@logicseek/hello-cc 1.0.4 → 1.0.5

package/CHANGELOG.md

@@ -16,6 +16,41 @@ the release description from the current changelog section. Use
 `npm run release:github` with `GH_TOKEN` or `GITHUB_TOKEN` only for local
 backfills.
 
+## 1.0.5
+
+### Summary
+
+macOS process identities use the kernel boot session UUID so changes to the
+reported boot time cannot make a running process appear to have been replaced.
+The issue was observed during post-release sustained acceptance of 1.0.4.
+
+### Highlights
+
+- Preserve process identity across changes to the wall-clock-derived boot time.
+- Keep live processes with an older Darwin identity format protected while their
+  ownership cannot be compared; a format change does not prove that an owner exited.
+- Retain strict process state, start time and zombie checks, with unknown results
+  when a stable boot session identifier cannot be read.
+- Keep the existing npm `latest` release channel.
+- Confirm the original local runtime has exited when its stop response is lost,
+  while preserving unknown owners and replacement runtime pointers.
+- Retain structured shutdown error codes when Node warnings share stderr.
+
+### Validation
+
+Targeted regression tests cover boot identity drift, boot-session changes,
+malformed observations and conservative handling of existing runtime ownership.
+Full source, package, current-device and sustained-run validation are recorded
+separately. The interrupted 1.0.4 sustained run remains a failed attempt.
+The first 1.0.5 candidate passed the current-Mac sustained check; a subsequent
+CI transport timeout exposed the separate stop-confirmation failure. Its
+targeted verification and replacement candidate retain separate evidence.
+
+Existing processes keep the implementation they started with. Quit and reopen
+Harness normally to activate the update. An older active owned runtime should
+finish and stop normally before it is reclaimed; do not force takeover based
+on an incompatible identity marker.
+
 ## 1.0.4
 
 ### Summary

package/docs/dsh.md

@@ -18,6 +18,8 @@ node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh web -- -
 
 Below, `hcc` means a CLI containing these changes. An older global installation may not include them.
 
+macOS 1.0.5 upgrades use a stable boot-session identity. Follow the [process identity migration notes](macos-process-identity.md) and restart owned runtimes normally.
+
 ## Choose An Entry Point
 
 | Entry | Use | Lifecycle owner |
@@ -113,7 +115,7 @@ Project overlays work directly from source. The managed manifest records the Cor
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.4.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.5.tgz
 ```
 
 Harness requires explicit approval for native dependency builds. If add returns `ERR_PNPM_IGNORED_BUILDS`, merge the following into the selected profile's `pnpm-workspace.yaml` and rerun the same add command. The default path is `~/.dsh/profiles/web/pnpm-workspace.yaml`; use the configured DSH_HOME when different. Preserve existing settings and approve only the candidate's pinned native dependency:

