[saucam]

Summary

Stopping a daemon with memory on could crash Bun. The daemon then died with SIGILL (exit 132) before memory's store was closed and before the data-dir lock (#450) was released. Shutdown now stops the embedding model's worker in a way that can't crash.

What was wrong

Memory's embedding model runs in a worker thread, through onnxruntime, a native addon. Shutdown called Worker.terminate() on that worker. If onnxruntime still held the thread, Bun panicked (NAPI FATAL ERROR: Error::New napi_create_error) and the whole process died. That covers three cases: loading the model, running a batch, or with native finalizers from the last batch still pending.

Why it matters

• Affected: any daemon with memory on (the default) whose model has loaded. The crash happens on shutdown, more often on Bun 1.3 than on 1.4.
• What a crash skips: the shutdown steps after memory. Memory's SQLite store isn't closed, and the data-dir lock isn't released. The next start takes the lock over and SQLite recovers its log, so no data is lost, but systemd records a crash.
• How it showed up: the new real-daemon lock tests in feat: opencode is a codeoid backend, with every tool call approved by codeoid #450 failed on CI three times with exit 132. CI's log captured the panic once the tests printed the daemon's output.

What changed

• The worker runs requests one at a time. On a stop message it finishes what it is running, collects garbage so the pending native finalizers run, then exits itself.
• The main thread asks the worker to stop and waits up to 5 s for it to exit. It never calls terminate(). A worker that doesn't exit in time is left to end with the process.
• The real-daemon lock tests run their daemons without embeddings. Each test daemon has a fresh home, so it downloaded the 34 MB model before listening. That's how one start missed its 30 s window on CI.

Verification

• Reproduced locally: closing the embedder while the model loads, or during a batch, panicked on nearly every delay tried with the old code.
• Probe after the fix: 40 of 40 clean runs on Bun 1.3.13 (CI's version) and 40 of 40 on 1.4.4.
• New regression test memory-embedder-shutdown.test.ts: closes the embedder at 8 points during load and embedding. Old code: 6 of 8 fail on 1.3.13 and 1 of 8 on 1.4.4. Fixed: 8 of 8 pass on both.
  • It needs the model on disk (CODEOID_TEST_EMBEDDING_MODELS, e.g. ~/.codeoid/models), so CI skips it.
• Checks: typecheck and lint pass; the full suite on Bun 1.3.13 has 5,404 pass and 0 fail.

---

🤖 Implementation context (for agents / maintainers)

• src/daemon/memory/embedder-worker.ts: requests are chained on queue. { type: "stop" } sets stopping, which ignores later messages, then awaits the running request. After that it calls embedder.close(), nulls the model, runs Bun.gc(true), sleeps 50 ms, runs Bun.gc(true) again, sleeps 10 ms, and calls process.exit(0) inside the worker.
  • Probe on 1.3.13: no wait, sleep only, and gc only all panicked. gc, sleep, gc was clean in every run.
• src/daemon/memory/embedder.ts: close() posts the stop and awaits the worker's close event, bounded by WORKER_STOP_MS (5 s). On timeout it calls unref(). #teardown (init failure or worker crash) posts the stop and unrefs. Neither calls terminate().
• src/tests/data-lock.test.ts: CODEOID_MEMORY_EMBEDDINGS=false in the spawned daemons' env.
• src/tests/memory-embedder-shutdown.test.ts and src/tests/fixtures/embedder-close.ts: the fixture keeps running 500 ms after close(), as a daemon's shutdown does, because the panic comes a moment after the worker is torn down.
• Not changed: the reranker runs on the main thread and is disposed there; nothing crashed in that path.

🤖 Generated with Claude Code