woods 2.0.0.beta3 → 2.0.0

data/lib/woods/retrieval/lexical_assembler.rb

@@ -16,9 +16,10 @@ module Woods
         SourceEvidence.validate_mode!(evidence)
         raise ArgumentError, 'budget must be a positive Integer' unless budget.is_a?(Integer) && budget.positive?
 
-        context = 'Mode: lexical (field-aware BM25; ranked top 20; token counts estimated).'
-        context += "\nNo lexical matches." if candidates.empty?
-        context = context[0, budget * 4]
+        # Reserve the largest included count before selecting evidence. Replacing
+        # it afterward can only shrink the text; do not refill or reorder sources.
+        notice = count_notice(candidates.size, candidates.size)
+        context = notice[0, budget * 4]
         sources = []
         candidates.each do |candidate|
           unit = candidate.metadata
@@ -50,12 +51,22 @@ module Woods
                        score: candidate.score, matched_fields: candidate.matched_fields, truncated: truncated }
           break if truncated
         end
+        body = context[notice.length..].to_s
+        context = (count_notice(candidates.size, sources.size) + body)[0, budget * 4]
         AssembledContext.new(context: context, tokens_used: estimate_tokens(context), budget: budget,
                              sources: sources, sections: [:primary], skipped_missing_metadata: 0)
       end
 
       private
 
+      def count_notice(candidates, included)
+        text = "Mode: lexical (field-aware BM25; sources included: #{included}; " \
+               "candidates considered: #{candidates}; candidate limit: #{LexicalIndex::DEFAULT_LIMIT}; " \
+               'token counts estimated).'
+        text += "\nNo lexical matches." if candidates.zero?
+        text
+      end
+
       def evidence_text(candidate)
         unit = candidate.metadata
         source = unit['source_code'].to_s

data/lib/woods/retrieval/lexical_index.rb

@@ -13,6 +13,7 @@ module Woods
       RUNTIME_FIELDS = %w[callbacks associations validations scopes concerns included_modules
                           methods instance_methods class_methods actions routes columns table_name
                           description purpose dependencies].freeze
+      DEFAULT_LIMIT = 20
       K1 = 1.2
       B = 0.75
       Document = Struct.new(:key, :unit, :fields, keyword_init: true)
@@ -36,7 +37,7 @@ module Woods
         @frequencies.freeze
       end
 
-      def execute(query:, limit: 20, type_filter: nil, exclude_types: nil)
+      def execute(query:, limit: DEFAULT_LIMIT, type_filter: nil, exclude_types: nil)
         terms = tokenize(query).uniq
         candidates = @documents.filter_map do |doc|
           next unless eligible?(doc.unit, type_filter, exclude_types)

data/lib/woods/retriever.rb

@@ -13,6 +13,7 @@ require_relative 'retrieval/lexical_assembler'
 require_relative 'retrieval/scope'
 require_relative 'retrieval/scoped_vector_store'
 require_relative 'retrieval/scoped_graph_store'
+require_relative 'retrieval/corpus_status'
 require_relative 'embedding/token_counter'
 require_relative 'token_utils'
 
@@ -85,7 +86,7 @@ module Woods
     #       source: :in_top_k,            # see enum below
     #       top_of_type_global_rank: 3,   # 1-based rank in unfiltered ranked, or nil
     #       global_k: 20,                 # size of the unfiltered ranked list
-    #       total_of_type: 183            # total units of that type in the index
+    #       total_of_type: 183            # retrieval metadata records of that type
     #     }
     #   }
     #
@@ -97,10 +98,11 @@ module Woods
     #                            the fallback vector search returned
     #                            candidates of this type. Weak match.
     #   :outside_top_k         — type NOT in the unfiltered ranked list, has
-    #                            units in the index, but the fallback did
+    #                            retrieval metadata, but the fallback did
     #                            not run (other requested types filled the
     #                            result). No results of this type.
-    #   :absent                — type has zero units in the index.
+    #   :absent                — type has zero retrieval metadata records;
+    #                            structural extraction may still contain it.
     #
     # Nil for unfiltered queries.
     RetrievalResult = Struct.new(:context, :sources, :classification, :strategy, :tokens_used, :budget, :trace,
@@ -199,6 +201,16 @@ module Woods
     # @return [Pipeline]
     attr_reader :pipeline, :mode, :default_budget
 
