mixdog 0.9.95 → 0.9.97

package/src/runtime/memory/lib/embedding-worker.mjs

@@ -57,15 +57,11 @@ const execFileAsync = promisify(execFile)
 const _envLoadCores = Number(process.env.MIXDOG_EMBED_LOAD_CORES)
 const LOAD_AFFINITY_CORES = Number.isInteger(_envLoadCores) && _envLoadCores >= 1 ? _envLoadCores : 1
 const MODEL_CACHE_DIR = join(resolvePluginData(), 'memory-models')
-// Reclaim the model after a short idle window. The worker remains available,
-// so the next recall reloads on demand without keeping hundreds of MB resident
-// throughout an otherwise idle desktop session. Set 0 to opt into keep-alive.
+// Reclaim the model after a short idle window. The parent retires this worker
+// thread so the next recall reloads on demand without keeping hundreds of MB
+// resident throughout an otherwise idle desktop session.
 const _envIdleMs = Number(process.env.MIXDOG_EMBED_IDLE_TIMEOUT_MS)
-const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0 ? _envIdleMs : 3 * 60_000
-const _envPressureMb = Number(process.env.MIXDOG_EMBED_PRESSURE_MIN_FREE_MB)
-const PRESSURE_MIN_FREE_BYTES = (
-  Number.isFinite(_envPressureMb) && _envPressureMb >= 0 ? _envPressureMb : 1536
-) * 1024 * 1024
+const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0 ? _envIdleMs : 60_000
 
 // Defensive belt against giant model inputs. Callers should already bound text
 // (see memory-embed truncateForEmbed), but the worker is the last line before
@@ -87,6 +83,7 @@ let configuredDtype = DEFAULT_DTYPE
 let _device = 'cpu'
 let _idleTimer = null
 let _embedInFlight = false
+let _reclaiming = false
 const _msgQueue = []
 let ortPatched = false
 // Control ops must never be overtaken by a priority embed: crossing a queued
@@ -155,44 +152,41 @@ function enqueue(msg) {
 // reset / ext.dispose() while the prior extractor is still being torn down.
 const GUARDED_ACTIONS = new Set(['embed', 'embed-batch', 'warmup', 'configure', 'dispose'])
 
-function disposeLoadedExtractor(reason) {
-  if (!extractorPromise) return false
+async function disposeLoadedExtractor(reason) {
+  if (!extractorPromise || _reclaiming) return false
+  _reclaiming = true
   const loaded = extractorPromise
   extractorPromise = null
   const prevDevice = _device
   _device = 'cpu'
-  loaded.then(ext => { try { ext.dispose() } catch {} }).catch(() => {})
-  __mixdogMemoryLog(`[embed-worker] ${reason} — model disposed\n`)
-  parentPort.postMessage({
-    type: 'idle-dispose',
-    reason,
-    device: prevDevice,
-    dtype: configuredDtype,
-  })
-  return true
+  try {
+    try {
+      const ext = await loaded
+      try { await Promise.resolve(ext.dispose()) } catch {}
+    } catch {}
+    __mixdogMemoryLog(`[embed-worker] ${reason} — model disposed\n`)
+    parentPort.postMessage({
+      type: 'idle-dispose',
+      reason,
+      device: prevDevice,
+      dtype: configuredDtype,
+    })
+    return true
+  } finally {
+    _reclaiming = false
+  }
 }
 
 function resetIdleTimer() {
   if (_idleTimer) clearTimeout(_idleTimer)
   if (IDLE_TIMEOUT_MS <= 0) return
   _idleTimer = setTimeout(() => {
-    if (!_embedInFlight) disposeLoadedExtractor('idle timeout')
+    if (!_embedInFlight) void disposeLoadedExtractor('idle timeout')
     _idleTimer = null
   }, IDLE_TIMEOUT_MS)
   _idleTimer.unref?.()
 }
 
