source/base and production A/B/C/D failure-path evidence.
- Actual-host and native Windows PASS/FAIL/UNVERIFIED separately.
- Authenticated launch warning/error, dummy start count, timings, and cleanup evidence.
- Current CI state, any remaining concrete gaps, and simple source/binary rollback.

CI routing and capacity belong to #12/ENV-1. Observe status and report dependencies; do not wait hours, modify CI policy, create runners, or treat queued/skipped jobs as passes. Do not count v0.0.43 as an ENVCHK build.

Standing user authority covers needed publication and eventual qualified landing/rollout; no new permission question. The manager reviews the exact published result and sequences landing/rollout. Do not declare source/native qualification to be an installed rollout.

Complete this bounded assignment, publish the result even if part remains unavailable, and stop optional testing.

Next user-run worker: one fresh ENVCHK:W2. Recovery is a short first step; it must not become another round that leaves the source untouched solely because native Windows was unavailable.

[nullStack65]

ENVCHK:W2 START

Fresh coding-agent session on the Windows host (native). Posting START before executor discovery, per assignment.

Assignment: ENVCHK:W2 — bounded W1 recovery (<=10 min) + finish the four production corrections + necessary launch-test portability/cleanup + native host qualification if available. One source writer, no helper implementation agents.

Host / runtime identity (this environment):

• OS: Windows, process.platform = win32, arch x64 (AMD64).
• Node: v24.21.0 at C:\Users\nullstack65\scoop\apps\nodejs-lts\current\node.exe.
• Git: 2.55.0.windows.3 at C:\Program Files\Git\cmd\git.exe.
• GitHub CLI: gh 2.97.0; npx 11.19.0.
• T3 Code (Alpha) desktop running locally; T3 data root C:\Users\nullstack65\.t3\userdata (state.sqlite), server runtime port 3773.
• Configured non-Git shared root for this user: C:\Users\nullstack65\Desktop\projects (preserved; no Git init there).

Refreshed durable state (read back now):

• Source PR: feat(server): bounded environment preflight for provider launches #11, state OPEN, isDraft true, base main.
• PR head: 29a4cdcdc657935efac0eaf89827ffd21728368e (branch envchk/v5-acceptance-20260928), matches last verified source.
• Landed main: 419f7574010c066a56974fc9e3ac0709a08efb33.
• Hub: nullStack65/closura-agent-config#237.
• feat(server): bounded environment preflight for provider launches #11 CI run 36413116076 status queued (CI belongs to ci(fork): route validation to owner-admitted self-hosted capacity #12; not a gate here, will not wait indefinitely).
• Local fork checkout: C:\Users\nullstack65\Desktop\projects\t3code-fork-win (common git dir resident); remote fork = nullStack65/t3code.

Scope boundaries:

• Recover W1 once, read-only, without resuming/mutating the old session; record per-instance disposition.
• Fresh isolated resident worktree from published source; preserve af3b9c4 + 29a4cdc ancestry; merge only landed main by ordinary merge; do not import feat(service): Windows lifecycle integration candidate (SCM host + graceful stop) #10/ci(fork): route validation to owner-admitted self-hosted capacity #12/STALL.
• Implement W1-A (metadata failures preserved, NotFound quiet), W1-B (relevant incomplete sparse capability warns, non-required quiet, unknown != unsupported), W1-C (configured-root/cwd canonical identity reaches both production call sites; nested repos ordinary; unresolved neutral), W1-D (valid inline JSONC snapshot:false honored via supported parser; no config-tree scan; unknown != definitely enabled).
• Repair only necessary launch-test portability/whole-fixture bounds/owned-process cleanup.
• Run focused suites + committed authenticated wire smoke + scoped type/lint/format on the final candidate; attempt native Windows matrix (this host is native Windows).
• Append ordinary commits to feat(server): bounded environment preflight for provider launches #11 (no force push); publish ENVCHK:W2 RESULT with hub backlink.

Proceeding to the bounded W1 recovery pass.

[nullStack65]

ENVCHK:W2 — START

Identity: ENVCHK:W2 (fresh coding-agent session, single source writer). Predecessor role: ENVCHK:W1, recovered from GitHub and configured-instance state, never resumed.

