@cruxy/cli 1.11.1 → 1.11.3

package/dist/agent/instruction-loss.js

@@ -0,0 +1,204 @@
+import { COMPACTION_MARKER } from "./prompts.js";
+/**
+ * Detect-and-warn for compaction (P3 context quality): after a prefix has been
+ * folded into a synopsis, which of the user's imperative or prohibitive
+ * sentences can no longer be found in it?
+ *
+ * A HEURISTIC, AND SAID TO BE ONE. It costs no tokens, it runs after the fact,
+ * and it can be wrong both ways: a paraphrased constraint that survived in
+ * spirit is reported lost, and a constraint whose key terms happen to appear
+ * elsewhere in the synopsis is reported kept. That is accepted. Before P3 a
+ * dropped constraint was SILENT — the user found out when the model touched
+ * the migrations. This turns silent loss into visible loss, in the same
+ * posture as the P2 verification record: evidence, not enforcement. It does
+ * not re-inject, pin, or refuse the synopsis (those need a constraint store,
+ * a retirement rule and an extractor, and the last changes the fail-open
+ * contract — deferred until a real loss has been observed AND recorded, which
+ * is what this makes possible).
+ *
+ * WHAT IT SCANS: the user's OWN words only — string-content user messages and
+ * text blocks in user messages. Tool results (also `role: "user"`) are not
+ * the user speaking, and a previous compaction's synthetic user message is
+ * not either. WHAT IT DOES NOT DO: infer that a sentence was a constraint
+ * from anything but its surface form, or decide what the constraint meant.
+ */
+/** Words that mark a sentence as an instruction, a constraint, or a prohibition. */
+const IMPERATIVE = /\b(never|don'?t|do not|must(?: not)?|mustn'?t|always|only|no longer|stop|avoid|keep|without|not allowed|forbidden|prohibited|refrain|ensure|make sure|should(?: not)?|shouldn'?t|can'?not|can'?t|leave .* alone|hands off)\b/i;
+/** Tokens that carry no identity of their own — never a key term. */
+const STOPWORDS = new Set([
+    "the",
+    "and",
+    "this",
+    "that",
+    "these",
+    "those",
+    "with",
+    "from",
+    "you",
+    "your",
+    "for",
+    "are",
+    "was",
+    "were",
+    "have",
+    "has",
+    "had",
+    "but",
+    "not",
+    "any",
+    "all",
+    "into",
+    "onto",
+    "just",
+    "also",
+    "then",
+    "than",
+    "when",
+    "what",
+    "which",
+    "who",
+    "will",
+    "would",
+    "should",
+    "could",
+    "can",
+    "may",
+    "might",
+    "please",
+    "let",
+    "use",
+    "our",
+    "its",
+    "they",
+    "them",
+    "there",
+    "here",
+    "about",
+    "after",
+    "before",
+    "over",
+    "under",
+    "again",
+    "still",
+    "very",
+    "some",
+    "more",
+    "most",
+    "other",
+    "only",
+    "never",
+    "always",
+    "must",
+    "don't",
+    "dont",
+    "avoid",
+    "keep",
+    "stop",
+    "make",
+    "sure",
+    "ensure",
+    "without",
+    "longer",
+    "allowed",
+    "forbidden",
+    "prohibited",
+    "refrain",
+    "cannot",
+    "can't",
+    "shouldn't",
+    "mustn't",
+    "want",
+    "need",
+    "like",
+    "thing",
+    "things",
+    "something",
+    "anything",
+    "everything",
+    "ever",
+    "each",
+    "every",
+]);
+/** Most sentences reported per compaction — an index, not a transcript. */
+export const MAX_LOST_SENTENCES = 5;
+/** Each reported sentence is cut here: enough to recognise, never the whole prompt. */
+export const MAX_SENTENCE_CHARS = 200;
+/**
+ * The user's imperative sentences in `prefix` whose key terms are NOT found
+ * in `synopsis`, bounded and truncated for the record. Empty when nothing
+ * looks lost — or when nothing looked like an instruction to begin with.
