swarph-cli 0.62.0__tar.gz → 0.63.0__tar.gz

{swarph_cli-0.62.0/src/swarph_cli.egg-info → swarph_cli-0.63.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: swarph-cli
-Version: 0.62.0
+Version: 0.63.0
 Summary: The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`.
 Author: Pierre Samson, Claude Opus
 License: MIT
@@ -148,6 +148,7 @@ swarph guide                      # the whole guide
 swarph guide channels             # one topic
 swarph guide --list               # every topic, with the commands it teaches
 swarph guide --search subscribe   # find a topic by INTENT, not by its name
+swarph guide doctrine             # the standard of evidence a cell is held to (v0.63.0)
 ```
 
 Three ways in, because a new cell does not know which word it has:

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/README.md

@@ -100,6 +100,7 @@ swarph guide                      # the whole guide
 swarph guide channels             # one topic
 swarph guide --list               # every topic, with the commands it teaches
 swarph guide --search subscribe   # find a topic by INTENT, not by its name
+swarph guide doctrine             # the standard of evidence a cell is held to (v0.63.0)
 ```
 
 Three ways in, because a new cell does not know which word it has:

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "swarph-cli"
-version = "0.62.0"
+version = "0.63.0"
 description = "The `swarph` binary — a multi-LLM CLI and mesh-gateway client + bundled server (`swarph gateway`): one-shot prompts across providers, interactive `chat`, multi-provider `spawn` (claude/codex/antigravity via a ProviderMembrane with subprocess billing-scrub), `mesh` send/inbox/register, `brain-ask` over the swarph-brain (gbrain) semantic memory, git-backed `assisted_memory`, per-invocation `gh` identity routing, a silent DM-wake hook, session `import`, and a stranded-session `watchdog`."
 readme = "README.md"
 license = { text = "MIT" }

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/__init__.py

@@ -16,6 +16,6 @@ The architecture splits CLI from substrate so:
 
 from __future__ import annotations
 
-__version__ = "0.62.0"
+__version__ = "0.63.0"
 
 __all__ = ["__version__"]

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/board.py

@@ -390,8 +390,38 @@ def _thread_url(gateway: str, card_id: int, *, limit: Optional[int] = None) -> s
     return f"{base}?limit={limit}" if limit else base
 
 
-def _thread_recipient(card: dict, explicit_to: Optional[str]) -> str:
-    """Who a card-thread post is addressed to. `--to` wins, else the assignee.
+def _project_owner_orchestrator(gw: str, token: str, project_id) -> Optional[str]:
+    """Resolve ``projects.owner_orchestrator`` for a card's project_id.
+
+    >>> THE CARD PAYLOAD DOES NOT CARRY THE OWNER (#864). <<< Measured
+    2026-09-17: GET /board/cards/{id} has assignee/project_id and no owner
+    field; GET /board/projects rows carry ``owner_orchestrator`` (NOT NULL on
+    the server). A second call is required — inventing a sentinel peer is the
+    #259 failure mode this helper exists to avoid.
+    """
+    if project_id is None:
+        return None
+    st, data = _http_get_json(f"{gw.rstrip('/')}/board/projects", token)
+    if st != 200:
+        return None
+    rows = data if isinstance(data, list) else (data or {}).get("projects", [])
+    for row in rows or []:
+        if row.get("id") == project_id or str(row.get("id")) == str(project_id):
+            owner = (row.get("owner_orchestrator") or "").strip()
+            return owner or None
+    return None
+
+
+def _thread_recipient(
+    card: dict,
+    explicit_to: Optional[str],
+    *,
+    owner_orchestrator: Optional[str] = None,
+) -> "tuple[str, str]":
+    """Who a card-thread post is addressed to, and why.
+
+    Order: ``--to`` > card assignee > project ``owner_orchestrator`` (#864).
+    Returns ``(to_node, reason)`` so the confirmation line can name the choice.
 
