fix(agents): recover status polling and scope failure diagnostics

[wesbillman]

On behalf of Wes, prepared by Brain.

Summary

• Continue the existing visible-page status polling after read/operation failures, without replaying writes or hiding errors during recovery.
• Put status/retry notices above agent cards. Successful status reads clear global warnings; native Start/Stop diagnostics remain per-agent, and failed Save/Create/Delete details remain in their originating dialog.
• Explain a missing Databricks workspace using the actual Advanced → Model → Databricks workspace (HTTPS origin) setting. Keep build-default instructions in docs, not end-user errors.

Scope

Targets main directly. The baseline profile query-count failure was independently fixed by #242 while this work was in progress; #282 is superseded and is not a dependency or part of this diff.

No supervisor/process cleanup changes, logging, local configuration, credentials, import changes, or automatic operation retries. This does not newly certify crash recovery or all imported agents. Existing native per-agent error ownership is reused; no new error store, lifecycle owner, or polling timer.

One separate six-line test-only commit fixes a gate failure in the model-picker authentication test: model lookup could finish before Base UI’s animation-frame popup opening, so Escape ran too soon. Wait for aria-expanded=true, then assert closure after Escape; existing retry/manual-entry assertions remain. No sleeps, retries, timeout changes, or product changes to the picker.

Validation

• Independent read-only review by Pinky: prior cross-agent leakage/duplicate-warning findings resolved; no startup blockers. Final review at 7d2f5b2 also found no blockers in the picker state barrier and confirmed unchanged startup delta/DCO. Optional message-priority/copy suggestions deferred. Hosted DCO passes; CI was still running at the delivery snapshot.
• Mounted regressions cover initial/persistent read failures, periodic recovery, hidden/unmount cleanup, failed Start recovery to running/failed without replay, unrelated editor isolation, and dialog-local failure retention.
• Focused Rust Databricks origin regression passed before the final stack rebase; that native delta is unchanged.
• Final required check-push at 7d2f5b2, based on f761867: TypeScript, 450/450 related tests (30 complete files), and design types/guards pass. Managed hooks were preserved; repo check groups ran explicitly because the installer refuses to replace them. Both outgoing Brain commits have matching DCO sign-offs.
• agent-control.spec.mjs and agent-editor-grid.spec.mjs: 32/32 browser cases pass across Chromium and WebKit, no retries, against isolated fixtures with no live identity. Run at 72e88200 immediately before dropping the unrelated profile-test barrier; verified the only tree difference to final head is ProfileAgentIdentity.test.tsx. This covers existing control/editor workflows, not native host/relay behavior. No browser cases were added or removed.

Remaining acceptance — draft only

• Hosted CI, including both browser engines and broad Rust suites, remains required. No claim of revised native-app acceptance or human confirmation.
• From the agreed worktree, launch bin/just desktop only when ready to switch builds; do not run the same identity in old Buzz and buzz-app simultaneously.
• With a disposable agent using the built-in Databricks harness and no effective workspace (including build defaults), Start once. Expect the specific workspace guidance on that agent; after status recovery, another agent’s editor must not inherit it.
• Set the correct workspace under Advanced → Model, save, and explicitly Start once. No write should replay automatically. Verify actual relay response separately; a running process is not proof of relay readiness.
• For an induced status failure in the isolated fixture, the warning and Retry appear above cards; after the host recovers, leaving the page visible recovers within the next five-second poll. A failed Save retains the draft and its error in its own dialog after recovery.
• Agent exercise of the revised app flow and then explicit human confirmation are still pending. No readiness marker or merge authorization.

[kalvinnchau]

🤖 No actionable findings at 7d2f5b2354c209001aa1dc495e471cdddc38d652 against f761867ed81f25604933620f9b4747a871a69c04. Polling recovery remains read-only; the reviewed error ownership, lifecycle and workspace-guidance changes have no supported defect.

Validation is not fully green: the full frontend run passed 3968 tests and failed four outside the changed paths (relay-broker 503, Vite subprocess timeout, relay-traffic timeout, profile-identity timeout). Their cause/baseline is unestablished, not proven unrelated. Changed frontend suites and typecheck passed; the full agent-controller crate passed 77 tests with one ignored.

Reconcile the frontend failures before merge. Native Tauri lifecycle, browser-engine acceptance and live workspace behavior were not exercised. This is a COMMENT, not approval.

[wesbillman]

Star Lord automated source review (via Wes’s account)

No actionable source-demonstrated defects found in this change. This is non-blocking COMMENT feedback, not approval or merge authorization.

• Head: 7d2f5b2354c209001aa1dc495e471cdddc38d652
• Base / merge base: f761867ed81f25604933620f9b4747a871a69c04

Checked

• The existing five-second observation timer now admits error-state reads, while the controller still coalesces reads, blocks them during writes, and fences stale reads with its generation. Recovery does not replay actions, and hidden/unmounted observers stop initiating periodic reads (control-react.ts:11–23, control.ts:230–272).
• Status/retry notices precede the cards. A successful snapshot clears the global warning; native Start/Stop diagnostics remain keyed by agent. Traced the missing-workspace failure through native start / record_error / snapshot to the affected card and editor, rather than introducing a second error owner.
• Failed Save now retains the sanitized operation message in its originating editor after status recovery. Create and Delete already retain their local failures; checked their callers and the new mounted assertions for error retention, unrelated-agent isolation, recovery, and no write replay.
• Databricks guidance names the existing Advanced → Model → Databricks workspace (HTTPS origin) control. Empty offline drafts remain saveable; invalid-origin diagnostics do not echo the input. The model-picker test change waits for actual popup opening/closure without loosening its retry/manual-entry assertions.

Validation limits

Source only: pinned Git-object extracts were byte/hash verified; no dirty checkout inputs were used; base→head git diff --check passed. No PR code, tests, builds, installs, or app workflows were executed, and CI was not assessed. The PR’s reported test results are not independently reproduced here. Native startup/recovery, real credential and relay behavior, rendered browser behavior, and human acceptance remain unverified. The PR description itself lists revised native-app exercise and human confirmation as pending; this review does not clear those acceptance gates.

[wesbillman]

On behalf of Wes, recorded by Brain.

Wes confirmed the requested local smoke test on 2026-09-25: “ok this seems to be working ok.” This follows the worktree launch/start/mention instructions for 7d2f5b2. The agent identity and individual failure scenarios were not specified, so this is normal-flow human confirmation—not a claim that every failure path or crash recovery was exercised.

CI run 36176389690 passed at that head: all Vitest, Rust/doctests and Node integration steps, both Chromium/WebKit journey shards, and browser measurements executed successfully. DCO also passes; Windows native validation was skipped by the automatic workflow. The PR is already approved and out of draft. No merge performed.