fix(desktop): forget a Host-removed Session registration on reconnect restore

[me2seeks]

Problem

Fixes #4758.

When the desktop main process reconnects to the Runtime Host after an IPC drop, desktop-manager hands the surviving observation registry (target.observations) to each replacement candidate, whose attach() replays every registration through subscription.open. If a previously observed Session no longer exists on the Host (Host restart with ephemeral state, Session GC, deletion by another client), the server deterministically answers subscription.open / not_found ("Session was not found").

The registry's attach() failure cleanup only deleted pending registrations, so a stale active registration stayed in the map forever. The candidate then computed failedSessionIds = observedSessionIds − restoredSessionIds from the pre-attach snapshot, threw Failed to restore Session observations: <id>, and aborted the candidate start. Because the reconnect lifecycle only stops on RuntimeHostPermanentReconnectError, this plain error just fed the backoff loop — every new candidate failed on the same stale registration, and renderer IPC surfaced RuntimeHostHandlerUnavailableError the whole time.

Fix

• runtime-host-session-observation-registry.ts: recognize RuntimeHostOperationError with operation === "subscription.open" and code === "not_found" as "the Host no longer serves this Session" (isMissingRuntimeHostSessionError). In attach()'s catch path, forget the registration regardless of lifecycle and report it through a new optional onSessionMissing callback. All other failures keep the existing behavior (pending-only cleanup + error reporting), so genuinely transient restore failures still fail the candidate and get retried — see the existing retries candidate startup when a restored observation cannot seed test, which still passes unchanged.
• runtime-host-desktop-candidate.ts: pass onSessionMissing to emit a deleted sessions-changed event (the renderer already handles deleted safely by refreshing the catalog and retiring the Session view), and compute failedSessionIds from the registrations that survive attach so forgotten Sessions no longer fail the candidate start.

This mirrors the deliberate asymmetry in isRecoverableSubscriptionFailure: session.transcript.page / not_found is transient and retryable, while subscription.open / not_found at attach time is terminal.

Tests

• New regression test forgets an observed Session the Host no longer serves instead of blocking every reconnect: the second candidate's Host answers subscription.open/not_found for the previously observed Session; the candidate starts (no throw), the registry forgets the stale entry, a deleted change is emitted, and a later candidate can observe new Sessions on the same registry. The test fails without the fix.
• npm run build:main clean; the 6 runtime-host desktop suites pass 132/132. (Full main-process suite: 2085/2090; the 5 failures are pre-existing browser-message-box environment failures on a display-less Linux box, reproduced on pristine origin/main.)

Real-environment follow-up (not done here): restart a Host / expire a Session with the desktop running and confirm the Failed to restore Session observations loop no longer appears.

[jackwener]

Approved. I found no blocking issues.

I verified the production reconnect path: a surviving observation is replayed through subscription.open, and a Host not_found response previously left the active registration behind so every replacement candidate failed again. This patch narrows the terminal case to that exact operation and error code, removes the stale registration, emits the existing deleted session change, and computes restore failures only from registrations that still exist. Other restore failures remain retryable.

The new regression fails when the missing-Session classification is removed and passes with the fix. The affected Desktop suites pass 147/147. I also built the current-main synthetic merge and reran the candidate suite there (22/22); the merge is clean.

---

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.