@awak-app/simy-cli 0.7.22 → 0.7.23

package/README.md

@@ -1,5 +1,18 @@
 # SIMY CLI
 
+**Copy connection URL / 接続用URLをコピー** copies the current SIMY authentication
+link, including its pending organization selection. It is available while waiting
+for the browser and in settings. Paste it into Chrome if automatic opening fails.
+**Copy workspace URL** continues to copy only the Web workspace address.
+This signs the desktop into SIMY; browser automation uses its own provider connection.
+
+Technical coding failures retain their task and retry after a persisted 5–30 minute
+cooldown. Automatic recovery preserves the original goal, usage limits, provider
+connection and explicit stops. Enabling automatic continuation can also adopt an
+ordinary loop waiting for an external dependency, starting with read-only inspection.
+A damaged provider-link file can be repaired by **Connect SIMY** for that provider;
+the original file is retained and the other provider stays disconnected.
+
 ### Experimental delegated approval and input bridge
 
 `simy delivery interactions proxy --policy-file /absolute/private/policy.json`
@@ -93,17 +106,15 @@ Both providers share one analysis deadline. A deterministic provider failure pau
 new claims and retains failed history until environment/settings change or **Retry
 analysis** is selected.
 
-After **6 consecutive SQM analysis failures**, this machine stops claiming new
-SQM analyses for the current Web/account/organization. Codex and Claude share the
-counter; a completed analysis resets it. Empty polls and user cancellations do
-not change it. The pause and partial failure count survive restart, sign-in and
-provider changes. A review interrupted by a host exit counts once on restart;
-graceful cancellation clears that unfinished marker without changing the count.
-Reconnecting or selecting Retry cannot clear this pause.
-Installing and running a **newer SIMY version** resets the counter and resumes
-claims automatically, subject to normal organization access and analysis settings.
-The native organization menu shows when an update is required. This pause does
-not change server analysis consent or stop ordinary implementation tasks.
+After **6 consecutive SQM analysis failures**, this machine waits before its next
+SQM claim for the current Web/account/organization. Codex and Claude share the
+counter; a completed analysis resets it. The cooldown increases from 5 to 30
+minutes and survives restart. Empty polls and reconnects do not reset failures.
+Retries resume automatically while analysis and the provider connection remain
+enabled. Authentication requiring the account holder remains a sign-in wait.
+The server's durable recovery migration requeues the same failed job and retains
+its input, history and attempt count; it is required to recover jobs previously
+held by the server's lifetime retry cap.
 
 Agentic Loop preflight accepts the task's existing requirement, acceptance
 criteria, required checks and charter context alongside the repository/provider.
@@ -1020,12 +1031,15 @@ records cannot be recovered.
 History remains visible with local analysis off and after restarting. A saved
 in-flight analysis is shown as Interrupted until this client claims it again;
 it does not contribute to the running count. The web workspace owns retry status.
-Model/provider execution failures permit one recovery claim after a five-minute
-cooldown, even when the app/account identity is unchanged. If that attempt fails
-again, the pause survives reconnects and host restarts until a newer SIMY version
-is installed. Sign-in, local installation, SIMY access, schema and persistence
-errors do not open this automatic provider recovery path. The existing six-failure
-circuit still protects other analysis failures.
+Model/provider execution failures permit a recovery claim after a five-minute
+cooldown, even when the app/account identity is unchanged. Repeated provider
+failures or six consecutive analysis failures schedule further automatic recovery
+with a persisted 5–30 minute backoff. Reconnects, restarts, empty claims and
+cancelled work do not reset the failure counters or cooldown. Only a successful
+review or a newer SIMY version clears the circuit. Authentication interaction,
+local installation, SIMY access and persistence requirements remain enforced;
+waiting does not grant permission. Turning analysis off or disconnecting its
+provider still prevents new work.
 
 Only summary metadata is retained, without analysis prompts, source inputs,
 model responses or credentials. Historical summaries are not a replacement for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awak-app/simy-cli",
-  "version": "0.7.22",
+  "version": "0.7.23",
   "description": "Local SIMY executor for non-coding Local Tasks and Agentic Loop runs.",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
   ],
   "scripts": {
     "start": "node ./src/index.js",
-    "test": "node --test --test-concurrency=2",
+    "test": "node --import ./test/isolate-simy-home.mjs --test --test-concurrency=2",
     "test:e2e:console": "node ./scripts/console-e2e.js",
     "test:e2e:work-activity": "node ./scripts/work-activity-e2e.js",
     "test:e2e:sqm-complete-loop": "node ./scripts/sqm-complete-loop-e2e.js",

package/src/agent.js

@@ -18,6 +18,7 @@ import { createDesktopAccessPolicy, desktopAccessReady, requireDesktopAccess } f
 import { readSqmEnabled, writeSqmEnabled, readSqmSettings, writeSqmEngineFallback } from "./desktop-sqm-settings.js";
 import { createServer } from "node:http";
 import { createHash, randomBytes } from "node:crypto";
+import { canRecoverCodingRun, codingRecoveryDue, codingRecoveryLinksMatch } from './coding-run-automatic-recovery.js';
 import { createReadStream } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 
@@ -35,6 +36,7 @@ import {
   prepareLocalCodingRunRecovery,
   reconcileLocalCodingRun,
   recoverCompletedLocalCodingRun,
+  recoverLocalCodingRun,
   queueLocalCodingGuidance,
   recheckLocalCodingRun,
   publishRestoredLocalCodingRun,
@@ -545,7 +547,7 @@ export async function startAgent({
     return inspection;
   };
 
-  const requireRunProvider = async (run, { backend = run.request.backend } = {}) => {
+  const requireRunProvider = async (run, { backend = run.request.backend, automatic = false } = {}) => {
     const scope = await authorizeDesktopWork();
     const inspection = await inspectReadyBackend(backend, { force: true });
     await authorizeDesktopWork(scope);
@@ -555,18 +557,19 @@ export async function startAgent({
         code: `desktop_executor_${inspection.status}`,
       });
     }
-    await bindRunAuthorization(run, scope, inspection, backend);
+    await bindRunAuthorization(run, scope, inspection, backend, !automatic);
   };
 
   const authorizeProviderDispatch = async (backend, scope, link) => {
     await authorizeDesktopWork(scope);
     await requireLinkedProvider(backend, link);
   };
-  const bindRunAuthorization = async (run, scope, inspection, backend = run.request.backend) => {
+  const bindRunAuthorization = async (run, scope, inspection, backend = run.request.backend, rememberConnection = true) => {
     const links = await readProviderLinks(sessionRoot);
     links[backend] = inspectedLinks.get(inspection);
     await authorizeProviderDispatch(backend, scope, links[backend]);
     runAuthorizations.set(run, { scope, links });
+    if (rememberConnection) run.snapshot.metadata.provider_link_epochs = Object.fromEntries(Object.entries(links).map(([provider, link]) => [provider, link.epoch]));
   };
   const providerRuntimeOptions = (task, options = {}, scope, link) => {
     const guard = () => authorizeProviderDispatch(task.backend, scope, link);
@@ -868,13 +871,29 @@ export async function startAgent({
     }
   };
 
+  const automaticCodingRecoveries = new WeakSet();
   const monitorCodingRuns = () => {
     if (!desktopWorkAllowed()) return Promise.resolve();
-    if (!daemon || !isSessionValid(session, Date.now(), apiOrigin)) return Promise.resolve();
+    if (!isSessionValid(session, Date.now(), apiOrigin)) return Promise.resolve();
     if (codingRunMonitorInFlight) return codingRunMonitorInFlight;
     codingRunMonitorInFlight = (async () => {
       for (const run of registry.list()) {
-        if (!["pr_ready_for_review", "merge_ready"].includes(run.status) || run.operation || run.child) continue;
+        if (canRecoverCodingRun(run) && !automaticCodingRecoveries.has(run) && (!run.snapshot.metadata?.automatic_recovery || codingRecoveryDue(run))) {
+          automaticCodingRecoveries.add(run);
+          void withUpdateWork(updateManager, async () => {
+            if (!sameRunScope(run.session, session) || run.apiOrigin !== apiOrigin) return;
+            const saved = { charter: run.snapshot.charter, metadata: { ...run.snapshot.metadata } };
+            if (!codingRecoveryLinksMatch(saved, await readProviderLinks(sessionRoot))) return;
+            await requireRunProvider(run, { automatic: true });
+            if (!codingRecoveryLinksMatch(saved, await readProviderLinks(sessionRoot))) return;
+            // Each run owns its operation promise; a slow repair must not
+            // prevent the monitor from advancing independent tasks.
+            await recoverLocalCodingRun(run, codingRuntimeOptions(run));
+          }).catch(error => reportStartupConnectionError(error, quiet))
+            .finally(() => automaticCodingRecoveries.delete(run));
+          continue;
+        }
+        if (!daemon || !["pr_ready_for_review", "merge_ready"].includes(run.status) || run.operation || run.child) continue;
         try {
           await (dependencies.recheckCodingRun || recheckAuthorizedCodingRun)(run);
         } catch (error) {
@@ -887,7 +906,7 @@ export async function startAgent({
 
   const startCodingRunMonitor = () => {
     if (!desktopWorkAllowed()) return;
-    if (!daemon || codingRunMonitorTimer) return;
+    if (codingRunMonitorTimer) return;
     codingRunMonitorTimer = setInterval(() => {
       void monitorCodingRuns().catch((error) => reportStartupConnectionError(error, quiet));
     }, dependencies.codingRunMonitorIntervalMs || CODING_RUN_MONITOR_INTERVAL_MS);
@@ -1140,6 +1159,7 @@ export async function startAgent({
       getHistoryScope: () => sqmHistoryScope(apiOrigin, session),
       getRecoveryKey: (provider) => providerRecoveryRevisions[provider] ?? 0,
       recordHistory: (scope, item) => sqmHistory.record(scope, item),
+      readHistory: scope => sqmHistory.items(scope),
       onHistoryError: () => { if (!quiet) console.error("Could not save the local SQM analysis history."); },
       getProvider: () => !desktopWorkAllowed() || availableCapabilities?.features?.sqm_local_review !== true ? null : ["codex", "claude"].find(
         (provider) => providerLinks[provider]?.connected === true && availableCapabilities?.backends?.[provider] === true &&
@@ -2353,7 +2373,7 @@ export async function startAgent({
               : [],
             required_checks: Array.isArray(body.required_checks) ? body.required_checks : [],
             independent_review_required: body.independent_review_required === true,
-            require_human_approval: body.require_human_approval !== false,
+            require_human_approval: body.require_human_approval === true,
             design_summary:
               typeof body.design_summary === "string" ? body.design_summary : "",
             design_review_approved_by:
@@ -3049,7 +3069,7 @@ export async function startAgent({
           expected_tests: [],
           expected_evidence: [],
           required_checks: [],
-          require_human_approval: true,
+          require_human_approval: input.require_human_approval === true,
           must_not: [],
           attachments: await referenceLocalAttachmentPaths(input.attachmentPaths || []),
         };

package/src/cli-contract.js

@@ -14,7 +14,7 @@ import {
 } from "./durable-local-task-steps-contract.js";
 import { buildExecutionCapabilityContract } from "./execution-capability-contract.js";
 
