@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/workflow/schedules/engine.ts

@@ -10,7 +10,7 @@ import {
   previewAutomaticRuntimeMaintenance,
   type RuntimeMaintenanceActionId,
 } from '../../recovery/maintenance-executor';
-import { appendWorkEvidence, getWorkContract, isTerminalWorkContractStatus } from '../../../../packages/kernel/work/api/index';
+import { appendWorkEvidence, getWorkContract, semanticWorkState } from '../../../../packages/kernel/work/api/index';
 import {
   controllerSessionBlocksRecovery,
   getControllerSession,
@@ -27,16 +27,16 @@ import {
   getSchedule,
   listActiveOccurrences,
   listOccurrences,
-  recordScheduleOccurrenceHandoff,
-  resumeScheduledControllerContinuation,
+  reclaimStaleCreatedOccurrences,
   listSchedules,
   saveOccurrence,
   saveScheduleDecision,
   updateSchedule,
 } from '../../../../packages/kernel/scheduler/api/index';
 export { cronDue };
-import { ensureScheduledControllerBinding, controllerHostForScheduledBinding } from '../../root/scheduled-controller-composition';
-import { listHandoffItems } from '../../control-plane/facade/handoff-inbox-store';
+import { ensureScheduledControllerBinding } from '../../root/scheduled-controller-composition';
+import { reconcileControllerProgression } from '../../root/controller-progression-composition';
+import { listUserRequests } from '../../../../packages/kernel/identity/api/index';
 import { runStandaloneChatgptPrompt } from '../../control-plane/launcher/chatgpt-work-continuation';
 
 import { classifyScheduledBrowserObservation, executeScheduledBrowserProbe } from './browser-probe';
@@ -51,6 +51,7 @@ import type {
 const execFileAsync = promisify(execFile);
 const LIVE_MAINTENANCE_OPERATION = 'runtime_maintenance_apply';
 const EXTERNAL_CONTROLLER_WAKE_OPERATION = 'external_controller_wake';
+const CONTROLLER_PROGRESSION_OPERATION = 'controller_progression';
 const BROWSER_PROBE_OPERATION = 'browser_probe';
 const GITHUB_ISSUE_WATCH_OPERATION = 'github_issue_watch';
 const DEFAULT_EXTERNAL_CONTROLLER_WAKE_TIMEOUT_MS = 60_000;
@@ -60,6 +61,7 @@ function isDeterministicSchedule(schedule: RepositorySchedule): boolean {
   // Kernel executes only typed, bounded dispatch operations.
   return schedule.action.operation === LIVE_MAINTENANCE_OPERATION
     || schedule.action.operation === EXTERNAL_CONTROLLER_WAKE_OPERATION
+    || schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION
     || schedule.action.operation === BROWSER_PROBE_OPERATION
     || schedule.action.operation === GITHUB_ISSUE_WATCH_OPERATION;
 }
@@ -87,35 +89,24 @@ async function workspaceDirty(controllerHome: string, repoId: string): Promise<b
 
 function workBoundScheduleWorkId(schedule: RepositorySchedule): string | undefined {
   if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
+    && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION
     && schedule.action.operation !== BROWSER_PROBE_OPERATION) return undefined;
   const value = schedule.action.arguments?.work_id;
   return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
 
-const HUMAN_ONLY_HANDOFF_REASONS = new Set([
-  'policy_approval_required',
-  'missing_authorization',
-  'invalid_objective',
-  'destructive_action_requires_confirmation',
-]);
-
-function handoffRequiresHumanReview(item: ReturnType<typeof listHandoffItems>[number]): boolean {
-  if (item.approvalAction) return true;
-  if (!item.creationReason) return true;
-  return HUMAN_ONLY_HANDOFF_REASONS.has(item.creationReason);
-}
-
 async function stopReason(controllerHome: string, schedule: RepositorySchedule): Promise<string | undefined> {
   const projection = readRepositoryProjection(controllerHome, schedule.repoId);
   const workId = workBoundScheduleWorkId(schedule);
   const work = workId ? getWorkContract({ controllerHome, repoId: schedule.repoId }, workId) : undefined;
   if (schedule.stopConditions.includes('human_review_required')) {
+    const pendingUserRequests = listUserRequests(controllerHome, 'pending');
     if (workId) {
-      const activeHandoff = listHandoffItems({ controllerHome, repoId: schedule.repoId, status: 'active', limit: 100 })
-        .find((item) => item.workId === workId && handoffRequiresHumanReview(item));
-      if (activeHandoff) return `Work ${workId} has active Handoff ${activeHandoff.id} requiring human review.`;
-    } else if (projection.currentAttention.length > 0) {
-      return 'Repository has jobs requiring human attention.';
+      const request = pendingUserRequests.find((item) => item.targetScope?.workId === workId);
+      if (request) return `Work ${workId} has pending UserRequest ${request.requestId} requiring human action.`;
+    } else {
+      const request = pendingUserRequests.find((item) => item.targetScope?.repoId === schedule.repoId);
+      if (request) return `Repository ${schedule.repoId} has pending UserRequest ${request.requestId}.`;
     }
   }
   if (schedule.stopConditions.includes('release_ready') && projection.releaseFrozen) return 'Repository is in release freeze.';
@@ -258,7 +249,7 @@ export function classifyChatgptWakeFailure(reason: string): ChatgptWakeFailureCl
   return 'ordinary_failure';
 }
 
