mixdog 1.4.2 → 1.4.3

package/src/runtime/memory/lib/memory-embed.mjs

@@ -2,7 +2,7 @@ import { __mixdogMemoryLog } from './memory-log.mjs';
 
 import { embedTexts, getEmbeddingModelId, holdEmbeddingWarm } from './embedding-provider.mjs';
 import { onnxRuntimeSupported } from '../../shared/onnx-runtime-support.mjs';
-import { embeddingToSql } from './memory.mjs';
+import { embeddingToSql, ROOT_EMBED_SWEEP_META_KEY } from './memory.mjs';
 import { createHash } from 'node:crypto';
 import { pruneEmbeddingCache, resolveEmbeddingCacheMaxRows } from './embedding-cache-retention.mjs';
 import { throwIfAborted, markStoreFault } from './memory-cycle-shared.mjs';
@@ -524,6 +524,18 @@ async function syncRawBatchEmbeddings(db, ids, options = {}) {
   return writtenIds;
 }
 
+// A chunk root is also the chunk's first message: cycle1 promotes that raw row
+// in place, and every other member keeps its own content vector. Embedding only
+// element/summary left the first message's own words with no vector, so its
+// details were reachable only through the lossy summary. The summary leads so a
+// long message truncated at the model window still keeps it.
+export function rootEmbedText(row) {
+  const head = [row?.element, row?.summary].filter(Boolean).join(' — ').trim();
+  if (!head) return '';
+  const content = isRawEmbeddable(row?.role, row?.content) ? row.content.trim() : '';
+  return content ? `${head}\n\n${content}` : head;
+}
+
 // Batch-embed all ids in one DB round-trip for fetching, one API call per unique text,
 // then one VALUES UPDATE for all results.
 // Returns the list of ids that were actually UPDATEd with a fresh embedding.
@@ -535,9 +547,10 @@ async function syncBatchEmbeddings(db, ids, options = {}) {
   throwIfAborted(signal);
   if (!onnxRuntimeSupported()) return [];
   const rows = (
-    await db.query(`SELECT id, element, summary FROM memory.entries WHERE id = ANY($1::bigint[]) AND is_root = 1`, [
-      ids,
-    ])
+    await db.query(
+      `SELECT id, element, summary, content, role FROM memory.entries WHERE id = ANY($1::bigint[]) AND is_root = 1`,
+      [ids]
+    )
   ).rows;
   throwIfAborted(signal);
   if (rows.length === 0) return [];
@@ -546,8 +559,9 @@ async function syncBatchEmbeddings(db, ids, options = {}) {
   throwIfAborted(signal);
   const expected = Number(dimsRow?.value ?? 0);
 
-  const texts = rows.map((row) => [row.element, row.summary].filter(Boolean).join(' — ').trim());
-  const vectors = await cachedEmbedTextBatch(db, texts.filter(Boolean), { signal });
+  const texts = rows.map(rootEmbedText);
+  const embedBatch = options.embedBatch ?? cachedEmbedTextBatch;
+  const vectors = await embedBatch(db, texts.filter(Boolean), { signal });
   throwIfAborted(signal);
   // Re-map: only non-empty texts were passed to cachedEmbedTextBatch
   let vecIdx = 0;
@@ -562,28 +576,29 @@ async function syncBatchEmbeddings(db, ids, options = {}) {
       __mixdogMemoryLog(`[embed] dim mismatch (id=${row.id} got=${vector.length} expected=${expected})\n`);
       continue;
     }
-    updates.push({ id: Number(row.id), element: row.element, summary: row.summary, vector });
+    updates.push({ id: Number(row.id), element: row.element, summary: row.summary, content: row.content, vector });
   }
 
   if (updates.length === 0) return [];
 
