@moretea-labs/forge 1.8.1 → 1.8.2

package/docs/architecture/decisions/20260904-ios-device-migration-baseline.md

@@ -50,6 +50,48 @@ The provider release is independently versioned from the Forge Runtime release a
 
 `interactionMayOwnTarget()` and the target-alias rules are the current migration fence: old records that cannot prove they refer to a different phone fail closed rather than allowing CoreDevice and agent-device to acquire the same device concurrently.
 
+## 2026-10-16 pre-migration stabilization
+
+Before T10 service extraction, the in-process implementation now closes the highest-risk ownership/lifecycle gaps without introducing a second provider:
+
+- physical iPhone ownership uses one Controller-global lock keyed by the hardware UDID shared by CoreDevice and XCTest (not CoreDevice's transport-local identifier), so neither provider nor repository scope can create a second mutation owner;
+- active same-app CoreDevice interactions are reusable and their device ownership lease is renewed by activity; Runtime restart can reclaim an unexpired session after the previous owner process dies;
+- physical mutation actions execute in the Forge Runtime so the RemoteXPC/HID worker can persist across consecutive actions instead of being recreated by every lightweight action process;
+- agent-device physical actions share the same exact-device fence, while Simulator remains outside the physical-device ownership domain;
+- plugin discovery includes the current repository overlay when a repository context is already selected, and iOS health reports development and physical-device readiness independently rather than treating Xcode/Simulator readiness as the physical-phone health authority.
+
+These are stabilization changes to the existing ownership boundary, not a new iOS-specific control plane. T10/T11 remain responsible for moving live provider/transport handles behind the independently operated `ios-device` service.
+
+### Low-round-trip observe / act / observe (2026-10-16)
+
+Measured real-device CoreDevice launch and screenshot calls are each on the order of 1 second, while complete navigation is dominated by multiple controller/tool/model turns. Reduce the **number of round trips**, not the number of foreground safety checks:
+
+- `physical_device_open({ observe_after_open: true })` and same-app session reuse optionally capture an initial screenshot in the same action; launch status is still not proof of foreground.
+- After independently inspecting the actual screenshot, `physical_device_confirm_foreground({ interaction_id, observation_id, bundle_id })` explicitly binds the target app. Only then may `physical_device_batch({ observation_id, steps, capture_after: true })` perform bounded input and capture the next screenshot. An observation ID alone never confirms the app; every subsequent captured screenshot requires its own confirmation. No unknown mutation is replayed.
+- `physical_device_observed_tap/swipe({ observation_id, ..., capture_after: true })` supports the same fused follow-up screenshot for system UI navigation.
+- All three variants call the **existing CoreDevice screenshot implementation**; no second image provider, autonomous app navigation engine, device state store, or XCUITest runner is introduced. Optional capture returns the same bounded Controller-owned PNG artifact.
+- If an input succeeds but the follow-up screenshot fails, return `postActionCapture.status=failed`, `mutationAlreadyApplied=true`, and allow **only** a new screenshot. Never retry the tap, swipe, or batch merely because screenshot failed.
+
+The optimization should be judged by real elapsed *open → observe → input → observe* time, tool-round-trip count and same-device correctness; unit tests and device readiness are necessary but not sufficient proof of shopping-app E2E reliability.
+
+### 2026-10-16 RemoteXPC HID toolchain correction
+
+The paired iPhone 17 (iOS 27.0.1) accepted JD launch and screenshot observation, but the Unicode search path failed at `pasteboard_set_text` with `IncompleteReadError: 0 bytes read on a total of 9 expected bytes`. The input ledger marked the clipboard write as dispatched, so the failed input was not replayed.
+
+The existing worker correctly uses a single pasteboard connection for snapshot, write, and restoration. `pymobiledevice3 10.2.1` numbers consecutive RemoteXPC reply-bearing requests incorrectly; inspecting `11.24.0` establishes an odd-message-ID correction and the required HID/pasteboard exports are compatible. Pin the single Controller-owned toolchain to `11.24.0` rather than adding a second transport or local protocol workaround. Offline verification of this candidate does not constitute live iPhone Unicode input acceptance or authorize runtime activation.
+
+### Unified Computer ingress (2026-10-16)
+
+Physical CoreDevice action descriptors, scopes and exact-phone authorization are exposed through the existing `computer` plugin. They delegate to the unchanged `ios-physical-device` executor and Controller-global UDID lock. The `ios` plugin retains iOS development, Simulator, and explicit agent-device/XCTest actions but no longer advertises CoreDevice app actions; the old `executeIosPluginAction` direct physical-device dispatch is retired and fails before any CoreDevice effect. The public typed action route remains `plugin_action_execute`; this introduces no second device provider, transport, session store, or replay authority. Existing `ios-device` interaction identity and target verification are unchanged.
+
+### Physical foreground drift witnessed during source acceptance
+
+A source-side JD acceptance opened and observed the correct iPhone App through `computer` and the existing CoreDevice provider, but a later script captured a *new, unreviewed* screenshot and applied coordinates derived from an earlier JD image. The device foreground had meanwhile changed to the user's ChatGPT App. The observed tap succeeded against that other App, so **fresh observation IDs alone are not foreground identity proof**. The root control failure also existed in `physical_device_batch`, where supplying `observation_id` bypassed explicit foreground confirmation; this path now fails closed until `physical_device_confirm_foreground` has bound the same observation and bundle. The session was closed by exact interaction ID and its global device lock was released; no further text input was sent. Do not replay the tap. The next app-specific attempt must separate model-reviewed observation from mutation, use the established `physical_device_confirm_foreground` authority for in-app gestures, and abort if user foreground changes. The live 11.24.0 HID tap is verified, but Unicode clipboard input, shopping SKU prices and personal medical document export are not. Standalone smoke tests must stop their retained HID worker, or their process can time out despite completing the CoreDevice open and screenshot.
+
+### Explicitly approved app-document access
+
+The Computer plugin exposes CoreDevice app-document filenames and single-file exports only for the exact owned iPhone/app interaction, with independent strong confirmations. CoreDevice `appDataContainer/Documents` is not universal iPhone Files, iCloud or hospital data access. Exports are bounded private Controller artifacts verified by size and SHA-256, with no additional transport, writer, cloud upload or deletion. Actual medical documents remain unverified until the device is connected, consent is supplied and file evidence succeeds.
+
 ## Existing module migration map
 
