feat(core): Workspace boot janitor — persisted bound workspaces are never idle-suspended or snapshotted after a restart #1622

Problem

The Workspace service's idle janitor only ever sees workspaces that the current process has connected to. After a restart, persisted workspace rows with live bindings are invisible to it — nothing at boot reconciles them — so their backing resources are never idle-suspended (and the promised ~23h safety snapshot rotation does not exist at all) until someone happens to provision/connect that exact workspace ID again.

The code itself promises this in a later PR that has not landed:

packages/core/src/workspace.ts:358-359 (at main a6bc4dca06faa872d83f1b65b00c4f7cd6dbd6a5):

// TODO(workspace-plan): add the boot janitor and ~23h safety snapshot rotation in a later PR.
// TODO(workspace-plan): make cold wake interruptible with a re-pin loop against janitor races.

Evidence (verified this run, pinned reads at a6bc4dca)

• The janitor loop (workspace.ts:190-222, repeated on Schedule.spaced(pollInterval ?? 1 minute) at :222) iterates only [...connections.entries()] (:194) — the in-memory connections map, which is empty at process start and only gains entries via open() on provision/connect.
• Every WorkspaceTable access in the tree is by-ID (find :96, saveBinding :105, updates :184/:211, create select :228-230, insert :244-247, delete :347); there is no scan of persisted rows anywhere, and no boot-time reconciliation pass in the layer.
• grep -rn "janitor" packages/ --include="*.ts" returns only the two TODO lines; grep -rn "snapshot" packages/core/src/workspace/ packages/core/src/environment/ returns nothing — the safety snapshot rotation is entirely unimplemented, not just unscheduled.
• packages/core/test/workspace.test.ts (33 tests) pins the in-process lifecycle — including "persists the workspace lifecycle and reconnects after idle suspension" (:330) with a fake driver recording suspendForIdle — but has no boot/restart scenario: no test builds the layer over pre-existing persisted rows (grep for boot/restart/reconcile in the test file: no matches).

Why it matters

Workspaces back real (potentially billed / resource-holding) driver resources. A server restart — deploy, crash, upgrade — silently orphans every persisted, bound workspace that nobody reconnects to: it is never suspended for idleness, never snapshotted, and its row's last_used_at goes stale with no process responsible for it. The longer the deployment runs between restarts, the more this looks like a slow resource leak that only manual destroy calls can clean up. The TODO's second line compounds it: cold wake is not interruptible against janitor races, so a boot janitor added naively could race wakes — the two TODOs need to be designed together.

Acceptance criteria

• On layer startup (boot), the Workspace service scans persisted WorkspaceTable rows and reconciles them: rows with a binding whose last_used_at is beyond the idle threshold are driven through the same suspendForIdle path the poll loop uses (respecting the per-workspace lock and the deliberate racing-spawn semantics documented at workspace.ts:206); rows with no binding are left untouched.
• Boot reconciliation is safe against a concurrent provision/connect of the same workspace (no double-suspend, no suspend of an active connection) — the cold-wake re-pin concern in the :359 TODO is addressed or explicitly documented as out of scope with reasoning.
• The ~23h safety snapshot rotation from the :358 TODO is either implemented (driver capability + rotation cadence + retention) or split into its own follow-up issue with the TODO updated to point at it — the TODO must not silently survive another "later PR".
• New tests in packages/core/test/workspace.test.ts style (fake driver, persisted rows seeded before layer construction): (a) a stale bound row is suspended at boot without any connect; (b) a fresh bound row is left alone; (c) a boot scan racing a connect does not suspend the active workspace.
• Existing workspace tests still pass.

Dedup / related

• gh search issues for "janitor", "boot janitor", "safety snapshot", "workspace-plan": no matches in any state. "workspace idle suspend" returns only fix(console): docs, share and enterprise proxy routes fetch upstream with no timeout — a stalled upstream hangs the console request forever #1110 (server fs endpoints auth, unrelated) and Migrate the fleet to OpenCode 2 #374 (local-first epic — possible parent, but it names no janitor work; link as related if the epic owner wants it attached natively).
• Filed by new-issue-creator-opencode, 2026-11-04 run; verification in a detached laptop probe worktree at dc3613c185 plus pinned gh api reads at a6bc4dca (the compare dc3613c185...a6bc4dca touches only session/runner/step.ts + its test, so the workspace evidence is unchanged at current main).