@logicseek/hello-cc 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -16,6 +16,70 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.0.5
+
+### Summary
+
+macOS process identities use the kernel boot session UUID so changes to the
+reported boot time cannot make a running process appear to have been replaced.
+The issue was observed during post-release sustained acceptance of 1.0.4.
+
+### Highlights
+
+- Preserve process identity across changes to the wall-clock-derived boot time.
+- Keep live processes with an older Darwin identity format protected while their
+  ownership cannot be compared; a format change does not prove that an owner exited.
+- Retain strict process state, start time and zombie checks, with unknown results
+  when a stable boot session identifier cannot be read.
+- Keep the existing npm `latest` release channel.
+- Confirm the original local runtime has exited when its stop response is lost,
+  while preserving unknown owners and replacement runtime pointers.
+- Retain structured shutdown error codes when Node warnings share stderr.
+
+### Validation
+
+Targeted regression tests cover boot identity drift, boot-session changes,
+malformed observations and conservative handling of existing runtime ownership.
+Full source, package, current-device and sustained-run validation are recorded
+separately. The interrupted 1.0.4 sustained run remains a failed attempt.
+The first 1.0.5 candidate passed the current-Mac sustained check; a subsequent
+CI transport timeout exposed the separate stop-confirmation failure. Its
+targeted verification and replacement candidate retain separate evidence.
+
+Existing processes keep the implementation they started with. Quit and reopen
+Harness normally to activate the update. An older active owned runtime should
+finish and stop normally before it is reclaimed; do not force takeover based
+on an incompatible identity marker.
+
+## 1.0.4
+
+### Summary
+
+Session lists no longer run synchronous tmux client probes for each displayed
+terminal. A bounded asynchronous snapshot supplies display information while
+live process and terminal observations continue to guard control actions.
+
+### Highlights
+
+- Share one short-lived tmux display snapshot across sessions. Cold, stale or
+  failed observations remain unknown, and pending probes stop with the runtime.
+- Preserve live checks for terminal control, rebind, stop and ownership.
+- Treat exited macOS zombie processes as dead, so shutdown waits can complete
+  while a parent has yet to reap the PID; malformed observations remain unknown.
+- Include the HTTP method, request path, deadline and elapsed time in runtime
+  request failures, without request bodies, query parameters or credentials.
+- Keep DeepSeek Harness on the existing npm `latest` channel.
+
+### Validation
+
+Targeted tests cover slow probes, stale and failed snapshots, refresh coalescing,
+shutdown and request diagnostics. Full regression, official installed Harness,
+registry readback and current-Mac model checks have separate verification records.
+The earlier 1.0.3 macOS CI timeout remains historical evidence: removing a known
+blocking path does not identify the specific cause of that earlier timeout.
+Regression shutdown tracks the exact fixture process identity, distinguishes
+reused PIDs and zombies, and retains bounded failure diagnostics before cleanup.
+
 ## 1.0.3
 
 ### Summary

package/docs/dsh.md

@@ -18,6 +18,8 @@ node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh web -- -
 
 Below, `hcc` means a CLI containing these changes. An older global installation may not include them.
 
+macOS 1.0.5 upgrades use a stable boot-session identity. Follow the [process identity migration notes](macos-process-identity.md) and restart owned runtimes normally.
+
 ## Choose An Entry Point
 
 | Entry | Use | Lifecycle owner |
@@ -113,7 +115,7 @@ Project overlays work directly from source. The managed manifest records the Cor
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.3.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.5.tgz
 ```
 
 Harness requires explicit approval for native dependency builds. If add returns `ERR_PNPM_IGNORED_BUILDS`, merge the following into the selected profile's `pnpm-workspace.yaml` and rerun the same add command. The default path is `~/.dsh/profiles/web/pnpm-workspace.yaml`; use the configured DSH_HOME when different. Preserve existing settings and approve only the candidate's pinned native dependency:
@@ -123,7 +125,7 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. The 1.0.3 release uses the normal npm latest channel. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
+Harness selects bundles through the profile's `dsh.profile.bundles`; do not also load the project Cordis/hooks overlay. Actual npm installation, official add/repeated add/remove, profile resolution and real-model collaboration calls have passed. The actual macOS desktop profile was installed and hot-loaded on 2026-10-02. Its paired ACP worker completed real collaboration calls using the existing DeepSeek route. The initially configured desktop sub2api model returned HTTP 403 because that account only accepts official Codex clients. After the desktop default was observed to have changed to official DeepSeek, a new session completed hcc_state, hcc_message_send and a real completed turn with that existing selection. The original sub2api route restriction remains. Maintenance releases use the normal npm latest channel. Harness manages profile package removal; project-overlay integration is disabled with `setup --mode off`.
 
 See Cordis/native acceptance (source checkout: `docs/verification/2026-10-02-dsh-cordis-native.md`), bridge acceptance (source checkout: `docs/verification/2026-10-02-dsh-official-bridge.md`), and the integration plan (source checkout: `docs/plans/2026-10-02-dsh-integration.md`). Real-model checks used temporary projects and owned processes, without replacing existing user sessions. The isolated order fixture passed artifact/evidence/handoff/lock-release/task-completion checks. See the Mac device receipt (source checkout: `docs/verification/2026-10-02-dsh-device-install.md`). Publication, deployment, other-device installation and genuine business acceptance remain separate delivery stages.
 

package/docs/dsh.zh-CN.md

@@ -18,6 +18,8 @@ node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh web -- -
 
 下文 `hcc` 指包含这些代码的 CLI。已有的全局 `hcc` 未必包含此接入。
 
+macOS 从 1.0.5 起使用稳定的启动周期标记。升级时按[进程身份迁移说明](macos-process-identity.md)正常重启所管理的运行时，保留身份无法比较的旧进程。
+
 ## 选择入口
 
 | 入口 | 适用场景 | 会话由谁持有 |
@@ -115,7 +117,7 @@ hcc native start --peer dsh-reviewer --provider dsh --binary /absolute/path/to/d
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.3.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.5.tgz
 ```
 
 Harness 的 pnpm 策略要求明确允许原生依赖构建。若首次 add 返回 `ERR_PNPM_IGNORED_BUILDS`，在所选 profile 的 `pnpm-workspace.yaml` 中合并以下配置，然后重跑同一 add 命令；默认位置是 `~/.dsh/profiles/web/pnpm-workspace.yaml`，自定义 DSH_HOME 时以该目录为准。保留文件中已有设置，只批准候选包使用的固定版本：
@@ -125,7 +127,7 @@ allowBuilds:
   node-pty@1.2.0-beta.15: true
 ```
 
-安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。1.0.3 沿用 npm latest 标签发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
+安装后由 Harness profile 的 `dsh.profile.bundles` 选择包；不要再同时加载项目 Cordis/hooks overlay。bundle 已通过实际 npm 安装、官方 add/重复 add/remove、隔离 profile 加载和真实模型工具调用。2026-10-02 已安装到本机真实 desktop profile 并热加载，配套 ACP 使用既有 DeepSeek 路由完成真实工具调用；初次桌面 sub2api 模型返回账户仅允许 Codex 官方客户端的 403；随后桌面默认模型已变为官方 DeepSeek，沿用当时配置的新建会话完成 hcc_state、hcc_message_send 和真实 completed 回合。原 sub2api 路由限制仍存在。后续维护版本沿用 npm latest 标签发布。profile 插件安装/移除由 Harness 管理，项目 overlay 则使用 `setup --mode off` 关闭。
 
