@dzhechkov/harness-core 0.8.35 → 0.8.37

package/dist/apply-leg.js

@@ -32,7 +32,7 @@ import { connect as netConnect } from 'node:net';
 // (core-boundary.test.ts's ratchet only counts fs/child_process/https). `probeApplyLeg`'s temp probe
 // cwd reuses the existing top-level 'node:fs' import above (mkdtempSync/rmSync added to that SAME
 // import statement, not a new one) so the ratchet stays at its pinned files:63 imports:69.
-import { tmpdir } from 'node:os';
+import { tmpdir, uptime } from 'node:os';
 import { join, resolve } from 'node:path';
 import { hookCommandsOf } from './managed-hooks.js';
 import { patternRecordId, recordPattern, removePatternsByIds, loadStorePatternsSync } from './patterns.js';
@@ -193,8 +193,26 @@ export function probeRecallEngine(socketPath, timeoutMs = 1000) {
  * the cosine-fallback `scored` array are filtered to exclude `domain === 'apply-leg-probe'` unless
  * the request carried `probe: true` — a probe's own beacon still needs to reach ITS query, only a
  * REAL prompt must never see it.
+ *
+ * Bumped 10→11 (feature `embed-daemon-memory`, ADR-001 D1): the daemon now tries core's OWN cached
+ * embedder (`resolveAgentdbEmbedder`) first — one pipeline per process — building a private one only
+ * when core cannot hand one over; `ready` gained the ` embedder=<core-shared|own-fallback>` suffix
+ * (see `features/embed-daemon-memory/07_code_changes/change_manifest.md` for the full T3 note; this
+ * paragraph was missing from the bump history and is added here for the record, fix round 1).
+ *
+ * Bumped 11→12 (`embed-daemon-memory`, fix round 1 — F1/F2, Codex #1b/#3): (a) F1 — the own-fallback
+ * pipeline now reads the STORE's own dtype manifest before building (absent = fp32 legacy, a
+ * present-but-unrecognized value fails the request loudly instead of silently building fp32 against
+ * a q8 store); `ready`'s own-fallback branch gains ` dtype=<fp32|q8|error>`. (b) F2 — a core-shared
+ * STARTUP init failure no longer falls back to building an own pipeline (which risked a second live
+ * embedder once a later hybrid call succeeded): `embedderSource` stays `'core-shared'` and `embed`
+ * re-resolves `core.resolveAgentdbEmbedder` per request instead; `ready` names a startup failure
+ * inline as `core-shared (init failed: <msg>, will retry per request)`; `warmUpHybridEngine()` is
+ * skipped entirely in own-fallback mode. (c) `answerRecall`'s `embed(prompt)` call is now wrapped so
+ * either failure mode degrades to the SAME honest `cosine-fallback` reply shape as every other
+ * failure, never a bare protocol `{error}`.
  */
-export const APPLY_LEG_VERSION = 10;
+export const APPLY_LEG_VERSION = 12;
 /**
  * Parse the `dz-apply-leg-version` stamp from a deployed helper file. Unlike
  * `writerVersionOf` (which floors an absent stamp at `0`), this returns `-1` for "no stamp at
@@ -1021,6 +1039,18 @@ function socketAlive(path) {
   });
 }
 
+// ADR-001 (embed-daemon-memory, D1/T3): better-sqlite3 is resolved INDEPENDENTLY of the embedder now
+// — the cosine-fallback leg always needs it to read the mirror, regardless of whether the embedder
+// itself comes from core (embedder=core-shared) or this daemon's own pipeline (embedder=own-fallback).
+// Splitting it out of the old resolveDeps() lets the daemon start on core-shared alone when only
+// better-sqlite3 (not transformers) is locally resolvable.
+function resolveDatabase() {
+  const req = createRequire(join(PROJECT, 'package.json'));
+  return req('better-sqlite3');
+}
+
+// own-fallback ONLY (ADR-001 D1): resolves the transformers module for the daemon's OWN pipeline,
+// built only when core has no resolveAgentdbEmbedder to share (no core module, or it errored).
 function resolveDeps() {
   const req = createRequire(join(PROJECT, 'package.json'));
   // agentdb >= 3.0.0-alpha depends on '@huggingface/transformers' (the '@xenova/transformers'
@@ -1048,7 +1078,7 @@ function resolveDeps() {
   if (transformers === undefined) {
     throw new Error('neither @huggingface/transformers nor @xenova/transformers could be resolved (' + String((lastErr && lastErr.message) || lastErr) + ')');
   }
-  return { Database: req('better-sqlite3'), transformers };
+  return { transformers };
 }
 
 const cos = (a, b) => {
@@ -1113,17 +1143,151 @@ async function main() {
 
   const started = Date.now();
   const model = configuredModel();
-  let deps;
+
+  // better-sqlite3 is required regardless of which embedder answers a request (ADR-001, T3) — the
+  // cosine-fallback leg always reads the mirror through it.
