moflo 4.12.5 → 4.12.7

package/bin/gate.cjs

@@ -13,7 +13,7 @@ var STATE_FILE = path.join(PROJECT_DIR, '.claude', 'workflow-state.json');
 // the code it describes, so a change made outside Write/Edit/MultiEdit (a Bash
 // write, a branch switch, the next issue in the same session) invalidates it.
 // See creditFingerprint() for why the boolean flags alone cannot.
-var STATE_DEFAULTS = { tasksCreated: false, taskCount: 0, memorySearched: false, memorySearchedBy: {}, memoryRequired: true, learningsStored: false, testsRun: false, testsFingerprint: null, simplifyRun: false, simplifySnapshotSha: null, simplifyFingerprint: null, verifyRun: false, verifyOutcome: null, verifyFingerprint: null, interactionCount: 0, sessionStart: null, lastBlockedAt: null, lastNamespaceHint: '', lastNamespaceHintEmittedBy: {}, flMode: null, swarmInitialized: false, hiveInitialized: false, sddMode: false, activeSddSlug: null };
+var STATE_DEFAULTS = { tasksCreated: false, taskCount: 0, tasksAcknowledged: false, memorySearched: false, memorySearchedBy: {}, memoryRequired: true, learningsStored: false, testsRun: false, testsFingerprint: null, simplifyRun: false, simplifySnapshotSha: null, simplifyFingerprint: null, verifyRun: false, verifyOutcome: null, verifyFingerprint: null, interactionCount: 0, sessionStart: null, lastBlockedAt: null, lastNamespaceHint: '', lastNamespaceHintEmittedBy: {}, flMode: null, swarmInitialized: false, hiveInitialized: false, sddMode: false, activeSddSlug: null };
 
 // Per-actor memory-search tracking (#838). The legacy `memorySearched` boolean
 // is session-wide, so once the parent searches memory, every spawned subagent
@@ -70,9 +70,24 @@ function loadGateConfig() {
   // ships a real /verify skill and has /flo delegate to it, so leaving it off by
   // default would make the default /flo run silently skip the acceptance check.
   // Disable per-project with `verify_before_done: false` or per-run `--no-verify`.
-  var defaults = { memory_first: true, task_create_first: true, context_tracking: true, testing_gate: true, simplify_gate: true, learnings_gate: true, swarm_invocation_gate: true, verify_before_done: true, sdd_gate: true };
+  // task_status_gate is a MODE, not a boolean: 'block' | 'warn' | 'off' (#1435).
+  // #1374 shipped the open-task count as a warn-only stdout line, and a consumer
+  // still shipped a PR over four untouched tasks — a reminder that survived ten
+  // consecutive ignores in one session is not a control. Blocking is the default
+  // because the honest "these stay open on purpose" outcome is one command away
+  // (record-tasks-acknowledged), so nothing here can deadlock a run.
+  var defaults = { memory_first: true, task_create_first: true, context_tracking: true, testing_gate: true, simplify_gate: true, learnings_gate: true, swarm_invocation_gate: true, verify_before_done: true, sdd_gate: true, task_status_gate: 'block' };
   var content = MOFLO_YAML;
   if (content) {
+    // Boolean forms are accepted so this key reads like every other gate in the
+    // block: `false` is the same opt-out `testing_gate: false` is, `true` means
+    // enforce. Anything unrecognised falls through to the default rather than
+    // silently disabling the gate — a typo must not be a stealth opt-out.
+    var tsg = /task_status_gate:\s*['"]?(block|warn|off|false|true)['"]?/i.exec(content);
+    if (tsg) {
+      var mode = tsg[1].toLowerCase();
+      defaults.task_status_gate = mode === 'false' ? 'off' : mode === 'true' ? 'block' : mode;
+    }
     if (/memory_first:\s*false/i.test(content)) defaults.memory_first = false;
     if (/task_create_first:\s*false/i.test(content)) defaults.task_create_first = false;
     if (/context_tracking:\s*false/i.test(content)) defaults.context_tracking = false;
@@ -172,6 +187,25 @@ var GATE_ORIGIN_NOTE = 'This is a moflo hook, not a Claude Code permission rule
 // /verify's Step 5 memory_store carries the verdict AND stamps learnings, which
 // is why learnings has no separate step here.
