@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/control-plane/global-scheduler/autonomous-continuation.ts

@@ -0,0 +1,248 @@
+import { createHash } from 'crypto';
+import type { RepositoryRecord } from '../../../cli/repositories/types';
+import {
+  controllerRoundBlockerClass,
+  controllerSessionBlocksRecovery,
+  getControllerRoundRelay,
+  listCurrentControllerRoundRelays,
+  getControllerSession,
+  getRetainedControllerSession,
+} from '../../../../packages/kernel/controller/api/index';
+import {
+  currentTaskSemanticProjectionForWork,
+  getWorkContract,
+  readActiveWorkCandidates,
+  semanticWorkState,
+  workSemanticView,
+} from '../../../../packages/kernel/work/api/index';
+import { workHasActiveExecution } from '../../execution/work-activity';
+import { readRequirement } from '../persistence/requirement-store';
+import { assertAutomatedOperationAllowed } from '../governance/external-effects';
+import {
+  controllerHostForScheduledBinding,
+  ensureScheduledControllerBindingForWork,
+} from '../../root/scheduled-controller-composition';
+import { ensureWorkflowSupervisorEnrollmentForWork } from '../../root/workflow-supervisor-composition';
+import { reconcileControllerProgression } from '../../root/controller-progression-composition';
+import { prepareControllerRoundOccurrence, resumeControllerRoundOccurrence } from '../../../../packages/kernel/controller/api/index';
+import { ensureControllerDispositionContinuation } from '../../workflow/schedules/work-continuation';
+import { deriveForgeActionableFailureCode, maybeRegisterForgeActionableFailureRepair } from '../../diagnostics/incident-repair';
+
+const DEFAULT_MAX_CONTINUATIONS = 2;
+
+export interface SchedulerAutonomousContinuationResult {
+  scanned: number;
+  eligible: number;
+  dispatched: number;
+  supervisorEnrolled: number;
+  failed: number;
+  skippedByReason: Record<string, number>;
+}
+
+export interface SchedulerAutonomousContinuationDependencies {
+  hasActiveExecution?: typeof workHasActiveExecution;
+  authorizeWake?: typeof assertAutomatedOperationAllowed;
+  ensureSupervisorEnrollment?: typeof ensureWorkflowSupervisorEnrollmentForWork;
+  hostForBinding?: typeof controllerHostForScheduledBinding;
+  ensureBinding?: typeof ensureScheduledControllerBindingForWork;
+  prepareOccurrence?: typeof prepareControllerRoundOccurrence;
+  resumeOccurrence?: typeof resumeControllerRoundOccurrence;
+}
+
+function skip(counts: Record<string, number>, reason: string): void {
+  counts[reason] = (counts[reason] ?? 0) + 1;
+}
+
+function planlessOccurrenceId(workId: string, semanticRevision: number): string {
+  const digest = createHash('sha256').update(workId + '\0semantic:' + semanticRevision).digest('hex').slice(0, 32);
+  return 'work-liveness:v2:' + digest;
+}
+
+function livenessMayReconcileExistingRound(record: ReturnType<typeof getControllerRoundRelay>): boolean {
+  if (!record) return true;
+  if (record.status === 'pending_release' || record.status === 'claimed') return true;
+  if (record.status === 'waiting') return true;
+  if (record.status === 'dispatching') return !record.providerDispatchStartedAt;
+  if (record.status === 'dispatched') return true;
+  return record.status === 'blocked' && controllerRoundBlockerClass(record) === 'provider_dispatch_outcome_unknown';
+}
+
+/**
+ * Single Scheduler liveness scanner. Scheduler selects only which open Work
+ * needs another mechanical opportunity; reconcileControllerProgression owns the
+ * stateless composition of existing authorities.