+    # Diagnose the currently served semantic stores without provider or remote
+    # store requests. Capture one pipeline so a reload cannot mix store counts.
+    # @return [Hash, nil] local corpus statistics, or nil for lexical retrieval
+    def corpus_status(include_types: true)
+      return unless mode == :semantic
+
+      current = @pipeline
+      Retrieval::CorpusStatus.build(current.vector_store, current.metadata_store, include_types: include_types)
+    end
+
     # Optional callback invoked with the pipeline struct the moment
     # {#retrieve} resolves it, before any pipeline work runs. Nil in
     # production. Observability seam for the reload transaction's old-or-new
@@ -642,9 +654,9 @@ module Woods
     #
     # +top_of_type_global_rank+ is the 1-based position of the first
     # candidate of that type in the ranked list, or nil when no candidate
-    # of that type survived ranking. +total_of_type+ is the canonical
-    # count from the metadata store — answers "does this type exist in the
-    # index at all?" independent of query match. +source+ labels the bucket
+    # of that type survived ranking. +total_of_type+ counts retrieval metadata
+    # records, including chunk records and units without vectors. It does not
+    # measure structural unit coverage or embedded units. +source+ labels the bucket
     # the type landed in so the caller doesn't infer it from a nil rank;
     # see the RetrievalResult docstring for the four-value enum.
     #
@@ -727,7 +739,7 @@ module Woods
       return context if type_rank_context.empty?
 
       lines = ['', '### Type rank context', '',
-               '| Type | Source | Rank in unfiltered top-K | Global K | Total in index |',
+               '| Type | Source | Rank in unfiltered top-K | Global K | Retrieval metadata records |',
                '|------|--------|--------------------------|----------|----------------|']
       type_rank_context.each do |type, info|
         rank = info[:top_of_type_global_rank] || '—'

data/lib/woods/session_tracer/file_store.rb

@@ -116,7 +116,8 @@ module Woods
       def clear(session_id)
         with_store_lock do
           FileUtils.rm_f(session_path(session_id))
-          FileUtils.rm_f(legacy_session_path(session_id))
+          legacy = legacy_session_path(session_id)
+          FileUtils.rm_f(legacy) if legacy
         end
       end
 
@@ -158,6 +159,10 @@ module Woods
       def migrate_legacy_session!(session_id)
         target = session_path(session_id)
         legacy = legacy_session_path(session_id)
+        # Expire each half before a merge or append can refresh its mtime.
+        [target, legacy].compact.each do |path|
+          FileUtils.rm_f(path) if File.exist?(path) && expired?(path)
+        end
         return target unless legacy && File.exist?(legacy)
 
         if File.exist?(target)

data/lib/woods/source_inputs/consumer_errors.rb

@@ -14,6 +14,10 @@ module Woods
         consumer.instance_variable_set(FLAG, true)
       end
 
+      def reset(consumer)
+        consumer.instance_variable_set(FLAG, false)
+      end
+
       def failed?(consumer)
         consumer && consumer.instance_variable_get(FLAG) == true
       end