 var ORDER_HINT = 'Order that satisfies all of them: tests green -> /flo-simplify (re-run tests if it edits) -> /verify -> its memory_store verdict -> gh pr create\n';
+// #1434 — the old text ('learnings have not been stored (call memory_store)')
+// named the mechanism but no quality bar, so the cheapest way past it was a
+// summary of the run — audit exhaust that displaces reusable lessons from every
+// future bounded search. Name the bar AND the no-write path here: an escape
+// hatch nobody can find is not an escape hatch (see #1332's gate deadlock).
+//
+// The escape command is built from __filename, not written as a relative path.
+// The caller is the model typing into a Bash tool, NOT a hook: $CLAUDE_PROJECT_DIR
+// is unset there (so the settings.json form would expand to "/.claude/..."), and a
+// bare `.claude/helpers/gate.cjs` breaks from any cwd but the project root. The
+// running script's own absolute path is correct on every OS and from any cwd;
+// double quotes carry Windows separators and spaces through the shell.
+var LEARNINGS_MISSING =
+  'no durable lesson recorded. A lesson qualifies only if it would help a future session ' +
+  'working on a DIFFERENT task — a reusable pattern, a trap, a decision + rationale. ' +
+  'Store one with mcp__moflo__memory_store (namespace "learnings"; use "patterns" for a ' +
+  'reusable code shape). What THIS run changed is git history — it belongs in the PR body, ' +
+  'not in memory. If this run taught nothing new, say so instead of inventing one: ' +
+  'node "' + __filename + '" record-no-durable-lesson';
 var GATE_DISABLE_NOTE = 'Disable per-gate via moflo.yaml: gates: memory_first: false';
 // #1338 — Claude Code spawns stdio MCP servers once at session start and never
 // respawns them, so a session can outlive its moflo MCP connection. Naming only
@@ -1355,6 +1389,41 @@ switch (command) {
     writeState(s);
     break;
   }
+  // #1435 — the escape from the task-status gate, for work deliberately left
+  // open. Session-scoped like `learningsStored`: it lives in STATE_DEFAULTS, so
+  // session-reset clears it, and neither applyPromptStateReset nor
+  // reset-edit-gates touches it — a decision the user made about the task list
+  // is not invalidated by the next prompt or the next source edit.
+  //
+  // A plain flag, not a count. The command is typed by the model into a Bash
+  // tool, where HOOK_TRANSCRIPT_PATH is unset (it is forwarded by gate-hook.mjs
+  // from the hook payload and exists only inside a hook), so this process cannot
+  // read the ledger to record WHICH tasks were acknowledged even if it wanted to.
+  case 'record-tasks-acknowledged': {
+    var s = readState();
+    if (!s.tasksAcknowledged) {
+      s.tasksAcknowledged = true;
+      writeState(s);
+    }
+    // writeState swallows its own errors by design — a gate must never crash the
+    // hook it runs in. That was harmless while every recorder was advisory. This
+    // one is the ONLY escape from a BLOCKING gate, so a lost write would report
+    // "satisfied" and then block the very next `gh pr create` with nothing said
+    // about why: #1332's deadlock shape exactly. Confirm it landed before
+    // claiming it did, and name the file and the way out when it did not.
+    if (!readState().tasksAcknowledged) {
+      process.stderr.write(
+        'Task-status gate NOT satisfied: the acknowledgement could not be persisted to\n' +
+        STATE_FILE + '\n' +
+        'Check that the file and its directory are writable, then run this again.\n' +
+        'To proceed without it: set gates: task_status_gate: off in moflo.yaml.\n');
+      process.exit(1);
+    }
+    process.stdout.write(
+      'Task-status gate satisfied: open tasks acknowledged as deliberately deferred.\n' +
+      'They stay visible in the task list — this records the decision, it does not close them.\n');
+    break;
+  }
   case 'record-memory-searched': {
     var s = readState();
     if (markMemorySearched(s)) writeState(s);
@@ -1417,12 +1486,48 @@ switch (command) {
     // Why it does nothing: see applyPromptStateReset().
     break;
   }
-  case 'record-learnings-stored': {
+  // #1434 — the gate demanded one memory_store per run whether or not the run
+  // produced a reusable lesson, and a mandatory write with nothing to say
+  // produces filler: a summary of this ticket, this commit, applicable never
+  // again. memory_search returns a bounded set, so each of those displaces a
+  // real lesson from every future search — the cost is retrieval quality, not
+  // disk. Declaring "nothing durable here" is the honest outcome of a run that
+  // learned nothing new, so it has to be reachable without a write; otherwise
+  // the cheapest way past the gate stays the filler write.
