@logicseek/hello-cc 1.1.0-rc.1 → 1.1.0-rc.4

package/scripts/regression.mjs

@@ -8,13 +8,21 @@ import path from 'node:path';
 import process from 'node:process';
 import { spawn, spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
+import { performance } from 'node:perf_hooks';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { DatabaseSync } from 'node:sqlite';
 import { Readable } from 'node:stream';
 import { pathToFileURL } from 'node:url';
 import WebSocket from 'ws';
-import { inspectProcessIdentity } from '../lib/process/identity.mjs';
+import { inspectProcessIdentity, compareProcessIdentity } from '../lib/process/identity.mjs';
+import { redactSecrets } from '../lib/shared/redact.mjs';
 import { applyBufferPlan, planBufferFiles } from '../lib/runtime/buffer-gc.mjs';
+import { readOwnedReentryOutputAtDeadline, readReentryTrace } from './shim-reentry-probe.mjs';
+import { createCookieExpiryWindow } from './regression-cookie-expiry.mjs';
+import { waitForTerminalMarker, terminalMarkerFailureDiagnostic } from './regression-terminal-marker.mjs';
+import { fixtureFetch as fetch } from './regression-http-transport.mjs';
+import { parseShutdownDiagnostics } from '../lib/web/shutdown-diagnostics.mjs';
+import { assertGcPreviewMetadata } from './helpers/gc-clock-observation.mjs';
 
 const repoRoot = path.resolve(import.meta.dirname, '..');
 const hccBin = path.join(repoRoot, 'bin', 'hcc.mjs');
@@ -27,16 +35,24 @@ const tmuxSession = `hcc-reg-${process.pid}`;
 const tmuxSocketName = `hcc-reg-${testId}`.replace(/[^A-Za-z0-9_-]/g, '-');
 const secondProjectRoot = path.join(root, 'second-project');
 const TERMINAL_WEBSOCKET_TIMEOUT_MS = 15_000;
+const COOKIE_WEBSOCKET_SNAPSHOT_TIMEOUT_MS = 5_000;
+// now() uses whole seconds: TTL=1 may leave only 1ms before expiry. Reserve
+// the existing snapshot budget plus clock quantization/setup margin first.
+const COOKIE_EXPIRY_FIXTURE_TTL_SEC = Math.ceil(COOKIE_WEBSOCKET_SNAPSHOT_TIMEOUT_MS / 1000) + 2;
 const realHome = process.env.HOME || os.homedir();
 const realRegistryFile = path.join(realHome, '.hello-cc', 'projects.json');
-const realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
-  encoding: 'utf8',
-  stdio: ['ignore', 'pipe', 'ignore']
-}).stdout.trim();
+let realTmuxBin = '';
 const port = 22000 + (process.pid % 10000);
 
 let tmuxStarted = false;
 let runtimePid = null;
+let runtimeOwner = null;
+let currentStage = 'startup';
+let lastStopDiagnostic = null;
+const diagnosticSecrets = new Set();
+const fixtureFailures = new WeakSet();
+const fixtureCommandFailures = new WeakMap();
+const fixtureHttpFailures = new WeakMap();
 const managedTmuxSessions = new Set();
 
 const env = {
@@ -50,22 +66,300 @@ for (const key of Object.keys(env)) {
   if (key.startsWith('HCC_')) delete env[key];
 }
 if (process.env.HCC_REGRESSION_DEBUG === '1') env.HCC_DEBUG = '1';
+env.HCC_SHUTDOWN_DIAGNOSTICS = '1';
 delete env.TMUX;
 delete env.TMUX_PANE;
 
 function log(message) {
+  currentStage = String(message);
   process.stdout.write(`${message}\n`);
 }
 
