moflo 4.12.2 → 4.12.3

package/bin/hooks.mjs

@@ -26,7 +26,7 @@ import { fileURLToPath, pathToFileURL } from 'url';
 import { createProcessManager } from './lib/process-manager.mjs';
 import { shouldDaemonAutoStart } from './lib/daemon-config.mjs';
 import { resolveMofloBin } from './lib/resolve-bin.mjs';
-import { findProjectRoot } from './lib/moflo-paths.mjs';
+import { resolveStateRoot } from './lib/moflo-paths.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -35,7 +35,10 @@ const __dirname = dirname(__filename);
 // in bin/ during development but gets synced to .claude/scripts/ in consumer
 // projects, so __dirname-relative paths break. findProjectRoot() works
 // everywhere and resolves identically to the TS bridge (see lib/moflo-paths.mjs).
-const projectRoot = findProjectRoot();
+// #1315 — resolveStateRoot, NOT findProjectRoot: this layer mkdirs
+// `.moflo/` state, and findProjectRoot honors CLAUDE_PROJECT_DIR verbatim,
+// so a sub-workspace-rooted session minted an island here every start.
+const projectRoot = resolveStateRoot();
 const logFile = resolve(projectRoot, '.moflo', 'logs', 'hooks.log');
 try { mkdirSync(dirname(logFile), { recursive: true }); } catch { /* best effort */ }
 const pm = createProcessManager(projectRoot);

package/bin/index-all.mjs

@@ -111,6 +111,41 @@ function killProcessTree(child) {
   }
 }
 
+// The step currently in flight, so a termination signal can reap it (#1317).
+let currentChild = null;
+let shuttingDown = false;
+
+// Reap on SIGTERM/SIGINT (#1317). hooks.mjs session-end calls pm.killAll(),
+// which SIGTERMs THIS process. Without a handler Node's default action kills us
+// instantly and the in-flight step is orphaned: it lives in its OWN process
+// group (detached:true in runStep, below), so the signal aimed at us never
+// reaches it, and no group-kill of our group can either. It reparents to init
+// and keeps burning CPU and writing .moflo/moflo.db after the session is gone —
+// build-embeddings most often, the same ~2 GB fastembed process as #744.
+// killProcessTree is the teardown primitive #744 already built; it was simply
+// never wired to the signal path.
+function handleTerminationSignal(signal) {
+  if (shuttingDown) return; // second signal while tearing down — ignore
+  shuttingDown = true;
+  log(`SIGNAL ${signal} — reaping in-flight step before exit`);
+  // Synchronous on both platforms: process.kill delivers before returning,
+  // spawnSync('taskkill') blocks. Safe to process.exit() immediately after.
+  killProcessTree(currentChild);
+  currentChild = null;
+  process.exit(signal === 'SIGINT' ? 130 : 143);
+}
+
+// 'SIGTERM' is never delivered on Windows — Node permits the listener but it
+// cannot fire, and Windows is already correct via taskkill /T. Registering it
+// unconditionally is therefore harmless, not a portability assumption.
+// 'SIGBREAK' is the Windows-only console-termination signal.
+for (const sig of ['SIGTERM', 'SIGINT']) {
+  try { process.on(sig, () => handleTerminationSignal(sig)); } catch { /* signal unsupported here */ }
+}
+if (platform() === 'win32') {
+  try { process.on('SIGBREAK', () => handleTerminationSignal('SIGBREAK')); } catch { /* ignore */ }
+}
+
 function runStep(label, cmd, args, timeoutMs = 120_000, extraEnv = null) {
   return new Promise((resolveStep) => {
     const start = Date.now();
@@ -122,6 +157,7 @@ function runStep(label, cmd, args, timeoutMs = 120_000, extraEnv = null) {
       detached: platform() !== 'win32', // POSIX: own process group for tree-kill
       env: extraEnv ? { ...process.env, ...extraEnv } : process.env,
     });
+    currentChild = child;
     let timedOut = false;
     const timer = setTimeout(() => {
       timedOut = true;
@@ -129,6 +165,7 @@ function runStep(label, cmd, args, timeoutMs = 120_000, extraEnv = null) {
     }, timeoutMs);
     child.once('exit', (code, signal) => {
       clearTimeout(timer);
+      if (currentChild === child) currentChild = null;
       const elapsed = ((Date.now() - start) / 1000).toFixed(1);
       if (timedOut) {
         log(`FAIL  ${label} (${elapsed}s): timed out after ${timeoutMs}ms, child killed`);
@@ -143,6 +180,7 @@ function runStep(label, cmd, args, timeoutMs = 120_000, extraEnv = null) {
     });
     child.once('error', (err) => {
       clearTimeout(timer);
+      if (currentChild === child) currentChild = null;
       const elapsed = ((Date.now() - start) / 1000).toFixed(1);
       log(`FAIL  ${label} (${elapsed}s): ${err.message?.split('\n')[0] || 'unknown'}`);
       resolveStep(false);

