pi-tuck 1.0.5 → 1.0.7

package/CHANGELOG.md

@@ -3,6 +3,33 @@
 All notable changes to pi-tuck. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
 [Semantic Versioning](https://semver.org/).
 
+## [1.0.7] - 2026-11-01
+
+### Changed
+
+- Semantic recall runs on Metal only, so only on Apple silicon. The CPU fallback is gone. Where the embedding server cannot start on Metal (a
+  VM, a Mac without a GPU), semantic recall goes off with "Semantic recall needs Metal; word recall still works", and word recall keeps
+  answering.
+- Off Apple silicon (Linux, Intel Macs), pi-tuck compacts and offers word recall only: `tuck_search` is no longer registered, `tuck_recall`'s
+  description no longer points to it, and nothing is downloaded. On Apple silicon both tools are as before.
+
+## [1.0.6] - 2026-11-01
+
+### Changed
+
+- Semantic recall embeds on the GPU (Metal) on Apple silicon. The pinned llama.cpp build already includes Metal, but pi-tuck started it on the
+  CPU only. On an Apple M5 under heavy load (load average 44-76), a batch of 8 passages took a median 38.6 s on the CPU and 0.69 s on Metal,
+  56 times faster, with nearly the same vectors (97.9% top-10 overlap with the CPU's). Indexing therefore finishes, and `tuck_search` ranks
+  by meaning instead of falling back to keywords. Where Metal cannot start (a VM, CI, no GPU), the same server starts on the CPU. The
+  installed runtime is kept; each session's index is rebuilt once.
+
+### Fixed
+
+- Semantic recall no longer switches itself off on a busy machine. The worker's start (Python, the runtime check, the model load) now has
+  its own deadline instead of the 60 s per-call limit, and an embed call's deadline grows with the number of texts it carries, so a slow
+  machine slows indexing down instead of making it fail. A worker that still fails is retried in the same session and recovers once the
+  machine is free.
+
 ## [1.0.5] - 2026-10-31
 
 ### Fixed

package/README.md

@@ -58,8 +58,8 @@ Then start a new Pi session. That is all. pi-tuck takes over Pi's compaction, bo
 
 - Needs Pi 1.1 or later (tested on 1.1.0 and 1.4.0), on macOS or Linux.
 - On macOS with Apple silicon, the first session also downloads a local search model in the background (about 390 MB, once). Until it is ready, search works by keyword. See [Semantic search](#semantic-search).
-- Prefer GitHub? `pi install git:github.com/galyavin/pi-tuck@v1.0.5`.
-- To pin a version, add it: `pi install npm:pi-tuck@1.0.5`.
+- Prefer GitHub? `pi install git:github.com/galyavin/pi-tuck@v1.0.7`.
+- To pin a version, add it: `pi install npm:pi-tuck@1.0.7`.
 
 ## How it works
 
@@ -120,7 +120,7 @@ Each row says what was measured, under which conditions, and where the data is.
 | Answers after cutting at 60% instead of 100% | No more losses than the limit on all 4 sets. Losses / wins over n questions: 128k shared 3 / 7 of 99; 128k asymmetric 3 / 1 of 67; 32k shared 5 / 3 of 77; 32k asymmetric 9 / 5 of 343. In the 32k asymmetric set the losses lean against 60% (test_result 4 / 2, error_hit 3 / 1); it is the set to watch | Paired replay, same 5 sessions, DeepSeek flash as agent and judge. Limit, set in advance: losses minus wins at most max(2, 5% of n). Asymmetric = evidence the base keeps native and the variant has summarised | [`rnd/replay32/RESULT-lean.md`](rnd/replay32/RESULT-lean.md) |
 | 1.0.2 changes (plain-text summary, shrinking dialogue view, time on user turns only) against 1.0.1 | No more losses than the limit on all 4 sets. Losses / wins: 128k 1 / 2 of 128; 128k time questions 0 / 0 of 48; 32k 4 / 2 of 127; 32k asymmetric 0 / 2 of 56 | Paired replay, 5 recorded live sessions, DeepSeek flash as agent and judge. 11 of 146 answer sessions hit a 15-minute wall limit and drop out of the pairing | [`rnd/replay32/RESULT-lean.md`](rnd/replay32/RESULT-lean.md), [`CHANGELOG.md`](CHANGELOG.md) |
 | Summary size, plain-text format against the 1.0.1 JSON format | About 30% shorter where the agent writes little, about 14% shorter where it writes a lot | Same dialogue | [`CHANGELOG.md`](CHANGELOG.md) 1.0.2 |
-| Small-window fix | A session that writes little prose cut 174 times in 300 tool rounds at 32k with a 16k reserve (1.0.1 code). With the fix, a test pins that no cut frees under a tenth of the room | Real planner on synthetic sessions | [`test/cut-yield.test.ts`](test/cut-yield.test.ts), which pins that every cut frees at least a tenth of the room |
+| Small-window fix | A session that writes little prose cut 174 times in 300 tool rounds at 32k with a 16k reserve (1.0.1 code). With the fix, a test pins that no cut frees under a tenth of the room | Real planner on synthetic sessions | [`CHANGELOG.md`](CHANGELOG.md) 1.0.2 (the 174 cuts); [`test/cut-yield.test.ts`](test/cut-yield.test.ts), which pins that every cut frees at least a tenth of the room |
 | Stall fix: a long session's cut | A cut at 3,888 entries took 72 s in 1.0.0 and takes 174 ms since 1.0.1. Since 1.0.1 the cost grows linearly with the session | One machine, the same synthetic session for both numbers (little prose, 128k window, reserve 16,384, turn 644) | [`CHANGELOG.md`](CHANGELOG.md) 1.0.1 |
 
 Notes:
@@ -161,7 +161,7 @@ If you reach the model through OpenRouter, you can also pin one upstream, so tha
 
 ## Semantic search
 
-Semantic search is on by default on macOS with Apple silicon. It runs entirely on your Mac: an embedding model, [EmbeddingGemma-2](https://huggingface.co/google/embeddinggemma-2), served by [llama.cpp](https://github.com/ggml-org/llama.cpp) on the CPU. No text leaves your machine. Elsewhere, `tuck_search` uses keywords, and everything else works.
+Semantic search is on by default on macOS with Apple silicon. It runs entirely on your Mac: an embedding model, [EmbeddingGemma-2](https://huggingface.co/google/embeddinggemma-2), served by [llama.cpp](https://github.com/ggml-org/llama.cpp) on your Mac's GPU (Metal), or on the CPU where Metal cannot start. No text leaves your machine. Elsewhere, `tuck_search` uses keywords, and everything else works.
 
