grepmax 0.26.54 → 0.26.55

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.54",
+      "version": "0.26.55",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -54,9 +54,11 @@ gmax config                   # View current settings
 gmax config --embed-mode gpu  # Switch to GPU (Apple Silicon)
 gmax config --worker-threads 2  # Cap worker processes (auto = default); applies on daemon restart
 gmax doctor                   # Health check
-gmax doctor --fix             # Auto-repair (compact, prune, remove stale locks)
+gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 ```
 
+**Storage containment:** full-table compaction is disabled, including forced maintenance and doctor repair. Existing retained index copies are not reclaimed by this release. The verified prune-only recovery path is separate work; normal incremental indexing remains available when the host is healthy and not quarantined. A persistent host safety stop blocks mutation and daemon restart. Installing an update preserves existing quarantine.
+
 ### Core Commands
 
 ```bash
@@ -234,7 +236,7 @@ gmax watch restart            # Stop it, wait for it to exit, start a fresh one
 gmax status                   # See all projects + watcher status
 ```
 
-Adding or indexing a project can start the daemon automatically. MCP acquires primary-project watch leases lazily when an index-reading tool is used; discovery and catalog listing start no background work. It shuts down after 4 hours of inactivity, and hands off to a fresh daemon after 24 hours or once its memory footprint passes 2.5 GB. File-change batches are processed on up to four worker processes by default, added only when work backs up, with one kept free for searches; LanceDB compaction runs after writes rather than on every maintenance tick.
+Adding or indexing a project can start the daemon automatically. MCP acquires primary-project watch leases lazily when an index-reading tool is used; discovery and catalog listing start no background work. It shuts down after 4 hours of inactivity, and hands off to a fresh daemon after 24 hours or once its memory footprint passes 2.5 GB. File-change batches are processed on up to four worker processes by default, added only when work backs up, with one kept free for searches; full-table compaction and new FTS/ANN index builds are disabled by containment. Existing indexes remain readable. Host safety stops persist across restart and block heavy operations.
 
 `gmax watch status` reports failed files, native watcher recovery or polling, dropped-event counts, and the last complete filesystem reconciliation. Polling scans run every five minutes, so recent edits can lag. Search and MCP responses retain health warnings even after the file queue drains. A complete reconciliation means the filesystem scan completed; queued embedding work can still be pending.
 
@@ -461,7 +463,7 @@ fixtures/
 
 ```bash
 gmax doctor                   # Check health
-gmax doctor --fix             # Auto-repair (compact, prune, fix locks)
+gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 gmax doctor --agent           # Machine-readable health output
 gmax index                    # Reindex (auto-detects and repairs cache/vector mismatches)
 gmax index --reset            # Full reindex from scratch
@@ -470,11 +472,11 @@ gmax watch restart            # Restart daemon
 
 `gmax doctor` reports ANN index state. `ANN: vector index not built` is normal with the default exact-search configuration.
 
-Compaction pauses index writes, waits for pending writes to commit, and opens a fresh table snapshot for each attempt. Each optimize call makes at most two attempts. Before each attempt it checks current free space against twice the table's logical size plus the critical-space reserve (5 GB by default). If there is insufficient headroom, it skips the rewrite and logs the required space; search remains available. A successful prune can reclaim fragment copies left by failed attempts.
+Full-table compaction and new FTS/ANN index builds are disabled in the containment release, including forced maintenance and doctor repair. Existing indexes remain readable; missing lexical indexes fall back to available retrieval. Retained copies are not recovered by this release. A separate exclusive prune-only path requires validation before deployment. Do not repeatedly force repair, use future cutoffs or manually remove index fragments.
 
-`~/.gmax/logs/daemon.log` records compaction attempts and outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
+`~/.gmax/logs/daemon.log` records containment skips and retained historical compaction outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
 
-`gmax doctor --fix` reports completed, skipped, failed, or unverified optimization. It exits nonzero when a requested optimization did not complete or an older daemon could not verify its outcome. A busy or failed daemon is never retried as a second writer in the CLI process.
+`gmax doctor --fix` refuses work under quarantine and otherwise reports optimization skipped by containment. It exits nonzero when a requested optimization did not complete or an older daemon could not verify its outcome. A busy or failed daemon is never retried as a second writer in the CLI process.
 
 ### Known issues
 
@@ -485,7 +487,7 @@ whether you need to act.
 | You see | What it means |
 |---|---|
 | `Optimize panicked ... inverted/builder.rs` | The historical FTS merge defect is fixed in the shipped LanceDB 0.39.0 runtime. If it recurs on a current release, preserve the version and logs and report a regression; the rebuild guard remains a recovery tripwire. |
-| `disabling auto-rebuild until an optimize succeeds` | Transient, not a wedge. The next successful optimize clears it. Search stays available. |
+| `disabling auto-rebuild until an optimize succeeds` | Recovery remains paused under containment. Preserve diagnostics; use existing indexes or vector retrieval rather than forcing optimize. |
 | `ANN: vector index not built` | Normal — exact search is the default. |
 | `cannot reach the daemon socket from this sandbox` (exit 2) | The shell is sandboxed. Add the two keys in [Running under the Claude Code sandbox](#running-under-the-claude-code-sandbox); `gmax doctor` warns about the same gap. |
 | `npm audit` reports advisories on install | Record the installed version and dependency path and report new findings. JavaScript consumer audits do not cover the Python embedding environment; maintainers also audit its locked registry dependencies with `pnpm run audit:python` (Python 3.11+; no model load). |

package/dist/commands/add.js

@@ -53,6 +53,7 @@ const index_config_1 = require("../lib/index/index-config");
 const sync_helpers_1 = require("../lib/index/sync-helpers");
