@phnx-labs/agents-cli 1.22.111 → 1.22.113

package/dist/lib/session/discover.js

@@ -823,7 +823,8 @@ function collectChangedFilesInLeafDirs(leafDirs, ext) {
                 let hot = isLiveRoot;
                 if (!hot && stamps) {
                     const s = stamps.get(filePath);
-                    hot = s?.scannedAt !== undefined && now - s.scannedAt <= HOT_FILE_WINDOW_MS;
+                    hot = s?.extractorVersion !== CONTENT_INDEX_VERSION
+                        || (s?.scannedAt !== undefined && now - s.scannedAt <= HOT_FILE_WINDOW_MS);
                 }
                 if (!hot)
                     continue;
@@ -3884,7 +3885,11 @@ function applyCodexLine(state, parsed) {
     }
     if (parsed.type === 'session_meta') {
         const payload = parsed.payload || {};
-        state.sessionId = payload.id || state.sessionId;
+        // Native forks prepend child ownership before inherited parent metadata.
+        // The first valid identity owns this file in both full and resumed scans.
+        if (state.sessionId || typeof payload.id !== 'string' || !payload.id.trim())
+            return;
+        state.sessionId = payload.id;
         state.timestamp = payload.timestamp || parsed.timestamp || state.timestamp;
         state.cwd = payload.cwd || state.cwd;
         state.gitBranch = payload.git?.branch || state.gitBranch;

package/dist/lib/session/hook-sessions.d.ts

@@ -1,3 +1,4 @@
+import { type PidSessionEntry } from './pid-registry.js';
 /** The subset of the hook's on-disk record this reader relies on. Extra fields are ignored. */
 export interface HookSessionRecord {
     session_id: string;
@@ -7,6 +8,7 @@ export interface HookSessionRecord {
     launch_id?: string;
     terminal_id?: string;
     ts?: number;
+    completed?: boolean;
 }
 /** Pre-built lookup maps over one scan of the hook state dir. */
 export interface HookSessionIndex {
@@ -23,6 +25,14 @@ export interface HookSessionIndex {
  * Unix SECONDS (the hook stamps `date +%s`); `startedAtMs` is millis.
  */
 export declare function readStateSessionRecord(pid: number, startedAtMs?: number): HookSessionRecord | undefined;
+/** Capture ownership while the launched wrapper is alive. The deployed hook
+ * walks ancestors to this registry entry and preserves these launcher fields. */
+export declare function captureLaunchBinding(pid: number | undefined, launchId: string): PidSessionEntry | undefined;
+/** Completion consumes the hook's launcher-keyed registry update, never a
+ * numeric-PID metadata guess. The hook PID can be any descendant of the wrapper.
+ * Ownership was measured before exit; matching the unique launch and preserved
+ * start timestamp prevents a reused slot from supplying another run's id. */
+export declare function recordCompletedLaunch(binding: PidSessionEntry | undefined): void;
 /**
  * Scan the hook state dir once and index every record by launch_id, terminal_id,
  * and pid. Returns empty maps if the dir is absent. Newest-by-`ts` wins a key

package/dist/lib/session/hook-sessions.js

@@ -19,7 +19,8 @@
  * NOT import the session-tracker package (a separate, workspace-less package;
  * see packages/session-tracker/CLAUDE.md) — mirroring AGI EXT's own
  * hand-copied reader in apps/ext/src/core/liveSession.ts. It only READS the
- * existing dir/schema; it never writes or moves anything, so it is safe across a
+ * existing dir/schema. The owning launcher also records a completed launch
+ * binding in that schema before returning; readers remain read-only across a
  * fleet where old hooks and a new CLI coexist.
  *
  * The whole state dir is scanned ONCE per active-scan into an index (the listing
@@ -27,8 +28,13 @@
  * re-scan per candidate.
