@vellumai/assistant 0.12.3 → 0.12.4-staging.2

package/src/persistence/conversation-queries.ts

@@ -116,6 +116,16 @@ export function hasLexicalTokens(text: string): boolean {
  */
 export type ArchiveStatusFilter = "active" | "archived" | "all";
 
+/**
+ * Which bucket a listing covers.
+ *
+ * The persisted {@link ConversationType} values plus `"all"`, a read-side
+ * union that exists only here: no row carries it, and nothing writes it. It
+ * lets one paginated request span a user's whole history, which is what a
+ * full-history view needs and what three interleaved cursors cannot give it.
+ */
+export type ConversationListTypeFilter = ConversationType | "all";
+
 function archiveStatusClause(status: ArchiveStatusFilter) {
   switch (status) {
     case "active":
@@ -196,6 +206,25 @@ function surfacedVisibilitySql(alias = "conversations"): string {
   );
 }
 
+/**
+ * Raw SQL predicate for the background **umbrella**: background and scheduled
+ * rows together, matched on `conversation_type` or on the system group the
+ * producer filed them in, with subagent runs excluded so the sidebar never
+ * surfaces them.
+ *
+ * Shared by the `"background"` bucket of {@link conversationTypeClause} and by
+ * the `"all"` bucket, which is the union of that one with the standard
+ * listing, so the combined read can never admit a row either bucket alone
+ * would have withheld.
+ */
+function backgroundUmbrellaSql(alias = "conversations"): string {
+  return (
+    `((${alias}.conversation_type IN ('background', 'scheduled')` +
+    ` OR COALESCE(${alias}.group_id, 'system:all') IN ('system:background', 'system:scheduled'))` +
+    ` AND (${alias}.source IS NULL OR ${alias}.source != 'subagent'))`
+  );
+}
+
 /**
  * Raw SQL predicate for "not an automated background/scheduled row".
  *
@@ -289,6 +318,11 @@ function ungroupedSql(alias = "conversations"): string {
  *   Background and Scheduled sidebar sections from one request.
  * - `"scheduled"` — scheduled rows only, so the Scheduled section can load
  *   independently of the broader background backlog without over-fetching it.
+ * - `"all"`: the union of `"standard"` and `"background"`, so one paginated
+ *   request covers a user's whole history instead of interleaving three. Not
+ *   a bypass of the visibility rules: it is exactly those two predicates
+ *   OR-ed, with the legacy `private` type excluded on top, so nothing reaches
+ *   it that neither bucket would have returned.
  *
  * `group_id` is matched alongside `conversationType` so conversations routed to
  * `system:background` / `system:scheduled` (heartbeat, reminders, schedule-job
@@ -296,7 +330,7 @@ function ungroupedSql(alias = "conversations"): string {
  * correct bucket. Subagent runs are excluded from the background/scheduled
  * buckets so the sidebar never surfaces them.
  */
-function conversationTypeClause(type: ConversationType) {
+function conversationTypeClause(type: ConversationListTypeFilter) {
   const notSubagent = sql`(${conversations.source} IS NULL OR ${conversations.source} != 'subagent')`;
   switch (type) {
     case "standard":
@@ -305,9 +339,20 @@ function conversationTypeClause(type: ConversationType) {
       // standardListingVisibilitySql for the full predicate semantics.
       return sql.raw(standardListingVisibilitySql());
     case "background":
-      return sql`(${conversations.conversationType} IN ('background', 'scheduled') OR group_id IN ('system:background', 'system:scheduled')) AND ${notSubagent}`;
+      return sql.raw(backgroundUmbrellaSql());
     case "scheduled":
       return sql`(${conversations.conversationType} = 'scheduled' OR group_id = 'system:scheduled') AND ${notSubagent}`;
+    case "all":
+      /* `private` is excluded explicitly rather than left to the two arms.
+         The standard arm already drops it everywhere, but the umbrella
+         matches on the system group as well as on the type, so a legacy
+         private row filed in `system:background` would otherwise arrive
+         through it. Those rows exist transiently after an in-place snapshot
+         restore, before migration cleanup deletes them. */
+      return sql.raw(
+        `((${standardListingVisibilitySql()} OR ${backgroundUmbrellaSql()})` +
+          ` AND conversations.conversation_type != 'private')`,
+      );
   }
 }
 