 const syncer_1 = require("../lib/index/syncer");
 const setup_helpers_1 = require("../lib/setup/setup-helpers");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const blocked_roots_1 = require("../lib/utils/blocked-roots");
@@ -87,6 +88,7 @@ Examples:
     var _a, _b, _c, _d, _e, _f;
     let vectorDb = null;
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         const targetDir = dir ? path.resolve(dir) : process.cwd();
         const projectRoot = (_a = (0, project_root_1.findProjectRoot)(targetDir)) !== null && _a !== void 0 ? _a : targetDir;
         const projectName = path.basename(projectRoot);

package/dist/commands/doctor.js

@@ -51,6 +51,7 @@ const commander_1 = require("commander");
 const config_1 = require("../config");
 const embedding_status_1 = require("../lib/index/embedding-status");
 const index_config_1 = require("../lib/index/index-config");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const doctor_optimize_1 = require("../lib/utils/doctor-optimize");
 const doctor_status_1 = require("../lib/utils/doctor-status");
 const exit_1 = require("../lib/utils/exit");
@@ -346,6 +347,14 @@ exports.doctor = new commander_1.Command("doctor")
     .action((opts) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
     var _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    if (opts.fix) {
+        const denied = (0, maintenance_policy_1.storeMutationDeniedReason)();
+        if (denied !== null) {
+            console.error(`gmax doctor --fix refused: ${denied}; preserving containment`);
+            process.exitCode = 2;
+            return;
+        }
+    }
     if (!opts.agent)
         console.log("gmax Doctor\n");
     const root = config_1.PATHS.globalRoot;

package/dist/commands/index.js

@@ -50,6 +50,7 @@ const grammar_loader_1 = require("../lib/index/grammar-loader");
 const sync_helpers_1 = require("../lib/index/sync-helpers");
 const syncer_1 = require("../lib/index/syncer");
 const setup_helpers_1 = require("../lib/setup/setup-helpers");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const exit_1 = require("../lib/utils/exit");
@@ -85,6 +86,7 @@ Examples:
     process.on("SIGINT", onSignal);
     process.on("SIGTERM", onSignal);
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         yield (0, setup_helpers_1.ensureSetup)();
         const indexRoot = options.path
             ? path.resolve(options.path)

package/dist/commands/remove.js

@@ -46,6 +46,7 @@ exports.remove = void 0;
 const path = __importStar(require("node:path"));
 const readline = __importStar(require("node:readline"));
 const commander_1 = require("commander");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const meta_cache_1 = require("../lib/store/meta-cache");
 const vector_db_1 = require("../lib/store/vector-db");
 const exit_1 = require("../lib/utils/exit");
@@ -82,6 +83,7 @@ Examples:
     let vectorDb = null;
     let metaCache = null;
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         // Resolve name → registered root when arg has no path separator and
         // isn't a dir. Avoids the footgun where a typo'd name silently removed
         // the cwd project.

package/dist/commands/repair.js

@@ -13,6 +13,7 @@ exports.repair = void 0;
 const commander_1 = require("commander");
 const config_1 = require("../config");
 const index_config_1 = require("../lib/index/index-config");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const daemon_client_1 = require("../lib/utils/daemon-client");
@@ -38,6 +39,7 @@ Examples:
     var _a, _b, _c;
     try {
         if (opts.rebuild) {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
             const running = yield (0, daemon_client_1.ensureDaemonRunning)();
             if (!running) {
                 const undo = (0, autostart_1.autostartDisabledUndo)();

package/dist/commands/watch.js

@@ -76,6 +76,12 @@ exports.watch = new commander_1.Command("watch")
     .option("--no-idle-timeout", "Disable the 30-minute idle shutdown")
     .action((options) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
+    const safetyDenied = (0, autostart_1.daemonStartDeniedReason)();
+    if (safetyDenied !== null) {
+        console.error(`gmax: ${safetyDenied}; preserving containment`);
+        process.exitCode = 2;
+        return;
+    }
     // A secondary store (src/bin.ts) never runs a daemon or a watcher: one
     // would hold the external drive open, and its startup sweep of stale
     // daemons judges liveness by its own home's lock and socket, so it takes
@@ -440,6 +446,12 @@ exports.watch
             error,
         });
     };
+    const deniedStartup = (0, autostart_1.daemonStartDeniedReason)();
+    if (deniedStartup !== null) {
+        refuse(`${deniedStartup}; preserving containment`);
+        yield (0, exit_1.gracefulExit)(2);
+        return;
+    }
     // Refused before anything is stopped: a daemon that cannot be started
     // again from here must not be taken down.
     if (process.env.GMAX_SECONDARY_STORE === "1") {

package/dist/lib/daemon/daemon.js

@@ -60,6 +60,7 @@ const server_1 = require("../llm/server");
 const meta_cache_1 = require("../store/meta-cache");
 const store_lease_1 = require("../store/store-lease");
 const vector_db_1 = require("../store/vector-db");
+const autostart_1 = require("../utils/autostart");
 const blocked_roots_1 = require("../utils/blocked-roots");
 const daemon_client_1 = require("../utils/daemon-client");
 const daemon_launcher_1 = require("../utils/daemon-launcher");
@@ -73,6 +74,7 @@ const process_footprint_1 = require("../utils/process-footprint");
 const project_registry_1 = require("../utils/project-registry");
 const resource_snapshot_1 = require("../utils/resource-snapshot");
 const root_availability_1 = require("../utils/root-availability");
+const safety_latch_1 = require("../utils/safety-latch");
 const watcher_store_1 = require("../utils/watcher-store");
 const pool_1 = require("../workers/pool");
 const ipc_handler_1 = require("./ipc-handler");
@@ -148,8 +150,6 @@ class Daemon {
         this.heartbeatInterval = null;
         this.idleInterval = null;
         this.heartbeatTick = 0;
-        /** Rate-limits the kernel-zone warn log — see checkKernelZonePressure. */
-        this.lastZoneWarnMs = 0;
         this.shuttingDown = false;
         this.recycling = false;
         this.recycleDueSinceMs = null;
@@ -238,6 +238,19 @@ class Daemon {
     start() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
+            const denied = (0, autostart_1.daemonStartDeniedReason)();
+            if (denied !== null)
+                throw new Error(`gmax: ${denied}; preserving containment`);
+            // Check before stale-process cleanup, store opening, workers or model setup.
