grepmax 0.26.64 → 0.26.66

package/dist/lib/store/prune-state.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneStatePath = pruneStatePath;
+exports.readPruneState = readPruneState;
+exports.writePruneState = writePruneState;
+const node_crypto_1 = require("node:crypto");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+function pruneStatePath(storeDir) {
+    return path.join(storeDir, ".gmax-prune-state.json");
+}
+/** A running receipt survives parent death. Readers must treat it as uncertain,
+ * never as successful cleanup or permission to launch automatic maintenance. */
+function readPruneState(storeDir) {
+    var _a, _b, _c;
+    const identity = fs.realpathSync(storeDir);
+    const target = pruneStatePath(identity);
+    let stat;
+    try {
+        stat = fs.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    if (!stat.isFile() || stat.size > 16 * 1024)
+        throw new Error("Prune state is unverified or oversized");
+    const state = JSON.parse(fs.readFileSync(target, "utf8"));
+    if (state.schemaVersion !== 1 ||
+        state.storeIdentity !== identity ||
+        typeof state.attemptId !== "string" ||
+        !state.attemptId ||
+        !Number.isSafeInteger(state.version) ||
+        state.version < 1 ||
+        !Number.isSafeInteger(state.cutoffMs) ||
+        !Number.isSafeInteger(state.startedAt) ||
+        !["running", "uncertain", "completed"].includes(state.outcome) ||
+        (state.outcome === "completed" &&
+            (!Number.isSafeInteger(state.finishedAt) ||
+                ((_a = state.result) === null || _a === void 0 ? void 0 : _a.version) !== state.version ||
+                ((_b = state.result) === null || _b === void 0 ? void 0 : _b.engine) !== "12.0.0" ||
+                ((_c = state.result) === null || _c === void 0 ? void 0 : _c.rewritten) !== false)))
+        throw new Error("Prune state is invalid; cleanup remains pending");
+    return state.outcome === "running"
+        ? Object.assign(Object.assign({}, state), { outcome: "uncertain" }) : state;
+}
+/** Persist and sync before native deletion. Failure refuses the operation;
+ * failed final writes leave a running/uncertain receipt for the next reader. */
+function writePruneState(state) {
+    const target = pruneStatePath(state.storeIdentity);
+    if (fs.existsSync(target)) {
+        const stat = fs.lstatSync(target);
+        if (!stat.isFile() || stat.size > 16 * 1024)
+            throw new Error("Prune state is unverified or oversized");
+    }
+    const temporary = path.join(state.storeIdentity, `.gmax-prune-${(0, node_crypto_1.randomUUID)()}.tmp`);
+    try {
+        const descriptor = fs.openSync(temporary, "wx", 0o600);
+        try {
+            fs.writeFileSync(descriptor, `${JSON.stringify(state)}\n`);
+            fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+        fs.renameSync(temporary, target);
+        const directory = fs.openSync(state.storeIdentity, "r");
+        try {
+            fs.fsyncSync(directory);
+        }
+        finally {
+            fs.closeSync(directory);
+        }
+    }
+    finally {
+        if (fs.existsSync(temporary))
+            fs.unlinkSync(temporary);
+    }
+}

