@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/standalone-recovery/mcp-server.ts

@@ -1,105 +1,53 @@
-import { randomUUID } from 'crypto';
 import type { IncomingMessage, ServerResponse } from 'http';
-import { Server, type Tool } from '@modelcontextprotocol/server';
-import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
-import { McpSessionRegistry, type McpSessionRoute, type McpSessionSnapshot } from '../../../adapters/mcp/transports/session-registry';
+import { createMcpHandler, Server, type Tool } from '@modelcontextprotocol/server';
+import { toNodeHandler } from '@modelcontextprotocol/node';
 import { FORGE_VERSION } from '../../version';
 
-export const RECOVERY_MCP_SESSION_ROUTE: McpSessionRoute = '/recovery/mcp';
-const RECOVERY_MCP_PRINCIPAL_ID = 'standalone-recovery-oauth-client';
-const RECOVERY_MCP_CONNECTION_ID = 'forge-standalone-recovery';
-
 export interface RecoveryMcpRequestContext {
   remoteAddress: string;
 }
 
-export interface RecoveryMcpSessionServerOptions {
+export interface RecoveryMcpServerOptions {
   tools: readonly Tool[];
   dispatchTool(name: string, args: Record<string, unknown>, context: RecoveryMcpRequestContext): Promise<unknown>;
 }
 
-type RecoveryMcpSessionContext = RecoveryMcpRequestContext;
-type RecoveryMcpRegistry = McpSessionRegistry<NodeStreamableHTTPServerTransport, RecoveryMcpSessionContext>;
-
-function sessionId(request: IncomingMessage): string | undefined {
-  const value = request.headers['mcp-session-id'];
-  return Array.isArray(value) ? value[0] : value;
-}
-
-function isInitialize(body: unknown): boolean {
-  return Boolean(body && typeof body === 'object' && !Array.isArray(body) && (body as { method?: unknown }).method === 'initialize');
-}
-
-function initializeClientIdentity(body: unknown): string {
-  if (!body || typeof body !== 'object' || Array.isArray(body)) return 'unknown-client';
-  const params = (body as { params?: unknown }).params;
-  if (!params || typeof params !== 'object' || Array.isArray(params)) return 'unknown-client';
-  const clientInfo = (params as { clientInfo?: unknown }).clientInfo;
-  if (!clientInfo || typeof clientInfo !== 'object' || Array.isArray(clientInfo)) return 'unknown-client';
-  const name = typeof (clientInfo as { name?: unknown }).name === 'string' ? (clientInfo as { name: string }).name.trim() : 'unknown';
-  const version = typeof (clientInfo as { version?: unknown }).version === 'string' ? (clientInfo as { version: string }).version.trim() : 'unknown';
-  return `${name || 'unknown'}/${version || 'unknown'}`.slice(0, 200);
-}
-
-function sendSessionLookupError(response: ServerResponse, id: string | undefined): void {
-  const missing = !id?.trim();
-  response.statusCode = missing ? 400 : 404;
-  response.setHeader('content-type', 'application/json; charset=utf-8');
-  response.setHeader('cache-control', 'no-store');
-  response.setHeader('Mcp-Session-Reset', 'reinitialize');
-  response.setHeader('x-forge-session-reset', 'reinitialize');
-  response.end(JSON.stringify(missing ? {
-    error: 'missing_session',
-    code: 'MCP_SESSION_REQUIRED',
-    message: 'Mcp-Session-Id header is required for this request.',
-    recoverable: true,
-    action: 'reinitialize',
-  } : {
-    error: 'session_not_found',
-    code: 'MCP_SESSION_EXPIRED',
-    message: 'MCP session not found or expired; initialize a new session.',
-    recoverable: true,
-    action: 'reinitialize',
-  }));
-}
-
-export class RecoveryMcpSessionServer {
-  private readonly registry: RecoveryMcpRegistry;
-
-  constructor(private readonly options: RecoveryMcpSessionServerOptions) {
-    this.registry = new McpSessionRegistry<NodeStreamableHTTPServerTransport, RecoveryMcpSessionContext>({
-      maximumSessions: 16,
-      maximumSessionsPerPrincipal: 16,
-    });
-  }
-
-  snapshot(): McpSessionSnapshot {
-    return this.registry.snapshot();
-  }
+/**
+ * Standalone Recovery owns durable recovery/release authority, never MCP
+ * transport-session authority. Both MCP 2026-07-28 and the bounded 2025-era
+ * compatibility protocol are served statelessly so a Gateway process
+ * replacement cannot invalidate the Recovery control path.
+ */
+export class RecoveryMcpServer {
+  constructor(private readonly options: RecoveryMcpServerOptions) {}
 
