@junghanacs/entwurf 0.16.1 → 0.17.2

package/scripts/smoke-meta-install-state.sh

@@ -317,6 +317,69 @@ def structural_cells():
         assert (broken, settings) == before
 
 cell("", "retired/managed sets stay disjoint and a corrupt key ledger fails closed", structural_cells)
+
+def compaction_cells():
+    # #94 — the two compaction keys join the retired set. They exercise two axes
+    # the skipDangerous cells above never touch: a NESTED path and a STRING
+    # scalar. Both matter, because relinquish compares `type(value) is
+    # type(last_managed_value)` and walks the path through get_nested.
+    for name, path, last in [
+        ("autoCompactEnabled", ["autoCompactEnabled"], False),
+        ("env.DISABLE_AUTOCOMPACT", ["env", "DISABLE_AUTOCOMPACT"], "1"),
+    ]:
+        def build(current=MISSING, old=MISSING):
+            settings = {}
+            if current is not MISSING:
+                node = settings
+                for key in path[:-1]:
+                    node = node.setdefault(key, {})
+                node[path[-1]] = current
+            keys = {} if old is MISSING else {name: copy.deepcopy(old)}
+            return {"files": {"settings": {"keys": keys}}}, settings
+
+        def led(existed, value):
+            return {"kind": "scalar", "path": path, "original": {"existed": existed, "value": value}}
+
+        def call(current=MISSING, old=MISSING):
+            state, settings = build(current, old)
+            m.relinquish_retired_scalar(state, settings, name, path, last)
+            return state, settings
+
+        # (a) still carrying what entwurf last managed, with provenance -> the
+        #     pre-entwurf snapshot is restored, and the entry is consumed.
+        state, settings = call(last, led(True, last))
+        assert m.get_nested(settings, path) == (True, last), (name, settings)
+        assert name not in state["files"]["settings"]["keys"], name
+        # (a') the same, where the operator had NOTHING before entwurf: restoring
+        #      the snapshot must DELETE the key rather than leave our value.
+        state, settings = call(last, led(False, None))
+        assert m.get_nested(settings, path)[0] is False, (name, settings)
+        # (b) the operator has since changed it -> already theirs, untouched.
+        other = True if last is False else "0"
+        state, settings = call(other, led(True, last))
+        assert m.get_nested(settings, path) == (True, other), (name, settings)
+        assert name not in state["files"]["settings"]["keys"], name
+        # (c) no ledger entry at all (fresh install) -> untouched, and a fresh
+        #     install never creates one because the key is not managed any more.
+        for current in [last, other, MISSING]:
+            state, settings = call(current)
+            expected = (False, None) if current is MISSING else (True, current)
+            assert m.get_nested(settings, path) == expected, (name, current, settings)
+        # Type strictness, where a lookalike EXISTS. For the bool axis that is `0`
+        # (`0 == False` is True while `type(0) is not bool`) — NOT `1`, which is
+        # simply unequal to False and would pass the cell without the type guard
+        # ever being consulted. The string axis has no lookalike at all: no
+        # non-str value equals `"1"`, so equality alone already refuses and there
+        # is nothing for a type check to add. Asserted only where it can fail.
+        if last is False:
+            state, settings = call(0, led(True, last))
+            assert m.get_nested(settings, path) == (True, 0), (name, settings)
+
+cell(
+    "",
+    "#94 compaction keys relinquish across nested/string axes: restore, delete, operator-changed, fresh, type-strict",
+    compaction_cells,
+)
 sys.exit(failed)
 PY
 then ok "#71 retirement leaf: provenance, bool strictness, malformed refusal, one-shot convergence"
@@ -339,10 +402,12 @@ assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
 s=json.load(open(path))
 assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['value'] is False
 assert s['files']['settings']['keys']['cleanupPeriodDays']['original']['value'] == 30
-assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['value'] == '0'
 assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
 assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
-assert s['files']['settings']['keys']['autoCompactEnabled']['original']['existed'] is False
+# #94 case (c) — a FRESH install never captures a retired key, so entwurf holds no
+# ownership evidence for compaction and uninstall can never restore a suppression.
+assert 'autoCompactEnabled' not in s['files']['settings']['keys']
+assert 'env.DISABLE_AUTOCOMPACT' not in s['files']['settings']['keys']
 assert 'skipDangerousModePermissionPrompt' not in s['files']['settings']['keys']
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
 PY
@@ -360,6 +425,21 @@ state['files']['settings']['keys']['skipDangerousModePermissionPrompt']={
   'kind':'scalar', 'path':['skipDangerousModePermissionPrompt'],
   'original':{'existed':True, 'value':False}
 }
+# #94 — the same upgrade shape for the two compaction keys, planted at DRIVE level
+# so apply() itself is the subject, not the leaf. Two branches that the unit cells
+# cannot reach through the real ledger: a NESTED path whose original must come
+# back, and a key whose original never existed and must therefore be DELETED
+# rather than left carrying entwurf's value.
+settings['autoCompactEnabled']=False
+state['files']['settings']['keys']['autoCompactEnabled']={
+  'kind':'scalar', 'path':['autoCompactEnabled'],
+  'original':{'existed':False, 'value':None}
+}
+settings.setdefault('env',{})['DISABLE_AUTOCOMPACT']='1'
+state['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']={
+  'kind':'scalar', 'path':['env','DISABLE_AUTOCOMPACT'],
+  'original':{'existed':True, 'value':'0'}
+}
 json.dump(settings, open(sp,'w'), indent=2); open(sp,'a').write('\n')
 json.dump(state, open(stp,'w'), indent=2); open(stp,'a').write('\n')
 PY
@@ -373,14 +453,26 @@ assert settings['enabledPlugins']['entwurf-meta-receive@meta-bridge-local'] is T
 assert settings['enabledPlugins']['keep@user'] is True
 assert settings['extraKnownMarketplaces']['meta-bridge-local']['source']['path'] == os.environ['ASM']
 assert settings['cleanupPeriodDays'] == 365
-assert settings['env']['DISABLE_AUTOCOMPACT'] == '1'
+# #94 - retired: apply neither writes nor rewrites it. The fixture's operator
+# value ('0') survives untouched, and the scalar is never introduced at all.
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
+assert 'autoCompactEnabled' not in settings
 assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
-for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
+for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert settings[key] is False, key
 assert settings['skipDangerousModePermissionPrompt'] is False
+# #94 drive-level relinquishment, both branches:
+#   nested path  -> the operator's pre-entwurf '0' is back, and the env map that
+#                   carries it survives with the neighbour key untouched.
+#   absent original -> the key is REMOVED, not left holding entwurf's False.
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
+assert settings['env']['KEEP_ME'] == 'yes'
+assert 'autoCompactEnabled' not in settings
 state=json.load(open(cfg + '/entwurf.install-state.json'))
 assert 'skipDangerousModePermissionPrompt' not in state['files']['settings']['keys']
+assert 'autoCompactEnabled' not in state['files']['settings']['keys']
+assert 'env.DISABLE_AUTOCOMPACT' not in state['files']['settings']['keys']
 for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
     assert item in settings['permissions']['allow'], item
 assert settings['permissions']['allow'].count('Read') == 1
@@ -455,7 +547,6 @@ import json, os
 s=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'))
 assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['value'] is False
 assert s['files']['settings']['keys']['cleanupPeriodDays']['original']['value'] == 30
-assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['value'] == '0'
 assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
 assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
 PY
@@ -479,13 +570,18 @@ root=json.load(open(os.environ['HOME'] + '/.claude.json'))
 assert settings['cleanupPeriodDays'] == 30
 assert settings['enabledPlugins']['entwurf-meta-receive@meta-bridge-local'] is False
 assert 'meta-bridge-local' not in settings.get('extraKnownMarketplaces', {})