package/bin/lib/moflo-paths.mjs

@@ -12,7 +12,7 @@
  * helpers no longer ship: the version-bump-gated cherry-pick lives entirely
  * in the launcher and the TS service `cli/services/cherry-pick-learnings.ts`.
  */
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import { basename, dirname, join, parse, resolve } from 'node:path';
 
 export const MOFLO_DIR = '.moflo';
@@ -127,6 +127,42 @@ export function findAncestorMofloRoot(dir) {
  * @param {{ cwd?: string; honorEnv?: boolean }} [opts]
  * @returns {string} absolute project root
  */
+/**
+ * Pure-JS twin of `src/cli/services/project-root.ts:resolveStateRoot()` (#1315).
+ *
+ * Use this — never `findProjectRoot()` — anywhere the bin/hook layer is about
+ * to CREATE `.moflo/` state. `findProjectRoot` returns `CLAUDE_PROJECT_DIR`
+ * verbatim, and Claude Code sets that to the SESSION directory; in a monorepo
+ * session rooted at a sub-workspace the launcher therefore mkdir'd a `.moflo/`
+ * island there every session. That made the healer's nested-island fix a
+ * perpetual loop: archive it, next session re-mints it.
+ *
+ * Semantics (kept in lockstep with the TS side): an EXISTING
+ * `CLAUDE_PROJECT_DIR` wins outright and is never climbed above — the marker
+ * walk has no upper bound, so climbing past an explicit anchor would let a
+ * stray ancestor `.moflo/moflo.db` capture every project beneath it. Otherwise
+ * walk up from cwd and take the topmost marker, which is what stops a
+ * sub-directory invocation from minting an island where it stands. A value
+ * naming a directory that does not exist is ignored rather than materialized.
+ *
+ * @param {{ cwd?: string }} [opts]
+ * @returns {string} absolute project root
+ */
+export function resolveStateRoot(opts) {
+  const envDir = process.env.CLAUDE_PROJECT_DIR;
+  const envAbs = envDir ? resolve(envDir) : undefined;
+  const resolved = envAbs && existsSync(envAbs)
+    ? envAbs
+    : findProjectRoot({ honorEnv: false, cwd: opts?.cwd });
+  // Canonicalize so this compares equal to the realpath'd root the TS side
+  // derives (macOS /var → /private/var). Falls back when the path is absent.
+  try {
+    return realpathSync(resolve(resolved));
+  } catch {
+    return resolve(resolved);
+  }
+}
+
 export function findProjectRoot(opts) {
   const honorEnv = opts?.honorEnv !== false;
   if (honorEnv && process.env.CLAUDE_PROJECT_DIR) {

package/bin/lib/process-manager.mjs

@@ -219,7 +219,22 @@ export function createProcessManager(root) {
           if (process.platform === 'win32') {
             execFileSync('taskkill', ['/T', '/F', '/PID', String(entry.pid)], { windowsHide: true, timeout: 10000 });
           } else {
-            process.kill(entry.pid, 'SIGTERM');
+            // POSIX tree-kill (#1317). Windows walks the tree via taskkill /T;
+            // a bare SIGTERM here only hit the one PID, so anything the tracked
+            // process left in its group survived session-end. Everything spawn()
+            // launches is detached (setsid), so the tracked PID leads its own
+            // group and the negative PID reaches those children.
+            //
+            // NOTE this does NOT reach grandchildren that called setsid again —
+            // index-all's steps do exactly that, which is why index-all reaps
+            // them itself on SIGTERM. This is defence in depth, not the whole fix.
+            try {
+              process.kill(-entry.pid, 'SIGTERM');
+            } catch {
+              // No such process group — e.g. an entry registered by
+              // registerBackgroundPid() whose process doesn't lead one.
+              process.kill(entry.pid, 'SIGTERM');
+            }
           }
           killed++;
         } catch {

