@moretea-labs/forge 1.8.0 → 1.8.1

package/adapters/chatgpt/controller-binding-store.ts

@@ -1,3 +1,4 @@
+import { FORGE_INSTANCE_SCOPE_KEY } from '../../src/cli/repositories/controller-home';
 import { withControllerLock } from '../../src/cli/repositories/locks';
 import { readControlPlaneRecord, writeControlPlaneRecord } from '../../src/runtime/control-plane/persistence/sqlite-store';
 import type { ControllerBinding } from '../../packages/kernel/controller/api/index';
@@ -7,7 +8,8 @@ const NAMESPACE = 'chatgpt_controller_binding';
 export interface ChatgptControllerBindingPayload {
   schemaVersion: 1;
   bindingId: string;
-  repoId: string;
+  /** Optional repository provenance only. */
+  repoId?: string;
   workId: string;
   sessionId: string;
   browserSessionId?: string;
@@ -17,39 +19,116 @@ export interface ChatgptControllerBindingPayload {
   reasoning?: 'medium' | 'high' | 'xhigh';
   tabPolicy?: 'auto' | 'reuse' | 'new';
   timeoutMs?: number;
+  /** Provider transport choice captured by launcher admission; not lifecycle authority. */
+  transportConversation?: 'bound' | 'fresh';
+  /** Initial provider hint captured for the queued ControllerRound only. */
+  continuationPrompt?: string;
+  authorizationGrantRefs?: string[];
   createdAt: string;
   updatedAt: string;
 }
 
-function bindingId(repoId: string, workId: string): string {
+export function chatgptControllerProviderBindingId(workId: string): string {
+  return `chatgpt-controller:${workId}`;
+}
+
+function canonicalBindingId(workId: string): string {
+  return chatgptControllerProviderBindingId(workId);
+}
+
+function legacyBindingId(repoId: string, workId: string): string {
   return `chatgpt-controller:${repoId}:${workId}`;
 }
 
+function readBinding(
+  controllerHome: string,
+  workId: string,
+  repoId?: string,
+): { value: ChatgptControllerBindingPayload; revision: number } | undefined {
+  const canonicalId = canonicalBindingId(workId);
+  const canonical = readControlPlaneRecord<ChatgptControllerBindingPayload>(
+    controllerHome,
+    NAMESPACE,
+    FORGE_INSTANCE_SCOPE_KEY,
+    canonicalId,
+  );
+  const legacy = repoId?.trim()
+    ? readControlPlaneRecord<ChatgptControllerBindingPayload>(
+        controllerHome,
+        NAMESPACE,
+        repoId.trim(),
+        legacyBindingId(repoId.trim(), workId),
+      )
+    : undefined;
+  if (canonical && legacy) {
+    const left = canonical.value;
+    const right = legacy.value;
+    if (left.workId !== right.workId
+      || left.sessionId !== right.sessionId
+      || (left.conversationUrl ?? '') !== (right.conversationUrl ?? '')) {
+      throw new Error(`CHATGPT_CONTROLLER_BINDING_COLLISION: ${workId}`);
+    }
+  }
+  return canonical ?? legacy;
+}
+
 export function upsertChatgptControllerBinding(
-  options: { controllerHome: string; repoId: string; now?: () => string },
+  options: { controllerHome: string; repoId?: string; now?: () => string },
   input: Omit<ChatgptControllerBindingPayload, 'schemaVersion' | 'bindingId' | 'repoId' | 'createdAt' | 'updatedAt'>,
 ): { binding: ControllerBinding; payload: ChatgptControllerBindingPayload } {
-  const id = bindingId(options.repoId, input.workId);
-  return withControllerLock(options.controllerHome, { scope: 'task', repoId: options.repoId, taskId: `chatgpt-controller-binding-${input.workId}` }, `chatgpt-controller-binding:${id}`, () => {
-    const current = readControlPlaneRecord<ChatgptControllerBindingPayload>(options.controllerHome, NAMESPACE, options.repoId, id);
-    const at = options.now?.() ?? new Date().toISOString();
-    const payload: ChatgptControllerBindingPayload = {
-      ...(current?.value ?? {} as ChatgptControllerBindingPayload),
-      ...input,
-      schemaVersion: 1, bindingId: id, repoId: options.repoId,
-      createdAt: current?.value.createdAt ?? at, updatedAt: at,
-    };
-    writeControlPlaneRecord(options.controllerHome, {
-      namespace: NAMESPACE, scope: options.repoId, key: id, schemaVersion: 1, value: payload,
-      action: current ? 'chatgpt_controller_binding_update' : 'chatgpt_controller_binding_create',
-      expectedRevision: current?.revision ?? null,
-    });
-    return { binding: { bindingId: id, hostKind: 'chatgpt', adapterRef: id }, payload };
-  });
+  const id = canonicalBindingId(input.workId);
+  return withControllerLock(
+    options.controllerHome,
+    { scope: 'global', resource: `chatgpt-controller-binding:${input.workId}` },
+    `chatgpt-controller-binding:${id}`,
+    () => {
+      const current = readBinding(options.controllerHome, input.workId, options.repoId);
+      const at = options.now?.() ?? new Date().toISOString();
+      const payload: ChatgptControllerBindingPayload = {
+        ...(current?.value ?? {} as ChatgptControllerBindingPayload),
+        ...input,
+        schemaVersion: 1,
+        bindingId: id,
+        ...(options.repoId?.trim() ? { repoId: options.repoId.trim() } : {}),
+        createdAt: current?.value.createdAt ?? at,
+        updatedAt: at,
+      };
+      writeControlPlaneRecord(options.controllerHome, {
+        namespace: NAMESPACE,
+        scope: FORGE_INSTANCE_SCOPE_KEY,
+        key: id,
+        schemaVersion: 1,
+        value: payload,
+        action: current ? 'chatgpt_controller_binding_update' : 'chatgpt_controller_binding_create',
+        expectedRevision: readControlPlaneRecord<ChatgptControllerBindingPayload>(
+          options.controllerHome,
+          NAMESPACE,
+          FORGE_INSTANCE_SCOPE_KEY,
+          id,
+        )?.revision ?? null,
+      });
+      return { binding: { bindingId: id, hostKind: 'chatgpt', adapterRef: id }, payload };
+    },
+  );
 }
 
