@dzhechkov/harness-core 0.8.35 → 0.8.37

package/src/apply-leg.ts

@@ -33,7 +33,7 @@ import { connect as netConnect } from 'node:net';
 // (core-boundary.test.ts's ratchet only counts fs/child_process/https). `probeApplyLeg`'s temp probe
 // cwd reuses the existing top-level 'node:fs' import above (mkdtempSync/rmSync added to that SAME
 // import statement, not a new one) so the ratchet stays at its pinned files:63 imports:69.
-import { tmpdir } from 'node:os';
+import { tmpdir, uptime } from 'node:os';
 import { join, resolve } from 'node:path';
 import { hookCommandsOf } from './managed-hooks.js';
 import { patternRecordId, recordPattern, removePatternsByIds, loadStorePatternsSync, type PatternRecord, type RemovePatternsResult } from './patterns.js';
@@ -190,8 +190,26 @@ export function probeRecallEngine(socketPath: string, timeoutMs = 1000): Promise
  * the cosine-fallback `scored` array are filtered to exclude `domain === 'apply-leg-probe'` unless
  * the request carried `probe: true` — a probe's own beacon still needs to reach ITS query, only a
  * REAL prompt must never see it.
+ *
+ * Bumped 10→11 (feature `embed-daemon-memory`, ADR-001 D1): the daemon now tries core's OWN cached
+ * embedder (`resolveAgentdbEmbedder`) first — one pipeline per process — building a private one only
+ * when core cannot hand one over; `ready` gained the ` embedder=<core-shared|own-fallback>` suffix
+ * (see `features/embed-daemon-memory/07_code_changes/change_manifest.md` for the full T3 note; this
+ * paragraph was missing from the bump history and is added here for the record, fix round 1).
+ *
+ * Bumped 11→12 (`embed-daemon-memory`, fix round 1 — F1/F2, Codex #1b/#3): (a) F1 — the own-fallback
+ * pipeline now reads the STORE's own dtype manifest before building (absent = fp32 legacy, a
+ * present-but-unrecognized value fails the request loudly instead of silently building fp32 against
+ * a q8 store); `ready`'s own-fallback branch gains ` dtype=<fp32|q8|error>`. (b) F2 — a core-shared
+ * STARTUP init failure no longer falls back to building an own pipeline (which risked a second live
+ * embedder once a later hybrid call succeeded): `embedderSource` stays `'core-shared'` and `embed`
+ * re-resolves `core.resolveAgentdbEmbedder` per request instead; `ready` names a startup failure
+ * inline as `core-shared (init failed: <msg>, will retry per request)`; `warmUpHybridEngine()` is
+ * skipped entirely in own-fallback mode. (c) `answerRecall`'s `embed(prompt)` call is now wrapped so
+ * either failure mode degrades to the SAME honest `cosine-fallback` reply shape as every other
+ * failure, never a bare protocol `{error}`.
  */
-export const APPLY_LEG_VERSION = 10;
+export const APPLY_LEG_VERSION = 12;
 
 /**
  * Parse the `dz-apply-leg-version` stamp from a deployed helper file. Unlike
@@ -1027,6 +1045,18 @@ function socketAlive(path) {
   });
 }
 
+// ADR-001 (embed-daemon-memory, D1/T3): better-sqlite3 is resolved INDEPENDENTLY of the embedder now
+// — the cosine-fallback leg always needs it to read the mirror, regardless of whether the embedder
+// itself comes from core (embedder=core-shared) or this daemon's own pipeline (embedder=own-fallback).
+// Splitting it out of the old resolveDeps() lets the daemon start on core-shared alone when only
+// better-sqlite3 (not transformers) is locally resolvable.
+function resolveDatabase() {
+  const req = createRequire(join(PROJECT, 'package.json'));
+  return req('better-sqlite3');
+}
+
+// own-fallback ONLY (ADR-001 D1): resolves the transformers module for the daemon's OWN pipeline,
+// built only when core has no resolveAgentdbEmbedder to share (no core module, or it errored).
 function resolveDeps() {
   const req = createRequire(join(PROJECT, 'package.json'));
   // agentdb >= 3.0.0-alpha depends on '@huggingface/transformers' (the '@xenova/transformers'
@@ -1054,7 +1084,7 @@ function resolveDeps() {
   if (transformers === undefined) {
     throw new Error('neither @huggingface/transformers nor @xenova/transformers could be resolved (' + String((lastErr && lastErr.message) || lastErr) + ')');
   }
-  return { Database: req('better-sqlite3'), transformers };
+  return { transformers };
 }
 
 const cos = (a, b) => {
@@ -1119,17 +1149,151 @@ async function main() {
 
   const started = Date.now();
   const model = configuredModel();
-  let deps;
+
+  // better-sqlite3 is required regardless of which embedder answers a request (ADR-001, T3) — the
+  // cosine-fallback leg always reads the mirror through it.
+  let Database;
   try {
-    deps = resolveDeps();
+    Database = resolveDatabase();
   } catch (err) {
     log('deps unavailable — not starting:', err?.message ?? err);
     process.exit(0); // never a hard failure: the hook degrades to silence
   }
 
