fix(coding-agent): failed workers recover on touch; roster gaps answer a structured recovering error

[snimu]

Part of the worker-state single-truth program (Linear RES-1270); squashes the confirmed residuals of discussions #1742 and #1650 and the mechanism behind #1870/#1641 (and the #1904d reconnect gap).

Purpose

Two owners for two worker-state facts:

1. Liveness/failure. After MAX_DEFERRED_RECOVERY_ROUNDS the recovery ladder parks a live-but-silent worker lifecycle='failed' terminally: no timer re-probes it, reuseWorkerForCreate hard-rejects it, and only client-owned workers auto-recover on attach. A worker frozen longer than the ~2-3 min probe budget (dark wake, paused VM, swap-in) stays written off even though isProcessAlive + processStartId prove it is ours and alive ([Bug] Sleeping the machine permanently orphans daemon sessions: a live worker is marked failed and never re-checked #1742 residual). The create path threw exactly in the gap where neither retry_worker nor a launchEnv-bearing fresh create applied ([Bug] Prime Agent 0.8.0: saved session becomes permanently unopenable after failed worker recovery #1650 residual).
2. Addressability. findWorker resolves selectors only through the in-memory roster, hydrated lazily from live workers after adoption; the persisted worker descriptors that carry rootActiveSessionId/rootSessionId were consulted only in the client-owned attach special case. Every supervisor replacement re-opens a window where attach/prompt/kill on a provably-known session answer Unknown active session, and clients cannot distinguish gone from recovering (v0.8.1: supervisor restart loses live worker active-session mapping during RLM fan-out #1870, [Bug] v0.8.0 supervisor restarts make every TUI fail to reattach with “Unknown active session” #1641).

Change

• canRetryFailedWorker (failed + no stop in flight + process identity verified current) and retryWorkerRecovery (the state reset retry_worker already performed) become the single retry semantics. retry_worker, attach, and create reuse all share them; the parked state is now exit-able on any touch. Identity gone/replaced/unverifiable keeps the old hard answers.
• The client-owned attach pre-pass generalizes to any descriptor-matched worker (owned keeps its launchEnv/recoveryConfig relaunch semantics; non-owned recovers only when identity-current-failed, and never blocks on an in-flight recovery). A child-session attach onto a failed worker retries after roster resolution.
• findWorker on a roster miss consults descriptors: a root session on a recovery-candidate worker answers with a structured, retryable session_recovering error (DaemonSessionRecoveringError, new DaemonErrorInfo variant, DAEMON_SCHEMA_REVISION 27). Failed workers deliberately keep Unknown active session so first-party clients take the saved-session/create fallback, which reclaims or retries them (that fallback is what self-heals identity-gone workers via launchEnv).
• main.ts (get_state lookup) and the agents view treat session_recovering like the unknown fallback, converging on the create path.

Wire classification: backward-compatible. The new variant rides the existing optional errorInfo; old clients see a readable message, old daemons never send it, nothing is capability-gated because it degrades to a plain error.

Net src LOC: +102/-38, of which the supervisor is +84/-38 (about half is the owned-attach special case becoming the general pre-pass, plus the two shared helpers replacing three inline copies of the reset).

Tests

• New pin: create reuse on a failed worker with a current process identity retries recovery instead of throwing (fail-unfixed verified: forcing the old terminal semantics rejects with "could not be safely reclaimed").
• New pin: a descriptor-known unaddressable root session answers session_recovering (typed, with activeSessionId); a failed worker and a truly unknown selector keep Unknown active session (fail-unfixed verified: removing the fallback yields Unknown).
• Both-direction wire pins in daemon-errors.test.ts: serialize/deserialize round-trip for new clients, readable message for old clients, and plain old-daemon failures do not misclassify.
• Existing pins kept green: retry-while-stopping rejection, intentional-stop tombstone reset, failed-unreclaimable create rejection (identity gone), owned-session recovery paths.

Ran locally: daemon-supervisor-{monitor,process,eviction,admission,input-pause}, daemon-agent-roster, daemon-supervisor-lazy-subagents, daemon-errors, regressions 4656 + 4603, agent-connection-daemon, daemon-ps, agents-view suite, main-interactive-routing — 540 tests pass; npm run check green.

---

Note

Medium Risk
Touches core daemon supervisor routing, attach/create, and worker lifecycle; behavior changes for failed-but-live workers and session lookup errors, though guarded by process identity and extensive new tests.

Overview
Fixes daemon sessions getting stuck when a worker is parked failed but its process is still alive, and when the supervisor knows a session id but cannot route to it yet.

Failed worker recovery: Shared canRetryFailedWorker / retryWorkerRecovery replace duplicated reset logic. retry_worker, session create reuse, attach, and any command forwarded to the worker now automatically retry recovery when failure is not terminal (current process identity, no stop in flight). User-stopped workers stay stopped until an explicit retry_worker.

Addressability: When roster lookup misses but a persisted descriptor matches a recovering (non-failed) worker, findWorker returns DaemonSessionRecoveringError with wire errorInfo.code: session_recovering (daemon schema 27). Failed workers still answer Unknown active session so clients can fall through to create/reclaim. resolveActiveSessionLookupFailure and the agents view treat recovering like unknown for the saved-session reopen path, while explicit attach can surface the typed retryable error.

^{Reviewed by Cursor Bugbot for commit 77b747a. Bugbot is set up for automated code reviews on this repo. Configure here.}

LOC

Total src: +148/−52 (net +96); tests: +260/−1 (net +259).

Note

Retry failed daemon workers on touch and add DaemonSessionRecoveringError to protocol revision 27

• Failed workers whose recorded process identity is still current are now retried on attach, create, retry, and command forwarding via a shared retryWorkerRecovery helper that clears stop/archive markers and waits for recovery
• Adds a typed DaemonSessionRecoveringError with an active session identifier, serialized over the wire as a structured error variant; clients deserialize it distinctly from unknown-session failures so they no longer treat a known recovering session as absent
• findWorker resolves descriptor-known recovering root sessions to the typed error instead of unknown-session, preserving the failed-session create fallback
• resolveActiveSessionLookupFailure in main.ts classifies structured recovering failures as thrown errors while keeping the saved-session fallback for unknown sessions; agents-view.openAgentsViewSession falls back to the saved session on recovering attach failures
• Risk: daemon protocol schema advances to revision 27; older clients without deserializeDaemonError support see only the plain message and cannot distinguish recovering sessions. Stop-marked or identity-invalid failed workers are excluded from retry by canRetryFailedWorker — reviewers should confirm no lifecycle path clears stop markers unintentionally

^{Macroscope summarized 77b747a.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7f94df0. Configure here.}

[sethkarten]

Included in #2028: #2028