grepmax 0.26.53 → 0.26.55

package/dist/lib/store/vector-db.js

@@ -66,6 +66,7 @@ const query_timeout_1 = require("../utils/query-timeout");
 const ann_config_1 = require("./ann-config");
 const compaction_result_1 = require("./compaction-result");
 const lancedb = __importStar(require("./lance-sdk"));
+const maintenance_policy_1 = require("./maintenance-policy");
 const store_lease_1 = require("./store-lease");
 /**
  * Find abandoned Lance scratch files under `<lancedbDir>/ *.lance/data`.
@@ -134,13 +135,8 @@ function sweepStaleLanceTempFiles(lancedbDir, minAgeMs = config_1.STALE_TEMP_FIL
     }
     return { filesRemoved, bytesFreed };
 }
-class DiskPressureError extends Error {
-    constructor(message = "Disk critically low — writes suspended") {
-        super(message);
-        this.name = "DiskPressureError";
-    }
-}
-exports.DiskPressureError = DiskPressureError;
+var maintenance_policy_2 = require("./maintenance-policy");
+Object.defineProperty(exports, "DiskPressureError", { enumerable: true, get: function () { return maintenance_policy_2.DiskPressureError; } });
 /**
  * Detects "Not found: <hash>.lance" errors from LanceDB — these indicate the
  * manifest references a fragment file that doesn't exist on disk, typically
@@ -370,11 +366,20 @@ class VectorDB {
             if (this.closed) {
                 throw new Error("VectorDB connection is closed");
             }
+            const creatingStore = !fs.existsSync(this.lancedbDir);
+            if (creatingStore) {
+                (0, maintenance_policy_1.assertStoreMutationAllowed)();
+                (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(this.lancedbDir);
+            }
             yield this.getLease();
             if (this.closed) {
                 throw new Error("VectorDB connection is closed");
             }
             if (!this.db) {
+                if (creatingStore || !fs.existsSync(this.lancedbDir)) {
+                    (0, maintenance_policy_1.assertStoreMutationAllowed)();
+                    (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(this.lancedbDir);
+                }
                 fs.mkdirSync(this.lancedbDir, { recursive: true });
                 this.session = createLanceSession();
                 // 0.38 accepts the legacy third argument in its types but drops it in
@@ -469,23 +474,18 @@ class VectorDB {
         });
     }
     getAvailableBytes() {
-        try {
-            const stats = fs.statfsSync(this.lancedbDir);
-            return stats.bavail * stats.bsize;
-        }
-        catch (_a) {
-            return Number.MAX_SAFE_INTEGER; // fail-open
-        }
+        return (0, maintenance_policy_1.availableStoreDiskBytes)(this.lancedbDir);
     }
-    checkDiskPressure() {
+    checkDiskPressure(fresh = false) {
         const now = Date.now();
-        if (now - this.lastDiskCheckMs < VectorDB.DISK_CHECK_INTERVAL_MS) {
+        if (!fresh &&
+            now - this.lastDiskCheckMs < VectorDB.DISK_CHECK_INTERVAL_MS) {
             return this.diskPressure;
         }
         this.lastDiskCheckMs = now;
         const avail = this.getAvailableBytes();
         let level;
-        if (avail < config_1.DISK_CRITICAL_BYTES) {
+        if (!Number.isFinite(avail) || avail < 0 || avail < config_1.DISK_CRITICAL_BYTES) {
             level = "critical";
         }
         else if (avail < config_1.DISK_LOW_BYTES) {
@@ -497,7 +497,7 @@ class VectorDB {
         if (level !== this.lastLoggedPressure) {
             const freeStr = `${(avail / 1024 / 1024 / 1024).toFixed(1)}GB`;
             if (level === "critical") {
-                (0, logger_1.log)("vectordb", `CRITICAL: disk space critically low (${freeStr} free) — writes suspended`);
+                (0, logger_1.log)("vectordb", `CRITICAL: ${Number.isFinite(avail) ? `disk space critically low (${freeStr} free)` : "disk space unknown"} — writes suspended`);
             }
             else if (level === "low") {
                 (0, logger_1.log)("vectordb", `WARNING: disk space low (${freeStr} free) — compaction limited`);
@@ -511,8 +511,8 @@ class VectorDB {
         return level;
     }
     ensureDiskOk() {
-        if (this.checkDiskPressure() === "critical") {
-            throw new DiskPressureError();
+        if (this.checkDiskPressure(true) === "critical") {
+            throw new maintenance_policy_1.DiskPressureError();
         }
     }
     /**
@@ -522,6 +522,8 @@ class VectorDB {
      */
     withWriteGate(fn) {
         return __awaiter(this, void 0, void 0, function* () {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            this.ensureDiskOk();
             while (this.exclusiveMutationPromise || this.compactingPromise) {
                 if (this.closed)