 验证记录见 Cordis/native 验收 (源码目录: `docs/verification/2026-10-02-dsh-cordis-native.md`)、兼容桥记录 (源码目录: `docs/verification/2026-10-02-dsh-official-bridge.md`) 和详细接入计划 (源码目录: `docs/plans/2026-10-02-dsh-integration.md`)。真实模型验收在临时项目和自有进程中完成；既有会话与模型凭据保留；本机实际安装记录见 Mac 接入验收 (源码目录: `docs/verification/2026-10-02-dsh-device-install.md`)。Linux 容器已验证，实际 WSL/员工设备和真实业务签收尚未完成；隔离订单样例已完成报告、证据、交接、解锁与任务结束验证。
 

package/docs/macos-process-identity.md

@@ -0,0 +1,13 @@
+# macOS 进程身份与升级
+
+macOS 的 `kern.boottime` 是墙上时钟时间，同一次开机期间也可能因时钟校正改变。以它的秒、微秒字段识别进程，会把仍在运行的进程误判为新实例。
+
+Darwin 身份改为 `darwin:<kern.bootsessionuuid>:<UTC/C ps lstart>`。开机 UUID 严格验证并统一小写；缺失、查询失败或格式错误时返回 `unknown`，不会退回 `kern.boottime`。进程开始时间仍前后读取两次，状态中的 zombie 仍视为已退出。PID、进程开始时间和命令摘要的所有权校验没有放宽。
+
+旧版本保存的 `<boot 秒>:<boot 微秒>:<ps lstart>` 无法可靠转换成新标记。对同一存活 PID，旧、新格式之间返回 `unknown`，既不授予所有权，也不证明旧进程已经退出。其 runtime 指针不因超过普通未知状态宽限期而被回收；Cordis 恢复和 native 启动也必须保留仍存活的旧 owner。与真实进程退出或同格式 PID 复用有关的判定保持原有规则。
+
+这种专用 `unknown` 同样保留 peer/binding、过期锁和缓冲文件，阻止过期任务被接管；它不会赋予 `live` 身份、续租或写权限。普通未知状态的超时策略不变。
+
+升级前，先用原版本正常关闭所属 native worker/runtime，正常退出 Harness Desktop，再安装并启动新版本，使运行中的 owner 重新建立身份。保留账号配置、会话与协作数据库；不要手工改写旧身份、删除仍存活 runtime 的指针，或仅凭 PID 强行接管。若旧进程已经退出，OS 的死亡证据仍允许正常恢复。没有完整身份的其他未知状态继续使用原有策略。
+
+回归覆盖同一次开机期间 `kern.boottime` 漂移、不同 boot UUID、错误和缺失 UUID、PATH 缺失时的固定系统路径、语言环境、PID 复用、exec、真实自有 zombie，以及跨格式 runtime 指针、native 启动和 Cordis 恢复边界。

package/lib/cli/app.mjs

@@ -54,7 +54,8 @@ import { readPackageMeta } from '../package-meta.mjs';
 import { removeGuidanceBlocks as removeGuidanceBlocksForRoot, writeGuidance as writeGuidanceForRoot } from '../guidance.mjs';
 import { globalRuntimePath, runtimePath } from '../runtime/paths.mjs';
 import { readRuntime, reclaimRuntimePointerFiles } from '../runtime/state.mjs';
-import { waitForProcessIdentityExit } from '../process/identity.mjs';
+import { waitForProcessIdentityExit, inspectProcessIdentity, compareProcessIdentity } from '../process/identity.mjs';
+import { withFileLock } from '../shared/file-lock.mjs';
 
 import { runtimeRequest } from '../runtime/client.mjs';
 
@@ -319,7 +320,7 @@ const { cmdDown, cmdFindRoot, cmdWhichReal } = createMiscCommands({
   path, fs, process, CliError, parseOpts, printResult,
   readRuntime, runtimeRequest, runtimePath, globalRuntimePath,
   reclaimRuntimePointerFiles, helpDown, loadSetup,
-  waitForProcessIdentityExit,
+  waitForProcessIdentityExit, inspectProcessIdentity, compareProcessIdentity, withFileLock,
   PRODUCT_NAME
 });
 

package/lib/cli/commands/lock.mjs

@@ -2,6 +2,7 @@
 // Factory pattern with injected deps.
 
 import { readTx } from '../../db/schema.mjs';
+import { isPeerEvidenceCompatibilityProtected } from '../../core/peers/evidence.mjs';
 import {
   findRequestedLock,
   upsertRequestedLock,
@@ -101,7 +102,8 @@ export function createLockCommands(deps) {
                 !(Number(row.expires_at) <= t && evidenceByOwner.get(row.owner)?.state === 'dead'))
             : subject.locks.filter((row) =>
                 Number(row.expires_at) > t ||
-                evidenceByOwner.get(row.owner)?.state === 'live'
+                evidenceByOwner.get(row.owner)?.state === 'live' ||
+                isPeerEvidenceCompatibilityProtected(evidenceByOwner.get(row.owner))
               );
           const conflict = activeLocks.find((row) => locksConflict(row, requested) && row.owner !== peer);
           if (conflict) {

package/lib/cli/commands/misc.mjs

@@ -2,13 +2,56 @@
 
 export function createMiscCommands(deps) {
   const {
-    path, process, CliError, parseOpts, printResult,
+    path, fs, process, CliError, parseOpts, printResult,
     readRuntime, runtimeRequest, runtimePath, globalRuntimePath,
     reclaimRuntimePointerFiles, helpDown, loadSetup,
-    waitForProcessIdentityExit,
+    waitForProcessIdentityExit, inspectProcessIdentity, compareProcessIdentity, withFileLock,
     PRODUCT_NAME
   } = deps;
 
+  function sameStopPointer(left, right) {
+    return left.raw === right.raw && ['dev', 'ino', 'size', 'mtimeMs', 'ctimeMs']
+      .every((key) => left.stat[key] === right.stat[key]);
+  }
+
+  function readStopPointer(file) {
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error('invalid runtime pointer');
+    const raw = fs.readFileSync(file, 'utf8');
+    const current = fs.lstatSync(file);
+    if (current.isSymbolicLink() || !current.isFile() ||
+        !sameStopPointer({ raw, stat }, { raw, stat: current })) {
+      throw new Error('runtime pointer changed');
+    }
+    return { raw, stat };
+  }
+
+  function stopOwnerEvidence(runtime, pointerFiles) {
+    try {
+      if (runtime.source === 'env') return null;
+      const source = pointerFiles.find((file) => path.resolve(file) === path.resolve(runtime.source || ''));
+      const url = new URL(runtime.base_url);
+      if (!source || !['http:', 'https:'].includes(url.protocol) ||
+          !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)) return null;
+      const owner = runtime.process_identity || runtime.processIdentity;
+      if (Object.hasOwn(runtime, 'process_identity') && Object.hasOwn(runtime, 'processIdentity')) return null;
+      if (owner?.pid !== Number(runtime.pid) || compareProcessIdentity(owner, owner) !== 'live') return null;
+      const observed = inspectProcessIdentity(owner.pid);
+      if (observed.state !== 'live' || compareProcessIdentity(owner, observed.identity) !== 'live' ||
+          owner.commandHash !== observed.identity.commandHash) return null;
+      const pointer = readStopPointer(source);
+      const recorded = JSON.parse(pointer.raw);
+      if (Object.hasOwn(recorded, 'process_identity') && Object.hasOwn(recorded, 'processIdentity')) return null;
+      const recordedOwner = recorded.process_identity || recorded.processIdentity;
+      if (Number(recorded.pid) !== owner.pid ||
+          compareProcessIdentity(owner, recordedOwner) !== 'live' || owner.commandHash !== recordedOwner.commandHash ||
+          ['base_url', 'token', 'tls_ca_file'].some((key) => recorded[key] !== runtime[key])) return null;
+      return { source, owner, pointer };
+    } catch {
+      return null;
+    }
+  }
+
   async function cmdDown(ctx, args) {
     if (args[0] === '--help' || args[0] === '-h') return helpDown();
     const pointerFiles = [runtimePath(ctx), globalRuntimePath()];
@@ -23,17 +66,39 @@ export function createMiscCommands(deps) {
         `${PRODUCT_NAME} stale runtime pointer removed${result.pointers === 1 ? '' : 's'}`);
       return;
     }
+    const stopEvidence = stopOwnerEvidence(runtime, pointerFiles);
     try {
       await runtimeRequest(ctx, 'POST', '/api/runtime/stop', {}, runtime);
     } catch (err) {
       if (!(err instanceof CliError && err.code === 'RUNTIME_UNREACHABLE')) throw err;
-      if (runtime.source === 'env') throw err;
-      const source = path.resolve(String(runtime.source || ''));
-      const localSource = pointerFiles.find((file) => path.resolve(file) === source);
-      if (!localSource) throw err;
-      const cleanup = reclaimRuntimePointerFiles([localSource], { reclaimUnknown: false });
-      if (cleanup.reclaimed !== 1 || cleanup.blocked) throw err;
-      printResult(ctx, { runtime: localSource }, () => `${PRODUCT_NAME} stale runtime pointer removed`);
+      if (!stopEvidence) throw err;
+      const stopped = await waitForProcessIdentityExit(stopEvidence.owner, {
+        timeoutMs: 5_000,
+        intervalMs: 25
+      });
+      if (stopped.state !== 'dead') throw err;
+      let cleanup;
+      try {
+        cleanup = withFileLock(stopEvidence.source, (file) => {
+          let current;
+          try { current = readStopPointer(file); }
+          catch (error) {
+            if (error.code === 'ENOENT') return { reclaimed: 0, blocked: false };
+            throw error;
+          }
+          if (!sameStopPointer(stopEvidence.pointer, current)) throw err;
+          // Hold the pointer's existing lock across comparison and reclamation.
