diff --git a/README.md b/README.md
index cc4f345..c9512ad 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,7 @@ Running several long-lived commands is pesky once they span terminal panes or ne
 - Saves and reloads task recipes: directories, commands, group assignments, and display names.
 - Reruns a completed task in place, keeping its identity, group, and name.
 - Preserves `claude`, `codex`, and `grok` conversations, so saved or rerun tasks resume instead of starting fresh.
+- Automatically snapshots the current task set for recovery.
 
 ## Documentation
 
diff --git a/docs/commands.md b/docs/commands.md
index 98a0b39..50c29ab 100644
--- a/docs/commands.md
+++ b/docs/commands.md
@@ -33,7 +33,7 @@
 | `r` | Rerun a finished task; supported agent tasks use the captured resume command |
 | `X` | Kill a running task (`TERM`, then `KILL` after 2 s), or remove a finished one |
 | `w` | Save the current tasks as a session |
-| `o` | Load a saved session |
+| `o` | Load a saved session or a recovery snapshot (opens the [session picker](#the-o-session-picker)) |
 | `q` (or `Ctrl-C`) | Disconnect; leave the daemon and tasks running |
 | `Q` | Quit; kill the tasks and stop the daemon |
 
@@ -130,6 +130,12 @@ Typing filters the rows; `Backspace` deletes one character and the matches re-fi
 
 The daemon normalizes every group name received from the picker or a [session](sessions.md) file. It removes control characters, trims surrounding whitespace, and caps the result at 64 characters. An empty result or the exact name `Unassigned` means no group, preventing a user-defined name from colliding with the reserved section. Comparison remains case-sensitive, so `unassigned` is a valid group name.
 
+## The `o` session picker
+
+`o` opens a bottom panel listing the saved [sessions](sessions.md): `↑`/`↓` move the highlight, `Enter` loads, `Esc` cancels. While [recovery snapshots](sessions.md#recovery) exist, the hint adds `tab recovery (N)` and `Tab` (or `Shift-Tab`) flips the panel to them; `Tab` again returns to the saved list. Each list keeps its own highlight. With no snapshots, `Tab` does nothing and the hint omits it.
+
+A recovery row reads `<age> ago · <tasks> task(s) · <label>`: the file's age, its command count, and its stored label (normally `autosaved <timestamp>`). `Enter` loads the highlighted snapshot; the status line confirms the load and suggests saving it. Press `w` to save the recovered fleet as a named session.
+
 ## Peek
 
 A centered box over the dashboard showing the selected task's live screen (the last screenful). `↑`/`↓` (or `k`/`j`) switch which task you're peeking at; `Enter` attaches to it; `r` reruns it if it has finished; `Space`, `Esc`, or `q` closes.
diff --git a/docs/sessions.md b/docs/sessions.md
index 45a9fd4..1051854 100644
--- a/docs/sessions.md
+++ b/docs/sessions.md
@@ -66,6 +66,21 @@ A bare agent command does not identify its conversation, so saving it verbatim w
 }
 ```
 
+## Recovery
+
+`fleetcom` automatically snapshots the current task set under `recovery/` inside the session directory. Each daemon (or `--foreground` core) writes to a file named for its start time and process ID. After each write, the new file and files whose process IDs are still live are protected; among the remaining files, the nine newest names survive. A shared recovery directory can therefore contain more than ten snapshots while multiple writers are live.
+
+A snapshot pass runs two seconds after the last command that can change a saved recipe, coalescing a burst of commands. A pass writes a nonempty recipe when its content or destination changed, or when the expected snapshot file is missing. Every 60 seconds, `fleetcom` also checks for stored-command changes such as a newly captured agent resume ID.
+
+- An empty fleet does not write a snapshot, so removing every task does not replace the previous snapshot with an empty recipe.
+- Quitting, disconnecting, and `fleetcom --kill` leave snapshots in place.
+
+A snapshot uses the session format above, with an `autosaved <timestamp>` UTC label in its `name` field. Loading one spawns its commands like a named session and suggests saving the recovered fleet under a permanent name.
+
+In the dashboard, `o` opens the [session picker](commands.md#the-o-session-picker) on the saved list; while snapshots exist, `Tab` flips it to the recovery list.
+
+Recovery files carry the same caveat as saved recipes: they persist full command lines, which can embed secrets. New recovery directories use mode 0700, and snapshot files use mode 0600.
+
 ## Saving and loading
 
 - Save: `w` in the dashboard, type a name, `Enter`. Writes the session name plus each task's directory, command, and optional group and name to `<name>.json`.
diff --git a/src/app.rs b/src/app.rs
index afb9bdd..0a8d0bc 100644
--- a/src/app.rs
+++ b/src/app.rs
@@ -27,8 +27,8 @@ use crate::{
     editbuf::EditBuffer,
     path,
     protocol::{
-        Command, Event, Key, Lifecycle, Mods, MouseBtn, MouseKind, ScreenView, ScrollAction,
-        TaskView,
+        Command, Event, Key, Lifecycle, Mods, MouseBtn, MouseKind, RecoveryEntry, ScreenView,
+        ScrollAction, TaskView,
     },
     transport::{ExitIntent, SocketTransport, ThreadTransport, Transport},
     ui,
@@ -94,6 +94,13 @@ impl GroupMode {
     }
 }
 
+/// Active page in the session picker.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub enum SessionPage {
+    Saved,
+    Recovery,
+}
+
 /// What Enter does with a picker row.
 #[derive(Clone, Copy, PartialEq, Eq, Debug)]
 pub enum DirKind {
@@ -179,6 +186,12 @@ pub struct App {
     // Load-session picker state.
     pub session_names: Vec<String>,
     pub session_sel: usize,
+    /// Recovery snapshots from the latest `Sessions` event, newest first.
+    pub session_recovery: Vec<RecoveryEntry>,
+    /// The displayed session-picker list; `o` resets it to `Saved`.
+    pub session_page: SessionPage,
+    /// Selection in the recovery list, clamped independently of `session_sel`.
+    pub recovery_sel: usize,
     /// Transient one-line notice (save/load result), dismissed on the next key.
     pub status: Option<String>,
     /// Parsed terminal events from the stdin reader thread. crossterm owns the
@@ -354,6 +367,9 @@ impl App {
             rename_target: None,
             session_names: Vec::new(),
             session_sel: 0,
+            session_recovery: Vec::new(),
+            session_page: SessionPage::Saved,
+            recovery_sel: 0,
             status: None,
             input_rx,
             input_tx: Some(input_tx),
@@ -601,11 +617,15 @@ impl App {
                     self.focused_screen = Some(s);
                 }
                 Event::Status(s) => self.status = Some(s),
-                Event::Sessions(names) => {
-                    // A shorter list can land while the picker is open; clamp
-                    // the selection before it can index past the end.
+                Event::Sessions { names, recovery } => {
+                    // Clamp both page selections to the refreshed lists.
                     self.session_sel = self.session_sel.min(names.len().saturating_sub(1));
+                    self.recovery_sel = self.recovery_sel.min(recovery.len().saturating_sub(1));
+                    if recovery.is_empty() {
+                        self.session_page = SessionPage::Saved;
+                    }
                     self.session_names = names;
+                    self.session_recovery = recovery;
                 }
             }
         }
@@ -977,6 +997,9 @@ impl App {
                 self.transport.send(Command::ListSessions);
                 self.session_names.clear();
                 self.session_sel = 0;
+                self.session_recovery.clear();
+                self.session_page = SessionPage::Saved;
+                self.recovery_sel = 0;
                 self.mode = Mode::LoadSession;
             }
             // Restart only finished tasks.
@@ -1024,19 +1047,45 @@ impl App {
     }
 
     fn on_key_loadsession(&mut self, k: KeyEvent) {
-        match k.code {
-            KeyCode::Esc => self.mode = Mode::Dashboard,
-            KeyCode::Up => self.session_sel = self.session_sel.saturating_sub(1),
-            KeyCode::Down => {
-                self.session_sel = step_down(self.session_sel, self.session_names.len())
+        if matches!(k.code, KeyCode::Tab | KeyCode::BackTab) {
+            if !self.session_recovery.is_empty() {
+                self.session_page = match self.session_page {
+                    SessionPage::Saved => SessionPage::Recovery,
+                    SessionPage::Recovery => SessionPage::Saved,
+                };
             }
-            KeyCode::Enter => {
-                if let Some(name) = self.session_names.get(self.session_sel).cloned() {
-                    self.load_session(&name);
+            return;
+        }
+        match self.session_page {
+            SessionPage::Saved => match k.code {
+                KeyCode::Esc => self.mode = Mode::Dashboard,
+                KeyCode::Up => self.session_sel = self.session_sel.saturating_sub(1),
+                KeyCode::Down => {
+                    self.session_sel = step_down(self.session_sel, self.session_names.len())
                 }
-                self.mode = Mode::Dashboard;
-            }
-            _ => {}
+                KeyCode::Enter => {
+                    if let Some(name) = self.session_names.get(self.session_sel).cloned() {
+                        self.load_session(&name);
+                    }
+                    self.mode = Mode::Dashboard;
+                }
+                _ => {}
+            },
+            SessionPage::Recovery => match k.code {
+                KeyCode::Esc => self.mode = Mode::Dashboard,
+                KeyCode::Up => self.recovery_sel = self.recovery_sel.saturating_sub(1),
+                KeyCode::Down => {
+                    self.recovery_sel = step_down(self.recovery_sel, self.session_recovery.len())
+                }
+                KeyCode::Enter => {
+                    if let Some(e) = self.session_recovery.get(self.recovery_sel) {
+                        let stem = e.stem.clone();
+                        self.transport.send(Command::LoadRecovery { stem });
+                    }
+                    self.mode = Mode::Dashboard;
+                }
+                _ => {}
+            },
         }
     }
 
diff --git a/src/app_tests.rs b/src/app_tests.rs
index 577f3e9..f239252 100644
--- a/src/app_tests.rs
+++ b/src/app_tests.rs
@@ -530,6 +530,234 @@ fn session_selection_clamps_when_a_shorter_list_arrives() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// Write a recovery fixture whose commands run in `dir`.
+fn write_recovery(dir: &Path, stem: &str, label: &str, cmds: &[&str]) {
+    let rec = dir.join("sessions").join("recovery");
+    std::fs::create_dir_all(&rec).unwrap();
+    let list: Vec<String> = cmds.iter().map(|c| format!("{c:?}")).collect();
+    std::fs::write(
+        rec.join(format!("{stem}.json")),
+        format!(
+            r#"{{"version":1,"name":"{label}","dirs":{{".":[{}]}}}}"#,
+            list.join(",")
+        ),
+    )
+    .unwrap();
+}
+
+/// Session events populate and independently clamp both picker lists.
+#[test]
+fn sessions_reply_populates_and_clamps_both_lists() {
+    let dir = session_scratch("rec_lists", &["a"]);
+    write_recovery(
+        &dir,
+        "20260101-000000-1",
+        "autosaved 2026-01-01 00:00",
+        &["sleep 5"],
+    );
+    write_recovery(
+        &dir,
+        "20260102-000000-1",
+        "autosaved 2026-01-02 00:00",
+        &["sleep 5"],
+    );
+    let mut app = app_with_config_dir(&dir);
+
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+    assert_eq!(app.session_names, vec!["a".to_string()]);
+    assert_eq!(
+        app.session_recovery
+            .iter()
+            .map(|e| e.stem.as_str())
+            .collect::<Vec<_>>(),
+        vec!["20260102-000000-1", "20260101-000000-1"],
+        "recovery entries list newest first"
+    );
+
+    // Refresh after removing the selected recovery entry.
+    app.recovery_sel = 1;
+    std::fs::remove_file(
+        dir.join("sessions")
+            .join("recovery")
+            .join("20260101-000000-1.json"),
+    )
+    .unwrap();
+    app.transport.send(Command::ListSessions);
+    app.pump();
+    assert_eq!(app.session_recovery.len(), 1);
+    assert_eq!(app.recovery_sel, 0, "recovery selection must clamp");
+    assert_eq!(app.session_sel, 0);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Reopening the picker resets its page and recovery state.
