@moretea-labs/forge 1.7.0 → 1.7.1

package/src/runtime/standalone-recovery/entry.ts

@@ -508,7 +508,7 @@ export async function dispatchRecoveryTool(config: RecoveryConfig, name: string,
     }
     case 'restart_primary_connector': {
       if (!requestId(args.request_id)) throw new Error('RECOVERY_REQUEST_ID_REQUIRED');
-      return restartPrimaryConnector(config);
+      return restartPrimaryConnector(config, { requestId: `recovery-gateway:${args.request_id}` });
     }
     case 'recover_primary_runtime': {
       if (!requestId(args.request_id)) throw new Error('RECOVERY_REQUEST_ID_REQUIRED');

package/src/runtime/standalone-recovery/installer.ts

@@ -340,7 +340,7 @@ function recoveryPlist(input: {
 }): string {
   const xml = (value: string) => value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
   const argumentsList = [
-    '/usr/bin/env', '-i', 'PATH=/usr/bin:/bin:/usr/sbin:/sbin', `FORGE_BUILD_VERSION=${FORGE_VERSION}`,
+    '/usr/bin/env', '-i', 'PATH=/usr/bin:/bin:/usr/sbin:/sbin', `FORGE_BUILD_VERSION=${FORGE_VERSION}`, `FORGE_CONNECTOR_EXECUTABLE=${process.execPath}`,
     input.executable, input.command, '--controller-home', input.controllerHome,
   ];
   return `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>${xml(input.label)}</string><key>ProgramArguments</key><array>${argumentsList.map((argument) => `<string>${xml(argument)}</string>`).join('')}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>5</integer><key>StandardOutPath</key><string>${xml(input.logPath)}</string><key>StandardErrorPath</key><string>${xml(input.logPath)}</string></dict></plist>\n`;

package/src/runtime/workflow/schedules/engine.ts

@@ -3,6 +3,7 @@ import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { getRepository } from '../../../cli/repositories/registry';
 import { findExecutionJob, listActiveExecutionJobs, listExecutionJobs } from '../../execution/jobs/store';
+import { executionJobBelongsToWork, workHasActiveExecution } from '../../execution/work-activity';
 import { readRepositoryProjection } from '../../projections/materialized-view';
 import {
   applyRuntimeMaintenance,
@@ -26,8 +27,8 @@ import {
   recordScheduleOccurrenceHandoff,
   listSchedules,
   saveOccurrence,
-  saveSchedule,
   saveScheduleDecision,
+  updateSchedule,
 } from './store';
 import { applyScheduleFailure, applyScheduleRetryableFailure } from './settlement';
 import { classifyScheduledBrowserObservation, executeScheduledBrowserProbe } from './browser-probe';
@@ -44,6 +45,8 @@ const LIVE_MAINTENANCE_OPERATION = 'runtime_maintenance_apply';
 const EXTERNAL_CONTROLLER_WAKE_OPERATION = 'external_controller_wake';
 const BROWSER_PROBE_OPERATION = 'browser_probe';
 const GITHUB_ISSUE_WATCH_OPERATION = 'github_issue_watch';
+const DEFAULT_EXTERNAL_CONTROLLER_WAKE_TIMEOUT_MS = 60_000;
+const MAX_EXTERNAL_CONTROLLER_WAKE_TIMEOUT_MS = 120_000;
 
 function isDeterministicSchedule(schedule: RepositorySchedule): boolean {
   // Kernel executes only typed, bounded dispatch operations.
@@ -261,13 +264,17 @@ function workBoundScheduleWorkId(schedule: RepositorySchedule): string | undefin
   return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
 
-function executionJobBelongsToWork(job: ReturnType<typeof listExecutionJobs>[number], workId: string): boolean {
-  if (job.resourceClaims.some((claim) => claim.workId === workId)) return true;
-  const payload = job.payload as Record<string, unknown>;
-  const args = payload.arguments && typeof payload.arguments === 'object' && !Array.isArray(payload.arguments)
-    ? payload.arguments as Record<string, unknown>
-    : undefined;
-  return [payload.workId, payload.work_id, args?.workId, args?.work_id].some((value) => value === workId);
+const HUMAN_ONLY_HANDOFF_REASONS = new Set([
+  'policy_approval_required',
+  'missing_authorization',
+  'invalid_objective',
+  'destructive_action_requires_confirmation',
+]);
+
+function handoffRequiresHumanReview(item: ReturnType<typeof listHandoffItems>[number]): boolean {
+  if (item.approvalAction) return true;
+  if (!item.creationReason) return true;
+  return HUMAN_ONLY_HANDOFF_REASONS.has(item.creationReason);
 }
 
