@cmgmyr/hive 1.5.0 → 1.7.0

package/claude-plugin/skills/cleanup/SKILL.md

@@ -47,13 +47,21 @@ Archive it. A pad still describing in-flight state for work that finished is wor
 
 A watch armed for a crew that is gone is noise. A dated reminder someone set on purpose is not - cancelling one silently loses a commitment nobody will notice missing until the date passes. If you cannot tell which it is, leave it and say so.
 
+## Project copies of the shared profile: report, do not rewrite
+
+At wrap-up, run `hive profile list` and use the `*` to identify the active profile and every file it carries, including extra Markdown files. Compare its rendered output from `hive posture`, `hive runbook`, and `hive profile read <file>` for every listed file with five kinds of project artifacts: pad headers, lines in the board pad, active todo bodies, the lead's project memory, and `CLAUDE.md`, `AGENTS.md`, or files under `docs/`. Read pad headers rather than whole lessons pads, and inspect todos without their comments. Read profile sources only when this pass runs: redirect `hive posture`, `hive runbook`, and each `hive profile read <file>` to files, then inspect them in bounded sections. For example, use `hive runbook > <file>` and read it by range. For every match, give the artifact and location, the exact profile source and line, its class, and a proposed pointer such as `see <profile source>, <section or line>`.
+
+List contradictions first, then restatements, then likely deliberate copies. A contradiction gives an outdated project-specific value as current guidance when the rendered profile now says something different or no longer says it. For example, a project memory that says commits use `--no-gpg-sign` contradicts a rendered rule requiring signed commits. A restatement repeats a profile rule without adding a project-specific choice; if replacing it with a pointer loses no useful detail, propose the pointer. A deliberate override has a project-specific delta, such as a path, a measured value, or a dated human decision; keep that detail and report it as an override. When a copy says it was kept because readers could not find the on-demand source, report it as a likely deliberate copy and ask whether it is still needed. Never infer that an outdated value is an override just because it is project-specific.
+
+This pass only reports and proposes. The lead may apply pointer changes to pads and board lines. Any memory change or deletion needs the human's OK. Do not edit, delete, archive, or send anything as part of this pass. Run it at wrap-up, not at every lane end.
+
 ## Residue you report and do not remove
 
 Worktrees, branches, running agents. Removing a worktree can destroy uncommitted work, and a running agent may be mid-turn. Name what you found and let the human or the lead decide.
 
 ## Finish by saying what you left, not just what you changed
 
-A cleanup that reports only its edits cannot be audited, and the interesting part is usually what was deliberately not touched. Leave the board in the shape the next session needs: where the code is now, whatever verification number this project quotes, what is genuinely in flight (often nothing), and what is waiting on a human.
+A cleanup that reports only its edits cannot be audited, and the interesting part is usually what was deliberately not touched. Leave the board in the shape the next session needs: where the code is now, whatever verification number this project quotes, what is genuinely in flight (often nothing), what is waiting on a human, and the profile-drift report with its proposed pointers.
 
 ## Where to route evidence in this project
 

package/claude-plugin/skills/profile/SKILL.md

@@ -9,7 +9,27 @@ You are interviewing someone to produce, or change, a hive profile: the standing
 
