perf+fix(daemon): cache getKnownRigs() per tick, atomic rigs.json writes (#3684)

Fixes #3463, #3464.

Cache getKnownRigs() per heartbeat tick (#3463)

d.getKnownRigs() re-read and re-parsed mayor/rigs.json on every call,
and ~10 call sites run per heartbeat tick. Memoize the result for the
duration of a tick via a new (knownRigsCache, knownRigsCacheValid) pair
on Daemon. Invalidated at the start of each heartbeat so changes
between ticks are picked up; accessed only from the heartbeat-loop
goroutine so no synchronization is needed.

The existing callers all already use d.getKnownRigs(), so no call-site
changes are required — they automatically benefit from the cache.

Atomic rigs.json writes (#3464)

SaveRigsConfig used os.WriteFile, which truncates the file before
writing. A concurrent reader (getKnownRigs on another tick, doctor
checks, LoadRigsConfig elsewhere) could observe a zero-byte or partial
file and fail with "unexpected end of JSON input".

- SaveRigsConfig now writes to a temp file in the same directory and
  renames into place; the rename is atomic on POSIX.
- LoadRigsConfig retries once on read/parse failures as a
  belt-and-suspenders recovery if an older non-atomic writer is still
  in the process tree.
- doctor/workspace_check.go Fix paths (RigsRegistryExistsCheck and
  RigsRegistryValidCheck) switch to the atomic write helper — same
  atomicity guarantee, same rigs.json target.

Extract atomic-write helpers to internal/atomicfile

internal/config could not import internal/util's AtomicWriteFile
without a cycle (util → lock → tmux → config via orphan.go). Rather
than duplicate the helper, move the atomic-write primitives out of
util into a dedicated leaf package internal/atomicfile, which has no
internal deps and so can be imported from anywhere. 13 existing
callers are updated to atomicfile.WriteFile / WriteJSON /
WriteJSONWithPerm / EnsureDirAndWriteJSON; util retains its non-atomic
helpers. Net -569 lines.

Tests

- internal/atomicfile: full port of the existing util/atomic_test.go
  suite (concurrency, integrity, permissions, read-only-dir,
  large-file cases).
- TestGetKnownRigs_CachedBetweenInvalidations: populates cache, deletes
  rigs.json, asserts d.getKnownRigs() still returns cached results, and
  that invalidation surfaces disk state (including after rewrites).
- TestSaveRigsConfig_AtomicAgainstConcurrentReaders: 4 concurrent
  writers × 2000 reader iterations; fails if any raw read observes a
  zero-byte or parse-failing file.
- TestLoadRigsConfig_RetriesOnTruncatedRead: asserts the retry path
  recovers a real payload after a seeded truncated state.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: oscarhermoso

internal/agent/state.go

@@ -7,7 +7,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/steveyegge/gastown/internal/util"
+	"github.com/steveyegge/gastown/internal/atomicfile"
 )
 
 // StateManager handles loading and saving agent state to disk.
@@ -58,5 +58,5 @@ func (m *StateManager[T]) Save(state *T) error {
 		return err
 	}
 
-	return util.AtomicWriteJSON(m.stateFilePath, state)
+	return atomicfile.WriteJSON(m.stateFilePath, state)
 }

internal/atomicfile/atomicfile.go

@@ -0,0 +1,90 @@
+// Package atomicfile provides atomic file-write primitives (write-to-temp +
+// rename). Kept as a leaf package with no internal dependencies so any other
+// package — including low-level ones that util/ transitively depends on — can
+// use it without creating an import cycle.
+package atomicfile
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+)
+
+// WriteJSON writes JSON data to a file atomically with mode 0644.
+// It first writes to a temporary file in the same directory, then renames it
+// to the target path. This prevents data corruption if the process crashes
+// during write. The rename operation is atomic on POSIX systems.
+func WriteJSON(path string, v interface{}) error {
+	data, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return err
+	}
+	return WriteFile(path, data, 0644)
+}
+
+// WriteJSONWithPerm is like WriteJSON but uses the given file mode.
+func WriteJSONWithPerm(path string, v interface{}, perm os.FileMode) error {
+	data, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return err
+	}
+	return WriteFile(path, data, perm)
+}
+
+// EnsureDirAndWriteJSON creates parent directories (mode 0755) if needed, then
+// atomically writes JSON with mode 0644.
+func EnsureDirAndWriteJSON(path string, v interface{}) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return err
+	}
+	return WriteJSON(path, v)
+}
+
+// EnsureDirAndWriteJSONWithPerm is like EnsureDirAndWriteJSON but uses the
+// given file mode for the output file.
+func EnsureDirAndWriteJSONWithPerm(path string, v interface{}, perm os.FileMode) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return err
+	}
+	return WriteJSONWithPerm(path, v, perm)
+}
+
+// WriteFile writes data to a file atomically by writing to a unique temp file
+// in the same directory and then renaming it over the target. The rename is
+// atomic on POSIX systems; concurrent writers each produce self-consistent
+// content because each uses a distinct temp file.
+func WriteFile(path string, data []byte, perm os.FileMode) error {
+	dir := filepath.Dir(path)
+	base := filepath.Base(path)
+
+	// "*" in the pattern is replaced with a random suffix by os.CreateTemp,
+	// preventing concurrent writers from colliding on the same temp file.
+	f, err := os.CreateTemp(dir, base+".tmp.*")
+	if err != nil {
+		return err
+	}
+	tmpName := f.Name()
+
+	if _, err := f.Write(data); err != nil {
+		f.Close()
+		os.Remove(tmpName)
+		return err
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmpName)
+		return err
+	}
+
+	// CreateTemp uses 0600 by default; apply the caller's permissions.
+	if err := os.Chmod(tmpName, perm); err != nil {
+		os.Remove(tmpName)
+		return err
+	}
+
+	if err := os.Rename(tmpName, path); err != nil {
+		os.Remove(tmpName)
+		return err
+	}
+
+	return nil
+}