sweet-search 2.6.9 → 2.6.10

package/README.md

@@ -711,6 +711,21 @@ without you ever running a command.
 - **Resource-polite:** ticks are budgeted (≤50 files / ≤2 s CPU per tick), run CPU-only (the GPU is reserved for cold full indexing), and the interval auto-tunes from load average, churn, and backlog.
 - `sweet-search reconcile status` / `reconcile inspect <path>` explain exactly what the daemon thinks and why. Opt out any time with `SWEET_SEARCH_RECONCILE_V2=0`.
 
+**Memory controls.** The resident daemons show up in `ps` / Activity Monitor as
+`sweet-search-maintainer` and `sweet-search-daemon`. A maintainer's steady state is
+roughly 2–3 GB (embedding + late-interaction models stay loaded so ticks are fast),
+and four independent mechanisms keep that bounded:
+
+| Mechanism | Default | Override |
+|-----------|---------|----------|
+| Background ORT profile (arena-off + parked threads) in the maintainer | on | `SWEET_SEARCH_ORT_BACKGROUND=0` |
+| Per-process recycle ceiling — the maintainer finishes its tick, exits cleanly, and respawns fresh on the next edit when its RSS crosses the line | clamp(25 % of RAM, 4 GiB, 8 GiB) | `SWEET_SEARCH_MAINTAINER_RSS_MAX_MB` (0 disables) |
+| Idle TTL — unattended daemons shut down and respawn on demand | tier-aware | `SWEET_SEARCH_MAINTAINER_IDLE_TTL_MS` / `SWEET_SEARCH_DAEMON_IDLE_TTL_MS` |
+| Fleet RSS budget — across all repos' daemons, the longest-idle one is evicted when the sum crosses a RAM-scaled budget | tier-aware | `SWEET_SEARCH_RSS_BUDGET_FRACTION` |
+
+A recycle or eviction never touches index state: every tick publishes atomically
+before the process exits, and the next edit (or query) respawns a fresh daemon.
+
 </details>
 
 ## 🦀 The Native Engine Room

package/core/cli.js

@@ -94,6 +94,13 @@ if (args[0] === 'init') {
     await runIndexer();
   }
 } else if (args[0] === '--serve' || args[0] === '--stop') {
+  // Name the resident daemon so ps/Activity Monitor shows what it is instead
+  // of an anonymous `node`. Entrypoint-scoped: library consumers of the
+  // search modules are never retitled. Liveness checks are lock/pid-based,
+  // never command-line matching, so this is cosmetic-only.
+  if (args[0] === '--serve') {
+    try { process.title = 'sweet-search-daemon'; } catch { /* best-effort */ }
+  }
   // Warm search server lifecycle is implemented in JS.
   const { runCli } = await import('./search/index.js');
   await runCli(args);

package/core/incremental-indexing/application/production-li-delta.mjs

@@ -117,6 +117,7 @@ export async function applyLateInteractionDelta({
   liEncoder,
   pickLiInput,
   onProgress = null,
+  readerCache = null,
 }) {
   const progress = typeof onProgress === 'function'
     ? (phase) => { onProgress(phase); }
@@ -128,11 +129,35 @@ export async function applyLateInteractionDelta({
   const encode = liEncoder || ((texts) => encodeDocumentsCpu(texts));
   const existing = fs.existsSync(indexPath);
   const segmented = existing ? segmentedState(indexPath) : null;
-  const index = new LateInteractionIndex({ indexPath, loadExisting: true });
-  await index.init();
-  progress('li:init');
+
+  // E.1-LI reader cache: reuse the loaded read view across the tick's files.
+  // Only the SEGMENTED path is cacheable — everything the reader serves there
+  // (config fields, positions/counts of pre-tick docs) is immutable within a
+  // tick: per-file ops only reference the file's own pre-tick docs, appends
+  // go through appendGrowingSegment (which re-reads the manifest from disk),
+  // and tombstone sidecar state is opened fresh per call. The legacy path
+  // MUTATES the loaded index (rewriteLegacyIndex), so it always loads fresh
+  // and drops any cached reader.
+  const cacheable = !!(readerCache && segmented);
+  let index;
+  if (cacheable && readerCache.index && readerCache.key === indexPath) {
+    index = readerCache.index;
+    progress('li:init-cached');
+  } else {
+    index = new LateInteractionIndex({ indexPath, loadExisting: true });
+    await index.init();
+    progress('li:init');
+    if (cacheable) {
+      readerCache.key = indexPath;
+      readerCache.index = index;
+    }
+  }
 
   if (existing && !segmented) {
+    if (readerCache) {
+      readerCache.key = null;
+      readerCache.index = null;
+    }
     return rewriteLegacyIndex(index, ops, encode, pickLiInput, progress);
   }
 

package/core/incremental-indexing/application/production-reconciler.mjs

@@ -419,7 +419,7 @@ class ProductionReconcileAdapter {
       applyGraphDelta: (file, hashes, epoch, ctx) => this.applyGraphDelta(file, hashes, epoch, ctx),
       applyVectorDelta: (file, chunks, hashes, epoch, ctx) => this.applyVectorDelta(file, chunks, hashes, epoch, ctx),
       applyBinaryHNSWDelta: (file, ops, epoch, ctx) => this.applyBinaryHNSWDelta(file, ops, epoch, ctx),
-      applyLIDelta: (file, ops, epoch) => this.applyLIDelta(file, ops, epoch),
+      applyLIDelta: (file, ops, epoch, ctx) => this.applyLIDelta(file, ops, ctx),
       applySparseGramDelta: (file, ops, epoch) => this.applySparseGramDelta(file, ops, epoch),
       readMaintenanceState: () => this.readMaintenanceState(),
       scheduleMaintenance: (job) => enqueueMaintenanceJob(this.stateDir, job),
@@ -1157,7 +1157,7 @@ class ProductionReconcileAdapter {
     return { ops: { binary_hnsw_append: append, binary_hnsw_tombstone: tombstone }, manifest: { path: 'codebase-binary-hnsw.idx' } };
   }
 
