@awak-app/simy-cli 0.6.10 → 0.6.12

package/src/connection-discovery.js

@@ -3,6 +3,8 @@ import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 
+import { assertConnectionScope, connectionDiagnostic } from "./connection-diagnostics.js";
+
 import { normalizeWebOrigin } from "./web-origin.js";
 
 export function connectionDiscoveryPath(webOrigin, sessionRoot) {
@@ -47,3 +49,162 @@ export async function removeConnectionDiscovery(discovery) {
     if (error?.code !== "ENOENT" && !(error instanceof SyntaxError)) throw error;
   }
 }
+
+// A private discovery file identifies a candidate; the live instance must prove
+// it owns that record before an entry point can reuse it. Never send a token.
+export async function findReusableConnection({
+  webOrigin,
+  sessionRoot,
+  cliVersion,
+  apiContractVersion,
+  expectedScope,
+  requestedPort = 0,
+  authorize = false,
+  reauthorize = false,
+  fetchImpl = fetch,
+  alive = (pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+}) {
+  const origin = normalizeWebOrigin(webOrigin);
+  let record;
+  try {
+    record = JSON.parse(
+      await readFile(connectionDiscoveryPath(origin, sessionRoot), "utf8"),
+    );
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw connectionError("connection_service_mismatch");
+  }
+  if (
+    record?.schema_version !== 1 ||
+    record.web_origin !== origin ||
+    !Number.isInteger(record.port) ||
+    record.port < 1 ||
+    record.port > 65535 ||
+    !Number.isInteger(record.pid) ||
+    record.pid <= 0 ||
+    typeof record.instance_id !== "string" ||
+    !record.instance_id
+  ) {
+    throw connectionError("connection_service_mismatch");
+  }
+  if (!alive(record.pid)) return null;
+  let response, health;
+  try {
+    response = await fetchImpl(
+      `http://127.0.0.1:${record.port}/v1/connection`,
+      {
+        signal: AbortSignal.timeout(1500),
+        redirect: "error",
+        cache: "no-store",
+      },
+    );
+    health = response.ok ? await response.json() : null;
+  } catch {
+    throw connectionError("connection_service_unavailable");
+  }
+  if (response.status === 404)
+    throw connectionError("connection_service_incompatible");
+  if (
+    !health?.ok ||
+    health.instance_id !== record.instance_id ||
+    health.pid !== record.pid ||
+    health.web_origin !== origin
+  ) {
+    throw connectionError("connection_service_mismatch");
+  }
+  if (health.daemon !== true)
+    throw connectionError("connection_service_not_background");
+  if (requestedPort && requestedPort !== record.port)
+    throw connectionError("connection_port_mismatch");
+  if (
+    !compatibleServiceVersion(health.cli_version, cliVersion) ||
+    health.api_contract_version !== apiContractVersion
+  )
+    throw connectionError("connection_service_incompatible");
+  assertConnectionScope(expectedScope, health.scope);
+  if (authorize && (reauthorize || !health.session_valid)) {
+    try {
+      response = await fetchImpl(
+        `http://127.0.0.1:${record.port}/v1/connection`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            instance_id: record.instance_id,
+            scope: health.scope,
+            reauthorize,
+          }),
+          signal: AbortSignal.timeout(1500),
+          redirect: "error",
+          cache: "no-store",
+        },
+      );
+      health = await response.json().catch(() => null);
+    } catch {
+      throw connectionError("connection_service_unavailable");
+    }
+    if (!response.ok && health?.code === "connection_scope_changed" &&
+        ["web_origin", "account_id", "organization_id", "device_id"].includes(health.field)) {
+      const diagnostic = connectionDiagnostic(health.code, health.field);
+      throw Object.assign(new Error(diagnostic.error), diagnostic);
+    }
+    if (!response.ok) throw connectionError("connection_service_mismatch");
+    if (
+      !health?.ok ||
+      health.instance_id !== record.instance_id ||
+      health.pid !== record.pid ||
+      health.web_origin !== origin
+    ) {
+      throw connectionError("connection_service_mismatch");
+    }
+    assertConnectionScope(expectedScope, health.scope);
+  }
+  if (health.login_url !== null) {
+    let url;
+    try {
+      url = new URL(health.login_url);
+    } catch {
+      throw connectionError("connection_service_mismatch");
+    }
+    if (
+      url.origin !== origin ||
+      url.pathname !== "/local-cli/connect" ||
+      url.searchParams.get("port") !== String(record.port)
+    ) {
+      throw connectionError("connection_service_mismatch");
+    }
+  }
+  return {
+    port: record.port,
+    webOrigin: origin,
+    loginUrl: health.login_url,
+    sessionValid: health.session_valid === true,
+  };
+}
+
+function connectionError(code) {
+  const diagnostic = connectionDiagnostic(code);
+  return Object.assign(new Error(diagnostic.error), diagnostic);
+}
+
+function compatibleServiceVersion(running, requested) {
+  const version = (value) =>
+    typeof value === "string"
+      ? /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.exec(value)
+      : null;
+  const existing = version(running),
+    target = version(requested);
+  return Boolean(
+    existing &&
+    target &&
+    existing[1] === target[1] &&
+    (existing[1] !== "0" || existing[2] === target[2]),
+  );
+}