+          // A replacement owner must never be removed by this stop request.
+          return reclaimRuntimePointerFiles([file], {
+            reclaimUnknown: false,
+            withLock: (_file, operation) => operation(file)
+          });
+        }, { createParent: false });
+      } catch { throw err; }
+      if (cleanup.blocked || cleanup.reclaimed > 1) throw err;
+      printResult(ctx, { runtime: stopEvidence.source }, () => cleanup.reclaimed === 1
+        ? `${PRODUCT_NAME} stale runtime pointer removed`
+        : `${PRODUCT_NAME} runtime stopped`);
       return;
     }
     if (runtime.source !== 'env') {

package/lib/core/coordination/gc-plan.mjs

@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { readTx, tx } from '../../db/schema.mjs';
 import { aggregateCleanupFailure } from '../../shared/cleanup-error.mjs';
+import { isPeerEvidenceCompatibilityProtected } from '../peers/evidence.mjs';
 import { DURABLE_RUNTIME_EVENTS } from './event-retention.mjs';
 
 export const HISTORY_GC_BATCH_SIZE = 256;
@@ -59,6 +60,10 @@ export function finalizeGcLockSubjects(db, subjects, evidenceByOwner, options =
         result.live += 1;
         continue;
       }
+      if (isPeerEvidenceCompatibilityProtected(evidenceByOwner.get(owner))) {
+        result.deferred += 1;
+        continue;
+      }
       if (dryRun || deleteExactRow(db, 'locks', planned.lock)) result.deleted += 1;
       else result.deferred += 1;
     }

package/lib/core/coordination/locks.mjs

@@ -1,4 +1,5 @@
 import { CliError } from '../../shared/errors.mjs';
+import { isPeerEvidenceCompatibilityProtected } from '../peers/evidence.mjs';
 
 export const WHOLE_LOCK_SCOPE = '*';
 
@@ -87,5 +88,6 @@ export function visibleLocksWithEvidence(locks, nowSec, {
   evidenceByOwner = new Map()
 } = {}) {
   return (locks || []).filter((lock) => graceActive || Number(lock.expires_at) > nowSec ||
-    evidenceByOwner.get(lock.owner)?.state === 'live');
+    evidenceByOwner.get(lock.owner)?.state === 'live' ||
+    isPeerEvidenceCompatibilityProtected(evidenceByOwner.get(lock.owner)));
 }

package/lib/core/peers/evidence.mjs

@@ -1,18 +1,26 @@
-import { compareProcessIdentity } from '../../process/identity.mjs';
+import { compareProcessIdentity, isProcessIdentityIncompatible } from '../../process/identity.mjs';
 
 const DEFAULT_ACTIVE_PEER_TTL = 600;
+const INCOMPATIBLE_PROCESS_REASON = 'process_identity_incompatible';
+
+export function isPeerEvidenceCompatibilityProtected(evidence = {}) {
+  return evidence.state === 'unknown' && evidence.reason === INCOMPATIBLE_PROCESS_REASON;
+}
 
 export function classifyPeerActivity(peer = {}, options = {}) {
   const activePeerTtl = Number(options.activePeerTtl ?? DEFAULT_ACTIVE_PEER_TTL);
   const graceActive = Boolean(options.graceActive);
   const evidenceState = peer.evidence_state || peer.evidence?.state || 'unknown';
+  const evidenceReason = peer.evidence_reason || peer.evidence?.reason;
   const age = Number(peer.age_sec);
   const active = evidenceState === 'live' ||
+    isPeerEvidenceCompatibilityProtected({ state: evidenceState, reason: evidenceReason }) ||
     (evidenceState !== 'dead' && (graceActive || (Number.isFinite(age) && age <= activePeerTtl)));
   return { active, stale: !active };
 }
 
 export function peerEvidenceAllowsReap(evidence = {}, options = {}) {
+  if (isPeerEvidenceCompatibilityProtected(evidence)) return false;
   if (evidence.state === 'dead') return true;
   if (evidence.state !== 'unknown') return false;
   const nowSec = Number(options.nowSec);
@@ -37,6 +45,9 @@ function processState(evidence) {
   if (evidence.current?.state === 'unknown') return 'unknown';
   if (evidence.current?.state === 'dead') return 'dead';
   if (evidence.current?.state !== 'live') return 'unknown';
+  if (isProcessIdentityIncompatible(evidence.storedIdentity, evidence.current.identity)) {
+    return 'incompatible';
+  }
   return compareProcessIdentity(evidence.storedIdentity, evidence.current.identity);
 }
 
@@ -48,6 +59,9 @@ function aggregateProcesses(processes) {
   if (states.includes('live')) {
     return { state: 'live', reason: 'process_identity_match' };
   }
+  if (states.includes('incompatible')) {
+    return { state: 'unknown', reason: INCOMPATIBLE_PROCESS_REASON };
+  }
   if (states.every((state) => state === 'dead')) {
     const missing = processes.every((item) => item?.current?.state === 'dead');
     return {
@@ -81,8 +95,14 @@ function tmuxVerifiedLive(tmux) {
 export function resolvePeerEvidence(input = {}) {
   const ordinaryProcess = aggregateProcesses(input.processes);
   if (ordinaryProcess.state === 'live') return ordinaryProcess;
+  // A live PID with incomparable Darwin generations proves neither ownership
+  // nor exit. Retain that distinction through persisted status and TTL gates.
+  if (isPeerEvidenceCompatibilityProtected(ordinaryProcess)) return ordinaryProcess;
 
   const tmux = input.tmux?.managed ? input.tmux : null;
+  if (ordinaryProcess.state === 'unknown' && tmux && tmuxProcessState(tmux) === 'incompatible') {
+    return { state: 'unknown', reason: INCOMPATIBLE_PROCESS_REASON };
+  }
   if (ordinaryProcess.state === 'unknown' && tmux && tmuxVerifiedLive(tmux)) {
     return { state: 'live', reason: 'tmux_identity_match' };
   }

package/lib/core/peers/tmux-safety.mjs

@@ -1,6 +1,7 @@
 import { compareProcessIdentity } from '../../process/identity.mjs';
 import { tx } from '../../db/schema.mjs';
 import { CliError } from '../../shared/errors.mjs';
+import { isPeerEvidenceCompatibilityProtected } from './evidence.mjs';
 
 function completeIdentity(identity) {
   return Boolean(
@@ -84,6 +85,9 @@ export function validateTmuxGcBindingEvidence(subject = {}, observed = {}, optio
   if (subject.owner_evidence?.state === 'live') {
     return { ok: false, reason: 'tmux_owner_process_live' };
   }
+  if (isPeerEvidenceCompatibilityProtected(subject.owner_evidence)) {
+    return { ok: false, reason: 'tmux_owner_process_incompatible' };
+  }
 
   const dead = validateTmuxGcDeadProcessEvidence(authority, observed, options);
   if (dead.ok) return { ok: true, mode: 'dead_process' };

package/lib/integrations/dsh-collaboration.mjs

@@ -16,7 +16,7 @@ import { createCoordinationState } from '../coordination-state.mjs';
 import { createScopedMcpTools } from '../mcp/tools.mjs';
 import { resolveProjectDatabase } from '../runtime/project-path.mjs';
 import { registerProjectActivity } from '../runtime/projects.mjs';
-import { inspectProcessIdentity } from '../process/identity.mjs';
+import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
 
 const fail = (message) => { throw new CliError('DSH_COLLABORATION_CONFLICT', message); };
 
@@ -29,9 +29,8 @@ function verifiedDeadOwner(peer) {
   // A recycled PID has a different start token. A changed command alone does
   // not prove the original process exited (a live process may change its title).
