feat: real recovery UI for generation failures

[rprabhat]

Summary

Item #4 from the consolidated fix plan - the highest-severity item, deliberately scoped as its own PR given its size relative to #1/#2/#3.

Root cause (accountant audit round three - David hit "Query failed - please try again" three times in a row on an identical retry, with the backend's own /health reporting healthy throughout): an unhandled exception inside the SSE generate() async generator in /query/stream just crashed it. FastAPI closed the connection with no event; the frontend's EventSource.onerror fired with zero information, and the dashboard showed a generic message - no distinction between "provider is briefly at capacity" (worth retrying) and a real bug, and no retry action beyond a one-line toast.

Backend (query.py): the astream loop is wrapped in try/except. On failure:

• The query row is marked failed (mirroring the existing embed-failure handling just above it).
• A typed {"type": "error", "transient": bool, "message": str} SSE event is emitted, followed by a normal [DONE] - so EventSource resolves cleanly instead of erroring.
• transient is classified via isinstance(e, openai.APIError) - litellm normalises every provider's rate-limit/timeout/connection/5xx failures onto openai's exception hierarchy, a real checkable signal instead of guessing from message text.

Frontend (query/page.tsx): a new generationError state renders an actual card (message + context-appropriate note + a "Try again" button that re-asks the same question), instead of collapsing into the generic error string other unrelated flows (save/edit/promote) share. The pre-existing outer catch (a dropped connection before any typed event arrives) now populates the same state, so the retry action is available for that failure mode too.

Verification

• Backend: 844 tests pass (2 new - a transient provider error emitting a retryable typed event with the query row marked failed and partial tokens preserved, and a non-provider exception emitting a non-transient event). Both exercise the real StreamingResponse.body_iterator at the ASGI level, not a mocked-away version of the new code.
• tsc --noEmit and eslint clean.
• Live UI verification not possible in this session: the local dev DB tunnel isn't reachable in this sandbox (same limitation hit earlier this session for other items), so a full authenticated end-to-end browser check couldn't be run. Confidence rests on the ASGI-level backend tests (which exercise real SSE byte output) and reviewed/type-checked frontend wiring - flagging this explicitly rather than claiming a live check that didn't happen.

Reviewer notes

• Worth a real click-through once deployed to confirm the retry card renders and the "Try again" button re-asks cleanly - the one piece this PR couldn't verify live.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
taxflow-dashboard	Ready	Preview	Aug 8, 2026 8:38am