+ */
+export function detectInstructionLoss(prefix, synopsis) {
+    const haystack = synopsis.toLowerCase();
+    const lost = [];
+    const seen = new Set();
+    for (const sentence of userSentences(prefix)) {
+        if (!IMPERATIVE.test(sentence))
+            continue;
+        const terms = keyTerms(sentence);
+        if (terms.length === 0)
+            continue; // nothing to look for → cannot judge
+        const found = terms.filter((t) => haystack.includes(t)).length;
+        // Half the terms, rounded up, is "survived": a paraphrase that keeps the
+        // nouns passes, a synopsis that never mentions the subject does not.
+        if (found >= Math.ceil(terms.length / 2))
+            continue;
+        const cut = truncate(sentence);
+        if (seen.has(cut))
+            continue;
+        seen.add(cut);
+        lost.push(cut);
+        if (lost.length >= MAX_LOST_SENTENCES)
+            break;
+    }
+    return lost;
+}
+/** Every sentence the USER wrote in `messages`, in order. */
+function userSentences(messages) {
+    const out = [];
+    for (const m of messages) {
+        if (m.role !== "user")
+            continue;
+        const texts = [];
+        if (typeof m.content === "string") {
+            if (m.content.startsWith(COMPACTION_MARKER))
+                continue;
+            texts.push(m.content);
+        }
+        else {
+            for (const b of m.content)
+                if (b.type === "text")
+                    texts.push(b.text);
+        }
+        for (const text of texts) {
+            for (const raw of text.split(/(?<=[.!?])\s+|\n+/)) {
+                const s = raw.trim();
+                if (s.length >= 8)
+                    out.push(s);
+            }
+        }
+    }
+    return out;
+}
+/** The words in `sentence` worth looking for: lowercased, ≥3 chars, not stopwords. */
+export function keyTerms(sentence) {
+    const terms = new Set();
+    for (const raw of sentence.toLowerCase().split(/\s+/)) {
+        // Strip the quotes and brackets a word is wrapped in, then the punctuation
+        // it ends with — `.` and `/` are kept INSIDE a word so `db/migrate` and
+        // `parse.ts` survive as the identifiers they are.
+        const word = raw
+            .replace(/^[^a-z0-9_./-]+|[^a-z0-9_./-]+$/g, "")
+            .replace(/[./-]+$/, "");
+        if (word.length < 3 || STOPWORDS.has(word))
+            continue;
+        terms.add(word);
+    }
+    return [...terms];
+}
+function truncate(s) {
+    const flat = s.replace(/\s+/g, " ").trim();
+    return flat.length > MAX_SENTENCE_CHARS
+        ? `${flat.slice(0, MAX_SENTENCE_CHARS - 1)}…`
+        : flat;
+}

package/dist/agent/prompts.js

@@ -131,17 +131,38 @@ export function buildSystemPrompt(ctx) {
     return sections.join("\n\n");
 }
 /**
- * Compact reminder injected after tool results when the loop has run long, to
- * keep the model anchored to the original objective and the verify step.
+ * The heading under which the synopsis must carry the user's instructions
+ * verbatim (P3 context quality). A fixed string so the carry rule is checkable
+ * — by a test, and by `detectInstructionLoss` after the fact.
  */
-export const PROGRESS_REMINDER = `Reminder: stay focused on the original task. Before declaring done, verify your change actually works (build/tests/lint), then summarize what changed.`;
+export const STANDING_INSTRUCTIONS_HEADING = "## Standing instructions";
 /**
  * System prompt for the side conversation that compacts an over-long history
  * (see Session.compact). It runs as a standalone, tool-less completion over a
  * rendered transcript — the goal is a synopsis dense enough that the main loop
  * can continue without the verbatim prefix.
