@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/workflow/schedules/engine.ts

@@ -1,4 +1,4 @@
-import { createHash, randomUUID } from 'crypto';
+import { createHash } from 'crypto';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import { getRepository } from '../../../cli/repositories/registry';
@@ -10,27 +10,35 @@ import {
   previewAutomaticRuntimeMaintenance,
   type RuntimeMaintenanceActionId,
 } from '../../recovery/maintenance-executor';
-import { appendWorkEvidence, controllerSessionBlocksRecovery, getControllerSession, getWorkContract, isTerminalWorkContractStatus, listHandoffItems } from '../../control-plane/facade';
-import { launchSuperController } from '../../control-plane/launcher/thin-launcher';
-import { getExternalControllerLaunchReservation } from '../../control-plane/launcher/launch-reservation-store';
-import { runStandaloneChatgptPrompt, runWorkChatgptContinuation } from '../../control-plane/launcher/chatgpt-work-continuation';
+import { appendWorkEvidence, getWorkContract, semanticWorkState } from '../../../../packages/kernel/work/api/index';
 import {
-  beginInitialControllerRoundDispatch,
-  buildControllerRoundRelayPrompt,
-  finishControllerRoundRelayDispatch,
-} from '../../control-plane/facade/controller-round-relay';
+  controllerSessionBlocksRecovery,
+  getControllerSession,
+  getControllerWorkBinding,
+  getRetainedControllerSession,
+} from '../../../../packages/kernel/controller/api/index';
 import {
+  applyScheduleFailure,
+  applyScheduleRetryableFailure,
+  cronDue,
+  evaluateScheduleOccurrenceAdmission,
+  evaluateScheduleTriggerEligibility,
   getOccurrence,
   getSchedule,
   listActiveOccurrences,
   listOccurrences,
-  recordScheduleOccurrenceHandoff,
+  reclaimStaleCreatedOccurrences,
   listSchedules,
   saveOccurrence,
   saveScheduleDecision,
   updateSchedule,
-} from './store';
-import { applyScheduleFailure, applyScheduleRetryableFailure } from './settlement';
+} from '../../../../packages/kernel/scheduler/api/index';
+export { cronDue };
+import { ensureScheduledControllerBinding } from '../../root/scheduled-controller-composition';
+import { reconcileControllerProgression } from '../../root/controller-progression-composition';
+import { listUserRequests } from '../../../../packages/kernel/identity/api/index';
+import { runStandaloneChatgptPrompt } from '../../control-plane/launcher/chatgpt-work-continuation';
+
 import { classifyScheduledBrowserObservation, executeScheduledBrowserProbe } from './browser-probe';
 import { executeScheduledGithubIssueWatch } from './github-issue-watch';
 import type {
@@ -38,7 +46,7 @@ import type {
   ScheduleDecisionType,
   ScheduleOccurrence,
   ScheduleTriggerContext,
-} from './types';
+} from '../../../../packages/kernel/scheduler/api/index';
 
 const execFileAsync = promisify(execFile);
 const LIVE_MAINTENANCE_OPERATION = 'runtime_maintenance_apply';
@@ -65,128 +73,6 @@ function retiredScheduleReason(schedule: RepositorySchedule): string | undefined
   return undefined;
 }
 
-function normalizedWindow(minutes: number, at = Date.now()): string {
-  return String(Math.floor(at / (Math.max(1, minutes) * 60_000)));
-}
-
-interface ZonedDateParts {
-  year: number;
-  month: number;
-  day: number;
-  hour: number;
-  minute: number;
-  weekday: number;
-}
-
-function zonedDateParts(at: number, timezone = 'UTC'): ZonedDateParts {
-  let formatter: Intl.DateTimeFormat;
-  try {
-    formatter = new Intl.DateTimeFormat('en-US-u-ca-iso8601', {
-      timeZone: timezone,
-      year: 'numeric', month: '2-digit', day: '2-digit',
-      hour: '2-digit', minute: '2-digit', weekday: 'short',
-      hourCycle: 'h23',
-    });
-  } catch {
-    throw new Error(`SCHEDULE_TIMEZONE_INVALID: ${timezone}`);
-  }
-  const values = Object.fromEntries(formatter.formatToParts(new Date(at)).map((entry) => [entry.type, entry.value]));
-  const weekdays: Record<string, number> = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
-  return {
-    year: Number(values.year),
-    month: Number(values.month),
-    day: Number(values.day),
-    hour: Number(values.hour),
-    minute: Number(values.minute),
-    weekday: weekdays[String(values.weekday)] ?? 0,
-  };
-}
-
-function fixedCronTime(expression: string | undefined): { minute: number; hour: number; day: string; month: string; weekday: string } | undefined {
-  if (!expression) return undefined;
-  const fields = expression.trim().split(/\s+/);
-  if (fields.length !== 5 || !/^\d+$/.test(fields[0]) || !/^\d+$/.test(fields[1])) return undefined;
-  const minute = Number(fields[0]);
-  const hour = Number(fields[1]);
-  if (minute < 0 || minute > 59 || hour < 0 || hour > 23) return undefined;
-  return { minute, hour, day: fields[2], month: fields[3], weekday: fields[4] };
-}
-
-function cronWindowKey(schedule: RepositorySchedule, at = Date.now()): string {
-  const timezone = schedule.trigger.timezone ?? 'UTC';
-  const parts = zonedDateParts(at, timezone);
-  const fixed = fixedCronTime(schedule.trigger.cronExpression);
-  if (fixed) {
-    return `${parts.year}-${String(parts.month).padStart(2, '0')}-${String(parts.day).padStart(2, '0')}@${String(fixed.hour).padStart(2, '0')}:${String(fixed.minute).padStart(2, '0')}[${timezone}]`;
-  }
-  return `${parts.year}-${String(parts.month).padStart(2, '0')}-${String(parts.day).padStart(2, '0')}T${String(parts.hour).padStart(2, '0')}:${String(parts.minute).padStart(2, '0')}[${timezone}]`;
-}
-
-function triggerWindowKey(schedule: RepositorySchedule, context: ScheduleTriggerContext | undefined, at = Date.now()): string {
-  // Explicit control-plane triggers use a separate identity namespace from timer/cron windows.
-  // A caller-supplied event/request id is the stable retry key; otherwise each manual trigger is distinct.