-const _pressureTimer = setInterval(() => {
-  if (PRESSURE_MIN_FREE_BYTES <= 0 || _embedInFlight || !extractorPromise) return
-  let freeBytes = Number.POSITIVE_INFINITY
-  try { freeBytes = Number(os.freemem()) } catch {}
-  if (Number.isFinite(freeBytes) && freeBytes < PRESSURE_MIN_FREE_BYTES) {
-    if (_idleTimer) { clearTimeout(_idleTimer); _idleTimer = null }
-    disposeLoadedExtractor('host memory pressure')
-  }
-}, 5_000)
-_pressureTimer.unref?.()
-
 // Set this process's CPU affinity to `mask` (bitmask of allowed logical
 // processors). Windows-only and best-effort: there is no Node API, so go
 // through PowerShell; a process may set its own affinity without elevation.
@@ -243,9 +237,6 @@ function patchOrtThreads() {
 async function loadExtractor() {
   if (!extractorPromise) {
     extractorPromise = (async () => {
-      if (PRESSURE_MIN_FREE_BYTES > 0 && os.freemem() < PRESSURE_MIN_FREE_BYTES) {
-        throw new Error('embedding model load deferred under host memory pressure')
-      }
       parentPort.postMessage({ type: 'profile', record: { phase: 'baseline', model: MODEL_ID, device: _device, dtype: configuredDtype, note: 'pre-load' } })
       patchOrtThreads()
       const { pipeline, env } = await import('@huggingface/transformers')
@@ -441,6 +432,11 @@ async function drainQueue() {
     await processMessage(next)
   }
   _embedInFlight = false
+  // Idle means time since the LAST completed inference, not time since it
+  // started. A cold model load can outlive a short idle window; without this
+  // re-arm that timer fires while busy, is discarded, and the loaded ORT
+  // session then remains resident indefinitely.
+  if (extractorPromise && !_reclaiming) resetIdleTimer()
 }
 
 parentPort.on('message', async (msg) => {

package/src/runtime/memory/lib/http-router.mjs

@@ -121,10 +121,7 @@ export function createHttpRouter({
   const _ownerInFlightHttpCalls = new Map()
 
   const requestHandler = async (req, res) => {
-    touchDaemonIdleTimer(`${req.method || 'HTTP'} ${req.url || '/'}`)
-    // Connected-client lifecycle. Proxies register on first use and
-    // deregister on CLI shutdown; the daemon reaps itself shortly after the
-    // last client leaves (see registerClient/deregisterClient in index.mjs).
+    touchDaemonIdleTimer?.(`${req.method || 'HTTP'} ${req.url || '/'}`)
     if (req.method === 'POST' && (req.url === '/client/register' || req.url === '/client/deregister')) {
       if (!isLocalOrigin(req)) {
         sendJson(res, { ok: false, error: 'forbidden: cross-origin' }, 403)
@@ -136,8 +133,6 @@ export function createHttpRouter({
       if (req.url === '/client/register') {
         const accepted = registerClient?.(clientPid)
         if (accepted === false) {
-          // Daemon is draining — distinct signal so the proxy respawns a fresh
-          // daemon and retries its pending RPC instead of binding to this one.
           sendJson(res, { ok: false, draining: true, error: 'memory worker draining' }, 503)
           return
         }
@@ -171,6 +166,7 @@ export function createHttpRouter({
       try {
         const db = getDb()
         const stats = await entryStats()
+        const memory = process.memoryUsage()
         sendJson(res, {
           status: 'ok',
           worker_pid: process.pid,
@@ -192,6 +188,13 @@ export function createHttpRouter({
           cycle_running: cycleScheduler.getCycleRunning(),
           cycle_health: cycleScheduler.getCycleHealth(),
           cycle_backlog: cycleScheduler.getCycleBacklogSnapshot(),
+          memory: {
+            rssBytes: memory.rss,
+            heapTotalBytes: memory.heapTotal,
+            heapUsedBytes: memory.heapUsed,
+            externalBytes: memory.external,
+            arrayBufferBytes: memory.arrayBuffers,
+          },
         })
       } catch (e) { sendError(res, e.message) }
       return

