@rubytech/create-maxy-code 0.1.434 → 0.1.436

package/payload/platform/lib/embed-client/dist/index.js

@@ -8,7 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EMBED_KEEP_ALIVE = exports.EMBED_REQUEST_TIMEOUT_MS = exports.EMBED_MS_PER_INPUT = exports.EMBED_SUBBATCH_COOLDOWN_MS = exports.EMBED_SUBBATCH_SIZE = exports.EMBED_INPUT_MAX_CHARS = void 0;
 exports.embed = embed;
-exports.effectiveSubBatchSize = effectiveSubBatchSize;
+exports.subBatchCharBudget = subBatchCharBudget;
 exports.embedBatch = embedBatch;
 const OLLAMA_URL = process.env.OLLAMA_URL ?? "http://localhost:11434";
 const EMBED_MODEL = process.env.EMBED_MODEL ?? "nomic-embed-text";
@@ -19,17 +19,18 @@ function envInt(name, def) {
     const n = Number(raw);
     return Number.isFinite(n) ? n : def;
 }
-// nomic-embed-text's usable embed context is 2048 tokens. The old 8000-char cap
-// assumed ~4 chars/token, but dense emoji/markup content runs richer, so a
-// section that passed the char cap still errored with "input length exceeds the
-// context length". Size the default against a conservative 3 chars/token worst
-// case, reserving a small token margin for the tokenizer's specials, so a capped
-// input is provably under context: (2048 - 48) * 3 = 6000. Context is
-// env-overridable so raising it raises the cap; EMBED_INPUT_MAX_CHARS is also
-// directly overridable.
+// nomic-embed-text's usable embed context is 2048 tokens. The cap has been
+// tightened twice against real 400s: 8000 (assumed ~4 chars/token) still
+// overflowed on dense emoji/markup, then 6000 (~3 chars/token) still 400'd on
+// the densest sections with "input length exceeds the context length" because
+// that content runs closer to ~2 chars/token. Size the default against a
+// conservative 2 chars/token worst case, reserving a small token margin for the
+// tokenizer's specials, so a capped input is provably under context:
+// (2048 - 48) * 2 = 4000 (Task 1558). Context is env-overridable so raising it
+// raises the cap; EMBED_INPUT_MAX_CHARS is also directly overridable.
 const EMBED_MODEL_CONTEXT_TOKENS = Math.max(1, Math.floor(envInt("EMBED_MODEL_CONTEXT_TOKENS", 2048)));
 const EMBED_CONTEXT_MARGIN_TOKENS = 48;
-const EMBED_WORST_CASE_CHARS_PER_TOKEN = 3;
+const EMBED_WORST_CASE_CHARS_PER_TOKEN = 2;
 exports.EMBED_INPUT_MAX_CHARS = Math.max(1, Math.floor(envInt("EMBED_INPUT_MAX_CHARS", (EMBED_MODEL_CONTEXT_TOKENS - EMBED_CONTEXT_MARGIN_TOKENS) *
     EMBED_WORST_CASE_CHARS_PER_TOKEN)));
 // Batch pacing (Task 960). On a passively-cooled Pi, embedding a whole
@@ -43,19 +44,36 @@ exports.EMBED_INPUT_MAX_CHARS = Math.max(1, Math.floor(envInt("EMBED_INPUT_MAX_C
 // this pacing is defence-in-depth and faster recovery. Both knobs are
 // env-overridable so an operator can tune them from on-device thermal
 // measurement without a code change.
-exports.EMBED_SUBBATCH_SIZE = Math.max(1, Math.floor(envInt("EMBED_SUBBATCH_SIZE", 32)));
+//
+// Count ceiling after adaptive sizing (Task 1558). Since Task 1553 each POST is
+// sized by a character budget derived from the device's *measured* ms-per-char,
+// so EMBED_SUBBATCH_SIZE is no longer the primary timeout guard — it is the hard
+// count cap layered on top. It still matters for the one case the char budget
+// cannot catch: the budget is derived from the probe's observed rate, so if the
+// probe runs while the machine is briefly quiet the budget is large and the next
+// POST packs up to this ceiling; if desktop contention then spikes mid-batch,
+// that POST runs far slower than measured and can blow EMBED_REQUEST_TIMEOUT_MS.
+// A ceiling of 4 bounds that worst case (~4 x 17s cold-CPU embeds on a contended
+// shared desktop ~= 68s, under the 120s timeout) so a fast-probe-then-contention
+// batch still fits. On a quiet dedicated appliance (a Pi) the char budget, not
+// this count, is the binding constraint.
+exports.EMBED_SUBBATCH_SIZE = Math.max(1, Math.floor(envInt("EMBED_SUBBATCH_SIZE", 4)));
 exports.EMBED_SUBBATCH_COOLDOWN_MS = Math.max(0, envInt("EMBED_SUBBATCH_COOLDOWN_MS", 1000));
-// Throughput-aware sub-batch sizing (Task 1533). On a CPU-only embedder each
-// input takes ~EMBED_MS_PER_INPUT ms; a fixed 32-input POST at the char cap is
-// ~128 s, past the 120 s request timeout, so a full-document batch aborts and