-  if (context?.source === 'manual' && schedule.trigger.type !== 'manual') {
-    const stableManualKey = context.eventId?.trim();
-    return `manual:${stableManualKey || randomUUID()}`;
-  }
-  switch (schedule.trigger.type) {
-    case 'cron':
-      return cronWindowKey(schedule, at);
-    case 'calendar':
-      return schedule.trigger.calendarAt ?? new Date(at).toISOString().slice(0, 16);
-    case 'repository-event':
-      return context?.eventId?.trim() || `${context?.eventName ?? schedule.trigger.eventName ?? 'event'}:${normalizedWindow(1, at)}`;
-    case 'dependency-checkpoint':
-      return createHash('sha256').update(JSON.stringify(schedule.trigger.dependencyJobIds ?? [])).digest('hex').slice(0, 20);
-    case 'manual':
-      return context?.eventId?.trim() || normalizedWindow(1, at);
-    case 'condition':
-    case 'interval':
-    default:
-      return normalizedWindow(schedule.trigger.everyMinutes ?? 60, at);
-  }
-}
-
-function cronFieldMatches(value: number, field: string, min: number, max: number): boolean {
-  return field.split(',').some((part) => {
-    const trimmed = part.trim();
-    if (trimmed === '*') return true;
-    const stepMatch = trimmed.match(/^\*\/(\d+)$/);
-    if (stepMatch) return value % Math.max(1, Number(stepMatch[1])) === 0;
-    const rangeMatch = trimmed.match(/^(\d+)-(\d+)(?:\/(\d+))?$/);
-    if (rangeMatch) {
-      const start = Math.max(min, Number(rangeMatch[1]));
-      const end = Math.min(max, Number(rangeMatch[2]));
-      const step = Math.max(1, Number(rangeMatch[3] ?? 1));
-      return value >= start && value <= end && (value - start) % step === 0;
-    }
-    const exact = Number(trimmed);
-    return Number.isInteger(exact) && exact >= min && exact <= max && value === exact;
-  });
-}
-
-export function cronDue(
-  expression: string | undefined,
-  at = Date.now(),
-  timezone = 'UTC',
-  catchUpMinutes = 0,
-): boolean {
-  if (!expression) return false;
-  const fields = expression.trim().split(/\s+/);
-  if (fields.length !== 5) throw new Error(`SCHEDULE_CRON_INVALID: expected five fields, received ${fields.length}`);
-  const parts = zonedDateParts(at, timezone);
-  const calendarMatches = cronFieldMatches(parts.day, fields[2], 1, 31)
-    && cronFieldMatches(parts.month, fields[3], 1, 12)
-    && cronFieldMatches(parts.weekday, fields[4], 0, 6);
-  if (!calendarMatches) return false;
-  if (cronFieldMatches(parts.minute, fields[0], 0, 59) && cronFieldMatches(parts.hour, fields[1], 0, 23)) return true;
-  const fixed = fixedCronTime(expression);
-  if (!fixed || catchUpMinutes <= 0) return false;
-  const scheduledMinute = fixed.hour * 60 + fixed.minute;
-  const currentMinute = parts.hour * 60 + parts.minute;
-  return currentMinute >= scheduledMinute && currentMinute - scheduledMinute <= Math.min(24 * 60, catchUpMinutes);
-}
-
 async function workspaceDirty(controllerHome: string, repoId: string): Promise<boolean> {
   try {
     const repository = getRepository(repoId, controllerHome, { includeRemoved: true });
@@ -199,64 +85,6 @@ async function workspaceDirty(controllerHome: string, repoId: string): Promise<b
   }
 }
 
-async function triggerDue(
-  controllerHome: string,
-  schedule: RepositorySchedule,
-  force: boolean,
-  context?: ScheduleTriggerContext,
-): Promise<{ due: boolean; reason?: string; evidence?: Record<string, unknown> }> {
-  if (force && schedule.trigger.type !== 'repository-event') return { due: true };
-  switch (schedule.trigger.type) {
-    case 'manual':
-      return { due: force, reason: force ? undefined : 'Manual Schedule requires an explicit trigger.' };
-    case 'interval':
-      return { due: true };
-    case 'cron':
-      return {
-        due: cronDue(schedule.trigger.cronExpression, Date.now(), schedule.trigger.timezone ?? 'UTC', schedule.trigger.catchUpMinutes ?? 0),
-        reason: `Cron expression is not due in the current ${schedule.trigger.timezone ?? 'UTC'} minute or catch-up window.`,
-      };
-    case 'calendar': {
-      const at = Date.parse(schedule.trigger.calendarAt ?? '');
-      if (!Number.isFinite(at)) throw new Error('SCHEDULE_CALENDAR_INVALID: calendarAt must be an ISO-8601 timestamp');
-      return { due: Date.now() >= at, reason: 'Calendar trigger is not due yet.', evidence: { calendarAt: schedule.trigger.calendarAt } };
-    }
-    case 'repository-event': {
-      const expected = schedule.trigger.eventName?.trim();
-      const actual = context?.eventName?.trim();
-      const due = context?.source === 'repository-event' && Boolean(actual) && (!expected || expected === actual);
-      return { due, reason: due ? undefined : 'Repository event did not match this Schedule.', evidence: { expected, actual, eventId: context?.eventId } };
-    }
-    case 'dependency-checkpoint': {
-      const dependencyJobIds = schedule.trigger.dependencyJobIds ?? [];
-      if (dependencyJobIds.length === 0) throw new Error('SCHEDULE_DEPENDENCY_REQUIRED: dependency checkpoint has no Job ids');
-      const jobs = dependencyJobIds.map((jobId) => findExecutionJob(controllerHome, jobId));
-      const due = jobs.every((job) => job?.status === 'succeeded');
-      return {
-        due,
-        reason: due ? undefined : 'Dependency checkpoint is not ready.',
-        evidence: { dependencies: dependencyJobIds.map((jobId, index) => ({ jobId, status: jobs[index]?.status ?? 'missing' })) },
-      };
-    }
-    case 'condition': {
-      const condition = schedule.trigger.condition;
-      if (!condition) throw new Error('SCHEDULE_CONDITION_REQUIRED');
-      if (condition.kind === 'repository_clean') {
-        const clean = !(await workspaceDirty(controllerHome, schedule.repoId));
-        return { due: clean, reason: clean ? undefined : 'Repository is not clean.', evidence: { clean } };
-      }
-      if (condition.kind === 'job_succeeded' || condition.kind === 'job_terminal') {
-        const job = condition.jobId ? findExecutionJob(controllerHome, condition.jobId) : undefined;
-        const terminal = Boolean(job && ['succeeded', 'failed', 'timed_out', 'cancelled', 'orphaned', 'stale', 'human_attention_required'].includes(job.status));
-        const due = condition.kind === 'job_succeeded' ? job?.status === 'succeeded' : terminal;
-        return { due, reason: due ? undefined : `Condition ${condition.kind} is not met.`, evidence: { jobId: condition.jobId, status: job?.status ?? 'missing' } };
-      }
-    }
-    default:
-      return { due: false, reason: 'Unsupported Schedule trigger.' };
-  }
-}
-
 function workBoundScheduleWorkId(schedule: RepositorySchedule): string | undefined {
   if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
     && schedule.action.operation !== BROWSER_PROBE_OPERATION) return undefined;
@@ -264,30 +92,18 @@ function workBoundScheduleWorkId(schedule: RepositorySchedule): string | undefin
   return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
 
