chore(buglog): bug-1884 partial (9b61fd99)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/bugs/bug-1884.md

@@ -1,8 +1,8 @@
 ---
 id: "bug-1884"
-status: "open"
+status: "partial"
 status_updated: "2026-09-29"
-status_note: "newly logged"
+status_note: "part 1 (9b61fd99): sim teardown + core registries, 17.2 MB -> 75 KB at exit; part 2: replay-event payload release, core->config, job/resource destructors, snapshot-load data"
 component: "scheduler"
 severity: "leak"
 timestamp: "2026-09-29T08:20:03Z"
@@ -66,10 +66,34 @@ default-settings replay, 2026-09-29)
 - Evidence: /home/claude/tmp/bug-1884/lsan-report.txt (full report), /home/claude/tmp/bug-1884/scheduler-replay-20260929-064412.replay
 
 ## Root cause
-TODO: required for fixed/partial
+Nothing tears the simulator down: sched_sim_driver_run() never joined its
+picker/allocator threads and main() exited without finalizing the core. On
+top of that, several ownership gaps only show once teardown runs:
+- xce_sched_core_fini() never destroyed the plugin/job/worker/queue/user/
+  project registries or the shared-resource arrays that init creates.
+- sim_alloc.c's two sched_make_allocs() stand-ins each ran a full
+  xce_sched_core_init(): a whole unused core, plus a re-init of the
+  process-wide string-intern and selector tables (two 8 MB tables leaked).
+- plugin_unregister() (the plugin registry's datakiller, never run before)
+  key_del()'d from the registry being destroyed and skipped fini_fn for
+  plugins registered with plugin_register_core().
+- The limit plugin's usage-instance table had kill_limit as datakiller for
+  xce_vres_t records (bad free on destroy); kill_vres() was an empty stub.
+- Remaining (part 2): replay-event payloads are never released after
+  xce_core_push_events() (sim_loop.c: documented "accepted leak"), unlike
+  driver.c's release_translated_payload(); the adopted core->config is never
+  freed (and a CONFIG_PUSH replaces it without freeing the old one);
+  kill_sched_job() is shallow; resmgr has no datakiller; snapshot-load data,
+  the builtin_fcfs plugin struct and some allocator scratch are not freed.
 
 ## Fix
-TODO: required for fixed/partial
+Part 1 (9b61fd99): sched_sim_driver_fini() -- cancel/join the threads the
+way sched_fini() does (thread ids now in core.jobpicker/allocator), close
+the files, finalize the core; main() calls it after a clean run. Core fini
+destroys every registry init makes. The allocator stand-ins set up only
+lock, nextid and the aliased resmgr. plugin_unregister() only runs fini_fn.
+Usage instances use kill_vres(), which frees the record. Leak at exit on the
+reproduction replay: 17,041,405 -> 75,495 bytes.
 
 ## Verification
 - Test: TODO: name + file; RED before the fix, GREEN after