fix(server): settle child threads on provider death (ADA-149) (#205)

* fix(server): settle child threads on provider death

* fix(server): harden provider-death settlement

* fix(server): guard unarchived session projections

* docs: plan ADA-149 round 3 P2 fixes

* fix: guard stopped child settlement during replacement start

* plan ada149 session projection marker

* fix unarchived stopped projection marker

* fix session-derived terminal reconciliation

---------

Co-authored-by: wizzoapp[bot] <254688279+wizzoapp[bot]@users.noreply.github.com>

Author: wizzoapp[bot]

ADA-149-round3-p2.plan.md

@@ -0,0 +1,15 @@
+# ADA-149 Round 3 P2 Plan
+
+Intent: fix the two confirmed PR #205 P2 regressions in `ChildThreadCoordinator` without changing provider-death semantics outside terminal child settlement. Stopped session-set events must not destroy a pending replacement start, and projection-restored terminal children must surface provider death `lastError` text instead of generic turn/session wording.
+
+Blast radius: `apps/server/src/orchestration/Layers/ChildThreadCoordinator.ts` live session-set handling, replay session-set handling, projected lifecycle reconciliation, one-shot projection settlement, archive projection settlement, wait/wake result text, dispatch-lease release, `subagent_wait_deliveries`/promoted fallback behavior, restart replay from persisted orchestration events, and `apps/server/src/orchestration/Layers/ChildThreadCoordinator.test.ts`.
+
+Edge-case matrix and red-first tests:
+
+- Ordering both ways: stale stopped before replacement session-set must remain pending; stale stopped after replacement running is already covered. Red test: `does not settle stale stopped while replacement start is pending`.
+- Duplicates/replays: persisted stale stopped with replay pending maps must not settle if a replacement start is replayed later/earlier; add replay only if cheap, otherwise document live coverage and handler symmetry.
+- Crash-between-steps: projection-restored stopped/error after terminal projection must preserve `session.lastError` through wait/wake. Red test: `surfaces provider-death lastError from non-running projected lifecycle`.
+- Same-timestamp ties: keep existing timestamp ownership tests unchanged; the new pending-start guard is independent of timestamp ordering.
+- Version skew/concurrency: keep `error` session-set behavior unchanged and only skip ambiguous `stopped` settlement while pending starts exist.
+
+Smallest-change argument: add a stopped-only pending replacement-start guard at the two event-handler settlement points and upgrade terminal error text through local `lastError` preference helpers. A same-turn pending marker identifies replacement-start races while preserving existing initial placeholder recovery. Do not add new settlement machinery; later replacement running/failure and existing wait reconciliation remain responsible for eventual settlement.

ada149-session-projection-marker.plan.md

@@ -0,0 +1,18 @@
+# ADA-149 session projection marker plan
+
+Intent: Fix the accepted PR #205 review defect where a stopped/error provider session already reflected in the projection can be converted through an interrupted/error latest turn without `fromSessionProjection`. The fix keeps stale post-unarchive projection-only provider-death failures pending on boot instead of waking the parent from pre-unarchive state.
+
+Blast radius: `apps/server/src/orchestration/Layers/ChildThreadCoordinator.ts` projection lifecycle reconciliation, boot replay projection guards, one-shot register/wait reconciliation, live session/turn handlers, pending wake pruning, dispatch lease seeding, and `apps/server/src/orchestration/Layers/ChildThreadCoordinator.test.ts` restart/unarchive tests. Consumers that could break are parent wake injection persistence, foreground waits, detached child settlement, provider-death lease release, archived/unarchived child replay, and projection snapshot readers after restart.
+
+Edge-case matrix:
+
+- Ordering archived -> unarchived -> no new turn with stopped session + interrupted latest turn: red-first test `keeps inactive unarchived stopped interrupted projections pending on boot`.
+- Ordering archived -> unarchived -> no new turn with error session + error latest turn: red-first coverage in the same test table.
+- Live turn-derived interrupted/error settlement after registration: existing tests `settles error turn-diff as failed`, `settles session-set ready with a completed projected turn as completed`, and provider-death live tests must remain unmarked behaviorally.
+- Duplicate/replayed boot events: existing replay reconciliation tests around unarchive terminal pruning and provider-death replay must remain idempotent.
+- Crash between wake persistence and restart: existing pending dispatch restart/pruning tests must remain unchanged because marker only affects projection-only skipped settlement.
+- Same-timestamp ties: no timestamp ordering changes; existing post-unarchive wake retention tests remain the guard.
+- Version skew with older logs lacking terminal turn events: marker applies only to current projection-derived session failures, preserving old live/replay event outcomes.
+- Concurrency/replacement start: existing pending replacement-start tests must still prevent stale stopped sessions from settling.
+
+Smallest-change argument: leave `turnTerminalOutcome` live-turn semantics unchanged and add a narrow projected terminal-session wrapper/guard for projection lifecycle and one-shot wait/register reconciliation. This avoids marking live turn-diff/session-set results while giving boot unarchive guards the structural signal they already expect.