-  async applyLIDelta(file, ops) {
+  async applyLIDelta(file, ops, ctx = null) {
     if (!Array.isArray(ops) || ops.length === 0) return { ops: { li_segment_append: 0, li_tombstone: 0 } };
     // LI generated-content parity: full indexing's buildLateInteractionIndex runs
     // applyIndexingChunkPolicy so @generated / config-excluded files never reach
@@ -1170,12 +1170,21 @@ class ProductionReconcileAdapter {
       ? ops.filter((op) => !(op.addId && op.chunk))
       : ops;
     const { applyLateInteractionDelta } = await import('./production-li-delta.mjs');
+    // E.1-LI: tick-scoped READER cache. The per-file delta previously paid a
+    // full loadExisting init (segment manifest + doc positions over a multi-
+    // hundred-MB index) once per file; within one tick the reader view it
+    // needs is stable (per-file ops only reference the file's own pre-tick
+    // docs, appendGrowingSegment re-reads the manifest from disk, and segment
+    // compaction only runs in maintenance after the tick). Null ctx (per-file
+    // path) ⇒ fresh load per file, exactly as before.
+    const readerCache = ctx ? (ctx._liReaderCache ??= { key: null, index: null }) : null;
     const { appended, tombstone } = await applyLateInteractionDelta({
       indexPath: path.join(this.stateDir, 'codebase-late-interaction.db'),
       ops: filteredOps,
       liEncoder: this.liEncoder,
       pickLiInput,
       onProgress: () => this.progress('production:li-delta'),
+      readerCache,
     });
     return { ops: { li_segment_append: appended, li_tombstone: tombstone }, manifest: { path: 'codebase-late-interaction.db', segments: 'codebase-late-interaction.db.segments/manifest.json' } };
   }

package/core/incremental-indexing/application/reconciler.mjs

@@ -461,7 +461,7 @@ export class Reconciler {
     if (bin?.ops?.binary_hnsw_append != null) ops.binary_hnsw_append = bin.ops.binary_hnsw_append;
     if (bin?.ops?.binary_hnsw_tombstone != null) ops.binary_hnsw_tombstone = bin.ops.binary_hnsw_tombstone;
     this.progress('reconciler:li:start');
-    const li = await this.adapters.applyLIDelta?.(file, vec?.tokenOps ?? [], epoch);
+    const li = await this.adapters.applyLIDelta?.(file, vec?.tokenOps ?? [], epoch, tickCtx);
     this.progress('reconciler:li:done');
     collectManifestTier(manifestTiers, 'lateInteraction', li);
     if (li?.ops?.li_segment_append != null) ops.li_segment_append = li.ops.li_segment_append;

package/core/indexing/artifact-builder.js

@@ -52,7 +52,7 @@ export const ARTIFACT_THRESHOLDS = {
   stateFile: '.sweet-search/artifact-rebuild-state.json',
 };
 
-import { BinaryHNSWIndex } from '../vector-store/binary-hnsw-index.js';
+import { BinaryHNSWIndex, int8SidecarCount } from '../vector-store/binary-hnsw-index.js';
 import { truncateForHNSW, fisherYatesShuffle, normalizedFloatToInt8, floatToBinary } from '../infrastructure/quantization.js';
 import { FloatVectorStore, getFloatStorePath } from '../vector-store/float-vector-store.js';
 
@@ -828,8 +828,10 @@ export async function getArtifactStats() {
   if (existsSync(int8SidecarPath)) {
     try {
       const fileStats = await fs.stat(int8SidecarPath);
-      const int8Data = JSON.parse(await fs.readFile(int8SidecarPath, 'utf-8'));
-      const count = Object.keys(int8Data).length;
+      // Header-only count (NDJSON v2 sidecar; v1 back-compat) — never
+      // JSON.parse the whole file, which exceeds V8's string ceiling on
+      // large indexes.
+      const count = await int8SidecarCount(int8SidecarPath);
 
