@moretea-labs/forge 1.8.1 → 1.8.2

package/packages/kernel/controller/infrastructure/controller-session-store.ts

@@ -746,45 +746,70 @@ export function bindControllerSessionToCurrentRuntime(
   },
 ): ControllerSession {
   assertIdentity(input);
-  const current = getControllerSession(options, input.workId);
-  if (!current) {
-    if (input.allowClaimIfMissing !== true) throw new Error(`WORK_CONTROLLER_OWNER_REQUIRED: ${input.workId}`);
-    return claimControllerSession(options, { ...input, expectedClaimGeneration: 0 });
-  }
-  const currentPrincipal = controllerSessionPrincipalId(current);
-  if (current.controllerId !== input.controllerId) {
-    throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${input.workId} is owned by ${current.controllerId}`);
-  }
-  if (current.controllerType !== input.controllerType) {
-    throw new Error(`WORK_CONTROLLER_TYPE_MISMATCH: ${input.workId} is owned by ${current.controllerType}`);
-  }
-  if (currentPrincipal !== input.principalId.trim()) {
-    throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${input.workId}`);
-  }
-  const ownerInstanceId = current.controllerInstanceId?.trim() || '';
   const requestedInstanceId = input.controllerInstanceId.trim();
-  if (ownerInstanceId !== requestedInstanceId) {
-    const currentRuntimeInstanceId = input.currentRuntimeInstanceId?.trim() || '';
-    if (!currentRuntimeInstanceId || currentRuntimeInstanceId !== requestedInstanceId) {
-      throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${input.workId}`);
-    }
-  }
-  const requestedAuthorityDigest = input.authorityDigest?.trim() || '';
-  const currentAuthorityDigest = current.authorityDigest?.trim() || '';
-  if (
-    ownerInstanceId === requestedInstanceId
-    && current.sessionId === input.sessionId
-    && (!requestedAuthorityDigest || requestedAuthorityDigest === currentAuthorityDigest)
-  ) return current;
-  // The opaque Work capability belongs to durable ownership, not to one
-  // transport or Runtime process. A positively-current Runtime migration keeps
-  // the same digest while claim generation fences the new controller epoch.
-  const preservedAuthorityDigest = input.authorityDigest?.trim() || current.authorityDigest?.trim() || undefined;
-  return resumeControllerSession(options, {
-    ...input,
-    ...(preservedAuthorityDigest ? { authorityDigest: preservedAuthorityDigest } : {}),
-    expectedClaimGeneration: current.claimGeneration,
-  });
+  const currentRuntimeInstanceId = input.currentRuntimeInstanceId?.trim() || '';
+  return withControllerSessionMutationLock(
+    options,
+    input.workId,
+    `controller-bind-current-runtime:${input.controllerId}:${input.sessionId}`,
+    () => {
+      assertControllerWorkClaimable(options, input.workId);
+      const store = read(options);
+      const current = activeSession(store, input.workId, optionsNowMs(options));
+      const retained = current ? undefined : getRetainedControllerSession(options, input.workId);
+      const retainedMatchesIdentity = Boolean(
+        retained
+        && retained.controllerId === input.controllerId
+        && retained.controllerType === input.controllerType
+        && controllerSessionPrincipalId(retained) === input.principalId.trim(),
+      );
+      const previous = current ?? (input.allowClaimIfMissing === true && retainedMatchesIdentity ? retained : undefined);
+
+      if (!current && !previous && input.allowClaimIfMissing !== true) {
+        throw new Error(`WORK_CONTROLLER_OWNER_REQUIRED: ${input.workId}`);
+      }
+      if (!current && retainedMatchesIdentity) {
+        if (!currentRuntimeInstanceId || currentRuntimeInstanceId !== requestedInstanceId) {
+          throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${input.workId}`);
+        }
+      }
+
+      if (current) {
+        const currentPrincipal = controllerSessionPrincipalId(current);
+        if (current.controllerId !== input.controllerId) {
+          throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${input.workId} is owned by ${current.controllerId}`);
+        }
+        if (current.controllerType !== input.controllerType) {
+          throw new Error(`WORK_CONTROLLER_TYPE_MISMATCH: ${input.workId} is owned by ${current.controllerType}`);
+        }
+        if (currentPrincipal !== input.principalId.trim()) {
+          throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${input.workId}`);
+        }
+        const ownerInstanceId = current.controllerInstanceId?.trim() || '';
+        if (ownerInstanceId !== requestedInstanceId) {
+          if (!currentRuntimeInstanceId || currentRuntimeInstanceId !== requestedInstanceId) {
+            throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${input.workId}`);
+          }
+        }
+        const requestedAuthorityDigest = input.authorityDigest?.trim() || '';
+        const currentAuthorityDigest = current.authorityDigest?.trim() || '';
+        if (
+          ownerInstanceId === requestedInstanceId
+          && current.sessionId === input.sessionId
+          && (!requestedAuthorityDigest || requestedAuthorityDigest === currentAuthorityDigest)
+        ) return current;
+      }
+
+      // The opaque Work capability belongs to durable ownership, not to one
+      // transport or Runtime process. A positively-current Runtime migration keeps
+      // the same digest while claim generation fences the new controller epoch.
+      const preservedAuthorityDigest = input.authorityDigest?.trim() || previous?.authorityDigest?.trim() || undefined;
+      return persistClaim(options, store, {
+        ...input,
+        ...(preservedAuthorityDigest ? { authorityDigest: preservedAuthorityDigest } : {}),
+      }, previous);
+    },
+  );
 }
 