     >>> RAISES RATHER THAN INVENTING A SENTINEL. <<< POST /messages requires
     exactly one of {to_node, channel}, so a card post needs a real recipient. The
@@ -401,18 +431,21 @@ def _thread_recipient(card: dict, explicit_to: Optional[str]) -> str:
     A placeholder here would manufacture that defect once per card post.
     """
     if explicit_to:
-        return explicit_to
+        return explicit_to, "--to"
     assignee = card.get("assignee")
     if assignee:
-        return assignee
+        return assignee, "card assignee"
+    if owner_orchestrator:
+        return owner_orchestrator, "project owner_orchestrator"
     raise RuntimeError(
-        f"card #{card.get('id')} has no assignee, so there is no default recipient "
-        f"for a thread post — pass --to <peer>. (A card post is still a DM on the "
-        f"wire; it needs someone to be addressed to.)"
+        f"card #{card.get('id')} has no assignee and project owner_orchestrator "
+        f"is unresolvable, so there is no default recipient for a thread post — "
+        f"pass --to <peer>. (A card post is still a DM on the wire; it needs "
+        f"someone to be addressed to.)"
     )
 
 
-def _say_line(resp: dict, card_id, to_node: str) -> str:
+def _say_line(resp: dict, card_id, to_node: str, *, reason: Optional[str] = None) -> str:
     """The post confirmation — AND any obligation the post just DISCHARGED.
 
     >>> THE GATEWAY ALREADY SAID SO AND THIS CLI THREW IT AWAY. <<< POST
@@ -435,7 +468,11 @@ def _say_line(resp: dict, card_id, to_node: str) -> str:
     POLICY (that is #562's own question) -- it is the fix for the holder not
     being told, which is what made six hours of divergence possible.
     """
-    line = f"posted id={resp.get('id')} onto card #{card_id} (to {to_node})"
+    if reason:
+        line = (f"posted id={resp.get('id')} onto card #{card_id} "
+                f"(to {to_node}; {reason})")
+    else:
+        line = f"posted id={resp.get('id')} onto card #{card_id} (to {to_node})"
     closed = resp.get("closed_obligations") or []
     if closed:
         ids = ", ".join(f"#{i}" for i in closed)
@@ -855,7 +892,8 @@ def _build_parser() -> argparse.ArgumentParser:
     add_content_args(cy)
     cy.add_argument("--kind", default="fyi", help="status|question|answer|unblock|fyi")
     cy.add_argument("--to", dest="to_node", default=None,
-                    help="recipient peer (default: the card's assignee)")
+                    help="recipient peer (default: card assignee, else project "
+                         "owner_orchestrator; refused if neither resolves)")
     _add_common(cy)
 
     ck = cards.add_parser(
@@ -1278,8 +1316,15 @@ def run_board(argv: list[str]) -> int:
                       f"(it predates #181a). Run scripts/migrate_card_threads.py on "
                       f"the gateway host.", file=sys.stderr)
                 return 1
+            # #864: card GET has no owner field — only fetch projects when the
+            # cheaper defaults (explicit --to, card assignee) are absent.
+            owner = None
+            if not args.to_node and not card.get("assignee"):
+                owner = _project_owner_orchestrator(gw, token, card.get("project_id"))
             try:
-                to_node = _thread_recipient(card, args.to_node)
+                to_node, reason = _thread_recipient(
+                    card, args.to_node, owner_orchestrator=owner,
+                )
             except RuntimeError as exc:
                 print(f"swarph board cards say: {exc}", file=sys.stderr)
                 return 1
@@ -1293,7 +1338,9 @@ def run_board(argv: list[str]) -> int:
             # explicit `propose` grant. `_out` passes `detail` through whole; it does
             # not need help, and a second copy of that logic is a second thing to
             # keep in sync.
-            return _out(st, d, lambda x: _say_line(x, args.id, to_node), aj)
+            return _out(
+                st, d, lambda x: _say_line(x, args.id, to_node, reason=reason), aj,
+            )
         if args.command == "ready":
             st, d = _patch_json(f"{gw}/board/cards/{args.id}", {"actor": self_name, "move_ready": not args.clear}, token)
             return _out(st, d, lambda x: f"card #{x.get('id')} move_ready -> {x.get('move_ready')}", aj)

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/codegraph.py

@@ -37,12 +37,65 @@ import sys
 from swarph_cli.commands.codegraph_hook import _match_quality
 
