mixdog 1.2.1 → 1.2.3

package/src/runtime/memory/lib/pg/process.mjs

@@ -5,26 +5,29 @@ import { sleep as delay } from '../../../shared/sleep.mjs';
 //
 // Public API:
 //   startPg({ runtimeDir, pgdataDir, port?, logPath? }) → { pid, port }
-//   stopPg({ runtimeDir, pgdataDir })                   → void
+//   stopPg({ runtimeDir, pgdataDir, timeoutMs? })       → void
 //   healthcheckPg({ port, host? })                      → boolean
+//
+// Every child on the start/stop path (initdb, pg_ctl start/reload/status/stop)
+// runs async; only stopPgSync — a process 'exit' hook — may block.
 
 import {
   existsSync,
   mkdirSync,
   mkdtempSync,
-  readdirSync,
   readFileSync,
   rmdirSync,
   rmSync,
-  statSync,
   symlinkSync,
   unlinkSync,
   writeFileSync,
 } from 'node:fs';
+import { readdir, readFile, rm, stat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
+import { execFile, spawn, spawnSync } from 'node:child_process';
 import { createConnection, createServer } from 'node:net';
 import { isPidAlive } from '../../../shared/pid-liveness.mjs';
+import { runChild } from './run-child.mjs';
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -202,14 +205,12 @@ function ensureConfV2(pgdataDir) {
 // callers route through this rather than re-implementing the conf/reload pair.
 // Reload-compatible settings apply immediately; postmaster settings such as
 // max_connections apply on the next normal PG start (never restart live work).
-export function reconcileConfV2(runtimeDir, pgdataDir) {
+export async function reconcileConfV2(runtimeDir, pgdataDir) {
   const applied = ensureConfV2(pgdataDir);
   if (!applied) return { applied: false, reloaded: false };
-  const reload = spawnSync(pgBin(runtimeDir, 'pg_ctl'), ['reload', '-D', pgdataDir], {
+  const reload = await runChild(pgBin(runtimeDir, 'pg_ctl'), ['reload', '-D', pgdataDir], {
     env: libEnv(runtimeDir),
-    stdio: 'pipe',
-    timeout: 5_000,
-    windowsHide: true,
+    timeoutMs: 5_000,
   });
   const reloaded = reload.status === 0;
   if (reloaded) {
@@ -239,7 +240,7 @@ async function attachExistingPostmaster({ runtimeDir, pgdataDir, existingWaitMs,
     __mixdogMemoryLog(`[pg-process] attaching to existing PG pid=${existing.pid} port=${existing.port}\n`);
     // Route through the single reconcile entry point so v1 → v2 conf
     // upgrades land on already-running instances without restart.
-    if (v2Applied) reconcileConfV2(runtimeDir, pgdataDir);
+    if (v2Applied) await reconcileConfV2(runtimeDir, pgdataDir);
     return { pid: existing.pid, port: existing.port, attached: true };
   }
   if (existing.state === 'alive-not-ready') {
@@ -260,6 +261,10 @@ async function attachExistingPostmaster({ runtimeDir, pgdataDir, existingWaitMs,
 // default_transaction_isolation: native PG default is read committed.
 // Native PG does not default to serializable; set isolation level explicitly
 // so behaviour is unambiguous across PG major versions.
+// Carries every versioned block ensureConfV2 checks for, so a fresh cluster
+// already holds what later boots expect: none of them rewrites the conf and
+// pg_ctl-reloads it (a postmaster-only setting such as shared_buffers cannot
+// change by reload, and every such reload logged an error).
 function freshClusterConfAppend() {
   return (
     [
@@ -280,7 +285,8 @@ function freshClusterConfAppend() {
     ].join('\n') +
     '\n' +
     buildV2Block() +
-    buildV3Block()
+    buildV3Block() +
+    buildV4Block()
   );
 }
 