+  //
+  // Both credits set the same flag; they differ only in whether the run has
+  // something to say. Sharing the case body keeps that single write in one
+  // place across all three copies of this file.
+  case 'record-learnings-stored':
+  case 'record-no-durable-lesson': {
     var s = readState();
     if (!s.learningsStored) {
       s.learningsStored = true;
       writeState(s);
     }
+    if (command === 'record-no-durable-lesson') {
+      // Same reasoning as record-tasks-acknowledged above: writeState swallows
+      // its own errors so a gate never crashes the hook it runs in, and this is
+      // the ONLY escape from the BLOCKING learnings gate that does not require a
+      // memory_store. A lost write here would print "satisfied" and then block
+      // the next `gh pr create` with nothing said about why — #1332's deadlock.
+      // Verified only on this arm: record-learnings-stored is fired
+      // automatically by the PostToolUse hook on every memory_store, where a
+      // failed write leaves the gate closed but the run still has the ordinary
+      // way through, and a diagnostic on every store would be noise.
+      if (!readState().learningsStored) {
+        process.stderr.write(
+          'Learnings gate NOT satisfied: the declaration could not be persisted to\n' +
+          STATE_FILE + '\n' +
+          'Check that the file and its directory are writable, then run this again.\n' +
+          'To proceed without it: set gates: learnings_gate: false in moflo.yaml.\n');
+        process.exit(1);
+      }
+      process.stdout.write(
+        'Learnings gate satisfied: no durable lesson declared for this run.\n' +
+        'What this run did belongs in the PR body, not in memory.\n',
+      );
+    }
     break;
   }
   case 'record-test-run': {
@@ -1645,25 +1750,46 @@ switch (command) {
     // chained, piped, parenthesised, and multi-line shapes (#1410).
     var cmd = process.env.TOOL_INPUT_command || '';
     if (!isPrCreateCommand(cmd)) break;
-    // #1374 — close the loop the TaskCreate reminder opens. Advisory: stdout,
-    // no exit, and worded as a reminder, because a message may only claim to
-    // block when it blocks (#1326). An open task list is a reporting failure,
-    // not a quality failure — blocking the PR on it would be a new deadlock.
+    // #1374 opened this loop; #1435 closes it. The count itself is unchanged —
+    // what changed is that it now has teeth and, in warn mode, a delivery path.
     //
     // Deliberately ABOVE the no-source exemption below: a docs-only PR can
     // abandon a list exactly like a source PR can, and the exemption is about
     // testing/simplify/learnings, not about whether the run told the user what
-    // it did. Gated on the same `task_create_first` flag as the reminder itself
-    // so the two halves are always consistent — a project that turned the nag
-    // off is not then nagged about the other end of it.
-    if (config.task_create_first) {
+    // it did. It also exits on its own rather than joining `missing` below, for
+    // the same reason — `missing` is unreachable on an exempt diff.
+    //
+    // Gated on the same `task_create_first` flag as the reminder itself so the
+    // two halves are always consistent: a project that turned the nag off is
+    // not then blocked about the other end of it.
+    //
+    // Fail-open is load-bearing. readTaskLedger() returns null on a missing,
+    // oversized, or unreadable transcript and on a session with no TaskCreate at
+    // all, and null must never block — a gate that stops PRs because it could
+    // not read a file is worse than the reporting gap it is closing.
+    //
+    // State is read ONCE for the whole case, here — the pre-PR gate logic below
+    // reuses it and nothing writes in between. Reading it before the ledger also
+    // means an already-acknowledged run never pays for the transcript scan.
