@dzhechkov/harness-core 0.8.31 → 0.8.33

package/src/apply-leg.ts

@@ -41,8 +41,15 @@ import { hookCommandsOf } from './managed-hooks.js';
  * `recallHookSource`'s `loadCoreModule` candidate list is now built with a conditional spread so a
  * `null` `coreDistDir` (the hub's own portable marker, C-6/finding-6) degrades cleanly to the
  * project-relative fallbacks — the generated BYTES changed for every caller, hub and consumer alike.
+ *
+ * Bumped 3→4 (feature `embed-socket-short-path`): both generated files now resolve the socket path
+ * through the same `DZ_EMBED_SOCKET` → project-path-if-short → tmpdir-short-hash logic as
+ * {@link resolveEmbedSocketPath} (inlined as TEXT in both — a template string cannot `import` a
+ * compiled module), the daemon writes a `.dz/embed.sock.path` pointer when it picks the tmpdir-short
+ * branch, and `ready` is now printed only after `existsSync(SOCKET)` confirms the bind actually
+ * landed (previously logged unconditionally, before `listen` even ran).
  */
-export const APPLY_LEG_VERSION = 3;
+export const APPLY_LEG_VERSION = 4;
 
 /**
  * Parse the `dz-apply-leg-version` stamp from a deployed helper file. Unlike
@@ -98,6 +105,11 @@ export function bakedCoreDistDirOf(content: string): string | null | undefined {
  * Behaviourally identical to the pre-existing hand-committed hub file except for: the version
  * stamp (new, line 2) and the candidate list in `loadCoreModule` (baked path first when present,
  * `/usr/lib/...` dropped — FR-3).
+ *
+ * Also carries the `embed-socket-short-path` fix (FR-1/FR-2): `SOCKET` is resolved through the
+ * same env → project-path-if-short → tmpdir-short-hash logic as
+ * {@link "./embed-socket-path.js".resolveEmbedSocketPath}, inlined as text and preferring an
+ * on-disk pointer when the resolver itself would land on the tmpdir-short branch.
  */
 export function recallHookSource(coreDistDir: string | null): string {
   return `#!/usr/bin/env node
@@ -123,11 +135,46 @@ export function recallHookSource(coreDistDir: string | null): string {
 const net = require('node:net');
 const path = require('node:path');
 const fs = require('node:fs');
+const crypto = require('node:crypto');
+const os = require('node:os');
 const { pathToFileURL } = require('node:url');
 
 const PROJECT = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 const CORE_DIST_DIR = ${coreDistDir === null ? 'null' : JSON.stringify(coreDistDir)};
-const SOCKET = process.env.DZ_EMBED_SOCKET || path.join(PROJECT, '.dz', 'embed.sock');
+
+// embed-socket-short-path (FR-1/FR-2): byte-for-byte the same logic as \`resolveEmbedSocketPath\` /
+// \`resolveEffectiveEmbedSocketPath\` in \`embed-socket-path.ts\` — inlined as TEXT because this file
+// is standalone and cannot \`import\` a compiled core module (apply-leg-twins.test.ts pins the copies
+// to the same behavior as the daemon's own inlined copy).
+const EMBED_SOCKET_PATH_BYTES_LIMIT = 100;
+function resolveEmbedSocketPath(projectRoot, env) {
+  const fromEnv = env.DZ_EMBED_SOCKET;
+  if (typeof fromEnv === 'string' && fromEnv !== '') return { path: fromEnv, reason: 'env' };
+  const projectPath = path.join(projectRoot, '.dz', 'embed.sock');
+  if (Buffer.byteLength(projectPath, 'utf8') <= EMBED_SOCKET_PATH_BYTES_LIMIT) return { path: projectPath, reason: 'project' };
+  const hash = crypto.createHash('sha1').update(projectRoot).digest('hex').slice(0, 12);
+  const uid = String(process.getuid?.() ?? 'u');
+  const shortPath = path.join(os.tmpdir(), \`dz-\${uid}\`, \`embed-\${hash}.sock\`);
+  const tooLong = Buffer.byteLength(shortPath, 'utf8') > EMBED_SOCKET_PATH_BYTES_LIMIT;
+  return tooLong ? { path: shortPath, reason: 'tmpdir-short', tooLong: true } : { path: shortPath, reason: 'tmpdir-short' };
+}
+function readEmbedSocketPointer(projectRoot) {
+  const pointerPath = path.join(projectRoot, '.dz', 'embed.sock.path');
+  if (!fs.existsSync(pointerPath)) return undefined;
+  try {
+    const raw = fs.readFileSync(pointerPath, 'utf-8').trim();
+    return raw !== '' ? raw : undefined;
+  } catch {
+    return undefined;
+  }
+}
+function resolveEffectiveEmbedSocketPath(projectRoot, env) {
+  const resolved = resolveEmbedSocketPath(projectRoot, env);
+  if (resolved.reason !== 'tmpdir-short') return resolved;
+  const pointer = readEmbedSocketPointer(projectRoot);
+  return pointer !== undefined && fs.existsSync(pointer) ? { path: pointer, reason: 'tmpdir-short' } : resolved;
+}
+const SOCKET = resolveEffectiveEmbedSocketPath(PROJECT, process.env).path;
 const USAGE_LOG = process.env.DZ_RECALL_USAGE_LOG || path.join(PROJECT, '.dz', 'recall-usage.jsonl');
 const TIMEOUT_MS = Number(process.env.DZ_RECALL_HOOK_TIMEOUT_MS || 800);
 
