@dzhechkov/harness-core 0.8.31 → 0.8.33

package/.dz-manifest.json

@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "54263cdc0ff93b433ed446ce4c4e73d65c8b9aa485d85e572619e4ac0f127acb"
+        "sha256": "70cf5d858ca889a834345fe7c00f7312fc65477f5e5c3f6d2f4dd7d742ca2ed3"
       },
       {
         "path": "dist/__tests__/golden-baseline.test.d.ts",
@@ -125,19 +125,19 @@
       },
       {
         "path": "dist/apply-leg.d.ts",
-        "sha256": "a55d5bf49f07b754abf06b14d4e7d6aa588d068e3ef8078eb375256c67254583"
+        "sha256": "a3b35c162ce1059ec52e66250f4d5eb40ea80031bc6ba211cf2c239125da2dab"
       },
       {
         "path": "dist/apply-leg.d.ts.map",
-        "sha256": "1bce79ef725136a5f4f46520ffbba6b028fa407add47930e117472462a35d64a"
+        "sha256": "a16afc919647db2ea568e29bf0e835df023a025716bf73e60ab5294300fee486"
       },
       {
         "path": "dist/apply-leg.js",
-        "sha256": "d7d36c98560831a883b6c161a8758789dd458981c1846c23f2a8791bc08009e0"
+        "sha256": "604ff5b789bf969728c174c560a0b463d64307f0120699feb28ed839d0e42afa"
       },
       {
         "path": "dist/apply-leg.js.map",
-        "sha256": "66b3a643d29f340c96c7d8bca16cc8e5ab39763db030d31ecf154b27f0a817de"
+        "sha256": "78b6f40ca672f6ea40ce4d29c9ae9baab74c74252400a5e05540272a612201b1"
       },
       {
         "path": "dist/apply.d.ts",
@@ -747,6 +747,22 @@
         "path": "dist/downloads.js.map",
         "sha256": "05587a82779e82165de0c21aebe85a6b43a182d24889180b845105f0010a55af"
       },
+      {
+        "path": "dist/embed-socket-path.d.ts",
+        "sha256": "d1e9b3cb7982f012b3da1de5b97b2a584b14e00c74a8de4bdc481e48b52f414b"
+      },
+      {
+        "path": "dist/embed-socket-path.d.ts.map",
+        "sha256": "67d855dd419e6221658bd96039db2328b4f0336f236dd5304de604f8b6d99045"
+      },
+      {
+        "path": "dist/embed-socket-path.js",
+        "sha256": "c5d11ebcd03e0b952a7021206cdffe6474cbd79101dfdaf0dfcd302fec1d4302"
+      },
+      {
+        "path": "dist/embed-socket-path.js.map",
+        "sha256": "aa0bcf9922795cd37e0be3fed8b8de7750e981e5cc6c373848fc283a9a581926"
+      },
       {
         "path": "dist/embedding-config.d.ts",
         "sha256": "850450c883fe4c0355df3e450fe7157f45fd35ab6d38874352822803d1e3eff2"
@@ -1021,19 +1037,19 @@
       },
       {
         "path": "dist/index.d.ts",
-        "sha256": "fd97f39647b729ea810c902f273fdfc36f59e567f3a4884290bed49fff4ec052"
+        "sha256": "9268dcea6b76bcc172de258f26b263384be72751ecd80bf695d30fa956ce3255"
       },
       {
         "path": "dist/index.d.ts.map",
-        "sha256": "d6430786c63f4b4fa3fada8187ac9402aa3594872a0db2c88ec7a2d5d9c822dc"
+        "sha256": "525593dc52d74876f41071fc906828b3b1807d5b8d1bf0e570589b8f5e23a6cd"
       },
       {
         "path": "dist/index.js",
-        "sha256": "b47ef22031aadc12196f5baec464fcc1f7feeeb0b72777e8b14016d7c78cfb95"
+        "sha256": "645544ee8ebb51df85c94f1150134c76885678ac0c54dfaaacfaa38090549ee6"
       },
       {
         "path": "dist/index.js.map",
-        "sha256": "16328408edcd3a051077e91cabaf1e4d83b89f4e6f299cdea7036704d2d9f8a8"
+        "sha256": "0a45a791953cdecc4fb0bff3d39ea158f1d204ba5c3507783affd94fc38c559a"
       },
       {
         "path": "dist/integration-apply.d.ts",
@@ -1473,15 +1489,15 @@
       },
       {
         "path": "dist/operations.d.ts.map",
-        "sha256": "ed5a263c47219eaa072cce5a0abaa470c32c9289ebe88f8b62294957ecebc120"
+        "sha256": "f147b33e2edd6766f4d8256f980315a1458f0408bb0683f5324ccee28e0b8223"
       },
       {
         "path": "dist/operations.js",
-        "sha256": "fb7ab749fea417fa2674b414b8a4b9447aba71f452d0013c7b2c434c51755e1c"
+        "sha256": "568d5ea2e70f3672deadf656384e0dedc8f02136e1aacfbff18b523ee0c90fa9"
       },
       {
         "path": "dist/operations.js.map",
-        "sha256": "d35bd1d760e49c2e0c5e95d350f121ccdc4f7de11ba498d42767d58cb26dc749"
+        "sha256": "43e8044e64abc740d5db2486e149acdc943c58a046d9b0c94038e53c207fc0af"
       },
       {
         "path": "dist/package-skill-layouts.d.ts",
@@ -1499,6 +1515,22 @@
         "path": "dist/package-skill-layouts.js.map",
         "sha256": "cfafe66b3e3a46524fdbaa3404163441c17fdd0245c353dca5fc5c8f35fed2ca"
       },
+      {
+        "path": "dist/packed-install-smoke.d.ts",
+        "sha256": "5fab8ab0b347d09711324875be550ce44724dca46d56be901f86dffd471e0506"
+      },
+      {
+        "path": "dist/packed-install-smoke.d.ts.map",
+        "sha256": "3f3bdc901c79b61534649c138306756cc2b59df0682def6ca903d3632e9fcfa7"
+      },
+      {