+ */
+export async function runSchedulerAutonomousContinuationReconciliation(input: {
+  controllerHome: string;
+  nowMs: number;
+  repositories: readonly Pick<RepositoryRecord, 'repoId' | 'canonicalRoot' | 'localRoot'>[];
+  maxContinuations?: number;
+  dependencies?: SchedulerAutonomousContinuationDependencies;
+}): Promise<SchedulerAutonomousContinuationResult> {
+  const maxContinuations = Math.max(1, Math.min(Math.trunc(input.maxContinuations ?? DEFAULT_MAX_CONTINUATIONS), 8));
+  const hasActiveExecution = input.dependencies?.hasActiveExecution ?? workHasActiveExecution;
+  const authorizeWake = input.dependencies?.authorizeWake ?? assertAutomatedOperationAllowed;
+
+  let scanned = 0;
+  let eligible = 0;
+  let dispatched = 0;
+  let supervisorEnrolled = 0;
+  let failed = 0;
+  let materialized = 0;
+  const skippedByReason: Record<string, number> = {};
+
+  for (const repository of input.repositories) {
+    if (materialized >= maxContinuations) break;
+    const store = { controllerHome: input.controllerHome, repoId: repository.repoId };
+    let works: ReturnType<typeof readActiveWorkCandidates>['contracts'];
+    try {
+      const active = readActiveWorkCandidates({ ...store, limit: 100 });
+      const candidates = new Map(active.contracts.map((work) => [work.workId, work]));
+      for (const invalid of active.invalid) {
+        skip(skippedByReason, 'invalid_work_contract');
+        console.error('[forge liveness] skipped invalid Work authority ' + repository.repoId + '/' + invalid.workId + ': ' + invalid.error);
+      }
+      // Semantic Work authority is Forge-scoped; the repository list is only
+      // an execution projection. Existing relay references must use the same
+      // canonical lookup as launcher admission, never infer deletion from a list.
+      for (const relay of listCurrentControllerRoundRelays(store, 100)) {
+        try {
+          const work = getWorkContract(store, relay.originWorkId);
+          if (work) candidates.set(work.workId, work);
+        } catch (error) {
+          skip(skippedByReason, 'invalid_relay_work_contract');
+          console.error('[forge liveness] skipped invalid relay Work authority ' + repository.repoId + '/' + relay.originWorkId + ':', error);
+        }
+      }
+      works = [...candidates.values()];
+    } catch (error) {
+      failed += 1;
+      console.error('[forge liveness] failed to read current Work authority for ' + repository.repoId + ':', error);
+      continue;
+    }
+
+    for (const work of works) {
+      if (materialized >= maxContinuations) break;
+      scanned += 1;
+      if (semanticWorkState(work) !== 'open') { skip(skippedByReason, 'semantic_work_terminal'); continue; }
+      if (hasActiveExecution(input.controllerHome, repository.repoId, work.workId)) { skip(skippedByReason, 'active_execution'); continue; }
+
+      const liveOwner = getControllerSession(store, work.workId);
+      if (liveOwner && controllerSessionBlocksRecovery(store, work.workId, { nowMs: input.nowMs })) {
+        skip(skippedByReason, 'active_controller_session');
+        continue;
+      }
+
+      const currentTask = currentTaskSemanticProjectionForWork(work);
+      const relayScopeId = currentTask.requirementId ? 'requirement:' + currentTask.requirementId : undefined;
+      const continuationHint = 'Resume exact Work ' + currentTask.workId + '; scheduler observed no active execution or live Controller owner and no unresolved semantic blocker.';
+
+      const requirementRecord = work.requirementId
+        ? readRequirement({ controllerHome: input.controllerHome }, work.requirementId)
+        : undefined;
+      if (work.requirementId && !requirementRecord) { skip(skippedByReason, 'requirement_missing'); continue; }
+      const requirementState = requirementRecord?.value.state;
+      if (requirementState === 'waiting_for_user') { skip(skippedByReason, 'requirement_waiting_for_user'); continue; }
+      if (requirementState === 'done' || requirementState === 'cancelled') { skip(skippedByReason, 'requirement:' + requirementState); continue; }
+
+      const existingRound = getControllerRoundRelay(store, work.workId);
+      if (!livenessMayReconcileExistingRound(existingRound)) {
+        skip(skippedByReason, `controller_round_${existingRound!.status}`);
+        continue;
+      }
+      const occurrenceId = existingRound?.occurrenceId
+        ?? planlessOccurrenceId(work.workId, workSemanticView(work).revision);
+
