@junghanacs/entwurf 0.16.1 → 0.17.1

package/scripts/check-gate-qualification.ts

@@ -804,6 +804,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"acp-prompt-lifecycle": 15,
 		"acp-stop-reason": 6,
 		"acp-stream-hooks": 10,
+		"acp-usage-accounting": 12,
 		"agy-permission": 6,
 		"bridge-boot-resume": 3,
 		"bridge-command-boot": 9,

package/scripts/lib/pi-record-discovery.ts

@@ -16,13 +16,60 @@
  * runs of the acp socket smokes).
  */
 
+import { existsSync } from "node:fs";
 import * as fsp from "node:fs/promises";
+import * as os from "node:os";
 import * as path from "node:path";
 
 function sleep(ms: number): Promise<void> {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * pi's own cross-process locks. `FileAuthStorageBackend` (pi `dist/core/auth-storage.js`) guards
+ * `auth.json` AND `models-store.json` with `proper-lockfile`, and every boot reads through it, so
+ * these two directories are the ones a killed resident can leave behind.
+ */
+const PI_LOCK_PATHS = ["auth.json.lock", "models-store.json.lock"].map((name) =>
+	path.join(os.homedir(), ".pi", "agent", name),
+);
+
+/**
+ * The bound a LIVE smoke must give a `pi` boot — and the reason it is NOT "how long a boot takes".
+ *
+ * MEASURED 2026-09-03 on the release host, in the smokes' own spawn shape:
+ *  - an undisturbed boot → V3 record is **1008–1212ms across 80 consecutive boots** (5.1–5.4s under
+ *    4× CPU oversubscription), so a bound in the tens of seconds is not about boot cost;
+ *  - pi reads its auth/models store under a `proper-lockfile` lock whose stale window is
+ *    `staleMs = 30_000` (pi `dist/core/auth-storage.js`), and a contender that finds the lock held
+ *    retries for exactly that long before taking it over;
+ *  - SIGTERM lands inside that window often enough to matter — sweeping 24 kill offsets across a
+ *    boot left `~/.pi/agent/models-store.json.lock` orphaned once (at +375ms), because the signal
+ *    ends the process before `proper-lockfile`'s release ever runs;
+ *  - with such an orphan present, the very next boot measured **30_148ms** (and 1_114ms immediately
+ *    after, once the stale takeover had cleared it).
+ *
+ * So a 30_000 bound is the single worst value available: it expires 148ms INSIDE the takeover, and
+ * the record lands just after the smoke has stopped looking — an empty stderr, a live child, and no
+ * record in any store. That is what blocked two of the three 0.17.0 `--cut` runs on C1b, while
+ * `smoke-entwurf-chain-live` — same two-resident dance, 45_000 — passed all three. This constant is
+ * that value, shared so no smoke sits on the cliff again. Raise it if pi's `staleMs` ever grows;
+ * it must stay strictly greater than that window plus a boot.
+ */
+export const PI_BOOT_TIMEOUT_MS = 45_000;
+
+/**
+ * Which pi locks are on disk right now, for a failure diagnostic — a boot that overran its bound
+ * while one of these exists overran it for a NAMED reason, not a mysterious one. Read-only: a lock
+ * is arbitrated by pi's own stale protocol and must never be deleted by a smoke, because a live
+ * holder and an orphan look identical from here.
+ */
+export function describePiLockResidue(): string {
+	const present = PI_LOCK_PATHS.filter((lock) => existsSync(lock));
+	if (present.length === 0) return "none held (so a boot overrun here is not the pi lock-stale window)";
+	return `${present.join(", ")} — a boot contending with this waits out pi's ${30_000}ms stale window before taking over`;
+}
+
 export async function waitForPiRecord(storeDir: string, timeoutMs: number, pollMs = 100): Promise<string | null> {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {

