Fix Windows daemon compatibility, lifecycle-lock race, and schema confidence gate

CodeAbra · CodeAbra · commit 47f7175dfd28 · 2026-07-11T12:31:28.000-07:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.3] — 2026-07-11
+
+### Fixed
+
+- **Windows daemon compatibility.** The background daemon now starts, stops, and
+  reports its own liveness correctly on Windows — shutdown terminates the whole
+  process tree so the store lock is released, the encryption key file is written
+  in binary mode and replaced atomically, and file locking uses a Windows-native
+  region lock so the store package imports and runs.
+- **Duplicate-daemon race.** The lifecycle lock is now claimed atomically, so two
+  processes starting at the same time can no longer both become the daemon.
+- **Schema confidence gate.** Mid-confidence memory-schema patterns now correctly
+  reach the user-approval path instead of being dropped.
+
 ## [2.0.2] — 2026-07-11
 
 ### Added
diff --git a/README.md b/README.md
@@ -9,7 +9,7 @@
 <p align="center"><b>Persistent memory for any MCP client.</b> Local, encrypted, verbatim recall via vector search + knowledge graph. MIT.</p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/release-v2.0.0-1f6feb?style=flat-square" alt="Release v2.0.0">
+  <img src="https://img.shields.io/badge/release-v2.0.3-1f6feb?style=flat-square" alt="Release v2.0.3">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-1f6feb?style=flat-square" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%20|%203.12-3776ab?style=flat-square&logo=python&logoColor=white" alt="Python 3.11 | 3.12">
   <img src="https://img.shields.io/badge/platform-macOS%20|%20Linux-555?style=flat-square" alt="Platform: macOS and Linux">
diff --git a/README_zh-CN.md b/README_zh-CN.md
@@ -14,7 +14,7 @@
 <p align="center">每一项声明都附带可复现的基准测试脚本。你可以自己跑一遍验证。</p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/release-v2.0.0-1f6feb?style=flat-square" alt="Release v2.0.0">
+  <img src="https://img.shields.io/badge/release-v2.0.3-1f6feb?style=flat-square" alt="Release v2.0.3">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-1f6feb?style=flat-square" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%20|%203.12-3776ab?style=flat-square&logo=python&logoColor=white" alt="Python 3.11 | 3.12">
   <img src="https://img.shields.io/badge/platform-macOS%20|%20Linux-555?style=flat-square" alt="Platform: macOS and Linux">
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "iai-mcp"
-version = "2.0.0"
+version = "2.0.3"
 description = "MCP server giving Claude persistent autistic-style memory + learning"
 requires-python = ">=3.11,<3.13"
 dependencies = [
diff --git a/src/iai_mcp/_flock.py b/src/iai_mcp/_flock.py
@@ -0,0 +1,42 @@
+"""flock() compatibility seam.
+
+POSIX re-exports ``fcntl.flock`` and its constants verbatim. Windows maps the
+same surface onto an ``msvcrt`` 1-byte region lock: every holder locks the
+first byte, which is all flock's whole-file-mutex semantics need. Windows has
+no shared locks — ``LOCK_SH`` degrades to exclusive, and ``SHARED_IS_EXCLUSIVE``
+tells lock-mode transitions (shared→exclusive and back) to relabel their
+bookkeeping instead of re-locking a region this process already owns (a
+same-process re-lock raises on Windows). A non-blocking failure is re-raised
+with ``EAGAIN`` so POSIX-shaped retry loops work unchanged.
+"""
+from __future__ import annotations
+
+try:
+    from fcntl import LOCK_EX, LOCK_NB, LOCK_SH, LOCK_UN, flock  # noqa: F401
+
+    SHARED_IS_EXCLUSIVE = False
+except ImportError:  # Windows
+    import errno as _errno
+    import msvcrt as _msvcrt
+    import os as _os
+
+    LOCK_SH = 0x1
+    LOCK_EX = 0x2
+    LOCK_NB = 0x4
+    LOCK_UN = 0x8
+    SHARED_IS_EXCLUSIVE = True
+
+    def flock(fd: int, operation: int) -> None:
+        _os.lseek(fd, 0, _os.SEEK_SET)
+        if operation & LOCK_UN:
+            try:
+                _msvcrt.locking(fd, _msvcrt.LK_UNLCK, 1)
+            except OSError:
+                # flock(LOCK_UN) on an unheld lock is a no-op; mirror that.
+                pass
+            return
+        mode = _msvcrt.LK_NBLCK if operation & LOCK_NB else _msvcrt.LK_LOCK
+        try:
+            _msvcrt.locking(fd, mode, 1)
+        except OSError as exc:
+            raise OSError(_errno.EAGAIN, "lock held (msvcrt)") from exc
diff --git a/src/iai_mcp/cli/_daemon.py b/src/iai_mcp/cli/_daemon.py
@@ -284,10 +284,10 @@ def cmd_daemon_stop(args: argparse.Namespace) -> int:
     except (OSError, ValueError, RuntimeError) as exc:
         logger.debug("sentinel write failed (non-blocking): %s", exc)
 