+      const retainedSession = getRetainedControllerSession(store, work.workId);
+      if (!retainedSession) { skip(skippedByReason, 'retained_controller_session_missing'); continue; }
+      if (retainedSession.controllerType === 'human') { skip(skippedByReason, 'human_controller'); continue; }
+
+      eligible += 1;
+      try {
+        authorizeWake('external_controller_wake', {
+          work_id: work.workId,
+          controller_type: retainedSession.controllerType,
+          relay_scope_id: relayScopeId,
+          recovery_reason: 'ownerless_work_ready_to_continue',
+        });
+
+        const progression = await reconcileControllerProgression(
+          {
+            controllerHome: input.controllerHome,
+            repoId: repository.repoId,
+            repoRoot: repository.canonicalRoot ?? repository.localRoot,
+          },
+          {
+            occurrenceId,
+            workId: work.workId,
+            relayScopeId,
+            continuationHint,
+            scheduleName: 'autonomous-work-liveness',
+          },
+          {
+            ...(input.dependencies?.ensureSupervisorEnrollment
+              ? { ensureSupervisorEnrollment: input.dependencies.ensureSupervisorEnrollment }
+              : {}),
+            ...(input.dependencies?.ensureBinding ? { ensureBinding: input.dependencies.ensureBinding } : {}),
+            ...(input.dependencies?.prepareOccurrence ? { prepareOccurrence: input.dependencies.prepareOccurrence } : {}),
+            ...(input.dependencies?.resumeOccurrence ? { resumeOccurrence: input.dependencies.resumeOccurrence } : {}),
+            ...(input.dependencies?.hostForBinding ? { hostForBinding: input.dependencies.hostForBinding } : {}),
+          },
+        );
+
+        if (progression.status === 'chatgpt_enrolled') {
+          supervisorEnrolled += 1;
+          materialized += 1;
+          continue;
+        }
+        if (progression.status === 'provider_dispatched') {
+          // The occurrence identity is the dedupe fence. A reused dispatched
+          // relay is already complete; reporting it as a fresh dispatch makes
+          // repeated scheduler scans look like new progress even though no
+          // provider call occurred.
+          if (progression.reused) {
+            skip(skippedByReason, 'controller_progression:already_dispatched');
+            continue;
+          }
+          dispatched += 1;
+          materialized += 1;
+          continue;
+        }
+        if (progression.status === 'wait_for_user') {
+          const settledRound = getControllerRoundRelay(store, work.workId);
+          if (settledRound?.status === 'waiting_for_user' && settledRound.handoffId) {
+            ensureControllerDispositionContinuation(input.controllerHome, repository.repoId, settledRound);
+          }
+        }
+        if (progression.status === 'chatgpt_not_enrolled') {
+          skip(skippedByReason, 'workflow_supervisor:' + progression.supervisorEnrollment.status);
+        } else {
+          skip(skippedByReason, 'controller_progression:' + progression.status);
+        }
+      } catch (error) {
+        failed += 1;
+        const reason = error instanceof Error ? error.message : String(error);
+        if (retainedSession.controllerType !== 'chatgpt') {
+          try {
+            maybeRegisterForgeActionableFailureRepair({
+              controllerHome: input.controllerHome,
+              now: () => input.nowMs,
+              observation: {
+                observationId: `progression:liveness:${repository.repoId}:${work.workId}:${input.nowMs}`,
+                source: 'progression',
+                code: deriveForgeActionableFailureCode('SCHEDULER_AUTONOMOUS_CONTINUATION_FAILED', reason),
+                message: reason,
+                at: new Date(input.nowMs).toISOString(),
+                repoId: repository.repoId,
+                workId: work.workId,
+              },
+            });
+          } catch {}
+        }
+        console.error('[forge liveness] autonomous continuation failed for ' + repository.repoId + '/' + work.workId + ':', reason);
+      }
+    }
+  }
+
+  return { scanned, eligible, dispatched, supervisorEnrolled, failed, skippedByReason };
+}

package/src/runtime/control-plane/global-scheduler/durable-admission.ts

@@ -5,7 +5,7 @@ import {
 import { tickSchedules } from '../../workflow/schedules/engine';
 import type { ExecutionJob } from '../../execution/jobs/types';
 
-const SCHEDULE_TICK_INTERVAL_MS = 30_000;