 export function getChatgptControllerBindingPayload(
-  options: { controllerHome: string; repoId: string }, adapterRef: string,
+  options: { controllerHome: string; repoId?: string },
+  adapterRef: string,
 ): ChatgptControllerBindingPayload | undefined {
-  return readControlPlaneRecord<ChatgptControllerBindingPayload>(options.controllerHome, NAMESPACE, options.repoId, adapterRef)?.value;
+  const canonical = readControlPlaneRecord<ChatgptControllerBindingPayload>(
+    options.controllerHome,
+    NAMESPACE,
+    FORGE_INSTANCE_SCOPE_KEY,
+    adapterRef,
+  )?.value;
+  if (canonical) return canonical;
+  const repoId = options.repoId?.trim();
+  if (!repoId) return undefined;
+  return readControlPlaneRecord<ChatgptControllerBindingPayload>(
+    options.controllerHome,
+    NAMESPACE,
+    repoId,
+    adapterRef,
+  )?.value;
 }

package/adapters/chatgpt/controller-round-host.ts

@@ -14,31 +14,31 @@ export function buildChatgptControllerRoundPrompt(
   const snapshot = readControllerRoundContextSnapshot(options, record);
   const requirementLine = snapshot.requirement
     ? `Requirement ${snapshot.requirement.requirementId}：state=${snapshot.requirement.state}；outcome=${snapshot.requirement.outcomeStatement}`
-    : `当前未绑定 durable Requirement；语义 relay scope 为 ${snapshot.relayScopeId}。`;
+    : '当前未绑定 durable Requirement。';
   const workLines = snapshot.works.length > 0
     ? snapshot.works.map((work) => {
-      const summary = `- ${work.workId}：status=${work.status}；phase=${work.phase}；updated=${work.updatedAt}；objective=${work.objective}`;
+      const summary = `- ${work.workId}：updated=${work.updatedAt}；objective=${work.objective}`;
       if (work.workId !== snapshot.originWorkId || work.acceptanceCriteria.length === 0) return summary;
       return [
         summary,
-        '  origin Work acceptanceCriteria（durable semantic contract）：',
+        '  origin Work acceptanceCriteria：',
         ...work.acceptanceCriteria.map((criterion, index) => `  ${index + 1}. ${criterion}`),
       ].join('\n');
     }).join('\n')
     : '- 未找到关联 Work 快照';
   const originWork = snapshot.works.find((work) => work.workId === snapshot.originWorkId);
-  const terminalOriginGuidance = originWork?.status === 'completed'
-    ? `origin Work ${snapshot.originWorkId} 已 completed。禁止再次 controller_claim/reclaim 这个 terminal Work。若它是 validating 的 Plan predecessor：先用当前 round authority 做 plan_accept_step；再显式 start 唯一 successor（related_work_id=${snapshot.originWorkId}, work_relation=continue，并显式提供 work_kind/所需 engineering_preconditions 以及同一 controller_authority_id + relay_scope_id）；start 成功后 successor 只做 mechanical bind、不得抢占 ownership；随后显式提交 continue_immediately 得到 pending_release，最后 controller_release predecessor 触发新的 successor ControllerRound。`
+  const terminalOriginGuidance = originWork?.state === 'completed'
+    ? `origin Work ${snapshot.originWorkId} 的持久状态已完成。不要重新打开它；重新读取 Requirement/Plan/Work 语义事实，由模型决定是否仍有新的明确工作。`
     : undefined;
