mixdog 0.9.147 → 0.9.149

package/src/runtime/memory/lib/ko-morph.mjs

@@ -56,17 +56,22 @@ let _kiwi = null
 let _log = () => {}
 let _initMs = 0
 let _idleTimer = null
+const _stemCache = new Map()
+const STEM_CACHE_LIMIT = 256
 // Idle window before the analyzer is released. A cold rebuild costs ~1.5-1.8s
 // and BLOCKS the recall path (buildFtsQuery awaits it for Hangul queries), so a
-// 60s window expired between ordinary conversational turns and made nearly
-// every interactive recall pay that rebuild. 5 minutes keeps the analyzer alive
-// across a normal back-and-forth while still reclaiming its ~560MB once the
-// session genuinely goes quiet. MIXDOG_KO_MORPH_IDLE_TIMEOUT_MS overrides;
+// 60s expired between ordinary conversational turns and made nearly every
+// interactive recall pay that rebuild. Two minutes covers a normal follow-up
+// while returning the analyzer's native memory promptly once recall goes quiet.
+// MIXDOG_KO_MORPH_IDLE_TIMEOUT_MS overrides;
 // 0 disables the release entirely.
-const _envIdleMs = Number(process.env.MIXDOG_KO_MORPH_IDLE_TIMEOUT_MS)
-const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0
-  ? _envIdleMs
-  : 300_000
+export function _resolveKoMorphIdleTimeout(value) {
+  const configured = Number(value)
+  return Number.isFinite(configured) && configured >= 0 ? configured : 120_000
+}
+const IDLE_TIMEOUT_MS = _resolveKoMorphIdleTimeout(
+  process.env.MIXDOG_KO_MORPH_IDLE_TIMEOUT_MS,
+)
 
 export function isReady() { return _state === 'ready' && _kiwi != null }
 export function state() { return _state }
@@ -80,6 +85,7 @@ function releaseLoaded(reason = '') {
   _state = 'idle'
   _initPromise = null
   _initMs = 0
+  _stemCache.clear()
   try { current?.dispose?.() } catch {}
   if (current && reason) _log(`[memory-service] kiwi morph ${reason} — analyzer released\n`)
 }
@@ -200,13 +206,20 @@ function readModelFiles(dir) {
   for (const f of REQUIRED_MODEL_FILES) {
     modelFiles[f] = new Uint8Array(fs.readFileSync(path.join(dir, f)))
   }
-  for (const f of OPTIONAL_MODEL_FILES) {
-    const p = path.join(dir, f)
-    if (fs.existsSync(p)) modelFiles[f] = new Uint8Array(fs.readFileSync(p))
-  }
   return modelFiles
 }
 
+export function _kiwiBuildArgs(modelFiles) {
+  return {
+    modelFiles,
+    modelType: 'knlm',
+    loadDefaultDict: true,
+    loadMultiDict: false,
+    loadTypoDict: false,
+    typos: 'none',
+  }
+}
+
 // Lazy, idempotent, never-throwing init. Fire-and-forget at boot.
 export async function init(dataDir, log = () => {}) {
   _log = typeof log === 'function' ? log : (() => {})
@@ -232,9 +245,10 @@ export async function init(dataDir, log = () => {}) {
     const dir = await downloadAndExtractModel(dataDir)
     const modelFiles = readModelFiles(dir)
     const builder = await KiwiBuilder.create(wasmPath)
-    // modelType 'knlm' = fast KnLM (sj.knlm); loadMultiDict/loadTypoDict only
-    // engage if the optional files were present.
-    _kiwi = await builder.build({ modelFiles, modelType: 'knlm' })
+    // Recall needs content stems, not typo correction or the 12 MB polysemous
+    // proper-noun dictionary. Keep the KNLM and default dictionary for Korean
+    // accuracy while leaving every optional model out of WASM memory.
+    _kiwi = await builder.build(_kiwiBuildArgs(modelFiles))
     _state = 'ready'
     _initMs = Date.now() - t0
     _log(`[memory-service] kiwi morph ready in ${_initMs}ms (model ${KIWI_MODEL_VERSION}, rss≈${Math.round(process.memoryUsage().rss / 1e6)}MB)\n`)
@@ -266,6 +280,15 @@ export function analyze(text) {
 // Content-morpheme stem forms for a Korean phrase. null when not ready.
 // Example: an inflected Korean noun/verb phrase is reduced to content stems.
 export function stems(text) {
+  const source = String(text ?? '')
+  if (!source) return null
+  const cached = _stemCache.get(source)
+  if (cached) {
+    _stemCache.delete(source)
+    _stemCache.set(source, cached)
+    touchIdleTimer()
+    return cached
+  }
   const tokens = analyze(text)
   if (!tokens) return null
   const out = []
@@ -274,6 +297,14 @@ export function stems(text) {
     const form = String(t.str || '').trim()
     if (form.length >= 1) out.push(form)
   }
+  if (source.length <= 4_096) {
+    _stemCache.set(source, out)
+    while (_stemCache.size > STEM_CACHE_LIMIT) {
+      const oldest = _stemCache.keys().next().value
+      if (oldest === undefined) break
+      _stemCache.delete(oldest)
+    }
+  }
   return out
 }
 

