docs(runner): retain the Pi v4 pre-provider infrastructure failure

Record canonical database bootstrap failure, zero-prompt billing observations and independent cleanup without weakening the Product matcher or retrying automatically.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/architecture/runner-pi-capabilities.md

@@ -406,8 +406,19 @@ every field in Pi's native event stream. These are explicit follow-ups:
 
 ## Authenticated local qualification progress
 
+The first [v4 plan attempt](../../packages/paperclip-runner/test-fixtures/pi-acp/product-plan-infrastructure-failure.v4.darwin-arm64.json)
+failed before provider startup: embedded PostgreSQL could not initialize the
+Product fixture. Canonical classification is `transient_infrastructure`, with
+zero provider prompts and two unchanged post-attempt key-billing observations.
+The fixture directory is gone and no matching process remains. A later read-only
+host snapshot shows 87,263 of 87,381 SysV semaphores in use, supporting a resource
+constraint; the original bootstrap stderr is unavailable, so its exact cause is
+not claimed. No unrelated database or IPC object was changed. Further paid
+qualification is held until a supported database resource path is available.
+
+
 The [sanitized attempt ledger](../../packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json)
-retains all seventeen attempts, including seven failures before a model prompt. One
+retains all eighteen attempts, including eight failures before a model prompt. One
 Runner protocol turn reached the exact model and successfully called `get_task_context`, `get_task_history`,
 `list_documents`, and `read_document`. The canonical case permits those extra
 orientation reads, but also requires a completed turn; it timed out after 120s

packages/paperclip-runner/test-fixtures/pi-acp/paid-qualification-progress.darwin-arm64.json

@@ -649,6 +649,25 @@
       },
       "diagnosis": "All three distinct resumed semantic executions reuse native call_0. Owned extension forwards it as MCP JSON-RPC id, causing shared exact-call dedupe to reject later corrected/different requests.",
       "evidence": "product-plan-resume-failure.darwin-arm64.json"
+    },
+    {
+      "attemptId": "pi-product-plan-03",
+      "family": "Product E2E",
+      "caseId": "extended-harnesses.runner-acpx-pi.local.plan-approve-complete",
+      "sourceRevision": "92bcd6f07ae9a3905333dbaa2542b1401945f5fa",
+      "runtimeSourceRevision": "f556110d588a9de9fefe676a9a62bf09e98afb85",
+      "profileVersion": 4,
+      "profileDigest": "sha256:2324d9b47650c12b16f8e2c44dc33637d52f1b22ba8e914623eac4049e7e1991",
+      "providerPackDigest": "sha256:4df7e9fa164929c7ae7d8e8711f0bf7d587d9fa6a246d0a8340f318f57168855",
+      "model": "openrouter/deepseek/deepseek-v4-flash-0731",
+      "status": "failed",
+      "failureClass": "transient_infrastructure",
+      "failurePhase": "embedded PostgreSQL fixture bootstrap",
+      "providerPromptCalls": 0,
+      "billingDeltaUsd": 0,
+      "terminalUsage": null,
+      "automaticRetries": 0,
+      "evidence": "product-plan-infrastructure-failure.v4.darwin-arm64.json"
     }
   ],
   "observedSemanticOperations": {
@@ -716,6 +735,17 @@
       "nativeRustTestsPassed": 16,
       "offlineProof": "offline-provider-pack-proof.darwin-arm64.json",
       "linuxInitializeProof": "offline-native-proof.linux-x64.v3.json"
+    },
+    "version4": {
+      "source": "f556110d588a9de9fefe676a9a62bf09e98afb85",
+      "offlineProof": "offline-provider-pack-proof.v4.darwin-arm64.json",
+      "recursiveTypecheck": "passed",
+      "fullBuild": "passed",
+      "focusedTypeScriptTestsPassed": 49,
+      "optionalInstallationSuitePassed": 5,
+      "installedPackageAndMaterializerTestsPassed": 24,
+      "nativeRustTestsPassed": 13,
+      "authenticatedQualification": "blocked before provider startup by local database fixture infrastructure"
     }
   },
   "publicationBoundary": {
@@ -726,7 +756,7 @@
   },
   "remaining": [
     "Successful canonical Runner protocol completion",
-    "Semantic plan approval with canonical write boundary, pending-input restart, and refreshed version3 Product hello",
+    "Semantic plan approval with canonical write boundary, pending-input restart, and refreshed version4 Product hello",
     "Durable native pending-request reconnect/recovery beyond direct ACP controls",
     "Complete token and price/billing coverage, separate from catalog estimates",
     "Linux x64 Daytona authenticated qualification"

packages/paperclip-runner/test-fixtures/pi-acp/product-plan-infrastructure-failure.v4.darwin-arm64.json

