@cmgmyr/hive 1.6.0 → 1.7.0

package/claude-plugin/skills/cleanup/SKILL.md

@@ -47,13 +47,21 @@ Archive it. A pad still describing in-flight state for work that finished is wor
 
 A watch armed for a crew that is gone is noise. A dated reminder someone set on purpose is not - cancelling one silently loses a commitment nobody will notice missing until the date passes. If you cannot tell which it is, leave it and say so.
 
+## Project copies of the shared profile: report, do not rewrite
+
+At wrap-up, run `hive profile list` and use the `*` to identify the active profile and every file it carries, including extra Markdown files. Compare its rendered output from `hive posture`, `hive runbook`, and `hive profile read <file>` for every listed file with five kinds of project artifacts: pad headers, lines in the board pad, active todo bodies, the lead's project memory, and `CLAUDE.md`, `AGENTS.md`, or files under `docs/`. Read pad headers rather than whole lessons pads, and inspect todos without their comments. Read profile sources only when this pass runs: redirect `hive posture`, `hive runbook`, and each `hive profile read <file>` to files, then inspect them in bounded sections. For example, use `hive runbook > <file>` and read it by range. For every match, give the artifact and location, the exact profile source and line, its class, and a proposed pointer such as `see <profile source>, <section or line>`.
+
+List contradictions first, then restatements, then likely deliberate copies. A contradiction gives an outdated project-specific value as current guidance when the rendered profile now says something different or no longer says it. For example, a project memory that says commits use `--no-gpg-sign` contradicts a rendered rule requiring signed commits. A restatement repeats a profile rule without adding a project-specific choice; if replacing it with a pointer loses no useful detail, propose the pointer. A deliberate override has a project-specific delta, such as a path, a measured value, or a dated human decision; keep that detail and report it as an override. When a copy says it was kept because readers could not find the on-demand source, report it as a likely deliberate copy and ask whether it is still needed. Never infer that an outdated value is an override just because it is project-specific.
+
+This pass only reports and proposes. The lead may apply pointer changes to pads and board lines. Any memory change or deletion needs the human's OK. Do not edit, delete, archive, or send anything as part of this pass. Run it at wrap-up, not at every lane end.
+
 ## Residue you report and do not remove
 
 Worktrees, branches, running agents. Removing a worktree can destroy uncommitted work, and a running agent may be mid-turn. Name what you found and let the human or the lead decide.
 
 ## Finish by saying what you left, not just what you changed
 
-A cleanup that reports only its edits cannot be audited, and the interesting part is usually what was deliberately not touched. Leave the board in the shape the next session needs: where the code is now, whatever verification number this project quotes, what is genuinely in flight (often nothing), and what is waiting on a human.
+A cleanup that reports only its edits cannot be audited, and the interesting part is usually what was deliberately not touched. Leave the board in the shape the next session needs: where the code is now, whatever verification number this project quotes, what is genuinely in flight (often nothing), what is waiting on a human, and the profile-drift report with its proposed pointers.
 
 ## Where to route evidence in this project
 

package/claude-plugin/skills/profile/SKILL.md

@@ -92,7 +92,14 @@ A command, a repository name, a ticket prefix: these belong in `hive.yml` `vars`
 
 After writing, run `hive doctor` and read each file you touched with "Read a rendered file in bounded sections" above, from the project the profile is meant to serve. Read it to the last line: a change near the end of a large file is easy to miss. A profile with no readable `runbook.md` fails `hive doctor` outright; `posture.md` and `worker.md` do not, but check them anyway. Tell the user to restart any running hive session so it picks up the change, and invite one small follow-up edit once they've tried it - that is the expected way a profile keeps improving.
 
