grepmax 0.26.57 → 0.26.58

package/dist/lib/daemon/daemon.js

@@ -62,6 +62,7 @@ const maintenance_policy_1 = require("../store/maintenance-policy");
 const meta_cache_1 = require("../store/meta-cache");
 const store_lease_1 = require("../store/store-lease");
 const vector_db_1 = require("../store/vector-db");
+const async_semaphore_1 = require("../utils/async-semaphore");
 const autostart_1 = require("../utils/autostart");
 const blocked_roots_1 = require("../utils/blocked-roots");
 const daemon_client_1 = require("../utils/daemon-client");
@@ -74,6 +75,7 @@ const operation_coordinator_1 = require("../utils/operation-coordinator");
 const process_1 = require("../utils/process");
 const process_footprint_1 = require("../utils/process-footprint");
 const project_registry_1 = require("../utils/project-registry");
+const query_timeout_1 = require("../utils/query-timeout");
 const resource_snapshot_1 = require("../utils/resource-snapshot");
 const root_availability_1 = require("../utils/root-availability");
 const safety_latch_1 = require("../utils/safety-latch");
@@ -81,6 +83,7 @@ const watcher_store_1 = require("../utils/watcher-store");
 const pool_1 = require("../workers/pool");
 const ipc_handler_1 = require("./ipc-handler");
 const mlx_server_manager_1 = require("./mlx-server-manager");
+const paused_reads_1 = require("./paused-reads");
 const process_manager_1 = require("./process-manager");
 const read_verbs_1 = require("./read-verbs");
 const rows_handler_1 = require("./rows-handler");
@@ -161,6 +164,9 @@ class Daemon {
         // (so liveness probes succeed during slow init), so commands that need those
         // resources must be gated on this to avoid hitting null stores mid-startup.
         this.ready = false;
+        this.pausedReason = null;
+        this.pausePromise = null;
+        this.pausedReadGate = new async_semaphore_1.AsyncSemaphore(1);
         this.processManager = new process_manager_1.ProcessManager({
             getShuttingDown: () => this.shuttingDown,
             getWorkerPids: () => { var _a; return (_a = this.workerPool) === null || _a === void 0 ? void 0 : _a.getWorkerPids(); },
@@ -239,18 +245,20 @@ class Daemon {
         return resources;
     }
     start() {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+        return __awaiter(this, arguments, void 0, function* (options = {}) {
+            var _a, _b;
             const denied = (0, autostart_1.daemonStartDeniedReason)();
-            if (denied !== null)
+            if (denied !== null && !options.readOnly)
                 throw new Error(`gmax: ${denied}; preserving containment`);
-            // Check before stale-process cleanup, store opening, workers or model setup.
+            // Explicit read-only startup preserves every marker and opens no models.
             const pressure = this.hostPressureDeniedReason();
-            if (pressure !== null) {
-                if (pressure.measured)
-                    (0, safety_latch_1.latchSafetyStop)(pressure.reason);
+            if (pressure === null || pressure === void 0 ? void 0 : pressure.critical) {
+                (0, safety_latch_1.latchSafetyStop)(pressure.reason);
                 throw new Error(`gmax: ${pressure.reason}; startup safety stop`);
             }
+            if (options.readOnly || pressure !== null) {
+                this.pausedReason = (_a = denied !== null && denied !== void 0 ? denied : pressure === null || pressure === void 0 ? void 0 : pressure.reason) !== null && _a !== void 0 ? _a : "read-only service requested";
+            }
             process.title = "gmax-daemon";
             // Read verbs register here rather than at read-verbs.ts module scope: the
             // registry is asserted on exactly in tests/ipc-read-verbs.test.ts, and a
@@ -262,7 +270,8 @@ class Daemon {
             (0, rows_handler_1.registerRowsVerbs)();
             (0, vector_handler_1.registerVectorVerbs)();
             // 0. Singleton enforcement: find and kill ALL stale daemon/worker processes
-            yield this.processManager.killStaleProcesses();
+            if (this.pausedReason === null)
+                yield this.processManager.killStaleProcesses();
             this.assertStartupActive();
             // 1. Acquire exclusive lock — kernel-enforced, atomic, auto-released on death
             const ipcHome = path.dirname(config_1.PATHS.daemonLockFile);
@@ -302,7 +311,7 @@ class Daemon {
             try {
                 fs.unlinkSync(config_1.PATHS.daemonSocket);
             }
-            catch (_b) { }
+            catch (_c) { }
             this.server = net.createServer((conn) => {
                 (0, logger_1.debug)("daemon", "client connected");
                 this.connections.add(conn);
@@ -370,7 +379,7 @@ class Daemon {
             // reads the PID can immediately ping this daemon and get a response.