@@ -566,10 +613,12 @@ export function embedDaemonSource(): string {
  */
 
 import { createServer } from 'node:net';
-import { existsSync, unlinkSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { existsSync, unlinkSync, readFileSync, mkdirSync, writeFileSync, renameSync, statSync } from 'node:fs';
+import { join, dirname } from 'node:path';
 import { createRequire } from 'node:module';
 import { connect } from 'node:net';
+import { createHash } from 'node:crypto';
+import { tmpdir } from 'node:os';
 
 const log = (...a) => console.error('[dz-embed]', ...a);
 
@@ -577,7 +626,26 @@ const log = (...a) => console.error('[dz-embed]', ...a);
 console.log = (...a) => console.error(...a);
 
 const PROJECT = process.env['DZ_PROJECT_ROOT'] ?? process.cwd();
-const SOCKET = process.env['DZ_EMBED_SOCKET'] ?? join(PROJECT, '.dz', 'embed.sock');
+// embed-socket-short-path (FR-1): a unix socket path has a hard platform limit on \`sun_path\`
+// (Linux 108 bytes incl. NUL, macOS 104) — a deeply nested project's \`.dz/embed.sock\` can exceed
+// it, and \`listen()\` then fails while every OTHER part of the daemon looks healthy. This mirrors
+// {@link resolveEmbedSocketPath} in \`embed-socket-path.ts\` byte-for-byte (this file is generated
+// TEXT, standalone, and cannot \`import\` a compiled core module — apply-leg-twins.test.ts pins the
+// two copies to the same behavior).
+const EMBED_SOCKET_PATH_BYTES_LIMIT = 100;
+function resolveEmbedSocketPath(projectRoot, env) {
+  const fromEnv = env['DZ_EMBED_SOCKET'];
+  if (typeof fromEnv === 'string' && fromEnv !== '') return { path: fromEnv, reason: 'env' };
+  const projectPath = join(projectRoot, '.dz', 'embed.sock');
+  if (Buffer.byteLength(projectPath, 'utf8') <= EMBED_SOCKET_PATH_BYTES_LIMIT) return { path: projectPath, reason: 'project' };
+  const hash = createHash('sha1').update(projectRoot).digest('hex').slice(0, 12);
+  const uid = String(process.getuid?.() ?? 'u');
+  const shortPath = join(tmpdir(), \`dz-\${uid}\`, \`embed-\${hash}.sock\`);
+  const tooLong = Buffer.byteLength(shortPath, 'utf8') > EMBED_SOCKET_PATH_BYTES_LIMIT;
+  return tooLong ? { path: shortPath, reason: 'tmpdir-short', tooLong: true } : { path: shortPath, reason: 'tmpdir-short' };
+}
+const { path: SOCKET, reason: SOCKET_REASON, tooLong: SOCKET_TOO_LONG } = resolveEmbedSocketPath(PROJECT, process.env);
+const SOCKET_POINTER = join(PROJECT, '.dz', 'embed.sock.path');
 // AM-10 (issue #10 defect 7): a setTimeout delay is a 32-bit signed int in Node — anything
 // above 2_147_483_647 ms silently becomes ~1ms (a "30 days" idle setting exited in ~1 second,
 // MEASURED). 0/NaN/negative disables the idle exit outright rather than firing immediately.
@@ -734,7 +802,6 @@ async function main() {
 
