@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/control-plane/global-scheduler/maintenance.ts

@@ -1,6 +1,6 @@
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { cleanupRuntimeComputerInteractionTargets } from '../../root/computer-target-composition';
-import { cleanupControllerHomeBrowserArtifacts, cleanupGeneratedRepositoryCaches, cleanupIdleXCTestDevices } from '../generated-cache-retention';
+import { cleanupControllerHomeBrowserArtifacts, cleanupGeneratedRepositoryCheckoutCaches, cleanupIdleXCTestDevices } from '../generated-cache-retention';
 import {
   cleanupRuntimeBrowserSessionTombstones,
   closeRuntimeBrowserSessionLegacyImportCutover,
@@ -8,18 +8,105 @@ import {
 import type { cleanupControllerRuntimeState } from '../runtime-cleanup';
 import type { reconcileTerminalWorkCleanups } from '../execution/work-terminal-cleanup';
 import type { gcTerminalProcesses } from '../../execution/process-runtime/gc';
+import { assertRuntimeMayWrite } from '../../root/write-fence';
 import { cleanupPersistedCheckResults } from '../../execution/process-runtime/check-result-retention';
 import { cleanupRetiredExecutionJobs } from '../../execution/jobs/store';
 import type { reconcilePendingWorkValidations } from '../execution/work-validation-reconciler';
 import type { reconcilePendingEditValidations } from '../execution/edit-validation-coordinator';
 import {
-  claimStalledControllerRoundRelays,
-  finishControllerRoundRelayDispatch,
+  controllerRoundBlockerClass,
+  listCurrentControllerRoundRelays,
 } from '../../../../packages/kernel/controller/api/index';
-import { assertAutomatedOperationAllowed } from '../governance/external-effects';
-import { runWorkChatgptContinuation } from '../launcher/chatgpt-work-continuation';
+import { settleWorkChatgptAutomationTab } from '../launcher/chatgpt-work-continuation';
 import { getChatgptWorkConversationBinding } from '../../../../adapters/chatgpt/work-conversation-binding-store';
-import { renderChatgptControllerRoundPrompt } from '../../root/controller-round-composition';
+import {
+  chatgptControllerRoundSettlementAttemptIdentity,
+  getChatgptControllerRoundSettlement,
+} from '../../../../adapters/chatgpt/controller-round-settlement-store';
+import { recordChatgptControllerRoundTabSettlement } from '../../root/controller-round-composition';
+import { deriveForgeActionableFailureCode, maybeRegisterFailedReleaseSessionRepairs, maybeRegisterForgeActionableFailureRepair } from '../../diagnostics/incident-repair';
+
+const PERIODIC_RETENTION_INTERVAL_MS = 5 * 60_000;
+const PERIODIC_DEEP_RETENTION_INTERVAL_MS = 15 * 60_000;
+// A provider-ambiguous ControllerRound remains durable and claimable, but its
+// Forge-owned Chrome tab is not durable authority. Give an in-flight ChatGPT
+// turn a bounded claim window, then release the ephemeral resource without
+// replaying or clearing the semantic outcome-unknown fence.
+const CHATGPT_OUTCOME_UNKNOWN_TAB_SETTLEMENT_GRACE_MS = 5 * 60_000;
+// Retention is a fallback GC path, not the primary ControllerRound settlement path.
+// Keep its external-effect volume deliberately small so one stale repository set
+// cannot create a provider burst or hold a maintenance worker for hours.
+const CHATGPT_TAB_SETTLEMENT_EFFECT_BUDGET_PER_PASS = 4;
+
+function runtimeMaintenanceAuthorityCurrent(controllerHome: string): boolean {
+  const fence = assertRuntimeMayWrite('cleanup', controllerHome);
+  if (fence.allowed) return true;
+  console.error(`[forge cleanup] stale periodic cleanup worker fenced: ${fence.reason ?? 'denied'}`);
+  return false;
+}
+
+function registerSchedulerFailure(input: {
+  controllerHome: string;
+  source: 'progression' | 'maintenance';
+  prefix: string;
+  message: string;
+  observationId: string;
+  repoId?: string;
+  workId?: string;
+  atMs?: number;
+}): void {
+  try {
+    maybeRegisterForgeActionableFailureRepair({
+      controllerHome: input.controllerHome,
+      observation: {
+        observationId: input.observationId,
+        source: input.source,
+        code: deriveForgeActionableFailureCode(input.prefix, input.message),
+        message: input.message,
+        at: new Date(input.atMs ?? Date.now()).toISOString(),
+        repoId: input.repoId,
+        workId: input.workId,
+      },
+    });
+  } catch {
+    // Repair promotion is evidence-side reconciliation, not the owning maintenance result.
