v0.42.2.0 — fixes issue #1678 (worker crash-loop + pooler-reap cascade + silent lens backlog) + a real cycle DB-disconnect bug

A production worker crash-looped ~400×/24h. Every visible log blamed the database (CONNECTION_ENDED, connect() has not been called, lock-renewal-failed) but none were the cause — the RSS watchdog was draining the worker mid-cycle on a too-low default cap, and every DB error was downstream of that. This wave fixes all three systemic problems in #1678, plus a fourth real production bug found while validating against real Postgres.

Problem 1 — RSS watchdog: opaque + footgun default

• New WORKER_EXIT_RSS_WATCHDOG exit code: a watchdog drain is no longer indistinguishable from a clean queue-drain. Supervisor classifies it as likely_cause=rss_watchdog with its own sliding-window breaker (independent of the stable-run reset that hid the 400×/day loop) + a loud rss_watchdog_loop alert naming the cap.
• resolveDefaultMaxRssMb() replaces the flat 2048 MB default at every spawn site (jobs work, jobs supervisor, autopilot, MinionSupervisor): clamp(0.5 × min(cgroupLimit, totalRAM), 4096, 16384). cgroup-aware so a 4GB container doesn't get a 16GB cap and SIGKILL anyway.
• 80% soft-warn (peak RSS + in-flight job kind) before the kill.

Problem 2 — pooler-reap cascade had no recovery

• CONNECTION_ENDED now classified retryable (code + message).
• PostgresEngine.sql getter throws a tailored retryable error on a reaped instance pool instead of the misleading module-singleton fallthrough — and transaction() / withReservedConnection() now route through that same getter (pre-landing review caught they bypassed it).
• promoteDelayed reconnect-retries; claim recovers on the next poll tick (no double-claim); the lock-renewal tick gets a bounded reconnect-once dep (no background retry racing the renewal deadline).

Problem 3 — extract_atoms backlog ran silently forever

• New extract_atoms_backlog doctor check (page-backlog-only label) warns with the exact --drain command when the active pack doesn't run the phase; pack-gated skips now carry a greppable pack_gated marker.
• New gbrain dream --phase extract_atoms --drain [--window N]: single-hold bounded drain that takes the same cycle lock id, rediscovers eligibility each batch, reports {extracted, skipped, remaining}, and exits non-zero while work remains (a failed count also counts as incomplete).

Bonus — the dream cycle could kill its own DB connection (found via E2E)

The lint phase's resolveLintContentSanity created + disconnected a module-style engine to read 4 config values, which cascaded to db.disconnect() and nulled the shared singleton mid-cycle — every later phase then threw connect() has not been called. Triggers whenever loadConfig() reports a connection string (i.e. every production Postgres gbrain dream). Lint now reuses the caller's live engine; standalone gbrain lint keeps the create-own path.

Review + verification

• Planned + /plan-eng-review (CLEAN) + Codex outside-voice (12 findings, all absorbed) before implementation; a second Codex adversarial pass on the final diff caught 4 more (2 fixed here: getter-bypass + drain-null-count; 2 documented follow-ups: claim idempotent-recovery, PGLite drain lock-parity — both already mitigated, see TODOS).
• bun run verify 29/29 · tsc clean · 12,333 unit pass (1 pre-existing isolation flake fixed) · real-Postgres E2E green incl. cycle/dream (was 3 pass/6 fail → 9/0) and db-singleton-shared-recovery.
• ~70 new test cases across watchdog, rss-default, retry-matcher, lock-renewal, queue, getter-selfheal, extract-atoms-backlog, drain, and lint-shared-engine.

Merged master's v0.42.1.0 (skillopt) cleanly; re-versioned 0.41.39.0 → 0.42.2.0. Plan: ~/.claude/plans/sorry-it-s-an-issue-tranquil-russell.md.

🤖 Generated with Claude Code

Documentation

• CHANGELOG.md — v0.42.2.0 entry (written at ship time, ELI10-lead-first): the watchdog crash-loop story + all three Worker crash-loop (400+/24h) from too-low RSS watchdog default, mis-reported as connection/lock failure + silently-starved lens-phase backlog #1678 fixes + the cycle lint DB-disconnect bonus + the "To take advantage of v0.42.2.0" upgrade block.
• CLAUDE.md — Key Files entries added for worker-exit-codes.ts, rss-default.ts, extract-atoms-drain.ts; v0.42.2.0 annotations on worker.ts (watchdog exit + claim-catch), child-worker-supervisor.ts (rss_watchdog breaker), lock-renewal-tick.ts (reconnect dep), and dream.ts (--drain). llms-full.txt regenerated to match (test/build-llms.test.ts gate).
• TODOS.md — section re-versioned to v0.42.2.0; documented two Codex pre-landing follow-ups (claim idempotent-recovery, PGLite drain lock-path parity).

Coverage

All new public surface is documented: gbrain dream --phase extract_atoms --drain [--window N] (CHANGELOG + CLAUDE.md), extract_atoms_backlog doctor check (CHANGELOG + CLAUDE.md), auto-sized --max-rss default (CHANGELOG). No architecture diagrams drifted. No documentation debt.