data/lib/woods/storage/local_corpus_stats.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Woods
+  module Storage
+    # Counts local store entries without loading vectors or source bodies.
+    # Counts describe records (including chunks), not canonical unit coverage.
+    module LocalCorpusStats
+      module_function
+
+      # @param types [Array<String, Symbol, nil>] one type per live entry
+      # @return [Hash] total, known types, and entries without a usable type
+      def from_types(types)
+        from_counts(types.tally)
+      end
+
+      # @param counts [Hash] locally grouped type => entry counts
+      # @return [Hash] entry counts with unknown types kept separate
+      def from_counts(counts)
+        by_type = Hash.new(0)
+        untyped = 0
+        counts.each do |type, count|
+          if type.nil? || type.to_s.strip.empty?
+            untyped += count
+          else
+            by_type[type.to_s] += count
+          end
+        end
+        { count: by_type.values.sum + untyped, by_type: by_type.sort.to_h, untyped_count: untyped }
+      end
+    end
+  end
+end

data/lib/woods/storage/metadata_store.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'local_corpus_stats'
+
 require 'json'
 require 'fileutils'
 require 'time'
@@ -265,6 +267,14 @@ module Woods
           @data.size
         end
 
+        # Local diagnostic capability; counts records, not embedded units.
+        # @return [Hash] metadata entry counts, including source-empty records
+        def local_corpus_stats(include_types: true)
+          return { count: count, by_type: nil, untyped_count: nil } unless include_types
+
+          LocalCorpusStats.from_types(@data.values.map { |record| record['type'] })
+        end
+
         # Iterate over every stored entry, yielding +(id, metadata)+ pairs.
         #
         # Persistence seam for {Snapshotter::Metadata}. Yields the raw internal
@@ -465,6 +475,16 @@ module Woods
           @db.get_first_value('SELECT COUNT(*) FROM units')
         end
 
+        # Reads only grouped type counts from the local SQLite database.
+        # @return [Hash] metadata entry counts, independent of vector coverage
+        def local_corpus_stats(include_types: true)
+          return { count: count, by_type: nil, untyped_count: nil } unless include_types
+
+          counts = @db.execute('SELECT type, COUNT(*) AS entry_count FROM units GROUP BY type')
+                      .to_h { |row| [row['type'], row['entry_count']] }
+          LocalCorpusStats.from_counts(counts)
+        end
+
         private
 
         # Bounded retry around a contended write, mirroring

data/lib/woods/storage/pgvector.rb

@@ -26,6 +26,7 @@ module Woods
       class Pgvector # rubocop:disable Metrics/ClassLength
         include Interface
 
+        MAX_HNSW_DIMENSIONS = 2000
         TABLE = 'woods_vectors'
         TABLE_NAME_PATTERN = /\A[a-z_][a-z0-9_]*\z/
 
@@ -219,9 +220,12 @@ module Woods
         private
 
         def normalize_dimensions(value)
-          return value if value.is_a?(Integer) && value.positive?
+          raise ArgumentError, 'dimensions must be a positive Integer' unless value.is_a?(Integer) && value.positive?
+          return value if value <= MAX_HNSW_DIMENSIONS
 
-          raise ArgumentError, 'dimensions must be a positive Integer'
+          raise ArgumentError,
+                "pgvector HNSW vector dimensions must be at most #{MAX_HNSW_DIMENSIONS}, got #{value}. " \
+                'Request a supported provider output width or choose another vector backend.'
         end
 
         def validate_identifier!(name, value, original)

data/lib/woods/storage/vector_store.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'set'
+require_relative 'local_corpus_stats'
 
 module Woods
   module Storage
@@ -263,6 +264,15 @@ module Woods
           @ids.size - @tombstones.size
         end
 
+        # Local diagnostic capability; does not load or copy vector values.
+        # @return [Hash] vector entry counts, including chunk entries
+        def local_corpus_stats(include_types: true)
+          return { count: count, by_type: nil, untyped_count: nil } unless include_types
+
+          types = @id_to_index.values.map { |idx| metadata_value(@metadata[idx], :type) }
+          LocalCorpusStats.from_types(types)
+        end
+
         private
 