+#[test]
+fn o_key_resets_the_picker_to_the_saved_page() {
+    let dir = session_scratch("rec_reset", &["a"]);
+    write_recovery(
+        &dir,
+        "20260101-000000-1",
+        "autosaved 2026-01-01 00:00",
+        &["sleep 5"],
+    );
+    let mut app = app_with_config_dir(&dir);
+
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+    app.on_key_loadsession(key(KeyCode::Tab));
+    assert_eq!(app.session_page, SessionPage::Recovery);
+    app.on_key_loadsession(key(KeyCode::Esc));
+
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    assert_eq!(app.session_page, SessionPage::Saved);
+    assert_eq!(app.recovery_sel, 0);
+    assert!(
+        app.session_recovery.is_empty(),
+        "the picker opens empty until the reply lands"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Tab does not leave the saved page when no recovery entries exist.
+#[test]
+fn tab_is_a_no_op_without_recovery_entries() {
+    let dir = session_scratch("rec_notab", &["a"]);
+    let mut app = app_with_config_dir(&dir);
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+    assert!(app.session_recovery.is_empty());
+
+    app.on_key_loadsession(key(KeyCode::Tab));
+    assert_eq!(app.session_page, SessionPage::Saved);
+    app.on_key_loadsession(key(KeyCode::BackTab));
+    assert_eq!(app.session_page, SessionPage::Saved);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Tab switches available pages without resetting either selection.
+#[test]
+fn tab_toggles_pages_and_selections_stay_independent() {
+    let dir = session_scratch("rec_tab", &["a", "b"]);
+    write_recovery(
+        &dir,
+        "20260101-000000-1",
+        "autosaved 2026-01-01 00:00",
+        &["sleep 5"],
+    );
+    write_recovery(
+        &dir,
+        "20260102-000000-1",
+        "autosaved 2026-01-02 00:00",
+        &["sleep 5"],
+    );
+    let mut app = app_with_config_dir(&dir);
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+
+    app.on_key_loadsession(key(KeyCode::Down)); // saved list -> "b"
+    app.on_key_loadsession(key(KeyCode::Tab));
+    assert_eq!(app.session_page, SessionPage::Recovery);
+    app.on_key_loadsession(key(KeyCode::Down)); // recovery list -> older entry
+    assert_eq!(app.recovery_sel, 1);
+
+    app.on_key_loadsession(key(KeyCode::Tab));
+    assert_eq!(app.session_page, SessionPage::Saved);
+    assert_eq!(app.session_sel, 1, "the saved selection survives the flip");
+    app.on_key_loadsession(key(KeyCode::BackTab));
+    assert_eq!(app.session_page, SessionPage::Recovery);
+    assert_eq!(app.recovery_sel, 1, "the recovery selection survives too");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// An empty recovery refresh returns the picker to the saved page.
+#[test]
+fn emptied_recovery_list_returns_to_the_saved_page() {
+    let dir = session_scratch("rec_empty", &["a"]);
+    write_recovery(
+        &dir,
+        "20260101-000000-1",
+        "autosaved 2026-01-01 00:00",
+        &["sleep 5"],
+    );
+    let mut app = app_with_config_dir(&dir);
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+    app.on_key_loadsession(key(KeyCode::Tab));
+    assert_eq!(app.session_page, SessionPage::Recovery);
+
+    std::fs::remove_file(
+        dir.join("sessions")
+            .join("recovery")
+            .join("20260101-000000-1.json"),
+    )
+    .unwrap();
+    app.transport.send(Command::ListSessions);
+    app.pump();
+    assert!(app.session_recovery.is_empty());
+    assert_eq!(app.session_page, SessionPage::Saved);
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Enter loads the selected recovery stem and displays the resulting status.
+#[test]
+fn enter_on_the_recovery_page_loads_the_selected_stem() {
+    let dir = session_scratch("rec_load", &[]);
+    write_recovery(
+        &dir,
+        "20260101-000000-1",
+        "autosaved 2026-01-01 00:00",
+        &["sleep 7"],
+    );
+    write_recovery(
+        &dir,
+        "20260102-000000-1",
+        "autosaved 2026-01-02 00:00",
+        &["sleep 9"],
+    );
+    let mut app = app_with_config_dir(&dir);
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+    app.on_key_loadsession(key(KeyCode::Tab));
+
+    // Select the older snapshot.
+    app.on_key_loadsession(key(KeyCode::Down));
+    app.on_key_loadsession(key(KeyCode::Enter));
+    assert!(
+        matches!(app.mode, Mode::Dashboard),
+        "Enter closes the picker"
+    );
+    app.pump();
+    assert_eq!(
+        app.status.as_deref(),
+        Some("loaded recovery snapshot; save to name it"),
+        "the daemon's notice must arrive unedited"
+    );
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.views[0].command, "sleep 7");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Esc closes the recovery page.
+#[test]
+fn esc_closes_the_picker_from_the_recovery_page() {
+    let dir = session_scratch("rec_esc", &[]);
+    write_recovery(
+        &dir,
+        "20260101-000000-1",
+        "autosaved 2026-01-01 00:00",
+        &["sleep 5"],
+    );
+    let mut app = app_with_config_dir(&dir);
+    app.on_key_dashboard(key(KeyCode::Char('o')));
+    app.pump();
+    app.on_key_loadsession(key(KeyCode::Tab));
+    assert_eq!(app.session_page, SessionPage::Recovery);
+    app.on_key_loadsession(key(KeyCode::Esc));
+    assert!(matches!(app.mode, Mode::Dashboard));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 /// The `@` recent list is the distinct task cwds, newest first.
 #[test]
 fn recent_dirs_are_distinct_and_newest_first() {
diff --git a/src/daemon.rs b/src/daemon.rs
index 948213e..d507d71 100644
--- a/src/daemon.rs
+++ b/src/daemon.rs
@@ -571,10 +571,8 @@ pub fn run_daemon() -> io::Result<()> {
     // as shutdown like the rest.
     crate::install_signal_handlers(Arc::clone(&term))?;
 
-    // Non-blocking accept lets the daemon reap exited tasks while idle:
-    // between clients it would otherwise block in accept() and never call
-    // poll_exit, so a task that finished after `q` would linger as a zombie until
-    // a reconnect.
+    // Polling accept lets the daemon reap tasks and maintain recovery snapshots
+    // while no client is connected.
     listener.set_nonblocking(true)?;
     const IDLE_REAP: Duration = Duration::from_millis(100);
     loop {
@@ -602,6 +600,8 @@ pub fn run_daemon() -> io::Result<()> {
             }
             Err(e) if e.kind() == ErrorKind::WouldBlock || transient_accept_error(&e) => {
                 sup.reap();
+                // `tick` is reserved for connected clients that drain its events.
+                sup.recovery_maintenance();
                 thread::sleep(IDLE_REAP);
             }
             Err(e) => {
diff --git a/src/harness/mod.rs b/src/harness/mod.rs
index 54b3a3e..d6f4e9f 100644
--- a/src/harness/mod.rs
+++ b/src/harness/mod.rs
@@ -31,8 +31,6 @@ use std::{
 
 pub use claude::Claude;
 pub use codex::Codex;
-// Test-only: `testutil::write_rollout` derives day directories from it.
-#[cfg(test)]
 pub(crate) use codex::civil_from_days;
 pub use grok::Grok;
 
diff --git a/src/protocol.rs b/src/protocol.rs
index ccf8e60..e2e01c9 100644
--- a/src/protocol.rs
+++ b/src/protocol.rs
@@ -12,7 +12,7 @@ use base64::{Engine as _, engine::general_purpose::STANDARD as B64};
 use crate::frame::{KIND_CONTROL, KIND_HELLO, KIND_SCREEN};
 
 /// Wire-protocol version; the handshake rejects mismatched peers.
-pub const PROTOCOL_VERSION: u32 = 8;
+pub const PROTOCOL_VERSION: u32 = 9;
 
 /// Environment and working directory supplied by the launching client.
 #[derive(Debug, Clone, PartialEq)]
@@ -99,6 +99,9 @@ pub enum Command {
     SaveSession { name: String },
     /// Spawn every command in a named recipe, each in its (existing) dir.
     LoadSession { name: String },
+    /// Spawn every command in the recovery snapshot identified by a listed
+    /// filename stem.
+    LoadRecovery { stem: String },
     /// Ask for the saved recipe names; answered with `Event::Sessions`. Listing
     /// is core-side like save/load, so the picker shows the same dir they use.
     ListSessions,
@@ -187,8 +190,26 @@ pub enum Event {
     Screen(ScreenView),
     /// A one-line notice for the status line (save/load result, spawn error).
     Status(String),
-    /// Saved session-recipe names, sorted: the reply to `ListSessions`.
-    Sessions(Vec<String>),
+    /// The reply to `ListSessions`: saved session-recipe names (sorted) and
+    /// recovery snapshots (newest first).
+    Sessions {
+        names: Vec<String>,
+        recovery: Vec<RecoveryEntry>,
+    },
+}
+
+/// Recovery-snapshot metadata sent to the session picker.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RecoveryEntry {
+    /// Filename stem used by `LoadRecovery`.
+    pub stem: String,
+    /// Stored session name, or the filename stem when no name is stored.
+    pub label: String,
+    /// Command count across the snapshot's directories.
+    pub tasks: u32,
+    /// Seconds since the snapshot file's mtime; 0 when the mtime is unreadable
+    /// or in the future.
+    pub age_secs: u64,
 }
 
 /// Process-derived lifecycle state, independent of the user's `tagged` intent.
@@ -390,6 +411,26 @@ fn str_vec(v: &jzon::JsonValue) -> Option<Vec<String>> {
     Some(out)
 }
 
+/// Decode valid recovery entries, treating a missing or non-array value as
+/// empty and skipping malformed members independently.
+fn recovery_vec(v: &jzon::JsonValue) -> Vec<RecoveryEntry> {
+    let mut out = Vec::new();
+    for m in v.members() {
+        let entry = || -> Option<RecoveryEntry> {
+            Some(RecoveryEntry {
+                stem: m["stem"].as_str()?.to_string(),
+                label: m["label"].as_str()?.to_string(),
+                tasks: u32::try_from(m["tasks"].as_u64()?).ok()?,
+                age_secs: m["age"].as_u64()?,
+            })
+        };
+        if let Some(e) = entry() {
+            out.push(e);
+        }
+    }
+    out
+}
+
 fn lifecycle_str(l: Lifecycle) -> &'static str {
     match l {
         Lifecycle::Active => "active",
@@ -620,6 +661,10 @@ pub fn encode_command(cmd: &Command) -> (u8, Vec<u8>) {
             let _ = o.insert("t", "load");
             let _ = o.insert("name", name.as_str());
         }
+        Command::LoadRecovery { stem } => {
+            let _ = o.insert("t", "recover");
+            let _ = o.insert("stem", stem.as_str());
+        }
         Command::ListSessions => {
             let _ = o.insert("t", "list");
         }
@@ -764,6 +809,9 @@ pub fn decode_command(kind: u8, payload: &[u8]) -> Option<Command> {
         "load" => Command::LoadSession {
             name: v["name"].as_str()?.to_string(),
         },
+        "recover" => Command::LoadRecovery {
+            stem: v["stem"].as_str()?.to_string(),
+        },
         "list" => Command::ListSessions,
         "shutdown" => Command::Shutdown,
         _ => return None,
@@ -816,14 +864,24 @@ pub fn encode_event(ev: &Event) -> (u8, Vec<u8>) {
             let _ = o.insert("msg", msg.as_str());
             (KIND_CONTROL, o.dump().into_bytes())
         }
-        Event::Sessions(names) => {
+        Event::Sessions { names, recovery } => {
             let mut arr = jzon::JsonValue::new_array();
             for n in names {
                 let _ = arr.push(n.as_str());
             }
+            let mut rec = jzon::JsonValue::new_array();
+            for r in recovery {
+                let mut m = jzon::JsonValue::new_object();
+                let _ = m.insert("stem", r.stem.as_str());
+                let _ = m.insert("label", r.label.as_str());
+                let _ = m.insert("tasks", u64::from(r.tasks));
+                let _ = m.insert("age", r.age_secs);
+                let _ = rec.push(m);
+            }
             let mut o = jzon::JsonValue::new_object();
             let _ = o.insert("t", "sessions");
             let _ = o.insert("names", arr);
+            let _ = o.insert("recovery", rec);
             (KIND_CONTROL, o.dump().into_bytes())
         }
         Event::Screen(sv) => {
@@ -906,7 +964,10 @@ pub fn decode_event(kind: u8, payload: &[u8]) -> Option<Event> {
                     Some(Event::Tasks(views))
                 }
                 "status" => Some(Event::Status(v["msg"].as_str()?.to_string())),
-                "sessions" => Some(Event::Sessions(str_vec(&v["names"])?)),
+                "sessions" => Some(Event::Sessions {
+                    names: str_vec(&v["names"])?,
+                    recovery: recovery_vec(&v["recovery"]),
+                }),
                 _ => None,
             }
         }
@@ -1063,6 +1124,9 @@ mod tests {
             Command::LoadSession {
                 name: "home".into(),
             },
+            Command::LoadRecovery {
+                stem: "20260714-093015-4242".into(),
+            },
             Command::ListSessions,
             Command::Shutdown,
         ];
@@ -1525,13 +1589,118 @@ mod tests {
             Vec::new(),
             vec!["my session".to_string(), "café ☕".to_string()],
         ] {
-            let ev = Event::Sessions(names);
+            let ev = Event::Sessions {
+                names,
+                recovery: Vec::new(),
+            };
             let (k, p) = encode_event(&ev);
             assert_eq!(k, KIND_CONTROL);
             assert_eq!(decode_event(k, &p).as_ref(), Some(&ev), "round-trip {ev:?}");
         }
     }
 
+    /// Recovery entries round-trip with their exact wire fields.
