reliquary/docs/workpad/reports/2026-10-16-09-headless-forks-preflight.md

Preflight report — headless forks, Phase 0

GO — every STOP item passed (P0.0 uv, P0.1 detach on rung 3 hidden, P0.2 large base, P0.3 usage); P0.4 and P0.6 passed too, so the parallel cap stays 2 and pings default on.

• Date: 2026-10-16, 08:16–12:16 +0200 (times from date; probing ended 10:13, the clock jumped from 10:13 to 12:16 between two consecutive commands, cause unknown)
• Run by: the Athanor, model id claude-opus-5-5[1m], from its own Bash (Agent-spawned subagent of the Desktop session, Windows 10, Git Bash)
• Build plan: plans/2026-10-16-02-headless-forks-build.md §6 Phase 0 (amends plan §7 Phase 0)
• Branch / checkout: headless-forks in .claude/worktrees/headless-forks, from d373689
• Raw files (not in git): C:\Users\g4b\AppData\Local\Temp\claude\G--dev-projects-reliquary\42c87f82-5542-46aa-8d01-4166e3f0bcfe\scratchpad\headless-forks-p0\ — $P0 below. Probe code in $P0\probes\, streams and summaries in $P0\raw\<item>\.
• Binary under test: $CLAUDE_CODE_EXECPATH = Desktop claude.exe 2.1.299 (PATH claude is 2.1.283; used once by accident, noted at P0.1).
• Spend: $5.68 client estimate (total_cost_usd), summed as per-call deltas over 45 calls by $P0\probes\spend.py; plus three killed claude calls that wrote no result (r3-kill3, r3-kill5, r5-kill, a few cents). Limit was $25 before P0.2 completed; $4.87 had been spent by 08:55, after P0.2–P0.5, P0.7 and P0.8.

