fix(shard): stable multishard + disk-offload on both runtimes; kill the multishard RAM zombie

CHANGELOG.md

@@ -77,6 +77,81 @@ supported under per-shard AOF layout`. Tracked for v0.2.0.
 `CDC.SUBSCRIBE` push channel (C3b), and the multi-shard master PSYNC
 deferred from v0.1.10. Tracked in `.planning/rfcs/v02-enterprise-architecture.md`.
 
+### Fixed — Multishard idle-RAM blowup + tokio-Linux serving hang + graph parser DoS (PR #136)
+
+Closes the "multishard RAM zombie": a fresh multishard instance with no
+`maxmemory` could commit multiple GB of RSS while idle, and the tokio
+runtime could hang its accept loop on Linux. Three independent root
+causes, all fixed and verified in the OrbStack VM under a cgroup memory
+cap (idle RSS **3791 MB → 29 MB** for a 4-shard no-`maxmemory` instance;
+~45 MB under load):
+
+- **PageCache eager pre-allocation.** Each shard committed
+  `num_frames × PAGE` zeroed bytes at construction, sized to 25% of the
+  **whole-instance** `maxmemory` (or a large default when unset). Now the
+  page buffers allocate lazily and the frame budget is divided by shard
+  count (`per_shard_pagecache_budget`); a startup `WARN` reports the
+  resolved per-shard budget.
+- **tokio listener bind-race.** The central accept listener bound the port
+  *without* `SO_REUSEPORT` while per-shard listeners bound *with* it,
+  producing a bind-order race that could leave the port served by a shard
+  that never received connections. The central listener now also binds
+  `SO_REUSEPORT`; `--per-shard-accept` defaults to `false` under tokio.
+- **io_uring-under-tokio default-off.** The tokio→io_uring bridge floods
+  errors under load. It is now **opt-in via `MOON_URING=1`**; tokio shards
+  run plain epoll/kqueue by default. `MOON_NO_URING=1` still force-disables
+  io_uring everywhere. The monoio runtime is unaffected (always io_uring
+  unless `MOON_NO_URING`).
+
+Two durability defects found during review were fixed in-PR with
+red/green TDD:
+
+- **Manifest compact-reopen failure no longer silently loses commits.**
+  `manifest.rs compact()` reopened `self.file` *after* `rename(tmp, path)`;
+  if that reopen failed, later commits silently wrote to an orphaned inode.
+  A `needs_reopen` flag now reattaches to `self.path` before any subsequent
+  commit (or fails loudly).
+- **tokio per-shard AOF writer now latches after a torn write.** The tokio
+  per-shard writer lacked the `write_error` latch present on the single-file
+  and monoio writers; a torn write (header OK, data fails) corrupted the
+  frame stream. It now latches on any write failure and acks `WriteFailed`.
+
+- **Cypher parser stack-overflow DoS bounded.** The precedence-climbing
+  expression grammar pushes ~9 stack frames per source nesting level but
+  `check_depth()` counts only one level per recursion, so the previous
+  limit of 64 overflowed a 2 MiB async-worker stack (SIGABRT) **before**
+  the guard could fire. `DEFAULT_MAX_NESTING_DEPTH` is now `32`
+  (~288 worst-case debug frames, ~50% margin); deep nesting returns
+  `NestingDepthExceeded` gracefully.
+
+Low-severity durability edge cases filed as follow-ups: #137
+(`apply_spill_completions` failed-commit cold-key window), #138
+(`do_rewrite_per_shard` panic wedges `--experimental-per-shard-rewrite`),
+#139 (multi-DB `SELECT >0` cold recovery restores db0 only).
+
+### Fixed — `maxmemory` is now a whole-instance cap across shards (G2)
+
+**Behavior change for multishard deployments.** Previously each shard
+enforced eviction against the *full* `maxmemory`, so an N-shard server
+tolerated ~N× the configured cap before evicting (a 4-shard server at
+`--maxmemory 100mb` retained ~307 MB / 768K keys vs a 1-shard server's
+124 MB / 322K — the "RAM keeps growing in multishard mode" report).
+
+`maxmemory` is now a true **whole-instance** cap. Each shard enforces
+eviction against `maxmemory / num_shards`, so aggregate RSS converges on
+the configured value regardless of shard count.
+
+- **`CONFIG GET maxmemory` / INFO are unchanged** — they report the
+  whole-instance value verbatim (Redis-compatible). Division happens only
+  at enforcement.
+- **Operators running explicit `--maxmemory N --shards M (M>1)`** now get
+  an effective ceiling of `N` (not `N×M`). A startup log line states the
+  resolved per-shard budget so the change is visible:
+  `maxmemory <N> bytes is a whole-instance cap; each of <M> shards enforces
+  eviction against a per-shard budget of <N/M> bytes`.
+- Single-shard servers are byte-for-byte unaffected (`num_shards == 1` ⇒
+  no division).
+
 ### Docs — Hash-field TTL three-way benchmark suite (PR #127)
 
