claude-ops/audit-install-state: make the unknown-name sample informative and add the .in_use PID lock-file scheme

[kyle-sexton]

Context

Two findings from the same numeric-name pass on the 2026-09-08 run.

First, the sample is useless at scale. classify_name returns unknown for any basename containing a digit that matches no scheme row; that fail-closed default is the engine's stated safety property and stays. But summarize_numeric caps unknown_meaning_sample at 25 entries, and on a tree with 978 unknown rows (954 under plugins/, mostly wml-2010.xsd-style schema files and 0001-*.md ADRs) the sample was 23 XSD files. The signal the sample exists to give, "here is a scheme the table has never seen", was drowned by one shape repeated.

Second, a real scheme is missing. 71 files named plugins/cache/<marketplace>/<plugin>/<version>/.in_use/4647 were classified unknown, and 4647 was the auditing session's own live claude PID (verified with ps; a second run in a different container reproduced it with PID 502). No docs page names .in_use (claude-directory.md, plugins-reference.md, plugin-marketplaces.md, fetched 2026-09-11), but the Claude Code CHANGELOG for 2.1.169 reads "Fixed plugin .in_use PID lock files accumulating without bound; stale markers from crashed sessions are now swept once per day". That is stronger evidence than the existing sessions/<n>.json PID row rests on, which is observation alone. A community issue also reports a .in_use/<pid>.tmp.<hash> staging shape; it was not observed in either run, so it stays a candidate.

Proposed work

• summarize_numeric: dedupe unknown_meaning_sample by name shape (digits collapsed to a placeholder, extension kept) with a count per shape, and add an unknown_by_parent histogram (top-level directory to count). The shape derivation is presentational only; it never feeds classify_name and adds no digit heuristic.
• NAME_SCHEMES: add a pid row for plugins/cache/[^/]+/[^/]+/[^/]+/\.in_use/\d+, liveness probe enabled, with a note carrying the four-part record: claim (the number is the PID of the Claude Code process that loaded that plugin version), basis (CHANGELOG 2.1.169 "PID lock files", plus observation), as-of (2026-09-11, Claude Code 2.1.268), recheck trigger (claude-directory.md or plugins-reference.md gains an .in_use row, or the CHANGELOG names the file again).
• pid_typed is uncapped today, so the new row would emit one identical entry per enabled plugin version. Group pid_typed rows by PID with a count and the list of paths, and mark the auditing process's own PID as self-held so 71 rows of the auditor's own markers are not read as evidence about anything else.
• reference/name-schemes.md: document the row, the self-held case, and record .in_use/<pid>.tmp.<hash> as a candidate shape with evidence community-reported, unobserved, not implemented until observed on a real tree.
• Tests: shape dedupe, parent histogram, the new scheme row (including that extract_pid yields the leading digit run), the self-held marking, and the existing spy-probe test still passing.

Acceptance criteria

• On a tree with hundreds of unknown rows sharing a few shapes, unknown_meaning_sample lists each shape once with its count, and unknown_by_parent names the directories they live in.
• plugins/cache/x/y/1.2.3/.in_use/4647 classifies as pid with a liveness verdict; .in_use/4647.tmp.abcd still classifies as unknown.
• WHILE the auditing process's own PID holds .in_use markers, those rows are grouped under one entry marked self-held, and the report does not list them one per plugin version.
• classify_name's fail-closed default is unchanged: an unrecognised digit-bearing basename still returns unknown, and no liveness probe runs on it.
• reference/name-schemes.md carries the four-part record for the new row.

References

• Run evidence: 2026-09-08 report numeric_names section; 978 unknown rows in the CSV; .in_use/4647 x71.
• anthropics/claude-code CHANGELOG.md, ## 2.1.169 entry (raw, fetched 2026-09-11); absence of in_use in claude-directory.md and plugins-reference.md the same day.
• plugins/claude-ops/skills/audit-install-state/scripts/install_state.py: NAME_SCHEMES, classify_name, extract_pid, summarize_numeric; reference/name-schemes.md; .claude/rules/skill-bodies-state-current-rules.md.

Metadata

Field	Value
Category	unspecified
Area	unspecified
Ecosystem	unspecified

---

Generated by Claude Code