       stats.int8Sidecar = {
         exists: true,

package/core/indexing/index-maintainer.mjs

@@ -1267,12 +1267,14 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
   // Best-effort — never block startup on the embedding module.
   if (process.env.SWEET_SEARCH_ORT_BACKGROUND !== '0') {
     try {
-      const [{ configureLocalModelRuntime }, { backgroundIntraOpThreads }] = await Promise.all([
-        import('../embedding/embedding-local-model.js'),
-        import('../infrastructure/onnx-session-utils.js'),
-      ]);
-      configureLocalModelRuntime({ intraOpThreads: backgroundIntraOpThreads(), background: true });
-      log('INFO', 'ORT background profile armed for maintainer daemon (force_spinning_stop + arena-off + bg threads)');
+      // Arms BOTH resident CPU sessions (dense + late-interaction) — the LI
+      // session previously stayed on the foreground profile (arena ON +
+      // allow_spinning) inside the daemon; measured consequence: 354 × 128MB
+      // arena extensions (~34GB RSS) after one edit-heavy day plus ~40% idle
+      // CPU from spinning workers.
+      const { armBackgroundOrtProfiles } = await import('./model-pool.js');
+      armBackgroundOrtProfiles();
+      log('INFO', 'ORT background profile armed for maintainer daemon (dense + LI: force_spinning_stop + arena-off + bg threads)');
     } catch (err) {
       log('WARN', `ORT background profile arming failed (continuing on foreground profile): ${err?.message ?? err}`);
     }
@@ -1314,15 +1316,30 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
   // system-RAM tier auto-enables a cap (small-RAM hosts). Best-effort, guarded
   // so a missing module is a no-op.
   let rssRegistration = null;
+  // D.5 per-process recycle ceiling: fleet-budget eviction only sheds the
+  // longest-IDLE daemon, so an active maintainer needs its own line. Resolved
+  // once; checked at tick boundaries below. 0 ⇒ disabled.
+  let rssCeiling = { ceilingBytes: 0, minUptimeMs: 0, shouldRecycleForRss: null };
   try {
     const mod = await import('./rss-budget.mjs');
     if (typeof mod.isEnabled === 'function' && mod.isEnabled()
         && typeof mod.registerDaemon === 'function') {
       rssRegistration = await mod.registerDaemon({ pid: process.pid, stateDir: ctx.stateDir, kind: 'maintainer' });
     }
+    if (typeof mod.maintainerRssCeilingBytes === 'function') {
+      rssCeiling = {
+        ceilingBytes: mod.maintainerRssCeilingBytes(),
+        minUptimeMs: mod.maintainerRssMinUptimeMs(),
+        shouldRecycleForRss: mod.shouldRecycleForRss,
+      };
+      if (rssCeiling.ceilingBytes > 0) {
+        log('INFO', `Maintainer RSS recycle ceiling armed: ${(rssCeiling.ceilingBytes / 1048576).toFixed(0)}MB (min uptime ${rssCeiling.minUptimeMs}ms; override SWEET_SEARCH_MAINTAINER_RSS_MAX_MB)`);
+      }
+    }
   } catch (err) {
     log('WARN', `RSS-budget registry unavailable (no soft cap on this daemon): ${err?.message ?? err}`);
   }
+  let completedTicks = 0;
 
   // D.1 idle-TTL: an unattended maintainer self-shuts-down after the configured
   // wall-clock idle budget so N resident model-loaded daemons collapse to 1–2
@@ -1432,6 +1449,23 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
             maintenanceBacklog: backlog,
             skipped: tickCounters?.skipped === true,
           });
+          // D.5: per-process RSS recycle check — tick boundary only (the tick
+          // above has published; a recycle here can never tear an artifact).
+          completedTicks += 1;
+          if (rssCeiling.ceilingBytes > 0 && typeof rssCeiling.shouldRecycleForRss === 'function') {
+            const rssNow = process.memoryUsage.rss();
+            const verdict = rssCeiling.shouldRecycleForRss({
+              rssBytes: rssNow,
+              ceilingBytes: rssCeiling.ceilingBytes,
+              uptimeMs: process.uptime() * 1000,
+              minUptimeMs: rssCeiling.minUptimeMs,
+              ticksCompleted: completedTicks,
+            });
+            if (verdict.recycle) {
+              log('WARN', `Maintainer RSS ${(rssNow / 1048576).toFixed(0)}MB exceeds recycle ceiling ${(rssCeiling.ceilingBytes / 1048576).toFixed(0)}MB; requesting clean shutdown for on-demand respawn. If this repeats right after startup, raise SWEET_SEARCH_MAINTAINER_RSS_MAX_MB.`);
+              shutdownRequested = true;
+            }
+          }
         } catch (err) {
           if (err instanceof MaintainerLifecycleAbort) {
             log('WARN', `Reconcile v2 lifecycle abort: ${err.message}. Cleaning up cancellation-orphaned temps and exiting cleanly.`);
@@ -1457,6 +1491,10 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
           log('ERROR', `Reconcile v2 tick failed: ${err?.message ?? err}`);
         }
       }
+      // Skip the sleep when a shutdown was requested during this iteration
+      // (idle-TTL, signal, or D.5 RSS recycle) — exit promptly instead of
+      // waiting out one more interval.
+      if (shutdownRequested) break;
       await sleepWithProgress(intervalMs, lock.lockFile, {
         // G6 early-wake: break the sleep the instant the watcher reports new
         // events so a fresh edit is reconciled without waiting out the interval.
@@ -2482,6 +2520,11 @@ async function main() {
   const dryRun = process.argv.includes('--dry-run');
   const merkleOnce = process.argv.includes('--merkle-once');
 
+  // Name the resident daemon so ps/Activity Monitor shows what it is instead
+  // of an anonymous `node`. Cosmetic-only: all liveness/takeover checks are
+  // lock/pid-based, never command-line matching.
+  try { process.title = 'sweet-search-maintainer'; } catch { /* best-effort */ }
+
   // A.1 (Tier-1, UNGATED): demote the maintainer daemon to low OS priority so
   // the foreground (editor / git / shell) never feels the background indexer's
   // CPU. Identical index output — only *when* CPU is granted changes. Covers

package/core/indexing/model-pool.js

@@ -29,12 +29,15 @@ import {
   getLocalPipeline,
   callLocalModelCpu,
   unloadLocalModel,
+  configureLocalModelRuntime,
 } from '../embedding/embedding-local-model.js';
 import {
   getLateInteractionPipeline,
   encodeDocumentsCpu,
   unloadLateInteractionModel,
+  configureLateInteractionRuntime,
 } from '../ranking/late-interaction-model.js';
+import { backgroundIntraOpThreads } from '../infrastructure/onnx-session-utils.js';
 
 /**
  * Small-changeset threshold. Incremental runs with fewer files than this use
@@ -69,6 +72,29 @@ export function selectAcceleratorDeviceKind(pref) {
   return null;
 }
 
