vexp-cli 3.1.0 → 3.1.2

package/dist/doctor.js

@@ -5,7 +5,9 @@ import * as net from "net";
 import { spawnSync } from "child_process";
 import chalk from "chalk";
 import { socketPathFor } from "./socket-path.js";
-import { parseJsonc } from "./agent-config.js";
+import { parseJsonc, isWsl, windsurfWslBridgeNote, windsurfGlobalMcpPath } from "./agent-config.js";
+import { resolveParentWorkspace, listWorkspaceRepos } from "./workspace-repos.js";
+import { CLI_VERSION } from "./version.js";
 // `vexp doctor` — audit the vexp MCP/daemon state WITHOUT connecting to a daemon.
 // Surfaces the failure modes behind the Codex drift report: stale daemons.json
 // entries, wrong-workspace resolution, mixed Codex transport (url+stdio),
@@ -24,7 +26,8 @@ function vexpHome() {
 function discoverWorkspaceRoot(start) {
     for (const test of [
         (d) => fs.existsSync(path.join(d, ".vexp", "manifest.json")) || fs.existsSync(path.join(d, ".vexp", "index.db")),
-        (d) => fs.existsSync(path.join(d, ".vexp")),
+        // Bare .vexp — except home/VEXP_HOME, whose .vexp is vexp's state dir.
+        (d) => fs.existsSync(path.join(d, ".vexp")) && path.resolve(d) !== path.resolve(vexpHome()),
         (d) => fs.existsSync(path.join(d, ".git")),
     ]) {
         let cur = start;
@@ -204,7 +207,7 @@ export function gitHooksVerdict(hooksPath, repoRoot, installedCount) {
  * wherever it stands. Null when nothing was skipped for size, or when the
  * file predates 3.1 and has no skip keys.
  */
-export function coverageVerdict(cov) {
+export function coverageVerdict(cov, coveragePath = ".vexp/coverage.json") {
     if (!cov || typeof cov !== "object")
         return null;
     const c = cov;
@@ -222,8 +225,13 @@ export function coverageVerdict(cov) {
         level: WARN,
         message: `${oversized} file(s) over max_file_size_kb = ${cap} are NOT indexed — their symbols and callers are invisible to impact, search and run_pipeline:\n` +
             examples.map((e) => `        - ${e}`).join("\n") +
-            (more > 0 ? `\n        … +${more} more (full list: .vexp/coverage.json)` : "") +
-            `\n        raise max_file_size_kb in .vexp/vexp.toml (0 = no cap) to include them, or exclude them on purpose with exclude_patterns.`,
+            (more > 0 ? `\n        … +${more} more` : "") +
+            // The path, not the name. coverage.json lives at the WORKSPACE root;
+            // a tester on a monorepo looked for it beside the package he was
+            // working in, found nothing, and concluded the feature had not
+            // shipped (tier-4 field report, 2026-09-05).
+            `\n        full list: ${coveragePath}` +
+            `\n        raise max_file_size_kb in .vexp/vexp.toml (0 = no cap) to include them, or exclude them on purpose with exclude_patterns — excluded files stop being counted here at the next reindex ('vexp index').`,
     };
 }
 /**
@@ -266,8 +274,85 @@ export function vsCodeMcpVerdict(cfg, wsRoot, exists = (p) => fs.existsSync(p))
     }
     return { level: OK, message: `.vscode/mcp.json vexp server: ${command} ${script ?? args.join(" ")}` };
 }
+/**
+ * How doctor runs a Codex `UserPromptSubmit` hook line: the way Codex does.
+ * On Windows Codex hands `cmd.exe /C` the WHOLE line wrapped in one more pair
+ * of quotes, verbatim (codex-rs/hooks engine/command_runner: `raw_arg`), and
+ * cmd strips that outer pair — which is why the installer may quote the
+ * script path. Passing the line as a normal argument instead lets Node escape
+ * the inner quotes, and cmd then looks for a program literally named
+ * `\"D:\…\vexp-hint.cmd\"` (field report, 2026-09-01: a correct hooks.json
+ * failed doctor's probe and passed once the user removed the quotes).