+## After a profile edit lands, ask once about notifying leads
+
+Do this once after the full profile edit has been reviewed and committed, not after each commit or review round. Find the changed files and the commit range for that edit, and record when both review and commit are complete; that is when the edit landed. Use `project_list` to enumerate registered projects and their paths. In each project, run `hive profile list`; its `*` marks the active profile. Keep projects whose active profile matches the one you edited.
+
+For each matching project, call `agent_list` with `{project_id: <project id>}`. A recipient must have `kind: "lead"`, `status: "running"`, and `alive: true`, which means the row owns a live pane. Inspect its `command` for `--append-system-prompt-file <path>`. When the named file exists, compare its modification time with the edit's landed time: notify if the file is older, and exclude it if it is equal or newer. `hive lead` rewrites that file when it launches, so its modification time reflects the current session's posture render. If the command has no such flag or the file is missing, include the lead and state the reason, such as `no posture file flag` or `posture file missing`. Do not include rows with `alive: false` or `alive: null`. Ask once and show the project names, lead names, and any reason a posture age could not be checked: `N running leads use this profile: <projects and reasons>. Notify them?` If no leads qualify, report that and stop.
+
+On no, send nothing. On yes, call `wake_set` once per qualifying lead with `delay_seconds: 1`, `project_id: <that project's integer id>`, and `deliver_to: <lead's integer agent_id>`. Do not pass an actor id such as `lead:663` as `deliver_to`. Each wake body names the changed files and commit range, then tells the lead to re-read with `hive posture`, `hive runbook`, and `hive profile read <file>`, or restart through `hive lead` to reload the posture. Do not send a wake before the human says yes.
+
 ## What this skill does not do
 
 It does not dispatch project work, change which agent application or model a project uses beyond what was explicitly asked, install a third-party tool, or commit or publish anything. It edits `hive.yml`'s `profile`, `agents`, `vars`, `context_checkpoint_percent`, and `lead_turn_budget` keys only on an explicit ask, and only to values the user gave or confirmed.
-

package/dist/build-info.json

@@ -1 +1 @@
-{"version":"1.6.0","sha":"ac13530","dirty":false,"build_id":"428a468f-98af-497e-a40c-fb87feef27ac"}
+{"version":"1.7.0","sha":"2000149","dirty":false,"build_id":"c539d81be530294a451590d781bd6922cd7155087a70b8fc64dedc35cf94f3e2"}

