mixdog 0.9.87 → 0.9.89

package/src/runtime/media/store.test.mjs

@@ -52,12 +52,42 @@ test('media assets are organized by kind, provider, model, and local date while
 
   try {
     const store = await import(`./store.mjs?test=${Date.now()}`);
-    const listed = store.listMediaAssets({ limit: 10 }).assets;
+    const beforeMigration = store.listMediaAssets({ limit: 10 }).assets;
+    assert.equal(beforeMigration[0].file, 'legacy-image.jpg',
+      'read-only listing must not run the write-side layout migration');
+    const saved = store.saveMediaAsset({
+      kind: 'video',
+      lane: 'gemini',
+      model: 'veo:3/preview',
+      prompt: 'new clip',
+      options: { aspectRatio: '16:9' },
+      mime: 'video/mp4',
+      bytes: Buffer.from('new-video'),
+    });
+    const migrated = store.listMediaAssets({ limit: 10 }).assets;
+    const listed = ['legacy-image', 'legacy-video'].map((id) =>
+      migrated.find((entry) => entry.id === id));
     assert.equal(listed[0].file, 'images/gemini/image-alpha/2026-07-05/legacy-image.jpg');
     assert.equal(listed[1].file, 'videos/grok/video-beta/2026-07-05/legacy-video.mp4');
     assert.equal(existsSync(join(assetsDir, ...listed[0].file.split('/'))), true);
     assert.equal(existsSync(join(assetsDir, ...listed[1].file.split('/'))), true);
     assert.equal(existsSync(join(assetsDir, 'legacy-image.jpg')), false);
+    const cacheBeforeReads = store.mediaStoreCacheStats();
+    await Promise.all([
+      store.resolveMediaFile('legacy-image'),
+      store.resolveMediaFile('legacy-video'),
+      store.resolveMediaFile('legacy-image'),
+    ]);
+    const cacheAfterReads = store.mediaStoreCacheStats();
+    assert.equal(cacheAfterReads.indexDiskReads, cacheBeforeReads.indexDiskReads,
+      'a thumbnail-resolution burst must reuse the parsed media index');
+    assert.ok(cacheAfterReads.indexCacheHits >= cacheBeforeReads.indexCacheHits + 3);
+    const cachedOnlyMiss = await store.resolveMediaFile('legacy-image', {
+      variant: 'thumb',
+      generate: false,
+    });
+    assert.equal(cachedOnlyMiss.available, false,
+      'a local protocol probe must not start native rendition generation on a cache miss');
     assert.equal(
       (await store.readMediaAsset('legacy-video')).base64,
       Buffer.from('video').toString('base64'),
@@ -66,7 +96,10 @@ test('media assets are organized by kind, provider, model, and local date while
     // A tile-sized rendition is impossible for these stub bytes (and video
     // needs ffmpeg): the read must REPORT the miss instead of quietly
     // shipping the original, which is what made the remote gallery slow.
-    const missing = await store.readMediaAsset('legacy-image', { variant: 'thumb' });
+    const missing = await store.readMediaAsset('legacy-image', {
+      variant: 'thumb',
+      generate: false,
+    });
     assert.equal(missing.available, false);
     assert.equal(missing.base64, '');
     // Callers that can afford full-size bytes (local IPC) opt in explicitly
@@ -74,20 +107,29 @@ test('media assets are organized by kind, provider, model, and local date while
     const downgraded = await store.readMediaAsset('legacy-image', {
       variant: 'thumb',
       allowOriginal: true,
+      generate: false,
     });
     assert.equal(downgraded.variant, 'original');
     assert.equal(downgraded.downgraded, true);
     assert.equal(downgraded.base64, Buffer.from('image').toString('base64'));
-
-    const saved = store.saveMediaAsset({
-      kind: 'video',
-      lane: 'gemini',
-      model: 'veo:3/preview',
-      prompt: 'new clip',
-      options: { aspectRatio: '16:9' },
-      mime: 'video/mp4',
-      bytes: Buffer.from('new-video'),
+    const browserThumb = Buffer.from('browser-generated-thumbnail');
+    const cached = store.cacheMediaThumbnail('legacy-video', {
+      mime: 'image/jpeg',
+      base64: browserThumb.toString('base64'),
+      durationSeconds: 7,
     });
+    assert.equal(cached.available, true);
+    const cachedTarget = await store.resolveMediaFile('legacy-video', {
+      variant: 'thumb',
+      generate: false,
+    });
+    assert.equal(cachedTarget.available, true,
+      'a cache-only local protocol probe must serve a browser-generated rendition');
+    const cachedRead = await store.readMediaAsset('legacy-video', { variant: 'thumb' });
+    assert.equal(cachedRead.mime, 'image/jpeg');
+    assert.equal(cachedRead.base64, browserThumb.toString('base64'));
+    assert.equal(cachedRead.durationSeconds, 7);
+
     assert.match(saved.file, /^videos\/gemini\/veo-3-preview\/\d{4}-\d{2}-\d{2}\/[0-9a-f-]+\.mp4$/);
     assert.equal(existsSync(join(assetsDir, ...saved.file.split('/'))), true);
     assert.equal(store.deleteMediaAsset(saved.id).removed, true);