-async function executeExternalControllerWake(
+async function executeControllerProgression(
   controllerHome: string,
   schedule: RepositorySchedule,
   occurrence: ScheduleOccurrence,
@@ -277,9 +268,9 @@ async function executeExternalControllerWake(
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `EXTERNAL_CONTROLLER_WAKE_WORK_NOT_FOUND:${workId}`);
   }
-  if (isTerminalWorkContractStatus(work.status)) {
-    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
-    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.status}); automatic continuation stopped.`);
+  if (semanticWorkState(work) !== 'open') {
+    updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.semanticState}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
+    return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.semanticState}); automatic continuation stopped.`);
   }
 
   const retainedSession = getRetainedControllerSession(workStore, workId);
@@ -323,12 +314,20 @@ async function executeExternalControllerWake(
     );
   }
 
+  if (schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION
+    && (typeof args.controller_binding_id !== 'string' || !args.controller_binding_id.trim())) {
+    throw new Error(`SCHEDULE_CONTROLLER_PROGRESSION_BINDING_REQUIRED:${workId}`);
+  }
+
   const hadLegacySessionIdentity = typeof args.controller_session_id === 'string' && args.controller_session_id.trim().length > 0;
 
   // Explicit compatibility migration for schedules written before Kernel V2 B4.
   // Provider metadata is copied once into the adapter-owned binding and the
   // Schedule is rewritten to exact Work/ControllerSession/ControllerBinding ids.
   if (!bindingRecord) {
+    if (schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION) {
+      throw new Error(`SCHEDULE_CONTROLLER_PROGRESSION_BINDING_NOT_FOUND:${workId}`);
+    }
     const binding = ensureScheduledControllerBinding(
       { controllerHome, repoId: schedule.repoId },
       { workId, session: retainedSession, scheduleName: schedule.name, args },
@@ -369,6 +368,10 @@ async function executeExternalControllerWake(
   const relayScopeId = typeof schedule.action.arguments?.relay_scope_id === 'string'
     ? schedule.action.arguments.relay_scope_id
     : undefined;
+  const controllerRoundOccurrenceId = typeof occurrence.triggerContext?.data?.controllerRoundOccurrenceId === 'string'
+    && occurrence.triggerContext.data.controllerRoundOccurrenceId.trim()
+    ? occurrence.triggerContext.data.controllerRoundOccurrenceId.trim()
+    : occurrence.occurrenceId;
   const wakeDecision = decideOccurrence(
     controllerHome,
     schedule,
@@ -387,23 +390,40 @@ async function executeExternalControllerWake(
   );
 