+            if (process.platform === "darwin") {
+                const usage = (0, kernel_zone_1.readKernelZoneUsage)();
+                if (!usage)
+                    throw new Error("gmax: kernel pressure unavailable; startup refused");
+                if (usage.pressure !== "ok") {
+                    (0, safety_latch_1.latchSafetyStop)((0, kernel_zone_1.formatZoneUsage)(usage));
+                    throw new Error(`gmax: ${(0, kernel_zone_1.formatZoneUsage)(usage)}; startup safety stop`);
+                }
+            }
             process.title = "gmax-daemon";
             // Read verbs register here rather than at read-verbs.ts module scope: the
             // registry is asserted on exactly in tests/ipc-read-verbs.test.ts, and a
@@ -457,13 +470,10 @@ class Daemon {
                 // after a frozen MLX process kept the port bound (v0.17.0 bug #1).
                 this.heartbeatTick++;
                 if (this.heartbeatTick % 5 === 0) {
-                    void this.mlxServerManager.checkMlxHealth();
-                    this.processManager.sweepOrphanWorkers();
-                    this.maybeRecycle();
-                    this.checkKernelZonePressure();
+                    this.runHeartbeatMaintenance(true);
                 }
                 else if (this.recycleDueSinceMs !== null) {
-                    this.maybeRecycle(false);
+                    this.runHeartbeatMaintenance(false);
                 }
             }, HEARTBEAT_INTERVAL_MS);
             // 10. Idle timeout (skip when disabled via env)
@@ -606,7 +616,22 @@ class Daemon {
         }
     }
     runSharedOperation(name, signal, fn) {
-        return this.operations.runShared(name, signal, fn);
+        const readOnly = (0, read_verbs_1.getReadVerb)(name) !== undefined ||
+            ["search", "project-stats", "unwatch", "llm-stop"].includes(name);
+        return this.operations.runShared(name, signal, (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+            if (!readOnly)
+                this.assertHeavyOperationAdmission(name);
+            return fn(operationSignal);
+        }));
+    }
+    assertHeavyOperationAdmission(name) {
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null)
+            throw new Error(`${name} refused: ${denied}`);
+        // Probe at operation admission, before setup/cache/worker/model side effects.
+        if (!this.checkKernelZonePressure()) {
+            throw new Error(`${name} refused: host pressure is unsafe or unknown`);
+        }
     }
     /**
      * Compact + prune on behalf of a CLI caller.
@@ -1298,6 +1323,18 @@ class Daemon {
                 (0, ipc_handler_1.writeDone)(conn, { ok: false, error: "daemon resources not ready" });
                 return;
             }
+            try {
+                this.assertHeavyOperationAdmission("repair");
+            }
+            catch (error) {
+                (0, ipc_handler_1.writeDone)(conn, {
+                    ok: false,
+                    error: error instanceof Error
+                        ? error.message
+                        : "repair safety admission failed",
+                });
+                return;
+            }
             const targetConfig = (0, index_config_1.readGlobalConfig)();
             const targetGeneration = (0, embedding_generation_1.resolveEmbeddingGeneration)(targetConfig);
             const clientAbort = new AbortController();
@@ -1338,8 +1375,10 @@ class Daemon {
             };
             try {
                 const result = yield this.operations.runExclusive("repair", () => __awaiter(this, void 0, void 0, function* () {
+                    this.assertHeavyOperationAdmission("repair");
                     desiredWatchRoots = yield this.watcherManager.quiesceAll();
                 }), (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+                    this.assertHeavyOperationAdmission("repair");
                     throwIfPreDropCancelled(operationSignal);
                     oldResources.vectorDb.pauseMaintenanceLoop();
                     this.searchers.clear();
@@ -1843,6 +1882,16 @@ class Daemon {
     resourceSnapshot() {
         return this.lastResourceSnapshot;
     }
+    runHeartbeatMaintenance(sampleFootprint) {
+        // Both ordinary probes and deferred-recycle ticks check safety first.
+        if (!this.checkKernelZonePressure())
+            return;
+        this.maybeRecycle(sampleFootprint);
+        if (this.shuttingDown || this.recycling || !sampleFootprint)
+            return;
+        void this.mlxServerManager.checkMlxHealth();
+        this.processManager.sweepOrphanWorkers();
+    }
     logResourceSnapshot(reason, footprintMb) {
         var _a, _b;
         var _c, _d;
@@ -1941,38 +1990,45 @@ class Daemon {
      * This host lost three sessions that way before the compactor was identified as
      * the largest write source on it.
      *
-     * So the daemon watches the zone it is pressurizing. A warn-level reading is
-     * logged and left alone; a critical reading exits without relaunch, because
-     * relaunching would resume the writes that caused it. Nothing here can reclaim
-     * the leaked memory — only a reboot does that — so the only useful move is to
-     * stop adding to it while the user still has a working machine.
+     * Warning, critical or unknown macOS readings stop mutation before another
+     * heavy operation can begin. Persist the reason before shutdown, so hooks and
+     * memory guards cannot revive the writer. Nothing here reclaims kernel memory.
      *
-     * Deliberately does nothing when the sample is unavailable or unparseable
-     * (non-macOS, no `zprint`, changed output format): an unknown reading must never
-     * shut the daemon down.
+     * Non-macOS hosts have no such probe. On macOS an unavailable sample is
+     * explicitly unknown and cannot authorize further mutation.
      */
     checkKernelZonePressure() {
         if (this.shuttingDown || this.recycling)
-            return;
+            return false;
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null) {
+            // The existing quarantine is already durable; preserve its ownership and
+            // do not replace it with a new marker that an operator must also clear.
+            this.stopForSafety(denied, false);
+            return false;
+        }
+        if (process.platform !== "darwin")
+            return true;
         const usage = (0, kernel_zone_1.readKernelZoneUsage)();
-        if (!usage || usage.pressure === "ok")
-            return;
-        if (usage.pressure === "warn") {
-            // Rate-limited to once an hour: at the 5-minute heartbeat this would
-            // otherwise print 12 identical lines an hour for as long as the condition
-            // holds, which on a leaking host is until reboot.
-            const now = Date.now();
-            if (now - this.lastZoneWarnMs < 60 * 60 * 1000)
-                return;
-            this.lastZoneWarnMs = now;
-            console.log(`[daemon] WARNING: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — macOS kernel zone is leaking ` +
-                `under write pressure. The daemon will stop itself at ` +
-                `${(kernel_zone_1.ZONE_THRESHOLDS.criticalBytes / Math.pow(1024, 3)).toFixed(0)}GiB. ` +
-                `Only a reboot reclaims this memory.`);
-            return;
+        if ((usage === null || usage === void 0 ? void 0 : usage.pressure) === "ok")
+            return true;
+        const reason = usage
+            ? `${usage.pressure} kernel pressure: ${(0, kernel_zone_1.formatZoneUsage)(usage)}`
+            : "kernel pressure unavailable; heavy work cannot be admitted";
+        this.stopForSafety(reason);
+        return false;
+    }
+    stopForSafety(reason, persist = true) {
+        // Warning already pauses mutation: a stale index costs less than another
+        // host crash. Unknown readings are visible stops, never healthy samples.
