@lincoln504/pi-research 1.4.1 → 1.4.3

package/src/infrastructure/browser/thread-worker.mjs

@@ -71,6 +71,8 @@ function redactSecrets(message) {
   }
   if (out.length > MAX_LOG_MESSAGE_LENGTH) {
     out = `${out.slice(0, keep)}\u2026[truncated ${Math.max(rawLength, out.length) - keep} chars]`;
+  } else if (rawLength > scanEnd) {
+    out = `${out}\u2026[truncated ${rawLength - scanEnd} chars]`;
   }
   return out;
 }
@@ -247,7 +249,7 @@ var init_error_tracker = __esm({
        * @param error - The error to track (Error object, string message, or unknown)
        * @param context - Optional context information about where the error occurred
        */
-      trackError(error, context2 = {}) {
+      trackError(error, context = {}) {
         let message;
         if (error instanceof Error) {
           message = error.message;
@@ -276,15 +278,15 @@ var init_error_tracker = __esm({
         }
         pattern.count++;
         pattern.lastSeen = now;
-        if (context2.domain) {
-          const existing = pattern.domainCounts.get(context2.domain);
+        if (context.domain) {
+          const existing = pattern.domainCounts.get(context.domain);
           if (existing !== void 0) {
-            pattern.domainCounts.set(context2.domain, existing + 1);
+            pattern.domainCounts.set(context.domain, existing + 1);
           } else if (pattern.domainCounts.size < this.MAX_DOMAINS_PER_PATTERN) {
-            pattern.domainCounts.set(context2.domain, 1);
+            pattern.domainCounts.set(context.domain, 1);
           }
         }
-        pattern.contexts.push(context2);
+        pattern.contexts.push(context);
         if (pattern.contexts.length > this.MAX_CONTEXTS_PER_PATTERN) {
           pattern.contexts.shift();
         }
@@ -1109,8 +1111,8 @@ var init_logger = __esm({
       error(...args) {
         const errArg = args.find((arg) => arg instanceof Error);
         if (errArg) {
-          const context2 = getLogContext();
-          errorTracker.trackError(errArg, context2);
+          const context = getLogContext();
+          errorTracker.trackError(errArg, context);
         }
         this.emit("ERROR" /* ERROR */, ...args);
       }
@@ -2025,7 +2027,7 @@ var workerId2 = "";
 var pageCreationLock = Promise.resolve();
 var PAGE_CREATION_HARD_RELEASE_MS = 5 * 60 * 1e3;
 var wedgedContext = null;
-async function createPageSafe(context2) {
+async function createPageSafe(context) {
   let release;
   const nextLock = new Promise((resolve) => {
     release = resolve;
@@ -2033,11 +2035,11 @@ async function createPageSafe(context2) {
   const currentLock = pageCreationLock;
   pageCreationLock = currentLock.then(() => nextLock);
   await currentLock;
-  if (context2 === wedgedContext) {
+  if (context === wedgedContext) {
     release();
     throw new Error("Browser context is wedged from a prior page-creation call that never settled; a new browser context is required.");
   }
-  const pagePromise = context2.newPage();
+  const pagePromise = context.newPage();
   let hardReleased = false;
   const releaseOnce = () => {
     if (hardReleased) return;
@@ -2047,17 +2049,17 @@ async function createPageSafe(context2) {
   };
   const hardReleaseTimer = setTimeout(() => {
     logToDebugFile2("WARN", "[ThreadWorker] page-creation mutex force-released \u2014 newPage() did not settle within the hard timeout");
-    wedgedContext = context2;
+    wedgedContext = context;
     releaseOnce();
   }, PAGE_CREATION_HARD_RELEASE_MS);
   safeUnref(hardReleaseTimer);
   pagePromise.then(
     () => {
-      if (wedgedContext === context2) wedgedContext = null;
+      if (wedgedContext === context) wedgedContext = null;
       releaseOnce();
     },
     () => {
-      if (wedgedContext === context2) wedgedContext = null;
+      if (wedgedContext === context) wedgedContext = null;
       releaseOnce();
     }
   );
@@ -2119,12 +2121,12 @@ function logToDebugFile2(level, ...args) {
   } catch {
   }
 }
-async function setupMocking(context2) {
+async function setupMocking(context) {
   const mockSearch = process.env["PI_RESEARCH_MOCK_SEARCH"] === "true";
   const mockScrape = process.env["PI_RESEARCH_MOCK_SCRAPE"] === "true";
   if (!mockSearch && !mockScrape) return;
   logToDebugFile2("INFO", `[Worker-${workerId2}] Setting up browser mocking (Search: ${mockSearch}, Scrape: ${mockScrape})`);
-  await context2.route("**", (route, request) => {
+  await context.route("**", (route, request) => {
     const urlStr = request.url();
     let url;
     try {
@@ -2297,6 +2299,7 @@ async function executeScrapeTask(_context, url, signal) {
   }
   let poisonedError = null;
   const pendingAddrChecks = [];
+  let oversizedPdfError = null;
   try {
     logToDebugFile2("DEBUG", `[Worker-${workerId2}] Starting scrape for: ${url}`);