-function fail(message) {
+function fail(message, commandResult = null, diagnosticOperation = null) {
+  const error = fixtureFailureError(message, commandResult, diagnosticOperation);
   if (process.env.GITHUB_ACTIONS === 'true') {
-    const escaped = String(message)
+    const escaped = fixtureDiagnosticText({ stage: currentStage, failure: fixtureFailureDiagnostic(error) }, diagnosticSecrets)
       .replace(/%/g, '%25')
       .replace(/\r/g, '%0D')
       .replace(/\n/g, '%0A');
     process.stderr.write(`::error::${escaped}\n`);
   }
-  throw new Error(message);
+  throw error;
+}
+
+export function fixtureFailureError(message, commandResult = null, diagnosticOperation = null) {
+  const error = new Error(String(message));
+  Object.defineProperty(error, 'fixtureStack', {
+    value: Object.freeze(new Error('fixture failure').stack.split('\n').slice(1, 7))
+  });
+  fixtureFailures.add(error);
+  const command = fixtureCommandResult(commandResult, diagnosticOperation);
+  if (command) fixtureCommandFailures.set(error, command);
+  return error;
+}
+
+export function fixtureFailureDiagnostic(error) {
+  const names = ['Error', 'TypeError', 'RangeError', 'SyntaxError', 'AssertionError', 'AbortError'];
+  const terminalMarker = terminalMarkerFailureDiagnostic(error);
+  return {
+    name: names.includes(error?.name) ? error.name : 'Error',
+    stack: fixtureFailures.has(error)
+      ? error.fixtureStack
+      : new Error('regression failure handler').stack.split('\n').slice(1, 7),
+    ...(fixtureCommandFailures.has(error) ? { command: fixtureCommandFailures.get(error) } : {}),
+    ...(fixtureHttpFailures.has(error) ? { http: fixtureHttpFailures.get(error) } : {}),
+    ...(terminalMarker ? { terminalMarker } : {})
+  };
+}
+
+function fixtureHttpRoute(route) {
+  if (typeof route !== 'string') return null;
+  const pathname = route.split(/[?#]/, 1)[0];
+  if (['/', '/api/projects', '/api/runtime', '/api/runtime/gc-buffers', '/api/detected',
+    '/api/sessions', '/api/sessions/attach', '/api/resumable',
+    '/assets/web/browser/core.mjs', '/assets/web/ui-agent-start.mjs'].includes(pathname)) return pathname;
+  const action = pathname.match(/^\/api\/peers\/[^/?#]+\/actions\/(status|state|inbox|heartbeat|task-next|task-takeover|lock-acquire)$/);
+  if (action) return `/api/peers/:peer/actions/${action[1]}`;
+  const session = pathname.match(/^\/api\/sessions\/[^/?#]+\/(input|stop)$/);
+  if (session) return `/api/sessions/:peer/${session[1]}`;
+  if (/^\/api\/detected\/[^/?#]+\/msg$/.test(pathname)) return '/api/detected/:peer/msg';
+  return null;
+}
+
+function fixtureHttpCallFrames() {
+  // Capture our call site before invoking fetch. Never parse the thrown error's
+  // stack, whose text can contain URLs, request data or third-party messages.
+  const capture = {};
+  Error.captureStackTrace(capture, withFixtureHttpDiagnostic);
+  const source = pathToFileURL(path.join(repoRoot, 'scripts', 'regression.mjs')).href;
+  const location = new RegExp(`(?:^|[ (])${source.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}:(\\d+):(\\d+)\\)?$`);
+  return Object.freeze(String(capture.stack).split('\n').flatMap((frame) => {
+    const match = frame.match(location);
+    if (!match) return [];
+    return [Object.freeze({ file: 'scripts/regression.mjs', line: Number(match[1]), column: Number(match[2]) })];
+  }).slice(0, 6));
+}
+
+function fixtureHttpNetworkCode(error) {
+  const allowed = ['ECONNRESET', 'ECONNREFUSED', 'EHOSTUNREACH', 'ENETUNREACH', 'ENOTFOUND',
+    'EAI_AGAIN', 'ETIMEDOUT', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT', 'UND_ERR_SOCKET'];
+  // Reading data descriptors avoids evaluating arbitrary error/cause getters.
+  try {
+    const direct = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+    const cause = Object.getOwnPropertyDescriptor(error, 'cause')?.value;
+    const nested = cause && Object.getOwnPropertyDescriptor(cause, 'code')?.value;
+    return allowed.includes(direct) ? direct : allowed.includes(nested) ? nested : null;
+  } catch { return null; }
+}
+
+export async function withFixtureHttpDiagnostic(route, options, request) {
+  const method = options?.method ?? 'GET';
+  const context = {
+    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'].includes(method) ? method : null,
+    route: fixtureHttpRoute(route),
+    callFrames: fixtureHttpCallFrames()
+  };
+  const started = performance.now();
+  try {
+    return await request();
+  } catch (error) {
+    if (error && (typeof error === 'object' || typeof error === 'function') && !fixtureHttpFailures.has(error)) {
+      fixtureHttpFailures.set(error, Object.freeze({ ...context,
+        code: fixtureHttpNetworkCode(error), elapsedMs: Math.max(0, Math.round(performance.now() - started)) }));
+    }
+    throw error;
+  }
+}
+
+export function fixtureDiagnosticText(value, secrets = []) {
+  function scrub(text) {
+    for (const secret of secrets) {
+      if (typeof secret === 'string' && secret.length >= 8) text = text.split(secret).join('[REDACTED]');
+    }
+    return redactSecrets(text)
+      .replace(/("(?:[^"\\]*token|authorization|cookie|[^"\\]*secret|password)"\s*:\s*)"(?:\\.|[^"\\])*"/gi, '$1"[REDACTED]"');
+  }
+  function visit(entry) {
+    if (typeof entry === 'string') return scrub(entry);
+    if (Array.isArray(entry)) return entry.map(visit);
+    if (entry && typeof entry === 'object') return Object.fromEntries(Object.entries(entry).map(([key, item]) => [key, visit(item)]));
+    return entry;
+  }
+  return typeof value === 'string' ? scrub(value) : JSON.stringify(visit(redactSecrets(value)));
+}
+
+function fixturePsState(pid) {
+  const result = spawnSync('ps', ['-p', String(pid), '-o', 'stat='], {
+    encoding: 'utf8', timeout: 1000, stdio: ['ignore', 'pipe', 'ignore']
+  });
+  const state = String(result.stdout || '').trim();
+  return result.status === 0 && /^[A-Za-z+<>NslLWE-]{1,16}$/.test(state) ? state : null;
+}
+
+export function observeFixtureOwner(owner, { inspect = inspectProcessIdentity, psState = fixturePsState } = {}) {
+  if (compareProcessIdentity(owner, owner) !== 'live') return { state: 'unknown', reason: 'missing_owner_identity' };
+  const observed = inspect(owner.pid);
+  const state = psState(owner.pid);
+  const details = { pid: owner.pid, psState: state, observedState: observed.state };
+  if (observed.state === 'dead') return { ...details, state: 'exited', reason: 'process_dead' };
+  if (/^[ZX]/i.test(state || '')) return { ...details, state: 'exited', reason: 'zombie_or_dead' };
+  if (observed.state !== 'live' || compareProcessIdentity(observed.identity, observed.identity) !== 'live') {
+    return { ...details, state: 'unknown', reason: 'identity_unavailable' };
+  }
+  details.birthHash = crypto.createHash('sha256').update(observed.identity.startToken).digest('hex');
+  details.commandHash = observed.identity.commandHash;
+  const comparison = compareProcessIdentity(owner, observed.identity);
+  if (comparison === 'dead') return { ...details, state: 'exited', reason: 'pid_reused' };
+  if (comparison !== 'live') return { ...details, state: 'unknown', reason: 'identity_incompatible' };
+  if (owner.commandHash !== observed.identity.commandHash) return { ...details, state: 'unknown', reason: 'command_changed' };
+  return { ...details, state: 'same-owner', reason: 'identity_match' };
+}
+
+export function signalFixtureOwner(owner, signal, { observe = observeFixtureOwner, send = process.kill.bind(process) } = {}) {
+  const observation = observe(owner);
+  if (observation.state !== 'same-owner') return { signal, sent: false, observation };
+  try { send(owner.pid, signal); return { signal, sent: true, observation }; }
+  catch (error) { return { signal, sent: false, observation, code: error.code || 'SIGNAL_FAILED' }; }
+}
+
+export async function waitForFixtureOwnerExit(owner, timeoutMs, {
+  observe = observeFixtureOwner, monotonicNow = () => performance.now(), wait = sleep
+} = {}) {
+  const deadline = monotonicNow() + timeoutMs;
+  for (;;) {
+    const observation = observe(owner);
+    if (observation.state === 'exited') return observation;
+    const remaining = deadline - monotonicNow();
+    if (remaining <= 0) {
+      const error = new Error('runtime fixture owner did not exit before deadline');
+      error.observation = observation;
+      throw error;
+    }
+    await wait(Math.min(100, remaining));
+  }
+}
+
+function fixtureCliFailurePayload(output) {
+  if (typeof output !== 'string' || Buffer.byteLength(output) > 64 * 1024) return null;
+  const text = output.trim();
+  const parse = value => {
+    try {
+      const payload = JSON.parse(value);
+      return payload?.ok === false && !Array.isArray(payload) && payload.error && typeof payload.error === 'object' &&
+        !Array.isArray(payload.error) ? payload : null;
+    } catch { return null; }
+  };
+  const direct = parse(text);
+  if (direct) return direct;
+  // Node warnings can precede or follow the CLI's complete JSON document.
+  // Strip only bounded, recognized edge lines; never scan arbitrary logs for
+  // inner objects, which could turn a nested error into the CLI failure.
+  const lines = text.split(/\r?\n/);
+  let first = 0, last = lines.length, warningLines = 0, warningBytes = 0;
+  const warning = line =>
+    /^\(node:\d+\) (?:\[[A-Z][A-Z0-9_]*\] )?(?:[A-Za-z]+Warning|Warning):/.test(line) ||
+    /^\(Use (?:`node --trace-(?:warnings|deprecation) \.\.\.`|node --trace-(?:warnings|deprecation)(?: \.\.\.)?) to show where the warning was created\)$/.test(line);
+  const strip = line => {
+    const trimmed = line.trim();
+    if (trimmed && !warning(trimmed)) return false;
+    if (trimmed) warningLines += 1;
+    warningBytes += Buffer.byteLength(line) + 1;
+    return true;
+  };
+  while (first < last && strip(lines[first])) first += 1;
+  while (first < last && strip(lines[last - 1])) last -= 1;
+  if (warningLines > 8 || warningBytes > 4096) return null;
+  return parse(lines.slice(first, last).join('\n'));
+}
+
+function fixtureCliResultParts(result) {
+  // --json failures are written with console.error; stdout is retained as a
+  // compatibility fallback for fixtures. Raw output never enters diagnostics.
+  const stderrFailure = fixtureCliFailurePayload(result.stderr);
+  const stdoutFailure = fixtureCliFailurePayload(result.stdout);
+  const payload = stderrFailure || stdoutFailure;
+  const extra = payload?.error?.extra || payload?.error || {};
+  const code = payload?.error?.code || result.error?.code;
+  const diagnostic = {
+    status: Number.isSafeInteger(result.status) ? result.status : null,
+    signal: typeof result.signal === 'string' && Object.hasOwn(os.constants.signals, result.signal) ? result.signal : null,
+    code: typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? code : null,
+    source: stderrFailure ? 'stderr' : stdoutFailure ? 'stdout' : result.error?.code ? 'spawn' : null,
+    stdoutBytes: typeof result.stdout === 'string' ? Buffer.byteLength(result.stdout) : 0,
+    stderrBytes: typeof result.stderr === 'string' ? Buffer.byteLength(result.stderr) : 0
+  };
+  return { diagnostic, extra };
+}
+
+export function fixtureDownResult(result) {
+  const { diagnostic, extra } = fixtureCliResultParts(result);
+  const numeric = ['pid', 'elapsedMs', 'timeoutMs', 'stopElapsedMs', 'confirmationMs'];
+  return {
+    ...diagnostic,
+    extra: {
+      ...Object.fromEntries(numeric.filter(key => typeof extra[key] === 'number' &&
+        Number.isFinite(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]])),
+      ...(['live', 'dead', 'unknown'].includes(extra.state) ? { state: extra.state } : {}),
+      ...(['evidence_unavailable', 'exit_unconfirmed', 'pointer_cleanup_failed', 'pointer_changed'].includes(extra.stopPhase)
+        ? { stopPhase: extra.stopPhase } : {})
+    }
+  };
+}
+
+function fixtureCommandResult(result, operation) {
+  // Only this explicit fixture operation opts in. Never copy command arguments,
+  // error messages, output, URLs or peer identifiers into public annotations.
+  if (operation !== 'broadcast' || !result || typeof result !== 'object') return null;
+  const { diagnostic, extra } = fixtureCliResultParts(result);
+  const context = Object.fromEntries(['elapsedMs', 'timeoutMs'].filter(key =>
+    Number.isSafeInteger(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]]));
+  if (Number.isSafeInteger(extra.status) && extra.status >= 100 && extra.status <= 599) context.status = extra.status;
+  if (extra.method === 'GET' || extra.method === 'POST') context.method = extra.method;
+  const route = typeof extra.path === 'string' ? extra.path.split(/[?#]/, 1)[0] : '';
+  if (route === '/api/sessions') context.path = route;
+  else if (/^\/api\/sessions\/[^/?#]+\/input$/.test(route)) context.path = '/api/sessions/:peer/input';
+  return Object.freeze({ operation, ...diagnostic, extra: Object.freeze(context) });
+}
+
+export function fixtureStopEnvironment(base) {
+  const local = { ...base, HCC_RUNTIME_LOCAL_ONLY: '1' };
+  delete local.HCC_RUNTIME_URL;
+  delete local.HCC_RUNTIME_TOKEN;
+  return local;
+}
+
+function rememberRuntimePid(pid) {
+  runtimePid = pid;
+  runtimeOwner = null;
+  try {
+    const pointer = currentRuntime();
+    if (pointer.token) {
+      diagnosticSecrets.add(pointer.token);
+      for (const part of pointer.token.split(/\s+/)) if (part.length >= 8) diagnosticSecrets.add(part);
+    }
+    if (pointer.process_identity?.pid === pid && compareProcessIdentity(pointer.process_identity, pointer.process_identity) === 'live') {
+      runtimeOwner = { ...pointer.process_identity };
+    }
+  } catch {}
+}
+
+function collectRuntimeDiagnostic(extra = {}) {
+  const diagnostic = { stage: currentStage, pid: runtimePid,
+    owner: observeFixtureOwner(runtimeOwner), pointerExists: fs.existsSync(path.join(root, '.hello-cc', 'runtime.json')), ...extra };
+  let logFd;
+  try {
+    logFd = fs.openSync(path.join(root, '.hello-cc', 'web.log'), 'r');
+    const size = fs.fstatSync(logFd).size, bytes = Buffer.alloc(Math.min(size, 65536));
+    fs.readSync(logFd, bytes, 0, bytes.length, Math.max(0, size - bytes.length));
+    diagnostic.shutdownPhases = parseShutdownDiagnostics(bytes.toString('utf8'), runtimePid);
+  } catch {} finally { if (logFd !== undefined) fs.closeSync(logFd); }
+  try {
+    const db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { readOnly: true, timeout: 200 });
+    try { diagnostic.events = db.prepare('SELECT id, type FROM events ORDER BY id DESC LIMIT 12').all(); }
+    finally { db.close(); }
+  } catch {}
+  return fixtureDiagnosticText(diagnostic, diagnosticSecrets);
 }
 
 function commandText(command, args) {
@@ -81,6 +375,10 @@ function canonicalPath(value) {
   catch { return path.resolve(value); }
 }
 
+export function isRegressionEntry(entry = process.argv[1], filename = import.meta.filename) {
+  return Boolean(entry) && canonicalPath(entry) === canonicalPath(filename);
+}
+
 function samePath(a, b) {
   return canonicalPath(a) === canonicalPath(b);
 }
@@ -117,7 +415,7 @@ function run(command, args, options = {}) {
   });
   if (result.status !== 0) {
     const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
-    fail(`${commandText(command, args)} failed${output ? `\n${output}` : ''}`);
+    fail(`${commandText(command, args)} failed${output ? `\n${output}` : ''}`, result, options.diagnosticOperation);
   }
   return result.stdout || '';
 }
@@ -1422,11 +1720,13 @@ function currentRuntimeUrl(route, params = {}) {
   return runtimeUrl(currentRuntime(), route, params);
 }
 