  */
 import fs from 'fs';
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { atomicWriteFileSync } from '../fs-atomic.js';
+import { hostProcessView } from './process-view.js';
 import path from 'path';
 import { getTerminalsDir, getRuntimeStateDir } from '../state.js';
+import { listPidSessionEntries, pidSessionEntryMatchesLiveProcess, readLivePidSessionEntry, readPidSessionEntry } from './pid-registry.js';
 function hookSessionsDir() {
     // Sibling of the pid-registry's by-pid/ dir. The hook hardcodes this same path
     // (packages/session-tracker/src/hook.sh); we read it, never move it.
@@ -97,6 +103,98 @@ function keepNewest(map, key, rec) {
     if (!prev || (rec.ts ?? 0) > (prev.ts ?? 0))
         map.set(key, rec);
 }
+let clockTicks;
+/** Recover an already-running launch after an old reader removed its registry.
+ * Enumerate live PIDs, not the hook's unbounded graveyard. Only decode the one
+ * allowed environment key; no unrelated environment value escapes this reader.
+ * Kernel incarnation and namespace are checked on both sides of the reads. */
+function liveUnregisteredHookRecords() {
+    const scope = hostProcessView();
+    if (process.platform !== 'linux' || !scope?.pidNamespace)
+        return [];
+    try {
+        clockTicks ??= Number(execFileSync('getconf', ['CLK_TCK'], { encoding: 'utf8', timeout: 1000 }));
+        if (!Number.isFinite(clockTicks) || clockTicks <= 0)
+            return [];
+        const bootSeconds = Number(fs.readFileSync('/proc/stat', 'utf8').match(/^btime (\d+)$/m)?.[1]);
+        if (!Number.isFinite(bootSeconds))
+            return [];
+        const result = [];
+        const identity = (pid) => {
+            if (fs.readlinkSync(`/proc/${pid}/ns/pid`) !== scope.pidNamespace)
+                return undefined;
+            const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+            const fields = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+            return fields[0] !== 'Z' && /^\d+$/.test(fields[19]) ? fields[19] : undefined;
+        };
+        const prefix = Buffer.from('AGENT_LAUNCH_ID=');
+        for (const name of fs.readdirSync('/proc')) {
+            if (!/^\d+$/.test(name))
+                continue;
+            const pid = Number(name);
+            try {
+                if (!fs.existsSync(stateSessionRecordPath(pid)))
+                    continue;
+                const before = identity(pid);
+                if (!before)
+                    continue;
+                const rec = readStateSessionRecord(pid);
+                const startedSeconds = bootSeconds + Number(before) / clockTicks;
+                if (!rec || rec.pid !== pid || typeof rec.ts !== 'number'
+                    || rec.ts < Math.floor(startedSeconds) || rec.ts > Date.now() / 1000)
+                    continue;
+                const environment = fs.readFileSync(`/proc/${pid}/environ`);
+                let launchId;
+                for (let start = 0; start < environment.length;) {
+                    const end = environment.indexOf(0, start);
+                    const limit = end < 0 ? environment.length : end;
+                    if (environment.subarray(start, start + prefix.length).equals(prefix)) {
+                        launchId = environment.subarray(start + prefix.length, limit).toString('utf8').trim();
+                        break;
+                    }
+                    start = limit + 1;
+                }
+                if (!launchId || launchId.length > 512 || /[\x00-\x20]/.test(launchId)
+                    || (rec.launch_id && rec.launch_id !== launchId) || identity(pid) !== before)
+                    continue;
+                result.push({ ...rec, launch_id: launchId });
+            }
+            catch { /* exited, inaccessible, or procfs raced: unknown, never prune */ }
+        }
+        return result;
+    }
+    catch {
+        return [];
+    }
+}
+/** Capture ownership while the launched wrapper is alive. The deployed hook
+ * walks ancestors to this registry entry and preserves these launcher fields. */
+export function captureLaunchBinding(pid, launchId) {
+    if (!pid)
+        return undefined;
+    const entry = readLivePidSessionEntry(pid);
+    return entry?.launchId === launchId ? structuredClone(entry) : undefined;
+}
+/** Completion consumes the hook's launcher-keyed registry update, never a
+ * numeric-PID metadata guess. The hook PID can be any descendant of the wrapper.
