grepmax 0.26.28 → 0.26.30

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.28",
+      "version": "0.26.30",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/dist/commands/mcp.js

@@ -151,6 +151,12 @@ function isMcpSessionFallback(error) {
  * a live daemon saying no, and is reported. Falling back there would put a
  * second opener on the store while the daemon is working.
  */
+/**
+ * Watch-lease cadence. Renewal is cheap (one IPC line), and the TTL is three
+ * renewals long so a slow tick or a daemon restart does not drop the project.
+ */
+const MCP_WATCH_LEASE_RENEW_MS = 5 * 60 * 1000;
+const MCP_WATCH_LEASE_TTL_MS = 3 * MCP_WATCH_LEASE_RENEW_MS;
 const MCP_STORE_FALLBACK = {
     fallbackOnUnknownVerb: true,
     fallbackOnOversize: true,
@@ -573,6 +579,13 @@ exports.mcp = new commander_1.Command("mcp")
         });
     }
     // --- Background watcher ---
+    // This server's watch lease. It names our PID, so the daemon drops it the
+    // minute this session exits; the TTL only covers a wedged server.
+    const WATCH_LEASE = {
+        holder: `mcp:${process.pid}`,
+        pid: process.pid,
+        ttlMs: MCP_WATCH_LEASE_TTL_MS,
+    };
     function ensureWatcher(root) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
@@ -580,7 +593,7 @@ exports.mcp = new commander_1.Command("mcp")
                 const watchRoot = root !== null && root !== void 0 ? root : (_a = resolveMcpProject(undefined, projectRoot)) === null || _a === void 0 ? void 0 : _a.root;
                 if (!watchRoot)
                     return;
-                const result = yield (0, watcher_launcher_1.launchWatcher)(watchRoot);
+                const result = yield (0, watcher_launcher_1.launchWatcher)(watchRoot, WATCH_LEASE);
                 if (result.ok && !result.reused) {
                     console.log(`[MCP] Started background watcher for ${watchRoot} (PID: ${result.pid})`);
                 }
@@ -2965,4 +2978,7 @@ exports.mcp = new commander_1.Command("mcp")
     // Kick off index readiness check and watcher in background
     ensureIndexReady().catch((e) => console.error("[MCP] Index readiness check failed:", e));
     ensureWatcher();
+    // Keep this session's project leased while the session lives. The daemon
+    // only watches projects some session holds.
+    setInterval(() => void ensureWatcher(), MCP_WATCH_LEASE_RENEW_MS).unref();
 }));

package/dist/commands/watch.js

@@ -67,7 +67,7 @@ const IDLE_CHECK_INTERVAL_MS = 60 * 1000; // check every minute
 exports.watch = new commander_1.Command("watch")
     .description("Start background file watcher for live reindexing")
     .option("-b, --background", "Run watcher in background and exit")
-    .option("-d, --daemon", "Run as centralized daemon watching all projects")
+    .option("-d, --daemon", "Run as centralized daemon watching projects that active sessions hold")
     .option("-p, --path <dir>", "Directory to watch (defaults to project root)")
     .option("--no-idle-timeout", "Disable the 30-minute idle shutdown")
     .action((options) => __awaiter(void 0, void 0, void 0, function* () {

package/dist/config.js

@@ -68,9 +68,14 @@ const DEFAULT_WORKER_THREADS = (() => {
     const fromEnv = Number.parseInt((_a = process.env.GMAX_WORKER_THREADS) !== null && _a !== void 0 ? _a : "", 10);
     if (Number.isFinite(fromEnv) && fromEnv > 0)
         return fromEnv;
+    // Each worker is a separate process that loads the ONNX models, peaking at
+    // ~800 MB-1 GB. The old max(4, cores/2) let a 14-core host run 7 of them;
+    // together with the daemon that froze a 48 GB machine. Four is the ceiling;
+    // two is the floor where the cores exist, so one worker can stay free for
+    // search. GMAX_WORKER_THREADS still overrides.
