sweet-search 2.6.9 → 2.6.11

package/README.md

@@ -711,6 +711,21 @@ without you ever running a command.
 - **Resource-polite:** ticks are budgeted (≤50 files / ≤2 s CPU per tick), run CPU-only (the GPU is reserved for cold full indexing), and the interval auto-tunes from load average, churn, and backlog.
 - `sweet-search reconcile status` / `reconcile inspect <path>` explain exactly what the daemon thinks and why. Opt out any time with `SWEET_SEARCH_RECONCILE_V2=0`.
 
+**Memory controls.** The resident daemons show up in `ps` / Activity Monitor as
+`sweet-search-maintainer` and `sweet-search-daemon`. A maintainer's steady state is
+roughly 2–3 GB (embedding + late-interaction models stay loaded so ticks are fast),
+and four independent mechanisms keep that bounded:
+
+| Mechanism | Default | Override |
+|-----------|---------|----------|
+| Background ORT profile (arena-off + parked threads) in the maintainer | on | `SWEET_SEARCH_ORT_BACKGROUND=0` |
+| Per-process recycle ceiling — the maintainer finishes its tick, exits cleanly, and respawns fresh on the next edit when its RSS crosses the line | clamp(25 % of RAM, 4 GiB, 8 GiB) | `SWEET_SEARCH_MAINTAINER_RSS_MAX_MB` (0 disables) |
+| Idle TTL — unattended daemons shut down and respawn on demand | tier-aware | `SWEET_SEARCH_MAINTAINER_IDLE_TTL_MS` / `SWEET_SEARCH_DAEMON_IDLE_TTL_MS` |
+| Fleet RSS budget — across all repos' daemons, the longest-idle one is evicted when the sum crosses a RAM-scaled budget | tier-aware | `SWEET_SEARCH_RSS_BUDGET_FRACTION` |
+
+A recycle or eviction never touches index state: every tick publishes atomically
+before the process exits, and the next edit (or query) respawns a fresh daemon.
+
 </details>
 
 ## 🦀 The Native Engine Room

package/core/cli.js

@@ -94,6 +94,13 @@ if (args[0] === 'init') {
     await runIndexer();
   }
 } else if (args[0] === '--serve' || args[0] === '--stop') {
+  // Name the resident daemon so ps/Activity Monitor shows what it is instead
+  // of an anonymous `node`. Entrypoint-scoped: library consumers of the
+  // search modules are never retitled. Liveness checks are lock/pid-based,
+  // never command-line matching, so this is cosmetic-only.
+  if (args[0] === '--serve') {
+    try { process.title = 'sweet-search-daemon'; } catch { /* best-effort */ }
+  }
   // Warm search server lifecycle is implemented in JS.
   const { runCli } = await import('./search/index.js');
   await runCli(args);

package/core/graph/graph-expansion.js

@@ -249,6 +249,18 @@ const TYPE_BOOST = {
   struct: 1.2,
 };
 
+/**
+ * Fetch int8 vectors for many ids with ONE stale-bitmap snapshot when the
+ * index supports it (BinaryHNSWIndex.getInt8VectorsForIds); falls back to
+ * per-id lookups for index doubles that only expose getInt8Vector.
+ */
+function batchInt8Vectors(hnswIndex, ids) {
+  if (typeof hnswIndex.getInt8VectorsForIds === 'function') {
+    return hnswIndex.getInt8VectorsForIds(ids);
+  }
+  return ids.map((id) => hnswIndex.getInt8Vector(id));
+}
+
 function clampSemanticWeight(value) {
   if (!Number.isFinite(value)) return 0.4;
   return Math.max(0, Math.min(1, value));
@@ -614,21 +626,27 @@ export function expandSecondHop(db, seedIds, expanded, edgeTypes, options = {})
   }
 
   const excluded = new Set([...seedIds, ...expanded.keys()]);
-  const candidates = [];
+  const eligible = [];
   for (const rel of hop2Forward) {
     if (!edgeTypes.has(rel.type) || excluded.has(rel.target_id)) continue;
 
