@moretea-labs/forge 1.8.1 → 1.8.2

package/supervisor/native-browser-adapter.ts

@@ -1,4 +1,6 @@
 import { randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
 import type {
   ComputerChatgptConversationIdentity,
   ComputerChatgptConversationObservation,
@@ -21,6 +23,7 @@ import type {
   WorkflowSupervisorBrowserCommand,
   WorkflowSupervisorBrowserTask,
   WorkflowSupervisorConsumerStatus,
+  WorkflowSupervisorPreflightComposerObservation,
 } from './types';
 
 const DEFAULT_INTERVAL_MS = 1_000;
@@ -44,6 +47,11 @@ const USER_VISIBLE_DEGRADED_AFTER_MS = 30_000;
 const TASK_TARGET_RETRY_BASE_MS = 30_000;
 /** Slow read-only probe cadence for an applied turn whose bounded resume is exhausted. */
 const AWAITING_RECEIPT_OBSERVATION_MS = 60_000;
+// Give a fully idle conversation longer than the 60-second late-receipt probe
+// cadence before releasing its disposable Chrome attachment. Under pressure
+// only the eight most recently idle exact resources retain that grace.
+const SUPERVISOR_IDLE_TAB_GRACE_MS = 5 * 60_000;
+const SUPERVISOR_IDLE_TAB_RETAIN_LIMIT = 8;
 const TASK_TARGET_RETRY_MAX_MS = 10 * 60_000;
 // Preparation may inspect/change a local draft, but never sends to ChatGPT.
 // Stop after bounded unsuccessful preflights; an unchanged failing provider
@@ -63,6 +71,8 @@ export const TASK_TARGET_SPACED_FAILURE_CODES: ReadonlySet<string> = new Set([
   'COMPUTER_CHATGPT_EXTENSION_EXACT_TARGET_AMBIGUOUS',
   'COMPUTER_CHATGPT_RESTORED_TARGET_UNPROVEN',
   'COMPUTER_CHATGPT_TARGET_RESTORE_FAILED',
+  // An absent manually closed tab cannot be re-created by a read-only probe.
+  'COMPUTER_CHATGPT_EXTENSION_EXACT_TARGET_ABSENT_READ_ONLY',
   'COMPUTER_CHATGPT_BOOTSTRAP_TARGET_UNAVAILABLE',
   'COMPUTER_CHATGPT_EXTENSION_TARGET_OPEN_OUTCOME_UNKNOWN',
   'COMPUTER_CHATGPT_EXTENSION_BOOTSTRAP_OPEN_OUTCOME_UNKNOWN',
@@ -167,6 +177,159 @@ function unknownObservationFingerprint(effectId: string, reason: string, snapsho
     isGenerating: snapshot.isGenerating,
   }));
 }
+function preflightComposerObservation(snapshot: ComputerChatgptConversationObservation, effectId: string): WorkflowSupervisorPreflightComposerObservation {
+  const value = snapshot.composerText;
+  const selectorVersion = snapshot.composerSelectorVersion === 'visible-single-v2' ? snapshot.composerSelectorVersion : undefined;
+  if (typeof value !== 'string') return { chars: 0, fingerprint: '', classification: 'unavailable', ...(selectorVersion ? { selectorVersion } : {}) };
+  const marker = /^<<<FORGE_WORKFLOW_EFFECT_V1:((?:fx|crpe)_[a-zA-Z0-9_-]{8,120})>>>/.exec(value);
+  return {
+    chars: value.length,
+    fingerprint: sha256(`preflight-composer-v1:\0${value}`).slice(0, 24),
+    classification: !value.trim() ? 'empty' : marker ? (marker[1] === effectId ? 'current_effect' : 'other_effect') : 'unattributed',
+    ...(selectorVersion ? { selectorVersion } : {}),
+  };
+}
+/**
+ * Optional, single-effect operator backup: this records no draft by default.
+ * A 0600 on-device authorization marker must name the exact blocked effect,
+ * current task, project URL, and observed fingerprint before raw text is saved.
+ * The file remains local; no transcript, plugin receipt, or logs carry text.
+ * This never clears an editor or permits a Send.
+ */
+export function backupAuthorizedBlockedComposer(
+  controllerHome: string,
+  taskId: string,
+  effectId: string,
+  projectUrl: string,
+  snapshot: ComputerChatgptConversationObservation,
+): string | undefined {
+  if (!/^supervisor:[a-z0-9]+$/.test(taskId) || !/^(?:fx|crpe)_[a-zA-Z0-9_-]{8,120}$/.test(effectId)) return;
+  if (snapshot.composerSelectorVersion !== 'visible-single-v2' || !snapshot.composerText?.trim()) return;
+  if (preflightComposerObservation(snapshot, effectId).classification !== 'unattributed') return;
+  let expectedUrl: URL;
+  let actualUrl: URL;
+  try { expectedUrl = new URL(projectUrl); actualUrl = new URL(snapshot.url); } catch { return; }
+  const projectRoute = (url: URL): string | undefined =>
+    /^\/g\/(g-p-[a-z0-9]+)(?:-[^/]+)?\/project\/?$/i.exec(url.pathname)?.[1]?.toLowerCase();
+  if (expectedUrl.origin !== 'https://chatgpt.com' || actualUrl.origin !== expectedUrl.origin
+    || !projectRoute(expectedUrl) || projectRoute(actualUrl) !== projectRoute(expectedUrl)) return;
+  const observation = preflightComposerObservation(snapshot, effectId);
+  const base = join(controllerHome, 'supervisor', 'draft-backups');