package/dist/cli.js

@@ -22,7 +22,7 @@ import { confirmQueenWrite, listQueenAudit } from "./queenAudit.js";
 import { formatRowCounts, projectRowCounts, removeProject } from "./projectRemove.js";
 import { ensureHooksFile } from "./hooks.js";
 import { errorMessage, registrationNoticeText, withTrailingNewline } from "./result.js";
-import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneReissue, } from "./scheduler.js";
+import { ACTIVE_TIMER_WHERE, dashboardFileContained, describeStall, HELD_REASON_CONVERSATION, HELD_REASON_LEAD_PANE_DEAD, HELD_REASON_UNCLASSIFIABLE_PANE_PREFIX, isLeadRowClosedHold, isUnclassifiablePaneHold, HELD_REASON_UNSUBMITTED_INPUT_PREFIX, isUnsubmittedInputHold, janitor, resolveDashboardFile, generateQueenDashboardNow, transcriptStaleness, wasHeldForPaneIdentity, } from "./scheduler.js";
 import { readTurnCount } from "./turnCount.js";
 import { collectPortfolio, leadText } from "./portfolio.js";
 import { STALL_BOUND_SECONDS } from "./backgroundTasks.js";
@@ -30,7 +30,7 @@ import { probeSessionInterpreter, reexecTarget, sessionStartVerdict, } from "./s
 import { backupHealth, backupNow, backupsDir, formatBytes, listSnapshots, previewRestore, restoreSnapshot, totalSizeBytes, } from "./backup.js";
 import { describeTeardownWindow, readTeardowns, teardownLogPath, } from "./teardown.js";
 import { asNameClash, buildEnvFlags, closeAgentRow, isReservedAgentName, launchAgent, LEAD_KIND, LEAD_NAME, mintLeadActorId, upsertActor, withWindowClaim, } from "./spawn.js";
-import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isPaneTarget, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePid, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, paneReissued, rowLive, rowLiveProbe, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
+import { adoptableWindow, applyLayout, claimInitialWindow, configureHiveWindow, controlModeFor, createWindow, DEFAULT_LAYOUT, describePaneChoice, ensureSession, findProjectWindow, foreignSocket, isViewSessionName, listOwnedWindows, liveTargets, observationFailed, observeRowOwnership, ORPHAN_MIN_AGE_MS, orphanScratchServers, orphansWorthWarningAbout, paneIsAloneInWindow, paneVisibility, panePidForRecord, PROCESSES_LAYOUT, processesPaneTitle, processesWindowName, projectWindows, RAW_ATTACH_TMUX_CONFIG, renderAttachCommand, resolveAttachTarget, resolveInTmuxTarget, rowLive, rowOwnership, SESSION_PREFIX, appendGlobalHook, globalHooks, replaceGlobalHooks, sessionName, setPaneTitle, shellQuote, shownPaneTitle, makeProcessesWindow, tmux, TMUX_DOC, tmuxSaysNothingThere, tmuxTimeoutOverride, tmuxSocketPath, untrustedTmuxServer, waitForPaneEstablished, windowLayout, } from "./tmux.js";
 import { describeVisibility, processCounts } from "./dashboard.js";
 import { runningCommandRow, runningCommandRows, snapshotProcesses, stopAllProcesses, stopLine, stopProcess, STOP_REASONS, } from "./processes.js";
 import { activeProfile, agentVarKeys, BUILT_IN_PROJECT_YML, configHash, loadProjectYml, mergedProjectVars, NO_PROFILE, PROJECT_YML_KEYS, resolveCommandDir, resolveFirstMessage, } from "./projectYml.js";
@@ -322,17 +322,20 @@ function ensureLeadRow(project, command) {
             previousCommand: existing.command,
             previousCodexHome: existing.codex_home,
             casExpected: existing.tmux_target,
+            casSocket: existing.tmux_socket,
+            casPid: existing.pane_pid,
         };
     }
     const priorClosed = db
         .prepare("SELECT actor_id, tmux_target, tmux_socket, pane_pid, command, codex_home FROM agents WHERE project_id = ? AND kind = ? AND status = 'closed' AND actor_id != '' ORDER BY id DESC LIMIT 1")
         .get(project.id, LEAD_KIND);
+    const insertedSocket = tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR);
     let result;
     try {
         result = db.transaction(() => {
             const info = db
                 .prepare("INSERT INTO agents (project_id, name, command, cwd, kind, parent_actor_id, tmux_target, tmux_socket, pane_pid) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)")
-                .run(project.id, LEAD_NAME, command, project.path, LEAD_KIND, currentActor(), "", tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), "");
+                .run(project.id, LEAD_NAME, command, project.path, LEAD_KIND, currentActor(), "", insertedSocket, "");
             const agentId = Number(info.lastInsertRowid);
             const actorId = priorClosed?.actor_id ?? mintLeadActorId(agentId);
             db.prepare("UPDATE agents SET actor_id = ? WHERE id = ?").run(actorId, agentId);
@@ -352,6 +355,8 @@ function ensureLeadRow(project, command) {
         previousCommand: priorClosed?.command ?? "",
         previousCodexHome: priorClosed?.codex_home ?? "",
         casExpected: "",
+        casSocket: insertedSocket,
+        casPid: "",
     };
 }
 function reportMigrationResult(result) {
@@ -375,6 +380,8 @@ async function cmdLead(argv) {
             registrationNotice = text;
         });
         const auditIdentity = captureQueenWriteIdentity(project.id);
+        // Only rows running before this invocation began are leftovers, trust prompts included; a later `hive start` is not.
+        const leftoverIds = new Set(runningCommandRows(project.id).map((row) => row.id));
         const { config, warnings, sources } = loadProjectYml(project.path);
         if (detach && (!process.stdin.isTTY || !process.stdout.isTTY)) {
             let untrusted;
@@ -453,7 +460,8 @@ async function cmdLead(argv) {
             }
         }
         const windowName = project.name;
-        const { agentId: leadAgentId, actorId: leadActorId, previousTarget, previousSocket, previousPanePid, previousCommand, previousCodexHome, casExpected, } = ensureLeadRow(project, leadCommand);
+        const { agentId: leadAgentId, actorId: leadActorId, previousTarget, previousSocket, previousPanePid, previousCommand, previousCodexHome, casExpected, casSocket, casPid, } = ensureLeadRow(project, leadCommand);
+        const previousIdentity = { tmux_target: previousTarget, tmux_socket: previousSocket, pane_pid: previousPanePid };
         // A fresh CODEX_HOME is built on every invocation, same as claude's hooks/posture files above -
