@rubytech/create-maxy-code 0.1.433 → 0.1.435

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.433",
+  "version": "0.1.435",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/embed-client/dist/index.d.ts

@@ -5,6 +5,6 @@ export declare const EMBED_MS_PER_INPUT: number;
 export declare const EMBED_REQUEST_TIMEOUT_MS: number;
 export declare const EMBED_KEEP_ALIVE: number | string;
 export declare function embed(text: string): Promise<number[]>;
-export declare function effectiveSubBatchSize(): number;
+export declare function subBatchCharBudget(msPerChar: number): number;
 export declare function embedBatch(texts: string[]): Promise<number[][]>;
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/embed-client/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,qBAAqB,QASjC,CAAC;AAaF,eAAO,MAAM,mBAAmB,QAA6D,CAAC;AAC9F,eAAO,MAAM,0BAA0B,QAGtC,CAAC;AAWF,eAAO,MAAM,kBAAkB,QAA8D,CAAC;AAQ9F,eAAO,MAAM,wBAAwB,QAGpC,CAAC;AAcF,eAAO,MAAM,gBAAgB,EAAE,MAAM,GAAG,MAEhB,CAAC;AA8EzB,wBAAsB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG3D;AAKD,wBAAgB,qBAAqB,IAAI,MAAM,CAM9C;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAqBrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,qBAAqB,QASjC,CAAC;AAaF,eAAO,MAAM,mBAAmB,QAA6D,CAAC;AAC9F,eAAO,MAAM,0BAA0B,QAGtC,CAAC;AAWF,eAAO,MAAM,kBAAkB,QAA8D,CAAC;AAY9F,eAAO,MAAM,wBAAwB,QAGpC,CAAC;AAcF,eAAO,MAAM,gBAAgB,EAAE,MAAM,GAAG,MAEhB,CAAC;AA0FzB,wBAAsB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAG3D;AAcD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAgDrE"}

