@jbarket/loomai 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -12,6 +12,118 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-24
+
+### Added
+
+- **CLI remote mode: `--url` / `LOOM_URL`, and `POST /cli` on loom-http.**
+  The store verbs (`wake`, `recall`, `remember`, `update`, `forget`, `memory`,
+  `knowledge`, `person`) can run against a daemon instead of a local stack,
+  for hooks and scripts on a host or in a container where loom lives
+  elsewhere. The CLI ships argv and stdin to `POST /cli`; the daemon runs the
+  same CLI on its own stack and returns stdout, stderr and the exit code, so
+  output and `--json` match a local run by construction. The bearer token
+  comes from `LOOM_TOKEN_FILE`. The endpoint is full-scope only, needs
+  `LOOM_BEARER_TOKEN` set, refuses browser requests (an `Origin` header or a
+  non-JSON body), and sits behind the same bearer gate and payload cap as
+  MCP. It takes only those verbs (minus `memory recompute-salience` and
+  `memory recall-stats`, which have no MCP tool), refuses `--context-dir` and
+  `--url`, and passes only `LOOM_CLIENT`/`LOOM_MODEL` through from the
+  caller's env.
+
+- **Person cards: `people` + `person_revisions`, eight `person_*` tools,
+  `loom person show|list`, and identity's `people` param.** A card is the
+  condensed current state of one human the agent works with: `where` fields
+  carrying a freshness marker (`[ok]`, `[unverified]`, `[STALE <n>d]`), `how`
+  fields (time zone, mode, who to loop in), descriptive `may` entries each with
+  a source, and a short agent-written summary. One value per field,
+  overwritten in place; every stored change snapshots the previous row (newest
+  10 kept), and every mutation is one `BEGIN IMMEDIATE` transaction. Cards are
+  not an authorization surface: the harness's gating names (`tier`, `field`,
+  `projects`, `scope`, `trust`) are rejected anywhere on a card.
+  `identity({people: [slug, ...]})` adds an `# In the room` block after the
+  tape (≤ 4 cards, 6,500 chars, best-effort). The dossier now says worker
+  bodies must not write cards. Design and acceptance criteria:
+  `docs/specs/person-cards.md` (criteria 1–12; the misfile heuristic, 13, is
+  still to come).
+
+- **Knowledge actor attribution: `pages.author`, `page_revisions.actor`, and a
+  `verifications` table (page_id, verifier, verified_at, outcome,
+  citation_checked).** Previously the only attribution field was
+  `created_by` — free text, meaning "who owns this `ours/` artifact," not
+  "who actually wrote or verified it" — so there was no way to tell who wrote
+  a page's first version, who performed a given body revision, or who has
+  verified a page and found what. `pages.author` is stamped once at creation
+  and never changed by later upserts; `page_revisions.actor` is stamped on
+  every body-replacing write and every history-restore; `verifications` is an
+  attributed audit trail additive to the existing `pages.verified_at` stamp
+  (which stays as the fast single-column freshness field everything else
+  sorts/filters on). All three are resolved server-side, never a free-text
+  tool argument, so no caller can claim another identity's authorship or
+  verification: MCP calls use the connection's identity from
+  `registerKnowledgeTools` ('art' on the main server, the bearer-resolved
+  identity on the knowledge-only service); the CLI and eurorack import use
+  `resolveIdentityName()` (`LOOM_IDENTITY` env override, else the context
+  dir's real basename).
+  `knowledge_verify` gains `outcome` ('confirmed' | 'stale' | 'corrected') and
+  `citation_checked` parameters; `knowledge_history`'s listing now shows who
+  performed each revision and surfaces the page's verification history. (t-675)