   // The VALUES update is one SQL batch; do not split it with an abort checkpoint.
   const valClauses = updates.map((_u, i) => {
-    const base = i * 4;
-    return `($${base + 1}::bigint, $${base + 2}::halfvec, $${base + 3}::text, $${base + 4}::text)`;
+    const base = i * 5;
+    return `($${base + 1}::bigint, $${base + 2}::halfvec, $${base + 3}::text, $${base + 4}::text, $${base + 5}::text)`;
   });
   const params = [];
   for (const u of updates) {
-    params.push(u.id, embeddingToSql(u.vector), u.element, u.summary);
+    params.push(u.id, embeddingToSql(u.vector), u.element, u.summary, u.content);
   }
   const res = await db.query(
     `UPDATE memory.entries AS e
      SET embedding = t.vector
-     FROM (VALUES ${valClauses.join(',')}) AS t(id, vector, element, summary)
+     FROM (VALUES ${valClauses.join(',')}) AS t(id, vector, element, summary, content)
      WHERE e.id = t.id AND e.is_root = 1
-       AND e.embedding IS NULL
+       AND e.embedding IS ${options.replace ? 'NOT ' : ''}NULL
        AND e.element IS NOT DISTINCT FROM t.element
        AND e.summary IS NOT DISTINCT FROM t.summary
+       AND e.content IS NOT DISTINCT FROM t.content
      RETURNING e.id`,
     params
   );
@@ -596,7 +611,7 @@ async function syncBatchEmbeddings(db, ids, options = {}) {
     const curRows = missedIds.length
       ? (
           await db.query(
-            `SELECT id, embedding IS NOT NULL AS has_embedding, element, summary
+            `SELECT id, embedding IS NOT NULL AS has_embedding, element, summary, content
            FROM memory.entries WHERE id = ANY($1::bigint[]) AND is_root = 1`,
             [missedIds]
           )
@@ -610,7 +625,8 @@ async function syncBatchEmbeddings(db, ids, options = {}) {
       if (!cur) continue;
       const textUnchanged =
         (cur.element === u.element || (cur.element == null && u.element == null)) &&
-        (cur.summary === u.summary || (cur.summary == null && u.summary == null));
+        (cur.summary === u.summary || (cur.summary == null && u.summary == null)) &&
+        (cur.content === u.content || (cur.content == null && u.content == null));
       if (!textUnchanged) {
         staleSkips++;
         continue;
@@ -631,6 +647,59 @@ async function syncBatchEmbeddings(db, ids, options = {}) {
   return writtenIds;
 }
 
+// One paced step of the root-text sweep (startRootEmbedSweep in memory.mjs).
+// Existing vectors stay searchable until replaced: the step claims the next
+// roots below the stored cursor that still HAVE a vector, embeds their current
+// text, replaces each vector only where the text is unchanged, and advances the
+// cursor in the same transaction. The meta row lock serializes concurrent
+// sweepers; any failure rolls back both vectors and cursor. Roots without a
+// vector are left to the ordinary flush, which already uses the new text.
+const ROOT_SWEEP_BATCH = 8;
+export async function sweepRootEmbedText(db, options = {}) {
+  const { batchSize = ROOT_SWEEP_BATCH, signal, embedBatch } = options;
+  throwIfAborted(signal);
+  if (!onnxRuntimeSupported()) return { claimed: 0, replaced: 0, done: true };
+  await ensureEmbCacheTable(db);
+  const client = await db._pool.connect();
+  let committed = false;
+  try {
+    await client.query('BEGIN');
+    const state = await client.query(`SELECT value FROM memory.meta WHERE key = $1 FOR UPDATE`, [
+      ROOT_EMBED_SWEEP_META_KEY,
+    ]);
+    const value = state.rows[0]?.value;
+    const cursor = Number(value?.cursor);
+    if (!value || value.done === true || !Number.isFinite(cursor)) {
+      await client.query('COMMIT');
+      committed = true;
+      return { claimed: 0, replaced: 0, done: true };
+    }
+    const claim = await client.query(
+      `SELECT id FROM memory.entries
+       WHERE is_root = 1 AND id < $1 AND embedding IS NOT NULL
+         AND (element IS NOT NULL OR summary IS NOT NULL)
+       ORDER BY id DESC
+       LIMIT $2
+       FOR UPDATE`,
+      [cursor, batchSize]
+    );
+    const ids = claim.rows.map((r) => Number(r.id));
+    throwIfAborted(signal);
+    const written = ids.length ? await syncBatchEmbeddings(client, ids, { signal, replace: true, embedBatch }) : [];
+    const done = ids.length < batchSize;
+    await client.query(
+      `UPDATE memory.meta SET value = jsonb_build_object('cursor', $2::bigint, 'done', $3::boolean) WHERE key = $1`,
+      [ROOT_EMBED_SWEEP_META_KEY, ids.length ? Math.min(...ids) : cursor, done]
+    );
+    await client.query('COMMIT');
+    committed = true;
+    return { claimed: ids.length, replaced: written.length, done };
+  } finally {
+    if (!committed) await client.query('ROLLBACK').catch(() => {});
+    client.release();
+  }
+}
+
 // Explicit maintenance must propagate partial failures and caller cancellation,
 // including callers sharing a flush that was started without their signal.
 export async function flushSearchEmbeddings(db, options = {}) {