   return observed.state === 'live' && observed.identity?.pid === peer.pid &&
-    typeof observed.identity.startToken === 'string' &&
-    typeof observed.identity.commandHash === 'string' && /^[a-f0-9]{64}$/.test(observed.identity.commandHash) &&
-    observed.identity.startToken !== peer.pid_start_token;
+    compareProcessIdentity({ pid: peer.pid, startToken: peer.pid_start_token,
+      commandHash: peer.pid_command_hash }, observed.identity) === 'dead';
 }
 
 // One in-process authority per Agent. All mutations still go through the same

package/lib/process/identity.mjs

@@ -84,48 +84,70 @@ function run(command, args, environment) {
   return spawnSync(command, args, options);
 }
 
+const MAC_BOOT_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
 function parseMacBootToken(text) {
-  const match = String(text ?? '').match(
-    /^\s*\{\s*sec\s*=\s*(\d+)\s*,\s*usec\s*=\s*(\d+)\s*\}/
-  );
-  if (!match) return null;
+  const uuid = String(text ?? '').trim();
+  return MAC_BOOT_UUID.test(uuid) ? uuid.toLowerCase() : null;
+}
 
-  const seconds = BigInt(match[1]);
-  const microseconds = Number(match[2]);
-  if (seconds <= 0n || !Number.isInteger(microseconds) ||
-      microseconds < 0 || microseconds > 999999) return null;
-  return `${seconds}:${microseconds}`;
+function macTokenFormat(token) {
+  const start = '(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) [A-Z][a-z]{2}\\s+\\d{1,2} \\d{2}:\\d{2}:\\d{2} \\d{4}';
+  const legacy = new RegExp(`^(\\d+):(\\d+):${start}$`).exec(token);
+  if (legacy && BigInt(legacy[1]) > 0n && Number(legacy[2]) >= 0 && Number(legacy[2]) <= 999999) return 'legacy-wall-clock';
+  const current = /^darwin:([^:]+):(.+)$/.exec(token);
+  if (current && MAC_BOOT_UUID.test(current[1]) && new RegExp(`^${start}$`).test(current[2])) return 'boot-session';
+  return null;
 }
 
-function macIdentity(pid) {
-  let boot = run('sysctl', ['-n', 'kern.boottime']);
+function parseMacStateStart(text) {
+  const match = /^(\S+)\s+([^\r\n]+)$/.exec(String(text ?? '').trim());
+  // Darwin ps uses X only as a traced/debugged modifier; Z is its exit state.
+  if (!match || !/^[IRSTUZ][+<>AELNSsVWX]*$/.test(match[1])) return null;
+  return { state: match[1][0], startToken: match[2].trim() };
+}
+
+function macObservation(pid) {
+  const unknown = { state: 'unknown', identity: null };
+  // kern.boottime is a wall-clock timestamp and can change during one boot.
+  // The boot-session UUID remains stable across those clock corrections.
+  let boot = run('sysctl', ['-n', 'kern.bootsessionuuid']);
   // Launchers often omit /usr/sbin from PATH; macOS still provides sysctl here.
-  if (boot.error?.code === 'ENOENT') boot = run('/usr/sbin/sysctl', ['-n', 'kern.boottime']);
-  if (boot.error || boot.status !== 0) return null;
+  if (boot.error?.code === 'ENOENT') boot = run('/usr/sbin/sysctl', ['-n', 'kern.bootsessionuuid']);
+  if (boot.error || boot.status !== 0) return unknown;
   const bootToken = parseMacBootToken(boot.stdout);
-  if (!bootToken) return null;
+  if (!bootToken) return unknown;
 
   const psEnvironment = { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' };
-  const started = run('ps', ['-p', String(pid), '-o', 'lstart='], psEnvironment);
+  // kill(pid, 0) also succeeds for an unreaped zombie on Darwin. Read state
+  // alongside each existing start-time probe, without adding subprocesses.
+  const started = run('ps', ['-p', String(pid), '-o', 'stat=', '-o', 'lstart='], psEnvironment);
+  const first = parseMacStateStart(started.stdout);
+  if (started.error || started.status !== 0 || !first) return unknown;
+  if (first.state === 'Z') return { state: 'dead', identity: null };
   const command = run('ps', ['-p', String(pid), '-o', 'command='], psEnvironment);
-  const confirmedStarted = run('ps', ['-p', String(pid), '-o', 'lstart='], psEnvironment);
-  if (started.error || command.error || confirmedStarted.error) return null;
-  if (started.status !== 0 ||
-      command.status !== 0 || confirmedStarted.status !== 0) return null;
+  const confirmedStarted = run('ps', ['-p', String(pid), '-o', 'stat=', '-o', 'lstart='], psEnvironment);
+  const last = parseMacStateStart(confirmedStarted.stdout);
+  if (confirmedStarted.error || confirmedStarted.status !== 0 || !last) return unknown;
+  if (last.state === 'Z') return { state: 'dead', identity: null };
+  if (command.error || command.status !== 0) return unknown;
 
   const commandOutput = String(command.stdout ?? '').trim();
   const parsed = parsePsStartIdentity(
-    `${String(started.stdout ?? '').trim()}\t${commandOutput}\n`
+    `${first.startToken}\t${commandOutput}\n`
   );
   const confirmed = parsePsStartIdentity(
-    `${String(confirmedStarted.stdout ?? '').trim()}\t${commandOutput}\n`
+    `${last.startToken}\t${commandOutput}\n`
   );
-  if (!parsed || !confirmed || confirmed.startToken !== parsed.startToken) return null;
+  if (!parsed || !confirmed || confirmed.startToken !== parsed.startToken) return unknown;
 
   return {
-    pid,
-    startToken: `${bootToken}:${parsed.startToken}`,
-    commandHash: hashCommand(parsed.command)
+    state: 'live',
+    identity: {
+      pid,
+      startToken: `darwin:${bootToken}:${parsed.startToken}`,
+      commandHash: hashCommand(parsed.command)
+    }
   };
 }
 
@@ -170,10 +192,9 @@ export async function waitForProcessIdentityExit(value, options = {}) {
     const observed = inspect(pid);
     if (observed?.state === 'dead') return { state: 'dead', identity: null };
     if (observed?.state === 'live' && isCompleteIdentity(observed.identity)) {
-      if (storedIdentity && compareProcessIdentity(storedIdentity, observed.identity) === 'dead') {
-        return { state: 'dead', identity: null };
-      }
-      lastObservation = observed;
+      const comparison = storedIdentity ? compareProcessIdentity(storedIdentity, observed.identity) : 'live';
+      if (comparison === 'dead') return { state: 'dead', identity: null };
+      lastObservation = comparison === 'live' ? observed : { state: 'unknown', identity: null };
     } else {
       lastObservation = { state: 'unknown', identity: null };
     }
@@ -204,7 +225,11 @@ export function inspectProcessIdentity(value) {
       if (observed.state === 'dead') return observed;
       identity = observed.identity;
     }
-    else if (process.platform === 'darwin') identity = macIdentity(pid);
+    else if (process.platform === 'darwin') {
+      const observed = macObservation(pid);
+      if (observed.state === 'dead') return observed;
+      identity = observed.identity;
+    }
   } catch {
     identity = null;
   }
@@ -217,8 +242,19 @@ export function inspectProcessIdentity(value) {
   return { state: 'live', identity };
 }
 
+export function isProcessIdentityIncompatible(stored, current) {
+  if (!isCompleteIdentity(stored) || !isCompleteIdentity(current) || stored.pid !== current.pid) return false;
+  const storedFormat = macTokenFormat(stored.startToken), currentFormat = macTokenFormat(current.startToken);
+  return Boolean(storedFormat && currentFormat && storedFormat !== currentFormat);
+}
+
 export function compareProcessIdentity(stored, current) {
   if (!isCompleteIdentity(stored) || !isCompleteIdentity(current)) return 'unknown';
-  return stored.pid === current.pid &&
-    stored.startToken === current.startToken ? 'live' : 'dead';
+  if (stored.pid !== current.pid) return 'dead';
+  if (stored.startToken === current.startToken) return 'live';
+  // An upgrade cannot translate wall-clock boot evidence to a boot UUID.