   async close(): Promise<void> {
-    await this.registry.closeAll('shutdown');
+    // Stateless handlers retain no cross-request transport resources.
   }
 
   async handle(request: IncomingMessage, response: ServerResponse, body?: unknown): Promise<void> {
-    await this.registry.prune();
-    if (request.method === 'POST') {
-      await this.handlePost(request, response, body);
-      return;
-    }
-    if (request.method === 'GET') {
-      await this.handleGet(request, response);
+    if (request.method !== 'POST') {
+      response.statusCode = 405;
+      response.setHeader('allow', 'POST');
+      response.end();
       return;
     }
-    if (request.method === 'DELETE') {
-      await this.handleDelete(request, response);
-      return;
+
+    const context: RecoveryMcpRequestContext = {
+      remoteAddress: request.socket.remoteAddress ?? 'unknown',
+    };
+    const handler = createMcpHandler(async () => this.createServer(context), {
+      legacy: 'stateless',
+      responseMode: 'auto',
+    });
+    try {
+      await toNodeHandler(handler)(request, response, body);
+    } finally {
+      await handler.close();
     }
-    response.statusCode = 405;
-    response.end();
   }
 
-  private createServer(context: RecoveryMcpSessionContext): Server {
+  private createServer(context: RecoveryMcpRequestContext): Server {
     const server = new Server(
       { name: 'forge-standalone-recovery', version: FORGE_VERSION },
       { capabilities: { tools: {} } },
@@ -128,116 +76,4 @@ export class RecoveryMcpSessionServer {
     });
     return server;
   }
-
-  private async handlePost(request: IncomingMessage, response: ServerResponse, body: unknown): Promise<void> {
-    const currentSessionId = sessionId(request);
-    if (isInitialize(body)) {
-      if (currentSessionId) {
-        response.setHeader('Mcp-Session-Reset', 'reinitialized');
-        response.setHeader('x-forge-session-reset', 'reinitialized');
-      }
-      const reservationId = await this.registry.reserveForInitialize({
-        principalId: RECOVERY_MCP_PRINCIPAL_ID,
-        connectionId: RECOVERY_MCP_CONNECTION_ID,
-        route: RECOVERY_MCP_SESSION_ROUTE,
-        ...(currentSessionId ? { supersedeSessionId: currentSessionId } : {}),
-      });
-      if (!reservationId) {
-        response.statusCode = 503;
-        response.setHeader('retry-after', '1');
-        response.setHeader('content-type', 'application/json; charset=utf-8');
-        response.end(JSON.stringify({
-          error: 'session_capacity',
-          code: 'MCP_SESSION_CAPACITY',
-          recoverable: true,
-          retryable: true,
-          action: 'retry',
-        }));
-        return;
-      }
-      const context: RecoveryMcpSessionContext = { remoteAddress: request.socket.remoteAddress ?? 'unknown' };
-      let transport: NodeStreamableHTTPServerTransport | undefined;
-      let initializedSessionId: string | undefined;
-      try {
-        transport = new NodeStreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID(),
-          onsessioninitialized: (newSessionId: string): void => {
-            this.registry.commitInitialize(reservationId, {
-              sessionId: newSessionId,
-              transport: transport!,
-              toolContext: context,
-              route: RECOVERY_MCP_SESSION_ROUTE,
-              principalId: RECOVERY_MCP_PRINCIPAL_ID,
-              connectionId: RECOVERY_MCP_CONNECTION_ID,
-              clientIdentity: initializeClientIdentity(body),
-            });
-            initializedSessionId = newSessionId;
-          },
-        });
-        transport.onclose = () => {
-          if (transport?.sessionId) this.registry.detach(transport.sessionId);
-        };
-        const server = this.createServer(context);
-        await server.connect(transport);
-        await transport.handleRequest(request, response, body);
-      } finally {
-        if (initializedSessionId) this.registry.endPost(initializedSessionId);
-        this.registry.releaseInitialize(reservationId);
-        if (!transport?.sessionId) await transport?.close().catch(() => undefined);
-      }
-      return;
-    }
-
-    if (!currentSessionId) {
-      sendSessionLookupError(response, currentSessionId);
-      return;
-    }
-    const managed = this.registry.get(currentSessionId);
-    if (!managed || managed.route !== RECOVERY_MCP_SESSION_ROUTE || managed.principalId !== RECOVERY_MCP_PRINCIPAL_ID) {
-      sendSessionLookupError(response, currentSessionId);
-      return;
-    }
-    this.registry.beginPost(currentSessionId);
-    try {
-      await managed.transport.handleRequest(request, response, body);
-    } finally {
-      this.registry.endPost(currentSessionId);
-    }
-  }
-
-  private async handleGet(request: IncomingMessage, response: ServerResponse): Promise<void> {
-    const currentSessionId = sessionId(request);
-    const managed = currentSessionId ? this.registry.get(currentSessionId) : undefined;
-    if (!managed || managed.route !== RECOVERY_MCP_SESSION_ROUTE || managed.principalId !== RECOVERY_MCP_PRINCIPAL_ID) {
-      sendSessionLookupError(response, currentSessionId);
-      return;
-    }
-    this.registry.beginStream(currentSessionId!);
-    let released = false;
-    const release = (): void => {
-      if (released) return;
-      released = true;
-      this.registry.endStream(currentSessionId!);
-    };
-    request.once('aborted', release);
-    response.once('close', release);
-    try {
-      await managed.transport.handleRequest(request, response);
-    } catch (error) {
-      release();
-      throw error;
-    }
-  }
-
-  private async handleDelete(request: IncomingMessage, response: ServerResponse): Promise<void> {
-    const currentSessionId = sessionId(request);
-    const managed = currentSessionId ? this.registry.get(currentSessionId) : undefined;
-    if (!managed || managed.route !== RECOVERY_MCP_SESSION_ROUTE || managed.principalId !== RECOVERY_MCP_PRINCIPAL_ID) {
-      sendSessionLookupError(response, currentSessionId);
-      return;
-    }
-    this.registry.setPendingCloseReason(currentSessionId!, 'client_delete');
-    await managed.transport.handleRequest(request, response);
-    if (this.registry.get(currentSessionId!)) await this.registry.close(currentSessionId!, 'client_delete');
-  }
 }