+export const SCHEDULE_TICK_INTERVAL_MS = 30_000;
 
 export function schedulerDurableAdmissionRequiresPolicy(input: {
   activeJobs: readonly ExecutionJob[];

package/src/runtime/control-plane/global-scheduler/maintenance.ts

@@ -1,6 +1,6 @@
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { cleanupRuntimeComputerInteractionTargets } from '../../root/computer-target-composition';
-import { cleanupControllerHomeBrowserArtifacts, cleanupGeneratedRepositoryCaches, cleanupIdleXCTestDevices } from '../generated-cache-retention';
+import { cleanupControllerHomeBrowserArtifacts, cleanupGeneratedRepositoryCheckoutCaches, cleanupIdleXCTestDevices } from '../generated-cache-retention';
 import {
   cleanupRuntimeBrowserSessionTombstones,
   closeRuntimeBrowserSessionLegacyImportCutover,
@@ -8,18 +8,100 @@ import {
 import type { cleanupControllerRuntimeState } from '../runtime-cleanup';
 import type { reconcileTerminalWorkCleanups } from '../execution/work-terminal-cleanup';
 import type { gcTerminalProcesses } from '../../execution/process-runtime/gc';
+import { assertRuntimeMayWrite } from '../../root/write-fence';
 import { cleanupPersistedCheckResults } from '../../execution/process-runtime/check-result-retention';
 import { cleanupRetiredExecutionJobs } from '../../execution/jobs/store';
 import type { reconcilePendingWorkValidations } from '../execution/work-validation-reconciler';
 import type { reconcilePendingEditValidations } from '../execution/edit-validation-coordinator';
 import {
-  claimStalledControllerRoundRelays,
-  finishControllerRoundRelayDispatch,
+  controllerRoundBlockerClass,
+  listCurrentControllerRoundRelays,
 } from '../../../../packages/kernel/controller/api/index';
-import { assertAutomatedOperationAllowed } from '../governance/external-effects';
-import { runWorkChatgptContinuation } from '../launcher/chatgpt-work-continuation';
+import { settleWorkChatgptAutomationTab } from '../launcher/chatgpt-work-continuation';
 import { getChatgptWorkConversationBinding } from '../../../../adapters/chatgpt/work-conversation-binding-store';
-import { renderChatgptControllerRoundPrompt } from '../../root/controller-round-composition';
+import {
+  chatgptControllerRoundSettlementAttemptIdentity,
+  getChatgptControllerRoundSettlement,
+} from '../../../../adapters/chatgpt/controller-round-settlement-store';
+import { recordChatgptControllerRoundTabSettlement } from '../../root/controller-round-composition';
+import { deriveForgeActionableFailureCode, maybeRegisterFailedReleaseSessionRepairs, maybeRegisterForgeActionableFailureRepair } from '../../diagnostics/incident-repair';
+
+const PERIODIC_RETENTION_INTERVAL_MS = 5 * 60_000;
+const PERIODIC_DEEP_RETENTION_INTERVAL_MS = 15 * 60_000;
+// A provider-ambiguous ControllerRound remains durable and claimable, but its
+// Forge-owned Chrome tab is not durable authority. Give an in-flight ChatGPT
+// turn a bounded claim window, then release the ephemeral resource without
+// replaying or clearing the semantic outcome-unknown fence.
+const CHATGPT_OUTCOME_UNKNOWN_TAB_SETTLEMENT_GRACE_MS = 5 * 60_000;
+// Retention is a fallback GC path, not the primary ControllerRound settlement path.
+// Keep its external-effect volume deliberately small so one stale repository set
+// cannot create a provider burst or hold a maintenance worker for hours.
+const CHATGPT_TAB_SETTLEMENT_EFFECT_BUDGET_PER_PASS = 4;
+
+function runtimeMaintenanceAuthorityCurrent(controllerHome: string): boolean {
+  const fence = assertRuntimeMayWrite('cleanup', controllerHome);
+  if (fence.allowed) return true;
+  console.error(`[forge cleanup] stale periodic cleanup worker fenced: ${fence.reason ?? 'denied'}`);
+  return false;
+}
+
+function registerSchedulerFailure(input: {
+  controllerHome: string;
+  source: 'progression' | 'maintenance';
+  prefix: string;
+  message: string;
+  observationId: string;
+  repoId?: string;
+  workId?: string;
+  atMs?: number;
+}): void {
+  try {
+    maybeRegisterForgeActionableFailureRepair({
+      controllerHome: input.controllerHome,
+      observation: {
+        observationId: input.observationId,
+        source: input.source,
+        code: deriveForgeActionableFailureCode(input.prefix, input.message),
+        message: input.message,
+        at: new Date(input.atMs ?? Date.now()).toISOString(),
+        repoId: input.repoId,
+        workId: input.workId,
+      },
+    });
+  } catch {
+    // Repair promotion is evidence-side reconciliation, not the owning maintenance result.