+    var s = readState();
+    if (config.task_create_first && config.task_status_gate !== 'off' && !s.tasksAcknowledged) {
       var ledger = readTaskLedger();
       if (ledger && ledger.open > 0) {
-        process.stdout.write(
-          'REMINDER: ' + ledger.created + ' task' + (ledger.created === 1 ? '' : 's') +
-          ' created this session, ' + ledger.open + ' still open. Close them with ' +
-          'TaskUpdate (status: completed), or delete the ones that no longer apply, ' +
-          'so the run does not report done over an unfinished list.\n');
+        var tally = ledger.created + ' task' + (ledger.created === 1 ? '' : 's') +
+          ' created this session, ' + ledger.open + ' still open.';
+        var closeIt = 'Close them with TaskUpdate (status: completed), or delete the ones ' +
+          'that no longer apply, so the run does not report done over an unfinished list.\n';
+        if (config.task_status_gate === 'warn') {
+          process.stdout.write('REMINDER: ' + tally + ' ' + closeIt);
+        } else {
+          process.stderr.write(
+            'BLOCKED: ' + tally + '\n' + closeIt +
+            'Deferring them on purpose is a legitimate outcome — declare it instead of\n' +
+            'closing tasks that are not done: node "' + __filename + '" record-tasks-acknowledged\n' +
+            GATE_ORIGIN_NOTE + '\n' +
+            'Report instead of blocking via moflo.yaml: gates: task_status_gate: warn   (or: off)\n');
+          process.exit(2);
+        }
       }
     }
     // No-source-files exemption (#1176, supersedes the original docs-only path).
@@ -1688,7 +1814,6 @@ switch (command) {
         break;
       }
     }
-    var s = readState();
     // Expire any credit whose fingerprint no longer matches the code before
     // reading the flags. This is what catches the mutations reset-edit-gates
     // structurally cannot see — Bash writes, git checkout/pull/merge, and the
@@ -1721,7 +1846,7 @@ switch (command) {
     var missing = [];
     if (config.testing_gate && !s.testsRun) missing.push('tests have not run green since the last code edit (run npm test, vitest, jest, pytest, or similar — a run whose output reports failures does not count)');
     if (config.simplify_gate && !s.simplifyRun) missing.push('/flo-simplify (or /distill) has not run since the last code edit');
-    if (config.learnings_gate && !s.learningsStored) missing.push('learnings have not been stored (call mcp__moflo__memory_store)');
+    if (config.learnings_gate && !s.learningsStored) missing.push(LEARNINGS_MISSING);
     if (missing.length === 0) break;
     process.stderr.write('BLOCKED: gh pr create requires the following before opening a PR:\n');
     for (var i = 0; i < missing.length; i++) {

package/dist/src/cli/commands/doctor-fixes.js

@@ -5,14 +5,14 @@
  * shell-out where possible). Falls back to running the check's `fix` string
  * if it looks like an `npx`/`npm`/`claude` command.
  */
-import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmdirSync, unlinkSync, writeFileSync, readdirSync } from 'fs';
-import { join } from 'path';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmdirSync, unlinkSync, writeFileSync, readdirSync } from 'fs';
+import { basename, dirname, isAbsolute, join, parse, relative, resolve } from 'path';
 import { output } from '../output.js';
 import { errorDetail } from '../shared/utils/error-detail.js';
 import { atomicWriteFileSync } from '../shared/utils/atomic-file-write.js';
 import { repairHookWiring } from '../services/hook-wiring.js';
 import { findProjectDaemonPids, getDaemonLockHolder } from '../services/daemon-lock.js';
-import { findProjectRoot, resolveStateRoot } from '../services/project-root.js';
+import { findProjectRoot, hasMofloStateMarker, resolveStateRoot } from '../services/project-root.js';
 import { legacyMemoryDbPath, legacyMemoryDbBakPath, memoryDbPath, mofloDir } from '../services/moflo-paths.js';
 import { findZombieProcesses } from './doctor-zombies.js';
 import { loadToolArrays, getTool } from './doctor-checks-functional-shared.js';
@@ -29,6 +29,86 @@ async function runFixCommand(cmd) {
         return false;
     }
 }
+/** `realpathSync` if the path exists, else the absolutized string. */
+function canonical(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        return abs;
+    }
+}
+/**
+ * Nearest moflo root at or above `from` (inclusive), or null.
