@compr/opscontext-mcp 2.10.0 → 2.12.0

package/dist/cli.js

@@ -651,7 +651,7 @@ import { listLearnings, parseSince, learningsToChunks, learningsStats, formatLea
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
 import { activate, deactivate, getActivationStatus, gateCheckFresh, } from "./activation.js";
 import { syncTierA, syncTierB, loadCommunityStore, communityRulesToChunks, mergeWithDedup, STORE_PATH as COMMUNITY_STORE_PATH, } from "./community-sync.js";
-import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, restoreSegment, scrubAuditLog, } from "./audit.js";
+import { readAuditLog, verifyChain, filterByRange, toCsv, rotateAuditLog, planRotation, listSegments, acknowledgeRedaction, restoreSegment, scrubAuditLog, recordVerifyState, acquireVerifyLock, } from "./audit.js";
 import { redactPayload, redactChunk } from "./secret-shapes.js";
 import { loadRepoPolicy, parsePolicy, formatPolicySummary, formatValidationErrors, repoPolicyPath, } from "./policy.js";
 import { buildCostReport } from "./cost-report.js";
@@ -1751,7 +1751,16 @@ safeAppend), visible via 'contextengine audit-verify' and consumed by the
         console.error(`❌ ${refused}`);
         process.exit(1);
     }
-    safeAppend(eventKind, prepareCapturedPayload(payload, eventKind), actor);
+    // [LOCKED] [RECEIVER-SAYS-WHAT-WAS-WRITTEN] - 2026-09-27
+    // [NEVER] report "Appended" or exit 0 for an entry the audit log refused.
+    // WHY: on a stuck log (a record cut short by a full disk) this printed "Appended vscode.tool_call to
+    //      audit log." and exited 0 while nothing landed (E2E_REVIEW_2026-09 B1-1); the VS Code
+    //      extension emits through this command and believed it.
+    // FIX: safeAppend() returns whether it wrote; a refusal exits 1. [LOCK] [A-REFUSED-APPEND-IS-COUNTED-AND-CHAINED]
+    if (!safeAppend(eventKind, prepareCapturedPayload(payload, eventKind), actor)) {
+        console.error(`❌ Not recorded: the audit log refused ${eventKind} (reason above). The refusal is counted and will be noted on the chain.`);
+        process.exit(1);
+    }
     console.log(`✅ Appended ${eventKind} to audit log.`);
 }
 async function cliWatch(args) {
@@ -2129,14 +2138,50 @@ function cliAuditRedactAck(args) {
     console.log(`   audit-verify now: ${after.ok ? "OK" : "FAILED"}, ${(after.redactedIndices ?? []).length} redacted, ${(after.tamperedIndices ?? []).length} altered.`);
 }
 async function cliAuditVerify() {
+    // [LOCK] [HEALTH-SEES-THE-CHAIN]: every full check leaves its result for fleet health. The
+    // daily one (--scheduled, started by the indexing server) runs one at a time and prints nothing.
+    const scheduled = process.argv.includes("--scheduled");
+    let releaseVerifyLock = null;
+    if (scheduled) {
+        releaseVerifyLock = acquireVerifyLock();
+        if (!releaseVerifyLock)
+            return; // another check is running
+    }
+    const t0 = Date.now();
     const report = verifyChain();
+    recordVerifyState(report, Date.now() - t0, scheduled ? "scheduled" : "cli");
+    if (scheduled) {
+        releaseVerifyLock?.();
+        return;
+    }
     const forks = report.forkIndices ?? [];
     const redacted = report.redactedIndices ?? [];
+    const dups = report.duplicateIndices ?? [];
+    // [LOCK] [VERIFY-FORK-IS-NOT-TAMPER]: a second copy of a record is counted once and named as a copy.
+    const copiesNote = () => {
+        if (dups.length === 0)
+            return;
+        console.log(`\n⚠️  ${dups.length} record(s) appear twice (a second copy of a record already in the log).`);
+        console.log(`   Counted once. Content intact, nothing missing. Usually a log trim that was interrupted or`);
+        console.log(`   ran while entries arrived. At: ${dups.slice(0, 8).join(", ")}${dups.length > 8 ? `, … (+${dups.length - 8} more)` : ""}`);
+    };
+    // [LOCK] [REDACTION-IS-A-CHAINED-RECORD]: an acknowledgement is a statement by whoever ran it; show each one used.
+    const acksNote = (log) => {