package/src/delivery-hooks/command.js

@@ -23,12 +23,12 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
     output('simy delivery activity [--watch] [--json] [--provider codex|claude] [--session ID] — local observations every 60 seconds; not productive time.');
     output('A task stops after repeated failures, and pauses for review when no progress is confirmed. Resume starts a new progress window.');
     output('simy delivery continuation_policy --provider PROVIDER --session ID --task-id ID --continuation-policy bounded|progress');
-    output('simy delivery continue --provider codex|claude --session ID [--max-no-progress-minutes 30] [--max-failures 3]\nsimy delivery dependency_ready --provider PROVIDER --session ID --task-id ID --wait-id ID --answer TEXT\nsimy delivery handoff|handoff_cancel --provider codex --session ID --task-id ID --target-session ID');
-    output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--max-failures 3]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Manual managed start requires an acceptance specification. Desktop Continue infers the original conversation goal first. Resume preserves original task identity, history and approvals.');
+    output('simy delivery continue --provider codex|claude --session ID [--execution-cwd PATH] [--max-no-progress-minutes 30] [--max-failures 3]\nsimy delivery dependency_ready --provider PROVIDER --session ID --task-id ID --wait-id ID --answer TEXT\nsimy delivery handoff|handoff_cancel --provider codex --session ID --task-id ID --target-session ID');
+    output('simy delivery start --provider codex|claude --session ID --objective TEXT --next-step TEXT [--managed-file task.json] [--execution-cwd PATH] [--max-failures 3]\nsimy delivery checkpoint --provider codex|claude --session ID --file checkpoint.json|-\nsimy delivery status\nsimy delivery stop|pause|resume --provider codex|claude --session ID [--task-id ID]\nsimy delivery replan --provider PROVIDER --session ID --task-id ID\nsimy delivery approve|reject --provider PROVIDER --session ID --task-id ID --approval-id ID\nsimy delivery verify --provider PROVIDER --session ID --task-id ID --criterion-id ID\nsimy delivery set_policy --provider PROVIDER --session ID --task-id ID --autonomy-policy strict|balanced|autonomous\nEnable and review SIMY hooks in your provider first. Standard start tracks checkpoints and reports done without certifying acceptance. Managed start freezes the original objective, optional user-selected deliveryLevel, and acceptance specification. Desktop Continue infers the original conversation goal first. Continue adopts an eligible ordinary loop with the same goal and failure budget; its first managed action reconciles prior work read-only. --execution-cwd explicitly binds the task directory while provider identity retains its original folder. Resume preserves original task identity, history and approvals.');
     return 0;
   }
   const options = {};
-  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
+  const allowed = new Set(['provider', 'session', 'objective', 'next-step', 'max-failures', 'max-no-progress-minutes', 'continuation-policy', 'file', 'managed-file', 'execution-cwd', 'task-id', 'approval-id', 'criterion-id', 'autonomy-policy', 'wait-id', 'answer', 'target-session']);
   for (let i = 0; i < args.length; i += 2) {
     const key = args[i]?.replace(/^--/, '');
     if (!args[i]?.startsWith('--') || !allowed.has(key) || args[i + 1] === undefined || Object.hasOwn(options, key)) throw new Error('Invalid delivery option. Use simy delivery --help.');
@@ -37,7 +37,7 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
   const base = { root, cwd, provider: options.provider, session: options.session };
   let result;
   if (action === 'status') result = (await listRecords(root)).filter(r => (!options.provider || r.provider === options.provider) && (!options.session || r.session === options.session));
-  else if (action === 'continue') result = await continueSession({ ...base, autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
+  else if (action === 'continue') result = await continueSession({ ...base, executionCwd: options['execution-cwd'], autonomyPolicy: options['autonomy-policy'], continuationPolicy: options['continuation-policy'],
     ...Object.fromEntries([['max-failures', 'maxFailures'], ['max-no-progress-minutes', 'maxNoProgressMinutes']]
       .filter(([key]) => options[key] !== undefined).map(([key, field]) => [field, Number(options[key])])) });
   else if (action === 'handoff') result = await handoffSession({ ...base, taskId: options['task-id'], targetSession: options['target-session'] });
@@ -53,7 +53,7 @@ export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = p
       if (!managed || typeof managed !== 'object') throw new Error('--max-no-progress-minutes requires --managed-file; use delivery continue for context-first supervision.');
       managed = { ...managed, maxNoProgressMinutes: Number(options['max-no-progress-minutes']) };
     }
-    result = await startDelivery({ ...base, objective: options.objective, nextStep: options['next-step'], managed, continuationPolicy: options['continuation-policy'],
+    result = await startDelivery({ ...base, executionCwd: options['execution-cwd'], objective: options.objective, nextStep: options['next-step'], managed, continuationPolicy: options['continuation-policy'],
     ...(options['max-failures'] === undefined ? {} : { maxFailures: Number(options['max-failures']) }) });
   }
   else if (action === 'checkpoint') {

