mixdog 0.9.150 → 0.9.151

package/src/runtime/agent/orchestrator/tools/patch/orchestrator.mjs

@@ -33,10 +33,11 @@ import {
 } from './paths.mjs';
 import { ensureNativePatchBinaryAvailable } from './native-server.mjs';
 import { assertPathReachable } from '../builtin/fs-reachability.mjs';
+import { symlinkWriteTarget } from '../builtin/atomic-write.mjs';
 import { findBySuffixStrip, findFileByBasename } from '../builtin/path-diagnostics.mjs';
 import { resolveReadPathRedirect } from '../builtin/snapshot-store.mjs';
 import { dispatchNativePatch, dispatchJsPatchEntries } from './dispatch.mjs';
-import { patchTargetUsesUtf16 } from './matcher.mjs';
+import { patchTargetUsesUtf16, splitTextLinesForPatch } from './matcher.mjs';
 import { nativePatchSessionSatisfiesContract } from './native-server.mjs';
 import {
   planV4ARenameSections,
@@ -202,21 +203,29 @@ async function applyParsedWave({ parsed: wparsed, entries: wentries, headerRewri
   // included — so the whole wave takes the JS writer.
   const codecNeedsJs = (fullPath, kind) => kind !== 'create' && kind !== 'delete'
     && patchTargetUsesUtf16(fullPath);
-  const needsJsCodec = (fullPath, kind) => !engineContractOk || codecNeedsJs(fullPath, kind);
+  // A symlinked target takes the JS writer too: the native engine renames its
+  // output over the path it was handed, which would replace the link with a
+  // regular file. The JS writer resolves the link and rewrites the file it
+  // points at. Delete is exempt — removing the link itself is correct there.
+  const symlinkNeedsJs = (fullPath, kind) => kind !== 'create' && kind !== 'delete'
+    && symlinkWriteTarget(fullPath) !== null;
+  const needsJsWriter = (fullPath, kind) => !engineContractOk
+    || codecNeedsJs(fullPath, kind)
+    || symlinkNeedsJs(fullPath, kind);
   const nativeEntries = wentries.filter(
     (entry) => entry.kind !== 'create'
       && !isResolvedPathOutsideBase(entry.fullPath, basePath)
-      && !needsJsCodec(entry.fullPath, entry.kind),
+      && !needsJsWriter(entry.fullPath, entry.kind),
   );
   const jsEntries = wentries.filter(
     (entry) => entry.kind === 'create'
       || isResolvedPathOutsideBase(entry.fullPath, basePath)
-      || needsJsCodec(entry.fullPath, entry.kind),
+      || needsJsWriter(entry.fullPath, entry.kind),
   );
   const parsedInside = (wparsed || []).filter(
     (entry) => classifyEntry(entry) !== 'create'
       && !isResolvedPathOutsideBase(parsedEntryResolvedPath(entry, basePath), basePath)
-      && !needsJsCodec(parsedEntryResolvedPath(entry, basePath), classifyEntry(entry)),
+      && !needsJsWriter(parsedEntryResolvedPath(entry, basePath), classifyEntry(entry)),
   );
   const executor = jsEntries.length > 0
     ? (nativeEntries.length > 0 ? 'native+js-patch' : 'js-patch')
@@ -802,6 +811,44 @@ function salvageShatteredV4APatchArgs(args) {
   return cleaned;
 }
 
