grepmax 0.26.53 → 0.26.55

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.53",
+      "version": "0.26.55",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -54,9 +54,11 @@ gmax config                   # View current settings
 gmax config --embed-mode gpu  # Switch to GPU (Apple Silicon)
 gmax config --worker-threads 2  # Cap worker processes (auto = default); applies on daemon restart
 gmax doctor                   # Health check
-gmax doctor --fix             # Auto-repair (compact, prune, remove stale locks)
+gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 ```
 
+**Storage containment:** full-table compaction is disabled, including forced maintenance and doctor repair. Existing retained index copies are not reclaimed by this release. The verified prune-only recovery path is separate work; normal incremental indexing remains available when the host is healthy and not quarantined. A persistent host safety stop blocks mutation and daemon restart. Installing an update preserves existing quarantine.
+
 ### Core Commands
 
 ```bash
@@ -234,7 +236,7 @@ gmax watch restart            # Stop it, wait for it to exit, start a fresh one
 gmax status                   # See all projects + watcher status
 ```
 
-Adding or indexing a project can start the daemon automatically. MCP acquires primary-project watch leases lazily when an index-reading tool is used; discovery and catalog listing start no background work. It shuts down after 4 hours of inactivity, and hands off to a fresh daemon after 24 hours or once its memory footprint passes 2.5 GB. File-change batches are processed on up to four worker processes by default, added only when work backs up, with one kept free for searches; LanceDB compaction runs after writes rather than on every maintenance tick.
+Adding or indexing a project can start the daemon automatically. MCP acquires primary-project watch leases lazily when an index-reading tool is used; discovery and catalog listing start no background work. It shuts down after 4 hours of inactivity, and hands off to a fresh daemon after 24 hours or once its memory footprint passes 2.5 GB. File-change batches are processed on up to four worker processes by default, added only when work backs up, with one kept free for searches; full-table compaction and new FTS/ANN index builds are disabled by containment. Existing indexes remain readable. Host safety stops persist across restart and block heavy operations.
 
 `gmax watch status` reports failed files, native watcher recovery or polling, dropped-event counts, and the last complete filesystem reconciliation. Polling scans run every five minutes, so recent edits can lag. Search and MCP responses retain health warnings even after the file queue drains. A complete reconciliation means the filesystem scan completed; queued embedding work can still be pending.
 
@@ -461,7 +463,7 @@ fixtures/
 
 ```bash
 gmax doctor                   # Check health
-gmax doctor --fix             # Auto-repair (compact, prune, fix locks)
+gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 gmax doctor --agent           # Machine-readable health output
 gmax index                    # Reindex (auto-detects and repairs cache/vector mismatches)
 gmax index --reset            # Full reindex from scratch
@@ -470,11 +472,11 @@ gmax watch restart            # Restart daemon
 
 `gmax doctor` reports ANN index state. `ANN: vector index not built` is normal with the default exact-search configuration.
 
-Compaction pauses index writes, waits for pending writes to commit, and opens a fresh table snapshot for each attempt. Each optimize call makes at most two attempts. Before each attempt it checks current free space against twice the table's logical size plus the critical-space reserve (5 GB by default). If there is insufficient headroom, it skips the rewrite and logs the required space; search remains available. A successful prune can reclaim fragment copies left by failed attempts.
+Full-table compaction and new FTS/ANN index builds are disabled in the containment release, including forced maintenance and doctor repair. Existing indexes remain readable; missing lexical indexes fall back to available retrieval. Retained copies are not recovered by this release. A separate exclusive prune-only path requires validation before deployment. Do not repeatedly force repair, use future cutoffs or manually remove index fragments.
 
-`~/.gmax/logs/daemon.log` records compaction attempts and outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
+`~/.gmax/logs/daemon.log` records containment skips and retained historical compaction outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
 
-`gmax doctor --fix` reports completed, skipped, failed, or unverified optimization. It exits nonzero when a requested optimization did not complete or an older daemon could not verify its outcome. A busy or failed daemon is never retried as a second writer in the CLI process.
