mixdog 0.9.149 → 0.9.151

package/src/runtime/agent/orchestrator/tools/patch/dispatch.mjs

@@ -2,7 +2,7 @@
 // verbatim from patch.mjs; native protocol, cache/snapshot side effects, and
 // output formatting are unchanged.
 
-import { readFileSync, lstatSync, mkdirSync } from 'node:fs';
+import { readFileSync, lstatSync, statSync, realpathSync, mkdirSync } from 'node:fs';
 import { unlink } from 'node:fs/promises';
 import { dirname as pathDirname } from 'node:path';
 import { performance } from 'node:perf_hooks';
@@ -393,6 +393,38 @@ function lstatRegularPatchFile(fullPath, displayPath) {
   return st;
 }
 
+// A symlinked target is patched THROUGH the link. atomicWrite compares the
+// live target with statSync, which FOLLOWS a leaf symlink, so the expected
+// snapshot must be taken the same way: an lstat describes the LINK inode
+// (size = target path length, its own mtime/ino) and can never equal the
+// followed stat, which failed every patch aimed at a symlinked file with
+// "changed on disk during the patch". Writing to the resolved real path also
+// keeps the link intact — the atomic rename would otherwise replace the
+// symlink itself with a regular file.
+function resolvePatchWriteTarget(fullPath, displayPath, lst) {
+  if (!lst?.isSymbolicLink?.()) return { writePath: fullPath, snapshotStat: lst };
+  let writePath;
+  let snapshotStat;
+  try {
+    writePath = realpathSync(fullPath);
+    snapshotStat = statSync(fullPath);
+  } catch (err) {
+    throw new Error(
+      `apply_patch: symlink target missing or unreadable: ${normalizeOutputPath(displayPath)}`
+      + ` (${err?.code || err?.message || String(err)})`,
+    );
+  }
+  if (isSpecialFileStat(snapshotStat)) {
+    throw new Error(
+      `apply_patch: cannot patch special file (FIFO / character / block device / socket): ${normalizeOutputPath(displayPath)}`,
+    );
+  }
+  if (!snapshotStat.isFile()) {
+    throw new Error(`apply_patch: symlink target is not a regular file: ${normalizeOutputPath(displayPath)}`);
+  }
+  return { writePath, snapshotStat };
+}
+
 function assertAddTargetAbsent(fullPath, displayPath) {
   try {
     lstatSync(fullPath);
@@ -466,6 +498,7 @@ async function applyJsParsedEntry(entry, basePath, { dryRun, fuzzy, readStateSco
   }
 
   const preMutationStat = lstatRegularPatchFile(fullPath, displayPath);
+  const { writePath, snapshotStat } = resolvePatchWriteTarget(fullPath, displayPath, preMutationStat);
   // Rewrite path: decode by BOM, re-encode into the same codec, and keep every
   // untouched line's own terminator (spliceTextLinesForPatch).
   // `toString('utf8')` here transcoded non-UTF-8 files and mangled UTF-16.
@@ -482,14 +515,14 @@ async function applyJsParsedEntry(entry, basePath, { dryRun, fuzzy, readStateSco
     // rewrote this file after we read it, the write fails instead of silently
     // clobbering it (and instead of inheriting a stale "body delivered" claim).
     try {
-      await atomicWrite(fullPath, content, {
+      await atomicWrite(writePath, content, {
         sessionId: readStateScope,
-        expectedTargetSnapshot: preMutationStat ? {
+        expectedTargetSnapshot: snapshotStat ? {
           exists: true,
-          size: preMutationStat.size,
-          mtimeMs: preMutationStat.mtimeMs,
-          ctimeMs: preMutationStat.ctimeMs,
-          ino: preMutationStat.ino,
+          size: snapshotStat.size,
+          mtimeMs: snapshotStat.mtimeMs,
+          ctimeMs: snapshotStat.ctimeMs,
+          ino: snapshotStat.ino,
         } : undefined,
       });
     } catch (err) {
@@ -498,12 +531,13 @@ async function applyJsParsedEntry(entry, basePath, { dryRun, fuzzy, readStateSco
       }
       throw err;
     }
-    invalidateBuiltinResultCache([fullPath]);
-    markCodeGraphDirtyPaths([fullPath]);
+    const touchedPaths = writePath === fullPath ? [fullPath] : [fullPath, writePath];
+    invalidateBuiltinResultCache(touchedPaths);
+    markCodeGraphDirtyPaths(touchedPaths);
     recordReadSnapshotForPath(fullPath, readStateScope, {
       source: 'apply_patch_js',
       isPartialView: false,
-      preMutationStat,
+      preMutationStat: snapshotStat,
     });
   }
   const { added, removed } = countHunkChanges(entry.hunks);