 DEFAULT_INDEX = os.path.expanduser("~/.swarph/codegraph/index.db")
-# NOTE: named DEFAULT_CALLER_CELL, not "*_CALLER" — this is an A8 caller-CELL
-# identity (sensitivity-gate scoping), not a SwarphCall `role.subrole.specific`
-# caller tag, and must NOT trip the repo-wide caller-convention meta-guard
-# (tests/test_caller_meta_guard.py) which validates every `*_CALLER` constant
-# against that unrelated dotted-slug convention.
-DEFAULT_CALLER_CELL = "lab-ovh"
+# >>> THERE IS NO DEFAULT IDENTITY ANY MORE. THIS CONSTANT IS GONE ON PURPOSE. <<<
+#
+# It used to read `DEFAULT_CALLER_CELL = "lab-ovh"`, and that one line meant every
+# unconfigured caller on lab-ovh queried with the ORCHESTRATOR'S READ AUTHORITY.
+#
+# MEASURED 2026-09-18 (science-claude, mesh 43183/43186/43188). The gateway was never
+# bypassed and nothing was ever spoofed: `_query_via_gateway` sends NO caller field, so
+# the server binds identity from the bearer token, correctly. What the default did was
+# pick WHICH REAL TOKEN got presented — `_resolve_token(self_name, ...)` reads the file
+# that name points at. A cell asking a question on this box authenticated AS lab-ovh,
+# with lab-ovh's genuine credential, and got a full, plausible, correctly-authorised
+# answer belonging to somebody else.
+#
+# >>> A WRONG-IDENTITY WRITE ANNOUNCES ITSELF — a DM arrives signed by the wrong cell
+# and someone notices. A WRONG-IDENTITY READ ANNOUNCES NOTHING. <<< It was found only
+# because a repo its owner KNEW they owned was missing from their own results.
+#
+# WHY REFUSE RATHER THAN WARN (commander, 2026-09-18 04:44Z): a warning on a read that
+# returns a correct-looking answer is a line of text above a result the caller already
+# believes. And the cost of refusing was measured first, not assumed — of 8 executable
+# `swarph` invocations in systemd + cron on lab-ovh, 7 already pass `--as` or
+# `--token-file`, and the 8th (`monitor reexec-on-change`) cannot authenticate at all:
+# no --gateway, no --token-file, no --as exists on that verb. SCHEDULED WORK BREAKS IN
+# ZERO PLACES. The population that pays is interactive use, which is the population
+# that was silently mis-attributed.
+#
+# $SWARPH_SELF STILL WORKS AND IS THE INTENDED PATH. It is a DECLARED identity. What is
+# refused is the *undeclared* case, where a package-level guess stood in for one.
+IDENTITY_UNSET = object()  # sentinel: argparse default when --caller-cell is omitted
+
+
+class IdentityNotDeclared(RuntimeError):
+    """No caller identity was declared and there is no default to fall back to."""
+
+
+def require_caller_cell(explicit=None, *, verb: str) -> str:
+    """Resolve the caller cell, or REFUSE.
+
+    Order: explicit flag -> $SWARPH_SELF -> $SWARPH_CELL -> refuse.
+
+    The refusal names the verb and every way to satisfy it, because an error that
+    says only "identity unset" moves the work to the reader.
+    """
+    if explicit not in (None, IDENTITY_UNSET) and str(explicit).strip():
+        return str(explicit).strip()
+    for var in ("SWARPH_SELF", "SWARPH_CELL"):
+        v = (os.environ.get(var) or "").strip()
+        if v:
+            return v
+    raise IdentityNotDeclared(
+        f"swarph {verb}: NO CALLER IDENTITY DECLARED, and there is no default.\n"
+        f"  This used to fall back to 'lab-ovh', which meant an undeclared caller\n"
+        f"  queried with that cell's read authority and got somebody else's answer.\n"
+        f"  Declare one of:\n"
+        f"    --caller-cell <cell>      for this invocation\n"
+        f"    SWARPH_SELF=<cell>        for this shell or unit\n"
+        f"    SWARPH_CELL=<cell>        (MCP hosts)\n"
+        f"  It is NOT guessable: this box hosts several cells under one uid."
+    )
 
 # NOT 1 and NOT 2. A distinct code so "nothing was searched" can never be confused
 # with a crash or a usage error, and so a caller can branch on it specifically.
@@ -332,7 +385,7 @@ def _query_via_gateway(gateway: str, query: str, limit: int, token_file):
     from swarph_cli.commands.mesh import _post_json, _resolve_token  # local import: keeps
     # the local-only path free of any mesh dependency, so an offline cell still works.
 