package/payload/platform/lib/embed-client/dist/index.js

@@ -8,7 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EMBED_KEEP_ALIVE = exports.EMBED_REQUEST_TIMEOUT_MS = exports.EMBED_MS_PER_INPUT = exports.EMBED_SUBBATCH_COOLDOWN_MS = exports.EMBED_SUBBATCH_SIZE = exports.EMBED_INPUT_MAX_CHARS = void 0;
 exports.embed = embed;
-exports.effectiveSubBatchSize = effectiveSubBatchSize;
+exports.subBatchCharBudget = subBatchCharBudget;
 exports.embedBatch = embedBatch;
 const OLLAMA_URL = process.env.OLLAMA_URL ?? "http://localhost:11434";
 const EMBED_MODEL = process.env.EMBED_MODEL ?? "nomic-embed-text";
@@ -45,17 +45,21 @@ exports.EMBED_INPUT_MAX_CHARS = Math.max(1, Math.floor(envInt("EMBED_INPUT_MAX_C
 // measurement without a code change.
 exports.EMBED_SUBBATCH_SIZE = Math.max(1, Math.floor(envInt("EMBED_SUBBATCH_SIZE", 32)));
 exports.EMBED_SUBBATCH_COOLDOWN_MS = Math.max(0, envInt("EMBED_SUBBATCH_COOLDOWN_MS", 1000));
-// Throughput-aware sub-batch sizing (Task 1533). On a CPU-only embedder each
-// input takes ~EMBED_MS_PER_INPUT ms; a fixed 32-input POST at the char cap is
-// ~128 s, past the 120 s request timeout, so a full-document batch aborts and
-// the atomic ingest write lands nothing. Bound each POST to 80% of the timeout
-// so it provably completes: derive a duration ceiling and take the smaller of
-// it and the count ceiling (EMBED_SUBBATCH_SIZE, Task 960's thermal cap).
-// EMBED_MS_PER_INPUT is the budgeted worst-case wall-time for one input at the
-// EMBED_INPUT_MAX_CHARS cap on the measured device; env-tunable for other
-// hardware.
+// Drift baseline (Task 1553). This was Task 1533's sizing driver — the budgeted
+// worst-case wall-time for one capped input — but sizing that from a single
+// fixed reading is exactly what over-provisioned a POST on a device slower than
+// the reading and aborted the ingest. Sizing is now measured per batch
+// (nextSubBatchSize), so EMBED_MS_PER_INPUT no longer drives it. It survives as
+// the reconciliation baseline: each POST compares its observed per-input time
+// against this budget and warns (op=drift) when the device runs slower, so a
+// device below budget is surfaced by a standing check rather than by a silent
+// ingest failure. Env-tunable for other hardware.
 exports.EMBED_MS_PER_INPUT = Math.max(1, Math.floor(envInt("EMBED_MS_PER_INPUT", 6000)));
 const EMBED_TIMEOUT_UTILISATION = 0.8;
+// Warn (op=drift) once a POST's observed per-input time exceeds the budget by
+// this factor. 1.5 tolerates ordinary variance while catching a device that is
+// materially slower than EMBED_MS_PER_INPUT.
+const EMBED_DRIFT_WARN_RATIO = 1.5;
 // Explicit per-request timeout, well under undici's 300000ms headers default.
 // Without it a slow or wedged ollama returns no headers and the caller hangs a
 // silent 5 minutes before a bare `fetch failed`. With it the request aborts in
@@ -130,7 +134,17 @@ async function embedRequest(input) {
     // oversized or slow sub-batch is visible before it times out and the
     // throughput-aware sizing is verifiable from the log. inputs is the POST's
     // sub-batch size; maxChars its largest input.
-    process.stderr.write(`[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${Date.now() - startedAt}\n`);
+    const ms = Date.now() - startedAt;
+    process.stderr.write(`[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${ms}\n`);
+    // Standing reconciliation (Task 1553). Compare this POST's observed per-input
+    // time against the EMBED_MS_PER_INPUT budget and warn on drift, so a device
+    // slower than budget is caught by a check rather than by a later ingest that
+    // aborts. Sizing already adapts to the true rate; this line makes the
+    // slowness legible.
+    const observedMsPerInput = ms / inputs.length;
+    if (inputs.length > 0 && observedMsPerInput > exports.EMBED_MS_PER_INPUT * EMBED_DRIFT_WARN_RATIO) {
+        process.stderr.write(`[embed] op=drift observedMsPerInput=${Math.round(observedMsPerInput)} budgetMsPerInput=${exports.EMBED_MS_PER_INPUT} ratio=${(observedMsPerInput / exports.EMBED_MS_PER_INPUT).toFixed(1)}\n`);
+    }
     return data.embeddings;
 }
 // POST one already-capped sub-batch of inputs to the embed endpoint.
@@ -141,30 +155,64 @@ async function embed(text) {
     const data = await embedRequest(capInput(text));
     return data[0];
 }
-// The POST size actually used by embedBatch: the smaller of the count ceiling
-// (thermal, Task 960) and the duration ceiling (throughput, Task 1533). At
-// defaults: min(32, floor(120000*0.8/6000)) = min(32, 16) = 16.
-function effectiveSubBatchSize() {
-    const durationCap = Math.max(1, Math.floor((exports.EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / exports.EMBED_MS_PER_INPUT));
-    return Math.min(exports.EMBED_SUBBATCH_SIZE, durationCap);
+// The character budget for one POST, decided from the device's *measured*
+// throughput rather than a fixed constant (Task 1553). Task 1533 sized every
+// POST by input count against `EMBED_MS_PER_INPUT`, a single optimistic
+// reading; on a device slower than that constant the derived POST was too large
+// to finish inside `EMBED_REQUEST_TIMEOUT_MS`, so it aborted and the atomic
+// ingest landed nothing. Sizing by *count* is also unsafe when inputs differ in
+// size — an embed's wall-time scales with its characters, so a POST sized from
+// a short probe (e.g. a document summary) over-provisions when the later inputs
+// are near-cap sections. Bound each POST by total characters instead:
+// `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / msPerChar)`, floored at 1. A near-zero
+// (very fast) rate yields an unbounded budget so the thermal count ceiling
+// (`EMBED_SUBBATCH_SIZE`, Task 960) governs instead.
+function subBatchCharBudget(msPerChar) {
+    const perChar = Math.max(msPerChar, Number.MIN_VALUE); // guard div-by-zero
+    return Math.max(1, Math.floor((exports.EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / perChar));
 }
 async function embedBatch(texts) {
     const inputs = texts.map(capInput);
-    const subBatch = effectiveSubBatchSize();
-    // Common case — an array within the sub-batch size is one POST, unchanged.
-    if (inputs.length <= subBatch) {
+    // 0 or 1 input is exactly one POST: the warm interactive query path is
+    // unaffected, and the empty-array behaviour is unchanged.
+    if (inputs.length <= 1) {
         return postBatch(inputs);
     }
-    // Oversized: split into sub-batches, cooling between each (not after the
-    // last). Vectors are concatenated in input order so callers can keep their
+    // Measure-and-size. Probe with one input, then pack each subsequent POST with
+    // as many inputs as fit the character budget derived from the worst
+    // ms-per-char seen so far, capped by the thermal count ceiling. Using the
+    // running max makes the budget monotonic — a mid-batch slowdown (e.g. the
+    // ingest itself loading the CPU) shrinks the remainder and it never re-expands
+    // into a timeout. Cool between POSTs (not after the last) so the SoC gets gaps
+    // (Task 960). Vectors concatenate in input order so callers keep their
     // index-aligned `embeddings[i]` ↔ `texts[i]` contract.
     const out = [];
-    for (let i = 0; i < inputs.length; i += subBatch) {
+    let maxMsPerChar = null;
+    for (let i = 0; i < inputs.length;) {
+        // Build the next chunk. With no measurement yet, probe with one input.
+        let end = i + 1;
+        if (maxMsPerChar !== null) {
+            const charBudget = subBatchCharBudget(maxMsPerChar);
+            let chars = inputs[i].length;
+            while (end < inputs.length &&
+                end - i < exports.EMBED_SUBBATCH_SIZE &&
+                chars + inputs[end].length <= charBudget) {
+                chars += inputs[end].length;
+                end += 1;
+            }
+        }
         if (i > 0 && exports.EMBED_SUBBATCH_COOLDOWN_MS > 0) {
             await sleep(exports.EMBED_SUBBATCH_COOLDOWN_MS);
         }
-        const chunk = inputs.slice(i, i + subBatch);
-        out.push(...(await postBatch(chunk)));
+        const chunk = inputs.slice(i, end);
+        const chunkChars = chunk.reduce((s, t) => s + t.length, 0);
+        const startedAt = Date.now();
+        const vectors = await postBatch(chunk);
+        const observedMsPerChar = (Date.now() - startedAt) / Math.max(chunkChars, 1);
+        maxMsPerChar =
+            maxMsPerChar === null ? observedMsPerChar : Math.max(maxMsPerChar, observedMsPerChar);
+        out.push(...vectors);
+        i = end;
     }
     return out;
 }