     const hop1Entry = expanded.get(rel.source_id);
     const hop1Score = hop1Entry?.score ?? 1;  // identity: preserves old edgePriority × weight
     const graphScore = hop1Score * (EDGE_PRIORITY[rel.type] || 1) * (rel.weight || 1.0);
+    eligible.push({ rel, graphScore });
+  }
+  // Batch int8 lookup: one stale-bitmap snapshot for all targets instead of
+  // one stat per target.
+  const eligibleInt8 = batchInt8Vectors(hnswIndex, eligible.map((e) => e.rel.target_id));
+  const candidates = eligible.map((e, i) => {
+    const entityInt8 = eligibleInt8[i];
     let normSim = null;
-    const entityInt8 = hnswIndex.getInt8Vector(rel.target_id);
     if (entityInt8) {
       const cosSim = cosineSimilarity(queryInt8, entityInt8);
       normSim = (cosSim + 1) / 2;
     }
-    candidates.push({ rel, graphScore, normSim });
-  }
+    return { rel: e.rel, graphScore: e.graphScore, normSim };
+  });
 
   if (candidates.length === 0) return;
   const normalizedGraphScores = normalizeMinMax(candidates.map(c => c.graphScore));
@@ -729,6 +747,25 @@ export function expandSecondHopAdaptive(db, seedIds, hop1Expanded, edgeTypes, op
   const vectorCache = semanticEnabled ? new Map() : null;
   const scoredCandidates = [];
 
+  // Pre-seed the vector cache with ONE batched int8 fetch (single
+  // stale-bitmap snapshot) so the scoring loop below never does per-target
+  // lookups.
+  if (semanticEnabled) {
+    const uniqueTargets = [];
+    for (const c of rawCandidates) {
+      if (!edgeTypes.has(c.type) || excluded.has(c.target_id)) continue;
+      if (vectorCache.has(c.target_id)) continue;
+      vectorCache.set(c.target_id, undefined);
+      uniqueTargets.push(c.target_id);
+    }
+    if (uniqueTargets.length > 0) {
+      const fetched = batchInt8Vectors(hnswIndex, uniqueTargets);
+      for (let i = 0; i < uniqueTargets.length; i++) {
+        vectorCache.set(uniqueTargets[i], fetched[i]);
+      }
+    }
+  }
+
   for (const c of rawCandidates) {
     if (!edgeTypes.has(c.type) || excluded.has(c.target_id)) continue;
 
@@ -743,6 +780,7 @@ export function expandSecondHopAdaptive(db, seedIds, hop1Expanded, edgeTypes, op
     let normSim = null;
     if (semanticEnabled) {
       if (!vectorCache.has(c.target_id)) {
+        // Miss fallback only — the pre-seed pass below batch-fills the cache.
         vectorCache.set(c.target_id, hnswIndex.getInt8Vector(c.target_id));
       }
       const entityInt8 = vectorCache.get(c.target_id);
@@ -929,12 +967,16 @@ export function rerankExpanded(expandedResults, seedResults, options = {}) {
     }
   } else {
     const normalizedGraphScores = normalizeMinMax(baseScores);
+    // Batch int8 lookup: one stale-bitmap snapshot for the whole result set.
+    const entityInt8s = batchInt8Vectors(
+      hnswIndex,
+      expandedResults.map((er) => er.entity_id || er.id)
+    );
     for (let i = 0; i < expandedResults.length; i++) {
       const er = expandedResults[i];
       const normGraph = normalizedGraphScores[i];
       let rerankScore = normGraph;
-      const entityId = er.entity_id || er.id;
-      const entityInt8 = hnswIndex.getInt8Vector(entityId);
+      const entityInt8 = entityInt8s[i];
       if (entityInt8) {
         const cosSim = cosineSimilarity(queryInt8, entityInt8);
         const normSim = (cosSim + 1) / 2;