-const HUMAN_ONLY_HANDOFF_REASONS = new Set([
-  'policy_approval_required',
-  'missing_authorization',
-  'invalid_objective',
-  'destructive_action_requires_confirmation',
-]);
-
-function handoffRequiresHumanReview(item: ReturnType<typeof listHandoffItems>[number]): boolean {
-  if (item.approvalAction) return true;
-  if (!item.creationReason) return true;
-  return HUMAN_ONLY_HANDOFF_REASONS.has(item.creationReason);
-}
-
 async function stopReason(controllerHome: string, schedule: RepositorySchedule): Promise<string | undefined> {
   const projection = readRepositoryProjection(controllerHome, schedule.repoId);
   const workId = workBoundScheduleWorkId(schedule);
   const work = workId ? getWorkContract({ controllerHome, repoId: schedule.repoId }, workId) : undefined;
   if (schedule.stopConditions.includes('human_review_required')) {
+    const pendingUserRequests = listUserRequests(controllerHome, 'pending');
     if (workId) {
-      const activeHandoff = listHandoffItems({ controllerHome, repoId: schedule.repoId, status: 'active', limit: 100 })
-        .find((item) => item.workId === workId && handoffRequiresHumanReview(item));
-      if (activeHandoff) return `Work ${workId} has active Handoff ${activeHandoff.id} requiring human review.`;
-    } else if (projection.currentAttention.length > 0) {
-      return 'Repository has jobs requiring human attention.';
+      const request = pendingUserRequests.find((item) => item.targetScope?.workId === workId);
+      if (request) return `Work ${workId} has pending UserRequest ${request.requestId} requiring human action.`;
+    } else {
+      const request = pendingUserRequests.find((item) => item.targetScope?.repoId === schedule.repoId);
+      if (request) return `Repository ${schedule.repoId} has pending UserRequest ${request.requestId}.`;
     }
   }
   if (schedule.stopConditions.includes('release_ready') && projection.releaseFrozen) return 'Repository is in release freeze.';
@@ -430,20 +246,6 @@ export function classifyChatgptWakeFailure(reason: string): ChatgptWakeFailureCl
   return 'ordinary_failure';
 }
 
-function externalControllerLaunchArgs(args: Record<string, unknown>, controllerType: string): string[] {
-  const launchArgs = Array.isArray(args.launch_args) ? args.launch_args.map(String) : [];
-  if (controllerType !== 'chatgpt') return launchArgs;
-  const explicit = new Set(launchArgs.filter((value) => value.startsWith('--')).map((value) => value.split('=', 1)[0]));
-  const add = (flag: string, value: unknown) => {
-    if (explicit.has(flag) || typeof value !== 'string' || !value.trim()) return;
-    launchArgs.push(flag, value.trim());
-  };
-  add('--model', args.model);
-  add('--reasoning', args.reasoning);
-  add('--tab-policy', args.tab_policy);
-  return launchArgs;
-}
-
 async function executeExternalControllerWake(
   controllerHome: string,
   schedule: RepositorySchedule,
@@ -454,167 +256,228 @@ async function executeExternalControllerWake(
   options: { transientWakeFailure?: boolean } = {},
 ): Promise<ScheduleOccurrence> {
   const workId = typeof args.work_id === 'string' ? args.work_id.trim() : '';
-  const controllerType = typeof args.controller_type === 'string' ? args.controller_type.trim() : 'chatgpt';
   if (!workId) {
     return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', 'EXTERNAL_CONTROLLER_WAKE_WORK_ID_REQUIRED');
   }
-  if (!['chatgpt', 'codex', 'claude', 'grok'].includes(controllerType)) {
-    return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', 'EXTERNAL_CONTROLLER_WAKE_TYPE_INVALID');
-  }
   const workStore = { controllerHome, repoId: schedule.repoId };
   const work = getWorkContract(workStore, workId);
   if (!work) {
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `EXTERNAL_CONTROLLER_WAKE_WORK_NOT_FOUND:${workId}`);
   }
-  if (isTerminalWorkContractStatus(work.status)) {
-    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
-    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.status}); automatic continuation stopped.`);
+  if (semanticWorkState(work) !== 'open') {
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.semanticState}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
+    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.semanticState}); automatic continuation stopped.`);
+  }
+
+  const retainedSession = getRetainedControllerSession(workStore, workId);
+  if (!retainedSession) {
+    return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `SCHEDULE_CONTINUATION_CONTROLLER_SESSION_REQUIRED:${workId}`);
+  }
+  const requestedControllerType = typeof args.controller_type === 'string' ? args.controller_type.trim() : '';
+  if (requestedControllerType && requestedControllerType !== retainedSession.controllerType) {
+    return decideOccurrence(
+      controllerHome,
+      schedule,
+      occurrence,
+      'operation_blocked',
+      'skipped',
+      `SCHEDULE_CONTINUATION_CONTROLLER_TYPE_MISMATCH:${workId}:expected=${retainedSession.controllerType}:requested=${requestedControllerType}`,
+    );
   }
-  const existingOwner = getControllerSession(workStore, workId);
   const occurrenceNowMs = Date.parse(timestamp);
   const nowMs = Number.isFinite(occurrenceNowMs) ? occurrenceNowMs : Date.now();
   if (workHasActiveExecution(controllerHome, schedule.repoId, workId)) {
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} has active execution; duplicate Controller wake suppressed.`);
   }
+  const existingOwner = getControllerSession(workStore, workId);
   if (existingOwner && controllerSessionBlocksRecovery(workStore, workId, { nowMs })) {
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} has a recently active Controller ${existingOwner.controllerId}.`);
   }
-  const launchReservation = getExternalControllerLaunchReservation(workStore, workId);
-  if (launchReservation) {
-    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
-    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} already has a pending external Controller launch ${launchReservation.reservationId}.`);
+
+  const repository = getRepository(schedule.repoId, controllerHome, { includeRemoved: true });
+  let bindingId = typeof args.controller_binding_id === 'string' ? args.controller_binding_id.trim() : '';
+  let bindingRecord = getControllerWorkBinding(workStore, workId);
+  if (bindingRecord && bindingRecord.binding.bindingId !== bindingId) {
+    return decideOccurrence(
+      controllerHome,
+      schedule,
+      occurrence,
+      'operation_blocked',
+      'skipped',
+      `SCHEDULE_CONTINUATION_BINDING_DRIFT:${workId}:expected=${bindingId}:actual=${bindingRecord.binding.bindingId}`,
+    );
+  }
+
+  const hadLegacySessionIdentity = typeof args.controller_session_id === 'string' && args.controller_session_id.trim().length > 0;
+
+  // Explicit compatibility migration for schedules written before Kernel V2 B4.