+  }
+}
+
+export function planSchedulerPeriodicMaintenance(input: {
+  nowMs: number;
+  cleanupIntervalMs: number;
+  repositoryCount: number;
+}): {
+  periodicSequence: number;
+  deepRetentionSequence: number;
+  generatedCacheRepositoryIndex?: number;
+  generatedCacheRootStartIndex: number;
+  runRetention: boolean;
+  runDeepRetention: boolean;
+  processGcRepositoryIndex?: number;
+  deepRetentionRepositoryIndex?: number;
+} {
+  const cleanupIntervalMs = Math.max(1, input.cleanupIntervalMs);
+  const periodicSequence = Math.floor(input.nowMs / cleanupIntervalMs);
+  const retentionEvery = Math.max(1, Math.ceil(PERIODIC_RETENTION_INTERVAL_MS / cleanupIntervalMs));
+  const deepRetentionEvery = Math.max(retentionEvery, Math.ceil(PERIODIC_DEEP_RETENTION_INTERVAL_MS / cleanupIntervalMs));
+  const repositoryCount = Math.max(0, Math.trunc(input.repositoryCount));
+  const deepRetentionSequence = Math.floor(periodicSequence / deepRetentionEvery);
+  return {
+    periodicSequence,
+    deepRetentionSequence,
+    generatedCacheRepositoryIndex: repositoryCount > 0 && periodicSequence % retentionEvery === 0
+      ? Math.floor(periodicSequence / retentionEvery) % repositoryCount : undefined,
+    generatedCacheRootStartIndex: repositoryCount > 0 ? Math.floor(periodicSequence / retentionEvery / repositoryCount) : 0,
+    runRetention: periodicSequence % retentionEvery === 0,
+    runDeepRetention: periodicSequence % deepRetentionEvery === 0,
+    processGcRepositoryIndex: repositoryCount > 0 ? periodicSequence % repositoryCount : undefined,
+    deepRetentionRepositoryIndex: repositoryCount > 0 && periodicSequence % deepRetentionEvery === 0
+      ? deepRetentionSequence % repositoryCount
+      : undefined,
+  };
+}
 
 export async function runSchedulerPeriodicCleanup(input: {
   controllerHome: string;
@@ -30,59 +117,194 @@ export async function runSchedulerPeriodicCleanup(input: {
   runtimeCleanup: typeof cleanupControllerRuntimeState;
   terminalWorkCleanup: typeof reconcileTerminalWorkCleanups;
   processGc: typeof gcTerminalProcesses;
+  settleBrowserTab?: typeof settleWorkChatgptAutomationTab;
 }): Promise<void> {
+  const plan = planSchedulerPeriodicMaintenance({
+    nowMs: input.nowMs,
+    cleanupIntervalMs: input.cleanupIntervalMs,
+    repositoryCount: input.repositories.length,
+  });
+  // The cleanup process inherits the spawning Runtime's exact write claim. Re-check
+  // that claim throughout a long pass so a detached child cannot survive a Runtime
+  // rollover and continue producing effects under retired authority.
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+  // Runtime-state phase rotation and terminal Work cleanup are lifecycle
+  // reconciliation, not retention. Keep them at the base cleanup cadence.