Defaults Phase 1 must use

Topic	Default	From
Spawn rung	Rung 3, hidden: the launcher creates the supervisor through CIM with a hidden window: powershell -NoProfile -NonInteractive -Command "$si = New-CimInstance -ClassName Win32_ProcessStartup -ClientOnly -Property @{ShowWindow=[uint16]0}; Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine=…; CurrentDirectory=…; ProcessStartupInformation=$si}", reading ReturnValue and ProcessId. Launch cost about 0.3 s. Without ShowWindow=0 the supervisor opens a visible console window (Windows Terminal tab titled with the interpreter path; user report and positive control).	P0.1
No visible windows	Every child the supervisor starts (claude, any helper process) is spawned with CREATE_NO_WINDOW (0x08000000), never DETACHED_PROCESS or CREATE_NEW_CONSOLE (a console-less parent makes each console child open its own window). claude's Bash children inherit the hidden console: no window seen with a 10-process tree (claude.exe → bash.exe ×3 → PING.EXE, 4 conhost.exe). Phase 1 tests and the smoke check "no visible window of the tree" (EnumWindows + IsWindowVisible on the tree's pids, plus visible ConsoleWindowClass/CASCADIA_HOSTING_WINDOW_CLASS windows).	P0.1 retest
Supervisor env	CIM gives the child the registry default user env, not the caller's. The launcher writes the full scrubbed child env into the job's state (e.g. jobs/<job>.json or a sidecar) and the supervisor passes exactly that env to claude. The binary path is stored absolute (it is in the fingerprint anyway).	P0.1
Interpreter	sys._base_executable (differs from sys.executable under uv run: venv launcher …\archive-v0\<id>\Scripts\python.exe vs …\uv\python\cpython-3.13.1-…\python.exe), with -I. -I drops the script dir from sys.path; the supervisor must not rely on it.	P0.0, C6
Kill	taskkill /T /F /PID <supervisor>; verify by recorded pid + creation time.	P0.1
Scrub additions (uv)	Drop VIRTUAL_ENV; drop PATH entries under VIRTUAL_ENV or sys.prefix (one entry: <venv>\Scripts, prepended). uv sets no UV_* vars here; dropping UV_* stays as a guard. Keep PYTHONDONTWRITEBYTECODE (host-set, not uv).	P0.0
where must report (host CLAUDE_CODE_* and kin on neither list)	CLAUDE_CODE_SESSION_ATTENDED, CLAUDE_CODE_DISABLE_CRON, CLAUDE_CODE_EAGER_FLUSH, CLAUDE_CODE_SIMPLE, CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES, CLAUDE_CODE_ORGANIZATION_UUID, CLAUDE_CODE_ACCOUNT_UUID, CLAUDE_CODE_USER_EMAIL, CLAUDE_CODE_OAUTH_SCOPES, CLAUDE_CODE_DISABLE_TERMINAL_TITLE, CLAUDE_CODE_STARTUP_FAILURE_RESULTS, CLAUDE_AGENT_SDK_MCP_NO_PREFIX, CLAUDE_PREVIEW_CLASSIFIER_FLOOR, DISABLE_MICROCOMPACT. All were inherited (kept) in every probe call and auth worked.	P0.0 env listing
Usage rule	Per call: the four columns and the 1h/5m split come from the result event's top-level usage (input_tokens, output_tokens, cache_creation_input_tokens, cache_read_input_tokens, cache_creation.ephemeral_1h_input_tokens / ephemeral_5m_input_tokens). For a fork this equals the modelUsage delta against the base's cumulative modelUsage, field for field (7 of 7 forks). models_used = the modelUsage keys whose counts grew. Cost Δ = total_cost_usd − the session total before the call (= the modelUsage[m].costUSD delta, 7 of 7). Never sum stream assistant events for output_tokens: they carry interim counts (seq forks: 102 summed vs 1,448 real).	P0.3
usage_mismatch	Compare result.usage with the modelUsage delta (they agreed exactly here).	P0.3
Cache verdict input	First assistant event's usage (input and cache fields are final there). Base context = input + cache_creation + cache_read of the base's last assistant message; the stream and the transcript give the same number (182,204).	P0.2, P0.7
Parallel cap	2 (P0.4 passed).	P0.4
Pings	on by default (init --pings on): a ping 50 min after the base's last hit kept it warm to 65 min (P0.6 pass). A ping can itself re-create part of the prefix (7,463 of 88,571 here) and still count as a hit.	P0.6
Fingerprint fields	Keep all launch fields of design §3.3. Effort stays pinned but is not cache-defining: a --effort medium fork of a high base read 182,202 of 182,204 tokens from cache, same as the control. init has no effort field (per_turn_effort_active: true only).	P0.5
Model ids	Full ids accepted; [1m] accepted (init.model and the modelUsage key both read claude-opus-5-5[1m]; message.model reads claude-opus-5-5). Compare models_used with the requested id including the suffix.	P0.5
availableModels rule (C8, D5)	A requested id is admitted if a list contains the id itself or its family alias (opus, sonnet, haiku, fable); no list in user/project/local settings admits everything. An id that is not admitted is not refused: Claude Code silently runs a permitted model and emits {"type":"system","subtype":"informational","level":"warning","content":"Model \"<id>\" is restricted by your organization's settings. Using <other> instead."}. So init applies the admit rule (exit 2 per C8), and at runtime the supervisor treats that event, or a modelUsage key ≠ the requested id, as failed, reason model_refused. In reliquary all four family aliases are listed, so every full id is admitted (U4 is moot for Sonnet and Haiku).	P0.5
Injection (R4)	! injection ran in an Agent-tool subagent's preload (probe where called 4.8 s after the headless launch). allowed-tools: Bash(uv:*) did not pre-approve the subagent's later uv run …/probe.py ping (denied: "This command requires approval"). SKILL.md must tell projects to add a Bash(uv run:*) (or Bash(uv:*)) allow rule; reliquary has Bash(uv:*). Caveat: the probe dir was an untrusted workspace.	P0.8
Fork session ids	--session-id <uuid> with --resume <base> --fork-session is honoured: the fork gets that id. The helper may pre-assign fork ids.	P0.7