+        "path": "dist/packed-install-smoke.js",
+        "sha256": "440ae2f1a8876ffae09f3a01534973a9fb7666b6ca963d7ecd01760d6abb32f5"
+      },
+      {
+        "path": "dist/packed-install-smoke.js.map",
+        "sha256": "0b929c1db7a5cc426160c4e2c19b16bf3db5e4a54a55719b46ea6d69d016277e"
+      },
       {
         "path": "dist/parity.d.ts",
         "sha256": "ada951eddf7fc9d5873b63943e45517129072440ad5ec2ed7cf32ec33d638025"
@@ -1643,6 +1675,22 @@
         "path": "dist/provenance.js.map",
         "sha256": "74f4d718f0ca68857448c043eb8f439c841604db64ee2d799ddec9f66dc15556"
       },
+      {
+        "path": "dist/publish-sibling-drift.d.ts",
+        "sha256": "63e4bb439f1366114d21b9796489fec34308c34818bddeb6b69f590b8882c0fd"
+      },
+      {
+        "path": "dist/publish-sibling-drift.d.ts.map",
+        "sha256": "6c564150ddcb07ce2994c63764a0acb3d282bd702ed79dc906c886affc3e84e9"
+      },
+      {
+        "path": "dist/publish-sibling-drift.js",
+        "sha256": "b99fca72e63868d9177052aefe47390e9f5e08ff6869d65299dc0286c8bdfd18"
+      },
+      {
+        "path": "dist/publish-sibling-drift.js.map",
+        "sha256": "504ecc5393016745aef5c60dfa9162a6531625a56b34ced46f4f8ee31d72bf11"
+      },
       {
         "path": "dist/publish-signing.d.ts",
         "sha256": "693c45518c7d13bef56f08b1af32955db990235922243c077c2e81fec7c000a3"
@@ -1661,35 +1709,35 @@
       },
       {
         "path": "dist/publish.d.ts",
-        "sha256": "613cf29c62332171a95b152ebc73d383a71e7ba2ff2d97ed1619f9a1f6f77b96"
+        "sha256": "c2494e9728e80aecd427671f17f252d250ea8866e5b1770efa74f64e37ced8d7"
       },
       {
         "path": "dist/publish.d.ts.map",
-        "sha256": "52bd5d82f546c0a9dce2a25b4775c44502d199ea1e11c33a0e0f4ca9c986215e"
+        "sha256": "a4cedae6fed2af78018ae9db1d57f71008373df4c42a9d23f6b73e0a1fde00a1"
       },
       {
         "path": "dist/publish.js",
-        "sha256": "23aa88616d9296bd571619baca8f31524c4c21ca3844dc71971ea66e56172238"
+        "sha256": "5521d2668e6ddb77086a911166eee4b7df1776ff94b23b5bab9ba927d479b6d4"
       },
       {
         "path": "dist/publish.js.map",
-        "sha256": "b6a45c54545e890424561cf8bfcbfa8f98061852ffc6b1fcaea526eb420a5a9e"
+        "sha256": "2dae5163293e7aa626a27d8da7642a82437b8bdac98b2735706f535572ec71c1"
       },
       {
         "path": "dist/qe-bridge.d.ts",
-        "sha256": "dc7d9b6325d8ef314d75834c649aeca914e0453324d1dbd631508b5d6e3e400d"
+        "sha256": "7bf6a9f4bbd79eef7858d3a5e073fbb897d7af01accf9257894635664432f449"
       },
       {
         "path": "dist/qe-bridge.d.ts.map",
-        "sha256": "0a32cc82bbc3b5df2576495e5d4823b32ddcc4375b9217d3c8a008cc68054997"
+        "sha256": "6eac09175e7d75786e831dc07a79fa17574a61cbe607ffecbe263ac4248f818d"
       },
       {
         "path": "dist/qe-bridge.js",
-        "sha256": "805dbe6e3d2e60b243b51b5f76c688707f1634625ab5326723f8e7e28b4f0246"
+        "sha256": "c61ce95a1fe307b340cb247cb7eb82708525452a12621fa42345e1561eb200e8"
       },
       {
         "path": "dist/qe-bridge.js.map",
-        "sha256": "82b9a67c5432a3b2d029720a16c7336b1443ed8b7f00e7ce911fb4eb31e106e5"
+        "sha256": "5f9c7d67e269024896199f171d84e918d6adb71d022983bfc959b3697d78be67"
       },
       {
         "path": "dist/qe-rounds.d.ts",
@@ -1853,19 +1901,19 @@
       },
       {
         "path": "dist/release.d.ts",
-        "sha256": "ccc6b0c5267e3c6236f7abba5c9b436d728acff7e1265b8661633150006da7aa"
+        "sha256": "cf5750b9c6d474c45cfd81b7cbb2f92a18b452fa1c069e4e3fbfc4dac06267d9"
       },
       {
         "path": "dist/release.d.ts.map",
-        "sha256": "e73877b3aa674936b7b195f7d2f310cfb8490d0c1c341c56612eb93cad4d7fb1"
+        "sha256": "6eaca079115921991149d68189ed8ef8c61be6efd12c426df8d091c1b39da5b9"
       },
       {
         "path": "dist/release.js",
-        "sha256": "c7af542cf783fcd639e6c0b3e15463864aaa816d93abce5e05c39d75979d4b1f"
+        "sha256": "627e5efa90298701d01bee346790647f5688dc0f10c4727b348298490c35d219"
       },
       {
         "path": "dist/release.js.map",
-        "sha256": "9123f8a37ffc19886f2940c700c2622509cd4deb0eea762ed3cc1e1f0907d17f"
+        "sha256": "a539f499cf28923856c6cb6f40417d67d662c6771b4df8fe4e7fe5ab9f2a7121"
       },
       {
         "path": "dist/repo-boundary.d.ts",
@@ -2125,19 +2173,19 @@
       },
       {
         "path": "dist/setup.d.ts",
-        "sha256": "653c6b53ddece860e58a148e6293fdeb88a780b2bb794cbffe10f74406cf8e2d"
+        "sha256": "f83a15a0c183e2dc67d95323a3eae1eddfd8b375ca92a0de488081ec9d020603"
       },
       {
         "path": "dist/setup.d.ts.map",