 async function stopReason(controllerHome: string, schedule: RepositorySchedule): Promise<string | undefined> {
@@ -277,8 +284,8 @@ async function stopReason(controllerHome: string, schedule: RepositorySchedule):
   if (schedule.stopConditions.includes('human_review_required')) {
     if (workId) {
       const activeHandoff = listHandoffItems({ controllerHome, repoId: schedule.repoId, status: 'active', limit: 100 })
-        .find((item) => item.workId === workId);
-      if (activeHandoff) return `Work ${workId} has active Handoff ${activeHandoff.id} requiring review.`;
+        .find((item) => item.workId === workId && handoffRequiresHumanReview(item));
+      if (activeHandoff) return `Work ${workId} has active Handoff ${activeHandoff.id} requiring human review.`;
     } else if (projection.currentAttention.length > 0) {
       return 'Repository has jobs requiring human attention.';
     }
@@ -367,11 +374,31 @@ function decideOccurrence(
 
 export type ChatgptWakeFailureClass = 'retryable_readiness' | 'semantic_wait' | 'user_action_required' | 'ordinary_failure';
 
+export function externalControllerWakeTimeoutMs(value: unknown): number {
+  if (typeof value !== 'number' || !Number.isFinite(value)) return DEFAULT_EXTERNAL_CONTROLLER_WAKE_TIMEOUT_MS;
+  return Math.max(5_000, Math.min(Math.trunc(value), MAX_EXTERNAL_CONTROLLER_WAKE_TIMEOUT_MS));
+}
+
+export async function awaitExternalControllerWake<T>(operation: Promise<T>, timeoutMs: number): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      operation,
+      new Promise<T>((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`CONTROLLER_WAKE_TOTAL_TIMEOUT: external Controller dispatch exceeded ${timeoutMs}ms.`)), timeoutMs);
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
 export function classifyChatgptWakeFailure(reason: string): ChatgptWakeFailureClass {
   const normalized = reason.toUpperCase();
   if (
     normalized.includes('CHATGPT_AUTOMATION_LOGIN_REQUIRED')
     || normalized.includes('PLUGIN_BROWSER_JAVASCRIPT_PERMISSION_REQUIRED')
+    || normalized.includes('PLUGIN_MACOS_CAPABILITY_BROKER_CAPABILITY_UNSUPPORTED')
     || normalized.includes('AUTHENTICATION_REQUIRED')
     || normalized.includes('CONSENT_REQUIRED')
   ) return 'user_action_required';
@@ -384,12 +411,15 @@ export function classifyChatgptWakeFailure(reason: string): ChatgptWakeFailureCl
     'PLUGIN_BROWSER_ACTIVE_TAB_UNAVAILABLE',
     'PLUGIN_BROWSER_SESSION_STATE_LOST',
     'PLUGIN_SESSION_NOT_FOUND',
+    'PLUGIN_BROWSER_NATIVE_TAB_IDENTITY_UNPROVEN',
+    'PLUGIN_MACOS_CAPABILITY_BROKER_UNAVAILABLE',
     'PLUGIN_BROWSER_NATIVE_FOREGROUND_ACTIVATOR_UNAVAILABLE',
     'CHATGPT_CONTROLLER_BROWSER_ROOT_UNAVAILABLE',
     'CHATGPT_CONTROLLER_BROWSER_FAILED',
     'CHATGPT_AUTOMATION_COMPOSER_UNAVAILABLE',
     'CHATGPT_AUTOMATION_INTELLIGENCE_CONTROL_UNAVAILABLE',
     'CHATGPT_AUTOMATION_REPLACEMENT_SESSION_NOT_CONFIRMED',
+    'CONTROLLER_WAKE_TOTAL_TIMEOUT',
     'HTTP 502',
     'ECONNREFUSED',
     'ECONNRESET',
@@ -434,24 +464,27 @@ async function executeExternalControllerWake(
   const workStore = { controllerHome, repoId: schedule.repoId };
   const work = getWorkContract(workStore, workId);
   if (!work) {
-    saveSchedule(controllerHome, { ...schedule, enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `EXTERNAL_CONTROLLER_WAKE_WORK_NOT_FOUND:${workId}`);
   }
   if (isTerminalWorkContractStatus(work.status)) {
-    saveSchedule(controllerHome, { ...schedule, enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.status}); automatic continuation stopped.`);
   }
   const existingOwner = getControllerSession(workStore, workId);
   const occurrenceNowMs = Date.parse(timestamp);
-  if (existingOwner && controllerSessionBlocksRecovery(workStore, workId, {
-    nowMs: Number.isFinite(occurrenceNowMs) ? occurrenceNowMs : Date.now(),
-  })) {
-    saveSchedule(controllerHome, { ...schedule, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId });
-    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} already has an active Controller ${existingOwner.controllerId}.`);
+  const nowMs = Number.isFinite(occurrenceNowMs) ? occurrenceNowMs : Date.now();
+  if (workHasActiveExecution(controllerHome, schedule.repoId, workId)) {
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
+    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} has active execution; duplicate Controller wake suppressed.`);
+  }
+  if (existingOwner && controllerSessionBlocksRecovery(workStore, workId, { nowMs })) {
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
+    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} has a recently active Controller ${existingOwner.controllerId}.`);
   }
   const launchReservation = getExternalControllerLaunchReservation(workStore, workId);
   if (launchReservation) {
-    saveSchedule(controllerHome, { ...schedule, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} already has a pending external Controller launch ${launchReservation.reservationId}.`);
   }
   const wakeDecision = decideOccurrence(
@@ -481,6 +514,7 @@ async function executeExternalControllerWake(
     if (controllerType === 'chatgpt') {
       const reasoning = args.reasoning === 'medium' || args.reasoning === 'xhigh' ? args.reasoning : 'high';
       const tabPolicy = args.tab_policy === 'reuse' || args.tab_policy === 'new' ? args.tab_policy : 'auto';
+      const timeoutMs = externalControllerWakeTimeoutMs(args.timeout_ms);
       let relay;
       try {
         relay = beginInitialControllerRoundDispatch(workStore, {
@@ -496,8 +530,8 @@ async function executeExternalControllerWake(
           conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
         });
         if (relay.status === 'blocked') throw new Error(`CONTROLLER_RELAY_LAUNCH_BLOCKED: ${relay.blockedReason ?? relay.relayScopeId}`);
-        const relayPrompt = `${buildControllerRoundRelayPrompt(workStore, relay)}\n\nScheduled continuation hint: ${continuationPrompt}`;
-        const dispatched = await runWorkChatgptContinuation({
+        const relayPrompt = `${buildControllerRoundRelayPrompt(workStore, relay, { exactOriginWork: true })}\n\nScheduled continuation hint: ${continuationPrompt}`;
+        const dispatched = await awaitExternalControllerWake(runWorkChatgptContinuation({
           controllerHome,
           repoId: schedule.repoId,
           repoRoot: repository.canonicalRoot,
@@ -509,8 +543,8 @@ async function executeExternalControllerWake(
           model: typeof args.model === 'string' ? args.model : 'gpt-5.6',
           reasoning,
           tabPolicy,
-          timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
-        });
+          timeoutMs,
+        }), timeoutMs);
         if (dispatched.status === 'failed') throw new Error(dispatched.error?.message ?? 'CHATGPT_WORK_CONTINUATION_FAILED');
         const completedRelay = finishControllerRoundRelayDispatch(workStore, {
           workId,
@@ -518,15 +552,13 @@ async function executeExternalControllerWake(
           browserSessionId: dispatched.browserSessionId,
           conversationUrl: dispatched.conversationUrl,
         });
-        const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-        saveSchedule(controllerHome, {
-          ...latest,
+        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
           lastTriggeredAt: timestamp,
           lastOccurrenceId: occurrence.occurrenceId,
           consecutiveFailures: 0,
           nextEligibleAt: undefined,
-          pausedReason: undefined,
-        });
+          ...(current.enabled ? { pausedReason: undefined } : {}),
+        }));
         const succeededOccurrence = saveOccurrence(controllerHome, {
           ...wakeDecision,
           status: 'succeeded',
@@ -548,8 +580,7 @@ async function executeExternalControllerWake(
           });
         }
         if (error instanceof Error && error.message.startsWith('CONTROLLER_RELAY_ROUND_ALREADY_OPEN:')) {
-          const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-          saveSchedule(controllerHome, { ...latest, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId });
+          updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
           return decideOccurrence(controllerHome, schedule, wakeDecision, 'nothing_to_do', 'skipped', `Work ${workId} already has an open ChatGPT controller round awaiting claim or disposition.`);
         }
         throw error;
@@ -570,15 +601,13 @@ async function executeExternalControllerWake(
       continuationPrompt,
       cwd: repository.canonicalRoot,
     });
-    const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-    saveSchedule(controllerHome, {
-      ...latest,
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
       lastTriggeredAt: timestamp,
       lastOccurrenceId: occurrence.occurrenceId,
       consecutiveFailures: 0,
       nextEligibleAt: undefined,
-      pausedReason: undefined,
-    });
+      ...(current.enabled ? { pausedReason: undefined } : {}),
+    }));
     return saveOccurrence(controllerHome, {
       ...wakeDecision,
       status: 'succeeded',
@@ -597,12 +626,10 @@ async function executeExternalControllerWake(
           : `Controller wake deferred by transient readiness; schedule remains active with bounded backoff: ${reason}`,
         countFailure: !semanticWait,
       });
-      const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-      saveSchedule(controllerHome, {
-        ...latest,
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
         lastTriggeredAt: timestamp,
         lastOccurrenceId: occurrence.occurrenceId,
-      });
+      }));
       return deferred.occurrence ?? saveOccurrence(controllerHome, {
         ...wakeDecision,
         status: semanticWait ? 'skipped' : 'failed',
@@ -628,8 +655,7 @@ async function executeExternalControllerWake(
         attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, `controller:${controllerType}`],
       },
     });
-    const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-    saveSchedule(controllerHome, { ...latest, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return failed.occurrence ?? saveOccurrence(controllerHome, { ...wakeDecision, status: 'failed', reason });
   }
 }
@@ -640,6 +666,10 @@ export async function evaluateSchedule(
   force = false,
   triggerContext?: ScheduleTriggerContext,
 ): Promise<ScheduleOccurrence | undefined> {
+  // The persisted Schedule record is the authority. Callers may legitimately
+  // retain the object returned by create/list/get across multiple trigger
+  // attempts, so never let an older in-memory revision become execution state.
+  schedule = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
   // Preserve retired schedule records as evidence, but do not create a new
   // occurrence or resume a controller/external action from their old payload.
   if (retiredScheduleReason(schedule)) return undefined;
@@ -694,7 +724,7 @@ export async function evaluateSchedule(
         attemptedActions: [`operation:${schedule.action.operation}`],
       },
     );
-    saveSchedule(controllerHome, { ...schedule, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
     return externalControllerHandoff;
   }
 