package/src/delivery-hooks/desktop.js

@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { canReplanDelivery, deliveryStop, deliveryStopBlocksResume, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { canReplanDelivery, pendingAcceptance, deliveryStop, deliveryStopBlocksResume, reconcileRecords, rootDirectory } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { originalSessionTarget } from '../session-supervision/original-session-target.js';
 
 export const HOOK_SETUP = Object.freeze({
@@ -28,7 +28,7 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       const latest = records.filter(r => r.provider === provider && Number.isFinite(r.observedAt)).sort((a, b) => b.observedAt - a.observedAt)[0];
       return [provider, { ...HOOK_SETUP[provider], state: latest ? 'observed' : 'not_observed', lastObservedAt: latest?.observedAt || null }];
     })),
-    runs: records.filter(r => r.run).sort((a, b) => b.run.updatedAt - a.run.updatedAt).slice(0, 30).map(r => ({
+    runs: records.filter(r => r.run && r.providerArchived !== true).sort((a, b) => b.run.updatedAt - a.run.updatedAt).slice(0, 30).map(r => ({
       provider: r.provider, session: r.session, originalSessionTarget: originalSessionTarget(r.provider, r.session),
       objective: r.run.objective, state: r.run.state, reason: r.run.reason,
       continuations: r.run.continuations,
@@ -37,6 +37,9 @@ export async function deliveryHookStatus({ root = rootDirectory(), now = Date.no
       stopCode: deliveryStop(r.run, now)?.code ?? null,
       outcomeProgress: r.run.managed?.outcomeProgress || null,
       needsAttention: ['blocked', 'failed', 'recovery_required', 'budget_exhausted', 'verification_pending'].includes(r.run.state), updatedAt: r.run.updatedAt,
+      mode: r.run.managed ? 'managed' : 'standard_loop',
+      deliveryLevel: r.run.managed?.deliveryLevel || null, enrollment: r.run.managed?.enrollment || null,
+      pendingAcceptance: pendingAcceptance(r.run),
       managed: Boolean(r.run.managed), taskId: r.run.managed?.taskId || null, actionId: r.run.managed?.actionId || null,
       actionDueAt: r.run.managed?.actionDueAt ?? null,
       actionAssociation: associationStatus(r.run.managed?.actionAssociation),

