grepmax 0.26.54 → 0.26.56

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.54",
+      "version": "0.26.56",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -54,9 +54,11 @@ gmax config                   # View current settings
 gmax config --embed-mode gpu  # Switch to GPU (Apple Silicon)
 gmax config --worker-threads 2  # Cap worker processes (auto = default); applies on daemon restart
 gmax doctor                   # Health check
-gmax doctor --fix             # Auto-repair (compact, prune, remove stale locks)
+gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 ```
 
+**Storage containment:** full-table compaction is disabled, including forced maintenance and doctor repair. Existing retained index copies are not reclaimed by this release. The verified prune-only recovery path is separate work; normal incremental indexing remains available when the host is healthy and not quarantined. A persistent host safety stop blocks mutation and daemon restart. Installing an update preserves existing quarantine. Speculative embedding warmup and maintenance timers are disabled. On macOS, startup, heavy queries, worker forks and MLX launches require known normal OS memory pressure and a healthy kernel-zone sample; unavailable probes report bounded diagnostic details and refuse work.
+
 ### Core Commands
 
 ```bash
@@ -234,7 +236,7 @@ gmax watch restart            # Stop it, wait for it to exit, start a fresh one
 gmax status                   # See all projects + watcher status
 ```
 
-Adding or indexing a project can start the daemon automatically. MCP acquires primary-project watch leases lazily when an index-reading tool is used; discovery and catalog listing start no background work. It shuts down after 4 hours of inactivity, and hands off to a fresh daemon after 24 hours or once its memory footprint passes 2.5 GB. File-change batches are processed on up to four worker processes by default, added only when work backs up, with one kept free for searches; LanceDB compaction runs after writes rather than on every maintenance tick.
+Adding or indexing a project can start the daemon automatically. MCP acquires primary-project watch leases lazily when an index-reading tool is used; discovery and catalog listing start no background work. It shuts down after 4 hours of inactivity, and hands off to a fresh daemon after 24 hours or once its memory footprint passes 2.5 GB. File-change batches are processed on up to four worker processes by default, added only when work backs up, with one kept free for searches; full-table compaction and new FTS/ANN index builds are disabled by containment. Existing indexes remain readable. Host safety stops persist across restart and block heavy operations.
 
 `gmax watch status` reports failed files, native watcher recovery or polling, dropped-event counts, and the last complete filesystem reconciliation. Polling scans run every five minutes, so recent edits can lag. Search and MCP responses retain health warnings even after the file queue drains. A complete reconciliation means the filesystem scan completed; queued embedding work can still be pending.
 
@@ -461,7 +463,7 @@ fixtures/
 
 ```bash
 gmax doctor                   # Check health
-gmax doctor --fix             # Auto-repair (compact, prune, fix locks)
+gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 gmax doctor --agent           # Machine-readable health output
 gmax index                    # Reindex (auto-detects and repairs cache/vector mismatches)
 gmax index --reset            # Full reindex from scratch
@@ -470,11 +472,11 @@ gmax watch restart            # Restart daemon
 
 `gmax doctor` reports ANN index state. `ANN: vector index not built` is normal with the default exact-search configuration.
 
-Compaction pauses index writes, waits for pending writes to commit, and opens a fresh table snapshot for each attempt. Each optimize call makes at most two attempts. Before each attempt it checks current free space against twice the table's logical size plus the critical-space reserve (5 GB by default). If there is insufficient headroom, it skips the rewrite and logs the required space; search remains available. A successful prune can reclaim fragment copies left by failed attempts.
+Full-table compaction and new FTS/ANN index builds are disabled in the containment release, including forced maintenance and doctor repair. Existing indexes remain readable; missing lexical indexes fall back to available retrieval. Retained copies are not recovered by this release. A separate exclusive prune-only path requires validation before deployment. Do not repeatedly force repair, use future cutoffs or manually remove index fragments.
 
-`~/.gmax/logs/daemon.log` records compaction attempts and outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
+`~/.gmax/logs/daemon.log` records containment skips and retained historical compaction outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
 
-`gmax doctor --fix` reports completed, skipped, failed, or unverified optimization. It exits nonzero when a requested optimization did not complete or an older daemon could not verify its outcome. A busy or failed daemon is never retried as a second writer in the CLI process.
+`gmax doctor --fix` refuses work under quarantine and otherwise reports optimization skipped by containment. It exits nonzero when a requested optimization did not complete or an older daemon could not verify its outcome. A busy or failed daemon is never retried as a second writer in the CLI process.