+ *
+ * Shares `hasMofloStateMarker` with `findProjectRoot`'s Pass A rather than
+ * restating the marker set: a guard that tests a narrower signal than the
+ * resolver it guards is blind exactly where it matters, which is #1431's
+ * fourth defect. `findAncestorMofloRoot` is deliberately not reused — it tests
+ * only `.moflo/moflo.db`, and it is exclusive of its starting directory.
+ */
+function nearestMofloRoot(from) {
+    const start = resolve(from);
+    const fsRoot = parse(start).root;
+    let dir = start;
+    while (dir !== fsRoot) {
+        // Same skip as Pass A — a marker inside `node_modules` is a vendored
+        // package's state, not a project root.
+        if (basename(dir) === 'node_modules') {
+            dir = dirname(dir);
+            continue;
+        }
+        if (hasMofloStateMarker(dir))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+/**
+ * Resolve the project root the daemon auto-fixes may act on, or null to refuse.
+ *
+ * The fixes SIGTERM processes and unlink lock files, so an over-broad root is
+ * not a cosmetic error. `findProjectRoot()` Pass A deliberately returns the
+ * TOPMOST ancestor carrying `.moflo/moflo.db` (#1174, so a monorepo's root
+ * daemon is canonical). For a checkout nested inside an unrelated project that
+ * walk climbs past our own root and lands on the parent's — whose daemons are
+ * not ours to kill. These handlers were previously rooted at `process.cwd()`,
+ * where that case degraded to a harmless no-op (`pids` came back empty), so
+ * aligning them with `checkDaemonOrphan` must not convert a no-op into a kill.
+ *
+ * Refuse whenever a NEARER moflo root sits at or above the cwd and differs
+ * from the resolved root: that is the nested-checkout signature. Both sides are
+ * realpath'd before comparison (Rule #1 §2) — `findProjectRoot` may hand back a
+ * raw `CLAUDE_PROJECT_DIR` while the walk yields a resolved path, and on macOS
+ * `/var/folders` vs `/private/var/folders` would otherwise compare unequal.
+ */
+function daemonFixRoot() {
+    const root = findProjectRoot();
+    const rootC = canonical(root);
+    const cwdC = canonical(process.cwd());
+    // Containment first: the cwd must live inside the root we are about to reap
+    // in. `findProjectRoot` returns `CLAUDE_PROJECT_DIR` verbatim when set, and
+    // that variable is inherited by hooks, test runners, and spawned tools whose
+    // cwd may be somewhere else entirely — a temp fixture, `/`, another repo.
+    // Without this check the handler happily reaps the daemons of whatever
+    // project the environment names, from a cwd with no relationship to it.
+    // `relative` + `isAbsolute` rather than string prefixing: on Windows two
+    // different drive letters yield an absolute result, which must count as
+    // "outside" (Rule #1).
+    const rel = relative(rootC, cwdC);
+    if (rel !== '' && (rel.startsWith('..') || isAbsolute(rel)))
+        return null;
+    const nearest = nearestMofloRoot(cwdC);
+    // No moflo state anywhere at or above cwd: nothing to disambiguate, and the
+    // scan will find no same-project daemons anyway.
+    if (nearest === null)
+        return root;
+    return canonical(nearest) === rootC ? root : null;
+}
 /**
  * Fix the `Config File` check by creating the project's JSON config.
  *
@@ -601,9 +681,13 @@ export async function autoFixCheck(check) {
         // Also reaps any same-project orphans whose PIDs aren't recorded in the
         // lock — those are the daemons that survived prior buggy fixes.
         'Daemon Status': async () => {
-            const cwd = process.cwd();
+            // #1431 — same subdirectory-mismatch class as `Daemon Orphan`; this one
+            // also reaps and unlinks, so it takes the same guarded root.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { getDaemonLockPayload, reapSameProjectOrphans } = await import('../services/daemon-lock.js');
-            const payload = getDaemonLockPayload(cwd);
+            const payload = getDaemonLockPayload(root);
             if (payload?.pid && payload.pid > 0) {
                 try {
                     process.kill(payload.pid, 'SIGTERM');
@@ -611,9 +695,9 @@ export async function autoFixCheck(check) {
                 catch { /* already dead */ }
             }
             // Wipe other same-project daemons that the lock doesn't account for.