                     throw new Error("VectorDB connection is closed");
@@ -529,6 +531,8 @@ class VectorDB {
             }
             if (this.closed)
                 throw new Error("VectorDB connection is closed");
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            this.ensureDiskOk();
             this.activeWrites++;
             try {
                 return yield fn();
@@ -567,6 +571,8 @@ class VectorDB {
     }
     withExclusiveTableMutation(mutation) {
         return __awaiter(this, void 0, void 0, function* () {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            this.ensureDiskOk();
             if (this.closed)
                 throw new Error("VectorDB connection is closed");
             if (this.exclusiveMutationPromise) {
@@ -592,6 +598,8 @@ class VectorDB {
                             });
                         }
                         yield Promise.all([this.drainWrites(), this.drainCompactions()]);
+                        (0, maintenance_policy_1.assertStoreMutationAllowed)();
+                        this.ensureDiskOk();
                         const db = yield this.getDb();
                         const result = yield mutation(db);
                         this.markWriteCommitted();
@@ -761,6 +769,14 @@ class VectorDB {
     }
     ensureTable() {
         return __awaiter(this, void 0, void 0, function* () {
+            if ((0, maintenance_policy_1.storeMutationDeniedReason)() !== null ||
+                this.checkDiskPressure(true) === "critical") {
+                const existing = yield this.openExistingTableUnsafe();
+                if (!existing)
+                    throw new Error("gmax store is quarantined and has no existing table");
+                yield this.validateSchema(existing);
+                return existing;
+            }
             return this.withWriteGate(() => this.ensureTableUnsafe());
         });
     }
@@ -774,6 +790,7 @@ class VectorDB {
             catch (err) {
                 if (!isMissingTableError(err))
                     throw err;
+                (0, maintenance_policy_1.assertStoreMutationAllowed)();
                 (0, logger_1.log)("db", `Creating table (${this.vectorDim}d)`);
                 const schema = this.buildSchema();
                 table = yield db.createTable(TABLE_NAME, [this.seedRow()], {
@@ -784,6 +801,7 @@ class VectorDB {
                 return table;
             }
             yield this.validateSchema(table);
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
             yield this.evolveSchema(table);
             return table;
         });
@@ -903,6 +921,12 @@ class VectorDB {
     }
     createFTSIndex() {
         return __awaiter(this, arguments, void 0, function* (rebuild = false, retries = 5) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                if (rebuild)
+                    throw new Error(maintenance_policy_1.FULL_TABLE_MAINTENANCE_DISABLED_REASON);
+                // Existing indexes remain searchable; absence does not authorize a build.
+                return this.adoptFTSIndex();
+            }
             return this.withWriteGate(() => this.createFTSIndexUnsafe(rebuild, retries));
         });
     }
@@ -939,7 +963,9 @@ class VectorDB {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.ftsIndexEnsured)
                 return;
-            const table = yield this.ensureTable();
+            const table = yield this.openExistingTableUnsafe();
+            if (!table)
+                throw new Error("[vector-db] No existing table or FTS index; index maintenance is disabled");
             const indices = yield table.listIndices();
             const existing = indices.find((index) => index.name === "content_idx" || index.columns.includes("content"));
             if (!existing) {
@@ -950,6 +976,10 @@ class VectorDB {
     }
     createVectorIndex() {
         return __awaiter(this, arguments, void 0, function* (rebuild = false, retries = 5, checkOnly = false) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                (0, logger_1.debug)("vectordb", "ANN/index maintenance disabled by host-safety containment");
+                return false;
+            }
             if (this.checkDiskPressure() !== "ok") {
                 (0, logger_1.debug)("vectordb", "ANN index skipped under disk pressure");
                 return false;
@@ -1108,9 +1138,84 @@ class VectorDB {
         (0, logger_1.log)("vectordb", `Compaction result: ${JSON.stringify(result)}`);
         return Object.assign({}, result);
     }
+    /** Prune the reserve-ID snapshot without another data rewrite. Caller holds
+     * compactingPromise and has drained writes; never use this for retention > 0.