     const cores = os.cpus().length || 1;
-    const HARD_CAP = Math.max(4, Math.floor(cores * 0.5));
-    return Math.max(1, Math.min(HARD_CAP, cores));
+    const target = Math.min(4, Math.max(2, Math.floor(cores * 0.5)));
+    return Math.max(1, Math.min(target, cores));
 })();
 exports.CONFIG = {
     VECTOR_DIM: 384,
@@ -224,6 +229,7 @@ exports.PATHS = {
     daemonSocket: path.join(GLOBAL_ROOT, "daemon.sock"),
     daemonPidFile: path.join(GLOBAL_ROOT, "daemon.pid"),
     daemonLockFile: path.join(GLOBAL_ROOT, "daemon.lock"),
+    watchLeasesFile: path.join(GLOBAL_ROOT, "watch-leases.json"),
     // Written by a daemon while it is gracefully shutting down (draining workers,
     // closing LanceDB). A successor's killStaleProcesses() respects this so it
     // never SIGKILLs a peer mid-cleanup once the peer has already dropped its

package/dist/lib/analysis/surprising-connections.js

@@ -62,6 +62,7 @@ const path = __importStar(require("node:path"));
 const callsites_1 = require("../graph/callsites");
 const ann_config_1 = require("../store/ann-config");
 const arrow_1 = require("../utils/arrow");
+const filter_builder_1 = require("../utils/filter-builder");
 const scope_filter_1 = require("../utils/scope-filter");
 exports.DEFAULT_SURPRISE_OPTIONS = {
     sample: 160,
@@ -73,6 +74,11 @@ exports.DEFAULT_SURPRISE_OPTIONS = {
     includeEval: false,
 };
 exports.MAX_SURPRISE_ROWS = 100000;
+/**
+ * Columns a pair row carries: the scan's metadata plus `content`, which the
+ * weak-code filter and the scorer read. `vector` is not here — only sampled
+ * anchors need one, and they fetch it by id (see `hydrateRows`).
+ */
 exports.SURPRISE_COLUMNS = [
     "id",
     "path",
@@ -83,8 +89,40 @@ exports.SURPRISE_COLUMNS = [
     "type_referenced_symbols",
     "role",
     "content",
-    "vector",
 ];
+const MIN_CODE_CONTENT_LENGTH = 80;
+/**
+ * The row scan reads up to MAX_SURPRISE_ROWS rows. Selecting `content` and
+ * `vector` there held every chunk body and embedding in memory for an answer
+ * that needs ~160 vectors. It now selects metadata plus two bounds on the
+ * weak-code test (`content.trim().length >= 80`), computed in the store:
+ *
+ * - `content_min_len` trims a *superset* of JS whitespace (Unicode White_Space
+ *   plus U+FEFF) and counts code points, so it never exceeds the JS length —
+ *   at or above the threshold, the row passes.
+ * - `content_max_len` trims a *subset* (ASCII whitespace) and counts UTF-8
+ *   bytes, so it is never below the JS length — under the threshold, it fails.
+ *
+ * Anything between the two (non-ASCII text or whitespace near the threshold)
+ * fetches its content by id and takes the exact JS test, so `codeRows` and the
+ * anchor sample are unchanged. Backslashes are literal in DataFusion strings.