-  const { pipeline } = await import(deps.transformers);
-  const extractor = await pipeline('feature-extraction', model);
-  const embed = async (text) => Array.from((await extractor(text, { pooling: 'mean', normalize: true })).data);
+  // ADR-001 D1 (embed-daemon-memory): the daemon SHARES core's single per-process embedder and
+  // builds a private pipeline only when core cannot hand one over AT ALL — no core module, or a core
+  // build too old to export \`resolveAgentdbEmbedder\` (F2, fix round 1, Codex #3). A STARTUP init
+  // FAILURE (core exists, has the export, but the call itself errored — offline model cache, a
+  // corrupted manifest) is NEVER treated as "core unavailable": own-fallback must not be built in
+  // that case, because a LATER hybrid call could succeed and stand up a SECOND, independent pipeline
+  // in the same process — the exact "two live embedders" defect the review named. Instead
+  // \`embedderSource\` STAYS \`'core-shared'\` and \`embed\` re-resolves \`core.resolveAgentdbEmbedder\`
+  // on EVERY call: core's own per-process cache (agentdb-index.ts) makes a repeat call after SUCCESS
+  // effectively free, and evicts its own entry on failure — so a transient startup failure can heal
+  // on a later request without this daemon ever building an embedder of its own.
+  //
+  // The shared embedder is still PROBED EAGERLY, before \`ready\`, for the same reason the own
+  // pipeline always was: the cosine-fallback leg must answer inside the hook budget on the FIRST
+  // request too (parity AC-2: hybrid delayed by 3000 ms, reply < 2000 ms). MEASURED 2026-09-16
+  // (change_manifest.md, deviation B): a LAZY resolve put the cold pipeline init (2000-3600 ms) on
+  // the first fallback reply — 4/5 runs at 2063-2146 ms. The probe's OUTCOME only decides the
+  // \`ready\`-log wording now (F2) — it never gates \`embedderSource\` or builds an own-fallback
+  // pipeline. The starved-budget parity test that used to lean on a cold engine now injects
+  // DZ_EMBED_HYBRID_DELAY_MS itself, so its premise holds by construction, not by cold timing.
+  let embed;
+  let embedderSource;
+  let embedderReadyDetail = '';
+  let ownFallbackDtypeLabel;
+  const startupCore = await loadCoreModule();
+  const coreHasSharedEmbedder = startupCore !== undefined && typeof startupCore.resolveAgentdbEmbedder === 'function';
+  if (coreHasSharedEmbedder) {
+    embedderSource = 'core-shared';
+    embed = async (text) => {
+      const shared = await startupCore.resolveAgentdbEmbedder(PROJECT);
+      if (!shared || typeof shared.embed !== 'function' || 'error' in shared) {
+        throw new Error((shared && shared.error) || 'resolveAgentdbEmbedder returned no embed()');
+      }
+      return shared.embed(text);
+    };
+    let startupProbe;
+    try {
+      startupProbe = await startupCore.resolveAgentdbEmbedder(PROJECT);
+    } catch (err) {
+      startupProbe = { error: err?.message ?? String(err) };
+    }
+    if (!startupProbe || typeof startupProbe.embed !== 'function' || 'error' in startupProbe) {
+      const msg = (startupProbe && startupProbe.error) || 'resolveAgentdbEmbedder returned no embed()';
+      log('core-shared embedder init failed at startup, will retry per request:', msg);
+      embedderReadyDetail = \` (init failed: \${msg}, will retry per request)\`;
+    }
+  }
+  if (embed === undefined) {
+    // own-fallback: ONLY when core has no resolveAgentdbEmbedder to share at all (no core module, or
+    // a fake/old core, as in test fixtures) — never as a reaction to a startup init error (above).
+    let deps;
+    try {
+      deps = resolveDeps();
+    } catch (err) {
+      log('deps unavailable — not starting:', err?.message ?? err);
+      process.exit(0); // never a hard failure: the hook degrades to silence
+    }
+    // F1 (fix round 1, Codex #1b): the daemon has no core to ask, so it reads the STORE's own dtype
+    // manifest directly — an own pipeline built blindly at fp32 would silently compare vectors from
+    // two different spaces against a q8 store. Absent manifest = fp32 (legacy — matches every store
+    // predating this feature, same discipline as embedding-config.ts's readEmbedManifest). A manifest
+    // that IS present but names neither known dtype is NEVER folded into that same fp32 case — this
+    // daemon fails loudly for that request (embed() throws below, caught honestly by answerRecall)
+    // rather than silently mixing dtype spaces.
+    const manifestPath = join(PROJECT, '.dz', 'agentdb.db.embed-manifest.json');
+    let ownDtype = 'fp32';
+    let ownDtypeError;
+    let manifestIsFile = false;
+    try {
+      manifestIsFile = statSync(manifestPath).isFile(); // a non-file at the sidecar path is "absent", as in core
+    } catch {
+      manifestIsFile = false;
+    }
+    if (manifestIsFile) {
+      try {
+        const raw = JSON.parse(readFileSync(manifestPath, 'utf-8'))?.dtype;
+        if (raw === 'fp32' || raw === 'q8') {
+          ownDtype = raw;
+        } else if (raw !== undefined) {
+          ownDtypeError = String(raw);
+        }
+      } catch (err) {
+        // Lead delta after Codex r2 (HIGH): a manifest that EXISTS but cannot be parsed is NOT
+        // "absent" — refusing beats guessing fp32 over a q8 store (same rule as core's readError).
+        ownDtypeError = 'unreadable manifest: ' + (err?.message ?? String(err));
+      }
+    }
+    embedderSource = 'own-fallback';
+    if (ownDtypeError !== undefined) {
+      log('manifest dtype unknown:', ownDtypeError);
+      ownFallbackDtypeLabel = 'error';
+      const dtypeErrMsg = \`manifest dtype unknown: \${ownDtypeError}\`;
+      embed = async () => { throw new Error(dtypeErrMsg); };
+    } else {
+      ownFallbackDtypeLabel = ownDtype;
+      const { pipeline } = await import(deps.transformers);
+      const extractor = await pipeline('feature-extraction', model, ownDtype === 'q8' ? { dtype: 'q8' } : {});
+      embed = async (text) => Array.from((await extractor(text, { pooling: 'mean', normalize: true })).data);
+    }
+  }
+
+  // AM-1 (fix round 1): warm resolveAgentdbEmbedder — cached PER PROCESS since db1521ba (cold
+  // ~2-3.6 s, warm ~1 ms, MEASURED, see the manifest's T8/AM-1 discussion) — OFF the request path,
+  // so the first REAL \`op: recall\` is not the one that pays the cold init. Fired fire-and-forget as
+  // early as main() can (moved up from right-before-listen, T3/embed-daemon-memory: every ms of
+  // extra head start matters against a multi-second cold cost — see change_manifest.md), never
+  // awaited by startup: this is a best-effort head start, not a guarantee — a request landing in
+  // the window before it completes still pays the (possibly-partial, since it JOINS the same
+  // in-flight resolveAgentdbEmbedder promise, D1) cold cost, and a warm-up failure (no core module,
+  // engine error) is silently swallowed — never-block applies to startup exactly as it does to a
+  // request. Measured: the slowest cold resolveAgentdbEmbedder init observed in this environment
+  // was 3653 ms (T8 log, 2026-09-14) — 10 s leaves a wide margin without risking an unbounded
+  // warm-up hang.
+  const WARMUP_TIMEOUT_MS = 10_000;
+  async function warmUpHybridEngine() {
+    const core = await loadCoreModule();
+    if (core === undefined) return;
+    const guard = new Promise((resolve) => {
+      const t = setTimeout(resolve, WARMUP_TIMEOUT_MS);
+      t.unref?.();
+    });
+    // An empty-string query still exercises the FULL semantic leg (embed + engine.search), which is
+    // exactly what needs warming; recallHybrid degrades any error inside it honestly, so nothing
+    // here needs its own try/catch beyond the outer .catch(() => {}) at the call site below.
+    await Promise.race([core.recallHybrid(PROJECT, '', { limit: 1, mode: 'hook', deferExposures: true }), guard]);
+  }
+  // Fire-and-forget, never awaited — main() proceeds immediately regardless of warm-up outcome.
+  // F2 (fix round 1, Codex #3): warm-up specifically primes the HYBRID leg's own use of
+  // resolveAgentdbEmbedder — pointless when this daemon has no core embedder to share (own-fallback
+  // has no core module, or a fake/old core in tests) AND risks standing up a SECOND, unrelated
+  // pipeline via whatever recallHybrid does internally in that case. Skipped entirely in own-fallback.
+  if (embedderSource === 'core-shared') {
+    warmUpHybridEngine().catch(() => {});
+  }
 