+  // Provider metadata is copied once into the adapter-owned binding and the
+  // Schedule is rewritten to exact Work/ControllerSession/ControllerBinding ids.
+  if (!bindingRecord) {
+    const binding = ensureScheduledControllerBinding(
+      { controllerHome, repoId: schedule.repoId },
+      { workId, session: retainedSession, scheduleName: schedule.name, args },
+    );
+    bindingId = binding.bindingId;
+    bindingRecord = getControllerWorkBinding(workStore, workId);
+    if (!bindingRecord || bindingRecord.binding.bindingId !== bindingId) {
+      throw new Error(`SCHEDULE_CONTINUATION_BINDING_MIGRATION_FAILED:${workId}`);
+    }
   }
+
+  const continuationHintForMigration = typeof args.continuation_hint === 'string'
+    ? args.continuation_hint
+    : typeof args.continuation_prompt === 'string'
+      ? args.continuation_prompt
+      : undefined;
+  const relayScopeIdForMigration = typeof args.relay_scope_id === 'string' ? args.relay_scope_id.trim() : undefined;
+  if (hadLegacySessionIdentity || bindingId !== bindingRecord.binding.bindingId) {
+    bindingId = bindingRecord.binding.bindingId;
+    schedule = updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
+      action: {
+        ...current.action,
+        arguments: {
+          work_id: workId,
+          controller_type: retainedSession.controllerType,
+          controller_binding_id: bindingId,
+          ...(relayScopeIdForMigration ? { relay_scope_id: relayScopeIdForMigration } : {}),
+          ...(continuationHintForMigration?.trim() ? { continuation_hint: continuationHintForMigration.trim() } : {}),
+        },
+      },
+    }));
+  }
+
+  const controllerType = retainedSession.controllerType;
+  const continuationHint = typeof schedule.action.arguments?.continuation_hint === 'string'
+    ? schedule.action.arguments.continuation_hint
+    : undefined;
+  const relayScopeId = typeof schedule.action.arguments?.relay_scope_id === 'string'
+    ? schedule.action.arguments.relay_scope_id
+    : undefined;
+  const controllerRoundOccurrenceId = typeof occurrence.triggerContext?.data?.controllerRoundOccurrenceId === 'string'
+    && occurrence.triggerContext.data.controllerRoundOccurrenceId.trim()
+    ? occurrence.triggerContext.data.controllerRoundOccurrenceId.trim()
+    : occurrence.occurrenceId;
   const wakeDecision = decideOccurrence(
     controllerHome,
     schedule,
     occurrence,
     'execute',
     'running',
-    'Deterministic external Controller wake is starting through Thin Launcher.',
+    'Deterministic Controller continuation is starting through Kernel Scheduler and ControllerHost.',
     occurrenceDecisionEvidence({
       operation: schedule.action.operation,
       workId,
       controllerType,
-      ...(controllerType === 'chatgpt' ? {
-        model: typeof args.model === 'string' ? args.model : 'gpt-5.6',
-        reasoning: typeof args.reasoning === 'string' ? args.reasoning : 'high',
-        tabPolicy: typeof args.tab_policy === 'string' ? args.tab_policy : 'auto',
-      } : {}),
+      controllerSessionId: retainedSession.sessionId,
+      controllerBindingId: bindingRecord.binding.bindingId,
       ...extraEvidence,
     }),
   );
+
   try {
-    const repository = getRepository(schedule.repoId, controllerHome, { includeRemoved: true });
-    const continuationPrompt = typeof args.continuation_prompt === 'string'
-      ? args.continuation_prompt
-      : `Scheduled continuation ${occurrence.occurrenceId} from ${schedule.scheduleId}. Read current Forge state and continue only the bounded Work objective.`;
-    if (controllerType === 'chatgpt') {
-      const reasoning = args.reasoning === 'medium' || args.reasoning === 'xhigh' ? args.reasoning : 'high';
-      const tabPolicy = args.tab_policy === 'reuse' || args.tab_policy === 'new' ? args.tab_policy : 'auto';
-      const timeoutMs = externalControllerWakeTimeoutMs(args.timeout_ms);
-      let relay;
-      try {
-        relay = beginInitialControllerRoundDispatch(workStore, {
-          workId,
-          identity: {
-            controllerId: `schedule:${schedule.scheduleId}`,
-            principalId: 'forge-scheduler',
-            controllerInstanceId: 'forge-runtime-scheduler',
-            sessionId: occurrence.occurrenceId,
-          },
-          requirementId: work.requirementId,
-          browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
-          conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
-        });
-        if (relay.status === 'blocked') throw new Error(`CONTROLLER_RELAY_LAUNCH_BLOCKED: ${relay.blockedReason ?? relay.relayScopeId}`);
-        const relayPrompt = `${buildControllerRoundRelayPrompt(workStore, relay, { exactOriginWork: true })}\n\nScheduled continuation hint: ${continuationPrompt}`;
-        const dispatched = await awaitExternalControllerWake(runWorkChatgptContinuation({
-          controllerHome,
-          repoId: schedule.repoId,
-          repoRoot: repository.canonicalRoot,
-          workId,
-          prompt: relayPrompt,
-          title: schedule.name,
-          browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
-          conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
-          model: typeof args.model === 'string' ? args.model : 'gpt-5.6',
-          reasoning,
-          tabPolicy,
-          timeoutMs,
-        }), timeoutMs);
-        if (dispatched.status === 'failed') throw new Error(dispatched.error?.message ?? 'CHATGPT_WORK_CONTINUATION_FAILED');
-        const completedRelay = finishControllerRoundRelayDispatch(workStore, {
-          workId,
-          ok: true,
-          browserSessionId: dispatched.browserSessionId,
-          conversationUrl: dispatched.conversationUrl,
-        });
-        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
-          lastTriggeredAt: timestamp,
-          lastOccurrenceId: occurrence.occurrenceId,
-          consecutiveFailures: 0,
-          nextEligibleAt: undefined,
-          ...(current.enabled ? { pausedReason: undefined } : {}),
-        }));