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -33,10 +33,11 @@ import {
 } from './paths.mjs';
 import { ensureNativePatchBinaryAvailable } from './native-server.mjs';
 import { assertPathReachable } from '../builtin/fs-reachability.mjs';
+import { symlinkWriteTarget } from '../builtin/atomic-write.mjs';
 import { findBySuffixStrip, findFileByBasename } from '../builtin/path-diagnostics.mjs';
 import { resolveReadPathRedirect } from '../builtin/snapshot-store.mjs';
 import { dispatchNativePatch, dispatchJsPatchEntries } from './dispatch.mjs';
-import { patchTargetUsesUtf16 } from './matcher.mjs';
+import { patchTargetUsesUtf16, splitTextLinesForPatch } from './matcher.mjs';
 import { nativePatchSessionSatisfiesContract } from './native-server.mjs';
 import {
   planV4ARenameSections,
@@ -202,21 +203,29 @@ async function applyParsedWave({ parsed: wparsed, entries: wentries, headerRewri
   // included — so the whole wave takes the JS writer.
   const codecNeedsJs = (fullPath, kind) => kind !== 'create' && kind !== 'delete'
     && patchTargetUsesUtf16(fullPath);
-  const needsJsCodec = (fullPath, kind) => !engineContractOk || codecNeedsJs(fullPath, kind);
+  // A symlinked target takes the JS writer too: the native engine renames its
+  // output over the path it was handed, which would replace the link with a
+  // regular file. The JS writer resolves the link and rewrites the file it
+  // points at. Delete is exempt — removing the link itself is correct there.
+  const symlinkNeedsJs = (fullPath, kind) => kind !== 'create' && kind !== 'delete'
+    && symlinkWriteTarget(fullPath) !== null;
+  const needsJsWriter = (fullPath, kind) => !engineContractOk
+    || codecNeedsJs(fullPath, kind)
+    || symlinkNeedsJs(fullPath, kind);
   const nativeEntries = wentries.filter(
     (entry) => entry.kind !== 'create'
       && !isResolvedPathOutsideBase(entry.fullPath, basePath)
-      && !needsJsCodec(entry.fullPath, entry.kind),
+      && !needsJsWriter(entry.fullPath, entry.kind),
   );
   const jsEntries = wentries.filter(
     (entry) => entry.kind === 'create'
       || isResolvedPathOutsideBase(entry.fullPath, basePath)
-      || needsJsCodec(entry.fullPath, entry.kind),
+      || needsJsWriter(entry.fullPath, entry.kind),
   );
   const parsedInside = (wparsed || []).filter(
     (entry) => classifyEntry(entry) !== 'create'
       && !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath)
-      && !needsJsCodec(parsedEntryResolvedPath(entry, basePath), classifyEntry(entry)),
+      && !needsJsWriter(parsedEntryResolvedPath(entry, basePath), classifyEntry(entry)),
   );
   const executor = jsEntries.length > 0
     ? (nativeEntries.length > 0 ? 'native+js-patch' : 'js-patch')
@@ -802,6 +811,44 @@ function salvageShatteredV4APatchArgs(args) {
   return cleaned;
 }
 
+// A whole-file rewrite is naturally written as "delete the old file, add the
+// new one", and that pair has exactly ONE possible outcome: the file ends up
+// holding the Add body. Rejecting it as a conflicting target cost a full turn
+// for a patch that was never ambiguous. Collapse it instead — into a full-file
+// Update when the target exists, so every ordinary update guard (special
+// files, reachability, verification, write locks) still runs, or into the
+// plain Add when it does not exist and the Delete had nothing to remove.
+// Everything else (Update+Delete, Add+Add, renames) keeps rejecting: those
+// pairs genuinely describe two different end states.
+function collapseDeleteThenAddSection(prior, section, fullPath) {
+    if (prior?.kind !== 'delete' || section?.kind !== 'add') return null;
+    if (prior.movePath || section.movePath) return null;
+    const added = Array.isArray(section.lines) ? [...section.lines] : [];
+    let raw;
+    try {
+        raw = readFileSync(fullPath);
+    } catch (error) {
+        if (error?.code !== 'ENOENT') return null;
+        return { ...section, lines: added, hunks: [] };
+    }
+    // A binary target has no line model to rewrite; leave it to the existing
+    // conflict error rather than inventing one.
+    if (raw.includes(0)) return null;
+    const current = splitTextLinesForPatch(raw.toString('utf8'));
+    return {
+        kind: 'update',
+        path: section.path,
+        lines: [],
+        hunks: [{
+            anchors: [],
+            lines: [
+                ...[...current].map((line) => `-${line}`),
+                ...added.map((line) => `+${line}`),
+            ],
+        }],
+    };
+}
+
 function coalesceCompatibleV4ASections(sections, basePath) {
   const out = [];
   const indexByPath = new Map();
@@ -823,6 +870,11 @@ function coalesceCompatibleV4ASections(sections, basePath) {
       continue;
     }
     const prior = out[priorIndex];
+    const replaced = collapseDeleteThenAddSection(prior, section, fullPath);
+    if (replaced) {
+      out[priorIndex] = replaced;
+      continue;
+    }
     const mergeable = prior?.kind === 'update'
       && section.kind === 'update'
       && !prior.movePath

