The snapshot only happens on green

The agent edits the handler, and then it doesn't trust the edit. It hits the app's own URL: every port on a Hoody container is already public HTTPS: and reads what came back. 500. It reads the trace, edits again, hits the URL again. 200, correct payload, twice in a row.

Only then does it snapshot.

That's the discipline: the snapshot isn't a checkpoint on a schedule, it's a merge commit that requires green. The container's history becomes a chain of verified states: every entry in the snapshot list is a version of the machine that provably served traffic.

Code generation trusts its own output. This loop closes on evidence. The agent believes the HTTP 200, not its own diff.

The agent believes the HTTP 200, not its own diff.