fix: harden daemon and large-index recovery paths (#1562)

* fix: harden indexing recovery and daemon liveness

* test: cover daemon and recovery review gaps

* test: pin that a failure marker never blocks a later successful parse (#1557 retry-discard guard)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: danusha2345 <ewidusoc498@gmail.com>
Co-authored-by: Colby McHenry <me@colbymchenry.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

__tests__/daemon-registry.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import { spawn } from 'child_process';
 import * as fs from 'fs';
+import * as net from 'net';
 import * as os from 'os';
 import * as path from 'path';
 import {
@@ -9,8 +10,11 @@ import {
   registerDaemon,
   deregisterDaemon,
   listDaemons,
+  listVerifiedDaemons,
+  stopDaemonAt,
   type DaemonRecord,
 } from '../src/mcp/daemon-registry';
+import { encodeLockInfo, getDaemonPidPath } from '../src/mcp/daemon-paths';
 
 /** A pid that's guaranteed dead: spawn a trivial process, let it exit, reap it. */
 async function deadPid(): Promise<number> {
@@ -100,4 +104,55 @@ describe('daemon-registry', () => {
     const live = listDaemons();
     expect(live.map((d) => d.root)).toEqual(['/proj/new', '/proj/old']);
   });
+
+  it('keeps a registry entry whose socket hello matches its PID and version', async () => {
+    const root = fs.mkdtempSync(path.join(tmpHome, 'verified-'));
+    const socketPath = process.platform === 'win32'
+      ? `\\\\.\\pipe\\cg-reg-${process.pid}-${Date.now()}`
+      : path.join(tmpHome, 'verified.sock');
+    const server = net.createServer((socket) => {
+      socket.end(JSON.stringify({
+        protocol: 1,
+        pid: process.pid,
+        codegraph: '1.5.0',
+        socketPath,
+      }) + '\n');
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(socketPath, resolve);
+    });
+    try {
+      registerDaemon({ root, pid: process.pid, version: '1.5.0', socketPath, startedAt: 1 });
+      expect((await listVerifiedDaemons()).map((d) => d.root)).toEqual([root]);
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  });
+
+  it('never signals a reused live PID when no matching daemon answers (#1553)', async () => {
+    const root = fs.mkdtempSync(path.join(tmpHome, 'project-'));
+    const pidPath = getDaemonPidPath(root);
+    fs.mkdirSync(path.dirname(pidPath), { recursive: true });
+    fs.writeFileSync(pidPath, encodeLockInfo({
+      pid: process.pid,
+      version: '1.5.0',
+      socketPath: path.join(root, '.codegraph', 'missing.sock'),
+      startedAt: Date.now() - 60_000,
+    }));
+
+    registerDaemon({
+      root,
+      pid: process.pid,
+      version: '1.5.0',
+      socketPath: path.join(root, '.codegraph', 'missing.sock'),
+      startedAt: Date.now() - 60_000,
+    });
+
+    expect(await listVerifiedDaemons()).toEqual([]);
+    const result = await stopDaemonAt(root);
+    expect(result).toMatchObject({ pid: process.pid, outcome: 'not-running' });
+    expect(isProcessAlive(process.pid)).toBe(true);
+    expect(fs.existsSync(pidPath)).toBe(false);
+  });
 });