+  An outcome of 'stale' is a failed verification: it is recorded in
+  `verifications` but does NOT advance `pages.verified_at`, so a known-wrong
+  page keeps its place at the front of the stale-first queue; the result's
+  new `stamped` flag (and the tool output) says whether the stamp moved.
+
+- **`MemoryMatch` carries `similarity` alongside `relevance`, and `scope`
+  alongside `project`.** `relevance` is now the post-MMR score that actually
+  decided a result's rank — equal to `similarity` (raw cosine) unless MMR
+  re-ranking traded a pick off against ones already selected, in which case
+  the two now diverge and both are visible (modeled on MemoriLabs/Memori's
+  `FactSearchResult.{similarity, rank_score}` split). Separately, every
+  memory now has an effective `scope` ('project' or 'global'): `recall` and
+  `memory similar` exclude a project-scoped memory tagged to a *different*
+  project than the one passed via `--project`/`project`, while global-scoped
+  memories (category default for `user`/`reference`, any untagged memory, or
+  an explicit `scope: "global"` at write time) still come through regardless.
+  Closes the gap where a preference learned on one project could surface
+  while working on an unrelated one. `remember` (MCP tool and `loom remember
+  --scope`) takes an explicit `project | global` override for the categories
+  where the category default can't tell (`self`, `feedback`) — e.g. a
+  security/git/tool-workflow lesson learned in one project but true
+  everywhere. (t-337)
+
+### Fixed
+
+- **All 34 MCP tools now declare `ToolAnnotations`** (`readOnlyHint`,
+  `destructiveHint`, `idempotentHint`, `openWorldHint`), so a client gating
+  approval on these hints (e.g. Codex under `approval: never`) can tell a
+  read from a write instead of refusing every call uniformly. Hints follow
+  actual behavior, not tool-name conventions: `recall`/`knowledge_recall`
+  are NOT read-only (they stamp `last_accessed`/`hit_count`, which
+  `knowledge_maintain` reads to find cold pages); `knowledge_history` and
+  `memory_revision_restore` are destructive in their restore mode even
+  though the displaced body is snapshotted first. `update`,
+  `knowledge_write` and `knowledge_move` are NOT idempotent: a repeated
+  `observation` bumps the evidence count again, a repeated append stores
+  the body twice, and a repeated prefix move into a child of itself
+  (`music` → `music/gear`) nests again. `openWorldHint` is
+  `false` everywhere — loom has no outbound network calls. This does not
+  by itself prove any client relaxes its approval gate on these hints; that
+  needs a live `tools/list` exchange against an updated server (tracked
+  separately). (t-415)
+
+- **`--context-dir` (and the other global flags) now work in front of the
+  subcommand, as the help text has always claimed.** `loom --context-dir DIR
+  knowledge write …` used to route to the stdio MCP server instead of the CLI:
+  the entry point dispatched on `argv[2]`, which was `--context-dir`, not a known
+  verb. The server read an empty stdin and exited 0, so a *write* verb reported
+  success having never entered the write path — and never even reached argument
+  validation, exiting 0 on an invocation that the working flag order rejects with
+  exit 1. Measured against a disposable context dir: no `knowledge.db` was created
+  and no row was written. Both entry points now resolve the subcommand past any
+  leading global flags, skipping flag values in pairs so `--context-dir recall`
+  still names a directory rather than invoking `recall`. Bare
+  `loom --context-dir DIR` with no subcommand remains the MCP path. (t-665)
+
 ## [0.5.0] - 2026-09-04
 