Results per item

Item	Result	Variant / notes
P0.0 uv	pass	(a) repo cwd, (b) pyproject.toml cwd, (c) .python-version = 3.9 cwd: all rc 0, stdout one JSON line, Python 3.13.1 in all three, no .venv/uv.lock created.
P0.1 detach	pass, rung 3 hidden	Rungs 1 and 2 failed (d). Rung 3 passed (a)–(d) and the tree-kill but showed a visible console window (fails the added "no visible window" criterion). Rung 3 with ShowWindow=0 and CREATE_NO_WINDOW children passed (a), (b), (d), the tree-kill and "no visible window"; (c) passed (1,000 s, no window in 24 checks).
P0.2 large base	pass	Base 182,204 context tokens, three sequential forks each read 182,202 on the first request (0.99999), no compaction.
P0.3 usage	pass	Rule above; reproducible on 7 forks (1, 3 and 7 turns).
P0.4 parallel	pass	No index.lock, both edits intact, both first requests 0.99999; the Athanor gated and committed both.
P0.5 flags and models	pass (all accepted)	Table below.
P0.6 TTL	pass	A's fork at 65 min after a 50-min ping: 1.0004; B's fork at 65 min without ping: 0.080 (partial).
P0.7 transcripts	recorded	Message usage present on every assistant line; copied base messages keep message.id and uuid; R6 honoured.
P0.8 injection proxy	injection yes, pre-approval no	Informational; fallback text applies.
Spend trigger	not hit	$5.68 total; $4.87 by 08:55 (P0.2 long done)

STOP criteria (plan decision 1, build plan §6): P0.0 pass, P0.1 pass (rung 3), P0.2 pass, P0.3 pass. No STOP. No fallback beyond the ladder was needed; rung 3 needed the hidden-window fix added after the coordinator's message.

---

P0.0 uv

• Probe: $P0\probes\p00_probe.py, the plan §2 PEP 723 header. Command: uv run "C:/…/probes/p00_probe.py" from the Athanor's Bash. Raw: $P0\raw\p00\.
• uv 0.5.13 (c456bae5e 2024-12-27). Python chosen: CPython 3.13.1, the cached archive venv C:\Users\g4b\AppData\Local\uv\cache\archive-v0\1V7ITIfzQwCDPBZsZhb9M. The same venv in all three cwds.
• (a) cwd = worktree; (b) cwd = $P0\p00-pyproject with [project] (deps requests, hatchling build): no sync, no .venv, no uv.lock; (c) cwd = $P0\p00-pyver with .python-version = 3.9 (3.9.16 is installed): 3.13.1 chosen, requires-python >= 3.10 wins.
• stdout: exactly the probe's one line in every run. stderr: one line, Reading inline script metadata from ….
• Latency: warm 125–134 ms (5 runs); cold uv cache (fresh UV_CACHE_DIR) 532 ms. The first-ever run in the real cache was not timed (the first probe call warmed it).
• Env diff Bash → inside uv run: added VIRTUAL_ENV (= the archive venv); PATH gains <venv>\Scripts at the head; no UV_*; PYTHONDONTWRITEBYTECODE=1 is host-set (present in Bash too).
• Resolved tools inside uv run: git = C:\Program Files\Git\mingw64\bin\git.EXE (2.34.1.windows.1), claude = C:\Users\g4b\.local\bin\claude.EXE (2.1.283), uv = C:\Users\g4b\.local\bin\uv.EXE, python = the venv's.
• sys.executable = …\archive-v0\1V7ITIfzQwCDPBZsZhb9M\Scripts\python.exe; sys._base_executable = C:\Users\g4b\AppData\Roaming\uv\python\cpython-3.13.1-windows-x86_64-none\python.exe (C6 applies).