-        const succeededOccurrence = saveOccurrence(controllerHome, {
-          ...wakeDecision,
-          status: 'succeeded',
-          reason: `ChatGPT dispatch action succeeded via ${dispatched.browserSessionId}; relay ${completedRelay?.relayScopeId ?? relay.relayScopeId} remains dispatched until the new Controller claims Work ${workId}.`,
-        });
-        appendWorkEvidence(workStore, workId, {
-          evidenceId: succeededOccurrence.occurrenceId,
-          title: 'scheduled ChatGPT continuation dispatched',
-          summary: `Schedule ${schedule.scheduleId} timer occurrence ${succeededOccurrence.occurrenceId} dispatched the Work-bound ChatGPT continuation successfully.`,
-          detailLevel: 'summary',
-        });
-        return succeededOccurrence;
-      } catch (error) {
-        if (relay) {
-          finishControllerRoundRelayDispatch(workStore, {
-            workId,
-            ok: false,
-            error: error instanceof Error ? error.message : String(error),
-          });
-        }
-        if (error instanceof Error && error.message.startsWith('CONTROLLER_RELAY_ROUND_ALREADY_OPEN:')) {
-          updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
-          return decideOccurrence(controllerHome, schedule, wakeDecision, 'nothing_to_do', 'skipped', `Work ${workId} already has an open ChatGPT controller round awaiting claim or disposition.`);
-        }
-        throw error;
-      }
+    const progression = await reconcileControllerProgression(
+      { controllerHome, repoId: schedule.repoId, repoRoot: repository.canonicalRoot },
+      {
+        occurrenceId: controllerRoundOccurrenceId,
+        workId,
+        relayScopeId,
+        continuationHint,
+        allowSemanticWaitRecovery: controllerType === 'chatgpt',
+        scheduleName: schedule.name,
+        bindingArgs: args,
+      },
+    );
+
+    if (progression.status === 'terminal_or_missing') {
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
+        enabled: false,
+        pausedReason: progression.reason,
+        lastTriggeredAt: timestamp,
+        lastOccurrenceId: occurrence.occurrenceId,
+      }));
+      return saveOccurrence(controllerHome, {
+        ...wakeDecision,
+        status: 'skipped',
+        decision: 'nothing_to_do',
+        reason: progression.reason,
+      });
     }
-    const launched = await launchSuperController({
-      work: { controllerHome, repoId: schedule.repoId },
-      handoff: { controllerHome, repoId: schedule.repoId },
-    }, {
-      controllerType: controllerType as 'codex' | 'claude' | 'grok',
-      executable: typeof args.executable === 'string' ? args.executable : undefined,
-      args: externalControllerLaunchArgs(args, controllerType),
-      workId,
-      handoffId: typeof args.handoff_id === 'string' ? args.handoff_id : undefined,
-      browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
-      conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
-      launchReservationMs: typeof args.launch_reservation_ms === 'number' ? args.launch_reservation_ms : typeof args.lease_ms === 'number' ? args.lease_ms : undefined,
-      continuationPrompt,
-      cwd: repository.canonicalRoot,
-    });
+
+    if (progression.status === 'semantic_wait'
+      || progression.status === 'wait_for_user'
+      || progression.status === 'retained_session_missing'
+      || progression.status === 'human_controller') {
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
+        lastTriggeredAt: timestamp,
+        lastOccurrenceId: occurrence.occurrenceId,
+      }));
+      return saveOccurrence(controllerHome, {
+        ...wakeDecision,
+        status: 'skipped',
+        decision: 'nothing_to_do',
+        reason: progression.reason ?? `Work ${workId} is not currently eligible for provider progression.`,
+      });
+    }
+
+    if (progression.status === 'rejected') {
+      throw new Error(progression.reason ?? 'CONTROLLER_HOST_RESUME_REJECTED');
+    }
+
+    if (progression.status === 'chatgpt_not_enrolled') {
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
+        lastTriggeredAt: timestamp,
+        lastOccurrenceId: occurrence.occurrenceId,
+      }));
+      return saveOccurrence(controllerHome, {
+        ...wakeDecision,
+        status: 'skipped',
+        decision: 'nothing_to_do',
+        reason: `Workflow Supervisor enrollment is not yet ready (${progression.supervisorEnrollment.status}); no ChatGPT provider attempt was consumed.`,
+      });
+    }
+
+    const supervisorEnrollment = progression.status === 'chatgpt_enrolled'
+      ? progression.supervisorEnrollment
+      : { status: 'not_eligible' as const };
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
       lastTriggeredAt: timestamp,
       lastOccurrenceId: occurrence.occurrenceId,
       consecutiveFailures: 0,
       nextEligibleAt: undefined,
-      ...(current.enabled ? { pausedReason: undefined } : {}),
+      ...(supervisorEnrollment.status === 'enrolled'
+        ? { enabled: false, pausedReason: 'workflow_supervisor_owns_outer_turn' }
+        : current.enabled ? { pausedReason: undefined } : {}),
     }));
-    return saveOccurrence(controllerHome, {
+    const dispatchedOccurrence = saveOccurrence(controllerHome, {
       ...wakeDecision,
-      status: 'succeeded',
-      reason: `External Controller wake started ${launched.controllerType} pid=${String(launched.pid ?? 'unknown')} for Work ${workId}.`,
+      status: 'dispatched',
+      reason: progression.status === 'chatgpt_enrolled'
+        ? `Workflow Supervisor reserved the exact ChatGPT effect ${progression.supervisorEnrollment.effectId ?? progression.relayScopeId}; Scheduler issued no provider send.`
+        : progression.reused
+          ? `Controller continuation occurrence ${occurrence.occurrenceId} was already durably dispatched; external replay suppressed and semantic round closure is still pending.`
+          : `ControllerHost accepted durable binding ${bindingRecord.binding.bindingId} for Work ${workId}; dispatch ${progression.providerDispatchReceiptId ?? progression.relayScopeId}; semantic round closure is still pending.`,
