What’s the most direct way to get the source linklet directory from a module path? The expander/main.rkt CLI looks promising using -xso to extract the s-expression linklet to a given file but it appears to compile the linklets. If I designate a cache directory, I see the cached compiled linklets and the command fails when it encounters expander/main.rkt itself (as far as I can tell), failing an attempt to read some compiled code. I can be more concrete if that would help.

For a module in an installed collection that has been compiled to bytecode, the intermediate linklet source is not preserved; it can be compiled on to a linklet in bytecode form. You can use the compiler/zo-parse API to inspect that byetcode, but it’s probably an unhelpful step away from the linklet source.

Probably the right choice is to use expander/run.rkt. As you say, it starts over compiling from source, running a completely separate version of the expander. By default, the expander runs on itself as input, but you can provide an alternate module as input using -l or -t. (Note that you can’t just provide a path without a flag, like you can for plain racket). Be sure to not use the same cache directory for source and non-source modes (i.e., -s or not).