   let patterns = loadPatterns();
   let patternsAt = Date.now();
-  log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET}\`);
 
   let idleTimer;
   let lastActivityAt = Date.now();
@@ -815,16 +882,62 @@ async function main() {
     } catch {
       /* ignore */
     }
+    try {
+      // Only OUR pointer is removed — one that already names another daemon's socket stays.
+      if (SOCKET_REASON === 'tmpdir-short' && existsSync(SOCKET_POINTER) && readFileSync(SOCKET_POINTER, 'utf-8').trim() === SOCKET) unlinkSync(SOCKET_POINTER);
+    } catch {
+      /* ignore */
+    }
     process.exit(code);
   }
 
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => shutdown(0));
 
-  server.listen(SOCKET, () => touch());
-  server.on('error', (err) => {
-    log('listen failed:', err?.message ?? err);
-    process.exit(0);
+  // FR-3 ("absence of a receipt is not success"): \`ready\` is printed ONLY after \`listen\`'s callback
+  // AND a fresh \`existsSync(SOCKET)\` both confirm the socket file is actually on disk — a caller
+  // that greps stderr for "ready" must never see it for a socket that silently failed to bind.
+  function bindFailed(detail) {
+    log(\`bind failed: \${detail} (path \${Buffer.byteLength(SOCKET, 'utf8')} bytes)\`);
+    process.exit(3);
+  }
+
+  // A fresh project's SOCKET directory (\`.dz/\`, or a caller-injected DZ_EMBED_SOCKET's own parent)
+  // may not exist yet — \`dz setup\` usually creates \`.dz/\` before this daemon ever runs, but a
+  // missing parent must not surface as an opaque platform EACCES/ENOENT when a plain mkdir fixes it.
+  if (SOCKET_TOO_LONG) bindFailed('even the tmpdir-short fallback exceeds the unix socket path limit — set DZ_EMBED_SOCKET to a short path');
+  try {
+    // Lead edit after Codex review (finding 2): the private per-user directory is created 0700 and
+    // verified — a socket in a world-writable tmpdir could be pre-bound or hijacked by a neighbour.
+    mkdirSync(dirname(SOCKET), { recursive: true, mode: 0o700 });
+    if (SOCKET_REASON === 'tmpdir-short') {
+      const st = statSync(dirname(SOCKET));
+      const ownUid = typeof process.getuid === 'function' ? process.getuid() : st.uid;
+      if (st.uid !== ownUid || (st.mode & 0o077) !== 0) bindFailed(\`socket directory \${dirname(SOCKET)} is not private (uid \${st.uid}, mode \${(st.mode & 0o777).toString(8)})\`);
+    }
+  } catch (err) {
+    if (SOCKET_REASON === 'tmpdir-short') bindFailed(\`cannot prepare socket directory: \${err?.message ?? err}\`);
+    /* project branch: listen() below reports the real reason if the directory truly cannot be created */
+  }
+
+  server.listen(SOCKET, () => {
+    if (!existsSync(SOCKET)) return bindFailed('socket file missing after listen');
+    if (SOCKET_REASON === 'tmpdir-short') {
+      // Lead edit after Codex review (finding 3): the pointer is published ATOMICALLY (tmp + rename)
+      // and BEFORE \`ready\` — a reader never sees a half-written or missing pointer after \`ready\`;
+      // a pointer that cannot be published is a bind failure, not a warning.
+      try {
+        mkdirSync(join(PROJECT, '.dz'), { recursive: true });
+        const tmp = \`\${SOCKET_POINTER}.\${process.pid}.tmp\`;
+        writeFileSync(tmp, SOCKET);
+        renameSync(tmp, SOCKET_POINTER);
+      } catch (err) {
+        return bindFailed(\`could not publish socket pointer: \${err?.message ?? err}\`);
+      }
+    }
+    log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET}\`);
+    touch();
   });
+  server.on('error', (err) => bindFailed(err?.message ?? String(err)));
 }
 