-export const CLI_VERSION = "0.7.22";
+export const CLI_VERSION = "0.7.23";
 export const CLI_API_CONTRACT_VERSION = 10;
 
 export function narrativeImageCapabilityMetadata() {

package/src/codex-plugins/simy/hooks/delivery-loop.mjs

@@ -118,7 +118,9 @@ const text = (value, max = 4000) => typeof value === 'string' ? value.trim().sli
 const exactText = value => typeof value === 'string' && Buffer.byteLength(value, 'utf8') <= 1000 ? value : null;
 export function canUpgradeDelivery(run) {
   return Boolean(run && !run.managed && text(run.id) && text(run.objective) && Number.isFinite(run.startedAt) &&
-    Number.isSafeInteger(run.maxFailures) && run.maxFailures > 0 && ['active', 'paused', 'recovery_required'].includes(run.state));
+    Number.isSafeInteger(run.maxFailures) && run.maxFailures > 0 &&
+    (['active', 'paused', 'recovery_required'].includes(run.state) ||
+      run.state === 'blocked' && run.blocker === 'external_dependency'));
 }
 const contextText = (value, max = 500) => text(value, max).replace(/\b(?:sk|key)-[A-Za-z0-9_-]{12,}\b|\bBearer\s+\S+|\b(?:password|token|api[_-]?key)\s*[:=]\s*\S+/gi, '[redacted]');
 export function recordPath(root, provider, session) {

package/src/codex-plugins/simy/hooks/outcome-progress.mjs

@@ -17,7 +17,7 @@ function classifyBlockers(findings) {
     const kind = ["machine", "human", "external"].includes(finding.blocker_kind)
       ? finding.blocker_kind
       : finding.repairability === "external" ? "external"
-      : finding.repairability === "manual" ? "human" : "machine";
+      : "machine";
     blockers[kind].push({
       code: text(finding.code) || "OUTCOME_UNPROVEN",
       target: text(finding.target) || null,

package/src/codex-plugins/simy/hooks/update-dispatch-gate.mjs

@@ -11,9 +11,10 @@ export const detachmentRoot = () => resolve(process.env.SIMY_HOME?.trim() || joi
 export const rootFromDelivery = root => basename(resolve(root)) === 'delivery-hooks' ? dirname(resolve(root)) : resolve(root);
 const path = root => join(resolve(root), 'update-detachment', 'gate.json');
 function read(root) {
-  const state = readState(path(root), { versions: [1, 2] }) || { schemaVersion: 1, revision: 0, generation: 0, connection: 'connected', attempts: {}, receipts: {}, events: {} };
+  const state = readState(path(root), { versions: [1, 2, 3] }) || { schemaVersion: 1, revision: 0, generation: 0, connection: 'connected', attempts: {}, receipts: {}, events: {} };
   if (!Number.isSafeInteger(state.generation) || !Number.isSafeInteger(state.revision) || !CONNECTION_STATES.includes(state.connection) || !['attempts', 'receipts', 'events'].every(key => isMap(state[key])) || (state.hookOwners !== undefined && !isMap(state.hookOwners)) || !Object.values(state.attempts).every(attempt => isMap(attempt) && typeof attempt.id === 'string' && Number.isSafeInteger(attempt.generation) && ['intent','sending','sent','provider_identified','result_saved','confirmed'].includes(attempt.phase))) fail('invalid_state');
-  if ((state.schemaVersion === 2 && ![2, 3].includes(state.minimumDispatchProtocol)) || (state.minimumDispatchProtocol !== undefined && ![2, 3].includes(state.minimumDispatchProtocol))) fail('writer_protocol_incompatible');
+  if ((state.schemaVersion >= 2 && ![2, 3].includes(state.minimumDispatchProtocol)) || (state.minimumDispatchProtocol !== undefined && ![2, 3].includes(state.minimumDispatchProtocol))) fail('writer_protocol_incompatible');
+  validateRecoveryFences(state);
   validateTaskFences(state, root);
   return state;
 }
@@ -31,7 +32,7 @@ export function transitionConnection({ root = detachmentRoot(), expectedRevision
     if (state.revision !== expectedRevision) fail('revision_conflict');
     const allowed = { connected: ['detaching'], ready: ['connected', 'detaching'], detaching: ['detached', 'recovery_required'], detached: ['reconciling'], reconciling: ['ready', 'recovery_required'], recovery_required: ['reconciling', 'detaching'] };
     if (!allowed[state.connection]?.includes(connection)) fail('invalid_transition');
-    if (connection === 'detaching') { state.generation++; state.schemaVersion = 2; state.minimumDispatchProtocol = DISPATCH_PROTOCOL; }
+    if (connection === 'detaching') { state.generation++; state.schemaVersion = Math.max(2, state.schemaVersion); state.minimumDispatchProtocol = DISPATCH_PROTOCOL; }
     state.connection = connection; state.revision++;
     if (eventId) state.events[digest(eventId)] = { revision: state.revision };
     atomicSave(path(root), state); return state;
@@ -221,7 +222,7 @@ export function prepareUpgradeFence({ root = detachmentRoot(), expectedRevision,
     const state = read(root); validateWriters(state, writers);
     if (state.revision !== expectedRevision) fail('revision_conflict');
     if (!['connected', 'ready', 'recovery_required'].includes(state.connection)) fail('invalid_transition');
-    state.generation++; state.schemaVersion = 2; state.minimumDispatchProtocol = DISPATCH_PROTOCOL;
+    state.generation++; state.schemaVersion = Math.max(2, state.schemaVersion); state.minimumDispatchProtocol = DISPATCH_PROTOCOL;
     state.connection = 'detaching'; state.revision++; atomicSave(path(root), state); return state;
   });
 }
@@ -252,6 +253,12 @@ function validateTaskFences(state, root) {
   }
 }
 function assertTaskAdmissionState(state, { taskId, identity = null }) {
+  for (const item of Object.values(state.recoveryFences?.items || {})) {
+    if (item.taskHash === digest(taskId) || identity && (item.identityHash === digest(identity) ||
+      item.sessions.some(target => target.provider === identity.provider && target.session === identity.session))) {
+      fail('dispatch_history_quarantined');
+    }
+  }
   const records = state.taskFences?.records || {};
   if (!identity) {
     if (Object.values(records).some(item => item.taskId === taskId)) fail('task_admission_identity_required');
@@ -276,7 +283,9 @@ export function readTaskAdmission({ root = detachmentRoot(), identity, taskId })
   identity = storedFenceIdentity(identity, root);
   if (identity.root !== realpathSync(root)) fail('identity_root_mismatch');
   const state = read(root), record = state.taskFences?.records[fenceKey(identity, taskId)] || null;
-  return { revision: state.revision, generation: state.generation, record, canResume: ['connected', 'ready'].includes(state.connection) && (!record || record.status === 'admitted' && record.generation === state.generation && admissionWriterMatches(state, record)) };
+  let historyAdmitted = true;
+  try { assertTaskAdmissionState(state, {taskId, identity}); } catch (error) { if (error.code !== 'dispatch_history_quarantined' && error.code !== 'task_admission_blocked') throw error; historyAdmitted = false; }
+  return { revision: state.revision, generation: state.generation, record, canResume: historyAdmitted && ['connected', 'ready'].includes(state.connection) && (!record || record.status === 'admitted' && record.generation === state.generation && admissionWriterMatches(state, record)) };
 }
 function checkAdmissionOwner(state, owner, identity, taskId, expectedRevision) {
   if (!owner || owner.root !== identity.root || owner.protocol !== DISPATCH_PROTOCOL || owner.generation !== state.generation) fail('owner_fenced');
@@ -295,7 +304,7 @@ export function setTaskAdmissionFence({ owner, identity, taskId, expectedRevisio
     state.taskFences ||= { version: 1, records: {} };
     state.taskFences.records[key] = { version: 1, identity, identityHash: digest(identity), taskId, taskHash: digest(taskId), generation: state.generation, revision: (previous?.revision || 0) + 1, status: 'blocked', reason: { ...reason }, createdAt: Date.now(), admission: null };
     // v2 writers validate minimumDispatchProtocol and cannot ignore taskFences.
-    state.schemaVersion = 2; state.minimumDispatchProtocol = 3; state.revision++;
+    state.schemaVersion = Math.max(2, state.schemaVersion); state.minimumDispatchProtocol = 3; state.revision++;
     atomicSave(path(identity.root), state); return state;
   });
 }
@@ -324,3 +333,77 @@ export async function admitTaskDispatch({ owner, identity, taskId, expectedRevis
     atomicSave(path(identity.root), state); return state;
   } finally { release(); }
 }
+
+// Historical evidence without a provable result is retained, never replayed or
+// called completed. A schema fence makes every pre-recovery binary fail closed.
+function validateRecoveryFences(state) {
+  if (state.schemaVersion !== 3 && state.recoveryFences === undefined) return;
+  const recovery = state.recoveryFences;
+  if (state.schemaVersion !== 3 || !recovery || recovery.version !== 1 || !isMap(recovery.items) ||
+      typeof recovery.auditRef !== 'string' || !/^[a-f0-9]{64}$/.test(recovery.auditDigest || '')) fail('recovery_fence_invalid');
+  for (const [key, item] of Object.entries(recovery.items)) {
+    const attempt = state.attempts[key];
+    if (!attempt || item.taskHash !== attempt.taskHash || item.identityHash !== attempt.identityHash ||
+        !/^[a-f0-9]{64}$/.test(item.attemptDigest || '') || !Array.isArray(item.sessions) ||
+        item.sessions.some(target => !['codex','claude'].includes(target.provider) || typeof target.session !== 'string' || !target.session)) fail('recovery_fence_invalid');
+  }
+}
+export function unresolvedDispatchAttempts(state) {
+  return Object.entries(state.attempts).filter(([key, attempt]) => attempt.phase !== 'confirmed' &&
+    state.recoveryFences?.items?.[key]?.attemptDigest !== digest(attempt)).map(([, attempt]) => attempt);
+}
+export function reconcileDispatchHistory({root = detachmentRoot(), expectedRevision, expectedGeneration, auditRef, auditDigest}) {
+  // Exclude a live update/reconnect owner as well as simultaneous dispatches.
+  const release = acquireLock(join(root, 'update-detachment', 'coordinator'));
+  try { return withLock(path(root), () => {
+    const state = read(root);
+    if (state.revision !== expectedRevision || state.generation !== expectedGeneration) fail('revision_conflict');
+    if (state.connection !== 'recovery_required') fail('reconciliation_required');
+    const auditPath = resolve(auditRef || '');
+    if (!auditPath.startsWith(resolve(root, 'update-detachment', 'recovery') + '/') || realpathSync(auditPath) !== auditPath) fail('recovery_audit_invalid');
+    const bytes = readFileSync(auditPath);
+    if (createHash('sha256').update(bytes).digest('hex') !== auditDigest) fail('recovery_audit_changed');
+    const audit = JSON.parse(bytes);
+    if (audit.version !== 1 || audit.gateDigest !== digest(state) || !Array.isArray(audit.items) ||
+        audit.items.length !== Object.keys(state.attempts).length) fail('recovery_audit_invalid');
+    const items = {}, seen = new Set(), settled = [];
+    for (const item of audit.items) {
+      const key = digest(item.attemptId), attempt = state.attempts[key];
+      if (!attempt || seen.has(key) || item.attemptDigest !== digest(attempt)) fail('recovery_attempt_changed');
+      seen.add(key);
+      if (item.disposition === 'already_confirmed' && attempt.phase === 'confirmed') continue;
+      if (item.disposition === 'saved_terminal_result') {
+        const evidence = item.evidence;
+        if (!evidence || !attempt.provenance || evidence.ref !== attempt.provenance.recordRef ||
+            !Object.values(state.receipts).some(receipt => receipt.attemptId === attempt.id && receipt.generation === attempt.generation && receipt.resultRef === evidence.ref)) fail('recovery_result_unbound');
+        if (!resolve(evidence.ref).startsWith(resolve(root, 'direct-tasks') + '/') || realpathSync(evidence.ref) !== evidence.ref) fail('recovery_result_scope');
+        const source = readFileSync(evidence.ref);
+        if (createHash('sha256').update(source).digest('hex') !== evidence.sha256) fail('recovery_result_changed');
+        const result = JSON.parse(source), match = /^(.*):provider:([1-9][0-9]*)$/.exec(attempt.id);
+        if (!match || result.id !== match[1] || digest(result.id) !== attempt.taskHash ||
+            result.id !== attempt.provenance.taskId || result.invocation_count !== Number(match[2]) ||
+            !['succeeded','failed','stopped'].includes(result.status)) fail('recovery_result_unbound');
+        settled.push(attempt);
+      } else if (item.disposition === 'retain_blocked_unknown') {
+        const sessions = [];
+        if (attempt.provenance?.providerSession) sessions.push({provider:attempt.provenance.context.provider,session:attempt.provenance.providerSession});
+        // Recover the parent identity only from its original canonical record.
+        const ref = attempt.provenance?.recordRef;
+        if (ref?.startsWith(resolve(root, 'delivery-hooks') + '/')) {
+          try { const record = JSON.parse(readFileSync(ref));
+            if (record.run?.managed?.taskId === attempt.provenance.taskId && record.provider === attempt.provenance.context.provider &&
+                basename(ref) === createHash('sha256').update(record.provider + '\0' + record.session).digest('hex') + '.json') sessions.push({provider:record.provider,session:record.session});
+          } catch { /* Missing parent never authorizes an inferred identity. */ }
+        }
+        items[key] = {taskHash:attempt.taskHash,identityHash:attempt.identityHash,attemptDigest:digest(attempt),sessions};
+      } else fail('recovery_disposition_invalid');
+    }
+    for (const attempt of settled) attempt.phase = 'confirmed';
+    state.schemaVersion = 3; state.minimumDispatchProtocol = 3;
+    state.generation++; state.revision++;
+    state.recoveryFences = {version:1,auditRef:auditPath,auditDigest,items};
+    validateRecoveryFences(state);
+    atomicSave(path(root), state);
+    return {settled:settled.length,blocked:Object.keys(items).length,revision:state.revision,generation:state.generation,replayAttempts:false};
+  }); } finally { release(); }
+}

