Enforce a single daemon per geth home

docs/architecture.md

@@ -21,6 +21,11 @@ registries for pubsub, pipes, and overlays live behind narrow mutex-protected
 structs in `runtime.rs`.
 
 Daemon shutdown is an owned lifecycle transition, not process-exit cleanup.
+Before starting Iroh or background modules, the daemon binds the selected
+home's local control endpoint. A live endpoint makes a second daemon fail with
+`daemon_already_running`; only an endpoint that cannot be connected is treated
+as stale and replaced. This keeps one daemon authoritative for each geth home
+and prevents a second process from unlinking the first daemon's control path.
 After local control stops accepting requests, `daemon.rs` cancels the Iroh
 accept and live-sync tasks, releases native docs/gossip/blob handles, calls
 `Endpoint::close().await`, and removes the local control socket. The same

docs/roadmap.md

@@ -17,6 +17,15 @@ For deployment-readiness work that cuts across feature areas, see
 
 ## Operator Usability
 
+- `[x]` Enforce one daemon per geth home.
+  Acceptance criteria:
+  - `[x]` Daemon startup claims the local control endpoint before starting
+    network and background modules.
+  - `[x]` A live endpoint rejects another daemon with the stable
+    `daemon_already_running` code instead of unlinking the first socket.
+  - `[x]` Stale, unreachable socket paths are recovered automatically.
+  - `[x]` Tests cover stale recovery and live second-daemon rejection.
+
 - `[x]` Make startup modes and the daemon lifecycle discoverable.
   Acceptance criteria:
   - `[x]` Base and nested CLI help explain every command family instead of