@awak-app/simy-cli 0.7.19 → 0.7.21

package/README.md

@@ -248,15 +248,19 @@ Closing the window keeps the agent running. Open the app again or choose
 **Show SIMY** from its menu bar icon to return. **Quit SIMY** asks before
 interrupting active tasks. The normal `simy` command remains available.
 
-Signed patch/minor updates wait for idle and verify the new runtime before
-handoff; failed startup restores the previous installed version. After a runtime
-update, choose **Restart to update** to load the updated native interface. This
-action asks to stop running tasks before restarting. **Stop task…** in a task
+The macOS **Automatic updates** switch saves this Mac's choice across restarts.
+Compatible signed installations enable it by default. Patch/minor updates wait
+for idle and verify the new runtime before handoff; failed startup restores the
+previous installed version. The app then switches to the verified new interface
+when no unfinished work or confirmation is pending. Turning the switch off keeps
+manual checks and **Download DMG** available. An explicit `SIMY_AUTO_UPDATE=0`
+remains authoritative, and major updates continue to use the DMG.
+**Stop task…** in a task
 detail asks for confirmation and terminates its local Provider process, keeping
 existing output and history. An explicit update can likewise stop active work
 after confirmation; automatic updates still wait for idle. **⌘Q** exits SIMY and
-its background services directly, including when work is running. The window reports App and runtime versions separately while they
-differ, and normal app launches select the newer installed interface.
+its background services directly, including when work is running. The window shows
+the app version, and normal app launches select the newer installed interface.
 
 Older installers that predate native app relaunch support need a one-time
 reinstallation from the official download page to update their Applications
@@ -337,8 +341,10 @@ seven days. Usage counters alone leave work time, idle time and utilization
 unavailable; a single observed activity event is a measured zero-duration sample.
 Missing usage records remain distinct from recorded zero tokens.
 
-The desktop Sessions page loads a recent window of up to 200 conversations,
-selected by last activity. The macOS work list then prioritizes verified running
+The desktop Sessions page loads the full available Codex and Claude Code
+conversation catalog without a 200-conversation display limit. Live process
+probes remain limited to recent conversations and explicitly retained work;
+older rows remain visible with unverified execution state. The macOS work list then prioritizes verified running
 conversations, including families with running children, followed by work needing
 a human response and recent activity. Its All, Running, Needs attention, Completed
 and Archived views combine with search. Tracking and auto-continue settings never
@@ -358,13 +364,15 @@ Codex candidates come from CLI, VS Code and app-server
 conversation sources; non-interactive exec, unknown sources and delegated agents
 are excluded. A hook observation alone cannot restore a filtered conversation.
 Explicitly tracked, monitored, auto-continue and unsettled supervision records
-remain visible even outside that window. When a retained Codex conversation is
+remain visible even during a provider discovery failure. When a retained Codex conversation is
 omitted from the recent provider page, SIMY reads its exact metadata without
 loading turns or taking writer ownership. The same interactive source filter and
 a matching active rollout path are required before restoring provider capabilities
 and probing its latest turn. Exact reads and turn probes share a bounded
 observation deadline. Claude discovery
-ranks file metadata before opening selected transcripts. A conflicting saved
+reads metadata with a bounded I/O pool and bounded transcript prefixes. Full
+catalog reads include every project and transcript, while exact conversation
+content and statistics remain separate reads. A conflicting saved
 workspace leaves only that conversation's Action association unavailable; it
 does not stop discovery or change the saved identity. The page lets users
 choose monitoring or supported session supervision with a goal, acceptance
@@ -1300,9 +1308,9 @@ original machine. See [setup, access requirements and recovery](docs/remote-code
 