-    self_name = os.environ.get("SWARPH_SELF") or DEFAULT_CALLER_CELL
+    self_name = require_caller_cell(verb="codegraph")
     token = _resolve_token(self_name, token_file)
     body = {"query": query, "limit": max(1, min(int(limit), 25))}
     status, payload = _post_json(gateway.rstrip("/") + "/codegraph", body, token)
@@ -352,7 +405,9 @@ def run_codegraph(argv) -> int:
                     "is configured (the server searches and returns the answer); falls back to a local index.")
     ap.add_argument("query", help="natural-language query, e.g. 'which function escapes HTML'")
     ap.add_argument("--index", default=DEFAULT_INDEX, help=f"index db (default {DEFAULT_INDEX})")
-    ap.add_argument("--caller-cell", default=DEFAULT_CALLER_CELL, help="A8 caller identity (default lab-ovh)")
+    ap.add_argument("--caller-cell", default=IDENTITY_UNSET,
+                    help="A8 caller identity. NO DEFAULT — else $SWARPH_SELF / $SWARPH_CELL, "
+                         "else the command REFUSES rather than guessing (it used to guess lab-ovh).")
     ap.add_argument("--limit", type=int, default=8)
     ap.add_argument("--json", action="store_true", help="machine-readable JSON output")
     ap.add_argument("--gateway", default=None,

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/guide.py

@@ -130,6 +130,38 @@ def _commands_in(section: str) -> "list[str]":
     return out
 
 
+def verbs_in_guide(topics: "dict[str, str] | None" = None) -> "set[str]":
+    """#547: the verbs the guide TEACHES, counted PER VERB (a topic count said 11 and
+    meant nothing). A verb is covered when some section's commands include it."""
+    topics = topics if topics is not None else _split_topics(_load_guide())
+    out: set[str] = set()
+    for body in topics.values():
+        for cmd in _commands_in(body):
+            parts = cmd.split()
+            if len(parts) >= 2:
+                out.add(parts[1])
+    return out
+
+
+def _registry() -> "list[str]":
+    # Lazy: main dispatches handlers by dotted path and does not import this module,
+    # but keep the direction one-way anyway.
+    from swarph_cli.main import registered_verbs
+    return registered_verbs()
+
+
+def _verb_entry(topics: "dict[str, str]", verb: str) -> "list[tuple[str, str]]":
+    """The line in each topic that teaches `swarph <verb>` -- one per topic, first hit."""
+    pat = re.compile(r"`swarph " + re.escape(verb) + r"(?:[ `])")
+    hits: list[tuple[str, str]] = []
+    for name, body in topics.items():
+        for raw in body.splitlines():
+            if pat.search(raw):
+                hits.append((name, raw.strip()))
+                break
+    return hits
+
+
 _TERM_RE = re.compile(r"\*\*(.+?)\*\*")
 
 
@@ -262,13 +294,21 @@ def run_guide(argv: "list[str]") -> int:
         # `apropos`: an LLM arrives with an INTENT ("subscribe to updates"), not the
         # topic's name ("channels"). Requiring the name is the #520 discovery defect
         # reproduced inside its own fix.
+        term = args.search.strip().lower()
+        # #547: a VERB name resolves to the verb's own entry first -- `--search highlight`
+        # used to answer with a topic list that did not contain it.
+        verb_hits = _verb_entry(topics, term) if term in _registry() else []
         hits = _search(topics, args.search)
-        if not hits:
+        if not hits and not verb_hits:
             print_safe(f"swarph guide: nothing matches {args.search!r}. "
                        f"Topics: {', '.join(topics)}", stream=sys.stderr)
             return 2
-        for name, line in hits:
+        for name, line in verb_hits:
             print_safe(f"{name:<22} {line}")
+        shown = {name for name, _ in verb_hits}
+        for name, line in hits:
+            if name not in shown:
+                print_safe(f"{name:<22} {line}")
         return 0
 