package/src/coding-run-automatic-recovery.js

@@ -0,0 +1,40 @@
+import { budgetState } from './orchestrator/budget.js';
+
+const BASE_DELAY = 5 * 60_000;
+const MAX_DELAY = 30 * 60_000;
+const MACHINE_STOPS = new Set(['outcome_progress_stalled', 'retry_circuit_open']);
+
+export function canRecoverCodingRun(run) {
+  const snapshot = run.snapshot;
+  return run.status === 'blocked' && !run.stopRequested &&
+    !['paused', 'stopped', 'stopping'].includes(run.controlState) &&
+    !snapshot.metadata?.local_stop_requested && !run.operation && !run.child &&
+    snapshot.final_audit?.requires_human === false &&
+    MACHINE_STOPS.has(snapshot.events?.at(-1)?.detail?.code) &&
+    !budgetState(snapshot).exhausted;
+}
+
+export function scheduleCodingRecovery(snapshot, now = Date.now()) {
+  const count = (snapshot.metadata?.automatic_recovery?.count || 0) + 1;
+  snapshot.metadata ??= {};
+  snapshot.metadata.automatic_recovery = {
+    count,
+    next_retry_at: now + Math.min(MAX_DELAY, BASE_DELAY * 2 ** Math.min(count - 1, 3)),
+  };
+}
+
+export function codingRecoveryDue(run, now = Date.now()) {
+  return canRecoverCodingRun(run) &&
+    Number.isFinite(run.snapshot.metadata?.automatic_recovery?.next_retry_at) &&
+    now >= run.snapshot.metadata.automatic_recovery.next_retry_at;
+}
+
+export function codingRecoveryLinksMatch(snapshot, links) {
+  return [snapshot.charter.backend, snapshot.charter.audit_backend].filter(Boolean).every(provider => {
+    const link = links[provider];
+    const saved = snapshot.metadata?.provider_link_epochs;
+    return link?.connected === true && (saved && Object.hasOwn(saved, provider)
+      ? saved[provider] === link.epoch
+      : link.epoch === null && link.requiresConsent === false);
+  });
+}

package/src/console/app.js

@@ -1147,6 +1147,7 @@ function statusLabel(run) {
   if (run.controlState === "stopping") return "Stopping";
   if (run.controlState === "stopped" || run.status === "stopped") return "Stopped";
   if (run.status === "pr_ready_for_review") return "PR ready · Review needed";
+  if (run.status === 'blocked' && run.snapshot?.final_audit?.requires_human === false) return 'Blocked';
   if (run.controlState === "waiting_human" || run.status === "waiting_human") {
     return "Waiting for you";
   }
@@ -1181,6 +1182,10 @@ function nextActionForRun(run, repositoryMissing = false) {
       text: "Review the final evidence and merge the pull request when ready.",
     };
   }
+  const latestRecovery = [...(run.snapshot?.events || [])].reverse().find(event => event.detail?.recovery)?.detail.recovery;
+  if (run.status === "blocked" && ['machine_recovery_pending', 'machine_recovery_exhausted'].includes(latestRecovery?.reason_code) && latestRecovery.requires_user_action === false) {
+    return { tone: latestRecovery.reason_code === 'machine_recovery_pending' ? 'yellow' : 'red', text: latestRecovery.user_message };
+  }
   if (run.controlState === "waiting_human" || run.status === "waiting_human") {
     return { tone: "yellow", text: "Press i, type your guidance or approval, then press Enter." };
   }

package/src/delivery-hooks/command.js

@@ -45,6 +45,18 @@ function parseDeliveryOptions(args, allowed) {
 
 export async function runDeliveryCommand(argv, { root = rootDirectory(), cwd = process.cwd(), webOrigin, input = process.stdin, output = console.log } = {}) {
   const [action, ...args] = argv;
+  if (action === 'history-recovery') {
+    const [operation,...flags] = args;
+    const options = parseDeliveryOptions(flags,new Set(['audit','digest']));
+    const recovery = await import('../update-detachment/history-recovery.js');
+    const parentRoot = dirname(root);
+    let result;
+    if (operation === 'plan') result = await recovery.planDispatchHistoryRecovery({root:parentRoot});
+    else if (operation === 'apply') result = await recovery.applyDispatchHistoryRecovery({root:parentRoot,auditRef:options.audit,auditDigest:options.digest});
+    else if (operation === 'reconnect') result = await recovery.reconnectRecoveredHistory({root:parentRoot,origin:webOrigin});
+    else throw new Error('Use simy delivery history-recovery plan|apply --audit PATH --digest SHA256|reconnect.');
+    output(JSON.stringify(result,null,2)); return 0;
+  }
   if (action === 'auto') {
     const [operation, ...flags] = args;
     if (!['on', 'off', 'status'].includes(operation)) throw new Error('Use simy delivery auto on|off|status --provider codex|claude in the project directory.');