-        "sha256": "b0be51ebb68bf00ba4649dd82a5ed862361e59a8911697e7e6a103e398ca801b"
+        "sha256": "baefa9d4a927880e51b8dc9ec4b899e7625c029de82ed397501b32cb1d3e925a"
       },
       {
         "path": "dist/setup.js",
-        "sha256": "0c2b6ff57f0362bb17c5c28843b52e8801f71218121dc0d6260d684aa7068d68"
+        "sha256": "6f8cbb59ffc98b5f8722134b9b28b4d2bd5d847fe50edc38d2f539ebc9980151"
       },
       {
         "path": "dist/setup.js.map",
-        "sha256": "ee3832352ba91e98f5497a3de74bfe6fdb395392a007eaa689974dd1cc2207fb"
+        "sha256": "f859ac7532e6b9d2232fbdbe6f7b3cb5e0a739842bc70024544c9263f78ec67e"
       },
       {
         "path": "dist/shell-veto-policy.d.ts",
@@ -2685,7 +2733,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "f00aaf01308571a44a9a46b0da4c6e039325fb7374b6a6d55a8ad05bfe8764a5"
+        "sha256": "a6f86350222413a151c6d4f73d9c80f4e2d3c21297000e2fe7b0708248d77724"
       },
       {
         "path": "src/__tests__/golden-baseline.test.ts",
@@ -2717,7 +2765,7 @@
       },
       {
         "path": "src/apply-leg.ts",
-        "sha256": "1d8f1c5f6edf5f3cc26de81a5697aae835511826b38b67832d51943d9dd1d14c"
+        "sha256": "15feafe9dedd298f2d8f7815d2a100cedaf4864223affb80f8e8c34317e4b0f6"
       },
       {
         "path": "src/apply.ts",
@@ -2875,6 +2923,10 @@
         "path": "src/downloads.ts",
         "sha256": "1442c789d2519c1b621b326411fcee4a57ab933ce332dbc60d271e64b49ec5db"
       },
+      {
+        "path": "src/embed-socket-path.ts",
+        "sha256": "2168f61719813abe70d90493a1e12936e084ae43bfc59cf131d9ad9bcbe27939"
+      },
       {
         "path": "src/embedding-config.ts",
         "sha256": "1323977cbf0a5e648e9c319c2584ff3fb71a15bc7c97e35c6a5154deb900ec56"
@@ -2945,7 +2997,7 @@
       },
       {
         "path": "src/index.ts",
-        "sha256": "5df0f960a0c66a364f123c9e519a2dccce1cbda9fdf210d0dfc622cffaedb05f"
+        "sha256": "307f2d574fd2d7a0f2b8ebe7a36047f0c3d8cade6e8fdda9e10e26d344914912"
       },
       {
         "path": "src/integration-apply.ts",
@@ -3061,12 +3113,16 @@
       },
       {
         "path": "src/operations.ts",
-        "sha256": "3f4047a17032ba1b84facf899b9934d4b4b5e4e126d84895c2a4dc2265343b8b"
+        "sha256": "fd66a40569fd53cbf0d621643ace1e4f89777e9634bcda24a730e971dc240ccd"
       },
       {
         "path": "src/package-skill-layouts.ts",
         "sha256": "d51f2eb3054716bf2c52113cef46445203f13e365a4efd551ce8d9936f1d7953"
       },
+      {
+        "path": "src/packed-install-smoke.ts",
+        "sha256": "c6c9ed22e4e06fc6de233efc1214349e60f66ea012c5162ef9fb1fcbc0a169d5"
+      },
       {
         "path": "src/parity.ts",
         "sha256": "8a444c993eb7b117b2606abec7783c1209833bd51af89c5828f43f96152c00ba"
@@ -3103,17 +3159,21 @@
         "path": "src/provenance.ts",
         "sha256": "09930294d2b7fcd2938c15b8d8a62a9d1615c064a2479cae1918e0ea4d4ba045"
       },
+      {
+        "path": "src/publish-sibling-drift.ts",
+        "sha256": "2bd607ec044e2bca2a7336e10d69cee99db53e6f41b60bfa770711d756dd9116"
+      },
       {
         "path": "src/publish-signing.ts",
         "sha256": "e190a24c144667843283268fcec3b0ee08a184a33f876c151f2b562eebe4f892"
       },
       {
         "path": "src/publish.ts",
-        "sha256": "4c699867eb449f72e83407f9f5901f480f0e7a5a99412ea8e08c4dc06f0d1a4a"
+        "sha256": "00024c5a639339c5184bdad4d0ccf2e2e7d609cd74f25e64b624a43c22ac8625"
       },
       {
         "path": "src/qe-bridge.ts",
-        "sha256": "5d4329089e2ad573a65663bfde91e2d94194dfe04f1bf4f8e1d7ac8f90db0e05"
+        "sha256": "abea068557211791925c6a046c71d49fa67753ec46c8f982f8f4351feb539970"
       },
       {
         "path": "src/qe-rounds.ts",
@@ -3157,7 +3217,7 @@
       },
       {
         "path": "src/release.ts",
-        "sha256": "aa9168da8584d311a2cdef736c2352180e6a52752a4d9859ad535d825cd502ad"
+        "sha256": "b7e248afaadc503642ef3b22eb86817e8ecb12744493c1780065de87772483a4"
       },
       {
         "path": "src/repo-boundary.ts",
@@ -3221,7 +3281,7 @@
       },
       {
         "path": "src/setup.ts",
-        "sha256": "d38887d6192184e02db4e3dc3932a88f09379c59fab92a146f7af17d80b11fdc"
+        "sha256": "795f796ad5093244807d5fd0c80478c89e28e3e3ef26540e8f636eb24d517038"
       },
       {
         "path": "src/shell-veto-policy.ts",
@@ -3365,5 +3425,5 @@
       }
     ]
   },
-  "signature": "b0SnCTZY4sjpSNs5NwbXiO6OXSRociRD8epVNuSt4mXEhGloftlse3aghvUoR4E1SjcxSB0aUzdIYkTec8H6BQ=="
+  "signature": "9lkZG7XpDHs9qtNmKiBJYt3PMKTOAhxXxEU3F4n2uOYQps/u6lY0vb50bdKsxMoZem8/R2qORHxYCU4kN+iYAQ=="
 }