             fs.writeFileSync(config_1.PATHS.daemonPidFile, String(process.pid));
             // 4. Kill existing per-project watchers
-            const existing = (0, watcher_store_1.listWatchers)();
+            const existing = this.pausedReason === null ? (0, watcher_store_1.listWatchers)() : [];
             for (const w of existing) {
                 console.log(`[daemon] Taking over from per-project watcher (PID: ${w.pid}, ${path.basename(w.projectRoot)})`);
                 yield (0, process_1.killProcess)(w.pid);
@@ -379,17 +388,34 @@ class Daemon {
             }
             // 5. Open shared resources
             try {
-                fs.mkdirSync(config_1.PATHS.cacheDir, { recursive: true });
-                fs.mkdirSync(config_1.PATHS.lancedbDir, { recursive: true });
-                console.log("[daemon] Opening LanceDB:", config_1.PATHS.lancedbDir);
+                if (this.pausedReason === null) {
+                    fs.mkdirSync(config_1.PATHS.cacheDir, { recursive: true });
+                    fs.mkdirSync(config_1.PATHS.lancedbDir, { recursive: true });
+                }
+                console.log(this.pausedReason === null
+                    ? "[daemon] Opening LanceDB:"
+                    : "[daemon] Preparing bounded retained-index reader:", config_1.PATHS.lancedbDir);
                 this.activeConfig = (0, index_config_1.readGlobalConfig)();
                 this.activeGeneration = (0, embedding_generation_1.resolveEmbeddingGeneration)(this.activeConfig);
-                this.vectorDb = new vector_db_1.VectorDB(config_1.PATHS.lancedbDir, this.activeGeneration.vectorDim);
-                this.vectorDb.markIndexOwner();
-                this.workerPool = this.createWorkerPool(this.activeGeneration, this.activeConfig.embedMode);
-                this.vectorDb.startMaintenanceLoop((fn) => this.runSharedOperation("store-maintenance", undefined, () => fn()));
-                console.log("[daemon] Opening MetaCache:", config_1.PATHS.lmdbPath);
-                this.metaCache = new meta_cache_1.MetaCache(config_1.PATHS.lmdbPath);
+                this.vectorDb = new vector_db_1.VectorDB(config_1.PATHS.lancedbDir, this.activeGeneration.vectorDim, undefined, this.pausedReason === null ? {} : paused_reads_1.PAUSED_CACHE_OPTIONS);
+                if (this.pausedReason === null) {
+                    this.vectorDb.markIndexOwner();
+                    try {
+                        this.workerPool = this.createWorkerPool(this.activeGeneration, this.activeConfig.embedMode);
+                    }
+                    catch (error) {
+                        const freshPressure = this.hostPressureDeniedReason();
+                        if (freshPressure === null || freshPressure.critical)
+                            throw error;
+                        this.pauseWork(freshPressure.reason);
+                        yield this.pausePromise;
+                    }
+                    if (this.pausedReason === null) {
+                        this.vectorDb.startMaintenanceLoop((fn) => this.runSharedOperation("store-maintenance", undefined, () => fn()));
+                        console.log("[daemon] Opening MetaCache:", config_1.PATHS.lmdbPath);
+                        this.metaCache = new meta_cache_1.MetaCache(config_1.PATHS.lmdbPath);
+                    }
+                }
                 this.assertStartupActive();
                 // Resources are open — only now may resource-dependent IPC commands run.