 `KEEP` means the responsibility stays in Forge. `MOVE` means the responsibility belongs in the independent `ios-device` provider. `REWRITE` means the current in-process module is useful evidence/behavior but is not itself the final service boundary. `DELETE` is conditional on the stated removal criterion.

package/docs/architecture/decisions/20260918-stable-candidate-release-lifecycle.md

@@ -133,7 +133,19 @@ from isolated B. `cutover_eligible` is impossible while A and B collide on Home
 or port. Before the first production activation, a transient failure to obtain a
 fresh Stable A verification leaves the same ReleaseSession `cutover_eligible` so
 the exact candidate can be retried after observation recovers; proven Stable A
-identity drift is a real precondition failure. `cutover_attempting` permits
+identity drift is a real precondition failure. After those exact pre-cutover
+checks and immutable Candidate promotion, Recovery may arm a bounded mechanical
+drain marker in the existing Package Connector service root. The marker is tied
+to the exact serving Stable A Connector generation (`releaseId`, `installedAt`,
+and endpoint) plus the Recovery owner lifetime; that generation rejects new MCP
+POST/stream admission with retryable 503 while already-admitted responses,
+initialization and the existing session-idle window drain. The zero-active
+request/stream gate is unchanged. A Candidate or rollback Connector rebind
+changes the service generation before strict MCP verification, so the
+replacement process is not trapped behind the predecessor marker. Recovery
+clears the marker on every cutover exit; owner-liveness and TTL checks bound any
+orphaned marker. This marker is transport fencing only, not ReleaseSession
+state, release intent or another lifecycle owner. `cutover_attempting` permits
 exactly one fenced production cutover; verified return to exact A terminalizes
 `rolled_back` and is never retried. If observation is interrupted after the
 rollback authority commit but before the ReleaseSession phase write,
@@ -194,7 +206,7 @@ summaries, never tokens, raw database payloads or browser messages.
 | known-good bundle | Standalone Recovery | bounded live attestations; prune only after state commit | validate release + DB + service contract offline |
 | RuntimeReleaseAuthority | Runtime Root physical release store | schema 2; active/previous release identity and previous SQLite backup only | physical publish/rollback; no release-phase or transaction intent |
 | ReleaseSession | Release domain / stateless ReleaseCoordinator | wire schema 1 + current semantic epoch 2; `known_good`, `rolled_back`, `failed`; bounded session retention is physical cleanup | revision CAS resumes the same session; Recovery provider executes physical effects |
-| Candidate B Home | ReleaseSession semantic authority / Recovery physical provider | explicit terminal cleanup only after evidence retention | no deletion/rebuild of A; B can be inspected independently |
+| Candidate B Home | ReleaseSession semantic authority / Recovery physical provider | explicit retired cleanup after evidence retention; soaking and terminal sessions are physically reclaimable only after candidate owner quiescence | no deletion/rebuild of A; B can be inspected independently |
 | Process Runtime terminal lease | Process Runtime lease authority | terminal evidence and lease release are separate idempotent phases | terminal observation/wait/cancel and full maintenance retry exact lease release until settled |
 