@@ -291,14 +297,14 @@ function freshClusterConfAppend() {
  * user profile). Such a share dir is passed through an ASCII junction under
  * %ProgramData% that is removed afterwards.
  */
-export function withInitdbShareDir(runtimeDir, run) {
+export async function withInitdbShareDir(runtimeDir, run) {
   const shareDir = join(runtimeDir, 'share');
   if (process.platform !== 'win32' || /^[\x20-\x7e]*$/.test(shareDir)) return run(null);
   const linkRoot = mkdtempSync(join(process.env.ProgramData, 'mixdog-initdb-'));
   const link = join(linkRoot, 'share');
   try {
     symlinkSync(shareDir, link, 'junction');
-    return run(link);
+    return await run(link);
   } finally {
     // Cleanup must not replace initdb's own result or error. Both removals are
     // non-recursive, so the junction target (the runtime share) is never touched.
@@ -313,11 +319,11 @@ export function withInitdbShareDir(runtimeDir, run) {
 }
 
 /** initdb if pgdata is not yet initialised (no PG_VERSION file). */
-function initClusterIfNeeded({ runtimeDir, pgdataDir, env }) {
+async function initClusterIfNeeded({ runtimeDir, pgdataDir, env }) {
   if (existsSync(join(pgdataDir, 'PG_VERSION'))) return;
   __mixdogMemoryLog(`[pg-process] initdb → ${pgdataDir}\n`);
-  const r = withInitdbShareDir(runtimeDir, (shareDir) =>
-    spawnSync(
+  const r = await withInitdbShareDir(runtimeDir, (shareDir) =>
+    runChild(
       pgBin(runtimeDir, 'initdb'),
       [
         '-D',
@@ -330,7 +336,7 @@ function initClusterIfNeeded({ runtimeDir, pgdataDir, env }) {
         '-U',
         'postgres',
       ],
-      { env, stdio: 'pipe', windowsHide: true }
+      { env }
     )
   );
   if (r.status !== 0) {
@@ -436,12 +442,7 @@ async function startAndWaitReady({ pgctl, startArgs, env, pgdataDir, port }) {
  */
 async function attachRaceWinner({ pgdataDir, pgctl, env, existingWaitMs }) {
   __mixdogMemoryLog(`[pg-process] pg_ctl start: "another server might be running" — probing status\n`);
-  const statusR = spawnSync(pgctl, ['status', '-D', pgdataDir], {
-    env,
-    stdio: 'pipe',
-    timeout: 3_000,
-    windowsHide: true,
-  });
+  const statusR = await runChild(pgctl, ['status', '-D', pgdataDir], { env, timeoutMs: 3_000 });
   __mixdogMemoryLog(
     `[pg-process] pg_ctl status: ${statusR.stdout?.toString() || statusR.stderr?.toString() || 'no output'}\n`
   );
@@ -481,7 +482,7 @@ export async function startPg({
   if (attached) return attached;
 
   const pgctl = pgBin(runtimeDir, 'pg_ctl');
-  initClusterIfNeeded({ runtimeDir, pgdataDir, env });
+  await initClusterIfNeeded({ runtimeDir, pgdataDir, env });
   // PostgreSQL requires a completely empty target on first init. Creating the
   // Spotlight marker before initdb makes every fresh macOS cluster fail with
   // "directory exists but is not empty"; add it only after initialization.
@@ -512,15 +513,18 @@ export async function startPg({
 // stopPg
 // ---------------------------------------------------------------------------
 
-export async function stopPg({ runtimeDir, pgdataDir }) {
+// Bounded graceful stop. `-m fast` rolls back open transactions and
+// disconnects clients; pg_ctl's own wait (-t, whole seconds) and the child
+// timeout share `timeoutMs`, so a wedged stop rejects instead of holding a
+// shutdown sequence open.
+export async function stopPg({ runtimeDir, pgdataDir, timeoutMs = 15_000 }) {
   const pgctl = pgBin(runtimeDir, 'pg_ctl');
   const env = libEnv(runtimeDir);
+  const waitSeconds = Math.max(1, Math.ceil(timeoutMs / 1000));
 