+ * Ownership was measured before exit; matching the unique launch and preserved
+ * start timestamp prevents a reused slot from supplying another run's id. */
+export function recordCompletedLaunch(binding) {
+    if (!binding?.launchId || !hostProcessView())
+        return;
+    const entry = readPidSessionEntry(binding.pid);
+    if (!entry?.sessionId || entry.pid !== binding.pid || entry.launchId !== binding.launchId
+        || entry.startedAtMs !== binding.startedAtMs || entry.agent !== binding.agent)
+        return;
+    const rec = { session_id: entry.sessionId, pid: entry.pid, agent: entry.agent,
+        launch_id: binding.launchId, terminal_id: binding.terminalId, ts: Date.now() / 1000, completed: true };
+    try {
+        fs.mkdirSync(hookSessionsDir(), { recursive: true });
+        const name = createHash('sha256').update(binding.launchId).digest('hex');
+        atomicWriteFileSync(path.join(hookSessionsDir(), `launch-${name}.json`), JSON.stringify(rec), 'utf8');
+    }
+    catch { /* completion must preserve the child exit status */ }
+}
 /**
  * Scan the hook state dir once and index every record by launch_id, terminal_id,
  * and pid. Returns empty maps if the dir is absent. Newest-by-`ts` wins a key
@@ -111,7 +209,7 @@ export function loadHookSessionIndex() {
         files = fs.readdirSync(hookSessionsDir()).filter(f => f.endsWith('.json'));
     }
     catch {
-        return { byLaunchId, byTerminalId, byPid };
+        files = [];
     }
     for (const f of files) {
         let rec;
@@ -123,13 +221,47 @@ export function loadHookSessionIndex() {
         }
         if (!rec)
             continue;
-        if (typeof rec.pid === 'number')
+        if (!rec.completed && typeof rec.pid === 'number')
             keepNewest(byPid, rec.pid, rec);
         if (rec.launch_id)
             keepNewest(byLaunchId, rec.launch_id, rec);
-        if (rec.terminal_id)
+        if (!rec.completed && rec.terminal_id)
             keepNewest(byTerminalId, rec.terminal_id, rec);
     }
+    // Deployed legacy hooks contain only a pid/session id. Join their targeted
+    // records with launch facts instead of requiring a terminal_id they never
+    // wrote. This is read-only: an observer cannot infer host PID liveness.
+    for (const entry of listPidSessionEntries()) {
+        if (!entry.launchId || pidSessionEntryMatchesLiveProcess(entry) !== true)
+            continue;
+        const rec = entry.sessionId
+            ? { session_id: entry.sessionId, pid: entry.pid, ts: entry.startedAtMs / 1000, agent: entry.agent }
+            : readStateSessionRecord(entry.pid, entry.startedAtMs);
+        if (!rec || !kindMatches(rec.agent, entry.agent))
+            continue;
+        if (rec.launch_id && rec.launch_id !== entry.launchId)
+            continue;
+        const joined = { ...rec, agent: rec.agent ?? entry.agent, launch_id: entry.launchId, terminal_id: entry.terminalId };
+        if (!byLaunchId.has(entry.launchId))
+            byLaunchId.set(entry.launchId, joined);
+        if (!byPid.has(entry.pid))
+            byPid.set(entry.pid, joined);
+        if (entry.terminalId && !byTerminalId.has(entry.terminalId))
+            byTerminalId.set(entry.terminalId, joined);
+    }
+    const recovered = new Map();
+    for (const rec of liveUnregisteredHookRecords()) {
+        if (!byPid.has(rec.pid))
+            byPid.set(rec.pid, rec);
+        const previous = recovered.get(rec.launch_id);
+        // Inherited launch metadata cannot disambiguate two different native
+        // sessions. Keep their exact PID identities but refuse the ambiguous join.