package/src/runtime/memory/lib/memory-process-lock.mjs

@@ -1,7 +1,11 @@
 // Process lock for the standalone memory MCP entry.
 // A direct entry (including the isolated daemon child) owns this lock.
 import fs from 'node:fs';
-import { execFileSync } from 'node:child_process';
+import { spawnSync } from 'node:child_process';
+import { killProcessTreesSync } from '../../agent/orchestrator/mcp/child-tree.mjs';
+
+// Windows: the tree kill's whole pass (a table read under load included).
+const PREVIOUS_SERVER_KILL_TIMEOUT_MS = 10_000;
 
 export function parsePositivePid(value) {
   const pid = Number(value);
@@ -18,42 +22,158 @@ export function isPidAliveLocal(pid) {
   }
 }
 
-function killPreviousServer(pid, log = () => {}) {
+const POSIX_ENV = () => ({ ...process.env, LC_ALL: 'C', LANG: 'C' });
+
+// When a process was created, as epoch-ms bounds { low, high } around the true
+// time, or null when it cannot be read. Linux: /proc/<pid>/stat starttime
+// (clock ticks since boot) against /proc/uptime, both read at `now`; the
+// margin covers one tick, uptime's centiseconds and the read skew.
+export function linuxCreatedBounds(statText, uptimeText, clockTicks, now) {
+  const ticks = linuxStartTicks(statText);
+  const startTicks = Number(ticks);
+  const uptime = Number(String(uptimeText || '').split(' ')[0]);
+  if (ticks === null || !Number.isFinite(uptime) || !(clockTicks > 0)) return null;
+  const created = now - (uptime - startTicks / clockTicks) * 1000;
+  const margin = 1000 / clockTicks + 20;
+  return { low: created - margin, high: created + margin };
+}
+
+// Elsewhere: `ps -o lstart=` under the C locale, whole seconds.
+export function lstartCreatedBounds(text) {
+  const started = Date.parse(String(text || '').trim());
+  return Number.isFinite(started) ? { low: started, high: started + 1000 } : null;
+}
+
+// /proc/<pid>/stat's starttime field (clock ticks since boot), as its digits.
+function linuxStartTicks(statText) {
+  const stat = String(statText || '');
+  if (!stat.includes(')')) return null;
+  const ticks = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+  return /^\d+$/.test(ticks || '') ? ticks : null;
+}
+
+/** A process's start token, as recorded in the lock and compared on
+ *  recovery, or null when it cannot be read: Linux `/proc/<pid>/stat`
+ *  starttime, elsewhere `ps -o lstart=` under the C locale. The two sources
+ *  never mix (each is prefixed), and both are read from the same host. */
+export function linuxStartToken(statText) {
+  const ticks = linuxStartTicks(statText);
+  return ticks ? `proc:${ticks}` : null;
+}
+export function lstartStartToken(text) {
+  const started = String(text || '').trim();
+  return Number.isFinite(Date.parse(started)) ? `lstart:${started}` : null;
+}
+
+function posixStartToken(pid) {
+  try {
+    if (process.platform === 'linux') return linuxStartToken(fs.readFileSync(`/proc/${pid}/stat`, 'utf8'));
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+      encoding: 'utf8',
+      env: POSIX_ENV(),
+      timeout: 5000,
+    });
+    return lstartStartToken(r.stdout);
+  } catch {
+    return null;
+  }
+}
+
+function posixCreatedBounds(pid) {
+  const env = POSIX_ENV();
+  try {
+    if (process.platform === 'linux') {
+      const ticks = Number(spawnSync('getconf', ['CLK_TCK'], { encoding: 'utf8', env, timeout: 5000 }).stdout);
+      const now = Date.now();
