# P4 — Launch integrity: D11 + D12 + clean-install onboarding (2026-06-11)

**Scope (ratified):** D11 (WAGGLE_DATA_DIR + startup log), D12 (stale tracked sidecar bundle —
release-stopping), the S4 founder flag (clean-install onboarding skip), FREE→Upgrade e2e re-run.

## D11 — dataDir split-brain closed

`startService` ignored `WAGGLE_DATA_DIR` while `local/index.ts` config, the marketplace installer,
and memory-mcp honored it — a custom install split state across two directories. Now:
`resolveDataDir()` = option > `WAGGLE_DATA_DIR` > `~/.waggle` (exported, unit-pinned), plus the
ratified ONE startup line — `Data dir: <resolved> · tier: <effective>` — via `readTierFromDataDir`
(extracted from the request-scoped reader; same config.json + `getEffectiveTier` contract as
`GET /api/tier`). Stale "default to SOLO" comments fixed in assert-tier.ts and settings.ts (the
canonical vocabulary is TRIAL/FREE/PRO/TEAMS/ENTERPRISE; legacy solo→FREE, basic→PRO via
`LEGACY_TIER_MAP`, verified in tiers.ts before asserting it in a comment).

**Live-verified:** sidecar booted with `WAGGLE_DATA_DIR=<tmp>` and NO option — log line printed the
tmp dir + `tier: FREE`; install landed in the env-pointed dir.

## D12 — the bundle is generated, never tracked

`app/src-tauri/resources/service.js` (esbuild output of service.ts) was COMMITTED — last refreshed
2026-04-30, six weeks behind the server. Every official build path (app npm scripts, both CI
workflows) already regenerates it, so the tracked copy only ever shipped through a raw
`npx tauri build` — exactly the stale-binary class the ruling names. Fix per the ratified
preference (build-time generation + untracking, stronger than the minimum CI hash gate):

- `service.js` + `service.js.map` untracked + gitignored (joining node.exe/native/ under the
  existing "generated at build time" section).
- `tauri.conf.json` `beforeBuildCommand` regenerates the SIDECAR BUNDLE (+ vite build) — a raw
  `npx tauri build` produces a current server instead of a stale (or, post-untracking, missing)
  one. cwd=app/ on every invocation path (npm scripts, CI `cd app && npx @tauri-apps/cli@2 build`).
  **Scope deliberately excludes bundle-native-deps/bundle-node (review HIGH):** those scripts are
  arch-parameterized via `TARGET_ARCH`, which the hook env doesn't carry — in the cross-arch macOS
  release matrix (arm64 runner, `--target x86_64-apple-darwin`) the hook's `process.arch` fallback
  would have CLOBBERED the x64-staged Node runtime + native libs with arm64 binaries, shipping a
  non-launching Intel DMG with green CI. build-sidecar emits portable JS — safe arch-blind. The
  arch-parameterized staging stays solely in the explicit npm/CI steps that set TARGET_ARCH.
- **Stale-dist closure (review MED, verified by metafile probe):** `@waggle/shared` and
  `@waggle/hive-mind-core` export only gitignored `dist/` (core/agent/server export src), so the
  regenerated bundle silently embedded whatever dist was last compiled — the same stale-server
  class, one layer down. build-sidecar.mjs now ALIASES both packages to `src/index.ts` (no subpath
  imports exist — verified), so the bundle always compiles from source; clean checkouts build
  without `build:packages`. Verified: post-alias bundle has 59 src files, 0 dist files for the two.
- Dev mode unaffected: `service.rs` debug branch spawns `service.ts` via tsx directly.
- Pinned in tauri-config.test.ts (beforeBuildCommand contains build-sidecar; gitignore covers both
  files). Bundle regenerated locally post-D11 + post-alias to prove the script runs clean (6.5 MB).

## Clean-install onboarding skip — CONFIRMED, fixed

S4 flagged it as suspected; P4 confirmed by code: `buildLocalServer` calls
`wsManager.ensureDefault()` unconditionally at boot (index.ts:322), and useOnboarding's
returning-user auto-complete fired on `getWorkspaces().length > 0` — so every clean production
install auto-completed the wizard before first render. **A brand-new user never saw onboarding.**
(The Tauri first-launch flag never gated this effect; web/dev had no flag at all.)

**Fix — server-authoritative status:** new `routes/onboarding.ts`:
- `GET /api/onboarding/status` → completed if the flag `<dataDir>/first-launch.flag` exists (the
  SAME file the Tauri `mark_first_launch_complete` command writes on default installs), OR legacy
  evidence for pre-flag installs: any frame in the personal mind, or >1 workspaces (the seeded
  default alone is NOT evidence). No flag + no evidence → `completed:false` → wizard runs (fail
  toward showing onboarding, same direction as the Rust command's IO-error fallback).
- `POST /api/onboarding/complete` → idempotent flag stamp; fired (fire-and-forget) from
  `useOnboarding.update()` whenever completion flips, alongside the Tauri IPC flag.
- The FE auto-complete effect now keys on this status; `?forceWizard` DEV bypass unchanged; adapter
  failure keeps the wizard (a truly new user can still set up).

**Live-verified on a clean dataDir:** seeded default workspace present (count=1) and
`{"completed":false,"source":"none"}` — the wizard renders for new users.

**Accepted edge (documented, not fixed):** a legacy returning user with a fresh webview AND zero
frames AND only the default workspace (onboarded historically but never used memory) re-sees the
wizard once — no durable signal distinguishes them from a clean install; the flag stamps on their
re-completion and the class dies out.