package/src/runtime/memory/lib/ko-morph.mjs

@@ -15,7 +15,6 @@
 //   analyze(text)  — sync; returns TokenInfo[] or null when not ready.
 //   stems(text)    — sync; content-morpheme stems (NNG/NNP/VV/VA/XR/SL) or null.
 import fs from 'node:fs'
-import os from 'node:os'
 import path from 'node:path'
 import zlib from 'node:zlib'
 
@@ -54,11 +53,7 @@ let _idleTimer = null
 const _envIdleMs = Number(process.env.MIXDOG_KO_MORPH_IDLE_TIMEOUT_MS)
 const IDLE_TIMEOUT_MS = Number.isFinite(_envIdleMs) && _envIdleMs >= 0
   ? _envIdleMs
-  : 2 * 60_000
-const _envPressureMb = Number(process.env.MIXDOG_KO_MORPH_PRESSURE_MIN_FREE_MB)
-const PRESSURE_MIN_FREE_BYTES = (
-  Number.isFinite(_envPressureMb) && _envPressureMb >= 0 ? _envPressureMb : 1536
-) * 1024 * 1024
+  : 60_000
 
 export function isReady() { return _state === 'ready' && _kiwi != null }
 export function state() { return _state }
@@ -78,14 +73,8 @@ function releaseLoaded(reason = '') {
 
 function touchIdleTimer() {
   if (_idleTimer) clearTimeout(_idleTimer)
-  let delay = IDLE_TIMEOUT_MS
-  try {
-    if (PRESSURE_MIN_FREE_BYTES > 0 && os.freemem() < PRESSURE_MIN_FREE_BYTES) delay = 1
-  } catch {}
-  if (delay <= 0) return
-  _idleTimer = setTimeout(() => releaseLoaded(
-    delay <= 1 ? 'host memory pressure' : 'idle timeout',
-  ), delay)
+  if (IDLE_TIMEOUT_MS <= 0) return
+  _idleTimer = setTimeout(() => releaseLoaded('idle timeout'), IDLE_TIMEOUT_MS)
   _idleTimer.unref?.()
 }
 
@@ -166,12 +155,6 @@ export async function init(dataDir, log = () => {}) {
     return true
   }
   if (_initPromise) return _initPromise
-  try {
-    if (PRESSURE_MIN_FREE_BYTES > 0 && os.freemem() < PRESSURE_MIN_FREE_BYTES) {
-      _log('[memory-service] kiwi morph load deferred under host memory pressure\n')
-      return false
-    }
-  } catch {}
   _state = 'loading'
   const t0 = Date.now()
   _log(`[memory-service] kiwi morph init start (model ${KIWI_MODEL_VERSION})\n`)

package/src/runtime/memory/lib/memory-action-handlers.mjs

@@ -33,6 +33,7 @@ import {
   promoteCoreCandidate,
   dismissCoreCandidate,
   normalizeCoreInput,
+  normalizeCoreOp,
 } from './core-memory-store.mjs'
 import { resolveProjectId, resolveProjectScope } from './project-id-resolver.mjs'
 import { resolvePluginData } from '../../shared/plugin-paths.mjs'
@@ -602,7 +603,7 @@ export function createMemoryActionHandlers({
     }
 
     if (action === 'core') {
-      const op = String(args.op ?? '').trim().toLowerCase()
+      const op = normalizeCoreOp(args.op)
       if (!['add', 'edit', 'delete', 'list', 'candidates', 'promote', 'dismiss'].includes(op)) {
         return { text: 'core requires op: "add" | "edit" | "delete" | "list" | "candidates" | "promote" | "dismiss"', isError: true }
       }

package/src/runtime/memory/lib/memory-config-flags.mjs

@@ -14,7 +14,7 @@ export function readMainConfig() {
 
 // Recap toggle lives in the `agent` config section (agent.recap.enabled,
 // default true) — the same file the session runtime persists via
-// saveConfigAndAdopt. The memory daemon runs as a detached cross-process HTTP
+// saveConfigAndAdopt. The memory runtime is hosted by the unified daemon
 // worker, so it re-reads this section from disk each cycle tick (poll-on-use)
 // rather than relying on IPC.
 