     const { validateUrlForSSRF: validateForWorker, validateUrlForSSRFSync: validateForWorkerSync } = await Promise.resolve().then(() => (init_scraper_utils(), scraper_utils_exports));
@@ -2328,6 +2331,20 @@ async function executeScrapeTask(_context, url, signal) {
       try {
         if (resp.request().resourceType() === "document" && resp.frame() === page.mainFrame()) {
           finalMainFrameAddr = resp.serverAddr().catch(() => null);
+          const check2 = Promise.resolve(resp.headerValue("content-type")).then(async (ct) => {
+            const looksLikePdf = ct?.includes("application/pdf") || url.toLowerCase().endsWith(".pdf");
+            if (!looksLikePdf || oversizedPdfError || poisonedError) return;
+            const declared = parseInt(await resp.headerValue("content-length").catch(() => null) || "", 10);
+            if (Number.isFinite(declared) && declared > MAX_PDF_SIZE) {
+              const sizeMB = Math.round(declared / 1024 / 1024);
+              oversizedPdfError = new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
+              logToDebugFile2("DEBUG", `[Worker-${workerId2}] Aborting oversized PDF (${sizeMB}MB declared) before download completes: ${url}`);
+              page.close().catch(() => {
+              });
+            }
+          }).catch(() => {
+          });
+          pendingAddrChecks.push(check2);
         }
         const check = Promise.resolve(resp.serverAddr()).then((addr) => {
           const ip = addr?.ipAddress;
@@ -2357,7 +2374,7 @@ async function executeScrapeTask(_context, url, signal) {
     }
     const contentType = await response?.headerValue("content-type") || "";
     const status = response?.status?.() ?? 0;
-    if (contentType.includes("application/pdf")) {
+    if (contentType.includes("application/pdf") || url.toLowerCase().endsWith(".pdf")) {
       if (!response) throw new Error(`[Worker] No response received for PDF URL: ${url}`);
       if (status >= 400) throw new Error(`HTTP ${status}`);
       const declaredLength = parseInt(await response.headerValue("content-length").catch(() => null) || "", 10);
@@ -2365,6 +2382,7 @@ async function executeScrapeTask(_context, url, signal) {
         const sizeMB = Math.round(declaredLength / 1024 / 1024);
         throw new Error(`PDF too large (${sizeMB}MB, max 100MB)`);
       }
+      if (oversizedPdfError) throw oversizedPdfError;
       const buffer = await response.body();
       if (buffer.byteLength > MAX_PDF_SIZE) {
         const sizeMB = Math.round(buffer.byteLength / 1024 / 1024);
@@ -2422,6 +2440,7 @@ async function executeScrapeTask(_context, url, signal) {
     return { contentType, html, jitter };
   } catch (error) {
     await page.close().catch((err) => logToDebugFile2("DEBUG", `[ThreadWorker] Swallowed page close/wait error: ${err.message || String(err)}`));
+    if (oversizedPdfError) throw oversizedPdfError;
     if (poisonedError) throw poisonedError;
     throw error;
   } finally {
@@ -2566,10 +2585,16 @@ var ConfigSchema = Type.Object({
   SEARCH_TIMEOUT_MS: Type.Number({ minimum: 5e3, maximum: 12e4, default: 45e3 }),
   /** TUI refresh debounce in milliseconds (default: 100ms) */
   TUI_REFRESH_DEBOUNCE_MS: Type.Number({ minimum: 0, maximum: 1e3, default: 100 }),
-  /** Queue-wait / overhead margin (ms) added on top of each browser operation's own nav
-   *  timeout to form its scheduler task-timeout ceiling: a search task times out after
-   *  SEARCH_TIMEOUT_MS + this, a scrape after SCRAPE_TIMEOUT_MS + this. Sized so a task is
-   *  never killed before it has used its full nav budget plus time waiting in the queue.
+  /** Overhead margin (ms) added on top of each browser operation's own nav timeout to
+   *  form its scheduler task-timeout ceiling: a search task times out after
+   *  SEARCH_TIMEOUT_MS + this, a scrape after SCRAPE_TIMEOUT_MS + this — covering
+   *  per-task work beyond raw navigation (page setup, result parsing). Queue wait is
+   *  NOT part of this margin: the deadline is armed on dispatch, not on enqueue, so
+   *  time spent waiting for a free worker never counts against it (see
+   *  browser-task-scheduler.ts). Cold browser-launch/context-creation time is also
+   *  separate from this margin — COLD_START_ALLOWANCE_MS
+   *  (infrastructure/browser/config.ts) covers that unconditionally on top of it,
+   *  since it isn't something a user should need to tune.
    *  (default: 10000) */
   BROWSER_TASK_TIMEOUT_MS: Type.Number({ minimum: 2e3, maximum: 12e4, default: 1e4 }),
   /** Timeout for coordinator/research-lead/repair/knowledge LLM calls in ms (default: 300000 = 5 min, range: 60s-30min).
@@ -2669,10 +2694,12 @@ function resolveHeadlessMode() {
   return true;
 }
 var HEALTHCHECK_MIN_BUDGET_MS = 45e3 + 6e4;
+var BROWSER_LAUNCH_TIMEOUT_MS = 9e4;
+var CONTEXT_CREATION_TIMEOUT_MS = 3e4;
+var COLD_START_ALLOWANCE_MS = BROWSER_LAUNCH_TIMEOUT_MS + CONTEXT_CREATION_TIMEOUT_MS;
 
