@moretea-labs/forge 1.8.0 → 1.8.1

package/scripts/forge-local-recovery-helper.mjs

@@ -4,15 +4,46 @@ import { existsSync, readFileSync } from 'fs';
 import { isAbsolute, join, resolve } from 'path';
 import { pathToFileURL } from 'url';
 import { resolveControllerHome } from '../src/cli/repositories/controller-home.ts';
-import { findRegisteredRepositoryByCheckoutRoot } from '../src/cli/repositories/registry.ts';
+import { findRegisteredRepositoryByCheckoutRoot, getRepository } from '../src/cli/repositories/registry.ts';
 import { createRecoveryConfig, gatewayToken, loadRecoveryConfig } from '../src/runtime/standalone-recovery/core.ts';
 
 export const PLUGIN_ID = 'local_recovery';
 export const PLUGIN_VERSION = '0.1.0';
 export const PROTOCOL_VERSION = 1;
 export const CAPABILITIES = ['forge.local_recovery.transport.v1'];
-export const ACTIONS = ['runtime_status', 'list_releases', 'stage_and_activate_runtime_release'];
-const MUTATING_ACTIONS = new Set(['stage_and_activate_runtime_release']);
+export const ACTIONS = [
+  'runtime_status',
+  'list_releases',
+  'verify_stable_runtime',
+  'stage_and_activate_runtime_release',
+  'release_session_status',
+  'advance_runtime_release_session',
+  'verify_runtime_release_session_static',
+  'verify_runtime_release_session_candidate',
+  'cutover_runtime_release_session',
+  'cancel_runtime_release_session',
+  'rollback_runtime_release_session',
+  'promote_runtime_release_session_known_good',
+];
+const RELEASE_SESSION_ACTIONS = new Set([
+  'release_session_status',
+  'verify_runtime_release_session_static',
+  'verify_runtime_release_session_candidate',
+  'cutover_runtime_release_session',
+  'cancel_runtime_release_session',
+  'rollback_runtime_release_session',
+  'promote_runtime_release_session_known_good',
+]);
+const MUTATING_ACTIONS = new Set([
+  'stage_and_activate_runtime_release',
+  'advance_runtime_release_session',
+  'verify_runtime_release_session_static',
+  'verify_runtime_release_session_candidate',
+  'cutover_runtime_release_session',
+  'cancel_runtime_release_session',
+  'rollback_runtime_release_session',
+  'promote_runtime_release_session_known_good',
+]);
 const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
 
 function providerError(code, message, retryable = false, details) {
@@ -91,8 +122,7 @@ export async function callRecoveryTool(controllerHome, toolName, args = {}, inje
       protocolVersion: '2025-06-18', capabilities: {}, clientInfo: { name: 'forge-local-recovery-provider', version: PLUGIN_VERSION },
     },
   });
-  const sessionId = initialized.response.headers.get('mcp-session-id');
-  if (!sessionId) throw providerError('LOCAL_RECOVERY_MCP_SESSION_MISSING', 'Recovery MCP initialize did not return a session id.');
+  const sessionId = initialized.response.headers.get('mcp-session-id') || undefined;
   try {
     await postRpc(fetchImpl, endpoint, token, { jsonrpc: '2.0', method: 'notifications/initialized' }, sessionId);
     const called = await postRpc(fetchImpl, endpoint, token, {
@@ -101,15 +131,21 @@ export async function callRecoveryTool(controllerHome, toolName, args = {}, inje
     if (called.payload?.error) throw providerError('LOCAL_RECOVERY_TOOL_FAILED', String(called.payload.error?.message ?? 'Recovery tool failed.'), false);
     const content = called.payload?.result?.content;
     const text = Array.isArray(content) ? content.find((entry) => entry?.type === 'text' && typeof entry.text === 'string')?.text : undefined;
+    if (called.payload?.result?.isError === true) {
+      const message = typeof text === 'string' && text.trim() ? text.trim().slice(0, 4000) : 'Recovery tool failed.';
+      throw providerError('LOCAL_RECOVERY_TOOL_FAILED', message, false);
+    }
     if (text) return parseJson(text, 'LOCAL_RECOVERY_TOOL_RESULT_INVALID');
     return called.payload?.result ?? {};
   } finally {
-    try {
-      await fetchImpl(endpoint, {
-        method: 'DELETE',
-        headers: { authorization: `Bearer ${token}`, accept: 'application/json, text/event-stream', 'mcp-session-id': sessionId },
-      });
-    } catch { /* Session cleanup is best effort; Recovery owns mutation transaction durability. */ }
+    if (sessionId) {
+      try {
+        await fetchImpl(endpoint, {
+          method: 'DELETE',
+          headers: { authorization: `Bearer ${token}`, accept: 'application/json, text/event-stream', 'mcp-session-id': sessionId },
+        });
+      } catch { /* Session cleanup is best effort; ReleaseSession durability is independent from this transport session. */ }
+    }
   }
 }
 