+     * Lance 12 treats one deletion-free fragment as a compaction no-op. */
+    cleanupCompactionReservation(table) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            let passes = 0;
+            const deferred = (reason) => ({
+                passes: 0,
+                bytesRemoved: 0,
+                reason,
+            });
+            try {
+                const stats = yield table.stats();
+                if (((_a = stats.fragmentStats) === null || _a === void 0 ? void 0 : _a.numFragments) !== 1) {
+                    return deferred("cleanup deferred: table is not a single fragment");
+                }
+                const version = yield table.version();
+                const fresh = yield this.openExistingTableUnsafe();
+                if (!fresh || (yield fresh.version()) !== version) {
+                    return deferred("cleanup deferred: table changed after compaction");
+                }
+                const latest = (yield fresh.listVersions()).find((v) => v.version === version);
+                if ((latest === null || latest === void 0 ? void 0 : latest.metadata.total_fragments) !== "1" ||
+                    latest.metadata.total_deletion_files !== "0" ||
+                    latest.metadata.total_deletion_file_rows !== "0") {
+                    return deferred("cleanup deferred: deletion-free fragment not verified");
+                }
+                // Manifest timestamps have sub-ms precision; wait for a real later tick,
+                // never invent a future cutoff. No gmax writes can enter while gated.
+                yield new Promise((resolve) => setTimeout(resolve, 1));
+                const cutoff = new Date();
+                if (!Number.isFinite(latest.timestamp.getTime()) ||
+                    cutoff.getTime() <= latest.timestamp.getTime()) {
+                    return deferred("cleanup deferred: clock has not passed the commit");
+                }
+                const freeBytes = this.getAvailableBytes();
+                const requiredBytes = stats.totalBytes * 2 + config_1.DISK_CRITICAL_BYTES;
+                if (!Number.isFinite(stats.totalBytes) ||
+                    stats.totalBytes < 0 ||
+                    freeBytes < requiredBytes) {
+                    return deferred("cleanup deferred: insufficient rewrite headroom");
+                }
+                (0, logger_1.log)("vectordb", `Compaction cleanup attempt: ${JSON.stringify({ version, cutoff: cutoff.getTime(), freeBytes, requiredBytes })}`);
+                passes = 1;
+                const result = yield fresh.optimize({
+                    cleanupOlderThan: cutoff,
+                    deleteUnverified: true,
+                });
+                if (result.compaction.fragmentsRemoved !== 0 ||
+                    result.compaction.fragmentsAdded !== 0) {
+                    return {
+                        passes,
+                        bytesRemoved: result.prune.bytesRemoved,
+                        failed: true,
+                        reason: "cleanup unexpectedly rewrote data; no retry",
+                    };
+                }
+                return { passes, bytesRemoved: result.prune.bytesRemoved };
+            }
+            catch (error) {
+                return {
+                    passes,
+                    bytesRemoved: 0,
+                    failed: true,
+                    reason: `cleanup failed: ${error instanceof Error ? error.message : String(error)}`,
+                };
+            }
+        });
+    }
     optimize() {
         return __awaiter(this, arguments, void 0, function* (retries = COMPACTION_MAX_ATTEMPTS, retentionMs = 0, bypassExclusiveMutation = false) {
             var _a;
+            var _b;
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                this.lastOptimizeDidWork = false;
+                return this.recordSkippedCompaction((0, maintenance_policy_1.recordMaintenanceContainment)(this.lancedbDir));
+            }
             if (!bypassExclusiveMutation) {
                 while (this.exclusiveMutationPromise)
                     yield this.exclusiveMutationPromise;
@@ -1120,7 +1225,7 @@ class VectorDB {
             if (this.compactingPromise) {
                 (0, logger_1.debug)("vectordb", "Optimize already in progress, skipping");
                 yield this.compactingPromise;