package/src/delivery-hooks/supervisor.js

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { dirname } from 'node:path';
-import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, deliveryProgressContext, deliveryStop, listRecords, readRecord, managedBudgetReason, notifyState, processIdentity, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+import { automaticContinuationAllowed, assessedCheckpointContract, checkpointDelivery, decideStop, deliveryProgressContext, deliveryStop, listRecords, readRecord, managedBudgetReason, notifyState, processIdentity, sharesTaskWorkspace, taskDirectory, reconcileRecords, updateRecord, verifyAutomaticCriteria } from '../codex-plugins/simy/hooks/delivery-loop.mjs';
 import { resolveBackendExecutable } from '../backend-executable.js';
 import { executeCodexAppServer } from '../session-supervision/codex-app-server.js';
 import { acquireWorkspaceLease, leaseOwnerDead } from '../session-supervision/workspace-lease.js';
@@ -75,8 +75,9 @@ export async function executeCodexResume(record, { signal, root, leaseId, execut
   if (!binary) throw new Error('Codex executable unavailable.');
   await assertActiveLease(root, record.provider, record.session, leaseId, signal, currentTime);
   const run = record.run;
-    const context = { taskId: run.managed.taskId, session: record.session, objective: run.objective, nextStep: run.nextStep,
+    const context = { taskId: run.managed.taskId, session: record.session, sessionCwd: record.cwd, executionCwd: taskDirectory(record), objective: run.objective, nextStep: run.nextStep,
     lastDependencyResolution: run.managed.lastDependencyResolution,
+    ...(run.managed.upgradedFrom ? { adoptedLoop: run.managed.upgradedFrom, priorCheckpoint: run.checkpoint } : {}),
     remainingWork: run.managed.remainingWork, acceptanceCriteria: run.managed.acceptanceCriteria, proposedAction: run.managed.proposedAction,
     currentDecision: run.managed.autonomyPolicy ? run.managed.decision : undefined, diagnosis: run.managed.plan?.diagnosis,
     progress: deliveryProgressContext(run) };
@@ -252,7 +253,7 @@ export async function tickManagedTasks({ root, now = Date.now(), execute, inspec
           result = { code: -3, busy: true };
         } else if (resource.busy) result = { code: -3, busy: true };
         else if (['local_edit', 'local_test'].includes(claimed.run.managed.decision?.action.kind) &&
-          (await listRecords(root)).some(other => other.cwd === claimed.cwd && other.run?.managed?.executionUncertain)) result = { code: -3, busy: true };
+          (await listRecords(root)).some(other => sharesTaskWorkspace(other, claimed) && other.run?.managed?.executionUncertain)) result = { code: -3, busy: true };
         if (!result) {
         await authorizeClaim();
         const runner = execute || (appServer ? executeCodexAppServer : executeCodexResume);

package/src/index.js

@@ -6,6 +6,10 @@ import { createInterface } from "node:readline/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+import { findReusableConnection } from "./connection-discovery.js";
+import { connectionScope } from "./connection-diagnostics.js";
+import { readSession } from "./session-store.js";
+import { CLI_API_CONTRACT_VERSION } from "./cli-contract.js";
 import { startAgent } from "./agent.js";
 import { createRuntimeDiagnostics, captureRuntimeOutput } from "./runtime-diagnostics.js";
 import {
@@ -165,6 +169,23 @@ async function runLocalAgent() {
   const webOrigin = configuredWebOrigin;
   const sessionRoot = process.env.SIMY_HOME?.trim() || join(homedir(), ".simy");
 