+`gmax doctor --fix` refuses work under quarantine and otherwise reports optimization skipped by containment. It exits nonzero when a requested optimization did not complete or an older daemon could not verify its outcome. A busy or failed daemon is never retried as a second writer in the CLI process.
 
 ### Known issues
 
@@ -485,7 +487,7 @@ whether you need to act.
 | You see | What it means |
 |---|---|
 | `Optimize panicked ... inverted/builder.rs` | The historical FTS merge defect is fixed in the shipped LanceDB 0.39.0 runtime. If it recurs on a current release, preserve the version and logs and report a regression; the rebuild guard remains a recovery tripwire. |
-| `disabling auto-rebuild until an optimize succeeds` | Transient, not a wedge. The next successful optimize clears it. Search stays available. |
+| `disabling auto-rebuild until an optimize succeeds` | Recovery remains paused under containment. Preserve diagnostics; use existing indexes or vector retrieval rather than forcing optimize. |
 | `ANN: vector index not built` | Normal — exact search is the default. |
 | `cannot reach the daemon socket from this sandbox` (exit 2) | The shell is sandboxed. Add the two keys in [Running under the Claude Code sandbox](#running-under-the-claude-code-sandbox); `gmax doctor` warns about the same gap. |
 | `npm audit` reports advisories on install | Record the installed version and dependency path and report new findings. JavaScript consumer audits do not cover the Python embedding environment; maintainers also audit its locked registry dependencies with `pnpm run audit:python` (Python 3.11+; no model load). |

package/dist/commands/add.js

@@ -53,6 +53,7 @@ const index_config_1 = require("../lib/index/index-config");
 const sync_helpers_1 = require("../lib/index/sync-helpers");
 const syncer_1 = require("../lib/index/syncer");
 const setup_helpers_1 = require("../lib/setup/setup-helpers");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const blocked_roots_1 = require("../lib/utils/blocked-roots");
@@ -87,6 +88,7 @@ Examples:
     var _a, _b, _c, _d, _e, _f;
     let vectorDb = null;
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         const targetDir = dir ? path.resolve(dir) : process.cwd();
         const projectRoot = (_a = (0, project_root_1.findProjectRoot)(targetDir)) !== null && _a !== void 0 ? _a : targetDir;
         const projectName = path.basename(projectRoot);

package/dist/commands/doctor.js

@@ -51,6 +51,7 @@ const commander_1 = require("commander");
 const config_1 = require("../config");
 const embedding_status_1 = require("../lib/index/embedding-status");
 const index_config_1 = require("../lib/index/index-config");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const doctor_optimize_1 = require("../lib/utils/doctor-optimize");
 const doctor_status_1 = require("../lib/utils/doctor-status");
 const exit_1 = require("../lib/utils/exit");
@@ -346,6 +347,14 @@ exports.doctor = new commander_1.Command("doctor")
     .action((opts) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
     var _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    if (opts.fix) {
+        const denied = (0, maintenance_policy_1.storeMutationDeniedReason)();
+        if (denied !== null) {
+            console.error(`gmax doctor --fix refused: ${denied}; preserving containment`);
+            process.exitCode = 2;
+            return;
+        }
+    }
     if (!opts.agent)
         console.log("gmax Doctor\n");
     const root = config_1.PATHS.globalRoot;

package/dist/commands/index.js

@@ -50,6 +50,7 @@ const grammar_loader_1 = require("../lib/index/grammar-loader");
 const sync_helpers_1 = require("../lib/index/sync-helpers");
 const syncer_1 = require("../lib/index/syncer");
 const setup_helpers_1 = require("../lib/setup/setup-helpers");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const exit_1 = require("../lib/utils/exit");
@@ -85,6 +86,7 @@ Examples:
     process.on("SIGINT", onSignal);
     process.on("SIGTERM", onSignal);
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         yield (0, setup_helpers_1.ensureSetup)();
         const indexRoot = options.path
             ? path.resolve(options.path)

package/dist/commands/remove.js

@@ -46,6 +46,7 @@ exports.remove = void 0;
 const path = __importStar(require("node:path"));
 const readline = __importStar(require("node:readline"));
 const commander_1 = require("commander");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const meta_cache_1 = require("../lib/store/meta-cache");
 const vector_db_1 = require("../lib/store/vector-db");
 const exit_1 = require("../lib/utils/exit");
@@ -82,6 +83,7 @@ Examples:
     let vectorDb = null;
     let metaCache = null;
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         // Resolve name → registered root when arg has no path separator and
         // isn't a dir. Avoids the footgun where a typo'd name silently removed
         // the cwd project.