package/core/incremental-indexing/application/production-li-delta.mjs

@@ -117,6 +117,7 @@ export async function applyLateInteractionDelta({
   liEncoder,
   pickLiInput,
   onProgress = null,
+  readerCache = null,
 }) {
   const progress = typeof onProgress === 'function'
     ? (phase) => { onProgress(phase); }
@@ -128,11 +129,35 @@ export async function applyLateInteractionDelta({
   const encode = liEncoder || ((texts) => encodeDocumentsCpu(texts));
   const existing = fs.existsSync(indexPath);
   const segmented = existing ? segmentedState(indexPath) : null;
-  const index = new LateInteractionIndex({ indexPath, loadExisting: true });
-  await index.init();
-  progress('li:init');
+
+  // E.1-LI reader cache: reuse the loaded read view across the tick's files.
+  // Only the SEGMENTED path is cacheable — everything the reader serves there
+  // (config fields, positions/counts of pre-tick docs) is immutable within a
+  // tick: per-file ops only reference the file's own pre-tick docs, appends
+  // go through appendGrowingSegment (which re-reads the manifest from disk),
+  // and tombstone sidecar state is opened fresh per call. The legacy path
+  // MUTATES the loaded index (rewriteLegacyIndex), so it always loads fresh
+  // and drops any cached reader.
+  const cacheable = !!(readerCache && segmented);
+  let index;
+  if (cacheable && readerCache.index && readerCache.key === indexPath) {
+    index = readerCache.index;
+    progress('li:init-cached');
+  } else {
+    index = new LateInteractionIndex({ indexPath, loadExisting: true });
+    await index.init();
+    progress('li:init');
+    if (cacheable) {
+      readerCache.key = indexPath;
+      readerCache.index = index;
+    }
+  }
 
   if (existing && !segmented) {
+    if (readerCache) {
+      readerCache.key = null;
+      readerCache.index = null;
+    }
     return rewriteLegacyIndex(index, ops, encode, pickLiInput, progress);
   }
 

package/core/incremental-indexing/application/production-reconciler-helpers.mjs

@@ -60,19 +60,56 @@ export function insertRelationships(db, relationships, liveIdFor, epoch) {
   }
 }
 
-export function markBinaryStale(index, id) {
-  const idx = index.idToIndex.get(id);
-  if (idx == null) return false;
+/**
+ * Batched stale marking. The per-id `markBinaryStale` loads, mutates, and
+ * fsyncs the bitmap file once PER RETIRED ID — O(retires × bitmap size) with
+ * an fsync each. A batch loads the bitmap once (lazily, on the first mark),
+ * applies every mark in memory with the exact per-op semantics (idToIndex /
+ * int8Vectors pruned immediately, reader cache invalidated), and persists
+ * once in flush(). End state on disk is identical to N sequential
+ * markBinaryStale calls.
+ *
+ * Crash window: marks staged between flush()es are lost on crash, which the
+ * reconciler's persist-before-advance gate already handles — an unflushed
+ * tick replays its ops.
+ */
+export function createStaleBatch(index) {
   const stalePath = index.stalePath || `${index.indexPath}.stale.bin`;
   let bitmap = null;
-  try { bitmap = loadBitmap(stalePath); } catch {}
-  bitmap = bitmap ? resizeBitmap(bitmap, Math.max(idx + 1, index.vectors.length, 1)) : createBitmap(Math.max(idx + 1, index.vectors.length, 1));
-  setBit(bitmap, idx);
-  saveBitmap(stalePath, bitmap);
-  index.idToIndex.delete(id);
-  index.int8Vectors.delete(id);
-  index._staleBitmapCache = null;
-  return true;
+  let loaded = false;
+  let dirty = false;
+  return {
+    markStale(id) {
+      const idx = index.idToIndex.get(id);
+      if (idx == null) return false;
+      if (!loaded) {
+        try { bitmap = loadBitmap(stalePath); } catch {}
+        loaded = true;
+      }
+      bitmap = bitmap
+        ? resizeBitmap(bitmap, Math.max(idx + 1, index.vectors.length, 1))
+        : createBitmap(Math.max(idx + 1, index.vectors.length, 1));
+      setBit(bitmap, idx);
+      dirty = true;
+      index.idToIndex.delete(id);
+      index.int8Vectors.delete(id);
+      index._staleBitmapCache = null;
+      return true;
+    },
+    flush() {
+      if (!dirty) return false;
+      saveBitmap(stalePath, bitmap);
+      dirty = false;
+      return true;
+    },
+  };
+}
+
+export function markBinaryStale(index, id) {
+  const batch = createStaleBatch(index);
+  const marked = batch.markStale(id);
+  batch.flush();
+  return marked;
 }
 