-// the atomic ingest write lands nothing. Bound each POST to 80% of the timeout
-// so it provably completes: derive a duration ceiling and take the smaller of
-// it and the count ceiling (EMBED_SUBBATCH_SIZE, Task 960's thermal cap).
-// EMBED_MS_PER_INPUT is the budgeted worst-case wall-time for one input at the
-// EMBED_INPUT_MAX_CHARS cap on the measured device; env-tunable for other
-// hardware.
+// Drift baseline (Task 1553). This was Task 1533's sizing driver — the budgeted
+// worst-case wall-time for one capped input — but sizing that from a single
+// fixed reading is exactly what over-provisioned a POST on a device slower than
+// the reading and aborted the ingest. Sizing is now measured per batch
+// (nextSubBatchSize), so EMBED_MS_PER_INPUT no longer drives it. It survives as
+// the reconciliation baseline: each POST compares its observed per-input time
+// against this budget and warns (op=drift) when the device runs slower, so a
+// device below budget is surfaced by a standing check rather than by a silent
+// ingest failure. Env-tunable for other hardware.
 exports.EMBED_MS_PER_INPUT = Math.max(1, Math.floor(envInt("EMBED_MS_PER_INPUT", 6000)));
 const EMBED_TIMEOUT_UTILISATION = 0.8;
+// Warn (op=drift) once a POST's observed per-input time exceeds the budget by
+// this factor. 1.5 tolerates ordinary variance while catching a device that is
+// materially slower than EMBED_MS_PER_INPUT.
+const EMBED_DRIFT_WARN_RATIO = 1.5;
 // Explicit per-request timeout, well under undici's 300000ms headers default.
 // Without it a slow or wedged ollama returns no headers and the caller hangs a
 // silent 5 minutes before a bare `fetch failed`. With it the request aborts in
@@ -130,7 +148,17 @@ async function embedRequest(input) {
     // oversized or slow sub-batch is visible before it times out and the
     // throughput-aware sizing is verifiable from the log. inputs is the POST's
     // sub-batch size; maxChars its largest input.
-    process.stderr.write(`[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${Date.now() - startedAt}\n`);
+    const ms = Date.now() - startedAt;
+    process.stderr.write(`[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${ms}\n`);
+    // Standing reconciliation (Task 1553). Compare this POST's observed per-input
+    // time against the EMBED_MS_PER_INPUT budget and warn on drift, so a device
+    // slower than budget is caught by a check rather than by a later ingest that
+    // aborts. Sizing already adapts to the true rate; this line makes the
+    // slowness legible.
+    const observedMsPerInput = ms / inputs.length;
+    if (inputs.length > 0 && observedMsPerInput > exports.EMBED_MS_PER_INPUT * EMBED_DRIFT_WARN_RATIO) {
+        process.stderr.write(`[embed] op=drift observedMsPerInput=${Math.round(observedMsPerInput)} budgetMsPerInput=${exports.EMBED_MS_PER_INPUT} ratio=${(observedMsPerInput / exports.EMBED_MS_PER_INPUT).toFixed(1)}\n`);
+    }
     return data.embeddings;
 }
 // POST one already-capped sub-batch of inputs to the embed endpoint.
@@ -141,30 +169,79 @@ async function embed(text) {
     const data = await embedRequest(capInput(text));
     return data[0];
 }
-// The POST size actually used by embedBatch: the smaller of the count ceiling
-// (thermal, Task 960) and the duration ceiling (throughput, Task 1533). At
-// defaults: min(32, floor(120000*0.8/6000)) = min(32, 16) = 16.
-function effectiveSubBatchSize() {
-    const durationCap = Math.max(1, Math.floor((exports.EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / exports.EMBED_MS_PER_INPUT));
-    return Math.min(exports.EMBED_SUBBATCH_SIZE, durationCap);
+// The character budget for one POST, decided from the device's *measured*
+// throughput rather than a fixed constant (Task 1553). Task 1533 sized every
+// POST by input count against `EMBED_MS_PER_INPUT`, a single optimistic
+// reading; on a device slower than that constant the derived POST was too large
+// to finish inside `EMBED_REQUEST_TIMEOUT_MS`, so it aborted and the atomic
+// ingest landed nothing. Sizing by *count* is also unsafe when inputs differ in
+// size — an embed's wall-time scales with its characters, so a POST sized from