   const handoffLines = snapshot.handoffs.length > 0
     ? snapshot.handoffs.map((handoff) => `- ${handoff.id}：status=${handoff.status}；work=${handoff.workId ?? 'repo'}；${handoff.title}；reason=${handoff.reason}`).join('\n')
     : '- 当前没有 active linked Handoff';
   return [
-    `继续 Forge Requirement/Goal relay ${snapshot.relayScopeId}，repo=${snapshot.repoId}。`,
-    '这是新的 ChatGPT controller round。第一步必须重新读取最新 Forge Requirement/Work/Handoff 状态；下面的快照只用于启动提示，不能代替 durable state。',
+    `继续 Forge ${snapshot.requirement ? `Requirement ${snapshot.requirement.requirementId}` : `Work ${snapshot.originWorkId}`}，repo=${snapshot.repoId}。`,
+    '下面快照来自本轮 claim-time durable state，用它直接恢复上下文。只有某个事实的新鲜度会实质改变下一次具体 domain action 时，才针对性重新读取；不要把本轮先消耗在重复读取 Requirement/Plan/Work/UserRequest 或 lifecycle bookkeeping 上。',
     requirementLine,
     `关联 Work 快照：\n${workLines}`,
-    'origin Work 的 objective 与 acceptanceCriteria 是本轮必须显式检查的 durable semantic contract；若最新事实满足其中更具体的终态义务，不得仅凭通用 disposition 指导改写成另一种终态。',
+    'origin Work 的 objective 与 acceptanceCriteria 是需要显式检查的 durable semantic contract；语义结论只来自最新事实与模型判断。',
     `Active Handoff 快照：\n${handoffLines}`,
     ...(snapshot.assistantContext ? [snapshot.assistantContext] : []),
     ...(snapshot.executionQualitySignals?.length ? [
@@ -46,24 +46,14 @@ export function buildChatgptControllerRoundPrompt(
       'Review this evidence before repeating the same operation. Diagnose semantically; record whether an adjustment is justified. Do not infer a bug from edit counts, discard mandatory checks, widen authority or create another supervisor.',
     ] : []),
     promptOptions.exactOriginWork
-      ? `这是 Work-bound scheduled round。只允许 claim 并推进 origin Work ${snapshot.originWorkId}。不得选择、启动、delegate、resume sibling Work，不得新建 schedule，也不得扩大 scope。如果经过一次有界诊断或修复后仍无法安全推进，记录精确证据，提交 wait 或带 active Handoff 的 wait_for_user，释放 ownership，然后结束本轮。`
-      : `上一轮 relay 的 origin Work 是 ${snapshot.originWorkId}。不要假设下一步必须继续该 Work；必须依据最新 semantic state 选择、启动或 claim 正确的 Work。`,
+      ? `只推进 origin Work ${snapshot.originWorkId} 的既定范围。若存在真实用户授权/判断 blocker，记录一个去重的 UserRequest；否则继续可执行工作。`
+      : `origin Work 是 ${snapshot.originWorkId}。不要假设下一步必须继续它；依据最新 semantic state 选择现有或新的明确 Work。`,
     ...(terminalOriginGuidance ? [terminalOriginGuidance] : []),
-    `机械 relay 预算：round=${snapshot.round.count}/${snapshot.round.maxRounds}；repeated_state=${snapshot.round.repeatedStateCount}/${snapshot.round.maxRepeatedState}；consecutive_failures=${snapshot.round.consecutiveFailures}/${snapshot.round.maxFailures}。`,
-    '仓库中的工程、验收、安全和权限约束始终有效。但如果某条 Skill/tool 指令明确限定为其他 Controller host/runtime（例如“仅 Codex 使用/发现的 Skill”），它不是 ChatGPT 当前 round 的硬 capability gate，也不得仅为了满足该 host wording 而 delegate；应使用当前 ChatGPT/Forge 已有能力完成同一工程目标，或基于真实缺失能力提交精确 blocker。',
-    record.authorityId
