Independent verification (second pass), 2026-08-18, worktree wf_6b6686dc-4c2-8 (HEAD a108fa7ef; install-machine.sh, protocol-self-update.ts, README, packages/bb-app unchanged vs 16ceb3a54; origin/main has no fix, no allow-scripts anywhere).
Own dev instance: app :12338 server :20338 daemon :28338, ROOT=/tmp/1120w, ports 41871-41873.
Results:
- v2-npm11.out: npm 11.16.0 -> warning printed, both .node PRESENT, fresh bb-server HTTP 200 (exit 143).
- v2-npm12.out: npm 12.0.2 -> "install scripts blocked", both .node MISSING, "Could not locate the bindings file", HTTP 000.  REPRODUCED.
- v2-npm12-allow.out: npm 12.0.2 --allow-scripts=better-sqlite3,node-pty,@parcel/watcher -> PRESENT, HTTP 200.
- v2-npx12.out: npx 12.0.2 -> bindings error. REPRODUCED.
- v2-installer-npm12.out: real /install.sh under npm 12 -> "Installed" then daemon dies "Failed to load native module: pty.node". REPRODUCED.
- v2-installer-npm12-fixed.out: with 1120-installer-fix.diff applied -> Joined successfully, host connected.
Defect in repro script: 1120-install-matrix.sh `kill $spid` kills only the bb-server wrapper (dist/bb-server.js); the child server/dist/index.js keeps listening (confirmed: after the script exited, ss showed pid 3186734 on :41871). That explains EADDRINUSE + HTTP 200 in the report's npm11.17.out and in a prior verifier's run (stray server from /tmp/1120v still on :39881).
Also hit ENOSPC (tmpfs inodes 91-97%): /tmp/1120 from the author's run holds ~426k inodes / 6.2 GB.