+ */
+const CONTENT_MIN_LEN_EXPR = "char_length(regexp_replace(content, '^[\\s\\x{FEFF}]+|[\\s\\x{FEFF}]+$', '', 'g'))";
+const CONTENT_MAX_LEN_EXPR = "octet_length(regexp_replace(content, '^[\\t\\n\\x0B\\f\\r ]+|[\\t\\n\\x0B\\f\\r ]+$', '', 'g'))";
+const SCAN_SELECT = {
+    id: "id",
+    path: "path",
+    start_line: "start_line",
+    end_line: "end_line",
+    defined_symbols: "defined_symbols",
+    referenced_symbols: "referenced_symbols",
+    type_referenced_symbols: "type_referenced_symbols",
+    role: "role",
+    content_min_len: CONTENT_MIN_LEN_EXPR,
+    content_max_len: CONTENT_MAX_LEN_EXPR,
+};
+/** Ids per `id IN (...)` hydration query. */
+const HYDRATE_BATCH = 200;
 const CODE_EXTENSIONS = new Set([
     ".ts",
     ".tsx",
@@ -430,19 +468,61 @@ function buildFileEdges(rows) {
 function hasDirectFileEdge(edges, a, b) {
     return edges.has(`${a.path}\0${b.path}`) || edges.has(`${b.path}\0${a.path}`);
 }
-function filterableCodeRow(row, opts) {
+/** The anchor filter minus its content and vector tests (see below). */
+function filterableCodeMeta(row, opts) {
     if (!row.path || !isCodePath(row.path))
         return false;
     if (!opts.includeTests && isTestPath(row.relPath))
         return false;
     if (!opts.includeEval && isEvalPath(row.relPath))
         return false;
-    if (vectorLength(row.vector) === 0)
-        return false;
-    if (row.content.trim().length < 80)
-        return false;
     return row.definedSymbols.length > 0;
 }
+function hasCodeContent(content) {
+    return content.trim().length >= MIN_CODE_CONTENT_LENGTH;
+}
+/**
+ * The weak-code verdict from the scan alone: true/false when the store-side
+ * bounds decide it, null when the row needs its content fetched. A row that
+ * already carries `content` (a caller-supplied table) is decided exactly.
+ */
+function contentVerdict(raw) {
+    if (typeof raw.content === "string")
+        return hasCodeContent(raw.content);
+    const min = Number(raw.content_min_len);
+    const max = Number(raw.content_max_len);
+    if (Number.isFinite(min) && min >= MIN_CODE_CONTENT_LENGTH)
+        return true;
+    if (Number.isFinite(max) && max < MIN_CODE_CONTENT_LENGTH)
+        return false;
+    return null;
+}
+/**
+ * Fetch `columns` for the given ids, keyed by id. The scope clause is ANDed
+ * on so a hydration can never reach outside the scan that produced the ids.
+ */
+function hydrateRows(table, where, ids, columns) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const out = new Map();
+        for (let i = 0; i < ids.length; i += HYDRATE_BATCH) {
+            const batch = ids.slice(i, i + HYDRATE_BATCH);
+            const list = batch.map((id) => `'${(0, filter_builder_1.escapeSqlString)(id)}'`).join(", ");
+            const rows = (yield table
+                .query()
+                .select(["id", ...columns])
+                .where(`(${where}) AND id IN (${list})`)
+                .limit(batch.length)
+                .toArray());
+            for (const row of rows)
+                out.set(String(row.id || ""), row);
+        }
+        return out;
+    });
+}
+/** Pair rows carry no vector: nothing downstream reads one, and findings cross the socket. */
+function withoutVector(row) {
+    return row.vector === undefined ? row : Object.assign(Object.assign({}, row), { vector: undefined });
+}
 function buildFindings(pairs) {
     var _a;
     const groups = new Map();
@@ -497,16 +577,53 @@ function analyzeSurprisingConnections(table_1, projectRoot_1) {
         const where = (0, scope_filter_1.buildScopeWhere)(scope);
         const rawRows = (yield table
             .query()
-            .select(exports.SURPRISE_COLUMNS)
+            .select(SCAN_SELECT)
             .where(where)
             .limit(opts.maxRows)
             .toArray());
         const rows = rawRows.map((row) => toChunkRow(row, prefix));
-        const codeRows = rows.filter((row) => filterableCodeRow(row, opts));
         const fileEdges = buildFileEdges(rows);
-        const anchors = [...codeRows]
-            .sort((a, b) => stableHash(rowKey(a)) - stableHash(rowKey(b)))
-            .slice(0, opts.sample);
+        // Weak-code test: decided from the scan's bounds where possible, otherwise
+        // from content fetched for just the undecided rows.