-      ? `本轮 durable controller authority 为 controller_authority_id=${record.authorityId}。在 controller_claim、plan_accept_step、continue、verify、review、finalize、stop、controller_release 以及 terminal-successor start 中，必须保持同一个 controller_authority_id 与 relay_scope_id=${record.relayScopeId}。Frozen client 第一次 claim 使用 controller.round:controller_claim:${record.authorityId}:${record.relayScopeId}；plan_accept_step、continue、verify、finalize、stop、controller_release 使用 controller.round:<operation>:${record.authorityId}:${record.relayScopeId} authority；review 必须使用 controller.round:review:<approved|changes_required|blocked>:${record.authorityId}:${record.relayScopeId}，并通过 reason 携带 review rationale。若 terminal-successor start 的旧 schema 缺 work_kind/engineering_preconditions/round 字段，使用 bounded semantic start compatibility carrier。绝不能用 transport session id 或其他 Work/conversation authority 替代。`
-      : '这是没有 controller authority capability 的 legacy relay record；只能沿用已经 claim 的 controller lineage，直到显式恢复本轮。',
-    ...(snapshot.recoveryReason
-      ? ['上一轮 ChatGPT 在 liveness grace 到期前没有提交显式 disposition。必须重新读取 durable state，并显式关闭本轮。']
-      : []),
-    terminalOriginGuidance
-      ? `terminal predecessor 必须在显式 successor start 完成 mechanical bind 后，再显式提交一次 continue_immediately；得到 pending_release 后仅释放 predecessor。若没有可执行 successor，则按最新 Plan/Requirement 事实使用 wait、带 active Handoff 的 wait_for_user 或 goal_complete。`
-      : `如果 Requirement/Goal 需要下一个 controller round，在释放 Work 前提交 continue_immediately，并带 relay_scope_id=${record.relayScopeId}。否则使用 wait、带 active Handoff 的 wait_for_user，或 goal_complete。Frozen MCP client 可使用 controller.disposition:<disposition>:${record.relayScopeId}。`,
-    '本轮结束协议是强制的：在向用户输出本轮最终回复之前，必须先提交且仅提交一次 semantic disposition，并完成 controller_release；不得只报告“继续中”“下一步继续”或输出进度后结束本轮。',
-    '如果最新 durable state 表明 Requirement/Goal 尚有可执行工作，且不存在真实 external blocker、active Handoff 或必须由用户决定的边界，则必须选择 continue_immediately。wait 只用于真实等待条件；wait_for_user 必须绑定 active Handoff；goal_complete 只用于 Requirement/Goal 已语义完成。',
-    '提交 continue_immediately 后必须立即 controller_release 当前 Work。controller_release 是立即续跑的 canonical trigger：Forge 将通过现有 ChatGPT launcher 复用 durable conversation binding 并投递下一 ControllerRound prompt。正常连续推进不得依赖用户再次发送“继续”，也不得用 interval schedule 代替该即时 relay；schedule 只能作为故障恢复/watchdog。',
-    'Forge 不得自行推断 semantic next step。现有 Work ownership、Handoff authority 与 external-effect authorization 始终是权威。',
+    'Provider/session binding、transport recovery、dedupe、retry 和 continuation bookkeeping 由 Forge 内部维护，不属于模型工作流，也不是 Requirement/Plan/Work 的第二套语义权威。',
+    '执行与验证直接使用当前 domain capability；只有 durable 语义实际变化时才更新 Requirement/Plan/Work。Forge 不替模型推断语义 next step。',
+    '如果 origin Work 尚未完成且没有真实 UserRequest/外部 blocker，本轮结束前必须完成至少一个直接推进 objective 的具体 domain action，例如源码修改、进程/检查、typed external effect，或对实现决策有实质作用的源码调查。仅汇报状态、重复读取 lifecycle、刷新进度或说明“下一步要做什么”不算推进。',
+    '仓库工程、安全、权限和资源 fence 始终有效。若真实外部条件或用户判断阻塞，记录精确 UserRequest/Handoff；不要为了机械续跑创建 sibling Work、PlanStep 或额外 lifecycle。',
+    'Presentation-only progress：持续较久或包含多轮工具调用时，在关键阶段用 1–2 句 user-visible 进度说明已确认结果、下一件事或真实 blocker。不要逐工具播报，不要输出 private reasoning / chain-of-thought。',
   ].join('\n');
 }
 

