fix: default to ~/.memxt/palace.db + serialize embedder init

Bare memxt commands no longer create empty memxt.db in random cwds.
Concurrent mine no longer races global Embedder init and drops chunks.

Author: debpalash

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .memxt,
-    .version = "0.3.0",
+    .version = "0.3.1",
     .fingerprint = 0x5bf95d78bca15787,
     .minimum_zig_version = "0.16.0",
     .paths = .{

src/config.zig

@@ -125,10 +125,35 @@ pub fn applyEnvOverrides(cfg: *Config, allocator: std.mem.Allocator) void {
     overrideZ(&cfg.database_path, "memxt.db", "MEMXT_DB", allocator);
     overrideZ(&cfg.model_path, "lib/minilm.gguf", "MEMXT_MODEL", allocator);
     overrideZ(&cfg.default_wing, "default", "MEMXT_WING", allocator);
+    resolveDatabasePath(cfg, allocator);
     resolveModelPath(cfg, allocator);
     resolveDefaultWing(cfg, allocator);
 }
 
+/// The `database_path` default is the *relative* literal "memxt.db", so a bare
+/// `memxt search` / `inspect` / `mine` run from any project directory used to
+/// silently CREATE a brand-new empty palace right there — littering repos with
+/// stray memxt.db files and, far worse, showing the user an empty memory
+/// ("0 wings, 0 drawers") as if everything they'd stored was gone. Nothing
+/// warned; it just looked like data loss.
+///
+/// Anchor the unconfigured default to the installer's canonical palace
+/// (~/.memxt/palace.db) so bare commands find the real memory from any cwd.
+/// An existing ./memxt.db still wins — that's a deliberate project-local
+/// palace, and silently re-pointing it at the global one would orphan real data.
+fn resolveDatabasePath(cfg: *Config, allocator: std.mem.Allocator) void {
+    // Explicitly configured (yaml or MEMXT_DB) — never second-guess it.
+    if (!std.mem.eql(u8, cfg.database_path, "memxt.db")) return;
+    // A project-local palace already exists here: keep using it.
+    if (fileExists(cfg.database_path)) return;
+
+    const home_raw = c.getenv("HOME") orelse return;
+    const home = std.mem.span(home_raw);
+    const tmp = std.fmt.allocPrint(allocator, "{s}/.memxt/palace.db", .{home}) catch return;
+    defer allocator.free(tmp);
+    cfg.database_path = allocator.dupeZ(u8, tmp) catch return;
+}
+
 /// If nothing (yaml nor MEMXT_WING) picked a wing, scope the default wing to
 /// the current project instead of dumping every project on the machine into
 /// one shared "default" wing. Prefers the basename of the git repository
@@ -236,6 +261,38 @@ test "MEMXT_WING env override wins over derived default" {
     try std.testing.expectEqualStrings("explicit-wing", cfg.default_wing);
 }
 
+test "unconfigured database_path anchors to ~/.memxt/palace.db, not a stray cwd file" {
+    const allocator = std.testing.allocator;
+    _ = c.unsetenv("MEMXT_DB");
+
+    var cfg = Config{};
+    applyEnvOverrides(&cfg, allocator);
+    defer cfg.deinit(allocator);
+
+    // Regression: the default used to stay the relative literal "memxt.db",
+    // so running memxt from any project dir created an empty palace there and
+    // reported "0 wings, 0 drawers" — indistinguishable from losing everything.
+    // (Guarded: only assert the rewrite when there's no project-local palace in
+    // cwd, since an existing ./memxt.db is legitimately preferred.)
+    if (!fileExists("memxt.db")) {
+        try std.testing.expect(!std.mem.eql(u8, cfg.database_path, "memxt.db"));
+        try std.testing.expect(std.mem.endsWith(u8, cfg.database_path, "/.memxt/palace.db"));
+        try std.testing.expect(std.fs.path.isAbsolute(cfg.database_path));
+    }
+}
+
+test "MEMXT_DB env override is never second-guessed" {
+    const allocator = std.testing.allocator;
+    _ = c.setenv("MEMXT_DB", "/tmp/explicit-palace.db", 1);
+    defer _ = c.unsetenv("MEMXT_DB");
+
+    var cfg = Config{};
+    applyEnvOverrides(&cfg, allocator);
+    defer cfg.deinit(allocator);
+
+    try std.testing.expectEqualStrings("/tmp/explicit-palace.db", cfg.database_path);
+}
+
 test "default wing derives from project when nothing is configured" {
     const allocator = std.testing.allocator;
     _ = c.unsetenv("MEMXT_WING");

src/embedder.zig

@@ -17,6 +17,12 @@ const c = @cImport({
     @cInclude("llama.h");
 });
 
+/// libc bits used only to locate the installed model in tests.
+const libc = @cImport({
+    @cInclude("stdlib.h");
+    @cInclude("unistd.h");
+});
+
 // MiniLM-L6-v2 embedding width. The vec_drawers virtual table is declared
 // float[384], so the active model MUST match this. Validated in init().
 pub const EMBEDDING_DIM = 384;
@@ -193,36 +199,71 @@ var global_emb: ?Embedder = null;
 /// Points at config/env memory — not freed here.
 var pending_model_path: ?[:0]const u8 = null;
 