+      return linuxCreatedBounds(
+        fs.readFileSync(`/proc/${pid}/stat`, 'utf8'),
+        fs.readFileSync('/proc/uptime', 'utf8'),
+        ticks,
+        now
+      );
+    }
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', env, timeout: 5000 });
+    return lstartCreatedBounds(r.stdout);
+  } catch {
+    return null;
+  }
+}
+
+/** Who holds a lock's pid, from the start token the writer recorded and the
+ *  pid's current one: 'writer' (the same token: the server that wrote the
+ *  lock), 'other' (a different one: the writer is gone and its pid reused) or
+ *  'unproven' (the current token cannot be read). */
+export function lockHolderTokenVerdict(recordedToken, currentToken) {
+  if (!currentToken) return 'unproven';
+  return currentToken === recordedToken ? 'writer' : 'other';
+}
+
+/** The legacy verdict, for a lock written without a start token: from the
+ *  holder's creation bounds, 'writer' (created before the lock was written),
+ *  'other' (created after) or 'unproven' (unreadable, or too close to the
+ *  write to tell). Only 'writer' may be signalled, and only 'other' or a dead
+ *  pid lets the lock be recovered. */
+export function lockHolderVerdict(bounds, lockWrittenAt) {
+  if (!bounds) return 'unproven';
+  if (bounds.high <= lockWrittenAt) return 'writer';
+  if (bounds.low > lockWrittenAt) return 'other';
+  return 'unproven';
+}
+
+/** The lock's text: the writer's pid, then (POSIX) its start token on the
+ *  next line. */
+export function formatLock(pid, token) {
+  return token ? `${pid}\n${token}` : String(pid);
+}
+export function parseLock(text) {
+  const [pidLine = '', token = ''] = String(text || '').split(/\r?\n/);
+  return { pid: Number(pidLine.trim()), token: token.trim() || null };
+}
+
+// The lock names its writer only while that writer lives. A POSIX writer
+// recorded its start token; the pid's holder is the writer exactly when its
+// token is still the same. Accepted: lstart has whole seconds, so a writer
+// that died within its first second, its pid reused in that same second,
+// would pass as the writer; sequential pid allocation makes that impractical,
+// and treating same-second tokens as unproven would block every restart.
+// Windows compares the holder's creation time against
+// the lock's write time inside the shared tree kill: its creation times are
+// sub-millisecond, and a pid is only reused after the writer died, after the
+// write. A lock without a token (an older writer) keeps the creation-bounds
+// verdict. A pid taken over since is never signalled; one whose identity
+// cannot be proven is neither signalled nor evicted (fail closed).
+function killPreviousServer(pid, recordedToken, lockWrittenAt, log = () => {}) {
   if (pid <= 0 || pid === process.pid) return false;
   if (process.platform === 'win32') {
-    try {
-      execFileSync('taskkill', ['/F', '/T', '/PID', String(pid)], {
-        encoding: 'utf8',
-        timeout: 5000,
-        windowsHide: true,
-      });
+    const status = killProcessTreesSync([pid], {
+      aliveAt: lockWrittenAt,
+      timeoutMs: PREVIOUS_SERVER_KILL_TIMEOUT_MS,
+    });
+    if (status === 0) {
       log(`[memory-service] Killed previous server PID ${pid}\n`);
       return true;
-    } catch (e) {
-      // Exit code 128 = process not found; treat stale lock as already-dead = success.