package/scripts/mutants/acp-stream-hooks.json

@@ -144,9 +144,11 @@
 			"claim": "ACPHOOK-ONRESPONSE-NEVER-CALLED",
 			"title": "someone 'completes' the hook contract by fabricating an HTTP 200 response on turn success — exactly the false evidence the exemption exists to forbid",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\tfunction finishSuccess(promptResult: { stopReason?: string }): void {"],
+			"find": [
+				"\tfunction finishSuccess(adapter: AcpBackendAdapter, session: BridgeSession, promptResult: AcpPromptResponse): void {"
+			],
 			"replace": [
-				"\tfunction finishSuccess(promptResult: { stopReason?: string }): void {",
+				"\tfunction finishSuccess(adapter: AcpBackendAdapter, session: BridgeSession, promptResult: AcpPromptResponse): void {",
 				"\t\tvoid options?.onResponse?.({ status: 200, headers: {} }, model);"
 			],
 			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],

package/scripts/mutants/acp-usage-accounting.json

@@ -0,0 +1,181 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-usage-accounting",
+	"mutants": [
+		{
+			"claim": "ACP-TURN-AGGREGATE-NOT-PROJECTED",
+			"title": "the turn's ROUND-TRIP AGGREGATE is projected back onto pi's four per-request usage fields — re-plants the exact 2026-09-02 defect: pi's own isContextOverflow then read 42 + 4,185,084 against a 1,000,000 window and compacted a live session whose context was 223,516",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tsealTurnUsage(adapter, session, promptResult);"],
+			"replace": [
+				"\t\tsealTurnUsage(adapter, session, promptResult);",
+				"\t\tconst reprojected = promptResult?.usage;",
+				"\t\tif (adapter.sealsTurnAccounting && reprojected) {",
+				"\t\t\tstate.output.usage.input = reprojected.inputTokens ?? 0;",
+				"\t\t\tstate.output.usage.output = reprojected.outputTokens ?? 0;",
+				"\t\t\tstate.output.usage.cacheRead = reprojected.cachedReadTokens ?? 0;",
+				"\t\t\tstate.output.usage.cacheWrite = reprojected.cachedWriteTokens ?? 0;",
+				"\t\t}"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-TURN-AGGREGATE-NOT-PROJECTED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CONTEXT-OCCUPANCY-PRESERVED",
+			"title": "the seal stops writing the session's context occupancy into totalTokens — pi's calculateContextTokens then falls through to summing the four (all zero) usage fields, so the status-line percentage and auto-compaction read a long session as empty",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tif (typeof session.contextOccupancyTokens === \"number\") {",
+				"\t\t\tstate.output.usage.totalTokens = session.contextOccupancyTokens;",
+				"\t\t}"
+			],
+			"replace": [
+				"\t\tif (typeof session.contextOccupancyTokens === \"number\") {",
+				"\t\t\tstate.output.usage.totalTokens = 0;",
+				"\t\t}"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CONTEXT-OCCUPANCY-PRESERVED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CONTEXT-OCCUPANCY-CARRIED",
+			"title": "the seal stops carrying the session's last known context occupancy — a turn whose usage_update never arrived now emits a token partition with a zero totalTokens, so pi falls through to that partition and reads a long session as nearly empty",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tif (typeof occupancy === \"number\") session.contextOccupancyTokens = occupancy;",
+				"\t\tif (typeof session.contextOccupancyTokens === \"number\") {",
+				"\t\t\tstate.output.usage.totalTokens = session.contextOccupancyTokens;",
+				"\t\t}"
+			],
+			"replace": ["\t\tif (typeof occupancy === \"number\") session.contextOccupancyTokens = occupancy;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CONTEXT-OCCUPANCY-CARRIED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-TURN-COST-SUM-MATCHES-SDK",
+			"title": "the backend's RUNNING SESSION TOTAL is assigned to the turn cost again instead of the adjacent diff — the arithmetic that displayed a $24.261 session as $444.370",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\t\tsession.sdkCumulativeCostUsd = observed;",
+				"\t\t\t\tstate.output.usage.cost.total = diff;",
+				"\t\t\t\tturnCostUsd = diff;"
+			],
+			"replace": [
+				"\t\t\t\tsession.sdkCumulativeCostUsd = observed;",
+				"\t\t\t\tstate.output.usage.cost.total = observed;",
+				"\t\t\t\tturnCostUsd = diff;"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-TURN-COST-SUM-MATCHES-SDK]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-COST-BASELINE-HELD-WHEN-MISSING",
+			"title": "a turn with no cost notification zeroes the baseline instead of holding it — the next diff then re-attributes every dollar the session had already spent",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tstate.output.usage.cost.total = 0;",