+  // Preserve a still-present legacy owner until it exits normally; a format
+  // change proves neither ownership nor process exit.
+  if (isProcessIdentityIncompatible(stored, current)) return 'unknown';
+  return 'dead';
 }

package/lib/runtime/buffer-evidence.mjs

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { performance } from 'node:perf_hooks';
 
-import { resolvePeerEvidence } from '../core/peers/evidence.mjs';
+import { isPeerEvidenceCompatibilityProtected, resolvePeerEvidence } from '../core/peers/evidence.mjs';
 import { inspectProcessIdentity } from '../process/identity.mjs';
 
 function canonicalDirectories(values) {
@@ -261,6 +261,9 @@ export function collectBufferEvidence({
       if (evidence.state === 'live') {
         recordKnownEvidence(unknownTracker, file, 'live', monotonicNowMs);
         addExternalGroup(protectedPaths, directory, id);
+      } else if (isPeerEvidenceCompatibilityProtected(evidence)) {
+        recordKnownEvidence(unknownTracker, file, 'incompatible', monotonicNowMs);
+        addExternalGroup(protectedPaths, directory, id);
       } else if (evidence.state === 'unknown' &&
           boundedUnknown(file, { nowMs, monotonicNowMs, unknownGraceMs, unknownTracker, gcCutoffs })) {
         addExternalGroup(unknownPaths, directory, id);
@@ -302,6 +305,9 @@ export function collectBufferEvidence({
         if (evidence.state === 'live') {
           recordKnownEvidence(unknownTracker, file, 'live', monotonicNowMs);
           protectedPaths.add(file);
+        } else if (isPeerEvidenceCompatibilityProtected(evidence)) {
+          recordKnownEvidence(unknownTracker, file, 'incompatible', monotonicNowMs);
+          protectedPaths.add(file);
         } else if (evidence.state === 'unknown' &&
             boundedUnknown(file, { nowMs, monotonicNowMs, unknownGraceMs, unknownTracker, gcCutoffs })) {
           unknownPaths.add(file);

package/lib/runtime/client.mjs

@@ -2,6 +2,7 @@ import { CliError } from '../shared/errors.mjs';
 import { readRuntime } from './state.mjs';
 import { runtimeApiUrl, runtimeHttpRequest } from '../web/runtime.mjs';
 import { withRuntimeApiVersionHeader } from '../web/api-version.mjs';
+import { performance } from 'node:perf_hooks';
 
 const DEFAULT_CLI_NAME = 'hcc';
 export const RUNTIME_SESSION_START_TIMEOUT_MS = 60_000;
@@ -56,7 +57,9 @@ export async function runtimeRequest(ctx, method, route, body = null, runtime =
   let res;
   let text;
   const abortScope = requestAbortScope(opts.signal, opts.timeoutMs);
+  const startedAt = performance.now();
   try {
+    abortScope.signal.throwIfAborted();
     res = await waitForAbort(runtimeHttpRequest(rt, route, {
       method,
       headers,
@@ -68,7 +71,12 @@ export async function runtimeRequest(ctx, method, route, body = null, runtime =
   } catch (err) {
     throw new CliError('RUNTIME_UNREACHABLE', `Runtime is not reachable at ${rt.base_url}. Start ${cliName} web again.`, {
       runtime: rt.source || rt.base_url,
-      message: err.message
+      message: err.message,
+      method,
+      path: url.pathname,
+      elapsedMs: Math.round(performance.now() - startedAt),
+      timeoutMs: opts.timeoutMs === undefined ? 8000 : opts.timeoutMs,
+      errorName: err.name || 'Error'
     });
   } finally {
     abortScope.cleanup();

package/lib/runtime/state.mjs

@@ -50,7 +50,11 @@ export function classifyRuntimePointer(runtime, {
   if (current?.state !== 'live' || !completeProcessIdentity(current.identity)) {
     return { state: 'unknown', reclaimable: ageMs >= unknownGraceMs };
   }
-  return compareProcessIdentity(stored, current.identity) === 'live'
+  const comparison = compareProcessIdentity(stored, current.identity);
+  // A live PID observed with an incompatible identity format is not an aged
+  // missing/unknown owner. In particular, do not reap a pre-upgrade Mac owner.
+  if (comparison === 'unknown') return { state: 'unknown', reclaimable: false };
+  return comparison === 'live'
     ? { state: 'alive', reclaimable: false }
     : { state: 'dead', reclaimable: true };
 }

package/lib/web/runtime-main.mjs

@@ -123,6 +123,7 @@ import { createAutoAttach } from '../web/auto-attach.mjs';
 import { createPtySessions } from '../web/pty-sessions.mjs';
 import { createHttpRoutes } from '../web/http-routes.mjs';
 import { createSessionSerialize } from '../web/session-serialize.mjs';
+import { createTmuxClientSnapshot } from '../web/tmux-client-snapshot.mjs';
 import { createTmuxStream } from '../web/tmux-stream.mjs';
 import {
   ensureTmuxAvailable,
@@ -231,6 +232,7 @@ async function cmdWeb(ctx, args, startMeta = {}) {
   const { WebSocketServer } = await import('ws');
   const pty = ptyModule.default || ptyModule;
   const sessions = new Map();
+  const tmuxClientSnapshot = createTmuxClientSnapshot();
 
   const {
     sessionKey, sessionsForProject,
@@ -238,10 +240,7 @@ async function cmdWeb(ctx, args, startMeta = {}) {
     serializeBindingSummary, serializeSession,
     broadcast, hasOpenClients, closeSessionClients: closeSerializedSessionClients
   } = createSessionSerialize({ sessions, cookieSocketValid, ctx, sameResolvedPath,
-    localClientObservation: (session) => {
-      try { return tmuxClientObservation(tmuxSessionNameForPane(session.pane)); }
-      catch { return { state: 'unknown', count: null }; }
-    }
+    localClientObservation: tmuxClientSnapshot.observe
   });
   const controlLease = createControlLease({ broadcast: (session) => {
     for (const [actionToken, socket] of session.actionTokenSockets || []) {
@@ -638,6 +637,7 @@ const {
   let cleanupPromise = null;
   let shutdownExitCode = 0;
   async function performRuntimeCleanup() {
+    tmuxClientSnapshot.close();
     clearRuntime(ctx);
     // rob-07: clear this runtime's per-project pointers for every registered
     // project, not just the primary ctx, so sibling projects don't keep

package/lib/web/tmux-client-snapshot.mjs

@@ -0,0 +1,85 @@
+import { execFile } from 'node:child_process';
+import { performance } from 'node:perf_hooks';
+
+const UNKNOWN = Object.freeze({ state: 'unknown', count: null });
+const MAX_AGE_MS = 5_000;
+const REFRESH_AFTER_MS = 2_000;
+
+function parseSnapshot(stdout) {
+  const rows = new Map();
+  for (const line of String(stdout).split(/\r?\n/).filter(Boolean)) {
+    const match = /^(%\d+)\|(\$\d+)\|(\d+)$/.exec(line);
+    if (!match || !Number.isSafeInteger(Number(match[3]))) throw new Error('Invalid tmux client snapshot');
+    const [, pane, session, countText] = match;
+    const count = Number(countText);
+    const previous = rows.get(pane);
+    // Linked windows may repeat a pane within or across sessions. A display
+    // hint must not guess which session's local clients control that pane.
+    if (rows.has(pane) && (!previous || previous.session !== session || previous.count !== count)) {
+      rows.set(pane, null);
+    } else if (!rows.has(pane)) {
+      rows.set(pane, { session, count });
+    }
+  }
+  return rows;
+}
+
+// Display-only observations. Destructive actions must continue to query live
+// clients through strictTmuxClientObservation and verify their ownership.
+// One asynchronous read covers every pane; serialization never waits for tmux.