+/**
+ * G3: arm the BACKGROUND/maintainer ORT profile for BOTH resident CPU
+ * sessions — dense (embedding-local-model) and late-interaction. The profile
+ * (force_spinning_stop + arena-off + 2–4 intra-op threads) prevents the two
+ * resident-daemon pathologies: idle spinning workers (~a core of idle CPU)
+ * and monotonic RSS from ORT arena extension (#25325; measured 354 × 128MB
+ * ≈ 34GB after one edit-heavy day when the LI session was left on the
+ * foreground profile). MUST run before the first encode — both session
+ * singletons are built once; configuring after is a silent no-op.
+ *
+ * Lives here (model-pool owns indexing-side model lifecycle) so daemon
+ * entrypoints don't need their own cross-context imports of the two model
+ * modules.
+ *
+ * @returns {{armed: boolean}}
+ */
+export function armBackgroundOrtProfiles() {
+  const intraOpThreads = backgroundIntraOpThreads();
+  configureLocalModelRuntime({ intraOpThreads, background: true });
+  configureLateInteractionRuntime({ intraOpThreads, background: true });
+  return { armed: true };
+}
+
 /**
  * Whether this process can use an inference accelerator (Metal / CoreML
  * cascade / CUDA) for indexing. Requires both accelerator-capable hardware

package/core/indexing/rss-budget.mjs

@@ -112,6 +112,71 @@ export function isOverBudget(totalRssBytes, budgetBytesValue) {
   );
 }
 
+// =============================================================================
+// D.5: per-process maintainer RSS recycle ceiling
+// =============================================================================
+//
+// The fleet budget above evicts the longest-IDLE daemon, so a single fat
+// ACTIVE maintainer can legitimately ride up to the whole fleet budget
+// (~76 GB on a 128 GB host) — measured in the wild when a session-config
+// regression left the LI ORT session on the foreground arena profile
+// (354 × 128MB arena extensions ≈ 34 GB RSS). This ceiling is the
+// per-process backstop: when the maintainer's OWN rss crosses the line at a
+// tick boundary, it requests the same graceful shutdown the idle-TTL uses
+// (finish tick, publish, release lock, exit). The O_EXCL launch trigger
+// respawns a fresh few-hundred-MB process on the next dirty event, so the
+// index is unchanged — exit-to-reclaim is already the sanctioned way to
+// return ORT memory (#25325).
+//
+// Guards against restart-thrash:
+//   - at least one COMPLETED tick (never abort startup work),
+//   - minimum uptime (default 10 min ⇒ worst case 6 recycles/hour even when
+//     the ceiling is misconfigured below the resident floor — visible via
+//     the per-recycle WARN, which names the env knob to raise).
+//
+// Measured anchors (2026-07-03, arena-off profile): steady floor ~2.7-2.9 GB
+// on a mid-size repo, encode-active peaks ~4.7 GB — hence the 4 GiB default
+// floor and 8 GiB cap.
+
+const MAINTAINER_RSS_CEILING_FRACTION = 0.25;
+const MAINTAINER_RSS_CEILING_MIN_BYTES = 4 * 1024 * 1024 * 1024;  // 4 GiB
+const MAINTAINER_RSS_CEILING_MAX_BYTES = 8 * 1024 * 1024 * 1024;  // 8 GiB
+const MAINTAINER_RSS_MIN_UPTIME_MS_DEFAULT = 10 * 60 * 1000;      // 10 min
+
+/**
+ * Resolve the per-process maintainer RSS ceiling in bytes.
+ * `SWEET_SEARCH_MAINTAINER_RSS_MAX_MB` set: explicit MB value; 0/garbage
+ * disables (returns 0). Unset: clamp(25% of RAM, 4 GiB, 8 GiB).
+ */
+export function maintainerRssCeilingBytes(env = process.env, totalMem = os.totalmem()) {
+  const raw = env.SWEET_SEARCH_MAINTAINER_RSS_MAX_MB;
+  if (raw != null && raw !== '') {
+    const mb = Number(raw);
+    if (!Number.isFinite(mb) || mb <= 0) return 0;
+    return Math.floor(mb * 1024 * 1024);
+  }
+  const scaled = Math.floor(totalMem * MAINTAINER_RSS_CEILING_FRACTION);
+  return Math.min(MAINTAINER_RSS_CEILING_MAX_BYTES, Math.max(MAINTAINER_RSS_CEILING_MIN_BYTES, scaled));
+}
+
+/** Minimum uptime before an RSS recycle may fire. */
+export function maintainerRssMinUptimeMs(env = process.env) {
+  const raw = Number(env.SWEET_SEARCH_MAINTAINER_RSS_MIN_UPTIME_MS);
+  return Number.isFinite(raw) && raw >= 0 ? raw : MAINTAINER_RSS_MIN_UPTIME_MS_DEFAULT;
+}
+
+/**
+ * Pure recycle decision — evaluated at tick boundaries only.
+ * @returns {{recycle: boolean, reason: string}}
+ */
+export function shouldRecycleForRss({ rssBytes, ceilingBytes, uptimeMs, minUptimeMs, ticksCompleted }) {
+  if (!Number.isFinite(ceilingBytes) || ceilingBytes <= 0) return { recycle: false, reason: 'disabled' };
+  if (!Number.isFinite(rssBytes) || rssBytes <= ceilingBytes) return { recycle: false, reason: 'under-ceiling' };
+  if (!(ticksCompleted >= 1)) return { recycle: false, reason: 'no-completed-tick' };
+  if (!(uptimeMs >= minUptimeMs)) return { recycle: false, reason: 'min-uptime' };
+  return { recycle: true, reason: 'over-ceiling' };
+}
+
 /**
  * Read the resident-set size (bytes) of an arbitrary pid, best-effort and
  * cross-platform. Returns a non-negative integer, or 0 when unknown (dead pid,