+// a short probe (e.g. a document summary) over-provisions when the later inputs
+// are near-cap sections. Bound each POST by total characters instead:
+// `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / msPerChar)`, floored at 1. A near-zero
+// (very fast) rate yields an unbounded budget so the thermal count ceiling
+// (`EMBED_SUBBATCH_SIZE`, Task 960) governs instead.
+function subBatchCharBudget(msPerChar) {
+    const perChar = Math.max(msPerChar, Number.MIN_VALUE); // guard div-by-zero
+    return Math.max(1, Math.floor((exports.EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / perChar));
 }
-async function embedBatch(texts) {
+async function embedBatch(texts, 
+// Progress callback (Task 1555). Fired after each sub-batch POST resolves
+// with (done, total): done = cumulative inputs embedded so far, total =
+// inputs.length. memory-ingest passes a callback that emits an MCP progress
+// notification per POST, which resets Claude Code's ~30-minute stdio idle
+// timer so a long single ingest is not aborted mid-write. Kept MCP-agnostic
+// — a plain (done, total) callback — so embed-client carries no MCP concepts
+// and every existing one-arg caller is unchanged.
+onProgress) {
     const inputs = texts.map(capInput);
-    const subBatch = effectiveSubBatchSize();
-    // Common case — an array within the sub-batch size is one POST, unchanged.
-    if (inputs.length <= subBatch) {
-        return postBatch(inputs);
+    // 0 or 1 input is exactly one POST: the warm interactive query path is
+    // unaffected, and the empty-array behaviour is unchanged. Report once so the
+    // callback contract ("fires after every POST") holds on this path too.
+    if (inputs.length <= 1) {
+        const vectors = await postBatch(inputs);
+        onProgress?.(inputs.length, inputs.length);
+        return vectors;
     }
-    // Oversized: split into sub-batches, cooling between each (not after the
-    // last). Vectors are concatenated in input order so callers can keep their
+    // Measure-and-size. Probe with one input, then pack each subsequent POST with
+    // as many inputs as fit the character budget derived from the worst
+    // ms-per-char seen so far, capped by the thermal count ceiling. Using the
+    // running max makes the budget monotonic — a mid-batch slowdown (e.g. the
+    // ingest itself loading the CPU) shrinks the remainder and it never re-expands
+    // into a timeout. Cool between POSTs (not after the last) so the SoC gets gaps
+    // (Task 960). Vectors concatenate in input order so callers keep their
     // index-aligned `embeddings[i]` ↔ `texts[i]` contract.
     const out = [];
-    for (let i = 0; i < inputs.length; i += subBatch) {
+    let maxMsPerChar = null;
+    for (let i = 0; i < inputs.length;) {
+        // Build the next chunk. With no measurement yet, probe with one input.
+        let end = i + 1;
+        if (maxMsPerChar !== null) {
+            const charBudget = subBatchCharBudget(maxMsPerChar);
+            let chars = inputs[i].length;
+            while (end < inputs.length &&
+                end - i < exports.EMBED_SUBBATCH_SIZE &&
+                chars + inputs[end].length <= charBudget) {
+                chars += inputs[end].length;
+                end += 1;
+            }
+        }
         if (i > 0 && exports.EMBED_SUBBATCH_COOLDOWN_MS > 0) {
             await sleep(exports.EMBED_SUBBATCH_COOLDOWN_MS);
         }
-        const chunk = inputs.slice(i, i + subBatch);
-        out.push(...(await postBatch(chunk)));
+        const chunk = inputs.slice(i, end);
+        const chunkChars = chunk.reduce((s, t) => s + t.length, 0);
+        const startedAt = Date.now();
+        const vectors = await postBatch(chunk);
+        const observedMsPerChar = (Date.now() - startedAt) / Math.max(chunkChars, 1);
+        maxMsPerChar =
+            maxMsPerChar === null ? observedMsPerChar : Math.max(maxMsPerChar, observedMsPerChar);
+        out.push(...vectors);
+        i = end;
+        // Report progress after each POST resolves. out.length is the cumulative
+        // inputs embedded so far; the final iteration reports out.length ===
+        // inputs.length.
+        onProgress?.(out.length, inputs.length);
     }
     return out;
 }