package/README.md

@@ -244,6 +244,10 @@ into this core input. Empty or omitted values are still absent from state, prese
 compatibility path.
 | `operations` | `runInit`, `runSync`, `runVerify`, `runDoctor` | The harness operations, returning structured reports. `InitReport` and `SyncReport` carry an additive, always-present `failures: readonly SkillLoadFailure[]` (empty when nothing failed): a single unloadable `SKILL.md` used to throw out of the whole loop, so `dz init`/`dz install`/`dz sync` reported NOTHING at all. They now skip, collect and name — skipping without a record would only trade a loud failure for a silent one. `runDoctor` is deliberately untouched: it was never a throw site, and a negative test asserts it gained no `failures` field |
 | `release` | `collectPackageFacts`, `selectAffectedPackages`, `planReleaseGates`, `classifyGateExecutions`, `buildFailureIssue`, `firstOutputLine` | Pure verified-release engine behind `dz release`: plans 4 HARD gates (tests / `pnpm audit --prod` / `node --check` / bin smoke-boot) as DATA and classifies injected results fail-closed — an unbuilt package (declared `build` script, no dist JS) is a `MISSING_DIST` failure, a template-only pack is a named `SKIP_NO_ARTIFACTS` skip, `selectAffectedPackages` fail-opens to the full set when the changed-file list is unavailable |
+| `publish-sibling-drift` | `detectSiblingDrift`, `normalizedPackageJsonText` | Pure sibling-drift detector behind the `dz publish` gate: for every `workspace:*` sibling, the registry tarball's dist/files/bin and the SHIPPING fields of package.json (name/type/main/module/types/exports/bin/files/engines/os/cpu + dependency names) are hashed against the workspace; any difference is a named violation that blocks the batch unless the sibling joins it (`--include-drifted`). |
+| `packed-install-smoke` | `planPackedInstallSmoke`, `judgePackedInstallSmoke`, `packedTarballName` | Pure plan/judge halves of the post-bump smoke: pack each package that declares a `bin` (workspace specs rewritten to exact sibling versions), install the tarballs into a clean directory under `/var/tmp` (npm no-ops `file:` tarballs under `/tmp`), run `<bin> --version`; exit 0 with non-empty stdout is the only PASS. |
+| `setup` (memory backend) | `resolveSetupMemoryBackend`, `memoryBackendSourceLabel` | `dz setup` backend resolution flag > `.dz/config.json` > default, with the source named (`flag`/`config`/`default`/`default-unreadable`/`disabled`); a downgrade rewrites only `memory.backend`. |
+| `embed-socket-path` | `resolveEmbedSocketPath`, `embedSocketPointerPath`, `readEmbedSocketPointer`, `resolveEffectiveEmbedSocketPath`, `EMBED_SOCKET_PATH_BYTES_LIMIT` | Unix-socket path resolver shared by the embed daemon, the recall hook and `dz doctor`: env override > project `.dz/embed.sock` when ≤ 100 bytes > `<tmpdir>/dz-<uid>/embed-<sha1[12]>.sock` (`tooLong` when even that overflows); the pointer file `.dz/embed.sock.path` is trusted only while its target exists. |
 | `parity` | `TARGET_CAPABILITIES`, `PARITY_FEATURES`, `computeParity`, `buildParityMatrix` | Declarative target-parity model behind `dz parity`: verified capability flags per target × feature FORMS with requirements; the feature×target matrix is always COMPUTED (never hand-written), and the model must classify exactly `TARGET_NAMES` — an unclassified new target refuses to compile |
 | `delivery-check` | `PLANE_SPECS`, `collectDeliveryFacts`, `planDeliveryCheck`, `renderDeliveryBrief`, `classifyDelivery`, `renderDeliveryReview` | Pure portable Step-10 Delivery Gate engine behind `dz delivery-check`: the four review planes as shared DATA (prose-identical to the workflow's inline `planePrompts`, held by a drift-guard test), a deterministic plan/classify over injected facts+findings, and the FAIL-CLOSED hand-off verdict — `ready` only off complete, cross-validated, clean evidence; classification reads only numeric severity counts so injected instruction-like text cannot move the verdict. No `child_process`; the only fs is `existsSync` in `collectDeliveryFacts` |
 | `skills-verify` | `scanSkillsLayout`, `parseInitFacts`, `verifyRegistration`, `registrationExitCode`, `renderRegistrationReport` | Pure registration-gate engine behind `dz skills-verify`: a static scan of `.claude/skills/` (which dirs CAN register + the shapes that never can) and a **sealed** verdict over one atomic evidence bundle (`RegistrationEvidence` = the whole scan + a tagged probe result + a provenance record). Cardinality and parse integrity are derived INSIDE from the raw `system/init` stream, so no caller can omit or falsify them. FAIL-CLOSED: an unobservable registration is `inconclusive`, never `pass`; a plugin-shaped container is advisory and its fate is decided by whether the session says that plugin LOADED, never by the layout. Also exports `findNonRegistrableSkillDirs` — the publish-time guard fact behind the `skills-registrable` rule (a pack counts only if it already has one registrable skill; a dir is flagged only when a `SKILL.md` exists inside but below depth 1 — the discriminator was chosen after MEASURING the real packs, since a naive rule flagged ~40 healthy dirs across 9 npx toolkits). Plugin containers are attributed by `init.plugins[].path`, never by directory name; a container whose plugin did not load FAILS, one that loaded PASSES with an advisory that its individual skills are unverified (modelling Claude Code's command-name resolution produced a new wrong verdict in every review round — the gap is disclosed, not guessed). Sees SLASH COMMANDS too: `InitFacts.slash_commands` carries the session's command listing (MEASURED on Claude Code 2.1.233 — `system/init` emits `slash_commands`, and a plugin command registers as `<plugin>:<file basename>`, not as its frontmatter name), `RegistrationEvidence.expectedCommands` names what must appear, and an ABSENT `slash_commands` key is `inconclusive` exactly like an absent `skills` key — never an empty list, because schema drift and "the commands did not load" are different facts. `declaredPluginSurface(dir)` derives the expected names from a plugin's own manifest so a gate run cannot drift from the manifest it checks, and returns `null` (never an empty, vacuously-passing expectation) for an unreadable one. Also ships the ADVISORY content layer (`buildContentProbePrompt` / `classifyContentProbe`): registration is not usability, so an extra model turn asks for a VERBATIM quote as evidence — advisory by construction, it never gates. No `child_process` — the CLI owns the probe |
@@ -574,6 +578,32 @@ generator (with the hub's own `coreDistDir`, via `harnessCoreDistDir()`) — a t
 (`test/apply-leg-twins.test.ts`) keeps the two byte-identical, the same discipline `feature-adr`'s
 workflow twins test applies to its own generated scripts.
 
