@logicseek/hello-cc 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -16,6 +16,35 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.0.4
+
+### Summary
+
+Session lists no longer run synchronous tmux client probes for each displayed
+terminal. A bounded asynchronous snapshot supplies display information while
+live process and terminal observations continue to guard control actions.
+
+### Highlights
+
+- Share one short-lived tmux display snapshot across sessions. Cold, stale or
+  failed observations remain unknown, and pending probes stop with the runtime.
+- Preserve live checks for terminal control, rebind, stop and ownership.
+- Treat exited macOS zombie processes as dead, so shutdown waits can complete
+  while a parent has yet to reap the PID; malformed observations remain unknown.
+- Include the HTTP method, request path, deadline and elapsed time in runtime
+  request failures, without request bodies, query parameters or credentials.
+- Keep DeepSeek Harness on the existing npm `latest` channel.
+
+### Validation
+
+Targeted tests cover slow probes, stale and failed snapshots, refresh coalescing,
+shutdown and request diagnostics. Full regression, official installed Harness,
+registry readback and current-Mac model checks have separate verification records.
+The earlier 1.0.3 macOS CI timeout remains historical evidence: removing a known
+blocking path does not identify the specific cause of that earlier timeout.
+Regression shutdown tracks the exact fixture process identity, distinguishes
+reused PIDs and zombies, and retains bounded failure diagnostics before cleanup.
+
 ## 1.0.3
 
 ### Summary

package/docs/dsh.md

@@ -113,7 +113,7 @@ Project overlays work directly from source. The managed manifest records the Cor
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.3.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.4.tgz
 ```
 
 Harness requires explicit approval for native dependency builds. If add returns `ERR_PNPM_IGNORED_BUILDS`, merge the following into the selected profile's `pnpm-workspace.yaml` and rerun the same add command. The default path is `~/.dsh/profiles/web/pnpm-workspace.yaml`; use the configured DSH_HOME when different. Preserve existing settings and approve only the candidate's pinned native dependency:
@@ -123,7 +123,7 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. The 1.0.3 release uses the normal npm latest channel. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
+Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. Maintenance releases use the normal npm latest channel. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
 
 See Cordis/native acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`), bridge acceptance (source checkout: `docs/verification/2026-10-02-dsh-official-bridge.md`), and the integration plan (source checkout: `docs/plans/2026-10-02-dsh-integration.md`). Real-model checks used temporary projects and owned processes, without replacing existing user sessions. The isolated order fixture passed artifact/evidence/handoff/lock-release/task-completion checks. See the Mac device receipt (source checkout: `docs/verification/2026-10-02-dsh-device-install.md`). Publication, deployment, other-device installation and genuine business acceptance remain separate delivery stages.
 

package/docs/dsh.zh-CN.md

@@ -115,7 +115,7 @@ hcc native start --peer dsh-reviewer --provider dsh --binary /absolute/path/to/d
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.3.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.4.tgz
 ```
 
 Harness 的 pnpm 策略要求明确允许原生依赖构建。若首次 add 返回 `ERR_PNPM_IGNORED_BUILDS`，在所选 profile 的 `pnpm-workspace.yaml` 中合并以下配置，然后重跑同一 add 命令；默认位置是 `~/.dsh/profiles/web/pnpm-workspace.yaml`，自定义 DSH_HOME 时以该目录为准。保留文件中已有设置，只批准候选包使用的固定版本：
@@ -125,7 +125,7 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。1.0.3 沿用 npm latest 标签发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
+安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。后续维护版本沿用 npm latest 标签发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
 
 验证记录见 Cordis/native 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)、兼容桥记录 (源码目录: `docs/verification/2026-10-02-dsh-official-bridge.md`) 和详细接入计划 (源码目录: `docs/plans/2026-10-02-dsh-integration.md`)。真实模型验收在临时项目和自有进程中完成；既有会话与模型凭据保留；本机实际安装记录见 Mac 接入验收 (源码目录: `docs/verification/2026-10-02-dsh-device-install.md`)。Linux 容器已验证，实际 WSL/员工设备和真实业务签收尚未完成；隔离订单样例已完成报告、证据、交接、解锁与任务结束验证。
 

package/lib/process/identity.mjs

@@ -97,35 +97,52 @@ function parseMacBootToken(text) {
   return `${seconds}:${microseconds}`;
 }
 