+ */
+export function codexHookSpawnSpec(cmdLine, platform = process.platform, comspec = process.env.COMSPEC) {
+    if (platform === "win32") {
+        return { file: comspec || "cmd.exe", args: ["/C", `"${cmdLine}"`], windowsVerbatimArguments: true };
+    }
+    return { file: "sh", args: ["-c", cmdLine], windowsVerbatimArguments: false };
+}
+function samePath(a, b) {
+    // The daemon registry lower-cases Windows roots; compare accordingly.
+    return path.resolve(a).toLowerCase() === path.resolve(b).toLowerCase();
+}
+/**
+ * A connected repo of a multi-repo workspace has no daemon of its own: the
+ * parent's daemon serves it. Doctor run inside such a repo used to treat it as
+ * a standalone workspace — "daemon NOT reachable", "NOT registered" — while
+ * `vexp search` from the same directory answered fine (field report,
+ * 2026-09-01, nine repos). The link is `.vexp/parent_workspace.json` in the
+ * member; when that file is missing, any registered workspace whose
+ * workspace.json lists this directory is the parent.
+ */
+export function resolveMemberParent(root, registryRoots) {
+    const link = resolveParentWorkspace(root);
+    if (link) {
+        const alias = listWorkspaceRepos(link.parentRoot).find((r) => samePath(r.resolvedPath, root))?.alias
+            ?? path.basename(root);
+        return { parentRoot: link.parentRoot, alias, via: ".vexp/parent_workspace.json" };
+    }
+    for (const reg of registryRoots) {
+        if (samePath(reg, root))
+            continue;
+        const hit = listWorkspaceRepos(reg).find((r) => !r.isPrimary && samePath(r.resolvedPath, root));
+        if (hit)
+            return { parentRoot: reg, alias: hit.alias, via: `${path.join(reg, ".vexp", "workspace.json")} (daemon registry)` };
+    }
+    return null;
+}
+/**
+ * Coverage verdicts for the workspace at `root` AND every repo connected to
+ * it, each tagged with its alias. Each repo's indexer writes its own
+ * `.vexp/coverage.json`; reading only the primary's hid three oversized files
+ * in a connected repo from a doctor run at the primary (same report).
+ */
+export function workspaceCoverageFindings(root) {
+    const repos = listWorkspaceRepos(root);
+    const targets = repos.map((r) => ({ alias: r.alias, dir: r.resolvedPath, primary: r.isPrimary }));
+    if (!targets.some((t) => t.primary))
+        targets.unshift({ alias: path.basename(root), dir: root, primary: true });
+    const out = [];
+    for (const t of targets) {
+        let cov;
+        try {
+            cov = JSON.parse(fs.readFileSync(path.join(t.dir, ".vexp", "coverage.json"), "utf-8"));
+        }
+        catch {
+            continue; /* never indexed, or an index older than 2.7 */
+        }
+        const v = coverageVerdict(cov, path.join(t.dir, ".vexp", "coverage.json"));
+        if (v)
+            out.push({ level: v.level, message: targets.length > 1 ? `[${t.alias}] ${v.message}` : v.message });
+    }
+    return out;
+}
 export async function runDoctor() {
     const home = vexpHome();
+    const regPath = path.join(home, ".vexp", "daemons.json");
+    let registry = {};
+    try {
+        registry = JSON.parse(fs.readFileSync(regPath, "utf-8"));
+    }
+    catch { /* absent */ }
     let warns = 0;
     let fails = 0;
     const line = (status, msg) => {
@@ -280,8 +365,15 @@ export async function runDoctor() {
     console.log(chalk.bold("\nvexp doctor — MCP / daemon diagnostics\n"));
     // 1) Workspace resolution for the current directory.