package/dist/commands/repair.js

@@ -13,6 +13,7 @@ exports.repair = void 0;
 const commander_1 = require("commander");
 const config_1 = require("../config");
 const index_config_1 = require("../lib/index/index-config");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const daemon_client_1 = require("../lib/utils/daemon-client");
@@ -38,6 +39,7 @@ Examples:
     var _a, _b, _c;
     try {
         if (opts.rebuild) {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
             const running = yield (0, daemon_client_1.ensureDaemonRunning)();
             if (!running) {
                 const undo = (0, autostart_1.autostartDisabledUndo)();

package/dist/commands/watch.js

@@ -76,6 +76,12 @@ exports.watch = new commander_1.Command("watch")
     .option("--no-idle-timeout", "Disable the 30-minute idle shutdown")
     .action((options) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
+    const safetyDenied = (0, autostart_1.daemonStartDeniedReason)();
+    if (safetyDenied !== null) {
+        console.error(`gmax: ${safetyDenied}; preserving containment`);
+        process.exitCode = 2;
+        return;
+    }
     // A secondary store (src/bin.ts) never runs a daemon or a watcher: one
     // would hold the external drive open, and its startup sweep of stale
     // daemons judges liveness by its own home's lock and socket, so it takes
@@ -440,6 +446,12 @@ exports.watch
             error,
         });
     };
+    const deniedStartup = (0, autostart_1.daemonStartDeniedReason)();
+    if (deniedStartup !== null) {
+        refuse(`${deniedStartup}; preserving containment`);
+        yield (0, exit_1.gracefulExit)(2);
+        return;
+    }
     // Refused before anything is stopped: a daemon that cannot be started
     // again from here must not be taken down.
     if (process.env.GMAX_SECONDARY_STORE === "1") {

package/dist/lib/daemon/daemon.js

@@ -60,6 +60,7 @@ const server_1 = require("../llm/server");
 const meta_cache_1 = require("../store/meta-cache");
 const store_lease_1 = require("../store/store-lease");
 const vector_db_1 = require("../store/vector-db");
+const autostart_1 = require("../utils/autostart");
 const blocked_roots_1 = require("../utils/blocked-roots");
 const daemon_client_1 = require("../utils/daemon-client");
 const daemon_launcher_1 = require("../utils/daemon-launcher");
@@ -73,6 +74,7 @@ const process_footprint_1 = require("../utils/process-footprint");
 const project_registry_1 = require("../utils/project-registry");
 const resource_snapshot_1 = require("../utils/resource-snapshot");
 const root_availability_1 = require("../utils/root-availability");
+const safety_latch_1 = require("../utils/safety-latch");
 const watcher_store_1 = require("../utils/watcher-store");
 const pool_1 = require("../workers/pool");
 const ipc_handler_1 = require("./ipc-handler");
@@ -148,8 +150,6 @@ class Daemon {
         this.heartbeatInterval = null;
         this.idleInterval = null;
         this.heartbeatTick = 0;
-        /** Rate-limits the kernel-zone warn log — see checkKernelZonePressure. */
-        this.lastZoneWarnMs = 0;
         this.shuttingDown = false;
         this.recycling = false;
         this.recycleDueSinceMs = null;
@@ -238,6 +238,19 @@ class Daemon {
     start() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
+            const denied = (0, autostart_1.daemonStartDeniedReason)();
+            if (denied !== null)
+                throw new Error(`gmax: ${denied}; preserving containment`);
+            // Check before stale-process cleanup, store opening, workers or model setup.
