Mind if I add a pending-free list? Unwatch defers the free there, poll_once drains it under lock before snapshotting—avoids the UAF without refcounting.

I have formatted the file with clang-format, please re-trigger the CI check.

Thanks @Golevka2001 — unwatching deleted projects is the right fix and the deferred-free design is sound. One concern before merge: cbm_watcher_free also drains/frees pending_free, so if it can run while cbm_watcher_poll_once is mid-cycle there's a use-after-free / double-free window on the pending_free array. Please confirm the watcher thread is stopped/joined before cbm_watcher_free frees it (or guard the free with projects_lock). A small test exercising the delete→unwatch path would also help. 🙏

Thanks @Golevka2001 — real bug and a clean fix: cbm_watcher_unwatch existed but had no production caller, so deleting a project left the watcher polling and re-indexing a deleted DB. Wiring it into handle_delete_project and using a deferred-free against the lock-free poll loop is the right approach (the one-cycle deferral is sound for the single watcher thread).

Two things before it can land:

1. Regression test: please add one exercising the fix — register a watch, run the delete_project path, and assert cbm_watcher_watch_count drops to 0 (ideally also a poll-after-unwatch to guard the deferred-free). The existing watcher tests are a good template.
2. CI hasn't run on this PR yet (no checks present — likely first-time-contributor workflow approval); it needs to be green before merge.

Nice catch on the zombie-reindex — looking forward to the test.

Fixed. cbm_watcher_free now sets stopped=1 as a safety net, documented the precondition in the header, and added a test for the unwatch -> pending_free drain path. 😃

Thank you — this is a real bug with a thoughtful fix. We verified the zombie is worse than reported: the watcher's index_fn recreates the deleted .db, so deleted projects actually resurrect. Your deferred-free design is the right call given poll_once polls outside the lock (a naive immediate free would be a genuine cross-thread UAF). Two follow-ups we'll track separately: the UI DELETE /api/project path has the same zombie (no watcher access at all), and the realloc-failure fallback frees immediately (reintroducing the UAF in the OOM corner) — neither blocks this. Merging.