@@ -321,7 +366,7 @@ function conversationTypeClause(type: ConversationType) {
  * transposition waiting to happen.
  */
 export interface ConversationListFilter {
-  conversationType?: ConversationType;
+  conversationType?: ConversationListTypeFilter;
   archiveStatus?: ArchiveStatusFilter;
   originChannel?: string;
   /**

package/src/persistence/embeddings/__tests__/embedding-local-lifecycle.test.ts

@@ -27,9 +27,14 @@ import { LocalEmbeddingBackend } from "../embedding-local.js";
 type Internals = any;
 
 /**
- * A stand-in for a Bun subprocess whose stdin pipe is broken. `write` throws
- * EPIPE the way a real worker's pipe does once the child is gone.
+ * A backend of its own for one test. Production gets the per-model instance
+ * from `forModel`; constructing directly keeps tests from sharing state.
  */
+function newBackend(): Internals {
+  return new (LocalEmbeddingBackend as Internals)("test-model");
+}
+
+/** A stand-in for a Bun subprocess whose stdin `write` fails synchronously. */
 function brokenPipeProc(pid = 4242) {
   return {
     pid,
@@ -196,7 +201,7 @@ describe("PID file ownership", () => {
    */
   test("releasePidFile leaves an entry that names someone else's worker", () => {
     writeFileSync(pidPath, "777");
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
 
     backend.releasePidFile(888);
 
@@ -206,7 +211,7 @@ describe("PID file ownership", () => {
 
   test("releasePidFile drops the entry when it names our worker", () => {
     writeFileSync(pidPath, "777");
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
 
     backend.releasePidFile(777);
 
@@ -219,7 +224,7 @@ describe("PID file ownership", () => {
    */
   test("disposing an instance with no worker keeps another's PID entry", () => {
     writeFileSync(pidPath, "777");
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.disposeRequested = true;
     backend.workerProc = null;
 
@@ -232,12 +237,12 @@ describe("PID file ownership", () => {
 
 describe("broken worker pipe", () => {
   /**
-   * A write to a dead worker raises EPIPE. Escaping, it reached the daemon's
-   * `unhandledRejection` handler and terminated the process; it must instead
-   * come back as an ordinary failed embed the backend chain can fall back from.
+   * A broken pipe comes back as an ordinary failed embed the backend chain can
+   * fall back from. An escaping rejection reaches the daemon's
+   * `unhandledRejection` handler, which shuts the process down.
    */
   test("EPIPE on write resolves the request as an error", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerProc = brokenPipeProc();
 
     const response = await backend.sendRequest(["hello"]);
@@ -247,7 +252,7 @@ describe("broken worker pipe", () => {
   });
 
   test("EPIPE surfaces to embed() as a rejection, not a process crash", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerProc = brokenPipeProc();
     // Skip initialization: the worker is already (notionally) running.
     backend.ensureInitialized = async () => {};
@@ -257,8 +262,34 @@ describe("broken worker pipe", () => {
     );
   });
 
+  /**
+   * A real pipe, because the failure lives in Bun's behaviour rather than in
+   * ours: a batch larger than the pipe buffer, sent to a worker too busy to
+   * drain stdin, leaves the write pending, and the pending write rejects when
+   * the worker dies. A synchronous guard never sees that rejection.
+   */
+  test("a write still pending when the worker dies resolves the request as an error", async () => {
+    const backend = newBackend();
+    const proc = Bun.spawn({
+      cmd: [process.execPath, "-e", "setTimeout(() => {}, 60_000)"],
+      windowsHide: true,
+      stdin: "pipe",
+      stdout: "ignore",
+      stderr: "ignore",
+    });
+    spawned.push(proc);
+    backend.workerProc = proc;
+
+    const request = backend.sendRequest(["x".repeat(4 * 1024 * 1024)]);
+    proc.kill("SIGKILL");
+    const response = await request;
+
+    expect(response.error).toContain("worker pipe write failed");
+    expect(backend.pendingRequests.size).toBe(0);
+  });
+
   test("a failed write does not leak the pending request", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerProc = brokenPipeProc();
 
     await backend.sendRequest(["hello"]);
@@ -274,7 +305,7 @@ describe("releasing ownership of a worker", () => {
    * strands it: no handle, no PID entry, invisible to every later reclaim.
    */
   test("stdout ending kills the child before clearing workerProc", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     const proc = liveProc();
     backend.workerProc = proc;
 