-    uid = os.getuid()
     if _cli._is_macos():
         from iai_mcp.lifecycle_lock import LifecycleLock, _is_pid_alive
 
+        uid = os.getuid()
         payload = LifecycleLock().read()
         pid = payload["pid"] if payload else None
 
@@ -324,6 +324,19 @@ def cmd_daemon_stop(args: argparse.Namespace) -> int:
             ["systemctl", "--user", "stop", _cli.SERVICE_NAME],
             check=False,
         )
+    elif os.name == "nt":
+        # Windows: signals cannot stop the tree — a plain terminate orphans
+        # the child that still holds the hippo lock. taskkill /T fells the
+        # whole process tree; /F because there is no SIGTERM grace concept.
+        from iai_mcp.lifecycle_lock import LifecycleLock, _is_pid_alive
+
+        payload = LifecycleLock().read()
+        pid = payload["pid"] if payload else None
+        if pid is not None and _is_pid_alive(pid):
+            _cli.subprocess.run(
+                ["taskkill", "/F", "/T", "/PID", str(pid)],
+                check=False, capture_output=True,
+            )
     else:
         print(f"Unsupported OS: {platform.system()}", file=sys.stderr)
         return 1
diff --git a/src/iai_mcp/crypto.py b/src/iai_mcp/crypto.py
@@ -221,14 +221,18 @@ def _try_file_set(self, key: bytes) -> None:
             except OSError:
                 pass
         tmp = final.parent / f"{final.name}.tmp.{os.getpid()}"
-        fd = os.open(str(tmp), os.O_CREAT | os.O_EXCL | os.O_WRONLY, 0o600)
+        # O_BINARY: without it the Windows CRT opens the fd in text mode and
+        # rewrites any 0x0A key byte as 0x0D0A — a silently corrupted AES key.
+        flags = os.O_CREAT | os.O_EXCL | os.O_WRONLY | getattr(os, "O_BINARY", 0)
+        fd = os.open(str(tmp), flags, 0o600)
         try:
-            os.fchmod(fd, 0o600)
+            if hasattr(os, "fchmod"):
+                os.fchmod(fd, 0o600)
             os.write(fd, key)
             os.fsync(fd)
         finally:
             os.close(fd)
-        os.rename(str(tmp), str(final))
+        os.replace(str(tmp), str(final))
 
 
     def get_or_create(self) -> bytes:
diff --git a/src/iai_mcp/daemon/_watchdog.py b/src/iai_mcp/daemon/_watchdog.py
@@ -620,7 +620,11 @@ def _self_kill(reason: str, kind: str) -> None:
         _write_breadcrumb(line)
     except Exception:  # noqa: BLE001 -- breadcrumb is best-effort ONLY
         pass
-    os.kill(os.getpid(), signal.SIGKILL)
+    if hasattr(signal, "SIGKILL"):
+        os.kill(os.getpid(), signal.SIGKILL)
+    # No SIGKILL on this platform (Windows): os.kill from a background thread
+    # cannot deliver it, so a wedged daemon would never die — hard-exit.
+    os._exit(1)
 