 ### Changed
@@ -462,7 +574,8 @@ Initial public release.
   stack and all added external-service dependencies or operational
   overhead.
 
-[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.5.0...HEAD
+[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/sleepunit-agents/loom/compare/v0.5.0...v0.6.0
 [0.5.0]: https://github.com/sleepunit-agents/loom/compare/v0.4.1...v0.5.0
 [0.4.1]: https://github.com/sleepunit-agents/loom/compare/v0.3.1...v0.4.1
 [0.4.0-alpha.7]: https://github.com/sleepunit-agents/loom/compare/v0.4.0-alpha.6...v0.4.0-alpha.7

package/README.md

@@ -16,6 +16,10 @@ which model or client it runs in.
 
 > When the harness changes, the agent persists.
 
+**See it whole:** [`docs/architecture.md`](docs/architecture.md) maps every
+moving part (entry points, tool wings, backends, stores) and how they
+touch, as diagrams GitHub renders in place.
+
 ## Demo
 
 [![asciicast](https://asciinema.org/a/5bUMXCLmCRc8lg51.svg)](https://asciinema.org/a/5bUMXCLmCRc8lg51)
@@ -55,6 +59,20 @@ an agent's persistent state:
 - **`memory_archive` / `memory_restore`** — soft-retire a memory with a
   tombstone (who/when/why + original body preserved) instead of deleting it.
   Archived memories are excluded from recall and audit but remain recoverable.
+- **`memory_merge`** — consolidate 2+ memories into one canonical row. Acts on
+  a `memory_audit` duplicate-finding: sources are archived with a tombstone
+  and a supersession pointer to the target, the target's times-seen counter
+  sums in each source's count, and bodies can optionally be concatenated.
+  Unlike `forget`/`memory_archive` on a duplicate pair, this consolidates
+  both sides into one row instead of only discarding one.
+- **`memory_history`** — body-revision history for a memory. `update()` snapshots
+  the displaced body into `memory_revisions` before overwriting it. List a
+  memory's snapshots (id, op, replaced_at, char count), or read one snapshot's
+  full content by `revision_id`. To put a snapshot back, use
+  `memory_revision_restore`.
+- **`memory_revision_restore`** — restore a snapshotted memory body back onto
+  the memory. Snapshots the current body first, so restore is never destructive.
+  Use `memory_history` to list revision IDs before calling this.
 - **`memory_propose` / `memory_proposals` / `memory_ratify` / `memory_reject`** —
   the capture-propose queue: a staging area a background lane drafts memory
   writes into, that Art ratifies before they become canon. A proposal is **not**
@@ -130,6 +148,18 @@ an agent's persistent state:
   itself a destructive overwrite. Revisions follow the page across renames and
   are purged with it.
 
+- **Person cards** — `person_write`, `person_verify`, `person_archive`,
+  `person_restore`, `person`, `person_list`, `person_history`,
+  `person_revision_restore`. A card is the condensed current state of one human
+  the agent works with (where they are in each system, with a freshness marker;
+  how to work with them; what they were said to be allowed to do, each with a
+  source). One value per field, overwritten; the past lives in revisions. Cards
+  are descriptive, never a grant: the harness's gating names (`tier`, `scope`,
+  …) are rejected on write. `identity({people: [slug, ...]})` adds an
+  `# In the room` block with the cards of the people a turn is addressed by.
+  CLI: `loom person show <slug>` / `loom person list`. Design:
+  `docs/specs/person-cards.md`.
+
 Everything lives on disk as plain markdown plus a single SQLite file.
 No daemon, no external service, no GPU.
 
@@ -276,6 +306,34 @@ must carry a matching `Authorization: Bearer …` header (compared in
 constant time). When unset, the network boundary alone gates access —
 appropriate for a token-less tailnet-only daemon.
 
+### Knowledge-only scope — a second identity without memory tools
+
+`loom serve --http --scope knowledge` starts a second, standalone daemon
+that registers **only** the `knowledge_*` tools — no `identity`,
+`remember`/`recall`, or any other memory-wing tool is on its surface.
+This is how a second identity (e.g. a teammate's agent) can read/write a
+shared knowledge store without ever being handed access to memory. Same
+bind-safety as above; auth is a **per-identity bearer** instead of one
+shared token, so the acting identity is derived from which token was
+presented — never from a request field — and a session is pinned to
+whichever identity opened it.
+
+```bash
+LOOM_KNOWLEDGE_BEARER_TOKENS="art:abc123,mark:def456" \
+  loom serve --http --scope knowledge --port 8788
+```
+
+| Variable | Flag | Default | Description |
+|---|---|---|---|
+| `LOOM_KNOWLEDGE_HTTP_PORT` | `--port` | `8788` | Port to listen on |
+| `LOOM_KNOWLEDGE_BEARER_TOKENS` | — | *(required)* | `"identity:token,identity:token"` — refuses to start if empty |
+
+Both scopes share the same backing store (`knowledge.db` under the
+context dir) and the same tool implementation — the full server (identity
+hardcoded to its own name) and the scoped service go through the exact
+same registration code, so there's no separate "local" code path that
+could drift from the one the scoped service uses.
+
 ### Session and stream behavior
 
 - **One server per session.** Each MCP session (keyed by the
@@ -297,6 +355,34 @@ The connecting client picks its own harness from the MCP handshake
 `clientInfo.name` (see [harness self-describe](#harness-manifests-and-self-describe)),
 so a single daemon serves multiple harnesses correctly.
 