@@ -731,7 +761,10 @@ export async function evaluateSchedule(
     return decideOccurrence(controllerHome, schedule, occurrence, 'active_occurrence', 'skipped', 'Maximum active occurrences reached.');
   }
   if (schedule.consecutiveFailures >= schedule.policy.maxFailures) {
-    saveSchedule(controllerHome, { ...schedule, enabled: false, pausedReason: 'Maximum consecutive failures reached.' });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
+      enabled: false,
+      pausedReason: current.enabled ? 'Maximum consecutive failures reached.' : current.pausedReason,
+    }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'stopped', 'skipped', 'Schedule paused after repeated failures.');
   }
   if (schedule.nextEligibleAt && Date.parse(schedule.nextEligibleAt) > Date.now() && !force) {
@@ -785,14 +818,14 @@ export async function evaluateSchedule(
           readyForExecution: preview.status.readyForExecution,
         }));
       }
-      saveSchedule(controllerHome, { ...schedule, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId });
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
       return decideOccurrence(controllerHome, schedule, occurrence, 'would_execute', 'shadowed', 'Shadow mode records the live maintenance decision without applying it.', occurrenceDecisionEvidence({
         actionId: preview.actionId,
         safeCandidates: preview.selectedCandidateIds.length,
         typedSafeCandidates: preview.selectedTypedCandidateIds.length,
       }));
     }
-    saveSchedule(controllerHome, { ...schedule, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId });
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'would_execute', 'shadowed', 'Shadow mode records the decision without modifying the repository.', due.evidence);
   }
 