     console.log(chalk.bold("Workspace targeting"));
-    const ws = resolveWorkspace();
+    const resolved = resolveWorkspace();
+    const member = resolveMemberParent(resolved.root, Object.keys(registry));
+    const ws = member
+        ? { root: member.parentRoot, source: `repo '${member.alias}' of the multi-repo workspace, linked by ${member.via}` }
+        : resolved;
     console.log(`  cwd: ${process.cwd()}`);
+    if (member) {
+        line(OK, `this directory is repo '${member.alias}' of the multi-repo workspace at ${member.parentRoot} — served by that workspace's daemon; diagnostics below target it`);
+    }
     line(OK, `resolves to: ${ws.root}  (via ${ws.source})`);
     // A *global* VEXP_WORKSPACE env var overrides the per-session signal
     // (CLAUDE_PROJECT_DIR) for EVERY agent session, pinning Claude *and* Codex to
@@ -307,9 +399,18 @@ export async function runDoctor() {
     if (live) {
         const st = await queryDaemon(sock, "index_status");
         if (st) {
+            // A daemon that is still loading its model answers "rule", which reads
+            // as a downgrade for the ~20s it takes to settle. The daemon already
+            // says which of the two it is; doctor was printing the label and
+            // dropping the reason (tier-4 field report, 2026-09-05).
+            const loading = st.compressor !== "llm"
+                && typeof st.llm_inactive_reason === "string"
+                && /still loading|finishing its startup/i.test(st.llm_inactive_reason);
             const comp = st.compressor === "llm"
                 ? `llm (${st.llm_model ?? "?"}, ${st.llm_inference ?? "?"})`
-                : st.compressor ?? "unknown (older daemon)";
+                : loading
+                    ? "loading (the model is still starting — this is not the rule compressor settling in)"
+                    : st.compressor ?? "unknown (older daemon)";
             line(OK, `index: ${st.total_files ?? "?"} files · ${st.total_nodes ?? "?"} nodes · state ${st.status ?? "?"} · compressor ${comp}`);
             if (st.llm_configured_but_inactive === true) {
                 // The daemon knows WHY, and doctor was throwing it away: it printed
@@ -388,21 +489,12 @@ export async function runDoctor() {
     // 3.1 — coverage gaps only the daemon log used to witness. Read from disk,
     // not from the daemon: the index that skipped the files may have been
     // built by a daemon that is no longer running.
-    try {
-        const cov = JSON.parse(fs.readFileSync(path.join(ws.root, ".vexp", "coverage.json"), "utf-8"));
-        const v = coverageVerdict(cov);
-        if (v)
-            line(v.level, v.message);
-    }
-    catch { /* no coverage.json: never indexed here, or an index older than 2.7 */ }
+    // Every connected repo has its own coverage.json; each finding carries the
+    // repo alias so a run at the primary sees the whole workspace.
+    for (const f of workspaceCoverageFindings(ws.root))
+        line(f.level, f.message);
     // 2) Daemon registry (~/.vexp/daemons.json) — stale entries are a drift source.
     console.log(chalk.bold("\nDaemon registry (~/.vexp/daemons.json)"));
-    const regPath = path.join(home, ".vexp", "daemons.json");
-    let registry = {};
-    try {
-        registry = JSON.parse(fs.readFileSync(regPath, "utf-8"));
-    }
-    catch { /* absent */ }
     const entries = Object.entries(registry);
     if (entries.length === 0) {
         line(OK, "no registered daemons (empty/absent registry)");
@@ -540,6 +632,32 @@ export async function runDoctor() {
             console.log(chalk.dim("        server log: Command Palette → 'MCP: List Servers' → vexp → Show Output (channel 'MCP: vexp'); daemon log: .vexp/daemon.log"));
         }
     }
+    // 5a-bis) WSL: agents on the Windows side read Windows-side configs, which
+    // nothing running in WSL can see or write. Say so, and for Windsurf hand
+    // over the exact entry (field report, 2026-09-01: a user built the bridge by
+    // hand and found no documentation).
