afx consistency check: reconcile registry vs git worktrees vs live processes (the independent observation that catches both under- and over-reporting)

[amrmelsayed]

Why

Three independently-reported defect instances this week share one species: a tool rendering unknown or partial state as a determinate result.

• afx spawn can half-register a builder: worktree + branch + live agent but no registry row (spawn must be transactional) #1712 — a half-registered spawn: builder alive, reachable, valid git worktree list entry, no registry row. The registry UNDER-reports.
• afx cleanup prints '[ok] cleaned up!' unconditionally — success line must be earned by verified post-conditions #1713 — cleanup printing success with the worktree and branches still alive. The tool OVER-reports.
• The dead-architects report (companion liveness issue): registry rows served for processes dead for days, because reconcile runs at Tower boot only and Tower never restarted.

Because the errors have opposite signs, no consumer can fix this by calibrating how much it trusts the registry: trusting it less worsens the over-report case, trusting it more worsens the under-report case. Only an independent observation of the substrate resolves the family.

Ask

An afx doctor-style (or codev doctor section, whichever home fits) consistency check that reconciles three independent sources and reports every disagreement:

1. Registry (global.db: builders, architects, terminal_sessions),
2. Git substrate (git worktree list + .builders/ directory entries + local/remote builder branches),
3. Live processes (pid liveness with start-time guard against reuse; optionally shellper socket reachability).

Output: one row per disagreement with a classification and the remedy, e.g.

• worktree + live process, no registry row → half-registered builder (afx spawn can half-register a builder: worktree + branch + live agent but no registry row (spawn must be transactional) #1712 class): offer re-registration or supervised cleanup;
• registry row, no live process (start-time mismatch or pid dead) → stale registration (liveness class): mark stale, point at recover;
• registry row + no worktree → cleanup remnant or manual deletion: offer row removal;
• worktree + no process + no registry → parked/orphaned worktree: report only (never auto-delete — worktree destruction stays a human call).

Read-only by default; remedies offered as printed commands or an explicit --fix for the provably-safe subset only (row-level corrections, never git worktree remove).

Non-goal

This complements, not replaces, the per-command fixes in #1712/#1713: those make the writers honest; this makes drift detectable regardless of which writer lied.