-  const r = spawnSync(pgctl, ['stop', '-m', 'fast', '-w', '-D', pgdataDir], {
+  const r = await runChild(pgctl, ['stop', '-m', 'fast', '-w', '-t', String(waitSeconds), '-D', pgdataDir], {
     env,
-    stdio: 'pipe',
-    timeout: 15_000,
-    windowsHide: true,
+    timeoutMs: waitSeconds * 1000 + 1_000,
   });
 
   if (r.status !== 0) {
@@ -607,22 +611,36 @@ export function classifyOrphanTempPostmaster({
   return Number(uptimeSec) >= Math.max(60, Number(minUptimeSec) || ORPHAN_TEMP_PG_MIN_UPTIME_SEC);
 }
 
-function tempPostmasterOwnerAlive(args) {
+async function tempPostmasterOwnerAlive(args) {
   const rawDataDir = pgDataDirFromArgs(args);
   if (!rawDataDir) return false;
   const dataRoot = join(rawDataDir, '..');
   for (const name of ['memory-runtime-owner.json', 'daemon-owner.json']) {
     try {
-      const owner = JSON.parse(readFileSync(join(dataRoot, name), 'utf8'));
+      const owner = JSON.parse(await readFile(join(dataRoot, name), 'utf8'));
       if (Number(owner?.pid) > 0 && isPidAlive(Number(owner.pid))) return true;
     } catch {}
   }
   return false;
 }
 
-function listPostmasterRows() {
+// Async child run: stdout on exit 0, null on any failure/timeout (the old
+// spawnSync `status !== 0` contract). Never blocks the event loop.
+function execFileText(file, args, options) {
+  return new Promise((resolve) => {
+    try {
+      execFile(file, args, { encoding: 'utf8', ...options }, (error, stdout) => {
+        resolve(error ? null : String(stdout || ''));
+      });
+    } catch {
+      resolve(null);
+    }
+  });
+}
+
+async function listPostmasterRows() {
   if (process.platform === 'win32') {
-    const result = spawnSync(
+    const stdout = await execFileText(
       'powershell',
       [
         '-NoProfile',
@@ -632,10 +650,10 @@ function listPostmasterRows() {
           'started = [int](New-TimeSpan -Start $_.CreationDate -End (Get-Date)).TotalSeconds; ' +
           'args = $_.CommandLine } }',
       ],
-      { encoding: 'utf8', timeout: 15_000, windowsHide: true }
+      { timeout: 15_000, windowsHide: true }
     );
-    if (result.status !== 0) return [];
-    return String(result.stdout || '')
+    if (stdout === null) return [];
+    return stdout
       .split(/\r?\n/)
       .filter(Boolean)
       .flatMap((line) => {
@@ -647,12 +665,9 @@ function listPostmasterRows() {
         }
       });
   }
-  const result = spawnSync('ps', ['-eo', 'pid=,etimes=,args='], {
-    encoding: 'utf8',
-    timeout: 15_000,
-  });
-  if (result.status !== 0) return [];
-  return String(result.stdout || '')
+  const stdout = await execFileText('ps', ['-eo', 'pid=,etimes=,args='], { timeout: 15_000 });
+  if (stdout === null) return [];
+  return stdout
     .split(/\r?\n/)
     .flatMap((line) => {
       const match = line.match(/^\s*(\d+)\s+(\d+)\s+(.*postgres.*)$/);
@@ -679,11 +694,11 @@ function pristineRootForArgs(args, tempRoot) {
 // (observed: 87 roots, 6.1GB, alongside 57 live postmasters). Roots a live
 // postmaster still owns are kept, and the same uptime margin that protects a
 // running harness from the process sweep protects its directory here.
-function sweepAbandonedPristineRoots(tempRoot, liveRoots, minAgeMs) {
+async function sweepAbandonedPristineRoots(tempRoot, liveRoots, minAgeMs) {
   let removed = 0;
   let entries;
   try {
-    entries = readdirSync(tempRoot, { withFileTypes: true });
+    entries = await readdir(tempRoot, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -693,12 +708,12 @@ function sweepAbandonedPristineRoots(tempRoot, liveRoots, minAgeMs) {
     const full = join(tempRoot, entry.name);
     if (liveRoots.has(normalizePathForMatch(full))) continue;
     try {
-      if (statSync(full).mtimeMs > cutoff) continue;
+      if ((await stat(full)).mtimeMs > cutoff) continue;
     } catch {
       continue;
     }
     try {
-      rmSync(full, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+      await rm(full, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
       removed += 1;
     } catch {
       /* a process this sweep did not reap still holds it */
@@ -709,18 +724,18 @@ function sweepAbandonedPristineRoots(tempRoot, liveRoots, minAgeMs) {
 
