Sam Valladares c12120b78a fix(autopilot): supervisor + dedup race + opt-out env var ... Three blockers from the 5-agent v2.0.9 audit, all in autopilot.rs. 1. Supervisor loops around both tokio tasks (event subscriber + prospective poller). Previously, if a cognitive hook panicked on a single bad memory, the spawned task died permanently and silently — every future event lost. Now the outer supervisor catches JoinError::is_panic(), logs the panic with full error detail, sleeps 5s, and respawns the inner task. Turns a permanent silent failure into a transient hiccup. 2. DedupSweepState struct replaces the bare Option<Instant> timestamp. It tracks the in-flight JoinHandle so the next Heartbeat skips spawning a second sweep while the first is still running. Previously, the cooldown timestamp was set BEFORE spawning the async sweep, which allowed two concurrent find_duplicates scans on 100k+ memory DBs where the sweep could exceed the 6h cooldown window. is_running() drops finished handles so a long-dead sweep doesn't block the next legitimate tick. 3. VESTIGE_AUTOPILOT_ENABLED=0 opt-out. v2.0.8 users updating in place can preserve the passive-library contract by setting the env var to any of {0, false, no, off}. Any other value (unset, 1, true, etc.) enables the default v2.0.9 Autopilot behavior. spawn() early-returns with an info! log before any task is spawned. Audit breakdown: - Agent 1 (internals): NO-GO → fixed (1, 2) - Agent 2 (backward compat): NO-GO → fixed (3) - Agent 3 (orphan cleanup): GO clean - Agent 4 (runtime safety): GO clean - Agent 5 (release prep): GO, procedural note logged Verification: - cargo check -p vestige-mcp: clean - cargo test -p vestige-mcp --lib: 373 passed, 0 failed - cargo clippy -p vestige-mcp --lib --bins -- -D warnings: clean		2026-04-24 01:43:45 -05:00
..
vestige-core	chore: remove 3,091 LOC of orphan code + fix ghost env-var docs	2026-04-23 03:18:53 -05:00
vestige-mcp	fix(autopilot): supervisor + dedup race + opt-out env var	2026-04-24 01:43:45 -05:00