diff --git a/CHANGELOG.md b/CHANGELOG.md
index 602c169..e8a1d11 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -56,6 +56,29 @@ retraction of the earlier false "0.36.0 requires node >= 24" alert.
 No image content changes: `NODE_VERSION` still 22, no pins moved. This is a test
 and a docs correction only.
 
+**The same bug class, twice in one file — and the second one was throwing away a
+proof the fleet cannot obtain any other way.** `scripts/smoke-test.sh`'s
+agent-browser guard captured the version *inside an `echo`, with `2>/dev/null`*:
+
+```sh
+echo "resolved=[$r] version=[$(agent-browser --version 2>/dev/null | head -n1)]" >&2
+```
+
+The exit code was discarded, so a binary that could not execute at all still
+**passed**, printing `version=[]`. Verified two-sided: a stub exiting 127 passes
+the old form and is caught by the new one.
+
+Why that exit code matters more than most: smoke runs `platforms: linux/amd64` on
+an x86 runner, i.e. **native amd64**, making this line the fleet's only recurring
+amd64 runtime proof for agent-browser's `linux-x64` ELF. **No devbox can ever
+supply one** — every machine in the pi fleet is an Apple Silicon Mac
+(`mbp-m1-2020`; `tor-ms22` = Mac Studio `Mac13,1` M1 Max, verified 2026-08-17 by
+`system_profiler`; `emb-7kj4vr4g` = Apple Silicon, verified 4 ways 2026-09-07).
+The "amd64 runtime proof still needed" item that was sent to two devices was
+therefore asking for the impossible, while CI already had the answer and was
+discarding it. `Dockerfile.base:607` does assert it (`agent-browser --version &&`),
+but only when the base actually rebuilds — and v1.8.13's base was cached.
+
 ---
 
 ## v1.8.13 — 2026-09-06
diff --git a/scripts/smoke-test.sh b/scripts/smoke-test.sh
index 4eb1516..8c6ef06 100755
--- a/scripts/smoke-test.sh
+++ b/scripts/smoke-test.sh
@@ -754,7 +754,22 @@ exec_test "pi-atelier registered from /opt, not npm: (volume-shadowing guard)" \
 exec_test "agent-browser resolves under /usr (volume-shadowing guard, build-time half)" '
   p=$(command -v agent-browser) || { echo "agent-browser not on PATH" >&2; exit 1; }
   r=$(readlink -f "$p")
-  echo "resolved=[$r] version=[$(agent-browser --version 2>/dev/null | head -n1)]" >&2
+  # EXECUTION is now ASSERTED, not printed. Until 2026-09-07 the version was
+  # captured inside an echo with 2>/dev/null, so a binary that could not run at
+  # all still PASSED this test and simply printed version=[]. Same failure class
+  # as the bare `node --version` two hundred lines up: a value displayed rather
+  # than compared.
+  # Why this particular exit code matters more than most: smoke runs
+  # `platforms: linux/amd64` on an x86 runner, i.e. NATIVE amd64, so this line is
+  # the fleet\'s only recurring amd64 runtime proof for the linux-x64 ELF. No
+  # devbox can ever supply one -- every machine in the pi fleet is an Apple
+  # Silicon Mac (mbp-m1-2020; tor-ms22 = Mac Studio Mac13,1 M1 Max, verified
+  # 2026-08-17 by system_profiler; emb-7kj4vr4g = Apple Silicon, 4 routes
+  # 2026-09-07). Asking a device for that proof is asking for the impossible;
+  # CI already had it and was discarding it.
+  v=$(agent-browser --version) || { echo "agent-browser did not EXECUTE" >&2; exit 1; }
+  test -n "$v" || { echo "agent-browser --version produced no output" >&2; exit 1; }
+  echo "resolved=[$r] version=[$(printf %s "$v" | head -n1)]" >&2
   case "$r" in /usr/*) ;; *) exit 1 ;; esac
   test ! -d "$HOME/.pi/npm-global/lib/node_modules/agent-browser" || exit 1
   echo ok