+    #[test]
+    fn sessions_recovery_entries_round_trip_and_pin_the_wire_shape() {
+        let ev = Event::Sessions {
+            names: vec!["work".to_string()],
+            recovery: vec![
+                RecoveryEntry {
+                    stem: "20260715-070000-22".into(),
+                    label: "autosaved 2026-07-15 07:00".into(),
+                    tasks: 3,
+                    age_secs: 42,
+                },
+                RecoveryEntry {
+                    stem: "20260714-093015-11".into(),
+                    label: "autosaved 2026-07-14 09:30".into(),
+                    tasks: 1,
+                    age_secs: 90_000,
+                },
+            ],
+        };
+        let (k, p) = encode_event(&ev);
+        assert_eq!(k, KIND_CONTROL);
+        assert_eq!(
+            std::str::from_utf8(&p).unwrap(),
+            r#"{"t":"sessions","names":["work"],"recovery":[{"stem":"20260715-070000-22","label":"autosaved 2026-07-15 07:00","tasks":3,"age":42},{"stem":"20260714-093015-11","label":"autosaved 2026-07-14 09:30","tasks":1,"age":90000}]}"#
+        );
+        assert_eq!(decode_event(k, &p), Some(ev));
+    }
+
+    /// A missing or non-array `recovery` value decodes as an empty list.
+    #[test]
+    fn sessions_frame_without_recovery_key_decodes_empty() {
+        for json in [
+            r#"{"t":"sessions","names":["a"]}"#,
+            r#"{"t":"sessions","names":["a"],"recovery":null}"#,
+            r#"{"t":"sessions","names":["a"],"recovery":"junk"}"#,
+        ] {
+            assert_eq!(
+                decode_event(KIND_CONTROL, json.as_bytes()),
+                Some(Event::Sessions {
+                    names: vec!["a".to_string()],
+                    recovery: Vec::new(),
+                }),
+                "should tolerate {json}"
+            );
+        }
+    }
+
+    /// Malformed recovery members are skipped without dropping valid entries.
+    #[test]
+    fn malformed_recovery_members_drop_without_rejecting_the_event() {
+        let json = r#"{"t":"sessions","names":[],"recovery":[
+            {"stem":5,"label":"x","tasks":1,"age":0},
+            {"label":"x","tasks":1,"age":0},
+            {"stem":"s1","tasks":1,"age":0},
+            {"stem":"s2","label":7,"tasks":1,"age":0},
+            {"stem":"s3","label":"x","age":0},
+            {"stem":"s4","label":"x","tasks":4294967296,"age":0},
+            {"stem":"s5","label":"x","tasks":-1,"age":0},
+            {"stem":"s6","label":"x","tasks":1,"age":-3},
+            {"stem":"s7","label":"x","tasks":1},
+            "flat",
+            {"stem":"good","label":"autosaved","tasks":2,"age":7}
+        ]}"#;
+        assert_eq!(
+            decode_event(KIND_CONTROL, json.as_bytes()),
+            Some(Event::Sessions {
+                names: Vec::new(),
+                recovery: vec![RecoveryEntry {
+                    stem: "good".into(),
+                    label: "autosaved".into(),
+                    tasks: 2,
+                    age_secs: 7,
+                }],
+            })
+        );
+    }
+
+    /// `LoadRecovery` requires a string stem in its wire representation.
+    #[test]
+    fn load_recovery_wire_form() {
+        let (k, p) = encode_command(&Command::LoadRecovery {
+            stem: "20260714-093015-4242".into(),
+        });
+        assert_eq!(k, KIND_CONTROL);
+        assert_eq!(
+            std::str::from_utf8(&p).unwrap(),
+            r#"{"t":"recover","stem":"20260714-093015-4242"}"#
+        );
+        for json in [
+            r#"{"t":"recover"}"#,
+            r#"{"t":"recover","stem":5}"#,
+            r#"{"t":"recover","stem":null}"#,
+        ] {
+            assert_eq!(
+                decode_command(KIND_CONTROL, json.as_bytes()),
+                None,
+                "should reject {json}"
+            );
+        }
+    }
+
     /// The `Screen` event keeps its formatted bytes intact through the raw tail,
     /// including non-UTF-8 bytes (0xFF) an ANSI stream really contains.
     #[test]
diff --git a/src/session.rs b/src/session.rs
index 0735b19..793825f 100644
--- a/src/session.rs
+++ b/src/session.rs
@@ -8,8 +8,11 @@ use std::{
     os::unix::fs::{DirBuilderExt, OpenOptionsExt, PermissionsExt},
     path::{Path, PathBuf},
     sync::atomic::{AtomicU64, Ordering},
+    time::SystemTime,
 };
 
+use crate::protocol::RecoveryEntry;
+
 /// One recipe entry. Entries without a group or name serialize as strings;
 /// other entries use objects whose optional fields are written only when set.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -75,9 +78,8 @@ pub fn sessions_dir(root: Option<PathBuf>) -> Option<PathBuf> {
 /// Missing versions are interpreted as version 1; unsupported versions fail.
 const FORMAT_VERSION: u64 = 1;
 
-/// Serialize the versioned wrapped schema. The stored name distinguishes
-/// names that sanitize to the same filename.
-fn to_json(name: &str, cfg: &SessionConfig) -> String {
+/// Build the recipe's `dirs` object.
+fn dirs_json(cfg: &SessionConfig) -> jzon::JsonValue {
     let mut dirs = jzon::JsonValue::new_object();
     for (dir, entries) in cfg {
         let mut arr = jzon::JsonValue::new_array();
@@ -100,13 +102,24 @@ fn to_json(name: &str, cfg: &SessionConfig) -> String {
         }
         let _ = dirs.insert(dir, arr);
     }
+    dirs
+}
+
+/// Serialize the versioned wrapped schema. The stored name distinguishes
+/// names that sanitize to the same filename.
+fn to_json(name: &str, cfg: &SessionConfig) -> String {
     let mut obj = jzon::JsonValue::new_object();
     let _ = obj.insert("version", FORMAT_VERSION);
     let _ = obj.insert("name", name);
-    let _ = obj.insert("dirs", dirs);
+    let _ = obj.insert("dirs", dirs_json(cfg));
     obj.pretty(2)
 }
 
+/// Serialize the recipe body for content-based change detection.
+pub fn fingerprint_json(cfg: &SessionConfig) -> String {
+    dirs_json(cfg).dump()
+}
+
 /// Parse wrapped and flat schemas, returning the stored name when present.
 /// A wrapped file has an object-valued `dirs`; flat files have entry arrays at
 /// the top level, including when a directory is literally named `dirs`.
@@ -183,9 +196,9 @@ fn from_json(text: &str) -> io::Result<(Option<String>, SessionConfig)> {
 /// Distinguishes concurrent savers' temp files within one process.
 static TMP_SEQ: AtomicU64 = AtomicU64::new(0);
 
-pub fn save_in(dir: &Path, name: &str, cfg: &SessionConfig) -> io::Result<PathBuf> {
-    // Create missing directories with 0700 and restrict the session directory
-    // itself to 0700. Existing parent directories remain unchanged.
+/// Create missing directories with mode 0700 and remove group and other
+/// permissions from `dir`. Existing parent permissions remain unchanged.
+fn ensure_private_dir(dir: &Path) -> io::Result<()> {
     fs::DirBuilder::new()
         .recursive(true)
         .mode(0o700)
@@ -193,40 +206,21 @@ pub fn save_in(dir: &Path, name: &str, cfg: &SessionConfig) -> io::Result<PathBu
     if fs::metadata(dir)?.permissions().mode() & 0o077 != 0 {
         fs::set_permissions(dir, fs::Permissions::from_mode(0o700))?;
     }
-    let trimmed = name.trim();
-    let file_name = format!("{}.json", sanitize(name));
-    let file = dir.join(&file_name);
-
-    // Refuse a stored-name mismatch because distinct names can sanitize to the
-    // same filename. Files without a parseable stored name remain overwritable.
-    match fs::read_to_string(&file) {
-        Ok(text) => {
-            if let Ok((Some(stored), _)) = from_json(&text)
-                && stored != trimmed
-            {
-                return Err(io::Error::new(
-                    io::ErrorKind::AlreadyExists,
-                    format!(
-                        "session \"{trimmed}\" collides with existing \"{stored}\" \
-                         (both map to {file_name})"
-                    ),
-                ));
-            }
-        }
-        Err(e) if e.kind() == io::ErrorKind::NotFound => {}
-        Err(e) => return Err(e),
-    }
+    Ok(())
+}
 
-    // Write a private temp file in the session directory, sync its contents,
-    // then atomically rename it over the recipe. The `.tmp` suffix keeps it
-    // out of `list_in`, and the rename gives the target mode 0600.
+/// Write `contents` to `<dir>/<file_name>` atomically: a private temp file in
+/// `dir`, synced, then renamed over the target. The `.tmp` suffix keeps the
+/// temp out of `list_in`, and the rename gives the target mode 0600.
+fn write_atomic(dir: &Path, file_name: &str, contents: &str) -> io::Result<PathBuf> {
+    let file = dir.join(file_name);
     let pid = std::process::id();
     let (mut tmp_file, tmp) = loop {
         let n = TMP_SEQ.fetch_add(1, Ordering::Relaxed);
-        // Shorten the recipe portion so the decorated temporary filename stays
+        // Shorten the target portion so the decorated temporary filename stays
         // within the 255-byte component limit.
         let suffix = format!(".{pid}.{n}.tmp");
-        let stem = prefix_bytes(&file_name, 254 - suffix.len());
+        let stem = prefix_bytes(file_name, 254 - suffix.len());
         let candidate = dir.join(format!(".{stem}{suffix}"));
         match fs::OpenOptions::new()
             .write(true)
@@ -240,8 +234,8 @@ pub fn save_in(dir: &Path, name: &str, cfg: &SessionConfig) -> io::Result<PathBu
         }
     };
     let written = (|| {
-        tmp_file.write_all(to_json(trimmed, cfg).as_bytes())?;
-        // Persist the contents before publishing the temp file as the recipe.