+        const acks = report.acknowledgements ?? [];
+        if (acks.length === 0)
+            return;
+        log(`   Acknowledged by (a statement by whoever ran it; the chain cannot tell a removal from a rewrite):`);
+        for (const a of acks.slice(0, 10))
+            log(`     ${a.ts.slice(0, 19).replace("T", " ")}Z  ${a.actor}  ${a.records} record(s)  "${a.reason.slice(0, 80)}"`);
+        if (acks.length > 10)
+            log(`     … (+${acks.length - 10} more)`);
+    };
     if (report.ok) {
-        console.log(`✅ Audit chain verified — ${report.total} record(s).`);
+        console.log(`✅ Audit chain verified — ${report.total - dups.length} record(s).`);
         console.log(redacted.length === 0
             ? `   No record was altered, and no history is missing.`
             : `   No history is missing. ${redacted.length} record(s) redacted and acknowledged on the chain (indices ${redacted.slice(0, 8).join(", ")}${redacted.length > 8 ? ", …" : ""}), 0 altered.`);
+        acksNote((x) => console.log(x));
         if (forks.length > 0) {
             // [VERIFY-FORK-IS-NOT-TAMPER] — surface this, but do not call it tampering.
             console.log(`\n⚠️  ${forks.length} concurrent-append fork(s) detected (not tampering).`);
@@ -2146,6 +2191,7 @@ async function cliAuditVerify() {
             console.log(`   property holds. Do NOT rewrite the log to linearise it — that would destroy`);
             console.log(`   the evidence it exists to provide.`);
         }
+        copiesNote();
         return;
     }
     console.error(`❌ Audit chain FAILED — ${report.total} record(s) checked.`);
@@ -2155,11 +2201,24 @@ async function cliAuditVerify() {
         console.error(`\n   Altered records (content does not match its own hash):`);
         console.error(`     ${t.slice(0, 10).join(", ")}${t.length > 10 ? `, … (+${t.length - 10} more)` : ""}`);
         console.error(`   This is tampering: the record's bytes were changed after it was written.`);
-        console.error(`   If this was a deliberate redaction of a secret, acknowledge it on the chain:`);
-        console.error(`     contextengine audit-redact-ack --index ${t.slice(0, 3).join(",")} --reason "<what was removed and why>"`);
+        console.error(`   If this was a deliberate redaction of a secret, acknowledge it on the chain`);
+        console.error(`   (every altered index is listed, so the command can be pasted as it is):`);
+        console.error(`     contextengine audit-redact-ack --index ${t.join(",")} --reason "<what was removed and why>"`);
     }
     if (redacted.length > 0) {
         console.error(`\n   Also ${redacted.length} redacted record(s), acknowledged on the chain, not counted above.`);
+        acksNote((x) => console.error(x));
+    }
+    // [LOCK] [VERIFY-READS-PAST-AN-UNREADABLE-LINE]: say where, and that the rest was checked.
+    const unreadable = report.unreadable ?? [];
+    if (unreadable.length > 0) {
+        console.error(`\n   Lines that are not records (every other record was checked):`);
+        for (const u of unreadable.slice(0, 10))
+            console.error(`     ${u.file} line ${u.line}`);
+        if (unreadable.length > 10)
+            console.error(`     … (+${unreadable.length - 10} more)`);
+        console.error(`   A last record cut short by a full disk is set aside by the next append on its own;`);
+        console.error(`   a line like these is damage: keep a copy of the file before touching it.`);
     }
     if ((report.orphanIndices ?? []).length > 0) {
         const o = report.orphanIndices;
@@ -2172,6 +2231,9 @@ async function cliAuditVerify() {
     if (forks.length > 0) {
         console.error(`\n   (Also ${forks.length} concurrent-append fork(s) — benign, see docs.)`);
     }
+    if (dups.length > 0) {
+        console.error(`\n   (Also ${dups.length} second copies of records, counted once, benign.)`);
+    }
     console.error(`\nFor compliance-graded evidence, treat the affected records as unverified.`);
     process.exit(2);
 }