   // READ-ONLY. This process must never be the writer that tears the file for a concurrent reader.
   const dbPath = join(PROJECT, '.dz', 'agentdb.db');
@@ -1137,7 +1301,7 @@ async function main() {
 
   function loadPatterns() {
     if (!existsSync(dbPath)) return [];
-    const db = new deps.Database(dbPath, { readonly: true, fileMustExist: true });
+    const db = new Database(dbPath, { readonly: true, fileMustExist: true });
     try {
       const ph = DZ_TASK_TYPES.map(() => '?').join(',');
       // NOTE: the vector mirror carries no \`domain\` — that column lives in the lexical store. An
@@ -1249,36 +1413,22 @@ async function main() {
       patternsAt = Date.now();
     }
     if (patterns.length === 0) return { hits: [], engine: 'cosine-fallback', reason: hybrid.reason };
-    const qv = await embed(prompt);
+    // F1/F2 (fix round 1): \`embed()\` can now THROW honestly (own-fallback with an unrecognized
+    // manifest dtype, F1; core-shared re-resolution failing on this exact request, F2) — caught here
+    // so it degrades to the SAME honest cosine-fallback shape every other failure gets, never a bare
+    // protocol {error} reply reaching the socket handler's outer catch (the AM-3 defect class).
+    let qv;
+    try {
+      qv = await embed(prompt);
+    } catch (err) {
+      return { hits: [], engine: 'cosine-fallback', reason: \`embedder unavailable: \${err?.message ?? err}\` };
+    }
     const scored = patterns.map((p) => ({ dzId: p.dzId, pattern: p.pattern, score: cos(qv, p.vec), domain: p.domain, ...(p.quarantined ? { quarantined: true } : {}) }));
     scored.sort((a, b) => b.score - a.score);
     // AM-3: same domain exclusion as the hybrid leg, applied before slicing for the same reason.
     return { hits: filterProbeHits(scored, probe).slice(0, limit), engine: 'cosine-fallback', reason: hybrid.reason };
   }
 