+				"\t\t} else {",
+				"\t\t\tconst diff = observed - (session.sdkCumulativeCostUsd ?? 0);"
+			],
+			"replace": [
+				"\t\t\tsession.sdkCumulativeCostUsd = 0;",
+				"\t\t\tstate.output.usage.cost.total = 0;",
+				"\t\t} else {",
+				"\t\t\tconst diff = observed - (session.sdkCumulativeCostUsd ?? 0);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-COST-BASELINE-HELD-WHEN-MISSING]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-COST-RESET-NOT-SILENT",
+			"title": "a running total that goes backwards is absorbed silently — the turn reports a negative cost, nobody is told, and the only observation that could settle what a conversation reset does to the total is destroyed",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tif (diff < 0) {"],
+			"replace": ["\t\tif (diff < -1_000_000) {"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-COST-RESET-NOT-SILENT]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CORTEX-USAGE-UNTOUCHED",
+			"title": "the seal stops being gated on the adapter DECLARING measured semantics — claude's accounting is sealed onto a backend nobody measured, minting the same unmeasured accounting this lane exists to end",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tif (!adapter.sealsTurnAccounting) return;"],
+			"replace": ["\t\tvoid adapter.sealsTurnAccounting;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CORTEX-USAGE-UNTOUCHED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-TURN-ACCOUNTING-ATTACHED",
+			"title": "the vendor's four turn totals stop riding their own key — pi's four fields are 0 and nothing else carries the numbers, so the cache-effect badge has no inputs and a paid-for prefix rewrite reaches the operator as silence",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\t(state.output.usage as unknown as { acp?: AcpTurnAccounting }).acp = aggregate;"],
+			"replace": ["\t\t\tvoid aggregate;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-TURN-ACCOUNTING-ATTACHED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-CACHE-REBILL-REPORTED",
+			"title": "the re-billed-prefix bound drops its ΣcacheWrite term, so a full prefix rewrite after an idle gap no longer clears the notice floor — the operator runs on a cache-effect badge while having already paid to rewrite the whole prefix",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\t? (priorOccupancy as number) - (priorIoSum as number) - Math.max(0, (occupancy as number) - cacheWriteForBound)"
+			],
+			"replace": ["\t\t\t? (priorOccupancy as number) - (priorIoSum as number) - Math.max(0, occupancy as number)"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-CACHE-REBILL-REPORTED]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-REBILL-NEVER-EXCEEDS-WRITE",
+			"title": "the re-billed claim loses its physical cap, so a context shrink (organic compaction) announces a six-figure cache miss over a turn that wrote a thousand tokens — a fact the operator has no way to disbelieve",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\tconst missLowerBound = rawBound === undefined ? undefined : Math.min(rawBound, cacheWriteForBound);"
+			],
+			"replace": ["\t\tconst missLowerBound = rawBound;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-REBILL-NEVER-EXCEEDS-WRITE]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-ACCOUNTING-PREFERS-WIDEST",
+			"title": "the accounting-grade model_usage rows stop being preferred, so the turn silently reports MAIN-LOOP-ONLY tokens against an all-inclusive cost denominator — the cache-effect badge understates itself exactly when compaction or a subagent ran, and nothing says so",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tif (Array.isArray(rows) && rows.length > 0) {"],
+			"replace": ["\tif (Array.isArray(rows) && rows.length > 99) {"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-ACCOUNTING-PREFERS-WIDEST]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		},
+		{
+			"claim": "ACP-REBILL-MAIN-LOOP-SCOPE",
+			"title": "the re-billed bound takes cacheWrite from the WIDE accounting rows instead of the main loop, so a warm main prefix announces a six-figure miss (and this turn's dollar figure) because an internal/compaction call wrote extra cache — mixing occupancy's scope with model_usage's",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tconst cacheWriteForBound = mainLoop !== undefined ? mainLoop.cacheWrite : 0;"],
+			"replace": ["\t\tconst cacheWriteForBound = aggregate !== undefined ? aggregate.cacheWrite : 0;"],
+			"gate": ["bash", "run.sh", "check-acp-usage-accounting"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:ACP-REBILL-MAIN-LOOP-SCOPE]",
+			"signatureSource": "scripts/check-acp-usage-accounting.ts"
+		}
+	]
+}

