restart before recreate

An agent lifecycle has a boring default: if a worker is broken, destroy it and build a new one. It is easy, it is total, and it throws away the only expensive thing in the system, which is the worker's accumulated context.

The rule adopted instead was restart before recreate. A worker that is still running gets relaunched in place, keeping its session and its history. A worker that has already exited falls back to a fresh start, because there is nothing left worth preserving.

The interesting part is what happens when the control path cannot honour the request. The supervisor exposes a small set of audited lifecycle verbs. If the running supervisor does not have them, the command refuses, closed, and says so. It does not quietly degrade into a fresh start, because "restarted" and "recreated" look identical in a log line and completely different to the person who just lost a day of work.

The cost is the usual one for failing closed: an unfamiliar deployment gets blocked instead of limping, and blocking is occasionally inconvenient. The compensation is that two lifecycle meanings stay distinguishable under pressure, when it matters most.

What this proves: destructive fallbacks were treated as a design decision rather than a convenience, and the system prefers to stop and explain itself.