+### The CLI against a remote loom
+
+The store verbs (`wake`, `recall`, `remember`, `update`, `forget`,
+`memory`, `knowledge`, `person`) can run against a daemon instead of a
+local stack, so hooks and scripts that shell out to `loom` keep working
+when loom lives on another host or the agent runs in a container:
+
+```bash
+export LOOM_URL=http://100.94.0.12:8787/mcp      # or --url per call
+export LOOM_TOKEN_FILE=/run/secrets/loom-token   # the bearer token, read from a file
+loom recall "meeting preferences"
+echo "Prefers async updates" | loom remember "working style" --category user --json
+```
+
+The CLI posts the argv (and a `remember`/`update` body from stdin, or from
+your local `$EDITOR`) to `POST /cli` next to the MCP URL. The daemon runs
+the same CLI against its own stack and sends back stdout, stderr and the
+exit code, so output, `--json` and exit codes match a local run. The
+endpoint sits behind the same bearer gate and payload cap as MCP, takes
+only those verbs (each one already has an MCP tool; `memory
+recompute-salience` and `memory recall-stats` have none, so they stay
+local), and refuses
+`--context-dir`: it only serves its own stack. It only exists when
+`LOOM_BEARER_TOKEN` is set, and it refuses browser requests (any `Origin`
+header, or a body that isn't `application/json`). The knowledge-only daemon
+has no `/cli`. Every other command (`doctor`, `inject`, `serve`, …) stays
+local, and `--url` on one of them is an error.
+
 ### Behind a reverse proxy
 
 Terminate TLS at a reverse proxy in front of the daemon and point the
@@ -442,6 +528,10 @@ npx @jbarket/loomai memory proposals --context-dir ~/.config/loom/my-agent
 npx @jbarket/loomai memory ratify 3 --context-dir ~/.config/loom/my-agent
 npx @jbarket/loomai memory reject 4 --context-dir ~/.config/loom/my-agent
 
+# Read a person card (exit 3 when there is none) / list cards and their freshness
+npx @jbarket/loomai person show patrick-kells --context-dir ~/.config/loom/my-agent
+npx @jbarket/loomai person list --context-dir ~/.config/loom/my-agent
+
 # Run loom as an HTTP MCP daemon (mesh-reachable; default stays stdio)
 npx @jbarket/loomai serve --http --host 127.0.0.1 --port 8787
 
@@ -564,6 +654,10 @@ All configuration is through environment variables:
 | `LOOM_HTTP_HOST` | `127.0.0.1` | Bind host for `loom serve --http` (bind-safety enforced) |
 | `LOOM_HTTP_PORT` | `8787` | Bind port for `loom serve --http` |
 | `LOOM_BEARER_TOKEN` | *(unset)* | Bearer token required on every HTTP request when set |
+| `LOOM_URL` | *(unset)* | Run the CLI's store verbs against this loom-http (its MCP URL) instead of a local stack |
+| `LOOM_TOKEN_FILE` | *(unset)* | File holding the bearer token for `LOOM_URL` (never passed in argv) |
+| `LOOM_KNOWLEDGE_HTTP_PORT` | `8788` | Bind port for `loom serve --http --scope knowledge` |
+| `LOOM_KNOWLEDGE_BEARER_TOKENS` | *(unset)* | `"identity:token,identity:token"` — required for `--scope knowledge` |
 
 `--context-dir <path>` works as a CLI alternative to
 `LOOM_CONTEXT_DIR`.
@@ -618,6 +712,9 @@ and `docs/archive/plans/` — implementation history, frozen after merge.
 
