mixdog 0.9.20 → 0.9.21

package/src/runtime/memory/lib/http-router.mjs

@@ -42,6 +42,9 @@ export function createHttpRouter({
   handleMemoryAction,
   handleToolCall,
   stop,
+  registerClient,
+  deregisterClient,
+  getDraining,
   getCycle1CallLlm,
   getTraceDb,
   setTraceDb,
@@ -120,6 +123,31 @@ export function createHttpRouter({
 
   const requestHandler = async (req, res) => {
     touchDaemonIdleTimer(`${req.method || 'HTTP'} ${req.url || '/'}`)
+    // Connected-client lifecycle. Proxies register on first use and
+    // deregister on CLI shutdown; the daemon reaps itself shortly after the
+    // last client leaves (see registerClient/deregisterClient in index.mjs).
+    if (req.method === 'POST' && (req.url === '/client/register' || req.url === '/client/deregister')) {
+      if (!isLocalOrigin(req)) {
+        sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
+        return
+      }
+      let body = {}
+      try { body = await readBody(req) } catch {}
+      const clientPid = Number(body?.clientPid)
+      if (req.url === '/client/register') {
+        const accepted = registerClient?.(clientPid)
+        if (accepted === false) {
+          // Daemon is draining — distinct signal so the proxy respawns a fresh
+          // daemon and retries its pending RPC instead of binding to this one.
+          sendJson(res, { ok: false, draining: true, error: 'memory worker draining' }, 503)
+          return
+        }
+      } else {
+        deregisterClient?.(clientPid)
+      }
+      sendJson(res, { ok: true })
+      return
+    }
     if (req.method === 'POST' && req.url === '/session-reset') {
       const ts = Date.now()
       setBootTimestamp(ts)
@@ -133,6 +161,10 @@ export function createHttpRouter({
     }
 
     if (req.method === 'GET' && req.url === '/health') {
+      if (getDraining?.()) {
+        sendJson(res, { status: 'draining' }, 503)
+        return
+      }
       if (!getInitialized()) {
         sendJson(res, { status: 'starting' }, 503)
         return
@@ -591,6 +623,13 @@ export function createHttpRouter({
         sendJson(res, { content: [{ type: 'text', text: 'forbidden: cross-origin' }], isError: true }, 403)
         return
       }
+      // Reject tool calls that arrive after shutdown has begun. The error text
+      // carries the "draining" token so the proxy treats it as transient,
+      // respawns a fresh daemon, and retries the RPC (including write RPCs).
+      if (getDraining?.()) {
+        sendJson(res, { content: [{ type: 'text', text: 'memory worker draining' }], isError: true }, 503)
+        return
+      }
       // Owner-side cancel plumbing: the fork-proxy worker forwards parent
       // 'cancel' IPC by issuing POST /api/cancel with the same callId. Track
       // each in-flight /api/tool by its caller-supplied X-Mixdog-Call-Id so

package/src/runtime/memory/lib/memory-cycle2-gate.mjs

@@ -11,6 +11,12 @@ import { __mixdogMemoryLog, throwIfAborted, resourceDir } from './memory-cycle2-
 
 export const CYCLE2_ACTIVE_TARGET_CAP = 100
 
+// Minimum number of active (promoted) rows cycle2 must preserve. When the
+// active pool is at or below this floor, active recheck/demotion is skipped
+// and no archiving path may push active below it — prevents draining the
+// pool to zero. Configurable via config.active_floor.
+export const CYCLE2_ACTIVE_MIN_FLOOR = 20
+
 // Status-based verb whitelist. 3-tier policy: pending → active/archived,
 // active → active/archived/update/merge.
 const STATUS_ALLOWED_VERBS = {

package/src/runtime/memory/lib/memory-cycle2-mutations.mjs

@@ -86,11 +86,15 @@ export async function applyBatchStatusVerdicts(db, batch, nowMs) {
   )
   let promoted = 0
   let archived = 0
+  let archived_active = 0
   for (const r of (res.rows ?? [])) {
     if (r.was_pending && r.new_status === 'active') promoted += 1
-    else if (r.new_status === 'archived') archived += 1
+    else if (r.new_status === 'archived') {
+      archived += 1
+      if (!r.was_pending) archived_active += 1
+    }
   }
-  return { promoted, archived }
+  return { promoted, archived, archived_active }
 }
 