package/dist/lib/store/recovery-admission.js

@@ -0,0 +1,92 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRUNE_METADATA_HEADROOM_BYTES = void 0;
+exports.createRecoveryBudget = createRecoveryBudget;
+exports.assertRecoveryAdmission = assertRecoveryAdmission;
+exports.admitPrune = admitPrune;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const resource_budget_1 = require("../utils/resource-budget");
+const safety_latch_1 = require("../utils/safety-latch");
+const maintenance_policy_1 = require("./maintenance-policy");
+exports.PRUNE_METADATA_HEADROOM_BYTES = 1024 * 1024;
+/** Explicit recovery has aggregate admission without changing normal service
+ * policy. Offline autostart containment is allowed; a host safety stop is not. */
+function createRecoveryBudget() {
+    return new resource_budget_1.ResourceBudget({
+        policy: () => "strict",
+        quarantine: safety_latch_1.safetyStopReason,
+        requireClientRegistration: false,
+        samplerOverrides: { sampleTimeoutMs: 8000, kernelProbeTimeoutMs: 5000 },
+        sampleMaxAgeMs: 10000,
+    });
+}
+function assertRecoveryAdmission(storeDir, budget) {
+    const marker = path.join(path.dirname(fs.realpathSync(storeDir)), "autostart-disabled");
+    const stat = fs.lstatSync(marker, { throwIfNoEntry: false });
+    if (!(stat === null || stat === void 0 ? void 0 : stat.isFile()) || stat.isSymbolicLink())
+        throw new Error("Recovery requires a persistent autostart-disabled file in the store home; close store owners separately");
+    const disk = (0, maintenance_policy_1.availableStoreDiskBytes)(storeDir);
+    if (!Number.isFinite(disk) || disk < exports.PRUNE_METADATA_HEADROOM_BYTES)
+        throw new Error("Prune metadata disk headroom is low or unknown");
+    const snapshot = budget.check();
+    if ((snapshot === null || snapshot === void 0 ? void 0 : snapshot.platform) !== "darwin")
+        throw new Error("Production recovery admission currently requires macOS host measurements");
+    if (snapshot.physicalFreeMb === null ||
+        !Number.isFinite(snapshot.physicalFreeMb) ||
+        snapshot.physicalFreeMb < resource_budget_1.HELPER_RESOURCE_RESERVE_MB)
+        throw new Error("Insufficient measured physical headroom for prune helper");
+    return snapshot;
+}
+function admitPrune(storeDir, budget = createRecoveryBudget()) {
+    assertRecoveryAdmission(storeDir, budget);
+    const reserve = budget.reserve(resource_budget_1.HELPER_RESOURCE_RESERVE_MB, "prune-helper");
+    let snapshot;
+    try {
+        snapshot = assertRecoveryAdmission(storeDir, budget);
+    }
+    catch (error) {
+        reserve.release();
+        throw error;
+    }
+    return {
+        snapshot,
+        start: (pid) => reserve.attach(pid),
+        approve: () => assertRecoveryAdmission(storeDir, budget),
+        check: () => assertRecoveryAdmission(storeDir, budget),
+        close: () => reserve.release(),
+    };
+}