@@ -848,28 +881,29 @@ export async function evaluateSchedule(
     try {
       const repository = getRepository(schedule.repoId, controllerHome, { includeRemoved: true });
       const observation = await executeScheduledGithubIssueWatch({ repoRoot: repository.canonicalRoot, args, observedAt: timestamp });
-      const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
       const evidence = occurrenceDecisionEvidence({
         githubRepository: typeof args.github_repository === 'string' ? args.github_repository : undefined,
         observationStatus: observation.status,
         observedIssueCount: observation.issues.length,
         changedIssueNumbers: observation.changedOpenIssues.map((issue) => issue.number),
       });
-      const persistObservation = () => saveSchedule(controllerHome, {
-        ...getSchedule(controllerHome, schedule.repoId, schedule.scheduleId),
-        action: {
-          ...latest.action,
-          arguments: { ...(latest.action.arguments ?? {}), issue_watch_state: observation.nextState, issue_watch_since: undefined },
-        },
-        lastTriggeredAt: timestamp,
-        lastOccurrenceId: occurrenceId,
-        lastObservationAt: timestamp,
-        lastObservationStatus: observation.status,
-        lastObservationChangedAt: observation.shouldWake ? timestamp : latest.lastObservationChangedAt,
-        consecutiveFailures: 0,
-        consecutiveNoops: observation.shouldWake ? 0 : (latest.consecutiveNoops ?? 0) + 1,
-        nextEligibleAt: undefined,
-        pausedReason: undefined,
+      const persistObservation = () => updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => {
+        if (current.action.operation !== GITHUB_ISSUE_WATCH_OPERATION) throw new Error('SCHEDULE_ACTION_CHANGED_DURING_GITHUB_OBSERVATION');
+        return {
+          action: {
+            ...current.action,
+            arguments: { ...(current.action.arguments ?? {}), issue_watch_state: observation.nextState, issue_watch_since: undefined },
+          },
+          lastTriggeredAt: timestamp,
+          lastOccurrenceId: occurrenceId,
+          lastObservationAt: timestamp,
+          lastObservationStatus: observation.status,
+          lastObservationChangedAt: observation.shouldWake ? timestamp : current.lastObservationChangedAt,
+          consecutiveFailures: 0,
+          consecutiveNoops: observation.shouldWake ? 0 : (current.consecutiveNoops ?? 0) + 1,
+          nextEligibleAt: undefined,
+          ...(current.enabled ? { pausedReason: undefined } : {}),
+        };
       });
       if (!observation.shouldWake) {
         const observedSchedule = persistObservation();
@@ -923,11 +957,11 @@ export async function evaluateSchedule(
       const workStore = { controllerHome, repoId: schedule.repoId };
       const work = getWorkContract(workStore, workId);
       if (!work) {
-        saveSchedule(controllerHome, { ...schedule, enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId });
+        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
         return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `SCHEDULE_BROWSER_PROBE_WORK_NOT_FOUND:${workId}`);
       }
       if (isTerminalWorkContractStatus(work.status)) {
-        saveSchedule(controllerHome, { ...schedule, enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId });
+        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
         return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.status}); browser watcher stopped before probing.`);
       }
     }
@@ -945,16 +979,15 @@ export async function evaluateSchedule(
       });
 
       if (probe.status === 'auth_required') {
-        const observedSchedule = saveSchedule(controllerHome, {
-          ...latest,
+        const observedSchedule = updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
           lastTriggeredAt: timestamp,
           lastOccurrenceId: occurrenceId,
           lastObservationAt: timestamp,
           lastObservationStatus: 'auth_required',
           consecutiveFailures: 0,
           nextEligibleAt: undefined,
-          pausedReason: undefined,
-        });
+          ...(current.enabled ? { pausedReason: undefined } : {}),
+        }));
         if (args.wake_on_auth_required !== false) {
           const authPrompt = typeof args.auth_required_prompt === 'string'
             ? args.auth_required_prompt
@@ -997,8 +1030,7 @@ export async function evaluateSchedule(
       }
 
       if (probe.status === 'keepalive') {
-        const observedSchedule = saveSchedule(controllerHome, {
-          ...latest,
+        const observedSchedule = updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
           lastTriggeredAt: timestamp,
           lastOccurrenceId: occurrenceId,
           lastObservationAt: timestamp,
@@ -1006,8 +1038,8 @@ export async function evaluateSchedule(
           consecutiveFailures: 0,
           consecutiveNoops: 0,
           nextEligibleAt: undefined,
-          pausedReason: undefined,
-        });
+          ...(current.enabled ? { pausedReason: undefined } : {}),
+        }));
         return decideOccurrence(controllerHome, observedSchedule, occurrence, 'execute', 'succeeded', 'Browser session keepalive refreshed successfully.', observationEvidence);
       }
 