 All bundle and session data is local Controller state. It contains no secrets:
@@ -218,4 +230,5 @@ the service contract records a token *path*, while each B token is an independen
 - no-op automatic reconciliation does not fork a Recovery worker, and terminal source revisions are not autonomously replayed;
 - definitive runaway-CPU rejection restores Stable A through the existing ReleaseSession rollback authority rather than repeating soak measurement;
 - terminal Process observation and full maintenance both reconcile any exact leftover workspace lease; `completed_unknown` cannot permanently fence a checkout;
+- periodic Runtime maintenance is the production retention caller; its rotating removal phase reaches release history without starving the other cleanup classes, while committed Runtime authority protects active/previous release trees, the serving Connector release and the previous rollback SQLite backup; historical known-good evidence alone does not pin release trees;
 - final live release testing remains a separate, one-shot governed operation.

package/docs/architecture/decisions/20260924-thin-semantic-working-context.md

@@ -26,7 +26,9 @@ No Runtime/Recovery release transition is part of this decision.
 
 ## Thin capability substrate consolidation (2026-09-24)
 
-### 0. Execution target and host-local command lane (2026-09-26, Slice 2 partial)
+### 0. Execution target and host-local command lane (historical 2026-09-26 Slice 2)
+
+**Command entrypoints superseded on 2026-10-15 by `1861b541d`.** The only model-visible general terminal tool is `execute_command`, defaulting to repository/workspace placement with explicit `scope=host` subject to the original `process:exec` Grant. `dry_run=true` replaces separate preview; process lifecycle tools attach to handles. The old `repository_command_execute`, `process_exec`, `work_execute`, `repository_command_preview` and the `local_system` generic command action are no longer public. The bullets below record the historical slice, **not current tool-selection guidance**. Canonical entry and gates: `adapters/mcp/tool-mapping/repository-tools.ts`, `adapters/mcp/server.ts`, `adapters/mcp/toolset-names.ts`, `scripts/check-runtime-architecture.mjs`.
 