+            if (process.platform === "darwin") {
+                const usage = (0, kernel_zone_1.readKernelZoneUsage)();
+                if (!usage)
+                    throw new Error("gmax: kernel pressure unavailable; startup refused");
+                if (usage.pressure !== "ok") {
+                    (0, safety_latch_1.latchSafetyStop)((0, kernel_zone_1.formatZoneUsage)(usage));
+                    throw new Error(`gmax: ${(0, kernel_zone_1.formatZoneUsage)(usage)}; startup safety stop`);
+                }
+            }
             process.title = "gmax-daemon";
             // Read verbs register here rather than at read-verbs.ts module scope: the
             // registry is asserted on exactly in tests/ipc-read-verbs.test.ts, and a
@@ -457,13 +470,10 @@ class Daemon {
                 // after a frozen MLX process kept the port bound (v0.17.0 bug #1).
                 this.heartbeatTick++;
                 if (this.heartbeatTick % 5 === 0) {
-                    void this.mlxServerManager.checkMlxHealth();
-                    this.processManager.sweepOrphanWorkers();
-                    this.maybeRecycle();
-                    this.checkKernelZonePressure();
+                    this.runHeartbeatMaintenance(true);
                 }
                 else if (this.recycleDueSinceMs !== null) {
-                    this.maybeRecycle(false);
+                    this.runHeartbeatMaintenance(false);
                 }
             }, HEARTBEAT_INTERVAL_MS);
             // 10. Idle timeout (skip when disabled via env)
@@ -606,7 +616,22 @@ class Daemon {
         }
     }
     runSharedOperation(name, signal, fn) {
-        return this.operations.runShared(name, signal, fn);
+        const readOnly = (0, read_verbs_1.getReadVerb)(name) !== undefined ||
+            ["search", "project-stats", "unwatch", "llm-stop"].includes(name);
+        return this.operations.runShared(name, signal, (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+            if (!readOnly)
+                this.assertHeavyOperationAdmission(name);
+            return fn(operationSignal);
+        }));
+    }
+    assertHeavyOperationAdmission(name) {
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null)
+            throw new Error(`${name} refused: ${denied}`);
+        // Probe at operation admission, before setup/cache/worker/model side effects.
+        if (!this.checkKernelZonePressure()) {
+            throw new Error(`${name} refused: host pressure is unsafe or unknown`);
+        }
     }
     /**
      * Compact + prune on behalf of a CLI caller.
@@ -1298,6 +1323,18 @@ class Daemon {
                 (0, ipc_handler_1.writeDone)(conn, { ok: false, error: "daemon resources not ready" });
                 return;
             }
+            try {
+                this.assertHeavyOperationAdmission("repair");
+            }
+            catch (error) {
+                (0, ipc_handler_1.writeDone)(conn, {
+                    ok: false,
+                    error: error instanceof Error
+                        ? error.message
+                        : "repair safety admission failed",
+                });
+                return;
+            }
             const targetConfig = (0, index_config_1.readGlobalConfig)();
             const targetGeneration = (0, embedding_generation_1.resolveEmbeddingGeneration)(targetConfig);
             const clientAbort = new AbortController();
@@ -1338,8 +1375,10 @@ class Daemon {
             };
             try {
                 const result = yield this.operations.runExclusive("repair", () => __awaiter(this, void 0, void 0, function* () {
+                    this.assertHeavyOperationAdmission("repair");
                     desiredWatchRoots = yield this.watcherManager.quiesceAll();
                 }), (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+                    this.assertHeavyOperationAdmission("repair");
                     throwIfPreDropCancelled(operationSignal);
                     oldResources.vectorDb.pauseMaintenanceLoop();
                     this.searchers.clear();
@@ -1843,6 +1882,16 @@ class Daemon {
     resourceSnapshot() {
         return this.lastResourceSnapshot;
     }
+    runHeartbeatMaintenance(sampleFootprint) {
+        // Both ordinary probes and deferred-recycle ticks check safety first.