+ *
+ * THE CARRY RULE (P3 context quality). Until P3 this prompt ended "omit
+ * pleasantries and restated instructions". That was never a decision to drop
+ * the user's constraints: C.11 wrote it for density, and "restated" meant the
+ * assistant echoing the task back. But a model reads "restated instructions"
+ * and applies it to a user's repeated "never touch the migrations" just as
+ * readily — so a constraint stated three turns before a compaction was, by
+ * the prompt's own wording, the first thing to go. Mid-session constraints
+ * live ONLY in the history (CRUXY.md and recalled memory are rebuilt every
+ * turn and never compacted; memory is framed as data and cannot carry an
+ * instruction by design), so the synopsis is the one place they can survive.
+ *
+ * The prompt now says the opposite, explicitly: every instruction, constraint
+ * or prohibition the user stated goes under a fixed heading, verbatim. A test
+ * asserts that we ask for this; nothing can assert that the model complies,
+ * which is what `detectInstructionLoss` is for.
  */
-export const SUMMARY_SYSTEM = `You are compacting a coding assistant's conversation to fit within its context window. Summarize the conversation so far into a compact synopsis that preserves: decisions made and their rationale, concrete file paths and identifiers touched, the current state of the work, and any open or pending tasks. Be specific and terse — omit pleasantries and restated instructions. Output only the synopsis.`;
+export const SUMMARY_SYSTEM = `You are compacting a coding assistant's conversation to fit within its context window. Summarize the conversation so far into a compact synopsis that preserves: decisions made and their rationale, concrete file paths and identifiers touched, the current state of the work, and any open or pending tasks. Be specific and terse; omit pleasantries.
+
+Then, under the heading "${STANDING_INSTRUCTIONS_HEADING}", list every instruction, constraint, or prohibition the user stated at any point, each VERBATIM in the user's own words — never paraphrased, never merged with another, and never dropped as redundant, restated, or obvious. A constraint the user gave once still binds. If the user stated none, write the heading followed by "none".
+
+Output only the synopsis.`;
 /**
  * Marker embedded in the synthetic messages that replace a compacted prefix, so
  * they're recognizable in the history (and fold cleanly into a later

package/dist/agent/session.js

@@ -9,6 +9,8 @@ import { resolveTaskModel, } from "../routing/index.js";
 import { UsageCollector, accumulateCacheTokens, } from "../usage/index.js";
 import { Budget } from "./budget.js";
 import { estimateTokens, findCut } from "./context.js";
+import { detectInstructionLoss } from "./instruction-loss.js";
+import { emptyCompactionTally, } from "../session/index.js";
 import { runAgent, } from "./loop.js";
 import { DEFAULT_MODE, modeAutoApproves, modePlans, parseMode, } from "./mode.js";
 import { SUMMARY_SYSTEM, COMPACTION_MARKER } from "./prompts.js";
@@ -41,6 +43,37 @@ export class Session {
     /** The most recent run's usage record (C.22) — the one-shot path reads it to
      * print the end-of-run summary. */
     lastRun;
+    /**
+     * The most recent run that actually executed this session (P2 verification),
+     * or undefined when nothing has — the `lastRun` pattern, for `/status` and
+     * the Overview view. Read from the ledger, never re-derived.
+     */
+    get lastVerification() {
+        return this.args.verification?.lastVerification;
+    }
+    /**
+     * What THIS turn recorded (P2 verification) — the one-shot summary's unit:
+     * every run that executed, and every write refused because its target
+     * moved. Empty lists when nothing did, or when no ledger is wired.
+     */
+    turnVerification() {
+        return (this.args.verification?.turn() ?? {
+            verifications: [],
+            externalChanges: [],
+        });
+    }
+    /**
+     * What compaction has cost this session so far (P3 context quality): a
+     * count, what it freed, what the summaries cost, and how many times a user
+     * instruction may have been dropped. Kept in memory for the live surfaces
+     * (`/context`, the one-shot summary) and written to the log event by event,
+     * from which a resume folds the same shape back (`SessionState.compactions`).