package/src/runtime/standalone-recovery/operation-lock.ts

@@ -24,6 +24,16 @@ export type RecoveryOperationLockAttempt =
   | { acquired: true; handle: RecoveryOperationLockHandle }
   | { acquired: false; owner: RecoveryOperationLockRecord };
 
+/** Preserve the competing owner identities when lock acquisition detects a race. */
+export class RecoveryOperationLockRaceError extends Error {
+  constructor(
+    readonly existing: RecoveryOperationLockRecord,
+    readonly latest: RecoveryOperationLockRecord | undefined,
+  ) {
+    super('RECOVERY_OPERATION_LOCK_RACE');
+  }
+}
+
 function processStartTime(pid: number): string | undefined {
   const result = spawnSync('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], {
     encoding: 'utf8',
@@ -72,7 +82,7 @@ export function recoveryOperationLockOwnerAlive(lock: RecoveryOperationLockRecor
   if (!isProcessAlive(lock.pid)) return false;
   if (!lock.processStartTime) return true;
   const observed = processStartTime(lock.pid);
-  return observed === undefined || observed === lock.processStartTime;
+  return observed === lock.processStartTime;
 }
 
 export function acquireRecoveryOperationLock(input: {
@@ -123,7 +133,7 @@ export function acquireRecoveryOperationLock(input: {
         if (!latest || latest.instanceId !== existing.instanceId) {
           if (attempt === 1) {
             if (latest && recoveryOperationLockOwnerAlive(latest)) return { acquired: false, owner: latest };
-            throw new Error('RECOVERY_OPERATION_LOCK_RACE');
+            throw new RecoveryOperationLockRaceError(existing, latest);
           }
           continue;
         }