 export function releaseControllerSession(options: ControllerSessionStoreOptions, workId: string, controllerId: string): void {

package/packages/kernel/identity/infrastructure/activity-projection-store.ts

@@ -36,6 +36,16 @@ export function recordDirectActivity(
   return item;
 }
 
+/** Read one existing activity by its stable identity, independent of list-window truncation. */
+export function getDirectActivity(controllerHome: string, activityId: string): CapabilityActivityItem | undefined {
+  try {
+    const item = JSON.parse(readFileSync(activityFilePath(controllerHome, activityId), 'utf8')) as CapabilityActivityItem;
+    return item.activityId === activityId ? item : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export function listDirectActivities(controllerHome: string, limit = 50): CapabilityActivityItem[] {
   const dir = activityDir(controllerHome);
   const files = readdirSync(dir).filter((f) => f.endsWith('.json'));

package/packages/kernel/scheduler/application/eligibility.ts

@@ -122,7 +122,10 @@ function cronFieldMatches(value: number, field: string, min: number, max: number
     const trimmed = part.trim();
     if (trimmed === '*') return true;
     const stepMatch = trimmed.match(/^\*\/(\d+)$/);
-    if (stepMatch) return value % Math.max(1, Number(stepMatch[1])) === 0;
+    if (stepMatch) {
+      const step = Math.max(1, Number(stepMatch[1]));
+      return value >= min && value <= max && (value - min) % step === 0;
+    }
     const rangeMatch = trimmed.match(/^(\d+)-(\d+)(?:\/(\d+))?$/);
     if (rangeMatch) {
       const start = Math.max(min, Number(rangeMatch[1]));

package/packages/kernel/scheduler/infrastructure/schedule-store.ts

@@ -101,9 +101,9 @@ function requestPath(controllerHome: string, targetKey: string, requestId: strin
 export const SCHEDULE_OCCURRENCE_RECENT_LIMIT = 5_000;
 export const SCHEDULE_CREATED_OCCURRENCE_STALE_MS = 5 * 60 * 1_000;
 
-const EXTERNAL_CONTROLLER_WAKE_MAX_FAILURES = 3;
-const EXTERNAL_CONTROLLER_WAKE_DAILY_BUDGET_MINUTES = 60;
-const EXTERNAL_CONTROLLER_WAKE_MIN_COOLDOWN_MINUTES = 10;
+const WORK_CONTINUATION_MAX_FAILURES = 3;
+const WORK_CONTINUATION_DAILY_BUDGET_MINUTES = 60;
+const WORK_CONTINUATION_MIN_COOLDOWN_MINUTES = 10;
 