                 this.ready = true;
@@ -401,20 +427,32 @@ class Daemon {
             // 6. LLM server manager (constructed, not started — starts on first request)
             this.llmServer = new server_1.LlmServer();
             // 6b. MLX embed server — start if GPU mode is active
-            const globalConfig = (_a = this.activeConfig) !== null && _a !== void 0 ? _a : (0, index_config_1.readGlobalConfig)();
+            const globalConfig = (_b = this.activeConfig) !== null && _b !== void 0 ? _b : (0, index_config_1.readGlobalConfig)();
             const isAppleSilicon = process.arch === "arm64" && process.platform === "darwin";
-            if (isAppleSilicon && globalConfig.embedMode === "gpu") {
-                yield this.ensureAdmittedMlxServer(globalConfig.mlxModel);
+            if (this.pausedReason === null &&
+                isAppleSilicon &&
+                globalConfig.embedMode === "gpu") {
+                try {
+                    yield this.ensureAdmittedMlxServer(globalConfig.mlxModel);
+                }
+                catch (error) {
+                    if (this.pausedReason === null || this.shuttingDown || this.recycling)
+                        throw error;
+                    yield this.pausePromise;
+                }
                 this.assertStartupActive();
             }
-            this.publishResourceGeneration(globalConfig, this.activeGeneration, this.vectorDb, this.workerPool, this.mlxMode(globalConfig));
+            if (this.pausedReason === null)
+                this.publishResourceGeneration(globalConfig, this.activeGeneration, this.vectorDb, this.workerPool, this.mlxMode(globalConfig));
             // 7. Register daemon (only after resources are open)
             (0, watcher_store_1.registerDaemon)(process.pid);
             // 8. Subscribe to the registered projects some session still holds a lease
             // on (skip missing directories). Everything else waits for a lease.
             const allProjects = (0, project_registry_1.listProjects)();
             this.watchLeases.load();
-            const indexed = allProjects.filter((p) => p.status === "indexed" && this.shouldWatch(p.root));
+            const indexed = this.pausedReason !== null
+                ? []
+                : allProjects.filter((p) => p.status === "indexed" && this.shouldWatch(p.root));
             console.log(`[daemon] Watching ${indexed.length} of ${allProjects.length} registered projects` +
                 (WATCH_ALL ? " (GMAX_WATCH_ALL=1)" : " (leased by active sessions)"));
             for (const p of indexed) {
@@ -439,12 +477,14 @@ class Daemon {
             // Re-check shuttingDown each iteration: shutdown's pendingLocks drain is a
             // snapshot, so a new project op kicked off after the snapshot would race
             // with vectorDb.close() and fail with "VectorDB connection is closed".
-            const pending = allProjects.filter((p) => (p.status === "pending" || p.status === "error") &&
-                !p.rebuildId &&
-                fs.existsSync(p.root));
+            const pending = this.pausedReason !== null
+                ? []
+                : allProjects.filter((p) => (p.status === "pending" || p.status === "error") &&
+                    !p.rebuildId &&
+                    fs.existsSync(p.root));
             void (() => __awaiter(this, void 0, void 0, function* () {
                 for (const p of pending) {
-                    if (this.shuttingDown)
+                    if (this.shuttingDown || this.pausedReason !== null)
                         return;
                     try {
                         yield this.indexPendingProject(p.root);
@@ -464,6 +504,12 @@ class Daemon {
                 catch (_a) { }
                 (0, log_rotate_1.rotateLogFds)(path.join(config_1.PATHS.logsDir, "daemon.log"));
                 this.sweepWatchLeases();
+                if (!this.checkKernelZonePressure()) {
+                    this.heartbeatTick++;
+                    if (this.pausedReason !== null && this.heartbeatTick % 5 === 0)
+                        this.logResourceSnapshot("paused-heartbeat", null);
+                    return;
+                }
                 // Every 5 ticks (5 min), probe the MLX embed server and respawn if
                 // it's gone zombie (port held but /health unresponsive). Closes the
                 // 42h-degradation window where workers silently fell back to ONNX CPU
@@ -480,7 +526,8 @@ class Daemon {
             if (IDLE_TIMEOUT_MS > 0) {
                 this.idleInterval = setInterval(() => {
                     var _a;
-                    if (Date.now() - this.lastActivity <= IDLE_TIMEOUT_MS)
+                    if (this.pausedReason !== null ||
+                        Date.now() - this.lastActivity <= IDLE_TIMEOUT_MS)
                         return;
                     // Don't kick off shutdown on top of a live maintenance pass — let it
                     // finish and check again next tick. close() awaits this anyway, but
@@ -496,7 +543,12 @@ class Daemon {
                 console.log("[daemon] Idle shutdown disabled (GMAX_DAEMON_IDLE_TIMEOUT_MS<=0)");
             }
             console.log(`[daemon] Started (PID: ${process.pid}, ${this.processors.size} projects)`);
-            this.scheduleSearchWarmup();
+            if (this.pausedReason === null)
+                this.scheduleSearchWarmup();
+            else {
+                console.log(`[daemon] Serving bounded reads; heavy work paused: ${this.pausedReason}`);
+                this.logResourceSnapshot("paused-startup", null);
+            }
         });
     }
     scheduleSearchWarmup() {
@@ -555,7 +607,7 @@ class Daemon {
     watchProjectWithinOperation(root) {
         // Every path that re-watches after an index/rebuild/remove goes through
         // here, so an unleased project stays unwatched after the operation too.