## FREE→Upgrade e2e re-run

Act 4 "Tier Wall" (user-behavior.spec.ts) against a fresh FREE-tier sidecar: first run 3/6 failed
on 401s — the API-level spec predates the P1b bearer gate (the documented dock-era e2e advisory
band, not a product regression). Re-run under `WAGGLE_TRUST_LOCALHOST=1` (the sanctioned local
mode): **6/6 pass** — gated 403 carries what's-missing detail, upgrade URL valid, tier ladder
coherent, FREE retains meaningful endpoints, Stripe checkout URL shape valid, cost dashboard
teases value at FREE. Spec-side bearer wiring stays ledgered with the P7 e2e band.

## Review — 5-dimension adversarial workflow (run split across a session-limit reset)

First pass: 6 confirmed / 18 refuted, with the onboarding-logic finder + 17 verifiers killed by
the session limit (resumed after reset; final tally in the P4 commit message). Dispositions:

| Sev | Finding | Disposition |
|-----|---------|-------------|
| HIGH (×2 dims) | beforeBuildCommand re-ran arch-parameterized bundle scripts without TARGET_ARCH — cross-arch macOS release legs clobbered x64 staging with arm64 (non-launching Intel DMG, green CI) | FIXED: hook trimmed to build-sidecar (arch-independent) + vite build |
| MED | Regenerated bundle silently embedded stale @waggle/shared + hive-mind-core dist (verified empirically) | FIXED: esbuild alias → src/index.ts; 0 dist files in bundle post-fix |
| LOW (×2 dims) | Double-run of sidecar/native/node/vite on every scripted build path | FIXED by the HIGH trim (hook now adds only build-sidecar+vite; build-sidecar double-run costs ~2s) |
| LOW | Tauri fs-flag fast-path hardcodes ~/.waggle while the server flag lives in <dataDir> — divergence reachable on custom-WAGGLE_DATA_DIR desktop installs (flag says returning, dataDir un-onboarded) | LEDGERED (P7): requires the Rust shell to learn the dataDir; default installs (the shipped path) share one file. Server status remains the primary signal |

**Resumed run (post-limit-reset, against the already-fixed code): 13 confirmed / 16 refuted.**
The fresh onboarding-logic finder verified the full pre-completion-evidence chain and two more
clusters; all fixed:

| Sev | Finding (clustered) | Disposition |
|-----|---------------------|-------------|
| MED ×4 | **Wizard/system-origin evidence pollution** — step-1 `PUT /api/profile` writes a 'User identity:' frame pre-completion (verified to the exact line), C33 import frames, workspace-create, and even the monthly-assessment CRON frame all count as "returning user"; mid-wizard abandon + fresh WebView profile (or Back-nav to step 0 + reload) silently skips the wizard | FIXED: server-durable PENDING latch — the first status call that finds no flag + no evidence stamps `<dataDir>/onboarding-pending.flag`; thereafter only explicit completion flips the status. Kills every evidence producer at once. Pinned with the exact verified attack chain (identity frame after latch → still `completed:false`) + a real-returning-user no-latch pin |
| MED ×5 (4 dims) | **Tauri fs-flag divergence** — `flag_path()` hardcoded `~/.waggle` while D11 makes `WAGGLE_DATA_DIR` official; a stale home flag auto-skips onboarding against a brand-new custom dataDir (the fast-path bypasses the server status entirely) | FIXED in Rust: `flag_path()` honors non-empty `WAGGLE_DATA_DIR` first (same resolution order as `resolveDataDir`), so the IPC flag and the server stamp are the same file on EVERY install shape. Sequential cargo test pins the order incl. the empty-env fallthrough |
| MED | **D12 raw-path overclaim** — after the arch-safety trim, a raw `npx tauri build` could silently package a binary with NO Node runtime (the resources glob tolerates absent files) | FIXED: `check-sidecar-resources.mjs` preflight in beforeBuildCommand — missing runtime/native artifacts now FAIL the build with instructions, never ship silently |
| LOW | D11 startup log line unpinned (deleting it kept gates green) | FIXED: console spy in the D11 integration test asserts the line + dataDir + tier |
| LOW | onboardingRoutes registration on the real server unpinned | FIXED: source-pin (import + register) in onboarding-status.test.ts |
| LOW | Production spawn seam (service.rs → bundled service.js) is smoke-only territory | LEDGERED: binary-smoke class, P7/D15 grid |

Self-triaged from the first run's unverified pile (fixed regardless — trivially real):
- `resolveDataDir` env leg used `??` — a set-but-EMPTY `WAGGLE_DATA_DIR` yielded `''`. Now `||`
  (pinned).
- **Mid-wizard auto-complete ejection** (the question the dead onboarding-logic finder was asked):
  a C33 import during the wizard writes personal-mind frames = legacy evidence; a mid-wizard
  refresh would auto-complete the wizard out from under the user. Guard added: `step > 0` never
  auto-completes (pinned).
- D11 re-homing note: an install that previously had implicit `~/.waggle` data while the
  launcher set `WAGGLE_DATA_DIR` elsewhere now follows the env var — that is the ratified D11
  behavior (the split-brain closing), recorded here as an intentional flip.

## Gates

FE 878/878 · server suite + tsc + lint recorded in the P4 commit message · D11 8 pins · onboarding
5 server + 4 FE pins · D12 pin · live: D11 boot, clean-install status, Act 4 6/6.