fix: enforce worker spawn concurrency cap

[polymath-orchestrator]

Summary

• Follow-up to P0: ao spawn resolves harness to project default, bypassing the weighted mix (only intake gets it) #96: route manual/API worker spawns through daemon-side project cap admission before any durable spawn state is created.
• Make trackerIntake.maxConcurrent a project-wide live worker cap shared by intake and manual spawns, while keeping worker-mix selection server-side from the already-merged P0: ao spawn resolves harness to project default, bypassing the weighted mix (only intake gets it) #96 fix.
• Serialize spawn admission through seed-row creation so concurrent manual/API spawns cannot overrun the cap or pick stale worker-mix buckets.
• Map cap hits to WORKER_CONCURRENCY_CAP 409 responses and update CLI/config wording.

Test plan

• Red first: go test ./internal/session_manager -run TestSpawn_RejectsWorkerWhenProjectAtConcurrencyCap -count=1 failed before implementation with missing cap sentinel.
• go test ./internal/session_manager -run 'TestSpawn_RejectsWorkerWhenProjectAtConcurrencyCap|TestSpawn_CountsInFlightSeedRowsAgainstConcurrencyCap|TestSpawn_WorkerMix' -count=1
• go test ./internal/observe/trackerintake -run 'TestPollHonorsMaxConcurrentAgainstLiveWorkers|TestPollDefersWhenAlreadyAtMaxConcurrent|TestLiveWorkersByProjectIgnoresTerminatedAndNonWorkers|TestPollWorkerMixRespectsConcurrencyCap' -count=1
• go test ./internal/service/session -run TestToAPIError -count=1
• cd backend && go build ./...
• cd backend && go vet ./...
• cd backend && go test ./...
• cd backend && go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 run --path-mode=abs

Review notes

• Final-review cycle 1 found a medium concurrency risk: count-and-create admission was not serialized. Fixed by guarding cap/mix selection through seed-row creation and adding the in-flight seed-row regression.

Merge note

Sensitive paths touched: backend/internal/session_manager/**. Per repo policy, do not automerge; park for human review/merge.

[polymath-orchestrator]

Final status: implementation is merge-ready by local gates, remote CI, and final-review pass.

Review cycles:

1. Found and fixed one medium concurrency issue: count-and-create admission needed serialization so concurrent spawns cannot overrun trackerIntake.maxConcurrent or select from stale worker-mix counts.
2. Re-reviewed amended diff: no remaining substantive findings.

Current gates:

• Local backend gates passed: go build ./..., go vet ./..., go test ./..., pinned golangci-lint.
• GitHub checks all passed on head 120ed2e7fb936325ba1eb1c4b5e28630307b0c8d.
• Review threads: none.

Parked for human merge because the PR touches sensitive path backend/internal/session_manager/**.

[polymath-orchestrator]

Superseded: #96 was fixed and merged via #102 (client-side empty-harness approach, reviewed + CI-green). This v2 (server-side) is redundant and touches sensitive session_manager/**. Closing to avoid a conflicting double-implementation. If we want to migrate to the server-side resolution, file a fresh issue.

[polymath-orchestrator]

Current status update (2026-07-07): keeping this PR parked as the merge-ready candidate for the #96 scope-add requested in issue comments and the current session request. This supersedes my earlier "superseded" comment on this PR thread.

Verified again on head 120ed2e7fb936325ba1eb1c4b5e28630307b0c8d:

1. cd backend && go build ./... passed.
2. cd backend && go vet ./... passed.
3. cd backend && go test ./... passed.
4. cd backend && go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 run --path-mode=abs passed with 0 issues.
5. Remote PR checks are green and the branch is mergeable.

Do not automerge: this touches sensitive path backend/internal/session_manager/** and also backend/internal/cli/project.go; parked for human review/merge per repo policy.

[polymath-orchestrator]

INDEPENDENT REVIEW — PR #108, cycle 2
Reviewer: Claude
Head SHA: 4c9cf0f
Previous findings status:

• resolved — observer.go now distinguishes a WORKER_CONCURRENCY_CAP spawn error and defers remaining intake work without triggering failure backoff. The new regression test covers the mid-pass cap collision and verifies the next poll is not suppressed.

Buckets reviewed: bugs, architecture, security, performance, repo-specific-invariants, tests, spec-drift, bypass-flags, docs
Verdict: approved
Findings: Zero findings.

Summary:

• Bugs: no remaining off-by-one, nil, race, lock leak, or error-path defect found in the manager admission path or intake cap handling.
• Architecture/integration: cap and worker-mix admission now converge on daemon-side state; the global spawn mutex is coarse but acceptable for this correctness fix.
• Security: no new external input, authz, secret, deserialization, or shell-injection surface.
• Performance: no unbounded loops or N+1 behavior; the manager cap check is a race backstop, not the common intake path.
• Repo-specific invariants: sensitive path backend/internal/session_manager/** is touched, so this remains parked for human merge.
• Tests: regression coverage now includes manager in-flight seed rows and intake mid-pass cap collision; backend build/vet/test/lint passed locally.
• Spec drift: no OpenSpec change applies; CLI help and config comments now match shared-cap semantics.
• Bypass flags: none found.
• Docs: no stale intake-only maxConcurrent wording found.

[polymath-orchestrator]

final-review: clean — reviewer=claude, head=4c9cf0f356e9b608f020080803ed6bdbab6d44c1

Verdict artifact: #108 (review)

Status: local gates passed, remote CI passed, review-passed status is green, and current-head review threads are clear. Parked for human merge because this PR touches sensitive path backend/internal/session_manager/**.

[polymath-orchestrator]

Final-review (independent, claude/fable): CLEAN. Per-project worker concurrency cap enforced server-side (WORKER_CONCURRENCY_CAP at spawn — machine-enforced, not LLM); intake DEFERS over-cap issues (retries next poll, no permanent drop, no failure-backoff); solid test coverage (cap collision → defer, cap of 1, no-backoff). Sensitive path (session_manager) → parked for Nick. Merge-ready.