 
 def _capture_blackbox(
diff --git a/src/iai_mcp/hippo/__init__.py b/src/iai_mcp/hippo/__init__.py
@@ -3,7 +3,7 @@
 import contextlib
 import enum
 import errno
-import fcntl
+from iai_mcp import _flock as fcntl
 import logging
 import os
 import re
diff --git a/src/iai_mcp/hippo/_db.py b/src/iai_mcp/hippo/_db.py
@@ -4,7 +4,7 @@
 
 import contextlib
 import errno
-import fcntl
+from iai_mcp import _flock as fcntl
 import logging
 import os
 import re
@@ -788,10 +788,17 @@ def downgrade_to_shared(self) -> None:
             if held is None:
                 return
             base_fd, refcount = held
-            try:
-                fcntl.flock(base_fd, fcntl.LOCK_SH)
-            except OSError:
-                return
+            if fcntl.SHARED_IS_EXCLUSIVE:
+                # No shared locks on this platform: a re-lock of the region
+                # this process already owns raises (and a blocking one polls
+                # forever against itself) — keep the held exclusive region and
+                # change only the bookkeeping label.
+                pass
+            else:
+                try:
+                    fcntl.flock(base_fd, fcntl.LOCK_SH | fcntl.LOCK_NB)
+                except OSError:
+                    return
             del _PROCESS_LOCKS[self._lock_key]
             _PROCESS_LOCKS_SHARED[self._lock_key] = (base_fd, refcount)
         self._access_mode = AccessMode.SHARED
@@ -843,7 +850,11 @@ def escalate_to_exclusive(self, intent_budget_ms: int = 4000) -> None:
 
         deadline = time.monotonic() + intent_budget_ms / 1000.0
         acquired = False
-        while time.monotonic() < deadline:
+        if held is not None and fcntl.SHARED_IS_EXCLUSIVE:
+            # The "shared" label on this platform already holds the exclusive
+            # region — re-locking it would fail against ourselves. Relabel.
+            acquired = True
+        while not acquired and time.monotonic() < deadline:
             try:
                 fcntl.flock(base_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
                 acquired = True
diff --git a/src/iai_mcp/lifecycle_lock.py b/src/iai_mcp/lifecycle_lock.py
@@ -4,7 +4,6 @@
 import logging
 import os
 import socket
-import tempfile
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import TypedDict
@@ -50,23 +49,43 @@ def _is_pid_alive(pid: int) -> bool:
     if pid <= 0:
         return False
 
-    try:
-        os.kill(pid, 0)
-    except ProcessLookupError:
-        return False
-    except PermissionError:
-        return True
-
     try:
         import psutil
     except ImportError:
+        psutil = None
+
+    if psutil is None:
+        # POSIX-only probe: on Windows os.kill(pid, 0) raises OSError
+        # (WinError 87) for a HEALTHY pid — a healthy daemon would read as
+        # dead. psutil (a hard dependency) is the reliable path; this branch
+        # survives only for a stripped environment.
+        try:
+            os.kill(pid, 0)
+        except ProcessLookupError:
+            return False
+        except PermissionError:
+            return True
+        except OSError:
+            # Unreliable probe result — never declare death on it.
+            return True
         log.debug(
             "lifecycle_lock: psutil unavailable; falling back to "
             "os.kill-only liveness for pid=%d",
             pid,
         )
         return True
 
+    try:
+        if not psutil.pid_exists(pid):
+            return False
+    except Exception:  # noqa: BLE001 -- defensive against psutil backend quirks
+        log.debug(
+            "lifecycle_lock: psutil.pid_exists(%d) raised; assuming live",
+            pid,
+            exc_info=True,
+        )
+        return True
+
     try:
         proc = psutil.Process(pid)
         cmdline = " ".join(proc.cmdline() or [])
@@ -148,44 +167,63 @@ def is_held_by_self(self) -> bool:
         )
 