package/src/runtime/memory/lib/memory-cycle1.mjs

@@ -634,6 +634,7 @@ async function _runCycle1Impl(db, config = {}, options = {}, _dataDir = null) {
         timeout,
         // Pin cwd to null so every memory cycle call hits the same agent cache shard.
         cwd: null,
+        signal,
       }, userMessage)
       throwIfAborted(signal)
       __mixdogMemoryLog(`[cycle1-time] window=${windowIdx} llmMs=${Date.now() - _tLlm}\n`)

package/src/runtime/memory/lib/memory-cycle2-gate.mjs

@@ -32,7 +32,7 @@ const isShiftFollowToken = (tok) => {
   return ALL_PRIMARY_VERBS.has(v) || v === 'why' || v === 'core'
 }
 
-async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispatch) {
+async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispatch, signal = null) {
   return await llmCall({
     agent: 'cycle2-agent',
     taskType: 'maintenance',
@@ -40,6 +40,7 @@ async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispa
     preset,
     timeout,
     cwd: null,
+    signal,
   }, prompt)
 }
 
@@ -357,7 +358,7 @@ export async function runUnifiedGate(db, rows, activeContext, config = {}, optio
   const callOnce = async (extraTag) => {
     throwIfAborted(signal)
     const p = extraTag ? `${prompt}\n\n[retry:${extraTag}]` : prompt
-    const raw = await invokeLlm(p, mode, preset, timeout, options.callLlm)
+    const raw = await invokeLlm(p, mode, preset, timeout, options.callLlm, signal)
     throwIfAborted(signal)
     return raw
   }
@@ -518,6 +519,7 @@ export async function sonnetCascade(candidates, rulesDigest, options = {}) {
       preset,
       timeout: 600000,
       cwd: null,
+      signal,
     }, prompt)
   } catch (err) {
     if (signal?.aborted) throw signal.reason ?? err

package/src/runtime/memory/lib/memory-cycle2-mutations.mjs

@@ -322,6 +322,7 @@ async function _llmJudgePair(summaryA, summaryB, siblingContext = [], options =
       preset: options.preset || resolveMaintenancePreset('memory'),
       timeout: 30000,
       cwd: null,
+      signal,
     }, prompt)
     throwIfAborted(signal)
     return String(raw ?? '').trim().toLowerCase().startsWith('merge')

package/src/runtime/memory/lib/memory-cycle2-shared.mjs

@@ -2,6 +2,7 @@
 // memory-cycle2.mjs). Logging shim, abort check, and resource-dir resolution.
 // No cycle2 business logic; safe to import from any cycle2 sub-module.
 import { fileURLToPath } from 'url'
+import { join } from 'path'
 
 import { __mixdogMemoryLog } from './memory-log.mjs'
 export { __mixdogMemoryLog }
@@ -11,5 +12,7 @@ export function throwIfAborted(signal) {
 }
 
 export function resourceDir() {
-  return process.env.MIXDOG_ROOT || fileURLToPath(new URL('../../../..', import.meta.url))
+  return process.env.MIXDOG_ROOT
+    ? join(process.env.MIXDOG_ROOT, 'src')
+    : fileURLToPath(new URL('../../..', import.meta.url))
 }

package/src/runtime/memory/lib/memory-cycle3.mjs

@@ -36,7 +36,7 @@ function resourceDir() {
   return process.env.MIXDOG_ROOT || fileURLToPath(new URL('../../../..', import.meta.url))
 }
 