package/src/runtime/standalone-recovery/performance.ts

@@ -10,7 +10,7 @@ export interface RuntimePerformanceIdentity {
 }
 
 export interface RuntimePerformanceEvidence extends RuntimePerformanceIdentity {
-  policy: 'idle-cpu-v1';
+  policy: 'runaway-cpu-v4';
   measuredFrom: string;
   measuredUntil: string;
   warmupMs: number;
@@ -18,10 +18,43 @@ export interface RuntimePerformanceEvidence extends RuntimePerformanceIdentity {
   sampleCount: number;
   meanCpuPercent: number;
   p95CpuPercent: number;
+  /** Windows whose CPU consumption reached the per-window runaway ceiling. */
+  sustainedHighWindowCount: number;
 }
 
 export interface RuntimeCpuReading { cpuMs: number; processStartTime: string }
 
+const PERFORMANCE_WINDOW_MS = 2_500;
+const PERFORMANCE_MAX_WINDOW_MS = 3_750;
+const PERFORMANCE_WARMUP_WINDOWS = 4;
+const PERFORMANCE_SAMPLE_WINDOWS = 20;
+const PERFORMANCE_WARMUP_MS = PERFORMANCE_WINDOW_MS * PERFORMANCE_WARMUP_WINDOWS;
+const PERFORMANCE_DURATION_MS = PERFORMANCE_WINDOW_MS * PERFORMANCE_SAMPLE_WINDOWS;
+
+// Recovery known-good is a runaway safety gate, not the comparative release benchmark.
+// The v4 sampler keeps the same 60-second budget, the same twenty 2.5-second windows
+// and the same 25%/50% ceilings as v2/v3, but decides runaway from *sustained*
+// consumption instead of from nearest-rank p95.
+//
+// Why p95 cannot be the decision rule: the Canonical Runtime performs bounded,
+// scheduled maintenance (the release-fenced periodic cleanup child and the in-process
+// scheduler/recovery passes). Such a pass lasts several seconds and recurs about once
+// per minute, so in any 50-second observation at least two windows necessarily land
+// inside it. nearest-rank p95 is exactly the second-highest window, so a healthy
+// Runtime with an ~11% mean was deterministically rejected (live evidence:
+// mean=12.60% p95=65.05% and mean=11.41% p95=65.13%, both rolled back within minutes
+// of cutover) and every automatic release progression converged on rollback.
+//
+// A watchdog duty must distinguish "unbounded spin" from "bounded periodic work", so
+// v4 rejects a sample only when the process is high for at least half of the observed
+// windows (sustainedHighWindowCount * 2 >= sampleCount) or when the mean exceeds the
+// ceiling. The historical runaway population (mean >= 90.64%, p95 >= 104.72%) fails
+// both tests by a wide margin, while a once-per-minute bounded pass (<= 4 of 20
+// windows) can no longer be mistaken for runaway. p95 stays in the evidence for audit.
+// Relative <=10% regression remains Benchmark/Release Evaluation authority.
+export const RECOVERY_RUNAWAY_MEAN_CPU_PERCENT = 25;
+export const RECOVERY_RUNAWAY_P95_CPU_PERCENT = 50;
+
 /** Dependencies are in-process test seams; no transport accepts evidence or threshold overrides. */
 export interface RuntimePerformanceDependencies {
   readCpu?: (pid: number) => RuntimeCpuReading;
@@ -54,20 +87,24 @@ export function assertRuntimePerformanceEvidence(
   now = Date.now(),
 ): void {
   const age = now - Date.parse(evidence.measuredUntil);
-  if (evidence.policy !== 'idle-cpu-v1' || !samePerformanceIdentity(evidence, identity)
+  if (evidence.policy !== 'runaway-cpu-v4' || !samePerformanceIdentity(evidence, identity)
     || !Number.isFinite(age) || age < 0 || age > 60_000
-    || evidence.warmupMs < 60_000 || evidence.warmupMs > 90_000
-    || evidence.durationMs < 300_000 || evidence.durationMs > 450_000 || evidence.sampleCount !== 30
+    || evidence.warmupMs < PERFORMANCE_WARMUP_MS || evidence.warmupMs > PERFORMANCE_MAX_WINDOW_MS * PERFORMANCE_WARMUP_WINDOWS
+    || evidence.durationMs < PERFORMANCE_DURATION_MS || evidence.durationMs > PERFORMANCE_MAX_WINDOW_MS * PERFORMANCE_SAMPLE_WINDOWS || evidence.sampleCount !== PERFORMANCE_SAMPLE_WINDOWS
     || !Number.isFinite(evidence.meanCpuPercent) || evidence.meanCpuPercent < 0
-    || !Number.isFinite(evidence.p95CpuPercent) || evidence.p95CpuPercent < 0) {
+    || !Number.isFinite(evidence.p95CpuPercent) || evidence.p95CpuPercent < 0
+    || !Number.isInteger(evidence.sustainedHighWindowCount)
+    || evidence.sustainedHighWindowCount < 0
+    || evidence.sustainedHighWindowCount > evidence.sampleCount) {
     throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: incomplete, stale or mismatched performance evidence');
   }
-  if (evidence.meanCpuPercent > 5 || evidence.p95CpuPercent > 10) {
-    throw new Error(`RECOVERY_PERFORMANCE_REJECTED: mean=${evidence.meanCpuPercent.toFixed(2)}% p95=${evidence.p95CpuPercent.toFixed(2)}%`);
+  const sustained = evidence.sustainedHighWindowCount * 2 >= evidence.sampleCount;
+  if (evidence.meanCpuPercent > RECOVERY_RUNAWAY_MEAN_CPU_PERCENT || sustained) {
+    throw new Error(`RECOVERY_PERFORMANCE_REJECTED: mean=${evidence.meanCpuPercent.toFixed(2)}% p95=${evidence.p95CpuPercent.toFixed(2)}% sustained=${evidence.sustainedHighWindowCount}/${evidence.sampleCount}`);
   }
 }
 