     def acquire(self) -> None:
-        existing = self.read()
-        if existing is not None:
-            if existing["hostname"] == _current_hostname() and _is_pid_alive(
-                existing["pid"]
-            ):
-                raise LifecycleLockConflict(
-                    f"daemon already running: pid={existing['pid']} "
-                    f"hostname={existing['hostname']} "
-                    f"started_at={existing['started_at']}",
-                    existing=existing,
-                )
-
+        # Atomic claim: O_CREAT|O_EXCL means exactly ONE racer creates the
+        # file. The prior read->check->replace shape let two daemons both
+        # pass the liveness check and both install their payload — a
+        # double-writer on the same store. A stale lock (dead pid, corrupt
+        # payload) is unlinked and the claim retried; only one racer wins the
+        # recreate.
         payload: LockPayload = {
             "pid": os.getpid(),
             "hostname": _current_hostname(),
             "started_at": _utc_now_iso(),
             "schema_version": SCHEMA_VERSION,
         }
-
         self._lock_path.parent.mkdir(parents=True, exist_ok=True)
-        fd, tmp = tempfile.mkstemp(
-            prefix=".locked.",
-            suffix=".tmp",
-            dir=str(self._lock_path.parent),
-        )
-        try:
-            with os.fdopen(fd, "w") as f:
-                json.dump(payload, f, indent=2)
-                f.flush()
-                os.fsync(f.fileno())
-            os.chmod(tmp, 0o600)
-            os.replace(tmp, self._lock_path)
-        except (OSError, TypeError, ValueError):
+
+        for _attempt in range(3):
+            try:
+                fd = os.open(
+                    str(self._lock_path),
+                    os.O_CREAT | os.O_EXCL | os.O_WRONLY,
+                    0o600,
+                )
+            except FileExistsError:
+                existing = self.read()
+                if existing is not None:
+                    if existing["hostname"] == _current_hostname() and _is_pid_alive(
+                        existing["pid"]
+                    ):
+                        raise LifecycleLockConflict(
+                            f"daemon already running: pid={existing['pid']} "
+                            f"hostname={existing['hostname']} "
+                            f"started_at={existing['started_at']}",
+                            existing=existing,
+                        )
+                # Stale or unreadable: clear it and retry the atomic claim.
+                try:
+                    os.unlink(self._lock_path)
+                except FileNotFoundError:
+                    pass
+                continue
             try:
-                os.unlink(tmp)
-            except OSError:
-                pass
-            raise
+                with os.fdopen(fd, "w") as f:
+                    json.dump(payload, f, indent=2)
+                    f.flush()
+                    os.fsync(f.fileno())
+            except (OSError, TypeError, ValueError):
+                try:
+                    os.unlink(self._lock_path)
+                except OSError:
+                    pass
+                raise
+            return
+
+        raise LifecycleLockConflict(
+            "lifecycle lock claim lost three consecutive races; "
+            "another daemon is starting on this store",
+            existing=self.read(),
+        )
 
     def release(self) -> None:
         try:
diff --git a/src/iai_mcp/lilli/cycle/schema.py b/src/iai_mcp/lilli/cycle/schema.py
@@ -75,12 +75,14 @@ def induce_schemas_tier0(store: MemoryStore) -> list[SchemaCandidate]:
         count = len(evidence)
         confidence = min(1.0, count / 10.0)
         pattern = f"tags:{'+'.join(sorted(pair))}"
+        # Confidence IS count/10 — re-checking both in one band anchors the
+        # gate to itself: the approval tier demanded confidence >= 0.65 of
+        # counts capped below 5 (max 0.4), so it could never fire, and counts
+        # between the bands dropped entirely. Auto keeps the double gate;
+        # everything else with enough co-occurrence goes to the human.
         if count >= AUTO_INDUCT_COOCCURRENCE and confidence >= AUTO_INDUCT_CONFIDENCE:
             status = "auto"
-        elif (
-            USER_APPROVAL_COOCCURRENCE <= count < AUTO_INDUCT_COOCCURRENCE
-            and confidence >= USER_APPROVAL_CONFIDENCE
-        ):
+        elif count >= USER_APPROVAL_COOCCURRENCE:
             status = "pending_user_approval"
         else:
             continue
diff --git a/src/iai_mcp/lock_protocol.py b/src/iai_mcp/lock_protocol.py
@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import errno
-import fcntl
+from iai_mcp import _flock as fcntl
 import logging
 import os
 from pathlib import Path
diff --git a/tests/test_schema_induction.py b/tests/test_schema_induction.py
diff --git a/tests/test_schema_induction_streaming.py b/tests/test_schema_induction_streaming.py