package/payload/platform/lib/embed-client/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gDAAgD;;;AAqKhD,sBAGC;AAKD,sDAMC;AAED,gCAqBC;AAxMD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACvG,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC9B,QAAA,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACR,MAAM,CACJ,uBAAuB,EACvB,CAAC,0BAA0B,GAAG,2BAA2B,CAAC;IACxD,gCAAgC,CACnC,CACF,CACF,CAAC;AAEF,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AACtE,sEAAsE;AACtE,qCAAqC;AACxB,QAAA,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACjF,QAAA,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAChD,CAAC,EACD,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAC3C,CAAC;AAEF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,0EAA0E;AAC1E,YAAY;AACC,QAAA,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,oBAAoB;AACP,QAAA,wBAAwB,GAAG,IAAI,CAAC,GAAG,CAC9C,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CACvD,CAAC;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,wEAAwE;AACxE,gEAAgE;AAChE,6EAA6E;AAC7E,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE;IAC/E,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtB,QAAA,gBAAgB,GAAoB,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACnF,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAC9B,CAAC,CAAC,oBAAoB,CAAC;AAEzB,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,6BAAqB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,MAAM,gBAAgB,6BAAqB,IAAI,CACtF,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAqB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,KAAwB;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,UAAU,YAAY,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,wBAAgB,EAAE,CAAC;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gCAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,gCAAwB,WAAW,MAAM,CAAC,MAAM,aAAa,QAAQ,IAAI,CACnG,CAAC;YACF,MAAM,IAAI,KAAK,CACb,wCAAwC,gCAAwB,cAAc,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,0HAA0H,CACnQ,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,KAAK,MAAM,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,uBAAuB,QAAQ,MAAM,IAAI,EAAE,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,MAAM,CAAC,MAAM,aAAa,QAAQ,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CAC9F,CAAC;IACF,OAAO,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,SAAS,CAAC,MAAgB;IACvC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,KAAK,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,gEAAgE;AAChE,SAAgB,qBAAqB;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,gCAAwB,GAAG,yBAAyB,CAAC,GAAG,0BAAkB,CAAC,CACxF,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,2BAAmB,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,KAAe;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IAEzC,2EAA2E;IAC3E,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,IAAI,kCAA0B,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC,kCAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gDAAgD;;;AAqLhD,sBAGC;AAcD,gDAMC;AAED,gCAgDC;AA5PD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACvG,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC9B,QAAA,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACR,MAAM,CACJ,uBAAuB,EACvB,CAAC,0BAA0B,GAAG,2BAA2B,CAAC;IACxD,gCAAgC,CACnC,CACF,CACF,CAAC;AAEF,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AACtE,sEAAsE;AACtE,qCAAqC;AACxB,QAAA,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACjF,QAAA,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAChD,CAAC,EACD,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAC3C,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,kDAAkD;AACrC,QAAA,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,8EAA8E;AAC9E,+EAA+E;AAC/E,6CAA6C;AAC7C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,oBAAoB;AACP,QAAA,wBAAwB,GAAG,IAAI,CAAC,GAAG,CAC9C,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CACvD,CAAC;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,wEAAwE;AACxE,gEAAgE;AAChE,6EAA6E;AAC7E,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE;IAC/E,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtB,QAAA,gBAAgB,GAAoB,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACnF,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAC9B,CAAC,CAAC,oBAAoB,CAAC;AAEzB,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,6BAAqB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,MAAM,gBAAgB,6BAAqB,IAAI,CACtF,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAqB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,KAAwB;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,UAAU,YAAY,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,wBAAgB,EAAE,CAAC;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gCAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,gCAAwB,WAAW,MAAM,CAAC,MAAM,aAAa,QAAQ,IAAI,CACnG,CAAC;YACF,MAAM,IAAI,KAAK,CACb,wCAAwC,gCAAwB,cAAc,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,0HAA0H,CACnQ,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,KAAK,MAAM,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,uBAAuB,QAAQ,MAAM,IAAI,EAAE,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,MAAM,CAAC,MAAM,aAAa,QAAQ,OAAO,EAAE,IAAI,CAC1E,CAAC;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,GAAG,0BAAkB,GAAG,sBAAsB,EAAE,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uCAAuC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,qBAAqB,0BAAkB,UAAU,CAAC,kBAAkB,GAAG,0BAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC/K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,SAAS,CAAC,MAAgB;IACvC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,KAAK,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,iFAAiF;AACjF,2EAA2E;AAC3E,qDAAqD;AACrD,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;IAC3E,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,gCAAwB,GAAG,yBAAyB,CAAC,GAAG,OAAO,CAAC,CAC7E,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,KAAe;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnC,uEAAuE;IACvE,0DAA0D;IAC1D,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAI,CAAC;QACpC,uEAAuE;QACvE,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,OACE,GAAG,GAAG,MAAM,CAAC,MAAM;gBACnB,GAAG,GAAG,CAAC,GAAG,2BAAmB;gBAC7B,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,UAAU,EACxC,CAAC;gBACD,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC5B,GAAG,IAAI,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,kCAA0B,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC,kCAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7E,YAAY;YACV,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACrB,CAAC,GAAG,GAAG,CAAC;IACV,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/payload/platform/lib/embed-client/src/index.ts

