fix(orchestration): exclude rolled-back work from bounded recovery

[saphid]

What Changed

Runtime recovery no longer materializes rolled-back history solely because abandoned command, tool, or subagent items retain a nonterminal status. Both SQL and memory selection exclude items owned by a rolled-back run while retaining orphaned items whose run is missing.

Current V2 already loads full projections only for the IDs returned by getRecoveryThreadIds("runtime"). This change preserves that API and adds a regression with 1,000 settled shells and one recovery candidate. It does not reintroduce the older duplicate recovery-query API.

Validation

On c0c3d6e61, based directly on V2 b9fa1399c:

• CI=true vp test run apps/server/src/orchestration-v2/ProjectionStore.test.ts apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.test.ts apps/server/src/orchestration-v2/ProviderRuntimeRecoveryService.regression.test.ts apps/server/src/orchestration-v2/ProviderTurnControlService.test.ts: 30 tests pass across four files, exit 0. The rolled-back selection tests failed before the fix; orphan selection passes in both stores.
• CI=true vp run --filter t3 typecheck: passes, exit 0, with existing suggestions.
• Targeted formatting, lint, and git diff --check pass, exit 0.
• Direct claude --model claude-opus-5 --effort high --print --tools '' --no-session-persistence --output-format json frozen review attempt exited 1 because OAuth expired before a model ran. No Claude review occurred.

The old branch was backed up before restacking. The final contribution is three files rather than the obsolete 926-file comparison.

Scope and limits

Targets Orchestrator V2 in #2829, not main. No UI changes, installed-runtime changes, or live database access. The production SQL recovery query retains its existing pending/running outbox selection. The in-memory projection store has no persisted outbox and this change makes no outbox-parity claim; the previous review referred to a helper removed during this restack.

Implemented and verified with GPT-6 in the Codex harness.

Current-base verification

Updated to exact V2 base 415ed0f73b97f1655b6282492f81d0b2bba3a9cc at head 97d295f475fed70f7c72374327d0d85a6d7efed7. The original leaf plus this base synthesizes cleanly as tree 2108d433dadef16b2cf38432e2c40f96805eec07; current V2 base still admits nonterminal items from rolled-back runs, so the recovery fix is not superseded.

• 30/30 focused projection/recovery/control tests pass across four files.
• Server typecheck and targeted lint pass.
• Diff checks pass; the contribution remains the same three recovery files.

The production SQL query retains pending/running outbox recovery. The in-memory store still makes no persisted-outbox parity claim. No live database was accessed. Fresh independent Claude review remains unavailable because OAuth is signed out; no Claude review is claimed. Refreshed by GPT-6 in the Codex harness.

Note

Fix bounded recovery to exclude rolled-back runs in ProjectionStore

Runtime recovery no longer treats unfinished command, dynamic-tool, or subagent items as candidates when their projected run has a rolled-back status. Both the in-memory needsRecovery predicate and the SQL recovery-candidate query skip these items, while orphaned items with no matching run projection remain candidates. Tests cover rolled-back, orphaned, settled, and running threads across in-memory and SQL-backed stores.

• Risk: needsRecovery and the SQL query in ProjectionStore.ts now skip unfinished items whose run is rolled back; verify no callers depend on recovering rolled-back work.

^{Macroscope summarized 97d295f.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 95edbe02-5ef5-4aa8-bf6b-fc452c4cc56d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at c0c3d6e

Macroscope's review found this PR approvable — This is a localized recovery-selection bug fix that prevents abandoned work from being reprocessed after rollback while preserving recovery for orphaned work. Production changes are minimal and covered by focused in-memory and SQL-backed regression tests.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.