+        const candidates = [];
+        for (let i = 0; i < rows.length; i++) {
+            if (!filterableCodeMeta(rows[i], opts))
+                continue;
+            candidates.push({ row: rows[i], verdict: contentVerdict(rawRows[i]) });
+        }
+        const undecidedContent = yield hydrateRows(table, where, candidates
+            .filter((c) => c.verdict === null && c.row.id)
+            .map((c) => c.row.id), ["content"]);
+        const codeRows = candidates
+            .filter(({ row, verdict }) => {
+            if (verdict !== null)
+                return verdict;
+            const hydrated = undecidedContent.get(row.id);
+            return hydrated ? hasCodeContent(String(hydrated.content || "")) : false;
+        })
+            .map(({ row }) => row);
+        // Anchors are the first `sample` code rows in hash order, and only they need
+        // content and a vector. Fetch those a page at a time, skipping any row that
+        // comes back without a vector (the column is non-nullable, so this is
+        // defensive) just as the old whole-scan filter did.
+        const ordered = [...codeRows].sort((a, b) => stableHash(rowKey(a)) - stableHash(rowKey(b)));
+        const anchors = [];
+        for (let i = 0; i < ordered.length && anchors.length < opts.sample; i += opts.sample) {
+            const page = ordered.slice(i, i + opts.sample);
+            const fetched = yield hydrateRows(table, where, page
+                .filter((row) => row.id && vectorLength(row.vector) === 0)
+                .map((row) => row.id), ["content", "vector"]);
+            for (const row of page) {
+                if (anchors.length >= opts.sample)
+                    break;
+                const extra = fetched.get(row.id);
+                const anchor = extra
+                    ? Object.assign(Object.assign({}, row), { content: String(extra.content || ""), vector: extra.vector }) : row;
+                if (vectorLength(anchor.vector) === 0)
+                    continue;
+                anchors.push(anchor);
+            }
+        }
         const filters = {
             rawNeighbors: 0,
             sameChunk: 0,
@@ -520,15 +637,16 @@ function analyzeSurprisingConnections(table_1, projectRoot_1) {
             belowThreshold: 0,
         };
         const pairs = new Map();
-        for (const source of anchors) {
-            const neighbors = (yield (0, ann_config_1.configureAnnVectorQuery)(table.vectorSearch(source.vector))
+        for (const anchor of anchors) {
+            const source = withoutVector(anchor);
+            const neighbors = (yield (0, ann_config_1.configureAnnVectorQuery)(table.vectorSearch(anchor.vector))
                 .select([...exports.SURPRISE_COLUMNS, "_distance"])
                 .where(where)
                 .limit(opts.neighbors + 8)
                 .toArray());
             for (const rawTarget of neighbors) {
                 filters.rawNeighbors++;
-                const target = toChunkRow(rawTarget, prefix);
+                const target = withoutVector(toChunkRow(rawTarget, prefix));
                 if (rowKey(source) === rowKey(target)) {
                     filters.sameChunk++;
                     continue;
@@ -537,7 +655,9 @@ function analyzeSurprisingConnections(table_1, projectRoot_1) {
                     filters.sameFile++;
                     continue;
                 }
-                if (!isCodePath(target.path) || vectorLength(target.vector) === 0) {
+                // A vector-search hit has a vector by construction, and `vector` is not
+                // selected, so only the path decides "non-code" here.
+                if (!isCodePath(target.path)) {
                     filters.nonCode++;
                     continue;
                 }

package/dist/lib/daemon/daemon.js

@@ -69,6 +69,7 @@ const log_rotate_1 = require("../utils/log-rotate");
 const logger_1 = require("../utils/logger");
 const operation_coordinator_1 = require("../utils/operation-coordinator");
 const process_1 = require("../utils/process");
+const process_footprint_1 = require("../utils/process-footprint");
 const project_registry_1 = require("../utils/project-registry");
 const root_availability_1 = require("../utils/root-availability");
 const watcher_store_1 = require("../utils/watcher-store");
@@ -80,6 +81,7 @@ const read_verbs_1 = require("./read-verbs");
 const rows_handler_1 = require("./rows-handler");
 const search_handler_1 = require("./search-handler");
 const vector_handler_1 = require("./vector-handler");
+const watch_leases_1 = require("./watch-leases");
 const watcher_manager_1 = require("./watcher-manager");
 // 30 min was too aggressive — every shutdown is a chance for races, FSEvents
 // drops, and orphan MLX cleanup. 4 hours keeps the daemon resident through a
@@ -100,6 +102,9 @@ const IDLE_TIMEOUT_MS = (() => {
     return parsed; // <= 0 disables the idle check below
 })();
 const HEARTBEAT_INTERVAL_MS = 60 * 1000;
+// Escape hatch for the pre-lease behavior: watch every indexed project for the
+// daemon's whole life. See WatchLeases for why that is no longer the default.