 function boundedSchedulePolicy(schedule: RepositorySchedule): RepositorySchedule['policy'] {
   const policy = {
@@ -111,17 +111,18 @@ function boundedSchedulePolicy(schedule: RepositorySchedule): RepositorySchedule
     backoffBaseMinutes: Math.max(1, schedule.policy.backoffBaseMinutes ?? schedule.policy.cooldownMinutes ?? 1),
     backoffMaxMinutes: Math.max(1, schedule.policy.backoffMaxMinutes ?? 24 * 60),
   };
-  if (schedule.action.operation !== 'external_controller_wake') return policy;
-  // A Work-bound controller wake is expensive and can affect the user's
+  if (schedule.action.operation !== 'external_controller_wake' && schedule.action.operation !== 'controller_progression') return policy;
+  // A Work-bound continuation is expensive and can affect the user's
   // provider. No schedule payload may convert a transient tool outage into an
   // all-day retry loop. Larger work needs an explicit future user action after
   // the bounded lane records useful failure evidence.
   return {
     ...policy,
-    maxFailures: Math.max(1, Math.min(policy.maxFailures, EXTERNAL_CONTROLLER_WAKE_MAX_FAILURES)),
-    dailyBudgetMinutes: Math.max(1, Math.min(policy.dailyBudgetMinutes, EXTERNAL_CONTROLLER_WAKE_DAILY_BUDGET_MINUTES)),
-    cooldownMinutes: Math.max(policy.cooldownMinutes, EXTERNAL_CONTROLLER_WAKE_MIN_COOLDOWN_MINUTES),
-    backoffBaseMinutes: Math.max(policy.backoffBaseMinutes, EXTERNAL_CONTROLLER_WAKE_MIN_COOLDOWN_MINUTES),
+    maxFailures: Math.max(1, Math.min(policy.maxFailures, WORK_CONTINUATION_MAX_FAILURES)),
+    dailyBudgetMinutes: Math.max(1, Math.min(policy.dailyBudgetMinutes, WORK_CONTINUATION_DAILY_BUDGET_MINUTES)),
+    cooldownMinutes: Math.max(policy.cooldownMinutes, WORK_CONTINUATION_MIN_COOLDOWN_MINUTES),
+    backoffBaseMinutes: Math.max(policy.backoffBaseMinutes, WORK_CONTINUATION_MIN_COOLDOWN_MINUTES),
+    backoffMaxMinutes: Math.max(policy.backoffMaxMinutes, WORK_CONTINUATION_MIN_COOLDOWN_MINUTES, policy.backoffBaseMinutes),
   };
 }
 function canonical(value: unknown): unknown {
@@ -175,7 +176,7 @@ export function createSchedule(controllerHome: string, input: CreateScheduleInpu
       return getSchedule(controllerHome, input.repoId, record.scheduleId);
     }
     const timestamp = new Date().toISOString();
-    const schedule: RepositorySchedule = {
+    const candidate: RepositorySchedule = {
       ...input,
       requestId,
       schemaVersion: 1,
@@ -185,6 +186,7 @@ export function createSchedule(controllerHome: string, input: CreateScheduleInpu
       updatedAt: timestamp,
       consecutiveFailures: 0,
     };
+    const schedule: RepositorySchedule = { ...candidate, policy: boundedSchedulePolicy(candidate) };
     writeJsonAtomic(schedulePath(controllerHome, schedule.repoId, schedule.scheduleId), schedule);
     writeJsonAtomic(requestRecordPath, { schemaVersion: 1, requestId, semanticKey, scheduleId: schedule.scheduleId, repoId: schedule.repoId, createdAt: timestamp } satisfies ScheduleRequestRecord);
     appendRuntimeEvent(controllerHome, { repoId: schedule.repoId, entityType: 'schedule', entityId: schedule.scheduleId, eventType: 'schedule_created', requestId, revision: schedule.revision, data: { name: schedule.name, shadowMode: schedule.policy.shadowMode } });
@@ -228,6 +230,7 @@ function persistScheduleRevision(
     requestId: current.requestId,
     createdAt: current.createdAt,
     updatedAt: new Date().toISOString(),
+    policy: boundedSchedulePolicy(candidate),
   };
   writeJsonAtomic(schedulePath(controllerHome, next.repoId, next.scheduleId), next);
   appendRuntimeEvent(controllerHome, { repoId: next.repoId, entityType: 'schedule', entityId: next.scheduleId, eventType: 'schedule_updated', requestId: next.requestId, revision: next.revision, data: { enabled: next.enabled, pausedReason: next.pausedReason } });

package/packages/kernel/work/application/work-service.ts

@@ -90,6 +90,7 @@ export {
   reviseWorkSemanticContext,
   summarizeWorkContract,
   updateWorkContract,
+  updateWorkContractPlacementAtomically,
   promoteWorkToRepositoryChange,
   recordWorkEvidenceState,
   activateWorkContract,