+### Short socket path for deeply nested projects (`embed-socket-path.ts`)
+
+A unix domain socket path is capped by the platform's `sun_path` buffer — 108 bytes on Linux, 104 on
+macOS, NUL included — measured in BYTES (`Buffer.byteLength`, not `.length`: a multi-byte path
+component costs more bytes than characters). Past that limit the embed daemon's `.dz/embed.sock`
+bind used to fail while everything ELSE about the daemon looked healthy — the daemon logged "ready",
+and the recall hook and `dz doctor` both independently recomputed the SAME too-long path and reported
+it absent, three consumers agreeing on a wrong answer for three unrelated reasons.
+
+`resolveEmbedSocketPath(projectRoot, env?)` is the ONE resolver all three now share: `DZ_EMBED_SOCKET`
+wins if set; otherwise `<projectRoot>/.dz/embed.sock` if its byte length is ≤100 (a safety margin
+under both platform limits); otherwise a short, deterministic path under `os.tmpdir()` keyed by a
+12-hex-char SHA-1 of `projectRoot` (`{reason: 'tmpdir-short'}`). When the daemon binds on the
+tmpdir-short branch it writes `<projectRoot>/.dz/embed.sock.path` — a pointer to the path it actually
+bound — so a reader whose `os.tmpdir()` might differ (a different `TMPDIR`) still finds it via
+`resolveEffectiveEmbedSocketPath`, which prefers the pointer ONLY on that branch (the `env`/`project`
+branches don't depend on `os.tmpdir()`, so there is nothing for a pointer to protect against there).
+The daemon and the recall hook — both standalone generated files that cannot `import` a compiled
+module — carry this logic inlined as TEXT, kept in lockstep with the exported function by
+`test/apply-leg-twins.test.ts`; `dz doctor`'s liveness check is a real `import` and now names the
+ACTUAL resolved path (`embed socket present at <path> (tmpdir-short: project path N bytes > 100)`)
+instead of only ever checking the plain project path. The daemon also now prints `ready` ONLY after
+`existsSync(SOCKET)` confirms the bind landed post-`listen()` — a bind failure logs `bind failed: …
+(path N bytes)` and exits non-zero, never a silent "ready" for a socket that was never created
+(`APPLY_LEG_VERSION` bumped 3→4 for this and the resolver change).
+
 ## Run a plan without the Claude host
 