+    if (isWsl()) {
+        console.log(chalk.bold("\nWSL"));
+        const distro = process.env.WSL_DISTRO_NAME ?? "?";
+        line(OK, `running inside WSL (${distro}) — editors and apps on the Windows side read their own configs there; vexp writes only WSL-side files`);
+        const windsurfHere = fs.existsSync(path.join(ws.root, ".windsurf")) || fs.existsSync(path.join(ws.root, ".devin"));
+        if (windsurfHere) {
+            let bin = "vexp-core";
+            try {
+                const { getBinaryPath } = await import("./binary.js");
+                bin = getBinaryPath();
+            }
+            catch { /* note still useful without the exact binary path */ }
+            const bundle = path.join(path.dirname(new URL(import.meta.url).pathname), "..", "mcp", "mcp-server.cjs");
+            line(WARN, `Windsurf/Devin Desktop on Windows will not read ${windsurfGlobalMcpPath()} (WSL home). Windows-side entry to paste:`);
+            for (const l of windsurfWslBridgeNote(ws.root, bin, fs.existsSync(bundle) ? bundle : undefined).split("\n")) {
+                console.log(chalk.dim(`        ${l}`));
+            }
+        }
+        else {
+            console.log(chalk.dim("        Windows-side apps (Codex app, Claude Desktop, Windsurf) need a wsl.exe bridge entry: https://vexp.dev/docs#windows-wsl"));
+        }
+    }
     // 5b) Claude Code guard hook — EXECUTE it the way Claude Code would, don't
     // just check presence. A shell-form command that word-splits on a project
     // path containing a space fails non-blocking on every call: the guard never
@@ -792,15 +910,18 @@ export async function runDoctor() {
                 line(BAD, "the entry has no 'commandWindows' — Codex runs hooks through cmd.exe on Windows, which cannot run the bash script, so orientation never fires (unless Git Bash is on PATH). Re-run 'vexp setup' to write the batch twin.");
             }
             else {
-                // Run it, through the same shell Codex would use: cmd.exe on
-                // Windows (COMSPEC), sh elsewhere. The script bakes an absolute path
+                // Run it, through the same shell Codex would use — cmd.exe on
+                // Windows (COMSPEC) with the line wrapped the way Codex wraps it, sh
+                // elsewhere (codexHookSpawnSpec). The script bakes an absolute path
                 // to the vexp binary and exits 0 when that path is not executable, so
                 // a stale or wrong-profile path leaves NO trace anywhere: no
                 // orientation, no error, forever. A Windows user found exactly that
                 // by reading the generated file.
                 const isWin = process.platform === "win32";
                 const cmdLine = (isWin ? hook.commandWindows : hook.command);
-                const r = spawnSync(isWin ? (process.env.COMSPEC || "cmd.exe") : "sh", [isWin ? "/c" : "-c", cmdLine], {
+                const spec = codexHookSpawnSpec(cmdLine);
+                const r = spawnSync(spec.file, spec.args, {
+                    windowsVerbatimArguments: spec.windowsVerbatimArguments,
                     env: { ...process.env, CLAUDE_PROJECT_DIR: ws.root },
                     input: JSON.stringify({ session_id: "vexp-doctor", prompt: "vexp doctor probe", cwd: ws.root }),
                     timeout: 10000,
@@ -897,11 +1018,54 @@ export async function runDoctor() {
             }
         }
     }
+    // A supervisor from an older install respawning the current bundle. It
+    // keeps reclaiming :7821 every 60s, and NO takeover rule on this side can
+    // stop it: the old process runs the old comparison. The only fix is to end
+    // it, so doctor has to name it — with its pid, which the record now
+    // carries. A tester spent a night on a :7821 server that came back with a
+    // new pid every two minutes, reported as v3.0.1 on a machine where 3.0.1
+    // was not installed anywhere: the LABEL came from a `vexp serve` resident
+    // since before the upgrade, holding its own version in memory
+    // (field report, 2026-09-06).
+    const staleSupervisorLine = (rec) => {
+        const by = typeof rec.spawnedBy === "string" ? rec.spawnedBy : undefined;
+        if (!by || by === CLI_VERSION)
+            return;
+        const pid = typeof rec.spawnedByPid === "number" ? rec.spawnedByPid : undefined;
+        const stillUp = pid !== undefined && isAlive(pid);
+        const who = rec.owner === "serve" ? "'vexp serve' supervisor" : `${rec.owner ?? "process"}`;
+        line(WARN, `that server was spawned by a ${who} running v${by}, not v${CLI_VERSION}` +
+            (pid ? ` (pid ${pid}${stillUp ? ", still running" : ", already gone"})` : "") +
+            `\n        an older supervisor reclaims :${rec.port} on its own schedule and cannot be stopped by re-running setup` +
+            // Ending it is the whole remediation: login autostart (or the next
+            // `vexp` command) starts a fresh supervisor, which reads the current
+            // package.json and serves the current build. The tester who did this
+            // had a correct server one second later without running anything
+            // else — and the `vexp setup` this line used to recommend blocks on
+            // an interactive prompt, which for the reader of a doctor line is a
+            // hang, not a fix (field report, 2026-09-07).