+const WATCH_ALL = process.env.GMAX_WATCH_ALL === "1";
 // Self-recycle. Under continuous load (a busy monorepo) the idle timeout never
 // fires, so a long-lived daemon never gets a fresh start. The 24h age trigger
 // is the primary hygiene mechanism. The RSS trigger is a backstop for a genuine
@@ -116,7 +121,11 @@ const envNum = (name, fallback) => {
     return Number.isFinite(parsed) ? parsed : fallback;
 };
 const MAX_LIFETIME_MS = envNum("GMAX_DAEMON_MAX_LIFETIME_MS", 24 * 60 * 60 * 1000);
+// Compared against the physical footprint (compressed + swapped included), not
+// RSS — see readFootprintMb. The env name is kept for existing overrides.
 const RSS_WATERMARK_MB = envNum("GMAX_DAEMON_RSS_WATERMARK_MB", 2560);
+const FOOTPRINT_RECYCLE_MIN_AGE_MS = 30 * 60 * 1000;
+const RECYCLE_FORCE_AFTER_MS = envNum("GMAX_DAEMON_RECYCLE_FORCE_AFTER_MS", 60 * 60 * 1000);
 class Daemon {
     constructor() {
         this.processors = new Map();
@@ -141,6 +150,9 @@ class Daemon {
         this.lastZoneWarnMs = 0;
         this.shuttingDown = false;
         this.recycling = false;
+        this.recycleDueSinceMs = null;
+        this.recycleReason = "";
+        this.lastRecycleDeferLogMs = 0;
         // False until LanceDB + MetaCache are open. The socket starts listening early
         // (so liveness probes succeed during slow init), so commands that need those
         // resources must be gated on this to avoid hitting null stores mid-startup.
@@ -168,6 +180,8 @@ class Daemon {
             runProjectOperation: (root, name, signal, fn) => this.withProjectLock(root, signal, () => this.runSharedOperation(name, signal, fn)),
         });
         this.projectMutex = new keyed_mutex_1.KeyedMutex();
+        // Tests construct daemons against the real HOME; keep their leases in memory.
+        this.watchLeases = new watch_leases_1.WatchLeases(process.env.VITEST ? null : config_1.PATHS.watchLeasesFile);
         this.operations = new operation_coordinator_1.OperationCoordinator();
         this.shutdownPromise = null;
         // Full-index progress per root while initialSync runs (--reset / initial
@@ -369,9 +383,13 @@ class Daemon {
             this.publishResourceGeneration(globalConfig, this.activeGeneration, this.vectorDb, this.workerPool, this.mlxMode(globalConfig));
             // 7. Register daemon (only after resources are open)
             (0, watcher_store_1.registerDaemon)(process.pid);
-            // 8. Subscribe to all registered projects (skip missing directories)
+            // 8. Subscribe to the registered projects some session still holds a lease
+            // on (skip missing directories). Everything else waits for a lease.
             const allProjects = (0, project_registry_1.listProjects)();
-            const indexed = allProjects.filter((p) => p.status === "indexed");
+            this.watchLeases.load();
+            const indexed = allProjects.filter((p) => p.status === "indexed" && this.shouldWatch(p.root));
+            console.log(`[daemon] Watching ${indexed.length} of ${allProjects.length} registered projects` +
+                (WATCH_ALL ? " (GMAX_WATCH_ALL=1)" : " (leased by active sessions)"));
             for (const p of indexed) {
                 if (!fs.existsSync(p.root)) {
                     // Skipping is already the safe behavior — the project keeps its registry
@@ -418,6 +436,7 @@ class Daemon {
                 }
                 catch (_a) { }
                 (0, log_rotate_1.rotateLogFds)(path.join(config_1.PATHS.logsDir, "daemon.log"));
+                this.sweepWatchLeases();
                 // Every 5 ticks (5 min), probe the MLX embed server and respawn if
                 // it's gone zombie (port held but /health unresponsive). Closes the
                 // 42h-degradation window where workers silently fell back to ONNX CPU
@@ -429,6 +448,9 @@ class Daemon {
                     this.maybeRecycle();
                     this.checkKernelZonePressure();
                 }
+                else if (this.recycleDueSinceMs !== null) {
+                    this.maybeRecycle(false);
+                }
             }, HEARTBEAT_INTERVAL_MS);
             // 10. Idle timeout (skip when disabled via env)
             if (IDLE_TIMEOUT_MS > 0) {
@@ -500,6 +522,10 @@ class Daemon {
         return this.withProjectLock(root, signal, () => this.runSharedOperation("watch", signal, () => this.watchProjectWithinOperation(root)));
     }
     watchProjectWithinOperation(root) {
+        // Every path that re-watches after an index/rebuild/remove goes through
+        // here, so an unleased project stays unwatched after the operation too.