package/src/runtime/memory/lib/memory-action-handlers.mjs

@@ -21,6 +21,7 @@ import {
   CYCLE2_ACTIVE_TARGET_CAP,
 } from './memory-cycle.mjs'
 import { getInFlightCycle1 } from './memory-cycle1.mjs'
+import { isStoreFault } from './memory-cycle2-shared.mjs'
 import { pruneOldEntries } from './memory-maintenance-store.mjs'
 import { computeEntryScore } from './memory-score.mjs'
 import { runFullBackfill } from './memory-ops-policy.mjs'
@@ -869,7 +870,19 @@ export function createMemoryActionHandlers({
               }
               acted.add(targetId)
               filteredSources.forEach(s => acted.add(Number(s)))
-              const moved = await applyMerge(db, targetId, filteredSources)
+              // Same optimistic contract as the archived/update verbs above: the
+              // gate's verdict is only applied while target and sources still
+              // hold the state it judged.
+              const expectedBySource = {}
+              for (const sourceId of filteredSources.map(Number)) {
+                const sourceRow = rowById.get(sourceId)
+                if (sourceRow) expectedBySource[sourceId] = { status: sourceRow.status, summary: sourceRow.summary }
+              }
+              const targetRow = rowById.get(targetId)
+              const moved = await applyMerge(db, targetId, filteredSources, {
+                expectedBySource,
+                expectedTarget: targetRow ? { status: targetRow.status, summary: targetRow.summary } : null,
+              })
               if (moved > 0) {
                 merged += moved
                 if (typeof act.element === 'string' || typeof act.summary === 'string') {
@@ -883,6 +896,10 @@ export function createMemoryActionHandlers({
               }
             }
           } catch (err) {
+            // Same split as the cycle2 apply path: a store fault stops the run
+            // (the DB state is unknown), while a guard-rejected verdict stays an
+            // ordinary counted error.
+            if (isStoreFault(err)) throw err
             log(`[retro_eval_active] action error (id=${act?.entry_id}): ${err.message}\n`)
             errors += 1
           }

package/src/runtime/memory/lib/memory-cycle1.mjs

@@ -1,4 +1,5 @@
 import { __mixdogMemoryLog } from './memory-log.mjs';
+import { createSemaphore } from './memory-cycle2-shared.mjs';
 
 import { cleanMemoryText } from './memory.mjs'
 import { resolveMaintenancePreset } from '../../shared/llm/index.mjs'
@@ -278,24 +279,6 @@ function logCycle1Throttled(key, message, intervalMs = 60_000) {
   __mixdogMemoryLog(message)
 }
 