-      // Status 128 reliably means "process not found" regardless of locale; no text match needed.
-      // Status 1 with English text match handles edge cases on some Windows versions.
-      const notFoundText =
-        /not found|no running instance/i.test(e.stdout || '') ||
-        /not found|no running instance/i.test(e.stderr || '') ||
-        /not found|no running instance/i.test(e.message || '');
-      const alreadyDead = e.status === 128 || (e.status === 1 && notFoundText);
-      if (alreadyDead) {
-        log(`[memory-service] PID ${pid} already dead (stale lock), proceeding\n`);
-        return true;
-      }
-      log(`[memory-service] taskkill failed for PID ${pid}: ${e.message}\n`);
-      return false;
     }
+    if (status === 128) {
+      log(`[memory-service] PID ${pid} is not the lock's writer any more (stale lock), proceeding\n`);
+      return true;
+    }
+    log(`[memory-service] Killing previous server PID ${pid} failed (status ${status})\n`);
+    return false;
   } else {
-    // Pre-flight: if the process is already gone, treat stale lock as success.
-    try {
-      process.kill(pid, 0);
-    } catch (e) {
-      if (e.code === 'ESRCH') {
-        log(`[memory-service] PID ${pid} already dead (stale lock), proceeding\n`);
-        return true;
-      }
+    const verdict = !isPidAliveLocal(pid)
+      ? 'gone'
+      : recordedToken
+        ? lockHolderTokenVerdict(recordedToken, posixStartToken(pid))
+        : lockHolderVerdict(posixCreatedBounds(pid), lockWrittenAt);
+    if (verdict === 'gone' || verdict === 'other' || (verdict === 'unproven' && !isPidAliveLocal(pid))) {
+      log(`[memory-service] PID ${pid} is not the lock's writer any more (stale lock), proceeding\n`);
+      return true;
+    }
+    if (verdict === 'unproven') {
+      log(
+        `[memory-service] PID ${pid} may still be the lock's writer and cannot be proven otherwise; leaving it running\n`
+      );
+      return false;
     }
     try {
       process.kill(pid, 'SIGTERM');
@@ -86,9 +206,10 @@ export function acquireLock(lockFile, log = () => {}) {
   if (process.env.MIXDOG_MULTI_INSTANCE === '1') return;
   try {
     if (fs.existsSync(lockFile)) {
-      const lockedPid = Number(fs.readFileSync(lockFile, 'utf8').trim());
+      const lockWrittenAt = fs.statSync(lockFile).mtimeMs;
+      const { pid: lockedPid, token } = parseLock(fs.readFileSync(lockFile, 'utf8'));
       if (lockedPid > 0 && lockedPid !== process.pid) {
-        const killed = killPreviousServer(lockedPid, log);
+        const killed = killPreviousServer(lockedPid, token, lockWrittenAt, log);
         if (!killed) {
           log(`[memory-service] Could not kill previous server PID ${lockedPid}, aborting\n`);
           process.exit(1);
@@ -98,9 +219,12 @@ export function acquireLock(lockFile, log = () => {}) {
         } catch {}
       }
     }
+    // Read before the lock exists: an unreadable token leaves a pid-only lock,
+    // which a successor judges by the legacy verdict.
+    const token = process.platform === 'win32' ? null : posixStartToken(process.pid);
     const fd = fs.openSync(lockFile, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
     try {
-      fs.writeSync(fd, String(process.pid));
+      fs.writeSync(fd, formatLock(process.pid, token));
     } finally {
       fs.closeSync(fd);
     }
@@ -116,7 +240,6 @@ export function acquireLock(lockFile, log = () => {}) {
 