         # Match a filter value against a metadata value. Arrays are

data/lib/woods/temporal/json_snapshot_store.rb

@@ -22,7 +22,7 @@ module Woods
     #
     # Implements the same public interface as SnapshotStore so the MCP server
     # tools work identically.
-    # Malformed, non-object, or unreadable retained snapshots (including files
+    # Malformed, invalidly shaped, or unreadable retained snapshots (including files
     # removed during retention) are warned about and treated as absent:
     # +find+ returns nil, +diff+ returns an empty result, and history/list scans
     # omit the corrupt file.
@@ -95,7 +95,6 @@ module Woods
         snapshots = load_all_with_units
                     .sort_by { |s| s[:extracted_at] || '' }
                     .reverse
-                    .first(limit)
 
         entries = snapshots.flat_map do |snap|
           snap[:units].values.select { |unit| unit[:identifier] == identifier }.map do |unit|
@@ -150,10 +149,8 @@ module Woods
           sha = File.basename(path, '.json')
           next unless sha.match?(/\A[0-9a-f]+\z/i) && File.file?(path)
 
-          data = read_snapshot(path) || {}
-          timestamp = data['extracted_at']
-          valid = data['git_sha'] == sha && timestamp.is_a?(String)
-          { git_sha: sha, extracted_at: valid ? timestamp : '', corrupt: !valid }
+          data = read_snapshot(path)
+          { git_sha: sha, extracted_at: data&.[]('extracted_at') || '', corrupt: data.nil? }
         end
       end
 
@@ -280,7 +277,10 @@ module Woods
 
       def read_snapshot(path)
         data = JSON.parse(AtomicFile.read(path))
-        raise JSON::ParserError, 'expected a JSON object' unless data.is_a?(Hash)
+        validate_snapshot_shape!(data)
+        unless data['git_sha'] == File.basename(path, '.json')
+          raise JSON::ParserError, 'git_sha does not match the snapshot filename'
+        end
 
         data
       rescue JSON::ParserError => e
@@ -291,6 +291,34 @@ module Woods
         nil
       end
 
+      # Guard only shapes consumed by conversion, sorting, and the next capture.
+      # Legacy files can omit units/timestamps and optional per-unit hashes;
+      # bare unit keys still supply identifiers when the record does not.
+      def validate_snapshot_shape!(data)
+        raise JSON::ParserError, 'expected a JSON object' unless data.is_a?(Hash)
+
+        sha = data['git_sha']
+        unless sha.is_a?(String) && sha.match?(/\A[0-9a-f]+\z/i)
+          raise JSON::ParserError, 'expected git_sha to be a hexadecimal string'
+        end
+
+        timestamp = data['extracted_at']
+        unless timestamp.nil? || timestamp.is_a?(String)
+          raise JSON::ParserError, 'expected extracted_at to be a string or null'
+        end
+
+        validate_snapshot_units!(data['units'])
+      end
+
+      def validate_snapshot_units!(units)
+        return if units.nil?
+
+        raise JSON::ParserError, 'expected units to be an object or null' unless units.is_a?(Hash)
+        return if units.each_value.all?(Hash)
+
+        raise JSON::ParserError, 'expected every unit record to be an object'
+      end
+
       # @param exclude_sha [String, nil] SHA to leave out of the result
       # @return [Hash, nil]
       def find_latest(exclude_sha: nil)

data/lib/woods/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Woods
-  VERSION = '2.0.0.beta3'
+  VERSION = '2.0.0'
 end