 /** Best-effort machine hygiene: reap orphan temp postmasters, then drop the
  *  throwaway roots no live postmaster owns. Runs periodically, not once. */
-export function sweepOrphanTempPostmasters({ tempRoot, minUptimeSec } = {}) {
+export async function sweepOrphanTempPostmasters({ tempRoot, minUptimeSec } = {}) {
   let reaped = 0;
   try {
     const root = tempRoot || process.env.TMPDIR || process.env.TEMP || process.env.TMP || '/tmp';
     const liveRoots = new Set();
-    for (const row of listPostmasterRows()) {
+    for (const row of await listPostmasterRows()) {
       if (!row.pid || row.pid === process.pid) continue;
       if (
         !classifyOrphanTempPostmaster({
           ...row,
           tempRoot: root,
-          ownerAlive: tempPostmasterOwnerAlive(row.args),
+          ownerAlive: await tempPostmasterOwnerAlive(row.args),
           minUptimeSec,
         })
       ) {
@@ -737,7 +752,7 @@ export function sweepOrphanTempPostmasters({ tempRoot, minUptimeSec } = {}) {
       }
     }
     const minAgeMs = Math.max(60, Number(minUptimeSec) || ORPHAN_TEMP_PG_MIN_UPTIME_SEC) * 1000;
-    const removed = sweepAbandonedPristineRoots(root, liveRoots, minAgeMs);
+    const removed = await sweepAbandonedPristineRoots(root, liveRoots, minAgeMs);
     if (removed > 0) __mixdogMemoryLog(`[pg-process] removed ${removed} abandoned pristine root(s)\n`);
   } catch {
     /* hygiene is best-effort */

package/src/runtime/memory/lib/pg/run-child.mjs

@@ -0,0 +1,49 @@
+import { spawn } from 'node:child_process';
+
+/**
+ * Async child run with spawnSync's result shape ({ status, signal, stdout,
+ * stderr, error }) so the PG runtime's tar / initdb / pg_ctl steps never block
+ * the event loop of the process hosting them (the daemon serves every client
+ * from one loop). `timeoutMs` > 0 kills the child and reports ETIMEDOUT, like
+ * spawnSync's `timeout`. Never rejects.
+ */
+export function runChild(file, args, { timeoutMs = 0, ...options } = {}) {
+  return new Promise((resolve) => {
+    const stdout = [];
+    const stderr = [];
+    let settled = false;
+    let timer = null;
+    let error = null;
+    const finish = (status, signal) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve({ status, signal, stdout: Buffer.concat(stdout), stderr: Buffer.concat(stderr), error });
+    };
+    let child;
+    try {
+      child = spawn(file, args, { windowsHide: true, ...options, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch (spawnError) {
+      error = spawnError;
+      finish(null, null);
+      return;
+    }
+    child.stdout?.on('data', (chunk) => stdout.push(chunk));
+    child.stderr?.on('data', (chunk) => stderr.push(chunk));
+    child.once('error', (childError) => {
+      error ??= childError;
+      finish(null, null);
+    });
+    // 'close' (not 'exit'): stdio is flushed, so captured output is complete.
+    child.once('close', (status, signal) => finish(status, signal));
+    if (timeoutMs > 0) {
+      timer = setTimeout(() => {
+        error = Object.assign(new Error(`${file} timed out after ${timeoutMs}ms`), { code: 'ETIMEDOUT' });
+        try {
+          child.kill();
+        } catch {}
+        finish(null, 'SIGTERM');
+      }, timeoutMs);
+    }
+  });
+}