 
 ### Known issues
 
@@ -485,7 +487,7 @@ whether you need to act.
 | You see | What it means |
 |---|---|
 | `Optimize panicked ... inverted/builder.rs` | The historical FTS merge defect is fixed in the shipped LanceDB 0.39.0 runtime. If it recurs on a current release, preserve the version and logs and report a regression; the rebuild guard remains a recovery tripwire. |
-| `disabling auto-rebuild until an optimize succeeds` | Transient, not a wedge. The next successful optimize clears it. Search stays available. |
+| `disabling auto-rebuild until an optimize succeeds` | Recovery remains paused under containment. Preserve diagnostics; use existing indexes or vector retrieval rather than forcing optimize. |
 | `ANN: vector index not built` | Normal — exact search is the default. |
 | `cannot reach the daemon socket from this sandbox` (exit 2) | The shell is sandboxed. Add the two keys in [Running under the Claude Code sandbox](#running-under-the-claude-code-sandbox); `gmax doctor` warns about the same gap. |
 | `npm audit` reports advisories on install | Record the installed version and dependency path and report new findings. JavaScript consumer audits do not cover the Python embedding environment; maintainers also audit its locked registry dependencies with `pnpm run audit:python` (Python 3.11+; no model load). |

package/dist/commands/add.js

@@ -53,6 +53,7 @@ const index_config_1 = require("../lib/index/index-config");
 const sync_helpers_1 = require("../lib/index/sync-helpers");
 const syncer_1 = require("../lib/index/syncer");
 const setup_helpers_1 = require("../lib/setup/setup-helpers");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const blocked_roots_1 = require("../lib/utils/blocked-roots");
@@ -87,6 +88,7 @@ Examples:
     var _a, _b, _c, _d, _e, _f;
     let vectorDb = null;
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         const targetDir = dir ? path.resolve(dir) : process.cwd();
         const projectRoot = (_a = (0, project_root_1.findProjectRoot)(targetDir)) !== null && _a !== void 0 ? _a : targetDir;
         const projectName = path.basename(projectRoot);

package/dist/commands/doctor.js

@@ -51,6 +51,7 @@ const commander_1 = require("commander");
 const config_1 = require("../config");
 const embedding_status_1 = require("../lib/index/embedding-status");
 const index_config_1 = require("../lib/index/index-config");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const doctor_optimize_1 = require("../lib/utils/doctor-optimize");
 const doctor_status_1 = require("../lib/utils/doctor-status");
 const exit_1 = require("../lib/utils/exit");
@@ -346,6 +347,14 @@ exports.doctor = new commander_1.Command("doctor")
     .action((opts) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
     var _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    if (opts.fix) {
+        const denied = (0, maintenance_policy_1.storeMutationDeniedReason)();
+        if (denied !== null) {
+            console.error(`gmax doctor --fix refused: ${denied}; preserving containment`);
+            process.exitCode = 2;
+            return;
+        }
+    }
     if (!opts.agent)
         console.log("gmax Doctor\n");
     const root = config_1.PATHS.globalRoot;

package/dist/commands/index.js

@@ -50,6 +50,7 @@ const grammar_loader_1 = require("../lib/index/grammar-loader");
 const sync_helpers_1 = require("../lib/index/sync-helpers");
 const syncer_1 = require("../lib/index/syncer");
 const setup_helpers_1 = require("../lib/setup/setup-helpers");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const exit_1 = require("../lib/utils/exit");
@@ -85,6 +86,7 @@ Examples:
     process.on("SIGINT", onSignal);
     process.on("SIGTERM", onSignal);
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         yield (0, setup_helpers_1.ensureSetup)();
         const indexRoot = options.path
             ? path.resolve(options.path)

package/dist/commands/remove.js

@@ -46,6 +46,7 @@ exports.remove = void 0;
 const path = __importStar(require("node:path"));
 const readline = __importStar(require("node:readline"));
 const commander_1 = require("commander");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const meta_cache_1 = require("../lib/store/meta-cache");
 const vector_db_1 = require("../lib/store/vector-db");
 const exit_1 = require("../lib/utils/exit");
@@ -82,6 +83,7 @@ Examples:
     let vectorDb = null;
     let metaCache = null;
     try {
+        (0, maintenance_policy_1.assertStoreMutationAllowed)();
         // Resolve name → registered root when arg has no path separator and
         // isn't a dir. Avoids the footgun where a typo'd name silently removed
         // the cwd project.