+        if (!this.shouldWatch(root))
+            return Promise.resolve();
         const project = (0, project_registry_1.getProject)(root);
         if ((project === null || project === void 0 ? void 0 : project.status) === "indexed" &&
             this.activeGeneration &&
@@ -509,6 +535,62 @@ class Daemon {
         }
         return this.watcherManager.watchProject(root);
     }
+    shouldWatch(root) {
+        return WATCH_ALL || this.watchLeases.isWanted(root);
+    }
+    /**
+     * Take (or renew) a lease on `root` and make sure it is watched. Called for
+     * every `watch` IPC — MCP servers renew theirs every few minutes, so the
+     * common case is a lease bump on an already-watched project.
+     */
+    requestWatch(root, lease = {}, signal) {
+        var _a;
+        this.watchLeases.acquire(root, {
+            holder: lease.holder || "cli",
+            pid: lease.pid,
+            ttlMs: (_a = lease.ttlMs) !== null && _a !== void 0 ? _a : watch_leases_1.DEFAULT_LEASE_TTL_MS,
+        });
+        if (this.processors.has(root))
+            return Promise.resolve();
+        return this.watchProject(root, signal);
+    }
+    /**
+     * Drop a lease — every lease on the root when `holder` is omitted, which is
+     * what an explicit `unwatch` means — and unwatch once nothing wants it.
+     */
+    releaseWatch(root, holder, signal) {
+        this.watchLeases.release(root, holder);
+        if (this.shouldWatch(root) || !this.processors.has(root)) {
+            return Promise.resolve();
+        }
+        return this.unwatchProject(root, signal);
+    }
+    /**
+     * A short lease for a CLI add/index: the project stays watched after the
+     * operation re-watches it, and lapses unless a session picks it up.
+     */
+    leaseForCli(root) {
+        this.watchLeases.acquire(root, {
+            holder: "cli",
+            ttlMs: watch_leases_1.DEFAULT_LEASE_TTL_MS,
+        });
+    }
+    listWatchLeases() {
+        return this.watchLeases.list();
+    }
+    /** Unwatch projects whose last lease expired or whose holder exited. */
+    sweepWatchLeases() {
+        if (this.shuttingDown || WATCH_ALL)
+            return;
+        for (const root of this.watchLeases.sweep()) {
+            if (!this.processors.has(root) || this.shouldWatch(root))
+                continue;
+            console.log(`[daemon] No session holds ${path.basename(root)} any more — unwatching`);
+            void this.unwatchProject(root).catch((err) => {
+                console.error(`[daemon] Failed to unwatch ${path.basename(root)}:`, err);
+            });
+        }
+    }
     runSharedOperation(name, signal, fn) {
         return this.operations.runShared(name, signal, fn);
     }
@@ -1572,6 +1654,7 @@ class Daemon {
                         const keys = yield this.metaCache.getKeysWithPrefix(rootPrefix);
                         for (const key of keys)
                             this.metaCache.delete(key);
+                        this.watchLeases.release(root);
                         (0, ipc_handler_1.writeDone)(conn, { ok: true });
                     }
                     catch (err) {
@@ -1719,26 +1802,61 @@ class Daemon {
      * too large. Only fires when quiet — no active compaction and no in-flight
      * project operations — so a recycle never interrupts indexing work. The
      * successor re-runs catchup on startup, so nothing is lost.