+        tmp_file.write_all(contents.as_bytes())?;
+        // Persist the contents before publishing the temp file as the target.
         tmp_file.sync_all()?;
         fs::rename(&tmp, &file)
     })();
@@ -252,6 +246,35 @@ pub fn save_in(dir: &Path, name: &str, cfg: &SessionConfig) -> io::Result<PathBu
     Ok(file)
 }
 
+pub fn save_in(dir: &Path, name: &str, cfg: &SessionConfig) -> io::Result<PathBuf> {
+    ensure_private_dir(dir)?;
+    let trimmed = name.trim();
+    let file_name = format!("{}.json", sanitize(name));
+    let file = dir.join(&file_name);
+
+    // Refuse a stored-name mismatch because distinct names can sanitize to the
+    // same filename. Files without a parseable stored name remain overwritable.
+    match fs::read_to_string(&file) {
+        Ok(text) => {
+            if let Ok((Some(stored), _)) = from_json(&text)
+                && stored != trimmed
+            {
+                return Err(io::Error::new(
+                    io::ErrorKind::AlreadyExists,
+                    format!(
+                        "session \"{trimmed}\" collides with existing \"{stored}\" \
+                         (both map to {file_name})"
+                    ),
+                ));
+            }
+        }
+        Err(e) if e.kind() == io::ErrorKind::NotFound => {}
+        Err(e) => return Err(e),
+    }
+
+    write_atomic(dir, &file_name, &to_json(trimmed, cfg))
+}
+
 pub fn load_in(dir: &Path, name: &str) -> io::Result<SessionConfig> {
     let file = dir.join(format!("{}.json", sanitize(name)));
     from_json(&fs::read_to_string(file)?).map(|(_, cfg)| cfg)
@@ -279,6 +302,149 @@ pub fn list_in(dir: &Path) -> Vec<String> {
     names
 }
 
+// --- automatic recovery snapshots -------------------------------------------
+
+/// Target snapshot count when no other live writers share the directory.
+const RECOVERY_KEEP: usize = 10;
+
+/// Recovery-snapshot directory under a session root.
+pub fn recovery_dir(sessions_root: &Path) -> PathBuf {
+    sessions_root.join("recovery")
+}
+
+/// UTC civil time as `(year, month, day, hour, minute, second)`.
+fn civil_utc(t: SystemTime) -> (i64, u32, u32, u64, u64, u64) {
+    let secs = t
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+    let (y, m, d) = crate::harness::civil_from_days((secs / 86_400) as i64);
+    let tod = secs % 86_400;
+    (y, m, d, tod / 3600, (tod % 3600) / 60, tod % 60)
+}
+
+/// Build a `<YYYYMMDD-HHMMSS>-<pid>` recovery filename stem in UTC.
+pub fn recovery_stem(start: SystemTime, pid: u32) -> String {
+    let (y, m, d, hh, mm, ss) = civil_utc(start);
+    format!("{y:04}{m:02}{d:02}-{hh:02}{mm:02}{ss:02}-{pid}")
+}
+
+/// Build the snapshot label `autosaved <YYYY-MM-DD HH:MM>` in UTC.
+pub fn recovery_label(now: SystemTime) -> String {
+    let (y, m, d, hh, mm, _) = civil_utc(now);
+    format!("autosaved {y:04}-{m:02}-{d:02} {hh:02}:{mm:02}")
+}
+
+/// Atomically replace a mode-0600 recovery snapshot, then prune old snapshots.
+/// The written stem and stems naming live process IDs are exempt from pruning.
+pub fn save_recovery_in(
+    dir: &Path,
+    file_stem: &str,
+    name: &str,
+    cfg: &SessionConfig,
+) -> io::Result<PathBuf> {
+    ensure_private_dir(dir)?;
+    let file = write_atomic(dir, &format!("{file_stem}.json"), &to_json(name, cfg))?;
+    prune_recovery(dir, file_stem);
+    Ok(file)
+}
+
+/// List readable recovery snapshots in descending stem order. Invalid files
+/// are skipped, and files without a stored name use their stem as the label.
+pub fn list_recovery_in(dir: &Path) -> Vec<RecoveryEntry> {
+    let mut out = Vec::new();
+    if let Ok(entries) = fs::read_dir(dir) {
+        for e in entries.flatten() {
+            let p = e.path();
+            if p.extension().and_then(|s| s.to_str()) != Some("json") {
+                continue;
+            }
+            let Some(stem) = p.file_stem().and_then(|s| s.to_str()) else {
+                continue;
+            };
+            let Ok((stored, cfg)) = fs::read_to_string(&p).and_then(|t| from_json(&t)) else {
+                continue;
+            };
+            // Saturate task counts; use age zero for unavailable or future mtimes.
+            let tasks =
+                u32::try_from(cfg.values().map(Vec::len).sum::<usize>()).unwrap_or(u32::MAX);
+            let age_secs = fs::metadata(&p)
+                .and_then(|m| m.modified())
+                .ok()
+                .and_then(|mtime| SystemTime::now().duration_since(mtime).ok())
+                .map_or(0, |d| d.as_secs());
+            out.push(RecoveryEntry {
+                stem: stem.to_string(),
+                label: stored.unwrap_or_else(|| stem.to_string()),
+                tasks,
+                age_secs,
+            });
+        }
+    }
+    out.sort_by(|a, b| b.stem.cmp(&a.stem));
+    out
+}
+
+/// Accept a nonempty stem without path separators, extensions, or dot-files.
+fn valid_recovery_stem(stem: &str) -> bool {
+    !stem.is_empty() && !stem.contains(['/', '\\', '.'])
+}
+
+/// Load a recovery snapshot by exact filename stem after path validation.
+pub fn load_recovery_in(dir: &Path, stem: &str) -> io::Result<SessionConfig> {
+    if !valid_recovery_stem(stem) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("invalid recovery stem {stem:?}"),
+        ));
+    }
+    from_json(&fs::read_to_string(dir.join(format!("{stem}.json")))?).map(|(_, cfg)| cfg)
+}
+
+/// Parse a recovery stem's trailing positive `i32` process ID.
+fn stem_pid(stem: &str) -> Option<i32> {
+    let (_, pid) = stem.rsplit_once('-')?;
+    if pid.is_empty() || !pid.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    pid.parse::<i32>().ok().filter(|p| *p > 0)
+}
+
+/// Return whether a valid PID suffix is not known to be dead. Only `ESRCH`
+/// proves death; invalid suffixes receive no liveness protection.
+fn stem_names_live_writer(stem: &str) -> bool {
+    use nix::{errno::Errno, sys::signal::kill, unistd::Pid};
+    stem_pid(stem).is_some_and(|pid| !matches!(kill(Pid::from_raw(pid), None), Err(Errno::ESRCH)))
+}
+
+/// Best-effort pruning that protects `keep_stem` and snapshots whose PID is
+/// not known to be dead. Of the remaining JSON files, retain the lexically
+/// greatest [`RECOVERY_KEEP`] minus one. Filesystem errors are ignored.
+fn prune_recovery(dir: &Path, keep_stem: &str) {
+    let Ok(entries) = fs::read_dir(dir) else {
+        return;
+    };
+    let keep_name = format!("{keep_stem}.json");
+    let mut snapshots: Vec<PathBuf> = entries
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| p.extension().and_then(|s| s.to_str()) == Some("json"))
+        .filter(|p| p.file_name().and_then(|n| n.to_str()) != Some(keep_name.as_str()))
+        .filter(|p| {
+            !p.file_stem()
+                .and_then(|s| s.to_str())
+                .is_some_and(stem_names_live_writer)
+        })
+        .collect();
+    if snapshots.len() < RECOVERY_KEEP {
+        return;
+    }
+    snapshots.sort();
+    for old in &snapshots[..snapshots.len() - (RECOVERY_KEEP - 1)] {
+        let _ = fs::remove_file(old);
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -671,4 +837,335 @@ mod tests {
         }
         let _ = fs::remove_dir_all(&dir);
     }
+
+    /// Fixed instant at 2026-07-14 09:30:15 UTC.
+    fn recovery_instant() -> SystemTime {
+        SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1_784_021_415)
+    }
+
+    /// Out-of-range PID used for dead-writer fixtures.
+    const DEAD_FIXTURE_PID: u32 = 9_999_999;
+
+    /// Spawn and reap a child, then return its inactive PID.
+    fn dead_child_pid() -> u32 {
+        let mut child = std::process::Command::new("sh")
+            .arg("-c")
+            .arg("exit 0")
+            .spawn()
+            .unwrap();
+        let pid = child.id();
+        child.wait().unwrap();
+        pid
+    }
+
+    /// The stem is `<YYYYMMDD-HHMMSS>-<pid>`; the label is the write minute.
+    #[test]
+    fn recovery_stem_and_label_render_utc() {
+        assert_eq!(
+            recovery_stem(recovery_instant(), 4242),
+            "20260714-093015-4242"
+        );
+        assert_eq!(
+            recovery_label(recovery_instant()),
+            "autosaved 2026-07-14 09:30"
+        );
+    }
+
+    /// Snapshots preserve their schema, label, contents, and permissions.
+    #[test]
+    fn recovery_snapshot_round_trips_with_version_and_label() {
+        let base = temp("session_recovery_roundtrip");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![gne("cargo run", "api", "server")]);
+        let stem = recovery_stem(recovery_instant(), 4242);
+        let label = recovery_label(recovery_instant());
+
+        let file = save_recovery_in(&rec, &stem, &label, &cfg).unwrap();
+        assert_eq!(file, rec.join("20260714-093015-4242.json"));
+        let text = fs::read_to_string(&file).unwrap();
+        assert!(text.contains("\"version\": 1"), "{text}");
+        let (stored, parsed) = from_json(&text).unwrap();
+        assert_eq!(stored.as_deref(), Some("autosaved 2026-07-14 09:30"));
+        assert_eq!(parsed, cfg);
+        assert_eq!(load_in(&rec, &stem).unwrap(), cfg);
+
+        let mode = |p: &Path| fs::metadata(p).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode(&rec), 0o700);
+        assert_eq!(mode(&file), 0o600);
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// Pruning keeps the lexically greatest [`RECOVERY_KEEP`] filenames.
+    #[test]
+    fn recovery_prune_keeps_the_newest_ten() {
+        let base = temp("session_recovery_prune");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        for i in 1..=12u32 {
+            let stem = format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}");
+            save_recovery_in(&rec, &stem, "autosaved 2026-07-14 09:30", &cfg).unwrap();
+        }
+
+        let mut names: Vec<String> = fs::read_dir(&rec)
+            .unwrap()
+            .flatten()
+            .map(|e| e.file_name().into_string().unwrap())
+            .collect();
+        names.sort();
+        let expected: Vec<String> = (3..=12u32)
+            .map(|i| format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}.json"))
+            .collect();
+        assert_eq!(names, expected, "prune must drop exactly the oldest two");
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// Pruning retains the just-written stem even when it is the oldest.
+    #[test]
+    fn recovery_prune_exempts_the_active_stem() {
+        let base = temp("session_recovery_prune_active");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        for i in 1..=10u32 {
+            let stem = format!("20260715-0930{i:02}-{DEAD_FIXTURE_PID}");
+            save_recovery_in(&rec, &stem, "autosaved 2026-07-15 09:30", &cfg).unwrap();
+        }
+
+        // This dead-PID stem sorts below every existing snapshot.
+        let active_stem = format!("20260714-093000-{DEAD_FIXTURE_PID}");
+        let active =
+            save_recovery_in(&rec, &active_stem, "autosaved 2026-07-15 09:30", &cfg).unwrap();
+        assert!(active.exists(), "the just-written snapshot must survive");
+
+        let mut names: Vec<String> = fs::read_dir(&rec)
+            .unwrap()
+            .flatten()
+            .map(|e| e.file_name().into_string().unwrap())
+            .collect();
+        names.sort();
+        let mut expected = vec![format!("{active_stem}.json")];
+        expected
+            .extend((2..=10u32).map(|i| format!("20260715-0930{i:02}-{DEAD_FIXTURE_PID}.json")));
+        assert_eq!(
+            names, expected,
+            "the active file plus the nine newest others must remain"
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// Below [`RECOVERY_KEEP`] files, pruning removes nothing.
+    #[test]
+    fn recovery_prune_below_limit_removes_nothing() {
+        let base = temp("session_recovery_prune_few");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        for i in 1..=5u32 {
+            let stem = format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}");
+            save_recovery_in(&rec, &stem, "autosaved 2026-07-14 09:30", &cfg).unwrap();
+        }
+
+        assert_eq!(
+            fs::read_dir(&rec).unwrap().flatten().count(),
+            5,
+            "no file may be pruned below the retention limit"
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// Pruning retains an older snapshot whose PID is still live.