 ## Read before you ask anything
 
-Run `hive profile list` and `hive doctor` (or read this project's `hive.yml` directly) before the first question. If this is an edit, also read the named profile's current, rendered behavior with `hive profile read <file> --profile <name>` for each of `posture.md`, `runbook.md`, `worker.md`, and any other `.md` it carries, so you understand what this profile actually does today. Do not ask the user to repeat anything already answered by what you just read. This rendered read is for understanding only - `references/interview.md` covers the raw template (via `hive profile path`) you must read from, and write onto, when you actually apply an edit; a rendered copy drops any conditional section whose var is unset, so it is never a safe edit source.
+Run `hive profile list` and `hive doctor` (or read this project's `hive.yml` directly) before the first question. If this is an edit, also read the named profile's current, rendered behavior for each of `posture.md`, `runbook.md`, `worker.md`, and any other `.md` it carries, using "Read a rendered file in bounded sections" below, so you understand what this profile actually does today. Do not ask the user to repeat anything already answered by what you just read. This rendered read is for understanding only - `references/interview.md` covers the raw template (via `hive profile path`) you must read from, and write onto, when you actually apply an edit; a rendered copy drops any conditional section whose var is unset, so it is never a safe edit source.
+
+## Read a rendered file in bounded sections
+
+A harness may persist tool output over about 30KB to a file and show only a short preview, so a large rendered file read straight into a tool result is read mostly unseen. Redirect first, then look. `profile_name` is a name from `hive profile list`, `profile_file` is a filename it lists, and `profile_rendered` is a disposable file:
+
+```sh
+profile_rendered=$(mktemp)
+hive profile read "$profile_file" --profile "$profile_name" > "$profile_rendered" && wc -c < "$profile_rendered"
+printf '%s\n' "$profile_rendered"
+```
+
+Shell variables do not survive between tool calls. Note the path the last line printed and write that literal path into every later command and every file-reader call; do not rely on `$profile_rendered` after this call.
+
+Use the saved content only if the read command succeeded. `wc -c` is the rendered size in bytes, the same number `hive profile list` and `hive doctor` show. If it is 25600 or less, read the whole file with your file reader. Above that, never read the whole file in one tool call; read it in sections of at most 16000 bytes each:
+
+1. Check for long lines first: `awk 'length > 2000 {print NR; exit}' PATH`. A file reader truncates any line over 2000 characters, so if this prints a line number, read the whole file by bytes with step 3 instead of with line ranges.
+2. Otherwise pick a line range with your file reader's offset and limit, and measure it first: `sed -n '1,80p' PATH | wc -c`. Shrink the range until the count is 16000 or less, then read it. Continue from the next line until you have read the last line. A scan of the headers is not a read.
+3. To read by bytes: `dd if=PATH bs=1 skip=0 count=16000 2>/dev/null`. Advance `skip` by 15996 each time, which overlaps 4 bytes so text split at a section edge shows whole in the next section. Stop when a section reaches the byte count from `wc -c`.
+
+Delete the temporary file when you are done. It is for understanding and checking only, never a source for an edit (see below).
 
 ## Discovery first, not a checklist
 
@@ -70,9 +90,16 @@ A command, a repository name, a ticket prefix: these belong in `hive.yml` `vars`
 
 ## Validate before you tell them it's done
 
-After writing, run `hive doctor` and `hive profile read <file> --profile <name>` for each file you touched, from the project the profile is meant to serve. A profile with no readable `runbook.md` fails `hive doctor` outright; `posture.md` and `worker.md` do not, but check them anyway. Tell the user to restart any running hive session so it picks up the change, and invite one small follow-up edit once they've tried it - that is the expected way a profile keeps improving.
+After writing, run `hive doctor` and read each file you touched with "Read a rendered file in bounded sections" above, from the project the profile is meant to serve. Read it to the last line: a change near the end of a large file is easy to miss. A profile with no readable `runbook.md` fails `hive doctor` outright; `posture.md` and `worker.md` do not, but check them anyway. Tell the user to restart any running hive session so it picks up the change, and invite one small follow-up edit once they've tried it - that is the expected way a profile keeps improving.
+
+## After a profile edit lands, ask once about notifying leads
+
+Do this once after the full profile edit has been reviewed and committed, not after each commit or review round. Find the changed files and the commit range for that edit, and record when both review and commit are complete; that is when the edit landed. Use `project_list` to enumerate registered projects and their paths. In each project, run `hive profile list`; its `*` marks the active profile. Keep projects whose active profile matches the one you edited.
+
+For each matching project, call `agent_list` with `{project_id: <project id>}`. A recipient must have `kind: "lead"`, `status: "running"`, and `alive: true`, which means the row owns a live pane. Inspect its `command` for `--append-system-prompt-file <path>`. When the named file exists, compare its modification time with the edit's landed time: notify if the file is older, and exclude it if it is equal or newer. `hive lead` rewrites that file when it launches, so its modification time reflects the current session's posture render. If the command has no such flag or the file is missing, include the lead and state the reason, such as `no posture file flag` or `posture file missing`. Do not include rows with `alive: false` or `alive: null`. Ask once and show the project names, lead names, and any reason a posture age could not be checked: `N running leads use this profile: <projects and reasons>. Notify them?` If no leads qualify, report that and stop.
+
+On no, send nothing. On yes, call `wake_set` once per qualifying lead with `delay_seconds: 1`, `project_id: <that project's integer id>`, and `deliver_to: <lead's integer agent_id>`. Do not pass an actor id such as `lead:663` as `deliver_to`. Each wake body names the changed files and commit range, then tells the lead to re-read with `hive posture`, `hive runbook`, and `hive profile read <file>`, or restart through `hive lead` to reload the posture. Do not send a wake before the human says yes.
 