-// Tiny inline semaphore — bounds cycle1 window fan-out.
-function createSemaphore(limit) {
-  const cap = Math.max(1, Number(limit) || 1)
-  let active = 0
-  const queue = []
-  const release = () => {
-    active -= 1
-    const next = queue.shift()
-    if (next) next()
-  }
-  return async (fn) => {
-    if (active >= cap) await new Promise(res => queue.push(res))
-    active += 1
-    try { return await fn() }
-    finally { release() }
-  }
-}
-
 export function packCycle1Windows(rowsBySession, packetSize = CYCLE1_PACKET_MAX_ROWS, maxPackets = CYCLE1_MAX_PACKETS) {
   const size = Math.min(CYCLE1_PACKET_MAX_ROWS, Math.max(1, Number(packetSize) || CYCLE1_PACKET_MAX_ROWS))
   const cap = Math.min(CYCLE1_MAX_PACKETS, Math.max(1, Number(maxPackets) || CYCLE1_MAX_PACKETS))

package/src/runtime/memory/lib/memory-cycle2-gate.mjs

@@ -7,7 +7,7 @@ import { join } from 'path'
 import { resolveMaintenancePreset } from '../../shared/llm/index.mjs'
 import { callAgentDispatch } from './agent-ipc.mjs'
 import { listCore } from './core-memory-store.mjs'
-import { __mixdogMemoryLog, throwIfAborted, resourceDir } from './memory-cycle2-shared.mjs'
+import { __mixdogMemoryLog, throwIfAborted, resourceDir, createSemaphore } from './memory-cycle2-shared.mjs'
 
 export const CYCLE2_ACTIVE_TARGET_CAP = 100
 const CYCLE2_PACKET_MATERIAL_CAP = 50
@@ -213,23 +213,6 @@ export function packUnifiedGatePackets(rows, candidates, options = {}) {
   return { packets, deferredIds }
 }
 
-function createSemaphore(limit) {
-  const cap = Math.max(1, Number(limit) || 1)
-  let active = 0
-  const queue = []
-  const release = () => {
-    active -= 1
-    const next = queue.shift()
-    if (next) next()
-  }
-  return async (fn) => {
-    if (active >= cap) await new Promise(resolve => queue.push(resolve))
-    active += 1
-    try { return await fn() }
-    finally { release() }
-  }
-}
-
 function formatLineageCandidates(rows, candidates) {
   const lines = []
   rows.forEach((row, index) => {

package/src/runtime/memory/lib/memory-cycle2-mutations.mjs

@@ -4,7 +4,7 @@
 import { deleteRootEmbedding, syncRootEmbedding } from './memory-embed.mjs'
 import { resolveMaintenancePreset } from '../../shared/llm/index.mjs'
 import { callAgentDispatch } from './agent-ipc.mjs'
-import { __mixdogMemoryLog, throwIfAborted } from './memory-cycle2-shared.mjs'
+import { __mixdogMemoryLog, throwIfAborted, markStoreFault } from './memory-cycle2-shared.mjs'
 