package/dist/commands/repair.js

@@ -13,6 +13,7 @@ exports.repair = void 0;
 const commander_1 = require("commander");
 const config_1 = require("../config");
 const index_config_1 = require("../lib/index/index-config");
+const maintenance_policy_1 = require("../lib/store/maintenance-policy");
 const vector_db_1 = require("../lib/store/vector-db");
 const autostart_1 = require("../lib/utils/autostart");
 const daemon_client_1 = require("../lib/utils/daemon-client");
@@ -38,6 +39,7 @@ Examples:
     var _a, _b, _c;
     try {
         if (opts.rebuild) {
+            (0, maintenance_policy_1.assertStoreMutationAllowed)();
             const running = yield (0, daemon_client_1.ensureDaemonRunning)();
             if (!running) {
                 const undo = (0, autostart_1.autostartDisabledUndo)();

package/dist/commands/watch.js

@@ -76,6 +76,12 @@ exports.watch = new commander_1.Command("watch")
     .option("--no-idle-timeout", "Disable the 30-minute idle shutdown")
     .action((options) => __awaiter(void 0, void 0, void 0, function* () {
     var _a, _b;
+    const safetyDenied = (0, autostart_1.daemonStartDeniedReason)();
+    if (safetyDenied !== null) {
+        console.error(`gmax: ${safetyDenied}; preserving containment`);
+        process.exitCode = 2;
+        return;
+    }
     // A secondary store (src/bin.ts) never runs a daemon or a watcher: one
     // would hold the external drive open, and its startup sweep of stale
     // daemons judges liveness by its own home's lock and socket, so it takes
@@ -440,6 +446,12 @@ exports.watch
             error,
         });
     };
+    const deniedStartup = (0, autostart_1.daemonStartDeniedReason)();
+    if (deniedStartup !== null) {
+        refuse(`${deniedStartup}; preserving containment`);
+        yield (0, exit_1.gracefulExit)(2);
+        return;
+    }
     // Refused before anything is stopped: a daemon that cannot be started
     // again from here must not be taken down.
     if (process.env.GMAX_SECONDARY_STORE === "1") {

package/dist/lib/daemon/daemon.js

@@ -57,9 +57,12 @@ const embedding_status_1 = require("../index/embedding-status");
 const index_config_1 = require("../index/index-config");
 const syncer_1 = require("../index/syncer");
 const server_1 = require("../llm/server");
+const compaction_result_1 = require("../store/compaction-result");
+const maintenance_policy_1 = require("../store/maintenance-policy");
 const meta_cache_1 = require("../store/meta-cache");
 const store_lease_1 = require("../store/store-lease");
 const vector_db_1 = require("../store/vector-db");
+const autostart_1 = require("../utils/autostart");
 const blocked_roots_1 = require("../utils/blocked-roots");
 const daemon_client_1 = require("../utils/daemon-client");
 const daemon_launcher_1 = require("../utils/daemon-launcher");
@@ -73,6 +76,7 @@ const process_footprint_1 = require("../utils/process-footprint");
 const project_registry_1 = require("../utils/project-registry");
 const resource_snapshot_1 = require("../utils/resource-snapshot");
 const root_availability_1 = require("../utils/root-availability");
+const safety_latch_1 = require("../utils/safety-latch");
 const watcher_store_1 = require("../utils/watcher-store");
 const pool_1 = require("../workers/pool");
 const ipc_handler_1 = require("./ipc-handler");
@@ -148,8 +152,6 @@ class Daemon {
         this.heartbeatInterval = null;
         this.idleInterval = null;
         this.heartbeatTick = 0;
-        /** Rate-limits the kernel-zone warn log — see checkKernelZonePressure. */
-        this.lastZoneWarnMs = 0;
         this.shuttingDown = false;
         this.recycling = false;
         this.recycleDueSinceMs = null;
@@ -165,6 +167,7 @@ class Daemon {
         });
         this.mlxServerManager = new mlx_server_manager_1.MlxServerManager({
             getShuttingDown: () => this.shuttingDown,
+            assertExpansionAdmission: () => this.assertHeavyOperationAdmission("mlx-start"),
         });
         this.watcherManager = new watcher_manager_1.WatcherManager({
             processors: this.processors,
@@ -238,6 +241,16 @@ class Daemon {
     start() {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
+            const denied = (0, autostart_1.daemonStartDeniedReason)();
+            if (denied !== null)
+                throw new Error(`gmax: ${denied}; preserving containment`);
+            // Check before stale-process cleanup, store opening, workers or model setup.