P0.1 detach

Probes: p01_launch.py (run under uv run, spawns the supervisor by rung), p01_sup.py (supervisor: ticks every 10 s, a python sleeper child, claude -p calls at given offsets), p01_check.py (pid + creation-time liveness, CIM descendant snapshot, taskkill /T /F). Raw: $P0\raw\p01\<tag>\ (launch.json, state.json, tick.log, sleeper.log, check-*.json, claude*.jsonl).

Job objects: IsProcessInJob was false for the uv run launcher and for every supervisor, so CREATE_BREAKAWAY_FROM_JOB had nothing to break from (A5's premise does not hold on this host today).

What the Bash tool does: a call that exceeds its timeout (5 s and 8 s tried) is not killed; it is moved to the background ("Command did not complete within its 5s timeout and was moved to the background"), and its completion notification arrived in this subagent. To get the "killed Bash call" of (d), the backgrounded task was stopped with TaskStop, which kills the process tree by parent links.

Rung	Tag	(a) uv exits	(b) Bash call ends	(c) ≥ 15 min, growing, completes	(d) Bash call killed (launcher still alive)	Tree-kill
1 DETACHED_PROCESS|CREATE_NEW_PROCESS_GROUP|CREATE_BREAKAWAY_FROM_JOB (0x1000208)	r1-main, r1-tkill	pass	pass	pass: 1,020 s, ticks 1→3→12→103 over checks at 08:21:04, 08:21:28, 08:23:02, 08:45:23; claude at +20 s and +935 s both P01-OK	fail: supervisor and sleeper dead at the first check after TaskStop (08:21:28)	—
2 same without breakaway (0x208)	r2-tkill	—	—	—	fail (same)	—
3 CIM Win32_Process.Create	r3-main, r3-tkill, r3-kill5	pass	pass	pass: 1,020 s, ticks 2→103, claude at +20 s and +933 s both P01-OK	pass: alive after TaskStop; parent is WmiPrvSE.exe (pid 34932)	pass: 8 processes (claude.exe → bash.exe ×3 → PING.EXE, conhost.exe ×2, sleeper) all dead by pid + creation time; no PING.EXE left

Retest for visible windows (coordinator's message, 09:52; user saw a Python console window on the desktop). Criterion added to P0.1: no visible window from the supervisor or any descendant. Window check: EnumWindows + IsWindowVisible for the tree's pids, plus any visible ConsoleWindowClass / CASCADIA_HOSTING_WINDOW_CLASS window.

Variant	Tag	Visible window	(a)	(b)	(c)	(d)	Tree-kill
Rung 3 as first run (positive control, 15 s)	r3-wincontrol	yes: Windows Terminal window (CASCADIA_HOSTING_WINDOW_CLASS, pid 19872) titled …\cpython-3.13.1-…\python.exe	—	—	—	—	—
Rung 3 hidden: Win32_ProcessStartup.ShowWindow=0; supervisor children CREATE_NO_WINDOW	r5-main, r5-tkill, r5-kill	none, checked 26 times incl. during a claude call and during claude → bash → PING	pass	pass	pass: 1,000 s, ticks 1→101 over 24 checks 09:55:54–10:13:01, claude at +20 s and +935 s both P01-OK, done	pass (alive after TaskStop at 09:56:31, check 09:56:43)	pass: 11 processes dead by pid + creation time, no PING.EXE left
Popen CREATE_NO_WINDOW|CREATE_NEW_PROCESS_GROUP|CREATE_BREAKAWAY_FROM_JOB, children CREATE_NO_WINDOW (informational)	r6-win	none (3 checks incl. a claude call)	pass	pass	not run	not run; expected to fail like rungs 1/2 (same parentage)	not run

So the earlier visible windows came from every rung-3 supervisor before the fix (r3-*, and the P0.2 and P0.6 probes, which were launched with the same unhidden CIM call), and presumably (not measured) from the console children of the rung-1/2 DETACHED_PROCESS supervisors (sleeper, claude), which get a new console each when the parent has none.