 The first time a session starts, pi-tuck downloads what it needs, once, about 390 MB, in the background. Keyword search works meanwhile:
 

package/dist/index.js

@@ -18,7 +18,9 @@ export default async function (pi) {
     // `/tuck-semantic off` holds for the rest of the session, including over a setup that finishes later.
     let off = false;
     const settings = readSettings(join(getAgentDir(), "pi-tuck.json"));
-    const handle = await installCompaction(pi, { semanticRecall, cutAt: settings.cutAt, onSemanticSetting: async (enabled) => { off = !enabled; } });
+    // Semantic recall runs on Metal, so only on Apple silicon; elsewhere the model is not offered tuck_search at all.
+    const appleSilicon = process.platform === "darwin" && process.arch === "arm64";
+    const handle = await installCompaction(pi, { semanticRecall, search: appleSilicon, cutAt: settings.cutAt, onSemanticSetting: async (enabled) => { off = !enabled; } });
     if (settings.semanticRecall === false)
         return;
     let session = 0, said = "", setup;
@@ -37,8 +39,8 @@ export default async function (pi) {
         off = false;
         if (settings.error)
             once(ctx, `pi-tuck: ${settings.error}; using the defaults.`, "warning");
-        if (process.platform !== "darwin" || process.arch !== "arm64")
-            return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon for now; compaction and word recall work.", "info");
+        if (!appleSilicon)
+            return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon; compaction and word recall work.", "info");
         // Semantic recall keeps its runtime and indexes outside the project it serves, so not when Pi runs in a folder that holds its
         // agent folder, such as the home folder.
         if (within(real(getAgentDir()), real(ctx.cwd)))

package/dist/src/build-id.d.ts

@@ -1 +1 @@
-export declare const BUILD_ID = "6c391c76284110aae5bb375c04b2147d2fab17de3cb427448e8a869f5ad1e659";
+export declare const BUILD_ID = "3ef35608c93cc69dbe42be20019d79b65f1a1e047e532fcd5efab4ab939b9150";

package/dist/src/build-id.js

@@ -1 +1 @@
-export const BUILD_ID = "6c391c76284110aae5bb375c04b2147d2fab17de3cb427448e8a869f5ad1e659";
+export const BUILD_ID = "3ef35608c93cc69dbe42be20019d79b65f1a1e047e532fcd5efab4ab939b9150";

package/dist/src/compaction.d.ts

@@ -23,6 +23,8 @@ export declare const MEASURED_CALIBRATION: Readonly<Record<string, number>>;
 export declare function seedWindow(branch: readonly SessionEntry[], key: string): number[];
 export interface CompactionOptions {
     semanticRecall?: SemanticRecallController;
+    /** Whether `tuck_search` exists: false where semantic recall cannot run (off Apple silicon), so the model is offered word recall only. */
+    search?: boolean;
     /** Optional host-owned transient operator preference; handle operations never call back. */
     onSemanticSetting?: (enabled: boolean) => Promise<unknown>;
     semanticStatus?: () => unknown;