+export function createTmuxClientSnapshot({ run = execFile, now = () => performance.now() } = {}) {
+  let rows = new Map();
+  let observedAt = -Infinity;
+  let nextRefreshAt = -Infinity;
+  let pending = null;
+  let closed = false;
+
+  function refresh(at) {
+    if (closed || pending || at < nextRefreshAt) return;
+    const operation = { controller: new globalThis.AbortController() };
+    pending = operation;
+    nextRefreshAt = at + REFRESH_AFTER_MS;
+    const complete = (error, stdout) => {
+      if (pending !== operation) return;
+      pending = null;
+      if (closed || operation.controller.signal.aborted) return;
+      nextRefreshAt = now() + REFRESH_AFTER_MS;
+      try {
+        if (error) throw error;
+        rows = parseSnapshot(stdout);
+        observedAt = at;
+      } catch {
+        rows = new Map();
+        observedAt = -Infinity;
+      }
+    };
+    try {
+      run('tmux', ['list-panes', '-a', '-F', '#{pane_id}|#{session_id}|#{session_attached}'], {
+        encoding: 'utf8', timeout: 1_000, maxBuffer: 1024 * 1024,
+        signal: operation.controller.signal
+      }, complete);
+    } catch (error) {
+      complete(error);
+    }
+  }
+
+  function observe(session) {
+    if (closed || session?.type !== 'tmux' || !/^%\d+$/.test(session.pane || '')) return UNKNOWN;
+    const at = now();
+    refresh(at);
+    const row = rows.get(session.pane);
+    if (!row || at - observedAt >= MAX_AGE_MS) return UNKNOWN;
+    return { state: 'known', count: row.count };
+  }
+
+  function close() {
+    closed = true;
+    rows = new Map();
+    observedAt = -Infinity;
+    const operation = pending;
+    pending = null;
+    operation?.controller.abort();
+  }
+
+  return { observe, close };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {

package/scripts/regression.mjs

@@ -8,12 +8,14 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
+import { performance } from 'node:perf_hooks';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { DatabaseSync } from 'node:sqlite';
 import { Readable } from 'node:stream';
 import { pathToFileURL } from 'node:url';
 import WebSocket from 'ws';
-import { inspectProcessIdentity } from '../lib/process/identity.mjs';
+import { inspectProcessIdentity, compareProcessIdentity } from '../lib/process/identity.mjs';
+import { redactSecrets } from '../lib/shared/redact.mjs';
 import { applyBufferPlan, planBufferFiles } from '../lib/runtime/buffer-gc.mjs';
 
 const repoRoot = path.resolve(import.meta.dirname, '..');
@@ -29,14 +31,16 @@ const secondProjectRoot = path.join(root, 'second-project');
 const TERMINAL_WEBSOCKET_TIMEOUT_MS = 15_000;
 const realHome = process.env.HOME || os.homedir();
 const realRegistryFile = path.join(realHome, '.hello-cc', 'projects.json');
-const realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
-  encoding: 'utf8',
-  stdio: ['ignore', 'pipe', 'ignore']
-}).stdout.trim();
+let realTmuxBin = '';
 const port = 22000 + (process.pid % 10000);
 
 let tmuxStarted = false;
 let runtimePid = null;
+let runtimeOwner = null;
+let currentStage = 'startup';
+let lastStopDiagnostic = null;
+const diagnosticSecrets = new Set();
+const fixtureFailures = new WeakSet();
 const managedTmuxSessions = new Set();
 
 const env = {
@@ -53,18 +57,194 @@ delete env.TMUX;
 delete env.TMUX_PANE;
 
 function log(message) {
+  currentStage = String(message);
   process.stdout.write(`${message}\n`);
 }
 
 function fail(message) {
+  const error = fixtureFailureError(message);
   if (process.env.GITHUB_ACTIONS === 'true') {
-    const escaped = String(message)
+    const escaped = fixtureDiagnosticText({ stage: currentStage, failure: fixtureFailureDiagnostic(error) }, diagnosticSecrets)
       .replace(/%/g, '%25')
       .replace(/\r/g, '%0D')
       .replace(/\n/g, '%0A');
     process.stderr.write(`::error::${escaped}\n`);
   }
-  throw new Error(message);
+  throw error;
+}
+
+export function fixtureFailureError(message) {
+  const error = new Error(String(message));
+  Object.defineProperty(error, 'fixtureStack', {
+    value: Object.freeze(new Error('fixture failure').stack.split('\n').slice(1, 7))
+  });
+  fixtureFailures.add(error);
+  return error;
+}
+
+export function fixtureFailureDiagnostic(error) {
+  const names = ['Error', 'TypeError', 'RangeError', 'SyntaxError', 'AssertionError', 'AbortError'];
+  return {
+    name: names.includes(error?.name) ? error.name : 'Error',
+    stack: fixtureFailures.has(error)
+      ? error.fixtureStack
+      : new Error('regression failure handler').stack.split('\n').slice(1, 7)
+  };
+}
+
+export function fixtureDiagnosticText(value, secrets = []) {
+  function scrub(text) {
+    for (const secret of secrets) {
+      if (typeof secret === 'string' && secret.length >= 8) text = text.split(secret).join('[REDACTED]');
+    }
+    return redactSecrets(text)
+      .replace(/("(?:[^"\\]*token|authorization|cookie|[^"\\]*secret|password)"\s*:\s*)"(?:\\.|[^"\\])*"/gi, '$1"[REDACTED]"');
+  }
+  function visit(entry) {
+    if (typeof entry === 'string') return scrub(entry);
+    if (Array.isArray(entry)) return entry.map(visit);
+    if (entry && typeof entry === 'object') return Object.fromEntries(Object.entries(entry).map(([key, item]) => [key, visit(item)]));
+    return entry;
+  }
+  return typeof value === 'string' ? scrub(value) : JSON.stringify(visit(redactSecrets(value)));
+}
+
+function fixturePsState(pid) {
+  const result = spawnSync('ps', ['-p', String(pid), '-o', 'stat='], {
+    encoding: 'utf8', timeout: 1000, stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const state = String(result.stdout || '').trim();
+  return result.status === 0 && /^[A-Za-z+<>NslLWE-]{1,16}$/.test(state) ? state : null;
+}
+
+export function observeFixtureOwner(owner, { inspect = inspectProcessIdentity, psState = fixturePsState } = {}) {
+  if (compareProcessIdentity(owner, owner) !== 'live') return { state: 'unknown', reason: 'missing_owner_identity' };
+  const observed = inspect(owner.pid);
+  const state = psState(owner.pid);
+  const details = { pid: owner.pid, psState: state, observedState: observed.state };
+  if (observed.state === 'dead') return { ...details, state: 'exited', reason: 'process_dead' };
+  if (/^[ZX]/i.test(state || '')) return { ...details, state: 'exited', reason: 'zombie_or_dead' };
+  if (observed.state !== 'live' || compareProcessIdentity(observed.identity, observed.identity) !== 'live') {
+    return { ...details, state: 'unknown', reason: 'identity_unavailable' };
+  }
+  details.birthHash = crypto.createHash('sha256').update(observed.identity.startToken).digest('hex');
+  details.commandHash = observed.identity.commandHash;
+  if (compareProcessIdentity(owner, observed.identity) === 'dead') return { ...details, state: 'exited', reason: 'pid_reused' };
+  if (owner.commandHash !== observed.identity.commandHash) return { ...details, state: 'unknown', reason: 'command_changed' };
+  return { ...details, state: 'same-owner', reason: 'identity_match' };
+}
+
+export function signalFixtureOwner(owner, signal, { observe = observeFixtureOwner, send = process.kill.bind(process) } = {}) {
+  const observation = observe(owner);
+  if (observation.state !== 'same-owner') return { signal, sent: false, observation };
+  try { send(owner.pid, signal); return { signal, sent: true, observation }; }
+  catch (error) { return { signal, sent: false, observation, code: error.code || 'SIGNAL_FAILED' }; }
+}
+
+export async function waitForFixtureOwnerExit(owner, timeoutMs, {
+  observe = observeFixtureOwner, monotonicNow = () => performance.now(), wait = sleep
+} = {}) {
+  const deadline = monotonicNow() + timeoutMs;
+  for (;;) {
+    const observation = observe(owner);
+    if (observation.state === 'exited') return observation;
+    const remaining = deadline - monotonicNow();
+    if (remaining <= 0) {
+      const error = new Error('runtime fixture owner did not exit before deadline');
+      error.observation = observation;
+      throw error;
+    }
+    await wait(Math.min(100, remaining));
+  }
+}
+
+function fixtureErrorPayload(output) {
+  const lines = String(output || '').split(/\r?\n/);
+  let start = null, standalone = false, quoted = false, escaped = false;
+  const stack = [];
+  for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+    const line = lines[lineIndex];
+    for (let offset = 0; offset < line.length; offset += 1) {
+      const char = line[offset];
+      if (start === null) {
+        if (char !== '{' && char !== '[') continue;
+        start = lineIndex;
+        standalone = line.slice(0, offset).trim() === '';
+      }
+      if (quoted) {
+        if (escaped) escaped = false;
+        else if (char === '\\') escaped = true;
+        else if (char === '"') quoted = false;
+        continue;
+      }
+      if (char === '"') quoted = true;
+      else if (char === '{' || char === '[') stack.push(char);
+      else if (char === '}' || char === ']') {
+        if (stack.pop() !== (char === '}' ? '{' : '[')) return null;
+        if (stack.length) continue;
+        // Consume arrays and prefixed JSON blocks as a unit, so their nested
+        // objects can never masquerade as independent CLI error documents.