 // Generic status update for archived/active terminal transitions.
@@ -186,24 +190,49 @@ export async function applyMerge(db, targetId, sourceIds, options = {}) {
       )
       continue
     }
+    // Floor guard: archiving an active source row shrinks the active pool, so
+    // it must reserve from the shared floor budget. Over-budget merges are
+    // skipped (source stays active); pending sources never reserve.
+    const srcActive = srcRow.status === 'active'
+    if (srcActive && options.floorGuard && !options.floorGuard.reserve()) {
+      __mixdogMemoryLog(`[cycle2] merge source archive skipped (floor guard): target=${targetId} src=${sid}\n`)
+      continue
+    }
+    let archivedPrevStatus = null
     try {
-      // One source merge is the mutation unit: DB reassignment/archive plus
-      // embedding cleanup. The next abort checkpoint is before the next source.
+      // Archive is the guarded mutation unit: the reservation is only kept if
+      // this transaction commits. Embedding cleanup is deliberately OUTSIDE
+      // this try — a post-commit cleanup failure must NOT refund the budget,
+      // since the active row is already archived.
       await db.transaction(async (tx) => {
         await tx.query(
           `UPDATE entries SET chunk_root = $1, project_id = $2 WHERE chunk_root = $3 AND id != $4 AND is_root = 0`,
           [targetId, target.project_id, sid, sid],
         )
-        await tx.query(
-          `UPDATE entries SET status = 'archived' WHERE id = $1 AND is_root = 1`,
+        // Capture prev status in the same statement so a stale snapshot (the
+        // row was already archived by a concurrent write) can refund below.
+        const ar = await tx.query(
+          `WITH pre AS (SELECT id, status AS prev FROM entries WHERE id = $1 AND is_root = 1)
+           UPDATE entries SET status = 'archived'
+           FROM pre WHERE entries.id = pre.id AND entries.is_root = 1
+           RETURNING pre.prev AS prev_status`,
           [sid],
         )
+        archivedPrevStatus = ar.rows?.[0]?.prev_status ?? null
       })
-      await deleteRootEmbedding(db, sid)
-      moved += 1
     } catch (err) {
+      if (srcActive && options.floorGuard) options.floorGuard.refund()
       __mixdogMemoryLog(`[cycle2] merge failed (target=${targetId} src=${sid}): ${err.message}\n`)
+      continue
     }
+    // Archive committed. If the source was no longer active at UPDATE time,
+    // the reservation did not cover a real active→archived transition — refund.
+    if (srcActive && options.floorGuard && archivedPrevStatus !== 'active') options.floorGuard.refund()
+    // Archive committed — best-effort embedding cleanup only. The next abort
+    // checkpoint is before the next source.
+    moved += 1
+    try { await deleteRootEmbedding(db, sid) }
+    catch (err) { __mixdogMemoryLog(`[cycle2] merge embedding cleanup failed (target=${targetId} src=${sid}): ${err.message}\n`) }
   }
   return moved
 }
@@ -245,6 +274,7 @@ async function _llmJudgePair(summaryA, summaryB, siblingContext = [], options =
 
 export async function runPhaseMerge(db, options = {}) {
   const signal = options?.signal
+  const floorGuard = options?.floorGuard
   throwIfAborted(signal)
   // PG-side lateral nearest-neighbor via HNSW index — replaces JS O(n²) double loop.
   const pairRes = await db.query(
@@ -296,7 +326,9 @@ export async function runPhaseMerge(db, options = {}) {
     if (mergedIds.has(a.id) || mergedIds.has(b.id)) return
     const keeper = _pickKeeper(a, b)
     const loser = keeper.id === a.id ? b : a
-    const moved = await applyMerge(db, keeper.id, [loser.id], { signal })
+    // phase_merge only pairs active rows, so the loser archive is an active
+    // demotion — thread the floor budget through applyMerge.
+    const moved = await applyMerge(db, keeper.id, [loser.id], { signal, floorGuard })
     if (moved > 0) {
       merged += moved
       mergedIds.add(loser.id)
@@ -372,6 +404,9 @@ export async function runPhaseMerge(db, options = {}) {
     )
     throwIfAborted(signal)
     if (!verdictMerge) continue
+    // Core-overlap archive is an active demotion — reserve floor budget and
+    // refund if the guarded UPDATE turns out not to fire.
+    if (floorGuard && !floorGuard.reserve()) continue
     // Archiving one overlap and deleting its embedding is one mutation unit;
     // cancellation resumes at the next row boundary.
     const r = await db.query(
@@ -387,6 +422,8 @@ export async function runPhaseMerge(db, options = {}) {
     if (Number(r.rowCount ?? r.affectedRows ?? 0) > 0) {
       coreOverlap++
       await deleteRootEmbedding(db, Number(row.entry_id))
+    } else if (floorGuard) {
+      floorGuard.refund()
     }
   }
   throwIfAborted(signal)