 const TIER1_THRESHOLD = 0.78
 const TIER2_LOW = 0.65
@@ -268,74 +268,122 @@ export async function applyMerge(db, targetId, sourceIds, options = {}) {
   const signal = options?.signal
   throwIfAborted(signal)
   if (!Number.isFinite(targetId)) return 0
-  const targetRes = await db.query(
-    `SELECT id, project_id FROM entries WHERE id = $1 AND is_root = 1`,
-    [targetId],
-  )
-  throwIfAborted(signal)
-  const target = targetRes.rows[0]
-  if (!target) return 0
+  // Optimistic guards keyed by source id: { status, summary } as observed when
+  // the merge verdict was produced (same contract as applyUpdate's `expected`).
+  const expectedBySource = options?.expectedBySource ?? null
+  const readExpected = (sid) => (
+    typeof expectedBySource?.get === 'function' ? expectedBySource.get(sid) : expectedBySource?.[sid]
+  ) ?? null
+  // Snapshot of the merge TARGET as the verdict saw it. A merge is a statement
+  // about both rows, so the target has to be validated exactly like a source.
+  const expectedTarget = options?.expectedTarget ?? null
   let moved = 0
   for (const src of sourceIds) {
     throwIfAborted(signal)
     const sid = Number(src)
     if (!Number.isFinite(sid) || sid === targetId) continue
-    const srcRes = await db.query(
-      `SELECT id, project_id, status FROM entries WHERE id = $1 AND is_root = 1`,
-      [sid],
-    )
-    throwIfAborted(signal)
-    const srcRow = srcRes.rows[0]
-    if (!srcRow) continue
-    if (target.project_id !== srcRow.project_id) {
-      __mixdogMemoryLog(
-        `[cycle2] merge rejected: cross-pool (target=${targetId} project_id=${target.project_id ?? 'COMMON'} src=${sid} project_id=${srcRow.project_id ?? 'COMMON'})\n`,
-      )
-      continue
-    }
-    // Floor guard: archiving an active source row shrinks the active pool, so
-    // it must reserve from the shared floor budget. Over-budget merges are
-    // skipped (source stays active); pending sources never reserve.
-    const srcActive = srcRow.status === 'active'
-    if (srcActive && options.floorGuard && !options.floorGuard.reserve()) {
-      __mixdogMemoryLog(`[cycle2] merge source archive skipped (floor guard): target=${targetId} src=${sid}\n`)
-      continue
-    }
-    let archivedPrevStatus = null
+    let reserved = false
+    let archived = false
+    let skip = null
     try {
       // Archive is the guarded mutation unit: the reservation is only kept if
       // this transaction commits. Embedding cleanup is deliberately OUTSIDE
       // this try — a post-commit cleanup failure must NOT refund the budget,
       // since the active row is already archived.
       await db.transaction(async (tx) => {
+        // Target AND source are read inside the transaction and locked in id
+        // order (deterministic ordering, so two concurrent merges cannot
+        // deadlock). Reading them outside meant the verdict was applied to
+        // state that could already have changed content or status.
+        const { rows } = await tx.query(
+          `SELECT id, project_id, status, summary FROM entries
+           WHERE id = ANY($1::bigint[]) AND is_root = 1
+           ORDER BY id FOR UPDATE`,
+          [[targetId, sid]],
+        )
+        const target = rows.find((r) => Number(r.id) === Number(targetId))
+        const srcRow = rows.find((r) => Number(r.id) === sid)
+        if (!target) { skip = `target ${targetId} is not a root`; return }
+        if (!srcRow) { skip = `source ${sid} is not a root`; return }
+        if (target.project_id !== srcRow.project_id) {
+          skip = `cross-pool (target=${targetId} project_id=${target.project_id ?? 'COMMON'} src=${sid} project_id=${srcRow.project_id ?? 'COMMON'})`
+          return
+        }
+        // Target guards: folding a live source into a target that has since been
+        // archived (or rewritten) destroys the source without a surviving
+        // consolidated row.
+        if (target.status === 'archived') { skip = `target ${targetId} is archived`; return }
+        if (expectedTarget && typeof expectedTarget.status === 'string' && target.status !== expectedTarget.status) {
+          skip = `target ${targetId} status moved (${expectedTarget.status} → ${target.status})`
+          return
+        }
+        if (expectedTarget && typeof expectedTarget.summary === 'string' && target.summary !== expectedTarget.summary) {
+          skip = `target ${targetId} content changed since the verdict`
+          return
+        }
+        // Status guard: never re-archive an already archived source.
+        if (srcRow.status === 'archived') { skip = `source ${sid} already archived`; return }
+        // Content guard: the source must still say what the verdict judged.
+        const expected = readExpected(sid)