     if not args.topic:
@@ -279,6 +319,19 @@ def run_guide(argv: "list[str]") -> int:
     if key in topics:
         print_safe(topics[key])
         return 0
+    if key in _registry():
+        # #547: every registered verb resolves, per verb (tests/test_547 pins the set):
+        # the lines that teach it, then -- when the name is also a topic's substring
+        # (`channel` -> channels) -- that one topic, as before.
+        for name, line in _verb_entry(topics, key):
+            print_safe(f"{name:<22} {line}")
+        near = [k for k in topics if key in k]
+        if len(near) == 1:
+            print_safe("")
+            print_safe(topics[near[0]])
+        else:
+            print_safe(f"\n  more:  swarph {key} --help")
+        return 0
 
     # Substring fallback before failing: `swarph guide channel` should find `channels`.
     hits = [k for k in topics if key in k]

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/mcp_server.py

@@ -151,7 +151,8 @@ def _codegraph_query(query: str, *, limit: int = 8) -> list[dict]:
 
     Delegates to :func:`codegraph.structural_query` against the module-level
     ``_CODEGRAPH_INDEX`` path, using ``SWARPH_CELL`` (else
-    ``codegraph.DEFAULT_CALLER_CELL``) as the A8 caller identity and the
+    ``codegraph.require_caller_cell``, which REFUSES rather than defaulting) as
+    the A8 caller identity and the
     default operate-what-you-own allowlist (``allowlist=None``).
 
     NEVER raises — any exception (missing index, corrupt db, bad query, or
@@ -162,7 +163,13 @@ def _codegraph_query(query: str, *, limit: int = 8) -> list[dict]:
     to keep the tool output tight for the calling agent.
     """
     try:
-        caller_cell = os.environ.get("SWARPH_CELL", codegraph.DEFAULT_CALLER_CELL)
+        # NO DEFAULT IDENTITY (2026-09-18). `codegraph.DEFAULT_CALLER_CELL` is gone;
+        # an undeclared caller used to become lab-ovh and receive that cell's read
+        # authority. require_caller_cell raises IdentityNotDeclared, which the
+        # NEVER-RAISES contract below turns into an empty result — FAIL-CLOSED: the
+        # MCP host gets nothing rather than somebody else's answer.
+        caller_cell = codegraph.require_caller_cell(
+            os.environ.get("SWARPH_CELL"), verb="mcp codegraph_query")
         rows = codegraph.structural_query(
             query,
             index_path=_CODEGRAPH_INDEX,

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/mesh.py

@@ -1172,8 +1172,14 @@ class PullSink(Sink):
         return True
 
     def pending_label(self, count: int) -> str:
+        # #126: this is NOT gateway-unread. It is inbox.log entries newer than
+        # last_delivered_id — on a frozen ledger it grows at the cell's DM rate
+        # forever. Naming it "unread" taught cells to distrust status.
         plural = "s" if count != 1 else ""
-        return f"{count} unread DM{plural}"
+        return (
+            f"{count} DM{plural} newer than last delivery "
+            f"(inbox.log after ledger — not gateway unread)"
+        )
 
 
 class NoneSink(Sink):
@@ -1590,17 +1596,25 @@ def _write_ledgers_atomic(path: Path, ledgers: dict) -> None:
 
 def _replay_from_inbox_log(
     path: Path, after_id: int, limit: int
-) -> tuple[list, int]:
-    """Owed DMs newer than `after_id`, newest `limit` kept. Returns (dms, skipped).
+) -> tuple[list, int, list[str]]:
+    """Owed DMs newer than `after_id`, newest `limit` kept.
+
+    Returns ``(dms, skipped, pending_from)``.
+
+    ``pending_from`` is the distinct-sender set over EVERY matching log entry,
+    not over the capped ``dms`` list (#126). The deque bounds returned LINES;
+    the sender set was taken from it by convenience and understated who was
+    waiting (evicting the longest-waiting senders first).
 