@@ -119,6 +155,17 @@ function assertEmptyInput(input) {
   }
 }
 
+function releaseSessionInput(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).length !== 1 || typeof input.session_id !== 'string') {
+    throw providerError('LOCAL_RECOVERY_RELEASE_SESSION_ARGUMENTS_INVALID', 'ReleaseSession actions accept only session_id.');
+  }
+  const sessionId = input.session_id.trim();
+  if (sessionId.length < 8 || sessionId.length > 120) {
+    throw providerError('LOCAL_RECOVERY_RELEASE_SESSION_ID_INVALID', 'ReleaseSession session_id must be 8 to 120 characters.');
+  }
+  return { session_id: sessionId };
+}
+
 function mutationRequestId(requestId) {
   return `local-recovery:${createHash('sha256').update(String(requestId)).digest('hex').slice(0, 32)}`;
 }
@@ -127,9 +174,36 @@ export function ensureSourceRepositoryProvenance(controllerHome, injected = {})
   const loadConfig = injected.loadRecoveryConfig ?? loadRecoveryConfig;
   const persistConfig = injected.createRecoveryConfig ?? createRecoveryConfig;
   const findRepository = injected.findRegisteredRepositoryByCheckoutRoot ?? findRegisteredRepositoryByCheckoutRoot;
+  const readRepository = injected.getRepository ?? getRepository;
   const recoveryConfig = loadConfig(controllerHome);
-  if (typeof recoveryConfig.primaryRuntimeSourceRepositoryId === 'string' && recoveryConfig.primaryRuntimeSourceRepositoryId.trim()) return recoveryConfig;
+  const repositoryId = typeof recoveryConfig.primaryRuntimeSourceRepositoryId === 'string'
+    ? recoveryConfig.primaryRuntimeSourceRepositoryId.trim()
+    : '';
   const sourceRoot = typeof recoveryConfig.primaryRuntimeSourceRoot === 'string' ? recoveryConfig.primaryRuntimeSourceRoot.trim() : '';
+
+  if (repositoryId) {
+    let repository;
+    try {
+      repository = readRepository(repositoryId, controllerHome);
+    } catch {
+      throw providerError('LOCAL_RECOVERY_SOURCE_REPOSITORY_UNRESOLVED', 'Configured primary Runtime source repository id is not one enabled registered repository.');
+    }
+    if (!repository || repository.repoId !== repositoryId || repository.enabled === false || repository.removedAt) {
+      throw providerError('LOCAL_RECOVERY_SOURCE_REPOSITORY_UNRESOLVED', 'Configured primary Runtime source repository id is not one enabled registered repository.');
+    }
+    const canonicalRoot = typeof repository.canonicalRoot === 'string' && repository.canonicalRoot.trim()
+      ? resolve(repository.canonicalRoot.trim())
+      : '';
+    if (!canonicalRoot || !isAbsolute(canonicalRoot) || !existsSync(canonicalRoot)) {
+      throw providerError('LOCAL_RECOVERY_SOURCE_CANONICAL_ROOT_UNAVAILABLE', 'Configured primary Runtime source repository canonical root is unavailable.');
+    }
+    if (sourceRoot && resolve(sourceRoot) === canonicalRoot) return recoveryConfig;
+    return persistConfig(controllerHome, {
+      primaryRuntimeSourceRoot: canonicalRoot,
+      primaryRuntimeSourceRepositoryId: repositoryId,
+    });
+  }
+
   if (!sourceRoot) throw providerError('LOCAL_RECOVERY_SOURCE_ROOT_UNAVAILABLE', 'Installed Recovery config does not identify the primary Runtime source root.');
   const repository = findRepository(sourceRoot, controllerHome);
   if (!repository?.repoId) throw providerError('LOCAL_RECOVERY_SOURCE_REPOSITORY_UNRESOLVED', 'Configured primary Runtime source root is not owned by one registered repository.');
@@ -142,10 +216,14 @@ export function ensureSourceRepositoryProvenance(controllerHome, injected = {})
 export async function executeAction(actionId, input, providerConfig, injected = {}) {
   const config = validateProviderConfig(providerConfig);
   if (!ACTIONS.includes(actionId)) throw providerError('LOCAL_RECOVERY_ACTION_UNSUPPORTED', 'Unsupported Local Recovery action.');
-  assertEmptyInput(input);
+  const sessionArgs = RELEASE_SESSION_ACTIONS.has(actionId) ? releaseSessionInput(input) : undefined;
+  if (!sessionArgs) assertEmptyInput(input);
   const callTool = injected.callRecoveryTool ?? callRecoveryTool;
-  if (actionId === 'stage_and_activate_runtime_release') ensureSourceRepositoryProvenance(config.controllerHome, injected);
-  const args = MUTATING_ACTIONS.has(actionId) ? { request_id: mutationRequestId(injected.requestId ?? actionId) } : {};
+  if (actionId === 'stage_and_activate_runtime_release' || actionId === 'advance_runtime_release_session') ensureSourceRepositoryProvenance(config.controllerHome, injected);
+  const args = {
+    ...(sessionArgs ?? {}),
+    ...(MUTATING_ACTIONS.has(actionId) ? { request_id: mutationRequestId(injected.requestId ?? actionId) } : {}),
+  };
   return await callTool(config.controllerHome, actionId, args, injected);
 }
 