package/bin/lib/registry-cleanup.cjs

@@ -32,7 +32,15 @@ function killTrackedSync(projectDir) {
           if (process.platform === 'win32') {
             childProcess.execFileSync('taskkill', ['/T', '/F', '/PID', String(entries[i].pid)], { windowsHide: true, timeout: 5000 });
           } else {
-            process.kill(entries[i].pid, 'SIGTERM');
+            // POSIX tree-kill — mirrors process-manager.mjs killAll (#1317).
+            // This is the second reaper over the same registry (session-end via
+            // hook-handler.cjs), so it must not be left behind on the bare-PID
+            // kill or session-end orphans depend on which path ran.
+            try {
+              process.kill(-entries[i].pid, 'SIGTERM');
+            } catch (groupErr) {
+              process.kill(entries[i].pid, 'SIGTERM');
+            }
           }
           killed++;
         } catch (e) { /* ok */ }

package/bin/session-start-launcher.mjs

@@ -11,7 +11,7 @@ import { spawn, execFileSync } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync, mkdirSync, statSync } from 'fs';
 import { resolve, dirname, join } from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
-import { mofloDir, findProjectRoot, findAncestorMofloRoot, COMMON_WALK_SKIP_NAMES } from './lib/moflo-paths.mjs';
+import { mofloDir, resolveStateRoot, findAncestorMofloRoot, COMMON_WALK_SKIP_NAMES } from './lib/moflo-paths.mjs';
 import { repairMemoryDbIfCorrupt } from './lib/db-repair.mjs';
 import { resolveMofloBin } from './lib/resolve-bin.mjs';
 import { applyRetiredPrune, writeRetainedRecord, reconcileRetainedRecord, RETAINED_RECORD_REL } from './lib/retired-files.mjs';
@@ -62,7 +62,10 @@ function sessionStartMirrorHeader(file) {
 // first, then walk up for .moflo/moflo.db / .swarm/memory.db / CLAUDE.md+pkg /
 // package.json / .git. Inline walks here have caused N writers to land on
 // different DBs than the bridge reads from — never reintroduce one.
-const projectRoot = findProjectRoot();
+// #1315 — resolveStateRoot, NOT findProjectRoot: this layer mkdirs
+// `.moflo/` state, and findProjectRoot honors CLAUDE_PROJECT_DIR verbatim,
+// so a sub-workspace-rooted session minted an island here every start.
+const projectRoot = resolveStateRoot();
 
 // Monorepo nested-.moflo guard (#1174). After the resolver fix, findProjectRoot
 // returns the topmost ancestor with .moflo/moflo.db, so an ancestor still

package/dist/src/cli/commands/agent.js

@@ -8,6 +8,7 @@ import { select, confirm, input } from '../prompt.js';
 import { callMCPTool, MCPClientError } from '../mcp-client.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import { resolveStateRoot } from '../services/project-root.js';
 /**
  * Update swarm-activity.json metrics with absolute agent count.
  * The statusline reads this file to display the swarm agent count.
@@ -17,7 +18,10 @@ import * as path from 'path';
  */
 function syncSwarmAgentCount(absoluteCount) {
     try {
-        const metricsDir = path.join(process.cwd(), '.moflo', 'metrics');
+        // #1315 — resolved root, not cwd. This mkdirs, so a subdirectory
+        // invocation minted a `.moflo/metrics/` island; and the statusline reads
+        // this file from the ROOT, so a cwd-anchored write was invisible to it.
+        const metricsDir = path.join(resolveStateRoot(), '.moflo', 'metrics');
         const activityPath = path.join(metricsDir, 'swarm-activity.json');
         let data = {
             timestamp: new Date().toISOString(),
@@ -48,7 +52,8 @@ function syncSwarmAgentCount(absoluteCount) {
  */
 function readSwarmAgentCount() {
     try {
-        const activityPath = path.join(process.cwd(), '.moflo', 'metrics', 'swarm-activity.json');
+        // #1315 — must read from the same root `syncSwarmAgentCount` writes to.
+        const activityPath = path.join(resolveStateRoot(), '.moflo', 'metrics', 'swarm-activity.json');
         if (!fs.existsSync(activityPath))
             return 0;
         const data = JSON.parse(fs.readFileSync(activityPath, 'utf-8'));