 // src/infrastructure/browser/thread-worker-browser.ts
 var browser = null;
-var context = null;
 var initPromise = null;
 var workerId3 = "";
 var activeTaskCount = 0;
@@ -2726,11 +2753,11 @@ function logToDebugFile3(level, ...args) {
   }
 }
 async function initBrowser() {
-  if (isBrowserConnected() && context) return;
+  if (isBrowserConnected()) return;
   if (initPromise) return initPromise;
   initPromise = (async () => {
     try {
-      if (!isBrowserConnected() || !context) {
+      if (!isBrowserConnected()) {
         logToDebugFile3("INFO", `[Worker-${workerId3}] Initializing browser instance...`);
         let CamoufoxModule;
         try {
@@ -2739,7 +2766,7 @@ async function initBrowser() {
           throw new Error(`[Worker] camoufox-js not found in node_modules. Please run 'npm install'. Original error: ${e instanceof Error ? e.message : String(e)}`, { cause: e });
         }
         const { Camoufox } = CamoufoxModule;
-        const launchTimeoutMs = 9e4;
+        const launchTimeoutMs = BROWSER_LAUNCH_TIMEOUT_MS;
         const launchOnce = async (headless) => {
           const launchPromise = Camoufox({
             headless,
@@ -2822,30 +2849,6 @@ async function initBrowser() {
           }
         }
         browser = launchedBrowser;
-        const contextPromise = browser.newContext();
-        contextPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser context rejection: ${err.message}`));
-        let contextTimeoutId;
-        let contextRaceLost = false;
-        contextPromise.then((c) => {
-          if (!contextRaceLost) return;
-          logToDebugFile3("WARN", `[Worker-${workerId3}] Browser context creation completed after its deadline; closing the orphaned context.`);
-          try {
-            c?.close?.();
-          } catch {
-          }
-        }).catch(() => {
-        });
-        context = await Promise.race([
-          contextPromise,
-          new Promise((_, reject) => {
-            contextTimeoutId = setTimeout(() => {
-              contextRaceLost = true;
-              reject(new Error("Browser context creation timed out after 30000ms"));
-            }, 3e4);
-          })
-        ]);
-        if (contextTimeoutId) clearTimeout(contextTimeoutId);
-        await setupMocking(context);
         logToDebugFile3("INFO", `[Worker-${workerId3}] Browser initialized.`);
       }
     } catch (e) {
@@ -2853,7 +2856,6 @@ async function initBrowser() {
         Promise.resolve(browser.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed browser close error during failed init: ${err.message}`));
       }
       browser = null;
-      context = null;
       const msg = e instanceof Error ? e.message : String(e);
       if (msg.includes("Camoufox is not installed") || msg.includes("Version information not found")) {
         throw new Error(`[Worker] Browser binaries not found. Please run 'npx camoufox-js fetch' to install them.`, { cause: e });
@@ -2872,13 +2874,39 @@ async function initBrowser() {
   })();
   return initPromise;
 }
-function getContext() {
-  return context;
+async function acquireTaskContext() {
+  const contextPromise = browser.newContext();
+  contextPromise.catch((err) => logToDebugFile3("DEBUG", `[ThreadWorker] Background browser context rejection: ${err.message}`));
+  let contextTimeoutId;
+  let contextRaceLost = false;
+  contextPromise.then((c) => {
+    if (!contextRaceLost) return;