Also recorded:

• r1-dprime (informational): rung 1 with the launcher already exited, then the Bash call stopped while a later process ran → supervisor survived. Rung 1 dies only while its launcher is alive in the stopped tree. That matters for the helper because wait stays alive while it would launch pings; rung 3 avoids the question.
• CIM env: a CIM-created process gets the registry default user env. 58 of the Bash env's variables were missing, among them every CLAUDE* var, CLAUDE_CODE_EXECPATH, HOME, MSYSTEM, Git's PATH entries ($P0\raw\p01\wmi-env.json). Effect seen: r3-main and r3-tkill (spawned before the fix) ran PATH claude 2.1.283 instead of 2.1.299. Fixed in the probe by shipping env.json; r3-kill2…r3-kill5 and P0.2/P0.6 ran 2.1.299.
• Kill-test retries: r3-kill (2.1.283) let the harness background sleep 240 and exited; the backgrounded sleep.exe was left orphaned after claude exited (killed by hand, pid 31372). r3-kill2 was missed (the scratch clone took 20 min, 08:24→08:45, and the target finished). r3-kill3 killed before the Bash child existed. r3-kill4: Opus 5.5 declined a bare blocking ping as pointless. r3-kill5 with an honest brief: pass (above).
• Spend in P0.1: about $0.20 (killed calls r3-kill3/r3-kill5 wrote no result and are not counted).

P0.2 large base

• Probe p02_base_forks.py, run detached via spawn3.py (rung 3, still unhidden then: it showed a console window while it ran). cwd = scratch clone $P0\clone (git clone --local --no-hardlinks of d373689; --no-hardlinks because G:→C: cannot hardlink). Raw: $P0\raw\p02\.
• Fingerprint: --model claude-opus-5-5 --effort high --permission-mode dontAsk --tools Bash,Read,Edit,Write,Glob,Grep,Skill --allowedTools <same> --disallowedTools "Bash(git push:*),Bash(git rebase:*),Bash(git reset --hard:*),Bash(claude:*)" --strict-mcp-config --mcp-config $P0\mcp-empty.json --append-system-prompt-file $P0\preamble-probe.md, --output-format stream-json --verbose, prompt on stdin, scrubbed env (design §4 + VIRTUAL_ENV + venv PATH), CLAUDE_CODE_PROMPT_CACHE_TTL=1h, DISABLE_AUTOUPDATER=1.
• Base d7c7a3aa-dfd5-40df-87f2-ccc82e49a369: read 42 files (all plugins/spire/**/*.md plus 7 workpad docs) with Read, 43 turns, 74.7 s, context 182,204 tokens (last message: 2 + 45,677 created + 136,525 read), all writes ephemeral_1h, cost $1.6298, no compaction event.

Fork	Turns	First request: cache read / created	Ratio	Cost Δ	Commit (clone)
seq 1	7	182,202 / 1,242	0.99999	$0.3116	64dbefa
seq 2	7	182,202 / 1,247	0.99999	$0.3091	9bfefb7
seq 3	7	182,202 / 1,259	0.99999	$0.3029	bb5514d

Each fork read plugins/spire/CLAUDE.md, wrote scratch/p0-fork-<k>.md, ran git diff --check, git add, git commit, git log, and replied with its hash. No denials. No re-run needed.

P0.3 usage

Analysis p03_usage.py → $P0\raw\p03-usage.json.