-async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispatch) {
+async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispatch, signal = null) {
   return await llmCall({
     agent: 'cycle3-agent',
     taskType: 'maintenance',
@@ -44,6 +44,7 @@ async function invokeLlm(prompt, mode, preset, timeout, llmCall = callAgentDispa
     preset,
     timeout,
     cwd: null,
+    signal,
   }, prompt)
 }
 
@@ -55,6 +56,7 @@ export async function invokeCycle3Maintenance(prompt, options = {}) {
     preset,
     Number(options.timeout ?? 600000),
     options.callLlm,
+    options.signal,
   )
 }
 

package/src/runtime/memory/lib/memory-daemon-lifecycle.mjs

@@ -24,6 +24,11 @@ export function createMemoryDaemonLifecycle({
       _idleShutdownTimer = null
     }
     _idleShutdownTimer = setTimeout(() => {
+      pruneDeadClients()
+      if (_connectedClients.size > 0) {
+        touchDaemonIdleTimer('live client retained')
+        return
+      }
       log(`[memory-service] daemon idle TTL elapsed after ${reason}; shutting down\n`)
       stop()
         .then(() => process.exit(0))

package/src/runtime/memory/lib/memory-log.mjs

@@ -1,4 +1,4 @@
-// Shared memory-daemon stderr logger. The write is captured at import time so
+// Shared memory-runtime stderr logger. The write is captured at import time so
 // memory output stays visible even when a TUI log guard swaps
 // process.stderr.write later; MIXDOG_QUIET_MEMORY_LOG mutes it entirely.
 const __mixdogMemoryStderrWrite = process.stderr.write.bind(process.stderr);

package/src/runtime/memory/lib/memory-process-lock.mjs

@@ -1,6 +1,5 @@
-// Extracted from index.mjs — single/multi-instance process-lock + owner-election
-// helpers. Pure functions parameterized on lock-file paths so index.mjs retains
-// ownership of DATA_DIR-derived constants and the daemon logger.
+// Process lock for the standalone memory MCP entry. Product mode is hosted
+// A direct entry (including the isolated daemon child) owns this lock.
 import fs from 'node:fs'
 import { execFileSync } from 'node:child_process'
 
@@ -15,55 +14,7 @@ export function isPidAliveLocal(pid) {
   catch (e) { return e.code !== 'ESRCH' }
 }
 
-export function tryAcquireMemoryOwnerLock(ownerLockFile, log = () => {}) {
-  // Returns true on success (this process now owns memory worker for the data
-  // dir), false when a live peer holds the lock. Stale locks (dead PID) are
-  // unlinked and retried atomically. Throws on unexpected fs errors so callers
-  // surface lock-system corruption rather than silently downgrading.
-  //
-  // EPERM/EBUSY/EACCES at openSync are transient — AV scanners (SignKorea /
-  // SKCert / ezPDFWS etc) briefly lock newly-created files during inspection.
-  // The 0.1.x baseline threw immediately and the worker promoted to
-  // permanentlyDegraded, killing memory tools for the rest of the session.
-  // Treat the AV error codes as retryable with bounded backoff (~750ms total)
-  // before giving up and rethrowing.
-  for (let attempt = 0; attempt < 5; attempt++) {
-    try {
-      const fd = fs.openSync(ownerLockFile, 'wx')
-      fs.writeSync(fd, String(process.pid))
-      fs.closeSync(fd)
-      return true
-    } catch (e) {
-      if (e.code === 'EEXIST') {
-        let ownerPid = NaN
-        try { ownerPid = Number(fs.readFileSync(ownerLockFile, 'utf8').trim()) } catch {}
-        if (isPidAliveLocal(ownerPid)) return false
-        // Stale lock: dead owner — unlink and retry exclusive create.
-        try { fs.unlinkSync(ownerLockFile) } catch {}
-        continue
-      }
-      const transient = e.code === 'EPERM' || e.code === 'EBUSY' || e.code === 'EACCES'
-      if (transient && attempt < 4) {
-        // Sync busy-wait acceptable here: this runs on memory worker boot
-        // path, once per process; the parent handler is not blocked.
-        const end = Date.now() + 50 * (attempt + 1)
-        while (Date.now() < end) {}
-        continue
-      }
-      throw e
-    }
-  }
-  return false
-}
-
-export function releaseMemoryOwnerLock(ownerLockFile) {
-  try {
-    const ownerPid = Number(fs.readFileSync(ownerLockFile, 'utf8').trim())
-    if (ownerPid === process.pid) fs.unlinkSync(ownerLockFile)
-  } catch {}
-}
-
-export function killPreviousServer(pid, log = () => {}) {
+function killPreviousServer(pid, log = () => {}) {
   if (pid <= 0 || pid === process.pid) return false
   if (process.platform === 'win32') {
     try {
@@ -117,14 +68,8 @@ export function killPreviousServer(pid, log = () => {}) {
 }
 