-  // AM-1 (fix round 1): warm resolveAgentdbEmbedder — cached PER PROCESS since db1521ba (cold
-  // ~2-3.6 s, warm ~1 ms, MEASURED, see the manifest's T8/AM-1 discussion) — OFF the request path,
-  // so the first REAL \`op: recall\` is not the one that pays the cold init. Fired fire-and-forget
-  // right before \`listen()\` below, never awaited by startup: this is a best-effort head start, not
-  // a guarantee — a request landing in the few-hundred-ms window before it completes still pays the
-  // cold cost exactly as before this amendment, and a warm-up failure (no core module, engine
-  // error) is silently swallowed — never-block applies to startup exactly as it does to a request.
-  // Measured: the slowest cold resolveAgentdbEmbedder init observed in this environment was 3653 ms
-  // (T8 log, 2026-09-14) — 10 s leaves a wide margin without risking an unbounded warm-up hang.
-  const WARMUP_TIMEOUT_MS = 10_000;
-  async function warmUpHybridEngine() {
-    const core = await loadCoreModule();
-    if (core === undefined) return;
-    const guard = new Promise((resolve) => {
-      const t = setTimeout(resolve, WARMUP_TIMEOUT_MS);
-      t.unref?.();
-    });
-    // An empty-string query still exercises the FULL semantic leg (embed + engine.search), which is
-    // exactly what needs warming; recallHybrid degrades any error inside it honestly, so nothing
-    // here needs its own try/catch beyond the outer .catch(() => {}) at the call site below.
-    await Promise.race([core.recallHybrid(PROJECT, '', { limit: 1, mode: 'hook', deferExposures: true }), guard]);
-  }
-
   let idleTimer;
   let lastActivityAt = Date.now();
   const touch = () => {
@@ -1353,9 +1503,6 @@ async function main() {
 
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => shutdown(0));
 
-  // AM-1: fire-and-forget, never awaited — bind proceeds immediately regardless of warm-up outcome.
-  warmUpHybridEngine().catch(() => {});
-
   // FR-3 ("absence of a receipt is not success"): \`ready\` is printed ONLY after \`listen\`'s callback
   // AND a fresh \`existsSync(SOCKET)\` both confirm the socket file is actually on disk — a caller
   // that greps stderr for "ready" must never see it for a socket that silently failed to bind.
@@ -1397,7 +1544,11 @@ async function main() {
         return bindFailed(\`could not publish socket pointer: \${err?.message ?? err}\`);
       }
     }
-    log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET}\`);
+    // F1/F2 (fix round 1): own-fallback names ITS resolved dtype (\`dtype=<fp32|q8|error>\`, F1); a
+    // core-shared daemon that failed its startup probe names that too, inline (\`(init failed: …,
+    // will retry per request)\`, F2) — both make the honest state observable from \`ready\` alone.
+    const embedderReadyLabel = embedderSource === 'own-fallback' ? \`\${embedderSource} dtype=\${ownFallbackDtypeLabel}\` : \`\${embedderSource}\${embedderReadyDetail}\`;
+    log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET} embedder=\${embedderReadyLabel}\`);
     touch();
   });
   server.on('error', (err) => bindFailed(err?.message ?? String(err)));
@@ -1768,6 +1919,19 @@ export interface ApplyLegProbeResult {
    * reason=…` stderr line when present, else a best-effort description of what went wrong. */
   readonly reason?: string;
   readonly elapsedMs: number;
+  /** Fix round 1 (HIGH-1): the KILL-ATTEMPT fact, straight from `probeHookLiveness`'s own
+   * `groupKillAttempted` — present only on the branches that actually reached a spawn (absent for the
+   * early "not installed" / "no hook configured" / "legacy command" / "beacon write failed"
+   * returns, none of which ever call `probeHookLiveness`). This is deliberately a DIFFERENT fact
+   * from "is the grandchild still alive" — a caller observes both separately, never conflates them. */
+  readonly groupKillAttempted?: boolean;
+  /** FR-3 (feature `apply-leg-daemon-hygiene`): present exactly when the pre-probe scavenge of
+   * STALE beacon-domain records failed — the reason comes straight from {@link
+   * scavengeStaleProbeBeacons}'s own `error`, never swallowed. Independent of `ok`/`reason`: a
+   * scavenge failure does not itself flip `ok` to `false` (the probe's own injection result may
+   * still be perfectly genuine), but it IS a fact `dz doctor`/`dz parity` callers can surface
+   * rather than lose. */
+  readonly scavengeError?: string;
 }
 
 /** Words a real prompt needs to clear `hasEnoughSignal` (recall-hook-policy.ts: `MIN_PROMPT_CHARS`
@@ -1778,6 +1942,221 @@ const PROBE_PROMPT_WORDS = 'apply leg live probe';
  * findable and excludable — never `dz-teach`/`general`, which would blend it into real lessons. */
 const PROBE_BEACON_DOMAIN = 'apply-leg-probe';
 
