Recover initial, terminal, and commit-uncertain subagent failures safely

[danielkov]

Summary

Initial subagent() failures and terminal or commit-uncertain follow-up prompt() failures still need explicit, safe recovery. Recovery must distinguish a known reusable live child from an unusable session or unknown remote/durable completion state.

Already implemented

The original report said every unsuccessful dispatched follow-up removed its logical subagent. That is no longer universally true. #56 (ceb727e; shipped in v0.1.114) added regression coverage in src/tools/subagent/tests.rs: reusable_prompt_failure_remains_failed_idle_and_can_be_retried. A nonterminal refusal from a still-live child leaves the roster Idle with a Failed outcome; the prior successful handle can be explicitly prompted again, and the next success advances generation correctly. This does not establish that arbitrary transport failures or repeated effectful prompts are safe to retry.

Remaining acceptance criteria

• Cover both initial subagent() failures (which may return no successful handle) and follow-up prompt() failures.
• Use the provider-independent possible-effects metadata from Report possible effects when a model turn fails after output or tool activity #48 to distinguish confirmed pre-output/pre-tool failures from assistant output, emitted tool calls, started/completed tool execution, and unknown/unconfirmed state. Absence of evidence is not proof of no effects.
• Define an explicit recovery path for terminal/lost-child failures when safe recovery is established; reconcile durable/remote completion and handle generations, or restart from a known completed snapshot. Never blindly replay a possibly effectful turn. Unknown effects or commit status must yield an actionable conservative failure rather than silently recovering.
• Preserve existing live-child nonterminal follow-up reuse; distinguish it from terminal failure, cancellation, and transport loss. Reject stale handles and prevent concurrent generation corruption.
• Test initial failure, terminal follow-up failure, uncertain transport/completion, safe pre-effect recovery, failures after output/tool activity, cancellation, and generation/handle invariants. Ensure diagnostics expose no private prompts, tool arguments/results, or provider payloads.

Dependency and historical context

Depends on #48 for conservative possible-effects evidence; #48 owns diagnostic facts, this issue owns recovery/reusable-session policy. The #35 follow-up explicitly expanded scope to both initial and follow-up failures: #21 (comment).

The original retirement rule avoided continuing from a potentially changed transcript after dispatch. Preserve that safety goal while improving recovery. Relevant implementation: src/tools/subagent.rs (Subagents::prompt, initial creation, and terminal classification). The historical resolved trigger remains documented in the subagent keepalive note.

[danielkov]

#35 identified that failed initial and follow-up subagent turns need typed transient/commit-uncertainty handling before a handle can be reused safely. #48 now tracks the provider-independent possible-effects metadata required for that decision. Please include both initial subagent() failures and follow-up prompt() failures in this issue's recovery scope.