package/src/runtime/memory/index.mjs

@@ -4,6 +4,15 @@ import { __mixdogMemoryLog } from './lib/memory-log.mjs';
 process.removeAllListeners('warning')
 process.on('warning', () => {})
 
+// V8 compile cache: the memory runtime is its own long-lived child process
+// (spawned by the channel daemon / standalone proxy) and never passes through
+// cli.mjs, so it pays full ESM parse cost on every boot without this. Same
+// best-effort guard as cli.mjs.
+try {
+  const { enableCompileCache } = await import('node:module')
+  enableCompileCache?.()
+} catch { /* launch-speed optimization only */ }
+
 import http from 'node:http'
 import os from 'node:os'
 import { performance } from 'node:perf_hooks'
@@ -55,21 +64,21 @@ import {
   sessionMessageContentForIngest,
   shouldExcludeIngestMessage,
 } from './lib/session-ingest.mjs'
-import { configureEmbedding, embedText, embedTexts, getEmbeddingDims, getEmbeddingDtype, getEmbeddingModelId, getKnownDimsForCurrentModel, isEmbeddingModelReady, primeEmbeddingDims, warmupEmbeddingProvider } from './lib/embedding-provider.mjs'
+import { configureEmbedding, embedText, embedTexts, getEmbeddingDims, getEmbeddingDtype, getEmbeddingModelId, getKnownDimsForCurrentModel, isEmbeddingModelReady, primeEmbeddingDims, shutdownEmbeddingProvider, warmupEmbeddingProvider } from './lib/embedding-provider.mjs'
 import { startLlmWorker, stopLlmWorker } from './lib/llm-worker-host.mjs'
 import { runCycle1, runCycle2, runCycle3, runUnifiedGate, parseInterval, syncRootEmbedding, flushRawEmbeddings, applySimpleStatus, applyUpdate, applyMerge, CYCLE2_ACTIVE_TARGET_CAP } from './lib/memory-cycle.mjs'
 import { loadConfig as loadAgentConfig } from '../agent/orchestrator/config.mjs'
 import { initProviders } from '../agent/orchestrator/providers/registry.mjs'
 import { makeAgentDispatch } from '../agent/orchestrator/agent-runtime/agent-dispatch.mjs'
 import { getInFlightCycle1 } from './lib/memory-cycle1.mjs'
-import { claimAndMarkScheduledCycle, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
+import { claimAndMarkScheduledCycle, markCycleRequest, resolveCoalesceMaxRetries, scheduleCoalescedCycleRetry } from './lib/memory-cycle-requests.mjs'
 import { searchRelevantHybrid } from './lib/memory-recall-store.mjs'
 import { fetchEntriesByIdsScoped } from './lib/memory-recall-id-patch.mjs'
 import { retrieveEntries } from './lib/memory-retrievers.mjs'
 import { pruneOldEntries } from './lib/memory-maintenance-store.mjs'
 import { computeEntryScore } from './lib/memory-score.mjs'
 import { runFullBackfill } from './lib/memory-ops-policy.mjs'
-import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandidates, promoteCoreCandidate, dismissCoreCandidate, CORE_SUMMARY_MAX } from './lib/core-memory-store.mjs'
+import { listCore, addCore, editCore, deleteCore, compactCoreIds, listCoreCandidates, promoteCoreCandidate, dismissCoreCandidate } from './lib/core-memory-store.mjs'
 import { resolveProjectId, resolveProjectScope } from './lib/project-id-resolver.mjs'
 import { openTraceDatabase, closeTraceDatabase, insertTraceEvents, enqueueTraceEvents, insertAgentCalls, registerTraceExitDrain } from './lib/trace-store.mjs'
 import { updateJsonAtomicSync, writeJsonAtomicSync } from '../shared/atomic-file.mjs'
@@ -79,8 +88,7 @@ import { parsePeriod, formatTs, coreRecallTerms, normalizeRecallProjectScope, se
 import { readBody, sendJson, sendError, isLocalOrigin, normalizeCoreProjectId } from './lib/http-wire.mjs'
 import { scheduledCycle1Signature, scheduledCycle2Signature, scheduledCycle3Signature } from './lib/cycle-signatures.mjs'
 import { createTranscriptIngest } from './lib/transcript-ingest.mjs'
-import { createEmbeddingWarmup } from './lib/embedding-warmup.mjs'
-import { init as initKoMorph } from './lib/ko-morph.mjs'
+import { init as initKoMorph, reset as resetKoMorph } from './lib/ko-morph.mjs'
 import { createCycleLlmAdapters } from './lib/cycle-llm-adapters.mjs'
 import { createCycleScheduler } from './lib/cycle-scheduler.mjs'
 import { createQueryHandlers } from './lib/query-handlers.mjs'
@@ -260,15 +268,6 @@ const _sessionIngest = createSessionIngestRuntime({
 })
 const { ingestSessionMessages } = _sessionIngest
 