package/src/delivery-hooks/supervisor.js

@@ -1,5 +1,5 @@
 import { captureDispatchProvenance } from '../update-detachment/provenance.js';
-import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, queueDispatchReceipt, rootFromDelivery, observeDispatchEvent } from '../update-detachment/dispatch-gate.js';
+import { captureDispatchOwner, assertTaskAdmission, dispatchWithFence, queueDispatchReceipt, confirmDispatch, rootFromDelivery, observeDispatchEvent } from '../update-detachment/dispatch-gate.js';
 import { bindCompletionArtifacts } from '../session-supervision/completion-artifacts.js';
 import { recoveryWorkProposal, admitRecoveryWork } from '../session-supervision/recovery-frontier.js';
 import { safeCheckpointDiagnostic } from './checkpoint-diagnostic.js';
@@ -480,7 +480,7 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
         else await checkpointDelivery({ root, provider: record.provider, session: record.session, cwd: record.cwd,
           checkpoint: result.checkpoint || parseAgentCheckpoint(result.output, record.session), expectedLease: leaseId, toolEvidence: result.toolEvidence || [], sourceContext: result.sourceContext, controllerEvidence: result.controllerEvidence, now: Date.now() });
         if (result.dispatchAttemptId) queueDispatchReceipt({ root: rootFromDelivery(root), attemptId: result.dispatchAttemptId, receiptId: `checkpoint:${leaseId}`, resultRef: `delivery-record:${record.provider}:${record.session}:${leaseId}` });
-        await updateRecord(root, record.provider, record.session, current => {
+        const checkpointed = await updateRecord(root, record.provider, record.session, current => {
           if (current?.run?.managed?.executionAttempt?.id !== leaseId) return current;
           current.run.managed.executionAttempt.phase = 'checkpointed';
           current.run.managed.executionAttempt.checkpointRevision = current.run.revision;
@@ -501,6 +501,14 @@ export async function tickManagedTasks({ root, webOrigin, now = Date.now(), exec
           }
           return current;
         });
+        // Settle this successful native turn while its exact durable checkpoint
+        // is still current. A later worker replaces executionAttempt, so waiting
+        // until an update boundary would lose the original result association.
+        const savedAttempt = checkpointed?.run?.managed?.executionAttempt;
+        if (result.dispatchAttemptId && checkpointed?.run?.id === claimed.run.id &&
+            savedAttempt?.id === leaseId && result.dispatchAttemptId === leaseId &&
+            savedAttempt.phase === 'checkpointed' && savedAttempt.checkpointRevision === checkpointed.run.revision)
+          confirmDispatch({ root: rootFromDelivery(root), attemptId: result.dispatchAttemptId });
       } catch (error) { result = { ...result, code: -1, errorCode: 'checkpoint_rejected', diagnostic: safeCheckpointDiagnostic(error) }; }
     }
     await updateRecordAfterControl(root, record.provider, record.session, async current => {
@@ -657,8 +665,10 @@ export function createManagedSupervisor(options) {
             // A queue entry is a wakeup, not authority or a saved action. Re-read
             // consent, revisions and task identity at admission and each claim.
             const readRecords = async () => {
-              const rows = options.readRecords ? await options.readRecords()
-                : [await readRecord(options.root, record.provider, record.session)];
+              const rows = options.readCurrentRecord
+                ? [await options.readCurrentRecord(record.provider, record.session)]
+                : options.readRecords ? await options.readRecords()
+                  : [await readRecord(options.root, record.provider, record.session)];
               return rows.filter(row => row?.provider === record.provider && row.session === record.session &&
                 row.run?.id === record.run.id && row.run?.managed?.taskId === record.run.managed.taskId);
             };

package/src/desktop-access.js

@@ -7,7 +7,7 @@ export function validDesktopAccessPath(path, slug) {
   return path === expected || path === `${expected}/`;
 }
 export const desktopAccessReady = value => value?.state === 'ready';
-const recoveryActions = new Set(['refresh', 'reconnect', 'login', 'authorization_open', 'organization_select', 'organization_cancel', 'organizations_refresh',
+const recoveryActions = new Set(['refresh', 'reconnect', 'login', 'authorization_open', 'authorization_copy', 'organization_select', 'organization_cancel', 'organizations_refresh',
   'check_update', 'auto_update_set_enabled', 'update', 'prepare_update_restart', 'quit', 'task_stop', 'delivery_stop', 'delivery_pause', 'delivery_reject',
   'provider_disconnect', 'desktop_access_refresh', 'desktop_access_settings', 'desktop_access_members']);
 export function desktopActionAllowed(access, command) {

package/src/desktop-clipboard.js

@@ -0,0 +1,23 @@
+import { spawn } from 'node:child_process';
+
+// Pass private links over stdin, never in process arguments, status, or logs.
+export function copyDesktopText(text, { platform = process.platform, spawnImpl = spawn } = {}) {
+  const command = platform === 'darwin' ? ['pbcopy', []] : platform === 'win32'
+    ? ['powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', '$inputText = [Console]::In.ReadToEnd(); Set-Clipboard -Value $inputText -ErrorAction Stop']]
+    : ['xclip', ['-selection', 'clipboard']];
+  return new Promise((resolve, reject) => {
+    const child = spawnImpl(command[0], command[1], { stdio: ['pipe', 'ignore', 'ignore'], windowsHide: true });
+    const timer = setTimeout(() => { child.kill(); finish(false); }, 5000);
+    let settled = false;
+    function finish(ok) {
+      if (settled) return;
+      settled = true; clearTimeout(timer);
+      if (ok) resolve();
+      else { child.kill(); reject(Object.assign(new Error('Clipboard unavailable.'), { code: 'desktop_clipboard_unavailable' })); }
+    }
+    child.on('error', () => finish(false));
+    child.on('close', code => finish(code === 0));
+    child.stdin.on('error', () => finish(false));
+    child.stdin.end(text);
+  });
+}

package/src/desktop-host.js

@@ -1,4 +1,5 @@
 import { remoteOperationFailure } from './session-supervision/remote-errors.js';
+import { copyDesktopText } from './desktop-clipboard.js';
 import { createRemoteHostManager } from './session-supervision/remote-hosts.js';
 import { readDesktopAutoUpdate, writeDesktopAutoUpdate } from './desktop-update-settings.js';
 import { createUpdateRuntime } from './update-detachment/runtime.js';
@@ -23,7 +24,7 @@ import { stopDesktopWorkForUpdate } from './desktop-update-stop.js';
 import { desktopAccessReady, desktopActionAllowed, requireDesktopAccess, validDesktopAccessPath } from './desktop-access.js';
 import { createActionDeadlineService } from './session-supervision/action-deadline.js';
 import { deliveryHookStatus, openHookSetup } from "./delivery-hooks/desktop.js";
-import { controlDelivery, verifyDelivery, createRecordReader, updateRecord, recordProviderArchive, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
+import { controlDelivery, verifyDelivery, createRecordReader, readRecord, updateRecord, recordProviderArchive, TERMINAL } from "./codex-plugins/simy/hooks/delivery-loop.mjs";
 import { createManagedSupervisor } from "./delivery-hooks/supervisor.js";
 import { createActionAssociationHost } from "./session-supervision/action-association-host.js";
 import { createStopNotifier } from "./session-supervision/stop-notifications.js";
@@ -105,6 +106,7 @@ function desktopActionError(action, error) {
     };
     if (messages[error?.code]) return messages[error.code];
   }
+  if (action === 'authorization_copy') return 'Could not copy the connection link. Reopen the connection page and try again.';
   if (action === 'authorization_open' || error?.code === 'desktop_browser_unavailable') return "Could not open your browser. Open the verification link again, or check your default browser.";
   if (error?.code === "desktop_access_required") return "Sign in to an organization with SQM and Developer access before using SIMY.";
   if (action === "codex_hooks" || action === "claude_hooks") return "Could not open the setup guide. Check your default browser, or use /hooks inside the provider.";
@@ -409,6 +411,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
       const link = await requireProviderLink({ root: deliveryRoot, provider: record.provider });
       return JSON.stringify([scope, link.epoch]);
     }, readRecords: () => recordReader.list(),
+    readCurrentRecord: (provider, session) => readRecord(deliveryRoot, provider, session),
     beforeClaim: record => actionAssociations.prepareCached?.(record) || record });
   let shuttingDown = null;
   let commands;
@@ -529,7 +532,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
         phase = "authorize_connect";
         await authorizeWork();
         phase = "save_connect";
-        providerLinks = await writeProviderLink(root, provider, true);
+        providerLinks = await writeProviderLink(root, provider, true, { repairInvalidSettings: true });
       }
       delete providerLinkFeedback[provider];
       try { await agent.refreshProviderStatus?.(); }
@@ -1329,6 +1332,11 @@ export async function startDesktopHost({ input = process.stdin, output = process
         else if (action === "sqm_set_engine_fallback") await agent.setSqmEngineFallback({ enabled: command.enabled, allowedProviders: command.allowedProviders });
         else if (action === "sqm_retry_environment") await agent.retrySqmEnvironment();
         else if (action === "organization_cancel") await agent.cancelOrganizationSelection();
+        else if (action === 'authorization_copy') {
+          const url = agent.getPendingAuthorizationUrl?.() || await agent.requestDesktopLogin();
+          if (!url || new URL(url).origin !== webOrigin || new URL(url).pathname !== '/local-cli/connect') throw new Error('No valid connection link.');
+          await (dependencies.copyText || copyDesktopText)(url);
+        }
         else if (action === "login" || action === "organization_select" || action === "authorization_open") {
           if (action === "organization_select" && (typeof command.organizationId !== "string" || !command.organizationId)) throw new Error("Select an organization first.");
           const url = action === "authorization_open" ? (agent.getPendingAuthorizationUrl?.() ?? agent.retryAuthorization?.())
@@ -1655,7 +1663,7 @@ export async function startDesktopHost({ input = process.stdin, output = process
     };
     if (command.action === "quit" || command.action === "prepare_update_restart" || command.action === "update" && (command.force === true || stoppingForUpdate)) {
       void execute();
-    } else if (["login", "organization_select", "organization_cancel", "authorization_open"].includes(command.action)) {
+    } else if (["login", "organization_select", "organization_cancel", "authorization_open", "authorization_copy"].includes(command.action)) {
       authorizationQueue = authorizationQueue.then(execute).catch(() => {});
     } else if (/^(codex|claude)_login$/.test(command.action || "") || ["provider_repair", "provider_connect", "provider_disconnect"].includes(command.action)) {
       // Opening an auth terminal must not wait for an unrelated provider turn.