@@ -285,7 +316,7 @@ describe("releasing ownership of a worker", () => {
   });
 
   test("shutdown reaps the worker and resolves only once it exits", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     const proc = liveProc(555);
     backend.workerProc = proc;
     writeFileSync(getEmbedWorkerPidPath(), "555");
@@ -298,7 +329,7 @@ describe("releasing ownership of a worker", () => {
   });
 
   test("shutdown settles in-flight requests instead of hanging them", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerProc = liveProc(556);
 
     const inFlight = backend.sendRequest(["hello"]);
@@ -315,7 +346,7 @@ describe("releasing ownership of a worker", () => {
    * pending requests are only settled after the wait.
    */
   test("a worker that ignores SIGTERM is escalated to SIGKILL, not waited on forever", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.terminateGraceMs = 50;
     const signals: (string | undefined)[] = [];
     const wedged = {
@@ -354,7 +385,7 @@ describe("termination that cannot be confirmed", () => {
   }
 
   test("keeps the PID publication instead of unpublishing a possibly-live child", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.terminateGraceMs = 20;
     const proc = wedgedProc();
     backend.workerProc = proc;
@@ -370,7 +401,7 @@ describe("termination that cannot be confirmed", () => {
   });
 
   test("refuses to start a replacement while the child may still be alive", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     // No workerPath recorded, so liveness falls back to a PID probe. Our own
     // PID is certainly alive, standing in for a child that will not die.
     backend.unconfirmedWorker = process.pid;
@@ -381,7 +412,7 @@ describe("termination that cannot be confirmed", () => {
   });
 
   test("surfaces the incomplete teardown through embed() rather than failing silently", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.unconfirmedWorker = process.pid;
 
     await expect(backend.embed(["hello"])).rejects.toThrow(
@@ -401,7 +432,7 @@ describe("termination that cannot be confirmed", () => {
     });
     await Bun.sleep(400);
 
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerPath = scriptPath;
     backend.unconfirmedWorker = proc.pid;
     writeFileSync(getEmbedWorkerPidPath(), String(proc.pid));
@@ -440,7 +471,7 @@ describe("reclaiming before spawning a replacement", () => {
     await Bun.sleep(400);
     writeFileSync(getEmbedWorkerPidPath(), String(proc.pid));
 
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     await backend.reclaimOwnedWorkers(scriptPath);
 
     // Confirmed gone by the time reclaim returns, not merely signalled.
@@ -464,7 +495,7 @@ describe("reclaiming before spawning a replacement", () => {
     spawned.push(proc);
     await Bun.sleep(400);
 
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.terminateGraceMs = 300;
     await backend.reclaimOwnedWorkers(scriptPath);
 
@@ -497,7 +528,7 @@ setTimeout(() => {}, 60_000);\n`,
     expect(workers.length).toBe(1);
     expect(workers[0].ppid).toBe(parent.pid);
 
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.terminateGraceMs = 300;
     await backend.reclaimOwnedWorkers(scriptPath);
 
@@ -521,7 +552,7 @@ describe("shutdown versus in-flight initialization", () => {
    * lets the initializer spawn a worker afterwards, with nobody left to reap it.
    */
   test("shutdown waits for an in-flight init and reaps the worker it creates", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     const proc = liveProc(600);
 
     let finishInit: () => void = () => {};
@@ -564,7 +595,7 @@ describe("parent exit orderings", () => {
    * process's and left it alone. So it kills its own child on the way out.
    */
   test("terminateNow kills the worker and releases the entry without waiting", () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     const signals: string[] = [];
     const proc = {
       pid: 909,
@@ -590,7 +621,7 @@ describe("parent exit orderings", () => {
    * process while the child was still being adopted.
    */
   test("shutdown does not inherit the model-load wait when init never settles", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.terminateGraceMs = 50;
     // An initialization that never resolves, as during a cold model load.
     backend.initInFlight = new Promise<void>(() => {});
@@ -602,7 +633,7 @@ describe("parent exit orderings", () => {
   });
 
   test("a backend already shutting down refuses to spawn a replacement", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.disposeRequested = true;
 
     await expect(backend.embed(["hello"])).rejects.toThrow(/shutting down/);
@@ -621,7 +652,7 @@ describe("transient failures stay transient", () => {
   const PERMANENT_FAILURE_SENTINEL = "Local embedding backend unavailable";
 
   test("an unconfirmed termination does not claim permanent unavailability", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.unconfirmedWorker = process.pid;
 