-function runtimeFetch(route, options = {}, params = {}) {
-  const runtime = currentRuntime();
-  const headers = { ...(options.headers || {}), 'X-HCC-API-Version': '2' };
-  if (runtime.token) headers.Authorization = `Bearer ${runtime.token}`;
-  return fetch(runtimeUrl(runtime, route, params), { ...options, headers });
+export function runtimeFetch(route, options = {}, params = {}) {
+  return withFixtureHttpDiagnostic(route, options, () => {
+    const runtime = currentRuntime();
+    const headers = { ...(options.headers || {}), 'X-HCC-API-Version': '2' };
+    if (runtime.token) headers.Authorization = `Bearer ${runtime.token}`;
+    return fetch(runtimeUrl(runtime, route, params), { ...options, headers });
+  });
 }
 
 function directTlsRequest(runtime, route, options = {}) {
@@ -1434,6 +1734,7 @@ function directTlsRequest(runtime, route, options = {}) {
   const body = options.body === undefined || options.body === null ? null : String(options.body);
   return new Promise((resolve, reject) => {
     const req = https.request({
+      agent: false,
       method: options.method || 'GET',
       hostname: url.hostname,
       port: url.port || 443,
@@ -1521,17 +1822,37 @@ async function waitForFile(file, expected, label = file) {
   ensureFile(file, expected);
 }
 
-async function waitForFileContent(file, expected, label = file) {
-  const deadline = Date.now() + 10000;
+async function waitForFileContent(file, expected, label = file, { diagnostics = null, ownedReentryOutput = false } = {}) {
+  const startedAt = Date.now();
+  const deadline = startedAt + 10000;
   let actual = '(missing)';
+  let lastReadAt = null;
   while (Date.now() < deadline) {
     if (fs.existsSync(file)) {
+      lastReadAt = Date.now();
       actual = fs.readFileSync(file, 'utf8').trim();
       if (actual === expected) break;
     }
     await sleep(100);
   }
+  let finalObservation = null;
+  if (actual !== expected && ownedReentryOutput) {
+    finalObservation = readOwnedReentryOutputAtDeadline(file, expected, deadline, Date.now());
+    if (finalObservation.matched) actual = expected;
+  }
   if (actual !== expected) {
+    if (diagnostics) {
+      const detail = JSON.stringify({ ...diagnostics(), wait: {
+        started_at_ms: startedAt, deadline_ms: deadline, last_read_at_ms: lastReadAt,
+        final_observation: finalObservation
+      } });
+      if (process.env.GITHUB_ACTIONS === 'true') {
+        const escaped = detail.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+        process.stderr.write(`::error title=Shim regression diagnostic::${escaped}\n`);
+      } else {
+        process.stderr.write(`Shim regression diagnostic: ${detail}\n`);
+      }
+    }
     fail(`timed out waiting for ${label}\nexpected: ${expected}\nactual: ${actual}`);
   }
   ensureFile(file, expected);
@@ -1572,9 +1893,9 @@ function assertHtmlCsp(response, html, label) {
     ? "default-src 'self'; " +
       `script-src 'self' 'nonce-${nonce}'; ` +
       "style-src 'self' 'unsafe-inline'; " +
-      "img-src 'self' data:; " +
+      "img-src 'self' data: blob:; " +
       "connect-src 'self' ws: wss:; " +
-      "object-src 'none'; base-uri 'none'; frame-ancestors 'none'"
+      "object-src 'none'; base-uri 'none'; frame-ancestors 'none'; frame-src 'self' blob:"
     : '';
   if (!nonce || policy !== expected) {
     fail(`${label} missing complete nonce CSP: ${policy || '(missing)'}`);
@@ -1588,15 +1909,7 @@ function assertHtmlCsp(response, html, label) {
 }
 
 function processIsAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    // Linux keeps an exited child addressable until PID 1 reaps its zombie.
-    // Product liveness treats that state as dead, and the regression wait must
-    // use the same semantic boundary instead of waiting forever on kill(0).
-    return process.platform !== 'linux' || inspectProcessIdentity(pid).state !== 'dead';
-  } catch {
-    return false;
-  }
+  return inspectProcessIdentity(pid).state !== 'dead' && !/^[ZX]/i.test(fixturePsState(pid) || '');
 }
 
 async function waitForProcessExit(pid, label, timeoutMs = 5000) {
@@ -1604,34 +1917,10 @@ async function waitForProcessExit(pid, label, timeoutMs = 5000) {
 }
 
 async function expectWebSocketMarker(peer, marker) {
-  await new Promise((resolve, reject) => {
-    let sawSnapshot = false;
-    let sawMarker = false;
-    const ws = trackTerminalControl(new WebSocket(runtimeWsUrl(peer), runtimeWsOptions()));
-    const timer = setTimeout(() => {
-      try { ws.terminate(); } catch {}
-      reject(new Error(`${peer} websocket timeout`));
-    }, TERMINAL_WEBSOCKET_TIMEOUT_MS);
-    ws.on('message', (raw) => {
-      const msg = JSON.parse(String(raw));
-      if (msg.type === 'snapshot') {
-        sawSnapshot = true;
-        claimTerminalControl(ws).then(() => ws.send(JSON.stringify({
-          type: 'input', data: `echo ${marker}\r`, action_token: ws.hccActionToken,
-          epoch: ws.hccControl.epoch
-        }))).catch(reject);
-      }
-      if (['snapshot', 'data', 'replace'].includes(msg.type) && String(msg.data || '').includes(marker)) {
-        sawMarker = true;
-      }
-      if (sawSnapshot && sawMarker) {
-        clearTimeout(timer);
-        releaseTerminalControl(ws);
-        ws.close();
-        resolve();
-      }
-    });
-    ws.on('error', (err) => { clearTimeout(timer); reject(err); });
+  const ws = trackTerminalControl(new WebSocket(runtimeWsUrl(peer), runtimeWsOptions()));
+  await waitForTerminalMarker(ws, marker, {
+    claim: signal => claimTerminalControl(ws, { signal }),
+    release: () => releaseTerminalControl(ws), timeoutMs: TERMINAL_WEBSOCKET_TIMEOUT_MS
   });
 }
 
@@ -1641,31 +1930,44 @@ function trackTerminalControl(ws) {
   ws.on('message', (raw) => {
     let message;
     try { message = JSON.parse(String(raw)); } catch { return; }
+    if (!message || typeof message !== 'object') return;
     if (message.action_token) ws.hccActionToken = message.action_token;
     if (message.control) ws.hccControl = message.control;
   });
   return ws;
 }
 
-async function claimTerminalControl(ws) {
+export async function claimTerminalControl(ws, { signal } = {}) {
+  const aborted = () => Object.assign(new Error('terminal control claim aborted'), { code: 'TERMINAL_CONTROL_ABORTED' });
+  if (signal?.aborted) throw aborted();
   if (ws.hccControl?.can_control) return ws.hccControl;
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => finish(new Error('terminal control claim timeout')), 5000);
+    let settled = false;
     const finish = (error = null) => {
+      if (settled) return;
+      settled = true;
       clearTimeout(timer);
       ws.off('message', onMessage);
+      signal?.removeEventListener('abort', onAbort);
       if (error) reject(error);
       else resolve(ws.hccControl);
     };
     const onMessage = (raw) => {
+      if (settled) return;
       let message;
       try { message = JSON.parse(String(raw)); } catch { return; }
+      if (!message || typeof message !== 'object') return;
       if (message.type === 'error') finish(new Error(`terminal control claim failed: ${JSON.stringify(message.error)}`));
       else if (message.type === 'control' && message.control?.can_control) finish();
     };
+    const onAbort = () => finish(aborted());
     ws.on('message', onMessage);
-    ws.send(JSON.stringify({ type: 'control', action: 'claim', action_token: ws.hccActionToken,
-      epoch: ws.hccControl?.epoch, force: true }));
+    signal?.addEventListener('abort', onAbort, { once: true });
+    try {
+      ws.send(JSON.stringify({ type: 'control', action: 'claim', action_token: ws.hccActionToken,
+        epoch: ws.hccControl?.epoch, force: true }));
+    } catch (error) { finish(error); }
   });
 }
 
@@ -1778,24 +2080,60 @@ async function fetchTerminalSnapshot(peer, params = {}) {
   });
 }
 
-async function issueBrowserSessionCookie() {
+function browserSessionCookie(setCookie, endpoint, { expired = false } = {}) {
+  const url = new URL(endpoint);
+  const protocol = url.protocol.slice(0, -1);
+  const effectivePort = url.port || (protocol === 'https' ? '443' : '80');
+  const expectedName = `hcc_sid_v2_${protocol}_${effectivePort}`;
+  const match = String(setCookie).match(/^([^=;\s]+)=([^;]*)/);
+  if (!match || match[1] !== expectedName || (expired ? match[2] !== '' : !match[2])) {
+    fail(`browser session cookie did not match endpoint scope ${expectedName} (expired=${expired})`);
+  }
+  return { name: match[1], sid: match[2], cookie: `${match[1]}=${match[2]}` };
+}
+
+async function selectCookieProject(baseUrl, cookie, projectRoot = root, {
+  signal, origin = new URL(baseUrl).origin, headers = {}
+} = {}) {
+  const url = new URL('/api/projects/select', baseUrl);
+  url.searchParams.set('root', projectRoot);
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      ...headers,
+      Cookie: cookie,
+      Origin: origin,
+      'X-HCC-API-Version': '2'
+    },
+    signal
+  });
+  const selected = await response.json();
+  if (!response.ok || !selected.project_identity) {
+    fail(`cookie project selection failed: status=${response.status} body=${JSON.stringify(selected)}`);
+  }
+  return selected.project_identity;
+}
+
+async function issueBrowserSessionCookie({ signal, selectProject = true } = {}) {
   const runtime = currentRuntime();
   const baseUrl = runtime.base_url || `http://127.0.0.1:${port}`;
   const response = await fetch(new URL('/login', baseUrl), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ token: runtime.token || '' }),
+    signal,
     redirect: 'manual'
   });
   const setCookie = response.headers.get('set-cookie') || '';
-  const sid = setCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (response.status !== 302 || !sid) {
-    fail(`browser session login failed: status=${response.status} cookie=${setCookie}`);
+  if (response.status !== 302) {
+    fail(`browser session login failed: status=${response.status}`);
   }
-  return { baseUrl, origin: new URL(baseUrl).origin, sid };
+  const auth = browserSessionCookie(setCookie, baseUrl);
+  const projectIdentity = selectProject ? await selectCookieProject(baseUrl, auth.cookie, root, { signal }) : null;
+  return { baseUrl, origin: new URL(baseUrl).origin, ...auth, projectIdentity };
 }
 
