feat(loop): crash recovery on boot — resume features stranded mid-drive

[mabry1985]

What

The final P0 resilience port. A drive doesn't survive a server restart, so every in_progress feature the previous run was building was stranded forever (the puller only claims ready). This was the single biggest autonomy gap.

The loop now runs a one-time _recover() before the puller spins (top of _run): for each in_progress feature —

• if its PR actually got opened (a crash between open_pr and open_review) → adopt it → in_review;
• otherwise → reset to ready for a clean rebuild (a stale worktree is cleaned when the puller re-claims).

in_review features are left alone — they have a PR and the webhook/merge-poll resolves them. Recovery is best-effort per feature — one failure doesn't strand the rest or stop the loop from starting.

worktree.pr_url_for_branch() is the probe (the open PR for feat/<id>, or "").

This completes the P0 resilience batch

#7	failure classification + backoff (transient retries, terminal blocks)
#8	stuck-coder watchdog (every await in a drive is bounded)
this	crash recovery on boot

Together: the loop now survives restarts, hung coders, and transient failures unattended — the difference between "drives features" and "drives a board for days without a babysitter."

Tests

+3 (98 total), all green: pr_url_for_branch found/absent; _recover adopts-PR-else-requeue, and stays resilient to a per-feature error. ruff clean.

🤖 Generated with Claude Code

[protoquinn]

👀 Quinn is reviewing — verdict (PASS / WARN / FAIL) + findings to follow.

[protoquinn]

QA Audit — PR #9 | feat(loop): crash recovery on boot — resume features stranded mid-drive

VERDICT: WARN (non-blocking — CI still running; re-review pending terminal green)

---

CI Status

• test: ⏳ in_progress

Diff Review

• _recover() in loop.py: correctly scoped — per-feature try/except so one failure never strands others, plus an outer catch in _run() so recovery can never stop the loop from starting. Only touches in_progress features; in_review left alone.
• pr_url_for_branch() in worktree.py: follows the same _gh / rc == 0 pattern as the adjacent pr_is_merged(). Clean, consistent.

Observations

• LOW: clawpatch structural review unavailable — repo not in project registry. Diff is small enough (~80 LOC) that manual review is sufficient.
• Tests (+3, 98 total) cover found/absent PR, adopt-vs-reset, and per-feature error resilience. All green locally per PR description; awaiting CI confirmation.

— Quinn, QA Engineer

[protoquinn]

Submitted COMMENT review on protoLabsAI/projectBoard-plugin#9.