+  let Database;
   try {
-    deps = resolveDeps();
+    Database = resolveDatabase();
   } catch (err) {
     log('deps unavailable — not starting:', err?.message ?? err);
     process.exit(0); // never a hard failure: the hook degrades to silence
   }
 
-  const { pipeline } = await import(deps.transformers);
-  const extractor = await pipeline('feature-extraction', model);
-  const embed = async (text) => Array.from((await extractor(text, { pooling: 'mean', normalize: true })).data);
+  // ADR-001 D1 (embed-daemon-memory): the daemon SHARES core's single per-process embedder and
+  // builds a private pipeline only when core cannot hand one over AT ALL — no core module, or a core
+  // build too old to export \`resolveAgentdbEmbedder\` (F2, fix round 1, Codex #3). A STARTUP init
+  // FAILURE (core exists, has the export, but the call itself errored — offline model cache, a
+  // corrupted manifest) is NEVER treated as "core unavailable": own-fallback must not be built in
+  // that case, because a LATER hybrid call could succeed and stand up a SECOND, independent pipeline
+  // in the same process — the exact "two live embedders" defect the review named. Instead
+  // \`embedderSource\` STAYS \`'core-shared'\` and \`embed\` re-resolves \`core.resolveAgentdbEmbedder\`
+  // on EVERY call: core's own per-process cache (agentdb-index.ts) makes a repeat call after SUCCESS
+  // effectively free, and evicts its own entry on failure — so a transient startup failure can heal
+  // on a later request without this daemon ever building an embedder of its own.
+  //
+  // The shared embedder is still PROBED EAGERLY, before \`ready\`, for the same reason the own
+  // pipeline always was: the cosine-fallback leg must answer inside the hook budget on the FIRST
+  // request too (parity AC-2: hybrid delayed by 3000 ms, reply < 2000 ms). MEASURED 2026-09-16
+  // (change_manifest.md, deviation B): a LAZY resolve put the cold pipeline init (2000-3600 ms) on
+  // the first fallback reply — 4/5 runs at 2063-2146 ms. The probe's OUTCOME only decides the
+  // \`ready\`-log wording now (F2) — it never gates \`embedderSource\` or builds an own-fallback
+  // pipeline. The starved-budget parity test that used to lean on a cold engine now injects
+  // DZ_EMBED_HYBRID_DELAY_MS itself, so its premise holds by construction, not by cold timing.
+  let embed;
+  let embedderSource;
+  let embedderReadyDetail = '';
+  let ownFallbackDtypeLabel;
+  const startupCore = await loadCoreModule();
+  const coreHasSharedEmbedder = startupCore !== undefined && typeof startupCore.resolveAgentdbEmbedder === 'function';
+  if (coreHasSharedEmbedder) {
+    embedderSource = 'core-shared';
+    embed = async (text) => {
+      const shared = await startupCore.resolveAgentdbEmbedder(PROJECT);
+      if (!shared || typeof shared.embed !== 'function' || 'error' in shared) {
+        throw new Error((shared && shared.error) || 'resolveAgentdbEmbedder returned no embed()');
+      }
+      return shared.embed(text);
+    };
+    let startupProbe;
+    try {
+      startupProbe = await startupCore.resolveAgentdbEmbedder(PROJECT);
+    } catch (err) {
+      startupProbe = { error: err?.message ?? String(err) };
+    }
+    if (!startupProbe || typeof startupProbe.embed !== 'function' || 'error' in startupProbe) {
+      const msg = (startupProbe && startupProbe.error) || 'resolveAgentdbEmbedder returned no embed()';
+      log('core-shared embedder init failed at startup, will retry per request:', msg);
+      embedderReadyDetail = \` (init failed: \${msg}, will retry per request)\`;
+    }
+  }
+  if (embed === undefined) {
+    // own-fallback: ONLY when core has no resolveAgentdbEmbedder to share at all (no core module, or
+    // a fake/old core, as in test fixtures) — never as a reaction to a startup init error (above).
+    let deps;
+    try {
+      deps = resolveDeps();
+    } catch (err) {
+      log('deps unavailable — not starting:', err?.message ?? err);
+      process.exit(0); // never a hard failure: the hook degrades to silence
+    }
+    // F1 (fix round 1, Codex #1b): the daemon has no core to ask, so it reads the STORE's own dtype
+    // manifest directly — an own pipeline built blindly at fp32 would silently compare vectors from
+    // two different spaces against a q8 store. Absent manifest = fp32 (legacy — matches every store
+    // predating this feature, same discipline as embedding-config.ts's readEmbedManifest). A manifest
+    // that IS present but names neither known dtype is NEVER folded into that same fp32 case — this
+    // daemon fails loudly for that request (embed() throws below, caught honestly by answerRecall)
+    // rather than silently mixing dtype spaces.
+    const manifestPath = join(PROJECT, '.dz', 'agentdb.db.embed-manifest.json');
+    let ownDtype = 'fp32';
+    let ownDtypeError;
+    let manifestIsFile = false;
+    try {
+      manifestIsFile = statSync(manifestPath).isFile(); // a non-file at the sidecar path is "absent", as in core
+    } catch {
+      manifestIsFile = false;
+    }
+    if (manifestIsFile) {
+      try {
+        const raw = JSON.parse(readFileSync(manifestPath, 'utf-8'))?.dtype;
+        if (raw === 'fp32' || raw === 'q8') {
+          ownDtype = raw;
+        } else if (raw !== undefined) {
+          ownDtypeError = String(raw);
+        }
+      } catch (err) {
+        // Lead delta after Codex r2 (HIGH): a manifest that EXISTS but cannot be parsed is NOT
+        // "absent" — refusing beats guessing fp32 over a q8 store (same rule as core's readError).