+        if (expected && typeof expected.status === 'string' && srcRow.status !== expected.status) {
+          skip = `source ${sid} status moved (${expected.status} → ${srcRow.status})`
+          return
+        }
+        if (expected && typeof expected.summary === 'string' && srcRow.summary !== expected.summary) {
+          skip = `source ${sid} content changed since the verdict`
+          return
+        }
+        // Floor guard: archiving an active source row shrinks the active pool,
+        // so it must reserve from the shared floor budget. Over-budget merges
+        // are skipped (source stays active); pending sources never reserve.
+        if (srcRow.status === 'active' && options.floorGuard) {
+          if (!options.floorGuard.reserve()) {
+            skip = `floor guard: target=${targetId} src=${sid}`
+            return
+          }
+          reserved = true
+        }
         await tx.query(
           `UPDATE entries SET chunk_root = $1, project_id = $2 WHERE chunk_root = $3 AND id != $4 AND is_root = 0`,
           [targetId, target.project_id, sid, sid],
         )
-        // Capture prev status in the same statement so a stale snapshot (the
-        // row was already archived by a concurrent write) can refund below.
         const ar = await tx.query(
-          `WITH pre AS (SELECT id, status AS prev FROM entries WHERE id = $1 AND is_root = 1)
-           UPDATE entries SET status = 'archived'
-           FROM pre WHERE entries.id = pre.id AND entries.is_root = 1
-           RETURNING pre.prev AS prev_status`,
-          [sid],
+          `UPDATE entries SET status = 'archived'
+           WHERE id = $1 AND is_root = 1 AND status IS NOT DISTINCT FROM $2::entry_status`,
+          [sid, srcRow.status],
         )
-        archivedPrevStatus = ar.rows?.[0]?.prev_status ?? null
+        archived = Number(ar.rowCount ?? ar.affectedRows ?? 0) > 0
       })
     } catch (err) {
-      if (srcActive && options.floorGuard) options.floorGuard.refund()
+      // Store fault: the transaction rolled back, or its COMMIT outcome is
+      // unknown. The reservation is deliberately NOT refunded — the source may
+      // in fact be archived, so returning the budget would let a later archive
+      // spend it twice and breach the active floor. Marked so callers can tell
+      // it apart from the guard rejections above, which return normally.
+      if (reserved && options.floorGuard) {
+        __mixdogMemoryLog(`[cycle2] merge floor reservation withheld after store fault: target=${targetId} src=${sid}\n`)
+      }
       __mixdogMemoryLog(`[cycle2] merge failed (target=${targetId} src=${sid}): ${err.message}\n`)
+      throw markStoreFault(err)
+    }
+    if (skip) __mixdogMemoryLog(`[cycle2] merge source skipped: ${skip}\n`)
+    if (!archived) {
+      if (reserved && options.floorGuard) options.floorGuard.refund()
       continue
     }
-    // Archive committed. If the source was no longer active at UPDATE time,
-    // the reservation did not cover a real active→archived transition — refund.
-    if (srcActive && options.floorGuard && archivedPrevStatus !== 'active') options.floorGuard.refund()
     // Archive committed — best-effort embedding cleanup only. The next abort
     // checkpoint is before the next source.
     moved += 1
-    try { await deleteRootEmbedding(db, sid) }
-    catch (err) { __mixdogMemoryLog(`[cycle2] merge embedding cleanup failed (target=${targetId} src=${sid}): ${err.message}\n`) }
+    try {
+      await deleteRootEmbedding(db, sid)
+    } catch (err) {
+      // The cleanup is a SECOND transaction, so its failure is a store fault of
+      // exactly the same kind — including the commit-ambiguous case. Absorbing
+      // it here kept archiving later sources against a store whose state is
+      // already unknown, which is the invariant the archive path enforces.
+      __mixdogMemoryLog(`[cycle2] merge embedding cleanup failed (target=${targetId} src=${sid}): ${err.message}\n`)
+      throw markStoreFault(err)
+    }
   }
   return moved
 }
@@ -432,7 +480,12 @@ export async function runPhaseMerge(db, options = {}) {
     const loser = keeper.id === a.id ? b : a
     // phase_merge only pairs active rows, so the loser archive is an active
     // demotion — thread the floor budget through applyMerge.
-    const moved = await applyMerge(db, keeper.id, [loser.id], { signal, floorGuard })
+    const moved = await applyMerge(db, keeper.id, [loser.id], {
+      signal,
+      floorGuard,
+      expectedBySource: { [loser.id]: { status: loser.status, summary: loser.summary } },
+      expectedTarget: { status: keeper.status, summary: keeper.summary },
+    })
     if (moved > 0) {
       merged += moved
       mergedIds.add(loser.id)