package/dist/src/cli/commands/benchmark.js

@@ -8,6 +8,9 @@ import { output } from '../output.js';
 import { writeFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { errorDetail } from '../shared/utils/error-detail.js';
+// #1315 — benchmark results are `.moflo/` state; anchor them at the resolved
+// root so a subdirectory run doesn't mint an island to save into.
+import { resolveStateRoot } from '../services/project-root.js';
 // ============================================================================
 // Pretrain Benchmark Subcommand
 // ============================================================================
@@ -46,7 +49,7 @@ const pretrainCommand = {
             }
             // Save to file if requested
             if (saveFile) {
-                const resultsDir = join(process.cwd(), '.moflo', 'benchmarks');
+                const resultsDir = join(resolveStateRoot(), '.moflo', 'benchmarks');
                 if (!existsSync(resultsDir)) {
                     mkdirSync(resultsDir, { recursive: true });
                 }
@@ -397,7 +400,7 @@ const allCommand = {
         // Save if requested
         const saveFile = ctx.flags.save;
         if (saveFile) {
-            const resultsDir = join(process.cwd(), '.moflo', 'benchmarks');
+            const resultsDir = join(resolveStateRoot(), '.moflo', 'benchmarks');
             if (!existsSync(resultsDir)) {
                 mkdirSync(resultsDir, { recursive: true });
             }