package/src/runtime/memory/lib/memory-cycle2.mjs

@@ -6,6 +6,7 @@
 //   memory-cycle2-mutations.mjs  — status/update/merge writers + runPhaseMerge
 //   memory-cycle2-gate.mjs       — prompt/parse/validate + runUnifiedGate + cascade
 import { flushEmbeddingDirty } from './memory-embed.mjs'
+import { refreshHotActive } from './memory.mjs'
 import { backfillCoreEmbeddings, nominateCoreCandidates, CORE_SUMMARY_MAX } from './core-memory-store.mjs'
 import { markCycleRequest, consumeCycleRequests, resolveCoalesceMaxDrains, scheduleCoalescedCycleRetry, makeCycleRequestSignature, resolveCoalesceMaxRetries } from './memory-cycle-requests.mjs'
 import { __mixdogMemoryLog, throwIfAborted } from './memory-cycle2-shared.mjs'
@@ -13,7 +14,7 @@ import {
   applyBatchStatusVerdicts, clampPendingPromotions, applySimpleStatus, applyUpdate, applyMerge, runPhaseMerge,
 } from './memory-cycle2-mutations.mjs'
 import {
-  CYCLE2_ACTIVE_TARGET_CAP, loadCurrentRulesDigest, runUnifiedGate, sonnetCascade,
+  CYCLE2_ACTIVE_TARGET_CAP, CYCLE2_ACTIVE_MIN_FLOOR, loadCurrentRulesDigest, runUnifiedGate, sonnetCascade,
   NON_ARCHIVE_VERBS, requiredCoreIdForAction,
 } from './memory-cycle2-gate.mjs'
 
@@ -48,6 +49,7 @@ function mergeCycle2Results(a, b) {
     archived: Number(a.archived || 0) + Number(b.archived || 0),
     merged: Number(a.merged || 0) + Number(b.merged || 0),
     updated: Number(a.updated || 0) + Number(b.updated || 0),
+    floor_protected: Number(a.floor_protected || 0) + Number(b.floor_protected || 0),
     kept: Number(a.kept || 0) + Number(b.kept || 0),
     rejected_verb: Number(a.rejected_verb || 0) + Number(b.rejected_verb || 0),
     merge_rejected: Number(a.merge_rejected || 0) + Number(b.merge_rejected || 0),
@@ -199,6 +201,9 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   const activeTargetCap = Number.isFinite(Number(config.active_target_cap))
     ? Math.max(1, Number(config.active_target_cap))
     : CYCLE2_ACTIVE_TARGET_CAP
+  const activeFloor = Number.isFinite(Number(config.active_floor))
+    ? Math.max(0, Number(config.active_floor))
+    : CYCLE2_ACTIVE_MIN_FLOOR
   const nowMs = Date.now()
 
   const stats = {
@@ -211,6 +216,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     rescore: { updated: 0 },
     phase_merge: { merged: 0, llm_calls: 0, tier1_pairs: 0, tier2_pairs: 0, core_overlap: 0 },
     cascade: { evaluated: 0, dropped: 0 },
+    floor_protected: 0,
   }
 
   if (dataDir) {
@@ -231,6 +237,20 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   const activeCount = Number(activeCountRes.rows[0]?.c ?? 0)
   const reviewActiveRows = activeCount > activeTargetCap
 