package/docs/dsh.zh-CN.md

@@ -18,6 +18,8 @@ node /absolute/path/to/hello-cc/bin/hcc.mjs --root /path/to/project dsh web -- -
 
 下文 `hcc` 指包含这些代码的 CLI。已有的全局 `hcc` 未必包含此接入。
 
+macOS 从 1.0.5 起使用稳定的启动周期标记。升级时按[进程身份迁移说明](macos-process-identity.md)正常重启所管理的运行时，保留身份无法比较的旧进程。
+
 ## 选择入口
 
 | 入口 | 适用场景 | 会话由谁持有 |
@@ -115,7 +117,7 @@ hcc native start --peer dsh-reviewer --provider dsh --binary /absolute/path/to/d
 
 ```bash
 npm pack --ignore-scripts
-dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.4.tgz
+dsh plugin --profile web add /absolute/path/to/logicseek-hello-cc-1.0.5.tgz
 ```
 
 Harness 的 pnpm 策略要求明确允许原生依赖构建。若首次 add 返回 `ERR_PNPM_IGNORED_BUILDS`，在所选 profile 的 `pnpm-workspace.yaml` 中合并以下配置，然后重跑同一 add 命令；默认位置是 `~/.dsh/profiles/web/pnpm-workspace.yaml`，自定义 DSH_HOME 时以该目录为准。保留文件中已有设置，只批准候选包使用的固定版本：

package/docs/macos-process-identity.md

@@ -0,0 +1,13 @@
+# macOS 进程身份与升级
+
+macOS 的 `kern.boottime` 是墙上时钟时间，同一次开机期间也可能因时钟校正改变。以它的秒、微秒字段识别进程，会把仍在运行的进程误判为新实例。
+
+Darwin 身份改为 `darwin:<kern.bootsessionuuid>:<UTC/C ps lstart>`。开机 UUID 严格验证并统一小写；缺失、查询失败或格式错误时返回 `unknown`，不会退回 `kern.boottime`。进程开始时间仍前后读取两次，状态中的 zombie 仍视为已退出。PID、进程开始时间和命令摘要的所有权校验没有放宽。
+
+旧版本保存的 `<boot 秒>:<boot 微秒>:<ps lstart>` 无法可靠转换成新标记。对同一存活 PID，旧、新格式之间返回 `unknown`，既不授予所有权，也不证明旧进程已经退出。其 runtime 指针不因超过普通未知状态宽限期而被回收；Cordis 恢复和 native 启动也必须保留仍存活的旧 owner。与真实进程退出或同格式 PID 复用有关的判定保持原有规则。
+
+这种专用 `unknown` 同样保留 peer/binding、过期锁和缓冲文件，阻止过期任务被接管；它不会赋予 `live` 身份、续租或写权限。普通未知状态的超时策略不变。
+
+升级前，先用原版本正常关闭所属 native worker/runtime，正常退出 Harness Desktop，再安装并启动新版本，使运行中的 owner 重新建立身份。保留账号配置、会话与协作数据库；不要手工改写旧身份、删除仍存活 runtime 的指针，或仅凭 PID 强行接管。若旧进程已经退出，OS 的死亡证据仍允许正常恢复。没有完整身份的其他未知状态继续使用原有策略。
+
+回归覆盖同一次开机期间 `kern.boottime` 漂移、不同 boot UUID、错误和缺失 UUID、PATH 缺失时的固定系统路径、语言环境、PID 复用、exec、真实自有 zombie，以及跨格式 runtime 指针、native 启动和 Cordis 恢复边界。

package/lib/cli/app.mjs

@@ -54,7 +54,8 @@ import { readPackageMeta } from '../package-meta.mjs';
 import { removeGuidanceBlocks as removeGuidanceBlocksForRoot, writeGuidance as writeGuidanceForRoot } from '../guidance.mjs';
 import { globalRuntimePath, runtimePath } from '../runtime/paths.mjs';
 import { readRuntime, reclaimRuntimePointerFiles } from '../runtime/state.mjs';
-import { waitForProcessIdentityExit } from '../process/identity.mjs';
+import { waitForProcessIdentityExit, inspectProcessIdentity, compareProcessIdentity } from '../process/identity.mjs';
+import { withFileLock } from '../shared/file-lock.mjs';
 
 import { runtimeRequest } from '../runtime/client.mjs';
 
@@ -319,7 +320,7 @@ const { cmdDown, cmdFindRoot, cmdWhichReal } = createMiscCommands({
   path, fs, process, CliError, parseOpts, printResult,
   readRuntime, runtimeRequest, runtimePath, globalRuntimePath,
   reclaimRuntimePointerFiles, helpDown, loadSetup,
-  waitForProcessIdentityExit,
+  waitForProcessIdentityExit, inspectProcessIdentity, compareProcessIdentity, withFileLock,
   PRODUCT_NAME
 });
 

package/lib/cli/commands/lock.mjs

@@ -2,6 +2,7 @@
 // Factory pattern with injected deps.