package/src/runtime/memory/lib/memory-cycle2-shared.mjs

@@ -11,6 +11,77 @@ export function throwIfAborted(signal) {
   if (signal?.aborted) throw signal.reason ?? new Error('aborted')
 }
 
+// Tiny inline semaphore — bounds cycle fan-out (cycle1 windows, cycle2 gate
+// packets). One implementation so the two concurrency caps cannot drift.
+export function createSemaphore(limit) {
+  const cap = Math.max(1, Number(limit) || 1)
+  let active = 0
+  const queue = []
+  const release = () => {
+    active -= 1
+    const next = queue.shift()
+    if (next) next()
+  }
+  return async (fn) => {
+    if (active >= cap) await new Promise(resolve => queue.push(resolve))
+    active += 1
+    try { return await fn() }
+    finally { release() }
+  }
+}
+
+// Two error classes travel through the cycle2 apply paths and must never be
+// confused:
+//   * STORE FAULT — the database itself failed the write (transaction rolled
+//     back, or its COMMIT outcome is unknown). Nothing about the verdict was
+//     wrong, and the store's state is no longer known, so the run stops.
+//   * verdict rejection — a guard refused the mutation (stale snapshot, status
+//     moved, content changed, floor budget exhausted). The store is healthy;
+//     these return normally and are counted as ordinary rejections/errors.
+// Only writers raise store faults, via markStoreFault; callers branch on
+// isStoreFault before absorbing an error into a per-action counter.
+// Classification is TYPE-based, never text-based: the writer raises a dedicated
+// error class, and `err instanceof MemoryStoreFault` is the decision. An
+// explicit own field (`isMemoryStoreFault` + `code`) corroborates it for the
+// cross-realm case where two copies of this module exist. Nothing about the
+// error's message or name participates — a foreign provider/DB error is never
+// reclassified because of how its text happens to read, and a store fault keeps
+// the original message verbatim so logs stay honest.
+//
+// Boundaries this signal actually crosses: none that serialize. The writer
+// (applyMerge) throws and the deciders (the cycle2 apply loop and
+// retro_eval_active) catch it in the same process, same module registry, same
+// tick. runCycle2 converts it at its own boundary into a plain
+// { ok: false, error: <string>, storeFault: <boolean> } result, so the explicit
+// boolean — not a re-parsed Error — is what any IPC/worker hop carries onward.
+export const MEMORY_STORE_FAULT_CODE = 'MEMORY_STORE_FAULT'
+
+export class MemoryStoreFault extends Error {
+  constructor(message, options) {
+    super(message, options)
+    this.name = 'MemoryStoreFault'
+    this.code = MEMORY_STORE_FAULT_CODE
+    this.isMemoryStoreFault = true
+  }
+}
+
+export function markStoreFault(err) {
+  if (isStoreFault(err)) return err
+  const cause = err instanceof Error ? err : new Error(String(err))
+  // The original is never mutated (frozen/sealed store errors are ordinary):
+  // it is carried as `cause`, with its message copied verbatim — unprefixed —
+  // and its stack preserved so the failing statement stays visible.
+  const fault = new MemoryStoreFault(cause.message || String(cause), { cause })
+  if (typeof cause.stack === 'string') fault.stack = cause.stack
+  return fault
+}
+
+export function isStoreFault(err) {
+  if (!err || typeof err !== 'object') return false
+  if (err instanceof MemoryStoreFault) return true
+  return err.isMemoryStoreFault === true && err.code === MEMORY_STORE_FAULT_CODE
+}
+
 export function resourceDir() {
   return process.env.MIXDOG_ROOT
     ? join(process.env.MIXDOG_ROOT, 'src')

