@@ -153,7 +153,7 @@ Two directors, selected by role:
   Auto mode is toggled by CLI flags (`--auto` / `--no-auto`); there is currently no in-session key to toggle it (default on; constrained envelope — workspace writes and unconstrained shell auto-allow; installs, recursive rm, force/uncontained worktree changes, sensitive-path and opaque-wrapper shell still ask; contained non-force `git worktree add`/`remove`/`prune` and `list` auto-allow; shell file-mutation denied). It is not a separate edit/plan mode.
 
 - **SubAgentDirector** (delegated work, `src/subagent/index.ts`) — Drives a dispatched worker until a turn arrives with no tool calls, then replies with the final assistant text and ends the run. A tool-less turn **after tools** completes only with the four-heading envelope (Summary, Findings, Blockers, Paths). Assistant text that prints explicit `<tool_call>` markup is treated as attempted tool use, not narration: one **verbatim-tool-call** nudge asks the worker to re-issue a real `tool_call` and does not count toward the tool-less spiral. A missing envelope otherwise nudges once (**incomplete-report**) and a second tool-less turn still without the envelope salvages as **incomplete-report-stop** (once; later tool-less turns wait). Explore/read-only workers that used tools then replied with findings remain normal completes; `requireEvidence` (off by default, set per director) additionally requires at least one read before a tool-less spawn-only reply can complete. `requirePlanSubstance` (planner or `intent=plan`, not `modelRole === "plan"`) additionally requires Findings to contain files/paths, acceptance criteria, non-goals, risks, and ordered steps with a non-placeholder line each — four headings with stub Findings are incomplete-report, not an attachable plan. After real tool work, wrap-up Findings that are not placeholder or outline-only complete instead of being salvaged as a stub plan. Reads done through `run_shell` count as evidence too — `src/subagent/shell-evidence.ts` classifies shell reads (`cat`, `grep`, `sed` without `-i`, …) over the same subject expansion the auto-shell policy uses — but there is no corresponding shell-write evidence or file-write requirement: a run that never touches a file still completes normally once it replies with the envelope. There is no turn budget. Operator/parent cancel after any progress returns a **cancelled** salvage report (partial findings + tool activity) instead of a bare cancel string; cancel before progress still surfaces as cancelled-by-operator. There is no repetition/no-progress/never-acted/never-edited hard stop and no fingerprint-based re-dispatch block — a genuinely stuck worker runs until it completes, stalls, hits an opt-in wall-clock deadline, or is cancelled.
-  `spawn_agent` starts each worker and records it in the caller's fleet mailbox. On the TUI primary, mailbox mail is the collect path: occupancy takes uncollected terminals and re-enters the parent as system inbound with a Summary + Blockers digest (Findings when Summary is empty) and a blob pointer named for `read_file`. Nested orchestrators collect through mailbox mail the same way. A mounted `wait_agents` (exec primary) collects worker reports directly instead. Already-collected waits return status without a second report or error body. Wait JSON includes `stop_reason` from the session when present so a salvage that is wait-`done` is not mistaken for a clean complete, and so parent-initiated interrupt (`interrupted`) is not mistaken for operator-cancel (`cancelled`). Every terminal non-clean outcome (failed, cancelled, interrupted, or a forced-stop salvage) also carries a `failure` record, written in the same store mutation that makes the outcome visible and never rewritten: a typed `failure_class` (`provider_retryable`, `provider_fatal`, `loop_guard` for the reactor's doom-loop guard, the forced-stop reasons, or `error`), `recovery` availability with a typed reason, the attempt number, the ask_director `handoff` state at termination (`delivered` only when the worker's own ask_director call returned the answer), and whether `cleanup` released everything. `provider_failure` and `continuable` derive from that record, so wait_agents, list_agents, and mailbox mail cannot disagree. Deadline salvage prepends an advisory parent hint suggesting continuation plus a longer deadline if more wall-clock time is warranted. Failed and incomplete-report salvage tell the parent to diagnose from the report or error and MAY spawn one successor with a changed brief. A parent-initiated interrupt is a resumable pause: wait unblocks with `stop_reason: interrupted` (often while the session is still running and has no report); the parent should `resume_agent` or re-wait, and must not spawn a successor against a still-live worker. Successor only if that session is no longer resumable. Operator-cancelled salvage asks the parent to synthesize Findings and Paths and wait for the operator instead of auto-starting another specialist. Identical re-dispatch of the same brief stays refused at the prompt / spawn-handoff layer, except a recoverable/continuable child failure (`continuable: true`) MAY spawn one successor with the same brief; there is no fingerprint-based re-dispatch hard-block. Deadline hints are advisory only — an identical re-dispatch is still admitted at runtime. Parent hints are prepended on salvage reports returned to the parent. The runtime does not auto-spawn successors.
+  `spawn_agent` starts each worker and records it in the caller's fleet mailbox. On the TUI primary, mailbox mail is the collect path: occupancy takes uncollected terminals and re-enters the parent as system inbound with a Summary + Blockers digest (Findings when Summary is empty) and a blob pointer named for `read_file`. Nested orchestrators collect through mailbox mail the same way. A mounted `wait_agents` (exec primary) collects worker reports directly instead. Already-collected waits return status without a second report or error body. Wait JSON includes `stop_reason` from the session when present so a salvage that is wait-`done` is not mistaken for a clean complete, and so parent-initiated interrupt (`interrupted`) is not mistaken for operator-cancel (`cancelled`). Every terminal non-clean outcome (failed, cancelled, interrupted, or a forced-stop salvage) also carries a `failure` record, written in the same store mutation that makes the outcome visible and never rewritten: a typed `failure_class` (`provider_retryable`, `provider_fatal`, `loop_guard` for the reactor's doom-loop guard, the forced-stop reasons, or `error`), `recovery` availability with a typed reason, the attempt number, the ask_director `handoff` state at termination (`delivered` only when the worker's own ask_director call returned the answer), and whether `cleanup` released everything. `provider_failure` and `continuable` derive from that record, so wait_agents, list_agents, and mailbox mail cannot disagree. Deadline salvage prepends an advisory parent hint suggesting continuation plus a longer deadline if more wall-clock time is warranted. Failed and incomplete-report salvage tell the parent to diagnose from the report or error and MAY spawn one successor with a changed brief. A parent-initiated interrupt is a resumable pause: wait unblocks with `stop_reason: interrupted` (often while the session is still running and has no report); the parent should `resume_agent` or re-wait, and must not spawn a successor against a still-live worker. Successor only if that session is no longer resumable. Operator-cancelled salvage asks the parent to synthesize Findings and Paths and wait for the operator instead of auto-starting another specialist. Identical re-dispatch of the same brief stays refused at the prompt / spawn-handoff layer, except a recoverable/continuable child failure (`continuable: true`), which the parent recovers by calling `spawn_agent` with `recovers` set to the failed agent_id; there is no fingerprint-based re-dispatch hard-block. Recovery is enforced, not advisory: `recovery.available` requires a `provider_retryable` failure on the original spawn (not a resume_agent turn), no prior recovery, an original attempt (a failed replacement is `recovery_exhausted`), and a replay-safe run that touched only read, search, and web read tools (anything else is `side_effects_completed`). The claim lands synchronously before the handler awaits, so a duplicate or concurrent `recovers` call gets the existing replacement back and spawns nothing; an ineligible one is refused with its reason and never falls back to a plain spawn. The replacement is an ordinary spawn: it inherits no grants, approvals, or pending asks from the failed worker. Deadline hints are advisory only — an identical re-dispatch is still admitted at runtime. Parent hints are prepended on salvage reports returned to the parent. The runtime does not auto-spawn successors.
 