 ## Docs
 
+- [`docs/architecture.md`](docs/architecture.md) — loom at a glance:
+  every moving part and how they touch. A contract test fails CI when a
+  new tool, subcommand, backend module or table isn't on it.
 - [`docs/troubleshooting.md`](docs/troubleshooting.md) — install
   failures, MCP tools not appearing, fastembed download issues, and
   what each `loom doctor` field means.

package/dist/backends/dedup.d.ts

@@ -0,0 +1,23 @@
+import type { Database } from 'better-sqlite3';
+export interface UniqKeyInput {
+    category: string;
+    project?: string | null;
+    title: string;
+    content: string;
+    /** Explicit scope override, if any — folded to the effective scope. */
+    scope?: string | null;
+}
+export declare function computeUniqKey(input: UniqKeyInput): string;
+/**
+ * Recompute `uniq` for every row from its current category/project/title/
+ * content with the current computeUniqKey(). Used by the migrations that
+ * introduce or re-key the column.
+ *
+ * Archived rows get NULL — remember() only ever matches active rows, and
+ * restore() recomputes the key when a row comes back. Among active rows,
+ * oldest (lowest id) wins: if several already share a key (an unresolved
+ * historical duplicate), only the first holds it and the rest stay NULL
+ * rather than pointing a future reheat at an arbitrary survivor. Those
+ * clusters are what memory_audit + memory_merge are for.
+ */
+export declare function rebuildUniqKeys(db: Database): void;

package/dist/backends/dedup.js

@@ -0,0 +1,100 @@
+/**
+ * Write-time dedup key for memories (t-335).
+ *
+ * `remember()` always inserted — audit() found near-duplicates after the
+ * fact (embedding similarity) but nothing caught a character-identical
+ * restatement before it became a second row. This gives remember() a cheap
+ * floor underneath audit/MMR: normalize and hash category+project+title+content,
+ * so an exact restatement collides with the existing row's `uniq` value and
+ * reheats it instead of inserting.
+ *
+ * Normalization is deliberately minimal (PR120 review, two rounds). The key
+ * must only fold differences that can never change what a memory says, and
+ * almost every character can: a sign ("-5" vs "5"), a decimal point ("1.5"
+ * vs "15"), a hyphen in an identifier ("foo-bar" vs "foobar"), a space
+ * ("foo bar" vs "foobar"), case ("US" vs "us"), a compatibility form ("x²"
+ * vs "x2"), indentation in a code snippet. Earlier versions folded case and
+ * punctuation (and, first, everything outside [a-z0-9]); each silently merged
+ * distinct writes. What is folded now, in title and content only:
+ *   - canonical Unicode equivalence (NFC — the same text, encoded two ways)
+ *   - line-ending style (CRLF/CR → LF)
+ *   - whitespace at the end of each line, and at the start/end of the field
+ * category and project are not normalized at all: they are identifiers, so
+ * they are compared exactly (missing project = empty string).
+ *
+ * The key also carries the memory's *effective* scope (backends/scope.ts):
+ * restating a project-scoped memory with scope: 'global' is a different
+ * write (it changes who can recall it), so it must not reheat the scoped
+ * row and drop the promotion. An explicit scope equal to the category
+ * default is the same write and still reheats.
+ *
+ * This only catches character-identical restatements (after normalization).
+ * It is not a replacement for audit's similarity-based duplicate detection —
+ * paraphrases, reworded titles, or trimmed content still need audit + merge.
+ */
+import { createHash } from 'node:crypto';
+import { effectiveScope } from './scope.js';
+function normalize(text) {
+    return text
+        .normalize('NFC')
+        .replace(/\r\n?/g, '\n')
+        .replace(/[^\S\n]+$/gm, '')
+        .trim();
+}
+export function computeUniqKey(input) {
+    // JSON array, not a delimiter join: no field content can alias a
+    // different split of the same characters across fields.
+    const basis = JSON.stringify([
+        input.category,
+        input.project ?? '',
+        effectiveScope(input),
+        normalize(input.title),
+        normalize(input.content),
+    ]);
+    return createHash('sha256').update(basis, 'utf-8').digest('hex');
+}
+/**
+ * Recompute `uniq` for every row from its current category/project/title/
+ * content with the current computeUniqKey(). Used by the migrations that
+ * introduce or re-key the column.
+ *
+ * Archived rows get NULL — remember() only ever matches active rows, and
+ * restore() recomputes the key when a row comes back. Among active rows,
+ * oldest (lowest id) wins: if several already share a key (an unresolved
+ * historical duplicate), only the first holds it and the rest stay NULL
+ * rather than pointing a future reheat at an arbitrary survivor. Those
+ * clusters are what memory_audit + memory_merge are for.
+ */
+export function rebuildUniqKeys(db) {
+    const rows = db
+        .prepare(
+    // scope only exists from add_scope on; a DB that predates it has no
+    // explicit overrides, so NULL (category default) is exact.
+    `SELECT id, category, project, title, content, archived,
+              ${hasScopeColumn(db) ? 'scope' : 'NULL AS scope'}
+       FROM memories ORDER BY id ASC`)
+        .all();
+    const seen = new Set();
+    const update = db.prepare('UPDATE memories SET uniq = ? WHERE id = ?');
+    db.transaction(() => {
+        // Clear every key first. Rekeying row by row in place could otherwise
+        // write a row's new key while a later row still holds it as a stale old
+        // key, and trip the unique index on active rows.
+        db.prepare('UPDATE memories SET uniq = NULL').run();
+        for (const row of rows) {
+            let key = null;
+            if (row.archived === 0) {
+                const k = computeUniqKey(row);
+                if (!seen.has(k)) {
+                    seen.add(k);
+                    key = k;
+                }
+            }
+            update.run(key, row.id);
+        }
+    })();
+}
+function hasScopeColumn(db) {
+    const info = db.pragma('table_info(memories)');
+    return info.some((c) => c.name === 'scope');
+}