 main().catch((err) => {

package/src/embed-socket-path.ts

@@ -0,0 +1,113 @@
+/**
+ * embed-socket-short-path (feature, ADR-001 D4-A follow-on to `setup-installs-apply-leg`).
+ *
+ * The APPLY-leg daemon binds a unix domain socket at `<projectRoot>/.dz/embed.sock`. Unix sockets
+ * carry a hard platform limit on `sun_path` — 108 bytes on Linux, 104 on macOS, NUL included — and
+ * `Buffer.byteLength`, not `.length`, is the right measure (a multi-byte path component under a
+ * deep, non-ASCII-free checkout costs more bytes than characters). Past that limit `listen()` fails
+ * while everything else about the daemon (deps resolved, model loaded, patterns read) looks fine —
+ * so a deeply nested project got a daemon that logged "ready" and a hook/doctor that both reported
+ * ABSENT, three consumers agreeing on a wrong answer for three different reasons.
+ *
+ * This module is the ONE resolver all three consumers use:
+ *   - the generated daemon ({@link "./apply-leg.js".embedDaemonSource}) — as inlined TEXT, since a
+ *     template string cannot `import` a compiled module (apply-leg-twins.test.ts pins the copies);
+ *   - the generated recall hook ({@link "./apply-leg.js".recallHookSource}) — same inlining;
+ *   - `dz doctor` (`operations.ts`) — a real `import`, since doctor runs compiled code.
+ *
+ * A safety margin (100, not 108/104) is deliberate: it leaves room for the NUL terminator and for
+ * platform differences without needing to fork the threshold per-OS.
+ *
+ * @packageDocumentation
+ */
+
+import { existsSync, readFileSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+/**
+ * Byte-length ceiling this module resolves under, measured via `Buffer.byteLength`. Chosen as a
+ * safety margin below the tightest real platform limit (macOS `sun_path` = 104 bytes incl. NUL;
+ * Linux = 108) rather than as a per-OS fork — a 100-byte project path always fits both.
+ */
+export const EMBED_SOCKET_PATH_BYTES_LIMIT = 100;
+
+/** Why {@link resolveEmbedSocketPath} picked the path it returned. */
+export type EmbedSocketPathReason = 'env' | 'project' | 'tmpdir-short';
+
+/** The resolved socket path plus the reason, so callers can render an honest doctor/log message. */
+export interface ResolvedEmbedSocketPath {
+  readonly path: string;
+  readonly reason: EmbedSocketPathReason;
+  /** The computed fallback itself exceeds the byte limit — the daemon must refuse, not pretend. */
+  readonly tooLong?: boolean;
+}
+
+/**
+ * FR-1. `DZ_EMBED_SOCKET` (if set to a non-empty string) always wins — an explicit override is
+ * never second-guessed. Otherwise: the natural `<projectRoot>/.dz/embed.sock` path if its BYTE
+ * length is within {@link EMBED_SOCKET_PATH_BYTES_LIMIT}; otherwise a short, deterministic path
+ * under `os.tmpdir()` keyed by a 12-hex-char SHA-1 of `projectRoot` — deterministic so a second
+ * process resolving the SAME project (with the SAME `os.tmpdir()`) independently arrives at the
+ * SAME path without needing to read a pointer file first.
+ */
+export function resolveEmbedSocketPath(projectRoot: string, env: NodeJS.ProcessEnv = process.env): ResolvedEmbedSocketPath {
+  const fromEnv = env.DZ_EMBED_SOCKET;
+  if (typeof fromEnv === 'string' && fromEnv !== '') {