+        recovered.set(rec.launch_id, previous === null || (previous && previous.session_id !== rec.session_id) ? null : rec);
+    }
+    for (const [launchId, rec] of recovered) {
+        if (rec && !byLaunchId.has(launchId))
+            byLaunchId.set(launchId, rec);
+    }
     return { byLaunchId, byTerminalId, byPid };
 }
 /**
@@ -156,13 +288,14 @@ function kindMatches(recordAgent, kind) {
  */
 export function resolveHookSessionRecord(index, opts) {
     const { pid, kind, launchId, terminalId, childPids } = opts;
-    const take = (rec) => rec?.session_id && kindMatches(rec.agent, kind) ? rec : undefined;
+    const take = (rec) => rec?.session_id && kindMatches(rec.agent, kind)
+        && (!launchId || !rec.launch_id || rec.launch_id === launchId) ? rec : undefined;
     if (launchId) {
         const hit = take(index.byLaunchId.get(launchId));
         if (hit)
             return hit;
     }
-    if (terminalId) {
+    if (terminalId && !launchId) {
         const hit = take(index.byTerminalId.get(terminalId));
         if (hit)
             return hit;

package/dist/lib/session/pid-registry.d.ts

@@ -49,7 +49,17 @@ export interface PidSessionEntry {
      */
     tmuxPane?: string;
     startedAtMs: number;
+    /** Kernel provenance, captured by the writer; absent on legacy records. */
+    processIdentity?: {
+        bootId?: string;
+        pidNamespace?: string;
+        initStartTicks?: string;
+        startTicks?: string;
+        startTime?: string;
+    };
 }
+/** Read-only identity proof for exact joins. Unknown is never a positive match. */
+export declare function pidSessionEntryMatchesLiveProcess(entry: PidSessionEntry): boolean | undefined;
 export declare function isSessionIdShape(value: string): boolean;
 export declare function extractSessionIdArg(args: string[]): string | undefined;
 /**
@@ -76,6 +86,8 @@ export declare function sessionIdFromLivePid(pid: number): string | undefined;
 export declare function writePidSessionEntry(entry: PidSessionEntry): void;
 /** Look up a live pid's recorded session. Returns undefined if absent/corrupt. */
 export declare function readPidSessionEntry(pid: number): PidSessionEntry | undefined;
+/** Live consumers require identity proof; raw history is not a PID binding. */
+export declare function readLivePidSessionEntry(pid: number): PidSessionEntry | undefined;
 /**
  * Every recorded launch, one entry per live-or-dead pid. Used to index launches
  * by their `tmuxPane` so the authoritative tmux source can attribute a pane it did
@@ -87,9 +99,10 @@ export declare function listPidSessionEntries(): PidSessionEntry[];
 /**
  * Remove entries whose pid is no longer alive. Best-effort housekeeping.
  *
- * `isAlive` receives the entry's recorded `startedAtMs` so it can reject a pid
- * that a newer process recycled (a "zombie" registry entry), not just one that
- * no longer exists. An unreadable/corrupt entry falls back to the pid-only
- * check.
+ * Linux deletion requires the writer's boot and PID namespace to match our own
+ * trustworthy proc view. ESRCH in another namespace says nothing about the
+ * recorded process. Legacy/corrupt/unreadable ownership is unknown, never dead.
+ * Kernel start ticks reject PID reuse without wall-clock heuristics. Other
+ * platforms retain the caller's start-time check after checking kernel liveness.