package/packages/kernel/work/domain/repository-completion-receipt.ts

@@ -55,7 +55,7 @@ export interface RepositoryCompletionReceipt {
   delivery: {
     kind: CompletionReceiptDeliveryKind;
     status: CompletionReceiptDeliveryStatus;
-    strategy: 'edit_session_commit' | 'work_fast_forward' | 'already_integrated' | 'no_change' | 'remote';
+    strategy: 'edit_session_commit' | 'work_fast_forward' | 'work_merge_commit' | 'already_integrated' | 'no_change' | 'remote';
     reachable: boolean;
     recordedAt: string;
   };

package/packages/kernel/work/domain/state-machine.ts

@@ -135,8 +135,15 @@ export function validateWorkSemantics(contract: WorkContract): WorkContract {
   if (outcome === 'completed_changed' && contract.workKind !== 'repository_change') {
     throw new Error('WORK_SEMANTICS_INVALID: completed_changed requires repository_change WorkKind');
   }
-  if (outcome === 'completed_no_change' && !['completed_no_change', 'read_only_review'].includes(contract.workKind)) {
-    throw new Error('WORK_SEMANTICS_INVALID: completed_no_change requires completed_no_change or read_only_review WorkKind');
+  // An empty repository delivery is evidence, not authority to rewrite WorkKind.
+  const emptyRepositoryDelivery = contract.workKind === 'repository_change'
+    && isRepositoryCompletionReceipt(contract.completionReceipt)
+    && contract.completionReceipt.delivery.kind === 'no_change'
+    && contract.completionReceipt.changedPaths.length === 0;
+  if (outcome === 'completed_no_change'
+    && !['completed_no_change', 'read_only_review'].includes(contract.workKind)
+    && !emptyRepositoryDelivery) {
+    throw new Error('WORK_SEMANTICS_INVALID: completed_no_change requires a no-change WorkKind or proven empty repository delivery');
   }
   if (outcome === 'completed_no_change' && contract.workKind === 'read_only_review' && contract.completionReceipt?.source !== 'read_only_review') {
     throw new Error('WORK_SEMANTICS_INVALID: read_only_review completed_no_change requires a read_only_review completion receipt');

package/packages/kernel/work/infrastructure/work-contract-store.ts

@@ -14,6 +14,7 @@ import {
   readControlPlaneRecordWithinTransaction,
   withControlPlaneTransaction,
   writeControlPlaneRecordWithinTransaction,
+  type SqliteDatabase,
 } from '../../../../src/runtime/control-plane/persistence/sqlite-store';
 import {
   MAX_IMPLEMENTATION_REVIEW_HISTORY,
@@ -97,6 +98,8 @@ export type CreateWorkContractInput = Omit<
 export interface ListWorkContractOptions extends WorkContractStoreOptions {
   state?: SemanticWorkState | 'active' | 'all';
   limit?: number;
+  /** Explicit pagination for complete internal historical inventory. */
+  offset?: number;
   detailLevel?: 'summary' | 'detail' | 'raw';
 }
 
@@ -121,6 +124,9 @@ export interface WorkContractLineageSnapshot {
   contracts: WorkContract[];
   invalid: Array<{
     workId: string;
+    requirementId?: string;
+    semanticParentWorkId?: string;
+    dependsOnWorkIds?: string[];
     parentWorkId?: string;
     predecessorWorkId?: string;
     supersedes: string[];
@@ -640,6 +646,9 @@ function lineageInvalidWork(
   const clean = (id: unknown): string | undefined => typeof id === 'string' && id.trim() ? id.trim() : undefined;
   return {
     workId: clean(raw.workId) ?? recordKey ?? '',
+    ...(clean(raw.requirementId) ? { requirementId: clean(raw.requirementId) } : {}),
+    ...(clean(raw.semanticParentWorkId) ? { semanticParentWorkId: clean(raw.semanticParentWorkId) } : {}),
+    dependsOnWorkIds: Array.isArray(raw.dependsOnWorkIds) ? raw.dependsOnWorkIds.map(clean).filter((id): id is string => Boolean(id)) : [],
     ...(clean(raw.parentWorkId) ? { parentWorkId: clean(raw.parentWorkId) } : {}),
     ...(clean(raw.predecessorWorkId) ? { predecessorWorkId: clean(raw.predecessorWorkId) } : {}),
     supersedes: Array.isArray(raw.supersedes) ? raw.supersedes.map(clean).filter((id): id is string => Boolean(id)) : [],
@@ -990,6 +999,8 @@ export function isCurrentWorkContract(contract: WorkContract): boolean {
 export function listWorkContracts(options: ListWorkContractOptions): WorkContract[] {
   const state = options.state ?? 'active';
   const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 50), 100));
+  const offset = Math.max(0, Math.trunc(options.offset ?? 0));
+  if (state === 'active' && offset > 0) throw new Error('WORK_ACTIVE_PAGINATION_UNSUPPORTED');
   if (state === 'active' && sqliteBacked(options)) {
     const active = readActiveWorkCandidates({ ...options, limit });
     if (active.invalid.length > 0) {
@@ -1008,7 +1019,7 @@ export function listWorkContracts(options: ListWorkContractOptions): WorkContrac
       return semanticWorkState(contract) === state;
     })
     .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
-    .slice(0, limit);
+    .slice(offset, offset + limit);
 }
 