• The result event carries usage, modelUsage, total_cost_usd, num_turns, is_error, permission_denials (plus subagent_stats, terminal_reason, timing fields). usage also has iterations[] and output_tokens_details.thinking_tokens; modelUsage[m] has costUSD, contextWindow (1,000,000 for claude-opus-5-5 here), canonicalModel, costBasis.
• On every fork (seq 1–3, par 1–2, two 1-turn forks) result.usage == modelUsage delta vs the base for all four columns, and total_cost_usd delta == modelUsage.costUSD delta. Example seq 1: input 14, output 1,448, created 3,113 (all 1h), read 1,288,193; cost Δ $0.311559.
• Summing stream assistant events (last event per message id) matches input and both cache columns but not output (102 vs 1,448): stream events carry interim output_tokens.
• num_turns ≠ assistant messages on the base (43 vs 7 message ids): turns count tool round trips, several Read calls share one message. The helper's turns should come from num_turns.

P0.4 parallel

Two forks launched together from the base (par1, par2, threads in the same probe), each writing scratch/p0-par-<k>.md and running git status, no commits. No index.lock in either stream; both files intact (3 lines each); both first requests 182,202 read (0.99999). The Athanor then gated (git add -N + git diff --check, rc 0) and committed each file by explicit path: clone 0f72edb, 9d3ddc1.

P0.5 flags and models

Probe p05_flags.py → $P0\raw\p05\. Tool-less calls (--tools "") unless noted.

Check	Outcome	Default
--effort with CLAUDE_EFFORT scrubbed	accepted; not visible in init; a medium fork of the high base hit 0.99999 like the high control	keep pinned; not cache-defining
--strict-mcp-config + empty config	mcp_servers: [], no mcp__* tools (the claude.ai Docs connector is gone)	keep
Skill in --tools	accepted; init.tools lists it	keep
[1m] in --model	accepted; init.model and modelUsage key claude-opus-5-5[1m]	keep
apiKeySource	present, "none" (OAuth)	check stays
--agent p0agent (project .claude/agents/p0agent.md) + --append-system-prompt-file	both markers quoted (AGENT-MARKER-3KX, PREAMBLE-MARKER-7Q4); control without --agent quoted none	keep
agent tools: Read vs --tools Bash,Read	init.tools = ["Read"]: the intersection	the agent file can only narrow --tools
claude-opus-5-5 (listed)	runs as asked	—
claude-sonnet-5-5, claude-haiku-5-5 (unlisted full ids, aliases listed), trusted checkout	run as asked	admitted via family alias
claude-opus-4-6 (bare; only [1m] form listed), trusted checkout	runs as asked	admitted via opus
unlisted family	none exists (all four aliases listed); skipped in project settings, tested via --settings instead ↓	—
--settings '{"availableModels":["claude-opus-5-5"]}', request claude-sonnet-5-5	substituted: ran claude-opus-5-5 with the system/informational warning quoted above	model_refused
same list, request claude-opus-5-5	runs	—
--settings '{"availableModels":["opus","sonnet"]}', request claude-sonnet-5-5	runs as asked	alias admits full id

Trust: in untrusted dirs (scratch clone, $P0\p05-cwd, $P0\p08-cwd) stderr says "Ignoring 36 permissions.allow entries from .claude/settings.json: this workspace has not been trusted". G:/dev/projects/reliquary is trusted; a tool-less call in the worktree printed no warning (trust is inherited by subdirectories). Project agents still load in untrusted dirs. The model rows marked "trusted checkout" ran tool-less in G:\dev\projects\reliquary (deviation, logged in the run log).

P0.6 TTL

Probe p06_ttl.py, detached via spawn3.py (rung 3, unhidden at the time) at 08:48:45. cwd = $P0\ttl-cwd (empty, not a git repo), the P0.2 fingerprint (same tools, mode, preamble, strict MCP, TTL pinned 1h). Training content was passed in the prompt (no tools used): A = five orbit/dirigent research and report files, B = six superpowers research and report files from the clone; "reply READY". Raw: $P0\raw\p06\ (state.json, train*.jsonl, ping*.jsonl, fork*.jsonl).

