# Modular Runtime — Production Target Discovery 01

Date: 2026-08-01

Status: accepted read-only discovery; the real macOS service target, portable runtime, immutable environment location, restart operations, rollback bundle, and clean scoped candidate are identified. No service, selector, symlink, database, process, or listener was changed.

## Production target

The repository has one current production service contract:

```text
launchd service:  gui/$(id -u)/com.nyx.moderator
plist:            ~/Library/LaunchAgents/com.nyx.moderator.plist
launcher:         ~/.nyx/runtime/current/bin/nyx-core
state root:       ~/.nyx
health:           http://127.0.0.1:8787/health
runtime mode:     full
authority:        NYX_RUNTIME_AUTHORITY=legacy|modular
```

`scripts/nyx-portable.mjs` compiles `apps/moderator/src/start.ts`, so the portable launcher enters the same selector used by the accepted safe-mode proofs. `scripts/nyx-portable-manager.mjs install-launchd` verifies the activated content-addressed bundle before writing the plist and deliberately leaves the job stopped. `scripts/nyx` controls only this label.

Docker Compose remains an alternate server deployment, not the configured target on this Mac. PM2 contains unrelated projects only. No Homebrew service or other launchd label claims Nyx authority.

## Observed machine state

Read-only process, socket, launchd, Homebrew, PM2, Docker, filesystem, and portable-bundle inspection established:

- `com.nyx.moderator` is not loaded;
- `~/Library/LaunchAgents/com.nyx.moderator.plist` is absent;
- no process listens on port `8787`;
- the former checkout-based launch agents are preserved under `~/.nyx/legacy-launch-agents/pre-core-4a2cc14c86dcdc8b8647210a5e1225911744a8f8/` and are not loaded;
- `~/.nyx/data/moderator.db` remains present;
- the activated portable rollback bundle is `dc714645fa47d791cec10f024d46c68195d75bdf-darwin-arm64-node22`;
- the standalone portable verifier accepts that bundle and its exact SHA-256 inventory;
- a local Wrangler listener on port `4328` serves only the Studio preview and has no Nyx runtime authority.

The accurate current statement is therefore: legacy remains the configured default and its state/artifact are recoverable, but no production Nyx daemon is running at discovery time.

## Immutable selector correction

Both launchd generation paths now validate `NYX_RUNTIME_AUTHORITY` as exactly `legacy` or `modular`, default it to `legacy`, and write it explicitly into the plist. An absent selector is still safe at runtime, but the service definition no longer depends on an implicit default.

This is a source correction only. Neither generator installs, loads, starts, restarts, or switches the real service during tests.

## Exact transition operations

The scoped process-manager operations are now known:

```sh
launchctl bootstrap "gui/$(id -u)" "$HOME/Library/LaunchAgents/com.nyx.moderator.plist"
launchctl kickstart -k "gui/$(id -u)/com.nyx.moderator"
launchctl bootout "gui/$(id -u)/com.nyx.moderator"
```

The release pointer is the atomic `~/.nyx/runtime/current` symlink. Portable activation retains the prior verified bundle as `previous`; portable rollback swaps the exact prior bundle back. Because launchd does not reload plist environment on `kickstart`, any selector change must use `bootout`, regenerate the plist with the authorized value, and `bootstrap`. A plain restart is not a selector transition.

The fail-back critical section is:

1. stop only `com.nyx.moderator`;
2. restore the previous portable bundle and the previous or explicit-legacy plist;
3. bootstrap only `com.nyx.moderator`;
4. require legacy build identity, legacy authority, HTTP health, and database health;
5. retain both databases and all transition evidence.

## Remaining authority boundary

The dirty working tree remains untouched. An isolated clone now preserves the audited bytes as clean scoped commit `c10d9f6bb8ac79efc94a9bd212e7be5d69531065`, a complete Git bundle, and portable archive SHA-256 `6c56717fc5304ed627f9debea49d832e28c05ad0d24699b96911166c32d0c250`. The installed artifact reports exact build identity and explicit legacy or modular authority. Evidence: [`MODULAR_RUNTIME_SCOPED_RELEASE_01.md`](./MODULAR_RUNTIME_SCOPED_RELEASE_01.md).

Explicit operator authority is still required to install/load `com.nyx.moderator`, select modular authority, run one direct and one graph smoke through that selected service, and invoke automatic fail-back on any failed condition.