+    return { path: fromEnv, reason: 'env' };
+  }
+  const projectPath = join(projectRoot, '.dz', 'embed.sock');
+  if (Buffer.byteLength(projectPath, 'utf8') <= EMBED_SOCKET_PATH_BYTES_LIMIT) {
+    return { path: projectPath, reason: 'project' };
+  }
+  // Lead edit after Codex review (findings 2/4): the short socket lives in a PRIVATE per-user
+  // directory (mode 0700, created by the daemon), never directly in the world-writable tmpdir; and
+  // the fallback itself is measured — a long TMPDIR can still overflow sun_path, which is reported
+  // as `tooLong` for the daemon to refuse with an exact diagnosis instead of a phantom "ready".
+  const hash = createHash('sha1').update(projectRoot).digest('hex').slice(0, 12);
+  const uid = String(process.getuid?.() ?? 'u');
+  const shortPath = join(tmpdir(), `dz-${uid}`, `embed-${hash}.sock`);
+  const tooLong = Buffer.byteLength(shortPath, 'utf8') > EMBED_SOCKET_PATH_BYTES_LIMIT;
+  return tooLong ? { path: shortPath, reason: 'tmpdir-short', tooLong: true } : { path: shortPath, reason: 'tmpdir-short' };
+}
+
+/** FR-2. Where the daemon writes (and a reader looks for) the tmpdir-short pointer file. */
+export function embedSocketPointerPath(projectRoot: string): string {
+  return join(projectRoot, '.dz', 'embed.sock.path');
+}
+
+/**
+ * FR-2. Read back the pointer the daemon wrote when it picked the `tmpdir-short` branch. Returns
+ * `undefined` on anything short of a non-empty file — absent, unreadable, or blank — never throws:
+ * this is a hint a reader may trust, not a contract it depends on.
+ */
+export function readEmbedSocketPointer(projectRoot: string): string | undefined {
+  const pointerPath = embedSocketPointerPath(projectRoot);
+  if (!existsSync(pointerPath)) return undefined;
+  try {
+    const raw = readFileSync(pointerPath, 'utf-8').trim();
+    return raw !== '' ? raw : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * FR-2/FR-5. The read-side combinator the hook and doctor both use: resolve as usual, and — ONLY
+ * when the resolver itself would have picked the `tmpdir-short` branch — prefer an on-disk pointer
+ * if one exists. This is deliberately narrower than "always prefer the pointer": the `env` and
+ * `project` branches are computed the same way in every process (no `os.tmpdir()` dependency), so
+ * there is nothing for a pointer to protect against there. `tmpdir-short` DOES depend on
+ * `os.tmpdir()`, which can differ between the daemon's process and a reader's (a different
+ * `TMPDIR`) — the pointer is the daemon's own record of the path it actually bound, and wins.
+ */
+export function resolveEffectiveEmbedSocketPath(projectRoot: string, env: NodeJS.ProcessEnv = process.env): ResolvedEmbedSocketPath {
+  const resolved = resolveEmbedSocketPath(projectRoot, env);
+  if (resolved.reason !== 'tmpdir-short') return resolved;
+  // Lead edit after Codex review (finding 1): a pointer is trusted only while its target exists —
+  // a stale pointer (daemon gone, TMPDIR changed) falls back to the computed path instead of
+  // steering the hook/doctor at a dead or foreign socket.
+  const pointer = readEmbedSocketPointer(projectRoot);
+  return pointer !== undefined && existsSync(pointer) ? { path: pointer, reason: 'tmpdir-short' } : resolved;
+}