package/dist/src/cli/commands/daemon.js

@@ -11,10 +11,11 @@ import { startDashboard, createDashboardMemoryAccessor, DEFAULT_DASHBOARD_PORT }
 import { bootstrapDaemonScheduler } from '../services/daemon-scheduler-bootstrap.js';
 import { loadMofloConfig } from '../config/moflo-config.js';
 import { spawn, execFileSync } from 'child_process';
-import { join, resolve } from 'path';
+import { join, resolve, isAbsolute } from 'path';
 import * as fs from 'fs';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { readMofloEnv } from '../services/env-compat.js';
+import { resolveStateRoot } from '../services/project-root.js';
 /**
  * Resolve the dashboard port from CLI flag and env, in that precedence order.
  *
@@ -68,7 +69,13 @@ const startCommand = {
         const foreground = ctx.flags.foreground;
         const noDashboard = ctx.flags.noDashboard;
         const rawDashboardPort = ctx.flags.dashboardPort;
-        const projectRoot = process.cwd();
+        // #1315 — the shared chokepoint. Every daemon-start path lands here:
+        // `maybeAutoStartDaemon`, the session-start launcher, bin/hooks.mjs, the
+        // daemon recycler, the scheduler, and the OS service definitions. Each one
+        // spawns with a cwd it inherited from the caller, so anchoring on
+        // `process.cwd()` let ANY of them mint a `.moflo/` island in a
+        // sub-workspace while resolving its own binary from the root install.
+        const projectRoot = resolveStateRoot();
         const isDaemonProcess = readMofloEnv('DAEMON') === '1';
         // Resolve dashboard port; see `resolveDashboardPort` for precedence.
         const portResult = resolveDashboardPort(rawDashboardPort, process.env.MOFLO_DAEMON_PORT);
@@ -314,13 +321,35 @@ function validatePath(path, label) {
         }
     }
 }
+/**
+ * Validate the resolved project root (#1315).
+ *
+ * Separate from `validatePath` because containment is meaningless for the root
+ * itself — it IS the boundary every other path is checked against. Passing it
+ * to `validatePath` would either compare it against `process.cwd()` (which now
+ * fails legitimately, since the root is an ANCESTOR of cwd for any
+ * sub-workspace invocation) or against itself (a tautology that silently
+ * retires the check). Assert the properties that actually matter instead:
+ * injection-free and absolute.
+ */
+function validateProjectRoot(root) {
+    if (root.includes('\0')) {
+        throw new Error('Project root contains null bytes');
+    }
+    if (/[;&|`$<>]/.test(root)) {
+        throw new Error('Project root contains shell metacharacters');
+    }
+    if (!isAbsolute(root)) {
+        throw new Error(`Project root is not absolute: ${root}`);
+    }
+}
 /**
  * Start daemon as a detached background process
  */
 async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemory, dashboardPort, noDashboard) {
     // Validate and resolve project root
     const resolvedRoot = resolve(projectRoot);
-    validatePath(resolvedRoot, 'Project root');
+    validateProjectRoot(resolvedRoot);
     const stateDir = join(resolvedRoot, '.moflo');
     const logFile = join(stateDir, 'daemon.log');
     // Validate all paths
@@ -374,6 +403,13 @@ async function startBackgroundDaemon(projectRoot, quiet, maxCpuLoad, minFreeMemo
     }
     const daemonEnv = {
         ...process.env,
+        // #1315 — PIN the child's project dir to the root we just resolved.
+        // Without this the daemon inherited the SESSION's `CLAUDE_PROJECT_DIR`
+        // (a sub-workspace), and so did everything it spawns — headless Claude,
+        // hooks, MCP — all of which resolve through `findProjectRoot()` and would
+        // anchor back on the sub-workspace, re-minting the island this fix
+        // removes. Pinning it closes the whole inherited-env class in one place.
+        CLAUDE_PROJECT_DIR: resolvedRoot,
         MOFLO_DAEMON: '1',
         // #981 — daemon process must skip its own write-routing client.
         MOFLO_IS_DAEMON: '1',
@@ -454,7 +490,10 @@ const stopCommand = {
     ],
     action: async (ctx) => {
         const quiet = ctx.flags.quiet;
-        const projectRoot = process.cwd();
+        // #1315 — must match `start`'s anchor. Anchoring on cwd here would look for
+        // the lock in a sub-workspace, miss the root daemon, and report "not
+        // running" while it kept going.
+        const projectRoot = resolveStateRoot();
         try {