 export function acquireLock(lockFile, log = () => {}) {
-  // Multi-instance guard. In multi-terminal mode the lock owner is a *peer*
-  // memory worker serving recall for another CC session. killPreviousServer
-  // would taskkill /F that healthy peer mid-flight, then this fork-proxy
-  // mode wouldn't even need a lock anyway. Skip the entire kill-the-previous
-  // protocol; fork-proxy detection in init() takes priority. If neither
-  // proxy nor lock-owner path applies (race window during simultaneous
-  // boot), the worker simply continues without the lock — server-main /
-  // PG / port-listen handle the actual conflict cases.
+  // Multi-instance mode is coordinated by the unified daemon, so a direct MCP
+  // entry does not evict an already-running peer from another client.
   if (process.env.MIXDOG_MULTI_INSTANCE === '1') return
   try {
     if (fs.existsSync(lockFile)) {

package/src/runtime/memory/lib/memory.mjs

@@ -417,7 +417,7 @@ async function _migrateRecallIndexesIfStale(db) {
 
 export async function ensureCurrentSchemaExtensions(db, dims) {
   // One-time cleanup: attachment-only placeholder rows ('(attachment)' user
-  // content, e.g. Discord backend discord.mjs:724) predate the
+  // content, e.g. Discord provider discord.mjs:724) predate the
   // shouldExcludeIngestMessage() ingest-time filter (session-ingest.mjs).
   // Delete any already-persisted rows so they stop polluting recall/cycle1.
   // Idempotent (no-op once cleaned); best-effort so a failure never blocks boot.

package/src/runtime/memory/lib/pg/process.mjs

@@ -107,6 +107,7 @@ async function findFreePort(preferred) {
 // ---------------------------------------------------------------------------
 
 const MIXDOG_CONF_V2_MARKER = '# mixdog overrides v2 — bgwriter / checkpoint distribution'
+const MIXDOG_CONF_V3_MARKER = '# mixdog overrides v3 — bounded local-app resources'
 
 // Lines emitted into postgresql.conf for v2. effective_io_concurrency requires
 // posix_fadvise; PostgreSQL rejects non-zero values on Windows and macOS.
@@ -124,6 +125,21 @@ function buildV2Block() {
   return lines.join('\n') + '\n'
 }
 
