qcontrol File Event Debug

c22.runtime-session-map is now working end to end for live network-driven sessions: qcontrol discover feeds the bridge, the reducer emits a valid runtime session, and qmap renders it in Live mode. But file-only scenarios are not showing up reliably in the same pipeline. That makes it unclear whether the gap is in qcontrol emission, discover attribution, bridge ingestion, or reducer behavior.

We need a dedicated debugging cycle so we can answer that question cleanly without mixing investigation work into the broader integration cycle.

Pin down where file-only sessions disappear in the live runtime-session flow and produce a repeatable diagnosis plan plus a clear product boundary for c22.

• Validate each stage of the file-event pipeline:
  • wrapped command
  • data-events emission
  • discover --all --socket --json
  • bridge ingestion
  • reducer output
  • c22 rendering
• Compare file-only vs network-only vs mixed scenarios
• Compare loader paths only if needed
• Document exact commands and expected outcomes
• Do not attempt to fix qcontrol itself in this cycle; characterize the boundary and feed that understanding back into qmap planning

• initial-prompt.md
• CYCLE.md
• plan.md
• findings.md

Traced the file-event pipeline end to end (full detail in findings.md) and localized the loss upstream of qmap: raw discover --all --socket --json output carries process.started/process.stopped but no file.*, exec.spawn, http.request, or connection.open events, and manual socket injection proved the discover listener path works. The bridge and reducer are cleared; this is a qcontrol telemetry boundary. Product decision: c22 is framed as a truthful runtime network/session map, with synthetic fixtures remaining the regression harness for richer shapes.

1. Do file.read / file.write events appear in raw discover --json output?
2. If they do, are they associated with the expected PID/process?
3. If they do not, is the problem in qcontrol hook coverage or event attribution?
4. If raw discover output is correct, does the bridge or reducer drop file events?
5. Should c22 treat file-only sessions as a separate handling case?
6. Given current qcontrol behavior, how should c22 be framed so it stays truthful and useful?