 /**

package/core/incremental-indexing/application/production-reconciler.mjs

@@ -13,7 +13,7 @@ import { readManifest, writeManifest } from '../infrastructure/manifest.mjs';
 import { annotateChunksForDelta, snapshotFileRows, diffChunks, applyDiff } from '../infrastructure/vector-delta-writer.mjs';
 import { appendDeltaRecord, FALLBACK_WEIGHTS_ID, fileIdFor, listDeltaSegments } from '../infrastructure/sparse-gram-delta.mjs';
 import { fts5Merge, fts5MergeBudgetPages } from '../infrastructure/sqlite-fts5.mjs';
-import { insertEntity, insertRelationships, markBinaryStale, maintainFloatStore, flushFloatStore } from './production-reconciler-helpers.mjs';
+import { insertEntity, insertRelationships, markBinaryStale, createStaleBatch, maintainFloatStore, flushFloatStore } from './production-reconciler-helpers.mjs';
 import {
   chunkCutoffEnabled,
   computeCutoffSignature,
@@ -419,7 +419,7 @@ class ProductionReconcileAdapter {
       applyGraphDelta: (file, hashes, epoch, ctx) => this.applyGraphDelta(file, hashes, epoch, ctx),
       applyVectorDelta: (file, chunks, hashes, epoch, ctx) => this.applyVectorDelta(file, chunks, hashes, epoch, ctx),
       applyBinaryHNSWDelta: (file, ops, epoch, ctx) => this.applyBinaryHNSWDelta(file, ops, epoch, ctx),
-      applyLIDelta: (file, ops, epoch) => this.applyLIDelta(file, ops, epoch),
+      applyLIDelta: (file, ops, epoch, ctx) => this.applyLIDelta(file, ops, ctx),
       applySparseGramDelta: (file, ops, epoch) => this.applySparseGramDelta(file, ops, epoch),
       readMaintenanceState: () => this.readMaintenanceState(),
       scheduleMaintenance: (job) => enqueueMaintenanceJob(this.stateDir, job),
@@ -1110,9 +1110,12 @@ class ProductionReconcileAdapter {
     if (ctx?.index) {
       const index = ctx.index;
       let append = 0; let tombstone = 0;
+      // One bitmap load + one save+fsync per file's ops instead of per
+      // retired id; marks apply in op order with identical semantics.
+      const staleBatch = createStaleBatch(index);
       for (const op of ops) {
         if (op.retireId) {
-          if (markBinaryStale(index, op.retireId)) tombstone += 1;
+          if (staleBatch.markStale(op.retireId)) tombstone += 1;
           ctx.floatRemoveIds.push(op.retireId);
         }
         if (op.addId && op.embedding) {
@@ -1122,6 +1125,7 @@ class ProductionReconcileAdapter {
           append += 1;
         }
       }
+      staleBatch.flush();
       ctx.tombstone += tombstone;
       // append is committed to ctx.append in finalize after the sorted inserts.
       ctx.append += append;
@@ -1137,9 +1141,13 @@ class ProductionReconcileAdapter {
     let append = 0; let tombstone = 0;
     const floatUpserts = [];
     const floatRemoveIds = [];
+    // One bitmap load + one save+fsync for the whole op list instead of per
+    // retired id. Marks still apply inline in op order (adds never consult
+    // the bitmap), so retire-then-readd sequences behave exactly as before.
+    const staleBatch = createStaleBatch(index);
     for (const op of ops) {
       if (op.retireId) {
-        if (markBinaryStale(index, op.retireId)) tombstone += 1;
+        if (staleBatch.markStale(op.retireId)) tombstone += 1;
         floatRemoveIds.push(op.retireId);
       }
       if (op.addId && op.embedding) {
@@ -1150,6 +1158,7 @@ class ProductionReconcileAdapter {
       }
       if ((append + tombstone) > 0 && (append + tombstone) % 100 === 0) this.progress('production:binary-hnsw-loop');
     }
+    staleBatch.flush();
     await index.save(indexPath);
     this.progress('production:binary-hnsw-saved');
     await maintainFloatStore(indexPath, { upserts: floatUpserts, removeIds: floatRemoveIds, binaryVectorsBefore, dimension: this.modelInfo.hnswDimension });
@@ -1157,7 +1166,7 @@ class ProductionReconcileAdapter {
     return { ops: { binary_hnsw_append: append, binary_hnsw_tombstone: tombstone }, manifest: { path: 'codebase-binary-hnsw.idx' } };
   }
 
