v0.42.20.0 — reliability fix wave

Closes a cluster of teardown/reliability bugs around how GBrain shuts down a command and talks to AI providers.

Bugs fixed

• CLI_ONLY commands (e.g. gbrain capture) hang after completing on multi-chunk pages, pinning the PGLite single-writer lock #1762 — gbrain capture hangs on PGLite, pinning the single-writer lock. put_page fires a fire-and-forget facts:absorb job after printing the receipt; on a multi-chunk page that job is still running when handleCliOnly disconnects, and db.close() racing the in-flight job spins into a 100%-CPU loop that holds the lock. Now every fire-and-forget sink is drained before disconnect.
• "connect() has not been called" still reproduces on 0.41.28 — concurrent minion-worker path not covered by #1570 fix #1745 — gbrain dream fails mid-cycle on Postgres ("connect() has not been called"). A blip made reconnect() tear down the shared module singleton out from under concurrent cycle/minion ops. Module-mode reconnect now re-establishes idempotently without a teardown.
• search/query render no output + engine.disconnect() 10s force-exit on 0.42.8.0 (Postgres brain); 0.22.8 works #1775 — search/query print no output + 10s force-exit (regression from 0.22.8). Cheap-hybrid embeds the query; a stalled provider made the embed never settle so keyword fallback never engaged. The query embed is now time-bounded → falls back to keyword.

Unifying changes (make this bug class structural)

• src/core/background-work.ts (NEW): a registry of the four fire-and-forget DB-write sinks (last-retrieved, facts, search-cache, eval-capture). drainAllBackgroundWorkForCliExit is called on every CLI exit path before engine.disconnect(). A future 5th sink auto-participates.
• Gateway-wide AI-HTTP timeout: chat / expand / OCR / embed (per sub-batch) / multimodal now carry a default wall-clock deadline (GBRAIN_AI_{CHAT,EMBED,MULTIMODAL}_TIMEOUT_MS), composed with caller signals via AbortSignal.any. Covers the native-Anthropic path and bounds SDK retries.

Commits (bisectable)

1. fix(core) background-work registry + drain-before-disconnect (CLI_ONLY commands (e.g. gbrain capture) hang after completing on multi-chunk pages, pinning the PGLite single-writer lock #1762)
2. fix(ai) gateway-wide AI-HTTP timeout (CLI_ONLY commands (e.g. gbrain capture) hang after completing on multi-chunk pages, pinning the PGLite single-writer lock #1762/search/query render no output + engine.disconnect() 10s force-exit on 0.42.8.0 (Postgres brain); 0.22.8 works #1775)
3. fix(postgres) module-mode reconnect preserves the shared singleton ("connect() has not been called" still reproduces on 0.41.28 — concurrent minion-worker path not covered by #1570 fix #1745)
4. fix(search) bounded query-embed deadline + keyword fallback (search/query render no output + engine.disconnect() 10s force-exit on 0.42.8.0 (Postgres brain); 0.22.8 works #1775)
5. test+chore tests + v0.42.20.0

Disconnect-site audit

The only CLI-exit disconnect sites that enqueue local background work are the two finally blocks (op-dispatch + handleCliOnly), both now draining. search diagnose embeds but enqueues nothing and is 60s-bounded; serve is excluded; thin-client is remote.

Testing

• Full unit suite green (9,500 pass / 0 fail). bun run verify 29/29.
• New: test/core/background-work.test.ts, test/search/query-embed-deadline.test.ts, test/eval-capture-drain.test.ts, test/e2e/postgres-reconnect-singleton.test.ts (real Postgres, "connect() has not been called" still reproduces on 0.41.28 — concurrent minion-worker path not covered by #1570 fix #1745 — verified green against pgvector:pg16), a gbrain capture exit-clean case in test/e2e/pglite-cli-exit.serial.test.ts, updated test/fix-wave-structural.test.ts.
• Pre-landing adversarial review (codex) on the implemented diff; 3 findings fixed (op-dispatch force-exit honors exit code; module reconnect fail-loud; query-embed budget floored so a healthy embed isn't starved by slow expansion).

Reviews

Plan went through /plan-eng-review (twice) + 3 codex passes; the final code through a codex adversarial pre-landing review.

Deferred (follow-ups, in TODOS.md)

• Convert runSync's internal process.exit sites to exitCode + return (graceful drain on sync error exits; today they avoid the hang by skipping disconnect).
• Decouple the op-dispatch force-exit timer to wrap disconnect() only + fix its message.
• Gateway idle-timeout (vs absolute) for streaming chat.

Incorporates and hardens #1763 (by @ElliotDrel, who diagnosed the corrected root cause); the residual hung-Haiku hole is closed by the facts shutdown() abort belt. Will close #1763 as superseded.

🤖 Generated with Claude Code