 - `ProcessScope` is the canonical Process/Operation storage scope. Repository placement is optional context; the ForgeInstance scope is a sibling partition (`<controllerHome>/instance`) so a non-repository process never needs a synthetic repository identity.
 - The Process Runtime owns an instance-level handle index (`process_handle_index`) recording processId -> target (`forge_instance` | `repository`) -> principal. Attachment resolves its target from the handle, never by scanning repositories or replaying placement inputs.
@@ -39,7 +41,7 @@ No Runtime/Recovery release transition is part of this decision.
 - Done — semantic storage identity (Slice 1 remainder): Requirement was already ForgeInstance-scoped (`scope: 'controller'`). Plan is repository-optional: `PlanContract.repoId` (and its revision/summary/input carriers) is optional provenance, `PlanContractStoreLocation` accepts a portable `scopeKey` (`semantic` is the reserved ForgeInstance scope, mirroring the workspace/instance partitions), and `plan_create` with zero enabled repositories creates the Plan in that scope — one repository stays authoritative, several keep the explicit ambiguity error. Plan and Work were already resolvable by stable id across scopes without a repository (`findControlPlaneRecordsByKey`). Work remains repository-bound on purpose: its execution semantics (WorkHandle, leases, checkout/delivery) have no meaning without a target, so its `repoId` is not a fake identity. `rh_status` is now instance-scoped: with zero or several repositories the summary resolves no repository target, reports `repositoryContext: null`, keeps runtime/tool-surface/source-coherence readiness, lists active Plans from the semantic scope, reports Work/handoff sections as unavailable rather than inventing a repository, downgrades `detail_level: detail` to the instance summary (reporting `requestedDetailLevel`), and fails closed with `REPOSITORY_CONTEXT_REQUIRED_FOR_REPAIR`/`..._FOR_DETAIL` only where repository context is genuinely required. `rh_inbox` (legacy Handoff) stays repository-scoped until Slice 7 replaces it with UserRequest.
 - Done — ephemeral workspace scope and typed command target: `workspace_*` is a reserved workspace scope key (`controller-home.ts` `WORKSPACE_SCOPE_PREFIX`/`scopedOperationRoot`). An arbitrary workspace is now a `RepositoryCommandScopeTarget` (`workspaceScopeKey` + root + workspace checkout coordinate) instead of a fabricated `RepositoryRecord`; `resolveEphemeralWorkspaceTarget` no longer builds a repository record. Process/Operation records, lightweight receipts, logs, GC, handle-index targets, command audit, git-command audit, access policy, approval requests, work-handle mirrors and execution leases for a workspace target live in `<controllerHome>/workspaces/<workspaceId>`, and attachment resolves by handle or by the workspace id. Repository and `__controller__` scopes keep their established roots and payload fields byte-for-byte; repository-semantic checks (bound-session mutation, default-branch delivery, work-handle authority, `repositoryGitStatus`) now run only when a repository target exists. Workspace preview/execute payloads report `scopeId` + `workspace` and never a `repoId`. Bounded read-only fallbacks still resolve facts written to the old repository location (process records, lightweight receipts, access policy, approval requests). Residual: `ResolvedExecutionIdentity.repositoryId` still carries the workspace scope key as its required field name, and the controller lock scope key for a workspace is still spelled `{ scope: 'repository', repoId }`; both are naming/typing debt rather than repository identity or repository storage. Repository-semantic behavior for a workspace target (mutation authority, delivery guards) is now explicitly "not applicable" rather than evaluated against a fabricated repository.
 - Open obligation — Grant target matching: exact matching with explicit wildcard only is blocked by `PluginCapabilityAuthorizationGrant.repoId` and `target.identityFingerprint` being optional while plugin queries always normalize `repoId`. Making matching exact requires migrating the stored plugin grants and the query normalization together; tightening only `grant-store.ts` would deny live plugin capabilities.
-- Still open in this slice: generalizing the durable Process/result/artifact/evidence stores to domain-handle scope, making `repository_command_execute` a translation-only facade over the host lane, and the instance-scoped recovery *apply* split (its audit record and several repository-repair actions still require RepositoryContext).
+- Historical remaining items: generalizing durable Process/result/artifact/evidence stores to domain-handle scope and the instance-scoped recovery *apply* split (its audit record and several repository-repair actions still require RepositoryContext). The earlier `repository_command_execute` facade proposal was retired rather than preserved as another execution layer; the single `execute_command` uses the existing Process Runtime.
 
 ### 1. Mode-free capability surface
 - Capabilities (`read`, `search`, `edit`, `command`, `process`, `git`, `workspace`, `browser`, `computer`, `plugin`, `API`, `agent`, `schedule`, `release`, `recovery`) remain domain-shaped public capabilities and compose without mandatory Requirement, Plan, Work, task-size thresholds, or mode tokens.

package/docs/architecture/decisions/20261001-supervisor-turn-authority.md

@@ -9,6 +9,8 @@ monitors its exact provider effect, commits the model's structured receipt, and
 reserves the next fixed prompt for CONTINUE. DONE and NEEDS_USER retain their
 configured semantic validators; STOPPED remains explicit operator authority.
 