         // cheap (a few KB; the codex-side plugins/cache bootstrap only materializes once a process
         // actually starts under it) and correct regardless of whether this invocation ends up creating
@@ -524,10 +532,8 @@ async function cmdLead(argv) {
             }
             else {
                 const foundWindow = findProjectWindow(session, project.id);
-                const probe = rowLiveProbe(previousSocket, previousTarget);
-                const adopted = isPaneTarget(previousTarget) && probe.live === true && !paneReissued(previousPanePid, probe)
-                    ? adoptableWindow(session, project.id, previousTarget)
-                    : null;
+                // Only a pane the row provably owns is adopted; unknown or reissued gets a fresh pane, never the stranger's pid.
+                const adopted = rowOwnership(previousIdentity) === "live" ? adoptableWindow(session, project.id, previousTarget) : null;
                 if (adopted) {
                     leadPane = previousTarget;
                     leadWindow = adopted;
@@ -574,12 +580,24 @@ async function cmdLead(argv) {
             if (newCodexHomeKey)
                 reapCodexHome(newCodexHomeKey);
         };
+        if (!createdPane && rowOwnership(previousIdentity) !== "live") {
+            abandonClaim();
+            throw new Error("The lead pane this `hive lead` was about to adopt no longer reads as the lead's own (its pane pid changed " +
+                "or could not be verified), so nothing was recorded. Re-run `hive lead`; it will start a fresh pane.");
+        }
+        const recordedPanePid = createdPane ? panePidForRecord(leadPane) : previousPanePid;
+        if (recordedPanePid === "") {
+            abandonClaim();
+            throw new Error(`tmux did not report a process id for the new lead pane ${leadPane} (asked twice), so it was discarded ` +
+                "rather than recorded: a lead row with no pane pid can never be verified as owning its pane. Re-run `hive lead`.");
+        }
         let wonRace;
         try {
             wonRace = db.transaction(() => {
                 const updated = db
-                    .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ?, command = ?, codex_home = ? WHERE id = ? AND tmux_target = ? AND status = 'running'")
-                    .run(leadPane, tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), panePid(leadPane), recordedCommand, recordedCodexHome, leadAgentId, casExpected).changes;
+                    .prepare("UPDATE agents SET tmux_target = ?, tmux_socket = ?, pane_pid = ?, command = ?, codex_home = ? " +
+                    "WHERE id = ? AND tmux_target = ? AND tmux_socket = ? AND pane_pid = ? AND status = 'running'")
+                    .run(leadPane, tmuxSocketPath(process.env.TMUX, process.env.TMUX_TMPDIR), recordedPanePid, recordedCommand, recordedCodexHome, leadAgentId, casExpected, casSocket, casPid).changes;
                 if (updated === 0)
                     return false;
                 db.prepare(`UPDATE wakes SET deliver_pane = ?, held_at = NULL, held_reason = NULL
@@ -610,7 +628,7 @@ async function cmdLead(argv) {
         }
         if (createdPane) {
             armLeadPaneExitedHook();
-            clearLeftoverProcesses(project, config);
+            clearLeftoverProcesses(project, config, leftoverIds);
         }
         else if (!leadPaneExitedHookArmed()) {
             console.log(`! this tmux server carries no ${LEAD_PANE_EXITED_HOOK} backstop and hive arms one only on a pane it created, ` +
@@ -1293,7 +1311,7 @@ function openDashboardOnce(project, dashboardFile) {
     if (claim.changes === 0)
         return;
     try {
-        execFileSync("open", [pathToFileURL(dashboardFile).href], { stdio: "ignore", timeout: 5000 });
+        execFileSync("open", [pathToFileURL(dashboardFile).href], { stdio: "ignore", timeout: 10000 });
     }
     catch {
         db.prepare("DELETE FROM kv WHERE project_id = ? AND key = ?").run(project.id, DASHBOARD_OPENED_KV_KEY);
@@ -1377,14 +1395,18 @@ function resolveNamedProcess(argv, verb) {
         console.log(`${name}: not running (start with: hive start "${name}")`);
         return null;
     }
-    const probe = rowLiveProbe(row.tmux_socket, row.tmux_target);
-    if (probe.live === null) {
+    const ownership = observeRowOwnership(row);
+    if (ownership === "probe-failed") {
         console.log(CANNOT_TELL_WHERE(name));
         return null;
     }
+    if (ownership === "unknown") {
+        console.log(`${name}: its pane ownership is unknown (no pane pid recorded, or another tmux socket), so hive will not move that pane`);
+        return null;
+    }
     // A pane id alone is not an identity: tmux restarts them at %0 on a fresh server, so a stale
-    // running row names whoever holds that id now. Same compare as janitor() and wake delivery.
-    if (!probe.live || paneReissued(row.pane_pid, probe)) {
+    // running row names whoever holds that id now.
+    if (ownership !== "live") {
         console.log(`${name}: not running (start with: hive start "${name}")`);
         return null;
     }
@@ -1466,8 +1488,10 @@ function cmdLeadPaneExited(argv) {
 }
 // Only a lead that CREATED its pane clears leftovers. An adopted live lead is the same lead those
 // processes belong to, and stopping them there would take down a running crew's dev server.
-function clearLeftoverProcesses(project, config) {
+function clearLeftoverProcesses(project, config, leftoverIds) {
     for (const row of runningCommandRows(project.id)) {
+        if (!leftoverIds.has(row.id))
+            continue;
         const stopped = stopProcess(row, STOP_REASONS.previousLead);
         // Nothing was running under it, so the auto-start line that follows is the whole story.
         if (stopped.leg === "already-gone")
@@ -2793,7 +2817,8 @@ export function heldReasonLabel(heldReason) {
     if (isUnsubmittedInputHold(heldReason))
         return "typing";
     if (heldReason === HELD_REASON_LEAD_PANE_DEAD ||
-        wasHeldForPaneReissue(heldReason) ||
+        wasHeldForPaneIdentity(heldReason) ||
+        isLeadRowClosedHold(heldReason) ||
         isUnclassifiablePaneHold(heldReason)) {
         return "needs you";
     }