+# #94 - still the operator's '0'. NOT restored by uninstall (we never owned it):
+# never written in the first place.
 assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
 assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == '/old/user/statusline.sh'
 assert settings['promptSuggestionEnabled'] is True
 assert settings['skipDangerousModePermissionPrompt'] is False
 assert settings['showTurnDuration'] is True
-for key in ['awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
+# One list, one meaning: these are the keys UNINSTALL removed. `autoCompactEnabled`
+# is not among them post-#94 — that entwurf never introduced it is a different
+# claim, pinned on the post-install assertion above.
+for key in ['awaySummaryEnabled','autoMemoryEnabled','verbose','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert key not in settings, key
 allow=settings['permissions']['allow']
 deny=settings['permissions']['deny']
@@ -667,7 +763,8 @@ s=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
 assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['existed'] is False
 assert s['files']['settings']['keys']['extraKnownMarketplaces.meta-bridge-local']['original']['existed'] is False
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['existed'] is False
-assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['existed'] is True
+# #94 - retired: prepare captures no ownership evidence for it any more.
+assert 'env.DISABLE_AUTOCOMPACT' not in s['files']['settings']['keys']
 PY
 then ok "legacy exact plugin/marketplace/MCP migrate as pi-owned absent, policy keys remain user-owned"; else bad "legacy migration state check failed"; fi
 py uninstall >/dev/null
@@ -706,18 +803,80 @@ valid_record "20260606T000001-bbbbbb" "native-b" > "$STORE/20260606T000001-bbbbb
 STATUS_INPUT_MATCH='{"session_id":"native-a","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":2,"current_usage":{"input_tokens":10}}}'
 STATUS_INPUT_MISS='{"session_id":"native-missing","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-opus-5"}}'
 STATUS_INPUT_READY='{"workspace":{"current_dir":"/tmp"},"model":{"id":"claude-haiku-4-5"}}'
-STATUS_OUT_MATCH="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+# Pin the mailbox root on EVERY statusline render below, not just the badge cells: the
+# #98 B badge reads it, so an unpinned call would let the operator's real ~/.pi mailbox
+# decide whether these rows carry an envelope.
+MBX="$TMP/mbx"; mkdir -p "$MBX/20260606T000000-aaaaaa"
+STATUS_OUT_MATCH="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if [ "$(printf '%s\n' "$STATUS_OUT_MATCH" | wc -l | tr -d ' ')" = "2" ]; then ok "statusline renders exactly two rows"; else bad "statusline should render two rows: $STATUS_OUT_MATCH"; fi
 if printf '%s\n' "$STATUS_OUT_MATCH" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$STATUS_OUT_MATCH" | sed -n '2p' | grep -q '🪛 20260606T000000-aaaaaa cc | s'; then ok "statusline keeps row-1 work context and maps native session_id to row-2 garden-id"; else bad "statusline did not show expected two-row content for native-a: $STATUS_OUT_MATCH"; fi
-STATUS_OUT_MISS="$(printf '%s' "$STATUS_INPUT_MISS" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+STATUS_OUT_MISS="$(printf '%s' "$STATUS_INPUT_MISS" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if printf '%s' "$STATUS_OUT_MISS" | grep -q '🪛 ? cc'; then ok "statusline no-record fallback is ?"; else bad "statusline no-record fallback wrong: $STATUS_OUT_MISS"; fi
-STATUS_OUT_READY="$(printf '%s' "$STATUS_INPUT_READY" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+STATUS_OUT_READY="$(printf '%s' "$STATUS_INPUT_READY" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if printf '%s' "$STATUS_OUT_READY" | grep -q '🪛 ready cc'; then ok "statusline no-session_id fallback is ready"; else bad "statusline ready fallback wrong: $STATUS_OUT_READY"; fi
 cp "$STORE/20260606T000000-aaaaaa.meta.json" "$STORE/20260606T000003-dddddd.meta.json"
-STATUS_OUT_DUP="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+STATUS_OUT_DUP="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if printf '%s' "$STATUS_OUT_DUP" | grep -q '🪛 ! cc'; then ok "statusline duplicate nativeSessionId fallback is !"; else bad "statusline duplicate fallback wrong: $STATUS_OUT_DUP"; fi
 rm "$STORE/20260606T000003-dddddd.meta.json"
 