+    #[test]
+    fn recovery_prune_exempts_live_pid_stems() {
+        let base = temp("session_recovery_prune_live");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        // The oldest candidate names this live test process.
+        let live_stem = format!("20260101-000000-{}", std::process::id());
+        save_recovery_in(&rec, &live_stem, "autosaved 2026-01-01 00:00", &cfg).unwrap();
+        for i in 1..=11u32 {
+            let stem = format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}");
+            save_recovery_in(&rec, &stem, "autosaved 2026-07-14 09:30", &cfg).unwrap();
+        }
+
+        let mut names: Vec<String> = fs::read_dir(&rec)
+            .unwrap()
+            .flatten()
+            .map(|e| e.file_name().into_string().unwrap())
+            .collect();
+        names.sort();
+        let mut expected = vec![format!("{live_stem}.json")];
+        expected
+            .extend((2..=11u32).map(|i| format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}.json")));
+        assert_eq!(
+            names, expected,
+            "the live writer's file must survive; the oldest dead file must not"
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// A snapshot from an exited process is eligible for pruning.
+    #[test]
+    fn recovery_prune_removes_dead_pid_stems() {
+        let base = temp("session_recovery_prune_dead");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        let oldest = format!("20260101-000000-{}", dead_child_pid());
+        save_recovery_in(&rec, &oldest, "autosaved 2026-01-01 00:00", &cfg).unwrap();
+        for i in 1..=10u32 {
+            let stem = format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}");
+            save_recovery_in(&rec, &stem, "autosaved 2026-07-14 09:30", &cfg).unwrap();
+        }
+
+        assert!(
+            !rec.join(format!("{oldest}.json")).exists(),
+            "a dead writer's snapshot is an ordinary prune candidate"
+        );
+        assert_eq!(
+            fs::read_dir(&rec).unwrap().flatten().count(),
+            RECOVERY_KEEP,
+            "dead-stem retention must converge to the bound"
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// Invalid PID suffixes receive no liveness protection.
+    #[test]
+    fn recovery_prune_ignores_malformed_pid_suffixes() {
+        let base = temp("session_recovery_prune_malformed");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        let malformed = [
+            "20260101-000000-x42",         // non-numeric pid
+            "20260101-000001-99999999999", // past i32::MAX
+            "20260101-000002-",            // empty pid
+            "20260101-000003-0",           // zero is not a positive pid
+        ];
+        for stem in malformed {
+            save_recovery_in(&rec, stem, "autosaved 2026-01-01 00:00", &cfg).unwrap();
+        }
+        for i in 1..=10u32 {
+            let stem = format!("20260714-0930{i:02}-{DEAD_FIXTURE_PID}");
+            save_recovery_in(&rec, &stem, "autosaved 2026-07-14 09:30", &cfg).unwrap();
+        }
+
+        for stem in malformed {
+            assert!(
+                !rec.join(format!("{stem}.json")).exists(),
+                "malformed stem {stem:?} must be pruned like any candidate"
+            );
+        }
+        assert_eq!(
+            fs::read_dir(&rec).unwrap().flatten().count(),
+            RECOVERY_KEEP,
+            "only the well-formed newest files may remain"
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// The recovery directory is excluded from named-session listings.
+    #[test]
+    fn list_ignores_the_recovery_subdirectory() {
+        let dir = temp("session_list_recovery");
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![e("vim")]);
+        save_in(&dir, "real", &cfg).unwrap();
+        save_recovery_in(
+            &recovery_dir(&dir),
+            &recovery_stem(recovery_instant(), 7),
+            &recovery_label(recovery_instant()),
+            &cfg,
+        )
+        .unwrap();
+
+        assert_eq!(list_in(&dir), vec!["real".to_string()]);
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    /// Listing sorts by descending stem and skips corrupt files.
+    #[test]
+    fn recovery_listing_is_newest_first_and_skips_corrupt_files() {
+        let base = temp("session_recovery_list");
+        let rec = recovery_dir(&base);
+        assert!(
+            list_recovery_in(&rec).is_empty(),
+            "a missing recovery dir must list empty"
+        );
+
+        let mut one = SessionConfig::new();
+        one.insert("~/a".into(), vec![e("vim")]);
+        let mut three = SessionConfig::new();
+        three.insert("~/a".into(), vec![e("vim"), e("top")]);
+        three.insert("~/b".into(), vec![e("make")]);
+        save_recovery_in(
+            &rec,
+            "20260714-093015-11",
+            "autosaved 2026-07-14 09:30",
+            &one,
+        )
+        .unwrap();
+        save_recovery_in(
+            &rec,
+            "20260715-070000-22",
+            "autosaved 2026-07-15 07:00",
+            &three,
+        )
+        .unwrap();
+        fs::write(rec.join("20260716-000000-33.json"), "{not json").unwrap();
+
+        let entries = list_recovery_in(&rec);
+        assert_eq!(
+            entries.len(),
+            2,
+            "the corrupt snapshot must drop alone: {entries:?}"
+        );
+        assert_eq!(entries[0].stem, "20260715-070000-22");
+        assert_eq!(entries[0].label, "autosaved 2026-07-15 07:00");
+        assert_eq!(entries[0].tasks, 3);
+        assert_eq!(entries[1].stem, "20260714-093015-11");
+        assert_eq!(entries[1].label, "autosaved 2026-07-14 09:30");
+        assert_eq!(entries[1].tasks, 1);
+        assert!(
+            entries.iter().all(|en| en.age_secs < 3600),
+            "just-written files must read near-zero ages: {entries:?}"
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
+
+    /// Recovery loads reject empty, dotted, or path-shaped stems.
+    #[test]
+    fn load_recovery_in_loads_by_stem_and_rejects_traversal() {
+        let base = temp("session_recovery_load");
+        let rec = recovery_dir(&base);
+        let mut cfg = SessionConfig::new();
+        cfg.insert("~/p".into(), vec![gne("cargo run", "api", "server")]);
+        save_recovery_in(
+            &rec,
+            "20260714-093015-11",
+            "autosaved 2026-07-14 09:30",
+            &cfg,
+        )
+        .unwrap();
+
+        assert_eq!(load_recovery_in(&rec, "20260714-093015-11").unwrap(), cfg);
+        for bad in ["../x", "a/b", "a.b", "a\\b", ""] {
+            let err = load_recovery_in(&rec, bad).unwrap_err();
+            assert_eq!(
+                err.kind(),
+                io::ErrorKind::InvalidInput,
+                "stem {bad:?} must be refused, got {err}"
+            );
+        }
+        assert_eq!(
+            load_recovery_in(&rec, "20990101-000000-1")
+                .unwrap_err()
+                .kind(),
+            io::ErrorKind::NotFound
+        );
+        let _ = fs::remove_dir_all(&base);
+    }
 }
diff --git a/src/supervisor.rs b/src/supervisor.rs
index 77083d7..a5e2126 100644
--- a/src/supervisor.rs
+++ b/src/supervisor.rs
@@ -89,6 +89,13 @@ fn effective_scrollback(flag: Option<usize>, env: Option<&str>) -> usize {
 /// that do not exit after SIGTERM.
 const KILL_GRACE: Duration = Duration::from_secs(2);
 
+/// Quiet period used to coalesce recipe changes into one recovery write.
+const RECOVERY_DEBOUNCE: Duration = Duration::from_secs(2);
+
+/// Interval for detecting stored-command changes that occur without a recipe
+/// mutation, such as a newly captured agent resume ID.
+const RECOVERY_CADENCE: Duration = Duration::from_secs(60);
+
 /// Maximum stored label length in Unicode scalar values after normalization,
 /// shared by group and display-name assignments.
 const MAX_LABEL_CHARS: usize = 64;
@@ -155,6 +162,45 @@ fn harness_home(env: &[(OsString, OsString)], h: &dyn harness::Harness) -> Optio
     val(h.home_env_var()).or_else(|| Some(val("HOME")?.join(h.home_dot_dir())))
 }
 
+/// State for automatic recovery snapshots. Write failures do not interrupt
+/// task supervision, and teardown does not write or delete snapshots.
+struct Recovery {
+    /// Recovery writes are opt-in in unit tests.
+    enabled: bool,
+    /// Whether a potentially recipe-changing command awaits a debounced pass.
+    dirty: bool,
+    /// The most recent scheduled recipe change: the debounce anchor.
+    last_mutation: Option<Instant>,
+    /// The start of the most recent cadence interval.
+    last_cadence: Instant,
+    /// Sessions root and recipe fingerprint of the last successful write.
+    /// A match is skipped only while the corresponding snapshot still exists.
+    last_written: Option<(PathBuf, String)>,
+    /// Filename stem reused for this supervisor's recovery writes.
+    stem: String,
+    /// Whether a write failure has been reported since the last successful write.
+    failing: bool,
+    /// Debounce and content-check intervals.
+    debounce: Duration,
+    cadence: Duration,
+}
+
+impl Recovery {
+    fn new() -> Recovery {
+        Recovery {
+            enabled: !cfg!(test),
+            dirty: false,
+            last_mutation: None,
+            last_cadence: Instant::now(),
+            last_written: None,
+            stem: session::recovery_stem(std::time::SystemTime::now(), std::process::id()),
+            failing: false,
+            debounce: RECOVERY_DEBOUNCE,
+            cadence: RECOVERY_CADENCE,
+        }
+    }
+}
+
 pub struct Supervisor {
     tasks: Vec<Task>,
     /// Removed tasks whose process groups may still be winding down: TERMed at
@@ -196,6 +242,8 @@ pub struct Supervisor {
     /// Capture assets keyed by canonicalized root and reused for this
     /// supervisor's lifetime.
     capture: BTreeMap<PathBuf, assets::CaptureAssets>,
+    /// Automatic fleet-recovery snapshot state.
+    recovery: Recovery,
 }
 
 impl Supervisor {
@@ -214,6 +262,7 @@ impl Supervisor {
             waker: Arc::new(Mutex::new(None)),
             kill_grace: KILL_GRACE,
             capture: BTreeMap::new(),
+            recovery: Recovery::new(),
         }
     }
 
@@ -228,6 +277,14 @@ impl Supervisor {
         self.kill_grace = grace;
     }
 
+    /// Enable recovery with test-specific timings.
+    #[cfg(test)]
+    pub fn set_recovery_timing(&mut self, debounce: Duration, cadence: Duration) {
+        self.recovery.enabled = true;
+        self.recovery.debounce = debounce;
+        self.recovery.cadence = cadence;
+    }
+
     /// Install the sender the current serving loop waits on, so task reader
     /// threads (present and future; they share this one slot) wake it on output.
     pub fn set_waker(&self, tx: Sender<Wake>) {
@@ -260,6 +317,21 @@ impl Supervisor {
     /// Apply one client request. Fire-and-forget: any result (a save/load
     /// notice, a spawn failure) is queued as `Event::Status`, never returned.
     pub fn apply(&mut self, cmd: Command) {
+        // Recipe-affecting command variants arm recovery before validation;
+        // fingerprinting filters rejected commands and other no-ops.
+        if matches!(
+            &cmd,
+            Command::Spawn { .. }
+                | Command::Remove { .. }
+                | Command::Restart { .. }
+                | Command::SetGroup { .. }
+                | Command::SetName { .. }
+                | Command::LoadSession { .. }
+                | Command::LoadRecovery { .. }
+        ) {
+            self.recovery.dirty = true;
+            self.recovery.last_mutation = Some(Instant::now());
+        }
         match cmd {
             Command::Spawn {
                 command,
@@ -366,6 +438,7 @@ impl Supervisor {
             }
             Command::SaveSession { name } => self.save_session(&name),
             Command::LoadSession { name } => self.load_session(&name),
+            Command::LoadRecovery { stem } => self.load_recovery(&stem),
             Command::ListSessions => self.list_sessions(),
             Command::Shutdown => self.shutdown_all(),
         }
@@ -497,6 +570,85 @@ impl Supervisor {
                 self.events.push(Event::Screen(view));
             }
         }
+
+        self.maybe_write_recovery(now);
+    }
+
+    /// Run a due debounce or cadence pass. Skip empty or unchanged recipes and
+    /// report at most one consecutive write-failure notice.