+  // Shared floor-demotion budget: the number of active rows that may be
+  // archived this cycle before the active pool would breach the minimum
+  // floor. EVERY archiving path that removes an active row must reserve()
+  // from this single budget (status demotions, cascade drops, applyMerge
+  // sources, and phase_merge) so no path can drain active below the floor.
+  // Reservations are refunded when the underlying write turns out not to
+  // demote (optimistic-guard miss / merge failure).
+  const floorGuard = {
+    remaining: Math.max(0, activeCount - activeFloor),
+    protected: 0,
+    reserve() { if (this.remaining <= 0) { this.protected += 1; return false } this.remaining -= 1; return true },
+    refund(n = 1) { this.remaining += Math.max(0, n) },
+  }
+
   // Rolling active re-review quota. Under cap, the unified selection below
   // pulls only pending rows, so an already-promoted entry that later drifts
   // stale or turns out to restate a rule file never gets re-judged — the
@@ -244,7 +264,9 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   // restatements. Embedding dedup is skipped on purpose: rule restatements
   // are often cross-language paraphrases whose cosine never clears the merge
   // threshold, but the LLM gate catches the semantic overlap.
-  const activeRecheckQuota = reviewActiveRows
+  // Floor guard: when the active pool is at/below the minimum floor, skip the
+  // rolling active recheck entirely so demotions cannot drain it further.
+  const activeRecheckQuota = (reviewActiveRows || activeCount <= activeFloor)
     ? 0
     : Math.max(0, Math.min(Number(config.active_recheck_quota ?? 8), batchSize - 1))
   const pendingLimit = batchSize - activeRecheckQuota
@@ -460,7 +482,7 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
             )
             continue
           }
-          const moved = await applyMerge(db, targetId, sourceIds, { signal })
+          const moved = await applyMerge(db, targetId, sourceIds, { signal, floorGuard })
           throwIfAborted(signal)
           if (moved > 0) {
             stats.merged += moved
@@ -489,23 +511,62 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
       // Status verdicts are applied as one SQL batch; checkpoint before the
       // batch and then again at the next cycle2 unit boundary.
       throwIfAborted(signal)
-      let activeDemotionsInBatch = 0
+      // Reserve floor budget for each active→archived demotion; over-budget
+      // demotions are dropped (the row stays active, still reviewed_at-bumped
+      // via reviewedIds). Pending→archived never reserves (was never active).
+      const guardedBatch = []
+      let reservedDemotions = 0
       for (const item of statusBatch) {
-        if (item.new_status === 'archived' && !item.was_pending) activeDemotionsInBatch += 1
+        if (item.new_status === 'archived' && !item.was_pending) {
+          if (!floorGuard.reserve()) continue
+          reservedDemotions += 1
+        }
+        guardedBatch.push(item)
       }
-      const activeCountForClamp = Math.max(0, activeCount - activeDemotionsInBatch)
-      const clampRes = clampPendingPromotions(statusBatch, rowsById, activeCountForClamp, activeTargetCap)
+      const activeCountForClamp = Math.max(0, activeCount - reservedDemotions)
+      const clampRes = clampPendingPromotions(guardedBatch, rowsById, activeCountForClamp, activeTargetCap)
       stats.promotion_clamped = clampRes.clamped
       const batchRes = await applyBatchStatusVerdicts(db, clampRes.batch, nowMs)
       stats.promoted += batchRes.promoted
       stats.archived += batchRes.archived
+      // Spend on CONFIRMED demotions only: refund reservations the optimistic
+      // guard skipped (concurrent write moved the row).
+      const confirmedActive = Number(batchRes.archived_active || 0)
+      if (reservedDemotions > confirmedActive) floorGuard.refund(reservedDemotions - confirmedActive)
     }
 
     if (cascadeDropArchiveIds.length > 0) {
       throwIfAborted(signal)
-      const r = await db.query(`UPDATE entries SET status = 'archived' WHERE id = ANY($1::bigint[]) AND is_root = 1`, [cascadeDropArchiveIds])
-      stats.cascade.dropped += Number(r.rowCount ?? r.affectedRows ?? 0)
-      stats.archived += Number(r.rowCount ?? r.affectedRows ?? 0)
+      // Floor guard: a cascade drop of an active row reduces the pool, so
+      // reserve budget; pending rows dropped here never were active. The
+      // snapshot status can be stale (statusBatch above / concurrent writes),
+      // so reserve optimistically then refund against the ACTUAL number of
+      // active→archived transitions the UPDATE performed (prev_status read in
+      // the same statement).
+      let reservedActive = 0
+      const toDrop = []
+      for (const id of cascadeDropArchiveIds) {
+        const row = rowsById.get(Number(id))
+        if (row && row.status === 'active') {
+          if (!floorGuard.reserve()) continue
+          reservedActive += 1
+        }
+        toDrop.push(id)
+      }
+      if (toDrop.length > 0) {
+        const r = await db.query(`
+          WITH pre AS (SELECT id, status AS prev FROM entries WHERE id = ANY($1::bigint[]) AND is_root = 1)
+          UPDATE entries SET status = 'archived'
+          FROM pre
+          WHERE entries.id = pre.id AND entries.is_root = 1
+          RETURNING entries.id, pre.prev AS prev_status
+        `, [toDrop])
+        const dropped = r.rows ?? []
+        stats.cascade.dropped += dropped.length
+        stats.archived += dropped.length
+        const actualArchivedActive = dropped.filter(x => x.prev_status === 'active').length
+        if (reservedActive > actualArchivedActive) floorGuard.refund(reservedActive - actualArchivedActive)
+      }
     }
     if (reviewedIds.length > 0) {
       throwIfAborted(signal)
@@ -570,9 +631,12 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
   }
 