package/core/ranking/late-interaction-model.js

@@ -26,6 +26,18 @@ let lateInteractionPipeline = null;
 let loadPromise = null;
 let lateInteractionRuntimeConfig = {
   intraOpThreads: null,
+  // G3-LI: background/maintainer ORT profile for the LI session. When truthy,
+  // the session is created with the CPU mem arena OFF and force_spinning_stop
+  // instead of allow_spinning — the same profile buildLocalSessionOptions
+  // applies to the dense session. ORT never returns arena memory once grown
+  // (#25325), and per-file reconcile encodes produce highly variable batch
+  // shapes, so an arena-ON LI session in the resident maintainer accrues
+  // monotonic RSS in 128MB arena-extension steps (measured: 354×128MB ≈ 34GB
+  // after one heavy edit day). Must be set BEFORE the first encode — the
+  // session singleton is built once; configuring after is a silent no-op.
+  // Default null/off everywhere else (search/query path keeps the foreground
+  // arena+spinning profile for latency).
+  background: null,
 };
 
 // Lightweight timing accumulators for profiling (Phase 6a).
@@ -90,6 +102,7 @@ export function configureLateInteractionRuntime(overrides = {}) {
 export function resetLateInteractionRuntime() {
   lateInteractionRuntimeConfig = {
     intraOpThreads: null,
+    background: null,
   };
 }
 
@@ -191,18 +204,26 @@ async function loadModel() {
   // 'extended' + memArena + memPattern: marginal overhead for no measurable gain.
   // Conclusion: keep LI session lean. Only proven-beneficial options added.
   const { getOptimizedGraphPath } = await import('../infrastructure/onnx-session-utils.js');
+  const liBackground = !!lateInteractionRuntimeConfig.background;
   const session = await ort.InferenceSession.create(onnxPath, {
     executionProviders: ['cpu'],
     logSeverityLevel: 3, // ERROR — silence ORT's expected "optimized model is machine-specific" warning
     intraOpNumThreads: lateInteractionRuntimeConfig.intraOpThreads ?? bestIntraOpThreads(),
     interOpNumThreads: 1,
     optimizedModelFilePath: getOptimizedGraphPath(modelConfig.hfId, 'lateon'),
+    // G3-LI: background (maintainer) profile disables the CPU mem arena — ORT
+    // never returns arena memory once grown (#25325), and variable-shaped
+    // per-file reconcile batches make the arena extend monotonically (128MB
+    // steps) in a resident daemon. Foreground keeps the arena for throughput.
+    enableCpuMemArena: !liBackground,
     // Thread spinning keeps ORT worker threads hot between batches — trades idle
-    // CPU for lower per-batch latency during sustained indexing runs.
+    // CPU for lower per-batch latency during sustained indexing runs. The
+    // background profile parks workers after the last Run() instead (the
+    // maintainer sits idle 20-60s between ticks; ~14% re-spin latency cost).
     extra: {
-      session: {
-        intra_op: { allow_spinning: '1' },
-      },
+      session: liBackground
+        ? { force_spinning_stop: '1' }
+        : { intra_op: { allow_spinning: '1' } },
     },
   });
   const coremlActive = false;

package/core/vector-store/binary-hnsw-index.js

@@ -11,8 +11,8 @@
  * CANONICAL INT8 STORAGE (Workstream H resolution):
  *   Int8 vectors for stage-2 rescoring are stored in this index's .int8.json sidecar.
  *   This file is saved/loaded alongside the binary HNSW index artifacts.
- *   - save(): Writes .int8.json with { id: Int8Array[], ... } format
- *   - load(): Populates this.int8Vectors Map from .int8.json
+ *   - save(): Writes .int8.json (NDJSON v2: header line + one {id, v} per line)
+ *   - load(): Populates this.int8Vectors Map from .int8.json (v1 back-compat)
  *   - getInt8Vector(id): O(1) lookup used by sweet-search.js during stage-2
  *
  *   This is the ONLY source of int8 vectors. The SQLite approach (codebase-int8.db)
@@ -28,9 +28,11 @@
 
 import fs from 'fs/promises';
 import {
-  existsSync, statSync,
+  existsSync, statSync, readFileSync,
   openSync, readSync, closeSync, fstatSync,
+  createWriteStream, createReadStream,
 } from 'fs';
+import readline from 'readline';
 import path from 'path';
 import { BINARY_HNSW_CONFIG, DB_PATHS } from '../infrastructure/config/index.js';
 import {
@@ -53,11 +55,12 @@ const PIPELINE_VERSION = 2;
 //
 // The default on-disk format is the JSON sidecar tuple
 // (.meta.json / .vectors.json / .graph.json / .int8.json / .calibration.json),
-// written by save() and read by load(). That format is preserved BYTE-FOR-BYTE
-// when SWEET_SEARCH_HNSW_MMAP !== '1' — this whole subsystem is inert by
-// default. Existing on-disk indexes (the 200 bench repos) keep loading via the
-// JSON path regardless of the flag: format is detected by inspecting the .idx
-// file's magic header (`_indexFormatOnDisk`), never by the flag.
+// written by save() and read by load() — the big sidecars as NDJSON v2 with
+// v1 read back-compat (see the sidecar-format block below). This whole mmap
+// subsystem is inert when SWEET_SEARCH_HNSW_MMAP !== '1'. Existing on-disk
+// indexes (the 200 bench repos) keep loading via the JSON path regardless of
+// the flag: format is detected by inspecting the .idx file's magic header
+// (`_indexFormatOnDisk`), never by the flag.
 //
 // When SWEET_SEARCH_HNSW_MMAP === '1', NEWLY written indexes are packed into a
 // single flat-binary `.idx` file (magic-prefixed) whose vectors / graph
@@ -202,6 +205,276 @@ function makeMmapVectorProxy(store) {
   });
 }
 