+    fn maybe_write_recovery(&mut self, now: Instant) {
+        if !self.recovery.enabled {
+            return;
+        }
+        let debounce_due = self.recovery.dirty
+            && self
+                .recovery
+                .last_mutation
+                .is_some_and(|t| now.duration_since(t) >= self.recovery.debounce);
+        let cadence_due = now.duration_since(self.recovery.last_cadence) >= self.recovery.cadence;
+        if !(debounce_due || cadence_due) {
+            return;
+        }
+        if cadence_due {
+            self.recovery.last_cadence = now;
+        }
+        // Do not replace an existing snapshot with an empty recipe.
+        if self.tasks.is_empty() {
+            self.recovery.dirty = false;
+            return;
+        }
+        // A missing config root disables this pass.
+        let Some(root) = self.sessions_root() else {
+            self.recovery.dirty = false;
+            return;
+        };
+        // Refresh finished tasks' resume IDs before serialization.
+        for t in &mut self.tasks {
+            scrape_now(t);
+        }
+        let cfg = self.session_config();
+        // Exclude the timestamped label from content comparison.
+        let hash = fnv1a_hex(session::fingerprint_json(&cfg).as_bytes());
+        // Deduplication is scoped to the current root and requires the snapshot
+        // to remain on disk, so a removed snapshot is recreated on a due pass.
+        let dest = session::recovery_dir(&root).join(format!("{}.json", self.recovery.stem));
+        if self
+            .recovery
+            .last_written
+            .as_ref()
+            .is_some_and(|(r, h)| *r == root && *h == hash)
+            && std::fs::metadata(&dest).is_ok()
+        {
+            self.recovery.dirty = false;
+            return;
+        }
+        let label = session::recovery_label(std::time::SystemTime::now());
+        match session::save_recovery_in(
+            &session::recovery_dir(&root),
+            &self.recovery.stem,
+            &label,
+            &cfg,
+        ) {
+            Ok(_) => {
+                self.recovery.last_written = Some((root, hash));
+                self.recovery.failing = false;
+            }
+            Err(e) => {
+                // Keep retrying on cadence passes, but report only the first
+                // consecutive failure.
+                if !self.recovery.failing {
+                    self.recovery.failing = true;
+                    self.status(format!("recovery snapshot failed: {e}"));
+                }
+            }
+        }
+        self.recovery.dirty = false;
+    }
+
+    /// Run recovery maintenance between clients without queuing task or screen
+    /// snapshots. Debounce and cadence checks bound the write rate.
+    pub fn recovery_maintenance(&mut self) {
+        self.maybe_write_recovery(Instant::now());
     }
 
     /// Hand the client every event queued since the last drain.
@@ -780,41 +932,30 @@ impl Supervisor {
         self.status(status);
     }
 
-    /// Answer `ListSessions` with the recipe names under this connection's
-    /// session root (sorted by `list_in`); no root reads as no sessions.
+    /// List named sessions and recovery snapshots from the connection's
+    /// session root.
     fn list_sessions(&mut self) {
-        let names = self
+        let (names, recovery) = self
             .sessions_root()
-            .map(|root| session::list_in(&root))
+            .map(|root| {
+                (
+                    session::list_in(&root),
+                    session::list_recovery_in(&session::recovery_dir(&root)),
+                )
+            })
             .unwrap_or_default();
-        self.events.push(Event::Sessions(names));
+        self.events.push(Event::Sessions { names, recovery });
     }
 
-    /// Spawn every command in the named session, each in its (existing) dir.
+    /// Spawn every entry of a loaded recipe, each in its (existing) dir.
     /// Missing dirs are skipped rather than spawning tasks doomed to fail on
-    /// chdir.
-    fn load_session(&mut self, name: &str) {
-        let Some(root) = self.sessions_root() else {
-            self.status("load failed: no config directory available");
-            return;
-        };
-        let cfg = match session::load_in(&root, name) {
-            Ok(c) => c,
-            // Preserve load errors; only a missing file maps to "not found".
-            Err(e) if e.kind() == io::ErrorKind::NotFound => {
-                self.status(format!("session '{name}' not found"));
-                return;
-            }
-            Err(e) => {
-                self.status(format!("session '{name}' failed to load: {e}"));
-                return;
-            }
-        };
-        let Some(launch) = self.launch_or_refuse() else {
-            return;
-        };
+    /// chdir. Returns `(spawned, skipped, failed)` for the caller's notice, or
+    /// `None` when no launch context is installed (already refused with its
+    /// own notice).
+    fn materialize(&mut self, cfg: &SessionConfig) -> Option<(usize, usize, usize)> {
+        let launch = self.launch_or_refuse()?;
         let (mut spawned, mut skipped, mut failed) = (0usize, 0usize, 0usize);
-        for (dir, entries) in &cfg {
+        for (dir, entries) in cfg {
             let resolved = path::resolve(&launch.cwd, dir);
             if !resolved.is_dir() {
                 skipped += entries.len();
@@ -839,6 +980,30 @@ impl Supervisor {
                 }
             }
         }
+        Some((spawned, skipped, failed))
+    }
+
+    /// Spawn every command in the named session via `materialize`.
+    fn load_session(&mut self, name: &str) {
+        let Some(root) = self.sessions_root() else {
+            self.status("load failed: no config directory available");
+            return;
+        };
+        let cfg = match session::load_in(&root, name) {
+            Ok(c) => c,
+            // Preserve load errors; only a missing file maps to "not found".
+            Err(e) if e.kind() == io::ErrorKind::NotFound => {
+                self.status(format!("session '{name}' not found"));
+                return;
+            }
+            Err(e) => {
+                self.status(format!("session '{name}' failed to load: {e}"));
+                return;
+            }
+        };
+        let Some((spawned, skipped, failed)) = self.materialize(&cfg) else {
+            return;
+        };
         // Omit zero buckets, except report zero tasks for an empty recipe.
         let mut parts = Vec::new();
         if spawned > 0 || (skipped == 0 && failed == 0) {
@@ -854,6 +1019,39 @@ impl Supervisor {
         }
         self.status(format!("loaded '{name}': {}", parts.join(", ")));
     }
+
+    /// Load a recovery snapshot by stem and suggest saving it as a named session.
+    fn load_recovery(&mut self, stem: &str) {
+        let Some(root) = self.sessions_root() else {
+            self.status("load failed: no config directory available");
+            return;
+        };
+        let cfg = match session::load_recovery_in(&session::recovery_dir(&root), stem) {
+            Ok(c) => c,
+            // Preserve load errors; only a missing file maps to "not found".
+            Err(e) if e.kind() == io::ErrorKind::NotFound => {
+                self.status(format!("recovery snapshot '{stem}' not found"));
+                return;
+            }
+            Err(e) => {
+                self.status(format!("recovery snapshot '{stem}' failed to load: {e}"));
+                return;
+            }
+        };
+        let Some((_, skipped, failed)) = self.materialize(&cfg) else {
+            return;
+        };
+        let mut msg = String::from("loaded recovery snapshot; save to name it");
+        if skipped > 0 {
+            msg.push_str(&format!(
+                ", {skipped} skipped (missing dir, task limit, or command too long)"
+            ));
+        }
+        if failed > 0 {
+            msg.push_str(&format!(", {failed} failed to spawn"));
+        }
+        self.status(msg);
+    }
 }
 
 #[cfg(test)]
diff --git a/src/supervisor_capture_tests.rs b/src/supervisor_capture_tests.rs
index 5dad1d7..7dfb9b6 100644
--- a/src/supervisor_capture_tests.rs
+++ b/src/supervisor_capture_tests.rs
@@ -1103,3 +1103,69 @@ fn non_agent_entries_survive_save_as_plain_strings() {
     );
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+/// Cadence passes persist changed capture IDs without rewriting stable recipes.
+#[test]
+fn recovery_cadence_rewrites_on_capture_drift_and_skips_when_static() {
+    let dir = scratch("cap_recovery_cadence");
+    let (bin, runtime, config) = (dir.join("bin"), dir.join("run"), dir.join("config"));
+    install_stub(&bin, "claude", &dir);
+    let mut s = Supervisor::new(24, 80, 2000);
+    s.set_launch_context(agent_ctx_plus(
+        &bin,
+        &runtime,
+        dir.clone(),
+        &[("FLEETCOM_CONFIG_DIR", &config)],
+    ));
+    s.set_recovery_timing(Duration::from_millis(20), Duration::from_millis(100));
+    spawn(&mut s, "claude", dir.clone());
+    let _ = wait_argv(&mut s, &dir.join("argv"));
+
+    let rec = config.join("sessions").join("recovery");
+    let snapshot = |rec: &Path| -> Option<(PathBuf, String)> {
+        let p = std::fs::read_dir(rec).ok()?.flatten().next()?.path();
+        let text = std::fs::read_to_string(&p).ok()?;
+        Some((p, text))
+    };
+    // The initial debounced snapshot contains only the spawn-time ID.
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.tick();
+            snapshot(&rec).is_some()
+        }),
+        "the spawn snapshot never landed"
+    );
+    assert!(!snapshot(&rec).unwrap().1.contains(CAP_OTHER));
+
+    // Change the capture ID without a recipe mutation.
+    let cap = s.tasks[0].capture_file.clone().expect("capture file set");
+    std::fs::write(
+        &cap,
+        format!(
+            r#"{{"session_id":"{CAP_OTHER}","hook_event_name":"SessionStart","source":"clear"}}"#
+        ),
+    )
+    .unwrap();
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.tick();
+            snapshot(&rec).is_some_and(|(_, t)| t.contains(CAP_OTHER))
+        }),
+        "the cadence pass never picked up the drifted ID"
+    );
+
+    // Stable recipe content leaves the snapshot unchanged.
+    let (path, _) = snapshot(&rec).unwrap();
+    let mtime = std::fs::metadata(&path).unwrap().modified().unwrap();
+    let rewritten = wait_until(Duration::from_millis(600), || {
+        s.tick();
+        std::fs::metadata(&path).unwrap().modified().unwrap() != mtime
+    });
+    assert!(
+        !rewritten,
+        "an unchanged recipe must not rewrite the snapshot"
+    );
+    let names: Vec<_> = std::fs::read_dir(&rec).unwrap().flatten().collect();
+    assert_eq!(names.len(), 1, "one incarnation owns one snapshot file");
+    let _ = std::fs::remove_dir_all(&dir);
+}
diff --git a/src/supervisor_tests.rs b/src/supervisor_tests.rs
index 0326d1f..71a720f 100644
--- a/src/supervisor_tests.rs
+++ b/src/supervisor_tests.rs
@@ -1174,7 +1174,7 @@ fn session_commands_use_the_launch_context_config_dir() {
     let evs = s.drain();
     assert!(
         evs.iter()
-            .any(|e| matches!(e, Event::Sessions(n) if n == &["ctx".to_string()])),
+            .any(|e| matches!(e, Event::Sessions { names, .. } if names == &["ctx".to_string()])),
         "list must see the recipe save just wrote; got {evs:?}"
     );
 
@@ -1608,5 +1608,486 @@ fn key_command_encodes_against_live_cursor_mode() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+// --- recovery-snapshot writer -------------------------------------------
+
+/// Build a supervisor with recovery enabled at test-specific intervals.
+fn recovery_sup(config: &Path, cwd: PathBuf, debounce: Duration, cadence: Duration) -> Supervisor {
+    let mut s = Supervisor::new(24, 80, 2000);
+    s.set_launch_context(config_ctx(config, cwd, &[]));
+    s.set_recovery_timing(debounce, cadence);
+    s
+}
+
+/// Sorted recovery-snapshot filenames under `config`'s session root.
+fn recovery_files(config: &Path) -> Vec<String> {
+    let mut names: Vec<String> = std::fs::read_dir(config.join("sessions").join("recovery"))
+        .map(|it| {
+            it.flatten()
+                .map(|e| e.file_name().to_string_lossy().into_owned())
+                .collect()
+        })
+        .unwrap_or_default();
+    names.sort();
+    names
+}
+
+/// Read and clear the writer's dirty flag.