 function workExecutionSemanticScopeKeys(contract: WorkContract): string[] {
@@ -1414,6 +1425,7 @@ function updateWorkContractInternal(
   allowLifecycleWrite = false,
   allowImplementationReviewWrite = false,
   allowPhaseRegression = false,
+  atomicPlacementEffect?: (database: SqliteDatabase, contract: WorkContract) => void,
 ): WorkContract {
   return withExactWorkContractWrite(options, workId, () => {
     const authoritativeOptions = authoritativeExistingWorkStoreOptions(options, workId);
@@ -1517,9 +1529,11 @@ function updateWorkContractInternal(
           action: 'work_contract_updated',
           expectedRevision: exact.revision,
         });
+        atomicPlacementEffect?.(database, next);
       });
       return next;
     }
+    if (atomicPlacementEffect) throw new Error('WORK_PLACEMENT_ATOMIC_SQLITE_REQUIRED');
     const contracts = [...store!.contracts];
     contracts[index] = next;
     writeWorkContractStore(authoritativeOptions, { schemaVersion: 4, updatedAt: at, contracts });
@@ -1604,6 +1618,19 @@ export function updateWorkContract(
 ): WorkContract {
   return updateWorkContractInternal(options, workId, patch, false);
 }
+export function updateWorkContractPlacementAtomically(
+  options: WorkContractStoreOptions,
+  workId: string,
+  patch: Pick<WorkContractMetadataPatch, 'checkoutId' | 'worktreeRef' | 'executionPlacement' | 'worktreePolicy'>,
+  effect: (database: SqliteDatabase, contract: WorkContract) => void,
+): WorkContract {
+  // The WorkContract writer remains the sole semantic metadata authority.
+  // An execution WorkHandle is committed inside the same SQLite transaction,
+  // never as a second step that could leave conflicting checkout ownership.
+  return updateWorkContractInternal(options, workId, patch, false, false, false, false, effect);
+}
+
+
 
 /** Explicit execution-classification transition when an open Work begins governed repository mutation. */
 export function promoteWorkToRepositoryChange(

package/packages/plugin-runtime/browser/provider-registry.ts

@@ -6,8 +6,6 @@ import {
 } from './runtime-contract';
 
 export interface BrowserRuntimeProvider<TInput, TResult> extends BrowserProviderCapabilities {
-  /** Lower values are preferred when multiple providers satisfy the same capability contract. */
-  priority: number;
   /** Availability is decided before execution; ordinary provider failures are never fallback signals. */
   supportsInput(input: TInput): boolean;
   execute(input: TInput): Promise<TResult>;
@@ -37,22 +35,6 @@ export class BrowserProviderSelectionError extends Error {
   }
 }
 
-/**
- * A typed pre-action rejection. Runtime may select another provider because this proves the action
- * was not attempted. Arbitrary provider errors are intentionally not mapped to this signal.
- */
-export class BrowserProviderUnavailableBeforeActionError extends Error {
-  readonly providerId: string;
-  readonly reason: string;
-
-  constructor(providerId: string, reason: string) {
-    super(`${providerId} unavailable before action: ${reason}`);
-    this.name = 'BrowserProviderUnavailableBeforeActionError';
-    this.providerId = providerId;
-    this.reason = reason;
-  }
-}
-
 function foregroundCompatible(
   provider: BrowserProviderCapabilities,
   requested: BrowserForegroundRequirement,
@@ -61,24 +43,23 @@ function foregroundCompatible(
 }
 
 export class BrowserProviderRegistry<TInput, TResult> {
-  private readonly providers = new Map<string, BrowserProviderState<TInput, TResult>>();
+  private state?: BrowserProviderState<TInput, TResult>;
 