+  try {
+    const existing = await findReusableConnection({ webOrigin, sessionRoot, cliVersion: packageInfo.version,
+      apiContractVersion: CLI_API_CONTRACT_VERSION, requestedPort: port, authorize: true,
+      expectedScope: connectionScope(await readSession(webOrigin, sessionRoot), webOrigin) });
+    if (existing) {
+      console.log(`Connected to existing SIMY service at http://127.0.0.1:${existing.port}`);
+      const url = existing.loginUrl || webOrigin;
+      console.log(`Continue in SIMY Web: ${url}`);
+      if (!args.has('--no-open') && process.env.SIMY_DAEMON_CHILD !== '1') await openAuthorizationUrl(url);
+      return;
+    }
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 2;
+    return;
+  }
+
   try {
     await prepareDaemonWorkflows({ argv, daemon });
   } catch (error) {

package/src/launch-authorization.js

@@ -0,0 +1,80 @@
+import { webApiHeaders, webApiUrl } from "./web-api.js";
+
+// Only an explicitly expired credential is renewable. A consumed or rejected
+// credential may represent an execution that already started; never replay it.
+export async function authorizeLaunch({
+  apiOrigin,
+  apiBaseUrl,
+  token,
+  runId,
+  challenge,
+  fetchImpl = fetch,
+}) {
+  const post = async (path, body) => {
+    const response = await fetchImpl(
+      webApiUrl(path, { webOrigin: apiOrigin, apiBaseUrl }),
+      {
+        method: "POST",
+        headers: webApiHeaders(
+          { token },
+          { "Content-Type": "application/json" },
+        ),
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal: AbortSignal.timeout(10_000),
+      },
+    );
+    return { response, payload: await response.json().catch(() => null) };
+  };
+  const rejected = ({ response, payload }) => ({
+    ok: false,
+    status: response.status >= 500 ? 502 : response.status === 401 ? 401 : 403,
+    code:
+      typeof payload?.code === "string"
+        ? payload.code
+        : response.status >= 500
+          ? "launch_service_unavailable"
+          : response.status === 401
+            ? "connection_session_expired"
+            : response.status === 404
+              ? "launch_service_incompatible"
+              : "launch_challenge_invalid",
+  });
+  const verificationOutcome = (result) => {
+    if (!result.response.ok) return rejected(result);
+    return result.payload?.ok === true
+      ? { ok: true }
+      : { ok: false, status: 502, code: "launch_service_unavailable" };
+  };
+  try {
+    if (challenge) {
+      const verified = await post("challenges/verify", {
+        run_id: runId,
+        challenge,
+      });
+      if (verified.response.ok) return verificationOutcome(verified);
+      if (verified.payload?.code !== "launch_challenge_expired")
+        return rejected(verified);
+    }
+    const issued = await post("challenges/issue", {
+      run_id: runId,
+      ...(challenge ? { previous_challenge: challenge } : {}),
+    });
+    if (!issued.response.ok) return rejected(issued);
+    if (
+      typeof issued.payload?.challenge !== "string" ||
+      !issued.payload.challenge ||
+      !Number.isFinite(Date.parse(issued.payload.expires_at)) ||
+      Date.parse(issued.payload.expires_at) <= Date.now()
+    ) {
+      return { ok: false, status: 502, code: "launch_service_unavailable" };
+    }
+    const verified = await post("challenges/verify", {
+      run_id: runId,
+      challenge: issued.payload.challenge,
+    });
+    return verificationOutcome(verified);
+  } catch {
+    return { ok: false, status: 502, code: "launch_service_unavailable" };
+  }
+}

package/src/orchestrator/evidence.js

@@ -47,7 +47,15 @@ export async function collectPrEvidence({
     minimumCompletion.status = "evidence_incomplete";
     minimumCompletion.errors = ["Checkout changed while collecting minimum evidence; verify again."];
   }
+  const collectionErrors = [
+    ...(!baseRefresh.ok ? [baseRefresh.error] : []),
+    ...(!latest.available ? latest.errors : []),
+    // No reported PR is an implementation gap; an unreadable reported PR is
+    // a collector failure. Never send the worker to repair a failed gh read.
+    ...(github.collection_error ? [github.collection_error] : []),
+  ].filter(Boolean);
   return {
+    ...(collectionErrors.length ? { collection_error: collectionErrors.join("; ") } : {}),
     minimum_completion: minimumCompletion,
     collected_at: new Date().toISOString(),
     local: latest,
@@ -160,13 +168,13 @@ async function collectGitHubEvidence({ charter, attempt, repositoryPath, runComm
     ["pr", "view", target, "--json", fields],
     repositoryPath,
   );
-  if (!result.ok) return unavailable(result.error);
+  if (!result.ok) return { ...unavailable(result.error), collection_error: result.error };
 