package/src/runtime/agent/orchestrator/tools/patch/patch-symlink.test.mjs

@@ -0,0 +1,141 @@
+// apply_patch through a symlink. The TOCTOU snapshot has to follow the link
+// exactly the way atomicWrite does; an lstat of the link inode never matches
+// the followed stat, which rejected every such patch as "changed on disk".
+// The link itself must also survive the atomic rename.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    lstatSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    rmSync,
+    symlinkSync,
+    writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { executePatchTool } from '../patch.mjs';
+import { closeNativePatchServerForTests } from './native-server.mjs';
+
+// Windows without Developer Mode / admin rights refuses symlink creation
+// (EPERM), so the host capability decides whether this case can run at all.
+function symlinkSupported(dir) {
+    try {
+        writeFileSync(join(dir, 'probe.txt'), 'x');
+        symlinkSync(join(dir, 'probe.txt'), join(dir, 'probe.link'));
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+const asHeaderPath = (p) => p.replace(/\\/g, '/');
+
+test('apply_patch updates a symlinked file through the link', async (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'mixdog-patch-symlink-'));
+    t.after(() => {
+        rmSync(dir, { recursive: true, force: true });
+        void closeNativePatchServerForTests?.();
+    });
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    // Target outside base_path — the shape that routes to the JS writer, and
+    // the exact shape of the nginx sites-enabled/default case from the bench.
+    const base = join(dir, 'app');
+    mkdirSync(base);
+    const real = join(dir, 'sites-available.conf');
+    const link = join(dir, 'sites-enabled.conf');
+    writeFileSync(real, 'root /var/www/html;\nindex index.html;\n');
+    symlinkSync(real, link);
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: base,
+        patch: `*** Begin Patch
+*** Update File: ${asHeaderPath(link)}
+@@
+-root /var/www/html;
++root /usr/share/novnc;
+ index index.html;
+*** End Patch
+`,
+    }, base, {}));
+
+    assert.doesNotMatch(result, /^Error/);
+    assert.doesNotMatch(result, /changed on disk/);
+    assert.equal(readFileSync(real, 'utf8'), 'root /usr/share/novnc;\nindex index.html;\n');
+    assert.equal(readFileSync(link, 'utf8'), 'root /usr/share/novnc;\nindex index.html;\n');
+    // The link is still a link: the write landed on its target, not on top of it.
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('an in-base symlinked target is patched through the link', async (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'mixdog-patch-symlink-'));
+    t.after(() => {
+        rmSync(dir, { recursive: true, force: true });
+        void closeNativePatchServerForTests?.();
+    });
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    // Inside base_path the native engine would normally take this entry; a
+    // symlinked target has to be routed to the JS writer instead, because the
+    // engine renames its output over the path it was handed.
+    const real = join(dir, 'real.conf');
+    const link = join(dir, 'link.conf');
+    writeFileSync(real, 'keep\nold\n');
+    symlinkSync(real, link);
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: link.conf
+@@
+ keep
+-old
++new
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(readFileSync(real, 'utf8'), 'keep\nnew\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('a second patch through the same link still sees a fresh snapshot', async (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'mixdog-patch-symlink-'));
+    t.after(() => {
+        rmSync(dir, { recursive: true, force: true });
+        void closeNativePatchServerForTests?.();
+    });
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const base = join(dir, 'app');
+    mkdirSync(base);
+    const real = join(dir, 'real.conf');
+    const link = join(dir, 'link.conf');
+    writeFileSync(real, 'a\nb\n');
+    symlinkSync(real, link);
+
+    const patch = (from, to) => `*** Begin Patch
+*** Update File: ${asHeaderPath(link)}
+@@
+-${from}
++${to}
+ b
+*** End Patch
+`;
+    const first = String(await executePatchTool('apply_patch', { base_path: base, patch: patch('a', 'A') }, base, {}));
+    assert.doesNotMatch(first, /^Error/);
+    const second = String(await executePatchTool('apply_patch', { base_path: base, patch: patch('A', 'AA') }, base, {}));
+    assert.doesNotMatch(second, /^Error/);
+    assert.equal(readFileSync(real, 'utf8'), 'AA\nb\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -598,9 +598,13 @@ export function validateV4ARenameSection(section, basePath, seenDestKeys) {
       return `apply_patch: V4A rename destination unreadable: ${normalizeOutputPath(section.movePath)} (${err?.code || err?.message || String(err)})`;
     }
   }
-  if (!section.hunks?.length) {
-    return `apply_patch: V4A rename for ${normalizeOutputPath(section.path)} has no update hunks`;
-  }
+  // A rename with no hunks is a PURE MOVE — `git mv` in V4A form — and its
+  // outcome is fully specified by the two paths: the file arrives at the
+  // destination byte-identical and leaves the source. Demanding an edit made
+  // the one unambiguous shape the only rejected one (measured: a Makefile.config
+  // move cost a turn and a fallback shell `mv`). The hunk applier already
+  // treats an empty hunk list as "no change", so the move runs through the
+  // same guarded write/unlink path as any other rename.
   return null;
 }
 