 #### Model-family policy (`src/agent/model-family-policy.ts`)
 
 
@@ -213,7 +213,7 @@ const GUIDELINE_SUB_BLOCKS: Record<
         (ctx.waitAgentsMounted
           ? " or re-wait"
           : ", or idle for its mailbox mail") +
-        "; do not `spawn_agent` a successor against a still-live worker. Successor only if that session is no longer resumable. Operator-cancel (`stop_reason` cancelled): wait for the operator; do not auto-retry. Identical brief: refuse. Recoverable/continuable child failure (`continuable: true`) MAY spawn one successor with the same brief; identical brief is still refused otherwise. Merge Summary/Findings into a coherent answer for the operator; do not paste raw fleet-agent dumps.",
+        "; do not `spawn_agent` a successor against a still-live worker. Successor only if that session is no longer resumable. Operator-cancel (`stop_reason` cancelled): wait for the operator; do not auto-retry. Identical brief: refuse. Recoverable/continuable child failure (`continuable: true`): recover it at most once with `spawn_agent` and `recovers` set to its agent_id; the runtime refuses any other recovery with a reason. Identical brief is still refused otherwise. Merge Summary/Findings into a coherent answer for the operator; do not paste raw fleet-agent dumps.",
       "- Use manage_tasks for your own coordination checklist; spawning workers is `spawn_agent`, not manage_tasks.",
       "- If context is compacted automatically, do not stop tasks early due to token fear; persist progress via manage_tasks and worker reports.",
     ];
 