@@ -54,17 +54,21 @@ export const EMBED_SUBBATCH_COOLDOWN_MS = Math.max(
   envInt("EMBED_SUBBATCH_COOLDOWN_MS", 1000),
 );
 
-// Throughput-aware sub-batch sizing (Task 1533). On a CPU-only embedder each
-// input takes ~EMBED_MS_PER_INPUT ms; a fixed 32-input POST at the char cap is
-// ~128 s, past the 120 s request timeout, so a full-document batch aborts and
-// the atomic ingest write lands nothing. Bound each POST to 80% of the timeout
-// so it provably completes: derive a duration ceiling and take the smaller of
-// it and the count ceiling (EMBED_SUBBATCH_SIZE, Task 960's thermal cap).
-// EMBED_MS_PER_INPUT is the budgeted worst-case wall-time for one input at the
-// EMBED_INPUT_MAX_CHARS cap on the measured device; env-tunable for other
-// hardware.
+// Drift baseline (Task 1553). This was Task 1533's sizing driver — the budgeted
+// worst-case wall-time for one capped input — but sizing that from a single
+// fixed reading is exactly what over-provisioned a POST on a device slower than
+// the reading and aborted the ingest. Sizing is now measured per batch
+// (nextSubBatchSize), so EMBED_MS_PER_INPUT no longer drives it. It survives as
+// the reconciliation baseline: each POST compares its observed per-input time
+// against this budget and warns (op=drift) when the device runs slower, so a
+// device below budget is surfaced by a standing check rather than by a silent
+// ingest failure. Env-tunable for other hardware.
 export const EMBED_MS_PER_INPUT = Math.max(1, Math.floor(envInt("EMBED_MS_PER_INPUT", 6000)));
 const EMBED_TIMEOUT_UTILISATION = 0.8;
+// Warn (op=drift) once a POST's observed per-input time exceeds the budget by
+// this factor. 1.5 tolerates ordinary variance while catching a device that is
+// materially slower than EMBED_MS_PER_INPUT.
+const EMBED_DRIFT_WARN_RATIO = 1.5;
 
 // Explicit per-request timeout, well under undici's 300000ms headers default.
 // Without it a slow or wedged ollama returns no headers and the caller hangs a
@@ -157,9 +161,21 @@ async function embedRequest(input: string | string[]): Promise<number[][]> {
   // oversized or slow sub-batch is visible before it times out and the
   // throughput-aware sizing is verifiable from the log. inputs is the POST's
   // sub-batch size; maxChars its largest input.
+  const ms = Date.now() - startedAt;
   process.stderr.write(
-    `[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${Date.now() - startedAt}\n`,
+    `[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${ms}\n`,
   );
+  // Standing reconciliation (Task 1553). Compare this POST's observed per-input
+  // time against the EMBED_MS_PER_INPUT budget and warn on drift, so a device
+  // slower than budget is caught by a check rather than by a later ingest that
+  // aborts. Sizing already adapts to the true rate; this line makes the
+  // slowness legible.
+  const observedMsPerInput = ms / inputs.length;
+  if (inputs.length > 0 && observedMsPerInput > EMBED_MS_PER_INPUT * EMBED_DRIFT_WARN_RATIO) {
+    process.stderr.write(
+      `[embed] op=drift observedMsPerInput=${Math.round(observedMsPerInput)} budgetMsPerInput=${EMBED_MS_PER_INPUT} ratio=${(observedMsPerInput / EMBED_MS_PER_INPUT).toFixed(1)}\n`,
+    );
+  }
   return data.embeddings;
 }
 