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -53,7 +53,7 @@ import { fileURLToPath } from "node:url";
 import { fetchControlSocketRuntimeInfo, formatRuntimeModel } from "../pi-extensions/lib/entwurf-control-rpc.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
-import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
+import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
 const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
@@ -64,7 +64,7 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
 const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 
-const BOOT_TIMEOUT_MS = 30_000;
+const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 const POLL_MS = 100;
 

package/scripts/smoke-acp-cortex-live.ts

@@ -54,7 +54,7 @@ import { fileURLToPath } from "node:url";
 import { upsertMetaSession, writeMetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
-import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
+import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
 const ACP_MODEL = process.env.ENTWURF_ACP_CORTEX_MODEL?.trim() || "cortex-claude-sonnet-5";
@@ -66,7 +66,7 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
 const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 
-const BOOT_TIMEOUT_MS = 30_000;
+const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 // The cortex CLI self-extracts on first launch and its newSession alone is
 // ~2.5 s; keep the generous default of the sibling smoke.
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_CORTEX_TIMEOUT_MS) || 300_000;

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.70.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.73.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-acp-socket-citizen-live.ts

@@ -32,7 +32,7 @@ import { fetchControlSocketRuntimeInfo, formatRuntimeModel } from "../pi-extensi
 import { scanSocketProbes } from "../pi-extensions/lib/socket-discovery.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
-import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
+import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
 const ACP_MODEL = process.env.ENTWURF_S1_MODEL?.trim() || "claude-opus-5";
@@ -43,7 +43,7 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
 const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 
-const BOOT_TIMEOUT_MS = 30_000;
+const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 const POLL_MS = 100;
 
 let passed = 0;

package/scripts/smoke-acp-v2-send-live.ts

@@ -82,7 +82,7 @@ import { fileURLToPath } from "node:url";
 import { upsertMetaSession, writeMetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
-import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
+import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
 const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
@@ -93,7 +93,7 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..
 // Load ONLY this checkout's extensions so the resident registers THIS acp-provider.ts.
 const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 
-const BOOT_TIMEOUT_MS = 30_000;
+const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // shared: pi lock-stale window + boot (see pi-record-discovery)
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 const POLL_MS = 100;
 

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -65,7 +65,7 @@ import {
 } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
-import { waitForPiRecord } from "./lib/pi-record-discovery.ts";
+import { describePiLockResidue, PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 // pi's control socket lives at the canonical dir keyed by the RECORD's garden id (#50 C4: the
 // record is the sole address authority — never a transcript/session id; :196 below proves it),
@@ -78,7 +78,14 @@ const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..
 const REPO_EXTENSION_ARGS = ["--no-extensions", "-e", REPO_ROOT] as const;
 
 // Staged timeouts (automation): short and per-stage so a stall is attributable.
-const BOOT_TIMEOUT_MS = 30_000; // pi --entwurf-control socket appears
+//
+// The boot bound is SHARED and carries its own receipt (see `PI_BOOT_TIMEOUT_MS` in
+// pi-record-discovery). Short version, because this smoke is where it was found: this cell used to
+// wait 30_000ms, which is EXACTLY pi's `proper-lockfile` stale window, and C1's own SIGTERM can
+// orphan that lock — so C1b's resident spent the whole wait queueing behind it and birthed its
+// record at a measured 30_148ms, 148ms after the smoke had stopped looking. That is what blocked
+// two of the three 0.17.0 `--cut` runs.
+const BOOT_TIMEOUT_MS = PI_BOOT_TIMEOUT_MS; // pi --entwurf-control record + socket appear
 const POLL_MS = 100;
 
