chore: repin bt-daemon to pick up the memory fix

[Stephen Belanger (Qard)]

Moves the bt-daemon pin from 1ca65d4 to abd6756, which is braintrustdata/braintrust-coding-agent-plugins#23 — "bound daemon memory so a long session cannot exhaust it".

Why

A user reported the daemon reaching 20 GB before crashing. Every Claude lifecycle event had been reading the whole transcript into memory and journaling it verbatim, so a session re-recorded its growing transcript on every turn — an 18 MB transcript produced a 1.6 GB journal (142 snapshot lines accounted for 1.54 GB; all 5,852 other lines totalled 19 MB). Replay then loaded that file with read_to_string and parsed every line into a Vec held at once.

The daemon now:

• mirrors transcript bytes once into daemon-owned storage and journals only a reference plus a high-water offset,
• streams journal replay entry by entry instead of materializing it,
• retires idle sessions so translator state, sink handles, and credential leases are released rather than held for the process lifetime,
• applies backpressure on session queues instead of using an unbounded channel.

Nothing on disk is capped or truncated — only in-memory caches are bounded, and each is re-derivable from disk.

Scope

No source changes are needed in bt. It only constructs bt-daemon's clap-parsed command schema (TraceArgs), and the one new field (ServeArgs::session_idle_timeout_secs) carries a default_value_t, so this is not a breaking API change. It surfaces as a new hidden flag:

bt trace daemon --session-idle-timeout-secs <SECS>   [default: 300]
    Retire a session's in-memory state after this many seconds without traffic.
    A later event rebuilds it from the journal. 0 disables retirement.

The Cargo.lock change is deliberately limited to the one source line. cargo update -p bt-daemon also re-resolved unrelated transitive picks (windows-sys, socket2, getrandom), which I reverted — the bump adds no dependencies, and pristine main passes --locked cleanly, so that churn was noise.

Verification

• cargo check --locked --all-targets — clean
• cargo test auth::tests — 77 passed (what CI runs)
• cargo test trace — 40 passed
• cargo clippy --locked --all-targets --all-features -- -D warnings — 14 findings, identical before and after the bump. They are pre-existing collapsible_if lints in src/traces.rs, src/sql.rs, and src/datasets/pipeline.rs from a newer local clippy than CI's pinned toolchain; untouched here.
• Confirmed the new flag and its default surface through the real bt binary.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

Latest downloadable build artifacts for this PR commit 0f36fa07adc8:

• Workflow run: https://github.com/braintrustdata/bt/actions/runs/32084873286
• Download all artifacts (GitHub CLI): gh run download 32084873286 --repo braintrustdata/bt
• Installers are published from main automatically. To publish one for a PR branch, run release-canary manually via workflow_dispatch.

Available artifact names

• artifacts-build-global
• artifacts-build-local-x86_64-apple-darwin
• artifacts-build-local-aarch64-pc-windows-msvc
• artifacts-build-local-x86_64-pc-windows-msvc
• artifacts-build-local-x86_64-unknown-linux-musl
• artifacts-build-local-x86_64-unknown-linux-gnu
• artifacts-build-local-aarch64-apple-darwin
• artifacts-build-local-aarch64-unknown-linux-gnu
• artifacts-plan-dist-manifest
• cargo-dist-cache