 ### Local conversation list on NVIDIA / Linux
 
-Run `simy sessions` directly on the machine where Codex is running. It reads
-that machine's actual Codex conversation metadata without starting the agent,
-updater, analysis worker or a Delivery Loop. No Mac or SSH bridge is needed.
+Run `simy sessions` to list local and explicitly registered SSH hosts. It reads
+both providers' actual conversation metadata without starting the agent,
+updater, analysis worker or a Delivery Loop. Remote reads use SSH with the existing user identity and verified host key.
 
 ```sh
 simy sessions --query NVIDIA
@@ -1311,12 +1319,28 @@ simy sessions --json
 ```
 
 In the interactive list, use Up/Down to select a conversation, `/` to search its
-title, folder or ID, Enter to finish searching, Esc to clear the filter, `r` to
+title, folder, provider or ID, Enter to finish searching, Esc to clear the filter, `r` to
 refresh and `q` to quit. The selected conversation shows its exact ID and folder.
-Search covers the current recent window (up to 200 active conversations and,
-with `--include-archived`, up to 200 archived conversations); older entries outside
-that window are not searched. This view respects the saved
-Codex provider connection setting and never enables automatic continuation.
+Search covers the full available catalog, including older conversations. Use
+`--include-archived` to include archived conversations from both providers.
+Each row identifies its provider; identical IDs in Codex and Claude remain
+separate rows. A provider failure preserves the other provider's results with
+an explicit incomplete warning (`complete: false` and `warnings` in JSON).
+This view respects both saved provider connection settings and never enables
+automatic continuation. Disconnected providers are not read.
+
+The terminal command reads this host and hosts explicitly registered in
+`~/.simy/remote-hosts.json`. Use `--local-only` to skip SSH, and
+`--provider codex` or `--provider claude` to select a provider. Remote SIMY must
+also include these options; older hosts produce an incomplete warning instead
+of silently disappearing. Each row retains its host, provider and conversation
+ID; search also matches the host label. SSH reads run `simy sessions --local-only`
+and do not start a desktop host, supervisor, or provider turn. Both the local
+and remote provider connection settings apply.
+
+The desktop bridge also includes both providers. Neither interface imports
+Codex desktop connection settings automatically or claims to discover
+unregistered hosts, another OS user's history, or malformed/unsupported records.
 
 The existing per-provider heartbeat now includes `device_io` with
 `schema_version: local_device_io.v1`. It distinguishes Codex verified native-cwd
@@ -1346,3 +1370,28 @@ When supervision is already live, install the candidate, request
 `runtime supervisor-handover --release ABSOLUTE_RELEASE`, and wait for activation.
 The watcher preserves the live supervisor while service registration is updated.
 No command here enrolls an unrelated conversation or renews an existing budget.
+
+### Resume after sleep, logout or reboot
+
+The OS watchdog retains activation in `supervisor-runtime/control.json`. Sleep
+re-observes the existing process before replacing it. After logout/login or a
+shutdown/reboot, the registered OS service loads the same runtime and saved task
+state. Linux uses a systemd user service (user lingering permits running after
+logout); macOS uses a login LaunchAgent; Windows uses the interactive user's
+scheduled task. macOS/Windows recovery therefore starts after that user logs in.
+No work runs while the computer is powered off or asleep.
+
+To enable durable recovery for one existing opted-in conversation:
+
+```sh
+~/.simy/bin/simy delivery runtime supervisor-enable --provider codex --session SESSION_ID
+~/.simy/bin/simy delivery runtime supervisor-watchdog-install
+```
+
+This selection binds its existing run and consent epoch, excluding other tasks.
+The recovered host starts by reading saved results and current artifacts. It
+retains the goal, budgets and unresolved effects; it does not replay an
+interrupted write or approve a pending external action. Explicit task
+stop/pause, provider permission prompts and unanswered user questions remain
+boundaries. `runtime supervisor-disable` is a durable explicit stop and is never
+reversed by waking or booting. A later explicit enable is required.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.19",
+  "version": "0.7.21",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {

package/src/auto-update.js

@@ -86,6 +86,7 @@ export class CliAutoUpdater extends EventEmitter {
       install_mode: options.installMode,
       automatic: Boolean(
         !options.disabled &&
+          options.autoUpdatesEnabled !== false &&
           options.daemon &&
           (options.installMode === "global_npm" ||
             (options.installMode === MACOS_INSTALLER_MODE && options.installerMarker?.teamId)) &&
@@ -101,7 +102,20 @@ export class CliAutoUpdater extends EventEmitter {
   }
 
   snapshot() {
-    return structuredClone({ ...this.#snapshot, requires_task_stop: !this.#isIdle() });
+    const supported = !this.#options.disabled && this.#options.daemon && this.#options.requestedPort === 0 &&
+      (this.#options.installMode === 'global_npm' || this.#options.installMode === MACOS_INSTALLER_MODE && Boolean(this.#options.installerMarker?.teamId));
+    return structuredClone({ ...this.#snapshot, auto_update_supported: Boolean(supported),
+      auto_update_enabled: this.#snapshot.automatic, auto_update_busy: Boolean(this.#applying || this.#confirmedUpdate), requires_task_stop: !this.#isIdle() });
+  }
+
+  setAutomaticUpdates(enabled) {
+    if (typeof enabled !== 'boolean') throw new Error('Choose whether automatic updates are enabled.');
+    if (enabled && !this.snapshot().auto_update_supported) throw new Error('Automatic updates are unavailable for this installation.');
+    if (this.#applying || this.#confirmedUpdate) throw new Error('Wait for the current update to finish.');
+    this.#options.autoUpdatesEnabled = enabled;
+    if (!enabled) this.#clearIdleTimer();
+    this.#setState(!enabled && this.#snapshot.state === 'waiting_for_idle' ? 'update_available' : this.#snapshot.state,
+      { automatic: enabled, error: null });
   }
 
   // Close admission before cancellation begins. The same transaction owns the
@@ -435,6 +449,7 @@ export async function createCliAutoUpdater({
   interactive,
   requestedPort = 0,
   disabled = false,
+  autoUpdatesEnabled = true,
   packageRoot = PACKAGE_ROOT,
   webOrigin,
   dependencies = {},
@@ -458,6 +473,7 @@ export async function createCliAutoUpdater({
     interactive: Boolean(interactive),
     requestedPort,
     disabled,
+    autoUpdatesEnabled,
     currentVersion: packageInfo.version,
     installMode,
     installerMarker,

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.19";
+export const CLI_VERSION = "0.7.21";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -824,7 +824,7 @@ function hookDeliveryContext(record, automatic = false) {
     `Preserve the current task and its permissions, pauses and stops; never restart or reset it automatically.`;
 }
 export async function startDelivery({ root = rootDirectory(), provider, session, cwd = process.cwd(), executionCwd, upgradeRunId, previousRunId, reconcileRunId, objective, nextStep, maxMinutes, maxContinuations, maxFailures, continuationPolicy, managed, admission,
-  liveHookAdmission, autoContinueEpoch, providerLinkEpoch, inspectProcess = processIdentity, now = Date.now() }) {
+  liveHookAdmission, autoContinueEpoch, followupAutoContinue = false, providerLinkEpoch, inspectProcess = processIdentity, now = Date.now() }) {
   const link = await providerLinkState(root, provider);
   if (providerLinkEpoch !== undefined && providerLinkEpoch !== link.epoch) throw Object.assign(new Error("SIMY provider connection changed before enrollment."), { code: "provider_link_changed" });
   if (!link.connected) throw Object.assign(new Error("Reconnect this provider to SIMY before using it."), { code: "provider_link_disconnected" });
@@ -871,6 +871,7 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
     if ((following || reconciling) && (provider !== 'codex' || !admitted || !managedState?.autoRecovery || managedState.capability !== 'codex_app_server' || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Follow-up requires exact-session managed supervision, a concrete goal and read-only reconciliation.');
     if (upgrading && (!managedState?.autonomyPolicy || managedState.initialAction.kind !== 'read' || managedState.contextBootstrap)) throw new Error('Upgrade requires read-only reconciliation and frozen acceptance of the original objective.');
     if (!managedState && continuationMode(continuationPolicy) === 'progress') throw new Error('Progress continuation requires frozen managed acceptance criteria.');
+    if (followupAutoContinue && !(following || reconciling)) throw new Error('Auto-continue follow-up requires the exact finished run.');
     if (autoContinueEpoch && managedState) managedState.autoContinueEpoch = autoContinueEpoch;
     if (managedState && previous.associationTaskId) {
       managedState.taskId = previous.associationTaskId;
@@ -916,6 +917,13 @@ export async function startDelivery({ root = rootDirectory(), provider, session,
       if (saved && digest(saved) !== digest(archive)) throw new Error('Finished run archive differs; reconcile its history before enrolling follow-up work.');
       if (!saved) atomicSave(file, archive);
     }
+    // The explicit follow-up dialog enrolls and saves ON in one transaction.
+    // A failed/stale request never leaves a half-enabled preference behind.
+    if (followupAutoContinue) {
+      const epoch = randomUUID();
+      managedState.autoContinueEpoch = epoch;
+      return { ...previous, autoContinue: true, autoContinueEpoch: epoch, run };
+    }
     return { ...previous, run };
   });
 }