 ## What this skill does not do
 
 It does not dispatch project work, change which agent application or model a project uses beyond what was explicitly asked, install a third-party tool, or commit or publish anything. It edits `hive.yml`'s `profile`, `agents`, `vars`, `context_checkpoint_percent`, and `lead_turn_budget` keys only on an explicit ask, and only to values the user gave or confirmed.
-

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"1.5.0","sha":"c050e7f","dirty":false,"build_id":"56840ccc-881f-49ae-bbc4-440224077976"}
+{"version":"1.7.0","sha":"2000149","dirty":false,"build_id":"c539d81be530294a451590d781bd6922cd7155087a70b8fc64dedc35cf94f3e2"}

package/dist/cli.js

@@ -22,7 +22,7 @@ import { confirmQueenWrite, listQueenAudit } from "./queenAudit.js";
 import { formatRowCounts, projectRowCounts, removeProject } from "./projectRemove.js";
 import { ensureHooksFile } from "./hooks.js";
 import { errorMessage, registrationNoticeText, withTrailingNewline } from "./result.js";
-import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneReissue, } from "./scheduler.js";
+import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isLeadRowClosedHold, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneIdentity, } from "./scheduler.js";
 import { readTurnCount } from "./turnCount.js";
 import { collectPortfolio, leadText } from "./portfolio.js";
 import { STALL_BOUND_SECONDS } from "./backgroundTasks.js";
@@ -30,7 +30,7 @@ import { probeSessionInterpreter, reexecTarget, sessionStartVerdict, } from "./s
 import { backupHealth, backupNow, backupsDir, formatBytes, listSnapshots, previewRestore, restoreSnapshot, totalSizeBytes, } from "./backup.js";
 import { describeTeardownWindow, readTeardowns, teardownLogPath, } from "./teardown.js";
 import { asNameClash, buildEnvFlags, closeAgentRow, isReservedAgentName, launchAgent, LEAD_KIND, LEAD_NAME, mintLeadActorId, upsertActor, withWindowClaim, } from "./spawn.js";
-import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isPaneTarget, isViewSessionName, listOwnedWindows, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePid, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, paneReissued, rowLive, rowLiveProbe, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
+import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, observeRowOwnership, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePidForRecord, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, rowLive, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
 import { describeVisibility, processCounts } from "./dashboard.js";
 import { runningCommandRow, runningCommandRows, snapshotProcesses, stopAllProcesses, stopLine, stopProcess, STOP_REASONS, } from "./processes.js";
 import { activeProfile, agentVarKeys, BUILT_IN_PROJECT_YML, configHash, loadProjectYml, mergedProjectVars, NO_PROFILE, PROJECT_YML_KEYS, resolveCommandDir, resolveFirstMessage, } from "./projectYml.js";
@@ -322,17 +322,20 @@ function ensureLeadRow(project, command) {
             previousCommand: existing.command,
             previousCodexHome: existing.codex_home,
             casExpected: existing.tmux_target,
+            casSocket: existing.tmux_socket,
+            casPid: existing.pane_pid,
         };
     }
     const priorClosed = db
         .prepare("SELECT actor_id, tmux_target, tmux_socket, pane_pid, command, codex_home FROM agents WHERE project_id = ? AND kind = ? AND status = 'closed' AND actor_id != '' ORDER BY id DESC LIMIT 1")
         .get(project.id, LEAD_KIND);
+    const insertedSocket = tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR);
     let result;
     try {
         result = db.transaction(() => {
             const info = db
                 .prepare("INSERT INTO agents (project_id, name, command, cwd, kind, parent_actor_id, tmux_target, tmux_socket, pane_pid) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")
-                .run(project.id, LEAD_NAME, command, project.path, LEAD_KIND, currentActor(), "", tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), "");
+                .run(project.id, LEAD_NAME, command, project.path, LEAD_KIND, currentActor(), "", insertedSocket, "");
             const agentId = Number(info.lastInsertRowid);
             const actorId = priorClosed?.actor_id ?? mintLeadActorId(agentId);
             db.prepare("UPDATE agents SET actor_id = ? WHERE id = ?").run(actorId, agentId);
@@ -352,6 +355,8 @@ function ensureLeadRow(project, command) {
         previousCommand: priorClosed?.command ?? "",
         previousCodexHome: priorClosed?.codex_home ?? "",
         casExpected: "",
+        casSocket: insertedSocket,
+        casPid: "",
     };
 }
 function reportMigrationResult(result) {
@@ -375,6 +380,8 @@ async function cmdLead(argv) {
             registrationNotice = text;
         });
         const auditIdentity = captureQueenWriteIdentity(project.id);
+        // Only rows running before this invocation began are leftovers, trust prompts included; a later `hive start` is not.
+        const leftoverIds = new Set(runningCommandRows(project.id).map((row) => row.id));
         const { config, warnings, sources } = loadProjectYml(project.path);
         if (detach && (!process.stdin.isTTY || !process.stdout.isTTY)) {
