Resource governance for agent-spawned process trees (memory caps, pressure feedback, teardown ordering)

## Problem

Claude Code executes arbitrary process trees (Bash, background tasks, subagents) on a machine it shares with the user's interactive session, with no resource governance: no memory ceiling, no system-pressure feedback, no guarantee spawned trees die with the session. An agent will also do things a human wouldn't: re-run a heavy command repeatedly, run it concurrently across sessions, or deliberately reproduce a pathological workload while investigating it.

## Incident that motivated this (macOS, 48GB)

A session ran a standard test target (`pytest -n 4`). A third-party SDK's background thread hit a pathological serialization loop (a `MagicMock` reached its JSON encoder; each pass spawned new mock children), allocating GB/s invisibly to the test harness. One worker reached ~60GB in ~4 minutes → kernel jetsam → machine froze and rebooted, killing every session.

Hours later it happened again — during the agent's own *capped* reproduction. The agent's watchdog polled `ps` RSS, and macOS memory compression had moved the ballooning pages out of the resident set: `ps` reported the tree at 8GB while the kernel's footprint accounting showed 87GB. The instrument the agent could build from inside a session was structurally blind; the machine paid again.

Diagnosis eventually required jetsam-report forensics plus a footprint-based watchdog that SIGABRTs the fattest process (with `PYTHONFAULTHANDLER=1`) to capture the allocating stack. All of that is generic and automatable — none of it is available from the harness.

## Requested capabilities, most valuable first

1. **Opt-in resource caps on spawned process trees.** Like `timeout`, but for memory: kill the process group when its combined physical footprint crosses a limit, and put *which process* and (where cheap) *which stack* in the tool result. cgroups v2 on Linux; on macOS a polling watchdog over `/usr/bin/footprint` — RSS is the wrong metric there (compression hides ballooning pages from `ps`).
2. **System-pressure feedback to the model.** Surface "this tree is at NGB and climbing; system free X%" in tool results or as a mid-turn warning. Agents can be defensive only if the harness gives them the signal.
3. **Teardown ordering.** When a session dies, spawned trees should die with it, leaf-work first. In the incident, session teardown killed the agent's watchdog while the multi-GB workload it guarded kept running — guard died before the guarded.
4. **Cumulative budget across a session's fan-out.** Subagents, background tasks, and concurrent sessions multiply footprint with no shared ceiling; a per-session (or per-machine) budget would bound the blast radius.

Happy to share the jetsam forensics recipe and the footprint-watchdog script the diagnosis produced.

No repository file or test is named. Start by tracing the harness entry point that launches Bash, background-task, and subagent trees, then review the cgroups v2 and /usr/bin/footprint approaches; pytest -n 4 is the motivating reproduction. Done means governed trees report pressure, enforce budgets, and tear down work in the required order.

Rédigé par le modèle d'indexation à partir du texte de l'issue.