+function buildV3Block() {
+  return [
+    '',
+    MIXDOG_CONF_V3_MARKER,
+    // The only long-lived pools are memory(max 5) + trace(max 5). Keep ample
+    // recovery/bootstrap headroom without reserving backend slots for 100
+    // connections this single-user local store can never use.
+    'max_connections = 32',
+    // Mixdog queries are short indexed lookups / bounded batches. LLVM compile
+    // setup adds latency and transient memory; parallel query workers remain
+    // untouched for genuinely large scans.
+    'jit = off',
+  ].join('\n') + '\n'
+}
+
 // Migration: an earlier v2 emitted effective_io_concurrency on every POSIX
 // platform. Strip it anywhere except Linux so old macOS clusters can start.
 function stripPlatformInvalidLines(conf) {
@@ -136,18 +152,25 @@ function ensureConfV2(pgdataDir) {
   if (!existsSync(confPath)) return false
   const original = readFileSync(confPath, 'utf8')
   let conf = stripPlatformInvalidLines(original)
-  const stripped = conf !== original
-  const hasMarker = conf.includes(MIXDOG_CONF_V2_MARKER)
-  if (hasMarker && !stripped) return false
-  if (!hasMarker) conf = conf + buildV2Block()
+  let changed = conf !== original
+  if (!conf.includes(MIXDOG_CONF_V2_MARKER)) {
+    conf += buildV2Block()
+    changed = true
+  }
+  if (!conf.includes(MIXDOG_CONF_V3_MARKER)) {
+    conf += buildV3Block()
+    changed = true
+  }
+  if (!changed) return false
   writeFileSync(confPath, conf)
   return true
 }
 
-// Public reconcile: idempotent conf v2 append + pg_ctl reload on a running
-// instance. Single source of truth for v2 application — supervisor and other
+// Public reconcile: idempotent current override append + pg_ctl reload on a
+// running instance. Single source of truth — supervisor and other
 // callers route through this rather than re-implementing the conf/reload pair.
-// All v2 settings are reload-applicable (no restart required).
+// Reload-compatible settings apply immediately; postmaster settings such as
+// max_connections apply on the next normal PG start (never restart live work).
 export function reconcileConfV2(runtimeDir, pgdataDir) {
   const applied = ensureConfV2(pgdataDir)
   if (!applied) return { applied: false, reloaded: false }
@@ -156,7 +179,7 @@ export function reconcileConfV2(runtimeDir, pgdataDir) {
   })
   const reloaded = reload.status === 0
   if (reloaded) {
-    __mixdogMemoryLog('[pg-process] postgresql.conf v2 overrides applied via pg_ctl reload\n')
+    __mixdogMemoryLog('[pg-process] postgresql.conf overrides reconciled via pg_ctl reload\n')
   } else {
     __mixdogMemoryLog(`[pg-process] pg_ctl reload after v2 append failed (non-fatal): ${reload.stderr?.toString() || ''}\n`)
   }
@@ -252,7 +275,7 @@ export async function startPg({
       'wal_compression = on',              // smaller WAL segments; fewer bytes for Defender to scan per segment
       'wal_init_zero = off',               // skips zero-fill on new WAL segment; cuts Defender contact at segment creation
       'wal_recycle = off',                 // disables WAL rename/recycle loop; eliminates rename-storm EPERM pattern in pgdata
-    ].join('\n') + '\n' + buildV2Block()
+    ].join('\n') + '\n' + buildV2Block() + buildV3Block()
 
     try {
       const existing = readFileSync(confPath, 'utf8')

package/src/runtime/memory/lib/session-ingest.mjs

@@ -305,7 +305,7 @@ export function shouldExcludeIngestMessage(m) {
   if (role === 'user' && typeof raw === 'string' && /^Reference files:\s*/i.test(raw.trimStart())) {
     return true
   }
-  // Attachment-only placeholder rows (e.g. Discord backend discord.mjs:724
+  // Attachment-only placeholder rows (e.g. Discord provider discord.mjs:724
   // `"(attachment)"` fallback when a message carries no text, only files).
   // Carries zero retrievable content — excluded so recall isn't polluted
   // with bare "(attachment)" memory rows.