package/dist/src/compaction.js

@@ -97,7 +97,7 @@ export async function installCompaction(pi, options = {}) {
     const cutAt = options.cutAt ?? DEFAULT_CUT_AT;
     if (!validCutAt(cutAt))
         throw new Error("Invalid cut point: cutAt must be a number above 0 and at most 1");
-    const semantic = options.semanticRecall ?? createSemanticRecall();
+    const semantic = options.semanticRecall ?? createSemanticRecall(), search = options.search ?? true;
     const hostAccess = () => {
         if (!active())
             throw new Error("Compaction host is inactive");
@@ -364,7 +364,7 @@ export async function installCompaction(pi, options = {}) {
     });
     pi.registerTool({
         name: "tuck_recall", label: "pi-tuck history", parameters: RecallInput,
-        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. Use tuck_search for historical information relevant to a question, including different wording and qualifications. Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
+        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. " + (search ? "Use tuck_search for historical information relevant to a question, including different wording and qualifications. " : "") + "Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
         async execute(_id, raw, signal, _update, ctx) {
             access();
             const input = checkedInput(raw);
@@ -391,31 +391,32 @@ export async function installCompaction(pi, options = {}) {
             return reply(tuckRecall(tuck, ctx.sessionManager.getEntries(), branch, input, options.recallPolicy));
         },
     });
-    pi.registerTool({ name: "tuck_search", label: "History search", parameters: SearchInput,
-        description: "Find historical information relevant to a question, including different wording and related qualifications. Combines keyword and local embedding search. Knowing a name or identifier does not imply keyword-only lookup is sufficient. Returns original evidence up to 20000 characters; not exhaustive. Semantic search may be off or incomplete, which is not the same as no matches. Read exact originals and their context with tuck_recall at the returned locators. priorResults lists source ranges already read.",
-        async execute(_id, raw, signal, _update, ctx) {
-            access();
-            if (!Check(SearchInput, raw))
-                throw new Error("Invalid broad search input");
-            const input = structuredClone(raw);
-            recorder.capture("recall-action", "authorized-native-tool-invocation-no-result-copy", input);
-            // Bind the actual independent lexical offer, including attribution derived
-            // from custom markers and receipts excluded from semantic indexing. Rebuild
-            // under current caller policy after await, when the session moved; never send this block to the encoder.
-            const wordOffer = () => tuckRecall(tuck, ctx.sessionManager.getEntries(), ctx.sessionManager.getBranch(), { query: input.query }, options.recallPolicy);
-            // The key is taken in the same synchronous step as the first lexical pass. After the await the second pass runs only if it moved (see eligibilityKey); a moved key alone invalidates nothing.
-            // The snapshot id check covers every in-contract change (any branch change moves the id); the key-gated second pass is defence in depth for out-of-contract callers.
-            const provider = semanticProvider(ctx), initialSnapshot = provider(), initialKey = eligibilityKey(ctx), words = wordOffer(), wordText = JSON.stringify(words);
-            const related = await semantic.search(input.query, provider, signal, input.priorResults ?? [], words);
-            access();
-            if (signal?.aborted)
-                throw Object.assign(new Error('Semantic recall cancelled'), { name: 'AbortError' });
-            const now = provider();
-            if (initialSnapshot.id !== now.id || (eligibilityKeyMoved(ctx, initialKey) && wordText !== JSON.stringify(wordOffer())))
-                return { ...reply({ status: "snapshot_invalidated", notice: "Search source eligibility or version changed; no earlier evidence delivered. Request a fresh query." }), isError: true };
-            const page = budgetSemantic(related, 20000 - wordText.length - 1);
-            return { content: [{ type: "text", text: wordText }, { type: "text", text: JSON.stringify(page) }], details: { semantic: { status: page.status, snapshotId: page.coverage.snapshotId } } };
-        } });
+    if (search)
+        pi.registerTool({ name: "tuck_search", label: "History search", parameters: SearchInput,
+            description: "Find historical information relevant to a question, including different wording and related qualifications. Combines keyword and local embedding search. Knowing a name or identifier does not imply keyword-only lookup is sufficient. Returns original evidence up to 20000 characters; not exhaustive. Semantic search may be off or incomplete, which is not the same as no matches. Read exact originals and their context with tuck_recall at the returned locators. priorResults lists source ranges already read.",
+            async execute(_id, raw, signal, _update, ctx) {
+                access();
+                if (!Check(SearchInput, raw))
+                    throw new Error("Invalid broad search input");
+                const input = structuredClone(raw);
+                recorder.capture("recall-action", "authorized-native-tool-invocation-no-result-copy", input);
+                // Bind the actual independent lexical offer, including attribution derived
+                // from custom markers and receipts excluded from semantic indexing. Rebuild
+                // under current caller policy after await, when the session moved; never send this block to the encoder.
+                const wordOffer = () => tuckRecall(tuck, ctx.sessionManager.getEntries(), ctx.sessionManager.getBranch(), { query: input.query }, options.recallPolicy);
+                // The key is taken in the same synchronous step as the first lexical pass. After the await the second pass runs only if it moved (see eligibilityKey); a moved key alone invalidates nothing.
+                // The snapshot id check covers every in-contract change (any branch change moves the id); the key-gated second pass is defence in depth for out-of-contract callers.
+                const provider = semanticProvider(ctx), initialSnapshot = provider(), initialKey = eligibilityKey(ctx), words = wordOffer(), wordText = JSON.stringify(words);
+                const related = await semantic.search(input.query, provider, signal, input.priorResults ?? [], words);
+                access();
+                if (signal?.aborted)
+                    throw Object.assign(new Error('Semantic recall cancelled'), { name: 'AbortError' });
+                const now = provider();
+                if (initialSnapshot.id !== now.id || (eligibilityKeyMoved(ctx, initialKey) && wordText !== JSON.stringify(wordOffer())))
+                    return { ...reply({ status: "snapshot_invalidated", notice: "Search source eligibility or version changed; no earlier evidence delivered. Request a fresh query." }), isError: true };
+                const page = budgetSemantic(related, 20000 - wordText.length - 1);
+                return { content: [{ type: "text", text: wordText }, { type: "text", text: JSON.stringify(page) }], details: { semantic: { status: page.status, snapshotId: page.coverage.snapshotId } } };
+            } });
     pi.on("session_before_compact", (event, ctx) => {
         try {
             if (!active())

package/dist/src/diagnostics.d.ts

@@ -1,6 +1,6 @@
 import { type RecallPolicy } from './recall.js';
 import type { SessionEntry } from '@earendil-works/pi-coding-agent';
-export declare const DIAGNOSTIC_BUILD = "6c391c76284110aae5bb375c04b2147d2fab17de3cb427448e8a869f5ad1e659";
+export declare const DIAGNOSTIC_BUILD = "3ef35608c93cc69dbe42be20019d79b65f1a1e047e532fcd5efab4ab939b9150";
 export interface Receipt {
     id: string;
     build: string;

package/dist/src/semantic-recall.d.ts

@@ -110,6 +110,18 @@ export declare const HEAL_DELAYS_MS: readonly number[];
 export declare const HEAL_STEADY_MS = 600000;
 /** A session that has not searched for this long gives its worker back (the index stays on disk). Enabling starts nothing; a search starts the worker again. */
 export declare const IDLE_STOP_MS = 600000;
+/** A worker call's deadline once the worker has answered a call after `ready`: index, embed and tokenize on a loaded model. */
+export declare const CALL_DEADLINE_MS = 60000;
+/** Why semantic recall is off where the embedding server cannot start on Metal (a VM, a Mac without a GPU): it runs on Metal only. */
+export declare const METAL_UNAVAILABLE = "Semantic recall needs Metal; word recall still works";
+/** What an `embed` call adds to its deadline for each text it carries. A batch of 8 passages on a starved CPU took longer than the per-call
+ * deadline, and the worker failed when it should have slowed down; a query (one text) still fails fast when the server hangs. The worker
+ * scales its native request timeout by the same amount (semantic-worker.py), so that limit is not reached first. */
+export declare const EMBED_TEXT_MS = 30000;
+/** The deadline for a worker's start: Python start, `ready` (which verifies every runtime file) and the first call after it, which loads the
+ * model and starts its native server. On a busy machine that takes minutes; held to the per-call deadline, the worker never started and
+ * semantic recall went unavailable. It stays above the worker's own native start limit (540 s, in semantic-worker.py). */
+export declare const START_DEADLINE_MS = 600000;
 /** The most units one index window holds. The worker's SQLite store stops at 8,008 rows (`PRAGMA max_page_count=8192` in scripts/semantic-worker.py), so a cap below that keeps a window of short units from filling the store and sticking in `unavailable`. Raise it only together with the store. */
 export declare const MAX_INDEX_UNITS = 8000;
 /** The wait before the next automatic attempt, given how many were already armed since the last success. */
@@ -168,6 +180,9 @@ export declare class SemanticRecallController {
         healDelaysMs?: readonly number[];
         healSteadyMs?: number;
         idleStopMs?: number;
+        startDeadlineMs?: number;
+        callDeadlineMs?: number;
+        embedTextMs?: number;
     });
     /** Be told when `status().state` or `lastError` changes: once per change, after the synchronous work that caused it. Returns the unsubscribe. A listener that throws is ignored. */
     onStateChange(listener: (state: SemanticState, reason: string | null) => void): () => void;