@@ -1019,19 +1051,18 @@ export async function evaluateSchedule(
       const changed = observation.status === 'changed';
       const shouldWake = args.wake_on_change !== false && observation.shouldWake;
       const observationStatus: RepositorySchedule['lastObservationStatus'] = observation.status;
-      const observedSchedule = saveSchedule(controllerHome, {
-        ...latest,
+      const observedSchedule = updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
         lastTriggeredAt: timestamp,
         lastOccurrenceId: occurrenceId,
         lastObservationAt: timestamp,
         lastObservationFingerprint: probe.fingerprint,
-        lastObservationChangedAt: changed ? timestamp : latest.lastObservationChangedAt,
+        lastObservationChangedAt: changed ? timestamp : current.lastObservationChangedAt,
         lastObservationStatus: observationStatus,
         consecutiveFailures: 0,
-        consecutiveNoops: shouldWake ? 0 : (latest.consecutiveNoops ?? 0) + 1,
+        consecutiveNoops: shouldWake ? 0 : (current.consecutiveNoops ?? 0) + 1,
         nextEligibleAt: undefined,
-        pausedReason: undefined,
-      });
+        ...(current.enabled ? { pausedReason: undefined } : {}),
+      }));
 
       if (!shouldWake) {
         const reason = observation.status === 'baseline'
@@ -1066,8 +1097,7 @@ export async function evaluateSchedule(
           attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, 'operation:browser_probe'],
         },
       });
-      const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-      saveSchedule(controllerHome, { ...latest, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId });
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
       return failed.occurrence ?? saveOccurrence(controllerHome, { ...occurrence, status: 'failed', decision: 'execute', reason });
     }
   }
@@ -1112,15 +1142,13 @@ export async function evaluateSchedule(
       cancelPendingApprovals: false,
     });
     const appliedCount = result.applied.filter((candidate) => candidate.applied).length;
-    const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-    saveSchedule(controllerHome, {
-      ...latest,
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
       lastTriggeredAt: timestamp,
       lastOccurrenceId: occurrenceId,
       consecutiveFailures: 0,
       nextEligibleAt: undefined,
-      pausedReason: undefined,
-    });
+      ...(current.enabled ? { pausedReason: undefined } : {}),
+    }));
     return saveOccurrence(controllerHome, {
       ...decision,
       status: 'succeeded',
@@ -1149,12 +1177,10 @@ export async function evaluateSchedule(
         ],
       },
     });
-    const latest = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-    saveSchedule(controllerHome, {
-      ...latest,
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
       lastTriggeredAt: timestamp,
       lastOccurrenceId: occurrenceId,
-    });
+    }));
     return failed.occurrence ?? saveOccurrence(controllerHome, {
       ...decision,
       status: 'failed',

package/src/runtime/workflow/schedules/settlement.ts

@@ -5,7 +5,7 @@ import {
   getSchedule,
   recordScheduleOccurrenceHandoff,
   saveOccurrence,
-  saveSchedule,
+  updateSchedule,
   type ScheduleOccurrenceHandoffInput,
 } from './store';
 
@@ -27,7 +27,7 @@ function computeScheduleFailureState(schedule: ReturnType<typeof getSchedule>, n
     consecutiveFailures: nextFailures,
     nextEligibleAt: computeScheduleBackoff(schedule, nextFailures),
     enabled: shouldPause ? false : schedule.enabled,
-    pausedReason: shouldPause ? 'Maximum consecutive failures reached.' : undefined,
+    pausedReason: shouldPause ? 'Maximum consecutive failures reached.' : schedule.enabled ? undefined : schedule.pausedReason,
   };
 }
 