-        if (!this.shouldWatch(root))
+        if (this.pausedReason !== null || !this.shouldWatch(root))
             return Promise.resolve();
         const project = (0, project_registry_1.getProject)(root);
         if ((project === null || project === void 0 ? void 0 : project.status) === "indexed" &&
@@ -581,7 +633,7 @@ class Daemon {
             pid: lease.pid,
             ttlMs: (_a = lease.ttlMs) !== null && _a !== void 0 ? _a : watch_leases_1.DEFAULT_LEASE_TTL_MS,
         });
-        if (this.processors.has(root))
+        if (this.pausedReason !== null || this.processors.has(root))
             return Promise.resolve();
         return this.watchProject(root, signal);
     }
@@ -631,6 +683,23 @@ class Daemon {
                 // callback as heavy work or probe the kernel for a known no-op.
                 return (0, compaction_result_1.skippedCompaction)(maintenance_policy_1.FULL_TABLE_MAINTENANCE_DISABLED_REASON);
             }
+            if (this.pausedReason !== null) {
+                if (!(0, paused_reads_1.isPausedRead)(name))
+                    throw new paused_reads_1.DaemonPausedError(this.pausedReason);
+                if (this.pausedReadGate.waiting >= 16)
+                    throw new paused_reads_1.DaemonPausedError("bounded read queue is full; retry shortly");
+                return this.pausedReadGate.run(operationSignal, () => __awaiter(this, void 0, void 0, function* () {
+                    operationSignal.throwIfAborted();
+                    if (this.pausePromise)
+                        yield (0, query_timeout_1.withQueryTimeout)(this.pausePromise, "pause transition", paused_reads_1.PAUSED_QUERY_TIMEOUT_MS);
+                    if (this.shuttingDown || this.recycling)
+                        throw new operation_coordinator_1.OperationClosedError();
+                    this.checkKernelZonePressure();
+                    if (this.shuttingDown || this.recycling)
+                        throw new operation_coordinator_1.OperationClosedError();
+                    return fn(operationSignal);
+                }));
+            }
             if (!readOnly)
                 this.assertHeavyOperationAdmission(name);
             return fn(operationSignal);
@@ -642,13 +711,59 @@ class Daemon {
             yield this.mlxServerManager.ensureMlxServer(model);
         });
     }
+    serviceStatus() {
+        return this.pausedReason === null
+            ? { mode: "active" }
+            : { mode: "paused", reason: this.pausedReason };
+    }
+    pauseWork(reason) {
+        var _a, _b;
+        if (this.pausedReason !== null || this.shuttingDown)
+            return;
+        this.pausedReason = reason;
+        console.log(`[daemon] Heavy work paused; service stays available: ${reason}`);
+        const error = new paused_reads_1.DaemonPausedError(reason);
+        for (const ac of this.shutdownAbortControllers)
+            ac.abort(error);
+        for (const timer of this.pendingIndexRetryTimers.values())
+            clearTimeout(timer);
+        this.pendingIndexRetryTimers.clear();
+        (_a = this.vectorDb) === null || _a === void 0 ? void 0 : _a.pauseMaintenanceLoop();
+        (_b = this.vectorDb) === null || _b === void 0 ? void 0 : _b.abortLeaseWaits();
+        const drain = this.operations.abortAndDrain(error);
+        const pool = this.workerPool;
+        this.workerPool = null;
+        this.resources = null;
+        this.searchers.clear();
+        this.pausePromise = (() => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            yield Promise.all([
+                this.watcherManager.quiesceAll(),
+                pool === null || pool === void 0 ? void 0 : pool.destroy(),
+                drain,
+            ]);
+            yield this.mlxServerManager.stopMlxServer();
+            yield (_a = this.llmServer) === null || _a === void 0 ? void 0 : _a.stop();
+            yield (_b = this.metaCache) === null || _b === void 0 ? void 0 : _b.close();
+            this.metaCache = null;
+            yield (_c = this.vectorDb) === null || _c === void 0 ? void 0 : _c.close();
+            this.vectorDb = null;
+            if (this.shuttingDown)
+                return;
+            this.vectorDb = new vector_db_1.VectorDB(config_1.PATHS.lancedbDir, (_d = this.activeGeneration) === null || _d === void 0 ? void 0 : _d.vectorDim, undefined, paused_reads_1.PAUSED_CACHE_OPTIONS);
+            this.logResourceSnapshot("paused-transition", null);
+        }))();
+        void this.pausePromise.catch((error) => {
+            console.error("[daemon] Paused reader transition failed; status remains available:", error);
+        });
+    }
     assertHeavyOperationAdmission(name) {
         const denied = (0, autostart_1.daemonStartDeniedReason)();
         if (denied !== null)
             throw new Error(`${name} refused: ${denied}`);
         // Probe at operation admission, before setup/cache/worker/model side effects.