-                return ((_a = this.compactionStatus()) !== null && _a !== void 0 ? _a : (0, compaction_result_1.skippedCompaction)("compaction unavailable"));
+                return ((_b = this.compactionStatus()) !== null && _b !== void 0 ? _b : (0, compaction_result_1.skippedCompaction)("compaction unavailable"));
             }
             this.lastOptimizeDidWork = false;
             let resolveCompacting;
@@ -1133,7 +1238,10 @@ class VectorDB {
             let logicalBytes;
             let diskBytesBefore;
             let freeBytesBefore;
+            let cleanupPasses = 0;
+            let cleanupReason;
             const finish = (status, reason, bytesReclaimed) => {
+                const diskBytesAfter = this.getDirectorySize(this.lancedbDir);
                 const result = {
                     status,
                     at: Date.now(),
@@ -1143,9 +1251,14 @@ class VectorDB {
                     logicalBytes,
                     diskBytesBefore,
                     freeBytesBefore,
-                    diskBytesAfter: this.getDirectorySize(this.lancedbDir),
+                    diskBytesAfter,
                     freeBytesAfter: this.getAvailableBytes(),
                     bytesReclaimed,
+                    netBytesReclaimed: diskBytesBefore === undefined
+                        ? undefined
+                        : diskBytesBefore - diskBytesAfter,
+                    cleanupPasses,
+                    cleanupReason,
                 };
                 this.lastCompactionResult = result;
                 (0, logger_1.log)("vectordb", `Compaction result: ${JSON.stringify(result)}`);
@@ -1210,7 +1323,18 @@ class VectorDB {
                         else {
                             (0, logger_1.debug)("vectordb", "Optimize: nothing to compact or prune");
                         }
-                        return finish("completed", undefined, prune.bytesRemoved);
+                        let bytesReclaimed = prune.bytesRemoved;
+                        if (retentionMs === 0 && compaction.fragmentsRemoved > 0) {
+                            const cleanup = yield this.cleanupCompactionReservation(table);
+                            cleanupPasses = cleanup.passes;
+                            cleanupReason = (_a = cleanup.reason) === null || _a === void 0 ? void 0 : _a.replace(/[\r\n\t]/g, " ").slice(0, 512);
+                            bytesReclaimed += cleanup.bytesRemoved;
+                            this.lastOptimizeDidWork || (this.lastOptimizeDidWork = cleanup.bytesRemoved > 0);
+                            (0, logger_1.log)("vectordb", `Compaction cleanup result: ${JSON.stringify(Object.assign(Object.assign({}, cleanup), { reason: cleanupReason }))}`);
+                            if (cleanup.failed)
+                                return finish("failed", cleanupReason, bytesReclaimed);
+                        }
+                        return finish("completed", undefined, bytesReclaimed);
                     }
                     catch (e) {
                         const msg = e instanceof Error ? e.message : String(e);
@@ -1282,10 +1406,14 @@ class VectorDB {
     /**
      * Run FTS rebuild + optimize as a single serialized operation.
      * Safe to call from multiple project processors — only one runs at a time.
-     * Checks disk bloat ratio and retries optimize when bloat persists.
+     * Reports bloat without another whole-table rewrite.
      */
     runMaintenance() {
         return __awaiter(this, arguments, void 0, function* (options = {}) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                this.lastOptimizeDidWork = false;
+                return this.recordSkippedCompaction((0, maintenance_policy_1.recordMaintenanceContainment)(this.lancedbDir));
+            }
             if (this.maintenanceRunning) {
                 (0, logger_1.debug)("vectordb", "Maintenance already running, skipping");
                 return (0, compaction_result_1.skippedCompaction)("maintenance already running");
@@ -1336,8 +1464,8 @@ class VectorDB {
                     // Track across both passes: `lastOptimizeDidWork` is reset per optimize()
                     // call, so a productive first pass followed by a barren bloat retry would
                     // otherwise read as unproductive and trigger a spurious backoff.