@@ -62,16 +62,15 @@ export function applyScheduleFailure(
 
   const countFailure = options.countFailure !== false;
   const nextSchedule = options.pauseReason
-    ? saveSchedule(controllerHome, {
-      ...schedule,
+    ? updateSchedule(controllerHome, repoId, scheduleId, (current) => ({
       enabled: false,
       pausedReason: options.pauseReason,
       nextEligibleAt: undefined,
-      consecutiveFailures: countFailure ? schedule.consecutiveFailures + 1 : schedule.consecutiveFailures,
-    })
+      consecutiveFailures: countFailure ? current.consecutiveFailures + 1 : current.consecutiveFailures,
+    }))
     : countFailure
-      ? saveSchedule(controllerHome, { ...schedule, ...computeScheduleFailureState(schedule, schedule.consecutiveFailures + 1) })
-      : schedule;
+      ? updateSchedule(controllerHome, repoId, scheduleId, (current) => computeScheduleFailureState(current, current.consecutiveFailures + 1))
+      : getSchedule(controllerHome, repoId, scheduleId);
   return { schedule: nextSchedule, occurrence: nextOccurrence };
 }
 
@@ -87,7 +86,6 @@ export function applyScheduleRetryableFailure(
     countFailure?: boolean;
   },
 ): { schedule: ReturnType<typeof getSchedule>; occurrence?: ScheduleOccurrence } {
-  const schedule = getSchedule(controllerHome, repoId, scheduleId);
   const occurrence = getOccurrence(controllerHome, repoId, occurrenceId);
   let nextOccurrence = occurrence;
   if (occurrence && !TERMINAL_OCCURRENCE_STATUSES.has(occurrence.status)) {
@@ -99,15 +97,22 @@ export function applyScheduleRetryableFailure(
     });
   }
   const countFailure = options.countFailure !== false;
-  const nextFailures = countFailure ? schedule.consecutiveFailures + 1 : schedule.consecutiveFailures;
-  const nextSchedule = saveSchedule(controllerHome, {
-    ...schedule,
-    consecutiveFailures: nextFailures,
-    nextEligibleAt: computeScheduleBackoff(schedule, Math.max(1, nextFailures)),
-    // Retryable readiness/semantic-wait failures never turn a durable schedule
-    // into a manual-resume task. Respect a concurrent explicit pause, however.
-    enabled: schedule.enabled,
-    pausedReason: schedule.enabled ? undefined : schedule.pausedReason,
+  const nextSchedule = updateSchedule(controllerHome, repoId, scheduleId, (current) => {
+    const nextFailures = countFailure ? current.consecutiveFailures + 1 : current.consecutiveFailures;
+    const failureState = countFailure && current.enabled
+      ? computeScheduleFailureState(current, nextFailures)
+      : {
+        consecutiveFailures: nextFailures,
+        nextEligibleAt: countFailure
+          ? current.nextEligibleAt
+          : computeScheduleBackoff(current, Math.max(1, nextFailures)),
+        enabled: current.enabled,
+        pausedReason: current.enabled ? undefined : current.pausedReason,
+      };
+    // One transient fault backs off and re-arms. Repeated faults have crossed
+    // the already-declared failure budget and must stop before they consume
+    // further controller sessions or browser interactions.
+    return failureState;
   });
   return { schedule: nextSchedule, occurrence: nextOccurrence };
 }
@@ -142,7 +147,6 @@ export function settleScheduledExecution(
   const occurrenceId = typeof job.payload.occurrenceId === 'string' ? job.payload.occurrenceId : undefined;
   if (!scheduleId || !occurrenceId) return;
   try {
-    const schedule = getSchedule(controllerHome, job.repoId, scheduleId);
     const occurrence = getOccurrence(controllerHome, job.repoId, occurrenceId);
     if (occurrence && !['succeeded', 'failed', 'shadowed', 'skipped'].includes(occurrence.status)) {
       saveOccurrence(controllerHome, {
@@ -175,12 +179,11 @@ export function settleScheduledExecution(
       });
       return;
     }
-    saveSchedule(controllerHome, {
-      ...schedule,
+    updateSchedule(controllerHome, job.repoId, scheduleId, (current) => ({
       consecutiveFailures: 0,
       nextEligibleAt: undefined,
-      pausedReason: undefined,
-    });
+      ...(current.enabled ? { pausedReason: undefined } : {}),
+    }));
   } catch {
     // Job terminal state remains authoritative even if an old schedule record
     // has already been removed. Reconciliation must not be blocked by it.