package/dist/backends/embedding-runtime.js

@@ -41,12 +41,25 @@ export const EmbeddingModel = {
     MLE5Large: 'fast-multilingual-e5-large',
 };
 /**
- * Where model tarballs come from. The upstream default is a Qdrant-owned GCS
- * bucket whose access has broken at least twice (fastembed-js issues #18, #33)
- * and which nobody maintains any more; the env override exists so a broken
- * bucket is a config change, not a release.
+ * Where model tarballs come from. The upstream default was a Qdrant-owned
+ * GCS bucket; as of 2026-10-16 every object in it 403s (t-1262) and nobody
+ * at Qdrant maintains it, so it isn't coming back. The replacement is a
+ * GitHub Release asset in this repo (sleepunit-agents/loom, tag
+ * models-fast-bge-small-en-v1.5-v1): the exact bytes this box had already
+ * downloaded from the GCS bucket before it died, reuploaded rather than
+ * re-exported, and confirmed bit-identical against the
+ * embedding-runtime.parity.test.ts golden vectors before upload. That
+ * matters: the public Hugging Face re-exports of this model are either
+ * int8/fp16-quantized or built with a different ONNX optimizer pass, and
+ * produce embeddings close to but not bit-identical with every vector
+ * already stored in a loom database. Only fast-bge-small-en-v1.5 — the
+ * model loom actually defaults to (src/backends/index.ts) — has a release
+ * asset; other EmbeddingModel entries will fail download() with a clear
+ * "set LOOM_MODEL_BASE_URL" error until someone needs one and mirrors it
+ * the same way. The env override exists so a dead host is a config change,
+ * not a release.
  */
-const DEFAULT_MODEL_BASE_URL = 'https://storage.googleapis.com/qdrant-fastembed';
+const DEFAULT_MODEL_BASE_URL = 'https://github.com/sleepunit-agents/loom/releases/download/models-fast-bge-small-en-v1.5-v1';
 /**
  * Loaded dense embedder: a tokenizer plus an ONNX inference session.
  *
@@ -238,6 +251,12 @@ function download(outputPath, model) {
         : model;
     const base = process.env.LOOM_MODEL_BASE_URL ?? DEFAULT_MODEL_BASE_URL;
     const url = `${base}/${remoteName}.tar.gz`;
+    // GitHub Release assets (the new default host) 302 to a signed, short-lived
+    // blob URL; the GCS bucket they replace never redirected, so this following
+    // logic didn't previously exist.
+    return fetchToFile(url, outputPath, 5);
+}
+function fetchToFile(url, outputPath, redirectsLeft) {
     return new Promise((resolve, reject) => {
         const fail = (err) => {
             // A partial archive on disk would be treated as a complete download on
@@ -246,15 +265,25 @@ function download(outputPath, model) {
                 unlinkSync(outputPath);
             reject(err);
         };
-        const file = createWriteStream(outputPath);
-        file.on('error', fail);
         httpsGet(url, { headers: { 'User-Agent': 'loom' } }, (response) => {
-            if (response.statusCode !== 200) {
+            const { statusCode, headers } = response;
+            if (statusCode && statusCode >= 300 && statusCode < 400 && headers.location) {
+                response.resume();
+                if (redirectsLeft <= 0) {
+                    fail(new Error(`Model download failed: too many redirects fetching ${url.toString()}`));
+                    return;
+                }
+                fetchToFile(new URL(headers.location, url), outputPath, redirectsLeft - 1).then(resolve, fail);
+                return;
+            }
+            if (statusCode !== 200) {
                 response.resume();
-                fail(new Error(`Model download failed: ${url} returned HTTP ${response.statusCode}. ` +
+                fail(new Error(`Model download failed: ${url.toString()} returned HTTP ${statusCode}. ` +
                     'Set LOOM_MODEL_BASE_URL to fetch models from a different host.'));
                 return;
             }
+            const file = createWriteStream(outputPath);
+            file.on('error', fail);
             response.on('error', fail);
             response.pipe(file);
             file.on('finish', () => {