package/dist/src/semantic-recall.js

@@ -169,6 +169,18 @@ export const HEAL_DELAYS_MS = [5000, 30000, 120000];
 export const HEAL_STEADY_MS = 600000;
 /** A session that has not searched for this long gives its worker back (the index stays on disk). Enabling starts nothing; a search starts the worker again. */
 export const IDLE_STOP_MS = 600000;
+/** A worker call's deadline once the worker has answered a call after `ready`: index, embed and tokenize on a loaded model. */
+export const CALL_DEADLINE_MS = 60000;
+/** Why semantic recall is off where the embedding server cannot start on Metal (a VM, a Mac without a GPU): it runs on Metal only. */
+export const METAL_UNAVAILABLE = 'Semantic recall needs Metal; word recall still works';
+/** What an `embed` call adds to its deadline for each text it carries. A batch of 8 passages on a starved CPU took longer than the per-call
+ * deadline, and the worker failed when it should have slowed down; a query (one text) still fails fast when the server hangs. The worker
+ * scales its native request timeout by the same amount (semantic-worker.py), so that limit is not reached first. */
+export const EMBED_TEXT_MS = 30000;
+/** The deadline for a worker's start: Python start, `ready` (which verifies every runtime file) and the first call after it, which loads the
+ * model and starts its native server. On a busy machine that takes minutes; held to the per-call deadline, the worker never started and
+ * semantic recall went unavailable. It stays above the worker's own native start limit (540 s, in semantic-worker.py). */
+export const START_DEADLINE_MS = 600000;
 /** The most units one index window holds. The worker's SQLite store stops at 8,008 rows (`PRAGMA max_page_count=8192` in scripts/semantic-worker.py), so a cap below that keeps a window of short units from filling the store and sticking in `unavailable`. Raise it only together with the store. */
 export const MAX_INDEX_UNITS = 8000;
 /** Keys per worker `score` request: a multiple of the worker's 128-key sub-batches, aligned from the start of the covered prefix. A key is a SHA-256 hex digest (64 characters, see `hash`), so 1024 keys and the 768-float query make a request of about 90 KiB, far under both the 512 KiB design bound and the worker's 1 MiB line limit. */
@@ -183,6 +195,7 @@ class LocalWorker {
     project;
     cleanupFailure;
     onLoss;
+    deadlines;
     nativeHelper = false;
     jobId;
     helperReceipt;
@@ -202,11 +215,13 @@ class LocalWorker {
     stopped = false;
     lost = false;
     closing;
-    constructor(config, project, cleanupFailure, onLoss = () => { }) {
+    loaded = false;
+    constructor(config, project, cleanupFailure, onLoss = () => { }, deadlines = { startMs: START_DEADLINE_MS, callMs: CALL_DEADLINE_MS, embedTextMs: EMBED_TEXT_MS }) {
         this.config = config;
         this.project = project;
         this.cleanupFailure = cleanupFailure;
         this.onLoss = onLoss;
+        this.deadlines = deadlines;
     }
     closeInBackground() { void this.close().catch(error => this.cleanupFailure(error)); }
     // The worker stopped without the controller asking: report it once, then join it like any other background close.
@@ -261,7 +276,7 @@ class LocalWorker {
                     if (pending) {
                         clearTimeout(pending.timer);
                         this.pending.delete(reply.id);
-                        reply.ok ? pending.resolve(reply.result) : pending.reject(new WorkerFailure('Local semantic runtime: ' + reply.error?.code, reply.error?.code ?? null));
+                        reply.ok ? pending.resolve(reply.result) : pending.reject(new WorkerFailure(reply.error?.code === 'metal_unavailable' ? METAL_UNAVAILABLE : 'Local semantic runtime: ' + reply.error?.code, reply.error?.code ?? null));
                         if (this.nativeHelper && this.nativeInputId === reply.id) {
                             this.nativeInputId = undefined;
                             this.pumpNativeInput();
@@ -303,7 +318,8 @@ class LocalWorker {
         const id = ++this.next, body = JSON.stringify({ id, op, ...input }) + '\n';
         if (Buffer.byteLength(body) > 1048576)
             throw new Error('Local worker input bound');
-        return new Promise((resolveReply, reject) => { const onAbort = () => { this.closeInBackground(); reject(abort()); }; signal?.addEventListener('abort', onAbort, { once: true }); const finish = (callback, value) => { signal?.removeEventListener('abort', onAbort); callback(value); }; const timer = setTimeout(() => { this.lose('Local runtime deadline'); finish(reject, new WorkerFailure('Local runtime deadline')); }, 60000); this.pending.set(id, { resolve: value => finish(resolveReply, value), reject: error => finish(reject, error), timer }); if (this.nativeHelper) {
+        return new Promise((resolveReply, reject) => { const onAbort = () => { this.closeInBackground(); reject(abort()); }; signal?.addEventListener('abort', onAbort, { once: true }); const finish = (callback, value) => { signal?.removeEventListener('abort', onAbort); callback(value); }; const timer = setTimeout(() => { this.lose('Local runtime deadline'); finish(reject, new WorkerFailure('Local runtime deadline')); }, this.loaded ? this.deadlines.callMs + (op === 'embed' ? this.deadlines.embedTextMs * (input.texts?.length ?? 0) : 0) : this.deadlines.startMs); this.pending.set(id, { resolve: value => { if (op !== 'ready')
+                this.loaded = true; finish(resolveReply, value); }, reject: error => finish(reject, error), timer }); if (this.nativeHelper) {
             const control = { op: 'input', input: Buffer.from(body).toString('base64') };
             this.nativeInputs.push({ id, control: JSON.stringify(control) + '\n' });
             this.pumpNativeInput();
@@ -620,7 +636,7 @@ export class SemanticRecallController {
         if (!this.worker) {
             const worker = new LocalWorker(this.config, project, error => { if (this.worker !== worker)
                 return; this.cleanupError = error instanceof Error ? error.message : 'Semantic cleanup failed'; this.error = this.cleanupError; this.enabled = false; this.generation++; }, reason => { if (this.worker === worker)
-                this.heal(new WorkerFailure(reason)); });
+                this.heal(new WorkerFailure(reason)); }, { startMs: this.timing.startDeadlineMs ?? START_DEADLINE_MS, callMs: this.timing.callDeadlineMs ?? CALL_DEADLINE_MS, embedTextMs: this.timing.embedTextMs ?? EMBED_TEXT_MS });
             this.worker = worker;
         }
         if (!this.identity) {