 
 import { readTx } from '../../db/schema.mjs';
+import { isPeerEvidenceCompatibilityProtected } from '../../core/peers/evidence.mjs';
 import {
   findRequestedLock,
   upsertRequestedLock,
@@ -101,7 +102,8 @@ export function createLockCommands(deps) {
                 !(Number(row.expires_at) <= t && evidenceByOwner.get(row.owner)?.state === 'dead'))
             : subject.locks.filter((row) =>
                 Number(row.expires_at) > t ||
-                evidenceByOwner.get(row.owner)?.state === 'live'
+                evidenceByOwner.get(row.owner)?.state === 'live' ||
+                isPeerEvidenceCompatibilityProtected(evidenceByOwner.get(row.owner))
               );
           const conflict = activeLocks.find((row) => locksConflict(row, requested) && row.owner !== peer);
           if (conflict) {

package/lib/cli/commands/misc.mjs

@@ -2,13 +2,56 @@
 
 export function createMiscCommands(deps) {
   const {
-    path, process, CliError, parseOpts, printResult,
+    path, fs, process, CliError, parseOpts, printResult,
     readRuntime, runtimeRequest, runtimePath, globalRuntimePath,
     reclaimRuntimePointerFiles, helpDown, loadSetup,
-    waitForProcessIdentityExit,
+    waitForProcessIdentityExit, inspectProcessIdentity, compareProcessIdentity, withFileLock,
     PRODUCT_NAME
   } = deps;
 
+  function sameStopPointer(left, right) {
+    return left.raw === right.raw && ['dev', 'ino', 'size', 'mtimeMs', 'ctimeMs']
+      .every((key) => left.stat[key] === right.stat[key]);
+  }
+
+  function readStopPointer(file) {
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error('invalid runtime pointer');
+    const raw = fs.readFileSync(file, 'utf8');
+    const current = fs.lstatSync(file);
+    if (current.isSymbolicLink() || !current.isFile() ||
+        !sameStopPointer({ raw, stat }, { raw, stat: current })) {
+      throw new Error('runtime pointer changed');
+    }
+    return { raw, stat };
+  }
+
+  function stopOwnerEvidence(runtime, pointerFiles) {
+    try {
+      if (runtime.source === 'env') return null;
+      const source = pointerFiles.find((file) => path.resolve(file) === path.resolve(runtime.source || ''));
+      const url = new URL(runtime.base_url);
+      if (!source || !['http:', 'https:'].includes(url.protocol) ||
+          !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)) return null;
+      const owner = runtime.process_identity || runtime.processIdentity;
+      if (Object.hasOwn(runtime, 'process_identity') && Object.hasOwn(runtime, 'processIdentity')) return null;
+      if (owner?.pid !== Number(runtime.pid) || compareProcessIdentity(owner, owner) !== 'live') return null;
+      const observed = inspectProcessIdentity(owner.pid);
+      if (observed.state !== 'live' || compareProcessIdentity(owner, observed.identity) !== 'live' ||
+          owner.commandHash !== observed.identity.commandHash) return null;
+      const pointer = readStopPointer(source);
+      const recorded = JSON.parse(pointer.raw);
+      if (Object.hasOwn(recorded, 'process_identity') && Object.hasOwn(recorded, 'processIdentity')) return null;
+      const recordedOwner = recorded.process_identity || recorded.processIdentity;
+      if (Number(recorded.pid) !== owner.pid ||
+          compareProcessIdentity(owner, recordedOwner) !== 'live' || owner.commandHash !== recordedOwner.commandHash ||
