fix(collab): liveness heartbeat + RSS monitor + orphan-workspace sweep

[hblanken]

Stability hardening pass (PR 3 of 5). Observability + hygiene for the single-replica task.

S5 — /healthz event-loop liveness

/healthz returned 200 as long as the HTTP listener answered, even if the event loop was wedged by a long synchronous op (giant JSON.parse on a runaway preview log, a tight loop in a plugin). Add a 5-s heartbeat stamping lastEventLoopTick; /healthz now reports event_loop + event_loop_lag_ms and returns 503 when the tick is >30 s stale, so the ALB pulls a wedged task ~1 min sooner than waiting for request timeout.

S6 — container RSS monitor (new cgroup-memory.ts)

opencode itself had no view of its own memory pressure (PR #34's cgroup read was preview-only). New shared util reads /sys/fs/cgroup/memory.current; startMemoryMonitor() logs a WARNING when total task RSS crosses 13 GB (leading indicator for the 16 GB ceiling) and INFO when it recovers. Pure telemetry — never kills anything; the preview memory cap stays the actor. Self-disables on non-Linux dev.

preview-launcher.ts keeps its private copy of the cgroup read for now to avoid conflicting with the in-flight preview-hardening PR (#40). Consolidating onto this shared util is a deferred cleanup, noted in the util's docstring.

S7 — orphan-workspace sweep

The original premise was wrong — explicit DELETE already wipes the workspace synchronously (router.ts:1293), so soft-deleted dirs don't pile up in the normal path. The real gap is drift: an rmSync that threw on an EFS hiccup, a task killed between soft-delete and cleanup, a manual DB edit — each leaves a ~1.5 GB frontend workspace orphaned on EFS forever.

cleanupOrphanWorkspaces() (boot, fire-and-forget) removes workspace-root dirs with no live session row whose mtime is older than a 24 h safety floor. A session inserts its DB row before cloning, so a live dir always has a live row; the floor just rules out any boot-time race with an in-progress init.

Files

• server/server.ts — event-loop heartbeat + /healthz stall check
• collab/cgroup-memory.ts (new) — shared RSS reader + startMemoryMonitor()
• collab/workspace.ts — cleanupOrphanWorkspaces()
• cli/cmd/serve.ts — wire S6 + S7 into boot

Test plan

• Deploy off this branch
• curl /healthz → now includes event_loop: ok + event_loop_lag_ms (small number)
• Boot log shows [collab.memory] line (monitor started, or disabled-on-non-Linux locally)
• Boot log shows orphan-sweep result (reclaimed N or silent when none)
• Create + delete a session → workspace gone immediately (unchanged); no orphan left for the sweep
• Manually leave an orphan dir (mtime >24 h, no session row) → next boot reclaims it
• A fresh dir (<24 h) with no row is NOT removed (init-race protection)
• No false 503 on /healthz under normal load (event_loop_lag_ms stays well under 30 s)

🤖 Generated with Claude Code