+     */
+    compactionTally = emptyCompactionTally();
+    /** The tally, read-only — see {@link compactionTally}. */
+    compactions() {
+        return this.compactionTally;
+    }
     args;
     /** Mutable so `/reload` can refresh CRUXY.md mid-session. */
     projectInstructions;
@@ -105,6 +138,12 @@ export class Session {
             this.usage.output_tokens = restore.usage.output_tokens;
             this.recordedCount = restore.messages.length;
             this.mode = this.resolveMode(restore.mode);
+            // The last run the log recorded is adopted, never re-derived: a resumed
+            // session's `/status` says what last ran and when, not "none".
+            args.verification?.seed(restore.lastVerification);
+            if (restore.compactions) {
+                Object.assign(this.compactionTally, restore.compactions);
+            }
         }
     }
     /**
@@ -221,6 +260,10 @@ export class Session {
         // model iterations WITHIN this turn — it just never leaks into the next one.
         for (const tool of this.args.registry.list())
             tool.onTurnStart?.();
+        // The verification record's turn boundary (P2 verification): this turn's
+        // runs start empty, so the one-shot summary's "none ran this turn" is
+        // about THIS turn. What last ran across the session is untouched.
+        this.args.verification?.beginTurn();
         // Re-read the account's headroom (P9 / cli#212), on EVERY turn and on every
         // surface — the REPL and headless included, neither of which has a rail to
         // have justified the probe before. It is fired here rather than after the
@@ -281,36 +324,89 @@ export class Session {
         // hooks — throws here and aborts the turn before the model is engaged
         // (fail-closed). No-op when hooks are disabled or none are registered.
         await this.args.hooks?.fire("before-run", this.args.ctx);
+        // The mid-loop seam (build item 3), built ONCE for both branches below: let
+        // a long turn compact between iterations, not just once up front, reusing
+        // this session's threshold/cut/summarize path over the loop's own history
+        // and attributing the summary usage to this run's collector.
+        //
+        // IT IS ALSO THE FLUSH (P2), which is why it remembers what it returned.
+        // `compactLoopHistory` records the history before it compacts, and the
+        // loop calls it at the top of every iteration — so the array it hands back
+        // is, at that moment, exactly what the log holds: coherent (every tool_use
+        // beside its tool_result) and recorded. A turn that throws later has no
+        // `result.messages` to adopt, and without this the live history would stay
+        // at the user's prompt while the log had moved past it. See the catch.
+        const seen = {
+            coherent: null,
+        };
+        const compact = async (messages) => {
+            const out = await this.compactLoopHistory(messages, onReq);
+            seen.coherent = { messages: out, length: out.length };
+            return out;
+        };
         // Plan mode (C.31) delegates the whole turn to the injected runner: propose a
         // plan, approve/revise, then execute step-by-step. Falls back to the normal
         // single-shot loop when off or unwired, so existing behavior is untouched.
-        const result = modePlans(this.mode) && this.args.planRunner
-            ? await this.args.planRunner({
-                messages: this.messages,
-                projectInstructions: this.projectInstructions,
-                recalledMemory: this.args.recalledMemory ?? null,
-                renderer,
-                onRequestUsage: onReq,
-            })
-            : await runAgent({
-                messages: this.messages,
-                ...this.args, // carries `router` through to the loop
-                // The per-turn token guard (build item 4). After the spread because
-                // SessionArgs has no `budget` field — it is a per-turn construction,
-                // not session state. `undefined` when the cap is off (no-op check).
-                budget,
-                taskClass: "main-turn",
-                // After the spread so a mid-session `/reload` wins over the initial value.
-                projectInstructions: this.projectInstructions,
-                planMode: false, // the plan directive belongs only to the runner's propose phase
-                renderer,
-                onRequestUsage: onReq,
-                // Mid-loop compaction (build item 3): let a long autonomous turn
-                // compact between iterations, not just once up front. Reuses this
-                // session's threshold/cut/summarize path over the loop's own history
-                // and attributes the summary usage to this run's collector.