package/dist/lib/store/recovery.js

@@ -0,0 +1,163 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverStore = recoverStore;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const resource_budget_1 = require("../utils/resource-budget");
+const lance_cleanup_1 = require("./lance-cleanup");
+const prune_state_1 = require("./prune-state");
+const recovery_admission_1 = require("./recovery-admission");
+const store_lease_1 = require("./store-lease");
+function recoverStore(request) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        (_a = request.signal) === null || _a === void 0 ? void 0 : _a.throwIfAborted();
+        const input = path.resolve(request.table);
+        const stat = fs.lstatSync(input);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || !input.endsWith(".lance"))
+            throw new Error("Recovery requires an existing local Lance table directory, without a table symlink");
+        const table = fs.realpathSync(input);
+        const store = path.dirname(table);
+        const previous = (0, prune_state_1.readPruneState)(store);
+        if (!request.prune && !request.check)
+            return {
+                outcome: "status",
+                table,
+                state: previous,
+                fullTableRewriting: "disabled",
+            };
+        if (request.prune &&
+            (!Number.isSafeInteger(request.version) ||
+                request.version < 1 ||
+                !request.cutoff ||
+                !Number.isSafeInteger(request.cutoff.getTime()) ||
+                request.cutoff.getTime() > Date.now()))
+            throw new Error("Explicit prune requires a positive --version and a real, nonfuture --cutoff");
+        if (request.prune &&
+            (previous === null || previous === void 0 ? void 0 : previous.outcome) === "uncertain" &&
+            request.acknowledgeUncertain !== previous.attemptId)
+            throw new Error(`Previous prune completion is uncertain; inspect retained state, then use --acknowledge-uncertain ${previous.attemptId} for a verified explicit retry`);
+        const budget = (0, recovery_admission_1.createRecoveryBudget)();
+        (0, recovery_admission_1.assertRecoveryAdmission)(store, budget);
+        if (!request.prune) {
+            const admission = (0, recovery_admission_1.admitPrune)(store, budget);
+            try {
+                return {
+                    outcome: "preflight-passed",
+                    table,
+                    state: previous,
+                    host: admission.snapshot,
+                    helperReserveMb: resource_budget_1.HELPER_RESOURCE_RESERVE_MB,
+                    fullTableRewriting: "disabled",
+                };
+            }
+            finally {
+                admission.close();
+            }
+        }
+        // Setup is admitted and monitored before acquiring store exclusion. No owner
+        // is killed and no marker is created or cleared by recovery itself.
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        (_b = request.signal) === null || _b === void 0 ? void 0 : _b.addEventListener("abort", abort, { once: true });
+        if ((_c = request.signal) === null || _c === void 0 ? void 0 : _c.aborted)
+            controller.abort();
+        let setup;
+        let monitor;
+        let lease;
+        try {
+            setup = budget.reserve(resource_budget_1.HELPER_RESOURCE_RESERVE_MB, "prune-runtime-setup");
+            monitor = setInterval(() => {
+                try {
+                    (0, recovery_admission_1.assertRecoveryAdmission)(store, budget);
+                }
+                catch (_a) {
+                    controller.abort();
+                }
+            }, 5000);
+            const runtime = yield (0, lance_cleanup_1.prepareCleanupRuntime)(controller.signal);
+            clearInterval(monitor);
+            setup.release();
+            (0, recovery_admission_1.assertRecoveryAdmission)(store, budget);
+            lease = yield store_lease_1.StoreLease.acquireExclusive({
+                storeDir: store,
+                timeoutMs: 1000,
+                signal: controller.signal,
+                role: "explicit-prune-recovery",
+            });
+            // Another completed/interrupted attempt may have happened during setup.
+            const current = (0, prune_state_1.readPruneState)(store);
+            if ((current === null || current === void 0 ? void 0 : current.outcome) === "uncertain" &&
+                request.acknowledgeUncertain !== current.attemptId)
+                throw new Error(`Prune completion is uncertain; inspect and acknowledge attempt ${current.attemptId} before retry`);
+            (0, recovery_admission_1.assertRecoveryAdmission)(store, budget);
+            const result = yield (0, lance_cleanup_1.pruneVersions)(runtime, table, request.version, request.cutoff, {
+                lease,
+                signal: controller.signal,
+                acknowledgeUncertain: request.acknowledgeUncertain,
+            });
+            return {
+                outcome: "verified",
+                table,
+                state: (0, prune_state_1.readPruneState)(store),
+                result,
+                allocatedBytesRecovered: result.allocatedBytesBefore - result.allocatedBytesAfter,
+                filesystemFreeBytesChange: result.freeBytesAfter - result.freeBytesBefore,
+                fullTableRewriting: "disabled",
+            };
+        }
+        catch (error) {
+            if (error instanceof store_lease_1.StoreLeaseTimeoutError)
+                throw new Error(`Recovery refused: store owners are live or unknown (${error.blockers.map((owner) => `${owner.role} pid=${owner.pid}`).join(", ") || "unverified owner"}); close them separately`);
+            throw error;
+        }
+        finally {
+            clearInterval(monitor);
+            (_d = request.signal) === null || _d === void 0 ? void 0 : _d.removeEventListener("abort", abort);
+            setup === null || setup === void 0 ? void 0 : setup.release();
+            yield lease === null || lease === void 0 ? void 0 : lease.release();
+        }
+    });
+}