+fn take_dirty(s: &mut Supervisor) -> bool {
+    std::mem::replace(&mut s.recovery.dirty, false)
+}
+
+/// Recipe-changing commands arm recovery even when rejected; tags do not.
+#[test]
+fn recovery_arms_on_structural_mutations_not_tag() {
+    let mut s = sup(24, 80);
+    assert!(!s.recovery.dirty, "a fresh supervisor starts clean");
+
+    spawn(&mut s, "sleep 30", here());
+    assert!(take_dirty(&mut s), "Spawn must arm");
+    let id = first_id(&mut s);
+
+    s.recovery.dirty = false; // first_id ticks; reassert a clean baseline
+    s.apply(Command::Tag { id, on: true });
+    assert!(
+        !take_dirty(&mut s),
+        "Tag is not recipe state and must not arm"
+    );
+
+    s.apply(Command::SetGroup {
+        id,
+        group: Some("api".into()),
+    });
+    assert!(take_dirty(&mut s), "SetGroup must arm");
+
+    s.apply(Command::SetName {
+        id,
+        name: Some("server".into()),
+    });
+    assert!(take_dirty(&mut s), "SetName must arm");
+
+    s.apply(Command::Restart { id });
+    assert!(take_dirty(&mut s), "Restart must arm");
+
+    s.apply(Command::LoadSession {
+        name: "ghost".into(),
+    });
+    assert!(take_dirty(&mut s), "LoadSession must arm");
+
+    s.apply(Command::LoadRecovery {
+        stem: "20990101-000000-1".into(),
+    });
+    assert!(take_dirty(&mut s), "LoadRecovery must arm");
+
+    s.apply(Command::Remove { id });
+    assert!(take_dirty(&mut s), "Remove must arm");
+}
+
+/// Session listings include recovery metadata in descending stem order.
+#[test]
+fn list_sessions_includes_recovery_snapshots_newest_first() {
+    let dir = scratch("recovery_list_wire");
+    let config = dir.join("config");
+    let mut s = Supervisor::new(24, 80, 2000);
+    s.set_launch_context(config_ctx(&config, dir.clone(), &[]));
+
+    let rec = config.join("sessions").join("recovery");
+    let entry = |cmd: &str| SessionEntry {
+        cmd: cmd.into(),
+        group: None,
+        name: None,
+    };
+    let mut one = SessionConfig::new();
+    one.insert("~/a".into(), vec![entry("vim")]);
+    let mut two = SessionConfig::new();
+    two.insert("~/a".into(), vec![entry("vim"), entry("top")]);
+    session::save_recovery_in(
+        &rec,
+        "20260714-093015-11",
+        "autosaved 2026-07-14 09:30",
+        &one,
+    )
+    .unwrap();
+    session::save_recovery_in(
+        &rec,
+        "20260715-070000-22",
+        "autosaved 2026-07-15 07:00",
+        &two,
+    )
+    .unwrap();
+
+    s.apply(Command::ListSessions);
+    let evs = s.drain();
+    let (names, recovery) = evs
+        .iter()
+        .find_map(|e| match e {
+            Event::Sessions { names, recovery } => Some((names, recovery)),
+            _ => None,
+        })
+        .expect("a Sessions reply");
+    assert!(names.is_empty(), "no recipes were saved; got {names:?}");
+    let summary: Vec<(&str, &str, u32)> = recovery
+        .iter()
+        .map(|r| (r.stem.as_str(), r.label.as_str(), r.tasks))
+        .collect();
+    assert_eq!(
+        summary,
+        vec![
+            ("20260715-070000-22", "autosaved 2026-07-15 07:00", 2),
+            ("20260714-093015-11", "autosaved 2026-07-14 09:30", 1),
+        ],
+        "snapshots must list newest first with labels and task counts"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Recovery loading restores commands, groups, and names and reports success.
+#[test]
+fn load_recovery_materializes_the_fleet_and_notices() {
+    let dir = scratch("recovery_load_wire");
+    let config = dir.join("config");
+    let mut s = Supervisor::new(24, 80, 2000);
+    s.set_launch_context(config_ctx(&config, dir.clone(), &[]));
+
+    let mut cfg = SessionConfig::new();
+    cfg.insert(
+        dir.to_string_lossy().into_owned(),
+        vec![
+            SessionEntry {
+                cmd: "sleep 30".into(),
+                group: Some("api".into()),
+                name: None,
+            },
+            SessionEntry {
+                cmd: "sleep 31".into(),
+                group: None,
+                name: Some("web".into()),
+            },
+        ],
+    );
+    session::save_recovery_in(
+        &config.join("sessions").join("recovery"),
+        "20260714-093015-11",
+        "autosaved 2026-07-14 09:30",
+        &cfg,
+    )
+    .unwrap();
+
+    s.apply(Command::LoadRecovery {
+        stem: "20260714-093015-11".into(),
+    });
+    let evs = s.drain();
+    assert!(
+        evs.iter().any(|e| matches!(
+            e,
+            Event::Status(m) if m == "loaded recovery snapshot; save to name it"
+        )),
+        "a clean load must report exactly the rename-steering notice; got {evs:?}"
+    );
+    assert_eq!(s.tasks.len(), 2, "both snapshot commands must spawn");
+    let by_cmd = |s: &Supervisor, cmd: &str| {
+        let t = s
+            .tasks
+            .iter()
+            .find(|t| t.command == cmd)
+            .unwrap_or_else(|| panic!("task '{cmd}' missing after load"));
+        (t.group.clone(), t.name.clone())
+    };
+    assert_eq!(by_cmd(&s, "sleep 30"), (Some("api".into()), None));
+    assert_eq!(by_cmd(&s, "sleep 31"), (None, Some("web".into())));
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Unknown and path-shaped recovery stems fail without spawning tasks.
+#[test]
+fn load_recovery_refuses_unknown_and_traversal_stems() {
+    let dir = scratch("recovery_load_refuse");
+    let config = dir.join("config");
+    let mut s = Supervisor::new(24, 80, 2000);
+    s.set_launch_context(config_ctx(&config, dir.clone(), &[]));
+
+    s.apply(Command::LoadRecovery {
+        stem: "20990101-000000-1".into(),
+    });
+    assert!(
+        s.drain().iter().any(|e| matches!(
+            e,
+            Event::Status(m) if m == "recovery snapshot '20990101-000000-1' not found"
+        )),
+        "an unknown stem must read as not-found"
+    );
+
+    s.apply(Command::LoadRecovery {
+        stem: "../x".into(),
+    });
+    assert!(
+        s.drain().iter().any(|e| matches!(
+            e,
+            Event::Status(m) if m.starts_with("recovery snapshot '../x' failed to load:")
+        )),
+        "a traversal stem must be refused, not probed"
+    );
+    assert!(s.tasks.is_empty(), "refused loads must spawn nothing");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Debouncing coalesces a mutation burst into one complete snapshot.
+#[test]
+fn recovery_debounce_coalesces_a_mutation_burst() {
+    let dir = scratch("recovery_debounce");
+    let config = dir.join("config");
+    let mut s = recovery_sup(
+        &config,
+        dir.clone(),
+        Duration::from_millis(500),
+        Duration::from_secs(600),
+    );
+    spawn(&mut s, "sleep 30", dir.clone());
+    spawn(&mut s, "sleep 31", dir.clone());
+    spawn(&mut s, "sleep 32", dir.clone());
+    s.tick();
+    assert!(
+        recovery_files(&config).is_empty(),
+        "a write inside the debounce window defeats coalescing"
+    );
+
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.tick();
+            !recovery_files(&config).is_empty()
+        }),
+        "the debounced snapshot never landed"
+    );
+    let files = recovery_files(&config);
+    assert_eq!(
+        files.len(),
+        1,
+        "a burst must produce one snapshot: {files:?}"
+    );
+    let text =
+        std::fs::read_to_string(config.join("sessions").join("recovery").join(&files[0])).unwrap();
+    for cmd in ["sleep 30", "sleep 31", "sleep 32"] {
+        assert!(text.contains(cmd), "snapshot must carry {cmd:?}: {text}");
+    }
+    assert!(!s.recovery.dirty, "a completed pass clears the flag");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Empty fleets do not create or replace recovery snapshots.
+#[test]
+fn recovery_empty_fleet_never_writes() {
+    let dir = scratch("recovery_empty");
+    let config = dir.join("config");
+    let mut s = recovery_sup(
+        &config,
+        dir.clone(),
+        Duration::from_millis(100),
+        Duration::from_millis(200),
+    );
+    // Cadence passes do not snapshot an initially empty fleet.
+    assert!(
+        !wait_until(Duration::from_millis(600), || {
+            s.tick();
+            !recovery_files(&config).is_empty()
+        }),
+        "an idle empty fleet must never write"
+    );
+
+    // Remove the only task before the debounced pass runs.
+    spawn(&mut s, "sleep 30", dir.clone());
+    let id = s.tasks[0].id;
+    s.apply(Command::Remove { id });
+    assert!(
+        !wait_until(Duration::from_millis(600), || {
+            s.tick();
+            !recovery_files(&config).is_empty()
+        }),
+        "a fleet emptied before the pass must never write"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Persistent write failures emit one notice and do not interrupt supervision.
+#[test]
+fn recovery_write_failure_notices_once_and_keeps_supervising() {
+    let dir = scratch("recovery_fail");
+    let config = dir.join("config");
+    // A plain file where `recovery/` must go fails every write attempt.
+    std::fs::create_dir_all(config.join("sessions")).unwrap();
+    std::fs::write(config.join("sessions").join("recovery"), "not a dir").unwrap();
+    let mut s = recovery_sup(
+        &config,
+        dir.clone(),
+        Duration::from_millis(10),
+        Duration::from_millis(50),
+    );
+    spawn(&mut s, "sleep 30", dir.clone());
+
+    // Count notices across several debounce and cadence intervals.
+    let mut notices = 0usize;
+    let deadline = Instant::now() + Duration::from_millis(500);
+    while Instant::now() < deadline {
+        s.tick();
+        notices += s
+            .drain()
+            .iter()
+            .filter(|e| matches!(e, Event::Status(m) if m.contains("recovery snapshot failed")))
+            .count();
+        std::thread::sleep(Duration::from_millis(10));
+    }
+    assert_eq!(notices, 1, "persistent failure must notice exactly once");
+
+    s.tick();
+    assert!(
+        s.drain()
+            .iter()
+            .any(|e| matches!(e, Event::Tasks(v) if v.len() == 1)),
+        "a failing writer must never disturb supervision"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Detached recovery maintenance writes without queuing client events.
+#[test]
+fn recovery_maintenance_writes_detached_and_queues_nothing() {
+    let dir = scratch("recovery_detached");
+    let config = dir.join("config");
+    let mut s = recovery_sup(
+        &config,
+        dir.clone(),
+        Duration::from_millis(50),
+        Duration::from_secs(600),
+    );
+    spawn(&mut s, "sleep 30", dir.clone());
+    // Match the daemon's detached reap-and-maintain loop.
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.reap();
+            s.recovery_maintenance();
+            !recovery_files(&config).is_empty()
+        }),
+        "the detached maintenance pass never wrote"
+    );
+    assert!(
+        s.drain().is_empty(),
+        "the idle path must not queue events; nothing drains them"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// Deduplication treats the destination root as part of snapshot identity.
+#[test]
+fn recovery_dedup_is_per_destination_root() {
+    let dir = scratch("recovery_root_switch");
+    let (config_a, config_b) = (dir.join("cfg_a"), dir.join("cfg_b"));
+    let mut s = recovery_sup(
+        &config_a,
+        dir.clone(),
+        Duration::from_millis(50),
+        Duration::from_secs(600),
+    );
+    spawn(&mut s, "sleep 30", dir.clone());
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.recovery_maintenance();
+            !recovery_files(&config_a).is_empty()
+        }),
+        "root A never received the first snapshot"
+    );
+
+    // Move the unchanged recipe to a new destination and arm recovery.