 let passed = 0;
@@ -90,6 +97,43 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
+/** What a spawned resident DID while the smoke waited on it — the fact a bare boot timeout
+ * throws away. Each resident owns its own stderr here: a single shared tail cannot say which
+ * of the two children spoke, and the C1b post-mortem is exactly that question. */
+interface ResidentWatch {
+	label: string;
+	pid: number | undefined;
+	startedAt: number;
+	exit: string | null;
+	stderr: string;
+}
+
+function watchResident(child: ChildProcess, label: string): ResidentWatch {
+	const watch: ResidentWatch = { label, pid: child.pid, startedAt: Date.now(), exit: null, stderr: "" };
+	child.once("exit", (code, signal) => {
+		watch.exit = `code=${code} signal=${signal} at +${Date.now() - watch.startedAt}ms`;
+	});
+	child.stderr?.on("data", (b: Buffer) => {
+		watch.stderr = (watch.stderr + b.toString()).slice(-2000);
+	});
+	return watch;
+}
+
+/** Read at FAILURE time, before the `finally` reaps anything: a resident that is still alive
+ * having birthed nothing is a different defect from one that exited silently, and "no pid" is a
+ * third (the spawn itself never took). */
+function describeResident(watch: ResidentWatch): string {
+	const waited = `${Date.now() - watch.startedAt}ms after spawn`;
+	if (watch.pid === undefined) return `never acquired a pid — the spawn did not take (${waited})`;
+	if (watch.exit) return `pid=${watch.pid} EXITED ${watch.exit} — it was gone before the wait ended`;
+	try {
+		process.kill(watch.pid, 0);
+		return `pid=${watch.pid} still ALIVE ${waited} and had birthed no record`;
+	} catch {
+		return `pid=${watch.pid} is GONE with no exit event seen (reaped elsewhere), ${waited}`;
+	}
+}
+
 function resolveTarget(): { provider: string; model: string } {
 	const combined = process.env.ENTWURF_LIVE_TARGET?.trim();
 	if (combined) {
@@ -153,7 +197,7 @@ async function main(): Promise<void> {
 	let resident: ChildProcess | null = null;
 	let residentGid = "";
 	let c1bGid = "";
-	let stderrTail = "";
+	const residents: ResidentWatch[] = [];
 	let succeeded = false;
 
 	const prodDeps = (sender: SenderEnvelope) =>
@@ -182,9 +226,7 @@ async function main(): Promise<void> {
 				[...REPO_EXTENSION_ARGS, "--entwurf-control", "--provider", provider, "--model", model, "--mode", "rpc"],
 				{ cwd: tmp, stdio: ["pipe", "ignore", "pipe"], detached: false },
 			);
-			resident.stderr?.on("data", (b: Buffer) => {
-				stderrTail = (stderrTail + b.toString()).slice(-2000);
-			});
+			residents.push(watchResident(resident, "C1"));
 
 			const bornGid = await waitForPiRecord(sessionsDir, BOOT_TIMEOUT_MS);
 			ok("C1 the resident BIRTHED its own V3 backend:pi record (the address authority)", bornGid !== null);
@@ -241,9 +283,7 @@ async function main(): Promise<void> {
 					env: { ...process.env, ENTWURF_META_SESSIONS_DIR: hiddenStore },
 				},
 			);
-			resident.stderr?.on("data", (b: Buffer) => {
-				stderrTail = (stderrTail + b.toString()).slice(-2000);
-			});
+			residents.push(watchResident(resident, "C1b"));
 
 			const bornGid = await waitForPiRecord(hiddenStore, BOOT_TIMEOUT_MS);
 			ok("C1b the resident birthed its record into the HIDDEN store", bornGid !== null);
@@ -358,7 +398,17 @@ async function main(): Promise<void> {
 	} catch (err) {
 		console.error("\n[smoke-entwurf-v2-matrix-live] FAILED — diagnostic artifacts:");
 		for (const [k, v] of Object.entries(artifacts)) console.error(`  ${k} = ${v}`);
-		if (stderrTail) console.error(`  pi stderr (tail):\n${stderrTail.replace(/^/gm, "    ")}`);
+		// Probed HERE, not in `finally`: the reaper runs after this block, so this is the last
+		// moment the residents' real state can still be read. An empty stderr is itself evidence
+		// and is printed as "(empty)" rather than skipped — silence that is never stated reads as
+		// a missing diagnostic instead of the observation it is.
+		console.error(`  pi locks held right now: ${describePiLockResidue()}`);
+		for (const watch of residents) {
+			console.error(`  resident ${watch.label}: ${describeResident(watch)}`);
+			console.error(
+				`  resident ${watch.label} stderr: ${watch.stderr ? `\n${watch.stderr.replace(/^/gm, "    ")}` : "(empty)"}`,
+			);
+		}
 		throw err;
 	} finally {
 		if (resident) {