package/dist/lib/store/store-lease.js

@@ -108,6 +108,14 @@ const defaultProbeDeps = {
     }).trim(),
 };
 function defaultProbeOwner(owner, deps = defaultProbeDeps) {
+    const parent = probeProcessOwner(owner, deps);
+    if ((parent === "dead" || parent === "reused") && owner.activeHelper) {
+        const child = probeProcessOwner(Object.assign(Object.assign({}, owner), { pid: owner.activeHelper.pid, processStart: owner.activeHelper.processStart }), deps);
+        return child === "same" || child === "unknown" ? child : parent;
+    }
+    return parent;
+}
+function probeProcessOwner(owner, deps) {
     try {
         deps.signal(owner.pid);
     }
@@ -124,6 +132,8 @@ function defaultProbeOwner(owner, deps = defaultProbeDeps) {
         if (code !== "EPERM")
             return "unknown";
     }
+    if (owner.processStart === "unverified")
+        return "unknown";
     if (owner.processStart.startsWith(`pid:${owner.pid}:started:`))
         return "same";
     try {
@@ -138,6 +148,7 @@ function defaultProbeOwner(owner, deps = defaultProbeDeps) {
     }
 }
 function readOwner(filePath) {
+    var _a;
     try {
         const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
         if (!parsed || typeof parsed !== "object")
@@ -147,18 +158,40 @@ function readOwner(filePath) {
             typeof owner.processStart === "string" &&
             typeof owner.nonce === "string" &&
             typeof owner.role === "string" &&
-            typeof owner.acquiredAt === "number"
+            typeof owner.acquiredAt === "number" &&
+            (owner.activeHelper === undefined ||
+                (Number.isSafeInteger((_a = owner.activeHelper) === null || _a === void 0 ? void 0 : _a.pid) &&
+                    owner.activeHelper.pid > 0 &&
+                    typeof owner.activeHelper.processStart === "string" &&
+                    !!owner.activeHelper.processStart))
             ? owner
             : null;
     }
-    catch (_a) {
+    catch (_b) {
         return null;
     }
 }
-function writeOwnerAtomic(filePath, owner) {
+function writeOwnerAtomic(filePath, owner, durable = false) {
     const temp = `${filePath}.${owner.nonce}.tmp`;
-    fs.writeFileSync(temp, `${JSON.stringify(owner)}\n`, { flag: "wx" });
+    const fd = fs.openSync(temp, "wx", 0o600);
+    try {
+        fs.writeFileSync(fd, `${JSON.stringify(owner)}\n`);
+        if (durable)
+            fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     fs.renameSync(temp, filePath);
+    if (durable) {
+        const dir = fs.openSync(path.dirname(filePath), "r");
+        try {
+            fs.fsyncSync(dir);
+        }
+        finally {
+            fs.closeSync(dir);
+        }
+    }
 }
 function delay(ms, signal) {
     return __awaiter(this, void 0, void 0, function* () {
@@ -189,6 +222,7 @@ class StoreLease {
         this.storeDir = storeDir;
         this.released = false;
         this.claimedBy = null;
+        this.exclusiveUseRunning = false;
     }
     static acquireShared(options) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -269,6 +303,9 @@ class StoreLease {
     }
     release() {
         return __awaiter(this, arguments, void 0, function* (options = {}) {
+            if (this.exclusiveUseRunning) {
+                throw new Error("Exclusive store operation must finish before releasing its lease");
+            }
             if (this.released)
                 return;
             if (this.mode === "shared") {
@@ -306,7 +343,82 @@ class StoreLease {
         if (this.claimedBy === holder)
             this.claimedBy = null;
     }
+    /** Hold verified cross-process exclusion through a destructive helper and its
+     * verification. A local write gate is not a substitute for this ownership. */
+    withExclusiveUse(storeDir, operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.exclusiveUseRunning) {
+                throw new Error("An exclusive store operation is already running");
+            }
+            const verify = () => {
+                if (this.mode !== "exclusive" || this.released) {
+                    throw new Error("Pruning requires an unreleased exclusive store lease");
+                }
+                if (fs.realpathSync(storeDir) !== fs.realpathSync(this.storeDir)) {
+                    throw new Error("Exclusive store lease belongs to a different store");
+                }
+                const ownerStat = fs.lstatSync(this.paths.intentOwnerFile);
+                if (!ownerStat.isFile() || ownerStat.size > 16 * 1024) {
+                    throw new Error("Exclusive store lease owner is unverified or oversized");
+                }
+                const current = readOwner(this.paths.intentOwnerFile);
+                if ((current === null || current === void 0 ? void 0 : current.nonce) !== this.owner.nonce ||
+                    current.pid !== this.owner.pid ||
+                    current.processStart !== this.owner.processStart) {
+                    throw new Error("Exclusive store lease ownership could not be verified");
+                }
+                // acquireExclusive has already removed verified stale readers. Refuse any
+                // remaining marker rather than assuming ignored/unknown readers are safe.
+                if (fs
+                    .readdirSync(this.paths.readersDir)
+                    .some((name) => name.endsWith(".json"))) {
+                    throw new Error("Pruning requires all shared store owners to close");
+                }
+            };
+            verify();
+            this.exclusiveUseRunning = true;
+            try {
+                const result = yield operation();
+                verify();
+                return result;
+            }
+            finally {
+                this.exclusiveUseRunning = false;
+            }
+        });
+    }
     /** Atomically replace this shared lease with an exclusive lease. */
+    pinExclusiveHelper(pid) {
+        if (!this.exclusiveUseRunning ||
+            this.owner.activeHelper ||
+            !Number.isSafeInteger(pid) ||
+            pid < 1)
+            throw new Error("Helper requires an active exclusive store operation");
+        const current = readOwner(this.paths.intentOwnerFile);
+        if ((current === null || current === void 0 ? void 0 : current.nonce) !== this.owner.nonce || current.activeHelper)
+            throw new Error("Exclusive store ownership changed before helper launch");
+        // Publish uncertainty first. A failed identity probe must retain exclusion
+        // until this child is confirmed dead, even if the parent is killed.
+        this.owner.activeHelper = { pid, processStart: "unverified" };
+        // The helper is the primary on-disk owner, so older readers also retain
+        // exclusion after parent death. It is blocked on stdin until this identity
+        // is durably verified; uncertainty here cannot admit native deletion.
+        writeOwnerAtomic(this.paths.intentOwnerFile, Object.assign(Object.assign({}, this.owner), { pid, processStart: "unverified" }), true);
+        const start = defaultProbeDeps.processStartOf(pid);
+        if (!start)
+            throw new Error("Prune helper identity unavailable");
+        this.owner.activeHelper.processStart = start;
+        writeOwnerAtomic(this.paths.intentOwnerFile, Object.assign(Object.assign({}, this.owner), { pid, processStart: start }), true);
+        return () => {
+            var _a;
+            const latest = readOwner(this.paths.intentOwnerFile);
+            if ((latest === null || latest === void 0 ? void 0 : latest.nonce) !== this.owner.nonce ||
+                ((_a = latest.activeHelper) === null || _a === void 0 ? void 0 : _a.pid) !== pid)
+                throw new Error("Exclusive store ownership changed during helper close");
+            delete this.owner.activeHelper;
+            writeOwnerAtomic(this.paths.intentOwnerFile, this.owner, true);
+        };
+    }
     upgrade() {
         return __awaiter(this, arguments, void 0, function* (options = {}) {
             if (this.mode !== "shared") {
@@ -328,6 +440,9 @@ class StoreLease {
     /** Replace this exclusive lease with a shared lease without an ownership gap. */
     downgrade() {
         return __awaiter(this, arguments, void 0, function* (options = {}) {
+            if (this.exclusiveUseRunning) {
+                throw new Error("Exclusive store operation must finish before downgrading its lease");
+            }
             if (this.mode !== "exclusive") {
                 throw new Error("Only an exclusive store lease can be downgraded");
             }