-async function cookieRuntimeFetch(route, auth, options = {}, params = {}) {
+export async function cookieRuntimeFetch(route, auth, options = {}, params = {}) {
   const url = new URL(route, auth.baseUrl);
   for (const [key, value] of Object.entries(params)) {
     if (value !== undefined && value !== null) url.searchParams.set(key, String(value));
@@ -1803,9 +2141,10 @@ async function cookieRuntimeFetch(route, auth, options = {}, params = {}) {
   return fetch(url, {
     ...options,
     headers: {
-      Cookie: `hcc_sid=${auth.sid}`,
+      Cookie: auth.cookie,
       Origin: auth.origin,
       'X-HCC-API-Version': '2',
+      ...(auth.projectIdentity ? { 'X-HCC-Root-Identity': auth.projectIdentity } : {}),
       ...(options.headers || {})
     }
   });
@@ -1819,8 +2158,9 @@ async function cookieRuntimeFetchWithoutOrigin(route, auth, options = {}, params
   return fetch(url, {
     ...options,
     headers: {
-      Cookie: `hcc_sid=${auth.sid}`,
+      Cookie: auth.cookie,
       'X-HCC-API-Version': '2',
+      ...(auth.projectIdentity ? { 'X-HCC-Root-Identity': auth.projectIdentity } : {}),
       ...(options.headers || {})
     }
   });
@@ -1846,9 +2186,10 @@ async function expectSocketMarkerAfter(ws, marker, action) {
   });
 }
 
-async function openCookieTerminalWebSocket(peer, sid, params = {}) {
+async function openCookieTerminalWebSocket(peer, cookie, params = {}, selectedProjectIdentity = null) {
   const runtime = currentRuntime();
   const baseUrl = runtime.base_url || `http://127.0.0.1:${port}`;
+  const projectIdentity = selectedProjectIdentity || await selectCookieProject(baseUrl, cookie, params.root || root);
   const url = new URL(`/ws/terminal/${encodeURIComponent(peer)}`, baseUrl);
   url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
   url.searchParams.set('api_version', '2');
@@ -1859,8 +2200,9 @@ async function openCookieTerminalWebSocket(peer, sid, params = {}) {
     let settled = false;
     const ws = trackTerminalControl(new WebSocket(url, {
       headers: {
-        Cookie: `hcc_sid=${sid}`,
-        Origin: new URL(baseUrl).origin
+        Cookie: cookie,
+        Origin: new URL(baseUrl).origin,
+        'X-HCC-Root-Identity': projectIdentity
       }
     }));
     const timer = setTimeout(() => {
@@ -1868,7 +2210,7 @@ async function openCookieTerminalWebSocket(peer, sid, params = {}) {
       settled = true;
       try { ws.terminate(); } catch {}
       reject(new Error(`${peer} cookie websocket snapshot timeout`));
-    }, 5000);
+    }, COOKIE_WEBSOCKET_SNAPSHOT_TIMEOUT_MS);
     const rejectBeforeSnapshot = (err) => {
       if (settled) return;
       settled = true;
@@ -1900,12 +2242,12 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
     redirect: 'manual'
   });
   const setCookie = login.headers.get('set-cookie') || '';
-  const sid = setCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (login.status !== 302 || !sid) {
-    fail(`cookie websocket login failed: status=${login.status} cookie=${setCookie}`);
+  if (login.status !== 302) {
+    fail(`cookie websocket login failed: status=${login.status}`);
   }
+  const auth = browserSessionCookie(setCookie, baseUrl);
 
-  const ws = await openCookieTerminalWebSocket(peer, sid, params);
+  const ws = await openCookieTerminalWebSocket(peer, auth.cookie, params);
   try {
     const closed = new Promise((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error(`${peer} cookie websocket logout close timeout`)), 5000);
@@ -1922,7 +2264,7 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
       fetch(new URL('/logout', baseUrl), {
         method: 'POST',
         headers: {
-          Cookie: `hcc_sid=${sid}`,
+          Cookie: auth.cookie,
           Origin: origin
         }
       }),
@@ -1931,11 +2273,12 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
     if (logout.status !== 204 || !(logout.headers.get('set-cookie') || '').includes('Max-Age=0')) {
       fail(`cookie websocket logout did not expire its session: status=${logout.status}`);
     }
+    browserSessionCookie(logout.headers.get('set-cookie') || '', baseUrl, { expired: true });
     if (closeResult.code !== 4001 || ws.readyState !== WebSocket.CLOSED) {
       fail(`cookie websocket logout did not close the established socket with 4001:\n${JSON.stringify({ closeResult, readyState: ws.readyState }, null, 2)}`);
     }
     const revoked = await fetch(new URL('/api/runtime', baseUrl), {
-      headers: { Cookie: `hcc_sid=${sid}`, 'X-HCC-API-Version': '2' }
+      headers: { Cookie: auth.cookie, 'X-HCC-API-Version': '2' }
     });
     if (revoked.status !== 401) {
       fail(`cookie websocket logout left the old cookie authorized: ${revoked.status}`);
@@ -1949,7 +2292,7 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
 
 async function assertEvictionClosesCookieWebSocket(peer, params = {}) {
   const auth = await issueBrowserSessionCookie();
-  const ws = await openCookieTerminalWebSocket(peer, auth.sid, params);
+  const ws = await openCookieTerminalWebSocket(peer, auth.cookie, params, auth.projectIdentity);
   try {
     const closed = new Promise((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error(`${peer} cookie websocket eviction close timeout`)), 10000);
@@ -1963,14 +2306,14 @@ async function assertEvictionClosesCookieWebSocket(peer, params = {}) {
       });
     });
     for (let offset = 0; offset < 256; offset += 32) {
-      await Promise.all(Array.from({ length: 32 }, () => issueBrowserSessionCookie()));
+      await Promise.all(Array.from({ length: 32 }, () => issueBrowserSessionCookie({ selectProject: false })));
     }
     const closeResult = await closed;
     if (closeResult.code !== 4001 || !closeResult.reason.includes('session limit reached')) {
       fail(`cookie websocket eviction did not close with 4001:\n${JSON.stringify(closeResult, null, 2)}`);
     }
     const revoked = await fetch(new URL('/api/runtime', auth.baseUrl), {
-      headers: { Cookie: `hcc_sid=${auth.sid}`, 'X-HCC-API-Version': '2' }
+      headers: { Cookie: auth.cookie, 'X-HCC-API-Version': '2' }
     });
     if (revoked.status !== 401) fail(`evicted cookie remained authorized: ${revoked.status}`);
   } finally {
@@ -2547,24 +2890,20 @@ function startRuntime(options = {}) {
   const output = hcc(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance'], { env: runtimeEnv });
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`hcc web did not print background pid:\n${output}`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
   if (!output.includes('web started in background')) fail(`hcc web did not report background start:\n${output}`);
 }
 
 async function cookieSessionExpiryWorkflow() {
   const expirySessionId = `cookie-expiry-${testId}`;
   const marker = `EXPIRED_COOKIE_INPUT_${testId}`;
-  // Sessions use whole-second timestamps. A one-second TTL can expire during
-  // the initial WebSocket/PTY snapshot, before this test reaches its assertion.
-  // Keep a bounded setup window, then explicitly wait past the same TTL.
-  const cookieTtlSec = 10;
   let ws = null;
 
   startRuntime({
     env: {
       ...env,
       HCC_REGRESSION_TEST: '1',
-      HCC_REGRESSION_WEB_SESSION_TTL_SEC: String(cookieTtlSec)
+      HCC_REGRESSION_WEB_SESSION_TTL_SEC: String(COOKIE_EXPIRY_FIXTURE_TTL_SEC)
     }
   });
   try {
@@ -2590,40 +2929,56 @@ async function cookieSessionExpiryWorkflow() {
     }
 
     const auth = await issueBrowserSessionCookie();
-    ws = await openCookieTerminalWebSocket(expirySessionId, auth.sid, { root });
+    ws = await openCookieTerminalWebSocket(expirySessionId, auth.cookie, { root }, auth.projectIdentity);
     if (!ws.hccActionToken) fail('short-TTL cookie terminal snapshot omitted its action token');
-    const closed = new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error('expired cookie websocket close timeout')), (cookieTtlSec + 5) * 1000);
+    const expiryWindow = createCookieExpiryWindow(COOKIE_EXPIRY_FIXTURE_TTL_SEC * 1000);
+    // Listen before waiting so spontaneous expiry is retained. Start the close
+    // deadline only after expiry, and defer rejection to avoid an unhandled
+    // error while this fixture is still waiting for the cookie to expire.
+    const closed = new Promise(resolve => {
       ws.once('close', (code, reason) => {
-        clearTimeout(timer);
         resolve({ code, reason: String(reason || '') });
       });
-      ws.once('error', (err) => {
-        clearTimeout(timer);
-        reject(err);
-      });
+      ws.once('error', error => resolve({ error }));
     });
 
-    await sleep(cookieTtlSec * 1000 + 200);
+    // A probe-only cookie is issued after the target cookie. Observing its
+    // expiry must not revoke the target socket before its input guard runs.
+    const probeAuth = await expiryWindow.prepare(signal => issueBrowserSessionCookie({ signal }));
+    // Cookie expiry uses the server's wall clock, which can advance more slowly
+    // than this fixture's timer. Observe real expiry within the original total
+    // TTL + close budget before sending input on this same socket.
+    await expiryWindow.waitForHttpExpiry(signal =>
+      cookieRuntimeFetch('/api/runtime', probeAuth, { signal }));
+    if (ws.readyState !== WebSocket.OPEN) fail('target cookie websocket closed before the expired-input check');
     ws.send(JSON.stringify({
       type: 'input',
       data: `echo ${marker}\r`,
       action_token: ws.hccActionToken,
       epoch: ws.hccControl.epoch
     }));
-    const closeResult = await closed;
-    if (closeResult.code !== 4001 || !closeResult.reason.includes('session expired')) {
-      fail(`expired cookie websocket did not close with 4001/session expired:\n${JSON.stringify(closeResult, null, 2)}`);
-    }
-
+    let closeError = null;
+    const closeResult = await expiryWindow.waitForClose(closed).catch(error => {
+      closeError = error; return null;
+    });
+    // Inspect the HTTP and input boundaries even if the close observation
+    // times out; a missing close event must not hide accepted terminal input.
     const expiredHttp = await cookieRuntimeFetch('/api/runtime', auth);
+    const snapshot = await fetchTerminalSnapshot(expirySessionId, { root });
+    const inputRejected = !snapshot.includes(marker);
     if (expiredHttp.status !== 401) {
       fail(`expired browser cookie remained authorized over HTTP: ${expiredHttp.status}`);
     }
-    const snapshot = await fetchTerminalSnapshot(expirySessionId, { root });
-    if (snapshot.includes(marker)) {
+    if (!inputRejected) {
       fail(`expired browser cookie executed terminal input after expiry:\n${snapshot}`);
     }
+    if (closeError) {
+      fail(`expired cookie websocket close failed: code=${closeError.code || 'CLOSE_FAILED'} httpStatus=${expiredHttp.status} inputRejected=${inputRejected}`);
+    }
+    if (closeResult.error) throw closeResult.error;
+    if (closeResult.code !== 4001 || !closeResult.reason.includes('session expired')) {
+      fail(`expired cookie websocket did not close with 4001/session expired:\n${JSON.stringify(closeResult, null, 2)}`);
+    }
   } finally {
     if (ws && ws.readyState !== WebSocket.CLOSED) {
       try { ws.terminate(); } catch {}
@@ -2649,7 +3004,7 @@ async function webSecretRedactionWorkflow() {
   ]);
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`redaction web did not print background pid`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
 
