Closes #1685. Layers the posture work on the mechanical foundation from #1678/#1735 (already in master at v0.42.5.0).

What this delivers

#1685 is the design invariant: an operator (human or agent) should never grep a worker log or read source to learn the brain is unhealthy or why. #1735 fixed the three concrete #1678 bugs (self-identifying RSS watchdog exit, cgroup-aware cap, pooler-reap self-heal, silent-backlog doctor warn). This PR closes the four remaining #1685-distinctive gaps.

A — worker_oom_loop doctor check (one line names the cause)

A worker OOM-looping now shows as a single gbrain doctor line: Worker OOM-looping: cap=8192MB, N watchdog kills/24h → raise --max-rss. It unions both worker modes — supervised workers (supervisor rss_watchdog crash bucket, read across current+prev ISO week so a Monday window can't lose Sunday) AND bare gbrain jobs work workers (the minion_jobs aborted: watchdog count, the same source queue_health reads). Cap comes from the breaker alert when present, else falls back to the auto-sized default. No grep, no source-reading.

C — cause-ranked doctor (single source of truth)

gbrain doctor prints a Top issues (ranked by cause) header — root causes above symptoms — and the JSON envelope gains top_issues so agents act on the root, not the cascade. Ranking is tier-only with grounded downstream_of: a symptom is tagged downstream of a root cause ONLY from a small map of known same-source edges, never a co-occurrence guess.

D — per-source auto-drain (self-heal the silent backlog)

When a pack doesn't declare extract_atoms but eligible pages pile up, autopilot now submits a bounded, PROTECTED extract-atoms-drain job per source — gated on autopilot.auto_drain.enabled (default on), a per-source backlog threshold, and a daily spend cap. The idempotency key is UTC-day time-sloted so a source reopens each day instead of being blocked forever.

B — pool_reap_health (reaped, and not recovering)

A new pool-recovery audit + pool_reap_health check surface DB pool reaps and, critically, whether reconnect is failing (the actionable signal) vs thrashing (warn at ≥10 reaps/hr).

Tests

New: doctor-worker-oom-loop, doctor-pool-reap-health, doctor-cause-rank, audit/pool-recovery-audit, extract-atoms-drain-handler, autopilot-auto-drain-wiring. Extended: extract-atoms-drain (shared-helper lock contract), connection-resilience (reconnect signature), dream-cli-flags (drain routes through the shared helper), worker-lock-renewal (reconnect error-threading). Typecheck clean; the merge-overlap surface (doctor.ts, jobs.ts, config.ts, doctor-categories.ts, postgres-engine.ts, retry.ts — all touched by both this branch and master's v0.42.6–10 wave) is green.

Reviews

Plan went through /plan-eng-review + a codex outside-voice plan challenge (10 findings, all folded — protected drain job, time-sloted key, source enumeration, union OOM signal, cap fallback, cross-week read, reason-threaded reconnect, evidence-gated downstream, config plumbing). A second codex pass on the implementation diff caught 4 more, 3 fixed before merge: multi-source auto-drain was broken by maxWaiting coalescing across sources; pool_reap_health could false-alarm on a recovered reap + an unrelated reconnect failure; the common lock-renewal reap path wasn't labeled as a reap. Plan + decisions persisted under ~/.claude/plans/.

Deferred (filed in TODOS.md): GAP E secondary-error cause_ref log tagging, and the worker_oom_loop thin-client/remote doctor path.

🤖 Generated with Claude Code