+  const authorization = join(base, `authorization-${effectId}.json`);
+  let marker: unknown;
+  try { marker = JSON.parse(readFileSync(authorization, 'utf8')); } catch { return; }
+  if (!marker || typeof marker !== 'object' || Array.isArray(marker)) return;
+  const expected = marker as Record<string, unknown>;
+  if (expected.schemaVersion !== 1 || expected.taskId !== taskId
+    || expected.effectId !== effectId || expected.projectUrl !== projectUrl
+    || expected.fingerprint !== observation.fingerprint || expected.consent !== 'user-authorized-exact-backup') return;
+  mkdirSync(base, { recursive: true, mode: 0o700 });
+  const path = join(base, `composer-${effectId}-${observation.fingerprint}.json`);
+  const payload = { schemaVersion: 1, taskId, effectId, projectUrl, observedUrl: snapshot.url,
+    selectorVersion: snapshot.composerSelectorVersion, fingerprint: observation.fingerprint,
+    composerText: snapshot.composerText };
+  try {
+    writeFileSync(path, JSON.stringify(payload) + '\n', { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  } catch (error) {
+    // A repeated preflight must not overwrite the original evidence.
+    if ((error as NodeJS.ErrnoException).code !== 'EEXIST') return;
+    try {
+      const existing = JSON.parse(readFileSync(path, 'utf8')) as typeof payload;
+      if (existing.fingerprint !== payload.fingerprint || existing.composerText !== payload.composerText
+        || existing.taskId !== taskId || existing.observedUrl !== snapshot.url) return;
+    } catch { return; }
+  }
+  return path;
+}
+
+/** An explicit on-device authorization + verified backup permits exactly one
+ * existing Chrome-extension editor replacement at prepare time. The dispatch
+ * still uses the unmodified canonical effect prompt and sole provider writer.
+ */
+export function authorizedDraftReplacementPrompt(
+  controllerHome: string, taskId: string, effectId: string, projectUrl: string,
+  snapshot: ComputerChatgptConversationObservation, prompt: string,
+): string | undefined {
+  // Disk projection does not attest that this exact Chrome tab loaded the latest script.
+  // Never spend a one-use authorization before a matching read-only contract receipt.
+  if (snapshot.composerReplacementContract !== 'exact-backed-up-project-draft-v1') return;
+  const backup = backupAuthorizedBlockedComposer(controllerHome, taskId, effectId, projectUrl, snapshot);
+  if (!backup || !prompt.startsWith(`<<<FORGE_WORKFLOW_EFFECT_V1:${effectId}>>>`)) return;
+  const observation = preflightComposerObservation(snapshot, effectId);
+  let marker: unknown;
+  try { marker = JSON.parse(readFileSync(join(controllerHome, 'supervisor', 'draft-backups', `authorization-${effectId}.json`), 'utf8')); }
+  catch { return; }
+  if (!marker || typeof marker !== 'object' || Array.isArray(marker)) return;
+  const auth = marker as Record<string, unknown>;
+  if (auth.taskId !== taskId || auth.effectId !== effectId || auth.projectUrl !== projectUrl
+    || auth.fingerprint !== observation.fingerprint || auth.consent !== 'user-authorized-exact-backup'
+    || typeof auth.nonce !== 'string' || !/^[a-f0-9]{32}$/.test(auth.nonce)) return;
+  // The authorization is a single-use physical mutation capability, not a
+  // reusable password. Atomic exclusive creation remains durable across
+  // Runtime/extension restarts and concurrent preflights. A failed prepare
+  // consumes this token; the operator must explicitly authorize another one.
+  const consumption = join(controllerHome, 'supervisor', 'draft-backups',
+    `consumed-${effectId}-${auth.nonce}.json`);
+  try {
+    writeFileSync(consumption, JSON.stringify({ schemaVersion: 1, taskId, effectId,
+      projectUrl, fingerprint: observation.fingerprint, nonce: auth.nonce }) + '\n',
+    { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  } catch { return; }
+  return `<<<FORGE_DRAFT_REPLACE_V1:${observation.fingerprint}:${auth.nonce}>>>\n${prompt}`;
+}
+
+/**
+ * An exact machine-owned draft can outlive its effect in a Project editor.
+ * Already-applied effects may be reflected by ChatGPT in other Project tabs;
+ * only the immutable full ledger prompt (allowing layout-only whitespace)
+ * qualifies. For never-sent STOPPED effects retain the original stricter
+ * preflight digest rule. Human, unknown-send and modified drafts never qualify.
+ */
+export function retiredBootstrapDraftReplacementPrompt(