   try {
     await waitRuntime();
@@ -2662,8 +3017,8 @@ async function webSecretRedactionWorkflow() {
       body: JSON.stringify({ token: secret }),
       redirect: 'manual'
     });
-    const sid = (login.headers.get('set-cookie') || '').match(/hcc_sid=([^;]+)/)?.[1] || '';
-    if (login.status !== 302 || !sid) fail(`redaction login failed with status ${login.status}`);
+    if (login.status !== 302) fail(`redaction login failed with status ${login.status}`);
+    const auth = browserSessionCookie(login.headers.get('set-cookie') || '', runtime.base_url);
 
     const create = await runtimeFetch('/api/sessions', {
       method: 'POST',
@@ -2677,7 +3032,7 @@ async function webSecretRedactionWorkflow() {
       })
     }, { root });
     if (!create.ok) fail(`redaction PTY create failed with status ${create.status}`);
-    terminalWs = await openCookieTerminalWebSocket(sessionId, sid, { root });
+    terminalWs = await openCookieTerminalWebSocket(sessionId, auth.cookie, { root });
     terminalWs.send(JSON.stringify({ type: 'resize', cols: 90, rows: 28,
       action_token: terminalWs.hccActionToken, epoch: terminalWs.hccControl.epoch }));
 
@@ -2694,7 +3049,7 @@ async function webSecretRedactionWorkflow() {
 
     const invalidCookie = await fetch(new URL('/api/runtime', runtime.base_url), {
       headers: {
-        Cookie: `hcc_sid=${secret}`,
+        Cookie: `${auth.name}=${secret}`,
         'X-HCC-API-Version': '2'
       }
     });
@@ -2743,6 +3098,7 @@ async function assertWebWrapperParentSurvives() {
   const wrapperRoot = fs.mkdtempSync(path.join(os.tmpdir(), `hcc-reg-wrapper-root-${testId}-`));
   const wrapperPort = port + 101;
   let wrapperPid = null;
+  let wrapperOwner = null;
   try {
     const script = [
       'set -e',
@@ -2757,44 +3113,62 @@ async function assertWebWrapperParentSurvives() {
     if (!match) fail(`wrapper hcc web did not print background pid:\n${result.stdout}`);
     wrapperPid = Number.parseInt(match[1], 10);
     ensureFile(path.join(wrapperRoot, '.hello-cc', 'runtime.json'));
+    wrapperOwner = JSON.parse(fs.readFileSync(path.join(wrapperRoot, '.hello-cc', 'runtime.json'), 'utf8')).process_identity;
   } finally {
-    runMaybe(process.execPath, [hccBin, '--root', wrapperRoot, 'down'], { env });
+    runMaybe(process.execPath, [hccBin, '--root', wrapperRoot, 'down'], { env: fixtureStopEnvironment(env) });
     if (wrapperPid) {
       try {
-        await waitForProcessExit(wrapperPid, 'wrapper runtime process exit', 5000);
+        await waitForFixtureOwnerExit(wrapperOwner, 5000);
       } catch {
-        try { process.kill(wrapperPid, 'SIGTERM'); } catch {}
-        try { await waitForProcessExit(wrapperPid, 'wrapper runtime process exit after SIGTERM', 2000); } catch {}
+        signalFixtureOwner(wrapperOwner, 'SIGTERM');
+        try { await waitForFixtureOwnerExit(wrapperOwner, 2000); } catch {}
       }
     }
     try { fs.rmSync(wrapperRoot, { recursive: true, force: true }); } catch {}
   }
 }
 
-async function stopRuntime() {
+async function stopRuntime({ peerStops = [] } = {}) {
   if (!runtimePid) return;
-  const pid = runtimePid;
-  hccMaybe(['down']);
+  const owner = runtimeOwner;
+  const before = observeFixtureOwner(owner);
+  const downStarted = performance.now();
+  const down = fixtureDownResult(stopFixtureCli());
+  const downDurationMs = Math.round(performance.now() - downStarted);
+  const afterDown = observeFixtureOwner(owner);
+  lastStopDiagnostic = { before, down, downDurationMs, afterDown, peerStops, stack: new Error('stopRuntime').stack.split('\n').slice(1, 7), signals: [] };
   try {
-    await waitForProcessExit(pid, 'runtime process exit', 5000);
+    await waitForFixtureOwnerExit(owner, 5000);
   } catch (err) {
-    try { process.kill(pid, 'SIGTERM'); } catch {}
+    lastStopDiagnostic.atDeadline = collectRuntimeDiagnostic({ before, down });
+    lastStopDiagnostic.signals.push(signalFixtureOwner(owner, 'SIGTERM'));
     try {
-      await waitForProcessExit(pid, 'runtime process exit after SIGTERM', 2000);
+      await waitForFixtureOwnerExit(owner, 2000);
     } catch {
-      try { process.kill(pid, 'SIGKILL'); } catch {}
-      try { await waitForProcessExit(pid, 'runtime process exit after SIGKILL', 2000); } catch {}
-      throw err;
+      lastStopDiagnostic.signals.push(signalFixtureOwner(owner, 'SIGKILL'));
+      try { await waitForFixtureOwnerExit(owner, 2000); } catch {}
     }
+    fail(`runtime stop failed: ${collectRuntimeDiagnostic(lastStopDiagnostic)}`);
   }
+  if (down.status !== 0) fail(`runtime down command failed: ${collectRuntimeDiagnostic(lastStopDiagnostic)}`);
   runtimePid = null;
+  runtimeOwner = null;
+}
+
+function stopFixtureCli() {
+  try {
+    const pointer = currentRuntime();
+    if (compareProcessIdentity(runtimeOwner, pointer.process_identity) === 'live' &&
+        runtimeOwner.commandHash === pointer.process_identity.commandHash) {
+      return hccMaybe(['--json', 'down'], { env: fixtureStopEnvironment(env) });
+    }
+  } catch {}
+  return { status: null, error: { code: 'FIXTURE_OWNER_POINTER_UNAVAILABLE' } };
 }
 
 function cleanup() {
-  try { hccMaybe(['down']); } catch {}
-  if (runtimePid) {
-    try { process.kill(runtimePid, 'SIGTERM'); } catch {}
-  }
+  try { stopFixtureCli(); } catch {}
+  if (runtimePid) signalFixtureOwner(runtimeOwner, 'SIGTERM');
   const managedPrefixes = [
     tmuxManagedSessionPrefix(root),
     tmuxManagedSessionPrefix(secondProjectRoot)
@@ -2813,10 +3187,6 @@ function cleanup() {
   if (fs.existsSync(path.join(fakeBin, 'tmux'))) {
     runMaybe('tmux', ['kill-server']);
   }
-  if (process.env.HCC_REGRESSION_PRESERVE_ARTIFACTS === '1') {
-    log(`regression artifacts preserved: ${root}`);
-    return;
-  }
   for (const dir of [root, home, fakeBin, outDir]) {
     try { fs.rmSync(dir, { recursive: true, force: true }); } catch {}
   }
@@ -2886,7 +3256,7 @@ async function setupRegression() {
   const output = hcc(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance']);
   const match = output.match(/^pid:\s*(\d+)/m);
   if (!match) fail(`hcc web did not print background pid during bootstrap:\n${output}`);
-  runtimePid = Number.parseInt(match[1], 10);
+  rememberRuntimePid(Number.parseInt(match[1], 10));
   await waitRuntime();
   for (const file of liveBufferFiles) ensureFile(file);
   for (const file of liveBufferFiles) fs.rmSync(file, { force: true });
@@ -2966,7 +3336,7 @@ async function setupRegression() {
   const directTlsOutput = hcc(['web', '--local', '--tls', '--port', String(port), '--no-discover', '--no-guidance']);
   const directTlsMatch = directTlsOutput.match(/^pid:\s*(\d+)/m);
   if (!directTlsMatch) fail(`direct TLS web did not print background pid:\n${directTlsOutput}`);
-  runtimePid = Number.parseInt(directTlsMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(directTlsMatch[1], 10));
   await waitFor(async () => {
     const runtimeFile = path.join(root, '.hello-cc', 'runtime.json');
     if (!fs.existsSync(runtimeFile)) return false;
@@ -2995,14 +3365,14 @@ async function setupRegression() {
     { headers: { Accept: 'text/html' } }
   );
   const directTlsSetCookie = String(directTlsExchange.headers['set-cookie']?.[0] || '');
-  const directTlsSid = directTlsSetCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (directTlsExchange.status !== 302 || !directTlsSid || !directTlsSetCookie.includes('Secure')) {
-    fail(`direct TLS login did not issue a Secure cookie: status=${directTlsExchange.status} cookie=${directTlsSetCookie}`);
+  if (directTlsExchange.status !== 302 || !directTlsSetCookie.includes('Secure')) {
+    fail(`direct TLS login did not issue a Secure cookie: status=${directTlsExchange.status}`);
   }
+  const directTlsAuth = browserSessionCookie(directTlsSetCookie, directTlsRuntime.base_url);
   const directTlsLogout = await directTlsRequest(directTlsRuntime, '/logout', {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${directTlsSid}`,
+      Cookie: directTlsAuth.cookie,
       Origin: new URL(directTlsRuntime.base_url).origin
     }
   });
@@ -3010,8 +3380,9 @@ async function setupRegression() {
   if (directTlsLogout.status !== 204 ||
       !directTlsLogoutCookie.includes('Max-Age=0') ||
       !directTlsLogoutCookie.includes('Secure')) {
-    fail(`direct TLS logout did not expire a Secure cookie: status=${directTlsLogout.status} cookie=${directTlsLogoutCookie}`);
+    fail(`direct TLS logout did not expire a Secure cookie: status=${directTlsLogout.status}`);
   }
+  browserSessionCookie(directTlsLogoutCookie, directTlsRuntime.base_url, { expired: true });
   await stopRuntime();
 