  */
-export declare function prunePidSessionRegistry(isAlive: (pid: number, startedAtMs?: number) => boolean): void;
+export declare function prunePidSessionRegistry(isAlive?: (pid: number, startedAtMs?: number) => boolean | undefined): void;

package/dist/lib/session/pid-registry.js

@@ -19,7 +19,69 @@
 import fs from 'fs';
 import path from 'path';
 import { execFileSync } from 'child_process';
+import { hostProcessView, writerProcessView } from './process-view.js';
 import { getTerminalsDir } from '../state.js';
+import { atomicWriteFileSync, withFileLock } from '../fs-atomic.js';
+function linuxStartTicks(pid) {
+    try {
+        const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
+        // comm (field 2) may contain spaces or parentheses; starttime is field 22.
+        const value = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+        return value && /^\d+$/.test(value) ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function pidExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ESRCH')
+            return false;
+        if (code === 'EPERM')
+            return true;
+        return undefined;
+    }
+}
+function darwinStartTime(pid) {
+    try {
+        return execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', timeout: 2000, stdio: ['ignore', 'pipe', 'ignore'] }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read-only identity proof for exact joins. Unknown is never a positive match. */
+export function pidSessionEntryMatchesLiveProcess(entry) {
+    if (!Number.isInteger(entry.pid) || entry.pid < 1)
+        return undefined;
+    if (process.platform === 'darwin') {
+        const exists = pidExists(entry.pid);
+        if (exists !== true)
+            return exists;
+        const start = darwinStartTime(entry.pid);
+        return start && entry.processIdentity?.startTime ? start === entry.processIdentity.startTime : undefined;
+    }
+    if (process.platform !== 'linux')
+        return undefined;
+    const scope = hostProcessView();
+    if (!scope || entry.processIdentity?.bootId !== scope.bootId
+        || entry.processIdentity?.pidNamespace !== scope.pidNamespace
+        || entry.processIdentity?.initStartTicks !== scope.initStartTicks)
+        return undefined;
+    const exists = pidExists(entry.pid);
+    if (exists !== true)
+        return exists;
+    const start = linuxStartTicks(entry.pid);
+    const recordedStart = entry.processIdentity?.startTicks;
+    if (!start || typeof recordedStart !== 'string' || !/^\d+$/.test(recordedStart))
+        return undefined;
+    return start === recordedStart;
+}
 /**
  * Pull an explicit `--session-id <uuid>` (or `--session-id=<uuid>`) out of a
  * raw agent arg vector. The transparent shim forwards args untouched, but when
@@ -106,13 +168,46 @@ function pidRegistryDir() {
 function entryPath(pid) {
     return path.join(pidRegistryDir(), `${pid}.json`);
 }
+// The deployed SessionStart hook reconstructs by-pid entries from an allowlist.
+// Keep launcher ownership separately, bound to the immutable launch coordinates.
+function ownershipPath(pid) {
+    return path.join(getTerminalsDir(), 'by-pid-ownership', `${pid}.json`);
+}
+function persistOwnership(entry) {
+    fs.mkdirSync(path.dirname(ownershipPath(entry.pid)), { recursive: true });
+    atomicWriteFileSync(ownershipPath(entry.pid), JSON.stringify(entry), 'utf8');
+}
+function restoreOwnership(entry) {
+    if (entry.processIdentity)
+        return entry;
+    try {
+        const owner = JSON.parse(fs.readFileSync(ownershipPath(entry.pid), 'utf8'));
+        if (owner.pid === entry.pid && owner.launchId === entry.launchId && owner.startedAtMs === entry.startedAtMs) {
+            return { ...entry, processIdentity: owner.processIdentity };
+        }
+    }
+    catch { /* legacy launch */ }
+    return entry;
+}
 /** Record a launched agent process. Never throws — the registry is an optimization. */
 export function writePidSessionEntry(entry) {
-    if (!entry.pid || entry.pid < 1)
+    if (!Number.isInteger(entry.pid) || entry.pid < 1)
         return;
     try {
+        const scope = process.platform === 'linux' ? writerProcessView() : undefined;
+        if (process.platform === 'linux' && !scope)
+            return;
         fs.mkdirSync(pidRegistryDir(), { recursive: true });
-        fs.writeFileSync(entryPath(entry.pid), JSON.stringify(entry), 'utf8');
+        const processIdentity = scope?.bootId && scope.pidNamespace ? { bootId: scope.bootId, pidNamespace: scope.pidNamespace, initStartTicks: scope.initStartTicks, startTicks: linuxStartTicks(entry.pid) }
+            : process.platform === 'darwin' ? { startTime: darwinStartTime(entry.pid) } : undefined;
+        const file = entryPath(entry.pid);
+        withFileLock(file, () => {
+            // The host writer owns numeric PID slots. Old-boot and legacy records
+            // must not reserve a recycled slot; restricted namespaces never get here.