-function macIdentity(pid) {
+function parseMacStateStart(text) {
+  const match = /^(\S+)\s+([^\r\n]+)$/.exec(String(text ?? '').trim());
+  // Darwin ps uses X only as a traced/debugged modifier; Z is its exit state.
+  if (!match || !/^[IRSTUZ][+<>AELNSsVWX]*$/.test(match[1])) return null;
+  return { state: match[1][0], startToken: match[2].trim() };
+}
+
+function macObservation(pid) {
+  const unknown = { state: 'unknown', identity: null };
   let boot = run('sysctl', ['-n', 'kern.boottime']);
   // Launchers often omit /usr/sbin from PATH; macOS still provides sysctl here.
   if (boot.error?.code === 'ENOENT') boot = run('/usr/sbin/sysctl', ['-n', 'kern.boottime']);
-  if (boot.error || boot.status !== 0) return null;
+  if (boot.error || boot.status !== 0) return unknown;
   const bootToken = parseMacBootToken(boot.stdout);
-  if (!bootToken) return null;
+  if (!bootToken) return unknown;
 
   const psEnvironment = { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' };
-  const started = run('ps', ['-p', String(pid), '-o', 'lstart='], psEnvironment);
+  // kill(pid, 0) also succeeds for an unreaped zombie on Darwin. Read state
+  // alongside each existing start-time probe, without adding subprocesses.
+  const started = run('ps', ['-p', String(pid), '-o', 'stat=', '-o', 'lstart='], psEnvironment);
+  const first = parseMacStateStart(started.stdout);
+  if (started.error || started.status !== 0 || !first) return unknown;
+  if (first.state === 'Z') return { state: 'dead', identity: null };
   const command = run('ps', ['-p', String(pid), '-o', 'command='], psEnvironment);
-  const confirmedStarted = run('ps', ['-p', String(pid), '-o', 'lstart='], psEnvironment);
-  if (started.error || command.error || confirmedStarted.error) return null;
-  if (started.status !== 0 ||
-      command.status !== 0 || confirmedStarted.status !== 0) return null;
+  const confirmedStarted = run('ps', ['-p', String(pid), '-o', 'stat=', '-o', 'lstart='], psEnvironment);
+  const last = parseMacStateStart(confirmedStarted.stdout);
+  if (confirmedStarted.error || confirmedStarted.status !== 0 || !last) return unknown;
+  if (last.state === 'Z') return { state: 'dead', identity: null };
+  if (command.error || command.status !== 0) return unknown;
 
   const commandOutput = String(command.stdout ?? '').trim();
   const parsed = parsePsStartIdentity(
-    `${String(started.stdout ?? '').trim()}\t${commandOutput}\n`
+    `${first.startToken}\t${commandOutput}\n`
   );
   const confirmed = parsePsStartIdentity(
-    `${String(confirmedStarted.stdout ?? '').trim()}\t${commandOutput}\n`
+    `${last.startToken}\t${commandOutput}\n`
   );
-  if (!parsed || !confirmed || confirmed.startToken !== parsed.startToken) return null;
+  if (!parsed || !confirmed || confirmed.startToken !== parsed.startToken) return unknown;
 
   return {
-    pid,
-    startToken: `${bootToken}:${parsed.startToken}`,
-    commandHash: hashCommand(parsed.command)
+    state: 'live',
+    identity: {
+      pid,
+      startToken: `${bootToken}:${parsed.startToken}`,
+      commandHash: hashCommand(parsed.command)
+    }
   };
 }
 
@@ -204,7 +221,11 @@ export function inspectProcessIdentity(value) {
       if (observed.state === 'dead') return observed;
       identity = observed.identity;
     }
-    else if (process.platform === 'darwin') identity = macIdentity(pid);
+    else if (process.platform === 'darwin') {
+      const observed = macObservation(pid);
+      if (observed.state === 'dead') return observed;
+      identity = observed.identity;
+    }
   } catch {
     identity = null;
   }

package/lib/runtime/client.mjs

@@ -2,6 +2,7 @@ import { CliError } from '../shared/errors.mjs';
 import { readRuntime } from './state.mjs';
 import { runtimeApiUrl, runtimeHttpRequest } from '../web/runtime.mjs';
 import { withRuntimeApiVersionHeader } from '../web/api-version.mjs';
+import { performance } from 'node:perf_hooks';
 