-                compact: (messages) => this.compactLoopHistory(messages, onReq),
-            });
+        //
+        // Both branches get the seam (plan-durability). Before it, the plan branch
+        // passed none: a plan turn's propose phase, approval and every step lived
+        // only in the runner's local array until the whole turn returned, so a
+        // provider error in step 3 left the session holding the prompt alone — in
+        // RAM and on disk — while the tree already carried steps 1 and 2.
+        let result;
+        try {
+            result =
+                modePlans(this.mode) && this.args.planRunner
+                    ? await this.args.planRunner({
+                        messages: this.messages,
+                        projectInstructions: this.projectInstructions,
+                        recalledMemory: this.args.recalledMemory ?? null,
+                        renderer,
+                        onRequestUsage: onReq,
+                        compact,
+                        record: this.args.recorder,
+                    })
+                    : await runAgent({
+                        messages: this.messages,
+                        ...this.args, // carries `router` through to the loop
+                        // The per-turn token guard (build item 4). After the spread because
+                        // SessionArgs has no `budget` field — it is a per-turn construction,
+                        // not session state. `undefined` when the cap is off (no-op check).
+                        budget,
+                        taskClass: "main-turn",
+                        // After the spread so a mid-session `/reload` wins over the initial value.
+                        projectInstructions: this.projectInstructions,
+                        planMode: false, // the plan directive belongs only to the runner's propose phase
+                        renderer,
+                        onRequestUsage: onReq,
+                        compact,
+                    });
+        }
+        catch (err) {
+            // ADOPT WHAT THE LOG ALREADY HOLDS, then fail. The seam flushed every
+            // coherent prefix it saw and advanced the recorder's watermark past it;
+            // the live array has to catch up or the two diverge — and the divergence
+            // is not benign. `flushRecorded` skips while the array is shorter than
+            // the watermark, so the NEXT turns would go unrecorded until the array
+            // grew past it, and from then on `slice(recordedCount)` would record the
+            // wrong messages at those positions. The log would be wrong, not merely
+            // short.
+            //
+            // The loop pushes onto the array the seam returned, so the coherent
+            // history is that array up to the length it had when the seam saw it:
+            // a half-iteration (an assistant tool_use whose tool threw before its
+            // result landed) is past that mark and is dropped, exactly as the log
+            // never received it.
+            //
+            // This was the shape of every plain turn before plan-durability too —
+            // the plan branch made it visible by being the one that throws for a
+            // step the user can see.
+            const { coherent } = seen;
+            if (coherent !== null && coherent.length > this.messages.length) {
+                this.messages = coherent.messages.slice(0, coherent.length);
+            }
+            throw err;
+        }
         this.messages = result.messages;
         this.usage.input_tokens += result.usage.input_tokens;
         this.usage.output_tokens += result.usage.output_tokens;
@@ -523,10 +619,15 @@ export class Session {
             return { messages, compacted: null };
         const prefix = messages.slice(0, cut);
         const kept = messages.slice(cut);
+        // Measured before anything is spent, over the SAME history the trigger
+        // measured (P3): the cost record is what the trigger saw, not a re-estimate.
+        const estimatedBefore = estimateTokens(messages);
         let synopsis;
+        let summaryUsage;
         try {
             const summary = await this.summarize(prefix, onRequestUsage);
             synopsis = summary.text;
+            summaryUsage = summary.reported ? summary.usage : undefined;
             this.usage.input_tokens += summary.usage.input_tokens;
             this.usage.output_tokens += summary.usage.output_tokens;
         }
@@ -547,19 +648,48 @@ export class Session {
                 content: `${COMPACTION_MARKER} Summary of the conversation so far:\n\n${synopsis}`,
             },
         ];
+        const next = [...summaryMessages, ...kept];
+        // What it cost (P3 context quality): the four facts in hand right here,
+        // which until P3 were thrown away at this line. Freed is the difference
+        // and is derived by every reader, never stored. Tallied in memory for the
+        // live surfaces and written to the log for the resumed ones.