-/** Observe 60 seconds of warmup followed by thirty 10-second CPU-time delta windows. */
+/** Observe 10 seconds of warmup followed by twenty 2.5-second CPU-time delta windows. */
 export async function measureRuntimePerformance(
   observeIdentity: () => RuntimePerformanceIdentity,
   dependencies: RuntimePerformanceDependencies = {},
@@ -90,12 +127,12 @@ export async function measureRuntimePerformance(
   };
   const warmingAt = monotonicNow();
   let previousWarmupAt = warmingAt;
-  for (let i = 0; i < 6; i++) {
-    await sleep(10_000);
+  for (let i = 0; i < PERFORMANCE_WARMUP_WINDOWS; i++) {
+    await sleep(PERFORMANCE_WINDOW_MS);
     observe();
     const nextWarmupAt = monotonicNow();
     const elapsed = nextWarmupAt - previousWarmupAt;
-    if (elapsed < 10_000 || elapsed > 15_000) {
+    if (elapsed < PERFORMANCE_WINDOW_MS || elapsed > PERFORMANCE_MAX_WINDOW_MS) {
       throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: interrupted CPU warmup window');
     }
     previousWarmupAt = nextWarmupAt;
@@ -107,14 +144,14 @@ export async function measureRuntimePerformance(
   const startedAt = previousAt;
   let totalCpuMs = 0;
   const windows: number[] = [];
-  for (let i = 0; i < 30; i++) {
-    await sleep(10_000);
+  for (let i = 0; i < PERFORMANCE_SAMPLE_WINDOWS; i++) {
+    await sleep(PERFORMANCE_WINDOW_MS);
     const nextCpu = observe().cpuMs;
     const nextAt = monotonicNow();
     const elapsed = nextAt - previousAt;
     const cpuDelta = nextCpu - previousCpu;
-    // Suspended/overloaded collectors cannot pass as thirty ordinary windows.
-    if (elapsed < 10_000 || elapsed > 15_000 || cpuDelta < 0) {
+    // Suspended/overloaded collectors cannot pass as ordinary sample windows.
+    if (elapsed < PERFORMANCE_WINDOW_MS || elapsed > PERFORMANCE_MAX_WINDOW_MS || cpuDelta < 0) {
       throw new Error('RECOVERY_PERFORMANCE_UNKNOWN: interrupted CPU observation window');
     }
     windows.push(cpuDelta / elapsed * 100);
@@ -125,10 +162,11 @@ export async function measureRuntimePerformance(
   const durationMs = previousAt - startedAt;
   windows.sort((a, b) => a - b);
   const evidence: RuntimePerformanceEvidence = {
-    ...identity, policy: 'idle-cpu-v1', measuredFrom, measuredUntil: new Date(wallNow()).toISOString(),
+    ...identity, policy: 'runaway-cpu-v4', measuredFrom, measuredUntil: new Date(wallNow()).toISOString(),
     warmupMs, durationMs, sampleCount: windows.length,
     meanCpuPercent: totalCpuMs / durationMs * 100,
     p95CpuPercent: windows[Math.ceil(windows.length * 0.95) - 1]!,
+    sustainedHighWindowCount: windows.filter((cpuPercent) => cpuPercent >= RECOVERY_RUNAWAY_P95_CPU_PERCENT).length,
   };
   assertRuntimePerformanceEvidence(evidence, observeIdentity(), wallNow());
   return evidence;