+            const pressure = this.hostPressureDeniedReason();
+            if (pressure !== null) {
+                if (pressure.measured)
+                    (0, safety_latch_1.latchSafetyStop)(pressure.reason);
+                throw new Error(`gmax: ${pressure.reason}; startup safety stop`);
+            }
             process.title = "gmax-daemon";
             // Read verbs register here rather than at read-verbs.ts module scope: the
             // registry is asserted on exactly in tests/ipc-read-verbs.test.ts, and a
@@ -391,7 +404,7 @@ class Daemon {
             const globalConfig = (_a = this.activeConfig) !== null && _a !== void 0 ? _a : (0, index_config_1.readGlobalConfig)();
             const isAppleSilicon = process.arch === "arm64" && process.platform === "darwin";
             if (isAppleSilicon && globalConfig.embedMode === "gpu") {
-                yield this.mlxServerManager.ensureMlxServer(globalConfig.mlxModel);
+                yield this.ensureAdmittedMlxServer(globalConfig.mlxModel);
                 this.assertStartupActive();
             }
             this.publishResourceGeneration(globalConfig, this.activeGeneration, this.vectorDb, this.workerPool, this.mlxMode(globalConfig));
@@ -457,13 +470,10 @@ class Daemon {
                 // after a frozen MLX process kept the port bound (v0.17.0 bug #1).
                 this.heartbeatTick++;
                 if (this.heartbeatTick % 5 === 0) {
-                    void this.mlxServerManager.checkMlxHealth();
-                    this.processManager.sweepOrphanWorkers();
-                    this.maybeRecycle();
-                    this.checkKernelZonePressure();
+                    this.runHeartbeatMaintenance(true);
                 }
                 else if (this.recycleDueSinceMs !== null) {
-                    this.maybeRecycle(false);
+                    this.runHeartbeatMaintenance(false);
                 }
             }, HEARTBEAT_INTERVAL_MS);
             // 10. Idle timeout (skip when disabled via env)
@@ -486,52 +496,59 @@ class Daemon {
                 console.log("[daemon] Idle shutdown disabled (GMAX_DAEMON_IDLE_TIMEOUT_MS<=0)");
             }
             console.log(`[daemon] Started (PID: ${process.pid}, ${this.processors.size} projects)`);
-            // Pre-warm the search hot path so the first user-facing search doesn't
-            // pay daemon-side cold costs:
-            //   - LanceDB connection open + first openTable() (~10–15s on a 5GB
-            //     index — this is the dominant cost)
-            //   - FTS index "already exists" round-trip
-            //   - Two parallel encodeQuery calls so the worker pool spawns + warms
-            //     workers ahead of the first real search. The reaper floor is
-            //     MIN_KEEP_WORKERS = 1 (pool.ts), so only one worker stays resident
-            //     long-term — but the prewarm still pays the model-load cost up front.
-            // Fire-and-forget; failures are non-fatal — the next real search just
-            // pays the cost once. Delay a few seconds so we don't compete with the
-            // catchup scans dispatched on startup.
-            setTimeout(() => {
-                if (this.shuttingDown)
-                    return;
-                void this.runSharedOperation("search-warmup", undefined, () => __awaiter(this, void 0, void 0, function* () {
-                    const t0 = Date.now();
-                    try {
-                        if (this.vectorDb) {
-                            yield this.vectorDb.ensureTable();
-                            yield this.vectorDb.createFTSIndex();
-                            yield this.vectorDb.createVectorIndex(false, 5, true);
-                        }
-                        const pool = this.workerPool;
-                        if (!pool)
-                            throw new Error("worker pool not ready");
-                        // Two parallel encodes force the pool to spawn two workers and
-                        // warm both (each worker loads Granite + ColBERT lazily on first
-                        // encode — once warmed, subsequent encodes are ~13ms).