@@ -173,36 +189,72 @@ export async function embed(text: string): Promise<number[]> {
   return data[0];
 }
 
-// The POST size actually used by embedBatch: the smaller of the count ceiling
-// (thermal, Task 960) and the duration ceiling (throughput, Task 1533). At
-// defaults: min(32, floor(120000*0.8/6000)) = min(32, 16) = 16.
-export function effectiveSubBatchSize(): number {
-  const durationCap = Math.max(
+// The character budget for one POST, decided from the device's *measured*
+// throughput rather than a fixed constant (Task 1553). Task 1533 sized every
+// POST by input count against `EMBED_MS_PER_INPUT`, a single optimistic
+// reading; on a device slower than that constant the derived POST was too large
+// to finish inside `EMBED_REQUEST_TIMEOUT_MS`, so it aborted and the atomic
+// ingest landed nothing. Sizing by *count* is also unsafe when inputs differ in
+// size — an embed's wall-time scales with its characters, so a POST sized from
+// a short probe (e.g. a document summary) over-provisions when the later inputs
+// are near-cap sections. Bound each POST by total characters instead:
+// `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / msPerChar)`, floored at 1. A near-zero
+// (very fast) rate yields an unbounded budget so the thermal count ceiling
+// (`EMBED_SUBBATCH_SIZE`, Task 960) governs instead.
+export function subBatchCharBudget(msPerChar: number): number {
+  const perChar = Math.max(msPerChar, Number.MIN_VALUE); // guard div-by-zero
+  return Math.max(
     1,
-    Math.floor((EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / EMBED_MS_PER_INPUT),
+    Math.floor((EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / perChar),
   );
-  return Math.min(EMBED_SUBBATCH_SIZE, durationCap);
 }
 
 export async function embedBatch(texts: string[]): Promise<number[][]> {
   const inputs = texts.map(capInput);
-  const subBatch = effectiveSubBatchSize();
 
-  // Common case — an array within the sub-batch size is one POST, unchanged.
-  if (inputs.length <= subBatch) {
+  // 0 or 1 input is exactly one POST: the warm interactive query path is
+  // unaffected, and the empty-array behaviour is unchanged.
+  if (inputs.length <= 1) {
     return postBatch(inputs);
   }
 
-  // Oversized: split into sub-batches, cooling between each (not after the
-  // last). Vectors are concatenated in input order so callers can keep their
+  // Measure-and-size. Probe with one input, then pack each subsequent POST with
+  // as many inputs as fit the character budget derived from the worst
+  // ms-per-char seen so far, capped by the thermal count ceiling. Using the
+  // running max makes the budget monotonic — a mid-batch slowdown (e.g. the
+  // ingest itself loading the CPU) shrinks the remainder and it never re-expands
+  // into a timeout. Cool between POSTs (not after the last) so the SoC gets gaps
+  // (Task 960). Vectors concatenate in input order so callers keep their
   // index-aligned `embeddings[i]` ↔ `texts[i]` contract.
   const out: number[][] = [];
-  for (let i = 0; i < inputs.length; i += subBatch) {
+  let maxMsPerChar: number | null = null;
+  for (let i = 0; i < inputs.length; ) {
+    // Build the next chunk. With no measurement yet, probe with one input.
+    let end = i + 1;
+    if (maxMsPerChar !== null) {
+      const charBudget = subBatchCharBudget(maxMsPerChar);
+      let chars = inputs[i].length;
+      while (
+        end < inputs.length &&
+        end - i < EMBED_SUBBATCH_SIZE &&
+        chars + inputs[end].length <= charBudget
+      ) {
+        chars += inputs[end].length;
+        end += 1;
+      }
+    }
     if (i > 0 && EMBED_SUBBATCH_COOLDOWN_MS > 0) {
       await sleep(EMBED_SUBBATCH_COOLDOWN_MS);
     }
-    const chunk = inputs.slice(i, i + subBatch);
-    out.push(...(await postBatch(chunk)));
+    const chunk = inputs.slice(i, end);
+    const chunkChars = chunk.reduce((s, t) => s + t.length, 0);
+    const startedAt = Date.now();
+    const vectors = await postBatch(chunk);
+    const observedMsPerChar = (Date.now() - startedAt) / Math.max(chunkChars, 1);
+    maxMsPerChar =
+      maxMsPerChar === null ? observedMsPerChar : Math.max(maxMsPerChar, observedMsPerChar);
+    out.push(...vectors);
+    i = end;
   }
   return out;
 }

package/payload/platform/plugins/admin/PLUGIN.md

@@ -174,6 +174,7 @@ Tools are available via the `admin` MCP server.
 