package/adapters/chatgpt/controller-round-settlement-store.ts

@@ -1,7 +1,8 @@
+import { createHash } from 'crypto';
 import { withControllerLock } from '../../src/cli/repositories/locks';
 import { readControlPlaneRecord, writeControlPlaneRecord } from '../../src/runtime/control-plane/persistence/sqlite-store';
 
-// Resource-cleanup evidence only. Provider dispatch authority is ControllerRoundRelayRecord.lifecycleStage/providerDispatchReceiptId.
+// Resource-cleanup evidence only. Autonomous outer-turn dispatch authority is the Workflow Supervisor Effect ledger; ControllerRound fields are lower-layer/bootstrap compatibility mirrors.
 const NAMESPACE = 'chatgpt_controller_round_settlement';
 
 export type ChatgptControllerRoundSettlementStatus =
@@ -21,15 +22,67 @@ export interface ChatgptControllerRoundSettlement {
   status: ChatgptControllerRoundSettlementStatus;
   recordedAt: string;
   error?: string;
+  /**
+   * Opaque identity of the browser resource and grants used for this settlement
+   * attempt. A matching failed attempt must not repeatedly call the provider.
+   */
+  attemptIdentity?: string;
+}
+
+function settlementKey(workId: string, relayScopeId: string): string {
+  return `${workId}:${relayScopeId}`;
+}
+
+/**
+ * Keep browser-session and grant identifiers out of durable settlement evidence
+ * while preserving the exact retry boundary: a changed session or grant set may
+ * be retried, an unchanged failed attempt may not.
+ */
+export function chatgptControllerRoundSettlementAttemptIdentity(input: {
+  browserSessionId: string;
+  authorizationGrantRefs?: readonly string[];
+}): string {
+  const identity = {
+    browserSessionId: input.browserSessionId.trim(),
+    authorizationGrantRefs: [...new Set((input.authorizationGrantRefs ?? [])
+      .map((grantRef) => grantRef.trim())
+      .filter(Boolean))].sort(),
+  };
+  return `sha256:${createHash('sha256').update(JSON.stringify(identity)).digest('hex')}`;
+}
+
+export function getChatgptControllerRoundSettlement(
+  options: { controllerHome: string; repoId: string },
+  input: { workId: string; relayScopeId: string },
+): ChatgptControllerRoundSettlement | undefined {
+  return readControlPlaneRecord<ChatgptControllerRoundSettlement>(
+    options.controllerHome,
+    NAMESPACE,
+    options.repoId,
+    settlementKey(input.workId, input.relayScopeId),
+  )?.value;
 }
 
 export function recordChatgptControllerRoundSettlement(
   options: { controllerHome: string; repoId: string; now?: () => string },
-  input: { workId: string; relayScopeId: string; status: ChatgptControllerRoundSettlementStatus; error?: string },
+  input: {
+    workId: string;
+    relayScopeId: string;
+    status: ChatgptControllerRoundSettlementStatus;
+    error?: string;
+    attemptIdentity?: string;
+  },
 ): ChatgptControllerRoundSettlement {
-  const key = `${input.workId}:${input.relayScopeId}`;
+  const key = settlementKey(input.workId, input.relayScopeId);
   return withControllerLock(options.controllerHome, { scope: 'task', repoId: options.repoId, taskId: `chatgpt-round-settlement-${input.workId}` }, `chatgpt-round-settlement:${key}`, () => {
     const existing = readControlPlaneRecord<ChatgptControllerRoundSettlement>(options.controllerHome, NAMESPACE, options.repoId, key);
+    const error = input.error?.trim().slice(0, 2_000) || undefined;
+    const attemptIdentity = input.attemptIdentity?.trim().slice(0, 200) || undefined;
+    if (
+      existing?.value.status === input.status
+      && existing.value.error === error
+      && existing.value.attemptIdentity === attemptIdentity
+    ) return existing.value;
     const value: ChatgptControllerRoundSettlement = {
       schemaVersion: 1,
       repoId: options.repoId,
@@ -37,7 +90,8 @@ export function recordChatgptControllerRoundSettlement(
       relayScopeId: input.relayScopeId,
       status: input.status,
       recordedAt: options.now?.() ?? new Date().toISOString(),
-      ...(input.error?.trim() ? { error: input.error.trim().slice(0, 2_000) } : {}),
+      ...(error ? { error } : {}),
+      ...(attemptIdentity ? { attemptIdentity } : {}),
     };
     writeControlPlaneRecord(options.controllerHome, { namespace: NAMESPACE, scope: options.repoId, key, schemaVersion: 1, value, action: 'chatgpt_controller_round_settlement', expectedRevision: existing?.revision ?? null });
     return value;