+        ownDtypeError = 'unreadable manifest: ' + (err?.message ?? String(err));
+      }
+    }
+    embedderSource = 'own-fallback';
+    if (ownDtypeError !== undefined) {
+      log('manifest dtype unknown:', ownDtypeError);
+      ownFallbackDtypeLabel = 'error';
+      const dtypeErrMsg = \`manifest dtype unknown: \${ownDtypeError}\`;
+      embed = async () => { throw new Error(dtypeErrMsg); };
+    } else {
+      ownFallbackDtypeLabel = ownDtype;
+      const { pipeline } = await import(deps.transformers);
+      const extractor = await pipeline('feature-extraction', model, ownDtype === 'q8' ? { dtype: 'q8' } : {});
+      embed = async (text) => Array.from((await extractor(text, { pooling: 'mean', normalize: true })).data);
+    }
+  }
+
+  // AM-1 (fix round 1): warm resolveAgentdbEmbedder — cached PER PROCESS since db1521ba (cold
+  // ~2-3.6 s, warm ~1 ms, MEASURED, see the manifest's T8/AM-1 discussion) — OFF the request path,
+  // so the first REAL \`op: recall\` is not the one that pays the cold init. Fired fire-and-forget as
+  // early as main() can (moved up from right-before-listen, T3/embed-daemon-memory: every ms of
+  // extra head start matters against a multi-second cold cost — see change_manifest.md), never
+  // awaited by startup: this is a best-effort head start, not a guarantee — a request landing in
+  // the window before it completes still pays the (possibly-partial, since it JOINS the same
+  // in-flight resolveAgentdbEmbedder promise, D1) cold cost, and a warm-up failure (no core module,
+  // engine error) is silently swallowed — never-block applies to startup exactly as it does to a
+  // request. Measured: the slowest cold resolveAgentdbEmbedder init observed in this environment
+  // was 3653 ms (T8 log, 2026-09-14) — 10 s leaves a wide margin without risking an unbounded
+  // warm-up hang.
+  const WARMUP_TIMEOUT_MS = 10_000;
+  async function warmUpHybridEngine() {
+    const core = await loadCoreModule();
+    if (core === undefined) return;
+    const guard = new Promise((resolve) => {
+      const t = setTimeout(resolve, WARMUP_TIMEOUT_MS);
+      t.unref?.();
+    });
+    // An empty-string query still exercises the FULL semantic leg (embed + engine.search), which is
+    // exactly what needs warming; recallHybrid degrades any error inside it honestly, so nothing
+    // here needs its own try/catch beyond the outer .catch(() => {}) at the call site below.
+    await Promise.race([core.recallHybrid(PROJECT, '', { limit: 1, mode: 'hook', deferExposures: true }), guard]);
+  }
+  // Fire-and-forget, never awaited — main() proceeds immediately regardless of warm-up outcome.
+  // F2 (fix round 1, Codex #3): warm-up specifically primes the HYBRID leg's own use of
+  // resolveAgentdbEmbedder — pointless when this daemon has no core embedder to share (own-fallback
+  // has no core module, or a fake/old core in tests) AND risks standing up a SECOND, unrelated
+  // pipeline via whatever recallHybrid does internally in that case. Skipped entirely in own-fallback.
+  if (embedderSource === 'core-shared') {
+    warmUpHybridEngine().catch(() => {});
+  }
 
   // READ-ONLY. This process must never be the writer that tears the file for a concurrent reader.
   const dbPath = join(PROJECT, '.dz', 'agentdb.db');
@@ -1131,7 +1295,7 @@ async function main() {
 
   function loadPatterns() {
     if (!existsSync(dbPath)) return [];
-    const db = new deps.Database(dbPath, { readonly: true, fileMustExist: true });
+    const db = new Database(dbPath, { readonly: true, fileMustExist: true });
     try {
       const ph = DZ_TASK_TYPES.map(() => '?').join(',');
       // NOTE: the vector mirror carries no \`domain\` — that column lives in the lexical store. An
@@ -1243,36 +1407,22 @@ async function main() {
       patternsAt = Date.now();
     }
     if (patterns.length === 0) return { hits: [], engine: 'cosine-fallback', reason: hybrid.reason };
-    const qv = await embed(prompt);
+    // F1/F2 (fix round 1): \`embed()\` can now THROW honestly (own-fallback with an unrecognized
+    // manifest dtype, F1; core-shared re-resolution failing on this exact request, F2) — caught here
+    // so it degrades to the SAME honest cosine-fallback shape every other failure gets, never a bare
+    // protocol {error} reply reaching the socket handler's outer catch (the AM-3 defect class).
+    let qv;
+    try {
+      qv = await embed(prompt);
+    } catch (err) {
+      return { hits: [], engine: 'cosine-fallback', reason: \`embedder unavailable: \${err?.message ?? err}\` };
+    }
     const scored = patterns.map((p) => ({ dzId: p.dzId, pattern: p.pattern, score: cos(qv, p.vec), domain: p.domain, ...(p.quarantined ? { quarantined: true } : {}) }));
     scored.sort((a, b) => b.score - a.score);
     // AM-3: same domain exclusion as the hybrid leg, applied before slicing for the same reason.
     return { hits: filterProbeHits(scored, probe).slice(0, limit), engine: 'cosine-fallback', reason: hybrid.reason };
   }
 
-  // AM-1 (fix round 1): warm resolveAgentdbEmbedder — cached PER PROCESS since db1521ba (cold
-  // ~2-3.6 s, warm ~1 ms, MEASURED, see the manifest's T8/AM-1 discussion) — OFF the request path,
-  // so the first REAL \`op: recall\` is not the one that pays the cold init. Fired fire-and-forget
-  // right before \`listen()\` below, never awaited by startup: this is a best-effort head start, not
-  // a guarantee — a request landing in the few-hundred-ms window before it completes still pays the
-  // cold cost exactly as before this amendment, and a warm-up failure (no core module, engine
-  // error) is silently swallowed — never-block applies to startup exactly as it does to a request.