package/dist/lib/utils/host-resource.js

@@ -132,7 +132,7 @@ function parseBatchFootprints(output) {
 function sampleHostResources(extraPids = [], overrides = {}, extraGroups = []) {
     var _a;
     var _b, _c;
-    const deps = Object.assign({ platform: process.platform, pid: process.pid, uid: (_b = (_a = process.getuid) === null || _a === void 0 ? void 0 : _a.call(process)) !== null && _b !== void 0 ? _b : -1, now: Date.now, monotonic: () => performance.now(), freeBytes: os.freemem, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
+    const deps = Object.assign({ platform: process.platform, pid: process.pid, uid: (_b = (_a = process.getuid) === null || _a === void 0 ? void 0 : _a.call(process)) !== null && _b !== void 0 ? _b : -1, now: Date.now, monotonic: () => performance.now(), freeBytes: os.freemem, sampleTimeoutMs: exports.HOST_SAMPLE_TIMEOUT_MS, kernelProbeTimeoutMs: 500, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
             encoding: "utf8",
             timeout: timeoutMs,
             maxBuffer: 512 * 1024,
@@ -153,7 +153,7 @@ function sampleHostResources(extraPids = [], overrides = {}, extraGroups = []) {
     };
     if (deps.platform !== "darwin")
         return snapshot;
-    const deadline = deps.monotonic() + exports.HOST_SAMPLE_TIMEOUT_MS;
+    const deadline = deps.monotonic() + deps.sampleTimeoutMs;
     const run = (command, args, maximumMs = 500) => {
         const remaining = Math.floor(deadline - deps.monotonic());
         if (remaining <= 0)
@@ -167,7 +167,7 @@ function sampleHostResources(extraPids = [], overrides = {}, extraGroups = []) {
     }
     catch (_d) { }
     try {
-        const zone = (0, kernel_zone_1.parseZprintOutput)(run("zprint", ["-L", "data.kalloc.1024"]));
+        const zone = (0, kernel_zone_1.parseZprintOutput)(run("zprint", ["-L", "data.kalloc.1024"], deps.kernelProbeTimeoutMs));
         if (zone) {
             const bytes = zone.elements * zone.elementSize;
             if (Number.isSafeInteger(bytes)) {