   try {
-    const host = controllerHostForScheduledBinding(
+    const progression = await reconcileControllerProgression(
       { controllerHome, repoId: schedule.repoId, repoRoot: repository.canonicalRoot },
-      bindingRecord.binding,
-    );
-    const resumed = await resumeScheduledControllerContinuation(
-      workStore,
       {
-        scheduleId: schedule.scheduleId,
-        occurrenceId: occurrence.occurrenceId,
+        occurrenceId: controllerRoundOccurrenceId,
         workId,
-        controllerBindingId: bindingRecord.binding.bindingId,
         relayScopeId,
         continuationHint,
+        allowSemanticWaitRecovery: controllerType === 'chatgpt',
+        scheduleName: schedule.name,
+        scheduleId: schedule.scheduleId,
+        scheduleOccurrenceId: occurrence.occurrenceId,
+        bindingArgs: args,
       },
-      host,
     );
-    if (resumed.dispatch.status === 'semantic_wait') {
+
+    if (progression.status === 'terminal_or_missing') {
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
+        enabled: false,
+        pausedReason: progression.reason,
+        lastTriggeredAt: timestamp,
+        lastOccurrenceId: occurrence.occurrenceId,
+      }));
+      return saveOccurrence(controllerHome, {
+        ...wakeDecision,
+        status: 'skipped',
+        decision: 'nothing_to_do',
+        reason: progression.reason,
+      });
+    }
+
+    if (progression.status === 'semantic_wait'
+      || progression.status === 'wait_for_user'
+      || progression.status === 'retained_session_missing'
+      || progression.status === 'human_controller') {
       updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
         lastTriggeredAt: timestamp,
         lastOccurrenceId: occurrence.occurrenceId,
@@ -412,37 +432,70 @@ async function executeExternalControllerWake(
         ...wakeDecision,
         status: 'skipped',
         decision: 'nothing_to_do',
-        reason: resumed.dispatch.reason ?? `Work ${workId} remains in unchanged semantic wait; provider dispatch suppressed.`,
+        reason: progression.reason ?? `Work ${workId} is not currently eligible for provider progression.`,
       });
     }
-    if (resumed.dispatch.status === 'rejected') {
-      throw new Error(resumed.dispatch.reason ?? 'CONTROLLER_HOST_RESUME_REJECTED');
 
