Module coordinator 

Recovery coordinator (RFC-029 §3.4) — drives the OTP-style recovery policy on top of the Unix lifecycle.

Wraps AgentLifecycleManager::execute_directive in an escalation ladder. On a provider/infra failure (signalled by ExecutionResult.failure_class), it retries with backoff (L1) and/or swaps to a fallback model (L2), recording each fallback for observability. Bounded by an AttemptBudget.

Current scope (P2)

• L1 same-model backoff retry (Transient/Unknown).
• L2 model/provider swap via ExecEnv.model_override (reads engine.fallback_models). Records FallbackEvent.
• L5 terminal — returns the best result with failure_class set.

Deferred (P2b / P3 / P4)

• Snapshot+restore state preservation (P2b): L2 currently re-runs from scratch (a fresh fork). This loses mid-execution conversation state. The unified snapshot→restore-with-new-model operation (RFC §3.2) will be wired once the Agent::export_state capture-on-failure path lands. For now, the side-effect duplication risk is mitigated by: (1) provider failures predominantly occur at connection/first- call level where no tools ran, and (2) the AttemptBudget bounds total attempts.
• Per-provider circuit breaker (P3): ProviderHealthRegistry.
• A2A delegation (P4): agent-specific failures only.

Structs

RecoveryCoordinator

The recovery coordinator. Holds the shared routing stats (for FallbackEvent recording) and the live fallback-model list. The lifecycle is passed per-call (the orchestrator owns it).

ResilienceConfig

Resilience configuration (RFC-029 §4). Mirrors a subset of [intent.resilience] from config.toml.