package/index.ts

@@ -22,7 +22,9 @@ export default async function (pi: ExtensionAPI) {
 	// `/tuck-semantic off` holds for the rest of the session, including over a setup that finishes later.
 	let off = false;
 	const settings = readSettings(join(getAgentDir(), "pi-tuck.json"));
-	const handle = await installCompaction(pi, { semanticRecall, cutAt: settings.cutAt, onSemanticSetting: async enabled => { off = !enabled; } });
+	// Semantic recall runs on Metal, so only on Apple silicon; elsewhere the model is not offered tuck_search at all.
+	const appleSilicon = process.platform === "darwin" && process.arch === "arm64";
+	const handle = await installCompaction(pi, { semanticRecall, search: appleSilicon, cutAt: settings.cutAt, onSemanticSetting: async enabled => { off = !enabled; } });
 	if (settings.semanticRecall === false) return;
 	let session = 0, said = "", setup: Promise<unknown> | undefined;
 	// A context outlives its session (a setup can finish after /new); a notice to an ended session is dropped.
@@ -33,8 +35,8 @@ export default async function (pi: ExtensionAPI) {
 		const current = ++session;
 		off = false;
 		if (settings.error) once(ctx, `pi-tuck: ${settings.error}; using the defaults.`, "warning");
-		if (process.platform !== "darwin" || process.arch !== "arm64")
-			return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon for now; compaction and word recall work.", "info");
+		if (!appleSilicon)
+			return once(ctx, "pi-tuck: semantic recall needs macOS on Apple silicon; compaction and word recall work.", "info");
 		// Semantic recall keeps its runtime and indexes outside the project it serves, so not when Pi runs in a folder that holds its
 		// agent folder, such as the home folder.
 		if (within(real(getAgentDir()), real(ctx.cwd)))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-tuck",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Deterministic compaction for Pi: compact summaries that keep the dialogue and the files touched, plus history recall by keyword and by meaning, all local.",
   "keywords": [
     "pi-package",

package/scripts/semantic-worker.py

@@ -12,12 +12,13 @@ WINDOWS=os.name=='nt';encoder_port=None;encoder_token=None
 class LocalHTTP(http.client.HTTPConnection):
  def connect(self):
   self.sock=socket.socket(socket.AF_UNIX,socket.SOCK_STREAM);self.sock.settimeout(self.timeout);self.sock.connect('encoder.sock')
-def request(path,data=None):
+# A native request's timeout: 55 s, plus 30 s per text it embeds (the host's EMBED_TEXT_MS), so a starved CPU slows a batch down and does not fail it.
+def request(path,data=None,texts=0):
  if path not in ('/health','/props','/v1/embeddings'):raise Refusal('native_path_failure')
  if WINDOWS:
   if encoder_port is None or not encoder_token:raise Refusal('native_transport_unavailable')
-  connection=http.client.HTTPConnection('127.0.0.1',encoder_port,timeout=55)
- else:connection=LocalHTTP('localhost',timeout=55)
+  connection=http.client.HTTPConnection('127.0.0.1',encoder_port,timeout=55+30*texts)
+ else:connection=LocalHTTP('localhost',timeout=55+30*texts)
  try:
   headers={'Content-Type':'application/json'}
   if WINDOWS:headers['Authorization']='Bearer '+encoder_token
@@ -26,6 +27,7 @@ def request(path,data=None):
   if len(payload)>16*1024*1024:raise Refusal('native_response_bound')
   if response.status!=200:raise Refusal('native_request_failure')
   return json.loads(payload)
+ except TimeoutError:raise Refusal('native_request_failure')
  finally:connection.close()
 def native_executable():
  executable=ROOT/('native/llama-server.exe' if WINDOWS else 'native/llama-server')
@@ -90,18 +92,26 @@ def load():
    # Pinned common/arg.cpp supports LLAMA_API_KEY; server-http.cpp requires Bearer
    # on /props and embeddings, but /health is public. No token in process argv.
    env['LLAMA_API_KEY']=encoder_token
-  server=subprocess.Popen([str(executable),'-m',str(ROOT/'model.gguf'),'--embedding','--pooling','mean','--embd-normalize','2','--ctx-size','8192','--batch-size','8192','--ubatch-size','8192','--parallel','1','--n-gpu-layers','0','--cache-type-k','f32','--cache-type-v','f32','--flash-attn','off','--threads','4',*transport,'--no-webui','--log-disable'],stdin=subprocess.DEVNULL,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,env=env)
-  started=time.monotonic()
-  while True:
-   if server.poll() is not None:raise Refusal('native_start_failure')
-   try:
-    if request('/health').get('status')=='ok':
-     if WINDOWS:request('/props') # Public health alone is not authenticated readiness.
-     if server.poll() is not None:raise Refusal('native_start_failure')
-     break
-   except (OSError,Refusal):pass
-   if time.monotonic()-started>50:raise Refusal('native_start_timeout')
-   time.sleep(.02)
+  def launch(limit):
+   """The server, or None when it exits or is not healthy within `limit` seconds (it is then stopped)."""
+   child=subprocess.Popen([str(executable),'-m',str(ROOT/'model.gguf'),'--embedding','--pooling','mean','--embd-normalize','2','--ctx-size','8192','--batch-size','8192','--ubatch-size','8192','--parallel','1','--n-gpu-layers','99','--cache-type-k','f32','--cache-type-v','f32','--flash-attn','off','--threads','4',*transport,'--no-webui','--log-disable'],stdin=subprocess.DEVNULL,stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,env=env)
+   started=time.monotonic()
+   while child.poll() is None and time.monotonic()-started<=limit:
+    try:
+     if request('/health').get('status')=='ok':
+      if WINDOWS:request('/props') # Public health alone is not authenticated readiness.
+      if child.poll() is None:return child
+    except (OSError,Refusal):pass
+    time.sleep(.02)
+   if child.poll() is None:
+    child.kill();child.wait()
+   return None
+  # Semantic recall runs on Metal only (the project's platform choice): on Apple silicon it embeds a batch about 56 times faster than the
+  # CPU did (0.7 s against 39 s for 8 passages at load 44-76). Where Metal cannot start (a VM, no GPU) the server exits or never becomes
+  # healthy, and semantic recall goes off with that reason; word recall keeps working. A busy machine can take minutes to start it; the
+  # limit stays under the host's start deadline (START_DEADLINE_MS, 600 s).
+  server=launch(540)
+  if server is None:raise Refusal('metal_unavailable')
  return server
 def run(req):
  op=req['op']
@@ -132,7 +142,7 @@ def run(req):
   if len(a)>8:raise Refusal('batch_limit')
   ids=[enc(framed(t,kind)) for t in a]
   if not a:return {'vectors':[],'identity':IDENTITY}
-  load();out=request('/v1/embeddings',{'input':ids,'encoding_format':'float','truncate':False})['data'];out.sort(key=lambda row:row['index']);vectors=[row['embedding'] for row in out]
+  load();out=request('/v1/embeddings',{'input':ids,'encoding_format':'float','truncate':False},len(ids))['data'];out.sort(key=lambda row:row['index']);vectors=[row['embedding'] for row in out]
   if len(vectors)!=len(a) or any(len(v)!=768 or any(not math.isfinite(x) for x in v) or abs(sum(x*x for x in v)**.5-1)>1e-5 for v in vectors):raise Refusal('invalid_vector')
   return {'vectors':vectors,'identity':IDENTITY,'nativePID':server.pid}
  if op=='index':return index(req)