+The Supervisor Effect prompt carries immutable task identity, outcome objective and terminal receipt; it is not a per-turn checklist, execution-time budget, or reason to perform a status probe before work. Ordinary CONTINUE turns should resume substantive work for as long as safe, useful actions remain. A terminal C receipt is a protocol acknowledgment, not evidence of productive progress; observed tool calls and deliverables are separate evidence. JSON metadata and Project instructions do not grant a missing ChatGPT App capability.
+
 The first Work-bound enrollment still requires authenticated launcher admission,
 canonical Work lookup and a prepared ControllerRound. Before consulting that lower
 admission gate, the Runtime checks whether the exact conversation already has a
@@ -50,7 +52,7 @@ orphan deletion, a new relay index, or a second cleanup lifecycle.
 | Evidence / privacy | Existing causal completion hashes, allowlisted provider evidence and redaction; no page-body persistence added. |
 | Capacity / time / performance | Existing send lane, bounded scanner and observation budgets. Provider-wide inventory/backpressure may delay the consumer globally; exact-conversation target failures are task-local and cannot back off unrelated Supervisor tasks. |
 | Topology / portability | Same in-process Runtime/Supervisor owner and native Browser adapter; no process, credential flow or platform dependency added. |
-| Release / rollback | ReleaseSession verifies isolated Candidate B, then cutover retains rollback authority during soak. The new Stable release cannot become known-good until the Supervisor ledger proves exact-active-release CONTINUE → CONTINUE → DONE across a Runtime reconnect. No component activation or manual live database repair. |
+| Release / rollback | ReleaseSession verifies isolated Candidate B, then cutover retains rollback authority during soak. The new Stable release cannot become known-good until the canonical Supervisor ledger proves a causal CONTINUE → CONTINUE → DONE on the exact active release: one dispatch and applied receipt per source effect, terminal_done after the third assistant_completion, and at least two Runtime incarnations. A bounded disposable acceptance task supplies this proof; long-running production Work need not terminate. Historical receipts before the active-release boundary never qualify. No component activation or manual live database repair. |
 
 ## Predecessor obligations
 
@@ -116,6 +118,29 @@ DONE, NEEDS_USER and explicit STOPPED retire owned resources; after restart the
 same owner reconstructs ownership from exact task identity and window.name.
 An adopted user tab loses only the Supervisor marker and stays open.
 