+        if (!this.checkKernelZonePressure())
+            return;
+        this.maybeRecycle(sampleFootprint);
+        if (this.shuttingDown || this.recycling || !sampleFootprint)
+            return;
+        void this.mlxServerManager.checkMlxHealth();
+        this.processManager.sweepOrphanWorkers();
+    }
     logResourceSnapshot(reason, footprintMb) {
         var _a, _b;
         var _c, _d;
@@ -1941,38 +1990,45 @@ class Daemon {
      * This host lost three sessions that way before the compactor was identified as
      * the largest write source on it.
      *
-     * So the daemon watches the zone it is pressurizing. A warn-level reading is
-     * logged and left alone; a critical reading exits without relaunch, because
-     * relaunching would resume the writes that caused it. Nothing here can reclaim
-     * the leaked memory — only a reboot does that — so the only useful move is to
-     * stop adding to it while the user still has a working machine.
+     * Warning, critical or unknown macOS readings stop mutation before another
+     * heavy operation can begin. Persist the reason before shutdown, so hooks and
+     * memory guards cannot revive the writer. Nothing here reclaims kernel memory.
      *
-     * Deliberately does nothing when the sample is unavailable or unparseable
-     * (non-macOS, no `zprint`, changed output format): an unknown reading must never
-     * shut the daemon down.
+     * Non-macOS hosts have no such probe. On macOS an unavailable sample is
+     * explicitly unknown and cannot authorize further mutation.
      */
     checkKernelZonePressure() {
         if (this.shuttingDown || this.recycling)
-            return;
+            return false;
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null) {
+            // The existing quarantine is already durable; preserve its ownership and
+            // do not replace it with a new marker that an operator must also clear.
+            this.stopForSafety(denied, false);
+            return false;
+        }
+        if (process.platform !== "darwin")
+            return true;
         const usage = (0, kernel_zone_1.readKernelZoneUsage)();
-        if (!usage || usage.pressure === "ok")
-            return;
-        if (usage.pressure === "warn") {
-            // Rate-limited to once an hour: at the 5-minute heartbeat this would
-            // otherwise print 12 identical lines an hour for as long as the condition
-            // holds, which on a leaking host is until reboot.
-            const now = Date.now();
-            if (now - this.lastZoneWarnMs < 60 * 60 * 1000)
-                return;
-            this.lastZoneWarnMs = now;
-            console.log(`[daemon] WARNING: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — macOS kernel zone is leaking ` +
-                `under write pressure. The daemon will stop itself at ` +
-                `${(kernel_zone_1.ZONE_THRESHOLDS.criticalBytes / Math.pow(1024, 3)).toFixed(0)}GiB. ` +
-                `Only a reboot reclaims this memory.`);
-            return;
+        if ((usage === null || usage === void 0 ? void 0 : usage.pressure) === "ok")
+            return true;
+        const reason = usage
+            ? `${usage.pressure} kernel pressure: ${(0, kernel_zone_1.formatZoneUsage)(usage)}`
+            : "kernel pressure unavailable; heavy work cannot be admitted";
+        this.stopForSafety(reason);
+        return false;
+    }
+    stopForSafety(reason, persist = true) {
+        // Warning already pauses mutation: a stale index costs less than another
+        // host crash. Unknown readings are visible stops, never healthy samples.