package/src/runtime/memory/lib/pg/supervisor.mjs

@@ -6,6 +6,9 @@ import { __mixdogMemoryLog } from '../memory-log.mjs';
  * Public API:
  *   ensurePgInstance(dataDir) → Promise<{ host, port, runtimeDir, pgdataDir }>
  *   stopPgForShutdown()       → Promise<void>  — call from server-main.mjs shutdown()
+ *   stopOwnedPgForShutdown()  → Promise<boolean> — a host stopping the cluster it ensured
+ *   installOwnedPgExitStop()  → void            — last-chance sync stop on process exit
+ *   pgClusterExists(dataDir)  → boolean         — initdb already ran for dataDir
  *
  * Uses process.mjs for startPg / stopPg / healthcheckPg (lazy-imported).
  *
@@ -17,7 +20,7 @@ import { __mixdogMemoryLog } from '../memory-log.mjs';
  */
 
 import { createServer } from 'node:net';
-import { unlinkSync, readFileSync, writeFileSync, renameSync, statSync, mkdirSync } from 'node:fs';
+import { existsSync, unlinkSync, readFileSync, writeFileSync, renameSync, statSync, mkdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import {
   discoveryPath as _pgDiscoveryPath,
@@ -51,6 +54,10 @@ let _live = null;
 let _ensureInFlight = null;
 /** Per-process flag — postgresql.conf reconcile attempted once per supervisor. */
 let _v2ReconcileTried = false;
+/** Set by stopOwnedPgForShutdown: this process is exiting, no further ensure. */
+let _ownedShutdownStarted = false;
+/** installOwnedPgExitStop registers its 'exit' hook once. */
+let _ownedExitStopInstalled = false;
 
 // ── Constants ────────────────────────────────────────────────────────────────
 const PG_PORT_MIN = 55432;
@@ -372,6 +379,16 @@ function readPostmasterInfo(pgdata) {
   }
 }
 
+// Async child run (never blocks the daemon loop): stdout on exit 0, else null.
+async function _execFileText(file, args) {
+  const { execFile } = await import('node:child_process');
+  return new Promise((resolveText) => {
+    execFile(file, args, { encoding: 'utf8', windowsHide: true, timeout: 15_000 }, (error, stdout) => {
+      resolveText(error ? null : String(stdout || ''));
+    });
+  });
+}
+
 /**
  * Best-effort process-name check: confirms the pid's comm name contains 'postgres'.
  * Falls back to true (alive) when the name cannot be determined.
@@ -383,19 +400,12 @@ async function isPostgresPid(pid) {
       return comm.includes('postgres');
     }
     if (process.platform === 'darwin') {
-      const { spawnSync } = await import('node:child_process');
-      const r = spawnSync('ps', ['-o', 'comm=', '-p', String(pid)], { encoding: 'utf8', windowsHide: true });
-      if (r.status === 0) return (r.stdout || '').trim().includes('postgres');
-      return true;
+      const out = await _execFileText('ps', ['-o', 'comm=', '-p', String(pid)]);
+      return out === null ? true : out.trim().includes('postgres');
     }
     if (process.platform === 'win32') {
-      const { spawnSync } = await import('node:child_process');
-      const r = spawnSync('tasklist', ['/FI', `PID eq ${pid}`, '/FO', 'CSV', '/NH'], {
-        encoding: 'utf8',
-        windowsHide: true,
-      });
-      if (r.status === 0) return (r.stdout || '').toLowerCase().includes('postgres');
-      return true;
+      const out = await _execFileText('tasklist', ['/FI', `PID eq ${pid}`, '/FO', 'CSV', '/NH']);
+      return out === null ? true : out.toLowerCase().includes('postgres');
     }
   } catch {
     /* cannot read — fall back to alive */
@@ -463,8 +473,8 @@ function scheduleOrphanTempPostmasterSweep() {
   _orphanSweepStarted = true;
   const runSweep = () => {
     void _getPgProc()
-      .then(({ sweepOrphanTempPostmasters }) => {
-        const reaped = sweepOrphanTempPostmasters?.() || 0;
+      .then(async ({ sweepOrphanTempPostmasters }) => {
+        const reaped = (await sweepOrphanTempPostmasters?.()) || 0;
         if (reaped > 0) __mixdogMemoryLog(`[supervisor-pg] orphan sweep reaped ${reaped} temp postmaster(s)\n`);
       })
       .catch(() => {
@@ -534,9 +544,20 @@ async function tryReusePgInstance({ pgdata, runtimeDir, healthcheckPg, source =
 