+        const cost = {
+            estimatedBefore,
+            estimatedAfter: estimateTokens(next),
+            ...(summaryUsage
+                ? {
+                    summaryInputTokens: summaryUsage.input_tokens,
+                    summaryOutputTokens: summaryUsage.output_tokens,
+                }
+                : {}),
+        };
+        this.compactionTally.count++;
+        this.compactionTally.measured++;
+        this.compactionTally.freedTokens += Math.max(0, cost.estimatedBefore - cost.estimatedAfter);
+        this.compactionTally.summaryInputTokens += cost.summaryInputTokens ?? 0;
+        this.compactionTally.summaryOutputTokens += cost.summaryOutputTokens ?? 0;
         // Record the rewrite as an EVENT (P2): the log stays append-only, and the
         // messages that were folded away remain readable earlier in the file even
         // though the model can no longer see them. The watermark moves to the
         // post-compaction length so the next append is measured against the new
         // array, not the old one.
         if (this.args.recorder) {
-            this.args.recorder.compaction(prefix.length, summaryMessages);
+            this.args.recorder.compaction(prefix.length, summaryMessages, cost);
             this.recordedCount = summaryMessages.length + kept.length;
         }
-        return {
-            messages: [...summaryMessages, ...kept],
-            compacted: prefix.length,
-        };
+        // Detect and warn (P3 context quality): which of the user's instructions
+        // in the folded prefix can no longer be found in the synopsis? A
+        // heuristic — it says so — and it costs no tokens. It does NOT re-inject
+        // or refuse the synopsis; it turns a silent loss into a visible one, and
+        // records it so the loss is auditable after the warning has scrolled away.
+        const lost = detectInstructionLoss(prefix, synopsis);
+        if (lost.length > 0) {
+            this.compactionTally.instructionLosses++;
+            this.args.recorder?.instructionLoss(lost);
+            this.args.ctx.logger.warn(`compaction may have dropped ${lost.length} instruction${lost.length === 1 ? "" : "s"} you gave — ` +
+                `restate any that still apply: ${lost.map((s) => `"${s}"`).join("; ")}`);
+        }
+        return { messages: next, compacted: prefix.length };
     }
     /**
      * Summarize a prefix via a standalone, tool-less provider call over a rendered
@@ -636,7 +766,9 @@ export class Session {
         });
         if (!text.trim())
             throw new Error("summary was empty");
-        return { text: text.trim(), usage };
+        // `reported` is the same honesty pivot the usage record keeps: a provider
+        // that streamed no usage event leaves the cost UNKNOWN, not zero.
+        return { text: text.trim(), usage, reported: sawUsage };
     }
 }
 /** Render a message list to a compact plain-text transcript for summarization. */

package/dist/agent/status.js

@@ -2,6 +2,7 @@ import { readContext } from "./context.js";
 import { modeDescription } from "./mode.js";
 import { globalDir } from "../config/paths.js";
 import { GLOBAL_DIR_NAME } from "../constants.js";
+import { relativeAge } from "../session/resume.js";
 /**
  * Where the disk figures come from: every declared root, plus `~/.cruxy`.
  *
@@ -63,6 +64,7 @@ disk) {
         };
     });
     const jobs = session.jobs?.list();
+    const last = session.lastVerification;
     const locations = disk
         ? diskLocations(toolCtx.workspace.roots(), disk)
         : undefined;
@@ -92,5 +94,21 @@ disk) {
             }
             : {}),
         tools: session.toolRegistry.list().length,
+        // The last run that executed (P2 verification), dated. Absent when none
+        // has — and the renderer SAYS so, because here absence is the fact worth
+        // showing: a session in which nothing ran is what this record exists to
+        // make visible. `lastRun`'s pattern: a field read, no probe.
