fix(daemon): suppress repeated-identical error storms and expected repo-gone log noise

[svarlamov-git-ai]

Issue

Two classes of daemon error logs are noise rather than actionable failures:

1. Repeated-identical-failure storms. On a machine whose daemon-side git environment is persistently broken (e.g. a broken Xcode CLT shim, or the daemon being denied read access to an included gitconfig), every traced command's side-effect pass fails with the identical error. Each failure logs at error level, producing an unbounded stream of identical error logs for as long as the environment stays broken.

2. Expected async-race conditions logged at error level. Git processing is trace2-driven and fully async, so the repo state at processing time need not match state at command time. Traced commands can run outside any repository, or in a temp repo (created by plugins/tooling) that is deleted before async processing. The resulting failures ("No git repository found for path without exec", fatal: cannot change to '<path>', fatal: not a git repository, failed to stat) are inherent to the design, not errors.

Fix

Add src/daemon/error_log_policy.rs and route the daemon's side-effect error log sites (command apply/side-effect, async side-effect, checkpoint side-effect/watermark) through a shared record_and_log_side_effect_error helper:

• Repeated-error suppression (per repo family): the first 3 consecutive identical errors still log at error level; subsequent identical occurrences downgrade to debug, with a rate-limited warn summary at most once per 30 minutes that includes the suppressed count. A success or a differing error re-arms error-level logging. Identity is keyed on git exit code + stderr with volatile hex runs (OIDs, pids) normalized away, so storms whose messages embed per-invocation values are still suppressed.
• Expected-condition classification: repo-discovery misses without exec, and git CLI failures whose stderr indicates a missing repository while the family root no longer exists on disk (only a definitive NotFound counts), log at debug as "repo removed before processing" instead of error. The trace-ingest worker's error site applies the same classification for repo-discovery misses.
• Trackers are tiny, in-memory, and garbage-collected after an idle window; expected conditions short-circuit before the tracker map so high-cardinality deleted temp repos never leave entries. Nothing is added to the trace-ingest hot path's happy path.

Intentionally left loud: panic sites (genuine bugs) and test-only completion-log write failures still log unconditionally at error level, and the ingest-site downgrade only applies to the no-repo discovery miss (traced commands legitimately run outside repos constantly, so no error budget there).

Testing

• New unit tests for the suppression state machine (identical-run counting, reset on differing error/success, summary timing via injected Instant, argv/OID-varying storm keys, idle eviction) and the expected-condition classifier (positive and negative cases; genuine git errors stay at error level).
• task fmt, task lint, full task test (lib + integration) pass locally; the two pre-existing env-dependent lib test failures on this machine reproduce identically on main.

🤖 Generated with Claude Code

---