-  async applyLIDelta(file, ops) {
+  async applyLIDelta(file, ops, ctx = null) {
     if (!Array.isArray(ops) || ops.length === 0) return { ops: { li_segment_append: 0, li_tombstone: 0 } };
     // LI generated-content parity: full indexing's buildLateInteractionIndex runs
     // applyIndexingChunkPolicy so @generated / config-excluded files never reach
@@ -1170,12 +1179,21 @@ class ProductionReconcileAdapter {
       ? ops.filter((op) => !(op.addId && op.chunk))
       : ops;
     const { applyLateInteractionDelta } = await import('./production-li-delta.mjs');
+    // E.1-LI: tick-scoped READER cache. The per-file delta previously paid a
+    // full loadExisting init (segment manifest + doc positions over a multi-
+    // hundred-MB index) once per file; within one tick the reader view it
+    // needs is stable (per-file ops only reference the file's own pre-tick
+    // docs, appendGrowingSegment re-reads the manifest from disk, and segment
+    // compaction only runs in maintenance after the tick). Null ctx (per-file
+    // path) ⇒ fresh load per file, exactly as before.
+    const readerCache = ctx ? (ctx._liReaderCache ??= { key: null, index: null }) : null;
     const { appended, tombstone } = await applyLateInteractionDelta({
       indexPath: path.join(this.stateDir, 'codebase-late-interaction.db'),
       ops: filteredOps,
       liEncoder: this.liEncoder,
       pickLiInput,
       onProgress: () => this.progress('production:li-delta'),
+      readerCache,
     });
     return { ops: { li_segment_append: appended, li_tombstone: tombstone }, manifest: { path: 'codebase-late-interaction.db', segments: 'codebase-late-interaction.db.segments/manifest.json' } };
   }

package/core/incremental-indexing/application/reconciler.mjs

@@ -461,7 +461,7 @@ export class Reconciler {
     if (bin?.ops?.binary_hnsw_append != null) ops.binary_hnsw_append = bin.ops.binary_hnsw_append;
     if (bin?.ops?.binary_hnsw_tombstone != null) ops.binary_hnsw_tombstone = bin.ops.binary_hnsw_tombstone;
     this.progress('reconciler:li:start');
-    const li = await this.adapters.applyLIDelta?.(file, vec?.tokenOps ?? [], epoch);
+    const li = await this.adapters.applyLIDelta?.(file, vec?.tokenOps ?? [], epoch, tickCtx);
     this.progress('reconciler:li:done');
     collectManifestTier(manifestTiers, 'lateInteraction', li);
     if (li?.ops?.li_segment_append != null) ops.li_segment_append = li.ops.li_segment_append;

package/core/indexing/artifact-builder.js

@@ -52,7 +52,7 @@ export const ARTIFACT_THRESHOLDS = {
   stateFile: '.sweet-search/artifact-rebuild-state.json',
 };
 
-import { BinaryHNSWIndex } from '../vector-store/binary-hnsw-index.js';
+import { BinaryHNSWIndex, int8SidecarCount } from '../vector-store/binary-hnsw-index.js';
 import { truncateForHNSW, fisherYatesShuffle, normalizedFloatToInt8, floatToBinary } from '../infrastructure/quantization.js';
 import { FloatVectorStore, getFloatStorePath } from '../vector-store/float-vector-store.js';
 
@@ -828,8 +828,10 @@ export async function getArtifactStats() {
   if (existsSync(int8SidecarPath)) {
     try {
       const fileStats = await fs.stat(int8SidecarPath);
-      const int8Data = JSON.parse(await fs.readFile(int8SidecarPath, 'utf-8'));
-      const count = Object.keys(int8Data).length;
+      // Header-only count (NDJSON v2 sidecar; v1 back-compat) — never
+      // JSON.parse the whole file, which exceeds V8's string ceiling on
+      // large indexes.
+      const count = await int8SidecarCount(int8SidecarPath);
 