package/src/runtime/memory/tool-defs.mjs

@@ -10,11 +10,7 @@ export const TOOL_DEFS = [
     name: 'memory',
     title: 'Memory Cycle',
     annotations: { title: 'Memory Cycle', readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
-    description: [
-      'Core-memory mutation/status; recall retrieves.',
-      'Mutations use action=core with op; status uses action=status.',
-      'Store only durable compact ENGLISH facts/rules/preferences.',
-    ].join(' '),
+    description: 'Core-memory mutation/status.',
     inputSchema: {
       type: 'object',
       properties: {

package/src/runtime/search/index.mjs

@@ -286,9 +286,9 @@ function normalizeNativeSearchPayload(result, args, startedAt) {
 
 async function _searchCore(args, { cacheState, nativeSearch, signal }) {
   const cacheArgs = searchArgsForCacheKey(args)
-  const backend = 'native-web-search'
+  const provider = 'native-web-search'
   const searchCacheKey = buildCacheKey('search', {
-    provider: backend,
+    provider,
     ...cacheArgs,
   })
   const cachedSearch = getCachedEntry(cacheState, searchCacheKey)

package/src/runtime/search/tool-defs.mjs

@@ -8,7 +8,7 @@ export const TOOL_DEFS = [
   {
     name: 'search',
     title: 'Mixdog Web Search',
-    description: `Web/docs/current-info search. ${TOOL_SYNC_EXECUTION_CONTRACT} Cached; query supports array fan-out.`,
+    description: `Cached web/docs/current-info search. ${TOOL_SYNC_EXECUTION_CONTRACT}`,
     inputSchema: {
       type: 'object',
       properties: {
@@ -27,7 +27,7 @@ export const TOOL_DEFS = [
   {
     name: 'web_fetch',
     title: 'Mixdog Web Fetch',
-    description: 'Use after search. Fetch page/docs body from URL.',
+    description: 'Fetch page/docs body from URL.',
     inputSchema: {
       type: 'object',
       properties: {

package/src/runtime/shared/abort-race.mjs

@@ -0,0 +1,70 @@
+export function abortReason(signal, fallback = 'Operation aborted') {
+  const reason = signal?.reason;
+  if (reason instanceof Error) return reason;
+  if (reason !== undefined && reason !== null && reason !== '') {
+    return new Error(String(reason));
+  }
+  return new Error(fallback);
+}
+
+export function throwIfAborted(signal, fallback) {
+  if (signal?.aborted) throw abortReason(signal, fallback);
+}
+
+/**
+ * Await one operation while making the caller's settlement independent from
+ * an implementation that ignores AbortSignal. The detached operation remains
+ * observed so a later rejection can never become unhandled.
+ */
+export async function runAbortable(signal, task, fallback) {
+  if (typeof task !== 'function') throw new TypeError('runAbortable requires a task function');
+  if (!signal) return await task();
+  throwIfAborted(signal, fallback);
+
+  const underlying = Promise.resolve().then(task);
+  underlying.catch(() => {});
+
+  return await new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (callback, value) => {
+      if (settled) return;
+      settled = true;
+      try { signal.removeEventListener('abort', onAbort); } catch {}
+      callback(value);
+    };
+    const onAbort = () => finish(reject, abortReason(signal, fallback));
+    signal.addEventListener('abort', onAbort, { once: true });
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    underlying.then(
+      (value) => finish(resolve, value),
+      (error) => finish(reject, error),
+    );
+  });
+}
+
+/**
+ * Bound best-effort cleanup without cancelling the underlying work. The
+ * detached promise remains observed and may still finish in the background.
+ */
+export async function settleWithin(promise, timeoutMs) {
+  const budget = Number(timeoutMs);
+  if (!(Number.isFinite(budget) && budget > 0)) {
+    return { settled: true, value: await promise };
+  }
+  const underlying = Promise.resolve(promise).then((value) => ({ settled: true, value }));
+  underlying.catch(() => {});
+  let timer = null;
+  try {
+    return await Promise.race([
+      underlying,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve({ settled: false, value: undefined }), budget);
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}