Recover interrupted work

Recovery starts from recorded state, not from replaying the original prompt. Inspect the session’s status, execution owner, pending actions and external-operation evidence before advancing it.

Establish the recovery boundary

Use cayu recovery --help and the recovery reference to inspect the available planning and execution commands. Choose the exact durable store and bounded selection. Review blockers before executing a recovery plan.

Recorded condition	Required decision
Another owner has a live execution lease	Wait for or coordinate with that owner
Exact approval or user input is pending	Resolve the owning action through its normal boundary
External mutation may have completed	Reconcile its receipt or idempotency state
Native work remains unresolved	Preserve the owning continuation; do not invent a result
Cleanup did not settle	Retain unknown evidence and use the supported retry path

An ancestor’s delegated-action reference identifies a child but cannot resolve the child’s action. Follow the reference to the owning session and apply normal actor and policy checks.

Prove recovery across a process boundary

Use the support recipe to stop between commands and continue from SQLite in a new process. Test both an approved effect and a denied decision. Retrying delivery should read the existing durable result rather than repeat the domain mutation.

Do not report exactly-once external effects based on session persistence alone. The domain transaction, stable operation identity and receipt are the proof. Read durability, durable operations and session API.