-                    let didWork = this.lastOptimizeDidWork;
-                    if (this.lastOptimizeDidWork) {
+                    const didWork = this.lastOptimizeDidWork;
+                    if (result.status === "completed" && this.lastOptimizeDidWork) {
                         const table = yield this.openExistingTableUnsafe();
                         if (table) {
                             // Collect abandoned scratch files before measuring. They are pure
@@ -1353,17 +1481,17 @@ class VectorDB {
                             const diskSize = this.getDirectorySize(this.lancedbDir);
                             const logicalSize = stats.totalBytes;
                             const bloatRatio = logicalSize > 0 ? diskSize / logicalSize : 0;
-                            // Only retry if disk is still ok after optimize (don't spiral)
-                            if (bloatRatio > 2.0 && this.checkDiskPressure() === "ok") {
-                                (0, logger_1.log)("vectordb", `Bloat detected after optimize: ${(diskSize / 1024 / 1024).toFixed(0)}MB disk vs ${(logicalSize / 1024 / 1024).toFixed(0)}MB logical (${bloatRatio.toFixed(1)}x) — retrying`);
-                                yield new Promise((r) => setTimeout(r, 2000));
-                                result = yield this.optimize(5, 0, true);
-                                didWork = didWork || this.lastOptimizeDidWork;
+                            if (bloatRatio > 2.0) {
+                                (0, logger_1.log)("vectordb", `Bloat remains after optimize: ${bloatRatio.toFixed(1)}x; additional rewrite disabled`);
                             }
                         }
                     }
                     this.noteCompaction(didWork);
                 }
+                if (result && result.status !== "completed")
+                    return result;
+                if (result === null || result === void 0 ? void 0 : result.cleanupReason)
+                    return result;
                 const maintainedTable = yield this.openExistingTableUnsafe();
                 this.maintainedTableVersion =
                     yield this.readTableVersion(maintainedTable);
@@ -1419,6 +1547,11 @@ class VectorDB {
     }
     compactIfNeeded() {
         return __awaiter(this, arguments, void 0, function* (threshold = config_1.FRAGMENT_COMPACT_THRESHOLD) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                this.lastOptimizeDidWork = false;
+                this.recordSkippedCompaction((0, maintenance_policy_1.recordMaintenanceContainment)(this.lancedbDir));
+                return false;
+            }
             if (this.maintenanceRunning)
                 return false;
             this.maintenanceRunning = true;

package/dist/lib/utils/autostart.js

@@ -35,10 +35,13 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.autostartDisabledReason = autostartDisabledReason;
 exports.isAutostartDisabled = isAutostartDisabled;
+exports.daemonStartDeniedReason = daemonStartDeniedReason;
 exports.autostartDisabledUndo = autostartDisabledUndo;
 exports.autostartDisabledNotice = autostartDisabledNotice;
 const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
+const safety_latch_1 = require("./safety-latch");
 /**
  * Kill switch for *implicit* daemon auto-start. Create
  * ~/.gmax/autostart-disabled (or export GMAX_NO_AUTOSTART=1) to keep session
@@ -46,8 +49,8 @@ const config_1 = require("../../config");
  * reviving the daemon — needed when the host is quarantined and the daemon's
  * write volume is the thing under investigation.
  *
- * Explicit `gmax watch --daemon` is never gated: typing it is the user asking
- * for a daemon in that moment.
+ * Safety containment also gates explicit daemon launches. A launch is not
+ * authorization to remove an existing host quarantine.
  *
  * plugins/grepmax/hooks/watch-lease.js carries a plain-JS copy of these semantics
  * (env var checked first, then the file) because a SessionStart hook cannot
@@ -56,16 +59,35 @@ const config_1 = require("../../config");
 function autostartDisabledReason() {
     if (process.env.GMAX_NO_AUTOSTART === "1")
         return "env";
-    try {
-        return fs.existsSync(config_1.PATHS.autostartDisabledFile) ? "file" : null;
-    }
-    catch (_a) {
-        return null;
+    if ((0, safety_latch_1.safetyStopReason)() !== null)
+        return "safety";
+    const markers = new Set([
+        config_1.PATHS.autostartDisabledFile,
+        ...(config_1.PATHS.sharedRoot
+            ? [path.join(config_1.PATHS.sharedRoot, "autostart-disabled")]
+            : []),
+    ]);
+    for (const marker of markers) {
+        try {
+            fs.lstatSync(marker);
+            return "file";
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return "file";
+        }
     }
+    return null;
 }
 function isAutostartDisabled() {
     return autostartDisabledReason() !== null;
 }
+function daemonStartDeniedReason() {
+    const safety = (0, safety_latch_1.safetyStopReason)();
+    if (safety !== null)
+        return `host safety stop: ${safety}`;
+    return isAutostartDisabled() ? "daemon startup is quarantined" : null;
+}
 /**
  * One-line notice for commands that fell back to in-process work because the
  * kill switch is on, or null when it isn't. Names the specific undo step so
@@ -76,11 +98,16 @@ function autostartDisabledUndo() {
     const reason = autostartDisabledReason();
     if (!reason)
         return null;
+    if (reason === "safety")
+        return "review the persistent host safety stop before resuming";
     return reason === "env"
         ? "unset GMAX_NO_AUTOSTART"
         : `rm ${config_1.PATHS.autostartDisabledFile}`;
 }
 function autostartDisabledNotice() {
+    const safety = (0, safety_latch_1.safetyStopReason)();
+    if (safety !== null)
+        return `Gmax is paused by a persistent host safety stop: ${safety}. Mutations remain blocked until containment is reviewed.`;
     // A secondary store (src/bin.ts) runs in-process by design, not because the
     // kill switch is on, so say that instead of naming an undo step. Callers use
     // a non-null notice as the gate, so this must stay non-null.