-// Boot-edge embedding warmup queue (extracted to lib/embedding-warmup.mjs).
-const _embeddingWarmup = createEmbeddingWarmup({
-  canStart: embeddingWarmupCanStart,
-  warmup: warmupEmbeddingProvider,
-  getDims: getEmbeddingDims,
-  persistMeta: (metaPath, value) => writeJsonAtomicSync(metaPath, value, { lock: true }),
-  log: __mixdogMemoryLog,
-})
-
 // DATA_DIR-bound wrappers over the extracted pure flag helpers (see
 // ./lib/memory-config-flags.mjs). The pg-attach check needs DATA_DIR, which is
 // module-local here.
@@ -324,20 +323,9 @@ async function _initStore() {
   if (dimsResolved) {
     primeEmbeddingDims(dimsResolved)
     assertSecondaryPgAttachable()
-    // Start embedding + kiwi warmup NOW so they run on their worker threads
-    // during the PG ensure I/O-wait window below: openDatabase spawns/awaits
-    // Postgres (I/O-bound, not CPU), so overlapping warmup there is safe and
-    // lands a cold boot's first recall dense instead of lexical-fallback.
-    // Both are fire-and-forget; the boot-complete fireDeferred/initKoMorph edge
-    // stays an idempotent no-op fallback. schedule() respects canStart
-    // (secondary/env-disabled skip → fireDeferred no-op); kiwi skips secondary.
-    _embeddingWarmup.schedule(EMBEDDING_META_PATH, metaKey)
-    memoryProfile('embedding:warmup:fire')
-    _embeddingWarmup.fireDeferred()
-    if (!memorySecondaryMode()) {
-      memoryProfile('ko-morph:warmup:fire')
-      initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
-    }
+    // Known dimensions are enough to open the vector schema. Keep the ONNX
+    // model and the ~560 MB Kiwi analyzer completely off the boot path; the
+    // first relevant query starts them on demand without blocking startup.
     const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
     memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
@@ -352,12 +340,6 @@ async function _initStore() {
     memoryProfile('embedding:cold-warmup:done', { ms: (performance.now() - warmupStartedAt).toFixed(1) })
     dimsResolved = Number(getEmbeddingDims())
     assertSecondaryPgAttachable()
-    // Embedding is already warm (awaited above); still fire kiwi during the PG
-    // ensure I/O-wait so the first recall's FTS path is morph-aware too.
-    if (!memorySecondaryMode()) {
-      memoryProfile('ko-morph:warmup:fire')
-      initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
-    }
     const openStartedAt = performance.now()
     db = await openDatabase(DATA_DIR, dimsResolved)
     memoryProfile('open-db:done', { ms: (performance.now() - openStartedAt).toFixed(1), dims: dimsResolved })
@@ -478,6 +460,7 @@ const _cycleScheduler = createCycleScheduler({
   flushRawEmbeddings,
   getInFlightCycle1,
   claimAndMarkScheduledCycle,
+  markCycleRequest,
   resolveCoalesceMaxRetries,
   scheduleCoalescedCycleRetry,
   scheduledCycle1Signature,
@@ -535,20 +518,6 @@ async function _initRuntime() {
     __mixdogMemoryLog('[memory-service] background cycle tick loop not started (secondary/env-disabled)\n')
   }
   _initialized = true
-  // Boot complete — continue straight into the deferred embedding warmup.
-  // Fire-and-forget on the embedding worker thread; never awaited so it does
-  // not delay init() returning or the memory-ready signal.
-  memoryProfile('embedding:warmup:fire')
-  _embeddingWarmup.fireDeferred()
-  // Boot-edge Korean morph warmup. Same fire-and-forget style: lazy async init
-  // downloads+caches the Kiwi model once under DATA_DIR/kiwi-model/<version>,
-  // then builds the WASM analyzer. On any failure ko-morph stays null and
-  // buildFtsQuery keeps the websearch_to_tsquery fallback (never throws here).
-  // Skipped in secondary mode (query path lives on the primary).
-  if (!memorySecondaryMode()) {
-    memoryProfile('ko-morph:warmup:fire')
-    initKoMorph(DATA_DIR, __mixdogMemoryLog).catch(() => {})
-  }
   memoryProfile('runtime-init:done', { ms: (performance.now() - runtimeStartedAt).toFixed(1) })
 }
 