+    if (progression.status === 'rejected') {
+      throw new Error(progression.reason ?? 'CONTROLLER_HOST_RESUME_REJECTED');
+    }
+
+    if (progression.status === 'chatgpt_not_enrolled') {
+      updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
+        lastTriggeredAt: timestamp,
+        lastOccurrenceId: occurrence.occurrenceId,
+      }));
+      return saveOccurrence(controllerHome, {
+        ...wakeDecision,
+        status: 'skipped',
+        decision: 'nothing_to_do',
+        reason: `Workflow Supervisor enrollment is not yet ready (${progression.supervisorEnrollment.status}); no ChatGPT provider attempt was consumed.`,
+      });
     }
+
+    const supervisorEnrollment = progression.status === 'chatgpt_enrolled'
+      ? progression.supervisorEnrollment
+      : progression.status === 'scheduled_supervisor_woken'
+        ? { status: 'enrolled' as const, taskId: progression.taskId, effectId: progression.effectId }
+        : { status: 'not_eligible' as const };
+    const supervisorOwnsTurn = progression.status === 'chatgpt_enrolled' || progression.status === 'scheduled_supervisor_woken';
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, (current) => ({
       lastTriggeredAt: timestamp,
       lastOccurrenceId: occurrence.occurrenceId,
       consecutiveFailures: 0,
       nextEligibleAt: undefined,
-      ...(current.enabled ? { pausedReason: undefined } : {}),
+      ...(supervisorEnrollment.status === 'enrolled'
+        && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION
+        ? { enabled: false, pausedReason: 'workflow_supervisor_owns_outer_turn' }
+        : current.enabled ? { pausedReason: undefined } : {}),
     }));
     const dispatchedOccurrence = saveOccurrence(controllerHome, {
       ...wakeDecision,
       status: 'dispatched',
-      reason: resumed.reused
-        ? `Controller continuation occurrence ${occurrence.occurrenceId} was already durably dispatched; external replay suppressed and semantic round closure is still pending.`
-        : `ControllerHost accepted durable binding ${bindingRecord.binding.bindingId} for Work ${workId}; dispatch ${resumed.dispatch.hostDispatchId ?? resumed.dispatch.relayScopeId}; semantic round closure is still pending.`,
+      reason: progression.status === 'chatgpt_enrolled'
+        ? `Workflow Supervisor reserved the exact ChatGPT effect ${progression.supervisorEnrollment.effectId ?? progression.relayScopeId}; Scheduler issued no provider send.`
+        : progression.status === 'scheduled_supervisor_woken'
+          ? `Scheduler occurrence ${occurrence.occurrenceId} woke the same Workflow Supervisor task and reserved effect ${progression.effectId}; Scheduler issued no provider send.`
+          : progression.reused
+            ? `Controller continuation occurrence ${occurrence.occurrenceId} was already durably dispatched; external replay suppressed and semantic round closure is still pending.`
+            : `ControllerHost accepted durable binding ${bindingRecord.binding.bindingId} for Work ${workId}; dispatch ${progression.providerDispatchReceiptId ?? progression.relayScopeId}; semantic round closure is still pending.`,
     });
     appendWorkEvidence(workStore, workId, {
       evidenceId: dispatchedOccurrence.occurrenceId,
-      title: 'scheduled Controller continuation dispatched',
-      summary: `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} resumed the exact Work-bound ControllerSession through ControllerHost.`,
+      title: supervisorOwnsTurn
+        ? 'scheduled Workflow Supervisor effect reserved'
+        : 'scheduled Controller continuation dispatched',
+      summary: progression.status === 'scheduled_supervisor_woken'
+        ? `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} woke the same Work-bound Supervisor task; Supervisor owns ChatGPT delivery.`
+        : progression.status === 'chatgpt_enrolled'
+          ? `Schedule ${schedule.scheduleId} materialized the exact ControllerRound occurrence and Supervisor effect; Supervisor owns ChatGPT delivery.`
+          : `Schedule ${schedule.scheduleId} occurrence ${dispatchedOccurrence.occurrenceId} resumed the exact Work-bound ControllerSession through ControllerHost.`,
       detailLevel: 'summary',
     });
     return dispatchedOccurrence;
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
-    if (reason.startsWith('SCHEDULE_CONTINUATION_ROUND_ALREADY_OPEN:')) {
+    if (reason.startsWith('CONTROLLER_CONTINUATION_ROUND_ALREADY_OPEN:') || reason.startsWith('CONTROLLER_CONTINUATION_ALREADY_DISPATCHING:')) {
       updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
       return decideOccurrence(controllerHome, schedule, wakeDecision, 'nothing_to_do', 'skipped', `Work ${workId} already has an open Controller round awaiting claim or disposition.`);
     }
@@ -473,20 +526,20 @@ async function executeExternalControllerWake(
       decision: 'execute',
       reason,
       ...(failureClass === 'user_action_required' ? { pauseReason: reason } : {}),
-      handoff: {
-        title: `External Controller wake ${occurrence.occurrenceId} failed`,
-        summary: 'Forge recorded the schedule trigger but could not resume the exact configured ControllerSession through ControllerHost.',
-        reason,
-        creationReason: 'repeated_infrastructure_failure',
-        blockingDecision: reason.startsWith('SCHEDULE_CONTINUATION_OUTCOME_UNKNOWN:')
-          ? 'Inspect the durable ControllerHost dispatch outcome before any retry; automatic replay is fenced.'
-          : 'Repair the ControllerHost adapter/binding or update the retained ControllerSession.',
-        recommendedDecision: 'Inspect the exact Scheduler continuation dispatch, ControllerSession, and adapter binding, then retrigger only when the outcome is known.',
-        recommendedPrompt: `Resume Work ${workId} manually, inspect failed wake occurrence ${occurrence.occurrenceId}, and repair the exact ControllerHost continuation path before unattended continuation resumes.`,
-        statusSummary: 'Scheduled ControllerHost continuation failed.',
-        blockedBy: ['external_controller_wake_failed'],
-        attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, `controller:${controllerType}`, `session:${retainedSession.sessionId}`, `binding:${bindingRecord.binding.bindingId}`],
-      },
+      ...(failureClass === 'user_action_required' ? {
+        handoff: {
+          title: `External Controller wake ${occurrence.occurrenceId} requires user authorization`,
+          summary: 'Forge cannot resume the configured ControllerSession until the required user authorization is restored.',
+          reason,
+          creationReason: 'missing_authorization' as const,
+          blockingDecision: 'Restore the required authenticated/authorized controller capability, then retry the same scheduled Work.',
+          recommendedDecision: 'Restore authorization only; do not create replacement Work or replay an unknown external effect.',
+          recommendedPrompt: `Restore authorization for Work ${workId} and retry scheduled continuation ${occurrence.occurrenceId}.`,
+          statusSummary: 'Scheduled Controller continuation is waiting on user authorization.',
+          blockedBy: ['controller_authorization_required'],
+          attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, `controller:${controllerType}`, `session:${retainedSession.sessionId}`, `binding:${bindingRecord.binding.bindingId}`],
+        },
+      } : {}),
     });
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrence.occurrenceId }));
     return failed.occurrence ?? saveOccurrence(controllerHome, { ...wakeDecision, status: 'failed', reason });
@@ -541,39 +594,25 @@ export async function evaluateSchedule(
     updatedAt: timestamp,
   });
 