     const err = await backend.ensureInitialized().catch((e: Error) => e);
@@ -631,7 +662,7 @@ describe("transient failures stay transient", () => {
   });
 
   test("shutting down does not claim permanent unavailability", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.disposeRequested = true;
 
     const err = await backend.embed(["hello"]).catch((e: Error) => e);
@@ -652,7 +683,7 @@ describe("audit regressions", () => {
    * embed queued behind it.
    */
   test("a startup failure against a wedged worker does not hang", async () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.terminateGraceMs = 30;
     const signals: (string | undefined)[] = [];
     backend.workerProc = {
@@ -680,7 +711,7 @@ describe("audit regressions", () => {
    * startup for the full two-minute timeout.
    */
   test("terminateNow clears the stdout buffer so a retry can parse ready", () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.stdoutBuffer = '{"id":5,"vect';
     backend.workerProc = null;
 
@@ -707,7 +738,7 @@ describe("audit regressions", () => {
     spawned.push(proc);
     await Bun.sleep(400);
 
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerPath = scriptPath;
     backend.workerProc = null; // spawned, never adopted
 
@@ -722,7 +753,7 @@ describe("audit regressions", () => {
    * contract, so it must leave the instance able to start a replacement.
    */
   test("terminateNow leaves the instance reusable", () => {
-    const backend = new LocalEmbeddingBackend("test-model") as Internals;
+    const backend = newBackend();
     backend.workerProc = null;
     backend.stdoutReaderActive = true;
 
@@ -766,3 +797,97 @@ test("orphan reclaim outlasts the embedding reap it must not truncate", () => {
     EMBEDDING_SHUTDOWN_BUDGET_MS + 1_000,
   );
 });
+
+describe("one backend per model", () => {
+  test("forModel hands out one instance per model", () => {
+    const first = LocalEmbeddingBackend.forModel("per-model-a");
+
+    expect(LocalEmbeddingBackend.forModel("per-model-a")).toBe(first);
+    expect(LocalEmbeddingBackend.forModel("per-model-b")).not.toBe(first);
+  });
+
+  /**
+   * A backend-cache reset disposes the backend it evicts, and that disposal
+   * waits for in-flight embeds. The next embed needs the model again inside
+   * that window, and the embeds in flight keep their worker.
+   */
+  test("needing the model again while a disposal is pending keeps the busy worker", () => {
+    const backend = LocalEmbeddingBackend.forModel(
+      "per-model-reopen",
+    ) as Internals;
+    const proc = liveProc(7101);
+    backend.workerProc = proc;
+    backend.activeEmbeds = 1;
+    backend.dispose();
+
+    const again = LocalEmbeddingBackend.forModel(
+      "per-model-reopen",
+    ) as Internals;
+    backend.activeEmbeds = 0;
+    backend.disposeIfIdle();
+
+    expect(again).toBe(backend);
+    expect(again.workerProc).toBe(proc);
+    expect(proc.killed).toBe(false);
+  });
+
+  test("a pending disposal nobody withdraws still releases the worker once idle", () => {
+    const backend = LocalEmbeddingBackend.forModel(
+      "per-model-dispose",
+    ) as Internals;
+    const proc = liveProc(7102);
+    backend.workerProc = proc;
+    backend.activeEmbeds = 1;
+    backend.dispose();
+
+    backend.activeEmbeds = 0;
+    backend.disposeIfIdle();
+
+    expect(backend.workerProc).toBeNull();
+    expect(proc.killed).toBe(true);
+  });
+
+  /** The process is exiting, so nothing may spawn a worker behind the reap. */
+  test("a shut-down backend stays shut down", async () => {
+    const backend = LocalEmbeddingBackend.forModel("per-model-shutdown");
+    await backend.shutdown();
+
+    const again = LocalEmbeddingBackend.forModel("per-model-shutdown");
+
+    expect(again).toBe(backend);
+    await expect(again.embed(["hello"])).rejects.toThrow(/shutting down/);
+  });
+
+  /**
+   * The backend cache forgets a backend whose disposal is pending, so process
+   * teardown reaches it through the class's own list.
+   */
+  test("shutdownAll reaps a busy backend no cache still holds", async () => {
+    const backend = LocalEmbeddingBackend.forModel(
+      "per-model-evicted",
+    ) as Internals;
+    const proc = liveProc(7103);
+    backend.workerProc = proc;
+    backend.activeEmbeds = 1;
+    backend.dispose();
+
+    await LocalEmbeddingBackend.shutdownAll();
+
+    expect(proc.killed).toBe(true);
+    expect(backend.workerProc).toBeNull();
+  });
+
+  test("terminateAllNow kills a busy backend no cache still holds", () => {
+    const backend = LocalEmbeddingBackend.forModel(
+      "per-model-evicted-now",
+    ) as Internals;
+    const proc = liveProc(7104);
+    backend.workerProc = proc;
+    backend.activeEmbeds = 1;
+    backend.dispose();
+
+    LocalEmbeddingBackend.terminateAllNow();
+
+    expect(proc.killed).toBe(true);
+  });
+});

