# Hardi agents V2 — recovery

Contract: 2. Revision: 2026-11-03. Status: available to active verified Hardi accounts; Free, Plus and Pro retain their native limits.

Persist the request ID before the first write. After a network timeout, call hardi_get_action with requestId, or hardi actions get --request-id <key>. A missing receipt is not itself proof of failure while the first request may still be in flight: exact replay uses the same key and original body. Never use a new key to recover an uncertain result. hardi actions retry recovers the receipt first, otherwise replays the exact request saved in its private per-request recovery journal, including specialized commands and undo. Unresolved requests are selected first; --request-id selects one explicitly. Parallel writes never overwrite another intent. At most 100 unresolved and 100 terminal entries (confirmed or definitively rejected) are retained; unresolved entries are never silently deleted. Optional --file original.json must match the original fingerprint. The recovery file contains the action body outside repositories, no tokens or model reasoning, and is removed by logout. A new command with a new key is a new intent.

Operation payloads are encrypted for seven days. Minimal receipts remain thirty days. Undo checks ownership, current permissions, after-versions, protected results/dependencies and native quotas. No forced conflicts. Native Settings → Connection can undo after grant revocation or a kill switch; the external agent cannot. Native planning undo (fifteen minutes) and Trash restoration (fifteen days) are separate. A changed object can make undo unavailable before seven days. Personal result/performance writes have undoUntil=null; every batch containing one of these actions has no undo. Correct a score with a fresh version instead. Other reversible settings retain conditional undo.

Token rotation uses a profile lock. Tokens renew before expiry throughout a long session. A definitive non-consuming refusal preserves refresh credentials and its retry delay. An uncertain refresh is not retried with the consumed token; reconnect. Logout reports local erasure separately from unconfirmed remote revocation.

Offline CLI recovery: hardi actions pending --profile live --json lists retained uncertain intents without authenticating. hardi actions export writes a new private metadata-only file; --request-id selects an intent and --include-content explicitly includes its original body. --output must be in a private directory outside repositories. No OAuth credential is exported. Resolve or export pending state before logout. Command and input validation runs before remote authentication. An invalid successful token response remains uncertain; never replay an old refresh token. Native plan capacities and technical pilot limits both apply; no Hardi AI or Energy is used.

Every write permission requires actions:read so an uncertain operation can recover its original receipt. Consent adds this dependency visibly; existing grants never gain it automatically. Removing receipt access removes dependent write permissions. If CLI logout reports program_running, remote revocation is reported separately and local state remains intact: stop the active program, then rerun the displayed logout command to finish cleanup.

canUndo is evaluated against the connection's current inverse permissions. requiredUndoScopes and missingUndoScopes explain a permission refusal; native concurrency and protected dependencies are rechecked at execution. auth logout --local-only performs no remote revocation. Profile replacement removes previous credential storage after installing the new profile. Cleanup failures are reported and their locations retained privately for a later logout; incomplete logout retains the profile.

Expanded authorizations default to no absolute expiration. Temporary 1/7/30-day grants remain available. Access tokens expire after 15 minutes; rotating refresh credentials retain a finite rolling 30-day idle lifetime, capped by any grant deadline. Existing grants keep their deadline and selected resources. More permissions, all current/future calendars or a longer deadline require native consent, never an agent command. A long idle period, revocation or a security event can require reconnection.

After reconnecting the same account, use hardi actions retry --request-id <original-key> --adopt-connection. Issuer, account binding and saved intent must match; existing receipts are read first, and the original business key and payload remain unchanged. Another account cannot adopt the operation. Legacy journals without account binding can be inspected with actions get but cannot be blindly replayed through a new grant. Recover before logout, which removes local journals. Folder undo checks the current destination authorization; it cannot move content back into a removed folder selection.