node down --force cannot verify its own empty broker from the supplied canonical state dir

[kjgbot]

Summary

node down --force refused to stop a healthy, empty broker even when invoked with the exact state directory whose connection metadata named the running PID.

Reproduction

dogpatch-mini was running 12.3.1 with:

• status RUNNING
• zero agents and zero child worker processes
• node delivery CONNECTED
• canonical state dir ~/.agentworkforce/relay/dogpatch-mini-node/state
• connection.json PID matching the sole agent-relay-broker init process
• process argv containing --instance-name dogpatch-mini and the exact --state-dir

agent-relay node down --state-dir ~/.agentworkforce/relay/dogpatch-mini-node/state --force

Result:

Broker identity could not be verified (pid: 97458); retained its state.
Connection metadata alone cannot authorize a signal.

After manually validating PID, command, state dir, and zero children, SIGTERM was required. Subsequent cleanup still reported No verified orphan broker found; retained existing state.

Impact

The supported recovery command cannot restart a broker during an outage and forces operators into manual process matching.

Acceptance

A broker started through supported lifecycle paths must persist enough canonical identity evidence for node down --force to verify it. For legacy or direct-init state, status or doctor must identify the missing identity artifact and provide a deterministic migration path before an outage.