-                        yield Promise.all([
-                            pool.encodeQuery("warmup-a"),
-                            pool.encodeQuery("warmup-b"),
-                        ]);
-                        console.log(`[daemon] Search hot path pre-warmed (${Date.now() - t0}ms)`);
-                    }
-                    catch (err) {
-                        console.log(`[daemon] Search warmup failed (non-fatal): ${err}`);
-                    }
-                })).catch((err) => {
-                    if (err instanceof operation_coordinator_1.OperationClosedError)
-                        return;
-                    console.log(`[daemon] Search warmup skipped: ${err}`);
-                });
-            }, 5000).unref();
+            this.scheduleSearchWarmup();
         });
     }
+    scheduleSearchWarmup() {
+        // Speculative encodes can spawn/load models even though existing FTS
+        // adoption is read-only. Containment schedules neither work nor admission.
+        if ((0, maintenance_policy_1.fullTableMaintenanceDisabled)())
+            return;
+        // Pre-warm the search hot path so the first user-facing search doesn't
+        // pay daemon-side cold costs:
+        //   - LanceDB connection open + first openTable() (~10–15s on a 5GB
+        //     index — this is the dominant cost)
+        //   - FTS index "already exists" round-trip
+        //   - Two parallel encodeQuery calls so the worker pool spawns + warms
+        //     workers ahead of the first real search. The reaper floor is
+        //     MIN_KEEP_WORKERS = 1 (pool.ts), so only one worker stays resident
+        //     long-term — but the prewarm still pays the model-load cost up front.
+        // Fire-and-forget; failures are non-fatal — the next real search just
+        // pays the cost once. Delay a few seconds so we don't compete with the
+        // catchup scans dispatched on startup.
+        setTimeout(() => {
+            if (this.shuttingDown)
+                return;
+            void this.runSharedOperation("search-warmup", undefined, () => __awaiter(this, void 0, void 0, function* () {
+                const t0 = Date.now();
+                try {
+                    if (this.vectorDb) {
+                        yield this.vectorDb.ensureTable();
+                        yield this.vectorDb.createFTSIndex();
+                        yield this.vectorDb.createVectorIndex(false, 5, true);
+                    }
+                    const pool = this.workerPool;
+                    if (!pool)
+                        throw new Error("worker pool not ready");
+                    // Two parallel encodes force the pool to spawn two workers and
+                    // warm both (each worker loads Granite + ColBERT lazily on first
+                    // encode — once warmed, subsequent encodes are ~13ms).
+                    yield Promise.all([
+                        pool.encodeQuery("warmup-a"),
+                        pool.encodeQuery("warmup-b"),
+                    ]);
+                    console.log(`[daemon] Search hot path pre-warmed (${Date.now() - t0}ms)`);
+                }
+                catch (err) {
+                    console.log(`[daemon] Search warmup failed (non-fatal): ${err}`);
+                }
+            })).catch((err) => {
+                if (err instanceof operation_coordinator_1.OperationClosedError)
+                    return;
+                console.log(`[daemon] Search warmup skipped: ${err}`);
+            });
+        }, 5000).unref();
+    }
     watchProject(root, signal) {
         return this.withProjectLock(root, signal, () => this.runSharedOperation("watch", signal, () => this.watchProjectWithinOperation(root)));
     }
@@ -606,7 +623,37 @@ class Daemon {
         }
     }
     runSharedOperation(name, signal, fn) {
-        return this.operations.runShared(name, signal, fn);
+        const readOnly = ((0, read_verbs_1.getReadVerb)(name) !== undefined && !(0, read_verbs_1.isHeavyReadVerb)(name)) ||
+            ["project-stats", "unwatch", "llm-stop"].includes(name);
+        return this.operations.runShared(name, signal, (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+            if (name === "store-maintenance" && (0, maintenance_policy_1.fullTableMaintenanceDisabled)()) {
+                // Retain coordinator close/exclusive checks, but never admit a disabled
+                // callback as heavy work or probe the kernel for a known no-op.
+                return (0, compaction_result_1.skippedCompaction)(maintenance_policy_1.FULL_TABLE_MAINTENANCE_DISABLED_REASON);
+            }
+            if (!readOnly)
+                this.assertHeavyOperationAdmission(name);
+            return fn(operationSignal);
+        }));
+    }
+    ensureAdmittedMlxServer(model) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertHeavyOperationAdmission("mlx-start");
+            yield this.mlxServerManager.ensureMlxServer(model);
+        });
+    }
+    assertHeavyOperationAdmission(name) {
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null)
+            throw new Error(`${name} refused: ${denied}`);
+        // Probe at operation admission, before setup/cache/worker/model side effects.