package/dist/help.js

@@ -179,6 +179,10 @@ runbook (fork it first), not a pad write.`,
     a stale row closed with no kill, stop or typing; a human or peer lead
     only, refused for a row that provably owns a live pane or when tmux
     could not be probed.
+  Every kill or type above acts only on a pane whose recorded pid matches.
+    Unverifiable ownership (no recorded pid) refuses by name; a gone or
+    reissued pane is never touched, and close, park and rename then act
+    on the row alone.
 
 Address a worker by its name, not its id: agent_send(name="impl", ...). A
 partial name works when it matches one running worker, so name="123" finds
@@ -316,7 +320,11 @@ place.`,
   pad_write(name, content, tags?) — create a pad; names are unique per project
   pad_write(pad_id, name, content, expected_revision) — full overwrite; the
     revision guard makes concurrent writers safe
-  pad_read(pad_id | name) — content plus revision and metadata
+  pad_read(pad_id | name, offset?, limit?) — content plus revision and metadata
+    offset and limit are nonnegative safe integers in UTF-16 code units, with
+    no default cap; a cut inside a surrogate pair moves back one unit, or
+    forward if moving back would return nothing, and the result reports its
+    effective offset
   pad_append(pad_id, content, expected_revision?) — add to the end
   pad_edit(pad_id, old_text, new_text, expected_revision?) — replace one
     unique literal occurrence; include enough context to disambiguate