package/dist/firewall.js

@@ -11,7 +11,7 @@
 //
 // This is the first MCP server that enforces agent behavior
 // through progressive response degradation.
-import { execSync } from "child_process";
+import { execSync, execFileSync } from "child_process";
 import { existsSync, readFileSync, statSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
 import { homedir } from "os";
@@ -513,19 +513,29 @@ export class ProtocolFirewall {
             this.gitCache.timestamp = now;
             this.gitCache.data = [];
             for (const dir of this.projectDirs.slice(0, 5)) {
+                // [LOCKED] [GIT-FAILURE-IS-UNKNOWN-NOT-CLEAN] - 2026-09-27 (Yan's GO for this one line, file under DO NOT RE-AUDIT)
+                // [NEVER] count dirty files through a shell pipe that turns a failed git into "0".
+                // WHY: `git status --porcelain 2>/dev/null | wc -l` printed 0 when git failed, so a repository
+                //      git could not read (a corrupt index: exit 128, 8 changed files) was reported "Git: ok,
+                //      clean" (E2E_REVIEW_2026-09 B6-2). [EXEC-FAILURE-IS-NOT-EMPTY] fixed the same shape in agents.ts.
+                // FIX: git by argument list, lines counted here; a folder that is not a repository is skipped as
+                //      before; any other failure (unreadable repo, timeout) is reported as unknown, never clean.
                 try {
-                    const out = execSync("git status --porcelain 2>/dev/null | wc -l", {
+                    const out = execFileSync("git", ["status", "--porcelain"], {
                         cwd: dir.path,
                         encoding: "utf-8",
                         timeout: 3000,
-                        stdio: ["pipe", "pipe", "pipe"],
-                    }).trim();
-                    const n = parseInt(out);
+                        stdio: ["ignore", "pipe", "pipe"],
+                    });
+                    const n = out.split("\n").filter(Boolean).length;
                     if (n > 0)
                         this.gitCache.data.push(`${dir.name}(${n})`);
                 }
-                catch {
-                    /* skip */
+                catch (e) {
+                    const stderr = String(e.stderr ?? "");
+                    if (/not a git repository/i.test(stderr))
+                        continue;
+                    this.gitCache.data.push(`${dir.name}(unknown: git could not read it)`);
                 }
             }
         }

package/dist/fleet-health.d.ts

@@ -45,6 +45,27 @@ export interface FleetHealth {
             detail: string;
         }>;
     };
+    /** The last full check of the audit chain (`audit-verify`, run by hand or daily by the indexing
+     *  server), or null when it never ran here. [LOCK] [HEALTH-SEES-THE-CHAIN] */
+    chain: {
+        checkedAt: string;
+        ageHours: number;
+        ok: boolean;
+        unique: number;
+        altered: number;
+        orphans: number;
+        unreadable: number;
+        duplicates: number;
+        reason: string | null;
+    } | null;
+    /** Entries the audit log refused today (chained as audit.append_failed, or still pending), and
+     *  records cut short today (audit.torn_tail). */
+    auditLog: {
+        refusedToday: number;
+        lastRefusal: string | null;
+        tornToday: number;
+        lastTornKept: string | null;
+    };
     /** The newest release for which verify-release passed on this machine, or null. */
     lastVerifiedRelease: string | null;
     /** Measured problems only. Empty means green. */
@@ -56,6 +77,8 @@ export declare const REINDEX_PER_HOUR_WARN = 30;
 export declare const DOUBLED_HOOK_EVENTS_WARN_PCT = 5;
 export declare const DOUBLED_MIN_EVENTS = 10;
 export declare const DOUBLED_WINDOW_MS = 2000;
+/** A full check older than this is reported: the indexing server runs one a day. */
+export declare const CHAIN_CHECK_STALE_HOURS = 48;
 export declare function fleetHealthPath(): string;
 /** The highest version with a verify-release marker; version order, not file time (ties). */
 export declare function lastVerifiedRelease(dir?: string): string | null;