package/scripts/lib/project-init-lib.sh

@@ -1825,6 +1825,9 @@ This is the root routing contract for Claude Code and Codex.
 - Keep root context concise; route durable human-authored detail into product, architecture, research, or intentional project documents.
 - Treat `_ref/` as ignored external reference material and `_ops/` as ignored local operations residue.
 - Use Controller Home for mutable workflow state instead of recreating repo-local task/workstream/session projections.
+- For architecture migrations, use one bounded Delivery Transaction: batch discovery -> architecture/root-cause decision -> freeze scope -> coherent implementation -> whole-diff review -> focused validation wave -> canonical gates -> one delivery/cleanup.
+- Do not create sibling Work, per-file commits, repeated broad validation, or release/canary cycles for same-root-cause discoveries while the current candidate is still moving.
+- Treat release as a source-complete candidate boundary. Defer workflow/lifecycle machinery improvements to a post-release Plan when they are not required to converge the current version safely.
 EOF_ROOT_CONTEXT
 }
 

package/scripts/open-source-audit-allowlist.txt

@@ -45,8 +45,6 @@ tests/runtime/target-architecture.test.ts
 # and installation locations to prove discovery and identity fencing.
 scripts/portability-bindings.mjs
 tests/runtime/browser-product-discovery.test.ts
-tests/runtime/chatgpt-work-continuation.test.ts
-tests/runtime/frozen-tool-contract-abi.test.ts
 tests/runtime/windows-host-discovery.test.ts
 tests/runtime/standalone-recovery.test.ts
 # Secret-marker rejection tests use non-secret synthetic values by design.
@@ -55,3 +53,4 @@ tests/runtime/context-plane.test.ts
 # Supervisor service unit tests use synthetic homeDir placeholders for PATH assembly.
 # Local monitor bridge defaults may reference a development repository id.
 scripts/run-mobile-monitor-bridge.ts
+tests/runtime/browser-session-authority.test.ts # Intentional placeholder user profile used to prove foreign Chrome profiles are never reclaimed.

package/scripts/run-bounded-command.mjs

@@ -49,6 +49,11 @@ if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || commandArgs.length === 0) {
   });
   child.once('close', (code) => {
     clearTimeout(timeout);
+    // The direct child can exit on SIGTERM while a stubborn descendant remains
+    // alive in its detached process group. Before dropping the escalation timer,
+    // synchronously send SIGKILL to that process group once more so timeout
+    // completion cannot orphan compiler/test descendants.
+    if (timedOut && process.platform !== 'win32') stop('SIGKILL');
     if (escalation) clearTimeout(escalation);
     process.exitCode = launchFailed ? 1 : (timedOut ? 124 : code ?? 1);
   });