 // ── Internal: full ensure logic (runs exclusively via _ensureInFlight) ────────
 
+function _pgdataDir(dataDir) {
+  return join(dataDir, 'pgdata');
+}
+
+/** True once `dataDir` holds an initialized cluster (initdb ran). Before that
+ *  no store in it can hold rows, so a read may answer empty without starting
+ *  PostgreSQL — the first start downloads/extracts the runtime and runs initdb. */
+export function pgClusterExists(dataDir) {
+  return existsSync(join(_pgdataDir(dataDir), 'PG_VERSION'));
+}
+
 async function _doEnsure(dataDir) {
   const { healthcheckPg } = await _getPgProc();
-  const pgdata = join(dataDir, 'pgdata');
+  const pgdata = _pgdataDir(dataDir);
 
   // Resolve runtimeDir via runtime-fetcher (cache-hits immediately when already downloaded).
   const { ensureRuntime } = await import('../runtime-fetcher.mjs');
@@ -549,7 +570,7 @@ async function _doEnsure(dataDir) {
     _v2ReconcileTried = true;
     try {
       const { reconcileConfV2 } = await _getPgProc();
-      reconcileConfV2(runtimeDir, pgdata);
+      await reconcileConfV2(runtimeDir, pgdata);
     } catch (e) {
       __mixdogMemoryLog(`[supervisor-pg] reconcileConfV2 error (non-fatal): ${e?.message}\n`);
     }
@@ -696,6 +717,12 @@ async function _doEnsure(dataDir) {
  * @returns {Promise<{ host: string, port: number, runtimeDir: string, pgdataDir: string }>}
  */
 export function ensurePgInstance(dataDir) {
+  // Once this process began stopping the cluster it owns, nothing may start
+  // or re-attach one: a late connection-loss recovery would otherwise bring a
+  // postmaster back up right after the stop and leave it running past exit.
+  if (_ownedShutdownStarted) {
+    return Promise.reject(new Error('[supervisor-pg] process is shutting down; PG start refused'));
+  }
   // Every route to a live PG passes here — start, attach, reuse and the
   // in-process fast path — so this is the one place the sweep cannot be
   // skipped. Latched internally, so repeated calls schedule it only once.
@@ -803,3 +830,84 @@ export function stopPgForShutdownSync() {
   // async path: never another live owner's); otherwise pg.json outlives the run.
   patchActiveInstance({ pg_port: null, pg_started_at: null, pg_pgdata: null, pg_runtime_dir: null }, { timeoutMs: 1000 });
 }
+
+// ── Owned-cluster shutdown (a host that starts PG through its stores) ────────
+//
+// `pg_ctl start` daemonizes the postmaster outside the starting process tree,
+// so nothing ends it when that process exits: the process that brought a
+// cluster up (or adopted one whose owner died) owns stopping it. Unlike
+// stopPgForShutdown above, these never act on a cluster this process did not
+// ensure, and never on one a different live process owns (pg_owner_pid) —
+// that owner stops it on its own exit.
+
+/** `_live` cluster's advert is held by another live process. */
+function _liveClusterForeignOwned(snap) {
+  let advert = null;
+  try {
+    advert = _readPgAdvert();
+  } catch {}
+  if (!advert?.pg_pgdata || resolve(advert.pg_pgdata) !== resolve(snap.pgdata)) return false;
+  return _pgAdvertIsForeignLive(advert);
+}
+
+/**
+ * Graceful, bounded stop (`pg_ctl stop -m fast`) of the cluster this process
+ * ensured. Latches the process into shutdown first, so no later ensure can