+        if (standalone && line.slice(offset + 1).trim() === '') {
+          try {
+            const parsed = JSON.parse(lines.slice(start, lineIndex + 1).join('\n'));
+            if (parsed && !Array.isArray(parsed) && parsed.error &&
+                typeof parsed.error === 'object' && !Array.isArray(parsed.error)) return parsed;
+          } catch {}
+        }
+        start = null;
+      }
+    }
+  }
+  return null;
+}
+
+export function fixtureDownResult(result) {
+  // Public --json failures share stderr with Node warnings. Accept only whole
+  // independent JSON objects; ordinary output never enters the diagnostic.
+  const payload = fixtureErrorPayload(result.stdout) || fixtureErrorPayload(result.stderr);
+  const extra = payload?.error?.extra || payload?.error || {};
+  const code = payload?.error?.code || result.error?.code;
+  const numeric = ['pid', 'elapsedMs', 'timeoutMs'];
+  return {
+    status: Number.isSafeInteger(result.status) ? result.status : null,
+    signal: /^SIG[A-Z0-9]{1,12}$/.test(result.signal || '') ? result.signal : null,
+    code: typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? code : null,
+    extra: Object.fromEntries(numeric.filter(key => typeof extra[key] === 'number' &&
+      Number.isFinite(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]]))
+  };
+}
+
+export function fixtureStopEnvironment(base) {
+  const local = { ...base, HCC_RUNTIME_LOCAL_ONLY: '1' };
+  delete local.HCC_RUNTIME_URL;
+  delete local.HCC_RUNTIME_TOKEN;
+  return local;
+}
+
+function rememberRuntimePid(pid) {
+  runtimePid = pid;
+  runtimeOwner = null;
+  try {
+    const pointer = currentRuntime();
+    if (pointer.token) {
+      diagnosticSecrets.add(pointer.token);
+      for (const part of pointer.token.split(/\s+/)) if (part.length >= 8) diagnosticSecrets.add(part);
+    }
+    if (pointer.process_identity?.pid === pid && compareProcessIdentity(pointer.process_identity, pointer.process_identity) === 'live') {
+      runtimeOwner = { ...pointer.process_identity };
+    }
+  } catch {}
+}
+
+function collectRuntimeDiagnostic(extra = {}) {
+  const diagnostic = { stage: currentStage, pid: runtimePid,
+    owner: observeFixtureOwner(runtimeOwner), pointerExists: fs.existsSync(path.join(root, '.hello-cc', 'runtime.json')), ...extra };
+  try {
+    const db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { readOnly: true, timeout: 200 });
+    try { diagnostic.events = db.prepare('SELECT id, type FROM events ORDER BY id DESC LIMIT 12').all(); }
+    finally { db.close(); }
+  } catch {}
+  return fixtureDiagnosticText(diagnostic, diagnosticSecrets);
 }
 
 function commandText(command, args) {
@@ -1587,15 +1767,7 @@ function assertHtmlCsp(response, html, label) {
 }
 
 function processIsAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    // Linux keeps an exited child addressable until PID 1 reaps its zombie.
-    // Product liveness treats that state as dead, and the regression wait must
-    // use the same semantic boundary instead of waiting forever on kill(0).
-    return process.platform !== 'linux' || inspectProcessIdentity(pid).state !== 'dead';
-  } catch {
-    return false;
-  }
+  return inspectProcessIdentity(pid).state !== 'dead' && !/^[ZX]/i.test(fixturePsState(pid) || '');
 }
 
 async function waitForProcessExit(pid, label, timeoutMs = 5000) {
@@ -2546,7 +2718,7 @@ function startRuntime(options = {}) {
   const output = hcc(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance'], { env: runtimeEnv });
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`hcc web did not print background pid:\n${output}`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
   if (!output.includes('web started in background')) fail(`hcc web did not report background start:\n${output}`);
 }
 
@@ -2644,7 +2816,7 @@ async function webSecretRedactionWorkflow() {
   ]);
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`redaction web did not print background pid`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
 
   try {
     await waitRuntime();
@@ -2738,6 +2910,7 @@ async function assertWebWrapperParentSurvives() {
   const wrapperRoot = fs.mkdtempSync(path.join(os.tmpdir(), `hcc-reg-wrapper-root-${testId}-`));
   const wrapperPort = port + 101;
   let wrapperPid = null;
+  let wrapperOwner = null;
   try {
     const script = [
       'set -e',
@@ -2752,14 +2925,15 @@ async function assertWebWrapperParentSurvives() {
     if (!match) fail(`wrapper hcc web did not print background pid:\n${result.stdout}`);
     wrapperPid = Number.parseInt(match[1], 10);
     ensureFile(path.join(wrapperRoot, '.hello-cc', 'runtime.json'));
+    wrapperOwner = JSON.parse(fs.readFileSync(path.join(wrapperRoot, '.hello-cc', 'runtime.json'), 'utf8')).process_identity;
   } finally {
-    runMaybe(process.execPath, [hccBin, '--root', wrapperRoot, 'down'], { env });
+    runMaybe(process.execPath, [hccBin, '--root', wrapperRoot, 'down'], { env: fixtureStopEnvironment(env) });
     if (wrapperPid) {
       try {
-        await waitForProcessExit(wrapperPid, 'wrapper runtime process exit', 5000);
+        await waitForFixtureOwnerExit(wrapperOwner, 5000);
       } catch {
-        try { process.kill(wrapperPid, 'SIGTERM'); } catch {}
-        try { await waitForProcessExit(wrapperPid, 'wrapper runtime process exit after SIGTERM', 2000); } catch {}
+        signalFixtureOwner(wrapperOwner, 'SIGTERM');
+        try { await waitForFixtureOwnerExit(wrapperOwner, 2000); } catch {}
       }
     }
     try { fs.rmSync(wrapperRoot, { recursive: true, force: true }); } catch {}
@@ -2768,28 +2942,42 @@ async function assertWebWrapperParentSurvives() {
 
 async function stopRuntime() {
   if (!runtimePid) return;
-  const pid = runtimePid;
-  hccMaybe(['down']);
+  const owner = runtimeOwner;
+  const before = observeFixtureOwner(owner);
+  const down = fixtureDownResult(stopFixtureCli());
+  lastStopDiagnostic = { before, down, stack: new Error('stopRuntime').stack.split('\n').slice(1, 7), signals: [] };
   try {
-    await waitForProcessExit(pid, 'runtime process exit', 5000);
+    await waitForFixtureOwnerExit(owner, 5000);
   } catch (err) {
-    try { process.kill(pid, 'SIGTERM'); } catch {}
+    lastStopDiagnostic.atDeadline = collectRuntimeDiagnostic({ before, down });
+    lastStopDiagnostic.signals.push(signalFixtureOwner(owner, 'SIGTERM'));
     try {
-      await waitForProcessExit(pid, 'runtime process exit after SIGTERM', 2000);
+      await waitForFixtureOwnerExit(owner, 2000);
     } catch {
-      try { process.kill(pid, 'SIGKILL'); } catch {}
-      try { await waitForProcessExit(pid, 'runtime process exit after SIGKILL', 2000); } catch {}
-      throw err;
+      lastStopDiagnostic.signals.push(signalFixtureOwner(owner, 'SIGKILL'));
+      try { await waitForFixtureOwnerExit(owner, 2000); } catch {}
     }
+    fail(`runtime stop failed: ${collectRuntimeDiagnostic(lastStopDiagnostic)}`);
   }
+  if (down.status !== 0) fail(`runtime down command failed: ${collectRuntimeDiagnostic(lastStopDiagnostic)}`);
   runtimePid = null;
+  runtimeOwner = null;
+}
+
+function stopFixtureCli() {
+  try {
+    const pointer = currentRuntime();