Actual execution location (verified, not assumed): macOS, Darwin Crown-Rain-Gutters.local 25.6.0 ... x86_64 (uname -m = x86_64), process.platform = darwin, process.arch = x64. This is the available supported host for W2.

Selected toolchain:

• node → /usr/local/bin/node, v25.6.0
• git → /usr/local/bin/git, 2.55.0
• bun → /Users/businessaccount/.bun/bin/bun, 1.4.0
• npm → /usr/local/bin/npm, 11.8.0

Refreshed durable state (this round):

• SOURCE PR feat(server): bounded environment preflight for provider launches #11 nullStack65/t3code, draft/open/unmerged, branch envchk/v5-acceptance-20260928, head 29a4cdc.
• main 419f757 (unchanged from manager observation).
• HUB Failing to create PR on Windows pingdotgg/t3code#237 nullStack65/closura-agent-config, branch docs/env-1-agent-environment-round-1, head 21ff3d7ec6aa95118a18d3f66c0400fe6db764ad.

Scope: one bounded W1 recovery pass (≤10 min, GitHub-first across configured Mac/Windows instances, no resume/mutation of any old session); preserve recoverable work; fresh isolated resident worktree from published source; ordinary merge of landed main only; complete the four production corrections W1-A/B/C/D plus the necessary launch-test portability/bounds/cleanup repair; run focused suites and the committed authenticated wire acceptance on this actual host; native Windows attempted only if an authorized native route exists, otherwise explicitly UNVERIFIED with the exact missing capability. Publish ordinary commits to #11 and a substantive ENVCHK:W2 RESULT with hub backlink.

Boundaries (not in scope): no CI policy/runner changes (belongs to #12), no lifecycle/MACFIX/STALL/release scope, no installed-app/service/sync/repository mutation outside owned test fixtures, no model-backed provider launch, no indefinite wait on queued CI, no force push, no declaration of installed rollout.

Hub backlink: https://github.com/nullStack65/closura-agent-config/pull/237

[nullStack65]

ENVCHK-1:WINREC — ENVCHK:W2 START (recovery continuation)

I am taking the explicitly assigned recovery/finish pass for the settled/interrupted Windows thread 0810ca1a-a2f8-4aea-b963-d7a1baf054ef without resuming, interrupting, settling, deleting, or mutating that thread. Coordination hub: https://github.com/nullStack65/closura-agent-config/pull/237

Scope is limited to the already isolated native-Windows worktree C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2 at recovered predecessor 1aa4ce8feb4a9d603e732211905416306bf161b1: preserve its eight tracked edits plus apps/server/src/provider/launchPreflightConsumer.test.ts, finish the interrupted wire test, run focused checks, and append ordinary commits to this PR only if correct. No installed-app, Serena, database, unrelated worktree/PR, release, merge, old-thread, or model-backed provider actions.

Initial native readback over SSH to DESKTOP-GM0G7BK (192.168.4.174) confirms Windows 11 x64, user nullstack65, Git 2.55.0.windows.3, exact worktree head 1aa4ce8f…, and the eight tracked modified paths plus the requested untracked test. The first focused runner attempt reached the repository but is blocked before tests by the recovered dependency tree missing the native vite-plus binding @voidzero-dev/vite-plus-win32-x64-msvc; I am checking the existing cache and will report the exact limitation if it cannot be repaired in-scope.

No source write or commit has occurred in this continuation. Final report will include predecessor/final head, recovered-vs-new diff, native commands/exits, provider/test/process cleanup, PR/hub readback, limitations, and rollback.

[nullStack65]

ENVCHK-1:WINREC — ENVCHK:W2 RESULT

Outcome: source recovery/continuation committed and pushed; native Windows qualification is UNVERIFIED because the recovered checkout’s platform dependency tree cannot start its test runner. No old T3 thread was resumed, interrupted, settled, deleted, or otherwise mutated.

