fix(embedder): thread-safe model loading + eager warmup to prevent PM2 recall timeouts

[Coding-Dev-Tools]

ProblemnConcurrent recall calls each saw _model is None and raced to load the 80-400 MB embedding model simultaneously. The forked PM2 worker wedged under N parallel loads, causing every recall to time out (observed as 300s MCP timeouts).nn## Fixn- Double-checked locking in _get_model(): fast-path early return + threading.Lock + re-check inside the lock. Exactly one load per process lifetime.n- warmup() helper: loads the model eagerly; never raises (returns bool).n- Startup integration: await asyncio.get_running_loop().run_in_executor(None, _warmup_embedder) in the FastAPI lifespan so the first recall does not pay the cold-load cost under request pressure.nn## Testsntests/test_embedder_threading.py (4 tests, all passing):n- 8-thread barrier race: asserts exactly 1 model load under contentionn- warmup() returns True on successn- warmup() returns False (never raises) on failuren- warmup() is idempotent (second call does not reload)nn## Council ReviewnAPPROVE — 4.68/5 avg, 100% agreement, 5/6 reviewers (1 invalid output).nSession: council-6e91d7f4-d7ab-4001-9936-149da69032ab

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Coding-Dev-Tools]

Pre-PR Code Review — APPROVE ✅

CI: 8/8 checks passing (all green)
Council: APPROVE — 4.68/5 avg, 100% agreement (5/6 reviewers)

Analysis

• Correctness: Double-checked locking pattern correctly implemented — fast-path early return avoids lock contention on hot path, re-check inside lock prevents double-load race. threading.Lock() appropriate for forked PM2 worker scenario.
• Security: No issues. No new attack surface.
• Tests: 4 new tests — 8-thread barrier race (asserts exactly 1 load), warmup success/failure/idempotency. Good coverage.
• Quality: warmup() is defensive (never raises, returns bool). Startup integration via run_in_executor avoids blocking the event loop.
• Regressions: None detected.

Verdict: APPROVE — Sound concurrency fix, well-tested, CI green. Ready to merge pending branch protection approval from a human reviewer.

[Coding-Dev-Tools]

Pre-PR Code Review — APPROVE ✅

Reviewer: Hermes Pre-PR Code Reviewer (automated)
Date: 2026-07-21

Summary

Thread-safe model loading via double-checked locking + eager warmup during FastAPI lifespan startup. Prevents PM2 worker wedge under concurrent recall calls.

Analysis

Correctness: ✅

• Double-checked locking pattern is correctly implemented: fast-path early return → acquire lock → re-check → load. Exactly one load per process lifetime.
• warmup() is defensive (never raises, returns bool) — safe for startup integration.
• run_in_executor(None, _warmup_embedder) correctly offloads the blocking model load to the thread pool, keeping the event loop responsive during startup.

Security: ✅ No issues. No secrets, no injection vectors, no unsafe deserialization.

Tests: ✅ 4 tests covering:

• 8-thread barrier race → exactly 1 model load (the core fix)
• warmup() success/failure/idempotency

CI: ✅ All 8 checks passing (Python 3.9–3.12, docker, browser smoke, wheel build).

Quality: ✅ Clean, minimal diff (+127/-1). Good comments explaining the "why". No style drift.

Prior-fix regressions: None detected.

Verdict: APPROVE

Sound fix, well-tested, CI green, council-approved (4.68/5). Ready to merge.

[Coding-Dev-Tools]

Pre-PR Code Review: APPROVE ✓

Verdict: APPROVE

Analysis

Bugs/Logic: None found. The double-checked locking pattern in _get_model() is correctly implemented:

• Fast-path early return avoids lock contention on the hot path
• threading.Lock + re-check inside the lock prevents the race where N threads all see _model is None
• Exactly one load per process lifetime — correct for a module-level singleton

Security: No issues. No secrets, no injection vectors, no unsafe deserialization. The warmup() helper catches all exceptions and returns bool — no information leakage.

Quality:

• 4 new tests covering: 8-thread barrier race (exactly-once load), warmup success, warmup failure (never raises), warmup idempotency
• Clean integration into FastAPI lifespan via run_in_executor — non-blocking startup
• Good docstrings and inline comments explaining the PM2 wedge scenario

CI: All 8 checks passing (3.10, 3.11, 3.12, numpy-only 3.9, wheel build, docker, browser smoke, path gate).

Council Review: APPROVE — 4.68/5 avg, 100% agreement.

No regressions of prior fixes detected. Ready to merge once branch protection approval requirement is satisfied.