         if (!this.checkKernelZonePressure()) {
-            throw new Error(`${name} refused: host pressure is unsafe or unknown`);
+            throw new Error(`${name} refused: host pressure is unsafe or unknown${this.pausedReason ? `: ${this.pausedReason}` : ""}`);
         }
         // Another process can quarantine the machine while the probes run.
         const finalDenied = (0, autostart_1.daemonStartDeniedReason)();
@@ -866,14 +981,27 @@ class Daemon {
             recentReindexed === 0 &&
             pendingFiles > 0;
         const health = this.watcherManager.health(root);
-        return Object.assign(Object.assign({ indexing: !!fullIdx || processing || batchPending > 0 || initialPending, pendingFiles,
-            verifying }, health), { failedFiles: Math.max((_h = (_d = processor === null || processor === void 0 ? void 0 : processor.progress) === null || _d === void 0 ? void 0 : _d.failedFiles) !== null && _h !== void 0 ? _h : 0, (_j = health.failedFiles) !== null && _j !== void 0 ? _j : 0) });
+        return Object.assign(Object.assign({ indexing: this.pausedReason == null &&
+                (!!fullIdx || processing || batchPending > 0 || initialPending), pendingFiles: this.pausedReason == null ? pendingFiles : 0, verifying: this.pausedReason == null && verifying }, health), { failedFiles: Math.max((_h = (_d = processor === null || processor === void 0 ? void 0 : processor.progress) === null || _d === void 0 ? void 0 : _d.failedFiles) !== null && _h !== void 0 ? _h : 0, (_j = health.failedFiles) !== null && _j !== void 0 ? _j : 0) });
     }
     search(payload, signal) {
         return __awaiter(this, void 0, void 0, function* () {
             // Search handling lives in search-handler.ts (Phase 12 split). The daemon
             // supplies its warm VectorDB + watcher/index bookkeeping; the handler runs
             // the query and assembles the response.
+            if (this.pausedReason === null)
+                this.checkKernelZonePressure();
+            if (this.shuttingDown || this.recycling)
+                return { ok: false, error: "daemon stopping for critical pressure" };
+            if (this.pausedReason !== null) {
+                return this.runSharedOperation("keyword-search", signal, (operationSignal) => __awaiter(this, void 0, void 0, function* () {
+                    if (!this.vectorDb)
+                        return { ok: false, error: "paused reader unavailable" };
+                    this.resetActivity();
+                    const result = yield (0, paused_reads_1.searchPausedIndex)(this.vectorDb, payload, this.pausedReason, operationSignal);
+                    return Object.assign(Object.assign({}, result), { indexState: this.indexState(payload.projectRoot) });
+                }));
+            }
             return this.runSharedOperation("search", signal, (operationSignal) => __awaiter(this, void 0, void 0, function* () {
                 return (0, search_handler_1.handleDaemonSearch)({
                     vectorDb: this.vectorDb,
@@ -902,6 +1030,7 @@ class Daemon {
             touchActivity: () => {
                 this.lastActivity = Date.now();
             },
+            queryTimeoutMs: this.pausedReason === null ? 15000 : paused_reads_1.PAUSED_QUERY_TIMEOUT_MS,
         };
     }
     listProjects() {
@@ -2014,9 +2143,9 @@ class Daemon {
      * This host lost three sessions that way before the compactor was identified as
      * the largest write source on it.
      *
-     * Warning, critical or unknown macOS readings stop mutation before another
-     * heavy operation can begin. Persist the reason before shutdown, so hooks and
-     * memory guards cannot revive the writer. Nothing here reclaims kernel memory.
+     * Warning or unknown readings pause heavy work while bounded reads remain
+     * available. Critical readings persist a stop before shutting down so hooks
+     * cannot revive the writer. Nothing here reclaims kernel memory.
      *
      * Non-macOS hosts have no such probe. On macOS an unavailable sample is
      * explicitly unknown and cannot authorize further mutation.