+/**
+ * FR-3 (feature `apply-leg-daemon-hygiene`): the scavenger that ran at the top of every probe used
+ * to delete EVERY beacon-domain record unconditionally — safe against a probe killed mid-flight
+ * (Codex round-2's own reason for the scavenger existing at all), but WRONG the moment two probes
+ * from two DIFFERENT sessions can be live against the SAME store at once: the second probe's
+ * scavenge deletes the first probe's still-in-flight beacon, and the first probe then reports a
+ * false `ok:false` (its own hook query returns nothing, because the lesson it was about to match
+ * against is already gone) — a false-red `dz doctor`/`dz parity` parity check with no defect behind
+ * it. The fix: tag every beacon with its OWNER (`probe-owner=<pid>:<startedMs>`, embedded in the
+ * pattern TEXT so it survives a round-trip through any store tier without a schema change — NFR-1
+ * forbids a new column) and scavenge ONLY a beacon whose owner is provably gone: the pid no longer
+ * answers `process.kill(pid, 0)`, OR the beacon has outlived its TTL (see {@link
+ * scavengeStaleProbeBeacons}'s own `ttlMs` parameter).
+ */
+const PROBE_OWNER_TAG_PREFIX = 'probe-owner=';
+/** Fix round 1 (HIGH-6 residual): a second, independent tag alongside `probe-owner=` — the WRITING
+ * process's own OS-level start time (epoch ms, from `/proc/<pid>/stat`), so the scavenger can tell a
+ * PID-REUSE case (the recorded pid is technically "alive" per `process.kill(pid,0)`, but the LIVE
+ * process at that pid started at a different time than the one that wrote the beacon) apart from
+ * the genuine same-process case. Absent whenever the write-time `/proc` read fails (non-Linux,
+ * permission) — the scavenger then falls back to the plain alive+TTL check alone, unchanged. */
+const PROC_START_TAG_PREFIX = 'proc-start=';
+/** Lead delta after Codex round 2 (HIGH-4): the beacon's OWN expiry, in epoch ms, written by the
+ * probe that owns it. The pre-delta scavenger applied ITS OWN `ttlMs` to SOMEONE ELSE'S beacon, so a
+ * default-budget probe (ttl 60 s) deleted the live beacon of a widened-budget probe (ttl 360 s) after
+ * 60 s — the very false-red this hardening exists to prevent, one level up. A beacon now states when
+ * IT expires; the scavenger's own `ttlMs` is only the fallback for a beacon written before this tag
+ * existed. */
+const PROBE_EXPIRES_TAG_PREFIX = 'probe-expires=';
+
+/**
+ * Fix round 1 (HIGH-6): the pre-fix-round TTL was a flat 60 000 ms, independent of the probe's own
+ * `timeoutMs` — a caller that legitimately widens `timeoutMs` past that (a widened, suspended, or
+ * heavily loaded probe) could have its OWN still-in-flight beacon scavenged by a concurrent probe
+ * before it ever replies. The TTL is now DERIVED from the probe's own `timeoutMs`
+ * (`max(timeoutMs * 3, 60_000)`, see {@link probeApplyLeg}'s call site) so a widened timeout widens
+ * its own protection window too; the 60 000 ms floor keeps the pre-fix-round generous margin for the
+ * default (unwidened) case. Exported as a named constant only for the floor value — the ACTUAL TTL
+ * used by a given probe is always `ttlMs`, computed at the call site, never this constant alone.
+ */
+const PROBE_BEACON_TTL_FLOOR_MS = 60_000;
+
+function formatProbeOwner(pid: number, startedMs: number): string {
+  return `${PROBE_OWNER_TAG_PREFIX}${pid}:${startedMs}`;
+}
+
+/** Parses the `probe-owner=<pid>:<startedMs>` tag out of a beacon's pattern text. `undefined` for
+ * any beacon predating this tag (an older deployed core wrote it) — treated by the scavenger as
+ * ownerless and therefore always safe to remove (the pre-FR-3 behavior for exactly that case). */
+function parseProbeOwner(patternText: string): { readonly pid: number; readonly startedMs: number } | undefined {
+  const idx = patternText.indexOf(PROBE_OWNER_TAG_PREFIX);
+  if (idx === -1) return undefined;
+  const match = /probe-owner=(\d+):(\d+)/u.exec(patternText.slice(idx));
+  if (match?.[1] === undefined || match[2] === undefined) return undefined;
+  return { pid: Number(match[1]), startedMs: Number(match[2]) };
+}
+
+function formatProcStart(procStartedAtMs: number): string {
+  return ` ${PROC_START_TAG_PREFIX}${procStartedAtMs}`;
+}
+
+function formatProbeExpires(expiresAtMs: number): string {
+  return ` ${PROBE_EXPIRES_TAG_PREFIX}${expiresAtMs}`;
+}
+
+/** Parses the `probe-expires=<epochMs>` tag — `undefined` for a beacon written before the tag
+ * existed, which is exactly when the scavenger falls back to its own `ttlMs`. */
+function parseProbeExpires(patternText: string): number | undefined {
+  const idx = patternText.indexOf(PROBE_EXPIRES_TAG_PREFIX);
+  if (idx === -1) return undefined;
+  const match = /probe-expires=(\d+)/u.exec(patternText.slice(idx));
+  if (match?.[1] === undefined) return undefined;
+  return Number(match[1]);
+}
+
+/** Parses the `proc-start=<ticks>` tag — `undefined` when absent (pre-fix-round beacon, or the
+ * write-time `/proc` read failed). */
+function parseProcStart(patternText: string): number | undefined {
+  const idx = patternText.indexOf(PROC_START_TAG_PREFIX);
+  if (idx === -1) return undefined;
+  const match = /proc-start=(\d+)/u.exec(patternText.slice(idx));
+  if (match?.[1] === undefined) return undefined;
+  return Number(match[1]);
+}
+
+/** True when `pid` answers a liveness signal — `process.kill(pid, 0)` sends no actual signal, it
+ * only probes whether the OS still has a process at that pid (ESRCH ⇒ dead). */
+function isPidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return (err as NodeJS.ErrnoException).code !== 'ESRCH';
+  }
+}
+
+/**
+ * Fix round 1 (HIGH-6 residual, Linux-only, best-effort), tightened by the lead after Codex round 2
+ * (MEDIUM-6): a process's OWN `starttime` from `/proc/<pid>/stat` — field 22 overall, found by
+ * skipping past the LAST `)` so a `comm` containing spaces or parens never misaligns the split —
+ * returned as RAW TICKS SINCE BOOT, the unit the kernel reports. No wall clock is consulted and no
+ * CLK_TCK conversion is performed, so a stepped wall clock can no longer make the same live process
+ * look like a different one. `undefined` on ANY read/parse failure (non-Linux, permission, the
+ * process exiting mid-read) — the caller MUST treat that as "cannot prove", never as a pass in
+ * either direction.
+ */
+function pidStartedAtMsFromProcStat(pid: number): number | undefined {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, 'utf-8');
+    const afterComm = stat.slice(stat.lastIndexOf(')') + 1).trim();
+    const fields = afterComm.split(/\s+/u);
+    // Overall field 22 (`starttime`) = fields[22 - 3] here, since fields[] starts at overall field 3
+    // (state) once `pid (comm)` (fields 1-2) has been stripped above.
+    const starttimeTicks = Number(fields[19]);
+    if (!Number.isFinite(starttimeTicks)) return undefined;