-  // Semantic / model-backed schedules only record a trigger + Handoff.
-  // Deterministic allowlisted operations continue into the local engine path.
+  // Semantic/model-owned schedule actions record the trigger only. A trigger is
+  // continuation input for the external Controller/Supervisor, not a human
+  // blocker and therefore must not manufacture Handoff/UserRequest state.
   if (!isDeterministicSchedule(schedule)) {
-    const externalControllerHandoff = recordScheduleOccurrenceHandoff(
+    const recorded = decideOccurrence(
       controllerHome,
       schedule,
-      decideOccurrence(
-        controllerHome,
-        schedule,
-        occurrence,
-        'operation_blocked',
-        'skipped',
-        'Schedule execution is external-controller-owned; no ExecutionJob was created.',
-        occurrenceDecisionEvidence({ operation: schedule.action.operation, trigger: occurrence.triggerContext?.source }),
-      ),
-      {
-        title: `Schedule ${schedule.name} requires an external Controller`,
-        summary: 'The scheduled trigger was recorded without dispatching a Kernel Job.',
-        reason: 'Schedule execution is external-controller-owned.',
-        creationReason: 'ambiguous_outcome',
-        blockingDecision: 'Claim or create the related Work before executing the scheduled operation.',
-        recommendedDecision: 'Review the trigger evidence and continue it through an explicitly claimed external Controller session.',
-        recommendedPrompt: `Review schedule ${schedule.scheduleId} occurrence ${occurrence.occurrenceId}; create or claim Work for ${schedule.action.operation} and continue through Process Runtime or Thin Launcher.`,
-        statusSummary: 'Schedule trigger is waiting for external Controller ownership.',
-        blockedBy: ['external_controller_required'],
-        attemptedActions: [`operation:${schedule.action.operation}`],
-      },
+      occurrence,
+      'operation_blocked',
+      'skipped',
+      'Schedule trigger recorded for external Controller continuation; no Kernel ExecutionJob or human Handoff was created.',
+      occurrenceDecisionEvidence({ operation: schedule.action.operation, trigger: occurrence.triggerContext?.source }),
     );
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
-    return externalControllerHandoff;
+    return recorded;
   }
 