+  }
+}
+
+export function planSchedulerPeriodicMaintenance(input: {
+  nowMs: number;
+  cleanupIntervalMs: number;
+  repositoryCount: number;
+}): {
+  periodicSequence: number;
+  deepRetentionSequence: number;
+  runRetention: boolean;
+  runDeepRetention: boolean;
+  processGcRepositoryIndex?: number;
+  deepRetentionRepositoryIndex?: number;
+} {
+  const cleanupIntervalMs = Math.max(1, input.cleanupIntervalMs);
+  const periodicSequence = Math.floor(input.nowMs / cleanupIntervalMs);
+  const retentionEvery = Math.max(1, Math.ceil(PERIODIC_RETENTION_INTERVAL_MS / cleanupIntervalMs));
+  const deepRetentionEvery = Math.max(retentionEvery, Math.ceil(PERIODIC_DEEP_RETENTION_INTERVAL_MS / cleanupIntervalMs));
+  const repositoryCount = Math.max(0, Math.trunc(input.repositoryCount));
+  const deepRetentionSequence = Math.floor(periodicSequence / deepRetentionEvery);
+  return {
+    periodicSequence,
+    deepRetentionSequence,
+    runRetention: periodicSequence % retentionEvery === 0,
+    runDeepRetention: periodicSequence % deepRetentionEvery === 0,
+    processGcRepositoryIndex: repositoryCount > 0 ? periodicSequence % repositoryCount : undefined,
+    deepRetentionRepositoryIndex: repositoryCount > 0 && periodicSequence % deepRetentionEvery === 0
+      ? deepRetentionSequence % repositoryCount
+      : undefined,
+  };
+}
 
 export async function runSchedulerPeriodicCleanup(input: {
   controllerHome: string;
@@ -30,53 +112,181 @@ export async function runSchedulerPeriodicCleanup(input: {
   runtimeCleanup: typeof cleanupControllerRuntimeState;
   terminalWorkCleanup: typeof reconcileTerminalWorkCleanups;
   processGc: typeof gcTerminalProcesses;
+  settleBrowserTab?: typeof settleWorkChatgptAutomationTab;
 }): Promise<void> {
+  const plan = planSchedulerPeriodicMaintenance({
+    nowMs: input.nowMs,
+    cleanupIntervalMs: input.cleanupIntervalMs,
+    repositoryCount: input.repositories.length,
+  });
+  // The cleanup process inherits the spawning Runtime's exact write claim. Re-check
+  // that claim throughout a long pass so a detached child cannot survive a Runtime
+  // rollover and continue producing effects under retired authority.
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+  // Runtime-state phase rotation and terminal Work cleanup are lifecycle
+  // reconciliation, not retention. Keep them at the base cleanup cadence.