package/src/index.ts

@@ -232,7 +232,9 @@ export type {
   TeachGuardResult,
 } from './vector-tier.js';
 export { runSetup, generateHooksConfig, generateAgentdbWriter, writerVersionOf, AGENTDB_WRITER_VERSION,
-  agentdbStorePath, agentdbMcpStorePath, agentdbStoreSeparationProblem } from './setup.js';
+  agentdbStorePath, agentdbMcpStorePath, agentdbStoreSeparationProblem,
+  resolveSetupMemoryBackend, memoryBackendSourceLabel } from './setup.js';
+export type { MemoryBackend, MemoryBackendSource, ResolvedSetupMemoryBackend } from './setup.js';
 // apply-leg (feature setup-installs-apply-leg, ADR-001): the third self-learning leg (APPLY) as a
 // versioned generator + the ONE measurement dz doctor/parity both read (Decision 3).
 export {
@@ -255,6 +257,16 @@ export type {
   ApplyLegNotInstalledReason,
   ResolvedIdleMs,
 } from './apply-leg.js';
+// embed-socket-short-path: the ONE resolver the daemon (inlined text), the recall hook (inlined
+// text), and dz doctor (real import) all use for the unix-socket sun_path length limit.
+export {
+  EMBED_SOCKET_PATH_BYTES_LIMIT,
+  resolveEmbedSocketPath,
+  embedSocketPointerPath,
+  readEmbedSocketPointer,
+  resolveEffectiveEmbedSocketPath,
+} from './embed-socket-path.js';
+export type { EmbedSocketPathReason, ResolvedEmbedSocketPath } from './embed-socket-path.js';
 export { countLearningStoreRowsReadonly, quarantineTierParity } from './store-counts.js';
 export type { QuarantineTierRow, QuarantineTierParity } from './store-counts.js';
 export type { LearningStoreRowCounts } from './store-counts.js';
@@ -717,7 +729,7 @@ export { fetchAllDownloads } from './downloads.js';
 export type { PackageDownloads, DownloadsReport } from './downloads.js';
 export { discoverInstalled, checkUpgrades } from './upgrade.js';
 export type { InstalledSkill, UpgradeCheck, UpgradeReport } from './upgrade.js';
-export type { PublishResult, PublishReport, ProvenanceMode, ProvenanceDecision } from './publish.js';
+export type { PublishResult, PublishReport, ProvenanceMode, ProvenanceDecision, PackedTarballArtifact, PackedTransportSmokeVerdict } from './publish.js';
 // Verified-release engine (feature release-verified, ADR-001) — pure VERIFY-phase planner +
 // classifier in front of the untouched publish path. formatPublishError is re-exported for the
 // CLI executor's captured-output discipline.
@@ -750,6 +762,27 @@ export type {
   FailureIssueContext,
 } from './release.js';
 export { formatPublishError } from './publish.js';
+// Sibling-drift + packed-install-smoke gates (feature publish-sibling-drift-gate, ADR-001).
+export { detectSiblingDrift } from './publish-sibling-drift.js';
+export type {
+  SiblingDriftStatus,
+  SiblingDriftResult,
+  FetchedPublished,
+  FetchPublished,
+  DetectSiblingDriftOptions,
+} from './publish-sibling-drift.js';
+export { planPackedInstallSmoke, judgePackedInstallSmoke, packedTarballName } from './packed-install-smoke.js';
+export type {
+  PackedInstallStepKind,
+  PackedInstallStep,
+  PackedInstallPackageSpec,
+  PackedInstallBinSpec,
+  PlanPackedInstallSmokeOptions,
+  PackedInstallPlan,
+  PackedInstallExecution,
+  PackedInstallBinVerdict,
+  PackedInstallVerdict,
+} from './packed-install-smoke.js';
 export { computeRiskScore } from './risk-scoring.js';
 export type { RiskScore, RiskThresholds } from './risk-scoring.js';
 export {

package/src/operations.ts

@@ -1412,6 +1412,60 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
     // never ran `dz setup` gets no apply-leg opinion, same as every other doctor check here.
   } catch { /* doctor never throws on a diagnostic */ }
 
