test(restart-chaos): grade a stopped retain-on-failure restore source as retained

A failed run's sandbox kept stopped for file recovery is owned by restore recovery
and destroyed with its environment; it is retained, not an orphan. A running one, or
one left with no lease, still counts as a leak.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/restart-chaos/daytona-sweep.test.ts

@@ -126,6 +126,17 @@ describe("Daytona R6 reconciliation", () => {
     expect(result.orphanSandboxes.map(leak => leak.sandboxId)).toEqual(["r2", "e1"]);
   });
 
+  it("keeps a stopped restore source (retain_on_failure) as retained, but not a running one or one with no lease", () => {
+    const result = reconcileSandboxes(
+      [{ id: "s1", state: "stopped" }, { id: "s2", state: "started" }, { id: "s3", state: "stopped" }],
+      [{ id: "f1", status: "released", leasePolicy: "retain_on_failure", providerLeaseId: "s1" },
+        { id: "f2", status: "released", leasePolicy: "retain_on_failure", providerLeaseId: "s2" }],
+    );
+    expect(result.retainedLeases.map(lease => lease.leaseId)).toEqual(["f1"]);
+    // Running, or left behind by a deleted environment (no lease): still leaks.
+    expect(result.orphanSandboxes.map(leak => leak.sandboxId)).toEqual(["s2", "s3"]);
+  });
+
   it("judges a reused sandbox by its current lease row, whatever the listing order", () => {
     const rows = [{ id: "old", status: "expired", leasePolicy: "reuse_by_environment", providerLeaseId: "r1" },
       { id: "new", status: "released", leasePolicy: "reuse_by_environment", providerLeaseId: "r1" }];

tests/restart-chaos/daytona-sweep.ts

@@ -43,16 +43,24 @@ export interface DaytonaSweepResult {
   orphanSandboxes: SandboxLeak[];
   /** Leases still `active` or `pending_cleanup` with every task at rest. */
   heldLeases: LeaseLeak[];
-  /** Leases kept on purpose (`retained`, or a released reusable lease whose sandbox is stopped for reuse), reported but not a leak. */
+  /** Leases kept on purpose (`retained`, a released reusable lease whose sandbox is stopped for reuse, or a released retain-on-failure restore source whose sandbox is stopped), reported but not a leak. */
   retainedLeases: LeaseLeak[];
   /** Archived sandboxes behind a released lease: expected and reported; Daytona deletes them. */
   archivedSandboxes: string[];
   error: string | null;
 }
 
-/** A stopped sandbox behind a released reuse_by_environment lease: a later run on the same workspace resumes it. */
+/**
+ * A stopped sandbox Paperclip keeps on purpose behind a released lease:
+ * - `reuse_by_environment`: a later run on the same workspace resumes it;
+ * - `retain_on_failure`: a failed run's workspace copy kept for file recovery
+ *   (restore recovery owns it; environment deletion destroys it).
+ * Only a stopped one counts: a running sandbox, or one with no lease (for
+ * example after its environment was deleted), is still a leak.
+ */
 function keptForReuse(lease: LeaseRow, sandbox: DaytonaSandboxRow): boolean {
-  return lease.status === "released" && lease.leasePolicy === "reuse_by_environment"
+  return lease.status === "released"
+    && (lease.leasePolicy === "reuse_by_environment" || lease.leasePolicy === "retain_on_failure")
     && String(sandbox.state ?? "").toLowerCase() === "stopped";
 }