data/lib/woods/watch/child_environment.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Woods
+  module Watch
+    # Restore Bundler's original environment while preserving the selected
+    # application Gemfile. Each child must resolve the current lockfile anew.
+    module ChildEnvironment
+      NIL_VALUE = 'BUNDLER_ENVIRONMENT_PRESERVER_INTENTIONALLY_NIL'
+      ACTIVATION_KEYS = %w[BUNDLE_BIN_PATH BUNDLER_VERSION BUNDLE_LOCKFILE].freeze
+
+      # @param env [Hash] complete intended application environment
+      # @param root [String] application working directory
+      # @return [Hash] independent environment for exec with unsetenv_others
+      def self.build(env, root:)
+        result = env.dup
+        gemfile = result['BUNDLE_GEMFILE']
+        ACTIVATION_KEYS.each { |key| result.delete(key) }
+        env.each do |key, value|
+          next unless key.start_with?('BUNDLER_ORIG_')
+
+          original = key.delete_prefix('BUNDLER_ORIG_')
+          value == NIL_VALUE ? result.delete(original) : result[original] = value
+          result.delete(key)
+        end
+        result['BUNDLE_GEMFILE'] = File.expand_path(gemfile, root) if gemfile && !gemfile.empty?
+        result
+      end
+    end
+  end
+end

data/lib/woods/watch/cli.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'optparse'
+require_relative 'supervisor'
+
+module Woods
+  module Watch
+    # Parses the foreground launcher contract without booting Rails.
+    class CLI
+      # @param output [#puts] diagnostic stream
+      def initialize(output: $stderr)
+        @output = output
+      end
+
+      # @param argv [Array<String>] launcher options and explicit child arguments
+      # @return [Integer] process exit status
+      def run(argv)
+        options, command = parse(argv.dup)
+        return 0 if @help
+
+        validate_platform!
+        validate_command!(command, options[:root])
+        supervisor = Supervisor.new(command: command, logger: @output, **options)
+        with_signals(supervisor) { supervisor.run }
+      rescue OptionParser::ParseError, ArgumentError, SystemCallError => e
+        @output.puts("[woods-watch] #{e.message}")
+        2
+      end
+
+      private
+
+      def parse(argv)
+        @help = false
+        options = { root: Dir.pwd, boot_timeout: 300, shutdown_timeout: 10 }
+        parser = OptionParser.new do |flags|
+          flags.banner = 'Usage: woods-watch [options] -- [bin/rails woods:watch]'
+          flags.on('--root PATH', 'Application root (default: current directory)') do |path|
+            options[:root] = File.realpath(path)
+          end
+          flags.on('--boot-timeout SECONDS', 'Boot/identity deadline (default: 300)') do |value|
+            options[:boot_timeout] = positive_seconds(value)
+          end
+          flags.on('--shutdown-timeout SECONDS', 'Graceful shutdown limit (default: 10)') do |value|
+            options[:shutdown_timeout] = positive_seconds(value)
+          end
+          flags.on('-h', '--help', 'Show help without booting Rails') { @help = true }
+        end
+        parser.order!(argv)
+        @output.puts(parser) if @help
+        [options, argv.empty? ? ['bin/rails', 'woods:watch'] : argv]
+      end
+
+      def positive_seconds(value)
+        number = Float(value)
+        return number if number.finite? && number.positive?
+
+        raise ArgumentError, 'timeout must be a positive finite number of seconds'
+      rescue ArgumentError, TypeError
+        raise ArgumentError, 'timeout must be a positive finite number of seconds'
+      end
+
+      def validate_platform!
+        return if Process.respond_to?(:fork) && !RUBY_PLATFORM.match?(/mswin|mingw|java/)
+
+        raise ArgumentError,
+              'managed watching requires POSIX process groups and fork; use an external raw-task supervisor'
+      end
+
+      def validate_command!(command, root)
+        executable = command.first
+        paths = if executable.include?(File::SEPARATOR)
+                  [File.expand_path(executable, root)]
+                else
+                  ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).map do |entry|
+                    File.expand_path(File.join(entry, executable), root)
+                  end
+                end
+        return if paths.any? { |path| File.file?(path) && File.executable?(path) }
+
+        raise ArgumentError, "child executable not found or not executable: #{executable}"
+      end
+
+      def with_signals(supervisor)
+        handlers = %w[INT TERM].to_h { |signal| [signal, Signal.trap(signal) { supervisor.stop }] }
+        yield
+      ensure
+        handlers&.each { |signal, handler| Signal.trap(signal, handler) }
+      end
+    end
+  end
+end