package/scripts/run-governed-gate.ts

@@ -22,7 +22,6 @@ export function stepsFor(gate: Gate): Step[] {
     { label: 'repository hygiene', command: 'node', args: ['scripts/check-repository-hygiene.mjs'], timeoutMs: 2 * 60_000 },
     { label: 'generated authority', command: 'node', args: ['scripts/sync-generated-authority.mjs', '--check'], timeoutMs: 2 * 60_000 },
     { label: 'source duplication', command: 'node', args: ['scripts/check-source-duplication.mjs'], timeoutMs: 2 * 60_000 },
-    { label: 'controller UI bundle', command: 'bun', args: ['run', 'check:controller-ui'], timeoutMs: 5 * 60_000 },
     { label: 'test manifest', command: 'bun', args: ['run', 'check:test-governance'], timeoutMs: 5 * 60_000 },
     { label: 'affected tests', command: 'bun', args: ['run', 'test'], timeoutMs: 30 * 60_000 },
   ];

package/scripts/run-mobile-monitor-bridge.ts

@@ -49,7 +49,6 @@ const handle = await startLocalBridgeServer({
   defaultRepoId,
   host,
   port,
-  openBrowser: false,
   allowLanMobileIntents: true,
   mode: 'standalone',
 });

package/scripts/smoke-control-plane-failure-domain.ts

@@ -0,0 +1,94 @@
+import { strict as assert } from 'node:assert';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  FORGE_RECOVERY_DAEMON_LABEL,
+  FORGE_RECOVERY_GATEWAY_LABEL,
+  forgeConnectorPersistentServiceLabel,
+  forgeRuntimePersistentServiceLabel,
+} from '../src/runtime/platform/service-inventory';
+import {
+  classifyRecoveryMcpRequest,
+  recoveryRuntimeRoleFromExecutable,
+} from '../src/runtime/standalone-recovery/entry';
+import { recentMcpTransportEvidence } from '../adapters/mcp/transports/http-observation';
+import { recordMcpTransportEvent, readRecentMcpTransportEvents } from '../src/runtime/diagnostics/mcp-timing';
+
+const controllerHome = mkdtempSync(join(tmpdir(), 'forge-control-plane-failure-domain-'));
+try {
+  // Main Runtime/MCP and Recovery must have distinct service identities. A
+  // restart or crash fence for one must not name the other lifecycle owner.
+  const runtimeLabel = forgeRuntimePersistentServiceLabel(controllerHome);
+  const connectorLabel = forgeConnectorPersistentServiceLabel(controllerHome);
+  assert.notEqual(runtimeLabel, FORGE_RECOVERY_DAEMON_LABEL);
+  assert.notEqual(runtimeLabel, FORGE_RECOVERY_GATEWAY_LABEL);
+  assert.notEqual(connectorLabel, FORGE_RECOVERY_DAEMON_LABEL);
+  assert.notEqual(connectorLabel, FORGE_RECOVERY_GATEWAY_LABEL);
+  assert.notEqual(FORGE_RECOVERY_DAEMON_LABEL, FORGE_RECOVERY_GATEWAY_LABEL);
+  assert.equal(recoveryRuntimeRoleFromExecutable('/tmp/forge-recovery-gateway'), 'gateway');
+  assert.equal(recoveryRuntimeRoleFromExecutable('/tmp/forge-recovery-watchdog'), 'watchdog');
+
+  // Recovery owns its own MCP route. Main MCP being unavailable must not turn a
+  // valid Recovery request into a route-level 404; authorization is evaluated
+  // by the Recovery gateway itself.
+  assert.equal(classifyRecoveryMcpRequest({
+    method: 'POST',
+    url: '/recovery/mcp',
+    headers: { authorization: 'Bearer recovery-token' },
+  } as any, 'recovery-token'), 'mcp');
+  assert.equal(classifyRecoveryMcpRequest({
+    method: 'POST',
+    url: '/recovery/mcp',
+    headers: {},
+  } as any, 'recovery-token'), 'auth_required');
+  assert.equal(classifyRecoveryMcpRequest({
+    method: 'POST',
+    url: '/main/mcp',
+    headers: { authorization: 'Bearer recovery-token' },
+  } as any, 'recovery-token'), 'not_mcp');
+
+  // Current health and recent incident evidence are separate dimensions. A
+  // successful reconnect does not erase the interruption that immediately
+  // preceded it, and a later health probe may still truthfully be green.
+  const interruptedAt = '2026-09-22T12:00:00.000Z';
+  const recoveredAt = '2026-09-22T12:00:05.000Z';
+  recordMcpTransportEvent(controllerHome, {
+    kind: 'interruption',
+    sessionId: 'mcp-before-outage',
+    connectionId: 'connection-before-outage',
+    route: '/mcp',
+    principalId: 'chatgpt-controller',
+    reason: 'transport_close',
+    at: interruptedAt,
+  });
+  recordMcpTransportEvent(controllerHome, {
+    kind: 'session_initialized',
+    sessionId: 'mcp-after-outage',
+    connectionId: 'connection-after-outage',
+    route: '/mcp',
+    principalId: 'chatgpt-controller',
+    at: recoveredAt,
+  });
+  const evidence = recentMcpTransportEvidence(
+    readRecentMcpTransportEvents(controllerHome),
+    '2026-09-22T11:00:00.000Z',
+    Date.parse('2026-09-22T12:01:00.000Z'),
+  );
+  assert.equal(evidence.current, 'healthy');
+  assert.equal(evidence.recentStatus, 'recovered');
+  assert.equal(evidence.lastInterruption?.at, interruptedAt);
+  assert.equal(evidence.lastRecoveryAt, recoveredAt);
+
+  console.log(JSON.stringify({
+    status: 'ok',
+    mainRuntimeLabel: runtimeLabel,
+    mainConnectorLabel: connectorLabel,
+    recoveryDaemonLabel: FORGE_RECOVERY_DAEMON_LABEL,
+    recoveryGatewayLabel: FORGE_RECOVERY_GATEWAY_LABEL,
+    recoveryRouteIndependent: true,
+    health: evidence,
+  }, null, 2));
+} finally {
+  rmSync(controllerHome, { recursive: true, force: true });
+}