package/payload/platform/lib/embed-client/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gDAAgD;;;AAqKhD,sBAGC;AAKD,sDAMC;AAED,gCAqBC;AAxMD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,sEAAsE;AACtE,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACvG,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC9B,QAAA,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACR,MAAM,CACJ,uBAAuB,EACvB,CAAC,0BAA0B,GAAG,2BAA2B,CAAC;IACxD,gCAAgC,CACnC,CACF,CACF,CAAC;AAEF,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AACtE,sEAAsE;AACtE,qCAAqC;AACxB,QAAA,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AACjF,QAAA,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAChD,CAAC,EACD,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAC3C,CAAC;AAEF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,0EAA0E;AAC1E,YAAY;AACC,QAAA,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,oBAAoB;AACP,QAAA,wBAAwB,GAAG,IAAI,CAAC,GAAG,CAC9C,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CACvD,CAAC;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,wEAAwE;AACxE,gEAAgE;AAChE,6EAA6E;AAC7E,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE;IAC/E,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtB,QAAA,gBAAgB,GAAoB,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACnF,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAC9B,CAAC,CAAC,oBAAoB,CAAC;AAEzB,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,6BAAqB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,MAAM,gBAAgB,6BAAqB,IAAI,CACtF,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAqB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,KAAwB;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,UAAU,YAAY,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,wBAAgB,EAAE,CAAC;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gCAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,gCAAwB,WAAW,MAAM,CAAC,MAAM,aAAa,QAAQ,IAAI,CACnG,CAAC;YACF,MAAM,IAAI,KAAK,CACb,wCAAwC,gCAAwB,cAAc,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,0HAA0H,CACnQ,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,KAAK,MAAM,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,uBAAuB,QAAQ,MAAM,IAAI,EAAE,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,8CAA8C;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,MAAM,CAAC,MAAM,aAAa,QAAQ,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,IAAI,CAC9F,CAAC;IACF,OAAO,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,SAAS,CAAC,MAAgB;IACvC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,KAAK,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,gEAAgE;AAChE,SAAgB,qBAAqB;IACnC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAC1B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,gCAAwB,GAAG,yBAAyB,CAAC,GAAG,0BAAkB,CAAC,CACxF,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,2BAAmB,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,KAAe;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IAEzC,2EAA2E;IAC3E,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,uDAAuD;IACvD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,IAAI,kCAA0B,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC,kCAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,gDAAgD;;;AAmMhD,sBAGC;AAcD,gDAMC;AAED,gCAiEC;AA3RD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,wBAAwB,CAAC;AACtE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,kBAAkB,CAAC;AAElE,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,qEAAqE;AACrE,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACvG,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC9B,QAAA,qBAAqB,GAAG,IAAI,CAAC,GAAG,CAC3C,CAAC,EACD,IAAI,CAAC,KAAK,CACR,MAAM,CACJ,uBAAuB,EACvB,CAAC,0BAA0B,GAAG,2BAA2B,CAAC;IACxD,gCAAgC,CACnC,CACF,CACF,CAAC;AAEF,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AACtE,sEAAsE;AACtE,qCAAqC;AACrC,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,yCAAyC;AAC5B,QAAA,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,QAAA,0BAA0B,GAAG,IAAI,CAAC,GAAG,CAChD,CAAC,EACD,MAAM,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAC3C,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,kDAAkD;AACrC,QAAA,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9F,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,8EAA8E;AAC9E,+EAA+E;AAC/E,6CAA6C;AAC7C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,oBAAoB;AACP,QAAA,wBAAwB,GAAG,IAAI,CAAC,GAAG,CAC9C,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CACvD,CAAC;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,wEAAwE;AACxE,gEAAgE;AAChE,6EAA6E;AAC7E,MAAM,oBAAoB,GACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,EAAE;IAC/E,CAAC,CAAC,IAAI;IACN,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtB,QAAA,gBAAgB,GAAoB,SAAS,CAAC,IAAI,CAAC,oBAAoB,CAAC;IACnF,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAC9B,CAAC,CAAC,oBAAoB,CAAC;AAEzB,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,6BAAqB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,MAAM,gBAAgB,6BAAqB,IAAI,CACtF,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,6BAAqB,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,KAAwB;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,UAAU,YAAY,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,wBAAgB,EAAE,CAAC;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gCAAwB,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,yBAAyB,gCAAwB,WAAW,MAAM,CAAC,MAAM,aAAa,QAAQ,IAAI,CACnG,CAAC;YACF,MAAM,IAAI,KAAK,CACb,wCAAwC,gCAAwB,cAAc,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,0HAA0H,CACnQ,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,yBAAyB;QACzB,IAAI,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAE,GAA2B,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uCAAuC,MAAM,CAAC,MAAM,uBAAuB,QAAQ,QAAQ,MAAM,KAAK,MAAM,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,uBAAuB,QAAQ,MAAM,IAAI,EAAE,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IAC9D,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,MAAM,CAAC,MAAM,aAAa,QAAQ,OAAO,EAAE,IAAI,CAC1E,CAAC;IACF,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,GAAG,0BAAkB,GAAG,sBAAsB,EAAE,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uCAAuC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,qBAAqB,0BAAkB,UAAU,CAAC,kBAAkB,GAAG,0BAAkB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC/K,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,CAAC;AACzB,CAAC;AAED,qEAAqE;AACrE,KAAK,UAAU,SAAS,CAAC,MAAgB;IACvC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAEM,KAAK,UAAU,KAAK,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,4EAA4E;AAC5E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,sEAAsE;AACtE,iFAAiF;AACjF,2EAA2E;AAC3E,qDAAqD;AACrD,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;IAC3E,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,gCAAwB,GAAG,yBAAyB,CAAC,GAAG,OAAO,CAAC,CAC7E,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,KAAe;AACf,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,UAAkD;IAElD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEnC,uEAAuE;IACvE,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACxC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,oEAAoE;IACpE,0EAA0E;IAC1E,0EAA0E;IAC1E,+EAA+E;IAC/E,+EAA+E;IAC/E,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,GAAI,CAAC;QACpC,uEAAuE;QACvE,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,OACE,GAAG,GAAG,MAAM,CAAC,MAAM;gBACnB,GAAG,GAAG,CAAC,GAAG,2BAAmB;gBAC7B,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,UAAU,EACxC,CAAC;gBACD,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC5B,GAAG,IAAI,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,kCAA0B,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,CAAC,kCAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,iBAAiB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC7E,YAAY;YACV,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACrB,CAAC,GAAG,GAAG,CAAC;QACR,yEAAyE;QACzE,qEAAqE;QACrE,iBAAiB;QACjB,UAAU,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/payload/platform/lib/embed-client/src/index.ts