@@ -569,6 +538,9 @@ const __queryHandlers = createQueryHandlers({
   log: __mixdogMemoryLog,
   resolveProjectScope,
   embeddingWarmupCanStart,
+  ensureKoMorph: () => memorySecondaryMode()
+    ? Promise.resolve(false)
+    : initKoMorph(DATA_DIR, __mixdogMemoryLog),
   getBootTimestamp: () => _bootTimestamp,
   getTraceDb: () => _traceDb,
 })
@@ -598,6 +570,7 @@ const _actionHandlers = createMemoryActionHandlers({
   startCycle1Run: _startCycle1Run,
   finalizeCycle2Run: _finalizeCycle2Run,
   finalizeCycle3Run: _finalizeCycle3Run,
+  requestCycle3Review: _cycleScheduler.requestCycle3Review,
   getSchedulerCycle1InFlight: () => _cycleScheduler.getCycle1InFlight(),
   getCycle2CallLlm,
   getCycle3CallLlm,
@@ -703,9 +676,12 @@ export async function stop() {
   _stopPromise = (async () => {
     _stopCycles()
     _memoryPortAdvertiser.reset()
-    _embeddingWarmup.reset()
     _daemonLifecycle.reset()
-    await stopLlmWorker()
+    await Promise.allSettled([
+      stopLlmWorker(),
+      shutdownEmbeddingProvider(),
+    ])
+    resetKoMorph()
     resetHttpListenErrorHandler()
     if (_httpBoundPort != null || _httpReadyPromise) {
       await new Promise(resolve => {

package/src/runtime/memory/lib/core-memory-candidates.mjs

@@ -4,7 +4,7 @@ import { cachedEmbedTextBatch } from './memory-embed.mjs'
 import { callAgentDispatch } from './agent-ipc.mjs'
 import { resolveMaintenancePreset } from '../../shared/llm/index.mjs'
 import { checkedConnect } from './pg/adapter.mjs'
-import { __mixdogMemoryLog, CORE_DEDUP_TOP_K, CORE_SUMMARY_MAX, _getDb, throwIfAborted, addCore } from './core-memory-store.mjs';
+import { __mixdogMemoryLog, CORE_DEDUP_TOP_K, _getDb, throwIfAborted, addCore } from './core-memory-store.mjs';
 