             if (!quiet) {
                 const spinner = output.createSpinner({ text: 'Stopping worker daemon...', spinner: 'dots' });
@@ -584,7 +623,12 @@ const statusCommand = {
     action: async (ctx) => {
         const verbose = ctx.flags.verbose;
         const showModes = ctx.flags.showModes;
-        const projectRoot = process.cwd();
+        // #1315 — `getDaemon` constructs a WorkerDaemon, and that constructor
+        // unconditionally mkdirs `<root>/.moflo` and `<root>/.moflo/logs`
+        // (`worker-daemon.ts`). Anchoring on cwd meant a read-only-looking
+        // `flo daemon status` MINTED a state-dir island in whatever directory it
+        // was run from — a creation path entirely separate from `start`.
+        const projectRoot = resolveStateRoot();
         try {
             const daemon = getDaemon(projectRoot);
             const status = daemon.getStatus();
@@ -721,7 +765,9 @@ const triggerCommand = {
             return { success: false, exitCode: 1 };
         }
         try {
-            const daemon = getDaemon(process.cwd());
+            // #1315 — resolved root, not cwd: the WorkerDaemon constructor creates
+            // the state dir it is pointed at.
+            const daemon = getDaemon(resolveStateRoot());
             const spinner = output.createSpinner({ text: `Running ${workerType} worker...`, spinner: 'dots' });
             spinner.start();
             const result = await daemon.triggerWorker(workerType);
@@ -764,7 +810,9 @@ const enableCommand = {
             return { success: false, exitCode: 1 };
         }
         try {
-            const daemon = getDaemon(process.cwd());
+            // #1315 — resolved root, not cwd (see `trigger`). Enabling a worker on a
+            // cwd-anchored daemon also wrote its state to the wrong `.moflo`.
+            const daemon = getDaemon(resolveStateRoot());
             daemon.setWorkerEnabled(workerType, !disable);
             output.printSuccess(`Worker ${workerType} ${disable ? 'disabled' : 'enabled'}`);
             return { success: true };
@@ -787,7 +835,11 @@ const installCommand = {
     ],
     action: async (ctx) => {
         const quiet = ctx.flags.quiet;
-        const projectRoot = process.cwd();
+        // #1315 — the highest-stakes anchor of the family. `installDaemonService`
+        // BAKES this path into a launchd plist / systemd unit / schtasks entry
+        // (`daemon-service.ts`), so a cwd-anchored install persisted an island
+        // across reboots — the one variant that outlives `flo doctor --fix`.
+        const projectRoot = resolveStateRoot();
         try {
             const result = installDaemonService(projectRoot);
             if (!quiet) {
@@ -821,9 +873,29 @@ const uninstallCommand = {
     ],
     action: async (ctx) => {
         const quiet = ctx.flags.quiet;
-        const projectRoot = process.cwd();
+        // #1315 — must match `install`'s anchor, or uninstall looks for a service
+        // registered under a different root and silently leaves it in place.
+        const projectRoot = resolveStateRoot();
         try {
             const result = uninstallDaemonService(projectRoot);
+            // #1315 — also sweep the LEGACY cwd-anchored registration. The service
+            // name is `sha256(resolvedRoot)`, so a consumer who ran `flo daemon
+            // install` from a sub-directory before this fix has a plist/unit/task
+            // named for THAT path. Resolving correctly now makes it unreachable:
+            // uninstall would report success while the old service stayed enabled
+            // and re-spawned a sub-root daemon at every login, with no supported way
+            // to remove it. Best-effort and silent — on the overwhelmingly common
+            // path cwd IS the root and this is a no-op.
+            const legacyRoot = resolve(process.cwd());
+            if (legacyRoot !== projectRoot) {
+                try {
+                    const legacy = uninstallDaemonService(legacyRoot);
+                    if (legacy.success && !quiet) {
+                        output.printSuccess(`Also removed a legacy service registered at ${legacyRoot}`);
+                    }
+                }
+                catch { /* nothing registered there — expected */ }
+            }
             if (!quiet) {
                 if (result.success) {
                     output.printSuccess(result.message);