+// A whole-file rewrite is naturally written as "delete the old file, add the
+// new one", and that pair has exactly ONE possible outcome: the file ends up
+// holding the Add body. Rejecting it as a conflicting target cost a full turn
+// for a patch that was never ambiguous. Collapse it instead — into a full-file
+// Update when the target exists, so every ordinary update guard (special
+// files, reachability, verification, write locks) still runs, or into the
+// plain Add when it does not exist and the Delete had nothing to remove.
+// Everything else (Update+Delete, Add+Add, renames) keeps rejecting: those
+// pairs genuinely describe two different end states.
+function collapseDeleteThenAddSection(prior, section, fullPath) {
+    if (prior?.kind !== 'delete' || section?.kind !== 'add') return null;
+    if (prior.movePath || section.movePath) return null;
+    const added = Array.isArray(section.lines) ? [...section.lines] : [];
+    let raw;
+    try {
+        raw = readFileSync(fullPath);
+    } catch (error) {
+        if (error?.code !== 'ENOENT') return null;
+        return { ...section, lines: added, hunks: [] };
+    }
+    // A binary target has no line model to rewrite; leave it to the existing
+    // conflict error rather than inventing one.
+    if (raw.includes(0)) return null;
+    const current = splitTextLinesForPatch(raw.toString('utf8'));
+    return {
+        kind: 'update',
+        path: section.path,
+        lines: [],
+        hunks: [{
+            anchors: [],
+            lines: [
+                ...[...current].map((line) => `-${line}`),
+                ...added.map((line) => `+${line}`),
+            ],
+        }],
+    };
+}
+
 function coalesceCompatibleV4ASections(sections, basePath) {
   const out = [];
   const indexByPath = new Map();
@@ -823,6 +870,11 @@ function coalesceCompatibleV4ASections(sections, basePath) {
       continue;
     }
     const prior = out[priorIndex];
+    const replaced = collapseDeleteThenAddSection(prior, section, fullPath);
+    if (replaced) {
+      out[priorIndex] = replaced;
+      continue;
+    }
     const mergeable = prior?.kind === 'update'
       && section.kind === 'update'
       && !prior.movePath

package/src/runtime/agent/orchestrator/tools/patch/patch-symlink.test.mjs

@@ -0,0 +1,141 @@
+// apply_patch through a symlink. The TOCTOU snapshot has to follow the link
+// exactly the way atomicWrite does; an lstat of the link inode never matches
+// the followed stat, which rejected every such patch as "changed on disk".
+// The link itself must also survive the atomic rename.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    lstatSync,
+    mkdirSync,
+    mkdtempSync,
+    readFileSync,
+    rmSync,
+    symlinkSync,
+    writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { executePatchTool } from '../patch.mjs';
+import { closeNativePatchServerForTests } from './native-server.mjs';
+
+// Windows without Developer Mode / admin rights refuses symlink creation
+// (EPERM), so the host capability decides whether this case can run at all.
+function symlinkSupported(dir) {
+    try {
+        writeFileSync(join(dir, 'probe.txt'), 'x');
+        symlinkSync(join(dir, 'probe.txt'), join(dir, 'probe.link'));
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+const asHeaderPath = (p) => p.replace(/\\/g, '/');
+
+test('apply_patch updates a symlinked file through the link', async (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'mixdog-patch-symlink-'));