 `runWorkflow` (`workflow-run.ts`) is the PURE scheduler behind `dz workflow run`: it INTERPRETS a

package/dist/apply-leg.d.ts

@@ -36,8 +36,15 @@
  * `recallHookSource`'s `loadCoreModule` candidate list is now built with a conditional spread so a
  * `null` `coreDistDir` (the hub's own portable marker, C-6/finding-6) degrades cleanly to the
  * project-relative fallbacks — the generated BYTES changed for every caller, hub and consumer alike.
+ *
+ * Bumped 3→4 (feature `embed-socket-short-path`): both generated files now resolve the socket path
+ * through the same `DZ_EMBED_SOCKET` → project-path-if-short → tmpdir-short-hash logic as
+ * {@link resolveEmbedSocketPath} (inlined as TEXT in both — a template string cannot `import` a
+ * compiled module), the daemon writes a `.dz/embed.sock.path` pointer when it picks the tmpdir-short
+ * branch, and `ready` is now printed only after `existsSync(SOCKET)` confirms the bind actually
+ * landed (previously logged unconditionally, before `listen` even ran).
  */
-export declare const APPLY_LEG_VERSION = 3;
+export declare const APPLY_LEG_VERSION = 4;
 /**
  * Parse the `dz-apply-leg-version` stamp from a deployed helper file. Unlike
  * `writerVersionOf` (which floors an absent stamp at `0`), this returns `-1` for "no stamp at
@@ -76,6 +83,11 @@ export declare function bakedCoreDistDirOf(content: string): string | null | und
  * Behaviourally identical to the pre-existing hand-committed hub file except for: the version
  * stamp (new, line 2) and the candidate list in `loadCoreModule` (baked path first when present,
  * `/usr/lib/...` dropped — FR-3).
+ *
+ * Also carries the `embed-socket-short-path` fix (FR-1/FR-2): `SOCKET` is resolved through the
+ * same env → project-path-if-short → tmpdir-short-hash logic as
+ * {@link "./embed-socket-path.js".resolveEmbedSocketPath}, inlined as text and preferring an
+ * on-disk pointer when the resolver itself would land on the tmpdir-short branch.
  */
 export declare function recallHookSource(coreDistDir: string | null): string;
 /** `setTimeout`'s delay argument is a 32-bit signed int in Node — see {@link resolveIdleMs}. */

package/dist/apply-leg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-leg.d.ts","sourceRoot":"","sources":["../src/apply-leg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAW7E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA8YnE;AAED,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,aAAgB,CAAC;AAE/C,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAIzD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAwS1C;AAED,0HAA0H;AAC1H,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAA;CAAE,CAehI;AAED,sDAAsD;AACtD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,0BAA0B,GAAG,iBAAiB,GAAG,eAAe,GAAG,eAAe,GAAG,YAAY,CAAC;AAE9G,8HAA8H;AAC9H,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC1C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;KAC5C,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QAChD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;KAC7C,CAAC;IACF,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;CACnD;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAG/E;AAmBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAyD3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAYpE"}
+{"version":3,"file":"apply-leg.d.ts","sourceRoot":"","sources":["../src/apply-leg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAW7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAibnE;AAED,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,aAAgB,CAAC;AAE/C,mGAAmG;AACnG,MAAM,WAAW,cAAc;IAC7B,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wFAAwF;IACxF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAIzD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CA0W1C;AAED,0HAA0H;AAC1H,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAA;CAAE,CAehI;AAED,sDAAsD;AACtD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,uGAAuG;IACvG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,0BAA0B,GAAG,iBAAiB,GAAG,eAAe,GAAG,eAAe,GAAG,YAAY,CAAC;AAE9G,8HAA8H;AAC9H,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;QAC1C,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;KAC5C,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;QAChD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;KAC7C,CAAC;IACF,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;CACnD;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAG/E;AAmBD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAyD3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAYpE"}

package/dist/apply-leg.js

@@ -39,8 +39,15 @@ import { hookCommandsOf } from './managed-hooks.js';
  * `recallHookSource`'s `loadCoreModule` candidate list is now built with a conditional spread so a
  * `null` `coreDistDir` (the hub's own portable marker, C-6/finding-6) degrades cleanly to the
  * project-relative fallbacks — the generated BYTES changed for every caller, hub and consumer alike.
+ *
+ * Bumped 3→4 (feature `embed-socket-short-path`): both generated files now resolve the socket path
+ * through the same `DZ_EMBED_SOCKET` → project-path-if-short → tmpdir-short-hash logic as
+ * {@link resolveEmbedSocketPath} (inlined as TEXT in both — a template string cannot `import` a
+ * compiled module), the daemon writes a `.dz/embed.sock.path` pointer when it picks the tmpdir-short
+ * branch, and `ready` is now printed only after `existsSync(SOCKET)` confirms the bind actually
+ * landed (previously logged unconditionally, before `listen` even ran).
  */
-export const APPLY_LEG_VERSION = 3;
+export const APPLY_LEG_VERSION = 4;
 /**
  * Parse the `dz-apply-leg-version` stamp from a deployed helper file. Unlike
  * `writerVersionOf` (which floors an absent stamp at `0`), this returns `-1` for "no stamp at
@@ -96,6 +103,11 @@ export function bakedCoreDistDirOf(content) {
  * Behaviourally identical to the pre-existing hand-committed hub file except for: the version
  * stamp (new, line 2) and the candidate list in `loadCoreModule` (baked path first when present,
  * `/usr/lib/...` dropped — FR-3).
+ *
+ * Also carries the `embed-socket-short-path` fix (FR-1/FR-2): `SOCKET` is resolved through the
+ * same env → project-path-if-short → tmpdir-short-hash logic as
+ * {@link "./embed-socket-path.js".resolveEmbedSocketPath}, inlined as text and preferring an
+ * on-disk pointer when the resolver itself would land on the tmpdir-short branch.
  */
 export function recallHookSource(coreDistDir) {
     return `#!/usr/bin/env node
@@ -121,11 +133,46 @@ export function recallHookSource(coreDistDir) {
 const net = require('node:net');
 const path = require('node:path');
 const fs = require('node:fs');
+const crypto = require('node:crypto');
+const os = require('node:os');
 const { pathToFileURL } = require('node:url');
 