             let untrusted;
@@ -453,7 +460,8 @@ async function cmdLead(argv) {
             }
         }
         const windowName = project.name;
-        const { agentId: leadAgentId, actorId: leadActorId, previousTarget, previousSocket, previousPanePid, previousCommand, previousCodexHome, casExpected, } = ensureLeadRow(project, leadCommand);
+        const { agentId: leadAgentId, actorId: leadActorId, previousTarget, previousSocket, previousPanePid, previousCommand, previousCodexHome, casExpected, casSocket, casPid, } = ensureLeadRow(project, leadCommand);
+        const previousIdentity = { tmux_target: previousTarget, tmux_socket: previousSocket, pane_pid: previousPanePid };
         // A fresh CODEX_HOME is built on every invocation, same as claude's hooks/posture files above -
         // cheap (a few KB; the codex-side plugins/cache bootstrap only materializes once a process
         // actually starts under it) and correct regardless of whether this invocation ends up creating
@@ -524,10 +532,8 @@ async function cmdLead(argv) {
             }
             else {
                 const foundWindow = findProjectWindow(session, project.id);
-                const probe = rowLiveProbe(previousSocket, previousTarget);
-                const adopted = isPaneTarget(previousTarget) && probe.live === true && !paneReissued(previousPanePid, probe)
-                    ? adoptableWindow(session, project.id, previousTarget)
-                    : null;
+                // Only a pane the row provably owns is adopted; unknown or reissued gets a fresh pane, never the stranger's pid.
+                const adopted = rowOwnership(previousIdentity) === "live" ? adoptableWindow(session, project.id, previousTarget) : null;
                 if (adopted) {
                     leadPane = previousTarget;
                     leadWindow = adopted;
@@ -574,12 +580,24 @@ async function cmdLead(argv) {
             if (newCodexHomeKey)
                 reapCodexHome(newCodexHomeKey);
         };
+        if (!createdPane && rowOwnership(previousIdentity) !== "live") {
+            abandonClaim();
+            throw new Error("The lead pane this `hive lead` was about to adopt no longer reads as the lead's own (its pane pid changed " +
+                "or could not be verified), so nothing was recorded. Re-run `hive lead`; it will start a fresh pane.");
+        }
+        const recordedPanePid = createdPane ? panePidForRecord(leadPane) : previousPanePid;
+        if (recordedPanePid === "") {
+            abandonClaim();
+            throw new Error(`tmux did not report a process id for the new lead pane ${leadPane} (asked twice), so it was discarded ` +
+                "rather than recorded: a lead row with no pane pid can never be verified as owning its pane. Re-run `hive lead`.");
+        }
         let wonRace;
         try {
             wonRace = db.transaction(() => {
                 const updated = db
-                    .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ?, command = ?, codex_home = ? WHERE id = ? AND tmux_target = ? AND status = 'running'")
-                    .run(leadPane, tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), panePid(leadPane), recordedCommand, recordedCodexHome, leadAgentId, casExpected).changes;
+                    .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ?, command = ?, codex_home = ? " +
+                    "WHERE id = ? AND tmux_target = ? AND tmux_socket = ? AND pane_pid = ? AND status = 'running'")
+                    .run(leadPane, tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), recordedPanePid, recordedCommand, recordedCodexHome, leadAgentId, casExpected, casSocket, casPid).changes;
                 if (updated === 0)
                     return false;
                 db.prepare(`UPDATE wakes SET deliver_pane = ?, held_at = NULL, held_reason = NULL
@@ -610,7 +628,7 @@ async function cmdLead(argv) {
         }
         if (createdPane) {
             armLeadPaneExitedHook();
-            clearLeftoverProcesses(project, config);
+            clearLeftoverProcesses(project, config, leftoverIds);
         }
         else if (!leadPaneExitedHookArmed()) {
             console.log(`! this tmux server carries no ${LEAD_PANE_EXITED_HOOK} backstop and hive arms one only on a pane it created, ` +
@@ -1111,6 +1129,16 @@ function profileDriftText(f) {
         text: `hive's default ${f.file} changed since you forked it${pct != null ? ` (${pct}% diverged)` : ""}`,
     };
 }
+const PROFILE_SIZE_WARNING_BYTES = 25600;
+function profileRenderedBytes(name, file, vars) {
+    const rendered = renderProfileFile(name, file, vars);
+    return rendered == null ? null : Buffer.byteLength(withTrailingNewline(rendered), "utf8");
+}
+function profileSizeAdvisory(name, file) {
+    return (`${name}/${file}: rendered size exceeds ${PROFILE_SIZE_WARNING_BYTES} bytes. A harness may persist tool output ` +
+        "over about 30KB and show only a short preview. Split into smaller profile files read with hive profile read, " +
+        "or redirect hive profile read to a file and read by section.");
+}
 function cmdProfile(argv) {
     const [sub, ...rest] = argv;
     try {
@@ -1125,7 +1153,9 @@ function cmdProfile(argv) {