   register(provider: BrowserRuntimeProvider<TInput, TResult>): void {
-    const current = this.providers.get(provider.providerId);
-    if (current) {
-      current.provider = provider;
+    if (this.state?.provider.providerId === provider.providerId) {
+      this.state.provider = provider;
       return;
     }
-    this.providers.set(provider.providerId, { provider, generation: 1 });
+    // A configuration change replaces the binding; it never accumulates candidates.
+    this.state = { provider, generation: 1 };
   }
 
   invalidate(providerId: string, reason: string): void {
-    const state = this.providers.get(providerId);
-    if (state) state.invalidatedReason = reason;
+    if (this.state?.provider.providerId === providerId) this.state.invalidatedReason = reason;
   }
 
   invalidateAll(reason: string): void {
-    for (const state of this.providers.values()) state.invalidatedReason = reason;
+    if (this.state) this.state.invalidatedReason = reason;
   }
 
   private async prepare(state: BrowserProviderState<TInput, TResult>): Promise<void> {
@@ -92,17 +73,12 @@ export class BrowserProviderRegistry<TInput, TResult> {
     input: TInput;
     requiredCapabilities: readonly BrowserProviderCapability[];
     foreground: BrowserForegroundRequirement;
-    excludedProviderIds?: ReadonlySet<string>;
   }): Promise<BrowserProviderSelection<TInput, TResult>> {
-    const candidates = [...this.providers.values()]
-      .filter(({ provider }) => !options.excludedProviderIds?.has(provider.providerId))
-      .filter(({ provider }) => provider.supportsInput(options.input))
-      .filter(({ provider }) => providerSupports(provider, options.requiredCapabilities))
-      .filter(({ provider }) => foregroundCompatible(provider, options.foreground))
-      .sort((left, right) => left.provider.priority - right.provider.priority
-        || left.provider.providerId.localeCompare(right.provider.providerId));
-
-    const selected = candidates[0];
+    const selected = this.state
+      && this.state.provider.supportsInput(options.input)
+      && providerSupports(this.state.provider, options.requiredCapabilities)
+      && foregroundCompatible(this.state.provider, options.foreground)
+      ? this.state : undefined;
     if (!selected) throw new BrowserProviderSelectionError(options.requiredCapabilities);
     await this.prepare(selected);
     return { provider: selected.provider, generation: selected.generation };

package/packages/plugin-runtime/computer/conversation-target.ts

@@ -22,6 +22,10 @@ export interface ComputerChatgptConversationObservation {
   userMessages?: string[];
   assistantMessages?: string[];
   composerText?: string;
+  /** Read-only content-script selector attestation; undefined on older loaded scripts. */
+  composerSelectorVersion?: 'visible-single-v2';
+  /** Exact loaded content-script contract; file projection/version on disk is not a live browser attestation. */
+  composerReplacementContract?: 'exact-backed-up-project-draft-v1';
   providerActivityText: string;
   providerFailureText: string;
   pageText?: string;
@@ -44,13 +48,13 @@ export interface ComputerChatgptConversationTarget {
   identity: ComputerChatgptTargetIdentity;
   observe(options?: ComputerChatgptConversationObservationOptions): Promise<ComputerChatgptConversationObservation>;
   /** UI-only preparation. Must never click Send or create a provider turn. */
-  prepare(prompt: string, options?: { mode?: 'send' | 'resume' | 'recover'; reasoning?: 'medium' | 'high' | 'xhigh' }): Promise<{ ready: true } | { ready: false; reasonCode: string }>;
+  prepare(prompt: string, options?: { mode?: 'send' | 'resume' | 'recover' }): Promise<{ ready: true } | { ready: false; reasonCode: string }>;
   dispatch(
     prompt: string,
-    options?: { mode?: 'send' | 'resume' | 'recover'; reasoning?: 'medium' | 'high' | 'xhigh' },
+    options?: { mode?: 'send' | 'resume' | 'recover' },
   ): Promise<
     | { mutation: 'not_attempted'; reasonCode: string }
-    | { mutation: 'attempted'; confirmed?: boolean; reasoningVerified?: 'medium' | 'high' | 'xhigh' }
+    | { mutation: 'attempted'; confirmed?: boolean }
   >;
 }
 
@@ -79,7 +83,10 @@ export interface ComputerObservedChatgptConversation {
 
 export interface ComputerChatgptConversationInventory {
   conversations: ComputerObservedChatgptConversation[];
+  /** Full coverage of all supported browser families, not only active providers. */
   complete: boolean;
+  /** At least one provider completed its own inventory; not exact-target/send proof. */
+  providerInventoryReady?: boolean;
   unavailableProviders: string[];
 }
 