+        ...(last
+            ? {
+                verification: {
+                    tool: last.tool,
+                    command: last.command,
+                    passed: last.passed,
+                    exitCode: last.exitCode,
+                    durationMs: last.durationMs,
+                    age: relativeAge(last.at),
+                },
+            }
+            : {}),
     };
 }

package/dist/checkpoint/service.js

@@ -8,6 +8,7 @@ import { captureFiles } from "./capture.js";
 import { GitCheckpointStore } from "./git-store.js";
 import { ShadowCheckpointStore } from "./shadow-store.js";
 import { applyRollback, buildRollbackPreview, computeRollbackPlan, } from "./restore.js";
+import { describeOwner, selfStamp, } from "../utils/process-owner.js";
 /** Is `root` inside a git working tree? (Decides the checkpoint substrate.) */
 export function isGitWorkTree(root) {
     const res = runGitCapture(["rev-parse", "--is-inside-work-tree"], root);
@@ -112,6 +113,7 @@ export class CheckpointService {
             files: entries,
             touchedPaths: [],
             hasShellMutations: false,
+            owner: selfStamp(),
         };
         await this.writeManifest(checkpoint);
         await this.prune();
@@ -203,10 +205,27 @@ export class CheckpointService {
         const applied = await applyRollback(this.root, plan, store);
         return { kind: "applied", checkpoint, applied };
     }
-    /** Enforce `checkpoint.retention`: drop oldest manifests, then GC content. */
+    /**
+     * Enforce `checkpoint.retention`: drop oldest manifests, then GC content.
+     *
+     * ACROSS PROCESSES (P1). `.cruxy/checkpoints/` is per root, not per process,
+     * and every cruxy in the project prunes it by count — so a second session
+     * creating its own checkpoints pushed the first session's out of the
+     * window and swept their objects, and the first session's `cruxy rollback`
+     * then failed or restored the wrong thing. A checkpoint whose recorded
+     * owner is another LIVE process is therefore not this process's to prune:
+     * it is set aside, its objects stay referenced, and the retention count is
+     * applied to everything else. The bound is exceeded by at most the live
+     * foreign checkpoints, and only while their owners run: a crashed owner's
+     * checkpoints are ordinary candidates the next time anyone prunes, because
+     * liveness is pid + start-time asked of the OS, never a file that must be
+     * cleaned up.
+     */
     async prune() {
         const all = await this.list();
-        const doomed = all.slice(this.config.checkpoint.retention);
+        const protectedIds = foreignLive(all);
+        const candidates = all.filter((c) => !protectedIds.has(c.id));
+        const doomed = candidates.slice(this.config.checkpoint.retention);
         if (doomed.length === 0)
             return;
         for (const checkpoint of doomed) {
@@ -214,7 +233,7 @@ export class CheckpointService {
                 force: true,
             });
         }
-        const survivors = all.slice(0, this.config.checkpoint.retention);
+        const survivors = all.filter((c) => !doomed.includes(c));
         const referenced = new Set(survivors.flatMap((c) => c.files.map((f) => f.oid)));
         // The shadow pool is ours to sweep; git's dangling objects belong to git gc.
         await new ShadowCheckpointStore(this.root).collect(referenced);
@@ -266,6 +285,28 @@ export class CheckpointService {
         return parsed;
     }
 }
+/**
+ * Ids of the checkpoints another LIVE process owns (P1 — see {@link prune}).
+ * One liveness lookup per distinct owner, not per manifest: the darwin lookup
+ * is a `ps` call, and a project can hold many checkpoints from one session.
+ */
+function foreignLive(all) {
+    const ids = new Set();
+    const status = new Map();
+    for (const c of all) {
+        if (!c.owner)
+            continue;
+        const key = `${c.owner.pid}:${c.owner.token}`;
+        let s = status.get(key);
+        if (s === undefined) {
+            s = describeOwner(c.owner);
+            status.set(key, s);
+        }
+        if (s === "live")
+            ids.add(c.id);
+    }
+    return ids;
+}
 /** `ck-<utc-stamp>-<rand>` — sortable, collision-safe enough for a local CLI. */
 function newCheckpointId() {
     const stamp = new Date()