Fix turn-arena memory retention

[iamken1204]

Fixes #483.

A long agent turn allocates from one arena that is freed only when the turn returns. Four kinds of transient memory were parked in it, and each on its own was enough for the OS to kill the process: the first report was 81 GB after a 23-minute turn, and a build carrying the first two fixes still reached 48 GiB with three one-off subagents running. Every fix uses the same shape: a scoped c_allocator-backed arena for the scratch, one copy-out of the survivors into the longer-lived owner.

Tool-call scratch (commit 1). Ordinary tools received the turn arena as their dispatch allocator, so every nested scratch arena inside a tool was backed by it and its deinit reclaimed nothing: grep_files kept the git grep stdout plus every scanned candidate file, prepareModelOutput kept the sanitize and mask copies of every raw result. File mutations already ran on a per-call arena with copy-out; this applies that contract to every call. The orchestrator and the parallel execution hook give each call its own arena, executeToolCallAuthorized threads it into the dispatch context, and executeRegisteredTool copies the survivors (body, status detail, tool result memory) out at the boundary. dupeToolResultMemory becomes one shared deep copy in types.zig with a field-count tripwire.

Checkpoint copies (commit 1). persistRecoveryCheckpoint deep-copied every accumulated tool result into the turn arena one to two times per settled provider attempt, quadratic in step count. The copy now lives in a scratch arena freed when the checkpoint returns; every sink already serializes or dupes before returning.

MCP error code lifetime (commit 2). PromptRunResult.error_code is a borrowed pointer, so the static "McpInputRequired" is assigned after the dispatch copy-out instead of pointing into the freed call arena.

Provider-attempt scratch (commit 3). Every model attempt received the turn arena, so the request body, the std.http.Client state, the provider-state replay parse of every prior assistant message, and the JSON DOM of every SSE event stayed until the turn returned. A long turn resends its growing context on every step, so this grew quadratically, and concurrent subagents in the same process multiplied it. Each attempt-loop iteration now owns an arena; the retry paths already called Result.deinit, which now reclaims; on success copyStreamResultToTurnArena deep-copies both Result variants into the turn arena. dupeModelCompletion carries comptime field-count assertions on ModelCompletion, ProviderBilling, Completed, Failure, FailureDiagnostics, and DeferredUsageReference, so a new slice-bearing field fails the build until the copy covers it.

Subagent inspect-wait polls (commit 4). A parent waiting on a child calls subagent inspect with a wait condition, and executeModelInspection polls every 100 ms for up to a minute. Each poll ran manager.execute with the tool call's arena, loading every locked child's control record and cloning the target's messages and events, and a child's event list grows while it works. Each poll now owns its own arena; encodeResult already serializes the returned inspection into the caller's allocator.

Measurements

Offline reproduction against a fake Codex Responses endpoint (real fx binary, no network). "Before" is the build with commits 1 and 2 only.

Workload	Before	After
50 grep steps, peak RSS	176.9 MB	47.8 MB
300 grep steps, peak RSS	869.3 MB	96.0 MB
50 grep steps with one 429 before every 10th step, peak RSS	174.6 MB	63.7 MB, every retry admitted
parent + 3 one-off subagents, 100 steps each, peak footprint	1643 MB	323 MB, 13 MB live at the end
parent waiting on 3 subagents with inspect (30 steps each), peak footprint	14,336 MB at 100 requests, killed	244 MB, 139 requests completed

Real Codex sessions on the full patch stack: a 15-step read_file turn adds 9 MB of footprint and releases it on return; a parent waiting on three one-off subagents (22 threads alive, two 60 s wait timeouts) peaks at 69 MB and settles at 28 MB, where the pre-fix build passed 3.6 GB one minute into the same phase and 57 GiB before the children finished.

Requests are byte-identical; permission, retry, and usage-ledger semantics are untouched.

Test plan

• zig build test
• New in types.zig: field-count tripwires for dupeToolResultMemory and dupeModelCompletion
• New in tool_runtime.zig: an ordinary tool runs with distinct call/result owners and the result is read after the call arena is destroyed
• New in orchestrator.zig: both Result variants are copied out of an attempt arena that is then destroyed, every surviving field read back
• Manual: the reproductions above, sampling RSS and footprint while the turn runs

[vercel-security-reviewer]

Security review: https://vercel.slack.com/archives/C0BSEH6GB18/p1788014541098329