                     return;
                 }
                 const here = findProjectForCwd();
-                const current = here ? activeProfile(loadProjectYml(here.path).config) : null;
+                const hereConfig = here ? loadProjectYml(here.path).config : null;
+                const current = here ? activeProfile(hereConfig) : null;
+                const listVars = mergedProjectVars(hereConfig);
                 const statuses = names.map((profile) => profileStatus(profile));
                 const fileWidth = Math.max(11, ...statuses.flatMap((s) => s.files.map((f) => f.file.length)));
                 for (const [i, profile] of names.entries()) {
@@ -1133,7 +1163,11 @@ function cmdProfile(argv) {
                     console.log(`${profile === current ? "*" : " "} ${profile}`);
                     for (const f of status.files) {
                         const drift = profileDriftText(f);
-                        console.log(`    ${f.file.padEnd(fileWidth)} ${f.source.padEnd(7)} ${f.path}${drift ? `   (${drift.text})` : ""}`);
+                        const bytes = profileRenderedBytes(profile, f.file, listVars);
+                        const size = bytes == null ? "[rendered size unavailable]" : `[${bytes} rendered bytes]`;
+                        console.log(`    ${f.file.padEnd(fileWidth)} ${f.source.padEnd(7)} ${f.path}${drift ? `   (${drift.text})` : ""} ${size}`);
+                        if (bytes != null && bytes > PROFILE_SIZE_WARNING_BYTES)
+                            console.log(`      ${profileSizeAdvisory(profile, f.file)}`);
                     }
                 }
                 if (current)
@@ -1277,7 +1311,7 @@ function openDashboardOnce(project, dashboardFile) {
     if (claim.changes === 0)
         return;
     try {
-        execFileSync("open", [pathToFileURL(dashboardFile).href], { stdio: "ignore", timeout: 5000 });
+        execFileSync("open", [pathToFileURL(dashboardFile).href], { stdio: "ignore", timeout: 10000 });
     }
     catch {
         db.prepare("DELETE FROM kv WHERE project_id = ? AND key = ?").run(project.id, DASHBOARD_OPENED_KV_KEY);
@@ -1361,14 +1395,18 @@ function resolveNamedProcess(argv, verb) {
         console.log(`${name}: not running (start with: hive start "${name}")`);
         return null;
     }
-    const probe = rowLiveProbe(row.tmux_socket, row.tmux_target);
-    if (probe.live === null) {
+    const ownership = observeRowOwnership(row);
+    if (ownership === "probe-failed") {
         console.log(CANNOT_TELL_WHERE(name));
         return null;
     }
+    if (ownership === "unknown") {
+        console.log(`${name}: its pane ownership is unknown (no pane pid recorded, or another tmux socket), so hive will not move that pane`);
+        return null;
+    }
     // A pane id alone is not an identity: tmux restarts them at %0 on a fresh server, so a stale
-    // running row names whoever holds that id now. Same compare as janitor() and wake delivery.
-    if (!probe.live || paneReissued(row.pane_pid, probe)) {
+    // running row names whoever holds that id now.
+    if (ownership !== "live") {
         console.log(`${name}: not running (start with: hive start "${name}")`);
         return null;
     }
@@ -1450,8 +1488,10 @@ function cmdLeadPaneExited(argv) {
 }
 // Only a lead that CREATED its pane clears leftovers. An adopted live lead is the same lead those
 // processes belong to, and stopping them there would take down a running crew's dev server.
-function clearLeftoverProcesses(project, config) {
+function clearLeftoverProcesses(project, config, leftoverIds) {
     for (const row of runningCommandRows(project.id)) {
+        if (!leftoverIds.has(row.id))
+            continue;
         const stopped = stopProcess(row, STOP_REASONS.previousLead);
         // Nothing was running under it, so the auto-start line that follows is the whole story.
         if (stopped.leg === "already-gone")
@@ -1550,9 +1590,17 @@ function cmdHide(argv) {
         return `${name}: hidden`;
     }));
 }
+const LEAD_OWNERSHIP_LABEL = {
+    live: "running",
+    gone: "no live pane",
+    reissued: "no live pane",
+    unknown: "pane identity unknown",
+};
 function cmdStatus() {
     janitor();
     let anyOutput = false;
+    let snapshot;
+    const statusSnapshot = () => (snapshot === undefined ? (snapshot = liveTargets()) : snapshot);
     let windows;
     let windowsError;
     const ownedWindows = () => {
@@ -1598,7 +1646,9 @@ function cmdStatus() {
         for (const a of agents) {
             const state = a.kind === "agent"
                 ? describeForHuman(deriveProvenance(a, null))
-                : (whereIs.get(a.name) ?? "running");
+                : a.kind === LEAD_KIND
+                    ? LEAD_OWNERSHIP_LABEL[rowOwnership(a, statusSnapshot())]
+                    : (whereIs.get(a.name) ?? "running");
             const label = a.kind === "command" ? "cmd  " : a.kind === LEAD_KIND ? "lead " : "agent";
             console.log(`  ${label}  ${a.name.padEnd(20)} ${state}`);
             if (reportsAgentStateLog(a)) {
@@ -2153,7 +2203,7 @@ function reportCrewTeardown(projectId) {
 }
 function reportStalledWorkers(projectId) {
     const latched = db
