feat(context): passive window observer + downward-only clamps (phase 5)

[Calmingstorm]

Campaign phase 5 (plan of record R2 §11–§12, backend half of §12 — the table UI itself is phase 6).

What this adds

src/llm/window_observer.py — the evidence store + clamp authority. Odin's normal work is the probe: every emergency rescue already carries the server's own numbers (phase-2 stamping), and the observer turns each same-request overflow→compressed-retry-acceptance pair into per-(opaque account, canonical model) evidence and a temporary DOWNWARD clamp on budget resolution. No probe traffic, no autonomous upward adjustment.

• data/context_windows.json: versioned schema, strict validation, opaque account keys only; ONE lock around the whole read–merge–atomic-write transaction; active_clamp() is synchronous, disk-free, lock-free (immutable-state replacement).
• Clamp qualification exactly per plan: structural overflow + same logical request's successful retry + server-authoritative acceptance echo + canonical model match + same opaque account. Cross-account retries record both sides, derive no clamp. Clamp value IS the acceptance, exact. 24h TTL, lazily judged; downward-only merges (lower-or-equal evidence replaces with fresh TTL; higher evidence never raises or clears a live clamp); manual clear is account-scoped and preserves bounds history.
• Forfeit invariant: every public entry point is total — an evidence-write failure logs and forfeits durability, never the request; in-memory evidence still serves this process.
• Filesystem contract: hostile-input-safe reads (O_NONBLOCK + O_NOFOLLOW, fstat shape check, size cap), quarantine-never-repair for corrupt material (preserved verbatim beside the store), atomic publication (O_EXCL temp + fsync + replace + parent-dir fsync), explicit fd ownership across every failure window, persistence off the event loop via asyncio.to_thread.

Resolution integration — snapshot_for_codex_config(observed_clamp=) feeds the clamp slot phase 1 built. All five snapshot sites pass the active clamp: chat _maybe_compress + _call_llm ladder, loop _maybe_compress_loop + _call_loop_llm ladder, agent _generation_budget_snapshot (plan capture + spawn provider).

Evidence capture at all three rescue-success sites: chat and loop record through a total runner helper; agents thread an evidence_recorder callable (spawn → _run_agent → _call_llm_with_recovery) with the dict-shape adapter living beside the callback that produces that shape.

API — GET /api/context/windows (canonical keys, floors, overrides, configured vs effective resolutions side by side, provenance, raw evidence) + POST /api/context/windows/clear (account-scoped). Route parity 188 → 190.

One deliberate deviation from the plan text

Plan §11 scopes the active clamp to "currently eligible pool accounts"; this implementation takes the minimum non-expired clamp across ALL accounts holding one — the conservative superset. Rationale: the pool is sticky but failover can seat any account at any moment, pool-membership introspection would couple the observer to CodexAuthPool, and a departed account's clamp dies with its 24h TTL anyway. Flagging explicitly for your verdict; happy to build pool-eligibility scoping if you judge the plan text binding here.

Notes for review

• Evidence accrues at RESCUE events only (the "highest accepted" field is populated by rescue acceptances). Recording every ordinary success would put the observer on the hot path for zero clamp benefit — clamps only ever derive from overflow pairs.
• The clamp deliberately bypasses operator override bounds (phase-1 semantics: evidence is not configuration); the resolver stays total under any clamp value.
• No config leaves added — the store is runtime evidence, so no apply-registry/template/docs changes. WebUI rendering (including clamp provenance + expiry and the clear control) is phase 6 per the plan.

Gates at 9565508

Full suite 9,516 passed / 5 skipped; coverage findings=0 (window_observer.py baselined via the 41-test battery: hostile store inputs, crashed-write atomicity, fd discipline under fdopen failure, the full qualification matrix, downward-only + TTL semantics, forfeit invariant, broken-observer guard arms on every surface, resolver integration, all three surface hooks, API); lint new=0; type new=0 (module itself mypy-clean); apply-registry clean; diff-check clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SHfEwTsEyuS8RUhwdoW66g

[Calmingstorm]

LGTM — approved at 87602fa. Verification record: all seven blocker fixes mutation-verified biting (M1 resume-correlation, M2 single-snapshot on both surfaces, M3 cancellation drain against the exact paused-A/cancelled/admitted-B interleaving, M4 truthful clear, M5 raw-auto ceiling — now bites after the real-typed fixture fix, M6 central admin policy, M7 eligible-account scope with fail-open-not-stale). Eligibility chain cross-checked end to end (pool → non-secret IDs → opaque keys at the client layer; observer imports no pool code). Direct API probe with real ContextCompressionConfig: auto → None + sol primary 1,277,400; explicit → 750,000 verbatim. Independent full battery at 38f7b8e: 9,530 passed / 5 skipped, coverage/lint/type/apply-registry clean; 87602fa is test-only (13 insertions, one file) with the focused suites green (250 passed). Both #274 codec advisories adopted (schema-owned effort set, snapshot classified RECONSTRUCTED). Merging to the campaign branch.