package/src/codex-work-pattern-sync.js

@@ -13,9 +13,11 @@ const MAX_MESSAGES = 24;
 const MAX_MESSAGE_CHARS = 1_500;
 const MAX_CANDIDATE_FILES = 200;
 export const MAX_GATEWAY_BODY_BYTES = 512 * 1024;
+const MAX_STATUS_RECEIPTS = 10;
+const MAX_STATUS_BODY_BYTES = 12 * 1024;
 const DEFAULT_LOOKBACK_DAYS = 90;
 const POLL_INTERVAL_MS = 15 * 60 * 1_000;
-const STATE_SCHEMA_VERSION = "work-pattern-history-sync.v6";
+const STATE_SCHEMA_VERSION = "work-pattern-history-sync.v7";
 export const HISTORY_EXTRACTION_POLICY = "user_conversation.v2";
 const PROVIDER_CODEX = "codex";
 const PROVIDER_CLAUDE = "claude";
@@ -125,7 +127,20 @@ export async function syncCodexWorkPatterns({
     deviceId,
   });
   const persistedState = await readSyncState(statePath);
-  const previousState = statusPayload.reset_cursor === true ? {} : persistedState;
+  const pendingReceipts = pendingReceiptMetadata(persistedState.pending_receipts);
+  if (pendingReceipts.length > 0) {
+    const pendingResult = await pollTimedOutReceipt({
+      endpoint,
+      token,
+      receipts: pendingReceipts,
+      fetchImpl,
+      signal,
+      authorizeProviders,
+    });
+    if (pendingResult.pending) return { status: "pending", uploaded: 0 };
+  }
+  const { pending_receipts: _pendingReceipts, ...resolvedPersistedState } = persistedState;
+  const previousState = statusPayload.reset_cursor === true ? {} : resolvedPersistedState;
   const state = { ...previousState, providers: Object.fromEntries(Object.entries(previousState.providers || {})
     .filter(([, cursor]) => cursor?.reset_pending !== true && (cursor?.lookback_days ?? previousState.lookback_days) === lookbackDays)) };
   const lookbackCutoffMs = now - lookbackDays * 24 * 60 * 60 * 1_000;
@@ -175,10 +190,12 @@ export async function syncCodexWorkPatterns({
   }))).flat();
   const selectedFiles = selectSessionFiles(files);
   const threads = [];
-  const acknowledgedRevisions = new Set(providerSpecs.flatMap((spec) =>
+  const acknowledgedRevisions = new Set([
+    ...providerSpecs.flatMap((spec) =>
     Object.values(providerCursor(state, spec.provider).processed_files)
       .filter((file) => file.lineage_ref && file.revision_ref)
-      .map((file) => `${file.lineage_ref}\0${file.revision_ref}`)));
+      .map((file) => `${file.lineage_ref}\0${file.revision_ref}`)),
+  ]);
   const successfullyReadFiles = [];
   const unreadableFiles = [];
   for (const file of selectedFiles) {
@@ -212,6 +229,7 @@ export async function syncCodexWorkPatterns({
       if (
         chunk.messages.length > 0
         && Date.parse(chunk.observed_at) >= lookbackCutoffMs
+        && !pendingReceipts.some(receipt => receiptKey(receipt) === threadReceiptKey(chunk))
       ) {
         threads.push(chunk);
       }
@@ -228,9 +246,38 @@ export async function syncCodexWorkPatterns({
     return { status: "up_to_date", uploaded: 0 };
   }
 