@@ -2024,62 +2153,71 @@ class Daemon {
     checkKernelZonePressure() {
         if (this.shuttingDown || this.recycling)
             return false;
+        const pressure = this.hostPressureDeniedReason();
+        if (pressure === null || pressure === void 0 ? void 0 : pressure.critical) {
+            this.stopForSafety(pressure.reason);
+            return false;
+        }
         const denied = (0, autostart_1.daemonStartDeniedReason)();
-        if (denied !== null) {
-            // The existing quarantine is already durable; preserve its ownership and
-            // do not replace it with a new marker that an operator must also clear.
-            this.stopForSafety(denied, false);
+        if (denied !== null || pressure !== null) {
+            this.pauseWork(denied !== null && denied !== void 0 ? denied : pressure.reason);
             return false;
         }
-        const pressure = this.hostPressureDeniedReason();
-        if (pressure === null)
-            return true;
-        this.stopForSafety(pressure.reason);
-        return false;
+        return this.pausedReason === null;
     }
-    /** Both measurements must be known and normal before any resource expansion. */
+    /** Unknown/warning pauses resource expansion; only known critical shuts down. */
     hostPressureDeniedReason() {
         if (process.platform !== "darwin")
             return null;
-        // This inexpensive probe rejects OS warning before a worker/model starts,
-        // or before paying the bounded but relatively slow kernel-zone probe cost.
         const memory = (0, kernel_zone_1.probeMemoryPressure)();
-        if (memory.status !== "known") {
+        if (memory.status === "known" && memory.pressure === "critical")
             return {
-                reason: `OS memory pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(memory)})`,
-                measured: false,
+                reason: `critical OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(memory)})`,
+                measured: true,
+                critical: true,
             };
-        }
-        if (memory.pressure !== "normal") {
+        // Paused reads still need the kernel-critical guard, even if OS pressure warns.
+        const kernel = (0, kernel_zone_1.probeKernelZoneUsage)();
+        if (kernel.status === "known" && kernel.usage.pressure === "critical")
+            return {
+                reason: `critical kernel pressure: ${(0, kernel_zone_1.formatZoneUsage)(kernel.usage)} (${(0, kernel_zone_1.formatPressureProbe)(kernel)})`,
+                measured: true,
+                critical: true,
+            };
+        const freshMemory = (0, kernel_zone_1.probeMemoryPressure)();
+        if (freshMemory.status === "known" && freshMemory.pressure === "critical")
             return {
-                reason: `${memory.pressure} OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(memory)})`,
+                reason: `critical OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(freshMemory)})`,
                 measured: true,
+                critical: true,
             };
+        for (const sample of [memory, freshMemory]) {
+            if (sample.status !== "known")
+                return {
+                    reason: `OS memory pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(sample)})`,
+                    measured: false,
+                    critical: false,
+                };
+            if (sample.pressure !== "normal")
+                return {
+                    reason: `warn OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(sample)})`,
+                    measured: true,
+                    critical: false,
+                };
         }
-        const kernel = (0, kernel_zone_1.probeKernelZoneUsage)();
-        if (kernel.status !== "known") {
+        if (kernel.status !== "known")
             return {
-                reason: `kernel pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(kernel)}); heavy work cannot be admitted`,
+                reason: `kernel pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(kernel)}); heavy work paused`,
                 measured: false,
+                critical: false,
             };
-        }
-        if (kernel.usage.pressure === "ok") {
-            // Kernel sampling can take seconds; use a new inexpensive OS observation
-            // at the actual admission boundary, rather than trusting its first sample.
-            const freshMemory = (0, kernel_zone_1.probeMemoryPressure)();
-            if (freshMemory.status === "known" && freshMemory.pressure === "normal")
-                return null;
+        if (kernel.usage.pressure !== "ok")
             return {
-                reason: freshMemory.status === "known"
-                    ? `${freshMemory.pressure} OS memory pressure (${(0, kernel_zone_1.formatPressureProbe)(freshMemory)})`
-                    : `OS memory pressure unavailable (${(0, kernel_zone_1.formatPressureProbe)(freshMemory)})`,
-                measured: freshMemory.status === "known",
+                reason: `warn kernel pressure: ${(0, kernel_zone_1.formatZoneUsage)(kernel.usage)} (${(0, kernel_zone_1.formatPressureProbe)(kernel)})`,
+                measured: true,
+                critical: false,
             };
-        }
-        return {
-            reason: `${kernel.usage.pressure} kernel pressure: ${(0, kernel_zone_1.formatZoneUsage)(kernel.usage)} (${(0, kernel_zone_1.formatPressureProbe)(kernel)})`,
-            measured: true,
-        };
+        return null;
     }
     stopForSafety(reason, persist = true) {
         // Warning already pauses mutation: a stale index costs less than another
@@ -2206,7 +2344,7 @@ class Daemon {
             const projectDrain = this.projectMutex.close();
             // Abort catchup/recovery and remove each processor before worker teardown.