 const PROJECT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const CORE_DIST_DIR = ${coreDistDir === null ? 'null' : JSON.stringify(coreDistDir)};
-const SOCKET = process.env.DZ_EMBED_SOCKET || path.join(PROJECT, '.dz', 'embed.sock');
+
+// embed-socket-short-path (FR-1/FR-2): byte-for-byte the same logic as \`resolveEmbedSocketPath\` /
+// \`resolveEffectiveEmbedSocketPath\` in \`embed-socket-path.ts\` — inlined as TEXT because this file
+// is standalone and cannot \`import\` a compiled core module (apply-leg-twins.test.ts pins the copies
+// to the same behavior as the daemon's own inlined copy).
+const EMBED_SOCKET_PATH_BYTES_LIMIT = 100;
+function resolveEmbedSocketPath(projectRoot, env) {
+  const fromEnv = env.DZ_EMBED_SOCKET;
+  if (typeof fromEnv === 'string' && fromEnv !== '') return { path: fromEnv, reason: 'env' };
+  const projectPath = path.join(projectRoot, '.dz', 'embed.sock');
+  if (Buffer.byteLength(projectPath, 'utf8') <= EMBED_SOCKET_PATH_BYTES_LIMIT) return { path: projectPath, reason: 'project' };
+  const hash = crypto.createHash('sha1').update(projectRoot).digest('hex').slice(0, 12);
+  const uid = String(process.getuid?.() ?? 'u');
+  const shortPath = path.join(os.tmpdir(), \`dz-\${uid}\`, \`embed-\${hash}.sock\`);
+  const tooLong = Buffer.byteLength(shortPath, 'utf8') > EMBED_SOCKET_PATH_BYTES_LIMIT;
+  return tooLong ? { path: shortPath, reason: 'tmpdir-short', tooLong: true } : { path: shortPath, reason: 'tmpdir-short' };
+}
+function readEmbedSocketPointer(projectRoot) {
+  const pointerPath = path.join(projectRoot, '.dz', 'embed.sock.path');
+  if (!fs.existsSync(pointerPath)) return undefined;
+  try {
+    const raw = fs.readFileSync(pointerPath, 'utf-8').trim();
+    return raw !== '' ? raw : undefined;
+  } catch {
+    return undefined;
+  }
+}
+function resolveEffectiveEmbedSocketPath(projectRoot, env) {
+  const resolved = resolveEmbedSocketPath(projectRoot, env);
+  if (resolved.reason !== 'tmpdir-short') return resolved;
+  const pointer = readEmbedSocketPointer(projectRoot);
+  return pointer !== undefined && fs.existsSync(pointer) ? { path: pointer, reason: 'tmpdir-short' } : resolved;
+}
+const SOCKET = resolveEffectiveEmbedSocketPath(PROJECT, process.env).path;
 const USAGE_LOG = process.env.DZ_RECALL_USAGE_LOG || path.join(PROJECT, '.dz', 'recall-usage.jsonl');
 const TIMEOUT_MS = Number(process.env.DZ_RECALL_HOOK_TIMEOUT_MS || 800);
 
@@ -555,10 +602,12 @@ export function embedDaemonSource() {
  */
 
 import { createServer } from 'node:net';
-import { existsSync, unlinkSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, unlinkSync, readFileSync, mkdirSync, writeFileSync, renameSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
 import { createRequire } from 'node:module';
 import { connect } from 'node:net';
+import { createHash } from 'node:crypto';
+import { tmpdir } from 'node:os';
 
 const log = (...a) => console.error('[dz-embed]', ...a);
 
@@ -566,7 +615,26 @@ const log = (...a) => console.error('[dz-embed]', ...a);
 console.log = (...a) => console.error(...a);
 