-        .prepare(`SELECT name, command, kind, cwd, session_id, transcript_path, agent_state, state_changed_at, tmux_target, tmux_socket
+        .prepare(`SELECT name, command, kind, cwd, session_id, transcript_path, agent_state, state_changed_at, tmux_target, tmux_socket, pane_pid
            FROM agents
           WHERE project_id = ? AND status = 'running' AND kind = 'agent'
             AND agent_state IN ('working', 'waiting') AND state_changed_at IS NOT NULL
@@ -2164,6 +2214,7 @@ function reportStalledWorkers(projectId) {
         // never this latch"), and a harness with no transcript to check would have nothing to read.
         .filter((row) => reportsAgentStateLog(row) && hasTranscriptSignal(row) && row.session_id !== "");
     const stalled = [];
+    let snapshot;
     for (const row of latched) {
         const latchedFor = ageSecondsSince(row.state_changed_at);
         if (latchedFor < STALL_BOUND_SECONDS)
@@ -2180,7 +2231,9 @@ function reportStalledWorkers(projectId) {
         if (stale !== "never" && stale.seconds < STALL_BOUND_SECONDS)
             continue;
         if (row.agent_state === "waiting") {
-            if (foreignSocket(row.tmux_socket))
+            if (snapshot === undefined)
+                snapshot = liveTargets();
+            if (rowOwnership(row, snapshot) !== "live")
                 continue;
             const choiceCheck = paneClassifierFor(row.command)?.choiceCheck;
             if (!choiceCheck || choiceCheck(row.tmux_target).awaitingChoice !== false)
@@ -2359,6 +2412,12 @@ function cmdDoctor(argv) {
             warn("profile vars", `hive.yml vars ${collisions.join(", ")} are derived from agents: and are ignored.`);
         }
         const vars = mergedProjectVars(cfg);
+        for (const f of resolved) {
+            const bytes = profileRenderedBytes(name, f.file, vars);
+            info("profile size", bytes == null ? `${name}/${f.file}: rendered size unavailable` : `${name}/${f.file}: ${bytes} rendered bytes`);
+            if (bytes != null && bytes > PROFILE_SIZE_WARNING_BYTES)
+                info("profile size warning", profileSizeAdvisory(name, f.file));
+        }
         const renderedText = profileFileNames(name)
             .map((file) => renderProfileFile(name, file, vars))
             .filter((t) => t != null)
@@ -2408,21 +2467,36 @@ function cmdDoctor(argv) {
     });
     if (here) {
         const lead = db
-            .prepare("SELECT tmux_target, tmux_socket FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
+            .prepare("SELECT id, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
             .get(here.id, LEAD_KIND);
         if (lead) {
-            const live = rowLive(lead.tmux_socket, lead.tmux_target);
-            if (live === false) {
-                warn("lead", "the lead's row is running but its pane is not live. The janitor leaves lead rows alone on " +
+            const snapshot = liveTargets();
+            const ownership = rowOwnership(lead, snapshot);
+            const unobserved = !foreignSocket(lead.tmux_socket) && observationFailed(snapshot);
+            if (ownership === "gone" || ownership === "reissued") {
+                warn("lead", (ownership === "reissued"
+                    ? "the lead's row is running but its pane id now belongs to a different process. "
+                    : "the lead's row is running but its pane is not live. ") +
+                    "The janitor leaves lead rows alone on " +
                     "purpose, so nothing will fix this by itself. Run `hive lead` to record a fresh pane and reuse " +
                     "this identity, or ask a claude session connected to this project's hive MCP server to call " +
-                    "the agent_close tool on it to retire the row for good - required before `hive restore`, which " +
+                    (ownership === "reissued"
+                        ? `agent_close({agent_id: ${lead.id}, row_only: true}) on it (plain agent_close refuses a pane id ` +
+                            "that still exists)"
+                        : "the agent_close tool on it") +
+                    " to retire the row for good - required before `hive restore`, which " +
                     "otherwise refuses while any lead row reads running, and end that session too, since it also " +
                     "holds this store open.");
             }
-            else if (live === null) {
+            else if (ownership === "unknown" && unobserved) {
                 warn("lead", "the lead's pane liveness could not be probed (tmux did not answer).");
             }
+            else if (ownership === "unknown") {
+                warn("lead", `pane identity unknown: the lead's row (agents.id ${lead.id}) cannot be verified as owning pane ` +
+                    `${lead.tmux_target || "(none)"}, because it is on another tmux socket or no pane pid was recorded ` +
+                    "for it. Its screen was not read. If this lead is gone, a human or peer lead (never a worker) can " +
+                    `retire the row with the MCP tool agent_close({agent_id: ${lead.id}, row_only: true}).`);
+            }
         }
         const stuck = db
             .prepare("SELECT name, kind, tmux_socket FROM agents WHERE project_id = ? AND status = 'running' AND kind != ?")