   const recent = listOccurrences(controllerHome, schedule.repoId, schedule.scheduleId, 1000);
+  reclaimStaleCreatedOccurrences(controllerHome, schedule.repoId, schedule.scheduleId);
   const active = listActiveOccurrences(controllerHome, schedule.repoId, schedule.scheduleId)
     .filter((entry) => entry.occurrenceId !== occurrence.occurrenceId);
   const admission = evaluateScheduleOccurrenceAdmission(schedule, {
@@ -593,18 +632,7 @@ export async function evaluateSchedule(
       reason: stop,
       countFailure: false,
       pauseReason: stop,
-      handoff: {
-        title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} stopped`,
-        summary: 'A live maintenance occurrence was blocked by an explicit schedule stop condition and requires review before automation resumes.',
-        reason: stop,
-        creationReason: 'ambiguous_outcome',
-        blockingDecision: 'Review the stop condition and decide whether automatic maintenance should stay paused.',
-        recommendedDecision: 'Resolve the stop condition, then explicitly re-enable or retrigger the maintenance schedule.',
-        recommendedPrompt: `Review maintenance schedule ${schedule.scheduleId} for repo ${schedule.repoId}, inspect stop condition ${stop}, and decide whether to resume the schedule.`,
-        statusSummary: 'Scheduled maintenance occurrence stopped before dispatch.',
-        blockedBy: ['schedule_stop_condition'],
-        attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
-      },
+
     });
     return failed.occurrence ?? stopped;
   }
@@ -641,22 +669,20 @@ export async function evaluateSchedule(
           reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
           countFailure: !preview.blockedPermanently,
           pauseReason: preview.blockedPermanently ? preview.blockedReason : undefined,
-          handoff: {
-            title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} blocked`,
-            summary: 'A bounded live maintenance occurrence was blocked before dispatch and requires a human decision.',
-            reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
-            creationReason: preview.blockedPermanently ? 'missing_authorization' : 'ambiguous_outcome',
-            blockingDecision: preview.blockedPermanently
-              ? 'Fix the schedule operation or authorization before automatic maintenance can resume.'
-              : 'Inspect runtime maintenance readiness before allowing another unattended attempt.',
-            recommendedDecision: preview.blockedPermanently
-              ? 'Correct the automatic maintenance configuration and re-enable the schedule deliberately.'
-              : 'Review the maintenance preview, resolve the blocker, and then retrigger the schedule intentionally.',
-            recommendedPrompt: `Review blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId}. Determine whether the schedule configuration or runtime maintenance readiness should be corrected before retrying.`,
-            statusSummary: 'Scheduled maintenance occurrence blocked before dispatch.',
-            blockedBy: [decision],
-            attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
-          },
+          ...(preview.blockedPermanently ? {
+            handoff: {
+              title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} needs a user decision`,
+              summary: 'Automatic maintenance is permanently blocked and requires an explicit user decision before the schedule can resume.',
+              reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
+              creationReason: 'ambiguous_outcome' as const,
+              blockingDecision: 'Correct the configuration/authorization or intentionally keep this schedule paused.',
+              recommendedDecision: 'Review the permanent blocker and explicitly decide whether to repair configuration and resume.',
+              recommendedPrompt: `Review permanently blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId} and decide whether to repair and resume it.`,
+              statusSummary: 'Scheduled maintenance is permanently blocked pending a user decision.',
+              blockedBy: [decision],
+              attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
+            },
+          } : {}),
         });
         return failed.occurrence ?? blocked;
       }
@@ -693,22 +719,20 @@ export async function evaluateSchedule(
         reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
         countFailure: !preview.blockedPermanently,
         pauseReason: preview.blockedPermanently ? preview.blockedReason : undefined,
-        handoff: {
-          title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} blocked`,
-          summary: 'A bounded live maintenance occurrence was blocked before dispatch and requires a human decision.',
-          reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
-          creationReason: preview.blockedPermanently ? 'missing_authorization' : 'ambiguous_outcome',
-          blockingDecision: preview.blockedPermanently
-            ? 'Fix the schedule operation or authorization before automatic maintenance can resume.'
-            : 'Inspect runtime maintenance readiness before allowing another unattended attempt.',
-          recommendedDecision: preview.blockedPermanently
-            ? 'Correct the automatic maintenance configuration and re-enable the schedule deliberately.'
-            : 'Review the maintenance preview, resolve the blocker, and then retrigger the schedule intentionally.',
-          recommendedPrompt: `Review blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId}. Determine whether the schedule configuration or runtime maintenance readiness should be corrected before retrying.`,
-          statusSummary: 'Scheduled maintenance occurrence blocked before dispatch.',
-          blockedBy: [decision],
-          attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
-        },
+        ...(preview.blockedPermanently ? {
+          handoff: {
+            title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} needs a user decision`,
+            summary: 'Automatic maintenance is permanently blocked and requires an explicit user decision before the schedule can resume.',
+            reason: preview.blockedReason ?? 'Automatic maintenance preview blocked the occurrence.',
+            creationReason: 'ambiguous_outcome' as const,
+            blockingDecision: 'Correct the configuration/authorization or intentionally keep this schedule paused.',
+            recommendedDecision: 'Review the permanent blocker and explicitly decide whether to repair configuration and resume.',
+            recommendedPrompt: `Review permanently blocked maintenance occurrence ${occurrence.occurrenceId} for schedule ${schedule.scheduleId} and decide whether to repair and resume it.`,
+            statusSummary: 'Scheduled maintenance is permanently blocked pending a user decision.',
+            blockedBy: [decision],
+            attemptedActions: [`schedule:${schedule.scheduleId}`, `operation:${schedule.action.operation}`],
+          },
+        } : {}),
       });
       return failed.occurrence ?? blocked;
     }
@@ -721,8 +745,9 @@ export async function evaluateSchedule(
   }
 
   const args = schedule.action.arguments ?? {};
-  if (schedule.action.operation === EXTERNAL_CONTROLLER_WAKE_OPERATION) {
-    return executeExternalControllerWake(controllerHome, schedule, occurrence, timestamp, args);
+  if (schedule.action.operation === EXTERNAL_CONTROLLER_WAKE_OPERATION
+    || schedule.action.operation === CONTROLLER_PROGRESSION_OPERATION) {
+    return executeControllerProgression(controllerHome, schedule, occurrence, timestamp, args);
   }
 