+ * start another one. Resolves true when a cluster was stopped; rejects when
+ * pg_ctl failed (the 'exit' hook then retries synchronously).
+ */
+export async function stopOwnedPgForShutdown({ timeoutMs = 6_000 } = {}) {
+  _ownedShutdownStarted = true;
+  // A start still under way (pg_ctl start already spawned, readiness pending)
+  // publishes its cluster only when it settles; stopping before that would
+  // miss the postmaster it is about to own. Bounded: a cold first start can
+  // be a download.
+  if (_ensureInFlight) {
+    let timer = null;
+    await Promise.race([
+      _ensureInFlight.catch(() => {}),
+      new Promise((resolveWait) => {
+        timer = setTimeout(resolveWait, timeoutMs);
+        timer.unref?.();
+      }),
+    ]);
+    clearTimeout(timer);
+  }
+  const snap = _live;
+  if (!snap) return false;
+  if (_liveClusterForeignOwned(snap)) {
+    __mixdogMemoryLog(`[supervisor-pg] PG on port ${snap.port} is owned by another live process; leaving it running\n`);
+    _live = null;
+    return false;
+  }
+  const { stopPg } = await _getPgProc();
+  await stopPg({ runtimeDir: snap.runtimeDir, pgdataDir: snap.pgdata, timeoutMs });
+  _live = null;
+  __mixdogMemoryLog(`[supervisor-pg] owned PG on port ${snap.port} stopped on shutdown\n`);
+  patchActiveInstance(
+    { pg_port: null, pg_started_at: null, pg_pgdata: null, pg_runtime_dir: null },
+    { timeoutMs: 2000, syncRetries: 1 }
+  );
+  return true;
+}
+
+/** Last-chance synchronous stop for a process 'exit' hook: acts only while the
+ *  cluster this process ensured is still recorded as live (an exit the async
+ *  stop never reached, or one where it failed). */
+export function stopOwnedPgForShutdownSync() {
+  if (!_live) return;
+  stopPgForShutdownSync();
+  _live = null;
+}
+
+/** Register stopOwnedPgForShutdownSync on process 'exit', once. Cheap when this
+ *  process never ensures a cluster: the hook is then a no-op. */
+export function installOwnedPgExitStop() {
+  if (_ownedExitStopInstalled) return;
+  _ownedExitStopInstalled = true;
+  process.on('exit', () => {
+    try {
+      stopOwnedPgForShutdownSync();
+    } catch {}
+  });
+}

package/src/runtime/memory/lib/runtime-fetcher.mjs

@@ -32,7 +32,7 @@ import {
 } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { spawnSync } from 'node:child_process';
+import { runChild } from './pg/run-child.mjs';
 import { renameWithRetrySync, writeFileAtomicSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
 import { downloadToFileWithRetry } from '../../shared/bounded-download.mjs';
 import { platformKey, platformKeyCandidates, verifySha256File } from '../../shared/native-asset.mjs';
@@ -250,21 +250,23 @@ export function _validateRuntimeTarEntries(entries, details, stagingBase) {
   }
 }
 
-export function _extractRuntimeTarGz(tarPath, destDir, stagingBase) {
+// Async throughout: the first boot extracts the whole PG runtime here, and a
+// synchronous tar froze the daemon loop for seconds.
+export async function _extractRuntimeTarGz(tarPath, destDir, stagingBase) {
   mkdirSync(destDir, { recursive: true });
   const resolvedTarPath = resolve(tarPath);
-  const tarOptions = { cwd: dirname(resolvedTarPath), stdio: 'pipe', windowsHide: true };
+  const tarOptions = { cwd: dirname(resolvedTarPath) };
   const tarName = basename(resolvedTarPath);
 