package/src/orchestrator/audit.js

@@ -101,11 +101,11 @@ export async function auditAttempt(charter, attempt, { previousAttempt = null, s
       target: check.id,
       explanation: check.detail,
       repairability:
-        check.id === "executor_succeeded" && attempt.raw_output.blocked
+        check.id === "executor_succeeded" && attempt.raw_output?.blocked && attempt.raw_output?.blocker_kind === "human"
           ? "manual"
           : check.repairability,
       auto_fix_hint:
-        check.id === "executor_succeeded" && attempt.raw_output.blocked
+        check.id === "executor_succeeded" && attempt.raw_output?.blocked && attempt.raw_output?.blocker_kind === "human"
           ? null
           : `Resolve ${check.label.toLowerCase()} and check the result.`,
     }));

package/src/orchestrator/independent-audit.js

@@ -12,7 +12,7 @@ export function buildIndependentAuditInstruction(charter, attempt) {
   return buildWorkflowReportingInstruction({ auditor: true }) + "\n" + buildAcceptedHumanGuidanceInstruction(charter) + "\n" + section("requested_review", `Review the original request and actual behavior read-only. Report concrete defects, regressions and missing user outcomes. No preparation matrix, citation package, assurance score or mandatory screenshot record is required. Do not certify unobserved results or grant permission.
 Request: ${JSON.stringify({ requirement: charter.requirement, criteria: acceptanceCriterionRows(charter), mustNot: charter.must_not, experience: charter.completion_contract?.experience })}
 Current result: ${JSON.stringify({ summary: attempt.summary ?? null, residual_risks: attempt.residual_risks, tests: attempt.tests_run, observations: attempt.criterion_evidence, current: attempt.observed_evidence })}
-Return SIMY_AUDIT_JSON: with {passed,summary,findings,criterion_results,coverage_review:{user_outcome:{passed,verification_method,observed_result}}}. Check the original requested result even if the listed criteria mention only code or tests. Each criterion result describes criterion_id,passed,verification_method,observed_result. Each finding candidate must contain passed. Only passed=false entries are findings; never report passed=true evidence as a finding. Findings describe the concrete remaining defect and necessary repair.`);
+Return SIMY_AUDIT_JSON: with {passed,summary,findings,criterion_results,coverage_review:{user_outcome:{passed,verification_method,observed_result}}}. Check the original requested result even if the listed criteria mention only code or tests. Each criterion result describes criterion_id,passed,verification_method,observed_result. Each finding candidate must contain passed. Only passed=false entries are findings; never report passed=true evidence as a finding. Findings describe the concrete remaining defect and necessary repair. Set blocker_kind to machine for technical failures, external for unavailable dependencies, and human only for actual missing authorization, authentication interaction or an explicitly user-reserved decision. A legacy repairability=manual label or missing report does not establish a human dependency.`);
 }
 
 export function buildIndependentAudit(execution, charter = null, attempt = null) {
@@ -60,11 +60,11 @@ export function buildIndependentAudit(execution, charter = null, attempt = null)
       severity: cleanString(item.severity).toLowerCase() || "major",
       target: cleanString(item.target) || "pull_request",
       explanation: cleanString(item.explanation) || "Independent audit finding.",
-      repairability: item.repairability === "manual" ? "manual" : "auto",
+      repairability: item.blocker_kind === "human" ? "manual" : "auto",
       disposition: ["defer", "dismiss"].includes(item.disposition) && cleanString(item.explanation)
         ? item.disposition : "fix",
       blocker_kind: ["machine", "human", "external"].includes(item.blocker_kind)
-        ? item.blocker_kind : item.repairability === "manual" ? "human" : "machine",
+        ? item.blocker_kind : "machine",
       auto_fix_hint: cleanString(item.auto_fix_hint) || null,
     }));
   const findings = evaluations.filter((item) => item.passed === false);

package/src/orchestrator/instruction.js

@@ -13,6 +13,7 @@ export function buildCodingInstruction(
   },
 ) {
   return [
+    section("automatic_recovery", "Continue authorized work without procedural sign-off. Repair technical failures automatically. For an actual blocker, report blocker_kind=machine for technical repair, external for an unavailable dependency, or human for missing authorization, authentication interaction or an explicitly reserved decision. Preserve native permissions and explicit stops; blocked=true alone does not require human input."),
     section("role", "Complete the user's requested outcome in this repository."),
     buildWorkflowReportingInstruction(),
     buildAcceptedHumanGuidanceInstruction(charter),

package/src/orchestrator/loop.js

@@ -113,7 +113,7 @@ async function runCodingLoopOwned({
       previousAttempt,
       previousFindings,
       promptInterventions,
-    });
+    }) + (snapshot.metadata?.automatic_recovery ? '\nAutomatic recovery of the same unfinished task: inspect the current failure and previous attempts, test a different cause or reversible repair, then return to the original requested work. Do not repeat an unchanged failing operation or ask the user to certify technical correctness. Preserve existing permissions and limits.' : '');
 
     let attempt = recoveredAttempt;
     if (!attempt) {
@@ -574,7 +574,18 @@ async function handleFailedAudit({
 }) {
   snapshot.charter.thread_state.failure_count += 1;
   const diagnosticCircuit = evaluateRetryCircuit({ attempt, previousAttempt: snapshot.attempts.at(-2) ?? null, findings });
-  const technicalStall = attempt.outcome_progress?.stalled || attempt.outcome_progress?.assessment_unavailable || diagnosticCircuit.open && !attempt.outcome_progress?.has_progress;
+  // A new commit does not resolve an unchanged review failure. Criteria can all
+  // pass while a required review finding still prevents acceptance. Compare
+  // concrete details: a shared generic code does not identify the same defect.
+  const priorAttempt = snapshot.attempts.at(-2);
+  const repeatedReview = !attempt.outcome_progress?.has_progress &&
+    diagnosticCircuit.previous_fingerprint?.review_findings_sha256 === diagnosticCircuit.fingerprint.review_findings_sha256 &&
+    priorAttempt?.outcome_progress?.objective_digest === attempt.outcome_progress?.objective_digest;
+  attempt.audit_retry_streak = repeatedReview ? (priorAttempt.audit_retry_streak || 1) + 1 : 1;
+  const reviewStalled = !requiresHuman && attempt.audit?.passed === true && attempt.independent_audit?.passed === false &&
+    attempt.audit_retry_streak >= 3 && attempt.outcome_progress?.status === "assessed" &&
+    !attempt.outcome_progress?.stalled && !attempt.outcome_progress?.assessment_unavailable;
+  const technicalStall = reviewStalled || attempt.outcome_progress?.stalled || attempt.outcome_progress?.assessment_unavailable || diagnosticCircuit.open && !attempt.outcome_progress?.has_progress;
   if (technicalStall && !requiresHuman) {
     const state = snapshot.charter.thread_state;
     const key = JSON.stringify([state.objective_contract?.current_digest, attempt.outcome_progress?.unproven_ids || [], findings.filter(row => row.code !== 'AI_STRATEGY_CHANGE_REQUIRED').map(row => row.code).sort()]);
@@ -590,18 +601,18 @@ async function handleFailedAudit({
       return false;
     }
   }
-  if (attempt.outcome_progress?.stalled) {
-    const unresolved = attempt.outcome_progress.unproven_ids;
+  if (reviewStalled || attempt.outcome_progress?.stalled) {
+    const unresolved = attempt.outcome_progress?.unproven_ids || [];
     snapshot.final_audit = {
       ...(snapshot.final_audit || {}),
       passed: false,
-      summary: "Independent review found no progress on the remaining user outcomes.",
+      summary: reviewStalled ? "Automatic diagnosis did not resolve the repeated review failure." : "Independent review found no progress on the remaining user outcomes.",
       findings: [...(snapshot.final_audit?.findings || []), {
         passed: false,
-        code: "OUTCOME_PROGRESS_STALLED",
+        code: reviewStalled ? "REVIEW_PROGRESS_STALLED" : "OUTCOME_PROGRESS_STALLED",
         severity: "blocker",
         target: "acceptance_criteria",
-        explanation: `The same user outcomes remain unproven after another attempt: ${unresolved.join(", ")}. Reassess the approach against the approved objective before more work.`,
+        explanation: reviewStalled ? "The same review findings remain after automatic diagnosis and another repair attempt. Preserve the failure for machine recovery; human certification cannot resolve it." : `The same user outcomes remain unproven after another attempt: ${unresolved.join(", ")}. Reassess the approach against the approved objective before more work.`,
         repairability: "auto",
         blocker_kind: "machine",
       }],
@@ -618,11 +629,7 @@ async function handleFailedAudit({
     await publish(snapshot, "blocked", onUpdate);
     return true;
   }
-  const retryCircuit = evaluateRetryCircuit({
-    attempt,
-    previousAttempt: snapshot.attempts.at(-2) ?? null,
-    findings,
-  });
+  const retryCircuit = diagnosticCircuit;
   if (retryCircuit.open && !attempt.outcome_progress?.has_progress &&
       !(attempt.audit?.passed && attempt.outcome_progress?.status === "insufficient_evidence" &&
         !attempt.outcome_progress?.failed_ids?.length)) {

package/src/orchestrator/recovery.js

@@ -1,4 +1,4 @@
-import { suggestedProviderTokenBudget, MAX_PROVIDER_TOKEN_BUDGET } from "./budget.js";
+import { suggestedProviderTokenBudget, MAX_PROVIDER_TOKEN_BUDGET, budgetState } from "./budget.js";
 
 const RECOVERABLE_STATES = new Set(["waiting_human", "blocked", "failed"]);
 