+            (stillUp ? `\n        end it — 'kill ${pid}' — a fresh supervisor starts on its own and serves the current build` : ""));
+    };
     // 6) HTTP MCP supervisor.
     console.log(chalk.bold("\nHTTP MCP supervisor (~/.vexp/mcp.pid)"));
     try {
         const rec = JSON.parse(fs.readFileSync(path.join(home, ".vexp", "mcp.pid"), "utf-8"));
-        line(isAlive(rec.pid) ? OK : WARN, `pid ${rec.pid} on :${rec.port} — ${isAlive(rec.pid) ? "alive" : "DEAD (stale pid file)"}`);
+        const alive = isAlive(rec.pid);
+        line(alive ? OK : WARN, `pid ${rec.pid} on :${rec.port} — ${alive ? "alive" : "DEAD (stale pid file)"}${rec.version ? ` · v${rec.version}` : ""}`);
+        if (alive && rec.version === CLI_VERSION)
+            staleSupervisorLine(rec);
+        // The supervisor is replaced on version mismatch only when a vexp command
+        // next runs; until then every HTTP client (Codex http transport, a
+        // `serverUrl` entry) talks to the OLD build — which advertises the old
+        // tool surface (2 tools before 2.7.0) and none of the newer fixes. A user
+        // saw two vexp servers with different tool counts and could not tell why.
+        if (alive && rec.version && rec.version !== CLI_VERSION) {
+            line(WARN, `the HTTP MCP server on :${rec.port} is v${rec.version} but this CLI is v${CLI_VERSION} — HTTP clients get the old build until it is replaced — run 'vexp setup' in the WORKSPACE ROOT (the directory holding .vexp/) and the current CLI takes it over`);
+            staleSupervisorLine(rec);
+        }
+        else if (alive && !rec.version) {
+            line(WARN, `the HTTP MCP server on :${rec.port} predates version tracking (older than 2.4) — run 'vexp setup' in the WORKSPACE ROOT so the current CLI replaces it and HTTP clients get v${CLI_VERSION}`);
+        }
     }
     catch {
         line(OK, "not running (no mcp.pid)");
@@ -916,4 +1080,8 @@ export async function runDoctor() {
         console.log(chalk.dim("  Tips: 'vexp daemon-cmd restart' restarts the workspace daemon; 'vexp setup' rewrites agent configs; restart Codex to drop a cached config."));
     }
     console.log("");
+    // Scripts and CI read the exit code, not the colors: any FAIL exits 1.
+    // Warnings alone stay 0 — advice, not breakage (field request, 2026-09-02).
+    if (fails > 0)
+        process.exitCode = 1;
 }

package/dist/mcp-supervisor.js

@@ -33,6 +33,8 @@ export function readPidRecord() {
                 // pass (measured 60.7s replacement period). The reuse fast path
                 // is only as good as the record it reads.
                 version: typeof rec.version === "string" ? rec.version : undefined,
+                spawnedBy: typeof rec.spawnedBy === "string" ? rec.spawnedBy : undefined,
+                spawnedByPid: typeof rec.spawnedByPid === "number" ? rec.spawnedByPid : undefined,
             };
         }
     }
@@ -97,6 +99,48 @@ export function resolveOrGenerateMcpToken() {
  * The MCP server is deliberately workspace-agnostic: clients disambiguate
  * via URL path /ws/<workspaceHash>/mcp. No VEXP_WORKSPACE env is passed.
  */
+/**
+ * Is the running server's version strictly older than ours?
+ *
+ * A record with no version predates version tracking (< 2.4) and counts as
+ * older. An unparseable version counts as older too: replacing it once is
+ * recoverable, whereas deferring to it forever is what the field report
+ * showed. A NEWER server is left alone — this process is the stale one.
+ */
+/**
+ * The version of the MCP bundle at `mcpPath`, read from the package.json that
+ * ships it — the build a client will actually be served, as opposed to the
+ * version of whatever process happens to be spawning it.