   try {
     input.runtimeCleanup(input.controllerHome, {
       reason: 'periodic',
       nowMs: input.nowMs,
-      periodicSequence: Math.floor(input.nowMs / input.cleanupIntervalMs),
+      periodicSequence: plan.periodicSequence,
       protectedControllerPid: input.controllerPid,
     });
   } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    registerSchedulerFailure({
+      controllerHome: input.controllerHome,
+      source: 'maintenance',
+      prefix: 'RUNTIME_CLEANUP_FAILED',
+      message: reason,
+      observationId: `maintenance:runtime-cleanup:${plan.periodicSequence}`,
+      atMs: input.nowMs,
+    });
     console.error('[forge cleanup] periodic cleanup failed:', error);
   }
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
   try {
     await input.terminalWorkCleanup(input.controllerHome, { nowMs: input.nowMs });
   } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    registerSchedulerFailure({
+      controllerHome: input.controllerHome,
+      source: 'maintenance',
+      prefix: 'TERMINAL_WORK_CLEANUP_FAILED',
+      message: reason,
+      observationId: `maintenance:terminal-work-cleanup:${plan.periodicSequence}`,
+      atMs: input.nowMs,
+    });
     console.error('[forge cleanup] terminal Work cleanup failed:', error);
   }
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+
   try {
-    const xctestCleanup = cleanupIdleXCTestDevices(input.controllerHome);
-    if (xctestCleanup.error) console.error('[forge cleanup] XCTest device cleanup failed:', xctestCleanup.error);
+    maybeRegisterFailedReleaseSessionRepairs({ controllerHome: input.controllerHome, now: () => input.nowMs });
   } catch (error) {
-    console.error('[forge cleanup] XCTest device cleanup failed:', error);
+    console.error('[forge cleanup] release failure repair reconciliation failed:', error);
   }
-  try {
-    closeRuntimeBrowserSessionLegacyImportCutover(
-      input.controllerHome,
-      input.repositories.map((repository) => ({ repoId: repository.repoId, repoRoot: repository.canonicalRoot })),
-    );
-    const browserSessions = cleanupRuntimeBrowserSessionTombstones(input.controllerHome, { nowMs: input.nowMs });
-    if (browserSessions.blockers.length > 0 || browserSessions.budgetExhausted) {
-      console.error('[forge cleanup] Browser session retention reported bounded blockers');
+
+  // Browser/computer tombstones are retention state. Their lifecycle truth is
+  // written synchronously by their owning authorities, so a five-minute sweep
+  // is sufficient and avoids repeating controller-wide scans every minute.
+  if (plan.runRetention) {
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    try {
+      closeRuntimeBrowserSessionLegacyImportCutover(
+        input.controllerHome,
+        input.repositories.map((repository) => ({ repoId: repository.repoId, repoRoot: repository.canonicalRoot })),
+      );
+      const browserSessions = cleanupRuntimeBrowserSessionTombstones(input.controllerHome, { nowMs: input.nowMs });
+      if (browserSessions.blockers.length > 0 || browserSessions.budgetExhausted) {
+        console.error('[forge cleanup] Browser session retention reported bounded blockers');
+      }
+    } catch (error) {
+      console.error('[forge cleanup] Browser session retention failed:', error);
+    }
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    try {
+      const computerTargets = await cleanupRuntimeComputerInteractionTargets(input.controllerHome, { nowMs: input.nowMs });
+      if (computerTargets.blockers.length > 0 || computerTargets.overCapacity || computerTargets.budgetExhausted) {
+        console.error('[forge cleanup] Computer interaction-target retention reported bounded blockers');
+      }
+    } catch (error) {
+      console.error('[forge cleanup] Computer interaction-target retention failed:', error);
+    }
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    let chatgptTabSettlementEffects = 0;
+    chatgptTabSettlementSweep:
+    for (const repository of input.repositories) {
+      const store = { controllerHome: input.controllerHome, repoId: repository.repoId };
+      for (const relay of listCurrentControllerRoundRelays(store, 100)) {
+        const blocker = controllerRoundBlockerClass(relay);
+        const outcomeUnknown = blocker === 'provider_dispatch_outcome_unknown';
+        const durableInactiveRound = ['waiting', 'waiting_for_user', 'goal_complete', 'failed'].includes(relay.status)
+          || (relay.status === 'blocked' && !outcomeUnknown);
+        if (!durableInactiveRound && !outcomeUnknown) continue;
+        if (outcomeUnknown) {
+          const blockedAtMs = Date.parse(relay.updatedAt);
+          if (!Number.isFinite(blockedAtMs) || input.nowMs - blockedAtMs < CHATGPT_OUTCOME_UNKNOWN_TAB_SETTLEMENT_GRACE_MS) continue;
+        }
+        const existingSettlement = getChatgptControllerRoundSettlement(store, {
+          workId: relay.originWorkId,
+          relayScopeId: relay.relayScopeId,
+        });
+        if (existingSettlement && ['closed', 'preserved_user_owned', 'session_closed'].includes(existingSettlement.status)) continue;
+        const binding = getChatgptWorkConversationBinding(store, relay.originWorkId);
+        if (!binding?.latestBrowserSessionId) continue;
+        const attemptIdentity = chatgptControllerRoundSettlementAttemptIdentity({
+          browserSessionId: binding.latestBrowserSessionId,
+          authorizationGrantRefs: binding.authorizationGrantRefs,
+        });
+        // Failed close_page calls are commonly authorization failures. Retrying
+        // the same browser/grant tuple on every retention pass only creates
+        // provider traffic and audit churn; a changed resource or grant set is a
+        // distinct attempt and remains eligible for recovery.