package/src/build-id.ts

@@ -1 +1 @@
-export const BUILD_ID = "6c391c76284110aae5bb375c04b2147d2fab17de3cb427448e8a869f5ad1e659";
+export const BUILD_ID = "3ef35608c93cc69dbe42be20019d79b65f1a1e047e532fcd5efab4ab939b9150";

package/src/compaction.ts

@@ -88,6 +88,8 @@ export function seedWindow(branch: readonly SessionEntry[], key: string): number
 }
 export interface CompactionOptions {
  semanticRecall?: SemanticRecallController;
+ /** Whether `tuck_search` exists: false where semantic recall cannot run (off Apple silicon), so the model is offered word recall only. */
+ search?: boolean;
  /** Optional host-owned transient operator preference; handle operations never call back. */
  onSemanticSetting?: (enabled: boolean) => Promise<unknown>;
  semanticStatus?: () => unknown;
@@ -119,7 +121,7 @@ export interface CompactionOptions {
 export async function installCompaction(pi: ExtensionAPI, options: CompactionOptions = {}) {
     const cutAt = options.cutAt ?? DEFAULT_CUT_AT;
     if (!validCutAt(cutAt)) throw new Error("Invalid cut point: cutAt must be a number above 0 and at most 1");
-    const semantic = options.semanticRecall ?? createSemanticRecall();
+    const semantic = options.semanticRecall ?? createSemanticRecall(), search = options.search ?? true;
     const hostAccess = () => {
         if (!active()) throw new Error("Compaction host is inactive");
         options.assertAccess?.();
@@ -318,7 +320,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
     });
 	pi.registerTool({
 		name: "tuck_recall", label: "pi-tuck history", parameters: RecallInput,
-        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. Use tuck_search for historical information relevant to a question, including different wording and qualifications. Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
+        description: "Keyword lookup locates particular text in your current branch. {query} returns ranked passages with read coordinates; punctuation separates words. Pass the returned next as {continuation} unchanged. " + (search ? "Use tuck_search for historical information relevant to a question, including different wording and qualifications. " : "") + "Knowing an identifier does not itself justify narrowing discovery. {entryId} or {index} (a summary sourceIndex or #N) reads one source, optionally with query, offset and limit in UTF-16 characters (limit defaults to 8000). {} browses history; {around} expands neighbors; {entryId,image} reads an image; outputPath writes an original to a file with the native write tool. Hidden reasoning and system records are excluded.",
 		async execute(_id, raw, signal, _update, ctx) {
 			access();
             const input = checkedInput(raw);
@@ -341,7 +343,7 @@ export async function installCompaction(pi: ExtensionAPI, options: CompactionOpt
             return reply(tuckRecall(tuck, ctx.sessionManager.getEntries(), branch, input, options.recallPolicy));
 		},
 	});
-    pi.registerTool({name:"tuck_search",label:"History search",parameters:SearchInput,
+    if (search) pi.registerTool({name:"tuck_search",label:"History search",parameters:SearchInput,
         description:"Find historical information relevant to a question, including different wording and related qualifications. Combines keyword and local embedding search. Knowing a name or identifier does not imply keyword-only lookup is sufficient. Returns original evidence up to 20000 characters; not exhaustive. Semantic search may be off or incomplete, which is not the same as no matches. Read exact originals and their context with tuck_recall at the returned locators. priorResults lists source ranges already read.",
         async execute(_id,raw,signal,_update,ctx){
             access();if(!Check(SearchInput,raw))throw new Error("Invalid broad search input");const input=structuredClone(raw);