+    });
+    appendWorkEvidence(workStore, workId, {
+      evidenceId: dispatchedOccurrence.occurrenceId,
+      title: progression.status === 'chatgpt_enrolled'
+        ? 'scheduled Workflow Supervisor effect reserved'
+        : 'scheduled Controller continuation dispatched',
+      summary: progression.status === 'chatgpt_enrolled'
+        ? `Schedule ${schedule.scheduleId} materialized the exact ControllerRound occurrence and Supervisor effect; Supervisor owns ChatGPT delivery.`
+        : `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} resumed the exact Work-bound ControllerSession through ControllerHost.`,
+      detailLevel: 'summary',
     });
+    return dispatchedOccurrence;
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
+    if (reason.startsWith('CONTROLLER_CONTINUATION_ROUND_ALREADY_OPEN:') || reason.startsWith('CONTROLLER_CONTINUATION_ALREADY_DISPATCHING:')) {
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
+      return decideOccurrence(controllerHome, schedule, wakeDecision, 'nothing_to_do', 'skipped', `Work ${workId} already has an open Controller round awaiting claim or disposition.`);
+    }
     const failureClass = controllerType === 'chatgpt' ? classifyChatgptWakeFailure(reason) : 'ordinary_failure';
     if (options.transientWakeFailure || failureClass === 'retryable_readiness' || failureClass === 'semantic_wait') {
       const semanticWait = failureClass === 'semantic_wait';
@@ -642,18 +505,20 @@ async function executeExternalControllerWake(
       decision: 'execute',
       reason,
       ...(failureClass === 'user_action_required' ? { pauseReason: reason } : {}),
-      handoff: {
-        title: `External Controller wake ${occurrence.occurrenceId} failed`,
-        summary: 'Forge recorded the schedule trigger but could not wake the configured external Controller.',
-        reason,
-        creationReason: 'repeated_infrastructure_failure',
-        blockingDecision: 'Repair the external Controller/browser launch path or update the saved session reference.',
-        recommendedDecision: 'Inspect launcher/browser readiness, then retrigger this bounded continuation.',
-        recommendedPrompt: `Resume Work ${workId} manually, inspect failed wake occurrence ${occurrence.occurrenceId}, and repair the configured external Controller launch path before unattended continuation resumes.`,
-        statusSummary: 'Scheduled external Controller wake failed.',
-        blockedBy: ['external_controller_wake_failed'],
-        attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, `controller:${controllerType}`],
-      },
+      ...(failureClass === 'user_action_required' ? {
+        handoff: {
+          title: `External Controller wake ${occurrence.occurrenceId} requires user authorization`,
+          summary: 'Forge cannot resume the configured ControllerSession until the required user authorization is restored.',
+          reason,
+          creationReason: 'missing_authorization' as const,
+          blockingDecision: 'Restore the required authenticated/authorized controller capability, then retry the same scheduled Work.',
+          recommendedDecision: 'Restore authorization only; do not create replacement Work or replay an unknown external effect.',
+          recommendedPrompt: `Restore authorization for Work ${workId} and retry scheduled continuation ${occurrence.occurrenceId}.`,
+          statusSummary: 'Scheduled Controller continuation is waiting on user authorization.',
+          blockedBy: ['controller_authorization_required'],
+          attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, `controller:${controllerType}`, `session:${retainedSession.sessionId}`, `binding:${bindingRecord.binding.bindingId}`],
+        },
+      } : {}),
     });
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return failed.occurrence ?? saveOccurrence(controllerHome, { ...wakeDecision, status: 'failed', reason });
@@ -673,11 +538,23 @@ export async function evaluateSchedule(
   // Preserve retired schedule records as evidence, but do not create a new
   // occurrence or resume a controller/external action from their old payload.
   if (retiredScheduleReason(schedule)) return undefined;
-  if (!schedule.enabled && !force) return undefined;
-  const due = await triggerDue(controllerHome, schedule, force, triggerContext);
-  if (!due.due) return undefined;
+  const eligibilityNowMs = Date.now();
+  const triggerJobIds = new Set<string>(schedule.trigger.dependencyJobIds ?? []);
+  if (schedule.trigger.condition?.jobId) triggerJobIds.add(schedule.trigger.condition.jobId);
+  const jobStatuses = Object.fromEntries([...triggerJobIds].map((jobId) => [jobId, findExecutionJob(controllerHome, jobId)?.status]));
+  const repositoryClean = schedule.trigger.condition?.kind === 'repository_clean'
+    ? !(await workspaceDirty(controllerHome, schedule.repoId))
+    : undefined;
+  const due = evaluateScheduleTriggerEligibility(schedule, {
+    nowMs: eligibilityNowMs,
+    force,
+    context: triggerContext,
+    repositoryClean,
+    jobStatuses,
+  });
+  if (!due.due || !due.windowKey) return undefined;
 
-  const key = triggerWindowKey(schedule, triggerContext);
+  const key = due.windowKey;
   const occurrenceId = `OCC-${schedule.scheduleId}-${createHash('sha256').update(key).digest('hex').slice(0, 20)}`;
   const existing = getOccurrence(controllerHome, schedule.repoId, occurrenceId);
   if (existing) return existing;
@@ -696,41 +573,36 @@ export async function evaluateSchedule(
     updatedAt: timestamp,
   });
 
-  // Semantic / model-backed schedules only record a trigger + Handoff.
-  // Deterministic allowlisted operations continue into the local engine path.
+  // Semantic/model-owned schedule actions record the trigger only. A trigger is
+  // continuation input for the external Controller/Supervisor, not a human
+  // blocker and therefore must not manufacture Handoff/UserRequest state.