+        if (existingSettlement?.status === 'failed' && existingSettlement.attemptIdentity === attemptIdentity) continue;
+        if (chatgptTabSettlementEffects >= CHATGPT_TAB_SETTLEMENT_EFFECT_BUDGET_PER_PASS) {
+          console.error('[forge cleanup] ChatGPT tab settlement reached bounded effect budget');
+          break chatgptTabSettlementSweep;
+        }
+        if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+        chatgptTabSettlementEffects += 1;
+        const settlement = await (input.settleBrowserTab ?? settleWorkChatgptAutomationTab)({
+          controllerHome: input.controllerHome,
+          workId: relay.originWorkId,
+          browserSessionId: binding.latestBrowserSessionId,
+          authorizationGrantRefs: binding.authorizationGrantRefs,
+        });
+        if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+        recordChatgptControllerRoundTabSettlement(store, {
+          workId: relay.originWorkId,
+          relayScopeId: relay.relayScopeId,
+          status: settlement.status,
+          error: settlement.error?.message,
+          attemptIdentity,
+        });
+      }
     }
-  } catch (error) {
-    console.error('[forge cleanup] Browser session retention failed:', error);
   }
-  try {
-    const computerTargets = await cleanupRuntimeComputerInteractionTargets(input.controllerHome, { nowMs: input.nowMs });
-    if (computerTargets.blockers.length > 0 || computerTargets.overCapacity || computerTargets.budgetExhausted) {
-      console.error('[forge cleanup] Computer interaction-target retention reported bounded blockers');
+
+  // Process GC includes stale-active reconciliation with a five-minute minimum
+  // age. Preserve the existing one-repository-per-base-pass round robin so that
+  // recovery remains smooth instead of concentrating all repositories in one
+  // periodic spike.
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+  if (plan.processGcRepositoryIndex !== undefined) {
+    const processRepo = input.repositories[plan.processGcRepositoryIndex]!;
+    const result = input.processGc({ controllerHome: input.controllerHome, repoId: processRepo.repoId });
+    if (!result.ok) {
+      const reason = result.error ?? 'unknown error';
+      registerSchedulerFailure({
+        controllerHome: input.controllerHome,
+        source: 'maintenance',
+        prefix: 'PROCESS_GC_FAILED',
+        message: reason,
+        observationId: `maintenance:process-gc:${processRepo.repoId}:${plan.periodicSequence}`,
+        repoId: processRepo.repoId,
+        atMs: input.nowMs,
+      });
+      console.error('[forge cleanup] Process GC failed:', reason);
     }
-  } catch (error) {
-    console.error('[forge cleanup] Computer interaction-target retention failed:', error);
   }
-  if (input.repositories.length === 0) return;
-  const slot = Math.floor(input.nowMs / input.cleanupIntervalMs) % input.repositories.length;
-  const repo = input.repositories[slot]!;
-  try {
-    const generated = cleanupGeneratedRepositoryCaches(repo.canonicalRoot, { nowMs: input.nowMs });
-    if (generated.errors.length > 0) {
-      console.error(`[forge cleanup] generated-cache retention reported ${generated.errors.length} error(s) for ${repo.repoId}`);
+
+  // Cache production is much faster than evidence retention. Reuse the existing
+  // five-minute pass, one repository and one bounded budget per pass. The root
+  // ordinal advances per repository visit, not by the correlated global index.