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
+- `hooks/askuserquestion-channel-carrier-gate.sh` — PreToolUse matcher=`AskUserQuestion`, registered as a **second command on the same matcher** as the investigate-gate (either exit 2 blocks; the two guard different conditions). Blocks the question (exit 2) when the session has a native channel attached, because the Claude Code channel protocol carries only the two permission methods — there is no carrier for the `AskUserQuestion` elicitation, so on an rc-spawn channel (webchat/WhatsApp/Telegram) session the harness would block the turn awaiting a selection that can never arrive and the reader renders only delivered replies, wedging the turn (live SiteDesk incident session `1a085718` 2026-07-11: `/chat` stalled on the delivered "On it…" ack with no card). **Signal:** the rc-spawn writes the channel MCP registration as a config file in `os.tmpdir()` keyed by session id (`maxy-channel-<sid>.json` / `maxy-webchat-channel-<sid>.json` / `maxy-wa-channel-<sid>.json` / `maxy-telegram-channel-<sid>.json`, `sid` sanitized `[^A-Za-z0-9_-]→_` exactly as the writers do); its presence at tool-call time is the authoritative "channel attached to this session" marker. The hook resolves the tmpdir the way Node's `os.tmpdir()` does (`${TMPDIR:-/tmp}`, trailing slash stripped). Correct in both readings of the claude.ai/code scoping question: a Pi channel process sees the tmpfile (block); a claude.ai/code process on another host never sees the Pi tmpfile (fail-open → allow, that surface can answer the card). **Block message:** `Blocked: this is a native-channel session and AskUserQuestion cannot be delivered over a channel (the channel protocol carries no elicitation card, so the turn would wedge). Ask the same question as prose in your channel reply tool and wait for the operator's next message.` **Log line** (stderr, one per decisive call): `[ask-channel] decision=<allow|block> sessionId=<id8> channel=<attached|none> reason=<channel-attached|no-channel|fail-open-no-envelope|fail-open-no-session>`. **Fail-open** on no envelope, blank session id, or absent channel file — nudges, never bricks the UI. The complementary standing check (`interactive-wedge` in the session manager) catches any un-carried interactive tool_use that slips past this hook.
 - `hooks/mcp-tool-missing.sh` — **PostToolUse hook on `mcp__.*` (directive 3).** Defence-in-depth for the `No such tool available: mcp__…` failure class that the name-binding is built to eliminate. Fires on any MCP tool call; no-op unless the `tool_response` carries `No such tool available` AND the qualified name resolves to a maxy plugin (read from the generated `hooks/lib/maxy-mcp-plugins.txt`). On a maxy match it logs one deterministic `[mcp-tool-missing] server=<server> tool=<tool>` line and exits 2 with a fixed envelope on stderr, so the agent relays a named server-unavailable failure instead of narrating "warming up" or blind-retrying. A missing non-maxy bridge tool (Playwright etc., upstream-owned) passes through (exit 0). The maxy-plugin list is regenerated and gate-diffed by `platform/scripts/check-canonical-tool-names.mjs`.
 - `hooks/post-tool-use-agent.sh` — **PostToolUse hook on `Agent`.** Drains any subagent hook-decision buffers under `~/.maxy-code/logs/hook-decisions/` modified since this parent's previous PostToolUse-Agent fire (cursor file keyed by parent session id), prints one `[hook-propagate]` line per record to stdout — Claude Code attaches the stdout as a `hook_success` attachment on the parent JSONL, making the records grep-queryable from the parent session alone. Rotates consumed buffers to `consumed/`. Emits one `[hook-propagate-census] parentSession=<…> subagentHooksObserved=<N> attachmentsEmitted=<M>` line per fire to stdout and server.log; `N != M` is the propagation regression signal. The companion emitter library `hooks/lib/hook-emit.sh` is sourced by `post-tool-use-agent.sh` and any other hook that records a block decision (4 KB stderr truncation, `truncated=true` set on the record).
 - `hooks/admin-authoring-observer.sh` — **PostToolUse hook on Write and Edit.** Observation only — never blocks; exits 0 on every path. Fires when the admin agent (not a specialist subagent — gated by `MAXY_SPECIALIST` env) writes or edits a file under `<accountDir>/output/`. Walks the session transcript from the latest real-user turn forward to detect any prior `Task` `tool_use` whose `subagent_type` starts with `specialists:`. Emits one stderr line `[admin-authoring] inline-write path=<rel> priorSpecialistSpawnInTurn=<true|false|unknown>`. A `false` value on a long-form prose file is the regression signal this hook was designed to make visible — the BioSymm proposal session (admin authored a customer-facing proposal inline despite content-producer being installed) is the failure mode this surfaces mechanically. Mechanical enforcement (refuse the write, force a re-spawn) is deferred per the task spec.

package/payload/platform/plugins/admin/hooks/__tests__/askuserquestion-channel-carrier-gate.test.sh