 const DEFAULT_CLI_NAME = 'hcc';
 export const RUNTIME_SESSION_START_TIMEOUT_MS = 60_000;
@@ -56,7 +57,9 @@ export async function runtimeRequest(ctx, method, route, body = null, runtime =
   let res;
   let text;
   const abortScope = requestAbortScope(opts.signal, opts.timeoutMs);
+  const startedAt = performance.now();
   try {
+    abortScope.signal.throwIfAborted();
     res = await waitForAbort(runtimeHttpRequest(rt, route, {
       method,
       headers,
@@ -68,7 +71,12 @@ export async function runtimeRequest(ctx, method, route, body = null, runtime =
   } catch (err) {
     throw new CliError('RUNTIME_UNREACHABLE', `Runtime is not reachable at ${rt.base_url}. Start ${cliName} web again.`, {
       runtime: rt.source || rt.base_url,
-      message: err.message
+      message: err.message,
+      method,
+      path: url.pathname,
+      elapsedMs: Math.round(performance.now() - startedAt),
+      timeoutMs: opts.timeoutMs === undefined ? 8000 : opts.timeoutMs,
+      errorName: err.name || 'Error'
     });
   } finally {
     abortScope.cleanup();

package/lib/web/runtime-main.mjs

@@ -123,6 +123,7 @@ import { createAutoAttach } from '../web/auto-attach.mjs';
 import { createPtySessions } from '../web/pty-sessions.mjs';
 import { createHttpRoutes } from '../web/http-routes.mjs';
 import { createSessionSerialize } from '../web/session-serialize.mjs';
+import { createTmuxClientSnapshot } from '../web/tmux-client-snapshot.mjs';
 import { createTmuxStream } from '../web/tmux-stream.mjs';
 import {
   ensureTmuxAvailable,
@@ -231,6 +232,7 @@ async function cmdWeb(ctx, args, startMeta = {}) {
   const { WebSocketServer } = await import('ws');
   const pty = ptyModule.default || ptyModule;
   const sessions = new Map();
+  const tmuxClientSnapshot = createTmuxClientSnapshot();
 
   const {
     sessionKey, sessionsForProject,
@@ -238,10 +240,7 @@ async function cmdWeb(ctx, args, startMeta = {}) {
     serializeBindingSummary, serializeSession,
     broadcast, hasOpenClients, closeSessionClients: closeSerializedSessionClients
   } = createSessionSerialize({ sessions, cookieSocketValid, ctx, sameResolvedPath,
-    localClientObservation: (session) => {
-      try { return tmuxClientObservation(tmuxSessionNameForPane(session.pane)); }
-      catch { return { state: 'unknown', count: null }; }
-    }
+    localClientObservation: tmuxClientSnapshot.observe
   });
   const controlLease = createControlLease({ broadcast: (session) => {
     for (const [actionToken, socket] of session.actionTokenSockets || []) {
@@ -638,6 +637,7 @@ const {
   let cleanupPromise = null;
   let shutdownExitCode = 0;
   async function performRuntimeCleanup() {
+    tmuxClientSnapshot.close();
     clearRuntime(ctx);
     // rob-07: clear this runtime's per-project pointers for every registered
     // project, not just the primary ctx, so sibling projects don't keep

package/lib/web/tmux-client-snapshot.mjs

@@ -0,0 +1,85 @@
+import { execFile } from 'node:child_process';
+import { performance } from 'node:perf_hooks';
+
+const UNKNOWN = Object.freeze({ state: 'unknown', count: null });
+const MAX_AGE_MS = 5_000;
+const REFRESH_AFTER_MS = 2_000;
+
+function parseSnapshot(stdout) {
+  const rows = new Map();
+  for (const line of String(stdout).split(/\r?\n/).filter(Boolean)) {
+    const match = /^(%\d+)\|(\$\d+)\|(\d+)$/.exec(line);
+    if (!match || !Number.isSafeInteger(Number(match[3]))) throw new Error('Invalid tmux client snapshot');
+    const [, pane, session, countText] = match;
+    const count = Number(countText);
+    const previous = rows.get(pane);
+    // Linked windows may repeat a pane within or across sessions. A display
+    // hint must not guess which session's local clients control that pane.
+    if (rows.has(pane) && (!previous || previous.session !== session || previous.count !== count)) {
+      rows.set(pane, null);
+    } else if (!rows.has(pane)) {
+      rows.set(pane, { session, count });
+    }
+  }
+  return rows;
+}
+
+// Display-only observations. Destructive actions must continue to query live
+// clients through strictTmuxClientObservation and verify their ownership.
+// One asynchronous read covers every pane; serialization never waits for tmux.
+export function createTmuxClientSnapshot({ run = execFile, now = () => performance.now() } = {}) {
+  let rows = new Map();
+  let observedAt = -Infinity;
+  let nextRefreshAt = -Infinity;
+  let pending = null;
+  let closed = false;
+
+  function refresh(at) {
+    if (closed || pending || at < nextRefreshAt) return;
+    const operation = { controller: new globalThis.AbortController() };
+    pending = operation;
+    nextRefreshAt = at + REFRESH_AFTER_MS;
+    const complete = (error, stdout) => {
+      if (pending !== operation) return;
+      pending = null;
+      if (closed || operation.controller.signal.aborted) return;
+      nextRefreshAt = now() + REFRESH_AFTER_MS;
+      try {
+        if (error) throw error;
+        rows = parseSnapshot(stdout);
+        observedAt = at;
+      } catch {
+        rows = new Map();
+        observedAt = -Infinity;
+      }
+    };
+    try {
+      run('tmux', ['list-panes', '-a', '-F', '#{pane_id}|#{session_id}|#{session_attached}'], {
+        encoding: 'utf8', timeout: 1_000, maxBuffer: 1024 * 1024,
+        signal: operation.controller.signal
+      }, complete);
+    } catch (error) {
+      complete(error);
+    }
+  }
+
+  function observe(session) {
+    if (closed || session?.type !== 'tmux' || !/^%\d+$/.test(session.pane || '')) return UNKNOWN;
+    const at = now();
+    refresh(at);
+    const row = rows.get(session.pane);
+    if (!row || at - observedAt >= MAX_AGE_MS) return UNKNOWN;
+    return { state: 'known', count: row.count };
+  }
+
+  function close() {
+    closed = true;
+    rows = new Map();
+    observedAt = -Infinity;
+    const operation = pending;
+    pending = null;
+    operation?.controller.abort();
+  }
+
+  return { observe, close };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {

package/scripts/regression.mjs

@@ -8,12 +8,14 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
+import { performance } from 'node:perf_hooks';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { DatabaseSync } from 'node:sqlite';
 import { Readable } from 'node:stream';
 import { pathToFileURL } from 'node:url';
 import WebSocket from 'ws';
-import { inspectProcessIdentity } from '../lib/process/identity.mjs';
+import { inspectProcessIdentity, compareProcessIdentity } from '../lib/process/identity.mjs';
+import { redactSecrets } from '../lib/shared/redact.mjs';
 import { applyBufferPlan, planBufferFiles } from '../lib/runtime/buffer-gc.mjs';
 
 const repoRoot = path.resolve(import.meta.dirname, '..');
@@ -29,14 +31,16 @@ const secondProjectRoot = path.join(root, 'second-project');
 const TERMINAL_WEBSOCKET_TIMEOUT_MS = 15_000;
 const realHome = process.env.HOME || os.homedir();
 const realRegistryFile = path.join(realHome, '.hello-cc', 'projects.json');
-const realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
-  encoding: 'utf8',
-  stdio: ['ignore', 'pipe', 'ignore']
-}).stdout.trim();
+let realTmuxBin = '';
 const port = 22000 + (process.pid % 10000);
 
 let tmuxStarted = false;
 let runtimePid = null;
+let runtimeOwner = null;
+let currentStage = 'startup';
+let lastStopDiagnostic = null;
+const diagnosticSecrets = new Set();
+const fixtureFailures = new WeakSet();
 const managedTmuxSessions = new Set();
 
 const env = {
@@ -53,18 +57,153 @@ delete env.TMUX;
 delete env.TMUX_PANE;
 
 function log(message) {
+  currentStage = String(message);
   process.stdout.write(`${message}\n`);
 }
 
