Deep-sweep fixes: cooperative-pool starvation, stdio tail loss, epoll integrity, UI pins

Host — the two remaining app-wide stall mechanisms plus main-thread pins
found by mining all nine hang reports:
- LinuxProcess.startStdinRelay wrote to a BLOCKING stdin fd on a
  width-limited cooperative-pool thread, non-cancellably; wedged guests
  starved the whole concurrency runtime (decode loops, watchdogs — an
  app-wide freeze surviving the reconcile fix). Writes now offload to a
  per-process GCD queue (vendored patch #18).
- TranscriptWriter (actor) did blocking write/fsync on the cooperative
  pool; it now runs on its own DispatchSerialQueue executor.
- UserMessageBubble's truncation probe typeset entire pasted-log-sized
  messages through CoreText per layout pass (100% main-thread pins in
  the 07-21 hang reports); certainly-long messages now skip the probe
  and render a prefix while collapsed.
- toolGroupSignature JSON-encoded every tool input in the transcript up
  to 12.5x/s on the MainActor; now a structural hash. The summary pass
  is trailing-throttled to 0.4s, and flatItems joins streaming chunks
  once instead of re-copying the prefix per delta.
- StatusFeedFetcher.parseDate allocated three formatters per call (86%
  of a pool thread in the 07-26 report); now shared statics.

Guest (vminitd) — teardown data loss and epoll registration hazards:
- IOPair no longer closes on a bare EPOLLHUP with a backpressure flush
  in flight (dropped the CLI's final output line); EPOLLOUT finishes the
  flush, then EOF closes loss-free. ManagedProcess.setExit closes only
  stdin, letting stdout/stderr self-close on EOF, with an 8s grace pass
  (patch #16).
- Epoll events carry a registration generation; the supervisor ignores
  stale events for recycled fd numbers. registerFd refuses EEXIST
  instead of clobbering the existing handler. TerminalIO's stdin relay
  writes a dup of the terminal fd so its backpressure registration
  can't collide with the stdout relay's (patch #17).
- VsockProxy flushes bytes parked toward the surviving peer on hangup,
  closes the dialing socket on a failed backend connect, and
  StandardIO/TerminalIO clean up partially-created pairs on setup
  failure (patch #16).

Full suite: 1451+292+74+20 tests, two failures — both pre-existing
environmental (MacVM base image absent on this machine; a load-flaky
liveness test that passes 3/3 in isolation).

Co-Authored-By: Claude Fable 5 <[email protected]>

Sources/Containerization/LinuxProcess.swift

@@ -270,11 +270,33 @@ extension LinuxProcess {
     func startStdinRelay(handle: FileHandle) {
         guard let stdin = self.ioSetup.stdin else { return }
 
+        // [Nucleic vendored patch] The stdin fd is BLOCKING (only the read fds get
+        // O_NONBLOCK), and `FileHandle.write` parks its thread for as long as the guest
+        // isn't reading once the vsock buffer fills — with a large prompt line that can be
+        // forever, and the old direct call parked a *width-limited Swift cooperative-pool
+        // thread*, non-cancellably. A few wedged sessions starved the entire concurrency
+        // runtime: every exec's decode loop, first-output watchdogs, all of it — an
+        // app-wide stall. Offload each write to a per-process GCD queue so the pool thread
+        // suspends instead; a wedged write now costs one expendable GCD thread, and
+        // process deletion closing the fd still unwedges it.
+        let writeQueue = DispatchQueue(label: "com.nucleic.stdin-relay")
+        // The handle is used from one queue at a time (writes are serialized on writeQueue;
+        // the close paths run after the relay ends or via _closeStdin's own lock).
+        nonisolated(unsafe) let handle = handle
         self.state.withLock {
             $0.stdinRelay = Task {
                 for await data in stdin.reader.stream() {
                     do {
-                        try handle.write(contentsOf: data)
+                        try await withCheckedThrowingContinuation { (c: CheckedContinuation<Void, Error>) in
+                            writeQueue.async {
+                                do {
+                                    try handle.write(contentsOf: data)
+                                    c.resume()
+                                } catch {
+                                    c.resume(throwing: error)
+                                }
+                            }
+                        }
                     } catch {
                         self.logger?.error("failed to write to stdin: \(error)")
                         break

Sources/ContainerizationOS/Linux/Epoll.swift

@@ -73,6 +73,13 @@ public final class Epoll: Sendable {
     /// An event returned by `wait()`.
     public struct Event: Sendable {
         public let fd: Int32
+        /// [Nucleic vendored patch] The `generation` value passed to `add` for this fd's
+        /// current registration, echoed back through `epoll_data`. Lets a dispatcher detect
+        /// a stale event: one queued for a PREVIOUS registration of a recycled fd number
+        /// (the old fd was closed and a new one with the same number registered between
+        /// `epoll_wait` returning and the event being dispatched). Without it, a stale
+        /// EPOLLHUP could tear down a brand-new healthy connection that inherited the number.
+        public let generation: UInt32
         public let mask: Mask
     }
 
@@ -115,9 +122,13 @@ public final class Epoll: Sendable {
         close(eventFD)
     }
 
-    /// Register a file descriptor for edge-triggered monitoring.
-    public func add(_ fd: Int32, mask: Mask) throws {
-        guard fcntl(fd, F_SETFL, O_NONBLOCK) == 0 else {
+    /// Register a file descriptor for edge-triggered monitoring. `generation` is echoed
+    /// back in every `Event` for this registration (see `Event.generation`).
+    public func add(_ fd: Int32, mask: Mask, generation: UInt32 = 0) throws {
+        // [Nucleic vendored patch] OR O_NONBLOCK into the existing flags — a bare F_SETFL
+        // REPLACED the whole flag set, silently clearing e.g. O_APPEND on anything registered.
+        let flags = fcntl(fd, F_GETFL)
+        guard flags != -1, fcntl(fd, F_SETFL, flags | O_NONBLOCK) == 0 else {
             throw POSIXError.fromErrno()
         }
 
@@ -125,7 +136,7 @@ public final class Epoll: Sendable {
 
         var event = epoll_event()
         event.events = events
-        event.data.fd = fd
+        event.data.u64 = UInt64(generation) << 32 | UInt64(UInt32(bitPattern: fd))
 
         try withUnsafeMutablePointer(to: &event) { ptr in
             if epoll_ctl(self.epollFD, EPOLL_CTL_ADD, fd, ptr) == -1 {
@@ -167,11 +178,19 @@ public final class Epoll: Sendable {
             var result: [Event] = []
             result.reserveCapacity(Int(n))
             for i in 0..<Int(n) {
-                let fd = events[i].data.fd
+                // [Nucleic vendored patch] fd rides the low 32 bits of `epoll_data`, the
+                // registration generation the high 32 (see `add`). The eventFD is registered
+                // via `data.fd` on a zeroed struct, so it decodes as generation 0 + its fd.
+                let data = events[i].data.u64
+                let fd = Int32(bitPattern: UInt32(truncatingIfNeeded: data))
                 if fd == self.eventFD {
                     return nil
                 }
-                result.append(Event(fd: fd, mask: Mask(rawValue: events[i].events)))
+                result.append(
+                    Event(
+                        fd: fd,
+                        generation: UInt32(truncatingIfNeeded: data >> 32),
+                        mask: Mask(rawValue: events[i].events)))
             }
             return result
         }