   try {
     input.runtimeCleanup(input.controllerHome, {
       reason: 'periodic',
       nowMs: input.nowMs,
-      periodicSequence: Math.floor(input.nowMs / input.cleanupIntervalMs),
+      periodicSequence: plan.periodicSequence,
       protectedControllerPid: input.controllerPid,
     });
   } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    registerSchedulerFailure({
+      controllerHome: input.controllerHome,
+      source: 'maintenance',
+      prefix: 'RUNTIME_CLEANUP_FAILED',
+      message: reason,
+      observationId: `maintenance:runtime-cleanup:${plan.periodicSequence}`,
+      atMs: input.nowMs,
+    });
     console.error('[forge cleanup] periodic cleanup failed:', error);
   }
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
   try {
     await input.terminalWorkCleanup(input.controllerHome, { nowMs: input.nowMs });
   } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    registerSchedulerFailure({
+      controllerHome: input.controllerHome,
+      source: 'maintenance',
+      prefix: 'TERMINAL_WORK_CLEANUP_FAILED',
+      message: reason,
+      observationId: `maintenance:terminal-work-cleanup:${plan.periodicSequence}`,
+      atMs: input.nowMs,
+    });
     console.error('[forge cleanup] terminal Work cleanup failed:', error);
   }
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+
   try {
-    const xctestCleanup = cleanupIdleXCTestDevices(input.controllerHome);
-    if (xctestCleanup.error) console.error('[forge cleanup] XCTest device cleanup failed:', xctestCleanup.error);
+    maybeRegisterFailedReleaseSessionRepairs({ controllerHome: input.controllerHome, now: () => input.nowMs });
   } catch (error) {
-    console.error('[forge cleanup] XCTest device cleanup failed:', error);
+    console.error('[forge cleanup] release failure repair reconciliation failed:', error);
   }
-  try {
-    closeRuntimeBrowserSessionLegacyImportCutover(
-      input.controllerHome,
-      input.repositories.map((repository) => ({ repoId: repository.repoId, repoRoot: repository.canonicalRoot })),
-    );
-    const browserSessions = cleanupRuntimeBrowserSessionTombstones(input.controllerHome, { nowMs: input.nowMs });
-    if (browserSessions.blockers.length > 0 || browserSessions.budgetExhausted) {
-      console.error('[forge cleanup] Browser session retention reported bounded blockers');
+
+  // Browser/computer tombstones are retention state. Their lifecycle truth is
+  // written synchronously by their owning authorities, so a five-minute sweep
+  // is sufficient and avoids repeating controller-wide scans every minute.
+  if (plan.runRetention) {
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    try {
+      closeRuntimeBrowserSessionLegacyImportCutover(
+        input.controllerHome,
+        input.repositories.map((repository) => ({ repoId: repository.repoId, repoRoot: repository.canonicalRoot })),
+      );
+      const browserSessions = cleanupRuntimeBrowserSessionTombstones(input.controllerHome, { nowMs: input.nowMs });
+      if (browserSessions.blockers.length > 0 || browserSessions.budgetExhausted) {
+        console.error('[forge cleanup] Browser session retention reported bounded blockers');
+      }
+    } catch (error) {
+      console.error('[forge cleanup] Browser session retention failed:', error);
+    }
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    try {
+      const computerTargets = await cleanupRuntimeComputerInteractionTargets(input.controllerHome, { nowMs: input.nowMs });
+      if (computerTargets.blockers.length > 0 || computerTargets.overCapacity || computerTargets.budgetExhausted) {
+        console.error('[forge cleanup] Computer interaction-target retention reported bounded blockers');
+      }
+    } catch (error) {
+      console.error('[forge cleanup] Computer interaction-target retention failed:', error);
+    }
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    let chatgptTabSettlementEffects = 0;
+    chatgptTabSettlementSweep:
+    for (const repository of input.repositories) {
+      const store = { controllerHome: input.controllerHome, repoId: repository.repoId };
+      for (const relay of listCurrentControllerRoundRelays(store, 100)) {
+        const blocker = controllerRoundBlockerClass(relay);
+        const outcomeUnknown = blocker === 'provider_dispatch_outcome_unknown';
+        const durableInactiveRound = ['waiting', 'waiting_for_user', 'goal_complete', 'failed'].includes(relay.status)
+          || (relay.status === 'blocked' && !outcomeUnknown);
+        if (!durableInactiveRound && !outcomeUnknown) continue;
+        if (outcomeUnknown) {
+          const blockedAtMs = Date.parse(relay.updatedAt);
+          if (!Number.isFinite(blockedAtMs) || input.nowMs - blockedAtMs < CHATGPT_OUTCOME_UNKNOWN_TAB_SETTLEMENT_GRACE_MS) continue;
+        }
+        const existingSettlement = getChatgptControllerRoundSettlement(store, {
+          workId: relay.originWorkId,
+          relayScopeId: relay.relayScopeId,
+        });
+        if (existingSettlement && ['closed', 'preserved_user_owned', 'session_closed'].includes(existingSettlement.status)) continue;
+        const binding = getChatgptWorkConversationBinding(store, relay.originWorkId);
+        if (!binding?.latestBrowserSessionId) continue;
+        const attemptIdentity = chatgptControllerRoundSettlementAttemptIdentity({
+          browserSessionId: binding.latestBrowserSessionId,
+          authorizationGrantRefs: binding.authorizationGrantRefs,
+        });
+        // Failed close_page calls are commonly authorization failures. Retrying
+        // the same browser/grant tuple on every retention pass only creates
+        // provider traffic and audit churn; a changed resource or grant set is a
+        // distinct attempt and remains eligible for recovery.