-  // Measured: the slowest cold resolveAgentdbEmbedder init observed in this environment was 3653 ms
-  // (T8 log, 2026-09-14) — 10 s leaves a wide margin without risking an unbounded warm-up hang.
-  const WARMUP_TIMEOUT_MS = 10_000;
-  async function warmUpHybridEngine() {
-    const core = await loadCoreModule();
-    if (core === undefined) return;
-    const guard = new Promise((resolve) => {
-      const t = setTimeout(resolve, WARMUP_TIMEOUT_MS);
-      t.unref?.();
-    });
-    // An empty-string query still exercises the FULL semantic leg (embed + engine.search), which is
-    // exactly what needs warming; recallHybrid degrades any error inside it honestly, so nothing
-    // here needs its own try/catch beyond the outer .catch(() => {}) at the call site below.
-    await Promise.race([core.recallHybrid(PROJECT, '', { limit: 1, mode: 'hook', deferExposures: true }), guard]);
-  }
-
   let idleTimer;
   let lastActivityAt = Date.now();
   const touch = () => {
@@ -1347,9 +1497,6 @@ async function main() {
 
   for (const sig of ['SIGINT', 'SIGTERM', 'SIGHUP']) process.on(sig, () => shutdown(0));
 
-  // AM-1: fire-and-forget, never awaited — bind proceeds immediately regardless of warm-up outcome.
-  warmUpHybridEngine().catch(() => {});
-
   // FR-3 ("absence of a receipt is not success"): \`ready\` is printed ONLY after \`listen\`'s callback
   // AND a fresh \`existsSync(SOCKET)\` both confirm the socket file is actually on disk — a caller
   // that greps stderr for "ready" must never see it for a socket that silently failed to bind.
@@ -1391,7 +1538,11 @@ async function main() {
         return bindFailed(\`could not publish socket pointer: \${err?.message ?? err}\`);
       }
     }
-    log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET}\`);
+    // F1/F2 (fix round 1): own-fallback names ITS resolved dtype (\`dtype=<fp32|q8|error>\`, F1); a
+    // core-shared daemon that failed its startup probe names that too, inline (\`(init failed: …,
+    // will retry per request)\`, F2) — both make the honest state observable from \`ready\` alone.
+    const embedderReadyLabel = embedderSource === 'own-fallback' ? \`\${embedderSource} dtype=\${ownFallbackDtypeLabel}\` : \`\${embedderSource}\${embedderReadyDetail}\`;
+    log(\`ready: \${patterns.length} pattern vectors, model \${model}, socket \${SOCKET} embedder=\${embedderReadyLabel}\`);
     touch();
   });
   server.on('error', (err) => bindFailed(err?.message ?? String(err)));
@@ -1697,6 +1848,215 @@ const PROBE_PROMPT_WORDS = 'apply leg live probe';
 /** Doctor/parity probes share ONE domain tag so a leaked beacon (a failed removal) is trivially
  * findable and excludable — never `dz-teach`/`general`, which would blend it into real lessons. */
 const PROBE_BEACON_DOMAIN = 'apply-leg-probe';
+/**
+ * FR-3 (feature `apply-leg-daemon-hygiene`): the scavenger that ran at the top of every probe used
+ * to delete EVERY beacon-domain record unconditionally — safe against a probe killed mid-flight
+ * (Codex round-2's own reason for the scavenger existing at all), but WRONG the moment two probes
+ * from two DIFFERENT sessions can be live against the SAME store at once: the second probe's
+ * scavenge deletes the first probe's still-in-flight beacon, and the first probe then reports a
+ * false `ok:false` (its own hook query returns nothing, because the lesson it was about to match
+ * against is already gone) — a false-red `dz doctor`/`dz parity` parity check with no defect behind
+ * it. The fix: tag every beacon with its OWNER (`probe-owner=<pid>:<startedMs>`, embedded in the
+ * pattern TEXT so it survives a round-trip through any store tier without a schema change — NFR-1
+ * forbids a new column) and scavenge ONLY a beacon whose owner is provably gone: the pid no longer
+ * answers `process.kill(pid, 0)`, OR the beacon has outlived its TTL (see {@link
+ * scavengeStaleProbeBeacons}'s own `ttlMs` parameter).