   if (!isDeterministicSchedule(schedule)) {
-    const externalControllerHandoff = recordScheduleOccurrenceHandoff(
+    const recorded = decideOccurrence(
       controllerHome,
       schedule,
-      decideOccurrence(
-        controllerHome,
-        schedule,
-        occurrence,
-        'operation_blocked',
-        'skipped',
-        'Schedule execution is external-controller-owned; no ExecutionJob was created.',
-        occurrenceDecisionEvidence({ operation: schedule.action.operation, trigger: occurrence.triggerContext?.source }),
-      ),
-      {
-        title: `Schedule ${schedule.name} requires an external Controller`,
-        summary: 'The scheduled trigger was recorded without dispatching a Kernel Job.',
-        reason: 'Schedule execution is external-controller-owned.',
-        creationReason: 'ambiguous_outcome',
-        blockingDecision: 'Claim or create the related Work before executing the scheduled operation.',
-        recommendedDecision: 'Review the trigger evidence and continue it through an explicitly claimed external Controller session.',
-        recommendedPrompt: `Review schedule ${schedule.scheduleId} occurrence ${occurrence.occurrenceId}; create or claim Work for ${schedule.action.operation} and continue through Process Runtime or Thin Launcher.`,
-        statusSummary: 'Schedule trigger is waiting for external Controller ownership.',
-        blockedBy: ['external_controller_required'],
-        attemptedActions: [`operation:${schedule.action.operation}`],
-      },
+      occurrence,
+      'operation_blocked',
+      'skipped',
+      'Schedule trigger recorded for external Controller continuation; no Kernel ExecutionJob or human Handoff was created.',
+      occurrenceDecisionEvidence({ operation: schedule.action.operation, trigger: occurrence.triggerContext?.source }),
     );
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
-    return externalControllerHandoff;
+    return recorded;
   }
 
   const recent = listOccurrences(controllerHome, schedule.repoId, schedule.scheduleId, 1000);
-  const stop = await stopReason(controllerHome, schedule);
-  if (stop) {
+  reclaimStaleCreatedOccurrences(controllerHome, schedule.repoId, schedule.scheduleId);
+  const active = listActiveOccurrences(controllerHome, schedule.repoId, schedule.scheduleId)
+    .filter((entry) => entry.occurrenceId !== occurrence.occurrenceId);
+  const admission = evaluateScheduleOccurrenceAdmission(schedule, {
+    nowMs: Date.now(),
+    force,
+    stopReason: await stopReason(controllerHome, schedule),
+    activeOccurrenceCount: active.length,
+    dailyRuntimeMinutes: dailyRuntimeMinutes(controllerHome, recent),
+  });
+  if (admission.kind === 'stop_condition') {
+    const stop = admission.reason ?? 'Schedule stop condition is active.';
     const stopped = decideOccurrence(controllerHome, schedule, occurrence, 'stopped', 'skipped', stop);
     if (!isLiveMaintenanceSchedule(schedule)) return stopped;
     const failed = applyScheduleFailure(controllerHome, schedule.scheduleId, schedule.repoId, occurrence.occurrenceId, {
@@ -739,42 +611,25 @@ export async function evaluateSchedule(
       reason: stop,
       countFailure: false,
       pauseReason: stop,
-      handoff: {
-        title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} stopped`,
-        summary: 'A live maintenance occurrence was blocked by an explicit schedule stop condition and requires review before automation resumes.',
-        reason: stop,
-        creationReason: 'ambiguous_outcome',
-        blockingDecision: 'Review the stop condition and decide whether automatic maintenance should stay paused.',
-        recommendedDecision: 'Resolve the stop condition, then explicitly re-enable or retrigger the maintenance schedule.',
-        recommendedPrompt: `Review maintenance schedule ${schedule.scheduleId} for repo ${schedule.repoId}, inspect stop condition ${stop}, and decide whether to resume the schedule.`,
-        statusSummary: 'Scheduled maintenance occurrence stopped before dispatch.',
-        blockedBy: ['schedule_stop_condition'],
-        attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
-      },
+
     });
     return failed.occurrence ?? stopped;
   }
-
-  const active = listActiveOccurrences(controllerHome, schedule.repoId, schedule.scheduleId)
-    .filter((entry) => entry.occurrenceId !== occurrence.occurrenceId);
-  if (active.length >= schedule.policy.maxActiveOccurrences) {
-    return decideOccurrence(controllerHome, schedule, occurrence, 'active_occurrence', 'skipped', 'Maximum active occurrences reached.');
+  if (admission.kind === 'active_occurrence') {
+    return decideOccurrence(controllerHome, schedule, occurrence, 'active_occurrence', 'skipped', admission.reason);
   }
-  if (schedule.consecutiveFailures >= schedule.policy.maxFailures) {
+  if (admission.kind === 'failure_limit') {
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
       enabled: false,
       pausedReason: current.enabled ? 'Maximum consecutive failures reached.' : current.pausedReason,
     }));
-    return decideOccurrence(controllerHome, schedule, occurrence, 'stopped', 'skipped', 'Schedule paused after repeated failures.');
+    return decideOccurrence(controllerHome, schedule, occurrence, 'stopped', 'skipped', admission.reason);
   }
-  if (schedule.nextEligibleAt && Date.parse(schedule.nextEligibleAt) > Date.now() && !force) {
-    return decideOccurrence(controllerHome, schedule, occurrence, 'cooldown', 'skipped', `Schedule backoff remains active until ${schedule.nextEligibleAt}.`);
+  if (admission.kind === 'cooldown') {
+    return decideOccurrence(controllerHome, schedule, occurrence, 'cooldown', 'skipped', admission.reason);
   }
-  if (schedule.lastTriggeredAt && Date.now() - Date.parse(schedule.lastTriggeredAt) < schedule.policy.cooldownMinutes * 60_000 && !force) {
-    return decideOccurrence(controllerHome, schedule, occurrence, 'cooldown', 'skipped', 'Schedule is cooling down.');
-  }
-  if (dailyRuntimeMinutes(controllerHome, recent) >= schedule.policy.dailyBudgetMinutes) {
-    return decideOccurrence(controllerHome, schedule, occurrence, 'budget_exhausted', 'skipped', 'Daily schedule budget exhausted.');
+  if (admission.kind === 'budget_exhausted') {
+    return decideOccurrence(controllerHome, schedule, occurrence, 'budget_exhausted', 'skipped', admission.reason);
   }
   if (schedule.policy.shadowMode) {
     if (isLiveMaintenanceSchedule(schedule)) {
@@ -793,22 +648,20 @@ export async function evaluateSchedule(
           reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
           countFailure: !preview.blockedPermanently,
           pauseReason: preview.blockedPermanently ? preview.blockedReason : undefined,
-          handoff: {
-            title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} blocked`,
-            summary: 'A bounded live maintenance occurrence was blocked before dispatch and requires a human decision.',
-            reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
-            creationReason: preview.blockedPermanently ? 'missing_authorization' : 'ambiguous_outcome',
-            blockingDecision: preview.blockedPermanently
-              ? 'Fix the schedule operation or authorization before automatic maintenance can resume.'
-              : 'Inspect runtime maintenance readiness before allowing another unattended attempt.',
-            recommendedDecision: preview.blockedPermanently
-              ? 'Correct the automatic maintenance configuration and re-enable the schedule deliberately.'