+    if (compareProcessIdentity(runtimeOwner, pointer.process_identity) === 'live' &&
+        runtimeOwner.commandHash === pointer.process_identity.commandHash) {
+      return hccMaybe(['--json', 'down'], { env: fixtureStopEnvironment(env) });
+    }
+  } catch {}
+  return { status: null, error: { code: 'FIXTURE_OWNER_POINTER_UNAVAILABLE' } };
 }
 
 function cleanup() {
-  try { hccMaybe(['down']); } catch {}
-  if (runtimePid) {
-    try { process.kill(runtimePid, 'SIGTERM'); } catch {}
-  }
+  try { stopFixtureCli(); } catch {}
+  if (runtimePid) signalFixtureOwner(runtimeOwner, 'SIGTERM');
   const managedPrefixes = [
     tmuxManagedSessionPrefix(root),
     tmuxManagedSessionPrefix(secondProjectRoot)
@@ -2877,7 +3065,7 @@ async function setupRegression() {
   const output = hcc(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance']);
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`hcc web did not print background pid during bootstrap:\n${output}`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
   await waitRuntime();
   for (const file of liveBufferFiles) ensureFile(file);
   for (const file of liveBufferFiles) fs.rmSync(file, { force: true });
@@ -2957,7 +3145,7 @@ async function setupRegression() {
   const directTlsOutput = hcc(['web', '--local', '--tls', '--port', String(port), '--no-discover', '--no-guidance']);
   const directTlsMatch = directTlsOutput.match(/^pid:\s*(\d+)/m);
   if (!directTlsMatch) fail(`direct TLS web did not print background pid:\n${directTlsOutput}`);
-  runtimePid = Number.parseInt(directTlsMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(directTlsMatch[1], 10));
   await waitFor(async () => {
     const runtimeFile = path.join(root, '.hello-cc', 'runtime.json');
     if (!fs.existsSync(runtimeFile)) return false;
@@ -3016,7 +3204,7 @@ async function setupRegression() {
   const tokenOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const tokenMatch = tokenOutput.match(/^pid:\s*(\d+)/m);
   if (!tokenMatch) fail(`token web did not print background pid:\n${tokenOutput}`);
-  runtimePid = Number.parseInt(tokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(tokenMatch[1], 10));
   if (!tokenOutput.includes('token=') || !tokenOutput.includes('open: http://<machine-ip>:')) {
     fail(`default web output did not include remote token URL:\n${tokenOutput}`);
   }
@@ -3200,7 +3388,7 @@ async function setupRegression() {
   ]);
   const proxyPidMatch = proxyOutput.match(/^pid:\s*(\d+)/m);
   if (!proxyPidMatch) fail(`trusted-proxy web did not print background pid:\n${proxyOutput}`);
-  runtimePid = Number.parseInt(proxyPidMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(proxyPidMatch[1], 10));
   await waitRuntime();
   const proxyRuntime = currentRuntime();
   if (proxyRuntime.proxy_origin !== proxyOrigin || proxyRuntime.trust_proxy !== true) {
@@ -3286,7 +3474,7 @@ async function setupRegression() {
   ]);
   const restoredPidMatch = restoredOutput.match(/^pid:\s*(\d+)/m);
   if (!restoredPidMatch) fail(`post-proxy web did not print background pid:\n${restoredOutput}`);
-  runtimePid = Number.parseInt(restoredPidMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(restoredPidMatch[1], 10));
   await waitRuntime();
 
   const badJsonResponse = await runtimeFetch('/api/projects', {
@@ -3313,7 +3501,7 @@ async function setupRegression() {
   const stableTokenOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const stableTokenMatch = stableTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!stableTokenMatch) fail(`stable-token web did not print background pid:\n${stableTokenOutput}`);
-  runtimePid = Number.parseInt(stableTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(stableTokenMatch[1], 10));
   await waitRuntime();
   const stableTokenRuntime = currentRuntime();
   if (stableTokenRuntime.token === tokenRuntime.token) {
@@ -3327,7 +3515,7 @@ async function setupRegression() {
   });
   const fixedTokenMatch = fixedTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!fixedTokenMatch) fail(`fixed-token web did not print background pid:\n${fixedTokenOutput}`);
-  runtimePid = Number.parseInt(fixedTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(fixedTokenMatch[1], 10));
   await waitRuntime();
   const fixedTokenRuntime = currentRuntime();
   if (fixedTokenRuntime.token !== fixedToken || !fixedTokenOutput.includes(`token=${encodeURIComponent(fixedToken)}`)) {
@@ -3338,7 +3526,7 @@ async function setupRegression() {
   const postFixedOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const postFixedMatch = postFixedOutput.match(/^pid:\s*(\d+)/m);
   if (!postFixedMatch) fail(`post-fixed-token web did not print background pid:\n${postFixedOutput}`);
-  runtimePid = Number.parseInt(postFixedMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(postFixedMatch[1], 10));
   await waitRuntime();
   const postFixedRuntime = currentRuntime();
   if (postFixedRuntime.token === fixedToken || fs.existsSync(tokenFile)) {
@@ -3351,7 +3539,7 @@ async function setupRegression() {
   const noTokenOutput = hcc(['web', '--local', '--port', String(port), '--no-token', '--no-discover', '--no-guidance']);
   const noTokenMatch = noTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!noTokenMatch) fail(`explicit no-token web did not print background pid:\n${noTokenOutput}`);
-  runtimePid = Number.parseInt(noTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(noTokenMatch[1], 10));
   if (noTokenOutput.includes('token=')) {
     fail(`explicit no-token web output included token:\n${noTokenOutput}`);
   }
@@ -11158,11 +11346,16 @@ function gcCoverageWorkflow() {
 }
 
 async function main() {
+  realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
+  }).stdout.trim();
   process.once('SIGINT', () => { cleanup(); process.exit(130); });
   process.once('SIGTERM', () => { cleanup(); process.exit(143); });
 
   await setupRegression();
+  currentStage = 'webSecretRedactionWorkflow';
   await webSecretRedactionWorkflow();
+  currentStage = 'cookieSessionExpiryWorkflow';
   await cookieSessionExpiryWorkflow();
   log('[2/13] runtime');
   startRuntime();
@@ -11194,12 +11387,18 @@ async function main() {
   log('FULL_REGRESSION_OK');
 }
 
-main().catch((err) => {
+if (process.argv[1] && path.resolve(process.argv[1]) === import.meta.filename) main().catch((err) => {
+  const failure = fixtureFailureDiagnostic(err);
+  const diagnostic = collectRuntimeDiagnostic({ failure, stop: lastStopDiagnostic });
+  process.stderr.write(`[regression failure diagnostic] ${diagnostic}\n`);
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    process.stderr.write(`::error::${diagnostic.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A')}\n`);
+  }
   try { assertNoRealProjectRegistryLeak(); } catch (leakErr) {
-    process.stderr.write(`${leakErr.stack || leakErr.message}\n`);
+    process.stderr.write(`${fixtureDiagnosticText(leakErr.stack || leakErr.message, diagnosticSecrets)}\n`);
   }
   cleanup();
-  process.stderr.write(`${err.stack || err.message}\n`);
+  process.stderr.write(`${fixtureDiagnosticText(err.stack || err.message, diagnosticSecrets)}\n`);
   process.exit(1);
 }).finally(() => {
   try {