+# --- #98 B: the unread badge -------------------------------------------------
+# Three states that must LOOK different: N letters, none, and "could not count".
+# The last one is the whole reason the badge exists — an unread letter that the
+# operator never saw is exactly the failure #98 opened on, and a statusline that
+# renders a confident 0 when its read failed reproduces it one layer down.
+badge_line() { printf '%s' "$1" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh" | sed -n '2p'; }
+
+# empty mailbox -> NO badge. Silence is the quiet common case; the badge is for mail.
+B_EMPTY="$(badge_line "$STATUS_INPUT_MATCH")"
+if ! printf '%s' "$B_EMPTY" | grep -q '✉'; then ok "badge: empty mailbox draws no envelope"; else bad "badge: empty mailbox drew one: $B_EMPTY"; fi
+
+# The counted set is EXACTLY readMetaInbox's unread union: *.msg + *.msg.delivered.
+# The three decoys below must all be excluded: a .read (already drained — a badge that
+# counted it would never clear), the signal file, and state.json.
+: > "$MBX/20260606T000000-aaaaaa/one.msg"
+: > "$MBX/20260606T000000-aaaaaa/two.msg.delivered"
+: > "$MBX/20260606T000000-aaaaaa/three.msg.delivered.read"
+: > "$MBX/20260606T000000-aaaaaa/inbox.signal"
+: > "$MBX/20260606T000000-aaaaaa/state.json"
+B_TWO="$(badge_line "$STATUS_INPUT_MATCH")"
+if printf '%s' "$B_TWO" | grep -q '✉2'; then ok "badge: .msg + .msg.delivered counted, .read/signal/state excluded (✉2)"; else bad "badge: expected ✉2, got: $B_TWO"; fi
+
+# The drain clears it on the NEXT render — the property acceptance criterion 4 names.
+mv "$MBX/20260606T000000-aaaaaa/one.msg" "$MBX/20260606T000000-aaaaaa/one.msg.read"
+mv "$MBX/20260606T000000-aaaaaa/two.msg.delivered" "$MBX/20260606T000000-aaaaaa/two.msg.delivered.read"
+B_DRAINED="$(badge_line "$STATUS_INPUT_MATCH")"
+if ! printf '%s' "$B_DRAINED" | grep -q '✉'; then ok "badge: clears after the read archives both bodies to .read"; else bad "badge: stayed after drain: $B_DRAINED"; fi
+
+# Could-not-count #1: no garden id resolved, so there is no mailbox to look in. The
+# statusline must NOT quietly claim zero for a session it could not place.
+B_NOGARDEN="$(badge_line "$STATUS_INPUT_MISS")"
+if printf '%s' "$B_NOGARDEN" | grep -q '✉?'; then ok "badge: unresolved garden id renders ✉? (never a false zero)"; else bad "badge: unresolved garden id should be ✉?, got: $B_NOGARDEN"; fi
+
+# Could-not-count #2: the mailbox dir exists but cannot be read. Same rule.
+chmod 000 "$MBX/20260606T000000-aaaaaa"
+B_UNREADABLE="$(badge_line "$STATUS_INPUT_MATCH")"
+chmod 755 "$MBX/20260606T000000-aaaaaa"
+if printf '%s' "$B_UNREADABLE" | grep -q '✉?'; then ok "badge: unreadable mailbox renders ✉? (measurement failure, not zero)"; else bad "badge: unreadable mailbox should be ✉?, got: $B_UNREADABLE"; fi
+
+# Could-not-count #3: no python3 at all. That degrade path predates the badge and used
+# to print a bare `🪛 ? cc`; without the ✉? it would read as "counted, none".
+# The stand-in PATH carries `cat` and nothing else: the script reads its stdin with `cat`
+# BEFORE it tests for python3, so a truly empty PATH would kill it under `set -e` and the
+# cell would pass for the wrong reason.
+mkdir -p "$TMP/emptybin"
+ln -sf "$(command -v cat)" "$TMP/emptybin/cat"
+if [ -n "$(command -v python3 2>/dev/null)" ] && PATH="$TMP/emptybin" command -v python3 >/dev/null 2>&1; then bad "no-python3 fixture is not actually python3-less"; else ok "no-python3 fixture really hides python3"; fi
+# `$BASH` (an absolute path) rather than the name `bash`, so the interpreter is reachable
+# without putting a second binary on the stand-in PATH the fixture is trying to empty.
+B_NOPY="$(printf '%s' "$STATUS_INPUT_MATCH" | PATH="$TMP/emptybin" ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$BASH" "$REPO/scripts/meta-bridge-statusline.sh" | sed -n '2p')"
+if printf '%s' "$B_NOPY" | grep -q '✉?'; then ok "badge: python3-less degrade line still says ✉? (not a silent zero)"; else bad "badge: python3-less degrade should carry ✉?, got: $B_NOPY"; fi
+
+# A garden id that never renders a real mailbox: the pre-record "ready" state. Nothing
+# has been addressed to this session yet, so an empty badge is TRUE, not a guess.
+B_READY="$(badge_line "$STATUS_INPUT_READY")"
+if ! printf '%s' "$B_READY" | grep -q '✉'; then ok "badge: pre-record 'ready' draws no envelope (nothing addressed yet)"; else bad "badge: ready state drew an envelope: $B_READY"; fi
+rm -rf "$MBX"
+
 if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null; then ok "store doctor accepts valid records"; else bad "store doctor rejected valid records"; fi
 cp "$STORE/20260606T000000-aaaaaa.meta.json" "$STORE/20260606T000002-cccccc.meta.json"
 if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; then bad "store doctor missed body/filename drift + duplicate"; else ok "store doctor fails on body/filename drift and duplicate nativeSessionId"; fi