package/src/semantic-recall.ts

@@ -102,6 +102,18 @@ export const HEAL_DELAYS_MS:readonly number[]=[5000,30000,120000];
 export const HEAL_STEADY_MS=600000;
 /** A session that has not searched for this long gives its worker back (the index stays on disk). Enabling starts nothing; a search starts the worker again. */
 export const IDLE_STOP_MS=600000;
+/** A worker call's deadline once the worker has answered a call after `ready`: index, embed and tokenize on a loaded model. */
+export const CALL_DEADLINE_MS=60000;
+/** Why semantic recall is off where the embedding server cannot start on Metal (a VM, a Mac without a GPU): it runs on Metal only. */
+export const METAL_UNAVAILABLE='Semantic recall needs Metal; word recall still works';
+/** What an `embed` call adds to its deadline for each text it carries. A batch of 8 passages on a starved CPU took longer than the per-call
+ * deadline, and the worker failed when it should have slowed down; a query (one text) still fails fast when the server hangs. The worker
+ * scales its native request timeout by the same amount (semantic-worker.py), so that limit is not reached first. */
+export const EMBED_TEXT_MS=30000;
+/** The deadline for a worker's start: Python start, `ready` (which verifies every runtime file) and the first call after it, which loads the
+ * model and starts its native server. On a busy machine that takes minutes; held to the per-call deadline, the worker never started and
+ * semantic recall went unavailable. It stays above the worker's own native start limit (540 s, in semantic-worker.py). */
+export const START_DEADLINE_MS=600000;
 /** The most units one index window holds. The worker's SQLite store stops at 8,008 rows (`PRAGMA max_page_count=8192` in scripts/semantic-worker.py), so a cap below that keeps a window of short units from filling the store and sticking in `unavailable`. Raise it only together with the store. */
 export const MAX_INDEX_UNITS=8000;
 /** Keys per worker `score` request: a multiple of the worker's 128-key sub-batches, aligned from the start of the covered prefix. A key is a SHA-256 hex digest (64 characters, see `hash`), so 1024 keys and the 768-float query make a request of about 90 KiB, far under both the 512 KiB design bound and the worker's 1 MiB line limit. */
@@ -118,8 +130,8 @@ class LocalWorker {
  // This leaves room for the previous native write to finish plus one queued
  // control, even when the child replies before that writer goroutine retires.
  private nativeInputs:{id:number;control:string}[]=[];private nativeInputId?:number;
- private child?:ChildProcessWithoutNullStreams;private scratch?:string;private starting?:Promise<void>;private exited?:Promise<void>;private buffer='';private next=0;private pending=new Map<number,{resolve:(value:any)=>void;reject:(error:Error)=>void;timer:ReturnType<typeof setTimeout>}>();private stopped=false;private lost=false;private closing?:Promise<void>;
- constructor(private config:SemanticRecallConfig, private project:string, private cleanupFailure:(error:unknown)=>void, private onLoss:(reason:string)=>void=()=>{}){}
+ private child?:ChildProcessWithoutNullStreams;private scratch?:string;private starting?:Promise<void>;private exited?:Promise<void>;private buffer='';private next=0;private pending=new Map<number,{resolve:(value:any)=>void;reject:(error:Error)=>void;timer:ReturnType<typeof setTimeout>}>();private stopped=false;private lost=false;private closing?:Promise<void>;private loaded=false;
+ constructor(private config:SemanticRecallConfig, private project:string, private cleanupFailure:(error:unknown)=>void, private onLoss:(reason:string)=>void=()=>{}, private deadlines:{startMs:number;callMs:number;embedTextMs:number}={startMs:START_DEADLINE_MS,callMs:CALL_DEADLINE_MS,embedTextMs:EMBED_TEXT_MS}){}
  private closeInBackground(){void this.close().catch(error=>this.cleanupFailure(error));}
  // The worker stopped without the controller asking: report it once, then join it like any other background close.
  private lose(reason:string){if(!this.stopped&&!this.lost){this.lost=true;this.onLoss(reason);}this.closeInBackground();}
@@ -139,7 +151,7 @@ class LocalWorker {
    const launchLine=JSON.stringify(launch)+'\n';if(this.nativeHelper&&Buffer.byteLength(launchLine)>2*1048576)throw new Error('Native owner launch bound');
    const child=spawn(this.nativeHelper?this.config.nativeOwnerHelperPath!:this.config.pythonPath,this.nativeHelper?['--run']:args,{cwd:this.scratch,env:this.nativeHelper?osEnvironment:env,stdio:'pipe',detached:!this.nativeHelper});
    this.child=child;this.exited=new Promise<void>(done=>child.once('close',(code,signal)=>{this.nativeExit={code,signal};this.rejectAll(new WorkerFailure('Local worker stopped'));done();this.lose('Local worker stopped');}));
-   child.stdout.on('data',data=>{this.buffer+=data.toString();if(this.buffer.length>16*1024*1024){this.lose('Local worker output bound');return;}let end;while((end=this.buffer.indexOf('\n'))>=0){const line=this.buffer.slice(0,end);this.buffer=this.buffer.slice(end+1);try{const reply=JSON.parse(line),pending=this.pending.get(reply.id);if(pending){clearTimeout(pending.timer);this.pending.delete(reply.id);reply.ok?pending.resolve(reply.result):pending.reject(new WorkerFailure('Local semantic runtime: '+reply.error?.code,reply.error?.code??null));if(this.nativeHelper&&this.nativeInputId===reply.id){this.nativeInputId=undefined;this.pumpNativeInput();}}}catch{this.lose('Local worker framing');}}});
+   child.stdout.on('data',data=>{this.buffer+=data.toString();if(this.buffer.length>16*1024*1024){this.lose('Local worker output bound');return;}let end;while((end=this.buffer.indexOf('\n'))>=0){const line=this.buffer.slice(0,end);this.buffer=this.buffer.slice(end+1);try{const reply=JSON.parse(line),pending=this.pending.get(reply.id);if(pending){clearTimeout(pending.timer);this.pending.delete(reply.id);reply.ok?pending.resolve(reply.result):pending.reject(new WorkerFailure(reply.error?.code==='metal_unavailable'?METAL_UNAVAILABLE:'Local semantic runtime: '+reply.error?.code,reply.error?.code??null));if(this.nativeHelper&&this.nativeInputId===reply.id){this.nativeInputId=undefined;this.pumpNativeInput();}}}catch{this.lose('Local worker framing');}}});
    child.stdout.on('error',()=>this.lose('Local worker output'));
    if(this.nativeHelper)this.helperReceipt=observeNativeFrames(child.stderr,()=>{},()=>this.closeInBackground());
    else child.stderr.resume();
@@ -152,7 +164,7 @@ class LocalWorker {
   if(signal?.aborted)throw abort();if(this.stopped)throw new WorkerFailure('Local worker closed');
   await this.start();if(this.stopped||signal?.aborted)throw this.lost&&!signal?.aborted?new WorkerFailure('Local worker stopped'):abort();if(this.pending.size>=2)throw new Error('Local semantic concurrency bound');