             yield this.watcherManager.quiesceAll();
-            yield this.drainOperationsBounded(operationDrain, projectDrain);
+            yield this.drainOperationsBounded(operationDrain, projectDrain, ...(this.pausePromise ? [this.pausePromise.catch(() => { })] : []));
             // Stop LLM server if running
             try {
                 yield (_b = this.llmServer) === null || _b === void 0 ? void 0 : _b.stop();

package/dist/lib/daemon/ipc-handler.js

@@ -55,6 +55,7 @@ const logger_1 = require("../utils/logger");
 const operation_coordinator_1 = require("../utils/operation-coordinator");
 const path_containment_1 = require("../utils/path-containment");
 const project_registry_1 = require("../utils/project-registry");
+const paused_reads_1 = require("./paused-reads");
 const read_verbs_1 = require("./read-verbs");
 const DAEMON_VERSION = (() => {
     try {
@@ -83,7 +84,8 @@ function writeDone(conn, data) {
     conn.end();
 }
 function errorResponse(err) {
-    if (err instanceof operation_coordinator_1.OperationBusyError ||
+    if (err instanceof paused_reads_1.DaemonPausedError ||
+        err instanceof operation_coordinator_1.OperationBusyError ||
         err instanceof operation_coordinator_1.OperationClosedError) {
         return { ok: false, error: err.message, code: err.code };
     }
@@ -123,8 +125,8 @@ function startHeartbeat(conn, intervalMs = HEARTBEAT_INTERVAL_MS) {
  */
 function handleCommand(daemon, cmd, conn) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
-        var _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        var _a, _b, _c, _d;
+        var _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
         try {
             (0, logger_1.debug)("daemon", `ipc cmd=${cmd.cmd}${cmd.root ? ` root=${cmd.root}` : ""}`);
             if (cmd.cmd !== "ping" &&
@@ -148,6 +150,7 @@ function handleCommand(daemon, cmd, conn) {
                         uptime: daemon.uptime(),
                         version: DAEMON_VERSION,
                         operationStatus: daemon.operationStatus(),
+                        service: (_a = daemon.serviceStatus) === null || _a === void 0 ? void 0 : _a.call(daemon),
                         resourceGeneration: daemon.resourceGenerationId(),
                         rebuildPending: daemon.hasUnfinishedRebuild(),
                         capabilities: {
@@ -189,10 +192,14 @@ function handleCommand(daemon, cmd, conn) {
                         diskPressure: daemon.getDiskPressure(),
                         mlx: daemon.getMlxStatus(),
                         workers: daemon.workerCount(),
-                        resources: (_c = (_a = daemon.resourceSnapshot) === null || _a === void 0 ? void 0 : _a.call(daemon)) !== null && _c !== void 0 ? _c : null,
-                        compaction: (_d = (_b = daemon.compactionStatus) === null || _b === void 0 ? void 0 : _b.call(daemon)) !== null && _d !== void 0 ? _d : null,
+                        resources: (_e = (_b = daemon.resourceSnapshot) === null || _b === void 0 ? void 0 : _b.call(daemon)) !== null && _e !== void 0 ? _e : null,
+                        compaction: (_f = (_c = daemon.compactionStatus) === null || _c === void 0 ? void 0 : _c.call(daemon)) !== null && _f !== void 0 ? _f : null,
                         workerThreads: config_1.WORKER_THREADS_SETTING,
+                        service: (_d = daemon.serviceStatus) === null || _d === void 0 ? void 0 : _d.call(daemon),
                     };
+                case "pause":
+                    daemon.pauseWork(String((_g = cmd.reason) !== null && _g !== void 0 ? _g : "read-only service requested"));
+                    return { ok: true, service: daemon.serviceStatus() };
                 case "optimize":
                     // Keeps compaction single-writer: see Daemon.runOptimize.