+        try {
+            if (persist)
+                (0, safety_latch_1.latchSafetyStop)(reason);
+        }
+        catch (error) {
+            console.error("[daemon] Failed to persist safety stop; stopping anyway:", error);
         }
-        console.log(`[daemon] CRITICAL: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — stopping to avoid a kernel panic. ` +
-            `Reboot to reclaim the zone; the index will catch up on next start.`);
+        console.log(`[daemon] SAFETY STOP: ${reason}. Containment stays in place across restart; review host health before resuming.`);
         this.recycling = true;
         void this.shutdown().finally(() => process.exit(0));
     }

package/dist/lib/output/mcp-results.js

@@ -47,6 +47,9 @@ exports.compactionSchema = zod_1.z.object({
     freeBytesBefore: zod_1.z.number().optional(),
     freeBytesAfter: zod_1.z.number().optional(),
     bytesReclaimed: zod_1.z.number().optional(),
+    netBytesReclaimed: zod_1.z.number().optional(),
+    cleanupPasses: zod_1.z.number().int().min(0).max(1).optional(),
+    cleanupReason: zod_1.z.string().optional(),
 });
 const embedding = zod_1.z.object({
     tier: zod_1.z.string(),

package/dist/lib/store/maintenance-policy.js

@@ -0,0 +1,172 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DiskPressureError = exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON = void 0;
+exports.fullTableMaintenanceDisabled = fullTableMaintenanceDisabled;
+exports.availableStoreDiskBytes = availableStoreDiskBytes;
+exports.assertFreshDiskMutationAllowed = assertFreshDiskMutationAllowed;
+exports.storeMutationDeniedReason = storeMutationDeniedReason;
+exports.assertStoreMutationAllowed = assertStoreMutationAllowed;
+exports.maintenancePolicyPath = maintenancePolicyPath;
+exports.recordMaintenanceContainment = recordMaintenanceContainment;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const config_1 = require("../../config");
+const autostart_1 = require("../utils/autostart");
+const safety_latch_1 = require("../utils/safety-latch");
+exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON = "full-table maintenance disabled by host-safety containment; disk recovery is pending";
+/** This release has no production override: force, configuration and persisted
+ * state cannot enable rewriting. Tests may mock this module to cover the old
+ * native algorithm without turning it into a supported production entry point. */
+function fullTableMaintenanceDisabled() {
+    return true;
+}
+class DiskPressureError extends Error {
+    constructor(message = "Disk critically low or unknown — writes suspended") {
+        super(message);
+        this.name = "DiskPressureError";
+    }
+}
+exports.DiskPressureError = DiskPressureError;
+/** Fresh, bounded filesystem sample. ENOENT alone permits trying an ancestor;
+ * permission errors, invalid values and all other uncertainty refuse writes. */
+function availableStoreDiskBytes(storeDir) {
+    let existing = path.resolve(storeDir);
+    for (;;) {
+        try {
+            const stats = fs.statfsSync(existing);
+            const available = stats.bavail * stats.bsize;
+            return Number.isFinite(available) && available >= 0
+                ? available
+                : Number.NaN;
+        }
+        catch (error) {
+            const parent = path.dirname(existing);
+            if (error.code !== "ENOENT" ||
+                parent === existing)
+                return Number.NaN;
+            existing = parent;
+        }
+    }
+}
+/** Reusable admission for LMDB and other store mutations. Never cached. */
+function assertFreshDiskMutationAllowed(storeDir) {
+    const available = availableStoreDiskBytes(storeDir);
+    if (!Number.isFinite(available) || available < config_1.DISK_CRITICAL_BYTES)
+        throw new DiskPressureError();
+    return available;
+}
+function storeMutationDeniedReason() {
+    const safety = (0, safety_latch_1.safetyStopReason)();
+    if (safety !== null)
+        return `host safety stop: ${safety}`;
+    return (0, autostart_1.autostartDisabledReason)() !== null
+        ? "store mutations are quarantined while daemon autostart is disabled"
+        : null;
+}
+function assertStoreMutationAllowed() {
+    const reason = storeMutationDeniedReason();
+    if (reason !== null)
+        throw new Error(`gmax store mutation blocked: ${reason}`);
+}
+function maintenancePolicyPath(storeDir) {
+    return path.join(storeDir, ".gmax-maintenance-policy.json");
+}
+/** Persist a zero-rewrite receipt once. Unknown/corrupt/unwritable state never