   const id=++this.next,body=JSON.stringify({id,op,...input})+'\n';if(Buffer.byteLength(body)>1048576)throw new Error('Local worker input bound');
-  return new Promise((resolveReply,reject)=>{const onAbort=()=>{this.closeInBackground();reject(abort());};signal?.addEventListener('abort',onAbort,{once:true});const finish=(callback:(value:any)=>void,value:any)=>{signal?.removeEventListener('abort',onAbort);callback(value);};const timer=setTimeout(()=>{this.lose('Local runtime deadline');finish(reject,new WorkerFailure('Local runtime deadline'));},60000);this.pending.set(id,{resolve:value=>finish(resolveReply,value),reject:error=>finish(reject,error),timer});if(this.nativeHelper){const control:NativeOwnerInputControl={op:'input',input:Buffer.from(body).toString('base64')};this.nativeInputs.push({id,control:JSON.stringify(control)+'\n'});this.pumpNativeInput();}else this.child!.stdin.write(body);});
+  return new Promise((resolveReply,reject)=>{const onAbort=()=>{this.closeInBackground();reject(abort());};signal?.addEventListener('abort',onAbort,{once:true});const finish=(callback:(value:any)=>void,value:any)=>{signal?.removeEventListener('abort',onAbort);callback(value);};const timer=setTimeout(()=>{this.lose('Local runtime deadline');finish(reject,new WorkerFailure('Local runtime deadline'));},this.loaded?this.deadlines.callMs+(op==='embed'?this.deadlines.embedTextMs*((input as {texts?:unknown[]}).texts?.length??0):0):this.deadlines.startMs);this.pending.set(id,{resolve:value=>{if(op!=='ready')this.loaded=true;finish(resolveReply,value);},reject:error=>finish(reject,error),timer});if(this.nativeHelper){const control:NativeOwnerInputControl={op:'input',input:Buffer.from(body).toString('base64')};this.nativeInputs.push({id,control:JSON.stringify(control)+'\n'});this.pumpNativeInput();}else this.child!.stdin.write(body);});
  }
  private pumpNativeInput(){if(this.stopped||this.nativeInputId!==undefined)return;const next=this.nativeInputs.shift();if(next){this.nativeInputId=next.id;this.child!.stdin.write(next.control);}}
  private rejectAll(error:Error){for(const p of this.pending.values()){clearTimeout(p.timer);p.reject(error);}this.pending.clear();this.nativeInputs=[];this.nativeInputId=undefined;}
@@ -235,7 +247,7 @@ export class SemanticRecallController {
  // Whether this session ran a search since the controller was created or last closed; it survives idle stops, so a cut after a long quiet spell still indexes.
  private searched=false;
  private readonly listeners=new Set<(state:SemanticState,reason:string|null)=>void>();private announced='disabled\0';private announcing=false;
- constructor(config?:SemanticRecallConfig,private readonly timing:{healDelaysMs?:readonly number[];healSteadyMs?:number;idleStopMs?:number}={}){if(config)this.configure(config);}
+ constructor(config?:SemanticRecallConfig,private readonly timing:{healDelaysMs?:readonly number[];healSteadyMs?:number;idleStopMs?:number;startDeadlineMs?:number;callDeadlineMs?:number;embedTextMs?:number}={}){if(config)this.configure(config);}
  /** Be told when `status().state` or `lastError` changes: once per change, after the synchronous work that caused it. Returns the unsubscribe. A listener that throws is ignored. */
  onStateChange(listener:(state:SemanticState,reason:string|null)=>void):()=>void{this.listeners.add(listener);return()=>{this.listeners.delete(listener);};}
  private touch(){if(this.announcing)return;this.announcing=true;queueMicrotask(()=>{this.announcing=false;const {state,lastError}=this.status(),key=state+'\0'+(lastError??'');if(key===this.announced)return;this.announced=key;for(const listener of [...this.listeners])try{listener(state,lastError);}catch{}});}
@@ -254,7 +266,7 @@ export class SemanticRecallController {
   * It is the conversation that left the view only (kind first, no full pass), a heal backoff in progress is not bypassed, and the idle limit applies afterwards. */
  indexAtCut(provider:()=>Snapshot){if(this.enabled&&!this.healTimer&&this.searched&&!this.active){this.active=true;this.armIdle();}this.schedule(provider);}
  private async runtime(project:string){if(this.idling)await this.idling;if(!this.enabled)throw abort();outsideProject(project,this.config!.runtimeRoot,'runtime');outsideProject(project,scratchParent(this.config!),'scratch');outsideRuntime(this.config!.runtimeRoot,scratchParent(this.config!),'scratch');if(this.worker&&this.recycle){const old=this.worker;await old.close();if(this.worker===old){this.worker=undefined;this.identity='';this.recycle=false;}if(!this.enabled)throw abort();}
-  if(!this.worker){const worker=new LocalWorker(this.config!,project,error=>{if(this.worker!==worker)return;this.cleanupError=error instanceof Error?error.message:'Semantic cleanup failed';this.error=this.cleanupError;this.enabled=false;this.generation++;},reason=>{if(this.worker===worker)this.heal(new WorkerFailure(reason));});this.worker=worker;}if(!this.identity){const ready=await this.worker.call('ready');if(ready.dimensions!==768||ready.maxTokens!==8192||!ready.offline)throw new Error('Incompatible semantic model; EG2 768/8192 offline required');this.identity=hash({worker:ready.identity,chunk:'eg2-passage256-focused-disjoint-direct-v3'});}return this.worker;}
+  if(!this.worker){const worker=new LocalWorker(this.config!,project,error=>{if(this.worker!==worker)return;this.cleanupError=error instanceof Error?error.message:'Semantic cleanup failed';this.error=this.cleanupError;this.enabled=false;this.generation++;},reason=>{if(this.worker===worker)this.heal(new WorkerFailure(reason));},{startMs:this.timing.startDeadlineMs??START_DEADLINE_MS,callMs:this.timing.callDeadlineMs??CALL_DEADLINE_MS,embedTextMs:this.timing.embedTextMs??EMBED_TEXT_MS});this.worker=worker;}if(!this.identity){const ready=await this.worker.call('ready');if(ready.dimensions!==768||ready.maxTokens!==8192||!ready.offline)throw new Error('Incompatible semantic model; EG2 768/8192 offline required');this.identity=hash({worker:ready.identity,chunk:'eg2-passage256-focused-disjoint-direct-v3'});}return this.worker;}
  private path(snapshot:Snapshot){const directory=this.config!.indexDirectory;outsideProject(snapshot.project,directory,'index');return join(directory,hash({owner:this.ownerId,session:snapshot.session,project:resolve(snapshot.project)})+'.sqlite');}
  private async index(action:string,snapshot:Snapshot,extra:object={}){const path=this.path(snapshot),generation=this.generation,worker=await this.runtime(snapshot.project);if(!this.enabled||generation!==this.generation)throw abort();if(this.provider)this.recheck(this.provider,snapshot);this.indexFiles.add(path);const result=await worker.call('index',{path,identity:this.identity,action,projectDirectory:snapshot.project,...extra});if(!this.enabled||generation!==this.generation)throw abort();if(this.provider)this.recheck(this.provider,snapshot);return result;}
  private async prepare(provider:()=>Snapshot,full=true){