package/dist/lib/utils/resource-budget.js

@@ -75,7 +75,7 @@ function resolveResourceBudgetMb(raw = process.env.GMAX_RESOURCE_BUDGET_MB) {
         throw new ResourceAdmissionError("resource budget must be 256..6144 MiB");
     return n;
 }
-function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now()) {
+function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now(), sampleMaxAgeMs = 5000) {
     if (snapshot.memoryPressure === "critical" ||
         snapshot.kernelPressure === "critical")
         throw new ResourceAdmissionError("critical host pressure; heavy work refused", true);
@@ -84,7 +84,7 @@ function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now())
     if (snapshot.platform !== "darwin")
         return;
     if (now < snapshot.at ||
-        now - snapshot.at > 5000 ||
+        now - snapshot.at > sampleMaxAgeMs ||
         snapshot.completedAt < snapshot.at ||
         snapshot.completedAt > now)
         throw new ResourceAdmissionError("resource sample stale or clock changed; heavy work paused");
@@ -107,8 +107,8 @@ class ResourceBudget {
     constructor(overrides = {}) {
         this.deps = Object.assign({ root: path.join(config_1.PATHS.sharedRoot, "resource-budget"), platform: process.platform, pid: process.pid, now: Date.now, sample: (extraPids = []) => {
                 const records = this.readRecords();
-                return (0, host_resource_1.sampleHostResources)([...records.map((r) => r.pid), ...extraPids], {}, records.flatMap((r) => (r.groupPid ? [r.groupPid] : [])));
-            }, signal: (pid) => process.kill(pid, 0), policy: host_guard_policy_1.hostGuardPolicy, criticalSample: host_guard_policy_1.sampleCriticalPressure, quarantine: autostart_1.daemonStartDeniedReason, latch: safety_latch_1.latchSafetyStop, processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
+                return (0, host_resource_1.sampleHostResources)([...records.map((r) => r.pid), ...extraPids], this.deps.samplerOverrides, records.flatMap((r) => (r.groupPid ? [r.groupPid] : [])));
+            }, signal: (pid) => process.kill(pid, 0), policy: host_guard_policy_1.hostGuardPolicy, requireClientRegistration: true, samplerOverrides: {}, sampleMaxAgeMs: 5000, criticalSample: host_guard_policy_1.sampleCriticalPressure, quarantine: autostart_1.daemonStartDeniedReason, latch: safety_latch_1.latchSafetyStop, processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
                 encoding: "utf8",
                 timeout: 500,
                 maxBuffer: 1024,
@@ -250,10 +250,10 @@ class ResourceBudget {
     }
     checked(snapshot, records) {
         try {
-            assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now());
+            assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now(), this.deps.sampleMaxAgeMs);
             const legacy = snapshot.processes.filter((p) => p.role === "mcp" &&
                 !records.some((r) => r.pid === p.pid && r.kind === "client"));
-            if (legacy.length)
+            if (legacy.length && this.deps.requireClientRegistration)
                 throw new ResourceAdmissionError(`${legacy.length} MCP client(s) need to reconnect after upgrading; heavy work paused`);
         }
         catch (error) {