+ */
+const PROBE_OWNER_TAG_PREFIX = 'probe-owner=';
+/** Fix round 1 (HIGH-6 residual): a second, independent tag alongside `probe-owner=` — the WRITING
+ * process's own OS-level start time (epoch ms, from `/proc/<pid>/stat`), so the scavenger can tell a
+ * PID-REUSE case (the recorded pid is technically "alive" per `process.kill(pid,0)`, but the LIVE
+ * process at that pid started at a different time than the one that wrote the beacon) apart from
+ * the genuine same-process case. Absent whenever the write-time `/proc` read fails (non-Linux,
+ * permission) — the scavenger then falls back to the plain alive+TTL check alone, unchanged. */
+const PROC_START_TAG_PREFIX = 'proc-start=';
+/** Lead delta after Codex round 2 (HIGH-4): the beacon's OWN expiry, in epoch ms, written by the
+ * probe that owns it. The pre-delta scavenger applied ITS OWN `ttlMs` to SOMEONE ELSE'S beacon, so a
+ * default-budget probe (ttl 60 s) deleted the live beacon of a widened-budget probe (ttl 360 s) after
+ * 60 s — the very false-red this hardening exists to prevent, one level up. A beacon now states when
+ * IT expires; the scavenger's own `ttlMs` is only the fallback for a beacon written before this tag
+ * existed. */
+const PROBE_EXPIRES_TAG_PREFIX = 'probe-expires=';
+/**
+ * Fix round 1 (HIGH-6): the pre-fix-round TTL was a flat 60 000 ms, independent of the probe's own
+ * `timeoutMs` — a caller that legitimately widens `timeoutMs` past that (a widened, suspended, or
+ * heavily loaded probe) could have its OWN still-in-flight beacon scavenged by a concurrent probe
+ * before it ever replies. The TTL is now DERIVED from the probe's own `timeoutMs`
+ * (`max(timeoutMs * 3, 60_000)`, see {@link probeApplyLeg}'s call site) so a widened timeout widens
+ * its own protection window too; the 60 000 ms floor keeps the pre-fix-round generous margin for the
+ * default (unwidened) case. Exported as a named constant only for the floor value — the ACTUAL TTL
+ * used by a given probe is always `ttlMs`, computed at the call site, never this constant alone.
+ */
+const PROBE_BEACON_TTL_FLOOR_MS = 60_000;
+function formatProbeOwner(pid, startedMs) {
+    return `${PROBE_OWNER_TAG_PREFIX}${pid}:${startedMs}`;
+}
+/** Parses the `probe-owner=<pid>:<startedMs>` tag out of a beacon's pattern text. `undefined` for
+ * any beacon predating this tag (an older deployed core wrote it) — treated by the scavenger as
+ * ownerless and therefore always safe to remove (the pre-FR-3 behavior for exactly that case). */
+function parseProbeOwner(patternText) {
+    const idx = patternText.indexOf(PROBE_OWNER_TAG_PREFIX);
+    if (idx === -1)
+        return undefined;
+    const match = /probe-owner=(\d+):(\d+)/u.exec(patternText.slice(idx));
+    if (match?.[1] === undefined || match[2] === undefined)
+        return undefined;
+    return { pid: Number(match[1]), startedMs: Number(match[2]) };
+}
+function formatProcStart(procStartedAtMs) {
+    return ` ${PROC_START_TAG_PREFIX}${procStartedAtMs}`;
+}
+function formatProbeExpires(expiresAtMs) {
+    return ` ${PROBE_EXPIRES_TAG_PREFIX}${expiresAtMs}`;
+}
+/** Parses the `probe-expires=<epochMs>` tag — `undefined` for a beacon written before the tag
+ * existed, which is exactly when the scavenger falls back to its own `ttlMs`. */
+function parseProbeExpires(patternText) {
+    const idx = patternText.indexOf(PROBE_EXPIRES_TAG_PREFIX);
+    if (idx === -1)
+        return undefined;
+    const match = /probe-expires=(\d+)/u.exec(patternText.slice(idx));
+    if (match?.[1] === undefined)
+        return undefined;
+    return Number(match[1]);
+}
+/** Parses the `proc-start=<ticks>` tag — `undefined` when absent (pre-fix-round beacon, or the
+ * write-time `/proc` read failed). */
+function parseProcStart(patternText) {
+    const idx = patternText.indexOf(PROC_START_TAG_PREFIX);
+    if (idx === -1)
+        return undefined;
+    const match = /proc-start=(\d+)/u.exec(patternText.slice(idx));
+    if (match?.[1] === undefined)
+        return undefined;
+    return Number(match[1]);
+}
+/** True when `pid` answers a liveness signal — `process.kill(pid, 0)` sends no actual signal, it
+ * only probes whether the OS still has a process at that pid (ESRCH ⇒ dead). */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code !== 'ESRCH';
+    }
+}
+/**
+ * Fix round 1 (HIGH-6 residual, Linux-only, best-effort), tightened by the lead after Codex round 2
+ * (MEDIUM-6): a process's OWN `starttime` from `/proc/<pid>/stat` — field 22 overall, found by
+ * skipping past the LAST `)` so a `comm` containing spaces or parens never misaligns the split —
+ * returned as RAW TICKS SINCE BOOT, the unit the kernel reports. No wall clock is consulted and no
+ * CLK_TCK conversion is performed, so a stepped wall clock can no longer make the same live process
+ * look like a different one. `undefined` on ANY read/parse failure (non-Linux, permission, the
+ * process exiting mid-read) — the caller MUST treat that as "cannot prove", never as a pass in
+ * either direction.
+ */
+function pidStartedAtMsFromProcStat(pid) {
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, 'utf-8');
+        const afterComm = stat.slice(stat.lastIndexOf(')') + 1).trim();
+        const fields = afterComm.split(/\s+/u);
+        // Overall field 22 (`starttime`) = fields[22 - 3] here, since fields[] starts at overall field 3
+        // (state) once `pid (comm)` (fields 1-2) has been stripped above.
