fix(embed): clear embedding on content change — lag means absent not stale; drain queue on shutdown (#418)

The reviewer demonstrated (cap=1 + 400ms fake backend) that a
content-changing UPDATE whose deferred embed job was dropped on queue
overflow kept the PREVIOUS body's embedding: non-NULL, so mimir_embed
batch repair (WHERE embedding IS NULL) never touched it and dense search
served the wrong vector permanently. Even without overflow, the update-lag
window served the old body's vector.

Fix: the content_changed stamp UPDATE in remember's update path now also
sets embedding = NULL, emb_sig = NULL — same transaction that rewrites the
FTS row. Lag/drop now means ABSENT (row out of dense search, keyword still
finds it) instead of STALE, and every dropped job is genuinely
NULL-scan-recoverable, making the documented overflow contract true.
Cleared regardless of backend config: a vector for a body the row no
longer has is wrong in any configuration. Identical re-asserts (gated on
content_changed) still keep their vector.

Also, per review suggestions:
- Shutdown now DRAINS queued jobs instead of skipping them (bounded by the
  existing 5s Drop grace, detached past it): CLI one-shot writes get their
  embeddings as they did synchronously pre-#393; the shutdown-skip flag is
  gone.
- debug_assert against pending-counter underflow at both decrement sites
  (saturating_sub no longer masks accounting drift in debug/test builds).
- Overflow warning, code comments, and CHANGELOG updated so every claim
  matches the fixed behavior.

Regression test overflow_dropped_update_clears_stale_vector_and_batch_repairs_it
(deterministic via a fake-server accept counter — no sleeps for the
worker-busy window): update under overflow-drop -> embedding is NULL, then
batch embed_entity repairs it with the CURRENT body's vector. Pre-fix
proof at the previous head: FAILED with "a dropped update job must leave
the embedding ABSENT (NULL), not body A's stale vector".

Full default suite 282 passed / 0 failed; lite (--no-default-features)
275 passed / 0 failed.

Co-authored-by: tcconnally <hermes@perseus.observer>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -22,20 +22,40 @@ All notable changes to Perseus Vault (formerly Mimir/Mneme) are documented here.
   with a rate-limited warning) and return immediately; the worker drains up
   to 32 jobs per wake, embeds, and stores each vector through a stale guard
   (an atomic conditional UPDATE against the entity's current FTS plaintext),
-  so a queued embed can never overwrite a newer body's vector. Deferral is
-  within the existing contract — auto-embed already ran post-commit with
-  non-fatal failures; a row simply doesn't surface in dense/hybrid search
-  until embedded (now milliseconds later; dropped-on-overflow rows are
-  recoverable via `mimir_embed` batch mode or their next change). Explicit
-  `mimir_embed` stays synchronous. The write path also no longer consults
-  the #219 embedding session cache (new/changed bodies can never hit it —
-  each write paid up to 256 full-body string compares for nothing), and the
+  so a queued embed can never overwrite a newer body's vector. A
+  content-changing UPDATE also clears the row's stored embedding inside the
+  write transaction, so embed lag — or a dropped job — means the row is
+  ABSENT from dense search (keyword search still finds it), never served
+  with the previous body's stale vector, and every unembedded row is
+  genuinely recoverable via `mimir_embed` batch mode
+  (`WHERE embedding IS NULL`) or its next change. Deferral is within the
+  existing contract — auto-embed already ran post-commit with non-fatal
+  failures; a row simply doesn't surface in dense/hybrid search until
+  embedded (now milliseconds later). Explicit `mimir_embed` stays
+  synchronous. The write path also no longer consults the #219 embedding
+  session cache (new/changed bodies can never hit it — each write paid up
+  to 256 full-body string compares for nothing), and the
   misconfigured-backend log (enabled, model missing, no endpoint — formerly
   one eprintln per write) is rate-limited to once per minute. `Drop` for
-  `Database` signals the worker and waits up to 5s: the in-flight embed
-  finishes, remaining queued jobs are dropped. Measured (debug profile,
-  1KB bodies, bundled ONNX, n=40, median-of-5-runs): write median
-  7,714µs → ~159µs (~48×).
+  `Database` disconnects the queue and waits up to 5s while the worker
+  DRAINS the remaining jobs (CLI one-shot writes still get embedded, as
+  they did synchronously pre-#393); a drain that outlives the grace
+  continues on the detached thread, and any never-embedded row is NULL —
+  batch-recoverable, never stale. Measured (debug profile, 1KB bodies,
+  bundled ONNX, n=40, median-of-5-runs): write median 7,714µs → ~159µs
+  (~48×).
+- **Empty-string `workspace_hash` is now STRICT everywhere (#408).**
+  `list_entities`/`count_entities` (the dashboard entity list and
+  its `total`) and `get_entity_graph` treated `Some("")` as *unscoped* —
+  no filter, every workspace's rows — while `recall`/`recall_when`/`follow`
+  treat `""` with strict equality (only the global `''` rows). The same
+  argument value meant two different scopes depending on the surface. All
+  three now apply strict equality for any `Some`, including `Some("")`;
+  `None`/omitting the param remains the unscoped view. On the web API this
+  means `?workspace=` (present but empty) now returns only global-`''`
+  rows instead of everything — omit the parameter entirely for the
+  unscoped view. The bundled dashboard never sends the parameter, so its
+  behavior is unchanged.
 
 ### Fixed
 - `follow()`'s row resolution no longer collapses real DB errors into
@@ -107,20 +127,6 @@ All notable changes to Perseus Vault (formerly Mimir/Mneme) are documented here.
   rejected with 400; the responses now echo the effective `limit` (and
   `offset` for `/api/entities`).
 
-### Changed
-- **Empty-string `workspace_hash` is now STRICT everywhere (#408).**
-  `list_entities`/`count_entities` (the dashboard entity list and
-  its `total`) and `get_entity_graph` treated `Some("")` as *unscoped* —
-  no filter, every workspace's rows — while `recall`/`recall_when`/`follow`
-  treat `""` with strict equality (only the global `''` rows). The same
-  argument value meant two different scopes depending on the surface. All
-  three now apply strict equality for any `Some`, including `Some("")`;
-  `None`/omitting the param remains the unscoped view. On the web API this
-  means `?workspace=` (present but empty) now returns only global-`''`
-  rows instead of everything — omit the parameter entirely for the
-  unscoped view. The bundled dashboard never sends the parameter, so its
-  behavior is unchanged.
-
 ## [2.14.0] - 2026-07-02
 
 ### Added