@@ -0,0 +1,78 @@
+{
+  "schema": "paperclip.pi-product-infrastructure-failure/v1",
+  "attemptId": "pi-product-plan-03",
+  "sourceRevision": "92bcd6f07ae9a3905333dbaa2542b1401945f5fa",
+  "runtimeSourceRevision": "f556110d588a9de9fefe676a9a62bf09e98afb85",
+  "profileVersion": 4,
+  "profileDigest": "sha256:2324d9b47650c12b16f8e2c44dc33637d52f1b22ba8e914623eac4049e7e1991",
+  "providerPackDigest": "sha256:4df7e9fa164929c7ae7d8e8711f0bf7d587d9fa6a246d0a8340f318f57168855",
+  "runnerdDigest": "sha256:373848d2d7287b2c47b2cee422cb7bd25073a594a620a9ad574f2d3d51cd1670",
+  "model": "openrouter/deepseek/deepseek-v4-flash-0731",
+  "case": "extended-harnesses.runner-acpx-pi.local.plan-approve-complete",
+  "result": {
+    "schema": "paperclip.runner-e2e.result/v2",
+    "executionId": "extended-harnesses.runner-acpx-pi.local.plan-approve-complete",
+    "suiteId": "extended-harnesses",
+    "suiteDefinitionHash": "e75cb2222d2f52ec3a2a425211d195d36b95882de2cb9ed0ad93231b7c42768a",
+    "source": {
+      "sha": "92bcd6f07ae9a3905333dbaa2542b1401945f5fa",
+      "ref": "refs/heads/codex/runner-pi-acp",
+      "workflowRunUrl": null
+    },
+    "attempt": 1,
+    "status": "failed",
+    "failureClass": "transient_infrastructure",
+    "error": "Playwright exited 1 before writing a result",
+    "profileId": "runner-acpx-pi",
+    "environmentId": "local",
+    "caseId": "plan-approve-complete",
+    "provider": "acpx",
+    "model": "openrouter/deepseek/deepseek-v4-flash-0731",
+    "runtimeMode": "native",
+    "startedAt": "2026-09-28T22:14:34.240Z",
+    "finishedAt": "2026-09-28T22:14:40.919Z",
+    "durationMs": 6679,
+    "cleanup": "not_started"
+  },
+  "providerPromptCalls": 0,
+  "providerStartupReached": false,
+  "terminalUsage": null,
+  "billingDeltaUsd": 0,
+  "billingCoverage": "Two spaced post-attempt exclusive-key observations show unchanged usage; the fixture failed before provider startup.",
+  "supervision": {
+    "reservationUsd": 2,
+    "watchdogUsd": 0.5,
+    "activeDeadlineSeconds": 120,
+    "outerDeadlineSeconds": 300,
+    "automaticRetries": 0,
+    "supervisorDurationSeconds": 13.774,
+    "outerDeadlineFired": false
+  },
+  "diagnosis": {
+    "failurePhase": "embedded PostgreSQL initdb bootstrap before Playwright test",
+    "observed": "Embedded PostgreSQL init script exited1 after selecting max_connections20/shared_buffers400kB; original bootstrap stderr was not retained.",
+    "hostCapacity": {
+      "recordedAt": "2026-09-28T22:16:06.846217+00:00",
+      "sysvSemaphoreSets": 5135,
+      "sysvSemaphoresInUse": 87263,
+      "sysvSemaphoreLimit": 87381,
+      "freeSemaphores": 118,
+      "usualPostgresSetSize": 17,
+      "attemptFixtureRemoved": true,
+      "scope": "read-only host capacity observation; unrelated IPC resources untouched"
+    },
+    "inference": "Near-limit SysV semaphore usage supports host resource exhaustion, but the exact initdb cause is unproven without original stderr.",
+    "unrelatedProcessesOrIpcModified": false
+  },
+  "independentCleanup": {
+    "fixtureDirectoryRemoved": true,
+    "matchingAttemptProcesses": 0,
+    "canonicalCleanup": "not_started; failed before test setup"
+  },
+  "privateLogSha256": "2600fbad9d5c736bd7e76526acd3eaec9de305f0b9d22f7f7e5bd3333b3f28ba",
+  "publication": {
+    "credentials": false,
+    "hiddenReasoning": false,
+    "rawProviderTranscript": false
+  }
+}