+        const starttimeTicks = Number(fields[19]);
+        if (!Number.isFinite(starttimeTicks))
+            return undefined;
+        // Lead delta after Codex round 2 (MEDIUM-6): return the RAW ticks-since-boot, never an epoch
+        // derived from `Date.now() - uptime()`. The derived epoch moves when the WALL CLOCK is stepped,
+        // so the same still-running process appeared to have "started at a different time" and its LIVE
+        // beacon was deleted as a pid-reuse. Ticks since boot are monotonic within a boot and identical
+        // for the same process on every read; across a reboot the recorded pid is dead anyway, which the
+        // liveness check catches first — WITHDRAWN by the lead after Codex round 4: that sentence was
+        // wrong, because across a reboot the pid may ALREADY have been reused and can collide on start
+        // ticks too; the honest scope is the NAMED LIMIT stated below. This also removes the CLK_TCK assumption entirely — no conversion
+        // to milliseconds happens at all, the two values are compared in their own unit.
+        // NAMED LIMIT (lead delta after Codex round 3, MEDIUM): identity holds WITHIN one boot. Across a
+        // reboot both pid allocation and ticks-since-boot restart, so a beacon that somehow persisted
+        // could in principle collide with a new process at the same pid and the same tick. A boot id
+        // would close it; the honest scope today is "within one boot", and a reboot also means the
+        // beacon's own TTL has almost certainly passed, which the TTL branch catches first.
+        return starttimeTicks;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Fix round 1 (HIGH-6 residual): `process.kill(pid,0)` proves SOME process occupies `pid`, never
+ * that it is the SAME process that wrote the beacon — PID reuse defeats the plain alive check named
+ * as a residual limit in the review. Compares the LIVE process's own start time (from `/proc/<pid>/
+ * stat`) against `recordedStartedMs` (the beacon's own `proc-start=` tag). A mismatch beyond {@link
+ * PID_START_TOLERANCE_MS} means the pid was reused by an unrelated process — the true owner is
+ * confirmed gone. `undefined` (stat unreadable) means "cannot prove either way" — the lead's decision
+ * (fix round 1, item 6) is explicit: that MUST read as "do not remove" wherever it is consumed, never
+ * as a pass. */
+function isSameProcessInstance(pid, recordedStartTicks) {
+    const actualStartTicks = pidStartedAtMsFromProcStat(pid);
+    if (actualStartTicks === undefined)
+        return undefined;
+    // Lead delta after Codex round 2 (MEDIUM-6): EXACT equality on ticks-since-boot. The old
+    // ±5 000 ms tolerance existed only to absorb the CLK_TCK guess in the epoch conversion; with the
+    // raw kernel value there is nothing to absorb, and a tolerance would re-admit the very pid-reuse
+    // case it was meant to exclude (a reused pid started within the tolerance read as "same process").
+    return actualStartTicks === recordedStartTicks;
+}
+/**
+ * FR-3/FR-4: remove only the STALE beacon-domain records in `root`'s store — owner dead
+ * (`process.kill(pid, 0)` ⇒ ESRCH), older than `ttlMs`, OR (fix round 1, HIGH-6 residual) alive AND
+ * within `ttlMs` but the live pid's OWN `/proc/<pid>/stat` start time no longer matches the beacon's
+ * `proc-start=` tag — a confirmed PID-reuse case, where the recorded owner is provably gone even
+ * though `pid` itself answers. An UNREADABLE stat at scavenge time never counts as reuse evidence —
+ * it falls back to the plain alive+TTL verdict, per the lead's "cannot prove ⇒ do not remove"
+ * decision. A beacon whose owner is alive, within TTL, and (when provable) confirmed the SAME
+ * process is left untouched, even though it belongs to a different probe. An ownerless (pre-FR-3)
+ * beacon is always treated as stale. `ttlMs` defaults to {@link PROBE_BEACON_TTL_FLOOR_MS} for a
+ * caller that does not derive one (`apply-leg-beacon-owner.test.ts`'s own fixtures); `probeApplyLeg`
+ * always passes its own derived value. Exported so `apply-leg-beacon-owner.test.ts` can exercise the
+ * property directly, without needing a live hook/daemon (FR-4's red-first case needs only a store
+ * and an injectable remover, never a real probe round-trip).
+ */
+export function scavengeStaleProbeBeacons(root, removeBeacon, ttlMs = PROBE_BEACON_TTL_FLOOR_MS) {
+    try {
+        const beacons = loadStorePatternsSync(root).filter((p) => p.domain === PROBE_BEACON_DOMAIN);
+        const staleIds = [];
+        for (const beacon of beacons) {
+            const owner = parseProbeOwner(beacon.pattern);
+            if (owner === undefined) {
+                staleIds.push(beacon.dzId ?? patternRecordId(beacon));
+                continue;
+            }
+            const alive = isPidAlive(owner.pid);
+            // Lead delta after Codex round 2 (HIGH-4): the beacon's OWN expiry wins over this scavenger's
+            // `ttlMs`, which belongs to a DIFFERENT probe and knows nothing of this owner's budget.