+// =============================================================================
+// NDJSON SIDECAR FORMAT (v2)
+// =============================================================================
+//
+// The big JSON sidecars (.vectors.json / .graph.json / .int8.json) used to be
+// written with one monolithic JSON.stringify. Past ~500k vectors that single
+// string crosses V8's ~512 MB ceiling and save() dies with "Invalid string
+// length" (libsql: 637,550 vectors) — the same failure mode the LI alias
+// sidecar hit, fixed the same way in 2.6.9. Cure: NDJSON v2 — one
+// {version:2,...} header line, then one record per line, flushed through a
+// write stream in bounded batches so no serialized string ever approaches the
+// ceiling. .meta.json / .calibration.json stay monolithic JSON (O(1)-sized).
+//
+// Back-compat: a v1 sidecar is a single line holding the whole payload, and
+// any v1 file on disk was produced by a JSON.stringify that SUCCEEDED — so it
+// fits back into one string, and the line-streaming readers handle it as
+// "first line IS the payload". Format is detected from the first line, never
+// from config, so old and new indexes coexist with zero migration.
+//
+// Truncation guard: NDJSON cut at a line boundary (crash mid-write, disk
+// full) is valid prefix NDJSON and would otherwise load a silent subset, so
+// every v2 reader enforces the header's record count and throws on mismatch —
+// callers route that to the rebuild path like any other corrupt artifact.
+// (The tmp+rename publish in save() makes this unreachable in normal
+// operation; the guard covers torn tmp files that somehow got renamed.)
+
+const NDJSON_LINE_BATCH = 20000;
+// Graph chunk lines are ~MB-sized, so batch flushes are bounded by chars too.
+const NDJSON_CHAR_BATCH = 8 * 1024 * 1024;
+const GRAPH_CHUNK_NODES = 10000;
+
+async function writeNdjsonSidecar(filePath, header, records) {
+  const ws = createWriteStream(filePath, { encoding: 'utf8' });
+  const finished = new Promise((resolve, reject) => {
+    ws.on('error', reject);
+    ws.on('finish', resolve);
+  });
+  const flush = (str) => new Promise((resolve, reject) => {
+    ws.write(str, (err) => (err ? reject(err) : resolve()));
+  });
+  try {
+    let lines = [JSON.stringify(header)];
+    let chars = lines[0].length;
+    for (const record of records) {
+      const line = JSON.stringify(record);
+      lines.push(line);
+      chars += line.length;
+      if (lines.length >= NDJSON_LINE_BATCH || chars >= NDJSON_CHAR_BATCH) {
+        await flush(lines.join('\n') + '\n');
+        lines = [];
+        chars = 0;
+      }
+    }
+    if (lines.length > 0) await flush(lines.join('\n') + '\n');
+    ws.end();
+    await finished;
+  } catch (err) {
+    finished.catch(() => { /* surfaced via throw below */ });
+    ws.destroy();
+    throw err;
+  }
+}
+
+// Yields one parsed JSON document per non-empty line. The input stream is
+// destroyed in `finally`: early exits abandon the readline iterator, and
+// rl.close() does NOT destroy its input — without the explicit destroy every
+// early return leaks an fd (fatal only in long-lived processes like the
+// daemon, but a leak everywhere).
+async function* iterateJsonLines(filePath) {
+  const input = createReadStream(filePath, { encoding: 'utf8' });
+  const rl = readline.createInterface({ input, crlfDelay: Infinity });
+  try {
+    for await (const line of rl) {
+      if (!line) continue;
+      yield JSON.parse(line);
+    }
+  } finally {
+    rl.close();
+    input.destroy();
+  }
+}
+
+function isV2Header(doc) {
+  return !!doc && !Array.isArray(doc) && doc.version === 2 && Number.isFinite(doc.count);
+}
+
+export async function readVectorsSidecar(vectorsPath) {
+  let header = null;
+  let first = true;
+  const entries = [];
+  for await (const doc of iterateJsonLines(vectorsPath)) {
+    if (first) {
+      first = false;
+      if (Array.isArray(doc)) return doc; // v1 — the whole payload is this line
+      if (!isV2Header(doc)) {
+        throw new Error(`BinaryHNSW: unrecognized vectors sidecar format: ${vectorsPath}`);
+      }
+      header = doc;
+      continue;
+    }
+    entries.push(doc);
+  }
+  if (!header) {
+    throw new Error(`BinaryHNSW: empty vectors sidecar: ${vectorsPath}`);
+  }
+  if (entries.length !== header.count) {
+    throw new Error(
+      `BinaryHNSW: truncated vectors sidecar (${entries.length}/${header.count} records): ${vectorsPath}`
+    );
+  }
+  return entries;
+}
+
+// Graph v2 records tile each level's node array in fixed-size chunks. Holes in
+// the (sparse) upper-level arrays serialize to null inside a chunk, matching
+// what JSON.parse produced for the v1 whole-array format.
+function* graphChunkRecords(graph) {
+  for (let level = 0; level < graph.length; level++) {
+    const nodes = graph[level];
+    for (let start = 0; start < nodes.length; start += GRAPH_CHUNK_NODES) {
+      yield { level, start, nodes: nodes.slice(start, start + GRAPH_CHUNK_NODES) };
+    }
+  }
+}
+
+function graphChunkCount(graph) {
+  let count = 0;
+  for (const nodes of graph) count += Math.ceil(nodes.length / GRAPH_CHUNK_NODES);
+  return count;
+}
+
+export async function readGraphSidecar(graphPath) {
