refactor(coding-agent): extract the append-only event-log substrate from the RLM spawn ledger

[snimu]

Summary

The daemon records every agent spawn, rename, and delete in an append-only JSONL spawn ledger: one file per sessions dir, appended concurrently by the supervisor and every session worker, and replayed to rebuild family and roster topology instead of re-deriving it from session files. Any of those writers can die mid-append, so the ledger carries a real crash-safety discipline — appends must be single atomic writes, a crashed writer's torn final line must be tolerated on read and repaired before the next append, and reads must be bounded so a bloated or hostile file can never trigger an unbounded allocation.

That discipline is not spawn-specific, and it had already been written a second time, independently, for another append-only ledger. Two private copies of subtle crash-recovery code is how the guarantees drift apart. This PR extracts the discipline into one shared substrate, src/core/event-log.ts (184 lines), and migrates the spawn ledger onto it. rlm-ledger.ts shrinks from 884 to 784 lines and keeps only spawn semantics; its public API is unchanged, and its entire 26-test suite passes unchanged — that unchanged suite is the migration proof. Net: +84 lines of src (+184 substrate, −100 in the ledger), plus 52 lines of substrate tests and a changelog entry.

The substrate

EventLog takes a path and optional bounds (maxBytes, maxRecords, and a log sink for repair and tolerance messages), and offers three operations, each carrying one crash-safety guarantee:

• Validated appends. Every event is serialized before the file is touched, and an unserializable event (JSON.stringify returns undefined) throws a TypeError before any byte — including repair — is written. The payload, plus a caller-supplied header when this append creates the file, goes out as one O_APPEND write, optionally fsynced. The multi-writer design relies on the atomicity of single small O_APPEND writes, so the substrate writes exactly once per append and never splits records across writes.

• Repair on append — never on read. A crashed writer can leave a final line missing its newline. Before appending to an existing file, an unterminated tail is truncated at its byte offset, guarded by a double-read stability check so a log that is changing under us is left alone; the byte bound is checked before the repair reads anything, and any repair failure leaves the tail for the reader's tolerance. Because repair happens only on append, a viewer can always replay a live writer's log without mutating it.

• Bounded, fail-closed replay. Replay reads through the file descriptor, so the size check and the allocation see the same fd and a log that grows concurrently cannot bypass maxBytes; maxRecords fails closed the same way. A missing file replays as empty, a malformed interior line fails closed, and exactly one torn final line — rejected by the consumer's parser and unterminated, the signature of a crashed writer — is logged and tolerated. What counts as valid is the consumer's call: replay takes a parse callback that throws to reject a line or returns undefined to deliberately skip one (the ledger skips records with unknown ops).

All offsets are byte offsets on raw buffers: string indices diverge from byte offsets as soon as any record carries multi-byte UTF-8, and ftruncate takes bytes.

The union of safety behaviors

The rule that shaped the substrate: when two implementations of the same crash-safety discipline are unified, the survivor must keep the stronger guarantee of each — the union of their safety behaviors, never the intersection. Three properties of the substrate exist because one side was weaker there; one weakness was the other implementation's, two sat in the spawn ledger's own pre-extraction code and are visible in this diff's deletions:

• Truncate, never complete. The friendlier-looking repair for an unterminated tail that still parses as JSON is to complete it with a newline. But a completed line that the consumer's strict parser rejects — well-formed JSON with the wrong fields, like a record missing v/at — becomes permanent fail-closed interior poison for every later replay. Truncation is safe for strict and lenient parsers alike, and the torn bytes were never readable data. An earlier revision of this change completed parseable tails; review caught the poison, and every unterminated tail is now truncated.

• Validate before any byte. An append path that interpolates JSON.stringify(record) unchecked writes the literal text undefined into the log for an unserializable record, poisoning every replay. The substrate throws before the file is touched.

• Read through the fd, everywhere. The old replay checked the size with stat and then read the file by path — a window in which a concurrent grow turns a bounded read into an unbounded allocation. The repair path already read through the descriptor; replay now does too.

All three are pinned in test/event-log.test.ts: the TypeError fires before any byte reaches the log, a JSON-parseable unterminated tail is truncated so a strict replay stays clean, and an oversized log fails closed through the descriptor on both the replay and append paths.

The migration

RlmSpawnLedger now delegates its file mechanics and keeps its semantics:

• Appends go through appendSync with durable: true (the ledger has always fsynced) and an onCreate hook that emits the meta header, so header and first record leave in the same single write.
• Replay goes through replaySync(parseLedgerLine) under the ledger's own bounds (RLM_LEDGER_MAX_BYTES = 32 MiB, RLM_LEDGER_MAX_RECORDS = 100,000); the edge-map reconciliation stays in the ledger.
• Everything else stays in the ledger: the record shapes and their strict per-line validation, the internal queue that serializes appends, lazy seeding from legacy registries with its atomic no-clobber link() publish, and family/sibling topology.

The public API is unchanged — the export list is identical, and the only src consumers, daemon-mode.ts and daemon-supervisor.ts, are untouched. test/rlm-ledger.test.ts — 26 tests covering torn-final-line tolerance (but not mid-file), byte-offset repair that preserves multi-byte UTF-8 records, fail-closed malformed lines, byte and record bounds, unknown-op skipping, durable-append admission failure, and the full seeding matrix — is untouched by this PR and passes as-is.

Validation

• At this head (1481de4a2), sanitized environment: the new event-log suite (3), the unchanged rlm-ledger suite (26), and the ledger's consumers — daemon-agent-roster, agent-roster, daemon-session-list, daemon-supervisor-monitor, daemon-supervisor-lazy-subagents (200 tests across those 7 files) plus daemon-mode (184): 384 tests, 0 failures.
• Root npm run check (biome, tsgo, installer render, browser smoke) passes.
• Changelog entry: .changes/event-log-substrate.md.

Linear: https://linear.app/primeintellect/issue/res-1254