+          ['base_url', 'token', 'tls_ca_file'].some((key) => recorded[key] !== runtime[key])) return null;
+      return { source, owner, pointer };
+    } catch {
+      return null;
+    }
+  }
+
   async function cmdDown(ctx, args) {
     if (args[0] === '--help' || args[0] === '-h') return helpDown();
     const pointerFiles = [runtimePath(ctx), globalRuntimePath()];
@@ -23,17 +66,39 @@ export function createMiscCommands(deps) {
         `${PRODUCT_NAME} stale runtime pointer removed${result.pointers === 1 ? '' : 's'}`);
       return;
     }
+    const stopEvidence = stopOwnerEvidence(runtime, pointerFiles);
     try {
       await runtimeRequest(ctx, 'POST', '/api/runtime/stop', {}, runtime);
     } catch (err) {
       if (!(err instanceof CliError && err.code === 'RUNTIME_UNREACHABLE')) throw err;
-      if (runtime.source === 'env') throw err;
-      const source = path.resolve(String(runtime.source || ''));
-      const localSource = pointerFiles.find((file) => path.resolve(file) === source);
-      if (!localSource) throw err;
-      const cleanup = reclaimRuntimePointerFiles([localSource], { reclaimUnknown: false });
-      if (cleanup.reclaimed !== 1 || cleanup.blocked) throw err;
-      printResult(ctx, { runtime: localSource }, () => `${PRODUCT_NAME} stale runtime pointer removed`);
+      if (!stopEvidence) throw err;
+      const stopped = await waitForProcessIdentityExit(stopEvidence.owner, {
+        timeoutMs: 5_000,
+        intervalMs: 25
+      });
+      if (stopped.state !== 'dead') throw err;
+      let cleanup;
+      try {
+        cleanup = withFileLock(stopEvidence.source, (file) => {
+          let current;
+          try { current = readStopPointer(file); }
+          catch (error) {
+            if (error.code === 'ENOENT') return { reclaimed: 0, blocked: false };
+            throw error;
+          }
+          if (!sameStopPointer(stopEvidence.pointer, current)) throw err;
+          // Hold the pointer's existing lock across comparison and reclamation.
+          // A replacement owner must never be removed by this stop request.
+          return reclaimRuntimePointerFiles([file], {
+            reclaimUnknown: false,
+            withLock: (_file, operation) => operation(file)
+          });
+        }, { createParent: false });
+      } catch { throw err; }
+      if (cleanup.blocked || cleanup.reclaimed > 1) throw err;
+      printResult(ctx, { runtime: stopEvidence.source }, () => cleanup.reclaimed === 1
+        ? `${PRODUCT_NAME} stale runtime pointer removed`
+        : `${PRODUCT_NAME} runtime stopped`);
       return;
     }
     if (runtime.source !== 'env') {

package/lib/core/coordination/gc-plan.mjs

@@ -2,6 +2,7 @@ import { randomBytes } from 'node:crypto';
 
 import { readTx, tx } from '../../db/schema.mjs';
 import { aggregateCleanupFailure } from '../../shared/cleanup-error.mjs';
+import { isPeerEvidenceCompatibilityProtected } from '../peers/evidence.mjs';
 import { DURABLE_RUNTIME_EVENTS } from './event-retention.mjs';
 
 export const HISTORY_GC_BATCH_SIZE = 256;
@@ -59,6 +60,10 @@ export function finalizeGcLockSubjects(db, subjects, evidenceByOwner, options =
         result.live += 1;
         continue;
       }
+      if (isPeerEvidenceCompatibilityProtected(evidenceByOwner.get(owner))) {
+        result.deferred += 1;
+        continue;
+      }
       if (dryRun || deleteExactRow(db, 'locks', planned.lock)) result.deleted += 1;