 export function releaseLock(lockFile) {
   try {
-    const content = fs.readFileSync(lockFile, 'utf8').trim();
-    if (Number(content) === process.pid) fs.unlinkSync(lockFile);
+    if (parseLock(fs.readFileSync(lockFile, 'utf8')).pid === process.pid) fs.unlinkSync(lockFile);
   } catch {}
 }

package/src/runtime/memory/lib/memory-text-utils.mjs

@@ -130,7 +130,12 @@ export function mergeRecallConceptTokens(text, conceptTokens, limit = 24) {
   const entityConcepts = concepts.filter(isEntityConcept);
   const rankingEntityConcepts = entityConcepts.filter((token) => !isStructuralTimeToken(token));
   const useEntityConcepts = rankingEntityConcepts.some(isIdentifierToken) || rankingEntityConcepts.length > 2;
-  const rankingConcepts = useEntityConcepts ? entityConcepts : concepts;
+  // Entity-heavy queries rank their entities first, but the Korean content
+  // words stay: dropping them left a mixed query ("웹 검색 원인 Claude Codex
+  // Hermes 비교") matching only on product names that half the history shares.
+  const rankingConcepts = useEntityConcepts
+    ? [...entityConcepts, ...concepts.filter((token) => !isEntityConcept(token))]
+    : concepts;
   const source =
     concepts.length > 0
       ? [...raw.filter((token) => isIdentifierToken(token) || isConceptCompound(token, concepts)), ...rankingConcepts]

package/src/runtime/memory/lib/memory.mjs

@@ -309,6 +309,22 @@ async function removeReviewAndPromotionCycleState(db) {
   }
 }
 
+// Root vectors now cover the chunk's first message as well as its summary
+// (memory-embed.mjs rootEmbedText). Vectors written under the older text stay
+// in place and are replaced by a paced background sweep (sweepRootEmbedText)
+// that walks roots below this starting cursor, newest first. One statement, so
+// the start is atomic; ON CONFLICT keeps an existing sweep's progress.
+export const ROOT_EMBED_SWEEP_META_KEY = 'embedding.root_text_v2';
+export async function startRootEmbedSweep(db) {
+  await db.query(
+    `INSERT INTO meta(key, value)
+     SELECT $1, jsonb_build_object('cursor', COALESCE(MAX(id), 0) + 1, 'done', false)
+     FROM entries WHERE is_root = 1
+     ON CONFLICT (key) DO NOTHING`,
+    [ROOT_EMBED_SWEEP_META_KEY]
+  );
+}
+
 export async function ensureCurrentSchemaExtensions(db, dims, embeddingIdentity = null) {
   await removeAttachmentPlaceholderRows(db);
   await removeRuntimeNotificationRowsOnce(db);
@@ -413,6 +429,7 @@ export async function openDatabase(dataDir, dims, embeddingIdentity = null) {
     }
     await ensureCurrentSchemaExtensions(db, Number(dims), embeddingIdentity);
     await validateEmbeddingDims(db, Number(dims));
+    await withSchemaBootstrapLock(pool, () => startRootEmbedSweep(db));
 
     dbs.set(key, db);
     return db;

package/src/runtime/memory/lib/pg/process.mjs

@@ -400,7 +400,7 @@ async function startAndWaitReady({ pgctl, startArgs, env, pgdataDir, port }) {
   // so the postmaster is already reparented OUT of the Node process tree —
   // detached only isolated the short-lived pg_ctl. Shutdown/reuse target
   // pgdata/postmaster.pid (pg_ctl stop -D, tryReusePgInstance), not a
-  // Node-tree taskkill, so `windowsHide` alone is correct on all platforms.
+  // Node-tree kill, so `windowsHide` alone is correct on all platforms.
   const child = spawn(pgctl, startArgs, { env, stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
   child.unref?.();
   const run = { stdout: '', stderr: '', closed: false, exitCode: null };

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -20,7 +20,7 @@ import { __mixdogMemoryLog } from '../memory-log.mjs';
  */
 
 import { createServer } from 'node:net';
-import { existsSync, unlinkSync, readFileSync, writeFileSync, renameSync, statSync, mkdirSync } from 'node:fs';
+import { existsSync, unlinkSync, readFileSync, renameSync, statSync, mkdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import {
   discoveryPath as _pgDiscoveryPath,
@@ -28,6 +28,7 @@ import {
   writeServiceAdvert as _writePgServiceAdvert,
 } from '../../../shared/service-discovery.mjs';
 import { withFileLockSync } from '../../../shared/atomic-file.mjs';
+import { withFileLock } from '../../../shared/file-lock.mjs';
 import { isPidAlive } from '../../../shared/pid-liveness.mjs';
 import { envFlag } from '../../../shared/env.mjs';
 import { createSharedAbortable } from '../../../shared/abort-race.mjs';
@@ -64,92 +65,11 @@ let _ownedExitStopInstalled = false;
 const PG_PORT_MIN = 55432;
 const PG_PORT_MAX = 55632;
 const PG_LOG_MAX_BYTES = 10 * 1024 * 1024; // 10 MB
-const SPAWN_LOCK_NAME = 'pg-spawn.lock';
-const LOCK_WAIT_MS = 30_000;
-const LOCK_POLL_MS = 100;
-const LOCK_WARN_MS = 5_000;
-const LOCK_WAIT_CODES = new Set(['EEXIST', 'EPERM', 'EACCES', 'EBUSY']);
 