@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+# Regression test for askuserquestion-channel-carrier-gate.sh.
+#
+# The hook blocks AskUserQuestion when the session has a native channel
+# attached — signalled by a channel MCP config file for this session id in
+# tmpdir. A channel carries no elicitation card, so the turn would wedge; the
+# hook steers the agent to ask in prose via its channel reply tool instead.
+#
+# Covers (per .tasks/1552):
+#   1. Channel attached (webchat config file present) + AskUserQuestion  → BLOCK channel-attached
+#   2. No channel file + AskUserQuestion                                 → ALLOW no-channel
+#   3. Non-AskUserQuestion tool                                          → exit 0 silent (no [ask-channel] line)
+#   4. PostToolUse event on AskUserQuestion                             → exit 0 silent
+#   5. Missing session_id                                               → ALLOW fail-open-no-session
+#   6. No stdin envelope                                                → ALLOW fail-open-no-envelope
+#   7. Each of the 4 channel filename shapes present                    → BLOCK channel-attached
+#   8. Session id needing sanitization, sanitized file present          → BLOCK channel-attached
+#
+# All decisive cases assert exit code AND the decision-log signature on stderr.
+
+set -u
+
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/askuserquestion-channel-carrier-gate.sh"
+if [ ! -x "$HOOK" ]; then
+  echo "FAIL: $HOOK not executable" >&2
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+
+# Run one case. Args:
+#   $1 = name
+#   $2 = stdin payload ("" for no-envelope: closed stdin)
+#   $3 = tmpdir the hook should scan (ASK_CHANNEL_TMPDIR override), "" for default
+#   $4 = expected exit code
+#   $5 = expected log signature regex (matched against stderr; "" = assert stderr is empty)
+run_case() {
+  local name="$1" stdin="$2" scan_dir="$3" expected_exit="$4" expected_log_re="$5"
+  local stderr_file actual_exit
+  stderr_file="$(mktemp)"
+  if [ -z "$stdin" ]; then
+    # No envelope: close stdin so the hook's `[ -t 0 ]` / empty-read path fires.
+    ASK_CHANNEL_TMPDIR="$scan_dir" bash "$HOOK" >/dev/null 2>"$stderr_file" </dev/null
+  else
+    printf '%s' "$stdin" | ASK_CHANNEL_TMPDIR="$scan_dir" bash "$HOOK" >/dev/null 2>"$stderr_file"
+  fi
+  actual_exit=$?
+  local stderr_content
+  stderr_content=$(cat "$stderr_file")
+  rm -f "$stderr_file"
+
+  local exit_ok=0 log_ok=0
+  if [ "$actual_exit" -eq "$expected_exit" ]; then exit_ok=1; fi
+  if [ -z "$expected_log_re" ]; then
+    # Empty regex means: assert the hook emitted NO [ask-channel] line.
+    if ! printf '%s' "$stderr_content" | grep -q '\[ask-channel\]'; then log_ok=1; fi
+  else
+    if printf '%s' "$stderr_content" | grep -Eq "$expected_log_re"; then log_ok=1; fi
+  fi
+
+  if [ $exit_ok -eq 1 ] && [ $log_ok -eq 1 ]; then
+    echo "PASS: $name (exit=$actual_exit)"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL: $name" >&2
+    [ $exit_ok -eq 0 ] && echo "  expected exit=$expected_exit, got=$actual_exit" >&2
+    [ $log_ok -eq 0 ]  && echo "  expected log regex: ${expected_log_re:-<none>}" >&2 && \
+                          echo "  actual stderr: $stderr_content" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+SID="1a085718-1111-2222-3333-444455556666"
+SID8="1a085718"
+
+# Stdin payloads.
+PRE_ASK="{\"hook_event_name\":\"PreToolUse\",\"tool_name\":\"AskUserQuestion\",\"session_id\":\"$SID\",\"tool_input\":{\"questions\":[]}}"
+PRE_OTHER="{\"hook_event_name\":\"PreToolUse\",\"tool_name\":\"Bash\",\"session_id\":\"$SID\",\"tool_input\":{\"command\":\"ls\"}}"
+POST_ASK="{\"hook_event_name\":\"PostToolUse\",\"tool_name\":\"AskUserQuestion\",\"session_id\":\"$SID\",\"tool_input\":{\"questions\":[]}}"
+PRE_ASK_NO_SID='{"hook_event_name":"PreToolUse","tool_name":"AskUserQuestion","tool_input":{"questions":[]}}'
