Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Adds installMicroProfile/readPreloadLibraries/writePreloadLibraries to
layer the micro postgres profile onto an existing PGDATA directory via
include_if_exists lines in postgresql.conf, idempotently.

…f writes

Address code review findings on the PGDATA conf-layering utilities:
- fix TS2532 undefined-narrowing in readPreloadLibraries
- match include_if_exists only when active (not commented out) so a
  disabled include no longer silently short-circuits profile install
- accept flexible spacing/quoting in shared_preload_libraries parsing
  and trim comma-separated entries
- writePreloadLibraries now updates/appends the preload line in place
  instead of clobbering the rest of pod.conf

….6.1.143

Wire postgres.provisioned (skip postgres-init for pre-initialized template
clones) and postgres.profile (skip -c runtime args on "micro", since those
settings live in micro.conf/pod.conf inside PGDATA) through StackBuilder and
the native postgres service. Bump DEFAULT_VERSIONS.postgres to 17.6.1.143.

Adds enableExtension(name) across the coordinator, Stack service,
RemoteStack/DaemonServer HTTP surface, and public StackHandle. When an
extension requires shared_preload_libraries (per PRELOAD_REQUIRED_EXTENSIONS)
and isn't already preloaded, it appends to pod.conf and restarts postgres;
otherwise it's a no-op so plain CREATE EXTENSION keeps working.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Two concurrent enableExtension calls could both read the same
shared_preload_libraries list, then write independently, silently
dropping one extension when the second write clobbered the first.
Concurrent restarts of the same "postgres" service also deadlocked
the orchestrator. Guard the whole enableExtension body with a
per-coordinator Effect Semaphore(1) so calls are serialized.

Add a regression test that fires two enableExtension calls
concurrently through the real StackLifecycleCoordinator (mocked
binary resolver/spawner, temp PGDATA) and asserts both extensions
land in pod.conf; without the fix the test times out instead of
completing.

Adds StackConfig.lazyServices: when true, StackLifecycleCoordinator.start()
only eagerly starts postgres (and postgres-init); every other service starts
on demand the first time the ApiProxy routes a request to it, via a new
ProxyConfig.ensureService hook memoized by lazyServices.ts so concurrent
first requests trigger a single start.

Deviates from the original sketch's `enabled: false` mechanic: process-compose's
buildGraph excludes disabled ServiceDefs from the dependency graph entirely, so
a lazily-disabled service can never be resurrected via startService/
updateServiceDefinition once the orchestrator is built. Services stay enabled
in the graph; laziness is enforced by skipping the eager start in the
coordinator instead.

StackLifecycleCoordinator.waitAllReady() unconditionally delegated to
orchestrator.waitAllReady() over the full graph startOrder. Under
lazyServices, services that are never started on demand (e.g. postgrest)
never resolve their healthy deferred and never emit a Failed state, so
ready() hung forever.

Track the set of services that have actually been started (eager set from
start(), plus startService/restartService/enableExtension/reload* calls).
Under lazyServices, waitAllReady() now waits per-service on that snapshot
instead of the full graph. Non-lazy behavior is unchanged: it still calls
orchestrator.waitAllReady() over the whole graph.

Adds PodManifest interface plus templateKey/baseTemplateKey helpers that
derive stable sha256-based cache keys from a partial VersionManifest,
independent of key order.

cloneDir() now rm -rf's dest before falling back to fs.cp when the
platform-specific cp -Rc/--reflink step exits non-zero, so a partially
written dest from a failed CoW attempt can't silently mix with fresh
fallback output. The fs.cp fallback also now passes verbatimSymlinks:
true so relative symlinks in src aren't rewritten to absolute paths
that point back into the source tree.

Adds an internal, documented `cowCommand` test seam (CloneDirOptions)
to force the CoW step to fail deterministically in tests, exercising
the fallback-cleanup and symlink-preservation paths without depending
on filesystem-specific CoW failure conditions.

Introduces PortRegistry as the single owner of the port space for all
pods on a host, replacing the plan for a cross-stack filesystem scan
(readReservedPorts()). Persists pod->port allocations to a JSON state
file, is idempotent per pod, and reuses freed ports on release.

- load() no longer crashes on invalid JSON or structurally invalid
  state (missing/NaN basePort, non-object pods); it quarantines the
  bad file to `${stateFile}.corrupt` (overwriting any prior
  quarantine) and starts from fresh empty state instead.
- Add restore(podId, ports) so the fleet daemon can re-seed known
  allocations from each pod's manifest after a quarantine/reset,
  without a full port scan. Idempotent for identical ports; throws on
  conflicting ports for the same pod or ports already held by another
  pod.
- Document the single-owner / no-port-probing / quarantine-and-restore
  design assumptions on the class.

Adds TemplateStore, which builds golden Postgres data-dir templates by
running @supabase/stack one-shot: base = postgres-only boot so
postgres-init applies baseline migrations, then installMicroProfile
freezes the result; warm = clone of base + enabled services booted
once to self-migrate. Builds are concurrency-safe via a per-key
wx-flag lockfile with a 10min stale threshold. Also exports
installMicroProfile/readPreloadLibraries/writePreloadLibraries from
stack's index so fleet can consume them.

PodRegistry persists pod manifests at podsRoot/<id>/pod.json. Provisioner
creates pods by allocating ports and CoW-cloning a base or warm template
into the pod's data dir, resets pods by re-cloning from the base template,
forks a pod's data dir under a fresh id and ports, and destroys pods by
removing their directory and releasing ports.