package/scripts/smoke-mux-lifecycle-live.ts

@@ -213,6 +213,46 @@ function pidIsAlive(pid: number): boolean {
 	}
 }
 
+/**
+ * What the launched window actually shows, read at the moment a nonce callback never arrived.
+ *
+ * The launch receipt says so itself — "if it never comes, the window is visible and can be read
+ * directly" — but on a headless release-gate run nobody is there to look, and the window is torn
+ * down in teardown seconds later. So the harness looks for the operator: is the pane process even
+ * alive, and what is painted in it. That separates the three states a bare timeout collapses into
+ * one — the runtime never started (or died), it started and is sitting on an error or a prompt, or
+ * it is running fine and the model simply did not call the callback tool. A pi-native callback
+ * timeout with no window evidence is what blocked the second 0.17.0 `--cut` (and, in the same
+ * shape, a 0.16.1 run), leaving nothing to tell those three apart afterwards.
+ *
+ * Diagnostics must never become the failure: every step is best-effort, and a tmux that cannot
+ * answer is reported as its own line rather than thrown.
+ */
+function paneForensics(label: string, socket: string, env: NodeJS.ProcessEnv, coords: Coordinates): string {
+	const lines: string[] = [`--- ${label} window forensics (the callback never came) ---`];
+	try {
+		lines.push(`pane ${coords.paneId} pid ${coords.panePid}: ${pidIsAlive(Number(coords.panePid)) ? "ALIVE" : "GONE"}`);
+	} catch (err) {
+		lines.push(`pane pid liveness unreadable: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const panes = tmux(
+		socket,
+		["list-panes", "-a", "-F", "#{pane_id} #{pane_pid} #{pane_dead} #{pane_current_command}"],
+		env,
+	);
+	lines.push(
+		panes.status === 0 ? `list-panes:\n${panes.stdout || "(none)"}` : `list-panes failed (status ${panes.status})`,
+	);
+	const captured = tmux(socket, ["capture-pane", "-p", "-t", coords.paneId], env);
+	if (captured.status === 0) {
+		const tail = captured.stdout.split("\n").slice(-40).join("\n");
+		lines.push(`capture-pane (last 40 lines):\n${tail || "(the pane painted nothing)"}`);
+	} else {
+		lines.push(`capture-pane failed (status ${captured.status}) — the window is already gone`);
+	}
+	return lines.join("\n");
+}
+
 async function waitForPidsGone(pids: ReadonlySet<number>, timeoutMs = 10_000): Promise<boolean> {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {
@@ -704,7 +744,9 @@ async function main(): Promise<void> {
 			ok(
 				`${cell}: the nonce came back and its SENDER ENVELOPE carries a garden id — correlation without asking the sibling`,
 				gid !== null && GARDEN_ID.test(gid),
-				`--- launch receipt ---\n${launch.text}`,
+				gid === null
+					? `--- launch receipt ---\n${launch.text}\n${paneForensics(cell, srv.socket, srv.env, coords)}`
+					: `--- launch receipt ---\n${launch.text}`,
 			);
 			const citizen = gid as string;
 			siblingGids.add(citizen);
@@ -936,7 +978,9 @@ async function main(): Promise<void> {
 			ok(
 				"claude-code: the nonce came back and its SENDER ENVELOPE carries a garden id",
 				ccGid !== null && GARDEN_ID.test(ccGid),
-				`--- launch receipt ---\n${ccLaunch.text}`,
+				ccGid === null
+					? `--- launch receipt ---\n${ccLaunch.text}\n${paneForensics("claude-code", cc.socket, cc.env, ccCoords)}`
+					: `--- launch receipt ---\n${ccLaunch.text}`,
 			);
 			const ccCitizen = ccGid as string;
 			siblingGids.add(ccCitizen);