+        try {
+            if (persist)
+                (0, safety_latch_1.latchSafetyStop)(reason);
+        }
+        catch (error) {
+            console.error("[daemon] Failed to persist safety stop; stopping anyway:", error);
         }
-        console.log(`[daemon] CRITICAL: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — stopping to avoid a kernel panic. ` +
-            `Reboot to reclaim the zone; the index will catch up on next start.`);
+        console.log(`[daemon] SAFETY STOP: ${reason}. Containment stays in place across restart; review host health before resuming.`);
         this.recycling = true;
         void this.shutdown().finally(() => process.exit(0));
     }

package/dist/lib/store/maintenance-policy.js

@@ -0,0 +1,172 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DiskPressureError = exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON = void 0;
+exports.fullTableMaintenanceDisabled = fullTableMaintenanceDisabled;
+exports.availableStoreDiskBytes = availableStoreDiskBytes;
+exports.assertFreshDiskMutationAllowed = assertFreshDiskMutationAllowed;
+exports.storeMutationDeniedReason = storeMutationDeniedReason;
+exports.assertStoreMutationAllowed = assertStoreMutationAllowed;
+exports.maintenancePolicyPath = maintenancePolicyPath;
+exports.recordMaintenanceContainment = recordMaintenanceContainment;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const config_1 = require("../../config");
+const autostart_1 = require("../utils/autostart");
+const safety_latch_1 = require("../utils/safety-latch");
+exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON = "full-table maintenance disabled by host-safety containment; disk recovery is pending";
+/** This release has no production override: force, configuration and persisted
+ * state cannot enable rewriting. Tests may mock this module to cover the old
+ * native algorithm without turning it into a supported production entry point. */
+function fullTableMaintenanceDisabled() {
+    return true;
+}
+class DiskPressureError extends Error {
+    constructor(message = "Disk critically low or unknown — writes suspended") {
+        super(message);
+        this.name = "DiskPressureError";
+    }
+}
+exports.DiskPressureError = DiskPressureError;
+/** Fresh, bounded filesystem sample. ENOENT alone permits trying an ancestor;
+ * permission errors, invalid values and all other uncertainty refuse writes. */
+function availableStoreDiskBytes(storeDir) {
+    let existing = path.resolve(storeDir);
+    for (;;) {
+        try {
+            const stats = fs.statfsSync(existing);
+            const available = stats.bavail * stats.bsize;
+            return Number.isFinite(available) && available >= 0
+                ? available
+                : Number.NaN;
+        }
+        catch (error) {
+            const parent = path.dirname(existing);
+            if (error.code !== "ENOENT" ||
+                parent === existing)
+                return Number.NaN;
+            existing = parent;
+        }
+    }
+}
+/** Reusable admission for LMDB and other store mutations. Never cached. */
+function assertFreshDiskMutationAllowed(storeDir) {
+    const available = availableStoreDiskBytes(storeDir);
+    if (!Number.isFinite(available) || available < config_1.DISK_CRITICAL_BYTES)
+        throw new DiskPressureError();
+    return available;
+}
+function storeMutationDeniedReason() {
+    const safety = (0, safety_latch_1.safetyStopReason)();
+    if (safety !== null)
+        return `host safety stop: ${safety}`;
+    return (0, autostart_1.autostartDisabledReason)() !== null
+        ? "store mutations are quarantined while daemon autostart is disabled"
+        : null;
+}
+function assertStoreMutationAllowed() {
+    const reason = storeMutationDeniedReason();
+    if (reason !== null)
+        throw new Error(`gmax store mutation blocked: ${reason}`);
+}
+function maintenancePolicyPath(storeDir) {
+    return path.join(storeDir, ".gmax-maintenance-policy.json");
+}
+/** Persist a zero-rewrite receipt once. Unknown/corrupt/unwritable state never
+ * weakens the immutable default. No timestamps or budgets authorize native work. */
+function recordMaintenanceContainment(storeDir) {
+    let temporary;
+    try {
+        fs.mkdirSync(storeDir, { recursive: true, mode: 0o700 });
+        const storeIdentity = fs.realpathSync(storeDir);
+        const target = maintenancePolicyPath(storeIdentity);
+        if (fs.existsSync(target)) {
+            const stat = fs.lstatSync(target);
+            if (!stat.isFile() || stat.size > 16 * 1024)
+                throw new Error("unsafe maintenance policy file");
+            const previous = JSON.parse(fs.readFileSync(target, "utf8"));
+            if (previous.schemaVersion === 1 &&
+                previous.storeIdentity === storeIdentity &&
+                previous.mode === "disabled" &&
+                previous.rewriteBudgetBytes === 0 &&
+                previous.cleanupPending === true) {
+                fs.chmodSync(target, 0o600);
+                return exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON;
+            }
+        }
+        const policy = {
+            schemaVersion: 1,
+            storeIdentity,
+            mode: "disabled",
+            reason: exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON,
+            recordedAt: Date.now(),
+            rewriteBudgetBytes: 0,
+            cleanupPending: true,
+        };
+        temporary = path.join(storeIdentity, `.gmax-maintenance-${(0, node_crypto_1.randomUUID)()}.tmp`);
+        const descriptor = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(descriptor, `${JSON.stringify(policy)}\n`);
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        fs.renameSync(temporary, target);
+        temporary = undefined;
+        const directory = fs.openSync(storeIdentity, "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+        return exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON;
+    }
+    catch (_a) {
+        return `${exports.FULL_TABLE_MAINTENANCE_DISABLED_REASON}; persistent policy unavailable or invalid (still disabled)`;
+    }
+    finally {
+        if (temporary) {
+            try {
+                fs.unlinkSync(temporary);
+            }
+            catch (_b) {
+                // Failed receipt cleanup cannot authorize maintenance.