+    s.set_launch_context(config_ctx(&config_b, dir.clone(), &[]));
+    s.recovery.dirty = true;
+    s.recovery.last_mutation = Some(Instant::now());
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.recovery_maintenance();
+            !recovery_files(&config_b).is_empty()
+        }),
+        "an unchanged recipe must still write to a root without a snapshot"
+    );
+    assert!(
+        !recovery_files(&config_a).is_empty(),
+        "the old root keeps its snapshot"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A failed write remains eligible for a later cadence retry.
+#[test]
+fn recovery_failed_write_retries_until_success() {
+    let dir = scratch("recovery_retry");
+    let config = dir.join("config");
+    // A plain file at the recovery path blocks the first write.
+    std::fs::create_dir_all(config.join("sessions")).unwrap();
+    std::fs::write(config.join("sessions").join("recovery"), "not a dir").unwrap();
+    let mut s = recovery_sup(
+        &config,
+        dir.clone(),
+        Duration::from_millis(10),
+        Duration::from_millis(50),
+    );
+    spawn(&mut s, "sleep 30", dir.clone());
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.recovery_maintenance();
+            s.recovery.failing
+        }),
+        "the blocked root never produced a failed pass"
+    );
+    assert!(
+        s.recovery.last_written.is_none(),
+        "a failed write must not advance the dedup pair"
+    );
+
+    // Remove the blocker; a cadence pass retries the unchanged content.
+    std::fs::remove_file(config.join("sessions").join("recovery")).unwrap();
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.recovery_maintenance();
+            !recovery_files(&config).is_empty()
+        }),
+        "the cadence never retried after the root became writable"
+    );
+    assert!(!s.recovery.failing, "a successful write clears the latch");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
+/// A cadence pass recreates a missing snapshot even when its recipe is unchanged.
+#[test]
+fn recovery_rewrites_after_a_sibling_prune_deletes_the_snapshot() {
+    let dir = scratch("recovery_sibling_prune");
+    let config = dir.join("config");
+    let mut s = recovery_sup(
+        &config,
+        dir.clone(),
+        Duration::from_millis(50),
+        Duration::from_millis(100),
+    );
+    spawn(&mut s, "sleep 30", dir.clone());
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.recovery_maintenance();
+            !recovery_files(&config).is_empty()
+        }),
+        "the first snapshot never landed"
+    );
+
+    // Remove the snapshot without changing the recipe or deduplication state.
+    let rec = config.join("sessions").join("recovery");
+    for name in recovery_files(&config) {
+        std::fs::remove_file(rec.join(name)).unwrap();
+    }
+
+    // No mutation arms the debounce; cadence alone must recreate the file.
+    assert!(
+        wait_until(Duration::from_secs(5), || {
+            s.recovery_maintenance();
+            !recovery_files(&config).is_empty()
+        }),
+        "an unchanged recipe must rewrite an externally deleted snapshot"
+    );
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[path = "supervisor_capture_tests.rs"]
 mod capture;
diff --git a/src/ui.rs b/src/ui.rs
index c491d5a..2b72b0e 100644
--- a/src/ui.rs
+++ b/src/ui.rs
@@ -13,10 +13,10 @@ use crossterm::{
 use unicode_width::UnicodeWidthStr;
 
 use crate::{
-    app::{App, DirKind, GroupMode, Mode, Row},
+    app::{App, DirKind, GroupMode, Mode, Row, SessionPage},
     editbuf::EditBuffer,
     format::{pad, rel_time, truncate},
-    protocol::{Lifecycle, Preview, PreviewSource, TaskView},
+    protocol::{Lifecycle, Preview, PreviewSource, RecoveryEntry, TaskView},
 };
 
 pub fn render(out: &mut Stdout, app: &mut App) -> io::Result<()> {
@@ -597,23 +597,64 @@ fn render_pickgroup(out: &mut impl Write, app: &App) -> io::Result<()> {
     )
 }
 
-/// The `o` load-session picker: a bottom panel listing saved session names.
-fn render_session_picker(out: &mut impl Write, app: &App) -> io::Result<()> {
-    render_panel(
-        out,
-        app,
-        &Panel {
-            header: "  load session".to_string(),
-            labels: &app.session_names,
-            sel: app.session_sel,
-            max_rows: 10,
-            hint: "↑↓ pick · enter load · esc".to_string(),
-            empty: Some("    (no saved sessions)"),
-            cursor: None,
-        },
+/// Format a recovery row with its variable-length label last for clipping.
+fn recovery_row(e: &RecoveryEntry) -> String {
+    let unit = if e.tasks == 1 { "task" } else { "tasks" };
+    format!(
+        "{} ago · {} {unit} · {}",
+        rel_time(Duration::from_secs(e.age_secs)),
+        e.tasks,
+        e.label
     )
 }
 
+/// Include the recovery Tab hint only when snapshots exist.
+fn saved_page_hint(recovery: usize) -> String {
+    if recovery > 0 {
+        format!("↑↓ pick · enter load · tab recovery ({recovery}) · esc")
+    } else {
+        "↑↓ pick · enter load · esc".to_string()
+    }
+}
+
+/// Render the saved-session or recovery page of the session picker.
+fn render_session_picker(out: &mut impl Write, app: &App) -> io::Result<()> {
+    match app.session_page {
+        SessionPage::Saved => {
+            let hint = saved_page_hint(app.session_recovery.len());
+            render_panel(
+                out,
+                app,
+                &Panel {
+                    header: "  load session".to_string(),
+                    labels: &app.session_names,
+                    sel: app.session_sel,
+                    max_rows: 10,
+                    hint,
+                    empty: Some("    (no saved sessions)"),
+                    cursor: None,
+                },
+            )
+        }
+        SessionPage::Recovery => {
+            let labels: Vec<String> = app.session_recovery.iter().map(recovery_row).collect();
+            render_panel(
+                out,
+                app,
+                &Panel {
+                    header: "  recovery".to_string(),
+                    labels: &labels,
+                    sel: app.recovery_sel,
+                    max_rows: 10,
+                    hint: "↑↓ pick · enter load · tab saved · esc".to_string(),
+                    empty: None,
+                    cursor: None,
+                },
+            )
+        }
+    }
+}
+
 /// Center `s` in `width` columns (a full-width string, so it overwrites the row).
 fn center(s: &str, width: usize) -> String {
     let len = s.width();
@@ -708,6 +749,55 @@ mod tests {
         }
     }
 
+    /// Build recovery metadata for row-formatting tests.
+    fn recovery_entry(age_secs: u64, tasks: u32, label: &str) -> RecoveryEntry {
+        RecoveryEntry {
+            stem: "20260101-000000-1".into(),
+            label: label.into(),
+            tasks,
+            age_secs,
+        }
+    }
+
+    /// Recovery rows format age, task count, and label.
+    #[test]
+    fn recovery_row_shapes() {
+        assert_eq!(
+            recovery_row(&recovery_entry(3, 1, "autosaved 2026-01-01 00:00")),
+            "3s ago · 1 task · autosaved 2026-01-01 00:00"
+        );
+        assert_eq!(
+            recovery_row(&recovery_entry(240, 12, "autosaved 2026-01-02 08:30")),
+            "4m ago · 12 tasks · autosaved 2026-01-02 08:30"
+        );
+        assert_eq!(
+            recovery_row(&recovery_entry(2 * 86_400, 0, "x")),
+            "2d ago · 0 tasks · x"
+        );
+    }
+
+    /// Wide labels clip to the panel's exact column width.
+    #[test]
+    fn recovery_row_clips_column_exact_for_wide_labels() {
+        let long = "日本語のラベルがここに延々と続いています";
+        let row = recovery_row(&recovery_entry(90, 3, long));
+        assert!(row.starts_with("1m ago · 3 tasks · "));
+        for cols in [24usize, 40, 80] {
+            let clipped = pad(&row, cols);
+            assert_eq!(clipped.width(), cols, "cols {cols}: {clipped:?}");
+        }
+    }
+
+    /// The saved-page hint shows the recovery page only when it exists.
+    #[test]
+    fn saved_page_hint_shows_the_count_only_when_nonzero() {
+        assert_eq!(saved_page_hint(0), "↑↓ pick · enter load · esc");
+        assert_eq!(
+            saved_page_hint(3),
+            "↑↓ pick · enter load · tab recovery (3) · esc"
+        );
+    }
+
     /// Directory and group destinations appear only when present.
     #[test]
     fn spawn_prompt_decoration_shapes() {
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index f4524d2..9eb31b9 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -17,7 +17,7 @@ use std::{
 
 /// The protocol version this test suite speaks; must track
 /// `protocol::PROTOCOL_VERSION` (drift fails the handshake, loudly).
-pub const PROTOCOL_VERSION: u32 = 8;
+pub const PROTOCOL_VERSION: u32 = 9;
 
 /// One frame of the given kind: `[u32 len][kind][payload]`.
 pub fn frame(kind: u8, payload: &[u8]) -> Vec<u8> {
@@ -196,6 +196,8 @@ pub fn start_daemon_raw(
     let mut cmd = Command::new(env!("CARGO_BIN_EXE_fleetcom"));
     cmd.arg("--daemon")
         .env("FLEETCOM_RUNTIME_DIR", &dir)
+        // Isolate recovery snapshots with the daemon's runtime files.
+        .env("FLEETCOM_CONFIG_DIR", dir.join("config"))
         .stdin(Stdio::null())
         .stdout(Stdio::null())
         .stderr(Stdio::null());
diff --git a/tests/daemon_recovery.rs b/tests/daemon_recovery.rs
new file mode 100644
index 0000000..73ad41a
--- /dev/null
+++ b/tests/daemon_recovery.rs
@@ -0,0 +1,68 @@
+//! Verifies that a detached daemon writes pending recovery snapshots and
+//! remains available for reconnection.
+
+mod common;
+
+use std::{
+    os::unix::net::UnixStream,
+    path::{Path, PathBuf},
+    time::{Duration, Instant},
+};
+
+use common::{read_frame, shake_hands, spawn_task, start_daemon, stop_daemon, wait_until};
+
+/// Recovery-snapshot paths under the test daemon's config root.
+fn snapshots(dir: &Path) -> Vec<PathBuf> {
+    std::fs::read_dir(dir.join("config").join("sessions").join("recovery"))
+        .map(|it| it.flatten().map(|e| e.path()).collect())
+        .unwrap_or_default()
+}
+
+#[test]
+fn detached_daemon_writes_the_pending_snapshot() {
+    let (dir, mut daemon, mut stream) = start_daemon("recovery", |_| {});
+    let pidfile = dir.join("task.pid");
+    spawn_task(
+        &mut stream,
+        &dir,
+        &pidfile,
+        &format!("echo $$ > {} && exec sleep 30", pidfile.display()),
+    );
+
+    // Disconnect before the two-second debounce expires.
+    assert!(
+        snapshots(&dir).is_empty(),
+        "the snapshot landed before disconnect; the detached path went untested"
+    );
+    drop(stream);
+
+    // The detached daemon's idle loop completes the pending write.
+    assert!(
+        wait_until(Duration::from_secs(10), || !snapshots(&dir).is_empty()),
+        "no recovery snapshot landed while detached"
+    );
+    let text = std::fs::read_to_string(&snapshots(&dir)[0]).unwrap();
+    assert!(
+        text.contains("sleep 30"),
+        "the snapshot must carry the fleet's command: {text}"
+    );
+
+    // The daemon remains available and retains the task after the write.
+    let mut stream = UnixStream::connect(dir.join("default.sock")).expect("reconnect failed");
+    shake_hands(&mut stream, &dir.display().to_string());
+    stream
+        .set_read_timeout(Some(Duration::from_secs(10)))
+        .unwrap();
+    let deadline = Instant::now() + Duration::from_secs(10);
+    loop {
+        assert!(Instant::now() < deadline, "no tasks event after reconnect");
+        let (kind, payload) = read_frame(&mut stream).expect("stream closed after reconnect");
+        let text = String::from_utf8_lossy(&payload);
+        if kind == 1 && text.contains(r#""t":"tasks""#) && text.contains("sleep 30") {
+            break;
+        }
+    }
+
+    stop_daemon(&mut daemon);
+    let _ = std::fs::remove_dir_all(&dir);
+}