@@ -91,7 +98,7 @@ export interface ComputerChatgptConversationInventory {
 export type ComputerChatgptExtensionCommand =
   | { commandId: string; kind: 'ensure'; identity: ComputerChatgptTargetIdentity; providerBinding?: ComputerSurfaceProviderBinding }
   | { commandId: string; kind: 'observe'; identity: ComputerChatgptTargetIdentity; providerBinding?: ComputerSurfaceProviderBinding; options?: ComputerChatgptConversationObservationOptions }
-  | { commandId: string; kind: 'dispatch' | 'prepare'; identity: ComputerChatgptTargetIdentity; providerBinding?: ComputerSurfaceProviderBinding; prompt: string; mode?: 'send' | 'resume' | 'recover'; reasoning?: 'medium' | 'high' | 'xhigh' }
+  | { commandId: string; kind: 'dispatch' | 'prepare'; identity: ComputerChatgptTargetIdentity; providerBinding?: ComputerSurfaceProviderBinding; prompt: string; mode?: 'send' | 'resume' | 'recover' }
   | { commandId: string; kind: 'find_marker'; marker: string; bootstrapKey?: string }
   | { commandId: string; kind: 'close'; identity: ComputerChatgptTargetIdentity; providerBinding?: ComputerSurfaceProviderBinding };
 export type ComputerChatgptExtensionCommandInput = ComputerChatgptExtensionCommand extends infer Command
@@ -107,10 +114,12 @@ export type ComputerChatgptExtensionCommandResult =
   | { kind: 'prepared'; ready: true }
   | { kind: 'prepared'; ready: false; reasonCode: string }
   | { kind: 'dispatch'; mutation: 'not_attempted'; reasonCode: string }
-  | { kind: 'dispatch'; mutation: 'attempted'; confirmed?: boolean; reasoningVerified?: 'medium' | 'high' | 'xhigh'; observation?: ComputerChatgptConversationObservation }
+  | { kind: 'dispatch'; mutation: 'attempted'; confirmed?: boolean; observation?: ComputerChatgptConversationObservation }
   | { kind: 'marker_matches'; matches: Array<{ identity: ComputerChatgptConversationIdentity; providerBinding?: ComputerSurfaceProviderBinding; observation: ComputerChatgptConversationObservation }> }
   | { kind: 'closed' }
-  | { kind: 'failed'; code: string; retryable?: boolean; failoverSafe?: boolean; humanAction?: 'login' | 'grant_permission' };
+  | { kind: 'failed'; code: string; retryable?: boolean; failoverSafe?: boolean; humanAction?: 'login' | 'grant_permission';
+      /** Exact attachment retained after ensure hydration failed; never Send/readiness authority. */
+      providerBinding?: ComputerSurfaceProviderBinding };
 
 export interface ComputerChatgptExtensionHeartbeat {
   providerId: string;
@@ -128,7 +137,8 @@ export interface ComputerChatgptExtensionBrokerRpc {
 
 export interface ComputerChatgptConversationTargetPort {
   inventory(): Promise<ComputerChatgptConversationInventory>;
-  ensureExact(identity: ComputerChatgptConversationIdentity): Promise<ComputerChatgptTargetResult>;
+  /** Read-only reconciliation cannot create a missing tab. Only a separately authorized new send may opt in to exact conversation creation. */
+  ensureExact(identity: ComputerChatgptConversationIdentity, options?: { createIfMissing?: boolean }): Promise<ComputerChatgptTargetResult>;
   openBootstrap(projectUrl: string, bootstrapKey: string): Promise<ComputerChatgptTargetResult>;
   findBySubmittedMarker(
     marker: string,

package/scripts/assemble-template.ts

@@ -9,7 +9,6 @@
 import { readFileSync, existsSync, readdirSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
-import { runHooks } from "./run-skill-hook";
 
 // ============================================================================
 // Types
@@ -64,23 +63,6 @@ export interface PlanMap {
   plans: Record<string, PlanConfig>;
 }
 