+    t.after(() => {
+        rmSync(dir, { recursive: true, force: true });
+        void closeNativePatchServerForTests?.();
+    });
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    // Target outside base_path — the shape that routes to the JS writer, and
+    // the exact shape of the nginx sites-enabled/default case from the bench.
+    const base = join(dir, 'app');
+    mkdirSync(base);
+    const real = join(dir, 'sites-available.conf');
+    const link = join(dir, 'sites-enabled.conf');
+    writeFileSync(real, 'root /var/www/html;\nindex index.html;\n');
+    symlinkSync(real, link);
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: base,
+        patch: `*** Begin Patch
+*** Update File: ${asHeaderPath(link)}
+@@
+-root /var/www/html;
++root /usr/share/novnc;
+ index index.html;
+*** End Patch
+`,
+    }, base, {}));
+
+    assert.doesNotMatch(result, /^Error/);
+    assert.doesNotMatch(result, /changed on disk/);
+    assert.equal(readFileSync(real, 'utf8'), 'root /usr/share/novnc;\nindex index.html;\n');
+    assert.equal(readFileSync(link, 'utf8'), 'root /usr/share/novnc;\nindex index.html;\n');
+    // The link is still a link: the write landed on its target, not on top of it.
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('an in-base symlinked target is patched through the link', async (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'mixdog-patch-symlink-'));
+    t.after(() => {
+        rmSync(dir, { recursive: true, force: true });
+        void closeNativePatchServerForTests?.();
+    });
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    // Inside base_path the native engine would normally take this entry; a
+    // symlinked target has to be routed to the JS writer instead, because the
+    // engine renames its output over the path it was handed.
+    const real = join(dir, 'real.conf');
+    const link = join(dir, 'link.conf');
+    writeFileSync(real, 'keep\nold\n');
+    symlinkSync(real, link);
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: link.conf
+@@
+ keep
+-old
++new
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(readFileSync(real, 'utf8'), 'keep\nnew\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});
+
+test('a second patch through the same link still sees a fresh snapshot', async (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'mixdog-patch-symlink-'));
+    t.after(() => {
+        rmSync(dir, { recursive: true, force: true });
+        void closeNativePatchServerForTests?.();
+    });
+    if (!symlinkSupported(dir)) {
+        t.skip('symlink creation is not permitted on this host');
+        return;
+    }
+    const base = join(dir, 'app');
+    mkdirSync(base);
+    const real = join(dir, 'real.conf');
+    const link = join(dir, 'link.conf');
+    writeFileSync(real, 'a\nb\n');
+    symlinkSync(real, link);
+
+    const patch = (from, to) => `*** Begin Patch
+*** Update File: ${asHeaderPath(link)}
+@@
+-${from}
++${to}
+ b
+*** End Patch
+`;
+    const first = String(await executePatchTool('apply_patch', { base_path: base, patch: patch('a', 'A') }, base, {}));
+    assert.doesNotMatch(first, /^Error/);
+    const second = String(await executePatchTool('apply_patch', { base_path: base, patch: patch('A', 'AA') }, base, {}));
+    assert.doesNotMatch(second, /^Error/);
+    assert.equal(readFileSync(real, 'utf8'), 'AA\nb\n');
+    assert.equal(lstatSync(link).isSymbolicLink(), true);
+});