@@ -8,13 +8,17 @@ export function recoveryContractForEvent({ snapshot, state, message, detail = {}
 
   const reasonCode = recoveryReasonCode(state, message, detail);
   const attemptNumber = positiveInteger(detail.attempt_number);
-  const actions = recoveryActions(reasonCode, detail.budget);
+  const machineStopped = state === "blocked" && snapshot?.final_audit?.requires_human === false &&
+    ["outcome_progress_stalled", "retry_circuit_open"].includes(detail.code);
+  const actions = machineStopped ? [] : recoveryActions(reasonCode, detail.budget);
+  const automaticRecovery = machineStopped && !budgetState(snapshot).exhausted;
   return {
     schema_version: 1,
     state,
-    reason_code: reasonCode,
-    user_message: isSafetyCeiling(reasonCode) ? safetyCeilingRecoveryMessage(reasonCode, detail.budget) : recoveryMessage(reasonCode),
-    primary_action_id: actions[0].id,
+    reason_code: automaticRecovery ? 'machine_recovery_pending' : machineStopped ? "machine_recovery_exhausted" : reasonCode,
+    ...(machineStopped ? { requires_user_action: false } : {}),
+    user_message: automaticRecovery ? 'The task remains unfinished. SIMY will retry this same task after a recovery cooldown while its connection is enabled. No manual confirmation is required.' : machineStopped ? "Automatic diagnosis and repair attempts could not resolve the technical failure. The task remains unfinished; failure details are retained. No human approval or success declaration is required." : isSafetyCeiling(reasonCode) ? safetyCeilingRecoveryMessage(reasonCode, detail.budget) : recoveryMessage(reasonCode),
+    primary_action_id: actions[0]?.id ?? null,
     actions,
     technical_details: {
       event_code: clean(detail.code) || null,
@@ -104,9 +108,10 @@ export function isRecoveryContract(value) {
       value.schema_version === 1 &&
       typeof value.reason_code === "string" &&
       typeof value.user_message === "string" &&
-      typeof value.primary_action_id === "string" &&
       Array.isArray(value.actions) &&
-      value.actions.length > 0,
+      (typeof value.primary_action_id === "string" && value.actions.length > 0 ||
+        value.state === "blocked" && ['machine_recovery_pending', 'machine_recovery_exhausted'].includes(value.reason_code) &&
+        value.requires_user_action === false && value.primary_action_id === null && value.actions.length === 0),
   );
 }
 

package/src/orchestrator/retry.js

@@ -39,6 +39,7 @@ export function buildRetryFingerprint(attempt, findings) {
     commit_sha: commitSha,
     finding_codes: normalizedFindings.map((finding) => finding.code),
     findings_sha256: sha256(findingPayload),
+    review_findings_sha256: sha256(stableJson(normalizeFindings(findings, true))),
     evidence_sha256: sha256(evidencePayload),
   };
 }
@@ -52,7 +53,7 @@ function findingsForAttempt(attempt) {
   ];
 }
 
-function normalizeFindings(findings) {
+function normalizeFindings(findings, includeDetails = false) {
   return (Array.isArray(findings) ? findings : [])
     .filter((finding) => finding && typeof finding === "object")
     .map((finding) => ({
@@ -62,6 +63,11 @@ function normalizeFindings(findings) {
       severity: cleanString(finding.severity).toLowerCase() || null,
       target: cleanString(finding.target) || null,
       repairability: cleanString(finding.repairability).toLowerCase() || null,
+      ...(includeDetails ? {
+        explanation: cleanString(finding.explanation) || null,
+        auto_fix_hint: cleanString(finding.auto_fix_hint) || null,
+        blocker_kind: cleanString(finding.blocker_kind) || null,
+      } : {}),
     }))
     .sort(compareStableValues);
 }

package/src/provider-links.js

@@ -14,12 +14,13 @@ async function readSettings(root) {
   let payload;
   try { payload = JSON.parse(await readFile(join(root, 'provider-links.json'), 'utf8')); }
   catch (error) { if (error.code === 'ENOENT') return defaults(); throw error; }
-  if (payload?.schemaVersion !== 1 || !payload.providers || PROVIDER_LINKS.some(provider => {
+  if (payload?.schemaVersion !== 1) throw new Error('Unsupported SIMY provider connection settings version.');
+  if (!payload.providers || PROVIDER_LINKS.some(provider => {
     const value = payload.providers[provider];
     return !value || typeof value.connected !== 'boolean' || typeof value.requiresConsent !== 'boolean' ||
       value.epoch !== null && (typeof value.epoch !== 'string' || !value.epoch || value.epoch.length > 128) ||
       value.consentEpoch !== undefined && (value.consentEpoch !== value.epoch || !value.consentEpoch || value.connected !== false || typeof value.enabled !== 'boolean');
-  })) throw new Error('Invalid SIMY provider connection settings.');
+  })) throw Object.assign(new Error('Invalid SIMY provider connection settings.'), { code: 'invalid_provider_link_settings' });
   return Object.fromEntries(PROVIDER_LINKS.map(provider => [provider, {
     connected: payload.providers[provider].consentEpoch ? payload.providers[provider].enabled : payload.providers[provider].connected,
     ...(payload.providers[provider].consentEpoch ? { consentEpoch: payload.providers[provider].consentEpoch } : {}),
@@ -52,13 +53,22 @@ export async function requireProviderLink({ root = join(defaultRoot(), 'delivery
   return link;
 }
 
-export function writeProviderLink(root = defaultRoot(), provider, connected) {
+export function writeProviderLink(root = defaultRoot(), provider, connected, { repairInvalidSettings = false } = {}) {
   validateProvider(provider);
   if (typeof connected !== 'boolean') throw new Error('Choose whether this provider is connected to SIMY.');
   const key = resolve(root);
   const previous = writeQueues.get(key) || Promise.resolve();
   const pending = previous.catch(() => {}).then(async () => {
-    const providers = await readSettings(root);
+    let providers;
+    try { providers = await readSettings(root); }
+    catch (error) {
+      if (!repairInvalidSettings || !connected || !(error instanceof SyntaxError || error.code === 'invalid_provider_link_settings')) throw error;
+      // Only an explicit Connect action restores this provider. Retain the
+      // damaged file and leave all other providers disconnected.
+      const original = await readFile(join(root, 'provider-links.json'));
+      await writeFile(join(root, `provider-links.invalid-${randomUUID()}.json`), original, { mode: 0o600, flag: 'wx' });
+      providers = disconnected();
+    }
     // Reconnection restores discovery only. Session execution consent is cleared
     // separately and must be selected again, including after a host restart.
     const epoch = randomUUID();

package/src/runner.js

@@ -59,6 +59,7 @@ import {
   assertRecoveryActor, completedWorkerResult, recoveryActorBinding, refreshRecoveryAudit, refreshRecoveryBudgetAudit,
 } from "./coding-run-recovery.js";
 import { workflowRunEnv } from "./dev-work-events.js";
+import { canRecoverCodingRun, codingRecoveryDue, scheduleCodingRecovery } from './coding-run-automatic-recovery.js';
 
 const execFileAsync = promisify(execFile);
 const MAX_LOCAL_LOG_LINES = 1_000;
@@ -321,6 +322,7 @@ export function restoreRun({ snapshot, session, apiOrigin, localPath = null, loc
   run.startedAt = restoredSnapshot.created_at || null;
   run.completedAt = restoredSnapshot.updated_at || null;
   run.controlState = restoredState === "stopped" ? "stopped" : "waiting_human";
+  if (canRecoverCodingRun(run)) run.controlState = 'complete';
   run.restoredFromState = restoredFromState;
   run.restoredObjectiveUnverified = objectiveUnverified;
   run.restoredCompletedWorkerResult = Boolean(recoverableResult);
@@ -430,6 +432,23 @@ export async function continueLocalCodingRun(run, guidance, dependencies = {}) {
   return executeLocalCodingRun(run, dependencies, { humanGuidance: message, resume: true });
 }
 
+// Automated recovery is not human guidance and does not reset stop intent,
+// usage, the objective, or the existing task identity.
+export async function recoverLocalCodingRun(run, dependencies = {}, now = Date.now()) {
+  if (!canRecoverCodingRun(run)) return run.snapshot;
+  if (!run.snapshot.metadata?.automatic_recovery) {
+    scheduleCodingRecovery(run.snapshot, now);
+    if (run.localStateRoot) await saveCodingRunSnapshot(run.localStateRoot, run.snapshot);
+    return run.snapshot;
+  }
+  if (!codingRecoveryDue(run, now)) return run.snapshot;
+  assertRunCanContinue(run);
+  run.completedAt = null;
+  run.controlState = 'running';
+  run.resumeCount += 1;
+  return executeLocalCodingRun(run, dependencies, { resume: true });
+}
+
 function assertRunCanContinue(run) {
   if (run.operation || run.child) throw new Error("The selected Agentic Loop run is still active.");
   if (!RESUMABLE_STATES.has(run.status)) {
@@ -1324,6 +1343,11 @@ async function updateRun(run, state) {
   run.snapshot.state = state;
   run.snapshot.metadata = { ...run.snapshot.metadata, pr_lifecycle_state: state };
   run.snapshot.updated_at = new Date().toISOString();
+  if (state === 'blocked' && run.snapshot.final_audit?.requires_human === false &&
+      ['outcome_progress_stalled', 'retry_circuit_open'].includes(run.snapshot.events.at(-1)?.detail?.code) &&
+      !budgetState(run.snapshot).exhausted) {
+    scheduleCodingRecovery(run.snapshot);
+  }
   run.completedAt = TERMINAL_STATES.has(state) ? run.snapshot.updated_at : null;
   if (state === "waiting_human" || state === "pr_ready_for_review") {
     run.controlState = "waiting_human";

package/src/sqm/failure-circuit.js

@@ -6,6 +6,10 @@ import { CLI_VERSION } from "../cli-contract.js";
 import { defaultSessionRoot } from "../session-store.js";
 
 export const SQM_FAILURE_PAUSE_THRESHOLD = 6;
+export const SQM_RECOVERY_DELAY_MS = 5 * 60_000;
+const MAX_RECOVERY_DELAY_MS = 30 * 60_000;
+const exhausted = state => state.failures >= SQM_FAILURE_PAUSE_THRESHOLD || (state.providerFailures || 0) >= 2;
+const recoveryDelay = state => Math.min(MAX_RECOVERY_DELAY_MS, SQM_RECOVERY_DELAY_MS * 2 ** Math.min(state.recoveryAttempts || 0, 3));
 const scopeKey = scope => JSON.stringify([scope?.webOrigin, scope?.accountId, scope?.organizationId]);
 const validVersion = value => typeof value === "string" && /^\d+\.\d+\.\d+$/.test(value);
 
@@ -21,6 +25,9 @@ export function createSqmFailureCircuitStore({ root = defaultSessionRoot() } = {
         const state = JSON.parse(await readFile(path(scope), "utf8"));
         if (!validVersion(state.version) || !Number.isInteger(state.failures) || state.failures < 0 || state.failures > SQM_FAILURE_PAUSE_THRESHOLD || (state.inFlight !== undefined && typeof state.inFlight !== "boolean") || (state.providerFailures !== undefined && (!Number.isInteger(state.providerFailures) || state.providerFailures < 0 || state.providerFailures > 2)) || (state.providerRetryAt !== undefined && (!Number.isFinite(state.providerRetryAt) || state.providerRetryAt < 0)))
           throw new Error("Invalid saved SQM failure state.");
+        if (state.recoveryAt !== undefined && (!Number.isFinite(state.recoveryAt) || state.recoveryAt < 0) ||
+            state.recoveryAttempts !== undefined && (!Number.isSafeInteger(state.recoveryAttempts) || state.recoveryAttempts < 0))
+          throw new Error("Invalid saved SQM recovery state.");
         return state;
       } catch (error) { if (error.code === "ENOENT") return null; throw error; }
     },
@@ -37,12 +44,17 @@ export function createSqmFailureCircuitStore({ root = defaultSessionRoot() } = {
 