package/src/runtime/agent/orchestrator/tools/patch/v4a-pure-move.test.mjs

@@ -0,0 +1,57 @@
+// `*** Update File: X` + `*** Move to: Y` with no hunks is a pure move — the
+// V4A spelling of `git mv` — and its outcome is fully specified by the two
+// paths.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { executePatchTool } from '../patch.mjs';
+import { closeNativePatchServerForTests } from './native-server.mjs';
+
+function makeDir() {
+    return mkdtempSync(join(tmpdir(), 'mixdog-v4a-move-'));
+}
+
+test('a hunkless rename moves the file byte-identically', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const before = 'CPU_ONLY := 1\r\nBLAS := atlas\n';
+    writeFileSync(join(dir, 'Makefile.config'), before);
+    mkdirSync(join(dir, 'caffe'), { recursive: true });
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: Makefile.config
+*** Move to: caffe/Makefile.config
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /no update hunks/);
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(existsSync(join(dir, 'Makefile.config')), false);
+    assert.equal(readFileSync(join(dir, 'caffe', 'Makefile.config'), 'utf8'), before);
+});
+
+test('a move onto an existing file is still refused', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    writeFileSync(join(dir, 'a.txt'), 'source\n');
+    writeFileSync(join(dir, 'b.txt'), 'occupied\n');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: a.txt
+*** Move to: b.txt
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.match(result, /destination already exists/);
+    assert.equal(readFileSync(join(dir, 'a.txt'), 'utf8'), 'source\n');
+    assert.equal(readFileSync(join(dir, 'b.txt'), 'utf8'), 'occupied\n');
+});

package/src/runtime/agent/orchestrator/tools/patch/v4a-section-coalesce.test.mjs

@@ -0,0 +1,81 @@
+// A whole-file rewrite written as "Delete File + Add File" for ONE path has a
+// single possible outcome, so it applies instead of being rejected as a
+// conflicting target. Genuinely ambiguous pairs keep rejecting.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { executePatchTool } from '../patch.mjs';
+import { closeNativePatchServerForTests } from './native-server.mjs';
+
+function makeDir() {
+    return mkdtempSync(join(tmpdir(), 'mixdog-v4a-coalesce-'));
+}
+
+test('Delete + Add on one existing path rewrites the file', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const file = join(dir, 'algo.py');
+    writeFileSync(file, 'def map(grid):\n    return grid\n');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Delete File: algo.py
+*** Add File: algo.py
++def map(grid):
++    return [row[::-1] for row in grid]
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /conflicting operations target/);
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(
+        readFileSync(file, 'utf8'),
+        'def map(grid):\n    return [row[::-1] for row in grid]\n',
+    );
+});
+
+test('Delete + Add for a path that does not exist still creates the file', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const file = join(dir, 'fresh.txt');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Delete File: fresh.txt
+*** Add File: fresh.txt
++created
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(readFileSync(file, 'utf8'), 'created\n');
+});
+
+test('Update + Delete on one path is still refused without touching the file', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const file = join(dir, 'target.txt');
+    writeFileSync(file, 'aleph\nbravo\ndelta\n');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: target.txt
+@@
+-bravo
++temporary
+*** Delete File: target.txt
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.match(result, /conflicting operations target/);
+    assert.equal(readFileSync(file, 'utf8'), 'aleph\nbravo\ndelta\n');
+});