package/src/runtime/standalone-recovery/release.ts

@@ -15,8 +15,8 @@ import {
 import { dirname, join, relative, resolve, sep } from 'path';
 import { writeJsonAtomic } from '../shared/json-files';
 
-export const RECOVERY_RELEASE_BINARIES = [
-  'forge-recovery',
+export const RECOVERY_RELEASE_BINARIES = ['forge-recovery'] as const;
+export const RECOVERY_RELEASE_COMPATIBILITY_BINARIES = [
   'forge-recovery-gateway',
   'forge-recovery-watchdog',
 ] as const;
@@ -24,7 +24,8 @@ export const RECOVERY_RELEASE_BINARIES = [
 export const RECOVERY_RELEASE_ROLE_CANARY_ARG = '--forge-release-role-canary';
 
 export type RecoveryReleaseBinary = (typeof RECOVERY_RELEASE_BINARIES)[number];
-export type RecoveryRuntimeRole = 'gateway' | 'watchdog';
+/** daemon is the only current persistent owner; gateway/watchdog remain legacy CLI compatibility roles. */
+export type RecoveryRuntimeRole = 'daemon' | 'gateway' | 'watchdog';
 export interface RecoveryReleaseManifest {
   schemaVersion: 1;
   releaseRevision: string;
@@ -84,6 +85,49 @@ export function recoveryRuntimeStatePath(controllerHome: string, role: RecoveryR
   return join(recoveryRoot(controllerHome), 'state', `${role}-runtime.json`);
 }
 
+export function recoveryGatewayDrainMarkerPath(controllerHome: string): string {
+  return join(recoveryRoot(controllerHome), 'state', 'gateway-draining.json');
+}
+
+const RECOVERY_GATEWAY_DRAIN_MARKER_TTL_MS = 5 * 60_000;
+
+export function recoveryGatewayIsDraining(controllerHome: string, now = Date.now()): boolean {
+  const path = recoveryGatewayDrainMarkerPath(controllerHome);
+  if (!existsSync(path)) return false;
+  try {
+    const marker = JSON.parse(readFileSync(path, 'utf8')) as { pid?: unknown; at?: unknown };
+    const pid = Number(marker.pid);
+    const at = typeof marker.at === 'string' ? Date.parse(marker.at) : Number.NaN;
+    if (!Number.isInteger(pid) || pid <= 0 || !Number.isFinite(at) || now - at > RECOVERY_GATEWAY_DRAIN_MARKER_TTL_MS) {
+      rmSync(path, { force: true });
+      return false;
+    }
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code === 'EPERM') return true;
+      rmSync(path, { force: true });
+      return false;
+    }
+  } catch {
+    rmSync(path, { force: true });
+    return false;
+  }
+}
+
+export function setRecoveryGatewayDraining(controllerHome: string, draining: boolean): void {
+  const path = recoveryGatewayDrainMarkerPath(controllerHome);
+  if (!draining) {
+    rmSync(path, { force: true });
+    return;
+  }
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  writeJsonAtomic(path, { schemaVersion: 1, draining: true, pid: process.pid, at: new Date().toISOString() });
+  chmodSync(path, 0o600);
+}
+
 function fileSha256(path: string): string {
   return createHash('sha256').update(readFileSync(path)).digest('hex');
 }
@@ -184,11 +228,15 @@ export function publishRecoveryCompatibilityLinks(controllerHome: string): void
   assertRecoveryReleaseContained(controllerHome, current);
   const binRoot = join(recoveryRoot(controllerHome), 'bin');
   mkdirSync(binRoot, { recursive: true, mode: 0o700 });
-  for (const binary of RECOVERY_RELEASE_BINARIES) {
+  const compatibilityTargets = [
+    ...RECOVERY_RELEASE_BINARIES.map((binary) => ({ binary, target: binary })),
+    ...RECOVERY_RELEASE_COMPATIBILITY_BINARIES.map((binary) => ({ binary, target: 'forge-recovery' as const })),
+  ];
+  for (const { binary, target } of compatibilityTargets) {
     const destination = join(binRoot, binary);
     const temporary = `${destination}.${process.pid}.tmp`;
     rmSync(temporary, { force: true });
-    symlinkSync(join('..', 'current', binary), temporary);
+    symlinkSync(join('..', 'current', target), temporary);
     renameSync(temporary, destination);
   }
 }