package/dist/fleet-health.js

@@ -13,6 +13,7 @@ import { closeSync, existsSync, fstatSync, mkdirSync, openSync, readSync, readdi
 import { join } from "path";
 import { homedir } from "os";
 import { listServers } from "./server-registry.js";
+import { readVerifyState, pendingRefusals } from "./audit.js";
 import { claudeHookRegistrations } from "./install-claude-hook.js";
 export const REINDEX_PER_HOUR_WARN = 30;
 /** Doubled hook events above this share of the day's hook events raise a warning, once the day
@@ -20,6 +21,8 @@ export const REINDEX_PER_HOUR_WARN = 30;
 export const DOUBLED_HOOK_EVENTS_WARN_PCT = 5;
 export const DOUBLED_MIN_EVENTS = 10;
 export const DOUBLED_WINDOW_MS = 2000;
+/** A full check older than this is reported: the indexing server runs one a day. */
+export const CHAIN_CHECK_STALE_HOURS = 48;
 const TAIL_BYTES = 8 * 1024 * 1024;
 function ceHome() {
     return process.env.CONTEXTENGINE_HOME || join(homedir(), ".contextengine");
@@ -109,6 +112,8 @@ export function computeFleetHealth(opts = {}) {
     let lastHourWrites = 0, blocks = 0, refusals = 0, learningsSaved = 0, hookEvents = 0, doubledHookEvents = 0;
     const lastBlocks = [];
     let prevHook = null;
+    let refusedToday = 0, tornToday = 0;
+    let lastRefusal = null, lastTornKept = null;
     for (const r of records) {
         const t = Date.parse(r.ts);
         if (Number.isNaN(t))
@@ -127,6 +132,16 @@ export function computeFleetHealth(opts = {}) {
         }
         if (t < midnight)
             continue;
+        if (r.event === "audit.append_failed") {
+            refusedToday += Number(r.payload?.count ?? 0) || 0;
+            const errs = r.payload?.errors;
+            if (errs && Object.keys(errs).length > 0)
+                lastRefusal = Object.keys(errs)[0];
+        }
+        if (r.event === "audit.torn_tail") {
+            tornToday++;
+            lastTornKept = String(r.payload?.kept ?? "");
+        }
         if (r.event === "hook.block") {
             blocks++;
             lastBlocks.push({ ts: r.ts, kind: "pre-commit", detail: blockDetail(r.payload) });
@@ -161,6 +176,42 @@ export function computeFleetHealth(opts = {}) {
         warnings.push(`${lastHourWrites} shared-index writes in the last hour (ceiling ${REINDEX_PER_HOUR_WARN}): something saves in a loop`);
     if (refusals > 0)
         warnings.push(`${refusals} learnings-store refusal(s) today: a write looked like a wipe or a runaway import`);
+    // [LOCKED] [HEALTH-SEES-THE-CHAIN] - 2026-09-27
+    // [NEVER] report green while the audit chain failed its last check, or while the log refuses entries.
+    // WHY: fleet health read the audit log for counts only. On three broken logs (a stuck log whose
+    //      appends were all refused, missing history, 100 altered records) the verifier said FAILED
+    //      and health said 0 warnings (E2E_REVIEW_2026-09 B6-1). The chain is the product's claim.
+    // FIX: health never runs the check (26 s and 3.5 GB on 4.9M records, measured): it reads the
+    //      result every `audit-verify` leaves, which the indexing server refreshes daily in a separate
+    //      low-priority process. A failed check, a check older than CHAIN_CHECK_STALE_HOURS, refused
+    //      entries (chained as audit.append_failed or still pending) and records cut short today are
+    //      each a warning. [LOCK] [A-REFUSED-APPEND-IS-COUNTED-AND-CHAINED] [LOCK] [TORN-TAIL-IS-KEPT-AND-CHAINED]
+    const vs = readVerifyState();
+    const chain = vs
+        ? {
+            checkedAt: vs.checkedAt,
+            ageHours: Math.max(0, Math.round((now.getTime() - Date.parse(vs.checkedAt)) / 3_600_000)),
+            ok: vs.ok,
+            unique: vs.unique,
+            altered: vs.altered,
+            orphans: vs.orphans,
+            unreadable: vs.unreadable,
+            duplicates: vs.duplicates,
+            reason: vs.reason,
+        }
+        : null;
+    if (chain && !chain.ok)
+        warnings.push(`the audit chain did not verify at its last check (${chain.checkedAt.slice(0, 16).replace("T", " ")}Z): ${chain.reason ?? "see contextengine audit-verify"}`);
+    else if (chain && chain.ageHours > CHAIN_CHECK_STALE_HOURS)
+        warnings.push(`the audit chain was last checked ${chain.ageHours} h ago: run contextengine audit-verify`);
+    const pending = pendingRefusals();
+    if (pending.count > 0 && pending.error)
+        lastRefusal = pending.error; // the newest refusal wins
+    const refusedTotal = refusedToday + pending.count;
+    if (refusedTotal > 0)
+        warnings.push(`the audit log refused ${refusedTotal} entr${refusedTotal === 1 ? "y" : "ies"} today${lastRefusal ? ` (${lastRefusal})` : ""}: they are not in the log, and the gap is noted on the chain`);
+    if (tornToday > 0)
+        warnings.push(`${tornToday} audit record(s) were cut short today (a full disk?); the bytes are kept in ${lastTornKept}`);
     for (const w of report.warnings)
         if (/index on their own/.test(w))
             warnings.push(w);
@@ -172,6 +223,8 @@ export function computeFleetHealth(opts = {}) {
         reindex: { lastHourWrites, perCorpus, threshold: REINDEX_PER_HOUR_WARN },
         claudeHooks,
         today: { hookEvents, doubledHookEvents, blocks, refusals, learningsSaved, lastBlocks: lastBlocks.slice(-3) },
+        chain,
+        auditLog: { refusedToday: refusedTotal, lastRefusal, tornToday, lastTornKept },
         lastVerifiedRelease: lastVerifiedRelease(),
         warnings,
     };
@@ -191,6 +244,9 @@ export function formatFleetHealth(h) {
     lines.push(`  servers ${h.servers.total}: ${h.servers.indexers} indexing, ${h.servers.readers} reading, ${h.servers.stale.length} on an old build`);
     lines.push(`  shared-index writes last hour: ${h.reindex.lastHourWrites} (ceiling ${h.reindex.threshold})`);
     lines.push(`  today: ${h.today.blocks} block(s) prevented, ${h.today.refusals} store refusal(s), ${h.today.learningsSaved} learning(s) saved`);
+    lines.push(h.chain
+        ? `  audit chain: ${h.chain.ok ? "verified" : "FAILED"} ${h.chain.ageHours} h ago, ${h.chain.unique} record(s)${h.chain.duplicates ? `, ${h.chain.duplicates} copies counted once` : ""}; ${h.auditLog?.refusedToday ?? 0} entr(ies) refused today`
+        : `  audit chain: not checked on this machine yet (the indexing server runs a full check daily; or run contextengine audit-verify)`);
     lines.push(`  claude code: ${h.today.hookEvents} hook event(s) today, ${h.today.doubledHookEvents} doubled; registrations ${h.claudeHooks ? Object.entries(h.claudeHooks).map(([ev, n]) => `${ev}=${n}`).join(" ") : "no settings.json"}`);
     for (const b of h.today.lastBlocks)
         lines.push(`    ${b.ts.slice(11, 19)}Z ${b.kind}: ${b.detail}`);