       stats.int8Sidecar = {
         exists: true,

package/core/indexing/index-maintainer.mjs

@@ -1267,12 +1267,14 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
   // Best-effort — never block startup on the embedding module.
   if (process.env.SWEET_SEARCH_ORT_BACKGROUND !== '0') {
     try {
-      const [{ configureLocalModelRuntime }, { backgroundIntraOpThreads }] = await Promise.all([
-        import('../embedding/embedding-local-model.js'),
-        import('../infrastructure/onnx-session-utils.js'),
-      ]);
-      configureLocalModelRuntime({ intraOpThreads: backgroundIntraOpThreads(), background: true });
-      log('INFO', 'ORT background profile armed for maintainer daemon (force_spinning_stop + arena-off + bg threads)');
+      // Arms BOTH resident CPU sessions (dense + late-interaction) — the LI
+      // session previously stayed on the foreground profile (arena ON +
+      // allow_spinning) inside the daemon; measured consequence: 354 × 128MB
+      // arena extensions (~34GB RSS) after one edit-heavy day plus ~40% idle
+      // CPU from spinning workers.
+      const { armBackgroundOrtProfiles } = await import('./model-pool.js');
+      armBackgroundOrtProfiles();
+      log('INFO', 'ORT background profile armed for maintainer daemon (dense + LI: force_spinning_stop + arena-off + bg threads)');
     } catch (err) {
       log('WARN', `ORT background profile arming failed (continuing on foreground profile): ${err?.message ?? err}`);
     }
@@ -1314,15 +1316,30 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
   // system-RAM tier auto-enables a cap (small-RAM hosts). Best-effort, guarded
   // so a missing module is a no-op.
   let rssRegistration = null;
+  // D.5 per-process recycle ceiling: fleet-budget eviction only sheds the
+  // longest-IDLE daemon, so an active maintainer needs its own line. Resolved
+  // once; checked at tick boundaries below. 0 ⇒ disabled.
+  let rssCeiling = { ceilingBytes: 0, minUptimeMs: 0, shouldRecycleForRss: null };
   try {
     const mod = await import('./rss-budget.mjs');
     if (typeof mod.isEnabled === 'function' && mod.isEnabled()
         && typeof mod.registerDaemon === 'function') {
       rssRegistration = await mod.registerDaemon({ pid: process.pid, stateDir: ctx.stateDir, kind: 'maintainer' });
     }
+    if (typeof mod.maintainerRssCeilingBytes === 'function') {
+      rssCeiling = {
+        ceilingBytes: mod.maintainerRssCeilingBytes(),
+        minUptimeMs: mod.maintainerRssMinUptimeMs(),
+        shouldRecycleForRss: mod.shouldRecycleForRss,
+      };
+      if (rssCeiling.ceilingBytes > 0) {
+        log('INFO', `Maintainer RSS recycle ceiling armed: ${(rssCeiling.ceilingBytes / 1048576).toFixed(0)}MB (min uptime ${rssCeiling.minUptimeMs}ms; override SWEET_SEARCH_MAINTAINER_RSS_MAX_MB)`);
+      }
+    }
   } catch (err) {
     log('WARN', `RSS-budget registry unavailable (no soft cap on this daemon): ${err?.message ?? err}`);
   }
+  let completedTicks = 0;
 