package/src/runtime/agent/orchestrator/tools/patch/v4a-convert.mjs

@@ -598,9 +598,13 @@ export function validateV4ARenameSection(section, basePath, seenDestKeys) {
       return `apply_patch: V4A rename destination unreadable: ${normalizeOutputPath(section.movePath)} (${err?.code || err?.message || String(err)})`;
     }
   }
-  if (!section.hunks?.length) {
-    return `apply_patch: V4A rename for ${normalizeOutputPath(section.path)} has no update hunks`;
-  }
+  // A rename with no hunks is a PURE MOVE — `git mv` in V4A form — and its
+  // outcome is fully specified by the two paths: the file arrives at the
+  // destination byte-identical and leaves the source. Demanding an edit made
+  // the one unambiguous shape the only rejected one (measured: a Makefile.config
+  // move cost a turn and a fallback shell `mv`). The hunk applier already
+  // treats an empty hunk list as "no change", so the move runs through the
+  // same guarded write/unlink path as any other rename.
   return null;
 }
 

package/src/runtime/agent/orchestrator/tools/patch/v4a-pure-move.test.mjs

@@ -0,0 +1,57 @@
+// `*** Update File: X` + `*** Move to: Y` with no hunks is a pure move — the
+// V4A spelling of `git mv` — and its outcome is fully specified by the two
+// paths.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { executePatchTool } from '../patch.mjs';
+import { closeNativePatchServerForTests } from './native-server.mjs';
+
+function makeDir() {
+    return mkdtempSync(join(tmpdir(), 'mixdog-v4a-move-'));
+}
+
+test('a hunkless rename moves the file byte-identically', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const before = 'CPU_ONLY := 1\r\nBLAS := atlas\n';
+    writeFileSync(join(dir, 'Makefile.config'), before);
+    mkdirSync(join(dir, 'caffe'), { recursive: true });
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: Makefile.config
+*** Move to: caffe/Makefile.config
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /no update hunks/);
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(existsSync(join(dir, 'Makefile.config')), false);
+    assert.equal(readFileSync(join(dir, 'caffe', 'Makefile.config'), 'utf8'), before);
+});
+
+test('a move onto an existing file is still refused', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    writeFileSync(join(dir, 'a.txt'), 'source\n');
+    writeFileSync(join(dir, 'b.txt'), 'occupied\n');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: a.txt
+*** Move to: b.txt
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.match(result, /destination already exists/);
+    assert.equal(readFileSync(join(dir, 'a.txt'), 'utf8'), 'source\n');
+    assert.equal(readFileSync(join(dir, 'b.txt'), 'utf8'), 'occupied\n');
+});

package/src/runtime/agent/orchestrator/tools/patch/v4a-section-coalesce.test.mjs

@@ -0,0 +1,81 @@
+// A whole-file rewrite written as "Delete File + Add File" for ONE path has a
+// single possible outcome, so it applies instead of being rejected as a
+// conflicting target. Genuinely ambiguous pairs keep rejecting.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { executePatchTool } from '../patch.mjs';
+import { closeNativePatchServerForTests } from './native-server.mjs';
+
+function makeDir() {
+    return mkdtempSync(join(tmpdir(), 'mixdog-v4a-coalesce-'));
+}
+
+test('Delete + Add on one existing path rewrites the file', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const file = join(dir, 'algo.py');
+    writeFileSync(file, 'def map(grid):\n    return grid\n');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Delete File: algo.py
+*** Add File: algo.py
++def map(grid):
++    return [row[::-1] for row in grid]
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /conflicting operations target/);
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(
+        readFileSync(file, 'utf8'),
+        'def map(grid):\n    return [row[::-1] for row in grid]\n',
+    );
+});
+
+test('Delete + Add for a path that does not exist still creates the file', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const file = join(dir, 'fresh.txt');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Delete File: fresh.txt
+*** Add File: fresh.txt
++created
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.doesNotMatch(result, /^Error/);
+    assert.equal(readFileSync(file, 'utf8'), 'created\n');
+});
+
+test('Update + Delete on one path is still refused without touching the file', async (t) => {
+    const dir = makeDir();
+    t.after(() => { rmSync(dir, { recursive: true, force: true }); void closeNativePatchServerForTests?.(); });
+    const file = join(dir, 'target.txt');
+    writeFileSync(file, 'aleph\nbravo\ndelta\n');
+
+    const result = String(await executePatchTool('apply_patch', {
+        base_path: dir,
+        patch: `*** Begin Patch
+*** Update File: target.txt
+@@
+-bravo
++temporary
+*** Delete File: target.txt
+*** End Patch
+`,
+    }, dir, {}));
+
+    assert.match(result, /conflicting operations target/);
+    assert.equal(readFileSync(file, 'utf8'), 'aleph\nbravo\ndelta\n');
+});

package/src/runtime/memory/index.mjs

@@ -691,10 +691,8 @@ export async function stop() {
     // closeDatabase() only ends the client pool; without this the child
     // postmaster keeps running after the unified daemon exits.
     if (!memorySecondaryMode()) {
-      try {
-        const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
-        await stopPgForShutdown()
-      } catch {}
+      const { stopPgForShutdown } = await import('./lib/pg/supervisor.mjs')
+      await stopPgForShutdown()
     } else {
       __mixdogMemoryLog('[memory-service] secondary mode; leaving shared PG running\n')
     }

package/src/runtime/memory/lib/pg/process.mjs

@@ -444,7 +444,7 @@ export async function stopPg({ runtimeDir, pgdataDir }) {
   })
 