package/dist/http-server.js

@@ -266,13 +266,23 @@ function handleEvents(req, res) {
             return;
         }
         // All valid — write them to audit log via safeAppend.
+        // [LOCK] [RECEIVER-SAYS-WHAT-WAS-WRITTEN] (src/cli.ts emit-event): count what the log took, and
+        // answer 503 when it refused any. On 2026-09-27 a stuck log answered {"ok":true,"written":25}
+        // with 0 of 25 recorded (E2E_REVIEW_2026-09 B1-1).
         let written = 0;
+        let failed = 0;
         for (const ev of batch.events) {
             const actor = typeof ev.actor === "string" ? ev.actor : "browser-ext";
             // event/payload were validated above — cast is safe.
             // [LOCK] [CAPTURE-IS-REDACTED-AT-THE-DOOR]: redact before the append, never after.
-            safeAppend(ev.event, prepareCapturedPayload(ev.payload, ev.event), actor);
-            written++;
+            if (safeAppend(ev.event, prepareCapturedPayload(ev.payload, ev.event), actor))
+                written++;
+            else
+                failed++;
+        }
+        if (failed > 0) {
+            sendJson(req, res, 503, { ok: false, error: "audit_append_failed", written, failed });
+            return;
         }
         sendJson(req, res, 200, { ok: true, written });
     });