-  const uploadResult = threads.length > 0
-    ? await uploadThreadBatches({ endpoint, token, threads, fetchImpl, signal, authorizeProviders })
-    : { uploaded: 0 };
+  let uploadResult = { uploaded: 0 };
+  if (threads.length > 0) {
+    // Persist only opaque receipt metadata before an admission request that
+    // could reach Crew after this process loses its response.  A restart polls
+    // these tuples and never reconstructs a plaintext retry from them.
+    let attempted = [...pendingReceipts];
+    const recordAttempt = async (batch, remove = false) => {
+      const keys = new Set(batch.map(threadReceiptKey));
+      attempted = attempted.filter(receipt => !keys.has(receiptKey(receipt)));
+      if (!remove) attempted.push(...batch.map(receiptMetadata));
+      if (attempted.length) {
+        await writePendingReceiptState({ statePath, lookbackDays, providers: previousState.providers || {}, receipts: attempted, now });
+      } else {
+        await clearPendingReceiptState({ statePath, lookbackDays, providers: previousState.providers || {}, now });
+      }
+    };
+    uploadResult = await uploadThreadBatches({ endpoint, token, threads, fetchImpl, signal, authorizeProviders, recordAttempt });
+    if (uploadResult.pending_receipts?.length > 0) uploadResult.pending_receipts = attempted;
+  }
+  if (uploadResult.pending_receipts?.length > 0) {
+    await writePendingReceiptState({
+      statePath,
+      lookbackDays,
+      providers: previousState.providers || {},
+      receipts: uploadResult.pending_receipts,
+      now,
+    });
+    return { status: "pending", uploaded: 0 };
+  }
+  if (threads.length > 0 && uploadResult.uploaded !== threads.length) {
+    return { status: "pending", uploaded: uploadResult.uploaded };
+  }
   if (shouldAcknowledgeEmptyReset) {
     const { payload } = await postThreadBatch({ endpoint, token, threads: [], fetchImpl, signal, authorizeProviders });
     validateThreadBatchAcknowledgement(payload, []);
@@ -279,7 +326,7 @@ export function workPatternSyncStatePath({ sessionRoot, apiOrigin, accountId, de
   return join(sessionRoot, "work-pattern-history-sync", `${scopeHash}.json`);
 }
 
-async function uploadThreadBatches({ endpoint, token, threads, fetchImpl, signal, authorizeProviders }) {
+async function uploadThreadBatches({ endpoint, token, threads, fetchImpl, signal, authorizeProviders, recordAttempt }) {
   const batches = [];
   let batch = [];
   for (const thread of threads) {
@@ -299,6 +346,7 @@ async function uploadThreadBatches({ endpoint, token, threads, fetchImpl, signal
   if (batch.length > 0) batches.push(batch);
 
   let uploaded = 0;
+  const pendingReceipts = [];
   for (const current of batches) {
     const result = await postBatchWithBounded413Recovery({
       endpoint,
@@ -307,26 +355,45 @@ async function uploadThreadBatches({ endpoint, token, threads, fetchImpl, signal
       fetchImpl,
       signal,
       authorizeProviders,
+      recordAttempt,
     });
     uploaded += result.uploaded;
+    if (result.pending_receipts?.length > 0) {
+      pendingReceipts.push(...result.pending_receipts);
+      break;
+    }
   }
-  return { uploaded };
+  return pendingReceipts.length > 0
+    ? { uploaded, pending_receipts: pendingReceipts }
+    : { uploaded };
 }
 