+  if (plan.generatedCacheRepositoryIndex !== undefined) {
+    if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+    const cacheRepo = input.repositories[plan.generatedCacheRepositoryIndex]!;
+    try {
+      const generated = cleanupGeneratedRepositoryCheckoutCaches(cacheRepo, {
+        nowMs: input.nowMs, rootStartIndex: plan.generatedCacheRootStartIndex,
+      });
+      if (generated.errors.length > 0) console.error(`[forge cleanup] generated-cache retention reported ${generated.errors.length} error(s) for ${cacheRepo.repoId}`);
+    } catch (error) {
+      console.error(`[forge cleanup] generated-cache retention failed for ${cacheRepo.repoId}:`, error);
     }
+  }
+  if (!plan.runDeepRetention) return;
+  if (!runtimeMaintenanceAuthorityCurrent(input.controllerHome)) return;
+
+  // Generated caches and persisted artifacts have hour/day-scale retention
+  // thresholds. Run one repository per deep-retention pass, and rotate the
+  // repository index on the deep cadence rather than the one-minute sequence.
+  try {
+    const xctestCleanup = cleanupIdleXCTestDevices(input.controllerHome);
+    if (xctestCleanup.error) console.error('[forge cleanup] XCTest device cleanup failed:', xctestCleanup.error);
   } catch (error) {
-    console.error(`[forge cleanup] generated-cache retention failed for ${repo.repoId}:`, error);
+    console.error('[forge cleanup] XCTest device cleanup failed:', error);
   }
+  if (plan.deepRetentionRepositoryIndex === undefined) return;
+  const repo = input.repositories[plan.deepRetentionRepositoryIndex]!;
   try {
     const browserArtifacts = cleanupControllerHomeBrowserArtifacts(input.controllerHome, repo.repoId, { nowMs: input.nowMs });
     if (browserArtifacts.errors.length > 0 || Object.values(browserArtifacts.classes).some((item) => item.overCapacity)) {
@@ -91,8 +313,6 @@ export async function runSchedulerPeriodicCleanup(input: {
   } catch (error) {
     console.error(`[forge cleanup] Browser artifact retention failed for ${repo.repoId}:`, error);
   }
-  const result = input.processGc({ controllerHome: input.controllerHome, repoId: repo.repoId });
-  if (!result.ok) console.error('[forge cleanup] Process GC failed:', result.error ?? 'unknown error');
   try {
     const checkResults = cleanupPersistedCheckResults(input.controllerHome, repo.repoId, { nowMs: input.nowMs });
     if (checkResults.blockers.length > 0 || checkResults.budgetExhausted) {
@@ -132,84 +352,3 @@ export async function runSchedulerValidationReconciliation(input: {
     }
   }
 }
-
-export async function runSchedulerControllerRoundRecovery(input: {
-  controllerHome: string;
-  nowMs: number;
-  repositories: readonly Pick<RepositoryRecord, 'repoId' | 'canonicalRoot' | 'localRoot'>[];
-  graceMs?: number;
-  maxRecoveries?: number;
-  dispatchPrompt?: typeof runWorkChatgptContinuation;
-  authorizeWake?: typeof assertAutomatedOperationAllowed;
-}): Promise<{ claimed: number; dispatched: number; failed: number }> {
-  const dispatchPrompt = input.dispatchPrompt ?? runWorkChatgptContinuation;
-  const authorizeWake = input.authorizeWake ?? assertAutomatedOperationAllowed;
-  const maxRecoveries = Math.max(1, Math.min(Math.trunc(input.maxRecoveries ?? 2), 8));
-  let claimed = 0;
-  let dispatched = 0;
-  let failed = 0;
-
-  for (const repository of input.repositories) {
-    if (claimed >= maxRecoveries) break;
-    const store = { controllerHome: input.controllerHome, repoId: repository.repoId };
-    let records: ReturnType<typeof claimStalledControllerRoundRelays>;
-    try {
-      records = claimStalledControllerRoundRelays(store, {
-        nowMs: input.nowMs,
-        graceMs: input.graceMs,
-        limit: maxRecoveries - claimed,
-        controllerTypes: ['chatgpt'],
-      });
-    } catch (error) {
-      const reason = error instanceof Error ? error.message : String(error);
-      failed += 1;
-      console.error(`[forge controller relay] stalled round scan failed for ${repository.repoId}:`, reason);
-      continue;
-    }