package/dist/leadWatch.js

@@ -2,7 +2,7 @@ import { db } from "./db.js";
 import { paneClassifierFor } from "./harnesses.js";
 import { readLeadTurnState } from "./leadState.js";
 import { LEAD_KIND } from "./spawn.js";
-import { holdsHumanInput, paneReissued, rowAliveProbe } from "./tmux.js";
+import { foreignSocket, holdsHumanInput, observationFailed, rowOwnership } from "./tmux.js";
 export const LEAD_TARGET_GONE = "LEAD_TARGET_GONE";
 export const LEAD_TARGET_REISSUED = "LEAD_TARGET_REISSUED";
 export const LEAD_TARGET_RESTARTED = "LEAD_TARGET_RESTARTED";
@@ -39,14 +39,16 @@ export function evaluateLeadWatch(sub, mode, snapshot, readers) {
         return { kind: "invalid", reason: LEAD_TARGET_GONE };
     if (lead.pane_pid !== sub.pane_pid)
         return { kind: "invalid", reason: LEAD_TARGET_RESTARTED };
-    if (snapshot === null)
-        return { kind: "pending", reason: "tmux did not answer" };
-    const probe = rowAliveProbe(lead.tmux_socket, lead.tmux_target, snapshot);
-    if (probe.live === null)
+    if (foreignSocket(lead.tmux_socket))
         return { kind: "pending", reason: "its pane cannot be probed from this process" };
-    if (!probe.live)
+    if (observationFailed(snapshot))
+        return { kind: "pending", reason: "tmux did not answer" };
+    const ownership = rowOwnership(lead, snapshot);
+    if (ownership === "unknown")
+        return { kind: "pending", reason: "pane ownership unknown" };
+    if (ownership === "gone")
         return { kind: "invalid", reason: LEAD_TARGET_GONE };
-    if (paneReissued(sub.pane_pid, probe))
+    if (ownership === "reissued")
         return { kind: "invalid", reason: LEAD_TARGET_REISSUED };
     const state = readLeadTurnState(lead.id);
     if (state === null || state.pane_pid !== sub.pane_pid)