+    logToDebugFile3("WARN", `[Worker-${workerId3}] Browser context creation completed after its deadline; closing the orphaned context.`);
+    try {
+      c?.close?.();
+    } catch {
+    }
+  }).catch(() => {
+  });
+  let newContext;
+  try {
+    newContext = await Promise.race([
+      contextPromise,
+      new Promise((_, reject) => {
+        contextTimeoutId = setTimeout(() => {
+          contextRaceLost = true;
+          reject(new Error(`Browser context creation timed out after ${CONTEXT_CREATION_TIMEOUT_MS}ms`));
+        }, CONTEXT_CREATION_TIMEOUT_MS);
+      })
+    ]);
+  } finally {
+    if (contextTimeoutId) clearTimeout(contextTimeoutId);
+  }
+  await setupMocking(newContext);
+  return newContext;
 }
 function doResetBrowser() {
-  if (context) Promise.resolve(context.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed context close error during reset: ${err.message}`));
   if (browser) Promise.resolve(browser.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed browser close error during reset: ${err.message}`));
-  context = null;
   browser = null;
 }
 function resetBrowser() {
@@ -2892,7 +2920,6 @@ function resetBrowser() {
 async function cleanupBrowser2() {
   const timeoutMs = 2e3;
   const cleanup = async () => {
-    if (context) await Promise.resolve(context.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed context close error during cleanup: ${err.message}`));
     if (browser) await Promise.resolve(browser.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed browser close error during cleanup: ${err.message}`));
   };
   try {
@@ -2902,7 +2929,6 @@ async function cleanupBrowser2() {
     ]);
   } catch {
   } finally {
-    context = null;
     browser = null;
   }
 }
@@ -2951,20 +2977,22 @@ async function runTask(data) {
     taskTimer = setTimeout(() => abortController.abort(new Error(`Task timed out after ${taskTimeoutMs}ms`)), taskTimeoutMs);
   }
   taskStarted();
+  let taskContext;
   try {
     await initBrowser();
     const initMs = Date.now() - startTime;
+    taskContext = await acquireTaskContext();
     let result;
     if (type === "search") {
       if (!query) throw new Error("Search task requires a query");
-      const searchResult = await executeSearchTask(getContext(), query, abortController.signal);
+      const searchResult = await executeSearchTask(taskContext, query, abortController.signal);
       result = { results: searchResult.results, duration: Date.now() - startTime, jitter: searchResult.jitter };
     } else if (type === "scrape") {
       if (!url) throw new Error("Scrape task requires a URL");
-      const scrapeResult = await executeScrapeTask(getContext(), url, abortController.signal);
+      const scrapeResult = await executeScrapeTask(taskContext, url, abortController.signal);
       result = { ...scrapeResult, duration: Date.now() - startTime };
     } else if (type === "healthcheck") {
-      const healthResult = await executeHealthCheck(getContext(), initMs, abortController.signal);
+      const healthResult = await executeHealthCheck(taskContext, initMs, abortController.signal);
       result = { ...healthResult, duration: Date.now() - startTime };
     } else {
       result = { error: "Unknown task type", duration: Date.now() - startTime };
@@ -2987,6 +3015,10 @@ async function runTask(data) {
     };
   } finally {
     if (taskTimer !== void 0) clearTimeout(taskTimer);
+    if (taskContext) {
+      Promise.resolve(taskContext.close()).catch(() => {
+      });
+    }
     taskFinished();
   }
 }