+An operator-STOPPED bootstrap may have written an entire machine-authored effect to a
+Project composer without clicking Send. A subsequent bootstrap for that **same Project**
+may replace the residue only if the canonical Supervisor ledger proves the prior task is
+STOPPED, the prior effect has zero dispatch generations, and its last pre-Send failure
+durably attests that exact, single visible editor (classification=current_effect,
+send_clicked=false, matching full text length and SHA-256 fingerprint). The permitted editor payload must either match the canonical
+immutable effect bytes exactly or match that persisted pre-Send observation's
+full length and fingerprint exactly. This dual exact check handles a corrected
+ProseMirror reader that no longer synthesizes layout newlines inside auto-linked
+URLs, without ignoring any other whitespace or allowing arbitrary human edits.
+New observations reconstruct text from the direct ProseMirror paragraphs' text
+nodes rather than CSS-rendered layout text. The sole Chrome extension
+rechecks the stopped effect marker and a fresh exact editor fingerprint immediately
+before its prepare-only replacement. If ChatGPT hydrates this exact STOPPED-owned draft
+after the first bootstrap snapshot, the same pinned Computer target may obtain
+one fresh read-only observation following a `composer_not_empty` prepare refusal
+and attempt exactly one guarded second **prepare**, still before any Send
+generation. Unknown mutation, foreign text or missing precise evidence remain
+blocked; no task, effect or provider is duplicated. This grants no replay or
+new provider authority. Ambiguous/applied/possibly-sent effects, user or foreign drafts,
+and a generating assistant always fail closed. A successful prepare still requires the
+normal exact-effect Send and completion checks; never count typing as delivery.
+
 When delivery or read-only observation is due, complete supported-browser
 inventory must prove the exact enrolled conversation absent before the owner
 opens its persisted conversation URL. An unreadable inventory, foreign owner,
@@ -215,9 +240,25 @@ Newly rendered Supervisor prompts use the typed outer automation metadata alread
 present on Forge tools: exact `automation_task_id`,
 `automation_type=autonomous_continuation`, and `automation_status`. Intermediate
 calls use `working`; the final Forge call for the turn uses `continue`, `done` or
-`needs_user`. Receipt processing still derives the exact source effect from the
-canonical Supervisor task and reserves the successor transactionally; tool payloads
-do not choose another task/effect/conversation. The historical
+`needs_user`. The provider-facing continuation is intentionally close to a
+human "continue working" request: the model reads the previous result and
+live project evidence, chooses useful actions and keeps executing while meaningful
+authorized work remains. It does not prescribe an existing Work, checkout,
+sequence or phase as a mandatory path, nor treat one successful check or tool
+call as completion. Parallel user and autonomous efforts may share an outcome
+without sharing a Work; models assess ownership and live source evidence,
+while Forge enforces mechanical writer/resource boundaries at execution. The
+prompt discourages repeated status-only rounds and requests actual results and
+remaining gaps. This is model guidance, not a semantic scoring gate, new state
+store or second Work/progress authority. An `automation:*` or `receipt:*` causal checkpoint
+is retained in the durable completion ledger but omitted from model-facing
+`continuity.summary`: it is a transport reference, not an engineering handoff.
+Meaningful non-receipt checkpoints and recovery/correction reasons remain
+bounded advisory context. No elapsed-time quota, forced operation count,
+semantic scoring gate, extra state store, or new lifecycle authority is added.
+Receipt processing still derives the exact source effect from the canonical
+Supervisor task and reserves the successor transactionally; tool payloads do
+not choose another task/effect/conversation. The historical
 `rh_work repair` / `automation.receipt:*` parser remains a bounded migration reader
 only for prompts already issued before cutover and must not be used by new prompt
 producers or become a second replay authority.
@@ -235,3 +276,67 @@ scenarios. Whole-Runtime activation follows canonical gates; actual productive
 successive turns remain separate live acceptance evidence. Original exhausted
 records are preserved and may only receive the existing explicit operator
 recovery after the exact provider turn is proven settled or failed.
+
+## Chrome attachment continuity (20261015)
+
+Computer owns browser/profile selection and tab attachments. The extension keeps
+one random provider instance id in `chrome.storage.local`, scoped by Chrome to
+that extension/profile. Worker suspension, extension reload and browser restart
+therefore preserve profile identity. The id is removed on extension uninstall;
+there is no task/effect state, credential, URL, or conversation content in this
+cache. The existing Computer Controller authority remains the only durable
+attachment writer. The extension owns only this constant-size transport identity,
+requires the standard storage permission and grants no new host access. Discovery
+and target-command heartbeats derive their source identity from this same
+persisted profile id; a worker restart must not orphan discovery or change
+the physical-tab binding. See the
+[Chrome storage contract](https://developer.chrome.com/docs/extensions/reference/api/storage#storage_areas).
+
+The native Browser primitive treats Runtime's process lookup as liveness
+only. Desktop Operator exclusively establishes exact Chrome GUI PID and Tab ID
+authority through ScriptingBridge and revalidates bundle/executable identity.
+Independent headless Chrome roots may coexist; zero or multiple GUI roots fail
+closed in Desktop Operator before Apple Events. Runtime must not re-implement
+process selection by counting every pgrep match or fall back to another
+provider.
+
+A missing pinned profile stays unavailable even when another profile is the sole
+live provider. Within the same profile, Chrome tab id takes precedence over
+window id so moving a tab between windows preserves attachment. An existing pin
+at another conversation URL is identity drift. Only a positive Chrome tab-missing
+result permits recovery through complete exact-conversation inventory: reuse the
+unique existing conversation tab, or reopen the persisted conversation URL when
+absent. This preserves the existing disposable-resource restoration rule without
+creating a new ChatGPT conversation. Ambiguous matches and unreadable inventory
+remain unresolved; they do not authorize profile replacement or another tab.
+Bootstrap recovery still requires the same live provider's positive missing-tab
+proof and the existing Computer binding CAS.
+
+Tab creation and conversation hydration are separate outcomes. An ensure failure
+may return its exact physical attachment alongside the error. The existing
+Computer surface lease stores that attachment before reporting failure; page
+readiness and Send remain unavailable. A subsequent worker uses that binding
+instead of creating another Project tab. Claimed commands without a result stay
+unknown and cannot authorize provider fallback or another tab creation. The
+optional failure binding is backward compatible; only updated extensions supply
+it. No database schema, lifecycle, process, retry budget, external send, or second
+writer is added. Existing leases, redacted receipts, task terminalization,
+tombstone retention, backpressure and unknown-effect fences remain. Complete
+Runtime release/rollback includes the adapter contract and matching extension.
+
+Incident evidence: read-only Runtime calls on 2026-10-15 observed 188 historical
+Supervisor tasks and zero active tasks; recent retrieved acceptance tasks were
+terminal. That inventory is not evidence of current autonomous sends. Computer
+reported 227 saved records, 221 unverified and six dead native records; metadata
+is not proof of a live tab. Existing discovery stays observation-only and never
+enrolls historical conversations. A source reproduction combined unavailable
+content scripts with worker restart: the old code changed instance id, returned
+no binding, and created two tabs for one bootstrap key. The candidate retained
+one instance and returned the failed page's binding, keeping one tab and sending
+nothing. A separate Controller probe verified failed-binding persistence, broker
+restart reuse and no commands to a foreign profile. These are bounded adapter
+facts; live release acceptance remains separate.
+
+### Live Chrome content contract at Bootstrap
+
+A projected Chrome extension on disk is not evidence that an existing Chrome tab has loaded the same content script. Before Supervisor consumes an exact, single-use authorization to back up and replace an unrelated Project composer draft, the actual pinned tab must attest `composerReplacementContract=exact-backed-up-project-draft-v1` in its read-only snapshot. An absent attestation is a task-local `COMPUTER_CHATGPT_BOOTSTRAP_LOADED_SCRIPT_STALE` pre-send failure, not permission to clear the editor, switch providers, create a replacement tab, or record Send. The Chrome background independently checks this exact-tab capability when preparing a guarded draft replacement. The original draft and one-use authorization remain intact when the loaded script is stale; after reloading the extension, the original unspent effect may be rearmed only within its existing bounded operator-retry contract. Projection checks and MCP health cannot substitute for this live evidence. Final release acceptance still requires independent actual multi-turn work to DONE.