+  let header = null;
+  let first = true;
+  let graph = null;
+  let parsed = 0;
+  for await (const doc of iterateJsonLines(graphPath)) {
+    if (first) {
+      first = false;
+      if (Array.isArray(doc)) return doc; // v1 — the whole payload is this line
+      if (!doc || doc.version !== 2 || !Array.isArray(doc.lengths) || !Number.isFinite(doc.chunks)) {
+        throw new Error(`BinaryHNSW: unrecognized graph sidecar format: ${graphPath}`);
+      }
+      header = doc;
+      graph = doc.lengths.map((len) => new Array(len).fill(null));
+      continue;
+    }
+    const target = graph[doc.level];
+    for (let i = 0; i < doc.nodes.length; i++) {
+      target[doc.start + i] = doc.nodes[i];
+    }
+    parsed++;
+  }
+  if (!header) {
+    throw new Error(`BinaryHNSW: empty graph sidecar: ${graphPath}`);
+  }
+  if (parsed !== header.chunks) {
+    throw new Error(
+      `BinaryHNSW: truncated graph sidecar (${parsed}/${header.chunks} chunks): ${graphPath}`
+    );
+  }
+  return graph;
+}
+
+export async function readInt8Sidecar(int8Path, out) {
+  let header = null;
+  let first = true;
+  let parsed = 0;
+  for await (const doc of iterateJsonLines(int8Path)) {
+    if (first) {
+      first = false;
+      if (!isV2Header(doc)) {
+        // v1 — the whole { id: number[] } map is this line. A v1 map can never
+        // look like a v2 header: its values are arrays, so doc.version is
+        // either undefined or a number[] and fails isV2Header.
+        for (const [id, vec] of Object.entries(doc || {})) {
+          out.set(id, new Int8Array(vec));
+        }
+        return;
+      }
+      header = doc;
+      continue;
+    }
+    out.set(doc.id, new Int8Array(doc.v));
+    parsed++;
+  }
+  if (header && parsed !== header.count) {
+    throw new Error(
+      `BinaryHNSW: truncated int8 sidecar (${parsed}/${header.count} records): ${int8Path}`
+    );
+  }
+}
+
+// Entry count without materializing the payload: v2 reads only the header
+// line; v1 (single line = whole map) is parsed from that same first line.
+// Used by diagnostics (getArtifactStats) so stats never re-load the index.
+export async function int8SidecarCount(int8Path) {
+  for await (const doc of iterateJsonLines(int8Path)) {
+    return isV2Header(doc) ? doc.count : Object.keys(doc || {}).length;
+  }
+  return 0;
+}
+
+// ---------------------------------------------------------------------------
+// Sync sidecar readers — TOOLING ONLY (soak probes, determinism dumps).
+// These readFileSync the whole file, so they inherit the very string ceiling
+// the streaming readers exist to avoid; fine at tool-corpus scale, never for
+// production-scale indexes. Same v1/v2 detection and truncation guards.
+// ---------------------------------------------------------------------------
+
+function parseSidecarLinesSync(filePath) {
+  return readFileSync(filePath, 'utf-8')
+    .split('\n')
+    .filter((l) => l.length > 0)
+    .map((l) => JSON.parse(l));
+}
+
+export function readVectorsSidecarSync(vectorsPath) {
+  const docs = parseSidecarLinesSync(vectorsPath);
+  if (Array.isArray(docs[0])) return docs[0]; // v1
+  if (!isV2Header(docs[0])) {
+    throw new Error(`BinaryHNSW: unrecognized vectors sidecar format: ${vectorsPath}`);
+  }
+  const entries = docs.slice(1);
+  if (entries.length !== docs[0].count) {
+    throw new Error(
+      `BinaryHNSW: truncated vectors sidecar (${entries.length}/${docs[0].count} records): ${vectorsPath}`
+    );
+  }
+  return entries;
+}
+
+export function readGraphSidecarSync(graphPath) {
+  const docs = parseSidecarLinesSync(graphPath);
+  if (Array.isArray(docs[0])) return docs[0]; // v1
+  const header = docs[0];
+  if (!header || header.version !== 2 || !Array.isArray(header.lengths) || !Number.isFinite(header.chunks)) {
+    throw new Error(`BinaryHNSW: unrecognized graph sidecar format: ${graphPath}`);
+  }
+  if (docs.length - 1 !== header.chunks) {
+    throw new Error(
+      `BinaryHNSW: truncated graph sidecar (${docs.length - 1}/${header.chunks} chunks): ${graphPath}`
+    );
+  }
+  const graph = header.lengths.map((len) => new Array(len).fill(null));
+  for (const rec of docs.slice(1)) {
+    const target = graph[rec.level];
+    for (let i = 0; i < rec.nodes.length; i++) {
+      target[rec.start + i] = rec.nodes[i];
+    }
+  }
+  return graph;
+}
+
+// Returns the v1-shaped plain object { id: number[] } for both formats.
+export function readInt8SidecarSync(int8Path) {
+  const docs = parseSidecarLinesSync(int8Path);
+  if (docs.length === 0) return {};
+  if (!isV2Header(docs[0])) return docs[0] || {}; // v1 — whole map on one line
+  const records = docs.slice(1);
+  if (records.length !== docs[0].count) {
+    throw new Error(
+      `BinaryHNSW: truncated int8 sidecar (${records.length}/${docs[0].count} records): ${int8Path}`
+    );
+  }
+  const out = {};
+  for (const rec of records) out[rec.id] = rec.v;
+  return out;
+}
+
 // =============================================================================
 // BINARY HNSW INDEX CLASS
 // =============================================================================
@@ -1070,12 +1343,6 @@ export class BinaryHNSWIndex {
       savedAt: new Date().toISOString(),
     };
 