+            const ownExpiresAtMs = parseProbeExpires(beacon.pattern);
+            const withinTtl = ownExpiresAtMs !== undefined
+                ? Date.now() <= ownExpiresAtMs
+                : Date.now() - owner.startedMs <= ttlMs;
+            if (!alive || !withinTtl) {
+                staleIds.push(beacon.dzId ?? patternRecordId(beacon));
+                continue;
+            }
+            // alive AND within TTL — the plain check says "keep", but confirm it is the SAME process, not
+            // a reused pid, whenever the beacon carries the (best-effort) proc-start tag.
+            const procStart = parseProcStart(beacon.pattern);
+            if (procStart !== undefined) {
+                const same = isSameProcessInstance(owner.pid, procStart);
+                if (same === false)
+                    staleIds.push(beacon.dzId ?? patternRecordId(beacon)); // confirmed reuse
+                // same === true, or same === undefined (unreadable ⇒ cannot prove ⇒ do not remove): keep.
+            }
+        }
+        if (staleIds.length === 0)
+            return { ok: true, removed: 0 };
+        const result = removeBeacon(root, new Set(staleIds));
+        if (result.error !== undefined)
+            return { ok: false, error: result.error };
+        return { ok: true, removed: result.removed };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
 /**
  * Live, end-to-end proof that the apply leg actually injects — ADR-001 Decision 1. `applyLegStatus`
  * only proves FILES exist and are STRUCTURALLY wired (issue #2's whole defect: four green checks,
@@ -1729,6 +2089,11 @@ const PROBE_BEACON_DOMAIN = 'apply-leg-probe';
 export async function probeApplyLeg(root, opts = {}) {
     const started = Date.now();
     const elapsed = () => Date.now() - started;
+    // Fix round 1 (HIGH-6): computed HERE, before the scavenger runs, so the scavenge TTL can be
+    // derived from THIS probe's own budget rather than a flat constant blind to a caller-widened
+    // timeout — see the `ttlMs` computation below, right before the beacon that carries its implicit
+    // promise is written.
+    const timeoutMs = opts.timeoutMs ?? 8000;
     const status = applyLegStatus(root);
     if (!status.installed) {
         return { ok: false, reason: 'apply-leg not installed', elapsedMs: elapsed() };
@@ -1751,8 +2116,32 @@ export async function probeApplyLeg(root, opts = {}) {
     // pattern's own text can produce it. `ok: true` therefore requires the SECRET, never the query.
     const queryToken = `dzapplylegquery${process.pid}${Date.now()}${Math.random().toString(36).slice(2, 10)}`;
     const secretToken = `dzapplylegsecret${process.pid}${Date.now()}${Math.random().toString(36).slice(2, 10)}`;
+    // FR-3: the owner tag rides the SAME pattern text as the secret — a beacon's owner is knowable
+    // from its store record alone, no side channel, no schema change (NFR-1).
+    const ownerTag = formatProbeOwner(process.pid, started);
+    // Fix round 1 (HIGH-6): TTL derives from THIS probe's own timeoutMs — a caller that widens
+    // timeoutMs (this repo's own live tests widen it to 15_000 ms) widens its own protection window
+    // too, rather than staying pinned to a flat constant blind to that widening. Floored at the
+    // pre-fix-round 60_000 ms so the default (unwidened) case keeps its original generous margin.
+    // Asserted, not merely trusted — an unreasoned future edit to the formula must fail loudly right
+    // here, where the beacon carrying this TTL's implicit promise is about to be written, rather than
+    // silently reintroducing the false-red-under-concurrency defect this closes.
+    const ttlMs = Math.max(timeoutMs * 3, PROBE_BEACON_TTL_FLOOR_MS);
+    if (!(timeoutMs < ttlMs)) {
+        throw new Error(`invariant violated: timeoutMs (${String(timeoutMs)}) must be < ttlMs (${String(ttlMs)}) — scavenger TTL formula regressed`);
+    }
+    // Fix round 1 (HIGH-6 residual, best-effort): the writing process's OWN OS-level start time,
+    // captured NOW so a later scavenger can tell a genuinely-still-alive owner apart from a DIFFERENT
+    // process that merely reused this pid (isSameProcessInstance's own doc comment). Omitted entirely
+    // when unreadable (non-Linux, permission) — the scavenger then falls back to the plain alive+TTL
+    // check for this beacon, unchanged from before this residual hardening.
+    const ownProcStart = pidStartedAtMsFromProcStat(process.pid);
+    const procStartTag = ownProcStart !== undefined ? formatProcStart(ownProcStart) : '';
+    // Lead delta after Codex round 2 (HIGH-4): this beacon states its OWN expiry, so a concurrent
+    // probe with a different (shorter) budget can never out-vote this probe's protection window.
+    const expiresTag = formatProbeExpires(started + ttlMs);
     const beaconPattern = {
-        pattern: `${PROBE_PROMPT_WORDS} ${queryToken} — dz doctor / dz parity live-probe marker, safe to remove. probe-secret=${secretToken}`,
+        pattern: `${PROBE_PROMPT_WORDS} ${queryToken} — dz doctor / dz parity live-probe marker, safe to remove. probe-secret=${secretToken} ${ownerTag}${procStartTag}${expiresTag}`,
         type: 'lesson-learned',
         reward: 0,
         domain: PROBE_BEACON_DOMAIN,
@@ -1779,14 +2168,14 @@ export async function probeApplyLeg(root, opts = {}) {
     // Codex round-2: a process killed mid-probe bypasses `finally`, so a beacon can outlive its probe.
     // Every probe therefore starts by SCAVENGING any beacon left behind by an earlier one (the probe
     // domain is reserved for beacons, never for user lessons) — the store is clean before AND after.