     This is BOTH the restart-retry path and the late-attached-sink replay path.
     They are the same question — "what does this ledger still owe" — so they get
     one mechanism; two would drift.
     """
     if not path.exists():
-        return [], 0
+        return [], 0, []
     keep: deque = deque(maxlen=max(0, limit))
     total = 0
+    from_nodes: set[str] = set()
     try:
         with path.open("r", encoding="utf-8") as fp:
             for raw in fp:
@@ -1615,10 +1629,13 @@ def _replay_from_inbox_log(
                     continue
                 total += 1
                 keep.append(dm)
+                src = dm.get("from_node")
+                if src is not None and str(src):
+                    from_nodes.add(str(src))
     except OSError as exc:
         print(f"[monitor] cannot replay {path}: {exc}", file=sys.stderr, flush=True)
-        return [], 0
-    return list(keep), total - len(keep)
+        return [], 0, []
+    return list(keep), total - len(keep), sorted(from_nodes)
 
 
 class MonitorState:
@@ -2198,7 +2215,7 @@ def _monitor_deliver(state: MonitorState) -> None:
                       f"{sink.name} (cursor advanced; delivery still pending)",
                       flush=True)
                 continue
-            dms, skipped = _replay_from_inbox_log(
+            dms, skipped, _pending_from = _replay_from_inbox_log(
                 state.inbox_log_path, delivered, state.replay_limit
             )
             if skipped:

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/monitor.py

@@ -678,7 +678,7 @@ def _collect(args: argparse.Namespace) -> dict:
             continue
         led = ledgers.get(sink.name)
         delivered = int(led["last_delivered_id"]) if led else 0
-        dms, skipped = mesh._replay_from_inbox_log(
+        dms, skipped, pending_from = mesh._replay_from_inbox_log(
             inbox_log, delivered, mesh._MONITOR_REPLAY_LIMIT
         )
         rows.append({
@@ -690,7 +690,9 @@ def _collect(args: argparse.Namespace) -> dict:
             "consecutive_failures": int(led["consecutive_failures"]) if led else 0,
             "ledger_missing": led is None,
             "pending": len(dms) + skipped,
-            "pending_from": sorted({str(d.get("from_node")) for d in dms}),
+            # #126: same set as `pending` — distinct senders across EVERY log
+            # entry newer than last_delivered_id, not over the 50-entry deque.
+            "pending_from": pending_from,
             "label": sink.pending_label(len(dms) + skipped),
         })
 

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/onboard.py

@@ -1123,4 +1123,12 @@ def run_onboard(argv: list[str]) -> int:
         f"      swarph ratify {canonical} --reason \"<short text>\"\n"
         f"  to flip ratified=true.\n"
     )
+    # #866: mechanics without the standard of evidence is half an onboard.
+    # The doctrine topic is bundled; print the command, do not paste the body
+    # here (the guide is the record -- a paraphrase in this banner would drift).
+    print_safe(
+        "\n[doctrine] the standard of evidence ships in the guide, not only the verbs:\n"
+        "      swarph guide doctrine\n"
+        "  Authority: proven/docs/THE_TEN.md -- approved extract: card #866 post 42503.\n"
+    )
     return 0

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/spawn.py

@@ -2704,19 +2704,70 @@ class MuseMembrane(ClaudeMembrane):
         )
 
 
-#: Opencode cell subdir, created INSIDE the cell cwd, holding the relocated
-#: config (XDG_CONFIG_HOME) and data (XDG_DATA_HOME). Both relocations are
-#: grounded against real opencode 1.18.30 by execution: `XDG_DATA_HOME=/tmp/x
-#: opencode --pure db path` -> `/tmp/x/opencode/opencode.db`, and
-#: `XDG_CONFIG_HOME=/tmp/x opencode --pure debug config` -> `"plugin": []`.
+#: Opencode cell CONFIG subdir, created INSIDE the cell cwd, holding the
+#: relocated config (XDG_CONFIG_HOME). Grounded against real opencode 1.18.30 by
+#: execution: `XDG_CONFIG_HOME=/tmp/x opencode --pure debug config` ->
+#: `"plugin": []`.
 _OPENCODE_CELL_SUBDIR = ".opencode-cell"
 
 
 def _opencode_cell_dir(cell: Cell) -> Path:
-    """The cell's private opencode root (``<cwd>/.opencode-cell``)."""
+    """The cell's private opencode CONFIG root (``<cwd>/.opencode-cell``)."""
     return cell.cwd / _OPENCODE_CELL_SUBDIR
 