   await assertWebWrapperParentSurvives();
@@ -3025,7 +3396,7 @@ async function setupRegression() {
   const tokenOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const tokenMatch = tokenOutput.match(/^pid:\s*(\d+)/m);
   if (!tokenMatch) fail(`token web did not print background pid:\n${tokenOutput}`);
-  runtimePid = Number.parseInt(tokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(tokenMatch[1], 10));
   if (!tokenOutput.includes('token=') || !tokenOutput.includes('open: http://<machine-ip>:')) {
     fail(`default web output did not include remote token URL:\n${tokenOutput}`);
   }
@@ -3119,26 +3490,28 @@ async function setupRegression() {
   });
   if (exchange.status !== 302) fail(`browser-nav ?token did not exchange to a cookie redirect: ${exchange.status}`);
   const setCookie = exchange.headers.get('set-cookie') || '';
-  if (!setCookie.includes('hcc_sid=') || !setCookie.includes('HttpOnly') || !setCookie.includes('SameSite=Lax')) {
-    fail(`exchange did not set an HttpOnly SameSite cookie: ${setCookie}`);
-  }
-  if (setCookie.includes('Secure')) fail(`plaintext LAN exchange issued a Secure cookie: ${setCookie}`);
-  const sidMatch = setCookie.match(/hcc_sid=([^;]+)/);
-  if (!sidMatch) fail(`exchange did not return a session id: ${setCookie}`);
-  const sid = sidMatch[1];
-  // (b) API with the session cookie → 200
-  const withCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `hcc_sid=${sid}`, 'X-HCC-API-Version': '2' } });
+  if (!setCookie.includes('HttpOnly') || !setCookie.includes('SameSite=Lax')) {
+    fail('exchange did not set an HttpOnly SameSite cookie');
+  }
+  if (setCookie.includes('Secure')) fail('plaintext LAN exchange issued a Secure cookie');
+  const browserAuth = browserSessionCookie(setCookie, baseUrl);
+  // (b) API with the session cookie and explicitly selected project → 200
+  const cookieProjectIdentity = await selectCookieProject(baseUrl, browserAuth.cookie);
+  const withCookie = await fetch(`${baseUrl}/api/runtime`, {
+    headers: { Cookie: browserAuth.cookie, 'X-HCC-API-Version': '2', 'X-HCC-Root-Identity': cookieProjectIdentity }
+  });
   if (!withCookie.ok) fail(`API with session cookie required auth: ${withCookie.status}`);
   // (c) API with a bogus session cookie → 401
-  const bogusCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: 'hcc_sid=bogus', 'X-HCC-API-Version': '2' } });
+  const bogusCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `${browserAuth.name}=bogus`, 'X-HCC-API-Version': '2' } });
   if (bogusCookie.status !== 401) fail(`API with bogus session cookie did not 401: ${bogusCookie.status}`);
   // (d) cookie-authenticated writes require an exact same-origin Origin header.
   const crossOriginCookieWrite = await fetch(`${baseUrl}/api/csrf-probe`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${sid}`,
+      Cookie: browserAuth.cookie,
       Origin: `http://127.0.0.1:${port + 1}`,
       'X-HCC-API-Version': '2',
+      'X-HCC-Root-Identity': cookieProjectIdentity,
       'Content-Type': 'application/json'
     },
     body: '{}'
@@ -3153,9 +3526,10 @@ async function setupRegression() {
   const sameOriginCookieWrite = await fetch(`${baseUrl}/api/csrf-probe`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${sid}`,
+      Cookie: browserAuth.cookie,
       Origin: new URL(baseUrl).origin,
       'X-HCC-API-Version': '2',
+      'X-HCC-Root-Identity': cookieProjectIdentity,
       'Content-Type': 'application/json'
     },
     body: '{}'
@@ -3180,23 +3554,25 @@ async function setupRegression() {
     body: JSON.stringify({ token: cookieToken }),
     redirect: 'manual'
   });
-  if (loginPost.status !== 302 || !(loginPost.headers.get('set-cookie') || '').includes('hcc_sid=')) {
+  if (loginPost.status !== 302) {
     fail(`POST /login did not issue a session cookie: ${loginPost.status}`);
   }
+  browserSessionCookie(loginPost.headers.get('set-cookie') || '', baseUrl);
 
   // (h) logout revokes the opaque session and expires the browser cookie.
   const logout = await fetch(`${baseUrl}/logout`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${sid}`,
+      Cookie: browserAuth.cookie,
       Origin: new URL(baseUrl).origin
     }
   });
   const logoutCookie = logout.headers.get('set-cookie') || '';
-  if (logout.status !== 204 || !logoutCookie.includes('hcc_sid=') || !logoutCookie.includes('Max-Age=0')) {
-    fail(`logout did not revoke and expire the session cookie: status=${logout.status} cookie=${logoutCookie}`);
+  if (logout.status !== 204 || !logoutCookie.includes('Max-Age=0')) {
+    fail(`logout did not revoke and expire the session cookie: status=${logout.status}`);
   }
-  const revokedCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `hcc_sid=${sid}`, 'X-HCC-API-Version': '2' } });
+  browserSessionCookie(logoutCookie, baseUrl, { expired: true });
+  const revokedCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: browserAuth.cookie, 'X-HCC-API-Version': '2' } });
   if (revokedCookie.status !== 401) fail(`logout left the old session cookie authorized: ${revokedCookie.status}`);
 
   // (i) trusted loopback reverse-proxy headers mark issued and expired cookies
@@ -3209,7 +3585,7 @@ async function setupRegression() {
   ]);
   const proxyPidMatch = proxyOutput.match(/^pid:\s*(\d+)/m);
   if (!proxyPidMatch) fail(`trusted-proxy web did not print background pid:\n${proxyOutput}`);
-  runtimePid = Number.parseInt(proxyPidMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(proxyPidMatch[1], 10));
   await waitRuntime();
   const proxyRuntime = currentRuntime();
   if (proxyRuntime.proxy_origin !== proxyOrigin || proxyRuntime.trust_proxy !== true) {
@@ -3225,14 +3601,24 @@ async function setupRegression() {
     redirect: 'manual'
   });
   const proxySetCookie = proxyExchange.headers.get('set-cookie') || '';
-  const proxySid = proxySetCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (proxyExchange.status !== 302 || !proxySid || !proxySetCookie.includes('Secure')) {
-    fail(`trusted proxy login did not issue a Secure cookie: status=${proxyExchange.status} cookie=${proxySetCookie}`);
+  if (proxyExchange.status !== 302 || !proxySetCookie.includes('Secure')) {
+    fail(`trusted proxy login did not issue a Secure cookie: status=${proxyExchange.status}`);
   }
+  const proxyAuth = browserSessionCookie(proxySetCookie, proxyOrigin);
+  const proxyProjectIdentity = await selectCookieProject(baseUrl, proxyAuth.cookie, root, {
+    origin: proxyOrigin, headers: proxyHeaders
+  });
+  const withProxyCookie = await fetch(`${baseUrl}/api/runtime`, {
+    headers: {
+      ...proxyHeaders, Cookie: proxyAuth.cookie, 'X-HCC-API-Version': '2',
+      'X-HCC-Root-Identity': proxyProjectIdentity
+    }
+  });
+  if (!withProxyCookie.ok) fail(`trusted proxy API rejected its session cookie: ${withProxyCookie.status}`);
   const proxyLogout = await fetch(`${baseUrl}/logout`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${proxySid}`,
+      Cookie: proxyAuth.cookie,
       Origin: proxyOrigin,
       'X-Forwarded-Host': 'public.example.test:9443',
       'X-Forwarded-Proto': 'https'
@@ -3240,9 +3626,12 @@ async function setupRegression() {
   });
   const proxyLogoutCookie = proxyLogout.headers.get('set-cookie') || '';
   if (proxyLogout.status !== 204 || !proxyLogoutCookie.includes('Max-Age=0') || !proxyLogoutCookie.includes('Secure')) {
-    fail(`trusted proxy logout did not expire a Secure cookie: status=${proxyLogout.status} cookie=${proxyLogoutCookie}`);
+    fail(`trusted proxy logout did not expire a Secure cookie: status=${proxyLogout.status}`);
   }
-  const revokedProxyCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `hcc_sid=${proxySid}`, 'X-HCC-API-Version': '2' } });
+  browserSessionCookie(proxyLogoutCookie, proxyOrigin, { expired: true });
+  const revokedProxyCookie = await fetch(`${baseUrl}/api/runtime`, {
+    headers: { ...proxyHeaders, Cookie: proxyAuth.cookie, 'X-HCC-API-Version': '2' }
+  });
   if (revokedProxyCookie.status !== 401) fail(`trusted proxy logout left the old cookie authorized: ${revokedProxyCookie.status}`);
 