   // D.1 idle-TTL: an unattended maintainer self-shuts-down after the configured
   // wall-clock idle budget so N resident model-loaded daemons collapse to 1–2
@@ -1432,6 +1449,23 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
             maintenanceBacklog: backlog,
             skipped: tickCounters?.skipped === true,
           });
+          // D.5: per-process RSS recycle check — tick boundary only (the tick
+          // above has published; a recycle here can never tear an artifact).
+          completedTicks += 1;
+          if (rssCeiling.ceilingBytes > 0 && typeof rssCeiling.shouldRecycleForRss === 'function') {
+            const rssNow = process.memoryUsage.rss();
+            const verdict = rssCeiling.shouldRecycleForRss({
+              rssBytes: rssNow,
+              ceilingBytes: rssCeiling.ceilingBytes,
+              uptimeMs: process.uptime() * 1000,
+              minUptimeMs: rssCeiling.minUptimeMs,
+              ticksCompleted: completedTicks,
+            });
+            if (verdict.recycle) {
+              log('WARN', `Maintainer RSS ${(rssNow / 1048576).toFixed(0)}MB exceeds recycle ceiling ${(rssCeiling.ceilingBytes / 1048576).toFixed(0)}MB; requesting clean shutdown for on-demand respawn. If this repeats right after startup, raise SWEET_SEARCH_MAINTAINER_RSS_MAX_MB.`);
+              shutdownRequested = true;
+            }
+          }
         } catch (err) {
           if (err instanceof MaintainerLifecycleAbort) {
             log('WARN', `Reconcile v2 lifecycle abort: ${err.message}. Cleaning up cancellation-orphaned temps and exiting cleanly.`);
@@ -1457,6 +1491,10 @@ async function runReconcileV2Main({ runOnce, merkleOnce }) {
           log('ERROR', `Reconcile v2 tick failed: ${err?.message ?? err}`);
         }
       }
+      // Skip the sleep when a shutdown was requested during this iteration
+      // (idle-TTL, signal, or D.5 RSS recycle) — exit promptly instead of
+      // waiting out one more interval.
+      if (shutdownRequested) break;
       await sleepWithProgress(intervalMs, lock.lockFile, {
         // G6 early-wake: break the sleep the instant the watcher reports new
         // events so a fresh edit is reconciled without waiting out the interval.
@@ -2482,6 +2520,11 @@ async function main() {
   const dryRun = process.argv.includes('--dry-run');
   const merkleOnce = process.argv.includes('--merkle-once');
 
+  // Name the resident daemon so ps/Activity Monitor shows what it is instead
+  // of an anonymous `node`. Cosmetic-only: all liveness/takeover checks are
+  // lock/pid-based, never command-line matching.
+  try { process.title = 'sweet-search-maintainer'; } catch { /* best-effort */ }
+
   // A.1 (Tier-1, UNGATED): demote the maintainer daemon to low OS priority so
   // the foreground (editor / git / shell) never feels the background indexer's
   // CPU. Identical index output — only *when* CPU is granted changes. Covers

package/core/indexing/model-pool.js

@@ -29,12 +29,15 @@ import {
   getLocalPipeline,
   callLocalModelCpu,
   unloadLocalModel,
+  configureLocalModelRuntime,
 } from '../embedding/embedding-local-model.js';
 import {
   getLateInteractionPipeline,
   encodeDocumentsCpu,
   unloadLateInteractionModel,
+  configureLateInteractionRuntime,
 } from '../ranking/late-interaction-model.js';
+import { backgroundIntraOpThreads } from '../infrastructure/onnx-session-utils.js';
 
 /**
  * Small-changeset threshold. Incremental runs with fewer files than this use
@@ -69,6 +72,29 @@ export function selectAcceleratorDeviceKind(pref) {
   return null;
 }
 
+/**
+ * G3: arm the BACKGROUND/maintainer ORT profile for BOTH resident CPU
+ * sessions — dense (embedding-local-model) and late-interaction. The profile
+ * (force_spinning_stop + arena-off + 2–4 intra-op threads) prevents the two
+ * resident-daemon pathologies: idle spinning workers (~a core of idle CPU)
+ * and monotonic RSS from ORT arena extension (#25325; measured 354 × 128MB
+ * ≈ 34GB after one edit-heavy day when the LI session was left on the
+ * foreground profile). MUST run before the first encode — both session
+ * singletons are built once; configuring after is a silent no-op.
+ *
+ * Lives here (model-pool owns indexing-side model lifecycle) so daemon
+ * entrypoints don't need their own cross-context imports of the two model
+ * modules.
+ *
+ * @returns {{armed: boolean}}
+ */
+export function armBackgroundOrtProfiles() {
+  const intraOpThreads = backgroundIntraOpThreads();
+  configureLocalModelRuntime({ intraOpThreads, background: true });
+  configureLateInteractionRuntime({ intraOpThreads, background: true });
+  return { armed: true };
+}
+
 /**
  * Whether this process can use an inference accelerator (Metal / CoreML
  * cascade / CUDA) for indexing. Requires both accelerator-capable hardware

package/core/indexing/rss-budget.mjs

@@ -112,6 +112,71 @@ export function isOverBudget(totalRssBytes, budgetBytesValue) {
   );
 }
 