       else result.deferred += 1;
     }

package/lib/core/coordination/locks.mjs

@@ -1,4 +1,5 @@
 import { CliError } from '../../shared/errors.mjs';
+import { isPeerEvidenceCompatibilityProtected } from '../peers/evidence.mjs';
 
 export const WHOLE_LOCK_SCOPE = '*';
 
@@ -87,5 +88,6 @@ export function visibleLocksWithEvidence(locks, nowSec, {
   evidenceByOwner = new Map()
 } = {}) {
   return (locks || []).filter((lock) => graceActive || Number(lock.expires_at) > nowSec ||
-    evidenceByOwner.get(lock.owner)?.state === 'live');
+    evidenceByOwner.get(lock.owner)?.state === 'live' ||
+    isPeerEvidenceCompatibilityProtected(evidenceByOwner.get(lock.owner)));
 }

package/lib/core/peers/evidence.mjs

@@ -1,18 +1,26 @@
-import { compareProcessIdentity } from '../../process/identity.mjs';
+import { compareProcessIdentity, isProcessIdentityIncompatible } from '../../process/identity.mjs';
 
 const DEFAULT_ACTIVE_PEER_TTL = 600;
+const INCOMPATIBLE_PROCESS_REASON = 'process_identity_incompatible';
+
+export function isPeerEvidenceCompatibilityProtected(evidence = {}) {
+  return evidence.state === 'unknown' && evidence.reason === INCOMPATIBLE_PROCESS_REASON;
+}
 
 export function classifyPeerActivity(peer = {}, options = {}) {
   const activePeerTtl = Number(options.activePeerTtl ?? DEFAULT_ACTIVE_PEER_TTL);
   const graceActive = Boolean(options.graceActive);
   const evidenceState = peer.evidence_state || peer.evidence?.state || 'unknown';
+  const evidenceReason = peer.evidence_reason || peer.evidence?.reason;
   const age = Number(peer.age_sec);
   const active = evidenceState === 'live' ||
+    isPeerEvidenceCompatibilityProtected({ state: evidenceState, reason: evidenceReason }) ||
     (evidenceState !== 'dead' && (graceActive || (Number.isFinite(age) && age <= activePeerTtl)));
   return { active, stale: !active };
 }
 
 export function peerEvidenceAllowsReap(evidence = {}, options = {}) {
+  if (isPeerEvidenceCompatibilityProtected(evidence)) return false;
   if (evidence.state === 'dead') return true;
   if (evidence.state !== 'unknown') return false;
   const nowSec = Number(options.nowSec);
@@ -37,6 +45,9 @@ function processState(evidence) {
   if (evidence.current?.state === 'unknown') return 'unknown';
   if (evidence.current?.state === 'dead') return 'dead';
   if (evidence.current?.state !== 'live') return 'unknown';
+  if (isProcessIdentityIncompatible(evidence.storedIdentity, evidence.current.identity)) {
+    return 'incompatible';
+  }
   return compareProcessIdentity(evidence.storedIdentity, evidence.current.identity);
 }
 
@@ -48,6 +59,9 @@ function aggregateProcesses(processes) {
   if (states.includes('live')) {
     return { state: 'live', reason: 'process_identity_match' };
   }
+  if (states.includes('incompatible')) {
+    return { state: 'unknown', reason: INCOMPATIBLE_PROCESS_REASON };
+  }
   if (states.every((state) => state === 'dead')) {
     const missing = processes.every((item) => item?.current?.state === 'dead');
     return {
@@ -81,8 +95,14 @@ function tmuxVerifiedLive(tmux) {
 export function resolvePeerEvidence(input = {}) {
   const ordinaryProcess = aggregateProcesses(input.processes);
   if (ordinaryProcess.state === 'live') return ordinaryProcess;
+  // A live PID with incomparable Darwin generations proves neither ownership
+  // nor exit. Retain that distinction through persisted status and TTL gates.