   let payload;
   try {
     payload = JSON.parse(result.stdout);
   } catch {
-    return unavailable("GitHub PR evidence was not valid JSON.");
+    return { ...unavailable("GitHub PR evidence was not valid JSON."), collection_error: "GitHub PR evidence was not valid JSON." };
   }
   const checks = normalizeChecks(payload.statusCheckRollup);
   const requiredChecks = stringArray(charter.required_checks);

package/src/orchestrator/loop.js

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+import { completedWorkerResult } from "../coding-run-recovery.js";
 import { validateCharter } from "./charter-validation.js";
 import { redactExecutionText } from "./execution-io.js";
 import { minimumCharter } from "./delivery/scripts/check-minimum-completion.mjs";
@@ -26,7 +28,7 @@ async function runCodingLoopOwned({
   shouldStop = () => false,
   consumeHumanGuidance = () => "",
 }) {
-  if (!resume && snapshot.attempts.length > 0) {
+  if (!resume && snapshot.attempts.length > 0 && !snapshot.metadata?.completed_worker_result) {
     return recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm, onUpdate });
   }
   snapshot.implementation_gate_passed = false;
@@ -76,7 +78,16 @@ async function runCodingLoopOwned({
   }
 
   let previousFindings = resume ? snapshot.final_audit?.findings || [] : [];
-  const firstAttempt = resume ? snapshot.attempts.length + 1 : 1;
+  const receipt = completedWorkerResult(snapshot);
+  if (snapshot.metadata?.completed_worker_result && !receipt) {
+    snapshot.final_audit = humanGate("The saved worker result cannot be safely reused.", [{
+      code: "WORKER_RESULT_UNVERIFIED", severity: "blocker", target: "worker_result",
+      explanation: "Reconcile the saved result and objective before continuing; do not replay unknown external effects.", repairability: "manual",
+    }]);
+    await publish(snapshot, "waiting_human", onUpdate);
+    return snapshot;
+  }
+  const firstAttempt = receipt?.attempt.attempt_number ?? (resume ? snapshot.attempts.length + 1 : 1);
   const lastAttempt = codingAttemptCeiling(snapshot);
   for (
     let attemptNumber = firstAttempt;
@@ -88,7 +99,8 @@ async function runCodingLoopOwned({
       attemptNumber,
       phase: "executor",
     });
-    if (!executorBudget.allowed) {
+    const recoveredAttempt = attemptNumber === firstAttempt ? receipt?.attempt : null;
+    if (!recoveredAttempt && !executorBudget.allowed) {
       await stopForBudget({
         snapshot,
         attempt: snapshot.attempts.at(-1) ?? null,
@@ -107,7 +119,7 @@ async function runCodingLoopOwned({
       const retainedGuidance = redactExecutionText(attemptGuidance.trim(), { maxChars: Infinity }).text;
       if (history.at(-1) !== retainedGuidance) history.push(retainedGuidance);
     }
-    const previousAttempt = snapshot.attempts.at(-1) ?? null;
+    const previousAttempt = snapshot.attempts.filter(item => item.attempt_number < attemptNumber).at(-1) ?? null;
     const promptInterventions = buildPromptInterventions(snapshot.charter, {
       attemptNumber,
       previousFindings,
@@ -121,37 +133,48 @@ async function runCodingLoopOwned({
       promptInterventions,
     });
 