package/dist/index.js

@@ -13,7 +13,7 @@ import { loadEmbeddingStore, compactEmbeddingStore } from "./embedding-store.js"
 import { sharedIndexEnabled, corpusId, electIndexer, writeSharedIndex, readSharedIndex, sharedIndexMtime, } from "./shared-index.js";
 import { listProjects, checkPorts, runComplianceAudit, formatProjectList, formatPortMap, formatPlan, scoreProject, formatScoreReport, runScoreCanary, } from "./agents.js";
 import { saveSession, loadSession, listSessions, deleteSession, formatSession, formatSessionList, } from "./sessions.js";
-import { verifyChain, readAuditLog, filterByRange, autoRotateAuditLog, safeAppend } from "./audit.js";
+import { verifyChain, readAuditLog, filterByRange, autoRotateAuditLog, safeAppend, readVerifyState } from "./audit.js";
 import { registerServer, listServers, formatServers, liveDaemonPid } from "./server-registry.js";
 import { secureCeHome } from "./ce-home.js";
 import { QUOTED_TEXT_NOTE } from "./framing.js";
@@ -26,7 +26,8 @@ import { communityRulesToChunks, mergeWithDedup, loadCommunityStore, } from "./c
 import { readFileSync, existsSync, watch, statSync, writeFileSync, mkdirSync } from "fs";
 import { basename, join, dirname } from "path";
 import { homedir } from "os";
-import { execSync } from "child_process";
+import { execSync, spawn } from "child_process";
+import { setPriority } from "os";
 import { scanCodeDir } from "./code-chunker.js";
 import { fileURLToPath } from "url";
 import { TOOL_COUNT, FREE_TOOL_COUNT, PREMIUM_TOOL_NAMES } from "./tools-manifest.js";
@@ -460,6 +461,64 @@ function evaluateRole(reason) {
 }
 let healthTick = 0;
 let lastStaleCount = -1;
+let stopRegistry = null;
+let ending = false;
+/**
+ * End this server. Everything that matters is already on disk (audit appends and store writes are
+ * synchronous); the registry record is removed first. With the embedding model loaded, a normal exit
+ * aborts in the model runtime's native teardown ("libc++abi: ... mutex lock failed", SIGABRT, 3 of 3
+ * runs, releasing the model does not help) and leaves a macOS crash report per exit, so such a server
+ * ends with SIGKILL, which skips that teardown. [LOCK] [A-CHAT-SERVER-ENDS-WITH-ITS-CHAT]
+ */
+function endThisServer() {
+    if (ending)
+        return;
+    ending = true;
+    try {
+        stopRegistry?.();
+    }
+    catch { /* the lister removes a dead record anyway */ }
+    if (isEmbeddingsReady())
+        process.kill(process.pid, "SIGKILL");
+    else
+        process.exit(0);
+}
+const SERVER_STARTED_AT = Date.now();
+let lastChainCheckSpawn = 0;
+/**
+ * The indexing server starts the daily full check of the audit chain, in its own process.
+ * [LOCK] [HEALTH-SEES-THE-CHAIN] (src/fleet-health.ts): the check costs 26 s and 3.5 GB on 4.9M
+ * records (measured 2026-09-27), so it never runs in this long-lived process, whose event loop
+ * serves the receiver and the tools. A separate low-priority `audit-verify --scheduled`, at most
+ * one attempt an hour, never in the first 10 minutes after a start, one at a time across processes
+ * (its own lock). CONTEXTENGINE_CHAIN_CHECK=0 turns it off.
+ */
+function maybeScheduleChainCheck() {
+    if (role !== "indexer" || process.env.CONTEXTENGINE_CHAIN_CHECK === "0")
+        return;
+    const now = Date.now();
+    if (now - SERVER_STARTED_AT < 10 * 60_000 || now - lastChainCheckSpawn < 60 * 60_000)
+        return;
+    const state = readVerifyState();
+    if (state && now - Date.parse(state.checkedAt) < 24 * 3_600_000)
+        return;
+    lastChainCheckSpawn = now;
+    try {
+        const cli = join(dirname(fileURLToPath(import.meta.url)), "cli.js");
+        const child = spawn(process.execPath, [cli, "audit-verify", "--scheduled"], { stdio: "ignore", detached: true, env: process.env });
+        if (child.pid) {
+            try {
+                setPriority(child.pid, 10);
+            }