+    // Lead delta after Codex round 2 (MEDIUM-6): return the RAW ticks-since-boot, never an epoch
+    // derived from `Date.now() - uptime()`. The derived epoch moves when the WALL CLOCK is stepped,
+    // so the same still-running process appeared to have "started at a different time" and its LIVE
+    // beacon was deleted as a pid-reuse. Ticks since boot are monotonic within a boot and identical
+    // for the same process on every read; across a reboot the recorded pid is dead anyway, which the
+    // liveness check catches first — WITHDRAWN by the lead after Codex round 4: that sentence was
+    // wrong, because across a reboot the pid may ALREADY have been reused and can collide on start
+    // ticks too; the honest scope is the NAMED LIMIT stated below. This also removes the CLK_TCK assumption entirely — no conversion
+    // to milliseconds happens at all, the two values are compared in their own unit.
+    // NAMED LIMIT (lead delta after Codex round 3, MEDIUM): identity holds WITHIN one boot. Across a
+    // reboot both pid allocation and ticks-since-boot restart, so a beacon that somehow persisted
+    // could in principle collide with a new process at the same pid and the same tick. A boot id
+    // would close it; the honest scope today is "within one boot", and a reboot also means the
+    // beacon's own TTL has almost certainly passed, which the TTL branch catches first.
+    return starttimeTicks;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Fix round 1 (HIGH-6 residual): `process.kill(pid,0)` proves SOME process occupies `pid`, never
+ * that it is the SAME process that wrote the beacon — PID reuse defeats the plain alive check named
+ * as a residual limit in the review. Compares the LIVE process's own start time (from `/proc/<pid>/
+ * stat`) against `recordedStartedMs` (the beacon's own `proc-start=` tag). A mismatch beyond {@link
+ * PID_START_TOLERANCE_MS} means the pid was reused by an unrelated process — the true owner is
+ * confirmed gone. `undefined` (stat unreadable) means "cannot prove either way" — the lead's decision
+ * (fix round 1, item 6) is explicit: that MUST read as "do not remove" wherever it is consumed, never
+ * as a pass. */
+function isSameProcessInstance(pid: number, recordedStartTicks: number): boolean | undefined {
+  const actualStartTicks = pidStartedAtMsFromProcStat(pid);
+  if (actualStartTicks === undefined) return undefined;
+  // Lead delta after Codex round 2 (MEDIUM-6): EXACT equality on ticks-since-boot. The old
+  // ±5 000 ms tolerance existed only to absorb the CLK_TCK guess in the epoch conversion; with the
+  // raw kernel value there is nothing to absorb, and a tolerance would re-admit the very pid-reuse
+  // case it was meant to exclude (a reused pid started within the tolerance read as "same process").
+  return actualStartTicks === recordedStartTicks;
+}
+
+/** {@link scavengeStaleProbeBeacons}'s result — FR-3: a scavenge error is a FACT the caller can
+ * surface, never a swallowed exception (the pre-fix `catch { /* best-effort *\/ }` this replaces). */
+export type ScavengeResult = { readonly ok: true; readonly removed: number } | { readonly ok: false; readonly error: string };
+
+/**
+ * FR-3/FR-4: remove only the STALE beacon-domain records in `root`'s store — owner dead
+ * (`process.kill(pid, 0)` ⇒ ESRCH), older than `ttlMs`, OR (fix round 1, HIGH-6 residual) alive AND
+ * within `ttlMs` but the live pid's OWN `/proc/<pid>/stat` start time no longer matches the beacon's
+ * `proc-start=` tag — a confirmed PID-reuse case, where the recorded owner is provably gone even
+ * though `pid` itself answers. An UNREADABLE stat at scavenge time never counts as reuse evidence —
+ * it falls back to the plain alive+TTL verdict, per the lead's "cannot prove ⇒ do not remove"
+ * decision. A beacon whose owner is alive, within TTL, and (when provable) confirmed the SAME
+ * process is left untouched, even though it belongs to a different probe. An ownerless (pre-FR-3)
+ * beacon is always treated as stale. `ttlMs` defaults to {@link PROBE_BEACON_TTL_FLOOR_MS} for a
+ * caller that does not derive one (`apply-leg-beacon-owner.test.ts`'s own fixtures); `probeApplyLeg`
+ * always passes its own derived value. Exported so `apply-leg-beacon-owner.test.ts` can exercise the
+ * property directly, without needing a live hook/daemon (FR-4's red-first case needs only a store
+ * and an injectable remover, never a real probe round-trip).
+ */
+export function scavengeStaleProbeBeacons(
+  root: string,
+  removeBeacon: (root: string, ids: ReadonlySet<string>) => RemovePatternsResult,
+  ttlMs: number = PROBE_BEACON_TTL_FLOOR_MS,
+): ScavengeResult {
+  try {
+    const beacons = loadStorePatternsSync(root).filter((p) => p.domain === PROBE_BEACON_DOMAIN);
+    const staleIds: string[] = [];
+    for (const beacon of beacons) {
+      const owner = parseProbeOwner(beacon.pattern);
+      if (owner === undefined) {
+        staleIds.push(beacon.dzId ?? patternRecordId(beacon));
+        continue;
+      }
+      const alive = isPidAlive(owner.pid);
+      // Lead delta after Codex round 2 (HIGH-4): the beacon's OWN expiry wins over this scavenger's
+      // `ttlMs`, which belongs to a DIFFERENT probe and knows nothing of this owner's budget.
+      const ownExpiresAtMs = parseProbeExpires(beacon.pattern);
+      const withinTtl = ownExpiresAtMs !== undefined
+        ? Date.now() <= ownExpiresAtMs
+        : Date.now() - owner.startedMs <= ttlMs;
+      if (!alive || !withinTtl) {
+        staleIds.push(beacon.dzId ?? patternRecordId(beacon));
+        continue;
+      }
+      // alive AND within TTL — the plain check says "keep", but confirm it is the SAME process, not
+      // a reused pid, whenever the beacon carries the (best-effort) proc-start tag.
+      const procStart = parseProcStart(beacon.pattern);
+      if (procStart !== undefined) {
+        const same = isSameProcessInstance(owner.pid, procStart);
+        if (same === false) staleIds.push(beacon.dzId ?? patternRecordId(beacon)); // confirmed reuse
+        // same === true, or same === undefined (unreadable ⇒ cannot prove ⇒ do not remove): keep.
+      }
+    }
+    if (staleIds.length === 0) return { ok: true, removed: 0 };
+    const result = removeBeacon(root, new Set(staleIds));
+    if (result.error !== undefined) return { ok: false, error: result.error };
+    return { ok: true, removed: result.removed };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
 /**
  * Live, end-to-end proof that the apply leg actually injects — ADR-001 Decision 1. `applyLegStatus`
  * only proves FILES exist and are STRUCTURALLY wired (issue #2's whole defect: four green checks,
@@ -1821,6 +2200,12 @@ export async function probeApplyLeg(
   const started = Date.now();
   const elapsed = (): number => Date.now() - started;
 
