[midhatn]

Built on #38. Validated development integration, 9 November 2026; the existing v0.4.0a1 release assets retain their original scope.

What this adds

• DesktopComposition automatically recovers a pending compiler/video operation after worker loss. On a non-zero worker exit with one pending effect whose exact terminal result the live tool host still holds, it:
  1. joins the worker;
  2. exports and saves CompilerHost.terminal_receipt;
  3. retires the old binding and runs the ordinary run_recovery reconcile command (no provider call);
  4. requires a clean ready checkpoint;
  5. launches one replacement worker through a narrow recovered-state lifecycle entry.
• The replacement keeps the task, native session, original deadline, counters, reopen_context and the durable execution budget.
• Recovery is refused after a clean or Stop-requested exit, on a closing or faulted host, near the deadline, at the attempt limit, or for a repeat recovery of the same worker and operation.
• Only three runtime modules change: composition.py, desktop_controls.py and task_handover.py. Source lineage is in provenance/automatic-tool-recovery/source-lineage.json.

Validation (local Windows, Python 3.11.9)

• Core suite: the first full run had 2 errors in 1,595 tests. Two existing launch tests used a bare object() as the tool host, which has no lifecycle(). I fixed the test doubles (tests only, runtime unchanged) and kept the failed run. The rerun passed 1,595/1,595.
• Workflow: all 16 remaining workflow commands passed, including 90/90 provenance tests. I reran them on the final tree with docs included, and they passed again.
• Package: 1,421 source files and 77 wheel modules verified. The wheel members are byte-identical to the build used in the installed trials.
• Installed SDK trial (scripted provider): worker exit 86 → automatic reconcile → worker-2 completed the same task. Independent closed review: 21/21 checks, 48 case files unchanged.
• Physical IQ3_S trial, with quality settings unchanged:
  • Explorer F5 during request 1 parked inference.
  • The host ran the NVENC clip.
  • Worker exit 86 → automatic recovery → a second native owner served request 2, which used the recovered video feedback.
  • The task was accepted and stopped normally.
  • Independent closed audit: 49/49 checks, all original files unchanged.
  • Two earlier failed attempts and the separate observer shutdown failure are kept and disclosed.
• Publication review: 52/52 checks (hashes, links, sanitization, runtime identity).

Evidence: provenance/automatic-tool-recovery/{local-validation,installed-worker-loss,physical-foreground-recovery}-2026-11-08.json. Docs: HANDOFF.md, PLAN.md, docs/evidence.md, docs/video-tool-recipe.md.

Hosted validation

The original attempt-1 push workflow and PR workflow passed at 08053a00d92c065b88bda3ce14f80a7cfe078f0f: all 14 jobs, 12 core-test steps and 12 distribution checks. The final condition-polling test correction does not alter the installed, physically tested runtime.

Remaining qualification

Not qualified: interruption during an active tool, host loss, repeated reliability, application restart and reboot.