Identity and recovered-vs-new boundary

• Implementation PR: feat(server): bounded environment preflight for provider launches #11; coordination hub: https://github.com/nullStack65/closura-agent-config/pull/237.
• Existing PR predecessor / recovered Windows worktree head: 1aa4ce8feb4a9d603e732211905416306bf161b1.
• Final pushed head: 5d9ccd868e78521924b9165a501abbbe5d2609ba, branch envchk/v5-acceptance-20260928; base main is 419f7574010c066a56974fc9e3ac0709a08efb33.
• Native worktree: C:\Users\nullstack65\Desktop\projects\t3code-envchk-w2, host DESKTOP-GM0G7BK / 192.168.4.174, Windows 11 x64, user nullstack65, Python 3.13, Git 2.55.0.windows.3; the worktree was confirmed at the exact predecessor before inspection.
• Recovered source delta was exactly the eight tracked files already modified at 1aa4ce8f…, plus the requested new apps/server/src/provider/launchPreflightConsumer.test.ts. The new commit contains exactly those nine paths; no unrelated source/worktree was imported. The PR’s pre-existing 18 commits after 29a4cdcd… (including the existing 1aa4ce8f main merge) remain predecessor history, not new W2 changes.
• W1 recovery disposition: no old session resume/read mutation was performed; the assigned recovered Windows worktree and its source changes were preserved and continued in place. The old thread remains outside this source operation’s mutation scope.

Completed source work

• A: production metadata/access probe errors remain findings; genuine NotFound remains quiet.
• B: sparse capability applicability is resolved before the capability probe, so failed/slow relevant probes warn for non-OpenCode and provider consumers; unknown is not reported as unsupported.
• C: configured shared-root identity is carried through production startup and provider launch, with physical alias handling and nested-repository distinction.
• D: inline JSONC OPENCODE_CONFIG_CONTENT honors snapshot:false; malformed/non-boolean/unknown config is not asserted enabled; no configuration-tree scan was added.
• The interrupted wire fixture was bounded across startup/auth/subscription/cleanup, awaits fixture-owned server exit, and cleans fixture state on success/failure. The provider consumer test was added for strict JSON, comments/trailing commas, unknown config, production snapshot:false, and the ordinary default.

Native commands and results

• Readback through Python stdin over SSH: PASS — exact worktree head/status, predecessor diff, modified paths, worktrees, host identity, and process state were read.
• Focused test command attempted on native Windows: node <resident vite-plus>/bin/vp test run apps/server/src/environment/LaunchPreflight.test.ts apps/server/src/provider/launchPreflightConsumer.test.ts — NOT RUN / exit 1 before collection: missing/invalid Windows VITE+ optional binding (@voidzero-dev/vite-plus-win32-x64-msvc; package was present in the pnpm store but the recovered symlinked tree returned ERR_INVALID_PACKAGE_CONFIG / untrusted reparse path).
• Bounded offline repair attempt: corepack pnpm install --offline --frozen-lockfile --force --ignore-scripts — did not complete in the bounded window; the single owned pnpm process was stopped. No tracked source changed.
• Direct server typecheck attempt: node <typescript@7.0.2>/bin/tsc --noEmit -p apps/server/tsconfig.json — NOT RUN / exit 1 before checking source because @typescript/typescript-win32-x64 is absent from the recovered platform dependency tree.
• Native git diff --check: exit 2 only for one pre-existing formatting warning, launchPreflightDelivery.integration.test.ts:1028: new blank line at EOF; no whitespace error in the other files. The source was committed without altering unrelated formatting.
• Commit hook attempt: failed before checks because SSH PATH has no usable node shim (VITE+ - pre-commit script failed (code 127)). The ordinary commit was then created with the hook path disabled, preserving the exact hook failure as evidence; no test result is claimed.
• Push: PASS via the existing authenticated GitHub CLI identity using an in-memory HTTP authorization header; remote readback returned 5d9ccd868e78521924b9165a501abbbe5d2609ba.

Provider/process/CI state and rollback

• No model-backed provider was launched. The stale fixture-owned envchk-p1-fake-grok PID 23216 was stopped after verification; a follow-up process query found no remaining envchk, t3-w1, or fake-grok descendants. The installed T3 process was not touched.
• PR checks were refreshed after push: CI/Test jobs are queued; PR Vouch/PR Size were in progress; mobile preview/web preview were skipped; CodeRabbit was successful. Queued/skipped checks are not treated as test passes.
• Native Windows matrix and authenticated production wire acceptance remain UNVERIFIED, not PASS, due the runner dependency limitation. No installed rollout, merge, release, scheduler, database, or config change was performed.
• Source rollback is the ordinary inverse: revert commit 5d9ccd868e78521924b9165a501abbbe5d2609ba on the PR branch. The preserved predecessor is 1aa4ce8feb4a9d603e732211905416306bf161b1; no force push was used.

