fix(commands): no tumbar la recuperación de cola por una carpeta de workspace inválida

[cursor]

Resumen ejecutivo

Qué cambia

Listar, reanudar o descartar la cola de recuperación ya no falla con 422 si outputs/ contiene una subcarpeta cuyo nombre no es un workspace válido. Esa carpeta se omite; el resto de leftovers se recuperan igual.

Para qué sirve

_list_workspaces incluye cualquier subdirectorio de outputs/ (no solo workspaces creados por la API). Una copia de seguridad como old copy o backup.old hacía que restore_recovery levantara 422 y bloqueaba vídeo, audio e imagen.

Impacto para el usuario

Tras un crash, la recuperación de cola vuelve a listar y reanudar el trabajo válido aunque exista una carpeta extra en outputs/.

Riesgo

• Bajo
• Medio
• Alto

Estado

• Listo para revisión

Summary

ImageGenerationCommands.restore_recovery iterates every name from _list_workspaces(). That helper lists every non-hidden subdirectory of outputs/, while _registry only accepts default or [A-Za-z0-9][A-Za-z0-9_-]*. A folder such as old copy, backup.old, or café raised HTTPException(422, invalid_workspace). GET /api/v1/jobs/recovery, POST .../resume and POST .../discard all call restore_recovery first, so one stray folder failed the entire recovery API — including unrelated video leftovers.

Concrete trigger after #275:

1. The user (or a backup/sync tool) creates outputs/old copy next to a real workspace.
2. An image or video generation crashes; leftovers remain in the durable queue.
3. Any later list/resume/discard returns 422 until that folder is renamed or removed by hand.

_restore_recovery now skips a 422 from _registry and continues with valid workspace names. Leftover rows whose own workspace field is invalid were already withheld by _recovery_task.

Overview

Crash leftovers stay in DurableGenerationQueue. Recovery endpoints restore interrupted admissions from each listed workspace, then filter the queue. Invalid listed folder names are no longer a hard failure of that restore pass. Valid interrupted image admissions still project into the queue; native video leftovers still pass through the filter.

Detailed changes

Backend

app/services/image_generation_commands.py: _restore_recovery catches HTTPException 422 from _registry and continues. Other errors, including storage 503, still abort the batch so discard cannot delete unverified records.

UI and Wizard

Unchanged.

Data, provenance and compatibility

No receipt or admission schema change. A leftover that belongs to a valid workspace is still recovered when a sibling outputs/ folder has an illegal name.

Files and ownership

• app/services/image_generation_commands.py — restore skip for invalid listed names
• tests/test_image_generation_commands.py — service-level invalid names + HTTP list/discard with mixed folders

Intentionally untouched: queue storage, admission writes, HTTP/MCP submit, UI Generate.

Validation

• Date (UTC): 2026-09-09

• Base SHA: 57c980c (feat/shared-generation-commands)

• Head SHA: c4fefc5

• Validation scope: focused

• python scripts/verify_clean_repo.py

• python -m compileall -q app/services/image_generation_commands.py → clean

• Focused Python tests: .venv/bin/python -m pytest tests/test_image_generation_commands.py tests/test_image_command_restart_boundaries.py tests/test_task_command_admission.py tests/test_studio_image_commands.py -q → 70 passed, 0 failed

• cd ui && npm run i18n:check

• UI tests: N/A (backend recovery only)

• cd ui && npm run lint -- --max-warnings=0

• cd ui && npm run build

• git diff --check (clean commit)

• E2E/smoke: N/A — no browser or GPU path; restore skip is covered by the focused suite

Code quality

• Score: pending CI
• Complexity trend: pending CI
• Production LOC trend: pending CI
• Regression versus main: pending CI
• Ratchet: pending CI

CI and review

• CI of this HEAD: pending

• Independent agent review of this HEAD: pending

• Human merge click (operational, not code review): pending

• Reviewed at current HEAD

• Earlier review; HEAD has changed since (stale)

• Pending

• Unavailable

Coste de la tarea

• Tests simulados: 0 tokens externos
• Tests reales: N/A
• Llamadas LLM externas: 0
• Tokens de prompt: N/A
• Tokens de respuesta: N/A
• Tokens totales: N/A
• Generaciones de imágenes/audio/vídeo: 0
• Tiempo transcurrido: N/A
• Proveedores/modelos: N/A

Notes and limitations

This stacks on #275. It does not change how an individual leftover with a bad workspace field is withheld (_recovery_task already returns False). Storage failures still 503 so discard cannot delete unverified records.

Follow-up work

#276 and #277 remain open on this feature branch and are out of scope here.

Checklist

• The executive summary is understandable without reading the code.
• The detailed Summary/Overview has not been removed or shortened.
• Tests and their actual results are recorded.
• Generated assets, secrets and local-only files are not committed.
• Required CI and Cursor/Bugbot review are complete, or the PR is clearly marked as waiting for them.

  

[IAnMove]

These ideas are already in #275 (65ed2852, refined locally). They cannot target development until that feature lands, so this stacked draft is closed instead of duplicating #275. Grouped development fixes are in #279.