-    appendEvent(snapshot, "dispatching", `Dispatching local coding attempt ${attemptNumber}.`, {
-      backend: snapshot.charter.backend,
-      attempt_number: attemptNumber,
-      instruction,
-    });
-    await publish(snapshot, "dispatching", onUpdate);
-
-    appendEvent(snapshot, "coding", `${snapshot.charter.backend} is executing locally.`, {
-      backend: snapshot.charter.backend,
-      attempt_number: attemptNumber,
-      instruction,
-    });
-    await publish(snapshot, "coding", onUpdate);
-
-    const execution = await safeExecution(() =>
-      executeAttempt({
-        attemptNumber,
-        backend: snapshot.charter.backend,
-        instruction,
-        charter: snapshot.charter,
-      }),
-    );
+    let attempt = recoveredAttempt;
+    if (!attempt) {
+      appendEvent(snapshot, "dispatching", `Dispatching local coding attempt ${attemptNumber}.`, {
+        backend: snapshot.charter.backend, attempt_number: attemptNumber, instruction,
+      });
+      await publish(snapshot, "dispatching", onUpdate);
+      appendEvent(snapshot, "coding", `${snapshot.charter.backend} is executing locally.`, {
+        backend: snapshot.charter.backend, attempt_number: attemptNumber, instruction,
+      });
+      await publish(snapshot, "coding", onUpdate);
+      const recordCompletion = async execution => {
+        attempt = buildAttempt({ attemptNumber, charter: snapshot.charter, instruction, promptInterventions, execution });
+        if (attempt.status !== "completed" || Array.isArray(attempt.raw_output) || !Object.keys(attempt.raw_output).length) return;
+        snapshot.metadata ??= {};
+        snapshot.metadata.completed_worker_result = {
+          version: 1, run_id: snapshot.id, invocation_id: execution.invocationId || randomUUID(),
+          objective_digest: verifyObjective(snapshot.charter).digest, attempt,
+          recorded_at: new Date().toISOString(),
+        };
+        // Do not enter collectors until the terminal result has been committed
+        // to private storage by onUpdate. A failed write must never become a
+        // synthetic executor failure that dispatches another worker.
+        try { await publish(snapshot, "coding", onUpdate); }
+        catch (error) {
+          snapshot.metadata.completed_worker_result.persistence_failed = true;
+          error.code = "worker_result_persistence_failed";
+          throw error;
+        }
+      };
+      const execution = await safeExecution(() => executeAttempt({
+        attemptNumber, backend: snapshot.charter.backend, instruction,
+        charter: snapshot.charter, onExecutionComplete: recordCompletion,
+      }));
+      if (!attempt) await recordCompletion(execution);
+    } else {
+      appendEvent(snapshot, "collecting_evidence", "Recovering the completed worker result without dispatching another worker.", {
+        code: "completed_worker_result_recovered", attempt_number: attemptNumber,
+        invocation_id: receipt.invocation_id,
+      });
+    }
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
-    const attempt = buildAttempt({
-      attemptNumber,
-      charter: snapshot.charter,
-      instruction,
-      promptInterventions,
-      execution,
-    });
-    attempt.budget = refreshBudgetState(snapshot, attempt);
+    attempt.budget = refreshBudgetState(snapshot, snapshot.attempts.some(item => item.attempt_number === attemptNumber) ? null : attempt);
 
     appendEvent(snapshot, "collecting_evidence", `Collecting attempt ${attemptNumber} evidence.`, {
       attempt_number: attemptNumber,
@@ -162,7 +185,11 @@ async function runCodingLoopOwned({
       tests_run: attempt.tests_run,
     });
     await publish(snapshot, "collecting_evidence", onUpdate);
-    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt, { retries: snapshot.metadata?.completed_worker_result ? 2 : 0, shouldStop });
+    if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
+    if (attempt.observed_evidence.collection_error && snapshot.metadata?.completed_worker_result) {
+      return waitForCollector(snapshot, attempt, onUpdate);
+    }
     attempt.sqm = await safeSqm(checkSqm, attempt);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
 
@@ -183,7 +210,9 @@ async function runCodingLoopOwned({
     });
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.implementation_gate = attempt.audit.implementation_gate;
-    snapshot.attempts.push(attempt);
+    const recordedIndex = snapshot.attempts.findIndex(item => item.attempt_number === attemptNumber);
+    if (recordedIndex >= 0) snapshot.attempts[recordedIndex] = attempt;
+    else snapshot.attempts.push(attempt);
     assessOutcomeProgress(snapshot.charter, attempt, previousAttempt, { ...outcomeOptions(snapshot), resetUnavailableCount: resume && attemptNumber === firstAttempt });
     attempt.budget = refreshBudgetState(snapshot);
     recordBudgetWarnings(snapshot, attempt);
@@ -200,6 +229,7 @@ async function runCodingLoopOwned({
 
     if (!attempt.audit.passed) {
       snapshot.final_audit = attempt.audit;
+      delete snapshot.metadata?.completed_worker_result;
       const terminal = await handleFailedAudit({
         snapshot,
         attempt,
@@ -267,7 +297,11 @@ async function runCodingLoopOwned({
     attempt.independent_audit.objective_version = reviewedObjectiveVersion;
 