@@ -15,17 +15,18 @@ function envInt(name: string, def: number): number {
   return Number.isFinite(n) ? n : def;
 }
 
-// nomic-embed-text's usable embed context is 2048 tokens. The old 8000-char cap
-// assumed ~4 chars/token, but dense emoji/markup content runs richer, so a
-// section that passed the char cap still errored with "input length exceeds the
-// context length". Size the default against a conservative 3 chars/token worst
-// case, reserving a small token margin for the tokenizer's specials, so a capped
-// input is provably under context: (2048 - 48) * 3 = 6000. Context is
-// env-overridable so raising it raises the cap; EMBED_INPUT_MAX_CHARS is also
-// directly overridable.
+// nomic-embed-text's usable embed context is 2048 tokens. The cap has been
+// tightened twice against real 400s: 8000 (assumed ~4 chars/token) still
+// overflowed on dense emoji/markup, then 6000 (~3 chars/token) still 400'd on
+// the densest sections with "input length exceeds the context length" because
+// that content runs closer to ~2 chars/token. Size the default against a
+// conservative 2 chars/token worst case, reserving a small token margin for the
+// tokenizer's specials, so a capped input is provably under context:
+// (2048 - 48) * 2 = 4000 (Task 1558). Context is env-overridable so raising it
+// raises the cap; EMBED_INPUT_MAX_CHARS is also directly overridable.
 const EMBED_MODEL_CONTEXT_TOKENS = Math.max(1, Math.floor(envInt("EMBED_MODEL_CONTEXT_TOKENS", 2048)));
 const EMBED_CONTEXT_MARGIN_TOKENS = 48;
-const EMBED_WORST_CASE_CHARS_PER_TOKEN = 3;
+const EMBED_WORST_CASE_CHARS_PER_TOKEN = 2;
 export const EMBED_INPUT_MAX_CHARS = Math.max(
   1,
   Math.floor(
@@ -48,23 +49,40 @@ export const EMBED_INPUT_MAX_CHARS = Math.max(
 // this pacing is defence-in-depth and faster recovery. Both knobs are
 // env-overridable so an operator can tune them from on-device thermal
 // measurement without a code change.
-export const EMBED_SUBBATCH_SIZE = Math.max(1, Math.floor(envInt("EMBED_SUBBATCH_SIZE", 32)));
+//
+// Count ceiling after adaptive sizing (Task 1558). Since Task 1553 each POST is
+// sized by a character budget derived from the device's *measured* ms-per-char,
+// so EMBED_SUBBATCH_SIZE is no longer the primary timeout guard — it is the hard
+// count cap layered on top. It still matters for the one case the char budget
+// cannot catch: the budget is derived from the probe's observed rate, so if the
+// probe runs while the machine is briefly quiet the budget is large and the next
+// POST packs up to this ceiling; if desktop contention then spikes mid-batch,
+// that POST runs far slower than measured and can blow EMBED_REQUEST_TIMEOUT_MS.
+// A ceiling of 4 bounds that worst case (~4 x 17s cold-CPU embeds on a contended
+// shared desktop ~= 68s, under the 120s timeout) so a fast-probe-then-contention
+// batch still fits. On a quiet dedicated appliance (a Pi) the char budget, not
+// this count, is the binding constraint.
+export const EMBED_SUBBATCH_SIZE = Math.max(1, Math.floor(envInt("EMBED_SUBBATCH_SIZE", 4)));
 export const EMBED_SUBBATCH_COOLDOWN_MS = Math.max(
   0,
   envInt("EMBED_SUBBATCH_COOLDOWN_MS", 1000),
 );
 
-// Throughput-aware sub-batch sizing (Task 1533). On a CPU-only embedder each
-// input takes ~EMBED_MS_PER_INPUT ms; a fixed 32-input POST at the char cap is
-// ~128 s, past the 120 s request timeout, so a full-document batch aborts and
-// the atomic ingest write lands nothing. Bound each POST to 80% of the timeout
-// so it provably completes: derive a duration ceiling and take the smaller of
-// it and the count ceiling (EMBED_SUBBATCH_SIZE, Task 960's thermal cap).
-// EMBED_MS_PER_INPUT is the budgeted worst-case wall-time for one input at the
-// EMBED_INPUT_MAX_CHARS cap on the measured device; env-tunable for other
-// hardware.
+// Drift baseline (Task 1553). This was Task 1533's sizing driver — the budgeted
+// worst-case wall-time for one capped input — but sizing that from a single
+// fixed reading is exactly what over-provisioned a POST on a device slower than
+// the reading and aborted the ingest. Sizing is now measured per batch
+// (nextSubBatchSize), so EMBED_MS_PER_INPUT no longer drives it. It survives as
+// the reconciliation baseline: each POST compares its observed per-input time
+// against this budget and warns (op=drift) when the device runs slower, so a
+// device below budget is surfaced by a standing check rather than by a silent
+// ingest failure. Env-tunable for other hardware.
 export const EMBED_MS_PER_INPUT = Math.max(1, Math.floor(envInt("EMBED_MS_PER_INPUT", 6000)));
 const EMBED_TIMEOUT_UTILISATION = 0.8;
+// Warn (op=drift) once a POST's observed per-input time exceeds the budget by
+// this factor. 1.5 tolerates ordinary variance while catching a device that is
+// materially slower than EMBED_MS_PER_INPUT.
+const EMBED_DRIFT_WARN_RATIO = 1.5;
 