package/src/runtime/memory/lib/memory-cycle2-shared.test.mjs

@@ -0,0 +1,78 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  MEMORY_STORE_FAULT_CODE,
+  MemoryStoreFault,
+  isStoreFault,
+  markStoreFault,
+} from './memory-cycle2-shared.mjs'
+
+test('a foreign error is never classified by its text', () => {
+  // The exact former marker text, now owned by nobody: a provider/DB error that
+  // happens to read this way must stay an ordinary, recoverable action error.
+  const lookalikeMessage = new Error('MemoryStoreFault: connection reset by peer')
+  assert.equal(isStoreFault(lookalikeMessage), false)
+
+  const lookalikeName = new Error('connection reset by peer')
+  lookalikeName.name = 'MemoryStoreFault'
+  assert.equal(isStoreFault(lookalikeName), false)
+
+  const lookalikeBoth = new Error('MemoryStoreFault: rollback')
+  lookalikeBoth.name = 'MemoryStoreFault:Error'
+  assert.equal(isStoreFault(lookalikeBoth), false)
+
+  // A half-claimed field is not a claim either.
+  const halfClaim = new Error('nope')
+  halfClaim.isMemoryStoreFault = true
+  assert.equal(isStoreFault(halfClaim), false)
+})
+
+test('markStoreFault produces a typed fault and preserves the original', () => {
+  const original = new Error('rollback')
+  const fault = markStoreFault(original)
+  assert.ok(fault instanceof MemoryStoreFault)
+  assert.equal(isStoreFault(fault), true)
+  assert.equal(fault.code, MEMORY_STORE_FAULT_CODE)
+  // Message stays verbatim — it is not a classification channel.
+  assert.equal(fault.message, 'rollback')
+  assert.equal(fault.cause, original)
+  assert.equal(original.message, 'rollback')
+})
+
+test('frozen, sealed and non-Error inputs still yield a typed fault', () => {
+  const frozen = Object.freeze(new Error('commit ambiguous'))
+  const fromFrozen = markStoreFault(frozen)
+  assert.equal(isStoreFault(fromFrozen), true)
+  assert.equal(fromFrozen.cause, frozen)
+  assert.equal(frozen.message, 'commit ambiguous')
+
+  const sealed = Object.seal(new Error('sealed write'))
+  assert.equal(isStoreFault(markStoreFault(sealed)), true)
+
+  const fromString = markStoreFault('boom')
+  assert.equal(isStoreFault(fromString), true)
+  assert.equal(fromString.message, 'boom')
+})
+
+test('marking is idempotent and non-faults stay unclassified', () => {
+  const fault = markStoreFault(new Error('rollback'))
+  assert.equal(markStoreFault(fault), fault)
+
+  assert.equal(isStoreFault(new Error('guard mismatch')), false)
+  assert.equal(isStoreFault(null), false)
+  assert.equal(isStoreFault(undefined), false)
+  assert.equal(isStoreFault('MemoryStoreFault: not an error'), false)
+  assert.equal(isStoreFault({}), false)
+})
+
+test('an explicitly tagged cross-realm fault is recognised without instanceof', () => {
+  // Second copy of the module (different realm/registry): instanceof fails, the
+  // explicit field pair still classifies.
+  const crossRealm = Object.assign(new Error('rollback'), {
+    isMemoryStoreFault: true,
+    code: MEMORY_STORE_FAULT_CODE,
+  })
+  assert.equal(crossRealm instanceof MemoryStoreFault, false)
+  assert.equal(isStoreFault(crossRealm), true)
+})