package/src/runtime/standalone-recovery/service-labels.ts

@@ -1,2 +1,5 @@
-export const RECOVERY_GATEWAY_LABEL = 'com.moretea.forge-recovery-gateway';
-export const RECOVERY_WATCHDOG_LABEL = 'com.moretea.forge-recovery-watchdog';
+export {
+  FORGE_RECOVERY_DAEMON_LABEL as RECOVERY_DAEMON_LABEL,
+  FORGE_RECOVERY_GATEWAY_LABEL as RECOVERY_GATEWAY_LABEL,
+  FORGE_RECOVERY_WATCHDOG_LABEL as RECOVERY_WATCHDOG_LABEL,
+} from '../platform/service-inventory';

package/src/runtime/standalone-recovery/watchdog-heartbeat.ts

@@ -151,10 +151,13 @@ export function evaluateRecoveryWatchdogHealth(input: {
   return { ok: true, detail: 'Recovery Watchdog heartbeat, PID, and immutable release identity are current', pulseAgeMs, heartbeat, runtimeIdentity, currentReleaseRevision: current.releaseRevision };
 }
 
-export function observeRecoveryWatchdogHealth(controllerHome: string): RecoveryWatchdogHealth {
+export function observeRecoveryWatchdogHealth(controllerHome: string, enabled = true): RecoveryWatchdogHealth {
+  if (!enabled) {
+    return { ok: true, detail: 'Recovery Watchdog is disabled by the configured install profile' };
+  }
   return evaluateRecoveryWatchdogHealth({
     heartbeat: readRecoveryWatchdogHeartbeat(controllerHome),
-    runtimeIdentity: readRecoveryRuntimeIdentity(controllerHome, 'watchdog'),
+    runtimeIdentity: readRecoveryRuntimeIdentity(controllerHome, 'daemon'),
     currentRelease: readCurrentRecoveryRelease(controllerHome),
   });
 }

package/src/runtime/workflow/schedules/browser-probe.ts

@@ -82,6 +82,7 @@ async function browserAction(
   occurrenceId: string,
   actionId: string,
   args: Record<string, unknown>,
+  authorizationGrantRefs: readonly string[],
 ): Promise<Record<string, unknown>> {
   return executeBrowserPluginAction({
     controllerHome,
@@ -92,9 +93,16 @@ async function browserAction(
     requestId: `schedule-browser-probe:${occurrenceId}:${actionId}`,
     args,
     origin: { surface: 'schedule', actor: 'browser-probe', correlationId: occurrenceId },
+    authorizationGrantRefs,
   });
 }
 
+/** Exact interactive grants attached to this Schedule; contents remain Controller-owned. */
+export function scheduledBrowserProbeAuthorizationGrantRefs(args: Record<string, unknown>): string[] {
+  if (!Array.isArray(args.authorization_grant_refs)) return [];
+  return [...new Set(args.authorization_grant_refs.map(String).map((value) => value.trim()).filter(Boolean))];
+}
+
 interface ScheduledBrowserSessionMetadata {
   url?: string;
   ownership?: string;
@@ -137,8 +145,9 @@ async function scheduledBrowserSessionMetadata(
   repository: RepositoryRecord,
   occurrenceId: string,
   sessionId: string,
+  authorizationGrantRefs: readonly string[],
 ): Promise<ScheduledBrowserSessionMetadata | undefined> {
-  const inventory = await browserAction(controllerHome, repository, occurrenceId, 'list_sessions', {});
+  const inventory = await browserAction(controllerHome, repository, occurrenceId, 'list_sessions', {}, authorizationGrantRefs);
   const sessions = Array.isArray(inventory.sessions) ? inventory.sessions : [];
   const saved = sessions
     .map((entry) => recordValue(entry))
@@ -170,10 +179,12 @@ export async function executeScheduledBrowserProbe(input: {
   const url = stringValue(input.args.probe_url) ?? stringValue(input.args.url);
   if (!requestedSessionId && !url) throw new Error('SCHEDULE_BROWSER_PROBE_TARGET_REQUIRED');
 