package/src/infrastructure/browser/thread-worker.ts

@@ -23,7 +23,7 @@ import {
 import {
   setWorkerId,
   initBrowser,
-  getContext,
+  acquireTaskContext,
   resetBrowser,
   cleanupBrowser,
   taskStarted,
@@ -107,23 +107,28 @@ async function runTask(data: TaskData | undefined): Promise<TaskResult> {
   // Registered around the whole browser-touching lifetime of this task so
   // resetBrowser() (below) can tell whether a sibling task dispatched to this
   // same worker process (WORKER_CONCURRENCY > 1) is still using the shared
-  // browser/context before tearing it down.
+  // browser before tearing it down.
   taskStarted();
+  // Task-owned, not module-owned: acquireTaskContext() below hands back a
+  // FRESH BrowserContext for this task alone, closed in the finally below —
+  // never shared with a concurrent or later sibling task.
+  let taskContext: any;
   try {
     await initBrowser();
     const initMs = Date.now() - startTime;
+    taskContext = await acquireTaskContext();
 
     let result: any;
     if (type === 'search') {
       if (!query) throw new Error('Search task requires a query');
-      const searchResult = await executeSearchTask(getContext(), query, abortController.signal);
+      const searchResult = await executeSearchTask(taskContext, query, abortController.signal);
       result = { results: searchResult.results, duration: Date.now() - startTime, jitter: searchResult.jitter };
     } else if (type === 'scrape') {
       if (!url) throw new Error('Scrape task requires a URL');
-      const scrapeResult = await executeScrapeTask(getContext(), url, abortController.signal);
+      const scrapeResult = await executeScrapeTask(taskContext, url, abortController.signal);
       result = { ...scrapeResult, duration: Date.now() - startTime };
     } else if (type === 'healthcheck') {
-      const healthResult = await executeHealthCheck(getContext(), initMs, abortController.signal);
+      const healthResult = await executeHealthCheck(taskContext, initMs, abortController.signal);
       result = { ...healthResult, duration: Date.now() - startTime };
     } else {
       result = { error: 'Unknown task type', duration: Date.now() - startTime };
@@ -156,6 +161,9 @@ async function runTask(data: TaskData | undefined): Promise<TaskResult> {
     };
   } finally {
     if (taskTimer !== undefined) clearTimeout(taskTimer);
+    if (taskContext) {
+      Promise.resolve(taskContext.close()).catch(() => { /* task is already done; a close failure here is not actionable */ });
+    }
     taskFinished();
   }
 }

package/src/infrastructure/embedding/embedding-server.ts

@@ -80,6 +80,11 @@ class SerialQueue {
   private readonly hardDeadlineMs: number;
   private readonly onPoison?: (err: Error) => void;
   private poisoned: Error | null = null;
+  // The currently-executing task's real work promise (not the soft-timeout race) —
+  // set only while a native call is actually in flight. Lets a caller that needs
+  // to dispose the underlying pipeline (EmbeddingServer.shutdown) wait for true
+  // idleness instead of racing disposal against a still-running inference.
+  private currentWork: Promise<unknown> | null = null;
 
   constructor(
     maxDepth = 200,
@@ -132,6 +137,7 @@ class SerialQueue {
         let hardTimer: ReturnType<typeof setTimeout> | undefined;
         try {
           work = fn();
+          this.currentWork = work;
           // Arm the hard-deadline watchdog from the moment the real GPU work starts, so
           // the cap is an honest wall-clock deadline measured from work-start rather than
           // (soft-timeout + hardDeadlineMs). A single inference still unsettled after
@@ -162,6 +168,7 @@ class SerialQueue {
           } finally {
             settled = true;
             if (hardTimer !== undefined) clearTimeout(hardTimer);
+            if (this.currentWork === work) this.currentWork = null;
           }
         }
       };
@@ -170,6 +177,23 @@ class SerialQueue {
     });
   }
 