   // List entries first and validate — reject traversal, external links, and
   // special files before the extractor can materialize archive content.
   // Keep the archive argument relative to cwd: GNU tar otherwise interprets
   // an absolute Windows path such as C:\runtime.tar.gz as a remote host path.
-  const listResult = spawnSync('tar', ['-tzf', tarName], tarOptions);
+  const listResult = await runChild('tar', ['-tzf', tarName], tarOptions);
   if (listResult.status !== 0) {
     throw new Error(`[runtime-fetcher] tar list failed: ${listResult.stderr?.toString() || 'unknown'}`);
   }
-  const detailResult = spawnSync('tar', ['-tvzf', tarName], tarOptions);
+  const detailResult = await runChild('tar', ['-tvzf', tarName], tarOptions);
   if (detailResult.status !== 0) {
     throw new Error(`[runtime-fetcher] tar detail list failed: ${detailResult.stderr?.toString() || 'unknown'}`);
   }
@@ -274,10 +276,7 @@ export function _extractRuntimeTarGz(tarPath, destDir, stagingBase) {
 
   const resolvedDestDir = resolve(destDir);
   const extractionArchive = relative(resolvedDestDir, resolvedTarPath);
-  const r = spawnSync('tar', ['-xzf', extractionArchive], {
-    ...tarOptions,
-    cwd: resolvedDestDir,
-  });
+  const r = await runChild('tar', ['-xzf', extractionArchive], { cwd: resolvedDestDir });
   if (r.status !== 0) {
     throw new Error(`[runtime-fetcher] tar extraction failed: ${r.stderr?.toString() || 'unknown error'}`);
   }
@@ -438,9 +437,9 @@ const runtimeCache = new Map();
 
 // One-shot tar availability probe; result cached after first call.
 let _tarProbed = false;
-function probeTar() {
+async function probeTar() {
   if (_tarProbed) return;
-  const r = spawnSync('tar', ['--version'], { stdio: 'pipe', windowsHide: true });
+  const r = await runChild('tar', ['--version']);
   if (r.status !== 0 || r.error) {
     throw new Error(
       '[runtime-fetcher] `tar` not found or not executable. ' +
@@ -532,7 +531,7 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
   // tar is only required for the download/extract path. Probe here (not at
   // ensureRuntime entry) so a machine without tar can still reuse an
   // already-extracted, sha-matching cached runtime via the fast path.
-  probeTar();
+  await probeTar();
 
   __mixdogMemoryLog(`[runtime-fetcher] downloading runtime ${version} for ${pkey} (~${size} bytes) …\n`);
 
@@ -574,7 +573,7 @@ async function installRuntimeVersion({ runtimeBaseDir, url, sha256, size, versio
         }
       }
       if (!downloadOk && lastDownloadErr) throw lastDownloadErr;
-      _extractRuntimeTarGz(tarPath, stagingDir, stagingDir);
+      await _extractRuntimeTarGz(tarPath, stagingDir, stagingDir);
     } finally {
       try {
         rmSync(tarPath, { force: true });

package/src/runtime/memory/lib/transcript-ingest.mjs

@@ -53,7 +53,21 @@ export function createTranscriptIngest({
     return run;
   }
 
+  /** A deleted session's transcripts: wait out any ingest of each file, then
+   *  drop its persisted read position. Returns the number of entries removed. */
+  async function forgetTranscripts(transcriptPaths) {
+    let removed = 0;
+    for (const transcriptPath of transcriptPaths) {
+      const resolved = path.resolve(transcriptPath);
+      await tails.get(resolved);
+      for (const key of new Set([transcriptPath, resolved])) if (offsets.forget(key)) removed += 1;
+    }
+    if (removed > 0) await offsets.persist();
+    return removed;
+  }
+
   return {
+    forgetTranscripts,
     loadTranscriptOffsets: offsets.load,
     persistTranscriptOffsets: offsets.persist,
     ingestTranscriptFile,