@@ -2441,19 +2515,21 @@ function cmdDoctor(argv) {
     }
     if (here) {
         const workers = db
-            .prepare("SELECT name, actor_id, command, kind, tmux_target, tmux_socket FROM agents WHERE project_id = ? AND status = 'running' AND kind = 'agent' ORDER BY id")
+            .prepare("SELECT name, actor_id, command, kind, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND status = 'running' AND kind = 'agent' ORDER BY id")
             .all(here.id);
+        const paneSnapshot = workers.length > 0 ? liveTargets() : null;
         let inputBoxClean = 0;
         let inputBoxDrifted = 0;
         let inputBoxUnclassified = 0;
         let leadsProbed = 0;
         let workersProbed = 0;
         const leadRows = db
-            .prepare("SELECT name, command, tmux_target, tmux_socket FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
+            .prepare("SELECT name, command, tmux_target, tmux_socket, pane_pid FROM agents WHERE project_id = ? AND kind = ? AND status = 'running' ORDER BY id")
             .all(here.id, LEAD_KIND);
+        const leadSnapshot = leadRows.length > 0 ? (paneSnapshot ?? liveTargets()) : null;
         for (const leadBox of leadRows) {
             const leadHarness = harnessFor(leadBox.command);
-            if (!leadHarness.classifiesPaneScreen || foreignSocket(leadBox.tmux_socket))
+            if (!leadHarness.classifiesPaneScreen || rowOwnership(leadBox, leadSnapshot) !== "live")
                 continue;
             leadsProbed += 1;
             const box = leadHarness.paneClassifier.inputBoxState(leadBox.tmux_target);
@@ -2478,20 +2554,26 @@ function cmdDoctor(argv) {
                 workersReported += 1;
                 // Dispatched through w's OWN harness, never the claude-only import - reading a codex pane
                 // with claude's dialog regexes fails silently in either direction (.claude/rules/tmux-and-panes.md).
+                const ownership = rowOwnership(w, paneSnapshot);
                 const foreign = foreignSocket(w.tmux_socket);
+                const unowned = ownership !== "live";
                 const workerChoiceCheck = paneClassifierFor(w.command)?.choiceCheck;
-                const { awaitingChoice, tail } = foreign || !workerChoiceCheck ? { awaitingChoice: null, tail: "" } : workerChoiceCheck(w.tmux_target);
+                const { awaitingChoice, tail } = unowned || !workerChoiceCheck ? { awaitingChoice: null, tail: "" } : workerChoiceCheck(w.tmux_target);
                 if (awaitingChoice === true)
                     dialogCount += 1;
                 verboseInfo("worker live state", `worker ${w.name}`, `last log event: ${describeLastLogEvent(lastLogEvent(w.actor_id))}`, `permission mode: ${lastPermissionMode(w.actor_id) ?? "unknown (no record)"}`, foreign
                     ? `pane: recorded on a different tmux socket (${w.tmux_socket}); this process cannot read it`
-                    : `pane: ${describePaneChoice(awaitingChoice)}`, ...(foreign
+                    : unowned
+                        ? `pane: not read - pane ownership ${ownership}`
+                        : `pane: ${describePaneChoice(awaitingChoice)}`, ...(foreign
                     ? ["tail: (not read - foreign socket)"]
-                    : awaitingChoice === null
-                        ? ["tail: (pane could not be read)"]
-                        : tail === ""
-                            ? ["tail: (pane rendered nothing)"]
-                            : ["tail:", ...tail.split("\n").map((line) => `| ${line}`)]));
+                    : unowned
+                        ? [`tail: (not read - pane ownership ${ownership})`]
+                        : awaitingChoice === null
+                            ? ["tail: (pane could not be read)"]
+                            : tail === ""
+                                ? ["tail: (pane rendered nothing)"]
+                                : ["tail:", ...tail.split("\n").map((line) => `| ${line}`)]));
             }
             // Gated on classifiesPaneScreen, not reportsAgentStateLog: this drift check only needs the pane,
             // and a codex worker's pane has been readable since todo 524, independent of whether its
@@ -2499,7 +2581,7 @@ function cmdDoctor(argv) {
             // own harness, never the claude-only import above, or a codex worker's screen gets read with
             // claude's regexes (see hive-internals).
             const harness = harnessFor(w.command);
-            if (!harness.classifiesPaneScreen || foreignSocket(w.tmux_socket))
+            if (!harness.classifiesPaneScreen || rowOwnership(w, paneSnapshot) !== "live")
                 continue;
             workersProbed += 1;
             const box = harness.paneClassifier.inputBoxState(w.tmux_target);
@@ -2735,7 +2817,8 @@ export function heldReasonLabel(heldReason) {
     if (isUnsubmittedInputHold(heldReason))
         return "typing";
     if (heldReason === HELD_REASON_LEAD_PANE_DEAD ||
-        wasHeldForPaneReissue(heldReason) ||
+        wasHeldForPaneIdentity(heldReason) ||
+        isLeadRowClosedHold(heldReason) ||
         isUnclassifiablePaneHold(heldReason)) {
         return "needs you";
     }