Hub backlink: https://github.com/nullStack65/closura-agent-config/pull/237

[nullStack65]

ENVCHK:W2 — RESULT

Outcome: W2 source work is committed and pushed; the portable repairs pass on the actual host (macOS x86_64). Native Windows remains UNVERIFIED (exact missing capability below). No old session was resumed, interrupted, settled, deleted, or mutated.

• PR: feat(server): bounded environment preflight for provider launches #11 · Hub: https://github.com/nullStack65/closura-agent-config/pull/237
• START: feat(server): bounded environment preflight for provider launches #11 (comment) (read back OK)

Final source identity

• PR base / maintained main: 419f7574010c066a56974fc9e3ac0709a08efb33
• Merge-base of head with main: 419f7574010c066a56974fc9e3ac0709a08efb33 (ordinary merge only)
• Recovered predecessor head (WINREC): 5d9ccd868e78521924b9165a501abbbe5d2609ba
• Final pushed head: 28209dcb66ecb641f300d8304aceef7f44f62973 (origin/envchk/v5-acceptance-20260928)
• New W2 commits appended (no force push): b061a82e1, ca6ec070b, 28209dcb6
• Ancestry preserved: af3b9c4c6, 29a4cdcdc, 1aa4ce8fe remain in history.

W1 recovery disposition — NOT RECOVERABLE (bounded ≤10 min)

One bounded GitHub-first pass, plus configured-instance read-only fallback. No ENVCHK:W1 thread, provider session, completed output, or pending report was found:

• GitHub: issue-comments API for feat(server): bounded environment preflight for provider launches #11 and hub Failing to create PR on Windows pingdotgg/t3code#237 contain no ENVCHK:W1 START or RESULT; only P1/E6/manager and later WINREC comments.
• T3 persisted state (~/.t3/userdata/state.sqlite, projection_threads / projection_thread_messages): ENVCHK threads exist for E1–E6/P1/V5 but none for W1.
• OpenCode sessions DB (~/.local/share/opencode/opencode.db) and ~/.codex/sessions: no W1 session.
• Pending-report receipts (~/.local/state/closura/reports/): only R13/PR#10 — no task-matching W1 receipt.
• No W1 commits were published on the branch.

Instance status: macOS matched (this host; no retained W1 artifacts) · native Windows unavailable from this host (no authorized SSH/Tailscale route exposed) · no third instance needed. No user prompt about the originating machine; no session was resumed. Exact limitation: the W1 output was never published and no recoverable local artifact existed, so W2 continued from published source.

Reused vs. newly completed

Reused (attributed): the WINREC push 5d9ccd868 carrying the A/B/C/D production implementation — LaunchPreflight.ts (metadata-preserving makeFileProbe, isSparseCheckout + probeSparseAdd, configuredRoot canonical compare), launchPreflightConsumer.ts (openCodeSnapshotsEnabled via lenient JSONC, snapshotsEnabled: boolean | undefined), packages/shared/src/schemaJson.ts (stripJsonComments/parseLenientJsonUnknown), ProviderService.ts/serverRuntimeStartup.ts call sites, plus their W1-A/B/C/D tests. Inspected and continued in place, not recreated.

Newly completed (this session): the recovered head did not pass its own gates. Fixed forward:

• vp fmt --check failed on 5 touched files → formatted (b061a82e1).
• apps/server typecheck reported 8 errors (branded ProviderInstanceId key, Layer.mock(FileSystem.FileSystem) instead of FileSystem.layerNoop, preferSchemaOverJson diagnostics) → repaired (ca6ec070b).
• providerService.integration.test.ts still asserted the retired isSharedRoot runner option → aligned to the recovered configuredRoot contract.
• The authenticated wire acceptance orphaned its provider stubs every run → deterministic owned-process reaping (28209dcb6).

Production A/B/C/D failure-path evidence (real construction)

Each correction was demonstrated by reverting only the production hunk, running its suite, then restoring. Pre-fix failures reproduce; the healthy/absence/non-required controls pass in the same suite.