+        if (existingSettlement?.status === 'failed' && existingSettlement.attemptIdentity === attemptIdentity) continue;
+        if (chatgptTabSettlementEffects >= CHATGPT_TAB_SETTLEMENT_EFFECT_BUDGET_PER_PASS) {
+          console.error('[forge cleanup] ChatGPT tab settlement reached bounded effect budget');
+          break chatgptTabSettlementSweep;
+        }
+        if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+        chatgptTabSettlementEffects += 1;
+        const settlement = await (input.settleBrowserTab ?? settleWorkChatgptAutomationTab)({
+          controllerHome: input.controllerHome,
+          workId: relay.originWorkId,
+          browserSessionId: binding.latestBrowserSessionId,
+          authorizationGrantRefs: binding.authorizationGrantRefs,
+        });
+        if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+        recordChatgptControllerRoundTabSettlement(store, {
+          workId: relay.originWorkId,
+          relayScopeId: relay.relayScopeId,
+          status: settlement.status,
+          error: settlement.error?.message,
+          attemptIdentity,
+        });
+      }
     }
-  } catch (error) {
-    console.error('[forge cleanup] Browser session retention failed:', error);
   }
-  try {
-    const computerTargets = await cleanupRuntimeComputerInteractionTargets(input.controllerHome, { nowMs: input.nowMs });
-    if (computerTargets.blockers.length > 0 || computerTargets.overCapacity || computerTargets.budgetExhausted) {
-      console.error('[forge cleanup] Computer interaction-target retention reported bounded blockers');
+
+  // Process GC includes stale-active reconciliation with a five-minute minimum
+  // age. Preserve the existing one-repository-per-base-pass round robin so that
+  // recovery remains smooth instead of concentrating all repositories in one
+  // periodic spike.
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+  if (plan.processGcRepositoryIndex !== undefined) {
+    const processRepo = input.repositories[plan.processGcRepositoryIndex]!;
+    const result = input.processGc({ controllerHome: input.controllerHome, repoId: processRepo.repoId });
+    if (!result.ok) {
+      const reason = result.error ?? 'unknown error';
+      registerSchedulerFailure({
+        controllerHome: input.controllerHome,
+        source: 'maintenance',
+        prefix: 'PROCESS_GC_FAILED',
+        message: reason,
+        observationId: `maintenance:process-gc:${processRepo.repoId}:${plan.periodicSequence}`,
+        repoId: processRepo.repoId,
+        atMs: input.nowMs,
+      });
+      console.error('[forge cleanup] Process GC failed:', reason);
     }
+  }
+
+  if (!plan.runDeepRetention) return;
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+
+  // Generated caches and persisted artifacts have hour/day-scale retention
+  // thresholds. Run one repository per deep-retention pass, and rotate the
+  // repository index on the deep cadence rather than the one-minute sequence.
