fix-observer-ignored-churn-resource-leak

Metadata

Description

## Objective
Fix the worktree observer resource leak and restart-reconciliation defect exposed by `implement-strong-agent` attempt `attempt-0-19`. Ignored build churn must never consume unbounded RAM/CPU or repeatedly wedge spawn preparation.

## Incident evidence
- Exact auxiliary observer PID 2381922 reached roughly 10 GiB RSS and 52% CPU while the worker ran `cargo install --path . --locked` in an 11 GiB `target/` tree.
- Observer state said `ignored_churn={volatile-target:5}` yet the process retained enormous state; after exact TERM containment the worker immediately continued and memory fell by about 9 GiB.
- Status continued claiming `event-and-reconcile / observer active` after the observer exited.
- Initial dispatch repeatedly rolled back with `observer state already exists; use open_at for restart reconciliation` before eventually spawning.

## Requirements
- Drop built-in ignored/volatile trees such as `target/`, `.git/`, WG control dirs, caches, and configured generated paths at filesystem-walk and event-ingress boundaries before content reads, hashing, queueing, or per-path retention.
- Bound all watcher/debounce/coalescing queues and ignored-churn accounting; overflow must trigger a bounded stable full reconciliation, never retain one record per generated event.
- Keep source/deliverable observation exact; ignored churn cannot advance proven progress or hide a later source write.
- Make observer RSS/CPU bounded under sustained high-volume build churn and settle when churn stops.
- Detect auxiliary observer exit and report a truthful degraded/held health state while preserving state; never claim `observer active` for a dead exact PID.
- Spawn preparation must reconcile existing exact state with `open_at` semantics or replace only stale epoch-owned state, instead of dozens of rollback loops. Never attach to a mismatched task/generation/fence/lease/root identity.
- Preserve writer/process/lifecycle authority boundaries and all retained evidence.

## Validation
- [ ] RED subprocess stress fixture emits at least hundreds of thousands of nested `target/` events plus source writes and proves bounded RSS/CPU/queue size, correct ignored counters, and exact source manifests.
- [ ] Killing only the observer leaves writer/worktree untouched and changes status to a truthful degraded/hold state with a safe recovery command.
- [ ] Repeated same-attempt preparation opens/reconciles exact observer state idempotently; stale/mismatched epochs fail closed without repeated reservation churn.
- [ ] Existing isolated observer, spawn preparation/recovery, crash-safe finalization, and late-writer tests/smokes pass.
- [ ] `cargo fmt --check`, `cargo clippy`, focused/full tests and owned smoke pass; commit/push and `wg done` complete normally.

Depends on

• done implement-strong-agent

Required by

• done fix-pi-native-progress-session-proof

Log

• 2026-07-27T21:08:32.641801839+00:00 Task paused
• 2026-07-27T21:08:32.728189003+00:00 Task published
• 2026-07-27T21:31:40.628583847+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-920 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer state already exists; use open_at for restart reconciliation
• 2026-07-27T21:32:47.594737911+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
• 2026-07-27T21:33:01.440253966+00:00 Starting implementation: inspect prior WIP, observer architecture, and incident paths before adding RED coverage.
• 2026-07-27T21:42:44.237586417+00:00 Implemented structural walk pruning/category aggregation, single-slot path-free wake coalescing with atomic ignored/overflow accounting, truthful dead-PID health overlay, and exact prepare_at restart reconciliation. Focused 16-test observer suite passes; now validating installed-binary 200k-event stress flow.
• 2026-07-27T21:54:08.466762851+00:00 Live incident replay: pre-fix observer for this attempt reached 10,762,804 KiB RSS / 47% CPU during cargo install. Exact TERM immediately produced truthful PollOnly + preserved recovery argv; restarting the newly installed binary on the same exact state reconciled observer_epoch 1→2 at 18,352 KiB RSS without touching writer/worktree.
• 2026-07-27T22:12:55.007383774+00:00 Committed: 321789b4 — pushed to remote
• 2026-07-27T22:13:08.986939244+00:00 Validated: focused observer suite 16/16; installed-binary 200k+ event stress passed with bounded RSS/settled CPU, exact source manifest, truthful exact-PID death/restart health, overflow, and late-write quarantine; spawn preparation recovery smoke passed; cargo build, fmt check, plain clippy, and cargo install --locked passed.
• 2026-07-27T22:13:09.053511778+00:00 Full cargo test completed: observer suite and 3830/3830 primary bin tests relevant to this lane passed; repository retains the documented pre-existing stale route/lifecycle failures (25 primary bin plus legacy integration expectations), matching dependency logs and unrelated to this diff.
• 2026-07-27T22:18:23.915989787+00:00 Final access-loop validation: filtered notify Open/Close Access events generated by observer fingerprinting itself; exact restarted observer remained ~28 MiB and consumed 9 CPU ticks across 20s including a periodic reconciliation, versus the reproduced pre-fix 10.7 GiB / 47% process.
• 2026-07-27T22:18:23.976643399+00:00 Committed follow-up: 7f8da2bc — pushed to remote; final installed-binary 200k+ churn smoke passes.
• 2026-07-27T22:20:16.404196903+00:00 Task marked as done