   if (schedule.action.operation === GITHUB_ISSUE_WATCH_OPERATION) {
@@ -769,7 +794,7 @@ export async function evaluateSchedule(
           ? `${args.continuation_prompt}\n\nGitHub issue watcher detected: ${issueSummary}`
           : `GitHub issue watcher detected actionable issue changes: ${issueSummary}. Read current Work/Plan/evidence and process these issues through the bounded repair workflow.`,
       };
-      const wake = await executeExternalControllerWake(controllerHome, schedule, occurrence, timestamp, wakeArgs, evidence, { transientWakeFailure: true });
+      const wake = await executeControllerProgression(controllerHome, schedule, occurrence, timestamp, wakeArgs, evidence, { transientWakeFailure: true });
       if (wake.status !== 'failed') persistObservation();
       return wake;
     } catch (error) {
@@ -778,18 +803,7 @@ export async function evaluateSchedule(
         outcome: 'failed',
         decision: 'execute',
         reason,
-        handoff: {
-          title: `GitHub issue watcher occurrence ${occurrence.occurrenceId} failed`,
-          summary: 'The local GitHub issue poll failed before Forge could compare issue state.',
-          reason,
-          creationReason: 'repeated_infrastructure_failure',
-          blockingDecision: 'Repair GitHub CLI authentication/connectivity before unattended issue monitoring resumes.',
-          recommendedDecision: 'Restore gh read access, then retrigger the watcher.',
-          recommendedPrompt: `Inspect GitHub issue watcher occurrence ${occurrence.occurrenceId} and restore the local read-only gh issue polling path.`,
-          statusSummary: 'GitHub issue watcher poll failed.',
-          blockedBy: ['github_issue_watch_failed'],
-          attemptedActions: [`schedule:${schedule.scheduleId}`, 'gh:api:issues'],
-        },
+
       });
       return failed.occurrence ?? occurrence;
     }
@@ -808,9 +822,9 @@ export async function evaluateSchedule(
         updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} no longer exists.`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
         return decideOccurrence(controllerHome, schedule, occurrence, 'operation_blocked', 'skipped', `SCHEDULE_BROWSER_PROBE_WORK_NOT_FOUND:${workId}`);
       }
-      if (isTerminalWorkContractStatus(work.status)) {
-        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.status}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
-        return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.status}); browser watcher stopped before probing.`);
+      if (semanticWorkState(work) !== 'open') {
+        updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ enabled: false, pausedReason: `Work ${workId} is terminal (${work.semanticState}).`, lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
+        return decideOccurrence(controllerHome, schedule, occurrence, 'nothing_to_do', 'skipped', `Work ${workId} is terminal (${work.semanticState}); browser watcher stopped before probing.`);
       }
     }
 
@@ -844,7 +858,7 @@ export async function evaluateSchedule(
               : `Scheduled browser watcher ${schedule.scheduleId} detected that authentication is required (${probe.authReason ?? 'login marker'}). Inspect the external dependency and request user login only if it cannot be restored safely.`;
           if (workId) {
             const wakeArgs = { ...args, continuation_prompt: authPrompt };
-            return executeExternalControllerWake(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, authReason: probe.authReason });
+            return executeControllerProgression(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, authReason: probe.authReason });
           }
           const controllerType = typeof args.controller_type === 'string' ? args.controller_type.trim() : 'chatgpt';
           if (controllerType !== 'chatgpt') {
@@ -925,25 +939,14 @@ export async function evaluateSchedule(
           ? args.continuation_prompt
           : `Scheduled browser watcher ${schedule.scheduleId} detected a changed external observation. Read the current external state, correlate it with Work ${workId}, and continue only the bounded Work objective.`,
       };
-      return executeExternalControllerWake(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, observationStatus });
+      return executeControllerProgression(controllerHome, observedSchedule, occurrence, timestamp, wakeArgs, { ...observationEvidence, observationStatus });
     } catch (error) {
       const reason = error instanceof Error ? error.message : String(error);
       const failed = applyScheduleFailure(controllerHome, schedule.scheduleId, schedule.repoId, occurrence.occurrenceId, {
         outcome: 'failed',
         decision: 'execute',
         reason,
-        handoff: {
-          title: `Browser watcher occurrence ${occurrence.occurrenceId} failed`,
-          summary: 'A bounded browser probe failed before Forge could compare the external observation.',
-          reason,
-          creationReason: 'repeated_infrastructure_failure',
-          blockingDecision: 'Repair browser/session readiness or update the watcher target before unattended probing resumes.',
-          recommendedDecision: 'Inspect the browser plugin/session and retrigger the watcher after the target is readable.',
-          recommendedPrompt: `Inspect browser watcher schedule ${schedule.scheduleId} for Work ${workId}, repair the failed browser probe, then retrigger one bounded occurrence.`,
-          statusSummary: 'Scheduled browser watcher failed.',
-          blockedBy: ['browser_probe_failed'],
-          attemptedActions: [`schedule:${schedule.scheduleId}`, `work:${workId}`, 'operation:browser_probe'],
-        },
+
       });
       updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({ lastTriggeredAt: timestamp, lastOccurrenceId: occurrenceId }));
       return failed.occurrence ?? saveOccurrence(controllerHome, { ...occurrence, status: 'failed', decision: 'execute', reason });
@@ -1008,22 +1011,7 @@ export async function evaluateSchedule(
       outcome: 'failed',
       decision: 'execute',
       reason,
-      handoff: {
-        title: `Scheduled maintenance occurrence ${occurrence.occurrenceId} failed`,
-        summary: 'A bounded live maintenance occurrence failed during deterministic apply and requires review before the schedule continues unattended.',
-        reason,
-        creationReason: 'repeated_infrastructure_failure',
-        blockingDecision: 'Review the failed maintenance occurrence and decide whether the schedule should continue automatically.',
-        recommendedDecision: 'Inspect the failed occurrence, fix the runtime blocker, then re-enable or retrigger the schedule intentionally.',
-        recommendedPrompt: `Review schedule occurrence ${occurrence.occurrenceId} for ${schedule.scheduleId}, inspect the failed runtime maintenance action, and decide whether to resume automatic maintenance.`,
-        statusSummary: 'Scheduled maintenance execution failed.',
-        blockedBy: ['scheduled_execution_failed'],
-        attemptedActions: [
-          `schedule:${schedule.scheduleId}`,
-          `operation:${schedule.action.operation}`,
-          actionIdRaw ? `action:${actionIdRaw}` : 'action:unknown',
-        ],
-      },
+
     });
     updateSchedule(controllerHome, schedule.repoId, schedule.scheduleId, () => ({
       lastTriggeredAt: timestamp,