+  try {
+    const xctestCleanup = cleanupIdleXCTestDevices(input.controllerHome);
+    if (xctestCleanup.error) console.error('[forge cleanup] XCTest device cleanup failed:', xctestCleanup.error);
   } catch (error) {
-    console.error('[forge cleanup] Computer interaction-target retention failed:', error);
+    console.error('[forge cleanup] XCTest device cleanup failed:', error);
   }
-  if (input.repositories.length === 0) return;
-  const slot = Math.floor(input.nowMs / input.cleanupIntervalMs) % input.repositories.length;
-  const repo = input.repositories[slot]!;
+  if (plan.deepRetentionRepositoryIndex === undefined) return;
+  const repo = input.repositories[plan.deepRetentionRepositoryIndex]!;
   try {
-    const generated = cleanupGeneratedRepositoryCaches(repo.canonicalRoot, { nowMs: input.nowMs });
+    const generated = cleanupGeneratedRepositoryCheckoutCaches(repo, { nowMs: input.nowMs, rootStartIndex: plan.deepRetentionSequence });
     if (generated.errors.length > 0) {
       console.error(`[forge cleanup] generated-cache retention reported ${generated.errors.length} error(s) for ${repo.repoId}`);
     }
@@ -91,8 +301,6 @@ export async function runSchedulerPeriodicCleanup(input: {
   } catch (error) {
     console.error(`[forge cleanup] Browser artifact retention failed for ${repo.repoId}:`, error);
   }
-  const result = input.processGc({ controllerHome: input.controllerHome, repoId: repo.repoId });
-  if (!result.ok) console.error('[forge cleanup] Process GC failed:', result.error ?? 'unknown error');
   try {
     const checkResults = cleanupPersistedCheckResults(input.controllerHome, repo.repoId, { nowMs: input.nowMs });
     if (checkResults.blockers.length > 0 || checkResults.budgetExhausted) {
@@ -132,84 +340,3 @@ export async function runSchedulerValidationReconciliation(input: {
     }
   }
 }
-
-export async function runSchedulerControllerRoundRecovery(input: {
-  controllerHome: string;
-  nowMs: number;
-  repositories: readonly Pick<RepositoryRecord, 'repoId' | 'canonicalRoot' | 'localRoot'>[];
-  graceMs?: number;
-  maxRecoveries?: number;
-  dispatchPrompt?: typeof runWorkChatgptContinuation;
-  authorizeWake?: typeof assertAutomatedOperationAllowed;
-}): Promise<{ claimed: number; dispatched: number; failed: number }> {
-  const dispatchPrompt = input.dispatchPrompt ?? runWorkChatgptContinuation;
-  const authorizeWake = input.authorizeWake ?? assertAutomatedOperationAllowed;
-  const maxRecoveries = Math.max(1, Math.min(Math.trunc(input.maxRecoveries ?? 2), 8));
-  let claimed = 0;
-  let dispatched = 0;
-  let failed = 0;
-
-  for (const repository of input.repositories) {
-    if (claimed >= maxRecoveries) break;
-    const store = { controllerHome: input.controllerHome, repoId: repository.repoId };
-    let records: ReturnType<typeof claimStalledControllerRoundRelays>;
-    try {
-      records = claimStalledControllerRoundRelays(store, {
-        nowMs: input.nowMs,
-        graceMs: input.graceMs,
-        limit: maxRecoveries - claimed,
-        controllerTypes: ['chatgpt'],
-      });
-    } catch (error) {
-      const reason = error instanceof Error ? error.message : String(error);
-      failed += 1;
-      console.error(`[forge controller relay] stalled round scan failed for ${repository.repoId}:`, reason);
-      continue;
-    }
-    claimed += records.length;
-    for (const record of records) {
-      try {
-        authorizeWake('external_controller_wake', {
-          work_id: record.originWorkId,
-          controller_type: 'chatgpt',
-          relay_scope_id: record.relayScopeId,
-          recovery_reason: 'unclosed_dispatched_round',
-        });
-        const binding = getChatgptWorkConversationBinding(store, record.originWorkId);
-        const result = await dispatchPrompt({
-          controllerHome: input.controllerHome,
-          repoId: repository.repoId,
-          repoRoot: repository.canonicalRoot ?? repository.localRoot,
-          workId: record.originWorkId,
-          prompt: renderChatgptControllerRoundPrompt(store, record, { exactOriginWork: !record.requirementId }),
-          browserSessionId: binding?.latestBrowserSessionId,
-          conversationUrl: binding?.conversationUrl,
-          model: 'gpt-5.6',
-          reasoning: 'high',
-          tabPolicy: 'auto',
-          timeoutMs: 30_000,
-        });
-        if (result.status === 'failed') throw new Error(result.error?.message ?? 'CHATGPT_CONTROLLER_RELAY_RECOVERY_FAILED');
-        const updatedBinding = getChatgptWorkConversationBinding(store, record.originWorkId);
-        finishControllerRoundRelayDispatch(store, {
-          workId: record.originWorkId,
-          ok: true,
-          bindingId: updatedBinding?.bindingId,
-        });
-        dispatched += 1;
-      } catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
-        finishControllerRoundRelayDispatch(store, {
-          workId: record.originWorkId,
-          ok: false,
-          error: reason,
-          recovery: true,
-          nowMs: input.nowMs,
-        });
-        failed += 1;
-        console.error(`[forge controller relay] stalled round recovery failed for ${record.relayScopeId}:`, reason);
-      }
-    }
-  }
-  return { claimed, dispatched, failed };
-}