 
+def _opencode_data_dir(cell: Cell) -> Path:
+    """The cell's private opencode DATA dir, OUTSIDE the cell cwd.
+
+    opencode snapshots its work-tree with a git-dir UNDER this data dir. If the
+    data dir sits inside the work-tree (the pre-fix shape, ``<cwd>/.opencode-cell/
+    data``), the snapshot repo snapshots its own object store — a self-referential
+    explosion measured 2026-09-19 at 9.1 GB of objects and a 319k-entry index,
+    with every turn blocked at ``loop step=0`` on the resulting ``git add``. Kept
+    under $HOME so no cell work-tree can ever contain it. Grounded:
+    ``XDG_DATA_HOME=/tmp/x opencode --pure db path`` -> ``/tmp/x/opencode/opencode.db``.
+    """
+    return Path.home() / ".local" / "share" / "swarph" / "opencode" / cell.name
+
+
+def _migrate_opencode_data(cell: Cell) -> None:
+    """Move a pre-fix in-tree data dir to the out-of-tree root, best-effort.
+
+    Session continuity: the ``opencode.db`` holds the cell's session, keyed by
+    directory, so relocating it preserves the resume. Never raises; the failure
+    direction is a lost resume, not a refused spawn.
+    """
+    old = _opencode_cell_dir(cell) / "data"
+    new = _opencode_data_dir(cell)
+    if not old.is_dir():
+        return
+    if new.exists():
+        # Measured 2026-09-19 11:2xZ on lab-ovh: a cell process spawned BEFORE the fix
+        # kept running with the in-tree env and wrote a second data dir there after
+        # the first migration. It is not merged (two opencode.db files cannot be);
+        # say so where the operator is looking instead of skipping in silence.
+        print(f"[spawn] opencode: legacy in-tree data at {old} left in place -- {new} "
+              f"already exists, sessions written in-tree after the first migration are "
+              f"NOT merged; respawn the cell so no process still writes there",
+              file=sys.stderr)
+        return
+    try:
+        new.parent.mkdir(parents=True, exist_ok=True)
+        # #888 half (2): the in-tree data dir may carry the SELF-REFERENTIAL snapshot
+        # repo (the specimen: 9.0 GB of objects, a 319,621-entry index). It is
+        # opencode's own work-tree snapshot cache, recreated on the next turn, so
+        # drop it rather than carry it out of the tree. The PROJECT index is never
+        # touched here -- on lab-ovh nothing was ever tracked (git ls-files
+        # .opencode-cell = 0), and a blind reset of the clone that backs the
+        # editable install would be a worse defect than this one.
+        snap = old / "opencode" / "snapshot"
+        if snap.is_dir():
+            shutil.rmtree(snap, ignore_errors=True)
+        shutil.move(str(old), str(new))
+    except OSError:
+        pass
+
+
 def _scrub_opencode_namespace(env: dict[str, str]) -> None:
     """DENY-BY-DEFAULT scrub of the ``OPENCODE_*`` namespace.
 
@@ -2768,9 +2819,13 @@ def _opencode_env(cell: Cell) -> dict[str, str]:
     """Subscription env for a local ``opencode`` CELL.
 