+ */
+export function mcpBundleVersion(mcpPath) {
+    const pkg = path.resolve(path.dirname(mcpPath), "..", "package.json");
+    try {
+        const parsed = JSON.parse(fs.readFileSync(pkg, "utf-8"));
+        if (typeof parsed.version === "string")
+            return parsed.version;
+    }
+    catch { /* not readable: fall back to the caller's own version */ }
+    return undefined;
+}
+export function isOlderVersion(recorded, mine) {
+    if (!recorded)
+        return true;
+    if (recorded === mine)
+        return false;
+    const parts = (v) => {
+        const nums = v.split("-")[0].split(".").map((n) => Number.parseInt(n, 10));
+        return nums.length === 3 && nums.every((n) => Number.isFinite(n)) ? nums : null;
+    };
+    const a = parts(recorded);
+    const b = parts(mine);
+    if (!a || !b)
+        return true;
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] < b[i];
+    }
+    return false;
+}
 export async function ensureMcpHttpServer(opts = {}) {
     const port = opts.port ?? DEFAULT_PORT;
     const owner = opts.owner ?? "unknown";
@@ -104,15 +148,23 @@ export async function ensureMcpHttpServer(opts = {}) {
     const mcpPath = getMcpServerPath();
     if (!mcpPath)
         return null;
-    // Fast path: already alive and tracked - but only if it is OUR version.
-    // Field report (Nathan): a 2.3.0 http server stayed authoritative for
-    // 9 days across extension upgrades because reuse never compared
-    // versions. On mismatch (or a legacy record without one) we take over:
-    // SIGTERM the old listener and spawn the current build.
+    // Fast path: already alive and tracked - but only if it is not OLDER than
+    // us. Field report (Nathan): a 2.3.0 http server stayed authoritative for
+    // 9 days across extension upgrades because reuse never compared versions.
+    // On an older server we take over: SIGTERM the old listener and spawn the
+    // current build.
+    //
+    // The comparison is ORDERED, not an equality check. Equality made takeover
+    // symmetric, so two installs of different versions each saw the other as
+    // "not mine" and reclaimed the port from it — and `vexp serve` re-runs this
+    // every 60s, so a supervisor left behind by an older install resurrected
+    // its own build indefinitely. A tester watched a v3.0.1 server come back
+    // after being replaced by v3.1.1, with a fresh pid (tier-4 field report,
+    // 2026-09-05). An older build now stands down and reuses what is there.
     {
         const existing = readPidRecord();
         if (existing && existing.port === port && isPidAlive(existing.pid) && (await isPortInUse(port))) {
-            if (existing.version === CLI_VERSION) {
+            if (!isOlderVersion(existing.version, CLI_VERSION)) {
                 return { pid: existing.pid, port, started: false };
             }
             try {
@@ -184,7 +236,15 @@ export async function ensureMcpHttpServer(opts = {}) {
         const pid = child.pid;
         if (!pid)
             return null;
-        writePidRecord({ pid, port, startedAt: Date.now(), owner, version: CLI_VERSION });
+        writePidRecord({
+            pid,
+            port,
+            startedAt: Date.now(),
+            owner,
+            version: mcpBundleVersion(mcpPath) ?? CLI_VERSION,
+            spawnedBy: CLI_VERSION,
+            spawnedByPid: process.pid,
+        });
         // Wait for the child to actually bind the port BEFORE releasing the
         // lock. Without this, a second caller arriving right after release
         // sees pidfile+live-pid but port-not-yet-bound → falsely concludes

package/dist/serve.js

@@ -108,6 +108,33 @@ export function isOwnerEntry(ws, sock) {
  *  cross-wired daemon serving the child's index on the parent's socket, which
  *  then blocked every legitimate restart of the parent (it held the bind) and
  *  never matched the parent's config. Routing rows must never be spawned. */
+/** A linked git worktree: `.git` is a FILE whose `gitdir:` points into
+ *  `<main>/.git/worktrees/`. Agent harnesses create one per parallel task
+ *  (Claude Code under `.claude/worktrees/`, Cursor, plain `git worktree add`
+ *  — the detection is the file's content, never a path convention). After a
+ *  reboot the supervisor resurrected 15 of them alongside 2 canonical repos