+            }
+        }
+    }
+}

package/dist/lib/store/meta-cache.js

@@ -67,14 +67,39 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const lmdb_1 = require("lmdb");
 const cleanup_1 = require("../utils/cleanup");
+const maintenance_policy_1 = require("./maintenance-policy");
 class MetaCache {
     constructor(lmdbPath) {
+        this.lmdbPath = lmdbPath;
         this.closed = false;
-        fs.mkdirSync(path.dirname(lmdbPath), { recursive: true });
+        let diskAllowsWrites = false;
+        try {
+            (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(lmdbPath);
+            diskAllowsWrites = true;
+        }
+        catch (_a) {
+            /* Unknown/critical disk allows existing-cache reads only. */
+        }
+        this.readOnly = (0, maintenance_policy_1.storeMutationDeniedReason)() !== null || !diskAllowsWrites;
+        if (this.readOnly) {
+            // Quarantine permits reads of an existing cache, never creating one.
+            try {
+                fs.lstatSync(lmdbPath);
+            }
+            catch (_b) {
+                throw new Error("gmax metadata cache is quarantined or disk-constrained and unavailable");
+            }
+        }
+        else {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(lmdbPath);
+            fs.mkdirSync(path.dirname(lmdbPath), { recursive: true });
+        }
         this.db = (0, lmdb_1.open)({
             path: lmdbPath,
             compression: true,
             cache: true,
+            readOnly: this.readOnly,
         });
         this.unregisterCleanup = (0, cleanup_1.registerCleanup)(() => this.close());
     }
@@ -129,11 +154,19 @@ class MetaCache {
         });
     }
     put(filePath, entry) {
+        this.assertWritable();
         this.db.put(filePath, entry);
     }
     delete(filePath) {
+        this.assertWritable();
         this.db.remove(filePath);
     }
+    assertWritable() {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
+        (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(this.lmdbPath);
+        if (this.readOnly)
+            throw new Error("gmax metadata cache was opened read-only; reopen after reviewing containment");
+    }
     entries() {
         return __asyncGenerator(this, arguments, function* entries_1() {
             var _a, e_3, _b, _c;

package/dist/lib/store/vector-db.js

@@ -66,6 +66,7 @@ const query_timeout_1 = require("../utils/query-timeout");
 const ann_config_1 = require("./ann-config");
 const compaction_result_1 = require("./compaction-result");
 const lancedb = __importStar(require("./lance-sdk"));
+const maintenance_policy_1 = require("./maintenance-policy");
 const store_lease_1 = require("./store-lease");
 /**
  * Find abandoned Lance scratch files under `<lancedbDir>/ *.lance/data`.
@@ -134,13 +135,8 @@ function sweepStaleLanceTempFiles(lancedbDir, minAgeMs = config_1.STALE_TEMP_FIL
     }
     return { filesRemoved, bytesFreed };
 }
-class DiskPressureError extends Error {
-    constructor(message = "Disk critically low — writes suspended") {
-        super(message);
-        this.name = "DiskPressureError";
-    }
-}
-exports.DiskPressureError = DiskPressureError;
+var maintenance_policy_2 = require("./maintenance-policy");
+Object.defineProperty(exports, "DiskPressureError", { enumerable: true, get: function () { return maintenance_policy_2.DiskPressureError; } });
 /**
  * Detects "Not found: <hash>.lance" errors from LanceDB — these indicate the
  * manifest references a fragment file that doesn't exist on disk, typically
@@ -370,11 +366,20 @@ class VectorDB {
             if (this.closed) {
                 throw new Error("VectorDB connection is closed");
             }
+            const creatingStore = !fs.existsSync(this.lancedbDir);
+            if (creatingStore) {
+                (0, maintenance_policy_1.assertStoreMutationAllowed)();
+                (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(this.lancedbDir);
+            }
             yield this.getLease();
             if (this.closed) {
                 throw new Error("VectorDB connection is closed");
             }
             if (!this.db) {
+                if (creatingStore || !fs.existsSync(this.lancedbDir)) {
+                    (0, maintenance_policy_1.assertStoreMutationAllowed)();
+                    (0, maintenance_policy_1.assertFreshDiskMutationAllowed)(this.lancedbDir);
+                }
                 fs.mkdirSync(this.lancedbDir, { recursive: true });
                 this.session = createLanceSession();
                 // 0.38 accepts the legacy third argument in its types but drops it in
@@ -469,23 +474,18 @@ class VectorDB {
         });
     }
     getAvailableBytes() {
-        try {
-            const stats = fs.statfsSync(this.lancedbDir);
-            return stats.bavail * stats.bsize;
-        }
-        catch (_a) {
-            return Number.MAX_SAFE_INTEGER; // fail-open
-        }
+        return (0, maintenance_policy_1.availableStoreDiskBytes)(this.lancedbDir);
     }
-    checkDiskPressure() {
+    checkDiskPressure(fresh = false) {
         const now = Date.now();
-        if (now - this.lastDiskCheckMs < VectorDB.DISK_CHECK_INTERVAL_MS) {
+        if (!fresh &&
+            now - this.lastDiskCheckMs < VectorDB.DISK_CHECK_INTERVAL_MS) {
             return this.diskPressure;
         }
         this.lastDiskCheckMs = now;
         const avail = this.getAvailableBytes();
         let level;
-        if (avail < config_1.DISK_CRITICAL_BYTES) {
+        if (!Number.isFinite(avail) || avail < 0 || avail < config_1.DISK_CRITICAL_BYTES) {
             level = "critical";
         }
         else if (avail < config_1.DISK_LOW_BYTES) {
@@ -497,7 +497,7 @@ class VectorDB {
         if (level !== this.lastLoggedPressure) {
             const freeStr = `${(avail / 1024 / 1024 / 1024).toFixed(1)}GB`;
             if (level === "critical") {
-                (0, logger_1.log)("vectordb", `CRITICAL: disk space critically low (${freeStr} free) — writes suspended`);
+                (0, logger_1.log)("vectordb", `CRITICAL: ${Number.isFinite(avail) ? `disk space critically low (${freeStr} free)` : "disk space unknown"} — writes suspended`);
             }
             else if (level === "low") {
                 (0, logger_1.log)("vectordb", `WARNING: disk space low (${freeStr} free) — compaction limited`);
@@ -511,8 +511,8 @@ class VectorDB {
         return level;
     }
     ensureDiskOk() {
-        if (this.checkDiskPressure() === "critical") {
-            throw new DiskPressureError();
+        if (this.checkDiskPressure(true) === "critical") {