+            const owned = { ...entry, processIdentity };
+            persistOwnership(owned);
+            atomicWriteFileSync(file, JSON.stringify(owned), 'utf8');
+        }, { realpath: false, acquireTimeoutMs: 0 });
     }
     catch {
         /* degrade to the newest-jsonl heuristic */
@@ -129,8 +224,8 @@ export function readPidSessionEntry(pid) {
     }
     try {
         const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object' && typeof parsed.pid === 'number') {
-            return parsed;
+        if (parsed && typeof parsed === 'object' && parsed.pid === pid) {
+            return restoreOwnership(parsed);
         }
     }
     catch {
@@ -138,6 +233,32 @@ export function readPidSessionEntry(pid) {
     }
     return undefined;
 }
+/** Live consumers require identity proof; raw history is not a PID binding. */
+export function readLivePidSessionEntry(pid) {
+    const entry = readPidSessionEntry(pid);
+    if (!entry || !hostProcessView())
+        return undefined;
+    if (process.platform === 'win32')
+        return pidExists(pid) === true ? entry : undefined;
+    if (!entry.processIdentity && pidExists(pid) === true) {
+        // Upgrade a native legacy launch only after the home namespace is proven,
+        // and the actual process start excludes a recycled PID. Hook timestamps may
+        // be later than process start, but cannot predate this process incarnation.
+        const start = darwinStartTime(pid);
+        const startMs = start ? Date.parse(start) : NaN;
+        if (Number.isFinite(startMs) && entry.startedAtMs >= startMs - 1000 && entry.startedAtMs <= Date.now()) {
+            const scope = hostProcessView();
+            entry.processIdentity = process.platform === 'linux'
+                ? { ...scope, startTicks: linuxStartTicks(pid) }
+                : { startTime: start };
+            try {
+                persistOwnership(entry);
+            }
+            catch { /* read remains useful */ }
+        }
+    }
+    return pidSessionEntryMatchesLiveProcess(entry) === true ? entry : undefined;
+}
 /**
  * Every recorded launch, one entry per live-or-dead pid. Used to index launches
  * by their `tmuxPane` so the authoritative tmux source can attribute a pane it did
@@ -158,7 +279,7 @@ export function listPidSessionEntries() {
         try {
             const parsed = JSON.parse(fs.readFileSync(path.join(pidRegistryDir(), f), 'utf8'));
             if (parsed && typeof parsed === 'object' && typeof parsed.pid === 'number') {
-                out.push(parsed);
+                out.push(restoreOwnership(parsed));
             }
         }
         catch {
@@ -170,10 +291,11 @@ export function listPidSessionEntries() {
 /**
  * Remove entries whose pid is no longer alive. Best-effort housekeeping.
  *
- * `isAlive` receives the entry's recorded `startedAtMs` so it can reject a pid
- * that a newer process recycled (a "zombie" registry entry), not just one that
- * no longer exists. An unreadable/corrupt entry falls back to the pid-only
- * check.
+ * Linux deletion requires the writer's boot and PID namespace to match our own
+ * trustworthy proc view. ESRCH in another namespace says nothing about the
+ * recorded process. Legacy/corrupt/unreadable ownership is unknown, never dead.
+ * Kernel start ticks reject PID reuse without wall-clock heuristics. Other
+ * platforms retain the caller's start-time check after checking kernel liveness.