-export interface SkillVersionManifest {
-  version: string;
-  templateVersion: string;
-  compatibility: {
-    minClaudeCodeVersion: string;
-    minBunVersion: string;
-  };
-  breakingChanges: Array<{
-    version: string;
-    description: string;
-  }>;
-  generatedProjectStamp: {
-    format: string;
-    location: string;
-  };
-}
-
 interface RuntimeProfileConfig {
   label: string;
   claudePolicy: string;
@@ -134,7 +116,6 @@ const ASSETS_DIR = join(REPO_ROOT, "assets");
 const PARTIALS_DIR = join(ASSETS_DIR, "partials");
 const PARTIALS_AGENTS_DIR = join(ASSETS_DIR, "partials-agents");
 const VERSIONS_FILE = join(ASSETS_DIR, "versions.json");
-const SKILL_VERSION_FILE = join(ASSETS_DIR, "skill-version.json");
 const PLAN_MAP_FILE = join(ASSETS_DIR, "plan-map.json");
 const QUESTION_PACK_FILE = join(ASSETS_DIR, "initializer-question-pack.v4.json");
 
@@ -276,31 +257,14 @@ export function loadVersions(versionsFilePath: string = VERSIONS_FILE): Record<s
   return versions;
 }
 
-/**
- * Load skill version manifest from skill-version.json.
- */
-export function loadSkillVersion(
-  skillVersionFilePath: string = SKILL_VERSION_FILE
-): SkillVersionManifest {
-  if (!existsSync(skillVersionFilePath)) {
-    throw new Error(`skill-version.json not found at ${skillVersionFilePath}`);
-  }
-
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(readFileSync(skillVersionFilePath, "utf-8"));
-  } catch (error) {
-    throw new Error(
-      `Failed to parse skill-version.json: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-
-  const manifest = parsed as SkillVersionManifest;
-  if (!manifest.version || !manifest.templateVersion) {
-    throw new Error("skill-version.json missing required version or templateVersion field");
+/** Read the Forge release version from its single canonical package manifest. */
+export function loadForgeVersion(): string {
+  const pkgPath = join(ASSETS_DIR, "..", "package.json");
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { version?: string };
+  if (typeof pkg.version !== "string" || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(pkg.version)) {
+    throw new Error("Invalid Forge package version in " + pkgPath);
   }
-
-  return manifest;
+  return pkg.version;
 }
 
 /**
@@ -935,7 +899,7 @@ export function assembleTemplate(options: AssemblyOptions): string {
 
   // Load version variables
   const versions = loadVersions();
-  const skillVersion = loadSkillVersion();
+  const forgeVersion = loadForgeVersion();
 
   // Merge all variables (user variables take precedence)
   const mergedVariables: Record<string, string> = {
@@ -943,8 +907,8 @@ export function assembleTemplate(options: AssemblyOptions): string {
     ...getDefaultTemplateVariables(resolvedPlanType, planMap, quickMode),
     ...variables,
     PLAN_TYPE: resolvedPlanType,
-    SKILL_VERSION: skillVersion.version,
-    TEMPLATE_VERSION: skillVersion.templateVersion,
+    FORGE_VERSION: forgeVersion,
+    TEMPLATE_VERSION: forgeVersion,
   };
 
   const webappRenderingModel = getWebappRenderingTemplateVariables(
@@ -1017,31 +981,6 @@ export function assembleTemplate(options: AssemblyOptions): string {
   return assembled;
 }
 
-/**
- * Async wrapper that runs lifecycle hooks around assembleTemplate().
- * Use this from CLI or scripts that support async. Tests can use sync assembleTemplate().
- */
-export async function assembleTemplateWithHooks(options: AssemblyOptions): Promise<string> {
-  const hookContext = {
-    planType: options.planType,
-    target: options.target ?? "claude",
-    quickMode: options.quickMode ?? false,
-  };
-
-  // Pre-assemble hook (sync — failure aborts)
-  const preResult = await runHooks("pre-assemble", hookContext);
-  if (!preResult.success) {
-    throw new Error("pre-assemble hook failed, aborting assembly");
-  }
-
-  const output = assembleTemplate(options);
-
-  // Post-assemble hook (advisory — failure is warning only)
-  await runHooks("post-assemble", { ...hookContext, outputLength: output.length });
-
-  return output;
-}
-
 // ============================================================================
 // CLI
 // ============================================================================
@@ -1163,7 +1102,7 @@ if (import.meta.main) {
       cloudflareNative: parsed.cloudflare,
     };
 
-    const output = await assembleTemplateWithHooks(options);
+    const output = assembleTemplate(options);
     console.log(output);
   } catch (error) {
     console.error("Error:", error instanceof Error ? error.message : error);