+            catch { /* the check still runs, at normal priority */ }
+        }
+        child.unref();
+        console.error(`[ContextEngine] 🔎 daily audit chain check started (pid ${child.pid ?? "?"})`);
+    }
+    catch (err) {
+        console.error(`[ContextEngine] ⚠ could not start the daily audit chain check: ${err.message}`);
+    }
+}
 /**
  * The indexer writes ~/.contextengine/fleet-health.json once a minute: version drift, reindex
  * rate, today's blocks and refusals, the last verified release. Every surface reads that file.
@@ -475,6 +534,7 @@ function publishHealth() {
         }
         if (role === "indexer")
             writeFleetHealth(h);
+        maybeScheduleChainCheck();
     }
     catch (err) {
         console.error(`[ContextEngine] ⚠ fleet health failed: ${err.message}`);
@@ -1356,7 +1416,8 @@ async function main() {
         }
     }
     try {
-        const reg = registerServer({ version: PKG_VERSION, script: fileURLToPath(import.meta.url), corpus, role: corpus ? "reader" : undefined, daemon: process.env.OPSCONTEXT_DAEMON === "1" });
+        const reg = registerServer({ version: PKG_VERSION, script: fileURLToPath(import.meta.url), corpus, role: corpus ? "reader" : undefined, daemon: process.env.OPSCONTEXT_DAEMON === "1", onSignal: endThisServer });
+        stopRegistry = reg.stop;
         setRegistryRole = reg.setRole;
         setRegistryEventPort = reg.setEventPort;
         const fleet = listServers();
@@ -1415,6 +1476,26 @@ async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
     console.error("[ContextEngine] 🚀 MCP server running on stdio (keyword search ready)");
+    // [LOCKED] [A-CHAT-SERVER-ENDS-WITH-ITS-CHAT] - 2026-09-27
+    // [NEVER] let a server whose client closed its stdin keep running, unless it is the launchd agent.
+    // WHY: the file watchers and the event receiver keep the event loop alive, and nothing listened for
+    //      the end of stdin. When a chat's client died without stopping its server (3 of 3 runs,
+    //      E2E_REVIEW_2026-09 B5-2), the server lived on, adopted by launchd, still the indexer, still
+    //      holding the event port, running its build for good; new servers became its readers.
+    // FIX: stdin's end or close ends a chat server (its registry record goes with it, and a reader takes
+    //      over the index within one role poll, 15 s). The launchd agent (OPSCONTEXT_DAEMON=1) has
+    //      stdin on /dev/null by design and is exempt. [LOCK] [AUTOSTART-IS-THE-STANDING-INDEXER]
+    //      Ending goes through endThisServer(): with the embedding model loaded, a normal exit aborts in
+    //      native code and leaves a macOS crash report each time, so such a server ends with SIGKILL
+    //      after its record is removed; the stop signals (SIGTERM, SIGINT, SIGHUP) take the same path.
+    if (process.env.OPSCONTEXT_DAEMON !== "1") {
+        const leave = () => {
+            console.error("[ContextEngine] 👋 the client closed the connection: this server stops");
+            endThisServer();
+        };
+        process.stdin.once("end", leave);
+        process.stdin.once("close", leave);
+    }
     // 3a. Audit log auto-rotation. Deferred so the first requests are answered before the
     // synchronous verify + rewrite (a few seconds on a 500k-record chain) blocks the loop.
     // [LOCK] [AUTO-ROTATE-HYSTERESIS-AND-ONE-RUNNER]
@@ -1423,7 +1504,7 @@ async function main() {
     const runAutoRotate = () => {
         try {
             const o = autoRotateAuditLog();
-            if (o.action === "rotated" || o.action === "refused" || o.action === "error" || o.action === "in_progress") {
+            if (o.action === "rotated" || o.action === "refused" || o.action === "error" || o.action === "in_progress" || o.action === "finished") {
                 console.error(`[ContextEngine] 📦 audit auto-rotate (${o.action}): ${o.detail}`);
             }
         }