 //
 // nominateCoreCandidates flags strong active entries as core-memory
@@ -225,12 +225,7 @@ export async function promoteCoreCandidate(dataDir, id, options = {}) {
   if (rowPid != null && rowPid !== scope) {
     throw new Error(`candidate id=${numId} belongs to project "${rowPid}", not the resolved scope "${scope ?? 'common'}"`)
   }
-  // Core summary cap: candidate summaries may exceed CORE_SUMMARY_MAX. Prefer
-  // the explicit override, else compress by truncation so addCore accepts it.
   const summary = options?.summary ?? cur.summary
-  const cappedSummary = summary && String(summary).length > CORE_SUMMARY_MAX
-    ? String(summary).slice(0, CORE_SUMMARY_MAX)
-    : summary
   const now = Date.now()
   // Phase 1 — claim (active+candidate guarded so a concurrent archive/promote
   // loses the race → 0 rows → nothing to promote). Embedding NOT nulled here
@@ -251,7 +246,7 @@ export async function promoteCoreCandidate(dataDir, id, options = {}) {
   try {
     entry = await addCore(
       dataDir,
-      { element: cur.element, summary: cappedSummary, category: cur.category },
+      { element: cur.element, summary, category: cur.category },
       rowPid,
     )
   } catch (err) {

package/src/runtime/memory/lib/core-memory-store.mjs

@@ -27,8 +27,7 @@ const VALID_CAT = new Set([
 const SIM_RECALL = 0.65
 export const CORE_DEDUP_TOP_K = 5
 
-export const CORE_SUMMARY_MAX = 100
-const CORE_ELEMENT_MAX = 40
+const CORE_ELEMENT_DERIVE_LENGTH = 40
 
 function trimOrNull(v) {
   if (v == null) return null
@@ -38,7 +37,7 @@ function trimOrNull(v) {
 
 export function normalizeCoreInput(input = {}, options = {}) {
   const summary = trimOrNull(input.summary ?? input.content)
-  const element = trimOrNull(input.element) ?? (summary ? summary.slice(0, CORE_ELEMENT_MAX) : null)
+  const element = trimOrNull(input.element) ?? (summary ? summary.slice(0, CORE_ELEMENT_DERIVE_LENGTH) : null)
   const suppliedCategory = trimOrNull(input.category)
   const category = (suppliedCategory ?? 'fact').toLowerCase()
   const errors = []
@@ -46,12 +45,6 @@ export function normalizeCoreInput(input = {}, options = {}) {
   if (options.requireElement && !element) errors.push('element required')
   if (options.requireSummary && !summary) errors.push('summary required')
   if (options.requireCategory && !suppliedCategory) errors.push('category required')
-  if (element && element.length > CORE_ELEMENT_MAX) {
-    errors.push(`element too long (${element.length}/${CORE_ELEMENT_MAX} chars, remove ${element.length - CORE_ELEMENT_MAX})`)
-  }
-  if (summary && summary.length > CORE_SUMMARY_MAX) {
-    errors.push(`summary too long (${summary.length}/${CORE_SUMMARY_MAX} chars, remove ${summary.length - CORE_SUMMARY_MAX})`)
-  }
   if (suppliedCategory && !VALID_CAT.has(category)) {
     errors.push(`invalid category "${category}". Valid: ${[...VALID_CAT].join(', ')}`)
   }

package/src/runtime/memory/lib/cycle-scheduler.mjs

@@ -62,6 +62,7 @@ export function createCycleScheduler(deps) {
     flushRawEmbeddings,
     getInFlightCycle1,
     claimAndMarkScheduledCycle,
+    markCycleRequest,
     resolveCoalesceMaxRetries,
     scheduleCoalescedCycleRetry,
     scheduledCycle1Signature,
@@ -362,6 +363,14 @@ export function createCycleScheduler(deps) {
     }, retryConfig, signature)
   }
 
+  async function requestCycle3Review(reason = 'core-mutation') {
+    const config = getConfig() || readMainConfig() || {}
+    const signature = scheduledCycle3Signature(config)
+    const marked = await markCycleRequest(getDb(), 'cycle3', reason, signature)
+    if (marked) scheduleScheduledCycle3(config, signature)
+    return marked
+  }
+
   async function _finalizeCycle2Run(result) {
     if (result?.skippedInFlight) {
       log('[cycle2] skipped: in flight\n')
@@ -558,6 +567,7 @@ export function createCycleScheduler(deps) {
       await setCycleLastRun('cycle3', Date.now())
       markCycleDone('cycle3', true)
     },
+    requestCycle3Review,
     periodicCycle1Config,
     // lifecycle
     startCycles,