+ *  and took a 16-core host down: ~1,585% CPU, 2 GB/s of reads, hard reset
+ *  (field incident, 2026-09-02, tier 3). Worktree daemons run on demand
+ *  only; resurrection is for canonical workspaces. A submodule's gitdir
+ *  points at `/.git/modules/` and is left alone. Mirrors vexp-core
+ *  utils::git_project_root. */
+export function isLinkedWorktree(ws) {
+    try {
+        const dotGit = path.join(ws, ".git");
+        if (fs.statSync(dotGit).isDirectory())
+            return false;
+        const gitdir = fs
+            .readFileSync(dotGit, "utf-8")
+            .split(/\r?\n/)
+            .find((l) => l.trim().startsWith("gitdir:"));
+        if (!gitdir)
+            return false;
+        return gitdir.replace(/\\/g, "/").includes("/.git/worktrees/");
+    }
+    catch {
+        return false;
+    }
+}
 export function resurrectionPlan(reg) {
     const bySock = new Map();
     for (const [ws, sock] of Object.entries(reg)) {
@@ -156,17 +183,70 @@ async function resurrectAll() {
             appendLog(`registry prune: ${ws} (no manifest)`);
             continue;
         }
+        if (isLinkedWorktree(ws)) {
+            appendLog(`registry prune: ${ws} (linked git worktree — on-demand only, never resurrected)`);
+            continue;
+        }
         pruned[ws] = sock;
     }
     const resurrected = new Map();
+    // Stagger actual spawns: every freshly started daemon runs its checkout
+    // sync and reconcile immediately, and a burst of them after a reboot is an
+    // IO storm (same incident as above). Rows whose socket is already alive
+    // cost nothing and are not delayed.
+    let spawnedOne = false;
     for (const { ws, sock } of resurrectionPlan(pruned)) {
+        const alive = await isSocketAlive(sock);
+        if (!alive && spawnedOne)
+            await new Promise((r) => setTimeout(r, 2000));
         resurrected.set(sock, await resurrectDaemon(ws, sock));
+        if (!alive)
+            spawnedOne = true;
     }
     for (const [ws, sock] of Object.entries(pruned)) {
         if (resurrected.get(sock))
             live[ws] = sock;
     }
-    writeRegistry(live);
+    // A row this supervisor did not resurrect is not thereby dead.
+    //
+    // `live` used to become the WHOLE new registry, so every row the plan
+    // skipped — another supervisor's daemon, a linked worktree, a workspace
+    // whose manifest had moved — was deleted while its daemon was still
+    // running and answering on its socket. The health loop re-runs this every
+    // 60s, so the deletion was permanent and self-renewing: on a tester's
+    // machine two daemons that had been serving a pre-upgrade build for five
+    // days disappeared from `vexp daemons`, from `index_status`'s "other live
+    // daemons" and from the concurrency fence the moment a supervisor
+    // restarted, leaving a three-daemon box reporting a clean single-workspace
+    // install (field report, 2026-09-07).
+    //
+    // Liveness decides what stays in the registry, never ownership. The fence
+    // counts these rows, so dropping a live daemon also made the cap evadable
+    // by restarting a supervisor.
+    writeRegistry(await survivingRegistryRows(reg, live, isSocketAlive, appendLog));
+}
+/**
+ * The rows that stay in `~/.vexp/daemons.json` after a resurrection pass:
+ * everything this supervisor brought up, PLUS every other row whose daemon is
+ * still answering. Only a row that is neither is dropped.
+ *
+ * Separated out because the rule is the whole bug: a supervisor may only
+ * report what it could not find, never delete what it does not own.
+ */
+export async function survivingRegistryRows(before, resurrected, alive, log = () => { }) {
+    const canonical = (ws) => (process.platform === "win32" ? ws.toLowerCase() : ws);
+    const out = { ...resurrected };
+    const kept = new Set(Object.keys(out).map(canonical));
+    for (const [ws, sock] of Object.entries(before)) {
+        if (kept.has(canonical(ws)))
+            continue;
+        if (await alive(sock)) {
+            out[ws] = sock;
+            kept.add(canonical(ws));
+            log(`registry keep: ${ws} (not ours to resurrect, but its daemon is alive)`);
+        }
+    }
+    return out;
 }
 async function startMcp() {
     const port = parseInt(process.env.VEXP_PORT ?? String(DEFAULT_MCP_PORT), 10);