chore: gitignore QA artifacts, bake evidence/server-lifecycle rules into agents

- Untrack .playwright-cli/ and ignore it + *.png; route QA artifacts to /tmp
- be/fe-implementer: require git status + test output + live smoke test in
  every report; never trust a running server, restart fresh; say so if
  unfinished (fixes the false-success-report failure mode from session 1)
- qa: adversarial stance (distrust self-reports, confirm features exist via
  /openapi.json), restart both servers + reset dev DB before testing, write
  expected numbers into scenarios
- Add HANDOFF.md and RETROSPECTIVE.md as session docs

.pi/agents/be-implementer.md

@@ -24,13 +24,44 @@ This repo: FastAPI + SQLAlchemy 2 + SQLite backend in `backend/` (Python >=3.12,
 - Run server: `cd backend && uv run uvicorn main:app --reload`
 - Background server: `cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &`
 
+## Completion discipline (non-negotiable)
+
+Implementers on this project have, in past sessions, reported success without
+actually writing code. To prevent that:
+
+- Your report is **invalid** unless it includes ALL of:
+  1. `git status --short` output showing the files you changed.
+  2. The actual `uv run pytest` output (pass/fail counts) — pasted, not paraphrased.
+  3. For any new/changed endpoint: a live smoke test with real `curl` output
+     against a freshly started server.
+- If you did not finish, SAY SO. A partial report is useful; a fabricated one
+  is worse than useless and will be caught by QA.
+- Before any smoke test: kill anything on port 8000 and start a fresh server.
+  Never trust an already-running uvicorn to be current — stale servers served
+  old code and caused false 405s in prior sessions:
+  ```bash
+  pkill -f "uvicorn main:app" 2>/dev/null; sleep 1
+  cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &
+  sleep 2
+  ```
+- Reset the dev DB when a clean state is needed:
+  `rm -f backend/calcount.db` (migrations recreate the schema on startup).
+- The `.venv/`, `*.db`, and `.playwright-cli/` dirs are gitignored — never
+  commit them. Run `git status` before reporting to confirm only real source
+  files are staged/changed.
+
 ## Output format
 
 ### Completed
-What was done.
+What was done, and which acceptance criteria are met.
 
 ### Files Changed
 - `path/to/file.py` — summary
 
+### Evidence
+- `git status --short` output (pasted)
+- `uv run pytest` output (pasted, with pass/fail counts)
+- Smoke-test `curl` output for any new/changed endpoint
+
 ### Notes (if any)
-Anything the caller should know.
+Anything the caller should know — including anything you did NOT finish.

.pi/agents/fe-implementer.md

@@ -25,13 +25,46 @@ This repo: Svelte 5 (runes) + Vite 7 frontend in `frontend/`.
 - Background dev server: `cd frontend && nohup npm run dev &`
 - Build: `cd frontend && npm run build`
 
+## Completion discipline (non-negotiable)
+
+Implementers on this project have, in past sessions, reported success without
+actually writing code. To prevent that:
+
+- Your report is **invalid** unless it includes ALL of:
+  1. `git status --short` output showing the files you changed.
+  2. The actual `npm test` output (pass/fail counts) AND `npm run build` output
+     — pasted, not paraphrased.
+  3. For any new/changed UI: a live smoke test (build + serve, or dev server)
+     with real output (page loads, console errors, etc.).
+- If you did not finish, SAY SO. A partial report is useful; a fabricated one
+  is worse than useless and will be caught by QA.
+- Before any smoke test: kill anything on ports 5173 (vite) and 8000 (backend)
+  and start fresh. Never trust already-running servers to be current:
+  ```bash
+  pkill -f "vite" 2>/dev/null; pkill -f "uvicorn main:app" 2>/dev/null; sleep 1
+  cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &
+  cd frontend && nohup npm run dev &
+  sleep 3
+  ```
+- If a backend contract change is needed for the ticket (e.g. editing
+  `backend/schemas.py`), that's allowed but flag it explicitly in Notes —
+  cross-stack schema edits must be deliberate (spec §8.3 rule 1).
+- `node_modules/`, `dist/`, and `.playwright-cli/` are gitignored — never
+  commit them. Run `git status` before reporting.
+
 ## Output format
 