   // A forwarded authority other than the pinned public origin is untrusted.
@@ -3257,7 +3646,7 @@ async function setupRegression() {
   });
   const defaultPortProxySetCookie = defaultPortProxyExchange.headers.get('set-cookie') || '';
   if (defaultPortProxyExchange.status !== 403 || defaultPortProxySetCookie) {
-    fail(`unpinned proxy authority received a session: status=${defaultPortProxyExchange.status} cookie=${defaultPortProxySetCookie}`);
+    fail(`unpinned proxy authority received a session: status=${defaultPortProxyExchange.status} setCookie=${Boolean(defaultPortProxySetCookie)}`);
   }
   const unpinnedProxyLogin = await fetch(`${baseUrl}/login`, {
     method: 'POST',
@@ -3282,7 +3671,7 @@ async function setupRegression() {
     });
     const spoofedLanCookie = spoofedLanExchange.headers.get('set-cookie') || '';
     if (spoofedLanExchange.status !== 403 || spoofedLanCookie) {
-      fail(`non-loopback forwarded spoof received a session: status=${spoofedLanExchange.status} cookie=${spoofedLanCookie}`);
+      fail(`non-loopback forwarded spoof received a session: status=${spoofedLanExchange.status} setCookie=${Boolean(spoofedLanCookie)}`);
     }
   } else {
     log('non-loopback forwarded spoof: no non-loopback IPv4 interface; focused boundary coverage retained');
@@ -3295,7 +3684,7 @@ async function setupRegression() {
   ]);
   const restoredPidMatch = restoredOutput.match(/^pid:\s*(\d+)/m);
   if (!restoredPidMatch) fail(`post-proxy web did not print background pid:\n${restoredOutput}`);
-  runtimePid = Number.parseInt(restoredPidMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(restoredPidMatch[1], 10));
   await waitRuntime();
 
   const badJsonResponse = await runtimeFetch('/api/projects', {
@@ -3322,7 +3711,7 @@ async function setupRegression() {
   const stableTokenOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const stableTokenMatch = stableTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!stableTokenMatch) fail(`stable-token web did not print background pid:\n${stableTokenOutput}`);
-  runtimePid = Number.parseInt(stableTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(stableTokenMatch[1], 10));
   await waitRuntime();
   const stableTokenRuntime = currentRuntime();
   if (stableTokenRuntime.token === tokenRuntime.token) {
@@ -3336,7 +3725,7 @@ async function setupRegression() {
   });
   const fixedTokenMatch = fixedTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!fixedTokenMatch) fail(`fixed-token web did not print background pid:\n${fixedTokenOutput}`);
-  runtimePid = Number.parseInt(fixedTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(fixedTokenMatch[1], 10));
   await waitRuntime();
   const fixedTokenRuntime = currentRuntime();
   if (fixedTokenRuntime.token !== fixedToken || !fixedTokenOutput.includes(`token=${encodeURIComponent(fixedToken)}`)) {
@@ -3347,7 +3736,7 @@ async function setupRegression() {
   const postFixedOutput = hcc(['web', '--host', '0.0.0.0', '--port', String(port), '--no-discover', '--no-guidance']);
   const postFixedMatch = postFixedOutput.match(/^pid:\s*(\d+)/m);
   if (!postFixedMatch) fail(`post-fixed-token web did not print background pid:\n${postFixedOutput}`);
-  runtimePid = Number.parseInt(postFixedMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(postFixedMatch[1], 10));
   await waitRuntime();
   const postFixedRuntime = currentRuntime();
   if (postFixedRuntime.token === fixedToken || fs.existsSync(tokenFile)) {
@@ -3360,7 +3749,7 @@ async function setupRegression() {
   const noTokenOutput = hcc(['web', '--local', '--port', String(port), '--no-token', '--no-discover', '--no-guidance']);
   const noTokenMatch = noTokenOutput.match(/^pid:\s*(\d+)/m);
   if (!noTokenMatch) fail(`explicit no-token web did not print background pid:\n${noTokenOutput}`);
-  runtimePid = Number.parseInt(noTokenMatch[1], 10);
+  rememberRuntimePid(Number.parseInt(noTokenMatch[1], 10));
   if (noTokenOutput.includes('token=')) {
     fail(`explicit no-token web output included token:\n${noTokenOutput}`);
   }
@@ -4427,13 +4816,21 @@ async function multiProjectWebWorkflow() {
     fail(`detected API did not return liveness metadata:\n${JSON.stringify(detectedJson, null, 2)}`);
   }
 
-  const htmlResponse = await fetch(currentRuntimeUrl('/'));
-  const html = await htmlResponse.text();
+  const htmlResponse = await withFixtureHttpDiagnostic('/', {}, () => fetch(currentRuntimeUrl('/')));
+  const pageHtml = await htmlResponse.text();
+  if (!pageHtml.includes('type="module" src="/assets/web/browser/core.mjs"')) fail('web page missing ESM bootstrap');
+  const moduleSources = [];
+  for (const asset of ['browser/core.mjs', 'ui-agent-start.mjs']) {
+    const response = await runtimeFetch('/assets/web/' + asset);
+    if (!response.ok || !response.headers.get('content-type')?.includes('javascript')) fail('web ESM asset did not load: ' + asset);
+    moduleSources.push(await response.text());
+  }
+  const html = pageHtml + '\n' + moduleSources.join('\n');
   const startFormHtml = html.match(/<form\b[^>]*\bid="startForm"[^>]*>[\s\S]*?<\/form>/)?.[0];
   if (!startFormHtml) fail('web form missing simplified session form');
   // A current-directory label in an approval or session details is valid;
   // obsolete creation inputs must be checked inside the creation form.
-  for (const forbidden of ['Alias optional', 'Role tag', 'Command<input', 'Working directory']) {
+  for (const forbidden of ['Alias optional', 'Role tag', 'Command<input']) {
     if (startFormHtml.includes(forbidden)) fail(`web form still exposes ${forbidden}`);
   }
   for (const forbidden of ['commandbar', 'lineInput', 'Send text to active terminal']) {
@@ -4444,6 +4841,7 @@ async function multiProjectWebWorkflow() {
     'id="projectPath"',
     'id="addProjectBtn"',
     'id="startForm"',
+    'id="agentCwd"',
     'id="kind"',
     'id="sessionKindFilter"',
     'id="sessions"'
@@ -4487,7 +4885,7 @@ async function multiProjectWebWorkflow() {
       !html.includes("fetch('/logout', { method: 'POST', headers })")) {
     fail('web UI missing logout control or session revocation request');
   }
-  if (!html.includes('id="startMode"') || !html.includes('id="resumeArg"') || !html.includes('syncStartModeOptions') || !html.includes("mode === 'resume'")) {
+  if (!html.includes('id="startMode"') || !html.includes('id="resumeArg"') || !html.includes('syncStartModeOptions') || !html.includes("mode.value === 'resume'")) {
     fail('web form missing provider resume controls');
   }
   for (const expected of [
@@ -4742,7 +5140,7 @@ async function multiProjectWebWorkflow() {
     fail(`same-origin cookie administrator create failed or leaked its action token:\n${JSON.stringify(cookieCreated, null, 2)}`);
   }
 
-  const cookieAdminWs = await openCookieTerminalWebSocket(cookieAdminId, cookieAdmin.sid, { root });
+  const cookieAdminWs = await openCookieTerminalWebSocket(cookieAdminId, cookieAdmin.cookie, { root }, cookieAdmin.projectIdentity);
   try {
     if (!cookieAdminWs.hccActionToken) fail('cookie administrator terminal snapshot omitted its action token');
     const inputRoute = `/api/sessions/${encodeURIComponent(cookieAdminId)}/input`;
@@ -5782,6 +6180,7 @@ async function bufferGcArbitrationWorkflow() {
   } finally {
     unifiedDb.close();
   }
+  const gapPreviewStartedAtSec = Math.floor(Date.now() / 1000);
   setSiblingClockGap(Math.floor(fs.statSync(gapOrphan).mtimeMs / 1000));
   const beforeGapPreviewDb = new DatabaseSync(path.join(secondProjectRoot, '.hello-cc', 'mesh.db'), { timeout: 5000 });
   let beforeGapMeta;
@@ -5794,8 +6193,11 @@ async function bufferGcArbitrationWorkflow() {
   const afterGapPreviewDb = new DatabaseSync(path.join(secondProjectRoot, '.hello-cc', 'mesh.db'), { timeout: 5000 });
   try {
     const afterGapMeta = afterGapPreviewDb.prepare('SELECT key, value FROM meta ORDER BY key').all();
-    if (JSON.stringify(afterGapMeta) !== JSON.stringify(beforeGapMeta) ||
-        !afterGapPreviewDb.prepare('SELECT 1 FROM events WHERE id = ?').get(unifiedIds.event) ||
+    assertGcPreviewMetadata(beforeGapMeta, afterGapMeta, {
+      startedAtSec: gapPreviewStartedAtSec,
+      finishedAtSec: Math.floor(Date.now() / 1000)
+    });
+    if (!afterGapPreviewDb.prepare('SELECT 1 FROM events WHERE id = ?').get(unifiedIds.event) ||
         !afterGapPreviewDb.prepare("SELECT 1 FROM locks WHERE resource = 'gc-unified-lock'").get() ||
         !afterGapPreviewDb.prepare("SELECT 1 FROM peers WHERE id = 'gc-unified-dead'").get()) {
       fail(`manual GC dry-run changed unified clock state: ${JSON.stringify({ beforeGapMeta, afterGapMeta })}`);
@@ -6258,13 +6660,53 @@ async function shimTmuxWorkflow() {
     cwd: root,
     env: { ...shimEnv, HCC_REG_VALUE: 'shim-second' }
   });
-  parsePane(restarted);
+  const restartedPane = parsePane(restarted);
   const secondEnvFile = path.join(outDir, 'shim-env-second');
   hcc(['inject', peer, `printf '%s\\n' "$HCC_REG_VALUE" > ${secondEnvFile}`]);
   await waitForFile(secondEnvFile, 'shim-second', 'shim env restart');
   const reentryFile = path.join(outDir, 'shim-reentry');
-  hcc(['inject', peer, `HCC_FAKE_STAY_ALIVE=0 HCC_REG_VALUE=shim-third ${sh(shim)} --resume shim-regression-session > ${sh(reentryFile)} 2>&1`]);
-  await waitForFileContent(reentryFile, 'fake-claude --resume shim-regression-session', 'shim tmux pane re-entry');
+  const reentryTrace = path.join(outDir, 'shim-reentry-stages');
+  const reentryStatus = path.join(outDir, 'shim-reentry-status');
+  const reentryProvider = path.join(outDir, 'shim-reentry-provider');
+  const reentryProbe = pathToFileURL(path.join(repoRoot, 'scripts', 'shim-reentry-probe.mjs')).href;
+  const reentryEventId = withMeshDb(db => db.prepare('SELECT MAX(id) AS id FROM events').get().id || 0);
+  const reentryStarted = Date.now();
+  hcc(['inject', peer, `printf 'started\\n' > ${sh(reentryStatus)}; HCC_FAKE_STAY_ALIVE=0 HCC_REG_VALUE=shim-third HCC_FAKE_LOG=${sh(reentryProvider)} HCC_REGRESSION_REENTRY_TRACE=${sh(reentryTrace)} HCC_REGRESSION_REENTRY_BIN=${sh(hccBin)} NODE_OPTIONS="\${NODE_OPTIONS:+\${NODE_OPTIONS} }"${sh(`--import=${reentryProbe}`)} ${sh(shim)} --resume shim-regression-session > ${sh(reentryFile)} 2>&1; printf '%s\\n' "$?" >> ${sh(reentryStatus)}`]);
+  await waitForFileContent(reentryFile, 'fake-claude --resume shim-regression-session', 'shim tmux pane re-entry', {
+    ownedReentryOutput: true,
+    diagnostics: () => {
+      // Query only this fixture's pane and fixed event types. Full terminal
+      // captures, process arguments, request bodies and environment are excluded.
+      const paneResult = spawnSync('tmux', ['display-message', '-p', '-t', restartedPane,
+        '#{pane_id}|#{pane_dead}|#{pane_current_command}'], {
+        env, encoding: 'utf8', timeout: 1000, maxBuffer: 1024, stdio: ['ignore', 'pipe', 'ignore']
+      });
+      const paneParts = (paneResult.stdout || '').trim().split('|');
+      const pane = {
+        found: paneResult.status === 0 && /^%\d+$/.test(paneParts[0] || ''),
+        dead: paneParts[1] === '1',
+        command: /^[A-Za-z0-9_.-]{1,40}$/.test(paneParts[2] || '') ? paneParts[2] : 'unknown'
+      };
+      let status = [];
+      try { status = fs.readFileSync(reentryStatus, 'utf8').slice(0, 32).trim().split('\n'); } catch {}
+      let events = [];
+      let db;
+      try {
+        db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { timeout: 250, readOnly: true });
+        events = db.prepare(`SELECT type, created_at FROM events WHERE id > ? AND actor = ?
+          AND type IN ('peer.attach.requested', 'tmux.session.attached', 'tmux.session.detached', 'tmux.session.exited')
+          ORDER BY id DESC LIMIT 8`).all(reentryEventId, peer);
+      } catch { events = [{ state: 'unavailable' }]; }
+      finally { if (db) db.close(); }
+      return {
+        elapsed_ms: Date.now() - reentryStarted,
+        shell_started: status[0] === 'started',
+        shell_exit: /^\d{1,3}$/.test(status[1] || '') ? Number(status[1]) : null,
+        provider_entered: fs.existsSync(reentryProvider),
+        pane, stages: readReentryTrace(reentryTrace), events
+      };
+    }
+  });
   hcc(['peer', 'stop', peer]);
 