 // Explicit per-request timeout, well under undici's 300000ms headers default.
 // Without it a slow or wedged ollama returns no headers and the caller hangs a
@@ -157,9 +175,21 @@ async function embedRequest(input: string | string[]): Promise<number[][]> {
   // oversized or slow sub-batch is visible before it times out and the
   // throughput-aware sizing is verifiable from the log. inputs is the POST's
   // sub-batch size; maxChars its largest input.
+  const ms = Date.now() - startedAt;
   process.stderr.write(
-    `[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${Date.now() - startedAt}\n`,
+    `[embed] op=post inputs=${inputs.length} maxChars=${maxChars} ms=${ms}\n`,
   );
+  // Standing reconciliation (Task 1553). Compare this POST's observed per-input
+  // time against the EMBED_MS_PER_INPUT budget and warn on drift, so a device
+  // slower than budget is caught by a check rather than by a later ingest that
+  // aborts. Sizing already adapts to the true rate; this line makes the
+  // slowness legible.
+  const observedMsPerInput = ms / inputs.length;
+  if (inputs.length > 0 && observedMsPerInput > EMBED_MS_PER_INPUT * EMBED_DRIFT_WARN_RATIO) {
+    process.stderr.write(
+      `[embed] op=drift observedMsPerInput=${Math.round(observedMsPerInput)} budgetMsPerInput=${EMBED_MS_PER_INPUT} ratio=${(observedMsPerInput / EMBED_MS_PER_INPUT).toFixed(1)}\n`,
+    );
+  }
   return data.embeddings;
 }
 
@@ -173,36 +203,89 @@ export async function embed(text: string): Promise<number[]> {
   return data[0];
 }
 
-// The POST size actually used by embedBatch: the smaller of the count ceiling
-// (thermal, Task 960) and the duration ceiling (throughput, Task 1533). At
-// defaults: min(32, floor(120000*0.8/6000)) = min(32, 16) = 16.
-export function effectiveSubBatchSize(): number {
-  const durationCap = Math.max(
+// The character budget for one POST, decided from the device's *measured*
+// throughput rather than a fixed constant (Task 1553). Task 1533 sized every
+// POST by input count against `EMBED_MS_PER_INPUT`, a single optimistic
+// reading; on a device slower than that constant the derived POST was too large
+// to finish inside `EMBED_REQUEST_TIMEOUT_MS`, so it aborted and the atomic
+// ingest landed nothing. Sizing by *count* is also unsafe when inputs differ in
+// size — an embed's wall-time scales with its characters, so a POST sized from
+// a short probe (e.g. a document summary) over-provisions when the later inputs
+// are near-cap sections. Bound each POST by total characters instead:
+// `floor(EMBED_REQUEST_TIMEOUT_MS * 0.8 / msPerChar)`, floored at 1. A near-zero
+// (very fast) rate yields an unbounded budget so the thermal count ceiling
+// (`EMBED_SUBBATCH_SIZE`, Task 960) governs instead.
+export function subBatchCharBudget(msPerChar: number): number {
+  const perChar = Math.max(msPerChar, Number.MIN_VALUE); // guard div-by-zero
+  return Math.max(
     1,
-    Math.floor((EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / EMBED_MS_PER_INPUT),
+    Math.floor((EMBED_REQUEST_TIMEOUT_MS * EMBED_TIMEOUT_UTILISATION) / perChar),
   );
-  return Math.min(EMBED_SUBBATCH_SIZE, durationCap);
 }
 
-export async function embedBatch(texts: string[]): Promise<number[][]> {
+export async function embedBatch(
+  texts: string[],
+  // Progress callback (Task 1555). Fired after each sub-batch POST resolves
+  // with (done, total): done = cumulative inputs embedded so far, total =
+  // inputs.length. memory-ingest passes a callback that emits an MCP progress
+  // notification per POST, which resets Claude Code's ~30-minute stdio idle
+  // timer so a long single ingest is not aborted mid-write. Kept MCP-agnostic
+  // — a plain (done, total) callback — so embed-client carries no MCP concepts
+  // and every existing one-arg caller is unchanged.
+  onProgress?: (done: number, total: number) => void,
+): Promise<number[][]> {
   const inputs = texts.map(capInput);
-  const subBatch = effectiveSubBatchSize();
 