+  // Fix round 1 (HIGH-6): computed HERE, before the scavenger runs, so the scavenge TTL can be
+  // derived from THIS probe's own budget rather than a flat constant blind to a caller-widened
+  // timeout — see the `ttlMs` computation below, right before the beacon that carries its implicit
+  // promise is written.
+  const timeoutMs = opts.timeoutMs ?? 8000;
+
   const status = applyLegStatus(root);
   if (!status.installed) {
     return { ok: false, reason: 'apply-leg not installed', elapsedMs: elapsed() };
@@ -1844,8 +2229,32 @@ export async function probeApplyLeg(
   // pattern's own text can produce it. `ok: true` therefore requires the SECRET, never the query.
   const queryToken = `dzapplylegquery${process.pid}${Date.now()}${Math.random().toString(36).slice(2, 10)}`;
   const secretToken = `dzapplylegsecret${process.pid}${Date.now()}${Math.random().toString(36).slice(2, 10)}`;
+  // FR-3: the owner tag rides the SAME pattern text as the secret — a beacon's owner is knowable
+  // from its store record alone, no side channel, no schema change (NFR-1).
+  const ownerTag = formatProbeOwner(process.pid, started);
+  // Fix round 1 (HIGH-6): TTL derives from THIS probe's own timeoutMs — a caller that widens
+  // timeoutMs (this repo's own live tests widen it to 15_000 ms) widens its own protection window
+  // too, rather than staying pinned to a flat constant blind to that widening. Floored at the
+  // pre-fix-round 60_000 ms so the default (unwidened) case keeps its original generous margin.
+  // Asserted, not merely trusted — an unreasoned future edit to the formula must fail loudly right
+  // here, where the beacon carrying this TTL's implicit promise is about to be written, rather than
+  // silently reintroducing the false-red-under-concurrency defect this closes.
+  const ttlMs = Math.max(timeoutMs * 3, PROBE_BEACON_TTL_FLOOR_MS);
+  if (!(timeoutMs < ttlMs)) {
+    throw new Error(`invariant violated: timeoutMs (${String(timeoutMs)}) must be < ttlMs (${String(ttlMs)}) — scavenger TTL formula regressed`);
+  }
+  // Fix round 1 (HIGH-6 residual, best-effort): the writing process's OWN OS-level start time,
+  // captured NOW so a later scavenger can tell a genuinely-still-alive owner apart from a DIFFERENT
+  // process that merely reused this pid (isSameProcessInstance's own doc comment). Omitted entirely
+  // when unreadable (non-Linux, permission) — the scavenger then falls back to the plain alive+TTL
+  // check for this beacon, unchanged from before this residual hardening.
+  const ownProcStart = pidStartedAtMsFromProcStat(process.pid);
+  const procStartTag = ownProcStart !== undefined ? formatProcStart(ownProcStart) : '';
+  // Lead delta after Codex round 2 (HIGH-4): this beacon states its OWN expiry, so a concurrent
+  // probe with a different (shorter) budget can never out-vote this probe's protection window.
+  const expiresTag = formatProbeExpires(started + ttlMs);
   const beaconPattern: PatternRecord = {
-    pattern: `${PROBE_PROMPT_WORDS} ${queryToken} — dz doctor / dz parity live-probe marker, safe to remove. probe-secret=${secretToken}`,
+    pattern: `${PROBE_PROMPT_WORDS} ${queryToken} — dz doctor / dz parity live-probe marker, safe to remove. probe-secret=${secretToken} ${ownerTag}${procStartTag}${expiresTag}`,
     type: 'lesson-learned',
     reward: 0,
     domain: PROBE_BEACON_DOMAIN,
@@ -1874,12 +2283,13 @@ export async function probeApplyLeg(
   // Codex round-2: a process killed mid-probe bypasses `finally`, so a beacon can outlive its probe.
   // Every probe therefore starts by SCAVENGING any beacon left behind by an earlier one (the probe
   // domain is reserved for beacons, never for user lessons) — the store is clean before AND after.
-  try {
-    // a loaded pattern carries the STORE's own id (`dzId`); recomputing it from normalised fields
-    // (type/ts round-trip) can diverge, so the store id wins and the recomputation is the fallback.
-    const stale = loadStorePatternsSync(root).filter((p) => p.domain === PROBE_BEACON_DOMAIN).map((p) => p.dzId ?? patternRecordId(p));
-    if (stale.length > 0) removeBeacon(root, new Set(stale));
-  } catch { /* scavenging is best-effort; the probe's own cleanup below is the accountable path */ }
+  // FR-3/FR-4: scavenging is no longer unconditional — a LIVE beacon from a DIFFERENT concurrent
+  // probe (another session's `dz doctor`/`dz parity` against the same store) must survive; only a
+  // beacon whose owner is dead or past its TTL is removed. A scavenge failure is a named FACT
+  // (`scavengeError`), never a swallowed exception (the pre-fix `catch {}` this replaces).
+  let scavengeError: string | undefined;
+  const scavengeResult = scavengeStaleProbeBeacons(root, removeBeacon, ttlMs);
+  if (!scavengeResult.ok) scavengeError = scavengeResult.error;
 