 function fail(message) {
+  const error = fixtureFailureError(message);
   if (process.env.GITHUB_ACTIONS === 'true') {
-    const escaped = String(message)
+    const escaped = fixtureDiagnosticText({ stage: currentStage, failure: fixtureFailureDiagnostic(error) }, diagnosticSecrets)
       .replace(/%/g, '%25')
       .replace(/\r/g, '%0D')
       .replace(/\n/g, '%0A');
     process.stderr.write(`::error::${escaped}\n`);
   }
-  throw new Error(message);
+  throw error;
+}
+
+export function fixtureFailureError(message) {
+  const error = new Error(String(message));
+  Object.defineProperty(error, 'fixtureStack', {
+    value: Object.freeze(new Error('fixture failure').stack.split('\n').slice(1, 7))
+  });
+  fixtureFailures.add(error);
+  return error;
+}
+
+export function fixtureFailureDiagnostic(error) {
+  const names = ['Error', 'TypeError', 'RangeError', 'SyntaxError', 'AssertionError', 'AbortError'];
+  return {
+    name: names.includes(error?.name) ? error.name : 'Error',
+    stack: fixtureFailures.has(error)
+      ? error.fixtureStack
+      : new Error('regression failure handler').stack.split('\n').slice(1, 7)
+  };
+}
+
+export function fixtureDiagnosticText(value, secrets = []) {
+  function scrub(text) {
+    for (const secret of secrets) {
+      if (typeof secret === 'string' && secret.length >= 8) text = text.split(secret).join('[REDACTED]');
+    }
+    return redactSecrets(text)
+      .replace(/("(?:[^"\\]*token|authorization|cookie|[^"\\]*secret|password)"\s*:\s*)"(?:\\.|[^"\\])*"/gi, '$1"[REDACTED]"');
+  }
+  function visit(entry) {
+    if (typeof entry === 'string') return scrub(entry);
+    if (Array.isArray(entry)) return entry.map(visit);
+    if (entry && typeof entry === 'object') return Object.fromEntries(Object.entries(entry).map(([key, item]) => [key, visit(item)]));
+    return entry;
+  }
+  return typeof value === 'string' ? scrub(value) : JSON.stringify(visit(redactSecrets(value)));
+}
+
+function fixturePsState(pid) {
+  const result = spawnSync('ps', ['-p', String(pid), '-o', 'stat='], {
+    encoding: 'utf8', timeout: 1000, stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const state = String(result.stdout || '').trim();
+  return result.status === 0 && /^[A-Za-z+<>NslLWE-]{1,16}$/.test(state) ? state : null;
+}
+
+export function observeFixtureOwner(owner, { inspect = inspectProcessIdentity, psState = fixturePsState } = {}) {
+  if (compareProcessIdentity(owner, owner) !== 'live') return { state: 'unknown', reason: 'missing_owner_identity' };
+  const observed = inspect(owner.pid);
+  const state = psState(owner.pid);
+  const details = { pid: owner.pid, psState: state, observedState: observed.state };
+  if (observed.state === 'dead') return { ...details, state: 'exited', reason: 'process_dead' };
+  if (/^[ZX]/i.test(state || '')) return { ...details, state: 'exited', reason: 'zombie_or_dead' };
+  if (observed.state !== 'live' || compareProcessIdentity(observed.identity, observed.identity) !== 'live') {
+    return { ...details, state: 'unknown', reason: 'identity_unavailable' };
+  }
+  details.birthHash = crypto.createHash('sha256').update(observed.identity.startToken).digest('hex');
+  details.commandHash = observed.identity.commandHash;
+  if (compareProcessIdentity(owner, observed.identity) === 'dead') return { ...details, state: 'exited', reason: 'pid_reused' };
+  if (owner.commandHash !== observed.identity.commandHash) return { ...details, state: 'unknown', reason: 'command_changed' };
+  return { ...details, state: 'same-owner', reason: 'identity_match' };
+}
+
+export function signalFixtureOwner(owner, signal, { observe = observeFixtureOwner, send = process.kill.bind(process) } = {}) {
+  const observation = observe(owner);
+  if (observation.state !== 'same-owner') return { signal, sent: false, observation };
+  try { send(owner.pid, signal); return { signal, sent: true, observation }; }
+  catch (error) { return { signal, sent: false, observation, code: error.code || 'SIGNAL_FAILED' }; }
+}
+
+export async function waitForFixtureOwnerExit(owner, timeoutMs, {
+  observe = observeFixtureOwner, monotonicNow = () => performance.now(), wait = sleep
+} = {}) {
+  const deadline = monotonicNow() + timeoutMs;
+  for (;;) {
+    const observation = observe(owner);
+    if (observation.state === 'exited') return observation;
+    const remaining = deadline - monotonicNow();
+    if (remaining <= 0) {
+      const error = new Error('runtime fixture owner did not exit before deadline');
+      error.observation = observation;
+      throw error;
+    }
+    await wait(Math.min(100, remaining));
+  }
+}
+
+export function fixtureDownResult(result) {
+  let payload = null;
+  try { payload = JSON.parse(result.stdout || ''); } catch {}
+  const extra = payload?.error?.extra || payload?.error || {};
+  const code = payload?.error?.code || result.error?.code;
+  const numeric = ['pid', 'elapsedMs', 'timeoutMs'];
+  return {
+    status: Number.isSafeInteger(result.status) ? result.status : null,
+    signal: /^SIG[A-Z0-9]{1,12}$/.test(result.signal || '') ? result.signal : null,
+    code: typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? code : null,
+    extra: Object.fromEntries(numeric.filter(key => typeof extra[key] === 'number' &&
+      Number.isFinite(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]]))
+  };
+}
+
+export function fixtureStopEnvironment(base) {
+  const local = { ...base, HCC_RUNTIME_LOCAL_ONLY: '1' };
+  delete local.HCC_RUNTIME_URL;
+  delete local.HCC_RUNTIME_TOKEN;
+  return local;
+}
+
+function rememberRuntimePid(pid) {
+  runtimePid = pid;
+  runtimeOwner = null;
+  try {
+    const pointer = currentRuntime();
+    if (pointer.token) {
+      diagnosticSecrets.add(pointer.token);
+      for (const part of pointer.token.split(/\s+/)) if (part.length >= 8) diagnosticSecrets.add(part);
+    }
+    if (pointer.process_identity?.pid === pid && compareProcessIdentity(pointer.process_identity, pointer.process_identity) === 'live') {
+      runtimeOwner = { ...pointer.process_identity };
+    }
+  } catch {}
+}
+
+function collectRuntimeDiagnostic(extra = {}) {
+  const diagnostic = { stage: currentStage, pid: runtimePid,
+    owner: observeFixtureOwner(runtimeOwner), pointerExists: fs.existsSync(path.join(root, '.hello-cc', 'runtime.json')), ...extra };
+  try {
+    const db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { readOnly: true, timeout: 200 });
+    try { diagnostic.events = db.prepare('SELECT id, type FROM events ORDER BY id DESC LIMIT 12').all(); }
+    finally { db.close(); }
+  } catch {}
+  return fixtureDiagnosticText(diagnostic, diagnosticSecrets);
 }
 