+  // MEMORY HOOKS MATCH CONFIG (feature `setup-backend-from-config`, FR-4). "Absence of a receipt
+  // is not success": a repeat `dz setup --target claude-code` (no `--memory`) used to silently drop
+  // `.dz/agentdb-writer.mjs` from SessionStart on an agentdb project without `doctor` ever noticing
+  // (AC-1, red-first) — `.dz/config.json`'s `memory.backend` and the ACTUAL SessionStart/
+  // SessionEnd/PreCompact hooks in `.claude/settings.json` are two independent truths, and this
+  // check compares them by fact rather than trusting either source alone.
+  try {
+    let configuredMemoryBackend: 'agentdb' | 'jsonl' | 'unknown' = 'unknown';
+    try {
+      const cfg = JSON.parse(readFileSync(join(root, '.dz', 'config.json'), 'utf-8')) as { memory?: { backend?: string } };
+      if (cfg.memory?.backend === 'agentdb') configuredMemoryBackend = 'agentdb';
+      else if (cfg.memory?.backend === 'jsonl') configuredMemoryBackend = 'jsonl';
+    } catch { /* no .dz/config.json yet — nothing to compare */ }
+
+    if (configuredMemoryBackend !== 'unknown') {
+      const { commandsOf } = await import('./setup.js');
+      // Lead edit after Codex review (findings 1/4): agentdb is "wired" only when EVERY session event
+      // invokes the writer (a writer on SessionStart alone loses the end-of-session row), and the writer
+      // is recognized by its PATH TOKEN, not a substring — `old-agentdb-writer.mjs` or the name inside an
+      // echo must not count.
+      const invokesWriter = (cmd: string): boolean =>
+        cmd.split(/\s+/).some((tok) => /^(?:\.\/)?(?:.*\/)?\.dz\/agentdb-writer\.mjs$/.test(tok.replace(/^["']|["']$/g, '')));
+      const WRITER_EVENTS = ['SessionStart', 'SessionEnd', 'PreCompact'];
+      let eventsWithWriter: string[] = [];
+      let settingsReadable = false;
+      try {
+        const settings = JSON.parse(readFileSync(join(root, '.claude', 'settings.json'), 'utf-8')) as {
+          hooks?: Record<string, unknown[]>;
+        };
+        settingsReadable = true;
+        eventsWithWriter = WRITER_EVENTS.filter((ev) => (settings.hooks?.[ev] ?? []).some((h) => commandsOf(h).some(invokesWriter)));
+      } catch {
+      }
+      const allWired = eventsWithWriter.length === WRITER_EVENTS.length;
+      const hooksInvokeAgentdbWriter = eventsWithWriter.length > 0;
+
+      if (configuredMemoryBackend === 'agentdb' && !allWired) {
+        checks.push({
+          name: 'memory hooks match config',
+          ok: false,
+          detail: `.dz/config.json says memory.backend=agentdb but ${WRITER_EVENTS.filter((ev) => !eventsWithWriter.includes(ev)).join('/')} hook(s) do not invoke .dz/agentdb-writer.mjs${settingsReadable ? '' : ' (.claude/settings.json unreadable or absent)'} — run: dz setup --target claude-code --memory agentdb`,
+        });
+      } else if (configuredMemoryBackend === 'jsonl' && hooksInvokeAgentdbWriter) {
+        checks.push({
+          name: 'memory hooks match config',
+          ok: false,
+          detail: '.dz/config.json says memory.backend=jsonl but SessionStart/SessionEnd/PreCompact hooks still invoke agentdb-writer.mjs — run: dz setup --target claude-code --memory jsonl (or --memory agentdb to keep agentdb and bring the config back in sync)',
+        });
+      }
+    }
+    // configuredMemoryBackend === 'unknown': no .dz/config.json yet — nothing to compare, same
+    // silence as every other doctor check that needs it.
+  } catch { /* doctor never throws on a diagnostic */ }
+
   const writerPath = join(root, '.dz', 'agentdb-writer.mjs');
   if (existsSync(writerPath)) {
     const { writerVersionOf, AGENTDB_WRITER_VERSION } = await import('./setup.js');
@@ -1433,13 +1487,23 @@ export async function runDoctor(options: { projectRoot: string }): Promise<Docto
         const settingsText = readFileSync(settingsPath, 'utf-8');
         const applyLegWired = settingsText.includes('recall-hook.cjs') && settingsText.includes('dz-embed-daemon.mjs');
         if (applyLegWired) {
-          const sockAlive = existsSync(join(root, '.dz', 'embed.sock'));
+          // embed-socket-short-path (FR-5): name the ACTUAL path the resolver picked — a deeply
+          // nested project's daemon binds a short tmpdir path, not `<root>/.dz/embed.sock`, and a
+          // doctor that only ever checks the latter reports ABSENT for a daemon that is alive.
+          const { resolveEffectiveEmbedSocketPath, EMBED_SOCKET_PATH_BYTES_LIMIT } = await import('./embed-socket-path.js');
+          const resolved = resolveEffectiveEmbedSocketPath(root);
+          const sockAlive = existsSync(resolved.path);
+          const projectPathBytes = Buffer.byteLength(join(root, '.dz', 'embed.sock'), 'utf8');
+          const tmpdirNote =
+            resolved.reason === 'tmpdir-short'
+              ? ` (tmpdir-short: project path ${projectPathBytes} bytes > ${EMBED_SOCKET_PATH_BYTES_LIMIT})`
+              : '';
           checks.push({
             name: 'apply-leg alive (embed daemon)',
             ok: sockAlive,
             detail: sockAlive
-              ? 'embed.sock present — recall injection can run'
-              : 'embed.sock ABSENT: the recall hook is wired but cannot inject (the hook self-heals on the next prompt; a persistent absence means the daemon cannot start)',
+              ? `embed socket present at ${resolved.path}${tmpdirNote} — recall injection can run`
+              : `embed socket ABSENT at ${resolved.path}: the recall hook is wired but cannot inject (the hook self-heals on the next prompt; a persistent absence means the daemon cannot start)`,
           });
         }
       }