PR #26967 real dev verification, Linux Boat VM
main: github/main 5732bbee39
verified PR head: 899257d4c2f6ffac62d2f6284885f9caadc16bfa

Dependencies: timeout 600 vp i in each checkout.
One dev server at a time, background setsid/nohup, task-owned PIDs.
main: vp run dev; server 16733, web 8693, isolated /home/user/main/.t3
PR: vp run dev --home-dir /home/user/t3code/.t3; server 13773, web 5733
Official public Connect identifiers from .env.example. No relay account or saved link.
Real web client: repo Playwright 1.60.0, /usr/bin/google-chrome.
Project /home/user/t3code added through Add project > Local folder.
Provider selected through composer: Codex gpt-6.1-sol.
Two real turns completed; the second followed a server restart with Connect disabled.

MAIN, T3CODE_CONNECT_ENABLED=false:
Authenticated POST /api/connect/link-proof -> 200, signed proof returned.
POST /api/t3-connect/health and /mint-credential -> 500, missing cloud mint key.
t3 --help with official public config and false -> connect command still listed.

PR, T3CODE_CONNECT_ENABLED=false:
Authenticated POST /api/connect/link-proof -> 500, explicitly Connect disabled.
POST /api/t3-connect/health and /mint-credential -> 500, explicitly Connect disabled.
GET /api/connect/link-state -> 200, linked=false.
Startup logs: T3 Connect is off (T3CODE_CONNECT_ENABLED=false).
GET /.well-known/t3/environment -> agentActivityPublishing=false.
Direct browser pairing and real Codex turn worked.

Gaps fixed on PR head:
1. service.env T3CODE_CONNECT_ENABLED=false, invoking CLI env unset:
   before t3 status --json reports connect={enabled:false,revoked:false}, offering Connect.
   after t3 status --json reports connect=null.
   after t3 up --connect --headless refuses with explicit disabled message.
2. preferences path previously entered saved-relay handling while disabled.
   extended existing test failed with CloudLinkNotLinkedError instead of connect-disabled.
   guard now runs before persistence/relay access.
   running server POST /api/connect/preferences with publishAgentActivity=false,
   holdWebhooksWhileOffline=true -> 500, explicitly Connect disabled.
   running server POST /api/connect/unlink -> 200, ok=true.

DEFAULT-ENABLED PR (variable removed, same state, restarted):
Authenticated POST /api/connect/link-proof -> 200, signed proof returned.
GET /api/connect/link-state -> 200.

Checks through blacksmith-check:
Initial focused existing suites: 6 files, 120 tests passed.
Two added assertions/cases failed before the guards, passed after: 54 tests.
vp run check:changed 54c5f25249961a1aa0b61932329092eadbd9d6fc:
format, lint, both knip passes, GraphQL, typecheck (35 packages),
tests (13 files), React compiler passed.
Explicit PR base used because testbox history is shallow.

Not verified: native desktop IPC/Clerk behavior on Linux/macOS/Windows/WSL;
native iOS/Android; real saved-link restore/resume, relay activity publishing,
webhook delivery and external Clerk login; actual LAN/Tailscale/SSH transport.
No mocked relay, saved-link fixtures, demo provider or fabricated UI data used.

Final CLI bypass correction (899257d4c2):
Before: service.env disables Connect but connect link --publish-only --headless
still printed the actual OAuth sign-in prompt; cancelled within 20 seconds.
After: login, managed link, publish-only link, and publish each exit 1 with
explicit T3CODE_CONNECT_ENABLED=false, before OAuth or relay installation.
publish --disable still exits 0 and confirms publishing disabled.
Focused final suites: 4 files, 61 tests passed through blacksmith-check.