package/src/runtime/memory/lib/embedding-provider.mjs

@@ -82,11 +82,11 @@ function ensureWorker() {
       return
     }
     if (msg.type === 'idle-dispose') {
-      cachedDims = null
       _modelReady = false
       _device = 'cpu'
-      __mixdogMemoryLog('[embed] idle timeout — model disposed\n')
-      writeProfilePoint({ phase: 'post-idle', model: MODEL_ID, device: msg.device, dtype: msg.dtype, note: 'idle dispose' })
+      const reason = String(msg.reason || 'idle timeout')
+      __mixdogMemoryLog(`[embed] ${reason} — model disposed\n`)
+      writeProfilePoint({ phase: 'post-idle', model: MODEL_ID, device: msg.device, dtype: msg.dtype, note: reason })
       return
     }
     const pending = _pending.get(msg.id)

package/src/runtime/memory/lib/embedding-worker.mjs

@@ -57,14 +57,15 @@ const execFileAsync = promisify(execFile)
 const _envLoadCores = Number(process.env.MIXDOG_EMBED_LOAD_CORES)
 const LOAD_AFFINITY_CORES = Number.isInteger(_envLoadCores) && _envLoadCores >= 1 ? _envLoadCores : 1
 const MODEL_CACHE_DIR = join(resolvePluginData(), 'memory-models')
-// Idle dispose was previously 15 min. Production profiling showed the model
-// re-load cost (~3 s DirectML cold start) repeating ~880×/4 h because cycle1
-// gaps exceed 15 min in normal use. Default to keep-alive (0) so the model
-// stays resident for the lifetime of the worker. Set MIXDOG_EMBED_IDLE_TIMEOUT_MS
-// to a positive value (in ms) to restore the prior dispose behaviour when GPU
-// VRAM pressure is a concern.
+// Reclaim the model after a short idle window. The worker remains available,
+// so the next recall reloads on demand without keeping hundreds of MB resident
+// throughout an otherwise idle desktop session. Set 0 to opt into keep-alive.
 const _envIdleMs = Number(process.env.MIXDOG_EMBED_IDLE_TIMEOUT_MS)
-const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0 ? _envIdleMs : 0
+const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0 ? _envIdleMs : 3 * 60_000
+const _envPressureMb = Number(process.env.MIXDOG_EMBED_PRESSURE_MIN_FREE_MB)
+const PRESSURE_MIN_FREE_BYTES = (
+  Number.isFinite(_envPressureMb) && _envPressureMb >= 0 ? _envPressureMb : 1536
+) * 1024 * 1024
 
 // Defensive belt against giant model inputs. Callers should already bound text
 // (see memory-embed truncateForEmbed), but the worker is the last line before
@@ -98,6 +99,15 @@ const CONTROL_ACTIONS = new Set(['configure', 'dispose', 'warmup'])
 // under sustained interactive traffic. MIXDOG_EMBED_PRIORITY_SKIP_CAP overrides.
 const _envSkipCap = Number(process.env.MIXDOG_EMBED_PRIORITY_SKIP_CAP)
 const PRIORITY_SKIP_CAP = Number.isFinite(_envSkipCap) && _envSkipCap >= 1 ? Math.floor(_envSkipCap) : 8
+// Bounded backlog: the queue previously grew without limit while a slow embed
+// held the in-flight guard — a flush storm could park thousands of messages
+// (each carrying full text payloads) in worker memory until the caller's 60s
+// timeout killed the whole worker. Reject new INFERENCE work beyond the cap
+// with an immediate error reply instead; control ops (configure/dispose/
+// warmup) always queue so lifecycle invariants can never be dropped.
+// MIXDOG_EMBED_QUEUE_MAX overrides (default 128).
+const _envQueueMax = Number(process.env.MIXDOG_EMBED_QUEUE_MAX)
+const QUEUE_MAX = Number.isFinite(_envQueueMax) && _envQueueMax >= 1 ? Math.floor(_envQueueMax) : 128
 // Queue with a single priority lane. Interactive query embeds (msg.priority)
 // jump ahead of background flush embed-batch work so an in-progress large
 // flush cannot starve a live recall's query vector. Constraints:
@@ -106,6 +116,16 @@ const PRIORITY_SKIP_CAP = Number.isFinite(_envSkipCap) && _envSkipCap >= 1 ? Mat
 //  - never preempt the running ONNX call,
 //  - never overtake the same flush batch more than PRIORITY_SKIP_CAP times.
 function enqueue(msg) {
+  if (!CONTROL_ACTIONS.has(msg?.action) && _msgQueue.length >= QUEUE_MAX) {
+    try {
+      parentPort.postMessage({
+        id: msg?.id,
+        type: 'error',
+        message: `embed worker queue full (max ${QUEUE_MAX}); retry after the embedding backlog drains`,
+      })
+    } catch { /* reply must never break the worker */ }
+    return
+  }
   if (!msg?.priority) { _msgQueue.push(msg); return }
   // Barrier: insertion must land after the last queued control op.
   let lastControl = -1
@@ -135,22 +155,44 @@ function enqueue(msg) {
 // reset / ext.dispose() while the prior extractor is still being torn down.
 const GUARDED_ACTIONS = new Set(['embed', 'embed-batch', 'warmup', 'configure', 'dispose'])
 