   if (r.status !== 0) {
-    const msg = r.stderr?.toString() || r.stdout?.toString() || ''
+    const msg = r.error?.message || r.stderr?.toString() || r.stdout?.toString() || ''
     // Stale postmaster.pid — PG is already down; clean up and continue.
     if (
       msg.includes('no server running') ||
@@ -453,10 +453,16 @@ export async function stopPg({ runtimeDir, pgdataDir }) {
     ) {
       __mixdogMemoryLog(`[pg-process] stopPg: already stopped (${msg.slice(0, 80)})\n`)
       try { rmSync(join(pgdataDir, 'postmaster.pid'), { force: true }) } catch {}
+      return
     } else {
       __mixdogMemoryLog(`[pg-process] pg_ctl stop warning: ${msg}\n`)
+      throw new Error(`pg_ctl stop failed${msg ? `: ${msg.trim()}` : ''}`)
     }
   }
+  const remaining = readPostmasterInfo(pgdataDir)
+  if (remaining.pid && isPidAlive(remaining.pid)) {
+    throw new Error(`postgres postmaster pid=${remaining.pid} survived pg_ctl stop`)
+  }
 }
 
 // Synchronous best-effort variant for a process 'exit' hook (only sync work is
@@ -494,6 +500,7 @@ export function classifyOrphanTempPostmaster({
   args,
   uptimeSec,
   tempRoot,
+  ownerAlive = false,
   minUptimeSec = ORPHAN_TEMP_PG_MIN_UPTIME_SEC,
 }) {
   const commandLine = String(args || '')
@@ -506,9 +513,24 @@ export function classifyOrphanTempPostmaster({
   const root = normalizePathForMatch(tempRoot).replace(/\/+$/, '')
   if (!root || !dataDir.startsWith(`${root}/`)) return false
   if (!dataDir.includes('mixdog')) return false
+  if (ownerAlive) return false
   return Number(uptimeSec) >= Math.max(60, Number(minUptimeSec) || ORPHAN_TEMP_PG_MIN_UPTIME_SEC)
 }
 
+function tempPostmasterOwnerAlive(args) {
+  const commandLine = String(args || '')
+  const dataDirMatch = commandLine.match(/(?:^|\s)-D\s+"?([^"]+?)"?(?:\s|$)/)
+  if (!dataDirMatch) return false
+  const dataRoot = join(dataDirMatch[1], '..')
+  for (const name of ['memory-runtime-owner.json', 'daemon-owner.json']) {
+    try {
+      const owner = JSON.parse(readFileSync(join(dataRoot, name), 'utf8'))
+      if (Number(owner?.pid) > 0 && isPidAlive(Number(owner.pid))) return true
+    } catch {}
+  }
+  return false
+}
+
 function listPostmasterRows() {
   if (process.platform === 'win32') {
     const result = spawnSync('powershell', ['-NoProfile', '-Command',
@@ -545,7 +567,12 @@ export function sweepOrphanTempPostmasters({ tempRoot, minUptimeSec } = {}) {
     const root = tempRoot || os.tmpdir()
     for (const row of listPostmasterRows()) {
       if (!row.pid || row.pid === process.pid) continue
-      if (!classifyOrphanTempPostmaster({ ...row, tempRoot: root, minUptimeSec })) continue
+      if (!classifyOrphanTempPostmaster({
+        ...row,
+        tempRoot: root,
+        ownerAlive: tempPostmasterOwnerAlive(row.args),
+        minUptimeSec,
+      })) continue
       try {
         process.kill(row.pid)
         reaped += 1