     On top of the canonical billing scrub, the cell relocates opencode's CONFIG
-    (XDG_CONFIG_HOME) and DATA (XDG_DATA_HOME) into ``<cwd>/.opencode-cell``, and
-    links the operator's ``auth.json`` in, so the cell's sessions/plugins/auth
-    never mix with the operator's. ``$HOME`` is deliberately NOT relocated — the
+    (XDG_CONFIG_HOME) to ``<cwd>/.opencode-cell/config`` and its DATA
+    (XDG_DATA_HOME) to ``~/.local/share/swarph/opencode/<cell>`` — data OUTSIDE
+    the work-tree, because opencode's snapshot git-dir lives under the data dir
+    and would otherwise snapshot its own object store (the 2026-09-19 9 GB
+    self-referential explosion). It links the operator's ``auth.json`` in, so the
+    cell's sessions/plugins/auth never mix with the operator's. ``$HOME`` is
+    deliberately NOT relocated — the
     vibe/cursor lesson: a fake $HOME costs the cell ``~/.config/swarph/<self>.
     peer_token``, ``~/.swarph/secrets.toml`` and the codegraph hook, and opencode's
     XDG-honoring knobs let us pay nothing to keep it.
@@ -2788,7 +2843,8 @@ def _opencode_env(cell: Cell) -> dict[str, str]:
     # ORDER IS LOAD-BEARING: the scrub removes an inherited OPENCODE_* var and this
     # sets the cell's own AFTER, so the membrane's values are authoritative.
     _scrub_opencode_namespace(env)
-    data_dir = _opencode_cell_dir(cell) / "data"
+    _migrate_opencode_data(cell)
+    data_dir = _opencode_data_dir(cell)
     config_dir = _opencode_cell_dir(cell) / "config"
     data_dir.mkdir(parents=True, exist_ok=True)
     config_dir.mkdir(parents=True, exist_ok=True)
@@ -2855,7 +2911,7 @@ def _opencode_prior_session(cell: Cell) -> Optional[str]:
     if binary is None:
         return None
     env = dict(os.environ)
-    env["XDG_DATA_HOME"] = str(_opencode_cell_dir(cell) / "data")
+    env["XDG_DATA_HOME"] = str(_opencode_data_dir(cell))
     env["OPENCODE_DISABLE_AUTOUPDATE"] = "1"
     try:
         out = subprocess.run(

{swarph_cli-0.62.0 → swarph_cli-0.63.0}/src/swarph_cli/commands/watchdog.py

@@ -641,10 +641,39 @@ def _fetch_peers(gateway: str, token: str) -> list[dict]:
     return []
 
 
+def _ppid(cur: int) -> int:
+    """Parent of ``cur``.
+
+    PRODUCTION, not a test helper (#515 / #492). ``_process_alive`` calls
+    ``_pid_under``, which calls this. Linux reads ``/proc/<pid>/stat`` —
+    ``comm`` can contain spaces and parens, so PPID is the field after the
+    final ``)``. Darwin has no ``/proc``; ``ps -o ppid=`` is the same fact.
+    A missing source raises ``OSError`` and the walker treats that as
+    "not under", which is the old Linux behaviour when ``/proc`` cannot
+    be read. ``monitor.py`` and ``orphan_daemons.py`` have their own
+    ``/proc`` readers and are not this function.
+    """
+    try:
+        with open(f"/proc/{cur}/stat", encoding="utf-8") as f:
+            data = f.read()
+    except OSError:
+        if sys.platform != "darwin":
+            raise
+        r = subprocess.run(
+            ["ps", "-o", "ppid=", "-p", str(cur)],
+            capture_output=True, text=True, encoding="utf-8", errors="replace",
+            timeout=5,
+        )
+        if r.returncode != 0 or not r.stdout.strip():
+            raise OSError(f"ps could not read ppid of {cur}")
+        return int(r.stdout.strip())
+    after = data[data.rfind(")") + 2:].split()
+    return int(after[1])  # stat field 4 (PPID): state, ppid, ...
+
+
 def _pid_under(pid: int, ancestors: set, _max_depth: int = 40) -> bool:
     """Walk the PPID chain up from ``pid``; True if any ancestor is in
-    ``ancestors``. Reads ``/proc/<pid>/stat`` (Linux). The ``comm`` field can
-    contain spaces/parens, so parse PPID after the final ``)``."""
+    ``ancestors``. See ``_ppid`` for the platform split."""
     cur = pid
     for _ in range(_max_depth):
         if cur in ancestors:
@@ -652,11 +681,8 @@ def _pid_under(pid: int, ancestors: set, _max_depth: int = 40) -> bool:
         if cur <= 1:
             return False
         try:
-            with open(f"/proc/{cur}/stat", encoding="utf-8") as f:
-                data = f.read()
-            after = data[data.rfind(")") + 2:].split()
-            cur = int(after[1])  # stat field 4 (PPID): state, ppid, ...
-        except (OSError, ValueError, IndexError):
+            cur = _ppid(cur)
+        except (OSError, ValueError, IndexError, subprocess.TimeoutExpired):
             return False
     return cur in ancestors