+function disposeLoadedExtractor(reason) {
+  if (!extractorPromise) return false
+  const loaded = extractorPromise
+  extractorPromise = null
+  const prevDevice = _device
+  _device = 'cpu'
+  loaded.then(ext => { try { ext.dispose() } catch {} }).catch(() => {})
+  __mixdogMemoryLog(`[embed-worker] ${reason} — model disposed\n`)
+  parentPort.postMessage({
+    type: 'idle-dispose',
+    reason,
+    device: prevDevice,
+    dtype: configuredDtype,
+  })
+  return true
+}
+
 function resetIdleTimer() {
   if (_idleTimer) clearTimeout(_idleTimer)
   if (IDLE_TIMEOUT_MS <= 0) return
   _idleTimer = setTimeout(() => {
-    if (extractorPromise) {
-      extractorPromise.then(ext => { try { ext.dispose() } catch {} }).catch(() => {})
-      extractorPromise = null
-      const prevDevice = _device
-      _device = 'cpu'
-      __mixdogMemoryLog('[embed-worker] idle timeout — model disposed\n')
-      parentPort.postMessage({ type: 'idle-dispose', device: prevDevice, dtype: configuredDtype })
-    }
+    if (!_embedInFlight) disposeLoadedExtractor('idle timeout')
     _idleTimer = null
   }, IDLE_TIMEOUT_MS)
+  _idleTimer.unref?.()
 }
 
+const _pressureTimer = setInterval(() => {
+  if (PRESSURE_MIN_FREE_BYTES <= 0 || _embedInFlight || !extractorPromise) return
+  let freeBytes = Number.POSITIVE_INFINITY
+  try { freeBytes = Number(os.freemem()) } catch {}
+  if (Number.isFinite(freeBytes) && freeBytes < PRESSURE_MIN_FREE_BYTES) {
+    if (_idleTimer) { clearTimeout(_idleTimer); _idleTimer = null }
+    disposeLoadedExtractor('host memory pressure')
+  }
+}, 5_000)
+_pressureTimer.unref?.()
+
 // Set this process's CPU affinity to `mask` (bitmask of allowed logical
 // processors). Windows-only and best-effort: there is no Node API, so go
 // through PowerShell; a process may set its own affinity without elevation.
@@ -201,6 +243,9 @@ function patchOrtThreads() {
 async function loadExtractor() {
   if (!extractorPromise) {
     extractorPromise = (async () => {
+      if (PRESSURE_MIN_FREE_BYTES > 0 && os.freemem() < PRESSURE_MIN_FREE_BYTES) {
+        throw new Error('embedding model load deferred under host memory pressure')
+      }
       parentPort.postMessage({ type: 'profile', record: { phase: 'baseline', model: MODEL_ID, device: _device, dtype: configuredDtype, note: 'pre-load' } })
       patchOrtThreads()
       const { pipeline, env } = await import('@huggingface/transformers')

package/src/runtime/memory/lib/http-router.mjs

@@ -230,6 +230,10 @@ export function createHttpRouter({
         const body = await readBody(req)
         const projectId = normalizeCoreProjectId(body.project_id)
         const entry = await addCore(DATA_DIR, body, projectId)
+        if (typeof cycleScheduler?.requestCycle3Review === 'function') {
+          try { await cycleScheduler.requestCycle3Review('core-http-add') }
+          catch (err) { log?.(`[core-memory] HTTP follow-up review queue failed: ${err?.message || err}\n`) }
+        }
         sendJson(res, { ok: true, item: entry })
       } catch (e) { sendJson(res, { ok: false, error: e.message }, 500) }
       return

package/src/runtime/memory/lib/ko-morph.mjs

@@ -15,6 +15,7 @@
 //   analyze(text)  — sync; returns TokenInfo[] or null when not ready.
 //   stems(text)    — sync; content-morpheme stems (NNG/NNP/VV/VA/XR/SL) or null.
 import fs from 'node:fs'
+import os from 'node:os'
 import path from 'node:path'
 import zlib from 'node:zlib'
 
