Grounded resumption: what happens when a browser agent gets interrupted

Budgets run out. Laptops sleep. The question isn't whether your agent gets interrupted — it's what it does on restart.

Every long-running agent gets interrupted. The budget runs out mid-task. You hit stop because you need the machine. The laptop sleeps. The judge decides the output isn't done yet and queues another pass.

Interruption isn't the failure mode. Amnesia is.

The naive restart re-does everything: re-browses the same pages, re-collects the same items, and — worse — merges duplicates into whatever it produced last time. Every re-run costs the full budget and degrades the output. That's the quiet reason most people babysit their automations instead of scheduling them.

rysh's ##auto web automations take a different position, and it rests on one design decision made long before any interruption happens: results are files.

The setup: state you can read

A rysh web automation (the full recipe format is in the companion post) writes its output to dated markdown files in a declared output_dir — not into chat scrollback. And its budget contract has a takeover leg: when a session burns through ~90% of its token ceiling (takeover_when: 90), the agent doesn't hit a wall. It switches to a wrap-up prompt with the remaining budget:

Stop browsing now. Save the results as-is, mark the file PARTIAL at the top, print the path and what's left to cover.

The agent lands the plane. What's on disk afterward isn't a corrupted half-run — it's an honest artifact: here's what I found, here's the flag saying it's incomplete, here's what a future run should do.

That artifact is the whole trick.

resume: load the past before starting the future

Alongside run, there's:

##auto web resume competitor-watch "ai terminals"

resume does one important extra thing: it loads the latest saved result into context before starting, with a fresh budget. In a real recorded session of one of our own discovery recipes, the agent's first visible move was exactly this:

grounded on …/results/ai-terminals-2026-07-10.md

It read its own previous output — which the takeover leg had marked PARTIAL — and reasoned, unprompted, that this pass should hunt only for new items and merge them into the existing list. No duplicate work, no duplicate entries, no re-spending the budget on ground already covered.

The task is a file in git. The state is a file too. The agent between them is replaceable — which is precisely what makes the system resilient.

The self-correction beat

The moment from that recorded run worth the price of admission came a few minutes in. The agent navigated to a profile that turned out to be the wrong one — a dead end. A selector-based bot dies here: broken XPath, cryptic log, 2 a.m. page.

This agent wrote, in its running commentary:

"Wrong profile. Let me pivot to the 'similar accounts' of a source I already verified, and mine that instead."

— and did. It fell back to an entity it had already confirmed in a previous pass (from the grounding file!) and used the platform's own recommendation graph to find new leads. Nobody was steering.

That's the practical difference between scripted automation and grounded resumption: the script encodes a path; the grounded agent holds the goal plus the verified past, so when the path breaks, it re-plans from what it already knows to be true.

Who decides when it's actually done?

Resumption needs a stopping rule, or "continue until done" becomes "continue forever." In rysh recipes that's the outer loop's until condition — a plain-language goal like:

until: >
  The findings file covers every source, each with a URL, a what-changed
  line, and a date — no duplicates.

After each session, an LLM judge checks that condition against the actual saved file — not against the agent's self-report — and decides whether another pass is warranted, under its own outer budget and session cap. Passes that re-enter go in grounded, so each iteration is additive.

Honesty required here: the judge is an LLM. "Done" is a strong signal, not a proof. For anything consequential, you review the file before acting on it — that's why it's a file.

Cheap interruptions change your behavior

Once stopping costs nothing, you stop differently:

##auto web stop competitor-watch        # mid-run, because you need the machine
# … later …
##auto web continue competitor-watch "ai terminals"   # checkpoint, budget re-armed

You interrupt agents the way you Ctrl+Z a process — freely, without dread. You schedule runs overnight knowing a power blip costs one session, not the whole job. You give recipes smaller budgets, because three grounded 600k-token sessions beat one anxious 2M-token marathon: each pass ends with a save, a judge check, and a clean re-entry point.

Hard budgets and graceful resumption aren't two features. They're one design — the leash only works because letting go of it is safe.

Honest scope

• rysh runs on Claude — bring your own Anthropic key. The provider layer is pluggable; Claude is what's wired today.
• rysh is self-hostable — your machine, your keys, your data. It is not open source.
• Grounding quality depends on the recipe declaring an output_dir and actually saving structured results — that's the recipe author's job (the takeover prompt is where you enforce it).
• The judge is an LLM signal, not a proof. Files are reviewable for exactly this reason.
• Recorded-run anecdotes above are from our own discovery recipes; the read-only ethics rules from the ##auto web post applied throughout.

Running agents that need to survive real-world interruptions? That's exactly the workflow we want design partners for — hands-on access, direct line to the founders, your edge cases shape the roadmap. → rysh.ai/design-partner

Companions: ##auto web: autonomous browser recipes in one markdown file · Judge-decided reset and resume