fix(mcp_server): lazy-init WAL to preserve _palace_root_exists() kill switch (#1676)

[ggettert]

Summary

Fixes MemPalace#1676. The kill switch added in MemPalace#1305 (hooks_cli._palace_root_exists()) was silently defeated by module-level _WAL_DIR.mkdir(parents=True, exist_ok=True) in mcp_server.py. Importing the MCP server unconditionally recreated ~/.mempalace/, so any user who removed the directory as a kill-switch gesture got it back as soon as the MCP server ran.

This PR moves the WAL setup (directory creation, chmod, file open) out of module scope into a lazy initializer (_ensure_wal()) called from _wal_log() — the single write path. Module import no longer touches disk. The kill-switch contract is preserved without mcp_server.py needing to know about it.

What changed

• mempalace/mcp_server.py (+30 / -13): module-level mkdir / chmod / WAL file open removed. Replaced with _ensure_wal() lazy initializer + _wal_initialized guard, called from the start of _wal_log(). Behavior is identical on first WAL write; subsequent writes short-circuit via the guard.
• tests/test_mcp_server.py (+47): new regression test asserting ~/.mempalace/ stays absent after import mempalace.mcp_server when HOME points at an empty temp dir.

Real behavior proof

Pre-fix reproduction (against develop HEAD, before this PR)

$ rm -rf /tmp/test-home/.mempalace
$ HOME=/tmp/test-home python -c "from mempalace.hooks_cli import _palace_root_exists; print('before:', _palace_root_exists())"
before: False
$ HOME=/tmp/test-home python -c "import mempalace.mcp_server"
$ HOME=/tmp/test-home python -c "from mempalace.hooks_cli import _palace_root_exists; print('after:', _palace_root_exists())"
after: True
$ ls /tmp/test-home/.mempalace/
wal/

Kill switch defeated by the import.

Post-fix reproduction (this branch)

$ rm -rf /tmp/test-home/.mempalace
$ HOME=/tmp/test-home python -c "from mempalace.hooks_cli import _palace_root_exists; print('before:', _palace_root_exists())"
before: False
$ HOME=/tmp/test-home python -c "import mempalace.mcp_server"
$ HOME=/tmp/test-home python -c "from mempalace.hooks_cli import _palace_root_exists; print('after:', _palace_root_exists())"
after: False
$ ls /tmp/test-home/.mempalace/ 2>&1
ls: cannot access '/tmp/test-home/.mempalace/': No such file or directory

Kill switch holds across the import.

Test suite

$ uv run pytest tests/test_mcp_server.py::test_mcp_server_import_does_not_create_palace_root -v
... PASSED [1.34s]

$ uv run pytest tests/ -v
========== 2278 passed, 3 skipped in 229.42s (0:03:49) ==========

No regressions. The new test passes. WAL is exercised via the existing _wal_log test paths in the rest of the suite (which create the WAL dir on demand, as designed by this PR).

Not tested

• Multi-process WAL contention. The lazy init still uses mkdir(exist_ok=True) + O_CREAT|O_WRONLY on the file, so two processes racing the first write would both succeed and converge — same race semantics as before this PR (the mkdir(parents=True, exist_ok=True) at module load was already serialised through filesystem atomicity, not application-level locking). No change in this PR's footprint.
• Behaviour when ~/.mempalace exists as a regular file or broken symlink. Same as before: _WAL_DIR.mkdir would raise; the existing _palace_root_exists() already uses is_dir() to defend against that case in hooks; _wal_log is unprotected against it both before and after this PR. Out of scope.

Why this shape (and not a broader refactor)

Option (2) in the issue (shared kill_switch.py module + cross-module test) is the right long-term answer if the kill switch needs to be enforced across more code paths in future. Keeping this PR minimal:

• Single file with the disk side effect = single fix
• One additional test asserting no top-level disk side effect on import
• No new module surface, no behaviour change for any caller that exercises _wal_log

If maintainers prefer the shared-module approach, happy to extend.

Related

• Bug: MCP server module-level mkdir defeats _palace_root_exists() kill switch MemPalace/mempalace#1676 (issue)
• fix(hooks): treat absent ~/.mempalace as auto-save off MemPalace/mempalace#1305 (introduced _palace_root_exists() on the hooks side)
• test: test_hooks_cli.py tests fail in isolation — hidden test-order dependency on test_cli.py creating ~/.mempalace MemPalace/mempalace#1510 / test(hooks): isolate test_hooks_cli from test_cli side effect (#1510) MemPalace/mempalace#1547 (test-isolation manifestation of the same pattern — same ~/.mempalace auto-creation gotcha, fixed in the test layer)
• Add lock/kill-switch guidance for autosave and MCP hook wrappers MemPalace/mempalace#504 (broader kill-switch guidance request)

Closes MemPalace#1676.

[Copilot]

Pull request overview

This PR fixes a regression where importing mempalace.mcp_server could recreate ~/.mempalace/, inadvertently defeating the documented hooks kill switch (hooks_cli._palace_root_exists()), by moving WAL directory/file setup from module import time to a lazy initializer invoked on first WAL write.

Changes:

• Reworked WAL initialization in mempalace/mcp_server.py to be lazy (_ensure_wal()), preventing import-time filesystem side effects.
• Added a regression test ensuring import mempalace.mcp_server does not create ~/.mempalace/ when HOME points to an empty temp directory.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
mempalace/mcp_server.py	Removes import-time WAL directory/file creation; initializes WAL on first _wal_log() call.
tests/test_mcp_server.py	Adds subprocess regression test ensuring MCP server import does not recreate the palace root directory.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ggettert]

Closing in favor of MemPalace#1678 — same lazy-init fix, with broader test coverage. Tracked from MemPalace#1676.