fix(test): acceptance-uds-delivery.sh still installed the relay the removed way

[rappdw]

Integration §25 failed all three cases at [label] daemon container is running, in 5 seconds, with no cause anywhere in the log.

Cause

test/acceptance-uds-delivery.sh:138 wrote SANDY_HANDOFF_RELAY=.sandy/relay.sh into the isolated host config. That key was removed as a configuration key in 2.2.0 (#354) and setting it from any config file is a hard error (sandy:11831), so every --start refused before docker run and no container ever appeared.

This is #362 again, in a different file. That fix swept acceptance-handoff-dirs.sh and stopped there. The lesson it was supposed to bank is that a retired mechanism has to be grepped for in both roles — what asserts it and what sets it up — across every harness, including the ones CI never runs. CI runs neither of these.

Three changes

Install the relay as a feature manifest entry, the same shape acceptance-handoff-dirs.sh now uses. No config key is involved, and a manifest under $SANDY_HOME is privileged by location so no approval prompt appears — which is exactly what the surrounding env -u SANDY_AUTO_APPROVE_PRIVILEGED exists to prove. Ordering is already correct for this: #321 moved the manifest pass ahead of the relay block precisely so an entry is visible to the four decisions gated on SANDY_HANDOFF_RELAY, including the conditional crossSessionInbound default this harness measures.

Move three in-container paths off ~/.handoff/relay/, removed in 2.2.0 (#353/#355), onto /opt/sandy/relay-state/ — the rw mount that replaced it. The sentinel, the injector log and Claude Code's --debug-file all write there, so even a launch that had succeeded would have had nowhere to put them; this was a second, independent break hiding behind the first. Verified in a live container: ~/.handoff does not exist, /opt/sandy/relay-state is mounted rw, SANDY_RELAY_STATE points at it, and sandy-handoff-sessions is still on PATH.

Keep the --start output. It was >/dev/null 2>&1, which is the whole reason a launch that refused in one line on stderr surfaced as three identical container-missing failures with the cause thrown away. The harness now prints the exit code and the tail of that output when no container appears.

Sweep

grep across every harness for SANDY_HANDOFF_RELAY=, .handoff/, handoff/relay and relay-bin now returns only negative controls and comments — assertions that the removed mechanisms are absent, which is what should remain.

Not run here

This harness needs Docker, which Claude Code inside sandy cannot reach. bash -n and test/lint-bash32.sh are clean; the harness itself needs a host run.

Unrelated to #364 — separate branch off main so either can land first.

🤖 Generated with Claude Code