+  /**
+   * Resolve once no native call is in flight. Used by EmbeddingServer.shutdown()
+   * to wait out a still-running inference before disposing the pipeline —
+   * without this, disposal could run concurrently with a legitimately slow (not
+   * hung) embed/embedMany call on the same re-entrant-locked GPU context, the
+   * exact native-segfault class this queue exists to prevent. No timeout: a
+   * promise that truly never settles is already an accepted, pre-existing
+   * leak-to-process-exit scenario elsewhere in this class (see the poison path's
+   * disposeEmbedder=false handling) — better to leak than risk concurrent
+   * native access.
+   */
+  async waitForIdle(): Promise<void> {
+    while (this.currentWork) {
+      await this.currentWork.catch(() => {});
+    }
+  }
+
   private poison(err: Error): void {
     if (this.poisoned) return;
     this.poisoned = err;
@@ -414,6 +438,16 @@ export class EmbeddingServer implements IEmbedder {
     // is enough for another process to re-elect; the leaked native resources die with
     // eventual process exit.
     if (disposeEmbedder) {
+      // Wait for the SerialQueue to go idle BEFORE disposing. This shutdown() path
+      // also runs on ordinary leadership loss — not just the poison path above — and
+      // a legitimately slow (not hung) embed/embedMany can still be mid-flight on
+      // this same GPU context. Embedder.dispose()'s own drainActiveEmbeddings only
+      // waits 5s, an order of magnitude under the queue's own 120s soft timeout, so
+      // without this a normal large batch could have its pipeline disposed out from
+      // under it — the same concurrent-native-call hazard the queue exists to
+      // prevent, just triggered by disposal racing a live call instead of two calls
+      // racing each other.
+      await this.queue.waitForIdle();
       await this.embedder.dispose().catch((err) => {
         if (this.isShuttingDown) {
           logger.debug('[EmbeddingServer] Error disposing embedder during shutdown (expected):', err);

package/src/knowledge/embedder-init.ts

@@ -417,7 +417,8 @@ export async function handleWebGPUWarmupError(
   gpuLockHeld: boolean,
   model: string,
   initializationTimeoutMs: number,
-  useCache: boolean
+  useCache: boolean,
+  poolingMode: 'mean' | 'cls' | 'last_token' = 'mean'
 ): Promise<{ success: boolean; pipeline?: FeatureExtractionPipeline; error?: Error; dummy?: any }> {
   markWebGpuFallback();
 
@@ -451,7 +452,7 @@ export async function handleWebGPUWarmupError(
     logger.info('[embedder] CPU pipeline loaded successfully');
     
     // Warmup CPU pipeline
-    const { dummy, success, error: cpuWarmupErr } = await warmupPipeline(cpuPipeline, 'mean', useCache);
+    const { dummy, success, error: cpuWarmupErr } = await warmupPipeline(cpuPipeline, poolingMode, useCache);
     if (!success || cpuWarmupErr) {
       logger.error('[embedder] CPU fallback pipeline warmup failed:', cpuWarmupErr);
       if (cpuPipeline) {