package/src/runtime/memory/lib/pg/process.test.mjs

@@ -0,0 +1,36 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { classifyOrphanTempPostmaster } from './process.mjs';
+
+const tempRoot = process.platform === 'win32'
+  ? 'C:/Users/test/AppData/Local/Temp'
+  : '/tmp';
+const args = `"${tempRoot}/mixdog-headless-pristine-test/data/runtime/bin/postgres" `
+  + `-D "${tempRoot}/mixdog-headless-pristine-test/data/pgdata"`;
+
+test('old unowned temp postmasters are sweep candidates', () => {
+  assert.equal(classifyOrphanTempPostmaster({
+    args,
+    uptimeSec: 3600,
+    tempRoot,
+    ownerAlive: false,
+  }), true);
+});
+
+test('a live owner protects a long-running temp postmaster', () => {
+  assert.equal(classifyOrphanTempPostmaster({
+    args,
+    uptimeSec: 3600,
+    tempRoot,
+    ownerAlive: true,
+  }), false);
+});
+
+test('the official data directory is never a sweep candidate', () => {
+  assert.equal(classifyOrphanTempPostmaster({
+    args: 'postgres -D "/home/test/.mixdog/data/pgdata"',
+    uptimeSec: 3600,
+    tempRoot,
+  }), false);
+});

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -458,6 +458,7 @@ async function tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source =
         // patchActiveInstance) so a concurrent restart/owner change is not
         // clobbered by this reuse-time snapshot.
         _restampReuseOwner({ pgdata, port: existingPort });
+        scheduleOrphanTempPostmasterSweep();
         return { host: '127.0.0.1', port: existingPort, runtimeDir: existingRtDir, pgdataDir: pgdata };
       }
     } catch {}
@@ -475,6 +476,7 @@ async function tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source =
           pg_pgdata: pgdata,
           pg_runtime_dir: runtimeDir,
         }, { timeoutMs: 1000, background: true });
+        scheduleOrphanTempPostmasterSweep();
         return { host: '127.0.0.1', port: pm.port, runtimeDir, pgdataDir: pgdata };
       }
     } catch {}
@@ -674,6 +676,7 @@ export async function stopPgForShutdown() {
       __mixdogMemoryLog(`[supervisor-pg] PG stopped (via active-instance.json) on shutdown\n`);
     } catch (e) {
       __mixdogMemoryLog(`[supervisor-pg] stopPg error on shutdown (no _live): ${e?.message}\n`);
+      throw e;
     }
     // Bounded sync clear (<=4s: 2s + one 2s retry). A residual stale pg_port is
     // tolerated — readers healthcheck-verify the port before reuse.
@@ -681,14 +684,15 @@ export async function stopPgForShutdown() {
     return;
   }
   const snap = _live;
-  _live = null;
   _ensureInFlight = null;
   try {
     const { stopPg } = await _getPgProc();
     await stopPg({ runtimeDir: snap.runtimeDir, pgdataDir: snap.pgdata });
+    _live = null;
     __mixdogMemoryLog(`[supervisor-pg] PG stopped gracefully on shutdown\n`);
   } catch (e) {
     __mixdogMemoryLog(`[supervisor-pg] stopPg error on shutdown: ${e?.message}\n`);
+    throw e;
   }
   // Bounded sync clear (<=4s: 2s + one 2s retry). A residual stale pg_port is
   // tolerated — readers healthcheck-verify the port before reuse.