package/adapters/chatgpt/provider-delivery.ts

@@ -4,6 +4,62 @@ export const DEFAULT_CHATGPT_AUTOMATION_MODEL = 'gpt-5.6';
 export const DEFAULT_CHATGPT_AUTOMATION_REASONING = 'high';
 export const DEFAULT_CHATGPT_AUTOMATION_TAB_POLICY = 'auto';
 export const CHATGPT_AUTOMATION_SUBMISSION_OUTCOME_UNKNOWN = 'CHATGPT_AUTOMATION_SUBMISSION_OUTCOME_UNKNOWN';
+export const CHATGPT_AUTOMATION_MESSAGE_DELIVERY_TIMED_OUT = 'CHATGPT_AUTOMATION_MESSAGE_DELIVERY_TIMED_OUT';
+export const CHATGPT_AUTOMATION_RESPONSE_STREAM_UNAVAILABLE = 'CHATGPT_AUTOMATION_RESPONSE_STREAM_UNAVAILABLE';
+export const CHATGPT_AUTOMATION_RATE_LIMITED = 'CHATGPT_AUTOMATION_RATE_LIMITED';
+export const CHATGPT_AUTOMATION_RATE_LIMITED_AFTER_SUBMIT = 'CHATGPT_AUTOMATION_RATE_LIMITED_AFTER_SUBMIT';
+export const CHATGPT_AUTOMATION_CONVERSATION_LIMIT_REACHED = 'CHATGPT_AUTOMATION_CONVERSATION_LIMIT_REACHED';
+
+export type ChatgptProviderPageFailureCode =
+  | typeof CHATGPT_AUTOMATION_MESSAGE_DELIVERY_TIMED_OUT
+  | typeof CHATGPT_AUTOMATION_RESPONSE_STREAM_UNAVAILABLE
+  | typeof CHATGPT_AUTOMATION_RATE_LIMITED
+  | typeof CHATGPT_AUTOMATION_CONVERSATION_LIMIT_REACHED;
+
+function normalizeChatgptProviderPageText(value: string): string {
+  return value.replace(/\s+/g, ' ').trim().toLowerCase();
+}
+
+/** Shared provider-page failure detection used by both direct delivery and durable Supervisor observation. */
+export function chatgptProviderPageFailure(
+  bodyText: string | undefined,
+): ChatgptProviderPageFailureCode | undefined {
+  const normalized = normalizeChatgptProviderPageText(bodyText ?? '');
+  // Dedicated live provider-status text only. Callers must not pass an
+  // unrestricted historical conversation transcript into this classifier.
+  if (normalized.includes('你已达到此对话的长度上限')
+    || normalized.includes('此对话已达到长度上限')
+    || normalized.includes('you have reached the maximum length for this conversation')
+    || normalized.includes("you've reached the maximum length for this conversation")
+    || normalized.includes('this conversation has reached its maximum length')
+    || normalized.includes('you have reached the conversation length limit')) {
+    return CHATGPT_AUTOMATION_CONVERSATION_LIMIT_REACHED;
+  }
+  if (
+    normalized.includes('resume stream unavailable')
+    || normalized.includes('tokenless_resume_unavailable')
+    || normalized.includes('stream recovery polling timed out')
+    || normalized.includes('连接已中断，正在等待完整答复')
+    || normalized.includes('connection interrupted, waiting for the full response')
+    || (normalized.includes('出了点问题') && normalized.includes('请重试'))
+    // A standalone current status is termination evidence. The same words in
+    // ordinary chat prose or a historical whole-page transcript are not.
+    || /^(?:已分析\s+)?(?:分析已暂停|analysis paused)(?:\s+(?:分析已暂停|analysis paused))*$/.test(normalized)
+  ) {
+    return CHATGPT_AUTOMATION_RESPONSE_STREAM_UNAVAILABLE;
+  }
+  if (
+    normalized.includes('too many requests')
+    || normalized.includes('rate limit exceeded')
+    || (normalized.includes('http 429') && normalized.includes('rate limit'))
+  ) {
+    return CHATGPT_AUTOMATION_RATE_LIMITED;
+  }
+  return ((normalized.includes('message delivery timed out') && normalized.includes('please try again'))
+    || (normalized.includes('消息传输超时') && normalized.includes('请重试')))
+    ? CHATGPT_AUTOMATION_MESSAGE_DELIVERY_TIMED_OUT
+    : undefined;
+}
 
 export type ChatgptAutomationReasoning = 'medium' | 'high' | 'xhigh';
 export type ChatgptAutomationTabPolicy = 'auto' | 'reuse' | 'new';
@@ -58,6 +114,172 @@ export interface ChatgptProviderDeliveryHost {
   dispatch(input: ChatgptProviderDeliveryInput): Promise<ChatgptProviderDeliveryResult>;
 }
 