+  if (isPeerEvidenceCompatibilityProtected(ordinaryProcess)) return ordinaryProcess;
 
   const tmux = input.tmux?.managed ? input.tmux : null;
+  if (ordinaryProcess.state === 'unknown' && tmux && tmuxProcessState(tmux) === 'incompatible') {
+    return { state: 'unknown', reason: INCOMPATIBLE_PROCESS_REASON };
+  }
   if (ordinaryProcess.state === 'unknown' && tmux && tmuxVerifiedLive(tmux)) {
     return { state: 'live', reason: 'tmux_identity_match' };
   }

package/lib/core/peers/tmux-safety.mjs

@@ -1,6 +1,7 @@
 import { compareProcessIdentity } from '../../process/identity.mjs';
 import { tx } from '../../db/schema.mjs';
 import { CliError } from '../../shared/errors.mjs';
+import { isPeerEvidenceCompatibilityProtected } from './evidence.mjs';
 
 function completeIdentity(identity) {
   return Boolean(
@@ -84,6 +85,9 @@ export function validateTmuxGcBindingEvidence(subject = {}, observed = {}, optio
   if (subject.owner_evidence?.state === 'live') {
     return { ok: false, reason: 'tmux_owner_process_live' };
   }
+  if (isPeerEvidenceCompatibilityProtected(subject.owner_evidence)) {
+    return { ok: false, reason: 'tmux_owner_process_incompatible' };
+  }
 
   const dead = validateTmuxGcDeadProcessEvidence(authority, observed, options);
   if (dead.ok) return { ok: true, mode: 'dead_process' };

package/lib/integrations/dsh-collaboration.mjs

@@ -16,7 +16,7 @@ import { createCoordinationState } from '../coordination-state.mjs';
 import { createScopedMcpTools } from '../mcp/tools.mjs';
 import { resolveProjectDatabase } from '../runtime/project-path.mjs';
 import { registerProjectActivity } from '../runtime/projects.mjs';
-import { inspectProcessIdentity } from '../process/identity.mjs';
+import { compareProcessIdentity, inspectProcessIdentity } from '../process/identity.mjs';
 
 const fail = (message) => { throw new CliError('DSH_COLLABORATION_CONFLICT', message); };
 
@@ -29,9 +29,8 @@ function verifiedDeadOwner(peer) {
   // A recycled PID has a different start token. A changed command alone does
   // not prove the original process exited (a live process may change its title).
   return observed.state === 'live' && observed.identity?.pid === peer.pid &&
-    typeof observed.identity.startToken === 'string' &&
-    typeof observed.identity.commandHash === 'string' && /^[a-f0-9]{64}$/.test(observed.identity.commandHash) &&
-    observed.identity.startToken !== peer.pid_start_token;
+    compareProcessIdentity({ pid: peer.pid, startToken: peer.pid_start_token,
+      commandHash: peer.pid_command_hash }, observed.identity) === 'dead';
 }
 
 // One in-process authority per Agent. All mutations still go through the same

package/lib/process/identity.mjs

@@ -84,17 +84,20 @@ function run(command, args, environment) {
   return spawnSync(command, args, options);
 }
 
+const MAC_BOOT_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
 function parseMacBootToken(text) {
-  const match = String(text ?? '').match(
-    /^\s*\{\s*sec\s*=\s*(\d+)\s*,\s*usec\s*=\s*(\d+)\s*\}/
-  );
-  if (!match) return null;
+  const uuid = String(text ?? '').trim();
+  return MAC_BOOT_UUID.test(uuid) ? uuid.toLowerCase() : null;
+}
 
-  const seconds = BigInt(match[1]);
-  const microseconds = Number(match[2]);
-  if (seconds <= 0n || !Number.isInteger(microseconds) ||
-      microseconds < 0 || microseconds > 999999) return null;
-  return `${seconds}:${microseconds}`;
+function macTokenFormat(token) {
+  const start = '(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) [A-Z][a-z]{2}\\s+\\d{1,2} \\d{2}:\\d{2}:\\d{2} \\d{4}';
+  const legacy = new RegExp(`^(\\d+):(\\d+):${start}$`).exec(token);
+  if (legacy && BigInt(legacy[1]) > 0n && Number(legacy[2]) >= 0 && Number(legacy[2]) <= 999999) return 'legacy-wall-clock';
+  const current = /^darwin:([^:]+):(.+)$/.exec(token);
+  if (current && MAC_BOOT_UUID.test(current[1]) && new RegExp(`^${start}$`).test(current[2])) return 'boot-session';
+  return null;
 }
 
 function parseMacStateStart(text) {
@@ -106,9 +109,11 @@ function parseMacStateStart(text) {
 
 function macObservation(pid) {
   const unknown = { state: 'unknown', identity: null };
-  let boot = run('sysctl', ['-n', 'kern.boottime']);
+  // kern.boottime is a wall-clock timestamp and can change during one boot.
+  // The boot-session UUID remains stable across those clock corrections.