 const PROJECT = process.env['DZ_PROJECT_ROOT'] ?? process.cwd();
-const SOCKET = process.env['DZ_EMBED_SOCKET'] ?? join(PROJECT, '.dz', 'embed.sock');
+// embed-socket-short-path (FR-1): a unix socket path has a hard platform limit on \`sun_path\`
+// (Linux 108 bytes incl. NUL, macOS 104) — a deeply nested project's \`.dz/embed.sock\` can exceed
+// it, and \`listen()\` then fails while every OTHER part of the daemon looks healthy. This mirrors
+// {@link resolveEmbedSocketPath} in \`embed-socket-path.ts\` byte-for-byte (this file is generated
+// TEXT, standalone, and cannot \`import\` a compiled core module — apply-leg-twins.test.ts pins the
+// two copies to the same behavior).
+const EMBED_SOCKET_PATH_BYTES_LIMIT = 100;
+function resolveEmbedSocketPath(projectRoot, env) {
+  const fromEnv = env['DZ_EMBED_SOCKET'];
+  if (typeof fromEnv === 'string' && fromEnv !== '') return { path: fromEnv, reason: 'env' };
+  const projectPath = join(projectRoot, '.dz', 'embed.sock');
+  if (Buffer.byteLength(projectPath, 'utf8') <= EMBED_SOCKET_PATH_BYTES_LIMIT) return { path: projectPath, reason: 'project' };
+  const hash = createHash('sha1').update(projectRoot).digest('hex').slice(0, 12);
+  const uid = String(process.getuid?.() ?? 'u');
+  const shortPath = join(tmpdir(), \`dz-\${uid}\`, \`embed-\${hash}.sock\`);
+  const tooLong = Buffer.byteLength(shortPath, 'utf8') > EMBED_SOCKET_PATH_BYTES_LIMIT;
+  return tooLong ? { path: shortPath, reason: 'tmpdir-short', tooLong: true } : { path: shortPath, reason: 'tmpdir-short' };
+}
+const { path: SOCKET, reason: SOCKET_REASON, tooLong: SOCKET_TOO_LONG } = resolveEmbedSocketPath(PROJECT, process.env);
+const SOCKET_POINTER = join(PROJECT, '.dz', 'embed.sock.path');
 // AM-10 (issue #10 defect 7): a setTimeout delay is a 32-bit signed int in Node — anything
 // above 2_147_483_647 ms silently becomes ~1ms (a "30 days" idle setting exited in ~1 second,
 // MEASURED). 0/NaN/negative disables the idle exit outright rather than firing immediately.
@@ -723,7 +791,6 @@ async function main() {
 
   let patterns = loadPatterns();
   let patternsAt = Date.now();
-  log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET}\`);
 
   let idleTimer;
   let lastActivityAt = Date.now();
@@ -804,16 +871,62 @@ async function main() {
     } catch {
       /* ignore */
     }
+    try {
+      // Only OUR pointer is removed — one that already names another daemon's socket stays.
+      if (SOCKET_REASON === 'tmpdir-short' && existsSync(SOCKET_POINTER) && readFileSync(SOCKET_POINTER, 'utf-8').trim() === SOCKET) unlinkSync(SOCKET_POINTER);
+    } catch {
+      /* ignore */
+    }
     process.exit(code);
   }
 
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => shutdown(0));
 
-  server.listen(SOCKET, () => touch());
-  server.on('error', (err) => {
-    log('listen failed:', err?.message ?? err);
-    process.exit(0);
+  // FR-3 ("absence of a receipt is not success"): \`ready\` is printed ONLY after \`listen\`'s callback
+  // AND a fresh \`existsSync(SOCKET)\` both confirm the socket file is actually on disk — a caller
+  // that greps stderr for "ready" must never see it for a socket that silently failed to bind.
+  function bindFailed(detail) {
+    log(\`bind failed: \${detail} (path \${Buffer.byteLength(SOCKET, 'utf8')} bytes)\`);
+    process.exit(3);
+  }
+
+  // A fresh project's SOCKET directory (\`.dz/\`, or a caller-injected DZ_EMBED_SOCKET's own parent)
+  // may not exist yet — \`dz setup\` usually creates \`.dz/\` before this daemon ever runs, but a
+  // missing parent must not surface as an opaque platform EACCES/ENOENT when a plain mkdir fixes it.
+  if (SOCKET_TOO_LONG) bindFailed('even the tmpdir-short fallback exceeds the unix socket path limit — set DZ_EMBED_SOCKET to a short path');
+  try {
+    // Lead edit after Codex review (finding 2): the private per-user directory is created 0700 and
+    // verified — a socket in a world-writable tmpdir could be pre-bound or hijacked by a neighbour.
+    mkdirSync(dirname(SOCKET), { recursive: true, mode: 0o700 });
+    if (SOCKET_REASON === 'tmpdir-short') {
+      const st = statSync(dirname(SOCKET));
+      const ownUid = typeof process.getuid === 'function' ? process.getuid() : st.uid;
+      if (st.uid !== ownUid || (st.mode & 0o077) !== 0) bindFailed(\`socket directory \${dirname(SOCKET)} is not private (uid \${st.uid}, mode \${(st.mode & 0o777).toString(8)})\`);
+    }
+  } catch (err) {
+    if (SOCKET_REASON === 'tmpdir-short') bindFailed(\`cannot prepare socket directory: \${err?.message ?? err}\`);
+    /* project branch: listen() below reports the real reason if the directory truly cannot be created */
+  }
+
+  server.listen(SOCKET, () => {
+    if (!existsSync(SOCKET)) return bindFailed('socket file missing after listen');
+    if (SOCKET_REASON === 'tmpdir-short') {
+      // Lead edit after Codex review (finding 3): the pointer is published ATOMICALLY (tmp + rename)
+      // and BEFORE \`ready\` — a reader never sees a half-written or missing pointer after \`ready\`;
+      // a pointer that cannot be published is a bind failure, not a warning.
+      try {
+        mkdirSync(join(PROJECT, '.dz'), { recursive: true });
+        const tmp = \`\${SOCKET_POINTER}.\${process.pid}.tmp\`;
+        writeFileSync(tmp, SOCKET);
+        renameSync(tmp, SOCKET_POINTER);
+      } catch (err) {
+        return bindFailed(\`could not publish socket pointer: \${err?.message ?? err}\`);
+      }
+    }
+    log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET}\`);
+    touch();
   });
+  server.on('error', (err) => bindFailed(err?.message ?? String(err)));
 }
 
 main().catch((err) => {