+        if (!this.checkKernelZonePressure()) {
+            throw new Error(`${name} refused: host pressure is unsafe or unknown`);
+        }
+        // Another process can quarantine the machine while the probes run.
+        const finalDenied = (0, autostart_1.daemonStartDeniedReason)();
+        if (finalDenied !== null)
+            throw new Error(`${name} refused: ${finalDenied}`);
     }
     /**
      * Compact + prune on behalf of a CLI caller.
@@ -1298,6 +1345,18 @@ class Daemon {
                 (0, ipc_handler_1.writeDone)(conn, { ok: false, error: "daemon resources not ready" });
                 return;
             }
+            try {
+                this.assertHeavyOperationAdmission("repair");
+            }
+            catch (error) {
+                (0, ipc_handler_1.writeDone)(conn, {
+                    ok: false,
+                    error: error instanceof Error
+                        ? error.message
+                        : "repair safety admission failed",
+                });
+                return;
+            }
             const targetConfig = (0, index_config_1.readGlobalConfig)();
             const targetGeneration = (0, embedding_generation_1.resolveEmbeddingGeneration)(targetConfig);
             const clientAbort = new AbortController();
@@ -1338,8 +1397,10 @@ class Daemon {
             };
             try {
                 const result = yield this.operations.runExclusive("repair", () => __awaiter(this, void 0, void 0, function* () {
+                    this.assertHeavyOperationAdmission("repair");
                     desiredWatchRoots = yield this.watcherManager.quiesceAll();
                 }), (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+                    this.assertHeavyOperationAdmission("repair");
                     throwIfPreDropCancelled(operationSignal);
                     oldResources.vectorDb.pauseMaintenanceLoop();
                     this.searchers.clear();
@@ -1435,7 +1496,7 @@ class Daemon {
                             throw new Error(`rebuilt table dimension ${physicalDim !== null && physicalDim !== void 0 ? physicalDim : "missing"} does not match target ${targetGeneration.vectorDim}`);
                         }
                         if (targetConfig.embedMode === "gpu") {
-                            yield this.mlxServerManager.ensureMlxServer(targetGeneration.mlxModel);
+                            yield this.ensureAdmittedMlxServer(targetGeneration.mlxModel);
                         }
                         const targetMlx = this.mlxMode(targetConfig);
                         targetPool = this.createWorkerPool(targetGeneration, targetConfig.embedMode);
@@ -1549,7 +1610,7 @@ class Daemon {
                                         : oldResources.vectorDb;
                                     if (oldResources.config.embedMode === "gpu" &&
                                         oldResources.mlx === "owned") {
-                                        yield this.mlxServerManager.ensureMlxServer(oldResources.embedding.mlxModel);
+                                        yield this.ensureAdmittedMlxServer(oldResources.embedding.mlxModel);
                                     }
                                     restoredPool = this.createWorkerPool(oldResources.embedding, oldResources.config.embedMode);
                                     yield restoredDb.downgradeStoreLease();
@@ -1843,6 +1904,18 @@ class Daemon {
     resourceSnapshot() {
         return this.lastResourceSnapshot;
     }
+    runHeartbeatMaintenance(sampleFootprint) {
+        // Both ordinary probes and deferred-recycle ticks check safety first.
+        if (!this.checkKernelZonePressure())
+            return;
+        this.maybeRecycle(sampleFootprint);
+        if (this.shuttingDown || this.recycling || !sampleFootprint)
+            return;
+        void this.mlxServerManager.checkMlxHealth().catch((error) => {
+            console.error("[daemon] MLX health/restart refused:", error instanceof Error ? error.message : "unknown failure");
+        });
+        this.processManager.sweepOrphanWorkers();
+    }
     logResourceSnapshot(reason, footprintMb) {
         var _a, _b;
         var _c, _d;
@@ -1941,38 +2014,84 @@ class Daemon {
      * This host lost three sessions that way before the compactor was identified as
      * the largest write source on it.
      *
-     * So the daemon watches the zone it is pressurizing. A warn-level reading is
-     * logged and left alone; a critical reading exits without relaunch, because
-     * relaunching would resume the writes that caused it. Nothing here can reclaim
-     * the leaked memory — only a reboot does that — so the only useful move is to
-     * stop adding to it while the user still has a working machine.
+     * Warning, critical or unknown macOS readings stop mutation before another
+     * heavy operation can begin. Persist the reason before shutdown, so hooks and
+     * memory guards cannot revive the writer. Nothing here reclaims kernel memory.