-    claimed += records.length;
-    for (const record of records) {
-      try {
-        authorizeWake('external_controller_wake', {
-          work_id: record.originWorkId,
-          controller_type: 'chatgpt',
-          relay_scope_id: record.relayScopeId,
-          recovery_reason: 'unclosed_dispatched_round',
-        });
-        const binding = getChatgptWorkConversationBinding(store, record.originWorkId);
-        const result = await dispatchPrompt({
-          controllerHome: input.controllerHome,
-          repoId: repository.repoId,
-          repoRoot: repository.canonicalRoot ?? repository.localRoot,
-          workId: record.originWorkId,
-          prompt: renderChatgptControllerRoundPrompt(store, record, { exactOriginWork: !record.requirementId }),
-          browserSessionId: binding?.latestBrowserSessionId,
-          conversationUrl: binding?.conversationUrl,
-          model: 'gpt-5.6',
-          reasoning: 'high',
-          tabPolicy: 'auto',
-          timeoutMs: 30_000,
-        });
-        if (result.status === 'failed') throw new Error(result.error?.message ?? 'CHATGPT_CONTROLLER_RELAY_RECOVERY_FAILED');
-        const updatedBinding = getChatgptWorkConversationBinding(store, record.originWorkId);
-        finishControllerRoundRelayDispatch(store, {
-          workId: record.originWorkId,
-          ok: true,
-          bindingId: updatedBinding?.bindingId,
-        });
-        dispatched += 1;
-      } catch (error) {
-        const reason = error instanceof Error ? error.message : String(error);
-        finishControllerRoundRelayDispatch(store, {
-          workId: record.originWorkId,
-          ok: false,
-          error: reason,
-          recovery: true,
-          nowMs: input.nowMs,
-        });
-        failed += 1;
-        console.error(`[forge controller relay] stalled round recovery failed for ${record.relayScopeId}:`, reason);
-      }
-    }
-  }
-  return { claimed, dispatched, failed };
-}

package/src/runtime/control-plane/global-scheduler/reconciliation.ts

@@ -8,7 +8,7 @@ import {
   childReferenceFromJob,
   childReferenceFromReceipt,
   hasDurableChildReference,
-  isAgentDelegationOperation,
+  isAgentDelegationJob,
   mergeChildReferences,
   buildDelegatedExecutionResult,
 } from '../../execution/jobs/child-reference';
@@ -17,6 +17,7 @@ import { operationReceiptMatchesJobOwnership, readOperationReceipt } from '../..
 import { releaseExecutionLeases, renewExecutionLeases } from '../../resources/leases/store';
 import { isProcessAlive, terminateProcessTree, terminateProcessTreeSync, type ProcessTreeTerminationResult } from '../../shared/process-tree';
 import { settleScheduledExecution } from '../../../../packages/kernel/scheduler/api/index';
+import { isRuntimeWriteFenceError } from '../../root/write-fence';
 
 const WORKER_HEARTBEAT_STALE_MS = 45_000;
 
@@ -33,16 +34,6 @@ function canAutomaticallyReplay(job: ExecutionJob): boolean {
   return !hasPotentialSideEffects(job);
 }
 
-function isAgentDelegationJob(job: ExecutionJob): boolean {
-  return isAgentDelegationOperation(job.payload.operation)
-    || job.type === 'agent-run'
-    || job.type === 'dispatch-task'
-    || job.payload.arguments?.agentDelegation === true
-    || (job.payload.operation === 'legacy-local-job'
-      && typeof job.payload.arguments?.localAction === 'string'
-      && ['launch-task', 'quick-agent-session'].includes(String(job.payload.arguments.localAction)));
-}
-
 function ambiguousStartedOperation(controllerHome: string, job: ExecutionJob): boolean {
   const receipt = readOperationReceipt(controllerHome, job.repoId, job.jobId);
   if (!receipt || !operationReceiptMatchesJobOwnership(receipt, job)) return false;
@@ -64,7 +55,7 @@ function recordIsolatedReconciliationFailure(job: ExecutionJob, error: unknown):
   // Losing the canonical write fence is a Runtime-wide invariant violation,
   // not corrupt state owned by one historical Job. Preserve the Scheduler's
   // fatal path so Runtime Root can stop the complete Runtime.