+/// `global_emb` is a by-value `?Embedder`, so *assigning* it rewrites the
+/// struct in place — including `lock_flag`, the very spinlock `embed()` uses to
+/// serialize the llama_context. Lazy-init therefore MUST be serialized itself:
+/// the miner calls `embed()` from one concurrent task per file, and an
+/// unguarded `if (global_emb == null) global_emb = init()` let every task see
+/// null, build its own Embedder, and overwrite the global underneath the
+/// others. In-flight calls had their `ctx` swapped mid-encode and their lock
+/// reset, which surfaced as a storm of EncodeFailed/NoEmbedding and silently
+/// dropped ~90% of chunks when mining a directory (single-file mining has one
+/// task, so it never raced and always looked fine).
+///
+/// `emb_ready` is the atomic publication flag — `global_emb` itself is a wide
+/// struct and can't be loaded atomically. Once published, `global_emb` is never
+/// reassigned until `deinitGlobal`, so `&global_emb.?` stays stable.
+var emb_ready: std.atomic.Value(bool) = .init(false);
+var init_lock: std.atomic.Value(bool) = .init(false);
+
+/// Initialize the process-global embedder exactly once. Safe to call from many
+/// threads concurrently; losers of the race wait and observe the winner's.
+fn initGlobalOnce(model_path: [:0]const u8) !void {
+    if (emb_ready.load(.acquire)) return;
+
+    while (init_lock.cmpxchgWeak(false, true, .acquire, .monotonic) != null) {
+        std.atomic.spinLoopHint();
+    }
+    defer init_lock.store(false, .release);
+
+    // Double-check under the lock: another thread may have published while we
+    // were spinning.
+    if (emb_ready.load(.acquire)) return;
+
+    global_emb = try Embedder.init(model_path);
+    emb_ready.store(true, .release);
+}
+
 /// Remember where the model lives without loading it. Mine can then skip the
 /// ~0.5s Metal init entirely when every chunk is already stored (incremental).
 pub fn setModelPath(model_path: [:0]const u8) void {
     pending_model_path = model_path;
 }
 
 pub fn initGlobal(model_path: [:0]const u8) !void {
-    if (global_emb != null) return;
     pending_model_path = model_path;
-    global_emb = try Embedder.init(model_path);
+    try initGlobalOnce(model_path);
 }
 
 pub fn deinitGlobal() void {
     if (global_emb != null) {
         global_emb.?.deinit();
         global_emb = null;
     }
+    emb_ready.store(false, .release);
     pending_model_path = null;
 }
 
 /// True once a model is loaded. Lets callers degrade gracefully (e.g. keyword
 /// search) instead of hard-failing when no model is configured.
 pub fn isReady() bool {
-    return global_emb != null;
+    return emb_ready.load(.acquire);
 }
 
 fn ensureReady() !void {
-    if (global_emb != null) return;
+    if (emb_ready.load(.acquire)) return;
     const path = pending_model_path orelse return error.EmbedderNotInitialized;
-    global_emb = try Embedder.init(path);
+    try initGlobalOnce(path);
 }
 
 pub fn embed(text: []const u8, allocator: Allocator) ![]f32 {
@@ -232,3 +273,57 @@ pub fn embed(text: []const u8, allocator: Allocator) ![]f32 {
     }
     return error.EmbedderNotInitialized;
 }
+
+// ═══════════════════════════════════════════════════════════════════
+// Regression tests
+// ═══════════════════════════════════════════════════════════════════
+
+test "concurrent embed() does not race the lazy global init" {
+    const allocator = std.testing.allocator;
+
+    // Needs the real model. Skip where it isn't installed (clean CI checkout).
+    const home_raw = libc.getenv("HOME") orelse return error.SkipZigTest;
+    const home = std.mem.span(home_raw);
+    const path = std.fmt.allocPrintSentinel(allocator, "{s}/.memxt/lib/minilm.gguf", .{home}, 0) catch return error.SkipZigTest;
+    defer allocator.free(path);
+    if (libc.access(path.ptr, 0) != 0) return error.SkipZigTest;
+
+    deinitGlobal();
+    setModelPath(path);
+
+    // The miner spawns one concurrent task per file, all landing in embed().
+    // Pre-fix, each saw `global_emb == null`, built its own Embedder and
+    // overwrote the global — swapping the llama_context (and resetting
+    // `lock_flag`, the spinlock guarding it) underneath in-flight calls. Most
+    // chunks then died with EncodeFailed/NoEmbedding and were silently dropped:
+    // mining src/ui (22 files) stored 4 drawers instead of 504, and still
+    // exited 0. Hammer the cold-start path from many threads at once; every
+    // call must succeed.
+    const N = 8;
+    const Worker = struct {
+        fn run(ok: *std.atomic.Value(u32), bad: *std.atomic.Value(u32), idx: usize) void {
+            var buf: [64]u8 = undefined;
+            const text = std.fmt.bufPrint(&buf, "regression sentence number {d}", .{idx}) catch return;
+            const a = std.testing.allocator;
+            if (embed(text, a)) |vec| {
+                a.free(vec);
+                _ = ok.fetchAdd(1, .monotonic);
+            } else |_| {
+                _ = bad.fetchAdd(1, .monotonic);
+            }
+        }
+    };
+
+    var ok: std.atomic.Value(u32) = .init(0);
+    var bad: std.atomic.Value(u32) = .init(0);
+    var threads: [N]std.Thread = undefined;
+    for (&threads, 0..) |*t, i| {
+        t.* = std.Thread.spawn(.{}, Worker.run, .{ &ok, &bad, i }) catch return error.SkipZigTest;
+    }
+    for (threads) |t| t.join();
+
+    try std.testing.expectEqual(@as(u32, 0), bad.load(.monotonic));
+    try std.testing.expectEqual(@as(u32, N), ok.load(.monotonic));
+
+    deinitGlobal();
+}