+  let boot = run('sysctl', ['-n', 'kern.bootsessionuuid']);
   // Launchers often omit /usr/sbin from PATH; macOS still provides sysctl here.
-  if (boot.error?.code === 'ENOENT') boot = run('/usr/sbin/sysctl', ['-n', 'kern.boottime']);
+  if (boot.error?.code === 'ENOENT') boot = run('/usr/sbin/sysctl', ['-n', 'kern.bootsessionuuid']);
   if (boot.error || boot.status !== 0) return unknown;
   const bootToken = parseMacBootToken(boot.stdout);
   if (!bootToken) return unknown;
@@ -140,7 +145,7 @@ function macObservation(pid) {
     state: 'live',
     identity: {
       pid,
-      startToken: `${bootToken}:${parsed.startToken}`,
+      startToken: `darwin:${bootToken}:${parsed.startToken}`,
       commandHash: hashCommand(parsed.command)
     }
   };
@@ -187,10 +192,9 @@ export async function waitForProcessIdentityExit(value, options = {}) {
     const observed = inspect(pid);
     if (observed?.state === 'dead') return { state: 'dead', identity: null };
     if (observed?.state === 'live' && isCompleteIdentity(observed.identity)) {
-      if (storedIdentity && compareProcessIdentity(storedIdentity, observed.identity) === 'dead') {
-        return { state: 'dead', identity: null };
-      }
-      lastObservation = observed;
+      const comparison = storedIdentity ? compareProcessIdentity(storedIdentity, observed.identity) : 'live';
+      if (comparison === 'dead') return { state: 'dead', identity: null };
+      lastObservation = comparison === 'live' ? observed : { state: 'unknown', identity: null };
     } else {
       lastObservation = { state: 'unknown', identity: null };
     }
@@ -238,8 +242,19 @@ export function inspectProcessIdentity(value) {
   return { state: 'live', identity };
 }
 
+export function isProcessIdentityIncompatible(stored, current) {
+  if (!isCompleteIdentity(stored) || !isCompleteIdentity(current) || stored.pid !== current.pid) return false;
+  const storedFormat = macTokenFormat(stored.startToken), currentFormat = macTokenFormat(current.startToken);
+  return Boolean(storedFormat && currentFormat && storedFormat !== currentFormat);
+}
+
 export function compareProcessIdentity(stored, current) {
   if (!isCompleteIdentity(stored) || !isCompleteIdentity(current)) return 'unknown';
-  return stored.pid === current.pid &&
-    stored.startToken === current.startToken ? 'live' : 'dead';
+  if (stored.pid !== current.pid) return 'dead';
+  if (stored.startToken === current.startToken) return 'live';
+  // An upgrade cannot translate wall-clock boot evidence to a boot UUID.
+  // Preserve a still-present legacy owner until it exits normally; a format
+  // change proves neither ownership nor process exit.