-  if (message.startsWith('WRITER_FENCED:')) throw error;
+  if (isRuntimeWriteFenceError(error)) throw error;
   process.stderr.write(`${JSON.stringify({
     event: 'forge_scheduler_execution_job_reconciliation_isolated',
     repoId: job.repoId,

package/src/runtime/control-plane/global-scheduler/scheduler.ts

@@ -23,16 +23,15 @@ import { reconcileTerminalWorkCleanups } from '../execution/work-terminal-cleanu
 import { gcTerminalProcesses } from '../../execution/process-runtime/gc';
 import { reconcilePendingWorkValidations } from '../execution/work-validation-reconciler';
 import { reconcilePendingEditValidations } from '../execution/edit-validation-coordinator';
-import { schedulerDispatchAllowed } from '../facade/work-admission-policy';
 import {
-  runSchedulerControllerRoundRecovery,
   runSchedulerPeriodicCleanup,
   runSchedulerValidationReconciliation,
 } from './maintenance';
 import { planSchedulerSourceSampling } from './source-scan';
+import { runSchedulerAutonomousContinuationReconciliation } from './autonomous-continuation';
 import {
   runSchedulerDurableAdmission,
-  schedulerDurableAdmissionRequiresPolicy,
+  SCHEDULE_TICK_INTERVAL_MS,
 } from './durable-admission';
 import { sampleRepositoryGitStatusForRepositories } from '../../projections/git-status-sampler';
 import { selectExecutionJobDispatchRepositories } from '../dispatch-priority';
@@ -98,7 +97,43 @@ export type { SchedulerWorkerCommand, SchedulerWorkerLaunchDescriptor } from './
 export { selectSchedulerSourceScanRepositories } from './source-scan';
 
 const DARWIN_MEMORY_SAMPLE_TTL_MS = 5_000;
+export const SCHEDULER_RECONCILIATION_INTERVAL_MS = 5_000;
 const RUNTIME_CLEANUP_INTERVAL_MS = Math.max(30_000, Number(process.env.FORGE_RUNTIME_CLEANUP_INTERVAL_MS ?? 60_000));
+
+function remainingRecurringDeadlineMs(nowMs: number, lastRanAt: number, intervalMs: number): number {
+  if (lastRanAt <= 0) return intervalMs;
+  const elapsed = Math.max(0, nowMs - lastRanAt);
+  return elapsed < intervalMs ? intervalMs - elapsed : intervalMs;
+}
+
+export function schedulerIdleWaitDelayMs(input: {
+  nowMs: number;
+  lastScheduleTickAt: number;
+}): number {
+  // Idle execution is event-driven. ExecutionJob/lease/policy mutations and
+  // check Process terminal persistence wake the scheduler immediately through
+  // the existing notification revision. The 30-second schedule cadence is the
+  // bounded idle lost-event safety deadline.
+  return remainingRecurringDeadlineMs(
+    input.nowMs,
+    input.lastScheduleTickAt,
+    SCHEDULE_TICK_INTERVAL_MS,
+  );
+}
+
+export function schedulerActiveWaitDelayMs(input: {
+  nowMs: number;
+  lastReconcileAt: number;
+}): number {
+  // Active execution uses the same canonical wake notifications as idle
+  // execution. A full scheduler tick is only the lost-event safety net, bounded
+  // by the existing reconciliation cadence instead of the legacy 250ms poll.
+  return remainingRecurringDeadlineMs(
+    input.nowMs,
+    input.lastReconcileAt,
+    SCHEDULER_RECONCILIATION_INTERVAL_MS,
+  );
+}
 const DARWIN_RECLAIMABLE_PAGE_LABELS = new Set([
   'Pages free',
   'Pages inactive',
@@ -510,7 +545,7 @@ export class GlobalScheduler {
     this.lastTickAt = this.lastHeartbeatAt;
     this.persistState();
     const repositories = this.repositoryList(this.controllerHome).filter((repo) => repo.enabled && !repo.removedAt);
-    let periodicCleanupRan = false;
+    let reconciliationRan = false;
     if (now - this.lastCleanupAt >= RUNTIME_CLEANUP_INTERVAL_MS) {
       // Advance the interval before cleanup so a failing pass cannot create a
       // tight retry loop on every scheduler tick. Canonical Runtime launches the
@@ -531,9 +566,8 @@ export class GlobalScheduler {
           processGc: this.processGc,
         });
       }
-      periodicCleanupRan = true;
     }
-    if (now - this.lastReconcile >= 5_000) {
+    if (now - this.lastReconcile >= SCHEDULER_RECONCILIATION_INTERVAL_MS) {
       await reconcileExecutionJobsAsync(this.controllerHome);
       for (const repository of repositories) {
         try {
@@ -551,6 +585,7 @@ export class GlobalScheduler {
       });
       this.lastReconcile = now;
       this.lastReconcileAt = new Date(now).toISOString();
+      reconciliationRan = true;
     }
     const activeJobSnapshot = listActiveExecutionJobs(this.controllerHome);
     const activeSourceRepoIds = new Set(activeJobSnapshot.map((job) => job.repoId));
@@ -587,34 +622,17 @@ export class GlobalScheduler {
         .map((repository) => [repository.repoId, repository] as const),
     ).values());
     this.sourceScansAvoided += sourceSampling.avoidedRepositoryCount;
-    // Phase 0 reuses one durable Work admission policy. Exclusive-Work mode stops
-    // ordinary schedule/workflow advancement and Worker dispatch while preserving
-    // cleanup and projections. Convergence mode remains dispatchable because new
-    // Work creation is independently fenced at the Work contract authority, so
-    // existing Work continuations can keep draining the backlog.