package/scripts/smoke-mcp-http-runtime.ts

@@ -148,6 +148,11 @@ try {
     throw new Error(`GATEWAY_START_FAILED: ${error instanceof Error ? error.message : String(error)} ${stderr}`);
   }
   if (health.status !== 200 || health.body.status !== 'ok') throw new Error(`HEALTH_FAILED: ${JSON.stringify(health)} ${stderr}`);
+  const initialTransportEvidence = health.body.transportEvidence as Record<string, unknown> | undefined;
+  if (initialTransportEvidence?.current !== 'healthy') throw new Error(`TRANSPORT_CURRENT_HEALTH_MISSING: ${JSON.stringify(initialTransportEvidence)}`);
+  if (!['stable', 'recovering', 'recovered'].includes(String(initialTransportEvidence?.recentStatus))) {
+    throw new Error(`TRANSPORT_RECENT_STATUS_INVALID: ${JSON.stringify(initialTransportEvidence)}`);
+  }
   const expectedPolicy = runtimePolicy(repoRoot, {
     repo: repoRoot,
     controllerHome,

package/scripts/smoke-runtime-recovery.ts

@@ -9,11 +9,8 @@ import {
   getWorkContract,
   getWorkContractByRequestId,
   recordWorkCompletionReceipt,
-  recordWorkImplementationReview,
-  requestWorkImplementationReview,
-  transitionWorkContractPhase,
 } from '../src/runtime/control-plane/facade/work-contract-store';
-import { implementationReviewChangedPathDigest } from '../src/runtime/control-plane/facade/work-implementation-review';
+import { reviseWorkSemanticContext } from '../packages/kernel/work/api/index';
 import {
   claimControllerSession,
   getControllerSession,
@@ -70,6 +67,7 @@ try {
     semanticKey: operation.semanticKey,
     operation,
     objective: 'Verify WorkContract and Process Runtime recovery without ExecutionJobs',
+    workKind: 'completed_no_change' as const,
     checks: [],
   };
   const accepted = acceptSubmittedWorkContract(controllerHome, request);
@@ -89,13 +87,6 @@ try {
     sessionId: 'session-recovery-a',
     leaseMs: 60_000,
   });
-  // Recovery smoke follows the same Work-only phase API enforced in production.
-  transitionWorkContractPhase({ controllerHome, repoId: repository.repoId }, accepted.contract.workId, {
-    phase: 'implementation',
-    status: 'running',
-    state: 'active',
-    summary: 'Process Runtime recovery smoke started implementation.',
-  });
   const handle = await spawnManagedProcess({
     controllerHome,
     repoId: repository.repoId,
@@ -135,42 +126,13 @@ try {
   assert(getControllerSession({ controllerHome, repoId: repository.repoId }, accepted.contract.workId)?.sessionId === 'session-recovery-b', 'replacement Controller session missing');
   const completionRecordedAt = new Date().toISOString();
   const completionRevision = String(spawnSync('git', ['-C', repoRoot, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).stdout).trim();
-  transitionWorkContractPhase({ controllerHome, repoId: repository.repoId }, accepted.contract.workId, {
-    phase: 'verification',
-    status: 'running',
-    state: 'satisfied',
-    summary: 'Recovered Process completed successfully for the exact no-change candidate.',
-  });
-  requestWorkImplementationReview(
-    { controllerHome, repoId: repository.repoId },
-    accepted.contract.workId,
-    'Recovery smoke verification completed; implementation review is required before completion.',
-  );
-  recordWorkImplementationReview({ controllerHome, repoId: repository.repoId }, accepted.contract.workId, {
-    schemaVersion: 1,
-    reviewId: `REV-smoke-${accepted.contract.workId}`,