+  const authorizationGrantRefs = scheduledBrowserProbeAuthorizationGrantRefs(input.args);
+
   const waitUntil = stringValue(input.args.wait_until) ?? 'domcontentloaded';
   const timeoutMs = boundedNumber(input.args.timeout_ms, 60_000, 1_000, 120_000);
   const savedSession = requestedSessionId
-    ? await scheduledBrowserSessionMetadata(input.controllerHome, input.repository, input.occurrenceId, requestedSessionId)
+    ? await scheduledBrowserSessionMetadata(input.controllerHome, input.repository, input.occurrenceId, requestedSessionId, authorizationGrantRefs)
     : undefined;
   const navigationAction = scheduledBrowserProbeNavigationAction(savedSession?.ownership, Boolean(url));
   const managedRehydrateIntent = scheduledBrowserProbeManagedRehydrateIntent(savedSession);
@@ -188,7 +199,7 @@ export async function executeScheduledBrowserProbe(input: {
       state: waitUntil,
       timeout_ms: timeoutMs,
       ...managedRehydrateIntent,
-    });
+    }, authorizationGrantRefs);
   } else if (navigationAction === 'navigate') {
     navigation = await browserAction(input.controllerHome, input.repository, input.occurrenceId, 'navigate', {
       ...(requestedSessionId ? { session_id: requestedSessionId } : {}),
@@ -197,14 +208,14 @@ export async function executeScheduledBrowserProbe(input: {
       timeout_ms: timeoutMs,
       retries: 1,
       ...managedRehydrateIntent,
-    });
+    }, authorizationGrantRefs);
   } else {
     navigation = await browserAction(input.controllerHome, input.repository, input.occurrenceId, 'reload', {
       session_id: requestedSessionId!,
       wait_until: waitUntil,
       timeout_ms: timeoutMs,
       ...managedRehydrateIntent,
-    });
+    }, authorizationGrantRefs);
   }
 
   const session = recordValue(navigation.session);
@@ -224,7 +235,7 @@ export async function executeScheduledBrowserProbe(input: {
       session_id: sessionId,
       ...(stringValue(input.args.selector) ? { selector: stringValue(input.args.selector) } : {}),
       max_chars: boundedNumber(input.args.max_chars, 20_000, 256, 100_000),
-    });
+    }, authorizationGrantRefs);
     rawText = stringValue(textResult.text) ?? '';
     truncated = textResult.truncated === true;
   }

package/src/runtime/workflow/schedules/chatgpt-automation-migration.ts

@@ -1,9 +1,17 @@
 import type { RepositorySchedule } from '../../../../packages/kernel/scheduler/api/index';
 
+import {
+  DEFAULT_CHATGPT_AUTOMATION_MODEL,
+  DEFAULT_CHATGPT_AUTOMATION_REASONING,
+  DEFAULT_CHATGPT_AUTOMATION_TAB_POLICY,
+} from '../../../../adapters/chatgpt/provider-delivery';
+
 export const CHATGPT_AUTOMATION_EXECUTION_PROFILE = 'chatgpt_browser_v1';
-export const CHATGPT_AUTOMATION_DEFAULT_MODEL = 'gpt-5.6';
-export const CHATGPT_AUTOMATION_DEFAULT_REASONING = 'high';
-export const CHATGPT_AUTOMATION_DEFAULT_TAB_POLICY = 'auto';
+// Missing legacy Schedule preferences inherit the single provider defaults.
+// Explicit saved preferences remain authoritative and are never overwritten.
+export const CHATGPT_AUTOMATION_DEFAULT_MODEL = DEFAULT_CHATGPT_AUTOMATION_MODEL;
+export const CHATGPT_AUTOMATION_DEFAULT_REASONING = DEFAULT_CHATGPT_AUTOMATION_REASONING;
+export const CHATGPT_AUTOMATION_DEFAULT_TAB_POLICY = DEFAULT_CHATGPT_AUTOMATION_TAB_POLICY;
 
 export interface ChatgptAutomationScheduleMigrationResult {
   changed: boolean;