data/lib/woods/watch/daemon.rb

@@ -167,6 +167,8 @@ module Woods
       # @param force_polling [Boolean] never use the `listen` backend — the
       #   right choice across a container bind mount, where native FS events
       #   do not propagate
+      # @param lifecycle [#call, nil] private managed-child boundary reporter
+      # @param conservative_claims [Boolean] refuse unknown/foreign managed ownership
       # @param logger [#info, #warn, #error]
       # rubocop:disable-next Metrics/ParameterLists -- every collaborator is
       # injectable on purpose; that is what makes the daemon placement-agnostic
@@ -175,7 +177,8 @@ module Woods
                      policy: ReloadPolicy.new, debounce: DEFAULT_DEBOUNCE,
                      full_extraction_threshold: DEFAULT_FULL_EXTRACTION_THRESHOLD,
                      idle_timeout: nil, lock: nil, catch_up: true, force_polling: false,
-                     boot_snapshot: nil, poll_interval: Watcher::DEFAULT_POLL_INTERVAL, logger: nil)
+                     boot_snapshot: nil, poll_interval: Watcher::DEFAULT_POLL_INTERVAL, logger: nil,
+                     lifecycle: nil, conservative_claims: false)
         @poll_interval = validated_poll_interval(poll_interval)
         @output_dir = output_dir.to_s
         @root = (root || (defined?(Rails) ? Rails.root : Dir.pwd)).to_s
@@ -190,6 +193,8 @@ module Woods
         @boot_snapshot = boot_snapshot
         @force_polling = force_polling
         @logger = logger || default_logger
+        @lifecycle = lifecycle
+        @conservative_claims = conservative_claims
         @generation = Generation.new(output_dir: @output_dir)
         @status = Status.new(output_dir: @output_dir)
         @lock = lock || default_lock
@@ -307,9 +312,7 @@ module Woods
             enqueue(paths)
             drain
           end
-          await_watcher_ready
-          catch_up unless @stop_reason
-          drain_cycles
+          reconcile_startup
           @last_event_at = monotonic_now
         end
         watcher_thread.join
@@ -320,6 +323,15 @@ module Woods
         shut_down(heartbeat, watcher_thread)
       end
 
+      def reconcile_startup
+        await_watcher_ready
+        @lifecycle&.call(:backend_ready)
+        catch_up unless @stop_reason
+        drain_cycles
+        @lifecycle_started = true
+        report_lifecycle
+      end
+
       # @param heartbeat [Thread, nil]
       # @param watcher_thread [Thread, nil]
       # @return [void]
@@ -499,6 +511,7 @@ module Woods
 
         begin
           drain_cycles
+          report_lifecycle if @lifecycle_started
         ensure
           # An extraction is work, not idleness. Stamping only on the event
           # would let a cycle longer than `idle_timeout` read as a quiet
@@ -532,6 +545,35 @@ module Woods
         @pending_mutex.synchronize { @pending.empty? }
       end
 
+      # Only a drained startup boundary (or a later recovery) can establish
+      # maintenance readiness. The early running heartbeat does not prove it.
+      def report_lifecycle
+        return unless @lifecycle
+        return if @stop_reason && @stop_reason != :restart_required
+
+        reason = lifecycle_reason
+        state = reason == 'reconciled' ? 'ready' : 'degraded'
+        return if @lifecycle_state == [state, reason]
+
+        @lifecycle.call(:startup, state: state, generation: @generation.current.number, reason: reason)
+        @lifecycle_state = [state, reason]
+      end
+
+      def lifecycle_reason
+        return 'restart_required' if @stop_reason == :restart_required
+        return 'startup_failed' if @degraded_reason
+        return 'pending_work' unless pending_empty?
+        return 'catch_up_disabled' unless @catch_up
+        return 'no_index' unless managed_index_published?
+
+        'reconciled'
+      end
+
+      def managed_index_published?
+        @generation.current.number.positive? && !dangling_payload_pointer? &&
+          @generation.payload_dir.join('manifest.json').file?
+      end
+
       # Carry the pending set across a restart.
       #
       # Within a run, carried paths survive; at shutdown they were dropped, and
@@ -583,7 +625,7 @@ module Woods
         return unless @catch_up
 