package/dist/lib/utils/daemon-launcher.js

@@ -48,6 +48,7 @@ const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
+const autostart_1 = require("./autostart");
 const log_rotate_1 = require("./log-rotate");
 /**
  * Spawn the daemon in background mode.
@@ -56,6 +57,8 @@ const log_rotate_1 = require("./log-rotate");
 function spawnDaemon() {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
+        if ((0, autostart_1.daemonStartDeniedReason)() !== null)
+            return null;
         let out = null;
         try {
             const logFile = path.join(config_1.PATHS.logsDir, "daemon.log");
@@ -90,6 +93,9 @@ function spawnDaemon() {
  */
 function spawnDaemonProcess() {
     return __awaiter(this, void 0, void 0, function* () {
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null)
+            throw new Error(`gmax: ${denied}`);
         const logFile = path.join(config_1.PATHS.logsDir, "daemon.log");
         const out = (0, log_rotate_1.openRotatedLog)(logFile);
         try {

package/dist/lib/utils/doctor-optimize.js

@@ -72,6 +72,12 @@ function formatDoctorOptimize(report, agent) {
             ...(typeof (r === null || r === void 0 ? void 0 : r.bytesReclaimed) === "number"
                 ? [`bytes_reclaimed=${r.bytesReclaimed}`]
                 : []),
+            ...(typeof (r === null || r === void 0 ? void 0 : r.netBytesReclaimed) === "number"
+                ? [`net_bytes_reclaimed=${r.netBytesReclaimed}`]
+                : []),
+            ...(typeof (r === null || r === void 0 ? void 0 : r.cleanupPasses) === "number"
+                ? [`cleanup_passes=${r.cleanupPasses}`]
+                : []),
             ...(reason ? [`reason=${reason}`] : []),
         ].join("\t");
     }

package/dist/lib/utils/kernel-zone.js

@@ -21,11 +21,15 @@ const node_child_process_1 = require("node:child_process");
  * docs/2026-08-04-macos-kernel-zone-panic-incident.md.
  *
  * gmax cannot fix the kernel defect, but it can decline to be the thing that
- * detonates it. Sampling the zone is cheap (~0.2 s), so the daemon watches its own
- * blast radius and stands down while there are still hours of headroom.
+ * detonates it. Sampling the zone has taken 1.584 s on the incident host, so the
+ * probe uses a bounded five-second budget. The daemon stands down while there
+ * are still hours of headroom.
  */
 /** The zone that leaks. Named explicitly so `zprint` returns a single line. */
 const ZONE_NAME = "data.kalloc.1024";
+// Two 500 ms probes timed out on the incident host; a subsequent probe completed
+// in 1,584 ms. Keep the previous five-second ceiling to allow scheduling margin.
+const PROBE_TIMEOUT_MS = 5000;
 /**
  * Warn threshold.
  *
@@ -84,8 +88,8 @@ function parseZprintOutput(output, zoneName = ZONE_NAME) {
 }
 /**
  * Sample the zone. Returns null off macOS, or whenever the sample cannot be
- * trusted — an unparseable report must read as "unknown", never as "healthy" and
- * never as a reason to stop working.
+ * trusted. An unparseable or timed-out report reads as "unknown", never as
+ * "healthy". macOS startup and heavy-operation admission refuse unknown samples.
  */
 function readKernelZoneUsage(zoneName = ZONE_NAME) {
     if (process.platform !== "darwin")
@@ -93,7 +97,8 @@ function readKernelZoneUsage(zoneName = ZONE_NAME) {
     try {
         const output = (0, node_child_process_1.execFileSync)("zprint", [zoneName], {
             encoding: "utf-8",
-            timeout: 5000,
+            timeout: PROBE_TIMEOUT_MS,
+            maxBuffer: 64 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
         });
         const parsed = parseZprintOutput(output, zoneName);