+// =============================================================================
+// D.5: per-process maintainer RSS recycle ceiling
+// =============================================================================
+//
+// The fleet budget above evicts the longest-IDLE daemon, so a single fat
+// ACTIVE maintainer can legitimately ride up to the whole fleet budget
+// (~76 GB on a 128 GB host) — measured in the wild when a session-config
+// regression left the LI ORT session on the foreground arena profile
+// (354 × 128MB arena extensions ≈ 34 GB RSS). This ceiling is the
+// per-process backstop: when the maintainer's OWN rss crosses the line at a
+// tick boundary, it requests the same graceful shutdown the idle-TTL uses
+// (finish tick, publish, release lock, exit). The O_EXCL launch trigger
+// respawns a fresh few-hundred-MB process on the next dirty event, so the
+// index is unchanged — exit-to-reclaim is already the sanctioned way to
+// return ORT memory (#25325).
+//
+// Guards against restart-thrash:
+//   - at least one COMPLETED tick (never abort startup work),
+//   - minimum uptime (default 10 min ⇒ worst case 6 recycles/hour even when
+//     the ceiling is misconfigured below the resident floor — visible via
+//     the per-recycle WARN, which names the env knob to raise).
+//
+// Measured anchors (2026-07-03, arena-off profile): steady floor ~2.7-2.9 GB
+// on a mid-size repo, encode-active peaks ~4.7 GB — hence the 4 GiB default
+// floor and 8 GiB cap.
+
+const MAINTAINER_RSS_CEILING_FRACTION = 0.25;
+const MAINTAINER_RSS_CEILING_MIN_BYTES = 4 * 1024 * 1024 * 1024;  // 4 GiB
+const MAINTAINER_RSS_CEILING_MAX_BYTES = 8 * 1024 * 1024 * 1024;  // 8 GiB
+const MAINTAINER_RSS_MIN_UPTIME_MS_DEFAULT = 10 * 60 * 1000;      // 10 min
+
+/**
+ * Resolve the per-process maintainer RSS ceiling in bytes.
+ * `SWEET_SEARCH_MAINTAINER_RSS_MAX_MB` set: explicit MB value; 0/garbage
+ * disables (returns 0). Unset: clamp(25% of RAM, 4 GiB, 8 GiB).
+ */
+export function maintainerRssCeilingBytes(env = process.env, totalMem = os.totalmem()) {
+  const raw = env.SWEET_SEARCH_MAINTAINER_RSS_MAX_MB;
+  if (raw != null && raw !== '') {
+    const mb = Number(raw);
+    if (!Number.isFinite(mb) || mb <= 0) return 0;
+    return Math.floor(mb * 1024 * 1024);
+  }
+  const scaled = Math.floor(totalMem * MAINTAINER_RSS_CEILING_FRACTION);
+  return Math.min(MAINTAINER_RSS_CEILING_MAX_BYTES, Math.max(MAINTAINER_RSS_CEILING_MIN_BYTES, scaled));
+}
+
+/** Minimum uptime before an RSS recycle may fire. */
+export function maintainerRssMinUptimeMs(env = process.env) {
+  const raw = Number(env.SWEET_SEARCH_MAINTAINER_RSS_MIN_UPTIME_MS);
+  return Number.isFinite(raw) && raw >= 0 ? raw : MAINTAINER_RSS_MIN_UPTIME_MS_DEFAULT;
+}
+
+/**
+ * Pure recycle decision — evaluated at tick boundaries only.
+ * @returns {{recycle: boolean, reason: string}}
+ */
+export function shouldRecycleForRss({ rssBytes, ceilingBytes, uptimeMs, minUptimeMs, ticksCompleted }) {
+  if (!Number.isFinite(ceilingBytes) || ceilingBytes <= 0) return { recycle: false, reason: 'disabled' };
+  if (!Number.isFinite(rssBytes) || rssBytes <= ceilingBytes) return { recycle: false, reason: 'under-ceiling' };
+  if (!(ticksCompleted >= 1)) return { recycle: false, reason: 'no-completed-tick' };
+  if (!(uptimeMs >= minUptimeMs)) return { recycle: false, reason: 'min-uptime' };
+  return { recycle: true, reason: 'over-ceiling' };
+}
+
 /**
  * Read the resident-set size (bytes) of an arbitrary pid, best-effort and
  * cross-platform. Returns a non-negative integer, or 0 when unknown (dead pid,