package/src/knowledge/embedder.ts

@@ -331,7 +331,8 @@ export class Embedder {
             this.gpuLockHeld,
             this.model,
             this.initializationTimeoutMs,
-            this.useCache
+            this.useCache,
+            this.poolingMode
           );
           if (!result.success) {
             throw result.error;
@@ -404,9 +405,16 @@ export class Embedder {
       // the VECTOR — the full text is still stored verbatim and covered by FTS — but the
       // truncation is otherwise silent, so surface it: a spike here means chunks are
       // arriving larger than the embed cap and vector recall on their tail is degraded.
+      let keep = maxChars;
+      // slice() counts UTF-16 code units, so the cut can land between the halves of
+      // a surrogate pair (emoji, rare CJK) — same guard as truncateWithMarker
+      // (utils/text-utils.ts): a lone high surrogate is invalid text some
+      // tokenizers/providers choke on. Back off one unit to restore well-formed text.
+      const lastKeptUnit = text.charCodeAt(keep - 1);
+      if (lastKeptUnit >= 0xd800 && lastKeptUnit <= 0xdbff) keep -= 1;
       metrics.increment('embedder_truncations_total', 1, { model: this.model });
-      logger.debug(`[embedder] Truncated input for embedding: ${text.length} -> ${maxChars} chars (model=${this.model})`);
-      return text.slice(0, maxChars);
+      logger.debug(`[embedder] Truncated input for embedding: ${text.length} -> ${keep} chars (model=${this.model})`);
+      return text.slice(0, keep);
     }
     return text;
   }

package/src/knowledge/index.ts

@@ -1,4 +1,5 @@
 import * as fs from 'node:fs';
+import * as path from 'node:path';
 import { KnowledgeStore } from './store.ts';
 import { WriterQueue } from './writer-queue.ts';
 import { Chunker } from './chunker.ts';
@@ -108,19 +109,44 @@ export async function createKnowledgeStoreComponents(
 }
 
 /**
- * Force delete the entire knowledge store directory.
- * Used for system-level clearing or recovery from corruption.
+ * Force delete the ACTIVE table's own directory, to recover from a corrupted
+ * LanceDB manifest. Scoped to that one table, not the whole dbDir: dbDir is a
+ * single unified store shared by every workspace and the global scope (rows
+ * are scoped by a `workspace` column, not by separate directories), and it
+ * also holds `_backup_*`/`_migration_*` sibling directories — the deliberate,
+ * user-recoverable safety net the 'backup' migration strategy creates. A
+ * directory-wide wipe here previously destroyed every other project's data
+ * and every backup the instant ANY workspace's session hit a corrupted
+ * manifest, on the one code path whose entire purpose is recovering from
+ * exactly that kind of damage.
  */
 export async function forceDeleteKnowledgeStore(config?: Config, workspace?: string): Promise<void> {
   const dbDir = getDbDir(config, workspace);
-  if (fs.existsSync(dbDir)) {
-    try {
-      fs.rmSync(dbDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
-      fs.mkdirSync(dbDir, { recursive: true });
-      logger.info(`[knowledge] Knowledge store at ${dbDir} forcefully deleted and recreated.`);
-    } catch (err) {
-      logger.error(`[knowledge] Failed to forcefully delete directory ${dbDir}:`, err);
-      throw err;
+  if (!fs.existsSync(dbDir)) return;
+
+  // Mirrors KnowledgeStore's own manifest read (store.ts): the active table
+  // name defaults to 'knowledge' but can point elsewhere after a persisted
+  // rename failure. A missing or unreadable manifest is not itself a reason to
+  // widen the blast radius, so it falls back to the default rather than
+  // escalating to a dbDir-wide delete.
+  let tableName = 'knowledge';
+  const manifestPath = path.join(dbDir, 'store-manifest.json');
+  try {
+    if (fs.existsSync(manifestPath)) {
+      const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')) as { activeTableName?: string };
+      if (manifest.activeTableName) tableName = manifest.activeTableName;
     }
+  } catch (err) {
+    logger.warn(`[knowledge] Failed to read manifest before forced delete, defaulting to table '${tableName}':`, err);
+  }
+
+  const tableDir = path.join(dbDir, `${tableName}.lance`);
+  if (!fs.existsSync(tableDir)) return;
+  try {
+    fs.rmSync(tableDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+    logger.info(`[knowledge] Corrupted table directory ${tableDir} forcefully deleted; will be recreated on next init.`);
+  } catch (err) {
+    logger.error(`[knowledge] Failed to forcefully delete table directory ${tableDir}:`, err);
+    throw err;
   }
 }