     // Re-collect after the read-only auditor to catch any mutated HEAD or working tree.
-    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt);
+    attempt.observed_evidence = await safeEvidence(collectEvidence, attempt, { retries: snapshot.metadata?.completed_worker_result ? 2 : 0, shouldStop });
+    if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
+    if (attempt.observed_evidence.collection_error && snapshot.metadata?.completed_worker_result) {
+      return waitForCollector(snapshot, attempt, onUpdate);
+    }
     attempt.sqm = await safeSqm(checkSqm, attempt, attempt.sqm);
     if (shouldStop()) return stopCodingLoop(snapshot, onUpdate);
     attempt.audit = await auditAttempt(snapshot.charter, attempt, {
@@ -282,6 +316,7 @@ async function runCodingLoopOwned({
     if (!attempt.audit.passed || !attempt.independent_audit.passed) {
       const findings = [...attempt.audit.findings, ...independentFindings];
       snapshot.final_audit = aggregateAudit(attempt, false, findings);
+      delete snapshot.metadata?.completed_worker_result;
       const terminal = await handleFailedAudit({
         snapshot,
         attempt,
@@ -296,6 +331,7 @@ async function runCodingLoopOwned({
       continue;
     }
 
+    delete snapshot.metadata?.completed_worker_result;
     snapshot.implementation_gate_passed = true;
     attempt.pr_readiness = evaluatePrReadiness(snapshot.charter, attempt);
     attempt.pr_gate = attempt.pr_readiness;
@@ -389,10 +425,23 @@ async function recheckPrReadinessOwned({ snapshot, collectEvidence, checkSqm = n
 }
 
 
+async function waitForCollector(snapshot, attempt, onUpdate) {
+  snapshot.final_audit = humanGate("Evidence collection failed; the completed worker result is retained for retry.", [{
+    code: "EVIDENCE_COLLECTION_UNAVAILABLE", severity: "blocker", target: "evidence_collector",
+    explanation: attempt.observed_evidence.collection_error, repairability: "manual",
+  }]);
+  appendEvent(snapshot, "waiting_human", "Retry evidence collection for the same completed attempt.", {
+    code: "evidence_collection_retry_required", attempt_number: attempt.attempt_number,
+  });
+  await publish(snapshot, "waiting_human", onUpdate);
+  return snapshot;
+}
+
 async function safeExecution(callback) {
   try {
     return await callback();
   } catch (error) {
+    if (error?.code === "worker_result_persistence_failed") throw error;
     return {
       exitCode: null,
       logs: [],
@@ -402,14 +451,19 @@ async function safeExecution(callback) {
   }
 }
 
-async function safeEvidence(collector, attempt) {
+async function safeEvidence(collector, attempt, { retries = 0, shouldStop = () => false } = {}) {
   if (!collector) return unavailableEvidence("Evidence collector is not configured.");
-  try {
-    return await collector(attempt);
-  } catch (error) {
-    return unavailableEvidence(
-      error instanceof Error ? error.message : "Evidence collection failed.",
-    );
+  for (let retry = 0; ; retry++) {
+    if (retry > 0 && shouldStop()) return unavailableEvidence("Evidence collection stopped by the operator.");
+    try {
+      const evidence = await collector(attempt);
+      if (evidence?.collection_error && retry < retries) continue;
+      return evidence;
+    }
+    catch (error) {
+      if (retry < retries) continue;
+      return unavailableEvidence(error instanceof Error ? error.message : "Evidence collection failed.");
+    }
   }
 }
 
@@ -430,6 +484,7 @@ async function safeSqm(checker, attempt, previous = null, phase = "min") {
 
 function unavailableEvidence(error) {
   return {
+    collection_error: error,
     collected_at: new Date().toISOString(),
     local: {
       available: false,