package/dist/src/cli/commands/doctor-checks-config.js

@@ -10,7 +10,7 @@ import { findProjectDaemonPids, getDaemonLockHolder, getDaemonLockPayload, } fro
 import { resolveClientPort, LEGACY_DEFAULT_PORT, probeDaemonHealthWithRetry as probeDaemonHealthIdentity, normalizeProjectRoot, } from '../services/daemon-port.js';
 import { COMMON_WALK_SKIP_NAMES, LEGACY_SWARM_DIR, memoryDbCandidatePaths, memoryDbPath, } from '../services/moflo-paths.js';
 import { probeDbIntegrity } from '../services/memory-db-integrity-repair.js';
-import { findProjectRoot } from '../services/project-root.js';
+import { findProjectRoot, resolveStateRoot } from '../services/project-root.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
 export async function checkConfigFile() {
     // JSON configs (parse-validated). LEGACY-CONFIG: `.claude-flow.json` and
@@ -382,11 +382,23 @@ export async function checkSwarmResidue() {
  * something more targeted.
  */
 const NESTED_BFS_MAX_FOUND = 50;
-function scanNestedMofloDirs(root, maxDepth = 5) {
-    const found = [];
+/**
+ * Depth bound for the nested-`.moflo/` walk.
+ *
+ * #1315 raised this from 5 to 8. The waxstak report found a stray seven levels
+ * deep (`back-office/ui/src/layout/Dashboard/Header/HeaderContent/.moflo`) —
+ * inside a React component folder, because ANY cwd could mint one. At depth 5
+ * the healer silently walked past it and reported a clean tree. The walk skips
+ * `node_modules`/`.git`/build output via `COMMON_WALK_SKIP_NAMES`, so the extra
+ * three levels cost little on a real repo.
+ */
+const NESTED_SCAN_MAX_DEPTH = 8;
+function scanNestedMofloDirs(root, maxDepth = NESTED_SCAN_MAX_DEPTH) {
+    const islands = [];
+    const husks = [];
     let truncated = false;
     function walk(dir, depth) {
-        if (found.length >= NESTED_BFS_MAX_FOUND) {
+        if (islands.length + husks.length >= NESTED_BFS_MAX_FOUND) {
             truncated = true;
             return;
         }
@@ -411,9 +423,17 @@ function scanNestedMofloDirs(root, maxDepth = 5) {
             if (entry.name.startsWith('.') && depth > 0)
                 continue;
             const childDir = join(dir, entry.name);
-            if (existsSync(join(childDir, '.moflo', 'moflo.db'))) {
-                found.push(childDir);
-                if (found.length >= NESTED_BFS_MAX_FOUND) {
+            // #1315 — key on the `.moflo/` DIRECTORY, then classify by whether it
+            // holds `moflo.db`. Keying on `moflo.db` alone (the pre-#1315 predicate)
+            // made every daemon-minted husk invisible.
+            if (existsSync(join(childDir, '.moflo'))) {
+                if (existsSync(join(childDir, '.moflo', 'moflo.db'))) {
+                    islands.push(childDir);
+                }
+                else {
+                    husks.push(childDir);
+                }
+                if (islands.length + husks.length >= NESTED_BFS_MAX_FOUND) {
                     truncated = true;
                     return;
                 }
@@ -426,15 +446,12 @@ function scanNestedMofloDirs(root, maxDepth = 5) {
                 continue;
             }
             walk(childDir, depth + 1);
-            if (found.length >= NESTED_BFS_MAX_FOUND)
+            if (islands.length + husks.length >= NESTED_BFS_MAX_FOUND)
                 return;
         }
     }
     walk(root, 0);
-    return { islands: found, truncated };
-}
-function findNestedMofloDirs(root, maxDepth = 5) {
-    return scanNestedMofloDirs(root, maxDepth).islands;
+    return { islands, husks, truncated };
 }
 /**
  * Public wrapper for the BFS used by `checkNestedMofloIslands`. Exposed so
@@ -443,7 +460,11 @@ function findNestedMofloDirs(root, maxDepth = 5) {
  * (the consumer joins `.moflo` itself).
  */
 export function findNestedMofloDirsForFix(root) {
-    return findNestedMofloDirs(root);
+    // #1315 — husks are archived alongside stateful islands. Archiving is a
+    // rename to `.moflo-archived-<ISO>/`, so it is non-destructive either way,
+    // and leaving husks in place lets the daemons bound to them keep running.
+    const { islands, husks } = scanNestedMofloDirs(root);
+    return [...islands, ...husks];
 }
 /**
  * Surface nested `.moflo/moflo.db` directories — every one of them is a daemon
@@ -463,7 +484,9 @@ export function findNestedMofloDirsForFix(root) {
  * first.
  */
 export async function checkNestedMofloIslands(cwd) {
-    const root = cwd ?? findProjectRoot();
+    // #1315 — must match the anchor `fixNestedMofloIslands` uses, or the check
+    // and its own auto-fix disagree about which tree they are talking about.
+    const root = cwd ?? resolveStateRoot();
     let scan;
     try {
         scan = scanNestedMofloDirs(root);
@@ -475,20 +498,33 @@ export async function checkNestedMofloIslands(cwd) {
             message: `Walk failed: ${errorDetail(e, { firstLineOnly: true })}`,
         };
     }
-    const { islands, truncated } = scan;
-    if (islands.length === 0) {
+    const { islands, husks, truncated } = scan;
+    if (islands.length === 0 && husks.length === 0) {
         return {
             name: 'Nested .moflo/ Islands',
             status: 'pass',
             message: 'No nested .moflo/ directories detected',
         };
     }
-    const rels = islands.map(p => relative(root, p) || '.');
-    const truncNote = truncated ? ' (walk truncated at depth 5 — deeper islands may exist)' : '';
+    const rel = (p) => relative(root, p) || '.';
+    const parts = [];
+    if (islands.length) {
+        // Stateful: created by `flo init` in a sub-workspace (#1174).
+        parts.push(`${islands.length} with state (#1174): ${islands.map(rel).join(', ')}`);
+    }
+    if (husks.length) {
+        // Stateless: minted by the daemon or a cwd-anchored command (#1315). Worth
+        // naming separately because the remedy differs — these mean something is
+        // still resolving its root from cwd, not that someone ran `flo init` wrong.
+        parts.push(`${husks.length} daemon-minted, no moflo.db (#1315): ${husks.map(rel).join(', ')}`);
+    }
+    const truncNote = truncated
+        ? ` (walk truncated at depth ${NESTED_SCAN_MAX_DEPTH} or ${NESTED_BFS_MAX_FOUND} results — more may exist)`
+        : '';
     return {
         name: 'Nested .moflo/ Islands',
         status: 'warn',
-        message: `${islands.length} nested .moflo/ ${islands.length === 1 ? 'directory' : 'directories'} (#1174): ${rels.join(', ')}${truncNote}`,
+        message: `${parts.join('; ')}${truncNote}`,
         fix: 'flo healer --fix -c nested-moflo',
     };
 }