package/src/knowledge/store.ts

@@ -502,12 +502,36 @@ export class KnowledgeStore implements IKnowledgeStore {
         // If canonical name was already something else and it still exists, 
         // we might need to handle it. But we just dropped it above.
         await fsPromises.rename(tempDir, canonicalDir);
-        
+
         this.tableName = canonicalName;
-        await this.saveManifest();
-        
-        // Reopen the canonical table so this.table reflects the renamed path
-        this.table = await this.db.openTable(this.tableName);
+        if (await this.saveManifest()) {
+          // Reopen the canonical table so this.table reflects the renamed path
+          this.table = await this.db.openTable(this.tableName);
+        } else {
+          // The directory rename to the canonical name already happened on disk,
+          // but the manifest still says tempTableName (persisted successfully
+          // above, before the old table was dropped). Left as-is, the next
+          // process start would read that stale name, find no such directory
+          // (renamed away), and silently CREATE A NEW EMPTY TABLE under it —
+          // stranding every re-embedded document in the now-unreferenced
+          // canonical directory with no recovery path (pruneOrphanedMigrationDirs
+          // doesn't recognize a bare 'knowledge.lance' as orphaned migration
+          // material). Revert the rename so the manifest (still correctly
+          // pointing at tempTableName, from the pre-drop save above) and the
+          // on-disk layout agree again — the data stays fully intact and
+          // accessible under its temp name either way. Deliberately NOT thrown:
+          // the migration itself fully succeeded and the in-memory handle is
+          // fine, so surfacing this as a migration failure would trip the
+          // caller's re-embed-failed fallback to the 'backup' strategy, which
+          // would needlessly rename this perfectly good, fully re-embedded data
+          // out of the way and start a fresh empty table over one manifest
+          // write hiccup.
+          logger.error('[store] Failed to persist canonical table name after rename — reverting to keep manifest and disk in sync.');
+          await fsPromises.rename(canonicalDir, tempDir);
+          this.tableName = tempTableName;
+          this.table = await this.db.openTable(this.tableName);
+          logger.info(`[store] Migrated data remains safe and accessible as ${tempTableName}; canonical rename deferred to a future successful manifest save.`);
+        }
       } catch (renameErr) {
         // If rename fails (cross-device, permissions, etc.) we keep the temp name
         // but CRITICALLY we now persist it in the manifest so future sessions

package/src/orchestration/deep-research-orchestrator.ts

@@ -517,7 +517,9 @@ export class DeepResearchOrchestrator {
         // Guarded so a one-round budget cannot announce the same round twice.
         if (this.currentRound > lastAnnouncedRound) {
           observer?.onRoundStart?.(this.currentRound);
-          lastAnnouncedRound = this.currentRound;
+          // No assignment to lastAnnouncedRound here: this is the last place in the
+          // function that reads it — final synthesis proceeds unconditionally right
+          // after, nothing downstream checks it again.
         }
         // The round this synthesis actually happens at, not the budget. They coincide on
         // the round-cap exit but not on the wait-exhaustion one, which breaks out early —

package/src/orchestration/session-state.ts

@@ -703,6 +703,22 @@ export function getPiActivePanels(piSessionId: string | undefined): ResearchPane
   return [...state.order].reverse().map(id => state.panels.get(id)!).filter(Boolean);
 }
 
+/**
+ * Count of research runs currently active in a Pi session, TUI or headless.
+ *
+ * Unlike getPiActivePanels (populated only by registerSessionPanel, which the
+ * TUI path alone calls), `aborts` is registered by registerSessionAbort on
+ * EVERY run — headless included — and removed only by endResearchSession. Use
+ * this wherever "am I the last/only active run in this session" must hold for
+ * headless callers too (e.g. gating a shared-state clear like steering
+ * messages so a finishing run doesn't wipe a concurrent sibling's).
+ */
+export function getActiveResearchRunCount(piSessionId: string | undefined): number {
+  const sid = normalizeSessionId(piSessionId);
+  const state = piSessions.get(sid);
+  return state ? state.aborts.size : 0;
+}
+
 /**
  * Get the ordered list of active research run IDs in a Pi session.
  * Returns IDs in chronological order (oldest first, newest last).