package/docs/architecture/decisions/20261009-exact-code-context-discovery.md

@@ -0,0 +1,19 @@
+# Exact code-symbol discovery within bounded Context retrieval
+
+`docs/architecture/CURRENT.md` remains the sole architecture authority. This note records a focused Context Plane implementation decision and test contract; it adds no store, cache, result state, or secondary search authority.
+
+## Observed defect
+
+A request containing two exact source symbols could split them into common word fragments or treat both as one literal query. Early broad matches then filled the candidate window and prevented later exact hits from entering. Separately, the Git inventory's alphabetic first-800-file cap made files beyond that prefix unsearchable by the lexical pass. Increasing the scan cap would add disk/CPU cost without fixing symbol priority.
+
+## Existing-authority correction
+
+- Parse explicit code-shaped tokens into independent bounded exact queries. Preserve caller-provided ordinary literal phrases (`return 42`) as search queries as well. Keep camel-case fragments as nonbinding discovery hints, not mandatory matches.
+- Preserve later exact hits when broad candidate capacity is reached, and reserve the highest-ranked candidate for each matched exact symbol before ordinary ranked results.
+- Use Git's read-only tracked-file grep only to **prioritize candidate paths** when the inventory exceeds the existing scan cap. The original policy-checked repository source matcher validates each file and enforces exact identifier boundaries. Git grep supplies no policy, semantic completion, persistence, or source identity authority.
+- Apply equivalent search admission and cache identity in synchronous and asynchronous Context paths. Neither path increases the existing actual-file scan cap or accepts forbidden paths from Git hints.
+- Context results remain bounded evidence, not completeness proof. Git hints may omit untracked files and max-files/snippet caps still apply; explicit known paths and progressively narrowed source requests remain the existing precise retrieval surfaces.
+
+## Verification
+
+Regression fixtures place two complete symbol declarations after more than 800 broad distractors, with multiple longer-prefix false positives. Both synchronous and asynchronous Context materialization must select the two exact target files and inspect fewer than 30 candidate source files. Process Runtime timeout observations independently release monitor waiters and abort listeners, with no post-timeout cancellation of a live command.