package/dist/backends/episodes.js

@@ -93,7 +93,7 @@ function openMemoriesDb(contextDir) {
     if (!existsSync(dbPath))
         return null;
     const db = new BetterSqlite3(dbPath, { readonly: true });
-    db.pragma('busy_timeout = 0');
+    db.pragma('busy_timeout = 5000');
     return db;
 }
 /** Raw episode rows in the window, oldest first. Empty when there is no store. */

package/dist/backends/fastembed.js

@@ -48,11 +48,30 @@ export class FastEmbedProvider {
         if (texts.length === 0)
             return [];
         const embedder = await this.ensureEmbedder();
-        const vectors = await collectBatches(embedder.embed(texts, 32));
-        if (vectors.length !== texts.length) {
-            throw new Error(`fastembed: embedBatch() produced ${vectors.length} vectors for ${texts.length} inputs (model ${this.config.model})`);
+        // Staged fallback ladder (t-334): a batch-level failure anywhere in a
+        // large request must not take remember()/recall() down with it. Each
+        // rung is strictly less efficient but more isolated than the one above
+        // it; only descend when the rung above actually failed or came back
+        // short.
+        const rungs = [
+            () => collectBatches(embedder.embed(texts, 32)), // 1. one batched call
+            () => collectBatches(embedder.embed(texts, 1)), // 2. sequential, still whole-array
+            () => embedOneByOne(texts, (t) => this.embed(t)), // 3. isolated, one call per text
+        ];
+        let lastErr;
+        for (const runRung of rungs) {
+            try {
+                const vectors = await runRung();
+                if (vectors.length === texts.length && vectors.every((v) => v.length > 0)) {
+                    return vectors;
+                }
+                lastErr = new Error(`fastembed: embedBatch() produced ${vectors.length} vectors for ${texts.length} inputs (model ${this.config.model})`);
+            }
+            catch (err) {
+                lastErr = err;
+            }
         }
-        return vectors;
+        throw lastErr;
     }
     async embedQuery(text) {
         const embedder = await this.ensureEmbedder();
@@ -93,3 +112,10 @@ async function collectBatches(gen) {
     }
     return out;
 }
+/** Rung 3 of the embedBatch fallback ladder: one isolated call per text. */
+async function embedOneByOne(texts, embedOne) {
+    const out = [];
+    for (const text of texts)
+        out.push(await embedOne(text));
+    return out;
+}