@@ -124,7 +124,9 @@ import { formatSubAgentSpawnAuthFailureMessage } from "./inference-auth-failure.
 import {
   classifySubAgentFailure,
   isProviderFailureClass,
+  withRecoveryReplacement,
   type SubAgentFailureRecord,
+  type SubAgentRecoveryReason,
 } from "./terminal-failure.js";
 import { errorMessage } from "../agent/error-message.js";
 import { isSubAgentCancelError } from "./dispose.js";
@@ -284,6 +286,25 @@ class FleetMailbox {
     this.sessions.wake();
   }
 
+  /**
+   * Record that `replacementId` recovers `failedId`. Runs synchronously in
+   * the spawn handler before anything awaits, so a second claim in the same
+   * tick already sees the replacement. An evicted session's record lives
+   * only on the overlay, so it is linked there.
+   */
+  claimRecovery(failedId: string, replacementId: string): void {
+    const overlay = this.records.get(failedId);
+    if (overlay === undefined) return;
+    if (this.sessions.get(failedId) !== undefined) {
+      this.sessions.linkRecoveryReplacement(failedId, replacementId);
+      this.mirrorFailure(failedId, overlay);
+      return;
+    }
+    if (overlay.failure !== undefined) {
+      overlay.failure = withRecoveryReplacement(overlay.failure, replacementId);
+    }
+  }
+
   markQueued(id: string): void {
     const existing = this.records.get(id);
     if (existing === undefined || existing.collected === true) return;
@@ -558,6 +579,7 @@ const SpawnAgentArgs = type({
   "do_not?": "string[]",
   "report_focus?": "string",
   "requires_tools?": "string[]",
+  "recovers?": "string",
 });
 
 export const spawnAgentToolDefinition: ToolDefinition = {
@@ -610,6 +632,11 @@ export const spawnAgentToolDefinition: ToolDefinition = {
         description:
           "Hard tool requirements (canonical names). Preflight fails closed when missing.",
       },
+      recovers: {
+        type: "string",
+        description:
+          "agent_id of a failed+continuable worker this spawn replaces. Once per failure; refused with a reason otherwise.",
+      },
     },
     required: ["description", "prompt"],
   },
@@ -627,7 +654,7 @@ export const MAX_WAIT_TIMEOUT_MS = 300_000;
 export const waitAgentsToolDefinition: ToolDefinition = {
   name: "wait_agents",
   description:
-    "Block until targets finish, fail, or ask (awaiting_director), or timeout_ms. mode any (default) or all. Timeout is not an error; workers keep running. Answer awaiting_director with send_input. failed+continuable:true may be respawned once.",
+    "Block until targets finish, fail, or ask (awaiting_director), or timeout_ms. mode any (default) or all. Timeout is not an error; workers keep running. Answer awaiting_director with send_input. failed+continuable:true: recover once via spawn_agent recovers=agent_id.",
   inputSchema: {
     type: "object",
     properties: {
@@ -915,6 +942,49 @@ function handoffRequiresSuccessCriteria(
   );
 }
 