package/dist/src/cli/commands/doctor-checks-memory.js

@@ -9,6 +9,7 @@ import { join } from 'path';
 import { memoryDbCandidatePaths } from '../services/moflo-paths.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
+import { resolveStateRoot } from '../services/project-root.js';
 /** Skew (cached / live count delta) above which the cache is treated as stale. */
 const VECTOR_STATS_SKEW_WARN_THRESHOLD = 0.2;
 /**
@@ -35,9 +36,9 @@ async function countEmbeddedRowsFromDb(dbPath) {
     }
 }
 export async function checkEmbeddings() {
-    const liveDbPath = memoryDbCandidatePaths(process.cwd()).find((p) => existsSync(p));
+    const liveDbPath = memoryDbCandidatePaths(resolveStateRoot()).find((p) => existsSync(p));
     // 1. Fast path: read cached vector-stats.json if available
-    const statsPath = join(process.cwd(), '.moflo', 'vector-stats.json');
+    const statsPath = join(resolveStateRoot(), '.moflo', 'vector-stats.json');
     try {
         if (existsSync(statsPath)) {
             const stats = JSON.parse(readFileSync(statsPath, 'utf8'));

package/dist/src/cli/commands/doctor-checks-writers-audit.js

@@ -24,6 +24,7 @@ import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { getDaemonLockHolder } from '../services/daemon-lock.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
+import { resolveStateRoot } from '../services/project-root.js';
 const SCAN_TIMEOUT_MS_WIN = 10_000;
 const SCAN_TIMEOUT_MS_POSIX = 5_000;
 const CMDLINE_CAPTURE_LEN = 300;
@@ -125,7 +126,10 @@ export function findForeignWriters(procs, daemonPid, trackedPids, selfPid) {
  * running a known cross-process writer. Lists every offender so the user can
  * SIGKILL them by PID.
  */
-export async function checkWritersAudit(cwd = process.cwd()) {
+// #1315 — the default anchor is the RESOLVED root, not cwd. Running the healer
+// from a sub-workspace previously audited whatever `.moflo` happened to sit
+// under that directory (often a stray) while reporting on "the project".
+export async function checkWritersAudit(cwd = resolveStateRoot()) {
     const name = 'Writers Audit';
     try {
         const daemonPid = getDaemonLockHolder(cwd);

package/dist/src/cli/commands/doctor-embedding-hygiene.js

@@ -34,6 +34,7 @@ import { CANONICAL_EMBEDDING_MODEL } from '../embeddings/migration/types.js';
 import { memoryDbCandidatePaths } from '../services/moflo-paths.js';
 import { openDaemonDatabase } from '../memory/daemon-backend.js';
 import { EPHEMERAL_NAMESPACES, EPHEMERAL_NAMESPACE_PREFIXES, } from '../memory/bridge-embedder.js';
+import { resolveStateRoot } from '../services/project-root.js';
 /**
  * Known neural-model labels that all share the all-MiniLM-L6-v2 384-dim
  * vector space. The Story-2 migration retags any of these to the
@@ -132,7 +133,7 @@ export async function checkEmbeddingHygiene() {
     };
 }
 function resolveMemoryDb() {
-    return memoryDbCandidatePaths(process.cwd()).find((p) => existsSync(p)) ?? null;
+    return memoryDbCandidatePaths(resolveStateRoot()).find((p) => existsSync(p)) ?? null;
 }
 async function loadModelGroups(dbPath) {
     let db;