[qingyun-wu]

Summary

Closes Bug #5 of 5 from Lucy's Maddy v0.8 migration report (2026-06-06 #design). Last of her five 🎉

Lucy ran nohup bash src/startup.sh > \$SUTANDO_WORKSPACE/logs/startup-<ts>.log 2>&1 & over SSH. Mid-run the v0.8 auto-migration `rm -rf`'d the legacy workspace dir her redirect was pointing at → log vanished mid-write, postmortem impossible.

Read-through confirms there's no startup.sh-internal leak — service logs all land in `$LOGS_DIR=$WORKSPACE/logs` resolved AFTER line 184's `unset SUTANDO_WORKSPACE` + fresh config resolve. Lucy concurred: "There's no startup.sh-internal leak. The lost log was my own invocation, not the script. Ship your fallback — tee startup.sh's stdout+stderr to /tmp/sutando-startup-.log at the very top. That's exactly the right fix here: it guarantees a recoverable trace regardless of how it's invoked."

Fix

At the very top of `src/startup.sh` (BEFORE any other output, BEFORE the v0.8 auto-migration block), tee stdout + stderr to `/tmp/sutando-startup--.log`:

```bash
if [ "${SUTANDO_STARTUP_NO_LOG:-0}" != "1" ]; then
_STARTUP_LOG="/tmp/sutando-startup-$(date -u +%Y%m%dT%H%M%SZ)-$$.log"
echo "📓 startup log → $_STARTUP_LOG" >&2
exec > >(tee -a "$_STARTUP_LOG") 2> >(tee -a "$_STARTUP_LOG" >&2)
fi
```

• PID suffix prevents collisions when the operator retries while a hung previous invocation is still running.
• Announce line goes to stderr immediately so the operator knows where to look if their own redirect gets eaten.
• Opt-out: `SUTANDO_STARTUP_NO_LOG=1` (e.g. test harnesses with their own output capture).

Tests

`tests/startup-self-log-tmp.test.sh`:

• 6 structural: opt-out env var honored, /tmp path, `exec > >(tee -a ...)` for stdout AND `2> >(tee -a ...)` for stderr, announce-to-stderr, tee block BEFORE the auto-migration block, PID in filename.
• 3 E2E: extracted block writes both stdout AND stderr to the captured /tmp log while preserving pass-through to real fds; opt-out env var actually skips the tee; announce line goes to stderr only.

ALL TESTS PASS.

Diff stats

2 files changed, +148 (20 in startup.sh, 128 test).

Related

• Lucy's Maddy report 2026-06-06 #design
• PR fix(sutando-migrate): auto-invoke --import to copy Claude memory (Lucy's bug #1) #1475 (Bug Add demo video to README #1) merged
• PR fix(startup): honor sutando-migrate's per-source sentinels — close Lucy's Bug #2 re-migrate loop #1478 (Bug temp: demo video upload #2) merged
• PR fix(sutando-migrate): default media excludes + skip-gzip-when-huge for backup_dest (Lucy's Bug #3) #1482 (Bug Inline demo video in README #3) merged
• PR fix(sync-workspace): refuse push/pull when .git present but sync uninit (Lucy's Bug #4) #1483 (Bug README: inline demo video #4) open (Lucy validated, awaiting merge)
• This = Bug Add context drop setup instructions #5 closes the sweep.

v0.3.0 milestone table

Milestone	Status
M0 (in-repo workspace default)	✓ merged
M1 (auto-recovery / runtime safeguards)	✓ merged
M2 (per-runtime CLAUDE_CONFIG_DIR)	✓ merged
M3 (v0.3.0 cutover)	tracked in #1472

Test plan

• Read the new tee block at top of startup.sh — confirm it runs BEFORE any other output
• Run `bash tests/startup-self-log-tmp.test.sh` locally — confirm ALL TESTS PASS
• On a fresh boot, verify `📓 startup log → /tmp/sutando-startup-*.log` line appears on stderr
• Cat that /tmp log after startup completes — should contain the full output

🤖 Generated with Claude Code

[sonichi]

LGTM. exec-with-process-substitution tee is the right pattern — both stdout and stderr captured, transparent to the rest of the script. Critical ordering: tee runs before auto-migration (Test 5 verifies this explicitly, which is exactly right — an early migration abort would otherwise be invisible). Timestamp+PID gives uniqueness for concurrent invocations. SUTANDO_STARTUP_NO_LOG=1 opt-out is clean. Test suite covers all 6 structural invariants. Stand: Echo Act IV Pro