package/dist/contextCheckpoint.js

@@ -24,7 +24,7 @@ export function contextCheckpointAdditionalContext(actorId, thresholdPercent, fi
         return null;
     }
 }
-export function runContextCheckpointHook(kind) {
+export function runContextCheckpointHook(kind, suppliedPayload) {
     const thresholdText = process.env.HIVE_CONTEXT_CHECKPOINT_PERCENT;
     if (!thresholdText || !/^\d+$/.test(thresholdText))
         return;
@@ -35,7 +35,7 @@ export function runContextCheckpointHook(kind) {
     if (!actorId.startsWith("agent:") || (kind !== "claude" && kind !== "codex"))
         return;
     try {
-        const payload = JSON.parse(readFileSync(0, "utf8"));
+        const payload = suppliedPayload === undefined ? JSON.parse(readFileSync(0, "utf8")) : suppliedPayload;
         if (payload === null || typeof payload !== "object" || Array.isArray(payload))
             return;
         const fill = readContextFill(kind, {

package/dist/help.js

@@ -175,7 +175,14 @@ runbook (fork it first), not a pad write.`,
   agent_close(name|agent_id) — kill the worker's pane and mark closed. Capture
     handoffs first; output is not retained. Self-close needs confirm_self.
     On a PARKED row (by agent_id) it releases the park instead, which is how
-    you abandon a lane you have decided not to resume.
+    you abandon a lane you have decided not to resume. row_only=true marks
+    a stale row closed with no kill, stop or typing; a human or peer lead
+    only, refused for a row that provably owns a live pane or when tmux
+    could not be probed.
+  Every kill or type above acts only on a pane whose recorded pid matches.
+    Unverifiable ownership (no recorded pid) refuses by name; a gone or
+    reissued pane is never touched, and close, park and rename then act
+    on the row alone.
 
 Address a worker by its name, not its id: agent_send(name="impl", ...). A
 partial name works when it matches one running worker, so name="123" finds
@@ -257,8 +264,9 @@ Every pad, todo, kv entry, and lease belongs to one project (a directory).
     under HIVE_PROJECT_LOCK=1 since it sweeps every project, not just yours.
     With project_id, removes only that project, and only if it owns no rows.
     With project_id and confirm_name (its exact name), removes it with every
-    row it owns after a snapshot; refuses while it has a running agent. From a
-    terminal: hive project rm <id|path> [--yes].
+    row it owns after a snapshot; refuses while a running row owns a live
+    pane or cannot be verified (agent_close row_only retires the latter).
+    From a terminal: hive project rm <id|path> [--yes].
 
 Resolution order: explicit project_id argument, then session selection, then
 working-directory auto-detection. When the working directory matches no
@@ -312,7 +320,11 @@ place.`,
   pad_write(name, content, tags?) — create a pad; names are unique per project
   pad_write(pad_id, name, content, expected_revision) — full overwrite; the
     revision guard makes concurrent writers safe
-  pad_read(pad_id | name) — content plus revision and metadata
+  pad_read(pad_id | name, offset?, limit?) — content plus revision and metadata
+    offset and limit are nonnegative safe integers in UTF-16 code units, with
+    no default cap; a cut inside a surrogate pair moves back one unit, or
+    forward if moving back would return nothing, and the result reports its
+    effective offset
   pad_append(pad_id, content, expected_revision?) — add to the end
   pad_edit(pad_id, old_text, new_text, expected_revision?) — replace one
     unique literal occurrence; include enough context to disambiguate