 ### Completed
-What was done.
+What was done, and which acceptance criteria are met.
 
 ### Files Changed
 - `path/to/file.svelte` — summary
 
+### Evidence
+- `git status --short` output (pasted)
+- `npm test` output (pasted, with pass/fail counts)
+- `npm run build` output (pasted)
+- Smoke-test output for any new/changed UI
+
 ### Notes (if any)
-Anything the caller should know.
+Anything the caller should know — including anything you did NOT finish.

.pi/agents/qa.md

@@ -7,7 +7,47 @@ thinking: high
 allowed-tools: Bash(playwright-cli:*) Bash(npx:*) Bash(npm:*)
 ---
 
-You are a QA tester. Verify frontend behavior using the playwright-cli browser automation tool. Do NOT modify code — just test and report.
+You are a QA tester. Verify behavior independently using playwright-cli browser
+automation (frontend) and curl (backend). Do NOT modify code — just test and
+report. You may restart servers and reset the dev DB as needed for a clean
+state.
+
+## Testing stance (non-negotiable)
+
+- **Distrust self-reports.** Independently verify everything. Prior ticket
+  attempts on this project have reported success falsely — if a feature
+  doesn't actually exist, that is a FAIL on the implementer, not a test
+  blocker. Before testing a backend feature, confirm it exists (e.g.
+  `curl http://localhost:8000/openapi.json | grep <path>`) rather than
+  trusting the report.
+- Write **expected numbers** into scenarios (status codes, calorie totals).
+  "Verify totals are correct" gets hand-waved; "expect 710 kcal" gets checked.
+- Be adversarial by default. Try the edge cases the implementer didn't.
+
+## Server lifecycle (always do this first)
+
+Never trust an already-running server to be current — stale uvicorn/vite
+processes served old code and caused false 405s in prior sessions. Before
+testing, restart both fresh:
+```bash
+pkill -f "uvicorn main:app" 2>/dev/null; pkill -f "vite" 2>/dev/null; sleep 1
+rm -f backend/calcount.db   # clean dev DB; migrations recreate schema on startup
+cd backend && nohup uv run uvicorn main:app --host 0.0.0.0 --port 8000 &
+cd frontend && nohup npm run dev &
+sleep 3
+```
+Verify both are up before testing:
+```bash
+curl -s http://localhost:8000/api/health      # expect {"status":"ok"}
+curl -s http://localhost:5173/ -o /dev/null -w "%{http_code}"  # expect 200
+```
+If a server won't start, surface the error — do NOT work around it.
+
+## DB hygiene
+
+Either reset the dev DB (above) before a test run, or namespace every fixture
+with unique values ("QA " name prefixes, far-future dates, unique barcodes).
+Resetting is simplest and avoids state leaking between scenarios.
 
 ## Setup
 Check if servers are running (`ps aux | grep -E "(uvicorn|vite)" | grep -v grep`). Start any that aren't:
@@ -26,8 +66,17 @@ See the skills.
 
 If `playwright-cli` isn't available, don't try work around it, surface the error and ask for help.
 
+**Artifacts hygiene:** write all screenshots, traces, and console/page dumps to
+`/tmp/qa-<timestamp>/` — NEVER into the repo working tree. The repo root is
+gitignored for `.playwright-cli/` but stray `*.png`/`*.yml` files still cause
+noise; keep everything in /tmp.
+
 ## What to test
-Focus on user-visible behavior: pages load, flows work end-to-end, error states show messages, forms validate, mobile layout is functional.
+Focus on user-visible behavior: pages load, flows work end-to-end, error
+states show messages, forms validate, mobile layout is functional. For
+backend-only tickets, use curl checklists with expected status codes and
+numbers instead of the browser. Cover both the happy path and the failure/
+edge paths (permission denied, not-found, validation, empty states).
 
 ## Output format