Keep the orchestrator running

Run an existing instance without keeping its terminal open.

Prerequisites

An initialized instance on persistent storage, its credentials in the instance environment, and access as the Unix user that owns the instance.

Procedure

1. Change to the instance folder and start the detached orchestrator:

   usine up --detach

2. Inspect its status and output:

   usine status
   tail -n 80 .usine/usine.log

3. On macOS, keep AC-powered system sleep off while work is open. Run caffeinate -s in another terminal, or configure the machine’s power settings. Closing a laptop lid can still cause sleep.

Check the result

usine status reports the PID, version, uptime, listener, and open runs. The log updates as work proceeds. Use a Linux server deployment for unattended operation.

Use usine stop to drain running attempts, and usine restart to restart an idle instance. --force interrupts the wait; the next start reattaches retained attempts. CLI lifecycle commands describe timeouts.

During a forced stop or upgrade restart, running attempts retain their checkouts for reattachment. Child backends treat the closing connection as an orderly stop. Codex leaves its remote supervisor and transport journals in place, and Codex and Claude Code defer session recovery to the next process. The next process resumes saved child conversations in their original checkouts and appends their events to the same attempt transcripts. A child under an operator hold remains addressable after its resumed turn ends; release the hold to return its report to the parent. A held child that finished its turn stays idle after restart. Release returns its saved report to the parent; a steer or operator message starts another turn. A child paused with Interrupt stays idle after restart until you send a steer or operator message. Releasing its hold preserves the pause. Child holds also suspend the runaway guard’s wall clock after restart. If recovery returns an interrupted call, the child’s hold and pause end, and the wall clock resumes unless another session remains held. Claude Code and Pi continue their committed token and cost totals under the same child ID. Recovery resolves the credential kind from the worker’s latest preflight and repeats harness admission at each launch. Saved child identities exclude credential routes and billing metadata, so a gateway switch between a subscription and an API key takes effect on the resumed child. Keep its harness home and Codex model_provider ID unchanged; a moved home or changed provider ID refuses resume with a mismatch message in the interrupted call. When the original worker and checkout are available, recovery stops the saved remote child before refusing a changed harness or home. If stopping the child after a harness change fails, recovery logs the failure and returns an interrupted call with its committed output. The interrupted call ends the child’s hold and pause and warns that the saved child may still be running. Gateway credential-kind changes retain the usine-gateway provider ID. If the saved conversation cannot be decoded, resume is unavailable, or recovery fails, the parent receives an interrupted call with its committed output. Codex, Claude Code, and Pi suppress child infrastructure failures caused by this shutdown. Unexpected connection losses while an attempt is attached retain their normal recovery and failure handling.

A failed progress checkpoint logs a warning while transcript events and token reports continue. The parent still receives the child’s final report; recovery after a later restart uses the last committed checkpoint.

When a resumed child returns a report, that report replaces its pre-restart infrastructure failure. Infrastructure failures from other children still fail the attempt. When a reattached attempt delegates to a replacement child, including after a failed recovery, that child’s report determines the outcome. Previous infrastructure failures remain in the transcript. If recovery fails and the parent finishes without another delegation, the stored infrastructure failure still fails the attempt.