-  // Common case — an array within the sub-batch size is one POST, unchanged.
-  if (inputs.length <= subBatch) {
-    return postBatch(inputs);
+  // 0 or 1 input is exactly one POST: the warm interactive query path is
+  // unaffected, and the empty-array behaviour is unchanged. Report once so the
+  // callback contract ("fires after every POST") holds on this path too.
+  if (inputs.length <= 1) {
+    const vectors = await postBatch(inputs);
+    onProgress?.(inputs.length, inputs.length);
+    return vectors;
   }
 
-  // Oversized: split into sub-batches, cooling between each (not after the
-  // last). Vectors are concatenated in input order so callers can keep their
+  // Measure-and-size. Probe with one input, then pack each subsequent POST with
+  // as many inputs as fit the character budget derived from the worst
+  // ms-per-char seen so far, capped by the thermal count ceiling. Using the
+  // running max makes the budget monotonic — a mid-batch slowdown (e.g. the
+  // ingest itself loading the CPU) shrinks the remainder and it never re-expands
+  // into a timeout. Cool between POSTs (not after the last) so the SoC gets gaps
+  // (Task 960). Vectors concatenate in input order so callers keep their
   // index-aligned `embeddings[i]` ↔ `texts[i]` contract.
   const out: number[][] = [];
-  for (let i = 0; i < inputs.length; i += subBatch) {
+  let maxMsPerChar: number | null = null;
+  for (let i = 0; i < inputs.length; ) {
+    // Build the next chunk. With no measurement yet, probe with one input.
+    let end = i + 1;
+    if (maxMsPerChar !== null) {
+      const charBudget = subBatchCharBudget(maxMsPerChar);
+      let chars = inputs[i].length;
+      while (
+        end < inputs.length &&
+        end - i < EMBED_SUBBATCH_SIZE &&
+        chars + inputs[end].length <= charBudget
+      ) {
+        chars += inputs[end].length;
+        end += 1;
+      }
+    }
     if (i > 0 && EMBED_SUBBATCH_COOLDOWN_MS > 0) {
       await sleep(EMBED_SUBBATCH_COOLDOWN_MS);
     }
-    const chunk = inputs.slice(i, i + subBatch);
-    out.push(...(await postBatch(chunk)));
+    const chunk = inputs.slice(i, end);
+    const chunkChars = chunk.reduce((s, t) => s + t.length, 0);
+    const startedAt = Date.now();
+    const vectors = await postBatch(chunk);
+    const observedMsPerChar = (Date.now() - startedAt) / Math.max(chunkChars, 1);
+    maxMsPerChar =
+      maxMsPerChar === null ? observedMsPerChar : Math.max(maxMsPerChar, observedMsPerChar);
+    out.push(...vectors);
+    i = end;
+    // Report progress after each POST resolves. out.length is the cumulative
+    // inputs embedded so far; the final iteration reports out.length ===
+    // inputs.length.
+    onProgress?.(out.length, inputs.length);
   }
   return out;
 }

package/payload/platform/plugins/admin/PLUGIN.md

@@ -174,6 +174,7 @@ Tools are available via the `admin` MCP server.
 