+     *
+     * "Quiet" alone was not enough: with a dozen watched projects some batch or
+     * catchup was in flight at nearly every 5-minute probe, and one daemon ran for
+     * 8 days past its 24h limit while its footprint sat at 4 GB. So once a recycle
+     * is due it is re-checked every heartbeat to catch a quiet minute, and after
+     * RECYCLE_FORCE_AFTER_MS of deferral it proceeds over in-flight project work
+     * (shutdown aborts it; the successor's catchup redoes it). Compaction is still
+     * waited out — killing it strands scratch files and wastes the rewrite.
+     *
+     * @param sampleFootprint false on the in-between ticks: `footprint` costs ~50 ms,
+     *   so it is only sampled on the 5-minute probe.
      */
-    maybeRecycle() {
+    maybeRecycle(sampleFootprint = true) {
         var _a;
         if (this.shuttingDown || this.recycling)
             return;
         const ageMs = process.uptime() * 1000;
-        const rssMb = process.memoryUsage().rss / (1024 * 1024);
         const ageExceeded = MAX_LIFETIME_MS > 0 && ageMs > MAX_LIFETIME_MS;
-        const rssExceeded = RSS_WATERMARK_MB > 0 && rssMb > RSS_WATERMARK_MB;
-        if (!ageExceeded && !rssExceeded)
-            return;
-        // Defer while busy; we'll re-check next tick.
+        let footprintMb = null;
+        if (this.recycleDueSinceMs === null &&
+            !ageExceeded &&
+            sampleFootprint &&
+            RSS_WATERMARK_MB > 0 &&
+            // A fresh daemon above the watermark would recycle in a loop; give the
+            // caches a chance to settle before judging the footprint.
+            ageMs > FOOTPRINT_RECYCLE_MIN_AGE_MS) {
+            footprintMb = (0, process_footprint_1.readFootprintMb)();
+        }
+        const footprintExceeded = footprintMb !== null && footprintMb > RSS_WATERMARK_MB;
+        if (this.recycleDueSinceMs === null) {
+            if (!ageExceeded && !footprintExceeded)
+                return;
+            this.recycleDueSinceMs = Date.now();
+            this.recycleReason = ageExceeded
+                ? `age ${(ageMs / 3600000).toFixed(1)}h > ${(MAX_LIFETIME_MS / 3600000).toFixed(1)}h`
+                : `footprint ${Math.round(footprintMb !== null && footprintMb !== void 0 ? footprintMb : 0)}MB > ${RSS_WATERMARK_MB}MB`;
+        }
+        // Defer while busy; re-checked on every heartbeat until it goes through.
         if ((_a = this.vectorDb) === null || _a === void 0 ? void 0 : _a.isMaintenanceActive())
             return;
-        if (this.projectMutex.pending > 0 || this.operations.activeCount > 0)
+        const busy = this.projectMutex.pending > 0 || this.operations.activeCount > 0;
+        const deferredMs = Date.now() - this.recycleDueSinceMs;
+        if (busy && deferredMs < RECYCLE_FORCE_AFTER_MS) {
+            if (Date.now() - this.lastRecycleDeferLogMs >= 30 * 60 * 1000) {
+                this.lastRecycleDeferLogMs = Date.now();
+                console.log(`[daemon] Recycle due (${this.recycleReason}) — deferred ${Math.round(deferredMs / 60000)}min, busy: ` +
+                    [
+                        ...this.operations.activeOperationNames(),
+                        ...this.projectMutex.pendingKeys().map((k) => path.basename(k)),
+                    ].join(", "));
+            }
             return;
-        const reason = ageExceeded
-            ? `age ${(ageMs / 3600000).toFixed(1)}h > ${(MAX_LIFETIME_MS / 3600000).toFixed(1)}h`
-            : `rss ${Math.round(rssMb)}MB > ${RSS_WATERMARK_MB}MB`;
-        console.log(`[daemon] Recycling (${reason}) — handing off to a fresh daemon`);
+        }
+        const forced = busy ? " (forced over in-flight work)" : "";