-            reapSameProjectOrphans(cwd);
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
-            const pidFile = join(cwd, '.moflo', 'daemon.pid');
+            reapSameProjectOrphans(root);
+            const lockFile = join(root, '.moflo', 'daemon.lock');
+            const pidFile = join(root, '.moflo', 'daemon.pid');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);
@@ -629,16 +713,19 @@ export async function autoFixCheck(check) {
         // bin/session-start-launcher.mjs so the auto-fix matches the launcher's
         // behavior exactly.
         'Daemon Version Skew': async () => {
-            const cwd = process.cwd();
+            // #1431 — same subdirectory-mismatch class as `Daemon Orphan`.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { getDaemonLockPayload } = await import('../services/daemon-lock.js');
-            const payload = getDaemonLockPayload(cwd);
+            const payload = getDaemonLockPayload(root);
             if (payload?.pid && payload.pid > 0) {
                 try {
                     process.kill(payload.pid, 'SIGTERM');
                 }
                 catch { /* already dead */ }
             }
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
+            const lockFile = join(root, '.moflo', 'daemon.lock');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);
@@ -653,20 +740,27 @@ export async function autoFixCheck(check) {
         // threaded into `reapSameProjectOrphans` so we don't re-run the
         // OS process scan inside it.
         'Daemon Orphan': async () => {
-            const cwd = process.cwd();
+            // #1431 — resolve the root the way `checkDaemonOrphan` does, not with
+            // `process.cwd()`. The check walks up to the project root; the fix used
+            // the raw cwd, so `flo doctor --fix` from a subdirectory scanned a root
+            // with no daemons, fell through `pids.length <= 1`, and reported
+            // "Fixed: Daemon Orphan" without reaping anything.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { findProjectDaemonPids, getDaemonLockHolder, reapSameProjectOrphans } = await import('../services/daemon-lock.js');
-            const pids = findProjectDaemonPids(cwd);
+            const pids = findProjectDaemonPids(root);
             if (pids.length <= 1)
                 return true; // already healthy
-            const lockHolder = getDaemonLockHolder(cwd);
+            const lockHolder = getDaemonLockHolder(root);
             if (lockHolder != null && pids.includes(lockHolder)) {
-                const { survived } = reapSameProjectOrphans(cwd, process.pid, lockHolder, pids);
+                const { survived } = reapSameProjectOrphans(root, process.pid, lockHolder, pids);
                 return survived.length === 0;
             }
             // No identifiable canonical daemon — kill them all, clear the lock,
             // respawn fresh.
-            const { survived } = reapSameProjectOrphans(cwd, process.pid, undefined, pids);
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
+            const { survived } = reapSameProjectOrphans(root, process.pid, undefined, pids);
+            const lockFile = join(root, '.moflo', 'daemon.lock');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);
@@ -682,16 +776,21 @@ export async function autoFixCheck(check) {
         // daemon binds the per-project deterministic port and stamps it into
         // the lock — clients can discover it without guessing.
         'Daemon Identity Match': async () => {
-            const cwd = process.cwd();
+            // #1431 — same resolver as `checkDaemonIdentityMatch`; see the note on
+            // the `Daemon Orphan` handler above. Reading the lock from a raw cwd
+            // would SIGTERM nothing and unlink a path the daemon never wrote.
+            const root = daemonFixRoot();
+            if (root === null)
+                return false;
             const { getDaemonLockPayload } = await import('../services/daemon-lock.js');
-            const payload = getDaemonLockPayload(cwd);
+            const payload = getDaemonLockPayload(root);
             if (payload?.pid && payload.pid > 0) {
                 try {
                     process.kill(payload.pid, 'SIGTERM');
                 }
                 catch { /* already dead */ }
             }
-            const lockFile = join(cwd, '.moflo', 'daemon.lock');
+            const lockFile = join(root, '.moflo', 'daemon.lock');
             try {
                 if (existsSync(lockFile))
                     unlinkSync(lockFile);