package/src/runtime/memory/lib/query-handlers.mjs

@@ -136,7 +136,7 @@ export function createQueryHandlers({
     // Over-fetch before compact-only dedupe so duplicated legacy rows cannot
     // consume the requested page and hide distinct older context.
     const fetchLimit = compactHandoff
-      ? Math.min(1000, Math.max(limit, limit * 10))
+      ? null
       : compactDigest
         ? Math.min(100, Math.max(limit, limit * 4))
         : limit
@@ -189,16 +189,17 @@ export function createQueryHandlers({
       })
       where.push(`(${clauses.join(' OR ')})`)
     }
-    params.push(fetchLimit)
+    if (fetchLimit != null) params.push(fetchLimit)
+    const limitClause = fetchLimit == null ? '' : `LIMIT $${params.length}`
     let rows = (await db.query(`
       SELECT id, ts, role, content, source_ref, session_id, source_turn, time_source, chunk_root, is_root,
              element, category, summary, status, score, last_seen_at, project_id
       FROM entries
       WHERE ${where.join(' AND ')}
       ORDER BY ts DESC, source_turn DESC NULLS LAST, id DESC
-      LIMIT $${params.length}
+      ${limitClause}
     `, params)).rows
-    if (rows.length < fetchLimit) {
+    if (fetchLimit != null && rows.length < fetchLimit) {
       const seen = new Set(rows.map((row) => Number(row.id)).filter((id) => Number.isFinite(id)))
       const fillLimit = Math.max(0, fetchLimit - rows.length)
       const fillWhere = ['session_id = $1', 'id <> ALL($2::bigint[])', '(is_root = 1 OR chunk_root IS NULL OR chunk_root = id)']
@@ -220,7 +221,7 @@ export function createQueryHandlers({
         : []
       if (fillRows.length > 0) rows = [...rows, ...fillRows]
     }
-    if (args.includeMembers === true && !compactHandoff) {
+    if (args.includeMembers === true) {
       const rootIds = rows
         .filter((row) => Number(row.is_root) === 1)
         .map((row) => Number(row.id))
@@ -243,7 +244,7 @@ export function createQueryHandlers({
         }
       }
     }
-    if (compactHandoff) rows = compactHandoffRows(rows, limit)
+    if (compactHandoff) rows = compactHandoffRows(rows)
     else if (compactDigest) rows = compactDigestRows(rows, limit)
     return { text: renderEntryLines(rows, { pendingMarks: !compactDigest && !compactHandoff }) }
   }

package/src/runtime/memory/lib/recall-format.mjs

@@ -399,16 +399,21 @@ export function compactDigestRows(rows, limit = 30) {
     .slice(0, cap)
 }
 
-export function compactHandoffRows(rows, limit = 100) {
-  const cap = Math.max(1, Math.floor(Number(limit) || 100))
-  const deduped = collapseNearDuplicateRows(collapseExactDuplicateRows(Array.isArray(rows) ? rows : []))
-    .filter((row) => !row?._dupStub)
+export function compactHandoffRows(rows) {
+  const deduped = Array.isArray(rows) ? rows : []
   const roots = []
   const raw = []
   for (const row of deduped) {
     if (Number(row?.is_root) === 1) {
-      const { members: _members, ...summaryRow } = row
-      roots.push(summaryRow)
+      if (String(row?.summary ?? '').trim()) {
+        const { members: _members, ...summaryRow } = row
+        roots.push(summaryRow)
+      } else if (Array.isArray(row?.members) && row.members.length > 0) {
+        raw.push(...row.members)
+      } else {
+        const { members: _members, ...rawRoot } = row
+        raw.push(rawRoot)
+      }
     } else if (row?.chunk_root == null || Number(row.chunk_root) === Number(row.id)) {
       raw.push(row)
     }
@@ -419,32 +424,9 @@ export function compactHandoffRows(rows, limit = 100) {
     || (Number(a?.ts) || 0) - (Number(b?.ts) || 0)
     || (Number(a?.id) || 0) - (Number(b?.id) || 0)
   ))
-  const endpoints = []
-  let userRow = null
-  let assistantRow = null
-  let fallbackRow = null
-  const flushEvent = () => {
-    if (assistantRow || fallbackRow) endpoints.push(assistantRow || fallbackRow)
-    if (userRow) endpoints.push(userRow)
-    userRow = null
-    assistantRow = null
-    fallbackRow = null
-  }
-  for (const row of raw) {
-    if (row?.role === 'user') {
-      flushEvent()
-      userRow = row
-    } else if (row?.role === 'assistant') {
-      assistantRow = row
-    } else {
-      fallbackRow = row
-    }
-  }
-  flushEvent()
-
-  const selected = [...roots, ...endpoints]
+  const selected = [...roots, ...raw]
   selected.sort(compareRecallNewestFirst)
-  return compactDigestRows(selected, cap)
+  return selected
 }
 
 // Compact session label for group headers: keep short ids verbatim, shorten