-    const vectorsData = this.vectors.map(v => ({
-      id: v.id,
-      binary: Array.from(v.binary),
-      metadata: v.metadata,
-    }));
-
     const metaPath = indexPath.replace('.idx', '.meta.json');
     const vectorsPath = indexPath.replace('.idx', '.vectors.json');
     const graphPath = indexPath.replace('.idx', '.graph.json');
@@ -1083,21 +1350,53 @@ export class BinaryHNSWIndex {
     const calibPath = indexPath.replace('.idx', '.calibration.json');
     const pidSuffix = `.tmp.${process.pid}`;
 
-    // Stage all sidecars to sibling temp paths.
+    // Stage all sidecars to sibling temp paths. The big three are NDJSON v2
+    // (see the sidecar-format block above the class) — one record per line
+    // through a write stream — so no serialized string can cross V8's ceiling
+    // on large indexes. Records are yielded lazily so no whole-index
+    // intermediate array/object is materialized either.
     await fs.writeFile(metaPath + pidSuffix, JSON.stringify(meta, null, 2));
-    await fs.writeFile(vectorsPath + pidSuffix, JSON.stringify(vectorsData));
-    await fs.writeFile(graphPath + pidSuffix, JSON.stringify(this.graph));
+
+    const vectors = this.vectors;
+    await writeNdjsonSidecar(
+      vectorsPath + pidSuffix,
+      { version: 2, count: vectors.length },
+      (function* () {
+        for (const v of vectors) {
+          yield { id: v.id, binary: Array.from(v.binary), metadata: v.metadata };
+        }
+      })()
+    );
+
+    await writeNdjsonSidecar(
+      graphPath + pidSuffix,
+      {
+        version: 2,
+        lengths: this.graph.map((nodes) => nodes.length),
+        chunks: graphChunkCount(this.graph),
+      },
+      graphChunkRecords(this.graph)
+    );
 
     let stagedInt8 = false;
     if (this.int8Vectors.size > 0) {
       const liveIds = new Set(this.vectors.map(v => v.id));
-      const int8Data = {};
-      for (const [id, vec] of this.int8Vectors) {
-        if (!liveIds.has(id)) continue;
-        int8Data[id] = Array.from(vec);
+      let liveCount = 0;
+      for (const id of this.int8Vectors.keys()) {
+        if (liveIds.has(id)) liveCount++;
       }
-      if (Object.keys(int8Data).length > 0) {
-        await fs.writeFile(int8Path + pidSuffix, JSON.stringify(int8Data));
+      if (liveCount > 0) {
+        const int8Vectors = this.int8Vectors;
+        await writeNdjsonSidecar(
+          int8Path + pidSuffix,
+          { version: 2, count: liveCount },
+          (function* () {
+            for (const [id, vec] of int8Vectors) {
+              if (!liveIds.has(id)) continue;
+              yield { id, v: Array.from(vec) };
+            }
+          })()
+        );
         stagedInt8 = true;
       }
     }
@@ -1183,7 +1482,7 @@ export class BinaryHNSWIndex {
     let attempt = 0;
     while (true) {
       meta = attempt === 0 ? initialMeta : JSON.parse(await fs.readFile(metaPath, 'utf-8'));
-      vectorsData = JSON.parse(await fs.readFile(vectorsPath, 'utf-8'));
+      vectorsData = await readVectorsSidecar(vectorsPath);
       const consistent = meta.vectorCount === vectorsData.length
         && (meta.entryPoint === -1 || meta.entryPoint < vectorsData.length);
       if (consistent) break;
@@ -1224,15 +1523,12 @@ export class BinaryHNSWIndex {
     }
 
     // Load graph
-    this.graph = JSON.parse(await fs.readFile(graphPath, 'utf-8'));
+    this.graph = await readGraphSidecar(graphPath);
 
     // Load int8 vectors if available
     this.int8Vectors.clear();
     if (existsSync(int8Path)) {
-      const int8Data = JSON.parse(await fs.readFile(int8Path, 'utf-8'));
-      for (const [id, vec] of Object.entries(int8Data)) {
-        this.int8Vectors.set(id, new Int8Array(vec));
-      }
+      await readInt8Sidecar(int8Path, this.int8Vectors);
     }
 
     // Load asymmetric calibration data

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sweet-search",
-  "version": "2.6.9",
+  "version": "2.6.10",
   "description": "Sweet Search - SOTA Hybrid Code Search Engine with WASM CatBoost Query Router, Semantic/Lexical/Structural Search, and Multilingual Support",
   "type": "module",
   "main": "core/search/sweet-search.js",
@@ -167,13 +167,13 @@
     "vitest": "^4.0.16"
   },
   "optionalDependencies": {
-    "@sweet-search/native-darwin-arm64": "2.6.9",
-    "@sweet-search/native-darwin-x64": "2.6.9",
-    "@sweet-search/native-linux-arm64-gnu": "2.6.9",
-    "@sweet-search/native-linux-arm64-gnu-cuda": "2.6.9",
-    "@sweet-search/native-linux-x64-gnu": "2.6.9",
-    "@sweet-search/native-linux-x64-gnu-cuda": "2.6.9",
-    "@sweet-search/bg-priority": "2.6.9"
+    "@sweet-search/native-darwin-arm64": "2.6.10",
+    "@sweet-search/native-darwin-x64": "2.6.10",
+    "@sweet-search/native-linux-arm64-gnu": "2.6.10",
+    "@sweet-search/native-linux-arm64-gnu-cuda": "2.6.10",
+    "@sweet-search/native-linux-x64-gnu": "2.6.10",
+    "@sweet-search/native-linux-x64-gnu-cuda": "2.6.10",
+    "@sweet-search/bg-priority": "2.6.10"
   },
   "engines": {
     "node": ">=18.0.0"