server: close Ticket lifecycle crash gaps

crates/worker-runtime/src/catalog.rs

@@ -202,6 +202,10 @@ impl std::fmt::Debug for WorkspaceApiRef {
 /// summarized without exposing raw host paths.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct CreateWorkerRequest {
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub idempotency_key: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub idempotency_fingerprint: Option<String>,
     pub profile: ProfileSelector,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub display_name: Option<String>,

crates/worker-runtime/src/http_server.rs

@@ -1412,6 +1412,8 @@ mod tests {
         let profile = ProfileSelector::Builtin("builtin:coder".to_string());
         let bundle = test_bundle(profile.clone());
         CreateWorkerRequest {
+            idempotency_key: None,
+            idempotency_fingerprint: None,
             profile,
             display_name: None,
             profile_source: crate::catalog::ProfileSourceArchiveSource::Http {
@@ -1812,6 +1814,8 @@ mod ws_tests {
     fn ws_create_request() -> CreateWorkerRequest {
         let bundle = ws_test_bundle(ProfileSelector::Builtin("builtin:companion".to_string()));
         CreateWorkerRequest {
+            idempotency_key: None,
+            idempotency_fingerprint: None,
             profile: ProfileSelector::Builtin("builtin:companion".to_string()),
             display_name: None,
             profile_source: crate::catalog::ProfileSourceArchiveSource::Http {

crates/worker-runtime/src/runtime.rs

@@ -354,6 +354,11 @@ impl Runtime {
         request: CreateWorkerRequest,
         scope: Option<&RuntimeWorkspaceScope>,
     ) -> Result<WorkerDetail, RuntimeError> {
+        if request.idempotency_key.is_some() != request.idempotency_fingerprint.is_some() {
+            return Err(RuntimeError::InvalidRequest(
+                "idempotency_key and idempotency_fingerprint must be provided together".to_string(),
+            ));
+        }
         let (backend, worker_ref, spawn_request) = {
             let mut state = self.lock()?;
             state.ensure_running()?;
@@ -375,6 +380,20 @@ impl Runtime {
                     )));
                 }
             }
+            if let Some(idempotency_key) = request.idempotency_key.as_deref() {
+                let workspace_id = scope.map(|scope| scope.workspace_id.as_str());
+                if let Some(existing) = state.workers.values().find(|record| {
+                    record.workspace_id.as_deref() == workspace_id
+                        && record.request.idempotency_key.as_deref() == Some(idempotency_key)
+                }) {
+                    if existing.request.idempotency_fingerprint != request.idempotency_fingerprint {
+                        return Err(RuntimeError::InvalidRequest(format!(
+                            "worker creation idempotency key {idempotency_key} was already used with different input"
+                        )));
+                    }
+                    return Ok(existing.detail());
+                }
+            }
             let backend = state.execution_backend.clone().ok_or_else(|| {
                 RuntimeError::ExecutionBackendUnavailable {
                     message: "worker creation requires an execution backend".to_string(),
@@ -2126,6 +2145,8 @@ mod tests {
         let profile = ProfileSelector::Builtin("builtin:coder".to_string());
         let bundle = test_bundle_for_profile(profile.clone());
         CreateWorkerRequest {
+            idempotency_key: None,
+            idempotency_fingerprint: None,
             profile,
             display_name: None,
             profile_source: crate::catalog::ProfileSourceArchiveSource::Http {
@@ -2614,6 +2635,24 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn create_worker_idempotency_reuses_worker_and_rejects_different_input() {
+        let runtime = runtime_with_backend();
+        let mut request = task_request("idempotent");
+        request.idempotency_key = Some("operation-1".to_string());
+        request.idempotency_fingerprint = Some("sha256:input-1".to_string());
+
+        let first = runtime.create_worker(request.clone()).unwrap();
+        let replayed = runtime.create_worker(request.clone()).unwrap();
+        assert_eq!(replayed.worker_ref, first.worker_ref);
+        assert_eq!(runtime.list_workers().unwrap().len(), 1);
+
+        request.idempotency_fingerprint = Some("sha256:different".to_string());
+        let error = runtime.create_worker(request).unwrap_err();
+        assert!(matches!(error, RuntimeError::InvalidRequest(_)));
+        assert_eq!(runtime.list_workers().unwrap().len(), 1);
+    }
+
     #[test]
     fn create_worker_rejects_system_initial_input_without_persisting_worker() {
         let runtime = runtime_with_backend();

crates/worker-runtime/src/worker_backend.rs

@@ -1451,6 +1451,8 @@ mod tests {
     fn create_request(_name: &str) -> CreateWorkerRequest {
         let bundle = test_bundle();
         CreateWorkerRequest {
+            idempotency_key: None,
+            idempotency_fingerprint: None,
             profile: ProfileSelector::Builtin("builtin:companion".to_string()),
             display_name: None,
             profile_source: crate::catalog::ProfileSourceArchiveSource::Embedded {