[markwang-obin]

Part A of #1233.

The problem. A registered process group whose boot identity Core can't decide (checkBootIdentity: same leader PID and start, different boot_id, which happens when an older Darwin agent recorded the clock-derived kern.boottime) is rightly kept without signaling. But:

• PreviewManagedProcessGroups aborted on the first such group and returned nothing. So codefly clear --dry-run listed no groups at all and stopped before counting stale sockets. That's what codefly run that fails or is stopped leaves docker containers and a native ClickHouse group holding ports; codefly clear refuses the group (0.1.222) #1233 shows: inspect registered group 95384: incompatible boot identity ….
• The stop path's error for it didn't say how to get out.

Fix

• PreviewManagedProcessGroups keeps going. A group whose ownership inspection fails, or isn't authenticated, is left out and named in the returned error with its recovery command (codefly recover process-group PGID --preview). Every other group is still listed. The error keeps its inspect registered group <pgid>: prefix, which TestReaperUsesOwnerInspectionForSupportedRecords relies on.
• reconcileRegisteredGroup names the same recovery in its error. It already continued past a refused group.
• codefly clear --dry-run prints the groups it could list, warns about the kept ones, carries on to the socket count, and then returns the error.
• docs/orchestration.md: one sentence on how a kept group affects the others.

Classification: fix at the owner. Core's refusal is unchanged: a group whose identity can't be decided is still never signaled. Reused: Core's ListProcessGroups/InspectOwnership, and the existing codefly recover process-group workflow. No new mechanism.

Tests (written first)

TestAnUndecidableGroupIsKeptWithoutStoppingTheRest starts two real tracked groups in one workspace, then rewrites one record's leader and owner boot_id the way an older writer left it.

• The preview lists only the healthy group, and its error names the undecidable one with codefly recover process-group <pgid>.
• The stop stops the healthy group, leaves the undecidable one alive, and names its recovery.

TestClearDryRunReportsPastAnUndecidableGroup (cmd) covers clear's dry-run output: two real tracked groups (one recorded as an older agent left it) and one stale agent socket, under a temporary HOME and TMPDIR. The dry run:

• logs the healthy group it would stop;
• warns about the kept group, with codefly recover process-group <pgid>;
• counts the stale socket;
• returns the refusal;
• signals neither group.

It fails with either half of the fix reverted: with main's cmd/clear.go nothing is logged, and with main's registered.go it logs count=0.

Against main, it fails with #1233's exact error ("inspect registered group …: incompatible boot identity for unchanged process start …") and an empty preview.

Also run: go test ./pkg/processgroup (all pass), go test ./cmd -run 'Clear|Recover', go vet, and golangci-lint run ./pkg/processgroup/... ./cmd/... (0 issues).

Not done here, and not verified

• reconcileProcessGroupRegistries still returns after a failing registered pass, without running the legacy-records pass. That's harmless for codefly run that fails or is stopped leaves docker containers and a native ClickHouse group holding ports; codefly clear refuses the group (0.1.222) #1233, where the leftover is a current registration. I left it because I couldn't prove a change there with a test this size.
• Not reproduced end to end: a real older agent's record on a real machine. The test rewrites the record field by field to match.
• Part B of codefly run that fails or is stopped leaves docker containers and a native ClickHouse group holding ports; codefly clear refuses the group (0.1.222) #1233 (containers outliving a failed or stopped run) is a design question for this repo's owners and isn't touched here.

🤖 Generated with Claude Code