-    workId: accepted.contract.workId,
-    reviewerPrincipalId: replacement.principalId ?? replacement.controllerId,
-    reviewerControllerSessionId: replacement.sessionId,
-    decision: 'approved',
-    rationale: 'Recovery smoke reviewed the exact recovered no-change candidate before terminal completion.',
-    findings: [],
-    sourceRevision: completionRevision,
-    workspaceFingerprint: 'runtime-recovery-smoke-no-change-content',
-    verificationWorkspaceFingerprint: 'runtime-recovery-smoke-no-change-verification',
-    changedPaths: [],
-    changedPathDigest: implementationReviewChangedPathDigest([]),
-    acceptanceCriteriaSummary: 'Managed Process recovery, Controller reclaim, and no-change Work completion remain coherent.',
-    verificationEvidence: [],
-    architectureEvidence: [],
-    recordedAt: completionRecordedAt,
-  });
+  const completionReceiptId = `REC-smoke-${accepted.contract.workId}`;
   recordWorkCompletionReceipt(
     { controllerHome, repoId: repository.repoId },
     accepted.contract.workId,
     {
       schemaVersion: 1,
-      receiptId: `REC-smoke-${accepted.contract.workId}`,
+      receiptId: completionReceiptId,
       source: 'direct_edit',
       issueId: 'ISS-runtime-recovery-smoke',
       taskId: 'T1',
@@ -186,7 +148,14 @@ try {
     'completed_no_change',
     'completed_no_change',
   );
-  assert(getWorkContract({ controllerHome, repoId: repository.repoId }, accepted.contract.workId)?.status === 'completed', 'completed WorkContract was not persisted');
+  const delivered = getWorkContract({ controllerHome, repoId: repository.repoId }, accepted.contract.workId);
+  assert(delivered?.semanticState !== 'completed', 'delivery receipt must not implicitly complete semantic Work');
+  reviseWorkSemanticContext(
+    { controllerHome, repoId: repository.repoId },
+    accepted.contract.workId,
+    { expectedRevision: Number(delivered?.semanticRevision ?? 1), state: 'completed', resultRefs: [`receipt:${completionReceiptId}`] },
+  );
+  assert(getWorkContract({ controllerHome, repoId: repository.repoId }, accepted.contract.workId)?.semanticState === 'completed', 'explicit semantic Work completion was not persisted');
   assert(listExecutionJobs(controllerHome, repository.repoId, 20).length === 0, 'runtime recovery created an ExecutionJob');
 
   const scheduleInput = {

package/scripts/smoke-schedule-engine.ts

@@ -71,8 +71,8 @@ try {
     manualOccurrence?.status === 'skipped'
       && manualOccurrence.decision === 'operation_blocked'
       && manualOccurrence.decisionId
-      && manualOccurrence.handoffId,
-    'manual semantic Schedule did not create an external-controller handoff',
+      && !manualOccurrence.handoffId,
+    'manual semantic Schedule manufactured a human blocker instead of recording a trigger',
   );
   assert(
     getScheduleDecision(controllerHome, repository.repoId, manualOccurrence.decisionId)?.decision === 'operation_blocked',
@@ -105,7 +105,7 @@ try {
     { source: 'repository-event', eventName: 'git.push', eventId: 'evt-1' },
   );
   assert(eventA?.occurrenceId === eventB?.occurrenceId, 'repository event was not idempotent');
-  assert(eventA?.handoffId === eventB?.handoffId, 'repository event created duplicate handoffs');
+  assert(eventA?.decisionId === eventB?.decisionId, 'repository event created a duplicate occurrence decision');
 