-async function postBatchWithBounded413Recovery({ endpoint, token, threads, fetchImpl, signal, authorizeProviders }) {
-  const { response, payload } = await postThreadBatch({
-    endpoint,
-    token,
-    threads,
-    fetchImpl,
-    signal,
-    allow413: true,
-    authorizeProviders,
-  });
+async function postBatchWithBounded413Recovery({ endpoint, token, threads, fetchImpl, signal, authorizeProviders, recordAttempt }) {
+  await recordAttempt(threads);
+  let response, payload;
+  try {
+    ({ response, payload } = await postThreadBatch({
+      endpoint,
+      token,
+      threads,
+      fetchImpl,
+      signal,
+      allow413: true,
+      authorizeProviders,
+    }));
+  } catch (error) {
+    if (error?.definitePreAdmission === true) await recordAttempt(threads, true);
+    throw error;
+  }
   if (response.status !== 413) {
-    validateThreadBatchAcknowledgement(payload, threads);
+    const partition = validateReceiptPartition(payload, threads.map(receiptMetadata));
+    if (partition.pending > 0 || payload?._receiptPending === true) {
+      return { uploaded: 0, pending_receipts: threads.map(receiptMetadata) };
+    }
+    if (partition.notFound > 0) throwIncompleteAcknowledgement();
     return { uploaded: threads.length };
   }
+  await recordAttempt(threads, true);
   if (threads.length > 1) {
     const middle = Math.ceil(threads.length / 2);
     const left = await postBatchWithBounded413Recovery({
@@ -336,7 +403,9 @@ async function postBatchWithBounded413Recovery({ endpoint, token, threads, fetch
       fetchImpl,
       signal,
       authorizeProviders,
+      recordAttempt,
     });
+    if (left.pending_receipts?.length) return left;
     const right = await postBatchWithBounded413Recovery({
       endpoint,
       token,
@@ -344,13 +413,19 @@ async function postBatchWithBounded413Recovery({ endpoint, token, threads, fetch
       fetchImpl,
       signal,
       authorizeProviders,
+      recordAttempt,
     });
-    return { uploaded: left.uploaded + right.uploaded };
+    return {
+      uploaded: left.uploaded + right.uploaded,
+      pending_receipts: [...(left.pending_receipts || []), ...(right.pending_receipts || [])],
+    };
   }
-  throw new Error(
+  const error = new Error(
     "Work-pattern observation chunk was rejected as too large; "
     + "the complete revision was not acknowledged and will be retried unchanged.",
   );
+  error.definitePreAdmission = true;
+  throw error;
 }
 