 function commandText(command, args) {
@@ -1587,15 +1726,7 @@ function assertHtmlCsp(response, html, label) {
 }
 
 function processIsAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    // Linux keeps an exited child addressable until PID 1 reaps its zombie.
-    // Product liveness treats that state as dead, and the regression wait must
-    // use the same semantic boundary instead of waiting forever on kill(0).
-    return process.platform !== 'linux' || inspectProcessIdentity(pid).state !== 'dead';
-  } catch {
-    return false;
-  }
+  return inspectProcessIdentity(pid).state !== 'dead' && !/^[ZX]/i.test(fixturePsState(pid) || '');
 }
 
 async function waitForProcessExit(pid, label, timeoutMs = 5000) {
@@ -2546,7 +2677,7 @@ function startRuntime(options = {}) {
   const output = hcc(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance'], { env: runtimeEnv });
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`hcc web did not print background pid:\n${output}`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
   if (!output.includes('web started in background')) fail(`hcc web did not report background start:\n${output}`);
 }
 
@@ -2644,7 +2775,7 @@ async function webSecretRedactionWorkflow() {
   ]);
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`redaction web did not print background pid`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
 
   try {
     await waitRuntime();
@@ -2738,6 +2869,7 @@ async function assertWebWrapperParentSurvives() {
   const wrapperRoot = fs.mkdtempSync(path.join(os.tmpdir(), `hcc-reg-wrapper-root-${testId}-`));
   const wrapperPort = port + 101;
   let wrapperPid = null;
+  let wrapperOwner = null;
   try {
     const script = [
       'set -e',
@@ -2752,14 +2884,15 @@ async function assertWebWrapperParentSurvives() {
     if (!match) fail(`wrapper hcc web did not print background pid:\n${result.stdout}`);
     wrapperPid = Number.parseInt(match[1], 10);
     ensureFile(path.join(wrapperRoot, '.hello-cc', 'runtime.json'));
+    wrapperOwner = JSON.parse(fs.readFileSync(path.join(wrapperRoot, '.hello-cc', 'runtime.json'), 'utf8')).process_identity;
   } finally {
-    runMaybe(process.execPath, [hccBin, '--root', wrapperRoot, 'down'], { env });
+    runMaybe(process.execPath, [hccBin, '--root', wrapperRoot, 'down'], { env: fixtureStopEnvironment(env) });
     if (wrapperPid) {
       try {
-        await waitForProcessExit(wrapperPid, 'wrapper runtime process exit', 5000);
+        await waitForFixtureOwnerExit(wrapperOwner, 5000);
       } catch {
-        try { process.kill(wrapperPid, 'SIGTERM'); } catch {}
-        try { await waitForProcessExit(wrapperPid, 'wrapper runtime process exit after SIGTERM', 2000); } catch {}
+        signalFixtureOwner(wrapperOwner, 'SIGTERM');
+        try { await waitForFixtureOwnerExit(wrapperOwner, 2000); } catch {}
       }
     }
     try { fs.rmSync(wrapperRoot, { recursive: true, force: true }); } catch {}
@@ -2768,28 +2901,42 @@ async function assertWebWrapperParentSurvives() {
 