-              : 'Review the maintenance preview, resolve the blocker, and then retrigger the schedule intentionally.',
-            recommendedPrompt: `Review blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId}. Determine whether the schedule configuration or runtime maintenance readiness should be corrected before retrying.`,
-            statusSummary: 'Scheduled maintenance occurrence blocked before dispatch.',
-            blockedBy: [decision],
-            attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
-          },
+          ...(preview.blockedPermanently ? {
+            handoff: {
+              title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} needs a user decision`,
+              summary: 'Automatic maintenance is permanently blocked and requires an explicit user decision before the schedule can resume.',
+              reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
+              creationReason: 'ambiguous_outcome' as const,
+              blockingDecision: 'Correct the configuration/authorization or intentionally keep this schedule paused.',
+              recommendedDecision: 'Review the permanent blocker and explicitly decide whether to repair configuration and resume.',
+              recommendedPrompt: `Review permanently blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId} and decide whether to repair and resume it.`,
+              statusSummary: 'Scheduled maintenance is permanently blocked pending a user decision.',
+              blockedBy: [decision],
+              attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
+            },
+          } : {}),
         });
         return failed.occurrence ?? blocked;
       }
@@ -845,22 +698,20 @@ export async function evaluateSchedule(
         reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
         countFailure: !preview.blockedPermanently,
         pauseReason: preview.blockedPermanently ? preview.blockedReason : undefined,
-        handoff: {
-          title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} blocked`,
-          summary: 'A bounded live maintenance occurrence was blocked before dispatch and requires a human decision.',
-          reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
-          creationReason: preview.blockedPermanently ? 'missing_authorization' : 'ambiguous_outcome',
-          blockingDecision: preview.blockedPermanently
-            ? 'Fix the schedule operation or authorization before automatic maintenance can resume.'
-            : 'Inspect runtime maintenance readiness before allowing another unattended attempt.',
-          recommendedDecision: preview.blockedPermanently
-            ? 'Correct the automatic maintenance configuration and re-enable the schedule deliberately.'
-            : 'Review the maintenance preview, resolve the blocker, and then retrigger the schedule intentionally.',
-          recommendedPrompt: `Review blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId}. Determine whether the schedule configuration or runtime maintenance readiness should be corrected before retrying.`,
-          statusSummary: 'Scheduled maintenance occurrence blocked before dispatch.',
-          blockedBy: [decision],
-          attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
-        },
+        ...(preview.blockedPermanently ? {
+          handoff: {
+            title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} needs a user decision`,
+            summary: 'Automatic maintenance is permanently blocked and requires an explicit user decision before the schedule can resume.',
+            reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
+            creationReason: 'ambiguous_outcome' as const,
+            blockingDecision: 'Correct the configuration/authorization or intentionally keep this schedule paused.',
+            recommendedDecision: 'Review the permanent blocker and explicitly decide whether to repair configuration and resume.',
+            recommendedPrompt: `Review permanently blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId} and decide whether to repair and resume it.`,
+            statusSummary: 'Scheduled maintenance is permanently blocked pending a user decision.',
+            blockedBy: [decision],
+            attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
+          },
+        } : {}),
       });
       return failed.occurrence ?? blocked;
     }
@@ -930,18 +781,7 @@ export async function evaluateSchedule(
         outcome: 'failed',
         decision: 'execute',
         reason,
-        handoff: {
-          title: `GitHub issue watcher occurrence ${occurrence.occurrenceId} failed`,
-          summary: 'The local GitHub issue poll failed before Forge could compare issue state.',
-          reason,
-          creationReason: 'repeated_infrastructure_failure',
-          blockingDecision: 'Repair GitHub CLI authentication/connectivity before unattended issue monitoring resumes.',
-          recommendedDecision: 'Restore gh read access, then retrigger the watcher.',
-          recommendedPrompt: `Inspect GitHub issue watcher occurrence ${occurrence.occurrenceId} and restore the local read-only gh issue polling path.`,
-          statusSummary: 'GitHub issue watcher poll failed.',
-          blockedBy: ['github_issue_watch_failed'],
-          attemptedActions: [`schedule:${schedule.scheduleId}`, 'gh:api:issues'],
-        },
+
       });
       return failed.occurrence ?? occurrence;
     }
@@ -960,9 +800,9 @@ export async function evaluateSchedule(
         updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
         return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `SCHEDULE_BROWSER_PROBE_WORK_NOT_FOUND:${workId}`);
       }
-      if (isTerminalWorkContractStatus(work.status)) {
-        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
-        return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.status}); browser watcher stopped before probing.`);
+      if (semanticWorkState(work) !== 'open') {
+        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.semanticState}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
+        return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.semanticState}); browser watcher stopped before probing.`);
       }
     }
 
@@ -1084,18 +924,7 @@ export async function evaluateSchedule(
         outcome: 'failed',
         decision: 'execute',
         reason,
-        handoff: {
-          title: `Browser watcher occurrence ${occurrence.occurrenceId} failed`,
-          summary: 'A bounded browser probe failed before Forge could compare the external observation.',
-          reason,
-          creationReason: 'repeated_infrastructure_failure',
-          blockingDecision: 'Repair browser/session readiness or update the watcher target before unattended probing resumes.',
-          recommendedDecision: 'Inspect the browser plugin/session and retrigger the watcher after the target is readable.',
-          recommendedPrompt: `Inspect browser watcher schedule ${schedule.scheduleId} for Work ${workId}, repair the failed browser probe, then retrigger one bounded occurrence.`,
-          statusSummary: 'Scheduled browser watcher failed.',
-          blockedBy: ['browser_probe_failed'],
-          attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, 'operation:browser_probe'],
-        },
+
       });
       updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
       return failed.occurrence ?? saveOccurrence(controllerHome, { ...occurrence, status: 'failed', decision: 'execute', reason });
@@ -1160,22 +989,7 @@ export async function evaluateSchedule(
       outcome: 'failed',
       decision: 'execute',
       reason,
-      handoff: {
-        title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} failed`,
-        summary: 'A bounded live maintenance occurrence failed during deterministic apply and requires review before the schedule continues unattended.',
-        reason,
-        creationReason: 'repeated_infrastructure_failure',
-        blockingDecision: 'Review the failed maintenance occurrence and decide whether the schedule should continue automatically.',
-        recommendedDecision: 'Inspect the failed occurrence, fix the runtime blocker, then re-enable or retrigger the schedule intentionally.',
-        recommendedPrompt: `Review schedule occurrence ${occurrence.occurrenceId} for ${schedule.scheduleId}, inspect the failed runtime maintenance action, and decide whether to resume automatic maintenance.`,
-        statusSummary: 'Scheduled maintenance execution failed.',
-        blockedBy: ['scheduled_execution_failed'],
-        attemptedActions: [
-          `schedule:${schedule.scheduleId}`,
-          `operation:${schedule.action.operation}`,
-          actionIdRaw ? `action:${actionIdRaw}` : 'action:unknown',
-        ],
-      },
+
     });
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
       lastTriggeredAt: timestamp,