Step	Elapsed since base's first event	First request: cache read / created	Ratio to base context	Cost Δ
train A (9c2fa6d6-…)	—	0 / 88,569 (all 1h)	context 88,571	$0.7086
train B (79af9c73-…)	—	7,469 / 85,406	context 92,877	$0.6848
ping A (Reply with only: OK, --max-turns 1)	3,004.6 s (50.1 min)	81,144 / 7,463	0.916	$0.0760
fork A	3,904.9 s (65.1 min), 15 min after the ping	88,607 / 0	1.0004	$0.0178
fork B (no ping)	3,902.7 s (65.0 min)	7,469 / 85,444	0.080	$0.6851

• Pass: A's fork ≥ 0.9 × A's context after the 50-min ping; B's fork < 0.5 × B's context. B shows partial (the 7,469-token shared prefix stayed warm, as A4/C5 predicted).
• A's fork read more than A's context (88,607 > 88,571) because the ping's identical prompt was cached too.
• The ping itself re-created 7,463 tokens instead of reading them (0.916, still a hit by C5). That size matches the shared system/tool prefix (7,469). Cause not isolated; it did not stop the ping from refreshing the base prefix.
• Economics: a cold start (fork B) cost $0.685; ping + warm fork cost $0.094. One ping pays for itself many times over at this base size.

P0.7 transcripts (informational)

p07_transcripts.py → $P0\raw\p07\p07.json.

• Transcript dir = ~/.claude/projects/<cwd with every non-alphanumeric → '-'>/ (exists for the clone).
• Base transcript: 128 lines, 46 assistant lines, all 46 carry message.usage; several lines per message id (one per content block). Base context from the transcript's last assistant line = 182,204 = the stream's number. max_base_tokens can be read from transcripts.
• Fork seq 1 transcript: all 7 base message ids and all 106 base uuids are present (copied unchanged), under the fork's own sessionId; no fork* field. Dedupe by message id works for the trial.
• R6: --session-id f2806537-… --resume <tiny base> --fork-session → init.session_id and result.session_id both f2806537-…; the fork recalled the base's word.

P0.8 injection and pre-approval proxy (informational)

p08_inject.py in $P0\p08-cwd (copy of the project settings with Bash(uv:*)/Bash(uvx:*) removed; skill forkprobe with allowed-tools: Bash(uv:*) and !`uv run "${CLAUDE_SKILL_DIR}/probe.py" where`; agent forkprobe preloading it). Headless claude -p --tools Task,Bash --permission-mode default --allowedTools Task,Agent dispatched forkprobe. Raw: $P0\raw\p08\.

• Injection in the subagent: yes. The reply quoted {"probe": "forkprobe", "marker": "INJECT-MARKER-W9P", …}; probe-calls.log shows one where call 4.8 s after launch.
• Pre-approval: no. permission_denials holds the subagent's uv run "…\probe.py" ping ("This command requires approval").
• Wall time: 13.7 s for the whole run; the injection completed within the first 4.8 s.
• Caveat: the dir is an untrusted workspace (its project allow list was ignored anyway, which is what the probe needed). Whether allowed-tools pre-approves in a trusted project is untested; Phase 4 checks it with the real plugin.

Not tested / open

• Survival of a rung-3 supervisor past the end of the Athanor's turn (all checks were inside one turn). Parentage under WmiPrvSE.exe makes a tree-kill from the agent impossible, so it is expected to hold; Phase 1's smoke can confirm it across a hand-back.
• What effort actually changes (no observable in init or in a 1-turn reply).
• Why the 50-min ping re-created 7,463 prefix tokens.
• rate_limit_event lines in every stream carry plan utilisation (five_hour 0.02, seven_day 0.56 this morning). Not used by the plan; a cheap input for R11 if Phase 1 wants it.
• Whether the Desktop's orphaned background Bash tasks (fork backgrounding a command) can be prevented by flags; the default is a preamble line.