  */
 export function prunePidSessionRegistry(isAlive) {
     let files;
@@ -183,23 +305,48 @@ export function prunePidSessionRegistry(isAlive) {
     catch {
         return;
     }
+    const scope = process.platform === 'linux' ? hostProcessView() : undefined;
     for (const f of files) {
         const pid = Number(f.slice(0, -'.json'.length));
-        if (!Number.isInteger(pid))
+        if (!Number.isInteger(pid) || pid < 1)
             continue;
-        let startedAtMs;
+        let raw;
+        let entry;
         try {
-            const parsed = JSON.parse(fs.readFileSync(path.join(pidRegistryDir(), f), 'utf8'));
-            if (typeof parsed?.startedAtMs === 'number')
-                startedAtMs = parsed.startedAtMs;
+            raw = fs.readFileSync(path.join(pidRegistryDir(), f), 'utf8');
+            entry = restoreOwnership(JSON.parse(raw));
+            if (entry?.pid !== pid)
+                continue;
         }
         catch {
-            /* unreadable/corrupt — fall back to the pid-only liveness check */
+            continue;
         }
-        if (isAlive(pid, startedAtMs))
+        if (process.platform === 'linux' && (!scope
+            || entry.processIdentity?.bootId !== scope.bootId
+            || entry.processIdentity?.pidNamespace !== scope.pidNamespace
+            || entry.processIdentity?.initStartTicks !== scope.initStartTicks))
+            continue;
+        const exists = pidExists(pid);
+        if (exists === undefined)
             continue;
+        if (exists) {
+            if (process.platform === 'linux') {
+                const start = linuxStartTicks(pid);
+                const recordedStart = entry.processIdentity?.startTicks;
+                if (!start || typeof recordedStart !== 'string' || !/^\d+$/.test(recordedStart) || start === recordedStart)
+                    continue;
+            }
+            else if (!isAlive || isAlive(pid, entry.startedAtMs) !== false)
+                continue;
+        }
         try {
-            fs.unlinkSync(path.join(pidRegistryDir(), f));
+            const file = path.join(pidRegistryDir(), f);
+            // Share the writer's lock so comparison and deletion cannot remove a
+            // successor published after the liveness check.
+            withFileLock(file, () => {
+                if (fs.readFileSync(file, 'utf8') === raw)
+                    fs.unlinkSync(file);
+            }, { realpath: false, acquireTimeoutMs: 0 });
         }
         catch {
             /* raced with another writer/pruner */

package/dist/lib/session/process-view.d.ts

@@ -0,0 +1,25 @@
+export interface HostProcessView {
+    bootId?: string;
+    pidNamespace?: string;
+    /** Namespace inodes can be reused within one boot; its init identifies the incarnation. */
+    initStartTicks?: string;
+    ownerPid?: number;
+    ownerStartTicks?: string;
+}
+/** Measure the calling process, never infer authority from a process name. */
+export declare function currentProcessView(): HostProcessView | undefined;
+/** Read-only ownership check. Observing a HOME never claims or migrates it. */
+export declare function hostProcessView(): HostProcessView | undefined;
+/** Explicit writers may enroll a fresh HOME in their measured namespace.
+ * Foreign ownership remains protected even when the prior writer is invisible.
+ * The initial host may enroll legacy state before daemon startup. */
+export declare function writerProcessView(): HostProcessView | undefined;
+/** Preflight BEFORE even the PID-keyed legacy lifecycle lock is inspected.
+ * The same decision is repeated under that lock before daemon state changes. */
+export declare function daemonProcessViewAllowed(): boolean;
+/** Called by the canonical daemon writer before lifecycle mutation.
+ * This is a writer statement, not an observer's guess about a numeric PID.
+ * Existing same-boot ownership cannot be taken over from another namespace. */
+export declare function recordDaemonProcessView(): void;
+export declare function requireHostProcessView(): void;
+export declare function requireWriterProcessView(): void;