 - `hooks/webfetch-preflight.mjs` — short-circuits WebFetch on JS-SPA shells with a structured `WEBFETCH_CANNOT_READ_JS_SPA` error so the agent surfaces a loud failure to the owner instead of paying the 60s extraction timeout. Fail-open on any internal error.
 - `hooks/askuserquestion-investigate-gate.sh` — PreToolUse matcher=`AskUserQuestion`. Blocks the question (exit 2) when no read-only investigation tool has fired since the latest real user turn in the session JSONL. The structural fix for the failure class where the agent fabricates a menu before evidence-gathering (session `c085ec2c-46fb-4b73-8865-68cf85866ea8` 2026-05-22 — "change remote access password" → invented options "Admin PIN / Cloudflare tunnel / WiFi password" with zero prior tool_use; post-correction the agent immediately fired `remote-auth-status` → `ToolSearch` → `remote-auth-set-password`, proving it knew the moves). **Allowlist** (exact, with trailing `__<tool>` suffix-match for namespaced `mcp__plugin_<plugin>_<server>__<tool>` aliases): `ToolSearch`, `Grep`, `Glob`, `Read`, `LS`, `NotebookRead`, `Bash`, `WebFetch`, `WebSearch`, plus the read-only admin / memory MCP tools (`*-status`, `*-list`, `*-read`, `skill-find`, `memory-find-candidates`, `profile-read`, `conversation-list`, `memory-list-attachments`, `memory-read-attachment`). **Block message:** `Blocked: AskUserQuestion requires at least one investigation tool (ToolSearch, Grep, Read, *-list, *-status, *-read, skill-find, ...) earlier in this turn. Search the operator's literal phrase first.` **Log line** (stderr, one per call): `[ask-gate] decision=<allow|block> sessionId=<id8> seen=<csv|-> reason=<allowlist-hit|no-investigation|fail-open-no-transcript|fail-open-parse-error>`. **Fail-open** on missing transcript or parse error — nudges, never bricks the UI.
+- `hooks/askuserquestion-channel-carrier-gate.sh` — PreToolUse matcher=`AskUserQuestion`, registered as a **second command on the same matcher** as the investigate-gate (either exit 2 blocks; the two guard different conditions). Blocks the question (exit 2) when the session has a native channel attached, because the Claude Code channel protocol carries only the two permission methods — there is no carrier for the `AskUserQuestion` elicitation, so on an rc-spawn channel (webchat/WhatsApp/Telegram) session the harness would block the turn awaiting a selection that can never arrive and the reader renders only delivered replies, wedging the turn (live SiteDesk incident session `1a085718` 2026-07-11: `/chat` stalled on the delivered "On it…" ack with no card). **Signal:** the rc-spawn writes the channel MCP registration as a config file in `os.tmpdir()` keyed by session id (`maxy-channel-<sid>.json` / `maxy-webchat-channel-<sid>.json` / `maxy-wa-channel-<sid>.json` / `maxy-telegram-channel-<sid>.json`, `sid` sanitized `[^A-Za-z0-9_-]→_` exactly as the writers do); its presence at tool-call time is the authoritative "channel attached to this session" marker. The hook resolves the tmpdir the way Node's `os.tmpdir()` does (`${TMPDIR:-/tmp}`, trailing slash stripped). Correct in both readings of the claude.ai/code scoping question: a Pi channel process sees the tmpfile (block); a claude.ai/code process on another host never sees the Pi tmpfile (fail-open → allow, that surface can answer the card). **Block message:** `Blocked: this is a native-channel session and AskUserQuestion cannot be delivered over a channel (the channel protocol carries no elicitation card, so the turn would wedge). Ask the same question as prose in your channel reply tool and wait for the operator's next message.` **Log line** (stderr, one per decisive call): `[ask-channel] decision=<allow|block> sessionId=<id8> channel=<attached|none> reason=<channel-attached|no-channel|fail-open-no-envelope|fail-open-no-session>`. **Fail-open** on no envelope, blank session id, or absent channel file — nudges, never bricks the UI. The complementary standing check (`interactive-wedge` in the session manager) catches any un-carried interactive tool_use that slips past this hook.
 - `hooks/mcp-tool-missing.sh` — **PostToolUse hook on `mcp__.*` (directive 3).** Defence-in-depth for the `No such tool available: mcp__…` failure class that the name-binding is built to eliminate. Fires on any MCP tool call; no-op unless the `tool_response` carries `No such tool available` AND the qualified name resolves to a maxy plugin (read from the generated `hooks/lib/maxy-mcp-plugins.txt`). On a maxy match it logs one deterministic `[mcp-tool-missing] server=<server> tool=<tool>` line and exits 2 with a fixed envelope on stderr, so the agent relays a named server-unavailable failure instead of narrating "warming up" or blind-retrying. A missing non-maxy bridge tool (Playwright etc., upstream-owned) passes through (exit 0). The maxy-plugin list is regenerated and gate-diffed by `platform/scripts/check-canonical-tool-names.mjs`.
 - `hooks/post-tool-use-agent.sh` — **PostToolUse hook on `Agent`.** Drains any subagent hook-decision buffers under `~/.maxy-code/logs/hook-decisions/` modified since this parent's previous PostToolUse-Agent fire (cursor file keyed by parent session id), prints one `[hook-propagate]` line per record to stdout — Claude Code attaches the stdout as a `hook_success` attachment on the parent JSONL, making the records grep-queryable from the parent session alone. Rotates consumed buffers to `consumed/`. Emits one `[hook-propagate-census] parentSession=<…> subagentHooksObserved=<N> attachmentsEmitted=<M>` line per fire to stdout and server.log; `N != M` is the propagation regression signal. The companion emitter library `hooks/lib/hook-emit.sh` is sourced by `post-tool-use-agent.sh` and any other hook that records a block decision (4 KB stderr truncation, `truncated=true` set on the record).
 - `hooks/admin-authoring-observer.sh` — **PostToolUse hook on Write and Edit.** Observation only — never blocks; exits 0 on every path. Fires when the admin agent (not a specialist subagent — gated by `MAXY_SPECIALIST` env) writes or edits a file under `<accountDir>/output/`. Walks the session transcript from the latest real-user turn forward to detect any prior `Task` `tool_use` whose `subagent_type` starts with `specialists:`. Emits one stderr line `[admin-authoring] inline-write path=<rel> priorSpecialistSpawnInTurn=<true|false|unknown>`. A `false` value on a long-form prose file is the regression signal this hook was designed to make visible — the BioSymm proposal session (admin authored a customer-facing proposal inline despite content-producer being installed) is the failure mode this surfaces mechanically. Mechanical enforcement (refuse the write, force a re-spawn) is deferred per the task spec.