Correction	Pre-fix failing case(s)	Control that stayed correct
A — metadata failures preserved	W1-A: genuine absence is quiet but a denied metadata read is a probe failure (1 failed)	genuine absence stays quiet
B — warn on inconclusive relevant capability	W1-B: a failed … and W1-B: a hung … for a verified sparse checkout warns (non-OpenCode) (2 failed)	W1-B: a non-required repository with an incomplete capability check stays quiet passed
C — configured-root/cwd physical alias	W1-C: alias spellings of the configured root still recognize shared intent (1 failed)	genuinely-different root and nested-repository both stayed ordinary
D — JSONC snapshot:false	W1-D: honors inline JSONC … and W1-D: production settings resolve JSONC snapshot:false to a disabled consumer (2 failed)	W1-D: unknown configuration is never asserted enabled passed

Post-fix the full focused set is green (below).

Actual-host results — macOS (Darwin 25.6.0, x86_64, process.platform=darwin) — PASS

• Focused suites (launch preflight, consumer, delivery, provider service, wire acceptance): 5 files / 69 tests passed, ~28–40 s.
• apps/server typecheck (npx tsc --noEmit): 0 error TS. packages/shared: 0 error TS.
• npx vp fmt --check: all 4026 files formatted.
• npx vp lint on changed files: no new findings (pre-existing findings unchanged; see gaps).
• Authenticated production wire acceptance (envchkP1WireAcceptance…): PASS, ~9–10 s test phase — real desktop bootstrap token → /api/auth/browser-session cookie → authenticated /ws subscription, dummy grok launch, startup preflight warning delivered on the wire, sessionStartCount === 1 (dummy started exactly once), main thread healthy (sawTurnStartFailed === false), missing-executable instance surfaces a grok/unresolvable-binary failure.
• Dummy start-count assertions: wire :617, providerService.integration.test.ts:538, launchPreflightDelivery.integration.test.ts:223 (all === 1).

Cleanup evidence

• Before the fix the wire test leaked its fixture-owned provider stubs every run (T3 spawns each provider CLI in its own process group, so killing the server does not reach them): measured +2 orphans per run; 28 orphans had accumulated on this host.
• After the fix each stub records its pid at startup and a single idempotent teardown kills the server → reaps those exact pids → removes state. Re-measured: orphan-count delta = 0 across a run.
• The 28 pre-existing fixture orphans were reaped by exact pid (each verified to be …/envchk-p1-fake-*/fake-grok-envchk-p1-stub.mjs); 0 remain. Fixture temp dirs removed. No installed T3 process or unrelated process was touched; no pattern-based kill.

Native Windows — UNVERIFIED (not fabricated)

• This host exposes no authorized native Windows execution route (no Tailscale/OpenSSH connector; discovery found no authenticated Windows host).
• WINREC's recovered Windows worktree could not start its runner: the Windows platform dependency tree cannot load @voidzero-dev/vite-plus-win32-x64-msvc (ERR_INVALID_PACKAGE_CONFIG / untrusted reparse path); direct typecheck also unavailable (@typescript/typescript-win32-x64 absent).
• Exact missing capability: an authenticated native Windows execution route with a runnable platform dependency tree. The prior review's full native matrix (PATH/PATHEXT, exe.cmd.bat with spaces, unstartable executable, healthy/warning launch once, bounded denied/slow ops, no late launch after cancel, alias/junction + nested repos, owned cleanup) is NOT RUN; the runnable tests are preserved in the branch.

CI state (belongs to #12/ENV-1)

On the pushed head, Test, Test Server 1–3, Rust, Release Smoke, Mobile Native Changes, Native fingerprint diff, Label PR* are pending/queued; web/EAS previews skipping; CodeRabbit pass (review skipped: draft). Queued/skipped checks are not counted as passes, and no CI policy/runner was modified or waited on indefinitely.

Remaining concrete gaps

• Native Windows matrix unverified (above).
• The full apps/server suite has pre-existing, ENVCHK-unrelated failures on macOS (e.g. UsageService /var↔/private/var expectation, worktree-retention tests); the optional full run was stopped rather than expanded in scope.
• Pre-existing lint findings in branch test files (process.platform usage) are unchanged and outside the four corrections.

Rollback

Source-only; no binaries or installed state changed. Ordinary inverse: git revert 28209dcb6 ca6ec070b b061a82e1 on envchk/v5-acceptance-20260928, or reset the branch to the preserved predecessor 5d9ccd868. No force push was used.

Hub backlink: https://github.com/nullStack65/closura-agent-config/pull/237