      *
-     * Deliberately does nothing when the sample is unavailable or unparseable
-     * (non-macOS, no `zprint`, changed output format): an unknown reading must never
-     * shut the daemon down.
+     * Non-macOS hosts have no such probe. On macOS an unavailable sample is
+     * explicitly unknown and cannot authorize further mutation.
      */
     checkKernelZonePressure() {
         if (this.shuttingDown || this.recycling)
-            return;
-        const usage = (0, kernel_zone_1.readKernelZoneUsage)();
-        if (!usage || usage.pressure === "ok")
-            return;
-        if (usage.pressure === "warn") {
-            // Rate-limited to once an hour: at the 5-minute heartbeat this would
-            // otherwise print 12 identical lines an hour for as long as the condition
-            // holds, which on a leaking host is until reboot.
-            const now = Date.now();
-            if (now - this.lastZoneWarnMs < 60 * 60 * 1000)
-                return;
-            this.lastZoneWarnMs = now;
-            console.log(`[daemon] WARNING: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — macOS kernel zone is leaking ` +
-                `under write pressure. The daemon will stop itself at ` +
-                `${(kernel_zone_1.ZONE_THRESHOLDS.criticalBytes / Math.pow(1024, 3)).toFixed(0)}GiB. ` +
-                `Only a reboot reclaims this memory.`);
-            return;
+            return false;
+        const denied = (0, autostart_1.daemonStartDeniedReason)();
+        if (denied !== null) {
+            // The existing quarantine is already durable; preserve its ownership and
+            // do not replace it with a new marker that an operator must also clear.
+            this.stopForSafety(denied, false);
+            return false;
+        }
+        const pressure = this.hostPressureDeniedReason();
+        if (pressure === null)
+            return true;
+        this.stopForSafety(pressure.reason);
+        return false;
+    }
+    /** Both measurements must be known and normal before any resource expansion. */
+    hostPressureDeniedReason() {
+        if (process.platform !== "darwin")
+            return null;
+        // This inexpensive probe rejects OS warning before a worker/model starts,
+        // or before paying the bounded but relatively slow kernel-zone probe cost.
+        const memory = (0, kernel_zone_1.probeMemoryPressure)();
+        if (memory.status !== "known") {
+            return {
+                reason: `OS memory pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(memory)})`,
+                measured: false,
+            };
+        }
+        if (memory.pressure !== "normal") {
+            return {
+                reason: `${memory.pressure} OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(memory)})`,
+                measured: true,
+            };
+        }
+        const kernel = (0, kernel_zone_1.probeKernelZoneUsage)();
+        if (kernel.status !== "known") {
+            return {
+                reason: `kernel pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(kernel)}); heavy work cannot be admitted`,
+                measured: false,
+            };
+        }
+        if (kernel.usage.pressure === "ok") {
+            // Kernel sampling can take seconds; use a new inexpensive OS observation
+            // at the actual admission boundary, rather than trusting its first sample.
+            const freshMemory = (0, kernel_zone_1.probeMemoryPressure)();
+            if (freshMemory.status === "known" && freshMemory.pressure === "normal")
+                return null;
+            return {
+                reason: freshMemory.status === "known"
+                    ? `${freshMemory.pressure} OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(freshMemory)})`
+                    : `OS memory pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(freshMemory)})`,
+                measured: freshMemory.status === "known",
+            };
+        }
+        return {
+            reason: `${kernel.usage.pressure} kernel pressure: ${(0, kernel_zone_1.formatZoneUsage)(kernel.usage)} (${(0, kernel_zone_1.formatPressureProbe)(kernel)})`,
+            measured: true,
+        };
+    }
+    stopForSafety(reason, persist = true) {
+        // Warning already pauses mutation: a stale index costs less than another
+        // host crash. Unknown readings are visible stops, never healthy samples.
+        try {
+            if (persist)
+                (0, safety_latch_1.latchSafetyStop)(reason);
+        }
+        catch (error) {
+            console.error("[daemon] Failed to persist safety stop; stopping anyway:", error);
         }
-        console.log(`[daemon] CRITICAL: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — stopping to avoid a kernel panic. ` +
-            `Reboot to reclaim the zone; the index will catch up on next start.`);
+        console.log(`[daemon] SAFETY STOP: ${reason}. Containment stays in place across restart; review host health before resuming.`);
         this.recycling = true;
         void this.shutdown().finally(() => process.exit(0));
     }