feat: self-upgrading MCP supervisor, permanent daemon residency, and a repo health pass

[githubrobbi]

Twelve commits in three themes. Every commit was validated locally before push (strict clippy on the pinned and floating-nightly toolchains, cross-target clippy for x86_64-pc-windows-msvc, all 2424 tests, and the full lint-pre-push gate including cargo-vet and the audit-discipline check).

Closes #584 and #587 via commit trailers.

1 — Zero-downtime MCP binary swaps

uffsmcp stdio mode is now fronted by a supervisor that owns the client's pipes for the whole session and serves through a hidden --worker child it can replace. When the binary on disk is swapped (an installer, just use-local), a ticker notices the changed (len, mtime) identity, waits for a quiet moment with nothing in flight, spawns a fresh worker, replays the captured initialize/initialized handshake (swallowing the duplicate response), reroutes traffic, kills the predecessor, and nudges the client with notifications/tools/list_changed.

The AI host's MCP connection never drops — a new binary can be swapped in without restarting any downstream session. The same replay path restarts a crashed worker, rate-limited to 3 crashes/60s. It is deliberately a byte pump, not a re-framing proxy: each JSON-RPC line is parsed only enough to classify it, and the original bytes are always forwarded. Plain std::process + threads, so no async runtime in the supervisor process and identical behavior on Windows.

An end-to-end test drives a real session across a simulated binary replacement over real pipes and asserts two different worker PIDs on the same connection plus the list_changed nudge.

Overrides: UFFS_MCP_WORKER_EXE, UFFS_MCP_WATCH_PATH, UFFS_MCP_POLL_MS.

2 — Permanent residency (uffs --daemon resident)

The tiering ladder's final rung (idle auto-retire) removed uffsd from the process list, so the next search paid a full restart. resident on registers a per-user login item — Windows HKCU Run key, macOS launchd LaunchAgent with KeepAlive.SuccessfulExit=false, Linux systemd user unit with Restart=on-failure — starting uffsd --no-retire, and starts the daemon immediately when none is running.

Windows deliberately uses the Run key rather than a scheduled task or service: it needs no Administrator, so the non-elevated resident daemon keeps reading the MFT through the Access Broker and the zero-UAC story is preserved end to end. The elevation gate exempts resident explicitly, since it only touches per-user artifacts.

Residency also survives crashes and manual stops on every platform via an auto-spawn marker (resident.args, beside the PID file). Every implicit daemon spawn merges it in at the single spawn_daemon choke point, so a revived daemon keeps --no-retire. Merging is conservative and unit-tested: caller flags always win, marker flag groups append only when absent, and ephemeral --ephemeral-id instances pass through untouched so a snapshot daemon can never inherit --no-retire and leak.

3 — Repo health pass

Nightly canary (#584). Two independent regressions on the floating nightly. min_ident_chars briefly extended to macro-generated single-letter constants and tripped on the DriveLetter A–Z constants — which are the domain model; that is now declared posture via allowed-idents-below-min-chars so the same churn cannot break the canary again, without weakening the lint elsewhere. It did catch one genuine offender: BloomFilter::k() → hash_count(). Separately, the new pedantic assert_is_empty lint: all 36 assert!(x.is_empty()) sites across 20 files became typed assert_eq!/assert_ne! so failures print the offending value — a test-quality upgrade, no suppressions. A redundant_field_names firing inside thiserror 2.0.19's generated code was fixed at the dependency level (2.0.20), per the ethnum precedent.

Dependency refresh. clap 4.6.6, futures 0.3.34, globset 0.4.20, rmcp 3.1.2, devicons 0.6.13, plus the darling 0.24 train. Every non-trusted delta got a real source-diff review recorded as a cargo-vet delta audit with Vet-Reviewed-Diff trailers (15 new audits; exemptions 238 → 234).

Toolchain pin 2026-07-23 → 2026-08-11, taken via just toolchain-sync, which gates on host clippy plus Windows (cargo-xwin) and Linux (cargo-zigbuild) cross-compiles before writing the pin. The canary's green floating-nightly result is exactly the precondition that made this safe.

sccache shim (#587). .cargo/config.toml named sccache directly as build.rustc-wrapper, making the repo unbuildable anywhere sccache is absent — which is why Dependabot's cargo updater has never opened a PR here (four red runs a month) and why fresh clones break before cargo install sccache. The wrapper now points at a shim that forwards to sccache when present and execs rustc directly when not. Verified with the real toolchain cargo, a PATH carrying rustc but not sccache, and a fresh target dir: before → could not execute process 'sccache rustc -vV' (exit 101); after → clean build and a full workspace cargo metadata resolve. With sccache present, sccache --show-stats records the compile requests, so caching is genuinely preserved. Bug B (dev-flow.md §5.2) is unaffected — both cache keys still live together in one atomic config; only the wrapper's value moved behind the shim.

Advisory bookkeeping. Corrected the standing assumption that a polars bump would clear the two quick-xml advisories: object_store 0.14.1 does now require the fixed quick-xml ^0.41, but polars-io still pins object_store ^0.13.1 even in polars 0.55.2, so the blocker is entirely upstream. Reachability remains nil (cloud-store XML LIST parsing; UFFS never touches a cloud object path).