 function attachOnlyMode() {
   return envFlag('MIXDOG_PG_ATTACH_ONLY') || envFlag('MIXDOG_MEMORY_SECONDARY');
 }
 
-// ── File lock (O_EXCL pattern from dispatch-persist.mjs / run-mcp.mjs) ───────
-
-/**
- * Acquire `${dataDir}/pg-spawn.lock`.
- * Returns the lock-file path on success, or null on timeout (caller proceeds
- * best-effort — worst case: two supervisors race initdb on the same pgdata,
- * but the second will fail pg_ctl start gracefully and healthcheck will
- * converge on the first's port).
- */
-async function acquireSpawnLock(dataDir, blockedProbe = null) {
-  const lp = join(dataDir, SPAWN_LOCK_NAME);
-  const deadline = Date.now() + LOCK_WAIT_MS;
-  const body = JSON.stringify({ pid: process.pid, startedAt: Date.now() });
-  let warned = false;
-  for (;;) {
-    try {
-      // 'wx' = O_CREAT | O_EXCL — atomic, fails with EEXIST if held.
-      writeFileSync(lp, body, { flag: 'wx' });
-      return { lockPath: lp, reuse: null };
-    } catch (err) {
-      if (!LOCK_WAIT_CODES.has(err?.code)) {
-        __mixdogMemoryLog(`[supervisor-pg] spawn lock error: ${err?.code || err?.message}\n`);
-        return { lockPath: null, reuse: null };
-      }
-      if (blockedProbe) {
-        try {
-          const reuse = await blockedProbe();
-          if (reuse) return { lockPath: null, reuse };
-        } catch {}
-      }
-      // Dead-holder detection: same as run-mcp.mjs acquireLock().
-      try {
-        const holder = JSON.parse(readFileSync(lp, 'utf8'));
-        if (holder?.pid) {
-          try {
-            process.kill(holder.pid, 0);
-          } catch (ke) {
-            if (ke.code === 'ESRCH') {
-              try {
-                unlinkSync(lp);
-              } catch {}
-              continue; // retry immediately after removing stale lock
-            }
-          }
-        }
-        const ageMs = Date.now() - Number(holder?.startedAt || 0);
-        if (!warned && ageMs >= LOCK_WARN_MS) {
-          warned = true;
-          __mixdogMemoryLog(
-            `[supervisor-pg] waiting for spawn lock holder pid=${holder?.pid || 'unknown'} ageMs=${ageMs}\n`
-          );
-        }
-      } catch {
-        /* unreadable — fall through and wait */
-      }
-      if (Date.now() >= deadline) {
-        if (blockedProbe) {
-          try {
-            const reuse = await blockedProbe();
-            if (reuse) return { lockPath: null, reuse };
-          } catch {}
-        }
-        throw new Error(`[supervisor-pg] spawn-lock acquire timeout (concurrent supervisor risk)`);
-      }
-      await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
-    }
-  }
-}
-
-function releaseSpawnLock(lp) {
-  if (!lp) return;
-  try {
-    unlinkSync(lp);
-  } catch {}
-}
-
 // ── Port allocation ──────────────────────────────────────────────────────────
 
 function _probePort(port) {
@@ -602,18 +522,10 @@ async function _doEnsure(dataDir, signal) {
     throw new Error('secondary memory runtime requires an existing PG instance');
   }
 