                     return yield daemon.runOptimize();
@@ -206,14 +213,14 @@ function handleCommand(daemon, cmd, conn) {
                     return Object.assign({ ok: true }, (yield daemon.projectStats(root)));
                 }
                 case "shutdown": {
-                    const reason = String((_e = cmd.reason) !== null && _e !== void 0 ? _e : "unknown");
-                    const fromPid = (_f = cmd.from_pid) !== null && _f !== void 0 ? _f : "?";
-                    const fromPpid = (_g = cmd.from_ppid) !== null && _g !== void 0 ? _g : "?";
-                    const fromVer = (_h = cmd.from_version) !== null && _h !== void 0 ? _h : "?";
+                    const reason = String((_h = cmd.reason) !== null && _h !== void 0 ? _h : "unknown");
+                    const fromPid = (_j = cmd.from_pid) !== null && _j !== void 0 ? _j : "?";
+                    const fromPpid = (_k = cmd.from_ppid) !== null && _k !== void 0 ? _k : "?";
+                    const fromVer = (_l = cmd.from_version) !== null && _l !== void 0 ? _l : "?";
                     const fromArgv = Array.isArray(cmd.from_argv)
                         ? cmd.from_argv.join(" ")
                         : "?";
-                    const fromParentCmd = (_j = cmd.from_parent_cmd) !== null && _j !== void 0 ? _j : "?";
+                    const fromParentCmd = (_m = cmd.from_parent_cmd) !== null && _m !== void 0 ? _m : "?";
                     console.log(`[daemon] shutdown command received via IPC: reason=${reason} from_pid=${fromPid} from_ppid=${fromPpid} from_version=${fromVer} from_argv=[${fromArgv}] from_parent_cmd=[${fromParentCmd}]`);
                     setImmediate(() => daemon.shutdown());
                     return { ok: true };
@@ -238,7 +245,7 @@ function handleCommand(daemon, cmd, conn) {
                         try {
                             maxPerFile = (0, per_file_1.validateMaxPerFile)(cmd.maxPerFile);
                         }
-                        catch (_m) {
+                        catch (_q) {
                             return { ok: false, error: "invalid maxPerFile" };
                         }
                         if (!Number.isInteger(limitRaw) || limitRaw < 1 || limitRaw > 1000) {
@@ -285,8 +292,8 @@ function handleCommand(daemon, cmd, conn) {
                                 return { ok: false, error: "invalid project_roots" };
                             }
                             for (const prefix of [
-                                ...((_k = filters === null || filters === void 0 ? void 0 : filters.inPrefixes) !== null && _k !== void 0 ? _k : []),
-                                ...((_l = filters === null || filters === void 0 ? void 0 : filters.excludePrefixes) !== null && _l !== void 0 ? _l : []),
+                                ...((_o = filters === null || filters === void 0 ? void 0 : filters.inPrefixes) !== null && _o !== void 0 ? _o : []),
+                                ...((_p = filters === null || filters === void 0 ? void 0 : filters.excludePrefixes) !== null && _p !== void 0 ? _p : []),
                             ]) {
                                 (0, path_containment_1.resolveContainedPath)(projectRoot, prefix);
                             }
@@ -419,7 +426,21 @@ function handleCommand(daemon, cmd, conn) {
                     try {
                         // Heavy verbs queue on a global gate before admission; see
                         // HEAVY_READ_VERBS in read-verbs.ts.
-                        return yield (0, read_verbs_1.runReadVerb)(name, ac.signal, () => daemon.runSharedOperation(name, ac.signal, (signal) => verb(cmd, { daemon, conn, signal })));
+                        return yield (0, read_verbs_1.runReadVerb)(name, ac.signal, () => daemon.runSharedOperation(name, ac.signal, (signal) => __awaiter(this, void 0, void 0, function* () {
+                            var _a;
+                            // Validate after admission: pressure can change while queued.
+                            const paused = ((_a = daemon.serviceStatus) === null || _a === void 0 ? void 0 : _a.call(daemon).mode) === "paused";
+                            if (paused) {
+                                (0, paused_reads_1.validatePausedRead)(name, cmd);
+                                if (name === "rows.locate" && cmd.limit === undefined)
+                                    cmd = Object.assign(Object.assign({}, cmd), { limit: paused_reads_1.PAUSED_RESULT_LIMIT });
+                            }
+                            const response = yield verb(cmd, { daemon, conn, signal });
+                            if (paused &&
+                                Buffer.byteLength(JSON.stringify(response)) > 262144)
+                                throw new paused_reads_1.DaemonPausedError("read response exceeds the paused service budget; narrow the request");
+                            return response;
+                        })));
                     }
                     finally {
                         conn.off("close", onClose);