-    try {
-        // a loaded pattern carries the STORE's own id (`dzId`); recomputing it from normalised fields
-        // (type/ts round-trip) can diverge, so the store id wins and the recomputation is the fallback.
-        const stale = loadStorePatternsSync(root).filter((p) => p.domain === PROBE_BEACON_DOMAIN).map((p) => p.dzId ?? patternRecordId(p));
-        if (stale.length > 0)
-            removeBeacon(root, new Set(stale));
-    }
-    catch { /* scavenging is best-effort; the probe's own cleanup below is the accountable path */ }
+    // FR-3/FR-4: scavenging is no longer unconditional — a LIVE beacon from a DIFFERENT concurrent
+    // probe (another session's `dz doctor`/`dz parity` against the same store) must survive; only a
+    // beacon whose owner is dead or past its TTL is removed. A scavenge failure is a named FACT
+    // (`scavengeError`), never a swallowed exception (the pre-fix `catch {}` this replaces).
+    let scavengeError;
+    const scavengeResult = scavengeStaleProbeBeacons(root, removeBeacon, ttlMs);
+    if (!scavengeResult.ok)
+        scavengeError = scavengeResult.error;
     try {
         wrote = true;
         let writeFailed;
@@ -1809,7 +2198,6 @@ export async function probeApplyLeg(root, opts = {}) {
             mkdirSync(join(tempCwd, '.dz'), { recursive: true });
             mkdirSync(join(tempCwd, '.claude'), { recursive: true });
             const { probeHookLiveness } = await import('./operations.js');
-            const timeoutMs = opts.timeoutMs ?? 8000;
             const probeResult = probeHookLiveness(command, JSON.stringify({ prompt: probePrompt }), {
                 cwd: tempCwd,
                 env: { ...(opts.env ?? {}), CLAUDE_PROJECT_DIR: tempCwd },
@@ -1829,13 +2217,13 @@ export async function probeApplyLeg(root, opts = {}) {
                 }
             }
             if (typeof additionalContext === 'string' && additionalContext.includes(secretToken)) {
-                result = { ok: true, elapsedMs: elapsed() };
+                result = { ok: true, elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
             }
             else if (typeof additionalContext === 'string' && additionalContext.includes(queryToken)) {
                 // AM-1: the QUERY came back but the SECRET did not — the hook (or a stub standing in for
                 // it) echoed its own input instead of genuinely querying the store. Named distinctly from
                 // every other red reason so a dead leg and a FAKING one never read the same.
-                result = { ok: false, reason: 'echo-not-injection', elapsedMs: elapsed() };
+                result = { ok: false, reason: 'echo-not-injection', elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
             }
             else {
                 // FR-1's own reason line is the authoritative source — the hook names itself why it stayed
@@ -1844,10 +2232,10 @@ export async function probeApplyLeg(root, opts = {}) {
                 const skipMatch = /\[dz-recall\] skipped reason=(\S+)/.exec(probeResult.stderr);
                 const skipReason = skipMatch?.[1];
                 if (skipReason !== undefined) {
-                    result = { ok: false, reason: skipReason, elapsedMs: elapsed() };
+                    result = { ok: false, reason: skipReason, elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
                 }
                 else if (probeResult.status === null) {
-                    result = { ok: false, reason: `probe did not complete (timeout or spawn error after ${timeoutMs} ms)`, elapsedMs: elapsed() };
+                    result = { ok: false, reason: `probe did not complete (timeout or spawn error after ${timeoutMs} ms)`, elapsedMs: elapsed(), groupKillAttempted: probeResult.groupKillAttempted };
                 }
                 else {
                     const stderrFirstLine = probeResult.stderr.trim().split('\n')[0];
@@ -1855,6 +2243,7 @@ export async function probeApplyLeg(root, opts = {}) {
                         ok: false,
                         reason: stderrFirstLine && stderrFirstLine !== '' ? stderrFirstLine : 'no beacon in additionalContext (empty or non-matching reply)',
                         elapsedMs: elapsed(),
+                        groupKillAttempted: probeResult.groupKillAttempted,
                     };
                 }
             }
@@ -1889,12 +2278,21 @@ export async function probeApplyLeg(root, opts = {}) {
         }
     }
     if (cleanupFailed) {
+        // a cleanup failure can only happen after `result` was assigned (the finally block runs after
+        // the try body) — carry the kill-attempt fact through rather than dropping it on this path.
+        // `exactOptionalPropertyTypes` forbids assigning `undefined` to an optional field explicitly, so
+        // the key is included only when `result.groupKillAttempted` actually has a value.
         return {
             ok: false,
             reason: `beacon-cleanup-failed: beacon ${beaconId} could not be removed (${cleanupErrMsg})`,
             elapsedMs: elapsed(),
+            ...(result.groupKillAttempted !== undefined ? { groupKillAttempted: result.groupKillAttempted } : {}),
+            ...(scavengeError !== undefined ? { scavengeError } : {}),
         };
     }
-    return result;
+    // FR-3: a scavenge failure is surfaced on the SUCCESS path too — it does not override `ok`/
+    // `reason` (this probe's own injection result may be perfectly genuine), but it is a fact a
+    // caller should not lose.
+    return scavengeError !== undefined ? { ...result, scavengeError } : result;
 }
 //# sourceMappingURL=apply-leg.js.map