-  // ── Acquire spawn lock to serialize initdb races ─────────────────────────
-  const acquired = await acquireSpawnLock(dataDir, () =>
-    tryReusePgInstance({
-      pgdata,
-      runtimeDir,
-      healthcheckPg,
-      source: 'lock-wait',
-    })
-  );
-  if (acquired?.reuse) return acquired.reuse;
-  const lp = acquired?.lockPath ?? null;
-  try {
+  // ── Spawn lock serializes initdb races (see withFileLock below) ──────────
+  let lockEntered = false;
+  const spawnUnderLock = async () => {
+    lockEntered = true;
     // ── Reuse path: another supervisor already started PG ─────────────────
     const lockedReuse = await tryReusePgInstance({
       pgdata,
@@ -701,8 +613,16 @@ async function _doEnsure(dataDir, signal) {
     // ── Allocate a fresh port and spawn ───────────────────────────────────
     const port = await allocatePort();
     return await _startFresh(dataDir, pgdata, port, runtimeDir);
-  } finally {
-    releaseSpawnLock(lp);
+  };
+  try {
+    return await withFileLock(join(dataDir, 'pg-spawn.lock'), spawnUnderLock, { timeoutMs: 30_000 });
+  } catch (err) {
+    // Only an acquisition timeout (spawnUnderLock never ran) falls back to
+    // reuse; failures from inside the locked region propagate untouched.
+    if (lockEntered || err?.code !== 'ELOCKTIMEOUT') throw err;
+    const reuse = await tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source: 'lock-wait' });
+    if (reuse) return reuse;
+    throw new Error('[supervisor-pg] spawn-lock acquire timeout (concurrent supervisor risk)', { cause: err });
   }
 }
 

package/src/runtime/memory/lib/recall-hybrid/hybrid-sql.mjs

@@ -119,6 +119,11 @@ exact AS (
   WHERE false
 ),`;
   }
+  // Each row is lowercased once (OFFSET 0 keeps the subquery from being
+  // inlined into the per-term condition) and every term is a literal strpos
+  // on that text. Per-term ILIKE re-lowercased the whole content for every
+  // term, so a natural-language query's 10+ terms multiplied the scan cost.
+  // Terms arrive lowercased from buildExactTerms.
   return `
 exact_matches AS (
   SELECT ee.id,
@@ -126,10 +131,14 @@ exact_matches AS (
          q.term,
          COUNT(*) OVER (PARTITION BY q.term)::float8 AS term_df
   FROM entries ee
+  CROSS JOIN LATERAL (
+    SELECT lower(ee.content) AS content, lower(ee.element) AS element, lower(ee.summary) AS summary
+    OFFSET 0
+  ) lc
   JOIN LATERAL unnest($${exactTermsParam}::text[]) AS q(term) ON (
-       ee.content ILIKE '%' || q.term || '%'
-       OR ${recallSubstringPredicate('ee.element', 'q.term')}
-       OR ${recallSubstringPredicate('ee.summary', 'q.term')}
+       strpos(lc.content, q.term) > 0
+       OR strpos(lc.element, q.term) > 0
+       OR strpos(lc.summary, q.term) > 0
   )
   WHERE true
     ${filters.exactFilterClause}

package/src/runtime/office/authoring/docx-html-runner.mjs

@@ -17,7 +17,7 @@ import { renderPdfPages } from '../pdf/pdf-render.mjs';
 const PX_TO_PT = 0.75;
 
 /** Artifacts kept beside the document: its HTML and the browser's print of it. */
-export function docxHtmlArtifacts(target) {
+function docxHtmlArtifacts(target) {
   return {
     source: `${target}.mixdog-source.html`,
     print: `${target}.mixdog-html.pdf`,

package/src/runtime/office/authoring/pptx-author-action.mjs

@@ -34,7 +34,7 @@ const PPTX_AUTHOR_NEEDS_SOURCE =
   'author requires script: HTML slides or a pptxgenjs script (without one it re-authors from <deck>.pptx.mixdog-source.html, and none is there). Load the `pptx` Skill first (Skill name:"pptx"): it carries the authoring workflow, the HTML contract, the composition grammar, and the device kit, then call author again with path and script.';
 
 // HTML opens with markup (a doctype, a comment, an element); a pptxgenjs script never does.
-export function isHtmlSource(source) {
+function isHtmlSource(source) {
   return /^\s*</.test(String(source || ''));
 }