package/src/persistence/embeddings/embedding-backend-shutdown.test.ts

@@ -0,0 +1,47 @@
+/**
+ * Process teardown reaches every local embedding worker the process owns.
+ *
+ * Kept in its own file: `shutdownEmbeddingBackends` latches the module into its
+ * shut-down state for the rest of the process.
+ */
+import { expect, test } from "bun:test";
+
+import { AssistantConfigSchema } from "../../config/schema.js";
+import {
+  clearEmbeddingBackendCache,
+  selectEmbeddingBackend,
+  shutdownEmbeddingBackends,
+} from "./embedding-backend.js";
+
+/** Reach past `private`, which is compile-time only, so tests drive real state. */
+type Internals = any;
+
+/**
+ * A backend-cache reset forgets a backend whose disposal is waiting on
+ * in-flight embeds, while that backend still holds a live worker.
+ */
+test("shutdown reaps a busy local worker the cache has already forgotten", async () => {
+  const config = AssistantConfigSchema.parse({
+    memory: { embeddings: { provider: "local" } },
+  });
+  const { backend } = await selectEmbeddingBackend(config);
+  const delegate = await (backend as Internals).getDelegate();
+  let killed = false;
+  delegate.workerProc = {
+    pid: 7201,
+    exited: new Promise<number>(() => {}),
+    kill() {
+      killed = true;
+    },
+    stdin: { write: () => 0, flush: () => 0 },
+  };
+  delegate.terminateGraceMs = 10;
+  delegate.activeEmbeds = 1;
+
+  clearEmbeddingBackendCache();
+  expect(killed).toBe(false);
+
+  await shutdownEmbeddingBackends();
+
+  expect(killed).toBe(true);
+});

package/src/persistence/embeddings/embedding-backend.ts

@@ -16,6 +16,7 @@ import {
   recordBillingSuccess,
 } from "./embedding-billing-breaker.js";
 import { GeminiEmbeddingBackend } from "./embedding-gemini.js";
+import type { LocalEmbeddingBackend } from "./embedding-local.js";
 import { OllamaEmbeddingBackend } from "./embedding-ollama.js";
 import {
   OpenAIEmbeddingBackend,
@@ -78,6 +79,13 @@ export const EMBEDDING_SHUTDOWN_BUDGET_MS = 8_000;
  * the failure is contained and other embedding backends can be used instead.
  */
 
+/**
+ * The local backend class, once {@link LazyLocalEmbeddingBackend} has loaded it.
+ * It lists every local backend this process owns, which process teardown needs
+ * and {@link backendCache} cannot supply.
+ */
+let localEmbeddingBackends: typeof LocalEmbeddingBackend | null = null;
+
 class LazyLocalEmbeddingBackend implements EmbeddingBackend {
   readonly provider = "local" as const;
   readonly model: string;
@@ -114,21 +122,9 @@ class LazyLocalEmbeddingBackend implements EmbeddingBackend {
     this.delegate?.dispose?.();
   }
 
-  terminateNow(): void {
-    this.delegate?.terminateNow?.();
-  }
-
-  async sweepOwnedWorkers(): Promise<void> {
-    await this.delegate?.sweepOwnedWorkers?.();
-  }
-
-  async shutdown(): Promise<void> {
-    // A delegate under construction still ends up owning a worker, so settle
-    // the in-flight import before tearing down rather than skipping it.
-    if (!this.delegate && this.initPromise) {
-      await this.initPromise.catch(() => undefined);
-    }
-    await this.delegate?.shutdown?.();
+  /** Settles once a delegate under construction has been handed out or failed. */
+  async loaded(): Promise<void> {
+    await this.initPromise?.catch(() => undefined);
   }
 
   resetForRetry(): void {
@@ -146,7 +142,8 @@ class LazyLocalEmbeddingBackend implements EmbeddingBackend {
         try {
           const { LocalEmbeddingBackend } =
             await import("./embedding-local.js");
-          this.delegate = new LocalEmbeddingBackend(this.model);
+          localEmbeddingBackends = LocalEmbeddingBackend;
+          this.delegate = LocalEmbeddingBackend.forModel(this.model);
           return this.delegate;
         } catch (err) {
           localBackendBroken = true;
@@ -270,7 +267,7 @@ export function clearEmbeddingBackendCache(): void {
 }
 