+  if (isProcessIdentityIncompatible(stored, current)) return 'unknown';
+  return 'dead';
 }

package/lib/runtime/buffer-evidence.mjs

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { performance } from 'node:perf_hooks';
 
-import { resolvePeerEvidence } from '../core/peers/evidence.mjs';
+import { isPeerEvidenceCompatibilityProtected, resolvePeerEvidence } from '../core/peers/evidence.mjs';
 import { inspectProcessIdentity } from '../process/identity.mjs';
 
 function canonicalDirectories(values) {
@@ -261,6 +261,9 @@ export function collectBufferEvidence({
       if (evidence.state === 'live') {
         recordKnownEvidence(unknownTracker, file, 'live', monotonicNowMs);
         addExternalGroup(protectedPaths, directory, id);
+      } else if (isPeerEvidenceCompatibilityProtected(evidence)) {
+        recordKnownEvidence(unknownTracker, file, 'incompatible', monotonicNowMs);
+        addExternalGroup(protectedPaths, directory, id);
       } else if (evidence.state === 'unknown' &&
           boundedUnknown(file, { nowMs, monotonicNowMs, unknownGraceMs, unknownTracker, gcCutoffs })) {
         addExternalGroup(unknownPaths, directory, id);
@@ -302,6 +305,9 @@ export function collectBufferEvidence({
         if (evidence.state === 'live') {
           recordKnownEvidence(unknownTracker, file, 'live', monotonicNowMs);
           protectedPaths.add(file);
+        } else if (isPeerEvidenceCompatibilityProtected(evidence)) {
+          recordKnownEvidence(unknownTracker, file, 'incompatible', monotonicNowMs);
+          protectedPaths.add(file);
         } else if (evidence.state === 'unknown' &&
             boundedUnknown(file, { nowMs, monotonicNowMs, unknownGraceMs, unknownTracker, gcCutoffs })) {
           unknownPaths.add(file);

package/lib/runtime/state.mjs

@@ -50,7 +50,11 @@ export function classifyRuntimePointer(runtime, {
   if (current?.state !== 'live' || !completeProcessIdentity(current.identity)) {
     return { state: 'unknown', reclaimable: ageMs >= unknownGraceMs };
   }
-  return compareProcessIdentity(stored, current.identity) === 'live'
+  const comparison = compareProcessIdentity(stored, current.identity);
+  // A live PID observed with an incompatible identity format is not an aged
+  // missing/unknown owner. In particular, do not reap a pre-upgrade Mac owner.
+  if (comparison === 'unknown') return { state: 'unknown', reclaimable: false };
+  return comparison === 'live'
     ? { state: 'alive', reclaimable: false }
     : { state: 'dead', reclaimable: true };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logicseek/hello-cc",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Local control plane for coordinating Claude Code, Codex, and other coding CLI sessions.",
   "type": "module",
   "bin": {

package/scripts/regression.mjs

@@ -158,9 +158,50 @@ export async function waitForFixtureOwnerExit(owner, timeoutMs, {
   }
 }
 
+function fixtureErrorPayload(output) {
+  const lines = String(output || '').split(/\r?\n/);
+  let start = null, standalone = false, quoted = false, escaped = false;
+  const stack = [];
+  for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+    const line = lines[lineIndex];
+    for (let offset = 0; offset < line.length; offset += 1) {
+      const char = line[offset];
+      if (start === null) {
+        if (char !== '{' && char !== '[') continue;
+        start = lineIndex;
+        standalone = line.slice(0, offset).trim() === '';
+      }
+      if (quoted) {
+        if (escaped) escaped = false;
+        else if (char === '\\') escaped = true;
+        else if (char === '"') quoted = false;
+        continue;
+      }
+      if (char === '"') quoted = true;
+      else if (char === '{' || char === '[') stack.push(char);
+      else if (char === '}' || char === ']') {
+        if (stack.pop() !== (char === '}' ? '{' : '[')) return null;
+        if (stack.length) continue;
+        // Consume arrays and prefixed JSON blocks as a unit, so their nested
+        // objects can never masquerade as independent CLI error documents.
+        if (standalone && line.slice(offset + 1).trim() === '') {
+          try {
+            const parsed = JSON.parse(lines.slice(start, lineIndex + 1).join('\n'));
+            if (parsed && !Array.isArray(parsed) && parsed.error &&
+                typeof parsed.error === 'object' && !Array.isArray(parsed.error)) return parsed;
+          } catch {}
+        }
+        start = null;
+      }
+    }
+  }
+  return null;
+}
+
 export function fixtureDownResult(result) {
-  let payload = null;
-  try { payload = JSON.parse(result.stdout || ''); } catch {}
+  // Public --json failures share stderr with Node warnings. Accept only whole
+  // independent JSON objects; ordinary output never enters the diagnostic.
+  const payload = fixtureErrorPayload(result.stdout) || fixtureErrorPayload(result.stderr);
   const extra = payload?.error?.extra || payload?.error || {};
   const code = payload?.error?.code || result.error?.code;
   const numeric = ['pid', 'elapsedMs', 'timeoutMs'];