 // One counter per organization on this machine, shared by both local engines.
 // Neither reconnecting nor an empty claim demonstrates successful analysis.
-export function createSqmFailureCircuit({ version = CLI_VERSION, store = null } = {}) {
+export function createSqmFailureCircuit({ version = CLI_VERSION, store = null, now = Date.now } = {}) {
   if (!validVersion(version)) throw new Error("SQM failure circuit requires a SIMY version.");
   const states = new Map();
   const unreadableScopes = new Set();
+  const scheduleRecovery = state => {
+    if (!exhausted(state) || state.recoveryAt > now()) return false;
+    state.recoveryAt = Math.max(state.providerRetryAt || 0, now() + recoveryDelay(state));
+    return true;
+  };
   const save = async (scope, state) => {
-    try { await store?.write(scope, { version: state.version, failures: state.failures, inFlight: state.inFlight === true, ...(state.providerFailures ? { providerFailures: state.providerFailures, providerRetryAt: state.providerRetryAt } : {}) }); state.storageError = false; }
+    try { await store?.write(scope, { version: state.version, failures: state.failures, inFlight: state.inFlight === true, ...(state.recoveryAt !== undefined ? { recoveryAt: state.recoveryAt, recoveryAttempts: state.recoveryAttempts || 0 } : {}), ...(state.providerFailures ? { providerFailures: state.providerFailures, providerRetryAt: state.providerRetryAt } : {}) }); state.storageError = false; }
     catch (error) { state.storageError = true; throw error; }
   };
   const load = async scope => {
@@ -52,7 +64,7 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       let saved;
       try { saved = await store?.read(scope); unreadableScopes.delete(key); }
       catch (error) { unreadableScopes.add(key); throw error; }
-      state = saved ? { version: saved.version, failures: saved.failures, inFlight: saved.inFlight === true, providerFailures: saved.providerFailures || 0, providerRetryAt: saved.providerRetryAt || 0 } : { version, failures: 0, inFlight: false };
+      state = saved ? { version: saved.version, failures: saved.failures, inFlight: saved.inFlight === true, providerFailures: saved.providerFailures || 0, providerRetryAt: saved.providerRetryAt || 0, ...(saved.recoveryAt !== undefined ? { recoveryAt: saved.recoveryAt, recoveryAttempts: saved.recoveryAttempts || 0 } : {}) } : { version, failures: 0, inFlight: false };
       states.set(key, state);
       // An unfinished review from this same version means the last host exited
       // without a result or graceful cancellation. Count it once on restart.
@@ -60,6 +72,7 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
         state.failures = Math.min(SQM_FAILURE_PAUSE_THRESHOLD, state.failures + 1);
         if (state.providerFailures === 1) state.providerFailures = 2;
         state.inFlight = false;
+        scheduleRecovery(state);
         await save(scope, state);
       }
     }
@@ -67,20 +80,35 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       state.version = version;
       state.providerFailures = 0; state.providerRetryAt = 0;
       state.failures = 0;
+      delete state.recoveryAt; delete state.recoveryAttempts;
       state.inFlight = false;
       await save(scope, state);
     } else if (state.storageError) await save(scope, state);
+    // Migrate a legacy update-only pause once, retaining counters and scope.
+    if (exhausted(state) && state.recoveryAt === undefined) {
+      scheduleRecovery(state); await save(scope, state);
+    }
     return state;
   };
   return {
-    async canClaim(scope, now = Date.now()) {
+    async canClaim(scope, time = now()) {
       const state = await load(scope);
-      return state.failures < SQM_FAILURE_PAUSE_THRESHOLD && (state.providerFailures || 0) < 2 && now >= (state.providerRetryAt || 0);
+      if (time < (state.providerRetryAt || 0) || state.inFlight) return false;
+      if (!exhausted(state)) return true;
+      if (time < state.recoveryAt) return false;
+      // Reserve the next cooldown before claiming. Empty claims, reconnects and
+      // cancelled work never reset failures or allow a burst of recovery turns.
+      state.recoveryAttempts = Math.min((state.recoveryAttempts || 0) + 1, 3);
+      state.recoveryAt = time + recoveryDelay(state);
+      await save(scope, state);
+      return true;
     },
     async providerFailure(scope, retryAt, retryAttempt = 0) {
       const state = await load(scope);
       state.providerFailures = retryAttempt === 1 ? 2 : Math.min(2, (state.providerFailures || 0) + 1);
       state.providerRetryAt = retryAt;
+      scheduleRecovery(state);
+      if (state.recoveryAt !== undefined) state.recoveryAt = Math.max(state.recoveryAt, retryAt);
       await save(scope, state);
     },
     async providerRetryUsed(scope) {
@@ -104,12 +132,14 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       state.failures = Math.min(SQM_FAILURE_PAUSE_THRESHOLD, state.failures + 1);
       if (state.inFlight && state.providerFailures === 1) state.providerFailures = 2;
       state.inFlight = false;
+      scheduleRecovery(state);
       await save(scope, state);
     },
     async success(scope) {
       const state = await load(scope);
       state.failures = 0;
       state.providerFailures = 0; state.providerRetryAt = 0;
+      delete state.recoveryAt; delete state.recoveryAttempts;
       state.inFlight = false;
       await save(scope, state);
     },
@@ -117,10 +147,12 @@ export function createSqmFailureCircuit({ version = CLI_VERSION, store = null }
       const state = states.get(scopeKey(scope));
       const paused = (state?.failures || 0) >= SQM_FAILURE_PAUSE_THRESHOLD || (state?.providerFailures || 0) >= 2;
       return { consecutive_failures: state?.failures || 0,
-        paused_until_update: paused,
+        paused_until_update: false,
+        recovery_pending: paused && state?.inFlight !== true,
+        next_retry_at: paused ? state.recoveryAt ?? null : null,
         provider_retry_exhausted: (state?.providerFailures || 0) >= 2,
         provider_recovery_pending: state?.providerFailures === 1,
-        paused_at_version: paused ? state.version : null,
+        paused_at_version: null,
         storage_unavailable: state?.storageError === true || unreadableScopes.has(scopeKey(scope)) };
     },
   };

package/src/sqm/review-worker.js

@@ -115,11 +115,12 @@ export function createSqmLocalReviewWorker({
   getHistoryScope = () => null,
   getWorkspaceUrl = () => null,
   recordHistory = async () => {},
+  readHistory = async () => [],
   onHistoryError = () => {},
   now = () => Date.now(),
   providerFailureCooldownMs = 5 * 60_000,
   getRecoveryKey = () => null,
-  failureCircuit = createSqmFailureCircuit(),
+  failureCircuit = createSqmFailureCircuit({ now }),
 } = {}) {
   if (!api || typeof api.request !== "function") throw new TypeError("api.request is required");
   let activeJobId = null;
@@ -158,6 +159,7 @@ export function createSqmLocalReviewWorker({
       item.state = state; item.finishedAt = new Date().toISOString();
       item.result = state === "completed" ? "SQM review submitted." : "";
       item.error = state === "failed" ? formatFailure(failure, failureReported) : "";
+      if (state === 'completed') for (const field of ['errorCode', 'errorStage', 'httpStatus', 'providerDiagnostic']) delete item[field];
       if (failure) { item.phase = failure.stage; item.errorStage = failure.stage; item.errorCode = failure.code; item.httpStatus = failure.status; item.providerDiagnostic = failure.providerDiagnostic; }
       await persist(scope, item);
     }
@@ -273,20 +275,22 @@ export function createSqmLocalReviewWorker({
     snapshot() {
       const pause = currentPause();
       const circuit = failureCircuit.snapshot(getHistoryScope());
+      const requiresInteraction = pause && !pause.recoverable && pause.recoveryKey === getRecoveryKey(getProvider());
+      const waitingForRecovery = circuit.recovery_pending && !requiresInteraction && !activeJobId;
       return { active_job_id: activeJobId, polling: Boolean(pollPromise), closed, suspended,
-        paused: pausedEnvironment !== null || circuit.paused_until_update || circuit.storage_unavailable,
-        pause_reason: circuit.provider_retry_exhausted ? "provider_retry_failed_until_update" : circuit.paused_until_update ? "consecutive_failures_until_update" : circuit.storage_unavailable ? "failure_state_unavailable" : pauseReason,
+        paused: !activeJobId && (pausedEnvironment !== null || circuit.recovery_pending || circuit.storage_unavailable),
+        pause_reason: activeJobId ? null : requiresInteraction ? pause.code : waitingForRecovery ? "automatic_recovery_pending" : circuit.storage_unavailable ? "failure_state_unavailable" : pauseReason,
         ...circuit, issue: issueContext === contextKey(getProvider(), getHistoryScope()) ? issue : null,
-        ...(pause ? { provider_pause: { code: pause.code, status: pause.status,
-          retry_at: circuit.provider_retry_exhausted ? null : new Date(pause.retryAt).toISOString(),
-          message: circuit.provider_retry_exhausted ? "The provider retry failed. New SQM reviews are paused until SIMY is updated." : pause.message } } : {}) };
+        ...(pause && !activeJobId ? { provider_pause: { code: pause.code, status: pause.status,
+          retry_at: new Date(Math.max(pause.retryAt, circuit.next_retry_at || 0)).toISOString(),
+          message: waitingForRecovery ? "SIMY will automatically retry after the recovery cooldown. No update or manual confirmation is required." : pause.message } } : {}) };
     },
     desktopTasks() { return { activeCount: activeJobId ? 1 : 0, items: visibleHistory().map(item => ({ ...item, canStop: item.id === activeJobId })) }; },
     desktopTaskDetail(key) {
       const item = visibleHistory().find(item => item.key === key);
       return item ? { key, instruction: `SQM local review · ${item.provider}`, result: item.state === "completed" ? "SQM review submitted." : "", error: item.error || "", links: item.webUrl ? [{ label: "Analysis details", url: item.webUrl }] : [] } : null;
     },
-    retry() { if (closed || suspended || pollPromise || failureCircuit.snapshot(getHistoryScope()).paused_until_update) return false; pausedEnvironment = null; pauseReason = null; pauses.delete(contextKey(getProvider(), getHistoryScope())); issue = null; onChange(); return true; },
+    retry() { if (closed || suspended || pollPromise || failureCircuit.snapshot(getHistoryScope()).recovery_pending) return false; pausedEnvironment = null; pauseReason = null; pauses.delete(contextKey(getProvider(), getHistoryScope())); issue = null; onChange(); return true; },
     resetHistory() { if (!pollPromise) { history.splice(0); issue = null; pausedEnvironment = null; pauseReason = null; } },
     poll() {
       if (closed || suspended || pollPromise) return pollPromise || Promise.resolve(null);
@@ -295,7 +299,8 @@ export function createSqmLocalReviewWorker({
         const pause = currentPause();
         // Known provider failures already have a bounded cooldown. Do not let
         // the environment gate suppress their recovery probe indefinitely.
-        if (!pause?.recoverable || (pause.recoveryKey === getRecoveryKey(getProvider()) && now() < pause.retryAt)) return Promise.resolve(null);
+        if (pause?.recoveryKey === getRecoveryKey(getProvider()) &&
+            (!pause.recoverable || now() < pause.retryAt)) return Promise.resolve(null);
         pausedEnvironment = null; pauseReason = null;
       } else if (pausedEnvironment !== null) {
         pausedEnvironment = null; pauseReason = null; pauses.delete(contextKey(getProvider(), getHistoryScope())); issue = null;
@@ -323,6 +328,23 @@ export function createSqmLocalReviewWorker({
           lease_seconds: leaseSeconds,
         }, { signal: reviewController.signal });
         if (issue) { issue = null; onChange(); }
+        if (claim?.recovered === true && claim.completed === true && typeof claim.job_id === 'string') {
+          // The server completed this exact saved result without re-running a
+          // provider. Reflect the original job's completion locally as well.
+          if (!history.some(item => item.id === claim.job_id)) {
+            let saved;
+            try { saved = (await readHistory(historyScope)).find(item => item.key === `sqm:${claim.job_id}`); }
+            catch { onHistoryError(); }
+            const item = { ...saved, id: claim.job_id, key: `sqm:${claim.job_id}`, kind: 'analysis',
+              label: saved?.label || `SQM · ${claim.job_id.slice(0, 8)}`, provider: saved?.provider || provider,
+              startedAt: saved?.startedAt || new Date().toISOString(), webUrl: saved?.webUrl || analysisTaskUrl(workspaceUrl, claim.job_id) };
+            history.unshift(item); historyScopes.set(item, JSON.stringify(historyScope)); history.splice(50);
+          }
+          await updateTask(claim.job_id, 'completed', historyScope);
+          await failureCircuit.success(historyScope);
+          pauses.delete(key);
+          return claim;
+        }
         if (!claim?.claimed) {
           // A successful empty claim proves SIMY access recovered, but it says
           // nothing about a local provider that has not executed again yet.