package/src/runtime/workflow/schedules/pending-activation.ts

@@ -5,6 +5,7 @@ import { resolveControllerHome } from '../../../cli/repositories/controller-home
 import { getSchedule, saveSchedule } from '../../../../packages/kernel/scheduler/api/index';
 
 const EXTERNAL_CONTROLLER_WAKE_OPERATION = 'external_controller_wake';
+const CONTROLLER_PROGRESSION_OPERATION = 'controller_progression';
 
 export interface PendingContinuationActivationMarker {
   schemaVersion: 1;
@@ -53,8 +54,9 @@ export function queuePendingContinuationActivation(
   scheduleId: string,
 ): PendingContinuationActivationMarker {
   const schedule = getSchedule(controllerHome, repoId, scheduleId);
-  if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION) {
-    throw new Error('PENDING_CONTINUATION_ACTIVATION_REQUIRES_EXTERNAL_CONTROLLER_WAKE');
+  if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
+    && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION) {
+    throw new Error('PENDING_CONTINUATION_ACTIVATION_REQUIRES_WORK_CONTINUATION');
   }
   const workId = schedule.action.arguments?.work_id;
   if (typeof workId !== 'string' || !workId.trim()) {
@@ -108,7 +110,8 @@ export function applyPendingContinuationActivations(controllerHome: string): Pen
       const marker = readMarker(path);
       const schedule = getSchedule(controllerHome, marker.repoId, marker.scheduleId);
       const workId = schedule.action.arguments?.work_id;
-      if (schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION || workId !== marker.workId) {
+      if ((schedule.action.operation !== EXTERNAL_CONTROLLER_WAKE_OPERATION
+        && schedule.action.operation !== CONTROLLER_PROGRESSION_OPERATION) || workId !== marker.workId) {
         results.push({ ...marker, status: 'failed', reason: 'Schedule no longer targets the queued Work continuation.' });
         continue;
       }
@@ -122,7 +125,11 @@ export function applyPendingContinuationActivations(controllerHome: string): Pen
         results.push({ ...marker, status: 'already_active' });
         continue;
       }
-      saveSchedule(controllerHome, { ...schedule, policy: { ...schedule.policy, shadowMode: false } });
+      saveSchedule(controllerHome, {
+        ...schedule,
+        action: { ...schedule.action, operation: CONTROLLER_PROGRESSION_OPERATION },
+        policy: { ...schedule.policy, shadowMode: false },
+      });
       rmSync(path, { force: true });
       results.push({ ...marker, status: 'activated' });
     } catch (error) {