 /**
- * Tear down every cached backend's OS resources and empty the caches.
+ * Tear down every local embedding worker this process owns and empty the caches.
  *
  * Called on daemon shutdown so process-owned embedding workers exit with their
  * owner instead of being orphaned. `clearEmbeddingBackendCache()` is the
@@ -279,24 +276,18 @@ export function clearEmbeddingBackendCache(): void {
  */
 export async function shutdownEmbeddingBackends(): Promise<void> {
   embeddingBackendsShutDown = true;
-  const backends = new Set(backendCache.values());
+  const loading = [...backendCache.values()].filter(
+    (backend) => backend instanceof LazyLocalEmbeddingBackend,
+  );
   backendCache.clear();
   vectorCache.clear();
   vectorCacheBytes = 0;
   backendDimCache.clear();
 
-  const teardown = Promise.all(
-    [...backends].map(async (backend) => {
-      try {
-        await backend.shutdown?.();
-        await backend.sweepOwnedWorkers?.();
-      } catch (err) {
-        log.warn(
-          { err, provider: backend.provider, model: backend.model },
-          "Failed to shut down embedding backend",
-        );
-      }
-    }),
+  // A delegate under construction still ends up owning a worker, so let it
+  // join the class's list before tearing that list down.
+  const teardown = Promise.all(loading.map((backend) => backend.loaded())).then(
+    () => localEmbeddingBackends?.shutdownAll(),
   );
 
   const timedOut = Symbol("timeout");
@@ -313,7 +304,7 @@ export async function shutdownEmbeddingBackends(): Promise<void> {
 }
 
 /**
- * SIGKILL every cached backend's worker synchronously.
+ * SIGKILL every local embedding worker this process owns, synchronously.
  *
  * For a process that must exit immediately and cannot run the graceful
  * teardown: the memory worker on PID-file eviction, where staying alive to reap
@@ -322,16 +313,7 @@ export async function shutdownEmbeddingBackends(): Promise<void> {
  * sweep has passed, leaving two workers alive (JARVIS-1125).
  */
 export function terminateEmbeddingWorkersNow(): void {
-  for (const backend of new Set(backendCache.values())) {
-    try {
-      backend.terminateNow?.();
-    } catch (err) {
-      log.warn(
-        { err, provider: backend.provider, model: backend.model },
-        "Failed to terminate embedding worker",
-      );
-    }
-  }
+  localEmbeddingBackends?.terminateAllNow();
 }
 
 /** Reset the sticky local-backend failure flag without evicting live backends. */

package/src/persistence/embeddings/embedding-gemini.test.ts

@@ -439,6 +439,23 @@ describe("GeminiEmbeddingBackend: batched text inputs", () => {
     expect(vectors.map((v) => v[0])).toEqual(texts(250).map(textIndex));
   });
 
+  test("managed text inputs use single calls from the first request and preserve vector order", async () => {
+    const fetchMock = routedFetch();
+    globalThis.fetch = fetchMock as unknown as typeof fetch;
+    const backend = new GeminiEmbeddingBackend("test-key", "test-model", {
+      managedBaseUrl: "https://proxy.example.com/v1/runtime-proxy/gemini",
+      interCallDelayMs: 0,
+    });
+
+    expect(await backend.embed(texts(3))).toEqual([[0], [1], [2]]);
+    expect(await backend.embed(["t4", "t5"])).toEqual([[4], [5]]);
+    expect(calledUrls(fetchMock)).toEqual(
+      Array(5).fill(
+        "https://proxy.example.com/v1/runtime-proxy/gemini/v1beta/models/test-model:embedContent",
+      ),
+    );
+  });
+
   test("each batched request names the model with the models/ prefix and carries taskType and outputDimensionality", async () => {
     const fetchMock = routedFetch();
     globalThis.fetch = fetchMock as unknown as typeof fetch;