package/dist/processes.js

@@ -1,8 +1,8 @@
 import { getProject } from "./context.js";
 import { db } from "./db.js";
 import { loadProjectYml } from "./projectYml.js";
-import { closeAgentRow, killAgentPane, relayoutAfterPaneLeft } from "./spawn.js";
-import { cancelCopyMode, paneProcessExited, paneReissued, paneVisibility, paneWindow, projectWindows, rowLive, rowLiveProbe, sessionName, tmux, } from "./tmux.js";
+import { closeAgentRow, currentOwnership, killAgentPane, paneIdentity, relayoutAfterPaneLeft } from "./spawn.js";
+import { cancelCopyMode, observeRowOwnership, paneProcessExited, paneVisibility, paneWindow, projectWindows, rowLive, sessionName, tmux, } from "./tmux.js";
 // One derivation for every surface that reports where a project's processes are: `hive status`,
 // `hive doctor`, and the dashboard. Two tmux window lookups per project, then one per running
 // process, and none at all for a project with neither a running command nor a defined one.
@@ -96,6 +96,19 @@ function waitForPaneToExit(target, timeoutMs) {
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(STOP_POLL_MS, remaining));
     }
 }
+const UNKNOWN_OWNERSHIP_NOTE = "its pane ownership is unknown (no pane pid recorded, a legacy window target, or another tmux socket), so hive left it running";
+const REISSUED_NOTE = "its pane id now belongs to another process, which was left alone";
+const CHANGED_NOTE = "its row was closed or recorded a different pane during the stop, so hive touched nothing further";
+// Unknown, or a row that changed underneath the stop, is left running: closing it would hide a
+// process that may still be running from every surface that reports one.
+function notOwned(row, ownership) {
+    if (ownership === "unknown")
+        return { name: row.name, leg: "unreachable", note: UNKNOWN_OWNERSHIP_NOTE };
+    if (ownership === "changed")
+        return { name: row.name, leg: "unreachable", note: CHANGED_NOTE };
+    closeAgentRow(row.id, paneIdentity(row));
+    return { name: row.name, leg: "already-gone", ...(ownership === "reissued" ? { note: REISSUED_NOTE } : {}) };
+}
 // The only thing that stops a hive.yml command. kill-pane alone is SIGHUP, which a dev server with
 // detached grandchildren survives while still holding its port, so the graceful leg comes first and
 // the receipt says which one ended it.
@@ -103,19 +116,19 @@ function waitForPaneToExit(target, timeoutMs) {
 // argument so every caller has to declare its trigger from the closed set docs/projects.md is
 // checked against, and whichever caller prints it already knows which one it passed.
 export function stopProcess(row, reason) {
-    const probe = rowLiveProbe(row.tmux_socket, row.tmux_target);
-    // A pane hive cannot see is left alone, row and all: closing the row here would hide a process
-    // that is still running from every surface that reports one.
-    if (probe.live === null)
+    const identity = paneIdentity(row);
+    const ownership = observeRowOwnership(identity);
+    if (ownership === "probe-failed")
         return { name: row.name, leg: "unreachable" };
-    // A reissued pane id belongs to whoever holds it now, so it is never killed - same compare as
-    // janitor() and wake delivery.
-    if (probe.live === false || paneReissued(row.pane_pid, probe)) {
-        closeAgentRow(row.id);
-        return { name: row.name, leg: "already-gone" };
-    }
+    if (ownership !== "live")
+        return notOwned(row, ownership);
     markStopping(row.project_id, row.id);
     const window = paneWindow(row.tmux_target);
+    const beforeSignal = currentOwnership(row.id, identity);
+    if (beforeSignal !== "live") {
+        clearStoppingMarker(row.project_id, row.id);
+        return notOwned(row, beforeSignal);
+    }
     try {
         // In copy mode C-c is `cancel`, not SIGINT, so the graceful leg would silently do nothing to a
         // pane someone scrolled back in. A stop may take that scrollback position: the process is ending.
@@ -126,6 +139,11 @@ export function stopProcess(row, reason) {
     }
     let leg = "interrupted";
     if (!waitForPaneToExit(row.tmux_target, STOP_GRACE_MS)) {
+        const beforeKill = currentOwnership(row.id, identity);
+        if (beforeKill !== "live") {
+            clearStoppingMarker(row.project_id, row.id);
+            return notOwned(row, beforeKill);
+        }
         try {
             killAgentPane(row.tmux_target);
         }
@@ -137,7 +155,7 @@ export function stopProcess(row, reason) {
     // RUNNING, so the process stays visible to hive status, hive stop and the janitor.
     if (leg === "still-running")
         return { name: row.name, leg };
-    closeAgentRow(row.id, row.tmux_target);
+    closeAgentRow(row.id, identity);
     clearStoppingMarker(row.project_id, row.id);
     relayoutAfterPaneLeft(window);
     return { name: row.name, leg };
@@ -152,9 +170,13 @@ export function stopLine(stopped) {
         case "killed":
             return `${stopped.name}: stopped (killed after ${STOP_GRACE_MS / 1000}s)`;
         case "already-gone":
-            return `${stopped.name}: already gone (nothing was running)`;
+            return stopped.note
+                ? `${stopped.name}: already gone (${stopped.note})`
+                : `${stopped.name}: already gone (nothing was running)`;
         case "unreachable":
-            return `${stopped.name}: tmux could not be probed, so hive left it running`;
+            return stopped.note
+                ? `${stopped.name}: ${stopped.note}`
+                : `${stopped.name}: tmux could not be probed, so hive left it running`;
         case "still-running":
             return `${stopped.name}: still running: its pane survived C-c and kill-pane, so hive left the row open`;
     }