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -9,7 +9,7 @@ import { flushEmbeddingDirty } from './memory-embed.mjs'
 import { refreshHotActive } from './memory.mjs'
 import { backfillCoreEmbeddings, nominateCoreCandidates } from './core-memory-store.mjs'
 import { markCycleRequest, consumeCycleRequests, resolveCoalesceMaxDrains, scheduleCoalescedCycleRetry, makeCycleRequestSignature, resolveCoalesceMaxRetries } from './memory-cycle-requests.mjs'
-import { __mixdogMemoryLog, throwIfAborted } from './memory-cycle2-shared.mjs'
+import { __mixdogMemoryLog, throwIfAborted, isStoreFault } from './memory-cycle2-shared.mjs'
 import {
   applyBatchStatusVerdicts, clampPendingPromotions, blockTransientPromotions, applySimpleStatus, applyUpdate, applyLineage, applyMerge, runPhaseMerge,
 } from './memory-cycle2-mutations.mjs'
@@ -142,6 +142,16 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
       try {
         result = await _runCycle2Impl(db, config, options, dataDir)
       } catch (err) {
+        // A marked store fault means the database just failed (or ambiguously
+        // failed) a write: do not push another write — the coalesced-request
+        // ledger is a meta-table INSERT/UPDATE — onto it. Go straight to the
+        // { ok: false } boundary. The in-process retry timer is left intact so
+        // recovery still happens on a later, independent run.
+        if (isStoreFault(err)) {
+          __mixdogMemoryLog('[cycle2] store fault — skipping coalesced request mark\n')
+          if (coalescedRetry && retryAttempt < maxRetries) scheduleRetry()
+          throw err
+        }
         if (coalescedRetry) {
           await markCycleRequest(db, 'cycle2', 'retry-error', requestSignature)
           if (retryAttempt < maxRetries) scheduleRetry()
@@ -162,6 +172,12 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
           const next = await _runCycle2Impl(db, config, options, dataDir)
           result = mergeCycle2Results(result, next)
         } catch (err) {
+          // Same rule on the drain pass: no ledger write after a store fault.
+          if (isStoreFault(err)) {
+            __mixdogMemoryLog('[cycle2] store fault — skipping coalesced drain mark\n')
+            if (!coalescedRetry || retryAttempt < maxRetries) scheduleRetry()
+            throw err
+          }
           await markCycleRequest(db, 'cycle2', 'drain-error', requestSignature)
           if (!coalescedRetry || retryAttempt < maxRetries) scheduleRetry()
           throw err
@@ -178,7 +194,10 @@ export async function runCycle2(db, config = {}, options = {}, dataDir = null) {
       return okResult
     } catch (e) {
       if (signal?.aborted) throw signal.reason ?? e
-      return { ok: false, error: e.message, ...partial }
+      // The store-fault outcome leaves this boundary as an explicit boolean, so
+      // no consumer downstream (IPC, worker, log pipeline) ever has to re-derive
+      // it from the error text.
+      return { ok: false, error: e.message, storeFault: isStoreFault(e), ...partial }
     } finally {
       let releaseErr = null
       try {
@@ -540,7 +559,16 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
             )
             continue
           }
-          const moved = await applyMerge(db, targetId, sourceIds, { signal, floorGuard })
+          // Pass the snapshot each verdict was computed against so applyMerge
+          // can refuse to archive a source whose status/content moved on.
+          const expectedBySource = {}
+          for (const sourceId of sourceIds.map(Number)) {
+            const sourceRow = rowsById.get(sourceId)
+            if (sourceRow) expectedBySource[sourceId] = { status: sourceRow.status, summary: sourceRow.summary }
+          }
+          const targetRow = rowsById.get(Number(targetId))
+          const expectedTarget = targetRow ? { status: targetRow.status, summary: targetRow.summary } : null
+          const moved = await applyMerge(db, targetId, sourceIds, { signal, floorGuard, expectedBySource, expectedTarget })
           throwIfAborted(signal)
           if (moved > 0) {
             stats.merged += moved
@@ -561,6 +589,12 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
         if (accepted) reviewedIds.push(id)
       } catch (err) {
         if (signal?.aborted) throw signal.reason ?? err
+        // A store fault leaves the database state unknown and the floor
+        // reservation permanently spent, so the cycle stops here exactly like
+        // phase_merge does (runCycle2 reports it as { ok: false }). Verdict
+        // rejections never land here — a guard mismatch or skipped merge
+        // returns normally and is counted as merge_rejected / error_count.
+        if (isStoreFault(err)) throw err
         __mixdogMemoryLog(`[cycle2] action error (id=${id}): ${err.message}\n`)
       }
     }

package/src/runtime/memory/lib/memory-cycle3.mjs

@@ -527,7 +527,7 @@ async function _runCycle3Impl(db, config, dataDir, options = {}) {
       const scope = core.project_id ? String(core.project_id) : 'common'
       let queryVector = null
       try {
-        queryVector = await embedText(queryText)
+        queryVector = await embedText(queryText, { inputType: 'query' })
       } catch (err) {
         if (signal?.aborted) throw signal.reason ?? err
         __mixdogMemoryLog(`[cycle3] embedding failed for core id=${core.id}: ${err.message}\n`)