@@ -49,11 +50,45 @@ let _initPromise = null
 let _kiwi = null
 let _log = () => {}
 let _initMs = 0
+let _idleTimer = null
+const _envIdleMs = Number(process.env.MIXDOG_KO_MORPH_IDLE_TIMEOUT_MS)
+const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0
+  ? _envIdleMs
+  : 2 * 60_000
+const _envPressureMb = Number(process.env.MIXDOG_KO_MORPH_PRESSURE_MIN_FREE_MB)
+const PRESSURE_MIN_FREE_BYTES = (
+  Number.isFinite(_envPressureMb) && _envPressureMb >= 0 ? _envPressureMb : 1536
+) * 1024 * 1024
 
 export function isReady() { return _state === 'ready' && _kiwi != null }
 export function state() { return _state }
 function initLatencyMs() { return _initMs }
 
+function releaseLoaded(reason = '') {
+  if (_idleTimer) clearTimeout(_idleTimer)
+  _idleTimer = null
+  const current = _kiwi
+  _kiwi = null
+  _state = 'idle'
+  _initPromise = null
+  _initMs = 0
+  try { current?.dispose?.() } catch {}
+  if (current && reason) _log(`[memory-service] kiwi morph ${reason} — analyzer released\n`)
+}
+
+function touchIdleTimer() {
+  if (_idleTimer) clearTimeout(_idleTimer)
+  let delay = IDLE_TIMEOUT_MS
+  try {
+    if (PRESSURE_MIN_FREE_BYTES > 0 && os.freemem() < PRESSURE_MIN_FREE_BYTES) delay = 1
+  } catch {}
+  if (delay <= 0) return
+  _idleTimer = setTimeout(() => releaseLoaded(
+    delay <= 1 ? 'host memory pressure' : 'idle timeout',
+  ), delay)
+  _idleTimer.unref?.()
+}
+
 function modelDir(dataDir) {
   return path.join(dataDir, 'kiwi-model', KIWI_MODEL_VERSION)
 }
@@ -125,9 +160,18 @@ function readModelFiles(dir) {
 
 // Lazy, idempotent, never-throwing init. Fire-and-forget at boot.
 export async function init(dataDir, log = () => {}) {
-  if (_state === 'ready') return true
-  if (_initPromise) return _initPromise
   _log = typeof log === 'function' ? log : (() => {})
+  if (_state === 'ready') {
+    touchIdleTimer()
+    return true
+  }
+  if (_initPromise) return _initPromise
+  try {
+    if (PRESSURE_MIN_FREE_BYTES > 0 && os.freemem() < PRESSURE_MIN_FREE_BYTES) {
+      _log('[memory-service] kiwi morph load deferred under host memory pressure\n')
+      return false
+    }
+  } catch {}
   _state = 'loading'
   const t0 = Date.now()
   _log(`[memory-service] kiwi morph init start (model ${KIWI_MODEL_VERSION})\n`)
@@ -151,6 +195,7 @@ export async function init(dataDir, log = () => {}) {
     _state = 'ready'
     _initMs = Date.now() - t0
     _log(`[memory-service] kiwi morph ready in ${_initMs}ms (model ${KIWI_MODEL_VERSION}, rss≈${Math.round(process.memoryUsage().rss / 1e6)}MB)\n`)
+    touchIdleTimer()
     return true
   })().catch(err => {
     _state = 'failed'
@@ -168,6 +213,7 @@ export function analyze(text) {
   if (!s) return null
   try {
     const r = _kiwi.analyze(s)
+    touchIdleTimer()
     return Array.isArray(r?.tokens) ? r.tokens : null
   } catch {
     return null
@@ -189,8 +235,5 @@ export function stems(text) {
 }
 
 export function reset() {
-  _state = 'idle'
-  _initPromise = null
-  _kiwi = null
-  _initMs = 0
+  releaseLoaded()
 }