+            throw new maintenance_policy_1.DiskPressureError();
         }
     }
     /**
@@ -522,6 +522,8 @@ class VectorDB {
      */
     withWriteGate(fn) {
         return __awaiter(this, void 0, void 0, function* () {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            this.ensureDiskOk();
             while (this.exclusiveMutationPromise || this.compactingPromise) {
                 if (this.closed)
                     throw new Error("VectorDB connection is closed");
@@ -529,6 +531,8 @@ class VectorDB {
             }
             if (this.closed)
                 throw new Error("VectorDB connection is closed");
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            this.ensureDiskOk();
             this.activeWrites++;
             try {
                 return yield fn();
@@ -567,6 +571,8 @@ class VectorDB {
     }
     withExclusiveTableMutation(mutation) {
         return __awaiter(this, void 0, void 0, function* () {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
+            this.ensureDiskOk();
             if (this.closed)
                 throw new Error("VectorDB connection is closed");
             if (this.exclusiveMutationPromise) {
@@ -592,6 +598,8 @@ class VectorDB {
                             });
                         }
                         yield Promise.all([this.drainWrites(), this.drainCompactions()]);
+                        (0, maintenance_policy_1.assertStoreMutationAllowed)();
+                        this.ensureDiskOk();
                         const db = yield this.getDb();
                         const result = yield mutation(db);
                         this.markWriteCommitted();
@@ -761,6 +769,14 @@ class VectorDB {
     }
     ensureTable() {
         return __awaiter(this, void 0, void 0, function* () {
+            if ((0, maintenance_policy_1.storeMutationDeniedReason)() !== null ||
+                this.checkDiskPressure(true) === "critical") {
+                const existing = yield this.openExistingTableUnsafe();
+                if (!existing)
+                    throw new Error("gmax store is quarantined and has no existing table");
+                yield this.validateSchema(existing);
+                return existing;
+            }
             return this.withWriteGate(() => this.ensureTableUnsafe());
         });
     }
@@ -774,6 +790,7 @@ class VectorDB {
             catch (err) {
                 if (!isMissingTableError(err))
                     throw err;
+                (0, maintenance_policy_1.assertStoreMutationAllowed)();
                 (0, logger_1.log)("db", `Creating table (${this.vectorDim}d)`);
                 const schema = this.buildSchema();
                 table = yield db.createTable(TABLE_NAME, [this.seedRow()], {
@@ -784,6 +801,7 @@ class VectorDB {
                 return table;
             }
             yield this.validateSchema(table);
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
             yield this.evolveSchema(table);
             return table;
         });
@@ -903,6 +921,12 @@ class VectorDB {
     }
     createFTSIndex() {
         return __awaiter(this, arguments, void 0, function* (rebuild = false, retries = 5) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                if (rebuild)
+                    throw new Error(maintenance_policy_1.FULL_TABLE_MAINTENANCE_DISABLED_REASON);
+                // Existing indexes remain searchable; absence does not authorize a build.
+                return this.adoptFTSIndex();
+            }
             return this.withWriteGate(() => this.createFTSIndexUnsafe(rebuild, retries));
         });
     }
@@ -939,7 +963,9 @@ class VectorDB {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.ftsIndexEnsured)
                 return;
-            const table = yield this.ensureTable();
+            const table = yield this.openExistingTableUnsafe();
+            if (!table)
+                throw new Error("[vector-db] No existing table or FTS index; index maintenance is disabled");
             const indices = yield table.listIndices();
             const existing = indices.find((index) => index.name === "content_idx" || index.columns.includes("content"));
             if (!existing) {
@@ -950,6 +976,10 @@ class VectorDB {
     }
     createVectorIndex() {
         return __awaiter(this, arguments, void 0, function* (rebuild = false, retries = 5, checkOnly = false) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                (0, logger_1.debug)("vectordb", "ANN/index maintenance disabled by host-safety containment");
+                return false;
+            }
             if (this.checkDiskPressure() !== "ok") {
                 (0, logger_1.debug)("vectordb", "ANN index skipped under disk pressure");
                 return false;
@@ -1182,6 +1212,10 @@ class VectorDB {
         return __awaiter(this, arguments, void 0, function* (retries = COMPACTION_MAX_ATTEMPTS, retentionMs = 0, bypassExclusiveMutation = false) {
             var _a;
             var _b;
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                this.lastOptimizeDidWork = false;
+                return this.recordSkippedCompaction((0, maintenance_policy_1.recordMaintenanceContainment)(this.lancedbDir));
+            }
             if (!bypassExclusiveMutation) {
                 while (this.exclusiveMutationPromise)
                     yield this.exclusiveMutationPromise;
@@ -1372,10 +1406,14 @@ class VectorDB {
     /**
      * Run FTS rebuild + optimize as a single serialized operation.
      * Safe to call from multiple project processors — only one runs at a time.
-     * Checks disk bloat ratio and retries optimize when bloat persists.
+     * Reports bloat without another whole-table rewrite.
      */
     runMaintenance() {
         return __awaiter(this, arguments, void 0, function* (options = {}) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                this.lastOptimizeDidWork = false;
+                return this.recordSkippedCompaction((0, maintenance_policy_1.recordMaintenanceContainment)(this.lancedbDir));
+            }
             if (this.maintenanceRunning) {
                 (0, logger_1.debug)("vectordb", "Maintenance already running, skipping");
                 return (0, compaction_result_1.skippedCompaction)("maintenance already running");
@@ -1426,7 +1464,7 @@ class VectorDB {
                     // Track across both passes: `lastOptimizeDidWork` is reset per optimize()
                     // call, so a productive first pass followed by a barren bloat retry would
                     // otherwise read as unproductive and trigger a spurious backoff.