+interface ChatgptProviderDispatchGate {
+  tail: Promise<void>;
+  queued: number;
+  pressureLevel: number;
+  cooldownUntilMs: number;
+}
+
+const CHATGPT_PROVIDER_BACKPRESSURE_BASE_MS = 2_000;
+const CHATGPT_PROVIDER_BACKPRESSURE_MAX_MS = 30_000;
+const CHATGPT_PROVIDER_EXPLICIT_RETRY_MAX_MS = 120_000;
+const chatgptProviderDispatchGates = new Map<string, ChatgptProviderDispatchGate>();
+
+function providerGateKey(controllerHome: string): string {
+  return controllerHome.trim() || 'forge-controller';
+}
+
+function chatgptProviderDispatchGate(controllerHome: string): ChatgptProviderDispatchGate {
+  const key = providerGateKey(controllerHome);
+  let gate = chatgptProviderDispatchGates.get(key);
+  if (!gate) {
+    gate = { tail: Promise.resolve(), queued: 0, pressureLevel: 0, cooldownUntilMs: 0 };
+    chatgptProviderDispatchGates.set(key, gate);
+  }
+  return gate;
+}
+
+function retryAfterDelayMs(message: string | undefined): number | undefined {
+  if (!message) return undefined;
+  const match = message.match(/\bretry[- ]?after\s*[:=]?\s*(\d+(?:\.\d+)?)\s*(ms|milliseconds?|s|sec(?:ond)?s?)?\b/i);
+  if (!match) return undefined;
+  const amount = Number(match[1]);
+  if (!Number.isFinite(amount) || amount <= 0) return undefined;
+  const milliseconds = match[2]?.toLowerCase().startsWith('m') ? amount : amount * 1_000;
+  return Math.max(1_000, Math.min(CHATGPT_PROVIDER_EXPLICIT_RETRY_MAX_MS, Math.round(milliseconds)));
+}
+
+/** Deterministic jitter keeps concurrent callers from reconverging on one provider boundary after cooldown. */
+export function chatgptProviderBackoffDelayMs(
+  pressureLevel: number,
+  key = 'chatgpt',
+  message?: string,
+): number {
+  const explicit = retryAfterDelayMs(message);
+  if (explicit !== undefined) return explicit;
+  const exponent = Math.max(0, Math.min(8, Math.trunc(pressureLevel) - 1));
+  const base = Math.min(CHATGPT_PROVIDER_BACKPRESSURE_MAX_MS, CHATGPT_PROVIDER_BACKPRESSURE_BASE_MS * 2 ** exponent);
+  const jitterByte = createHash('sha256').update(`${key}\n${pressureLevel}`).digest()[0] ?? 128;
+  const jitter = 0.8 + (jitterByte / 255) * 0.4;
+  return Math.max(1_000, Math.min(CHATGPT_PROVIDER_BACKPRESSURE_MAX_MS, Math.round(base * jitter)));
+}
+
+export function chatgptProviderFailureRequiresBackpressure(
+  status: ChatgptProviderDeliveryStatus | undefined,
+  code?: string,
+  message?: string,
+): boolean {
+  if (status === 'outcome_unknown') return true;
+  const normalized = `${code ?? ''}\n${message ?? ''}`.toUpperCase();
+  return normalized.includes('RATE_LIMITED')
+    || normalized.includes('TOO MANY REQUESTS')
+    || normalized.includes('HTTP 429')
+    || normalized.includes('TOKENLESS_RESUME_UNAVAILABLE')
+    || normalized.includes('RESPONSE_STREAM_UNAVAILABLE')
+    || normalized.includes('MESSAGE_DELIVERY_TIMED_OUT');
+}
+
+export function noteChatgptProviderBackpressure(
+  controllerHome: string,
+  message?: string,
+  nowMs = Date.now(),
+): number {
+  const key = providerGateKey(controllerHome);
+  const gate = chatgptProviderDispatchGate(controllerHome);
+  gate.pressureLevel += 1;
+  const delayMs = chatgptProviderBackoffDelayMs(gate.pressureLevel, key, message);
+  gate.cooldownUntilMs = Math.max(gate.cooldownUntilMs, nowMs + delayMs);
+  return delayMs;
+}
+
+export function chatgptProviderBackpressureRemainingMs(
+  controllerHome: string,
+  nowMs = Date.now(),
+): number {
+  const gate = chatgptProviderDispatchGates.get(providerGateKey(controllerHome));
+  return gate ? Math.max(0, gate.cooldownUntilMs - nowMs) : 0;
+}
+
+export interface ChatgptProviderDispatchOutcome {
+  status?: ChatgptProviderDeliveryStatus;
+  code?: string;
+  message?: string;
+  /**
+   * True only when the provider actually accepted this submission. A local