Provisioner.create() and fork() allocated ports before cloning the
data directory and writing the pod manifest. If cloneDir or pods.write
threw, the allocated port pair stayed recorded in the PortRegistry
state file with no pod ever created to release it. Wrap the
post-allocation steps in try/catch and release the ports (plus
best-effort cleanup of any partially-written data/pod dir) before
rethrowing. Pre-checks (duplicate id, unknown source) still run before
allocation so failure cleanup can never release a pre-existing pod's
ports.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Adds EdgeProxy: binds a pod's external port once and keeps it bound
for the pod's lifetime, awaiting wake() per accepted connection to get
the live upstream before splicing bytes both ways. Emits
connect/data/disconnect activity per pod for the idle monitor to
consume. wake() rejection destroys the client without unhandled
rejections; concurrent connections to the same suspended pod both
succeed regardless of how many times wake() runs (dedup is the fleet
layer's job).

Buffers client bytes behind a real 'data' listener (not just pause())
before replaying them to the backend, since some runtimes start
sockets flowing before user code attaches a listener and would
otherwise silently drop data received while wake() is in flight.

Two review findings in EdgeProxy: (1) a client streaming data at a
suspended pod during a slow wake() buffered without limit; add
MAX_PREWAKE_BUFFER_BYTES (1 MiB) and destroy the client socket if it's
exceeded before the backend is reachable. Fixing this exposed that the
prior data+manual-array buffering never actually delivered data events
while the socket was paused (confirmed under both Bun and Node), so the
buffering mechanism was switched to readable+read(), which fires while
paused and makes byte counting/capping actually work. (2) wake() resolving
with a malformed upstream (e.g. an invalid port) could throw synchronously
inside the .then() resolve handler, surfacing as an unhandled rejection;
wrap that branch in try/catch routed to the same client-destroy path, and
correct the doc comment's overstated guarantee. Also drop the redundant
client.resume() after pipe() and note that the activity data listener is
independent of pipe()'s internal listener.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Adds IdleMonitor: fires onIdle(podId) once a tracked pod has no open
connections and no activity for idleMs. Open connections hold the pod
warm indefinitely; any recordActivity call (re)arms the countdown;
onIdle fires at most once per warm period and untracks the pod.

Ties together TemplateStore/PodRegistry/PortRegistry/Provisioner with
EdgeProxy/IdleMonitor into createFleet(): pods stay suspended until their
first proxied connection wakes an in-process @supabase/stack StackHandle,
and idle warm pods are suspended again after idleMs with no open
connections. Startup reconciliation kills stale run.pid processes from a
previous daemon and re-seeds PortRegistry from each pod's manifest via
restore().

Also exports PRELOAD_REQUIRED_EXTENSIONS from @supabase/stack's index so
the suspended-pod enableExtension path can guard non-preload extensions
without a restart.

Two race/leak fixes surfaced in review of the Fleet facade:

- suspend() deleted from `warm` before awaiting stack.dispose(), and
  wakeUpstream()/destroyPod/resetPod/forkPod had no way to see an
  in-flight wake (tracked only in wakesInFlight, not yet `warm`) before
  mutating the same pod's data dir. Added a small per-pod async lock
  (PodLock, src/podLock.ts) and routed the wake body, suspend's full
  body, and the lifecycle-affecting sections of destroyPod/resetPod/
  forkPod through it, so these can never interleave against the same
  pod's process/data dir. Wake dedup via wakesInFlight stays outside
  the lock so concurrent connections still share one wake.

- Startup reconciliation killed `-run.pid` (the daemon's own pid), but
  process-compose/createStack spawn postgres `detached: true` in its
  own process group, so that kill missed stale postmasters entirely.
  Reap now keys off postgres's own ground truth,
  `<dataDir>/postmaster.pid` (src/reapStalePostmaster.ts): its first
  line is the postmaster pid, which is always its own process-group
  leader, so `-pid` reliably reaches the whole tree. run.pid is kept
  as a "was running" hint but no longer drives the kill decision.

Also documented the enableExtension asymmetry: a suspended pod can
only durably record intent for preload-required extensions; a
non-preload extension request against a suspended pod is a silent
no-op until the pod is woken.

Adds a gated Fleet integration stress test interleaving suspend/wake/
query calls, plus unit tests for both new modules.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Adds the density guardrail E2E (register N pods, wake a subset, confirm
the rest stay at zero processes, explicit suspend) gated behind
FLEET_PG_TESTS with pod count tunable via FLEET_E2E_PODS. Mirrors
packages/stack's e2e vitest project (fileParallelism: false) so nx picks
up a test:e2e target for @supabase/fleet, and extends the package's knip
entry points to cover tests/**/*.ts.

Also adds the package README covering the public API, wake/suspend/fork
lifecycle, and phase-1 limitations (native-only, kill-then-resuspend
reconciliation, HTTP/realtime lazy-start gaps).

- Add enableExtension stub to Stack mocks (mocks.ts, running-stack.ts)
  to match the Stack service contract added in this branch.
- Fix StackLifecycleCoordinator.unit.test.ts flakiness under Bun: widen
  the projected-status assertion to tolerate the transient "Restarting"
  state, and bind the fake healthy postgrest server on an OS-assigned
  port (listen(0)) instead of a hard-coded port to avoid EADDRINUSE
  under parallel test runs.
- Remove unused effect and @supabase/process-compose dependencies from
  packages/fleet/package.json (zero imports), reformat with oxfmt, and
  move @tsconfig/bun into knip's ignoreDependencies (false positive —
  used only via tsconfig extends).
- Sync pnpm-lock.yaml after the dependency removal.

Lockfile regenerated against merged manifests; verified with a from-scratch
'pnpm install --frozen-lockfile'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…icro-stacks-review-hardening