-                    let didWork = this.lastOptimizeDidWork;
+                    const didWork = this.lastOptimizeDidWork;
                     if (result.status === "completed" && this.lastOptimizeDidWork) {
                         const table = yield this.openExistingTableUnsafe();
                         if (table) {
@@ -1443,17 +1481,17 @@ class VectorDB {
                             const diskSize = this.getDirectorySize(this.lancedbDir);
                             const logicalSize = stats.totalBytes;
                             const bloatRatio = logicalSize > 0 ? diskSize / logicalSize : 0;
-                            // Only retry if disk is still ok after optimize (don't spiral)
-                            if (bloatRatio > 2.0 && this.checkDiskPressure() === "ok") {
-                                (0, logger_1.log)("vectordb", `Bloat detected after optimize: ${(diskSize / 1024 / 1024).toFixed(0)}MB disk vs ${(logicalSize / 1024 / 1024).toFixed(0)}MB logical (${bloatRatio.toFixed(1)}x) — retrying`);
-                                yield new Promise((r) => setTimeout(r, 2000));
-                                result = yield this.optimize(5, 0, true);
-                                didWork = didWork || this.lastOptimizeDidWork;
+                            if (bloatRatio > 2.0) {
+                                (0, logger_1.log)("vectordb", `Bloat remains after optimize: ${bloatRatio.toFixed(1)}x; additional rewrite disabled`);
                             }
                         }
                     }
                     this.noteCompaction(didWork);
                 }
+                if (result && result.status !== "completed")
+                    return result;
+                if (result === null || result === void 0 ? void 0 : result.cleanupReason)
+                    return result;
                 const maintainedTable = yield this.openExistingTableUnsafe();
                 this.maintainedTableVersion =
                     yield this.readTableVersion(maintainedTable);
@@ -1509,6 +1547,11 @@ class VectorDB {
     }
     compactIfNeeded() {
         return __awaiter(this, arguments, void 0, function* (threshold = config_1.FRAGMENT_COMPACT_THRESHOLD) {
+            if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                this.lastOptimizeDidWork = false;
+                this.recordSkippedCompaction((0, maintenance_policy_1.recordMaintenanceContainment)(this.lancedbDir));
+                return false;
+            }
             if (this.maintenanceRunning)
                 return false;
             this.maintenanceRunning = true;

package/dist/lib/utils/autostart.js

@@ -35,10 +35,13 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.autostartDisabledReason = autostartDisabledReason;
 exports.isAutostartDisabled = isAutostartDisabled;
+exports.daemonStartDeniedReason = daemonStartDeniedReason;
 exports.autostartDisabledUndo = autostartDisabledUndo;
 exports.autostartDisabledNotice = autostartDisabledNotice;
 const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
+const safety_latch_1 = require("./safety-latch");
 /**
  * Kill switch for *implicit* daemon auto-start. Create
  * ~/.gmax/autostart-disabled (or export GMAX_NO_AUTOSTART=1) to keep session
@@ -46,8 +49,8 @@ const config_1 = require("../../config");
  * reviving the daemon — needed when the host is quarantined and the daemon's
  * write volume is the thing under investigation.
  *
- * Explicit `gmax watch --daemon` is never gated: typing it is the user asking
- * for a daemon in that moment.
+ * Safety containment also gates explicit daemon launches. A launch is not
+ * authorization to remove an existing host quarantine.
  *
  * plugins/grepmax/hooks/watch-lease.js carries a plain-JS copy of these semantics
  * (env var checked first, then the file) because a SessionStart hook cannot
@@ -56,16 +59,35 @@ const config_1 = require("../../config");
 function autostartDisabledReason() {
     if (process.env.GMAX_NO_AUTOSTART === "1")
         return "env";
-    try {
-        return fs.existsSync(config_1.PATHS.autostartDisabledFile) ? "file" : null;
-    }
-    catch (_a) {
-        return null;
+    if ((0, safety_latch_1.safetyStopReason)() !== null)
+        return "safety";
+    const markers = new Set([
+        config_1.PATHS.autostartDisabledFile,
+        ...(config_1.PATHS.sharedRoot
+            ? [path.join(config_1.PATHS.sharedRoot, "autostart-disabled")]
+            : []),
+    ]);
+    for (const marker of markers) {
+        try {
+            fs.lstatSync(marker);
+            return "file";
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return "file";
+        }
     }
+    return null;
 }
 function isAutostartDisabled() {
     return autostartDisabledReason() !== null;
 }
+function daemonStartDeniedReason() {
+    const safety = (0, safety_latch_1.safetyStopReason)();
+    if (safety !== null)
+        return `host safety stop: ${safety}`;
+    return isAutostartDisabled() ? "daemon startup is quarantined" : null;
+}
 /**
  * One-line notice for commands that fell back to in-process work because the
  * kill switch is on, or null when it isn't. Names the specific undo step so
@@ -76,11 +98,16 @@ function autostartDisabledUndo() {
     const reason = autostartDisabledReason();
     if (!reason)
         return null;
+    if (reason === "safety")
+        return "review the persistent host safety stop before resuming";
     return reason === "env"
         ? "unset GMAX_NO_AUTOSTART"
         : `rm ${config_1.PATHS.autostartDisabledFile}`;
 }
 function autostartDisabledNotice() {
+    const safety = (0, safety_latch_1.safetyStopReason)();
+    if (safety !== null)
+        return `Gmax is paused by a persistent host safety stop: ${safety}. Mutations remain blocked until containment is reviewed.`;
     // A secondary store (src/bin.ts) runs in-process by design, not because the
     // kill switch is on, so say that instead of naming an undo step. Callers use
     // a non-null notice as the gate, so this must stay non-null.

package/dist/lib/utils/daemon-launcher.js

@@ -48,6 +48,7 @@ const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
+const autostart_1 = require("./autostart");
 const log_rotate_1 = require("./log-rotate");
 /**
  * Spawn the daemon in background mode.
@@ -56,6 +57,8 @@ const log_rotate_1 = require("./log-rotate");
 function spawnDaemon() {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
+        if ((0, autostart_1.daemonStartDeniedReason)() !== null)
+            return null;
         let out = null;
         try {
             const logFile = path.join(config_1.PATHS.logsDir, "daemon.log");
@@ -90,6 +93,9 @@ function spawnDaemon() {
  */
 function spawnDaemonProcess() {
     return __awaiter(this, void 0, void 0, function* () {
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null)
+            throw new Error(`gmax: ${denied}`);
         const logFile = path.join(config_1.PATHS.logsDir, "daemon.log");
         const out = (0, log_rotate_1.openRotatedLog)(logFile);
         try {

package/dist/lib/utils/kernel-zone.js

@@ -21,11 +21,15 @@ const node_child_process_1 = require("node:child_process");
  * docs/2026-08-04-macos-kernel-zone-panic-incident.md.