   const missingDependency = createSchedule(controllerHome, {
     ...semanticBase,
@@ -132,8 +132,8 @@ try {
   assert(
     conditionOccurrence?.status === 'skipped'
       && conditionOccurrence.decision === 'operation_blocked'
-      && conditionOccurrence.handoffId,
-    'condition Schedule did not create an external-controller handoff',
+      && !conditionOccurrence.handoffId,
+    'condition Schedule manufactured a human blocker instead of recording a trigger',
   );
 
   const cron = createSchedule(controllerHome, {
@@ -143,7 +143,7 @@ try {
     trigger: { type: 'cron', cronExpression: '* * * * *' },
   });
   const cronOccurrence = await evaluateSchedule(controllerHome, cron);
-  assert(cronOccurrence?.decision === 'operation_blocked' && cronOccurrence.handoffId, 'cron Schedule did not hand off');
+  assert(cronOccurrence?.decision === 'operation_blocked' && !cronOccurrence.handoffId, 'cron Schedule did not record a bounded trigger');
 
   const calendar = createSchedule(controllerHome, {
     ...semanticBase,
@@ -153,8 +153,8 @@ try {
   });
   const calendarOccurrence = await evaluateSchedule(controllerHome, calendar);
   assert(
-    calendarOccurrence?.decision === 'operation_blocked' && calendarOccurrence.handoffId,
-    'calendar Schedule did not hand off',
+    calendarOccurrence?.decision === 'operation_blocked' && !calendarOccurrence.handoffId,
+    'calendar Schedule did not record a bounded trigger',
   );
 
   const staleJobPath = writeLocalJob('JOB-stale', {
@@ -231,9 +231,9 @@ try {
   assert(
     blockedOccurrence?.status === 'skipped'
       && blockedOccurrence.decision === 'maintenance_not_ready'
-      && blockedOccurrence.handoffId
+      && !blockedOccurrence.handoffId
       && !blockedOccurrence.jobId,
-    'unsafe maintenance candidate did not create a bounded handoff',
+    'retryable maintenance blocker was incorrectly promoted to a human handoff',
   );
   assert(readFileSync(brokenJobPath, 'utf8') === brokenBefore, 'blocked maintenance modified an unreadable candidate');
   const backedOff = getSchedule(controllerHome, repository.repoId, blockedMaintenance.scheduleId);
@@ -243,17 +243,25 @@ try {
   );
 
   const handoffs = listHandoffItems({ controllerHome, repoId: repository.repoId, status: 'all' });
-  assert(handoffs.length >= 6, 'expected external-controller and maintenance handoffs were not persisted');
+  // Semantic Schedule triggers are continuation input, not human blockers. Only
+  // a real authorization/judgement boundary may persist a Handoff projection.
+  assert(
+    !manualOccurrence.handoffId && !conditionOccurrence.handoffId && !cronOccurrence.handoffId && !calendarOccurrence.handoffId,
+    'semantic Schedule triggers manufactured human blockers',
+  );
+  assert(
+    !blockedOccurrence.handoffId && handoffs.length === 0,
+    'retryable mechanical maintenance failure manufactured a human blocker',
+  );
   assert(listExecutionJobs(controllerHome, repository.repoId, 100).length === 0, 'Schedule smoke created an ExecutionJob');
 
   console.log(JSON.stringify({
     status: 'ok',
-    manualHandoff: manualOccurrence.handoffId,
+    manualTriggerRecorded: manualOccurrence.decisionId,
     repositoryEventIdempotent: eventA?.occurrenceId === eventB?.occurrenceId,
     missingDependencySuppressed: true,
-    conditionHandoff: conditionOccurrence.handoffId,
-    cronHandoff: cronOccurrence.handoffId,
-    calendarHandoff: calendarOccurrence.handoffId,
+    semanticScheduleHandoffs: 0,
+    maintenanceMechanicalBlockerHasHandoff: Boolean(blockedOccurrence.handoffId),
     maintenance: maintenanceOccurrence.status,
     maintenanceBackoffUntil: backedOff.nextEligibleAt,
     handoffCount: handoffs.length,