 async function postThreadBatch({
@@ -366,46 +441,171 @@ async function postThreadBatch({
   if (Buffer.byteLength(body, "utf8") > MAX_GATEWAY_BODY_BYTES) {
     throw new Error("Work-pattern observation payload exceeds the local CLI gateway limit.");
   }
-  await authorizeProviders();
-  const response = await fetchImpl(endpoint, {
-    method: "POST",
-    headers: webApiHeaders({ token }, { "Content-Type": "application/json" }),
-    body,
-    signal: signalWithTimeout(signal, 120_000),
-  });
+  try {
+    await authorizeProviders();
+  } catch (error) {
+    error.definitePreAdmission = true;
+    throw error;
+  }
+  let response;
+  try {
+    response = await fetchImpl(endpoint, {
+      method: "POST",
+      headers: webApiHeaders({ token }, { "Content-Type": "application/json" }),
+      body,
+      signal: signalWithTimeout(signal, 120_000),
+    });
+  } catch (error) {
+    if (signal?.aborted || !isTimeout(error)) throw error;
+    const polled = await pollTimedOutReceipt({ endpoint, token, threads, fetchImpl, signal, authorizeProviders });
+    return polled.pending
+      ? { response: polled.response, payload: { ...polled.payload, _receiptPending: true } }
+      : polled;
+  }
   const payload = await response.json().catch(() => null);
   if (!response.ok && !(allow413 && response.status === 413)) {
-    throw new Error(webApiErrorMessage(payload, response.status));
+    if (response.status >= 500 || response.status === 408 || response.status === 429) {
+      const polled = await pollTimedOutReceipt({ endpoint, token, threads, fetchImpl, signal, authorizeProviders });
+      return polled.pending
+        ? { response: polled.response, payload: { ...polled.payload, _receiptPending: true } }
+        : polled;
+    }
+    const error = new Error(webApiErrorMessage(payload, response.status));
+    error.definitePreAdmission = response.status >= 400 && response.status < 500 && response.status !== 409;
+    throw error;
   }
   return { response, payload };
 }
 
+function isTimeout(error) {
+  return error?.name === "TimeoutError" || error?.name === "AbortError";
+}
+
+async function pollTimedOutReceipt({ endpoint, token, threads, receipts, fetchImpl, signal, authorizeProviders }) {
+  const expectedReceipts = receipts || threads.map(receiptMetadata);
+  const batches = receiptBatches(expectedReceipts);
+  await authorizeProviders();
+  const responses = [];
+  let hasPending = false;
+  for (const batch of batches) {
+    const response = await fetchImpl(new URL("status/", endpoint), {
+      method: "POST",
+      headers: webApiHeaders({ token }, { "Content-Type": "application/json" }),
+      body: JSON.stringify({ receipts: batch }),
+      signal: signalWithTimeout(signal, 5_000),
+    });
+    const payload = await response.json().catch(() => null);
+    if (!response.ok) throw new Error(webApiErrorMessage(payload, response.status));
+    const partition = validateReceiptPartition(payload, batch);
+    if (partition.notFound > 0) throwIncompleteAcknowledgement();
+    hasPending ||= partition.pending > 0;
+    responses.push({ response, payload });
+  }
+  const last = responses.at(-1);
+  return hasPending
+    ? { response: last.response, payload: last.payload, pending: true }
+    : { response: last.response, payload: last.payload };
+}
+
 function validateThreadBatchAcknowledgement(payload, threads) {
+  const partition = validateReceiptPartition(payload, threads.map(receiptMetadata));
+  if (partition.pending > 0 || partition.notFound > 0) throwIncompleteAcknowledgement();
+}
+
+function validateReceiptPartition(payload, expectedReceipts) {
+  const accepted = Array.isArray(payload?.accepted_receipts) ? payload.accepted_receipts : [];
+  const pending = Array.isArray(payload?.pending_receipts) ? payload.pending_receipts : [];
+  const notFound = Array.isArray(payload?.not_found_receipts) ? payload.not_found_receipts : [];
   if (
-    payload?.raw_content_persisted !== false ||
-    !Number.isInteger(payload?.accepted) ||
-    payload.accepted !== threads.length ||
-    !Array.isArray(payload.accepted_receipts) ||
-    payload.accepted_receipts.length !== threads.length
-  ) {
+    payload?.raw_content_persisted !== false
+    || !Number.isInteger(payload?.accepted)
+    || payload.accepted !== accepted.length
+    || (payload?.pending !== undefined && (!Number.isInteger(payload.pending) || payload.pending !== pending.length))
+    || (payload?.not_found !== undefined && (!Number.isInteger(payload.not_found) || payload.not_found !== notFound.length))
+  ) throwIncompleteAcknowledgement();
+  const expected = expectedReceipts.map(receiptKey).sort();
+  const actual = [...accepted, ...pending, ...notFound].map(receiptKey).sort();
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
     throwIncompleteAcknowledgement();
   }
-  const expected = threads.map(threadReceiptKey).sort();
-  const actual = payload.accepted_receipts.map(receiptKey).sort();
-  for (let index = 0; index < expected.length; index += 1) {
-    if (actual[index] !== expected[index]) throwIncompleteAcknowledgement();
-  }
+  if (new Set(actual).size !== actual.length) throwIncompleteAcknowledgement();
+  return { accepted: accepted.length, pending: pending.length, notFound: notFound.length };
 }
 