 - `scripts/bench-hash-ttl.sh` (2-way harness) + `scripts/bench-hash-ttl-3way.sh`

CLAUDE.md

@@ -85,7 +85,8 @@ orb run -m moon-dev bash -c 'sudo apt-get update -qq && sudo apt-get install -y
 ## Environment Variables
 
 - `RUST_LOG=moon=debug` — enable tracing output (uses `tracing-subscriber` with `env-filter`)
-- `MOON_NO_URING=1` — disable io_uring at runtime; used in CI/containers/WSL where io_uring is unavailable
+- `MOON_NO_URING=1` — force-disable io_uring everywhere (monoio runtime + tokio bridge); used in CI/containers/WSL where io_uring is unavailable
+- `MOON_URING=1` — opt **into** the tokio→io_uring bridge. The bridge is **default-off under the tokio runtime** (it floods errors under load and can hang the accept loop); tokio shards run plain epoll/kqueue unless this is set. No effect on the monoio runtime, which always uses io_uring unless `MOON_NO_URING` is set.
 - `RUSTFLAGS="-C target-cpu=native"` — enable CPU-specific optimizations for benchmarking
 
 ## Key Design Decisions

README.md

@@ -233,6 +233,14 @@ cargo build --release
   --maxmemory 8g --maxmemory-policy allkeys-lfu
 ```
 
+> **`--maxmemory` is a whole-instance cap.** With `--shards M`, each
+> shard enforces eviction against `maxmemory / M`, so total RSS converges
+> on the value you set regardless of shard count. `CONFIG GET maxmemory`
+> and `INFO` report the whole-instance value (Redis-compatible); a startup
+> log line shows the resolved per-shard budget. If `--maxmemory` is omitted,
+> Moon auto-caps at ~80% of detected RAM with `allkeys-lru` (pass
+> `--maxmemory 0` for unlimited).
+
 ### Connect with any Redis client
 
 ```bash

src/command/persistence.rs

@@ -300,6 +300,34 @@ pub fn bgrewriteaof_start_sharded(
             b"ERR Background AOF rewrite already in progress",
         ));
     }
+
+    // [F6] PerShard pools use the per-shard fan-out (synchronized seq bump +
+    // single manifest commit across all writers). TopLevel multi-DB pools keep
+    // the legacy single-writer RewriteSharded path.
+    if pool.layout() == crate::persistence::aof_manifest::AofLayout::PerShard {
+        // Per-shard fan-out for BOTH runtimes. The fold is synchronous std::fs
+        // IO; on monoio the writer runs it inline, on tokio the writer converts
+        // its `tokio::fs` handle to `std::fs` for the fold's duration (both run
+        // on a dedicated block_on_local thread, so blocking is safe). The fold
+        // body — and therefore the exactly-once invariant — is identical.
+        //
+        // try_send_rewrite_per_shard loads the manifest, builds the shared
+        // coordinator, and reliably fans out to every writer. The in-progress
+        // flag is cleared by the coordinator's final commit
+        // (PerShardRewriteCoord::shard_done), not here.
+        match pool.try_send_rewrite_per_shard(shard_databases) {
+            Ok(()) => {
+                return Frame::SimpleString(Bytes::from_static(
+                    b"Background append only file rewriting started",
+                ));
+            }
+            Err(e) => {
+                AOF_REWRITE_IN_PROGRESS.store(false, Ordering::SeqCst);
+                return rewrite_pool_error_frame(e);
+            }
+        }
+    }
+
     match pool.try_send_rewrite(AofMessage::RewriteSharded(shard_databases)) {
         Ok(()) => Frame::SimpleString(Bytes::from_static(
             b"Background append only file rewriting started",