The lab said nothing was running while two machines were

'incus list' failed because this shell had no permission to reach the daemon,
incusOk returned null, and the caller wrote ?? "[]". So 'mesh-lab list'
printed 'no scenario instances standing' -- confidently, about a question it
had never managed to ask.

The comment on incusOk warns about exactly this, in those words: absence and
success made indistinguishable. Three of its own callers then did it. Two
listings and the live diagram, which would have drawn an empty scenario rather
than fail -- a picture that is confidently wrong, which is worse than none.

Anything enumerating what exists now goes through enumerate() and throws.
incusOk stays right where failure genuinely means no, like instanceExists,
and there is a test holding that line so this does not get over-corrected
until nothing can be asked at all.

Worth noting 'mesh-lab check' already diagnoses this precise cause, down to
'a session that predates it cannot see it'. The diagnosis existed; the
listing just never asked for it.

src/diagram/from-live.ts

@@ -8,7 +8,7 @@
  * by the running machine now — nothing is inferred from a file on disk.
  */
 
-import { incusOk, taggedNetworks } from "../incus/client.ts";
+import { incus, incusOk, taggedNetworks } from "../incus/client.ts";
 import { depthOf, type Diagram, type DiagramMachine, type DiagramSegment } from "./model.ts";
 
 interface RawInstance {
@@ -28,7 +28,10 @@ interface RawInstance {
 export async function diagramFromLive(instanceId: string): Promise<Diagram> {
   const networks = (await taggedNetworks()).filter((n) => n.instanceId === instanceId);
 
-  const json = (await incusOk(["list", "--format", "json"], 30_000)) ?? "[]";
+  // Not `incusOk(...) ?? "[]"`. A picture is read from what runs (novox/hq ADR 0018), and a read
+  // that failed and became an empty list would draw an empty scenario rather than fail — a
+  // diagram that is confidently wrong, which is worse than no diagram.
+  const json = (await incus(["list", "--format", "json"], 30_000)).stdout.trim() || "[]";
   const parsed = JSON.parse(json) as RawInstance[];
   const mine = parsed.filter((i) => i.config?.["user.mesh-lab.instance"] === instanceId);
   if (mine.length === 0 && networks.length === 0) throw new Error(`no scenario instance '${instanceId}'`);

src/incus/client.ts

@@ -111,6 +111,22 @@ export async function incusOk(args: string[], timeoutMs = 60_000): Promise<strin
   }
 }
 
+/**
+ * Ask incus what exists, where answering "none" without having looked would be a lie.
+ *
+ * The comment on `incusOk` above warns that absence and success must not be made
+ * indistinguishable. Three of its callers then wrote `?? "[]"` and did exactly that, and it cost
+ * a session: `mesh-lab list` reported *no scenario instances standing* while two were standing,
+ * because this shell had no permission to reach the daemon. The lab was not wrong about the
+ * instances — it had never managed to ask.
+ *
+ * So anything enumerating what exists comes through here and throws. `incusOk` remains right for
+ * questions where failure genuinely means no, like `instanceExists`.
+ */
+async function enumerate(args: string[], timeoutMs = 30_000): Promise<string> {
+  return (await incus(args, timeoutMs)).stdout;
+}
+
 /** Did the command work? For commands whose output is not the point. */
 export async function succeeds(args: string[], timeoutMs = 60_000): Promise<boolean> {
   return (await incusOk(args, timeoutMs)) !== null;
@@ -168,14 +184,18 @@ export interface TaggedInstance {
  * nothing. Metadata is what the instance actually knows about itself.
  */
 export async function taggedInstances(): Promise<TaggedInstance[]> {
-  const json = (await incusOk(["list", "--format", "json"], 30_000)) ?? "[]";
+  const json = (await enumerate(["list", "--format", "json"])).trim() || "[]";
   let parsed: unknown;
   try {
     parsed = JSON.parse(json);
   } catch {
-    return [];
+    throw new IncusError(["list", "--format", "json"],
+      `incus answered something that is not JSON: ${json.slice(0, 200)}`, null);
+  }
+  if (!Array.isArray(parsed)) {
+    throw new IncusError(["list", "--format", "json"],
+      "incus answered JSON that is not a list of instances", null);
   }
-  if (!Array.isArray(parsed)) return [];
 
   const tagged: TaggedInstance[] = [];
   for (const entry of parsed) {
@@ -199,14 +219,17 @@ export interface TaggedNetwork {
 }
 
 export async function taggedNetworks(): Promise<TaggedNetwork[]> {
-  const json = (await incusOk(["network", "list", "--format", "json"], 30_000)) ?? "[]";
+  const args = ["network", "list", "--format", "json"];
+  const json = (await enumerate(args)).trim() || "[]";
   let parsed: unknown;
   try {
     parsed = JSON.parse(json);
   } catch {
-    return [];
+    throw new IncusError(args, `incus answered something that is not JSON: ${json.slice(0, 200)}`, null);
+  }
+  if (!Array.isArray(parsed)) {
+    throw new IncusError(args, "incus answered JSON that is not a list of networks", null);
   }
-  if (!Array.isArray(parsed)) return [];
 
   const tagged: TaggedNetwork[] = [];
   for (const entry of parsed) {