fix(memory): only unlink serve.port files that still hold our own port

[KM-IA-Agency]

Problem

When several cce serve processes run for the same project (one per agent session, or e.g. Claude Code and Codex on the same repo), each start overwrites serve.port and the rendezvous file ~/.cce/projects/<name>/serve.port with its own port. On graceful exit, _unlink_port_files removed both files unconditionally.

So as soon as an older server exited, the newer one kept running with no rendezvous: cce_hook.cmd / the hook script found no port and silently dropped every captured turn until the next server start. In our setup (six concurrent cce serve on one repo), live memory capture was mostly dead for four days without any visible error.

Fix

_unlink_port_files now removes a port file only when it still contains this server's bound port. The bound port is kept in a closure because the aiohttp app is frozen once the runner is set up.

Unchanged: the single-server case (files are still removed on exit, the existing tests pass), tolerance of files already removed, and the storage == rendezvous layout.

Tests

• New test_cleanup_leaves_port_files_owned_by_another_server: two servers on one project; stopping the first must leave the second's port in both files, and stopping the second removes them.
• tests/memory/test_hook_server_cleanup.py: 4 passed with the fix; the new test fails without it (1 failed, 3 passed). Run locally on Windows / Python 3.13 with -n0; I have not run the full suite locally.

Not covered

SIGKILL still bypasses on_cleanup, so a killed server leaves a stale file. That is the existing #66 limit, handled by the socket-liveness probe in the hook script.

Update: cross-process lock (review feedback)

The ownership check and the unlink were not atomic across processes: a peer could publish between them. Publication (_publish_port) and the compare-and-delete now share one cross-process lock on <storage_base>/serve.port.lock (fcntl on POSIX, msvcrt on Windows), bounded to 2 s. On timeout, cleanup leaves the files rather than risk deleting a peer's rendezvous.

New regression test_peer_publishing_during_cleanup_keeps_its_rendezvous: a peer publishes between the read and the unlink. It passes with the lock and fails with the lock disabled. tests/memory/test_hook_server_cleanup.py + test_hooks.py: 33 passed locally (Windows / Python 3.13, -n0).

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Concurrent publication between the ownership check and deletion can still cause cleanup to remove a newer server’s rendezvous.

Review effort: Balanced
Findings: 1

Open (1)

• Make rendezvous ownership check and deletion atomic across processes · New

What changed in this PR

Protects memory-hook discovery when multiple cce serve processes share a project.

Changes:

• Records the bound port and checks file ownership before cleanup.
• Adds a two-server regression test for sequential shutdowns.

File	Description
tests/​memory/​test_hook_server_cleanup.py	Tests preservation of a newer server’s port files.
src/​context_engine/​memory/​hook_server.py	Adds ownership checks before deleting port files.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.