package/src/update-detachment/history-recovery.js

@@ -0,0 +1,51 @@
+import {readFile,writeFile,mkdir,realpath} from 'node:fs/promises';
+import {join,resolve} from 'node:path';
+import {createHash,randomUUID} from 'node:crypto';
+import {digest} from './state-store.js';
+import {readDispatchGate,reconcileDispatchHistory} from './dispatch-gate.js';
+import {createUpdateRuntime} from './runtime.js';
+import {createUpdateCoordinator} from './coordinator.js';
+import {readSession,isSessionValid} from '../session-store.js';
+import {webApiUrl,webApiHeaders} from '../web-api.js';
+import {acquireDesktopProcessLock} from '../desktop-process-lock.js';
+import {listRecords} from '../codex-plugins/simy/hooks/delivery-loop.mjs';
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+export async function planDispatchHistoryRecovery({root}) {
+ root=await realpath(root);const state=readDispatchGate(root),items=[];
+ for(const attempt of Object.values(state.attempts)) {
+  const item={attemptId:attempt.id,attemptDigest:digest(attempt),disposition:attempt.phase==='confirmed'?'already_confirmed':'retain_blocked_unknown'};
+  const ref=attempt.provenance?.recordRef;
+  if(attempt.phase==='result_saved' && ref?.startsWith(resolve(root,'direct-tasks')+'/')) {
+   try {
+    const bytes=await readFile(ref),result=JSON.parse(bytes),match=/^(.*):provider:([1-9][0-9]*)$/.exec(attempt.id);
+    if(await realpath(ref)===ref && match && result.id===match[1] && result.id===attempt.provenance.taskId && digest(result.id)===attempt.taskHash &&
+      result.invocation_count===Number(match[2]) && ['succeeded','failed','stopped'].includes(result.status) && Object.values(state.receipts).some(r=>r.attemptId===attempt.id && r.generation===attempt.generation && r.resultRef===ref)) {
+     item.disposition='saved_terminal_result';item.evidence={ref,sha256:sha(bytes),status:result.status};
+    }
+   } catch { /* Unknown effects remain blocked, including removed test output. */ }
+  }
+  items.push(item);
+ }
+ const audit={version:1,gateDigest:digest(state),expectedRevision:state.revision,expectedGeneration:state.generation,items};
+ const directory=join(root,'update-detachment','recovery');await mkdir(directory,{recursive:true,mode:0o700});
+ const auditRef=join(directory,randomUUID()+'.json'),bytes=JSON.stringify(audit,null,2)+'\n';await writeFile(auditRef,bytes,{flag:'wx',mode:0o600});
+ return {auditRef,auditDigest:sha(bytes),revision:state.revision,generation:state.generation,results:items.filter(i=>i.disposition==='saved_terminal_result').length,blocked:items.filter(i=>i.disposition==='retain_blocked_unknown').length,replayAttempts:false};
+}
+export async function applyDispatchHistoryRecovery({root,auditRef,auditDigest}) {
+ root=await realpath(root);const lock=await acquireDesktopProcessLock(root);
+ try {const audit=JSON.parse(await readFile(auditRef,'utf8'));return reconcileDispatchHistory({root,auditRef,auditDigest,expectedRevision:audit.expectedRevision,expectedGeneration:audit.expectedGeneration});}
+ finally {await lock.release();}
+}
+export async function reconnectRecoveredHistory({root,origin='https://app.simy.one'}) {
+ root=await realpath(root);const lock=await acquireDesktopProcessLock(root);
+ try {
+  const session=await readSession(origin,root);if(!isSessionValid(session,Date.now(),origin))throw Error('Existing device sign-in required.');
+  const response=await fetch(webApiUrl('desktop-access',{webOrigin:origin,apiBaseUrl:session.api_base_url}),{headers:webApiHeaders(session),signal:AbortSignal.timeout(10000)});
+  const access=await response.json();if(!response.ok || access.state!=='ready' || access.organizationId!==session.organization_id)throw Error('Current server entitlement required.');
+  const runtime=createUpdateRuntime({root,origin,readContext:()=>({actor:{account:session.account_id,device:session.device_id,origin},runs:[],directTasks:[],localTasks:[]}),listRecords:()=>listRecords(join(root,'delivery-hooks'))});
+  // Reconciliation reads exact results or retained fences. It never resumes a task.
+  const coordinator=createUpdateCoordinator({store:runtime.store,gate:runtime.gate,boundary:runtime.boundary,reconcile:runtime.reconcile,initialState:'recovery_required'});
+  if(digest(await readSession(origin,root))!==digest(session))throw Error('Device connection changed.');
+  return await coordinator.reconnect();
+ } finally {await lock.release();}
+}

package/src/update-detachment/runtime.js

@@ -6,7 +6,7 @@ import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { readFile, lstat, readlink, realpath } from 'node:fs/promises';
 import { atomicSave, readState, digest, withLock } from './state-store.js';
-import { readDispatchGate, adoptHookOwner, DISPATCH_PROTOCOL, confirmDispatch, flushDispatchIntake, readTaskAdmission } from './dispatch-gate.js';
+import { readDispatchGate, unresolvedDispatchAttempts, adoptHookOwner, DISPATCH_PROTOCOL, confirmDispatch, flushDispatchIntake, readTaskAdmission } from './dispatch-gate.js';
 import { createLedgerCoordinatorAdapters } from './ledger-adapter.js';
 import { listDispatchRegistrations, normalizeDispatchIdentity } from './provenance.js';
 import { reconcileSession } from './reconcile.js';
@@ -182,7 +182,7 @@ export function createUpdateRuntime({ root, origin, readContext, listRecords, ob
       confirmDispatch({root,attemptId:attempt.id});
     }
     ledger=readDispatchGate(root);
-    const unresolved=Object.values(ledger.attempts).filter(attempt=>attempt.phase!=='confirmed' && !workers.some(task=>task.handle.attemptId===attempt.id && attempt.taskHash===digest(task.taskId) && attempt.identityHash===digest(task.identity) && attempt.generation===task.generation));
+    const unresolved=unresolvedDispatchAttempts(ledger).filter(attempt=> !workers.some(task=>task.handle.attemptId===attempt.id && attempt.taskHash===digest(task.taskId) && attempt.identityHash===digest(task.identity) && attempt.generation===task.generation));
     if(unresolved.length)return {safe:false,liveExecutions:0,pendingWrites:0,unsettledPermissions:0};
     const currentGate=readDispatchGate(root);
     if(currentGate.connection!=='detaching' || currentGate.generation!==startingGate.generation)throw failure('boundary_owner_changed');
@@ -194,7 +194,7 @@ export function createUpdateRuntime({ root, origin, readContext, listRecords, ob
   const reconcile=async()=> {
     const actor=context().actor, assessments=[];
     const workers=(transaction?.tasks || []).filter(task=>task.handle);
-    if(Object.values(readDispatchGate(root).attempts).some(attempt=>attempt.phase!=='confirmed' && !workers.some(task=>task.handle.attemptId===attempt.id)))return {verified:false,unresolvedAttempts:1};
+    if(unresolvedDispatchAttempts(readDispatchGate(root)).some(attempt=> !workers.some(task=>task.handle.attemptId===attempt.id)))return {verified:false,unresolvedAttempts:1};
     for (const task of transaction?.tasks || []) {
       if(task.handle) {
         if(actor?.account!==task.identity.account || actor?.origin!==task.identity.origin || actor?.device!==task.identity.device || task.identity.root!==root)return {verified:false,unresolvedAttempts:1};