package/dist/learnings.d.ts

@@ -15,6 +15,9 @@ export interface LearningsStore {
     version: number;
     count: number;
     learnings: Learning[];
+    /** Bundled default rules (lowercased, trimmed) the owner deleted: never merged back.
+     *  [LOCK] [A-READ-NEVER-WRITES-THE-STORE] */
+    dismissed_defaults?: string[];
 }
 /** Valid categories for learnings */
 export declare const LEARNING_CATEGORIES: readonly ["deployment", "api", "database", "frontend", "backend", "devops", "security", "performance", "testing", "debugging", "tooling", "git", "dependencies", "architecture", "data", "infrastructure", "mobile", "other"];

package/dist/learnings.js

@@ -76,10 +76,13 @@ function loadBundledDefaults() {
 function mergeDefaults(store) {
     const bundled = loadBundledDefaults();
     if (bundled.length === 0)
-        return false;
+        return 0;
     const existingRules = new Set(store.learnings
         .filter((l) => typeof l.rule === "string")
         .map((l) => l.rule.toLowerCase().trim()));
+    // A default the owner deleted stays deleted. [LOCK] [A-READ-NEVER-WRITES-THE-STORE]
+    for (const r of store.dismissed_defaults ?? [])
+        existingRules.add(r);
     let added = 0;
     const now = new Date().toISOString();
     for (const def of bundled) {
@@ -97,7 +100,12 @@ function mergeDefaults(store) {
         existingRules.add(def.rule.toLowerCase().trim());
         added++;
     }
-    return added > 0;
+    return added;
+}
+/** Is this rule text one of the bundled defaults? */
+function isBundledDefault(rule) {
+    const key = rule.toLowerCase().trim();
+    return loadBundledDefaults().some((d) => d.rule.toLowerCase().trim() === key);
 }
 // [LOCKED] [STORE-NEVER-STARTS-FRESH-OVER-DATA] 2026-09-05
 // [NEVER] turn an unreadable learnings.json into an empty store, write the store with a
@@ -127,6 +135,55 @@ let batchDirty = false;
 function sleepMs(ms) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+// [LOCKED] [A-DEAD-STORE-HOLDER-LOSES-THE-LOCK-AT-ONCE] 2026-09-27
+// [NEVER] make a save wait out LOCK_STALE_MS for a holder that is provably gone, or leave a dead
+//         writer's full copy of the store on disk.
+// WHY: a saver killed inside the lock made every other save in the next ~20 s wait 10 s and fail
+//      with "locked by another process" (6 per run, 3 of 3, E2E_REVIEW_2026-09 B4-2), and left its
+//      temp copy of the whole store behind for good. The lock directory names its holder's pid;
+//      nothing read it.
+// FIX: a lock whose pid no longer exists, or a lock directory older than a second with no pid in
+//      it, is taken over at once; a live pid keeps the 30 s rule. Inside the lock, temp copies
+//      written by a pid that no longer exists are removed.
+function storeHolderIsGone(age) {
+    let pid = NaN;
+    try {
+        pid = parseInt(readFileSync(join(STORE_LOCK_DIR, "pid"), "utf-8"), 10);
+    }
+    catch { /* no pid yet */ }
+    if (!Number.isInteger(pid) || pid <= 0)
+        return age > 1000;
+    if (pid === process.pid)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (e) {
+        return e.code === "ESRCH";
+    }
+}
+function removeDeadWritersTemps() {
+    try {
+        const dir = dirname(LEARNINGS_PATH);
+        for (const f of readdirSync(dir)) {
+            const m = /^learnings\.json\.tmp-(\d+)-\d+$/.exec(f);
+            if (!m)
+                continue;
+            const pid = Number(m[1]);
+            if (pid === process.pid)
+                continue;
+            try {
+                process.kill(pid, 0);
+            }
+            catch (e) {
+                if (e.code === "ESRCH")
+                    unlinkSync(join(dir, f));
+            }
+        }
+    }
+    catch { /* cleanup is a courtesy; the store is untouched either way */ }
+}
 /** Cross-process, re-entrant (within this process) lock around the store file. */
 export function withStoreLock(fn) {
     if (lockDepth > 0) {
@@ -160,7 +217,8 @@ export function withStoreLock(fn) {
             catch {
                 age = 0;
             }
-            if (age > LOCK_STALE_MS) {
+            // [LOCK] [A-DEAD-STORE-HOLDER-LOSES-THE-LOCK-AT-ONCE]
+            if (age > LOCK_STALE_MS || storeHolderIsGone(age)) {
                 // Holder died (or hung) without releasing: take it over.
                 try {
                     rmSync(STORE_LOCK_DIR, { recursive: true, force: true });
@@ -176,6 +234,7 @@ export function withStoreLock(fn) {
     }
     lockDepth = 1;
     try {
+        removeDeadWritersTemps();
         return fn();
     }
     finally {
@@ -237,14 +296,42 @@ function readStoreFromDisk() {
     else {
         store = { version: 1, count: 0, learnings: [] };
     }
-    // Auto-merge bundled defaults on first load or when new defaults are added
-    if (mergeDefaults(store)) {
+    // [LOCKED] [A-READ-NEVER-WRITES-THE-STORE] - 2026-09-27
+    // [NEVER] write the store from a read that does not hold the store lock, and never merge back a
+    //         bundled default the owner deleted.
+    // WHY: a plain read (listLearnings, searchLearnings, the index build) merged a missing bundled
+    //      default and wrote the whole store WITHOUT the lock. With that read held 1.5 s before its
+    //      write, a concurrent saver's 5 learnings, each saved with success, were gone (3 of 3,
+    //      E2E_REVIEW_2026-09 B4-1); at natural speed the window is milliseconds and opens after every
+    //      release that adds a default. And a deleted default came back at the next read, with a new id
+    //      and no audit record: the delete never stuck. [LOCK] [STORE-NEVER-STARTS-FRESH-OVER-DATA]
+    //      already said "never let two processes write it without the lock".
+    // FIX: holding the lock (a save, a delete, a batch), the merge is written as before. A plain read
+    //      takes the lock for it (re-reading inside), and if the lock is busy only shows the defaults,
+    //      writing nothing. A deleted default is remembered in `dismissed_defaults`; every persisted
+    //      merge is recorded as a learning.import of the bundled defaults.
+    if (!hasMissingDefaults(store))
+        return store;
+    if (lockDepth > 0) {
+        const added = mergeDefaults(store);
         if (batchStore)
             batchDirty = true;
         else
             writeStoreToDisk(store);
+        safeAppend("learning.import", { source: "bundled defaults", format: "json", imported: added, updated: 0, skipped: 0 });
+        return store;
+    }
+    try {
+        return withStoreLock(() => readStoreFromDisk());
     }
-    return store;
+    catch {
+        mergeDefaults(store); // the lock is busy: show them, persist at the next locked read or write
+        return store;
+    }
+}
+function hasMissingDefaults(store) {
+    const probe = { version: store.version, count: 0, learnings: store.learnings.slice(), dismissed_defaults: store.dismissed_defaults };
+    return mergeDefaults(probe) > 0;
 }
 function loadStore() {
     if (batchStore)
@@ -517,12 +604,19 @@ function deleteLearningUnlocked(id) {
         return false;
     const removed = store.learnings[index];
     store.learnings.splice(index, 1);
+    // A deleted bundled default stays deleted. [LOCK] [A-READ-NEVER-WRITES-THE-STORE]
+    const dismissed = typeof removed.rule === "string" && isBundledDefault(removed.rule);
+    if (dismissed) {
+        const key = removed.rule.toLowerCase().trim();
+        store.dismissed_defaults = [...new Set([...(store.dismissed_defaults ?? []), key])];
+    }
     saveStore(store);
     safeAppend("learning.delete", {
         id: removed.id,
         category: removed.category,
         project: removed.project,
         rule_length: typeof removed.rule === "string" ? removed.rule.length : 0,
+        ...(dismissed ? { default_dismissed: true } : {}),
     });
     return true;
 }