         carried = restore_pending
-        paths = (uncovered_paths + carried).uniq
+        paths = (uncovered_paths + carried + vanished_restart_paths).uniq
         boot_changes = @boot_snapshot ? @boot_snapshot.changed_paths : []
         enqueue(boot_changes) unless boot_changes.empty?
         prepare_startup_reconciliation(paths)
@@ -623,7 +665,8 @@ module Woods
       # graph knows every path it attributed a unit to; any of those gone from
       # disk means the extractor's sweep has reconciling to do.
       #
-      # The daemon only *detects*; it does not name the paths. Naming them
+      # Except for boot inputs handled by vanished_restart_paths, the daemon
+      # only detects; it does not name the paths. Naming them
       # would put them in the change set, whose deletions are authoritative for
       # any unit type — and some registered paths are nominal (on Rails < 7.1,
       # `ActiveRecord::SchemaMigration` registers a convention path no app
@@ -631,9 +674,22 @@ module Woods
       # still produces. An empty-change-set run reaches the same ghosts through
       # the sweep, which carries the bounds that make it safe.
       def stale_deletions?
-        root_prefix = "#{@root}/"
+        vanished_registered_paths.any?
+      end
+
+      # Deleted boot inputs have no mtime and are absent from a fresh snapshot.
+      # Preserve their restart obligation so a boot that already omitted them
+      # performs a full extraction. Do not promote nominal model paths to
+      # authoritative deletions, even when application reloading is disabled.
+      def vanished_restart_paths
+        vanished_registered_paths.select do |path|
+          @policy.classify(path.delete_prefix("#{@root}/")) == :restart
+        end
+      end
 
-        persisted_registered_paths.any? do |path|
+      def vanished_registered_paths
+        root_prefix = "#{@root}/"
+        persisted_registered_paths.select do |path|
           path.start_with?(root_prefix) && !File.exist?(path)
         end
       end
@@ -1094,7 +1150,7 @@ module Woods
       #
       # @return [Boolean]
       def another_daemon_alive?
-        return false if ENV['WOODS_IGNORE_WATCH'] == '1'
+        return false if ENV['WOODS_IGNORE_WATCH'] == '1' && !@conservative_claims
         return false unless @status.alive?
 
         record = @status.read
@@ -1130,7 +1186,7 @@ module Woods
       # @return [Boolean] true when this instance now holds the claim (or
       #   was told to skip claiming entirely)
       def claim_startup?
-        return true if ENV['WOODS_IGNORE_WATCH'] == '1'
+        return true if ENV['WOODS_IGNORE_WATCH'] == '1' && !@conservative_claims
 
         with_claim_lock do
           3.times do
@@ -1258,11 +1314,17 @@ module Woods
       #   live daemon's claim
       def stale_claim?
         record = JSON.parse(File.read(claim_path))
+        return false if @conservative_claims && !verifiable_managed_claim?(record)
         return true unless same_claim_host?(record['host'])
 
         !claim_pid_alive?(record['pid'])
       rescue JSON::ParserError, SystemCallError
-        true
+        !@conservative_claims
+      end
+
+      def verifiable_managed_claim?(record)
+        record.is_a?(Hash) && record['host'] == Status.host_identity &&
+          record['pid'].is_a?(Integer) && record['pid'].positive?
       end
 
       # Mirrors {Status#alive?}'s host check: a pid is only meaningful inside