   // phase_merge: cosine dedup over active entries.
-  const phaseMergeStats = await runPhaseMerge(db, { ...options, signal })
+  const phaseMergeStats = await runPhaseMerge(db, { ...options, signal, floorGuard })
   throwIfAborted(signal)
   stats.phase_merge = phaseMergeStats
+  // Surface how many active-row demotions were withheld to hold the floor
+  // across every archiving path this cycle (status/cascade/merge/phase_merge).
+  stats.floor_protected = floorGuard.protected
 
   // Core-candidate nomination (proposal mode): flag strong durable active
   // roots as core-memory candidates for user approval. Runs AFTER phase_merge
@@ -621,6 +685,18 @@ async function _runCycle2Impl(db, config = {}, options = {}, dataDir = null) {
     __mixdogMemoryLog(`[cycle2] chronic sweep failed: ${err.message}\n`)
   }
 
+  // Refresh the hot-active materialized view now that every promotion/archival/
+  // dedup mutation for this cycle has landed, so the recall hot path reads a
+  // current active set. refreshHotActive is itself best-effort (logs + swallows);
+  // the guard here also keeps a refresh failure from failing the cycle.
+  try {
+    throwIfAborted(signal)
+    await refreshHotActive(db)
+  } catch (err) {
+    if (signal?.aborted) throw signal.reason ?? err
+    __mixdogMemoryLog(`[cycle2] mv_hot_active refresh failed: ${err.message}\n`)
+  }
+
   __mixdogMemoryLog(
     `[cycle2] rescore=${stats.rescore.updated}` +
     ` core_backfill=${stats.core_embedding_backfill}` +

package/src/runtime/memory/lib/memory.mjs

@@ -296,6 +296,45 @@ async function ensureHotActiveSearchObjects(db) {
   await db.exec(`CREATE INDEX IF NOT EXISTS mv_hot_active_score ON mv_hot_active(score DESC)`)
 }
 
+// Refresh mv_hot_active. Owned by cycle2 — call after promotion/archival/dedup
+// mutations land so the recall hot path reads the current active set. The MV is
+// created WITH NO DATA (memory.mjs:243), and an unpopulated MV CANNOT be
+// refreshed CONCURRENTLY, so the first refresh is non-concurrent; once populated
+// we refresh CONCURRENTLY (the mv_hot_active_id UNIQUE index — created at
+// :251/:293 — makes this legal) to avoid an AccessExclusive lock on the recall
+// read path. Best-effort: every failure is logged and swallowed so a refresh
+// error never crashes the cycle. Returns true when the view was refreshed.
+export async function refreshHotActive(db) {
+  try {
+    const r = await db.query(
+      `SELECT relispopulated FROM pg_class WHERE relname = 'mv_hot_active' LIMIT 1`,
+    )
+    if (!r.rows.length) {
+      __mixdogMemoryLog('[memory] refreshHotActive: mv_hot_active not found; skipping\n')
+      return false
+    }
+    if (Boolean(r.rows[0].relispopulated)) {
+      try {
+        await db.exec(`REFRESH MATERIALIZED VIEW CONCURRENTLY mv_hot_active`)
+        return true
+      } catch (err) {
+        // CONCURRENTLY needs a populated MV + unique index; if either is not
+        // true (e.g. MV was reset since the catalog read), fall back to a plain
+        // refresh so the view still ends up fresh (brief AccessExclusive lock).
+        __mixdogMemoryLog(`[memory] refreshHotActive CONCURRENTLY failed, retrying non-concurrent: ${err?.message || err}\n`)
+        await db.exec(`REFRESH MATERIALIZED VIEW mv_hot_active`)
+        return true
+      }
+    }
+    // First refresh of a WITH-NO-DATA view — must be non-concurrent.
+    await db.exec(`REFRESH MATERIALIZED VIEW mv_hot_active`)
+    return true
+  } catch (err) {
+    __mixdogMemoryLog(`[memory] refreshHotActive failed: ${err?.message || err}\n`)
+    return false
+  }
+}
+
 async function resetEmbeddingColumnsForDims(db, dimCount) {
   const entriesDims = await getEmbeddingColumnDims(db, 'entries')
   const coreDims = await getEmbeddingColumnDims(db, 'core_entries')