refactor(daemon): consolidate rlm subagent metadata onto the spawn ledger

[snimu]

What this is

PR 2 of the spawn-ledger stack (base: #1387). With the ledger as the topology authority, the per-parent rlm-subagents.jsonl registries stop being written entirely. Hydration metadata (prompt, spawn code, model, names, status) moves to one small JSON display file per child, and every registry consumer now answers topology questions from the ledger and metadata questions from the display file — with a read-only legacy fallback so existing profiles keep working.

What changes

• New rlm-subagent-display.ts (88 lines): one rlm-subagent.json per child in the artifact dir the child already owns (session-artifacts/<parentId>/<childId>/). Atomic temp+rename writes (0600), tolerant reads (missing/malformed → undefined, unknown fields kept for forward compat). Deliberately contains no topology fields — parent, depth, and current name always come from the ledger; the display file is hydration metadata only. Written at the same three moments the registry used to be: spawn admission, completion, deletion.
• Registries become read-only legacy data. The writers are deleted. One tolerant reader remains (same validation as before — sub-* ids, absent depths, malformed lines skipped) serving two purposes: the ledger seed source from PR 1, and metadata fallback for children spawned before this PR.
• Consumers repointed through one helper (display file → legacy registry → edge-only defaults): passive subagent listing, all three hydration sites (a2a wake, cron restore, selector resume), and deletion. A child with a ledger edge but no metadata anywhere still lists and hydrates with defaults rather than becoming unreachable.
• Deletion is hardened: the display tombstone is written first, then the ledger delete is awaited and load-bearing — if the ledger append fails, the deletion fails, because post-consolidation the ledger is the only thing standing between a deleted child and a permanent ghost edge. A crash between the two writes self-heals on a retried deletion.
• Dead code deleted: the catalog siblings command, its client method, and the registry-walking listSavedSessionSiblings (unconsumed since feat(daemon): supervisor-owned rlm spawn ledger as family authority #1387 moved the supervisor to ledger-backed siblings), plus all registry-write plumbing.

Compatibility

• Pre-ledger profiles (never ran feat(daemon): supervisor-owned rlm spawn ledger as family authority #1387): lazy seeding from feat(daemon): supervisor-owned rlm spawn ledger as family authority #1387 builds topology; metadata comes from the legacy registry fallback. Covered by tests whose fixtures write the exact registry shape the old writer produced (raw JSONL, not via any current writer).
• Profiles from the feat(daemon): supervisor-owned rlm spawn ledger as family authority #1387 era: children have both a ledger edge and a registry; display files win when present, registry fills the gap.
• Rollback asymmetry, stated plainly: rolling back to the feat(daemon): supervisor-owned rlm spawn ledger as family authority #1387 build is lossless (it still dual-writes). Rolling back further to a pre-ledger build and then forward again leaves children spawned during the rollback invisible to ledger-backed listing (seeding only runs when no ledger file exists); they remain deletable via the legacy fallback. This is the inherent cost of ending dual-write.
• Legacy children without a persisted depth keep the old behavior exactly: hydration falls back to header-derived depth rather than trusting the seeded estimate.

Numbers

Net src +125 lines (new display module +88, daemon-mode +105 net for the fallback chain and hardened deletion, catalog process −68). The registry merge semantics — last-writer-wins reconstruction at every read — are gone; metadata now has one source order. The large deletion (the catalog family walk and its helper) belongs to the v0.8 stack rebase, not this PR.

Testing

Targeted daemon suites: 458 passed / 8 skipped (env-stripped), npm run check clean, reviewed twice (all findings addressed or explicitly accepted as nits: display-file trust is display-grade only; createdAt epoch default for metadata-less children; the tombstone→ledger crash window keeps its retry self-heal from #1387). The full suite has the same ~93 pre-existing env-dependent failures as the merge base.

Known follow-ups deliberately not in this PR: surfacing the ledger spawn timestamp for metadata-less children's createdAt, and tightening the legacy entry type to mark unvalidated fields as optional.

---

Note

High Risk
Changes core daemon session topology, admission, and deletion durability with migration/rollback edge cases; incorrect ordering or ledger failures could leave ghost or unreachable subagents.

Overview
RLM subagent persistence is split: the spawn ledger owns topology only; new per-child rlm-subagent.json display files hold hydration metadata (prompt, model, status, etc.) with atomic writes. Per-parent rlm-subagents.jsonl is no longer written—only read for pre-ledger fallback and seeding.

The daemon rewrites passive listing, spawn/completion recording, hydration, and deletion to walk ledger edges and resolve metadata via display file → legacy registry → defaults. Spawn admission now awaits a durable ledger append and fails closed (closes the runtime and removes a stray display file) if the append fails. Deletion writes a display tombstone first, then requires a successful ledger delete; tombstoned edges still resolve paths for job cleanup and legacy-only children.

Removes the catalog siblings command, client API, and listSavedSessionSiblings. Ledger seed publish drops the rename fallback when hard links are unavailable (skips seeding instead of risking clobber). RlmSpawnLedger.edges() can include deleted tombstones for retries.

^{Reviewed by Cursor Bugbot for commit b74f6e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Consolidate RLM subagent metadata onto a durable spawn ledger

• Introduces a new append-only JSONL spawn ledger (rlm-ledger.ts) that tracks subagent topology (spawn/rename/delete) per sessions directory, replacing per-parent rlm-subagents.jsonl registries as the source of truth.
• Adds per-child display files (rlm-subagent-display.ts) for storing metadata (prompt, model, status, etc.) atomically via temp-file + fsync + rename.
• Rewrites listPassiveRlmSubagents, recordRlmSubagentState, and recordRlmSubagentDeletion in daemon-mode.ts to derive topology from the ledger and metadata from display files, with legacy registry as a read-only fallback for pre-ledger children.
• Migrates sibling lookups in daemon-supervisor.ts from catalog.siblings() to ledger-backed rlmLedgerSiblings(); removes the siblings command from the catalog process entirely.
• Behavioral Change: subagent admission now waits for rlmSpawnLedger.flush() before returning the runtime; deletion durability order is display tombstone then ledger tombstone with an explicit reason (user or revoked).

Changes since #1390 opened

• Changed subagent admission to synchronously await spawn record durability and fail admission if the append cannot be persisted [b74f6e4]
• Changed RlmSpawnLedger.publishSeedFile to skip seeding entirely when hard links are unavailable instead of falling back to non-atomic rename [b74f6e4]
• Added test coverage for spawn record durability failure during admission and updated tests for the modified seeding behavior [b74f6e4]

📊 Macroscope summarized ee8d43f. 4 files reviewed, 0 issues evaluated, 0 issues filtered, 0 comments posted

🗂️ Filtered Issues

No issues evaluated.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ee8d43f. Configure here.}