   const exitedResume = 'shim-exited-session';
@@ -6384,15 +6826,18 @@ async function askBroadcastWorkflow() {
   }
   await waitForFile(dispatchFile, 'DISPATCH_OK', 'task dispatch injection');
   const broadcastFile = path.join(outDir, 'broadcast-ok');
-  hcc(['broadcast', `echo BROADCAST_OK > ${broadcastFile}`, '--from', 'human', '--inject']);
+  hccJson(['broadcast', `echo BROADCAST_OK > ${broadcastFile}`, '--from', 'human', '--inject'], { diagnosticOperation: 'broadcast' });
   await waitForFile(broadcastFile, 'BROADCAST_OK', 'broadcast injection');
 }
 
 async function downGcPackWorkflow() {
   log('[9/13] down/gc/pack');
-  hccMaybe(['peer', 'stop', 'shell-a']);
-  hccMaybe(['peer', 'stop', 'shell-b']);
-  await stopRuntime();
+  const peerStops = ['shell-a', 'shell-b'].map(peer => {
+    const started = performance.now();
+    const result = fixtureDownResult(hccMaybe(['--json', 'peer', 'stop', peer]));
+    return { ...result, durationMs: Math.round(performance.now() - started) };
+  });
+  await stopRuntime({ peerStops });
   await waitFor(() => !fs.existsSync(path.join(root, '.hello-cc', 'runtime.json')), 'runtime cleanup', 5000);
   hcc(['gc', '--older-than', '0', '--yes']);
   const pack = JSON.parse(run('npm', ['pack', '--dry-run', '--json']));
@@ -6641,7 +7086,7 @@ async function syntaxAndHelp() {
   const integrationShimScriptSource = fs.readFileSync(path.join(repoRoot, 'lib', 'integrations', 'shims', 'script.mjs'), 'utf8');
   const shellPathSource = fs.readFileSync(path.join(repoRoot, 'lib', 'shell-path.mjs'), 'utf8');
   const webPeerActionsSource = fs.readFileSync(path.join(repoRoot, 'lib', 'web', 'peer-actions.mjs'), 'utf8');
-  const webUiTemplateSource = fs.readFileSync(path.join(repoRoot, 'lib', 'web', 'ui-template.mjs'), 'utf8');
+  const webUiTemplateSource = ['ui-template.mjs', 'browser/core.mjs'].map(name => fs.readFileSync(path.join(repoRoot, 'lib', 'web', name), 'utf8')).join('\n');
   const tmuxSafetySource = fs.readFileSync(path.join(repoRoot, 'lib', 'core', 'peers', 'tmux-safety.mjs'), 'utf8');
   // cmdWeb moved whole to lib/web/runtime-main.mjs; subsystem modules extend it
   const cmdWebSource = [
@@ -6705,15 +7150,15 @@ async function syntaxAndHelp() {
     'sameResolvedPath(global.root, ctx.root)',
     'sameResolvedPath(global.db, ctx.dbPath)',
     'async function stopOrphanWebRuntimes(',
-    'await stopOrphanWebRuntimes(ctx, existing.pid || null);',
-    'await stopOrphanWebRuntimes(ctx);'
+    'await stopOrphanWebRuntimes(boundCtx, existing.pid || null);',
+    'await stopOrphanWebRuntimes(boundCtx);'
   ]) {
     if (!webStartupSource.includes(expected)) fail(`web startup guard missing: ${expected}`);
   }
   for (const expected of [
     'function listTmuxPanesOnce()',
     'let autoAttachScanInFlight = false;',
-    'if (autoAttachScanInFlight) return;',
+    'if (isStopping() || autoAttachScanInFlight) return;',
     'const paneByPid = new Map();',
     'const attached = attachedTmuxState(ctx, db);',
     'function killOldTmuxForRebind(',
@@ -7073,7 +7518,7 @@ async function syntaxAndHelp() {
       !hccSource.includes("} from '../web/http.mjs'") ||
       !hccSource.includes("import * as webUiTemplate from '../web/ui-template.mjs'") ||
       !hccSource.includes('const VERSION = PACKAGE_META.version') ||
-      !hccSource.includes('writeGuidanceForRoot(ctx.root)')) {
+      !hccSource.includes('writeGuidanceForRoot(ctx.root, { expectedSnapshot: ctx.initialRootIdentity })')) {
     fail('CLI still has duplicated package metadata, cli args, DB schema helpers, CLI runtime helpers, coordination state helpers, format helpers, runtime paths/state helpers, runtime client helpers, project context helpers, handoff helpers, timeline helpers, task liveness helpers, automation helpers, state render helpers, help text helpers, message store helpers, task store helpers, task CLI helpers, session launch helpers, provider command helpers, peer binding helpers, tmux helpers, lock helpers, team planning helpers, peer identity helpers, project registry helpers, web runtime/HTTP/UI helpers, or guidance wiring');
   }
   for (const expected of [
@@ -10657,6 +11102,13 @@ function manualGcRetentionContractWorkflow() {
     }
     if (fs.existsSync(ordinaryBuffer)) fail('ordinary GC did not remove eligible technical buffer state');
 
+    const beforeDryRun = new DatabaseSync(gcDbPath, { timeout: 5000 });
+    let beforeDryRunMeta;
+    try {
+      beforeDryRunMeta = beforeDryRun.prepare('SELECT key, value FROM meta ORDER BY key').all();
+    } finally {
+      beforeDryRun.close();
+    }
     const historyDryRun = readJson(['gc', '--older-than', '0', '--history']);
     for (const key of ['old_events', 'old_tasks', 'old_messages', 'old_handoffs']) {
       if (Number(historyDryRun[key] || 0) < 1) {
@@ -10668,6 +11120,10 @@ function manualGcRetentionContractWorkflow() {
     }
     const afterDryRun = new DatabaseSync(gcDbPath, { timeout: 5000 });
     try {
+      const afterDryRunMeta = afterDryRun.prepare('SELECT key, value FROM meta ORDER BY key').all();
+      if (JSON.stringify(afterDryRunMeta) !== JSON.stringify(beforeDryRunMeta)) {
+        fail(`CLI-only history dry-run changed persisted metadata: ${JSON.stringify({ beforeDryRunMeta, afterDryRunMeta })}`);
+      }
       if (!rowExists(afterDryRun, 'messages', seeded.message) ||
           !rowExists(afterDryRun, 'handoffs', seeded.handoff)) {
         fail('history dry-run changed persisted history');
@@ -11168,11 +11624,16 @@ function gcCoverageWorkflow() {
 }
 
 async function main() {
+  realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
+    encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore']
+  }).stdout.trim();
   process.once('SIGINT', () => { cleanup(); process.exit(130); });
   process.once('SIGTERM', () => { cleanup(); process.exit(143); });
 
   await setupRegression();
+  currentStage = 'webSecretRedactionWorkflow';
   await webSecretRedactionWorkflow();
+  currentStage = 'cookieSessionExpiryWorkflow';
   await cookieSessionExpiryWorkflow();
   log('[2/13] runtime');
   startRuntime();
@@ -11204,12 +11665,18 @@ async function main() {
   log('FULL_REGRESSION_OK');
 }
 
-main().catch((err) => {
+if (isRegressionEntry()) main().catch((err) => {
+  const failure = fixtureFailureDiagnostic(err);
+  const diagnostic = collectRuntimeDiagnostic({ failure, stop: lastStopDiagnostic });
+  process.stderr.write(`[regression failure diagnostic] ${diagnostic}\n`);
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    process.stderr.write(`::error::${diagnostic.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A')}\n`);
+  }
   try { assertNoRealProjectRegistryLeak(); } catch (leakErr) {
-    process.stderr.write(`${leakErr.stack || leakErr.message}\n`);
+    process.stderr.write(`${fixtureDiagnosticText(leakErr.stack || leakErr.message, diagnosticSecrets)}\n`);
   }
   cleanup();
-  process.stderr.write(`${err.stack || err.message}\n`);
+  process.stderr.write(`${fixtureDiagnosticText(err.stack || err.message, diagnosticSecrets)}\n`);
   process.exit(1);
 }).finally(() => {
   try {