  *
  * gmax cannot fix the kernel defect, but it can decline to be the thing that
- * detonates it. Sampling the zone is cheap (~0.2 s), so the daemon watches its own
- * blast radius and stands down while there are still hours of headroom.
+ * detonates it. Sampling the zone has taken 1.584 s on the incident host, so the
+ * probe uses a bounded five-second budget. The daemon stands down while there
+ * are still hours of headroom.
  */
 /** The zone that leaks. Named explicitly so `zprint` returns a single line. */
 const ZONE_NAME = "data.kalloc.1024";
+// Two 500 ms probes timed out on the incident host; a subsequent probe completed
+// in 1,584 ms. Keep the previous five-second ceiling to allow scheduling margin.
+const PROBE_TIMEOUT_MS = 5000;
 /**
  * Warn threshold.
  *
@@ -84,8 +88,8 @@ function parseZprintOutput(output, zoneName = ZONE_NAME) {
 }
 /**
  * Sample the zone. Returns null off macOS, or whenever the sample cannot be
- * trusted — an unparseable report must read as "unknown", never as "healthy" and
- * never as a reason to stop working.
+ * trusted. An unparseable or timed-out report reads as "unknown", never as
+ * "healthy". macOS startup and heavy-operation admission refuse unknown samples.
  */
 function readKernelZoneUsage(zoneName = ZONE_NAME) {
     if (process.platform !== "darwin")
@@ -93,7 +97,8 @@ function readKernelZoneUsage(zoneName = ZONE_NAME) {
     try {
         const output = (0, node_child_process_1.execFileSync)("zprint", [zoneName], {
             encoding: "utf-8",
-            timeout: 5000,
+            timeout: PROBE_TIMEOUT_MS,
+            maxBuffer: 64 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
         });
         const parsed = parseZprintOutput(output, zoneName);

package/dist/lib/utils/safety-latch.js

@@ -0,0 +1,121 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SAFETY_LATCH_NAME = void 0;
+exports.safetyStopReason = safetyStopReason;
+exports.latchSafetyStop = latchSafetyStop;
+exports.assertNoSafetyStop = assertNoSafetyStop;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const config_1 = require("../../config");
+/** Machine-wide stop: changing stores or installing a version cannot clear it. */
+exports.SAFETY_LATCH_NAME = "safety-stop.json";
+function safetyRoot() {
+    var _a;
+    return (_a = config_1.PATHS.sharedRoot) !== null && _a !== void 0 ? _a : path.dirname(config_1.PATHS.autostartDisabledFile);
+}
+/** Absence is distinct from an unreadable/corrupt stop, which stays stopped. */
+function safetyStopReason(root = safetyRoot()) {
+    const file = path.join(root, exports.SAFETY_LATCH_NAME);
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.size > 8192)
+            return "unverified safety stop";
+        const value = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (value.schemaVersion !== 1 ||
+            !Number.isFinite(value.at) ||
+            typeof value.reason !== "string" ||
+            !value.reason.trim())
+            return "unverified safety stop";
+        return value.reason.replace(/[\r\n\t]/g, " ").slice(0, 512);
+    }
+    catch (error) {
+        return error.code === "ENOENT"
+            ? null
+            : "unreadable safety stop";
+    }
+}
+/** Atomic durable latch; intentionally no automatic expiry or clear operation. */
+function latchSafetyStop(reason, root = safetyRoot()) {
+    if (safetyStopReason(root) !== null)
+        return;
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.chmodSync(root, 0o700);
+    const file = path.join(root, exports.SAFETY_LATCH_NAME);
+    const temporary = path.join(root, `.safety-stop-${(0, node_crypto_1.randomUUID)()}.tmp`);
+    let fd;
+    try {
+        fd = fs.openSync(temporary, "wx", 0o600);
+        const record = {
+            schemaVersion: 1,
+            at: Date.now(),
+            reason: reason.replace(/[\r\n\t]/g, " ").slice(0, 512) || "host safety stop",
+        };
+        fs.writeFileSync(fd, `${JSON.stringify(record)}\n`);
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        fd = undefined;
+        // Publish without replacing another concurrent stop's original cause.
+        try {
+            fs.linkSync(temporary, file);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        // Persist the directory entry, not only the payload, before stopping.
+        const dir = fs.openSync(root, "r");
+        try {
+            fs.fsyncSync(dir);
+        }
+        finally {
+            fs.closeSync(dir);
+        }
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch (_a) { }
+    }
+}
+function assertNoSafetyStop() {
+    const reason = safetyStopReason();
+    if (reason !== null)
+        throw new Error(`gmax safety stop: ${reason}; containment must be reviewed before resuming`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.54",
+  "version": "0.26.55",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.54",
+  "version": "0.26.55",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",

package/plugins/grepmax/hooks/watch-lease.js

@@ -15,15 +15,23 @@ const SOCKET = path.join(GMAX_DIR, "daemon.sock");
 // Activity refreshes this TTL; idle sessions do not watch forever.
 const SESSION_LEASE_TTL_MS = 4 * 60 * 60 * 1000;
 
-function isAutostartDisabled() {
-  if (process.env.GMAX_NO_AUTOSTART === "1") return true;
+function markerPresentOrUnknown(file) {
   try {
-    return fs.existsSync(path.join(GMAX_DIR, "autostart-disabled"));
-  } catch {
-    return false;
+    fs.lstatSync(file);
+    return true;
+  } catch (error) {
+    return error.code !== "ENOENT";
   }
 }
 
+function isAutostartDisabled() {
+  if (process.env.GMAX_NO_AUTOSTART === "1") return true;
+  return (
+    markerPresentOrUnknown(path.join(GMAX_DIR, "autostart-disabled")) ||
+    markerPresentOrUnknown(path.join(GMAX_DIR, "safety-stop.json"))
+  );
+}
+
 function readHookInput(timeoutMs = 1000) {
   return new Promise((resolve) => {
     let data = "";