 async function stopRuntime() {
   if (!runtimePid) return;
-  const pid = runtimePid;
-  hccMaybe(['down']);
+  const owner = runtimeOwner;
+  const before = observeFixtureOwner(owner);
+  const down = fixtureDownResult(stopFixtureCli());
+  lastStopDiagnostic = { before, down, stack: new Error('stopRuntime').stack.split('\n').slice(1, 7), signals: [] };
   try {
-    await waitForProcessExit(pid, 'runtime process exit', 5000);
+    await waitForFixtureOwnerExit(owner, 5000);
   } catch (err) {
-    try { process.kill(pid, 'SIGTERM'); } catch {}
+    lastStopDiagnostic.atDeadline = collectRuntimeDiagnostic({ before, down });
+    lastStopDiagnostic.signals.push(signalFixtureOwner(owner, 'SIGTERM'));
     try {
-      await waitForProcessExit(pid, 'runtime process exit after SIGTERM', 2000);
+      await waitForFixtureOwnerExit(owner, 2000);
     } catch {
-      try { process.kill(pid, 'SIGKILL'); } catch {}
-      try { await waitForProcessExit(pid, 'runtime process exit after SIGKILL', 2000); } catch {}
-      throw err;
+      lastStopDiagnostic.signals.push(signalFixtureOwner(owner, 'SIGKILL'));
+      try { await waitForFixtureOwnerExit(owner, 2000); } catch {}
     }
+    fail(`runtime stop failed: ${collectRuntimeDiagnostic(lastStopDiagnostic)}`);
   }
+  if (down.status !== 0) fail(`runtime down command failed: ${collectRuntimeDiagnostic(lastStopDiagnostic)}`);
   runtimePid = null;
+  runtimeOwner = null;
+}
+
+function stopFixtureCli() {
+  try {
+    const pointer = currentRuntime();
+    if (compareProcessIdentity(runtimeOwner, pointer.process_identity) === 'live' &&
+        runtimeOwner.commandHash === pointer.process_identity.commandHash) {
+      return hccMaybe(['--json', 'down'], { env: fixtureStopEnvironment(env) });
+    }
+  } catch {}
+  return { status: null, error: { code: 'FIXTURE_OWNER_POINTER_UNAVAILABLE' } };
 }
 
 function cleanup() {
-  try { hccMaybe(['down']); } catch {}
-  if (runtimePid) {
-    try { process.kill(runtimePid, 'SIGTERM'); } catch {}
-  }
+  try { stopFixtureCli(); } catch {}
+  if (runtimePid) signalFixtureOwner(runtimeOwner, 'SIGTERM');
   const managedPrefixes = [
     tmuxManagedSessionPrefix(root),
     tmuxManagedSessionPrefix(secondProjectRoot)
@@ -2877,7 +3024,7 @@ async function setupRegression() {
   const output = hcc(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance']);
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`hcc web did not print background pid during bootstrap:\n${output}`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
   await waitRuntime();
   for (const file of liveBufferFiles) ensureFile(file);
   for (const file of liveBufferFiles) fs.rmSync(file, { force: true });
@@ -2957,7 +3104,7 @@ async function setupRegression() {
   const directTlsOutput = hcc(['web', '--local', '--tls', '--port', String(port), '--no-discover', '--no-guidance']);
   const directTlsMatch = directTlsOutput.match(/^pid:\s*(\d+)/m);
   if (!directTlsMatch) fail(`direct TLS web did not print background pid:\n${directTlsOutput}`);
-  runtimePid = Number.parseInt(directTlsMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(directTlsMatch[1], 10));
   await waitFor(async () => {
     const runtimeFile = path.join(root, '.hello-cc', 'runtime.json');
     if (!fs.existsSync(runtimeFile)) return false;
@@ -3016,7 +3163,7 @@ async function setupRegression() {
   const tokenOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const tokenMatch = tokenOutput.match(/^pid:\s*(\d+)/m);
   if (!tokenMatch) fail(`token web did not print background pid:\n${tokenOutput}`);
-  runtimePid = Number.parseInt(tokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(tokenMatch[1], 10));
   if (!tokenOutput.includes('token=') || !tokenOutput.includes('open: http://<machine-ip>:')) {
     fail(`default web output did not include remote token URL:\n${tokenOutput}`);
   }
@@ -3200,7 +3347,7 @@ async function setupRegression() {
   ]);
   const proxyPidMatch = proxyOutput.match(/^pid:\s*(\d+)/m);
   if (!proxyPidMatch) fail(`trusted-proxy web did not print background pid:\n${proxyOutput}`);
-  runtimePid = Number.parseInt(proxyPidMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(proxyPidMatch[1], 10));
   await waitRuntime();
   const proxyRuntime = currentRuntime();
   if (proxyRuntime.proxy_origin !== proxyOrigin || proxyRuntime.trust_proxy !== true) {
@@ -3286,7 +3433,7 @@ async function setupRegression() {
   ]);
   const restoredPidMatch = restoredOutput.match(/^pid:\s*(\d+)/m);
   if (!restoredPidMatch) fail(`post-proxy web did not print background pid:\n${restoredOutput}`);
-  runtimePid = Number.parseInt(restoredPidMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(restoredPidMatch[1], 10));
   await waitRuntime();
 