+ * weakens the immutable default. No timestamps or budgets authorize native work. */
+function recordMaintenanceContainment(storeDir) {
+    let temporary;
+    try {
+        fs.mkdirSync(storeDir, { recursive: true, mode: 0o700 });
+        const storeIdentity = fs.realpathSync(storeDir);
+        const target = maintenancePolicyPath(storeIdentity);
+        if (fs.existsSync(target)) {
+            const stat = fs.lstatSync(target);
+            if (!stat.isFile() || stat.size > 16 * 1024)
+                throw new Error("unsafe maintenance policy file");
+            const previous = JSON.parse(fs.readFileSync(target, "utf8"));
+            if (previous.schemaVersion === 1 &&
+                previous.storeIdentity === storeIdentity &&
+                previous.mode === "disabled" &&
+                previous.rewriteBudgetBytes === 0 &&
+                previous.cleanupPending === true) {
+                fs.chmodSync(target, 0o600);
+                return exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON;
+            }
+        }
+        const policy = {
+            schemaVersion: 1,
+            storeIdentity,
+            mode: "disabled",
+            reason: exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON,
+            recordedAt: Date.now(),
+            rewriteBudgetBytes: 0,
+            cleanupPending: true,
+        };
+        temporary = path.join(storeIdentity, `.gmax-maintenance-${(0, node_crypto_1.randomUUID)()}.tmp`);
+        const descriptor = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(descriptor, `${JSON.stringify(policy)}\n`);
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        fs.renameSync(temporary, target);
+        temporary = undefined;
+        const directory = fs.openSync(storeIdentity, "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+        return exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON;
+    }
+    catch (_a) {
+        return `${exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON}; persistent policy unavailable or invalid (still disabled)`;
+    }
+    finally {
+        if (temporary) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (_b) {
+                // Failed receipt cleanup cannot authorize maintenance.
+            }
+        }
+    }
+}

package/dist/lib/store/meta-cache.js

@@ -67,14 +67,39 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const lmdb_1 = require("lmdb");
 const cleanup_1 = require("../utils/cleanup");
+const maintenance_policy_1 = require("./maintenance-policy");
 class MetaCache {
     constructor(lmdbPath) {
+        this.lmdbPath = lmdbPath;
         this.closed = false;
-        fs.mkdirSync(path.dirname(lmdbPath), { recursive: true });
+        let diskAllowsWrites = false;
+        try {
+            (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(lmdbPath);
+            diskAllowsWrites = true;
+        }
+        catch (_a) {
+            /* Unknown/critical disk allows existing-cache reads only. */
+        }
+        this.readOnly = (0, maintenance_policy_1.storeMutationDeniedReason)() !== null || !diskAllowsWrites;
+        if (this.readOnly) {
+            // Quarantine permits reads of an existing cache, never creating one.
+            try {
+                fs.lstatSync(lmdbPath);
+            }
+            catch (_b) {
+                throw new Error("gmax metadata cache is quarantined or disk-constrained and unavailable");
+            }
+        }
+        else {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(lmdbPath);
+            fs.mkdirSync(path.dirname(lmdbPath), { recursive: true });
+        }
         this.db = (0, lmdb_1.open)({
             path: lmdbPath,
             compression: true,
             cache: true,
+            readOnly: this.readOnly,
         });
         this.unregisterCleanup = (0, cleanup_1.registerCleanup)(() => this.close());
     }
@@ -129,11 +154,19 @@ class MetaCache {
         });
     }
     put(filePath, entry) {
+        this.assertWritable();
         this.db.put(filePath, entry);
     }
     delete(filePath) {
+        this.assertWritable();
         this.db.remove(filePath);
     }
+    assertWritable() {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
+        (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(this.lmdbPath);
+        if (this.readOnly)
+            throw new Error("gmax metadata cache was opened read-only; reopen after reviewing containment");
+    }
     entries() {
         return __asyncGenerator(this, arguments, function* entries_1() {
             var _a, e_3, _b, _c;