   try {
     wrote = true;
@@ -1903,7 +2313,6 @@ export async function probeApplyLeg(
       mkdirSync(join(tempCwd, '.claude'), { recursive: true });
 
       const { probeHookLiveness } = await import('./operations.js');
-      const timeoutMs = opts.timeoutMs ?? 8000;
       const probeResult = probeHookLiveness(command, JSON.stringify({ prompt: probePrompt }), {
         cwd: tempCwd,
         env: { ...(opts.env ?? {}), CLAUDE_PROJECT_DIR: tempCwd },
@@ -1924,12 +2333,12 @@ export async function probeApplyLeg(
       }
 
       if (typeof additionalContext === 'string' && additionalContext.includes(secretToken)) {
-        result = { ok: true, elapsedMs: elapsed() };
+        result = { ok: true, elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
       } else if (typeof additionalContext === 'string' && additionalContext.includes(queryToken)) {
         // AM-1: the QUERY came back but the SECRET did not — the hook (or a stub standing in for
         // it) echoed its own input instead of genuinely querying the store. Named distinctly from
         // every other red reason so a dead leg and a FAKING one never read the same.
-        result = { ok: false, reason: 'echo-not-injection', elapsedMs: elapsed() };
+        result = { ok: false, reason: 'echo-not-injection', elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
       } else {
         // FR-1's own reason line is the authoritative source — the hook names itself why it stayed
         // quiet. Falling back to a raw stderr/status summary keeps the probe honest even against an
@@ -1937,15 +2346,16 @@ export async function probeApplyLeg(
         const skipMatch = /\[dz-recall\] skipped reason=(\S+)/.exec(probeResult.stderr);
         const skipReason = skipMatch?.[1];
         if (skipReason !== undefined) {
-          result = { ok: false, reason: skipReason, elapsedMs: elapsed() };
+          result = { ok: false, reason: skipReason, elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
         } else if (probeResult.status === null) {
-          result = { ok: false, reason: `probe did not complete (timeout or spawn error after ${timeoutMs} ms)`, elapsedMs: elapsed() };
+          result = { ok: false, reason: `probe did not complete (timeout or spawn error after ${timeoutMs} ms)`, elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
         } else {
           const stderrFirstLine = probeResult.stderr.trim().split('\n')[0];
           result = {
             ok: false,
             reason: stderrFirstLine && stderrFirstLine !== '' ? stderrFirstLine : 'no beacon in additionalContext (empty or non-matching reply)',
             elapsedMs: elapsed(),
+            groupKillAttempted: probeResult.groupKillAttempted,
           };
         }
       }
@@ -1978,11 +2388,20 @@ export async function probeApplyLeg(
   }
 
   if (cleanupFailed) {
+    // a cleanup failure can only happen after `result` was assigned (the finally block runs after
+    // the try body) — carry the kill-attempt fact through rather than dropping it on this path.
+    // `exactOptionalPropertyTypes` forbids assigning `undefined` to an optional field explicitly, so
+    // the key is included only when `result.groupKillAttempted` actually has a value.
     return {
       ok: false,
       reason: `beacon-cleanup-failed: beacon ${beaconId} could not be removed (${cleanupErrMsg})`,
       elapsedMs: elapsed(),
+      ...(result.groupKillAttempted !== undefined ? { groupKillAttempted: result.groupKillAttempted } : {}),
+      ...(scavengeError !== undefined ? { scavengeError } : {}),
     };
   }
-  return result;
+  // FR-3: a scavenge failure is surfaced on the SUCCESS path too — it does not override `ok`/
+  // `reason` (this probe's own injection result may be perfectly genuine), but it is a fact a
+  // caller should not lose.
+  return scavengeError !== undefined ? { ...result, scavengeError } : result;
 }