package/scripts/smoke-meta-keyset-guard.sh

@@ -31,7 +31,10 @@ d=json.load(sys.stdin)
 s=d['settings']
 assert 'statusLine' in s['map-entry'], 'statusLine missing from SSOT map-entry'
 assert 'permissions.allow' in s['array-items'] and 'permissions.deny' in s['array-items'], 'permissions missing'
-assert 'verbose' in s['scalar'] and 'autoCompactEnabled' in s['scalar'], 'scalar policy missing'
+assert 'verbose' in s['scalar'] and 'awaySummaryEnabled' in s['scalar'], 'scalar policy missing'
+# #94: the compaction keys are RETIRED, so managed-keys must NOT claim them.
+assert 'autoCompactEnabled' not in s['scalar'], 'retired compaction scalar still claimed as managed'
+assert 'env.DISABLE_AUTOCOMPACT' not in s['scalar'], 'retired compaction env scalar still claimed as managed'
 assert any(k.startswith('enabledPlugins.') for k in s['map-entry']), 'plugin ref missing'
 assert d['claudeRoot']['map-entry'] == ['mcpServers.entwurf-bridge'], 'MCP key missing'
 " && ok "managed-keys SSOT is valid JSON with the expected owned keys" \

package/scripts/smoke-mux-lifecycle-live.ts

@@ -213,6 +213,46 @@ function pidIsAlive(pid: number): boolean {
 	}
 }
 
+/**
+ * What the launched window actually shows, read at the moment a nonce callback never arrived.
+ *
+ * The launch receipt says so itself — "if it never comes, the window is visible and can be read
+ * directly" — but on a headless release-gate run nobody is there to look, and the window is torn
+ * down in teardown seconds later. So the harness looks for the operator: is the pane process even
+ * alive, and what is painted in it. That separates the three states a bare timeout collapses into
+ * one — the runtime never started (or died), it started and is sitting on an error or a prompt, or
+ * it is running fine and the model simply did not call the callback tool. A pi-native callback
+ * timeout with no window evidence is what blocked the second 0.17.0 `--cut` (and, in the same
+ * shape, a 0.16.1 run), leaving nothing to tell those three apart afterwards.
+ *
+ * Diagnostics must never become the failure: every step is best-effort, and a tmux that cannot
+ * answer is reported as its own line rather than thrown.
+ */
+function paneForensics(label: string, socket: string, env: NodeJS.ProcessEnv, coords: Coordinates): string {
+	const lines: string[] = [`--- ${label} window forensics (the callback never came) ---`];
+	try {
+		lines.push(`pane ${coords.paneId} pid ${coords.panePid}: ${pidIsAlive(Number(coords.panePid)) ? "ALIVE" : "GONE"}`);
+	} catch (err) {
+		lines.push(`pane pid liveness unreadable: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const panes = tmux(
+		socket,
+		["list-panes", "-a", "-F", "#{pane_id} #{pane_pid} #{pane_dead} #{pane_current_command}"],
+		env,
+	);
+	lines.push(
+		panes.status === 0 ? `list-panes:\n${panes.stdout || "(none)"}` : `list-panes failed (status ${panes.status})`,
+	);
+	const captured = tmux(socket, ["capture-pane", "-p", "-t", coords.paneId], env);
+	if (captured.status === 0) {
+		const tail = captured.stdout.split("\n").slice(-40).join("\n");
+		lines.push(`capture-pane (last 40 lines):\n${tail || "(the pane painted nothing)"}`);
+	} else {
+		lines.push(`capture-pane failed (status ${captured.status}) — the window is already gone`);
+	}
+	return lines.join("\n");
+}
+
 async function waitForPidsGone(pids: ReadonlySet<number>, timeoutMs = 10_000): Promise<boolean> {
 	const deadline = Date.now() + timeoutMs;
 	while (Date.now() < deadline) {
@@ -704,7 +744,9 @@ async function main(): Promise<void> {
 			ok(
 				`${cell}: the nonce came back and its SENDER ENVELOPE carries a garden id — correlation without asking the sibling`,
 				gid !== null && GARDEN_ID.test(gid),
-				`--- launch receipt ---\n${launch.text}`,
+				gid === null
+					? `--- launch receipt ---\n${launch.text}\n${paneForensics(cell, srv.socket, srv.env, coords)}`
+					: `--- launch receipt ---\n${launch.text}`,
 			);
 			const citizen = gid as string;
 			siblingGids.add(citizen);
@@ -936,7 +978,9 @@ async function main(): Promise<void> {
 			ok(
 				"claude-code: the nonce came back and its SENDER ENVELOPE carries a garden id",
 				ccGid !== null && GARDEN_ID.test(ccGid),
-				`--- launch receipt ---\n${ccLaunch.text}`,
+				ccGid === null
+					? `--- launch receipt ---\n${ccLaunch.text}\n${paneForensics("claude-code", cc.socket, cc.env, ccCoords)}`
+					: `--- launch receipt ---\n${ccLaunch.text}`,
 			);
 			const ccCitizen = ccGid as string;
 			siblingGids.add(ccCitizen);