fix(workspaces): retry Durable Object resets when a document session opens

[posthog]

Problem

• An MCP agent that reads a document can get a failed workspace_read_items call from one transient Cloudflare fault. The whole read fails, including the other items in the batch.
• The fault is "Internal error in Durable Object storage caused object to be reset", thrown from partyserver getServerByName when the document session opens.
• partyserver retries only errors with retryable === true. This reset does not set that flag, so no retry occurs.
• observeWorkspaceOperation then captures the platform fault as an exception, which opens an error tracking issue.

Origin

• Error tracking: issue
• First signal: 2026-10-15
• Inbox report: open
• Likely cause: 9dd7b60
• Task started by: auto-start, after the report was rated P3 and ready to fix

Changes

• Bounded app-level retry when a document session opens. getDocumentSessionFromEnv makes a maximum of 3 attempts, with a 100 ms / 200 ms backoff. It sets routingRetry: false, so only one retry policy applies.
• Wider transient check (isTransientDurableObjectError): retryable, durableObjectReset, or a "caused object to be reset" message. Overloaded errors never retry.
• Recovery count: each retried open logs document_session_open_retry with attempts and recovered.
• Classification: a transient reset that outlasts the retries becomes a rejected workspace_operation outcome with the error fields. It is not an exception capture. Other errors are captured as before.

Path	Before	After
Reset on session open, then success	Read call fails, exception captured	Read succeeds, document_session_open_retry (recovered: true)
Reset on all 3 attempts	Read call fails, exception captured	Read call fails, rejected outcome, no exception
Other error	Exception captured	Same

Note

The retry applies to all callers of getDocumentSessionFromEnv: read, edit, edit review, and PDF export. A session open is idempotent: it only awaits onStart(), so a retry is safe.

Testing

• vp check passes: format, lint, types.
• tsc --noEmit passes.
• Node tests for src/features/workspaces pass, including new tests for retry, attempt limit, no retry for overloaded or other errors, and the rejected classification.
• Workers tests for mcp-operation-catalog and document-session-revocation pass.
• Not run: the full pnpm verify build. I did not reproduce a real storage reset, because Cloudflare cannot inject one locally.

Agent context

• PR #626 targets the removed WorkspaceKernel module, so it does not cover this path.
• I did not use partyserver's routingRetry option alone. Its predicate checks only retryable, and this reset does not set that flag.
• Not done: failing only the affected document in the read loop. That needs a new failure code in the read contract. With the retry, the whole-call failure should be rare.

Closes #859
Refs #784

---

Created with PostHog Desktop from this inbox report.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 935fbecd-9928-4e1d-9568-8d7e9bdf9bc0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 824a299.}