+        console.log(`[daemon] Recycling (${this.recycleReason})${forced} — handing off to a fresh daemon`);
         this.recycling = true;
         void this.shutdown({ relaunch: true }).finally(() => process.exit(0));
     }

package/dist/lib/daemon/graph-handler.js

@@ -94,6 +94,7 @@ const callsites_1 = require("../graph/callsites");
 const graph_builder_1 = require("../graph/graph-builder");
 const impact_1 = require("../graph/impact");
 const arrow_1 = require("../utils/arrow");
+const async_semaphore_1 = require("../utils/async-semaphore");
 const daemon_client_1 = require("../utils/daemon-client");
 const filter_builder_1 = require("../utils/filter-builder");
 const path_containment_1 = require("../utils/path-containment");
@@ -113,6 +114,8 @@ const MAX_PATH_HOPS = 10;
 const MAX_SUBGRAPH_FILES = 500;
 /** A diff can name many symbols; each costs three graph queries. */
 const MAX_RISK_SYMBOLS = 200;
+/** Symbols `graph.risk` resolves at once (three store scans each). */
+const RISK_SYMBOL_CONCURRENCY = 4;
 function clampInt(value, min, max, fallback) {
     const n = typeof value === "number" ? value : Number.NaN;
     if (!Number.isFinite(n))
@@ -430,10 +433,13 @@ function runGraphSubgraph(db, args) {
  * The caller keeps the git half and assembles the `RiskInput` rows, so the
  * scoring stays exactly where it was.
  */
-function runGraphRisk(db, args) {
+function runGraphRisk(db, args, signal) {
     return __awaiter(this, void 0, void 0, function* () {
         const builder = new graph_builder_1.GraphBuilder(db, args.scope.pathPrefix, args.scope.excludePrefixes);
-        return Promise.all(args.symbols.slice(0, MAX_RISK_SYMBOLS).map((symbol) => __awaiter(this, void 0, void 0, function* () {
+        // Each symbol costs three unindexed content scans. Fanning all of them out
+        // at once put up to MAX_RISK_SYMBOLS x 3 scans in native memory together;
+        // the pool keeps it at RISK_SYMBOL_CONCURRENCY x 3.
+        return (0, async_semaphore_1.mapWithConcurrency)(args.symbols.slice(0, MAX_RISK_SYMBOLS), RISK_SYMBOL_CONCURRENCY, (symbol) => __awaiter(this, void 0, void 0, function* () {
             var _a, _b;
             const [callers, loc, tests] = yield Promise.all([
                 builder.callersOf(symbol).catch(() => []),
@@ -447,7 +453,7 @@ function runGraphRisk(db, args) {
                 callerCount: callers.length,
                 hasTests: tests.length > 0,
             };
-        })));
+        }), signal);
     });
 }
 // Names too generic to be useful as god-node signal (`id`, `el`, `fn`, …).
@@ -810,13 +816,13 @@ function createGraphVerbs(getDeps) {
             });
             return { ok: true, subgraph };
         }),
-        "graph.risk": (payload, db) => __awaiter(this, void 0, void 0, function* () {
+        "graph.risk": (payload, db, signal) => __awaiter(this, void 0, void 0, function* () {
             const decoded = decodeScopePayload(payload);
             const facts = yield runGraphRisk(db, {
                 symbols: requireSymbols(payload),
                 queryRoot: queryRootFor(decoded),
                 scope: decoded.scope,
-            });
+            }, signal);
             return { ok: true, facts };
         }),
         "graph.audit": (payload, db) => __awaiter(this, void 0, void 0, function* () {
@@ -831,7 +837,7 @@ function createGraphVerbs(getDeps) {
     };
     const wired = {};
     for (const [name, run] of Object.entries(handlers)) {
-        wired[name] = (payload, ctx) => __awaiter(this, void 0, void 0, function* () { return run(payload, requireStore(getDeps(ctx))); });
+        wired[name] = (payload, ctx) => __awaiter(this, void 0, void 0, function* () { return run(payload, requireStore(getDeps(ctx)), ctx.signal); });
     }
     return wired;
 }