+/**
+ * Why a `recovers` request spawns nothing, or undefined when it may proceed.
+ * A duplicate is not an error: it hands back the replacement already
+ * started so every caller converges on one agent_id.
+ */
+function recoveryRefusal(
+  callId: string,
+  fleetRecords: FleetMailboxHandle,
+  failedId: string,
+): ToolResult | undefined {
+  const record = fleetRecords.peek(failedId);
+  if (record === undefined) {
+    return fleetResult(
+      callId,
+      `Error: spawn_agent recovers="${failedId}" is not one of your workers; nothing was spawned.`,
+    );
+  }
+  const replacementId = record.failure?.recovery.replacement_id;
+  if (replacementId !== undefined) {
+    return fleetResult(
+      callId,
+      fleetJson({
+        agent_id: replacementId,
+        recovers: failedId,
+        status: "recovery_already_started",
+        reason: "already_recovered" satisfies SubAgentRecoveryReason,
+      }),
+    );
+  }
+  if (
+    record.status === "failed" &&
+    record.failure?.recovery.available === true
+  ) {
+    return undefined;
+  }
+  const reason: SubAgentRecoveryReason =
+    record.failure?.recovery.reason ?? "not_retryable";
+  return fleetResult(
+    callId,
+    `Error: recovery_unavailable reason=${reason}: spawn_agent recovers="${failedId}" spawned nothing. Diagnose from the failure and continue with a changed brief, or wait for the operator.`,
+  );
+}
+
 export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
   const telemetry = deps.telemetry ?? NOOP_TELEMETRY;
   // Concurrent-lane overlap detection, replacing the static per-package
@@ -995,6 +1065,7 @@ export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
         do_not: rawDoNot,
         report_focus: rawReportFocus,
         requires_tools: rawRequiresTools,
+        recovers: rawRecovers,
       } = parsed;
       const description = rawDesc.trim();
       const prompt = rawPrompt.trim();
@@ -1004,6 +1075,11 @@ export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
           "Error: spawn_agent requires a non-empty description and prompt.",
         );
       }
+      const recovers = rawRecovers?.trim();
+      if (recovers !== undefined) {
+        const refusal = recoveryRefusal(call.id, deps.fleetRecords, recovers);
+        if (refusal !== undefined) return refusal;
+      }
       const context = rawCtx?.trim();
       const goals =
         rawGoals?.map((g) => g.trim()).filter((g) => g.length > 0) ?? [];
@@ -1254,6 +1330,11 @@ export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
           : {}),
       });
 
+      // CL-10202: the claim lands before this handler's first await (and
+      // before the session exists), so a concurrent duplicate sees it.
+      if (recovers !== undefined) {
+        deps.fleetRecords.claimRecovery(recovers, call.id);
+      }
       const session = deps.sessions.start({
         id: call.id,
         description,
@@ -1268,6 +1349,7 @@ export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
         ...(deps.parentSessionId !== undefined
           ? { parentSessionId: deps.parentSessionId }
           : {}),
+        ...(recovers !== undefined ? { recovers } : {}),
       });
       deps.fleetRecords.register(session.id);
       const agentName = classifyAgentName(resolved.directorId);
@@ -1760,7 +1842,14 @@ export function createSpawnAgentTool(deps: AgentFleetDeps): AgentTool {
         start,
       });
       if (status === "queued") deps.fleetRecords.markQueued(session.id);
-      return fleetResult(call.id, fleetJson({ agent_id: session.id, status }));
+      return fleetResult(
+        call.id,
+        fleetJson({
+          agent_id: session.id,
+          status,
+          ...(recovers !== undefined ? { recovers, attempt: 2 } : {}),
+        }),
+      );
     },
   });
 }
 
@@ -144,13 +144,12 @@ export interface MailboxWorkerDigest {
 }
 
 /**
- * Single-successor guidance for a failed+continuable entry. The marker is
- * advisory only — no runtime auto-retry backs it.
+ * Guidance for a failed+continuable entry. spawn_agent enforces the "at most
+ * once": a second recovers call gets the first replacement back.
  */
-export const RECOVERABLE_FAILURE_CONTINUE_GUIDANCE =
-  "This worker failed with a transient provider error (retryable/timeout/overload) " +
-  "and is terminal — do not re-wait it. You may spawn at most one successor with " +
-  "the same brief; do not retry in a loop.";
+function recoverableFailureContinueGuidance(agentId: string): string {
+  return `Recoverable: call spawn_agent with recovers="${agentId}" at most once.`;
+}
 
 export function shouldDriveOpenTasks(input: {
   previousRunning?: number | undefined;
@@ -441,7 +440,7 @@ export function projectMailboxRecord(
     ...(taken.status === "failed" && taken.recoverableFailure === true
       ? {
           continuable: true as const,
-          continue_with: RECOVERABLE_FAILURE_CONTINUE_GUIDANCE,
+          continue_with: recoverableFailureContinueGuidance(id),
         }
       : {}),
     ...(taken.stopReason !== undefined