package/docs/architecture/decisions/20261009-generated-xcode-cache-retention.md

@@ -0,0 +1,37 @@
+# Checkout-local Xcode cache reuse and reclamation
+
+Status: accepted contract for the storage repair candidate; activation is a separate complete Runtime release decision.
+Evidence: local 2026-10-09 disk audit reclaimed 60.39 GiB of generated Xcode subdirectories across 384 directories; issue #194 records the bounded-retention gap.
+
+## Root causes and decision
+
+The existing iOS producer already used stable build buckets, but the key included device identity and tests used a separate scheme-only bucket. Build and test now reuse the same checkout-local container/scheme/configuration/platform bucket. Simulator identities, test selectors and invocation timestamps do not create another cache. Device and simulator platforms and configurations remain separate; Xcode owns source, SDK and toolchain invalidation. Cross-checkout mutable DerivedData sharing is forbidden because absolute paths and concurrent writers differ.
+
+The existing Runtime maintenance owner reclaims generated caches on its five-minute retention cadence, with one repository and the existing 1,000-entry/eight-removal budget per pass. Repository, checkout, namespace and nested directory rotations consume independent visit ordinals; a global sequence must not couple these selection layers.
+
+Discovery uses Xcode's info.plist plus known rebuildable directories, including arbitrary preview bucket names under existing owned namespaces. Reclamation deletes only Build, ModuleCache.noindex, Index.noindex, CompilationCache.noindex, SDKExplicitPrecompiledModules and SDKStatCaches.noindex. Logs, result bundles, SourcePackages, metadata, unknown contents and tracked content remain. This replaces the unsafe whole-DerivedData deletion contract.
+
+## Cross-cutting closure
+
+| Area | Owner and behavior |
+| --- | --- |
+| Identity / scope | Existing repository registry and active managed checkouts; existing .forge/ios, .ai/harness, .repo-harness and .tmp namespaces only. A cache name alone is not ownership or disposable-content proof. |
+| Authority / trust | Existing Runtime maintenance write claim and explicit full-maintenance action. No new daemon, registry, schema, credential or permission authority. Symlink ancestors and unprovable Git/process inventory stop deletion. |
+| Concurrency / fencing | Existing plugin workspace claims serialize canonical build/test operations. Maintenance protects processes referencing the cache and conservatively protects checkout-scoped or unscoped xcodebuild commands. Producer refreshes bucket last-use before and after execution; six-hour periodic grace remains. External shell activity is observable process evidence, not a Forge lease; this is conservative protection rather than a transactional filesystem lock. |
+| Lifecycle / retention | Reusable cache lives within its checkout. Rebuildable children expire after idle grace and are regenerated by Xcode. Source checkout and evidence lifecycle remain separate. Missing process inventory yields a bounded diagnostic and no reclamation. |
+| Persistence / integrity / recovery | No database migration. Deleting disposable children is idempotent; interrupted passes leave a valid surviving bucket for the next scan/build. Existing source, Git, dependency and evidence backups retain their owners. |
+| Evidence / privacy | Existing cleanup reports record removed paths, protection reasons and budget exhaustion; no source, credential or process text persistence added. Result bundles use the existing collision-resistant artifact stamp. |
+| Capacity / time / performance | Stable keys reduce cache production. Existing bounded scan/removal budgets protect scheduler latency; rotation prevents protected early entries from permanently starving later directories. Grace uses the newer bucket/child mtime and completed reuse refreshes last-use. This is idle reclamation, not a hard global disk quota. |
+| Topology / portability / release | Same in-process Runtime maintenance owner; no additional process. iOS commands remain Darwin-only. Deploy/rollback is the complete Runtime release under existing authority; source delivery alone does not activate the fix. |
+
+## Preserved and deferred boundaries
+
+KEEP existing bounded budgets, active-process protection, Git ownership checks, evidence retention and complete Runtime rollback.
+CHANGE whole-directory deletion to typed disposable children; cache key to compatible build/test reuse; correlated/deep-only cache scheduling to independent five-minute rotation.
+DEFER relocating existing iOS build caches into Controller Home: install/build product paths and checkout fencing need one coherent owner migration. This candidate creates no additional cache root and does not duplicate or copy legacy buckets.
+DEFER arbitrary external /private/tmp builds and third-party caches: neither naming nor age grants Forge deletion ownership. Use the canonical build/test producer for managed builds; manual external runs should reuse an explicit per-checkout cache and remove it at their own terminal boundary.
+DEFER cloud transfer of cold recovery bundles until verified upload/restore and local-retention authority exist. Rebuildable caches are not cloud backup data.
+
+## Verification
+
+Extend retained iOS producer and generated-cache safety scenarios; do not add tests during Kernel V2 suite freeze. Verify cache reuse across simulators/build/test, platform/configuration separation, unique result bundles, arbitrary-name recognition, nested evidence/dependency preservation and independent rotation. Run affected type and repository/architecture checks before source delivery.