   const badJsonResponse = await runtimeFetch('/api/projects', {
@@ -3313,7 +3460,7 @@ async function setupRegression() {
   const stableTokenOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const stableTokenMatch = stableTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!stableTokenMatch) fail(`stable-token web did not print background pid:\n${stableTokenOutput}`);
-  runtimePid = Number.parseInt(stableTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(stableTokenMatch[1], 10));
   await waitRuntime();
   const stableTokenRuntime = currentRuntime();
   if (stableTokenRuntime.token === tokenRuntime.token) {
@@ -3327,7 +3474,7 @@ async function setupRegression() {
   });
   const fixedTokenMatch = fixedTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!fixedTokenMatch) fail(`fixed-token web did not print background pid:\n${fixedTokenOutput}`);
-  runtimePid = Number.parseInt(fixedTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(fixedTokenMatch[1], 10));
   await waitRuntime();
   const fixedTokenRuntime = currentRuntime();
   if (fixedTokenRuntime.token !== fixedToken || !fixedTokenOutput.includes(`token=${encodeURIComponent(fixedToken)}`)) {
@@ -3338,7 +3485,7 @@ async function setupRegression() {
   const postFixedOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const postFixedMatch = postFixedOutput.match(/^pid:\s*(\d+)/m);
   if (!postFixedMatch) fail(`post-fixed-token web did not print background pid:\n${postFixedOutput}`);
-  runtimePid = Number.parseInt(postFixedMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(postFixedMatch[1], 10));
   await waitRuntime();
   const postFixedRuntime = currentRuntime();
   if (postFixedRuntime.token === fixedToken || fs.existsSync(tokenFile)) {
@@ -3351,7 +3498,7 @@ async function setupRegression() {
   const noTokenOutput = hcc(['web', '--local', '--port', String(port), '--no-token', '--no-discover', '--no-guidance']);
   const noTokenMatch = noTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!noTokenMatch) fail(`explicit no-token web did not print background pid:\n${noTokenOutput}`);
-  runtimePid = Number.parseInt(noTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(noTokenMatch[1], 10));
   if (noTokenOutput.includes('token=')) {
     fail(`explicit no-token web output included token:\n${noTokenOutput}`);
   }
@@ -11158,11 +11305,16 @@ function gcCoverageWorkflow() {
 }
 
 async function main() {
+  realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
+  }).stdout.trim();
   process.once('SIGINT', () => { cleanup(); process.exit(130); });
   process.once('SIGTERM', () => { cleanup(); process.exit(143); });
 
   await setupRegression();
+  currentStage = 'webSecretRedactionWorkflow';
   await webSecretRedactionWorkflow();
+  currentStage = 'cookieSessionExpiryWorkflow';
   await cookieSessionExpiryWorkflow();
   log('[2/13] runtime');
   startRuntime();
@@ -11194,12 +11346,18 @@ async function main() {
   log('FULL_REGRESSION_OK');
 }
 
-main().catch((err) => {
+if (process.argv[1] && path.resolve(process.argv[1]) === import.meta.filename) main().catch((err) => {
+  const failure = fixtureFailureDiagnostic(err);
+  const diagnostic = collectRuntimeDiagnostic({ failure, stop: lastStopDiagnostic });
+  process.stderr.write(`[regression failure diagnostic] ${diagnostic}\n`);
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    process.stderr.write(`::error::${diagnostic.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A')}\n`);
+  }
   try { assertNoRealProjectRegistryLeak(); } catch (leakErr) {
-    process.stderr.write(`${leakErr.stack || leakErr.message}\n`);
+    process.stderr.write(`${fixtureDiagnosticText(leakErr.stack || leakErr.message, diagnosticSecrets)}\n`);
   }
   cleanup();
-  process.stderr.write(`${err.stack || err.message}\n`);
+  process.stderr.write(`${fixtureDiagnosticText(err.stack || err.message, diagnosticSecrets)}\n`);
   process.exit(1);
 }).finally(() => {
   try {