 function threadReceiptKey(thread) {
-  return receiptKey({
+  return receiptKey(receiptMetadata(thread));
+}
+
+function receiptMetadata(thread) {
+  return {
     source_ref: thread.source_ref,
     revision_ref: thread.revision_ref,
     lineage_ref: thread.lineage_ref,
     chunk_index: thread.chunk_index,
     chunk_count: thread.chunk_count,
     message_offset: thread.message_offset,
-    message_count: Array.isArray(thread.messages) ? thread.messages.length : -1,
+    message_count: Array.isArray(thread.messages)
+      ? thread.messages.length
+      : (Number.isInteger(thread.message_count) ? thread.message_count : -1),
+    extraction_policy: thread.extraction_policy,
+  };
+}
+
+function pendingReceiptMetadata(receipts) {
+  if (receipts === undefined) return [];
+  if (!Array.isArray(receipts)) {
+    throw new Error("Pending work-pattern receipt state is invalid; history was not resent.");
+  }
+  return receipts.map((receipt) => {
+    if (
+      !/^(?:codex|claude):[0-9a-f]{64}$/.test(receipt?.source_ref || "")
+      || !/^(?:codex|claude):[0-9a-f]{64}$/.test(receipt?.lineage_ref || "")
+      || !/^[0-9a-f]{64}$/.test(receipt?.revision_ref || "")
+      || receipt?.extraction_policy !== HISTORY_EXTRACTION_POLICY
+      || !Number.isInteger(receipt?.chunk_index)
+      || !Number.isInteger(receipt?.chunk_count)
+      || !Number.isInteger(receipt?.message_offset)
+      || !Number.isInteger(receipt?.message_count)
+    ) {
+      throw new Error("Pending work-pattern receipt state is invalid; history was not resent.");
+    }
+    return receipt;
+  });
+}
+
+function receiptBatches(receipts) {
+  const batches = [];
+  let batch = [];
+  for (const receipt of receipts) {
+    const candidate = [...batch, receipt];
+    if (candidate.length > MAX_STATUS_RECEIPTS || Buffer.byteLength(JSON.stringify({ receipts: candidate }), "utf8") > MAX_STATUS_BODY_BYTES) {
+      if (batch.length === 0) throw new Error("Work-pattern receipt metadata exceeds the local gateway limit.");
+      batches.push(batch);
+      batch = [receipt];
+    } else {
+      batch = candidate;
+    }
+  }
+  if (batch.length > 0) batches.push(batch);
+  return batches;
+}
+
+async function writePendingReceiptState({ statePath, lookbackDays, providers, receipts, now }) {
+  await writeSyncState(statePath, {
+    schema_version: STATE_SCHEMA_VERSION,
+    lookback_days: lookbackDays,
+    providers,
+    pending_receipts: receipts,
+    last_synced_at: new Date(now).toISOString(),
+  });
+}
+
+async function clearPendingReceiptState({ statePath, lookbackDays, providers, now }) {
+  await writeSyncState(statePath, {
+    schema_version: STATE_SCHEMA_VERSION,
+    lookback_days: lookbackDays,
+    providers,
+    last_synced_at: new Date(now).toISOString(),
   });
 }