-    const admissionPolicyRequired = periodicCleanupRan || schedulerDurableAdmissionRequiresPolicy({
-      activeJobs: activeJobSnapshot,
-      nowMs: now,
-      lastScheduleTickAt: this.lastScheduleTick,
-    });
-    if (admissionPolicyRequired && !schedulerDispatchAllowed(this.controllerHome)) {
-      refreshSchedulerRepositoryProjections({
-        controllerHome: this.controllerHome,
-        repositories,
-        sourceScanRepositories: projectionMaintenanceRepositories,
-        projectionRefreshRepoIds: [],
-        controllerPid: this.controllerPid,
-      });
-      this.lastHeartbeatAt = new Date().toISOString();
-      this.persistState(true);
-      return { activeJobs: activeJobSnapshot.length };
-    }
-    if (periodicCleanupRan) {
-      await runSchedulerControllerRoundRecovery({
+    // Migration-era global Work admission gates are retired. Scheduler dispatch
+    // is constrained by durable admission, placement and concrete resource authority.
+    if (reconciliationRan) {
+      const liveness = await runSchedulerAutonomousContinuationReconciliation({
         controllerHome: this.controllerHome,
         nowMs: now,
         repositories,
       });
+      if (liveness.failed > 0) {
+        console.error('[forge liveness] controller progression reconciliation reported ' + liveness.failed + ' failure(s)');
+      }
     }
     const durableAdmission = await runSchedulerDurableAdmission({
       controllerHome: this.controllerHome,
@@ -731,30 +749,38 @@ export class GlobalScheduler {
       this.persistState(true);
     }, this.config.heartbeatIntervalMs);
     heartbeatTimer.unref?.();
-    let idleStreak = 0;
     let activeJobs = 0;
     try {
       while (!signal?.aborted) {
+        let tickFailed = false;
         try {
           activeJobs = (await this.tick()).activeJobs;
-          idleStreak = activeJobs === 0 ? idleStreak + 1 : 0;
         } catch (error) {
           if (this.fatalOnTickError) throw error;
-          idleStreak = 0;
+          tickFailed = true;
           this.lastHeartbeatAt = new Date().toISOString();
           this.lastTickAt = this.lastHeartbeatAt;
           this.persistState(true);
           console.error('[forge scheduler] tick failed:', error);
         }
-        const delayMs = idleStreak > 0
-          ? Math.min(
-            this.config.idleBackoffMaxMs,
-            this.config.pollIntervalMs * (2 ** Math.min(idleStreak, 6)),
-          )
-          : this.config.pollIntervalMs;
+        const now = Date.now();
+        const delayMs = tickFailed
+          ? this.config.pollIntervalMs
+          : activeJobs > 0
+            ? schedulerActiveWaitDelayMs({
+              nowMs: now,
+              lastReconcileAt: this.lastReconcile,
+            })
+            : schedulerIdleWaitDelayMs({
+              nowMs: now,
+              lastScheduleTickAt: this.lastScheduleTick,
+            });
         const wakeRevision = readSchedulerWakeSignal(this.controllerHome).revision;
         const waitResult = await waitForSchedulerWakeSignal(this.controllerHome, wakeRevision, delayMs, signal, {
-          fallbackPollMs: activeJobs > 0 ? 250 : Math.min(1_000, Math.max(500, delayMs)),
+          // fs.watch is authoritative for ordinary wakeups. Polling is only a
+          // lost-event safety net, so active execution must not regress to a
+          // 250ms JSON-read loop after removing the full-tick poll.
+          fallbackPollMs: Math.min(5_000, Math.max(1_000, delayMs)),
         });
         if (waitResult === 'aborted') break;
       }