package/src/runtime/agent/orchestrator/tools/shell-command.mjs

@@ -821,28 +821,42 @@ export function execShellCommand({
         : (backgroundDeadlineMs > 0
           ? Math.max(1, backgroundDeadlineMs - elapsedMs)
           : 0);
-      try {
-        job = await promoteForegroundShellJob({
-          command,
-          cwd,
-          pid: child.pid,
-          jobId: _foregroundRecordId,
-          timeoutMs: remainingBackgroundTimeoutMs,
-          // Carry the command's own start moment into the job: promotion time
-          // and a standby's process-creation time are both wrong.
-          startedAtMs: _commandStartedAtMs,
-          mergeStderr: false,
-          stdoutPath,
-          stderrPath,
-          // Stamp the promoted job with the dispatching terminal's claude.exe
-          // pid so the statusline scopes it to the owning session.
-          clientHostPid,
-          // …and with the dispatching SESSION, so a pooled host (desktop) can
-          // show the job on its own pane only.
-          ownerSessionId,
-        });
-      } catch {
-        job = null;
+      let promotionFailure = '';
+      const _tryPromote = async () => {
+        try {
+          const promoted = await promoteForegroundShellJob({
+            command,
+            cwd,
+            pid: child.pid,
+            jobId: _foregroundRecordId,
+            timeoutMs: remainingBackgroundTimeoutMs,
+            // Carry the command's own start moment into the job: promotion time
+            // and a standby's process-creation time are both wrong.
+            startedAtMs: _commandStartedAtMs,
+            mergeStderr: false,
+            stdoutPath,
+            stderrPath,
+            // Stamp the promoted job with the dispatching terminal's claude.exe
+            // pid so the statusline scopes it to the owning session.
+            clientHostPid,
+            // …and with the dispatching SESSION, so a pooled host (desktop) can
+            // show the job on its own pane only.
+            ownerSessionId,
+          });
+          if (!promoted) promotionFailure = promotionFailure || 'promotion unavailable';
+          return promoted;
+        } catch (err) {
+          promotionFailure = err?.message || String(err);
+          return null;
+        }
+      };
+      job = await _tryPromote();
+      // One bounded retry: a promotion that failed on a transient registry/IPC
+      // race heals within a beat, while a capability gap fails identically and
+      // falls through to the kill path with its reason attached below.
+      if (!job && !settled && child.exitCode == null && child.signalCode == null) {
+        await new Promise((resolve) => setTimeout(resolve, 250));
+        job = await _tryPromote();
       }
       // Adoption failed AFTER the foreground timers/size-watchdog were already
       // torn down. Do NOT resolve as backgrounded — that would leave the child
@@ -856,7 +870,12 @@ export function execShellCommand({
           timedOut = true;
           _treeKillForceSettle('timeout');
         } else {
-          _treeKillForceSettle('background-promotion-failed');
+          // Keep the stable cause tag first (trace classifiers match on it)
+          // and attach the captured reason so the next occurrence is
+          // diagnosable from the transcript alone.
+          _treeKillForceSettle(promotionFailure
+            ? `background-promotion-failed (${promotionFailure.slice(0, 120)})`
+            : 'background-promotion-failed');
         }
         return;
       }

package/src/runtime/media/renditions.mjs

@@ -60,7 +60,13 @@ export function renditionSpec(variant) {
 
 let sharpPromise;
 async function loadSharp() {
-  sharpPromise ??= import('sharp').then((mod) => mod?.default || mod || null, () => null);
+  sharpPromise ??= import('sharp').then((mod) => {
+    const sharp = mod?.default || mod || null;
+    // Renditions are cached on disk; libvips' in-memory operation cache
+    // (default ~50MB per process) would only duplicate them in native memory.
+    try { sharp?.cache(false); } catch { /* cache stays default */ }
+    return sharp;
+  }, () => null);
   return sharpPromise;
 }
 

package/src/runtime/memory/index.mjs

@@ -691,10 +691,8 @@ export async function stop() {
     // closeDatabase() only ends the client pool; without this the child
     // postmaster keeps running after the unified daemon exits.
     if (!memorySecondaryMode()) {
-      try {
-        const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
-        await stopPgForShutdown()
-      } catch {}
+      const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
+      await stopPgForShutdown()
     } else {
       __mixdogMemoryLog('[memory-service] secondary mode; leaving shared PG running\n')
     }