+   * transport failure (foreground required, composer missing, transport
+   * unavailable) is neither acceptance nor provider backpressure, so it must
+   * not clear pressure that a real provider limit established.
+   */
+  providerAccepted?: boolean;
+}
+
+/**
+ * One active Runtime owns one transient ChatGPT provider dispatch lane. This is
+ * deliberately mechanical and in-memory: ControllerRound effect identity remains
+ * the durable replay fence across Runtime rotation, while provider pressure must
+ * not become Work/Plan lifecycle state.
+ *
+ * Provider rate limiting is an account-level resource, so *every* transport that
+ * can submit a provider prompt through this Runtime must enter the same lane and
+ * obey the same cooldown. A separate lane that only reads the cooldown still
+ * submits concurrently with this one, which is exactly how one ChatGPT account
+ * observes request concurrency that no single session produced.
+ */
+export async function withChatgptProviderDispatchLane<T>(
+  controllerHome: string,
+  operation: () => Promise<T>,
+  outcomeOf: (result: T) => ChatgptProviderDispatchOutcome | undefined,
+): Promise<T> {
+  const key = providerGateKey(controllerHome);
+  const gate = chatgptProviderDispatchGate(controllerHome);
+
+  const predecessor = gate.tail;
+  let release!: () => void;
+  gate.tail = new Promise<void>((resolve) => { release = resolve; });
+  gate.queued += 1;
+  await predecessor;
+
+  try {
+    const waitMs = gate.cooldownUntilMs - Date.now();
+    if (waitMs > 0) await new Promise((resolve) => setTimeout(resolve, waitMs));
+
+    const result = await operation();
+    const outcome = outcomeOf(result);
+    if (outcome && chatgptProviderFailureRequiresBackpressure(outcome.status, outcome.code, outcome.message)) {
+      noteChatgptProviderBackpressure(controllerHome, outcome.message);
+    } else if (outcome?.providerAccepted === true) {
+      gate.pressureLevel = 0;
+      gate.cooldownUntilMs = 0;
+    }
+    return result;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (chatgptProviderFailureRequiresBackpressure(undefined, undefined, message)) {
+      noteChatgptProviderBackpressure(controllerHome, message);
+    }
+    throw error;
+  } finally {
+    gate.queued -= 1;
+    release();
+    if (gate.queued === 0 && gate.pressureLevel === 0 && gate.cooldownUntilMs <= Date.now()) {
+      chatgptProviderDispatchGates.delete(key);
+    }
+  }
+}
+
+/** Controller-relay delivery: one serialized provider prompt submission lane. */
+export async function dispatchWithChatgptProviderBackpressure(
+  controllerHome: string,
+  dispatch: () => Promise<ChatgptProviderDeliveryResult>,
+): Promise<ChatgptProviderDeliveryResult> {
+  return await withChatgptProviderDispatchLane(controllerHome, dispatch, (result) => (
+    chatgptProviderFailureRequiresBackpressure(result.status, result.error?.code, result.error?.message)
+      ? { code: result.error?.code, message: result.error?.message }
+      : { providerAccepted: result.status === 'dispatch_confirmed' }
+  ));
+}
+
 const CHATGPT_WAIT_FOR_USER_MARKERS = [
   'LOGIN_REQUIRED',
   'AUTH_REQUIRED',
@@ -73,7 +295,12 @@ export function classifyChatgptProviderFailure(
   message?: string,
 ): ChatgptProviderFailureDisposition {
   const normalized = `${code ?? ''}\n${message ?? ''}`.toUpperCase();
-  if (normalized.includes('OUTCOME_UNKNOWN') || normalized.includes('SUBMISSION_NOT_CONFIRMED')) return 'outcome_unknown';
+  if (
+    normalized.includes('OUTCOME_UNKNOWN')
+    || normalized.includes('MESSAGE_DELIVERY_TIMED_OUT')
+    || normalized.includes('RESPONSE_STREAM_UNAVAILABLE')
+    || normalized.includes('RATE_LIMITED_AFTER_SUBMIT')
+  ) return 'outcome_unknown';
   if (CHATGPT_WAIT_FOR_USER_MARKERS.some((marker) => normalized.includes(marker))) return 'wait_for_user';
   return 'failed';
 }