+
+# ---------- Cases ----------
+
+# 1. Channel attached (webchat config present) → BLOCK.
+DIR_WEBCHAT=$(mktemp -d)
+: > "$DIR_WEBCHAT/maxy-webchat-channel-$SID.json"
+run_case "Webchat channel attached → BLOCK channel-attached" \
+  "$PRE_ASK" "$DIR_WEBCHAT" 2 \
+  "\[ask-channel\] decision=block sessionId=$SID8 channel=attached reason=channel-attached"
+rm -rf "$DIR_WEBCHAT"
+
+# 2. No channel file → ALLOW no-channel.
+DIR_EMPTY=$(mktemp -d)
+run_case "No channel file → ALLOW no-channel" \
+  "$PRE_ASK" "$DIR_EMPTY" 0 \
+  "\[ask-channel\] decision=allow sessionId=$SID8 channel=none reason=no-channel"
+rm -rf "$DIR_EMPTY"
+
+# 3. Non-AskUserQuestion tool → silent exit 0.
+DIR_WITH_FILE=$(mktemp -d)
+: > "$DIR_WITH_FILE/maxy-webchat-channel-$SID.json"
+run_case "Non-AskUserQuestion tool → exit 0 silent" \
+  "$PRE_OTHER" "$DIR_WITH_FILE" 0 ""
+rm -rf "$DIR_WITH_FILE"
+
+# 4. PostToolUse event → silent exit 0 (even with channel file present).
+DIR_POST=$(mktemp -d)
+: > "$DIR_POST/maxy-webchat-channel-$SID.json"
+run_case "PostToolUse on AskUserQuestion → exit 0 silent" \
+  "$POST_ASK" "$DIR_POST" 0 ""
+rm -rf "$DIR_POST"
+
+# 5. Missing session_id → ALLOW fail-open-no-session.
+DIR_NOSID=$(mktemp -d)
+run_case "Missing session_id → ALLOW fail-open-no-session" \
+  "$PRE_ASK_NO_SID" "$DIR_NOSID" 0 \
+  '\[ask-channel\] decision=allow sessionId=- channel=none reason=fail-open-no-session'
+rm -rf "$DIR_NOSID"
+
+# 6. No stdin envelope → ALLOW fail-open-no-envelope.
+run_case "No stdin envelope → ALLOW fail-open-no-envelope" \
+  "" "" 0 \
+  '\[ask-channel\] decision=allow sessionId=- channel=none reason=fail-open-no-envelope'
+
+# 7. Each of the 4 channel filename shapes present → BLOCK.
+for kind in channel webchat-channel wa-channel telegram-channel; do
+  DIR_KIND=$(mktemp -d)
+  : > "$DIR_KIND/maxy-$kind-$SID.json"
+  run_case "Channel file shape maxy-$kind-<sid>.json → BLOCK channel-attached" \
+    "$PRE_ASK" "$DIR_KIND" 2 \
+    "\[ask-channel\] decision=block sessionId=$SID8 channel=attached reason=channel-attached"
+  rm -rf "$DIR_KIND"
+done
+
+# 8. Session id needing sanitization: raw id has chars outside [A-Za-z0-9_-];
+#    the writer sanitizes to '_', so the on-disk file uses the sanitized id.
+RAW_SID="acc/one:sess"          # '/' and ':' are sanitized to '_'
+SAN_SID="acc_one_sess"
+DIR_SAN=$(mktemp -d)
+: > "$DIR_SAN/maxy-webchat-channel-$SAN_SID.json"
+PRE_ASK_RAW="{\"hook_event_name\":\"PreToolUse\",\"tool_name\":\"AskUserQuestion\",\"session_id\":\"$RAW_SID\",\"tool_input\":{\"questions\":[]}}"
+run_case "Sanitized session id resolves the file → BLOCK channel-attached" \
+  "$PRE_ASK_RAW" "$DIR_SAN" 2 \
+  '\[ask-channel\] decision=block sessionId=acc/one: channel=attached reason=channel-attached'
+rm -rf "$DIR_SAN"
+
+# 9. Real tmpdir resolution fallback: no ASK_CHANNEL_TMPDIR override, TMPDIR
+#    unset, TMP set → the hook must resolve TMP (mirroring Node's os.tmpdir())
+#    and find the config file there. Proves the production resolution order, not
+#    just the test override.
+DIR_TMP=$(mktemp -d)
+: > "$DIR_TMP/maxy-webchat-channel-$SID.json"
+tmp_stderr="$(mktemp)"
+printf '%s' "$PRE_ASK" | env -u TMPDIR -u ASK_CHANNEL_TMPDIR -u TEMP TMP="$DIR_TMP" \
+  bash "$HOOK" >/dev/null 2>"$tmp_stderr"
+tmp_exit=$?
+if [ "$tmp_exit" -eq 2 ] && grep -Eq "\[ask-channel\] decision=block sessionId=$SID8 channel=attached reason=channel-attached" "$tmp_stderr"; then
+  echo "PASS: TMP-fallback resolution finds the config file → BLOCK (exit=$tmp_exit)"
+  PASS=$((PASS + 1))
+else
+  echo "FAIL: TMP-fallback resolution" >&2
+  echo "  expected exit=2 got=$tmp_exit; stderr: $(cat "$tmp_stderr")" >&2
+  FAIL=$((FAIL + 1))
+fi
+rm -f "$tmp_stderr"
+rm -rf "$DIR_TMP"
+
+echo
+echo "──────── askuserquestion-channel-carrier-gate test summary ────────"
+echo "PASS: $PASS"
+echo "FAIL: $FAIL"
+
+[ "$FAIL" -gt 0 ] && exit 1
+exit 0