+  control: WorkflowSupervisorControlPlane,
+  task: WorkflowSupervisorBrowserTask,
+  snapshot: ComputerChatgptConversationObservation,
+  prompt: string,
+): string | undefined {
+  if (snapshot.composerSelectorVersion !== 'visible-single-v2' || !snapshot.composerText
+    || snapshot.isGenerating || !prompt.startsWith('<<<FORGE_WORKFLOW_EFFECT_V1:')) return;
+  const draft = snapshot.composerText.replace(/\r\n?/g, '\n');
+  const match = /^<<<FORGE_WORKFLOW_EFFECT_V1:((?:fx|crpe)_[a-zA-Z0-9_-]{8,120})>>>/.exec(draft);
+  if (!match) return;
+  const staleEffect = control.getEffect(match[1]!);
+  if (!staleEffect || staleEffect.taskId === task.taskId) return;
+  const alreadyApplied = control.store.effectApplied(staleEffect.effectId);
+  // A live effect can only be retired after durable proof that its own Send
+  // already applied. This never treats an unknown Send as a safe draft.
+  if (alreadyApplied) {
+    if (snapshot.composerReplacementContract !== 'exact-backed-up-project-draft-v1') return;
+    let expected: URL; let actual: URL;
+    try { expected = new URL(control.bootstrapProjectUrl(task.taskId)); actual = new URL(snapshot.url); }
+    catch { return; }
+    const projectRoute = (url: URL) => /^\/g\/(g-p-[a-z0-9]+)(?:-[^/]+)?\/project\/?$/i.exec(url.pathname)?.[1]?.toLowerCase();
+    if (expected.origin !== 'https://chatgpt.com' || actual.origin !== expected.origin
+      || !projectRoute(expected) || projectRoute(actual) !== projectRoute(expected)) return;
+    const canonical = staleEffect.prompt.replace(/\r\n?/g, '\n');
+    if (draft.replace(/\s+/g, ' ').trim() !== canonical.replace(/\s+/g, ' ').trim()) return;
+  } else {
+    if (control.effectDispatchBudget(staleEffect.effectId).generations !== 0) return;
+    const oldTask = control.getTask(staleEffect.taskId);
+    const retired = oldTask && control.getTaskByConversationId(oldTask.conversationId);
+    if (retired?.terminal !== 'STOPPED'
+      || control.bootstrapProjectUrl(staleEffect.taskId) !== control.bootstrapProjectUrl(task.taskId)) return;
+  }
+  const attested = control.preSendComposerObservation(staleEffect.effectId);
+  // Both proofs are exact: the immutable effect text, or the previously
+  // attested pre-Send editor bytes. The older extension could synthesize an
+  // extra newline inside a URL; the corrected extension reads the canonical
+  // text without it. Require the persisted no-click preflight in either case.
+  const fingerprint = sha256('preflight-composer-v1:\0' + draft).slice(0, 24);
+  const exactSource = draft === staleEffect.prompt.replace(/\r\n?/g, '\n');
+  const exactPreflight = attested?.fingerprint === fingerprint && attested.chars === draft.length;
+  if (!alreadyApplied && (!attested || (!exactSource && !exactPreflight))) return;
+  return '<<<FORGE_RETIRED_DRAFT_V1:' + staleEffect.effectId + ':' + fingerprint + '>>>\n' + prompt;
+}
+
 function exactConversation(snapshot: ComputerChatgptConversationObservation, task: WorkflowSupervisorBrowserTask): boolean {
   try { return parseChatgptConversationIdentity(snapshot.url).conversationId === task.conversationId; }
   catch { return false; }
@@ -222,6 +385,8 @@ export class WorkflowSupervisorNativeBrowserAdapter {
   private readonly projectedTaskStalls = new Map<string, Omit<WorkflowSupervisorStallProjection, 'taskId' | 'state' | 'observedAt'>>();
   /** Spacing for read-only observation of a turn whose bounded resume is exhausted. */
   private readonly awaitingReceiptObservedAtMs = new Map<string, number>();
+  /** Rebuildable idle-grace projection; Supervisor effects remain the sole authority. */
+  private readonly idleResourceSinceMs = new Map<string, number>();
 
   constructor(
     private readonly control: WorkflowSupervisorControlPlane,
@@ -253,7 +418,49 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     }
   }
 
-  private noteTaskFailure(code: string, task: WorkflowSupervisorBrowserTask, effectId?: string): void {
+  /** Rebuildable de-duplication only; SQLite events and CAS own the decision. */
+  private readonly automaticMigrationAttempted = new Map<string, { key: string; atMs: number }>();
+  /** Read-only provider progress, not another durable effect/Send ledger. */
+  private readonly stalledProviderObservations = new Map<string, { fingerprint: string; changedAtMs: number; failedProbeAtMs: number }>();
+
+  /**
+   * Fail over a proven repeatedly unusable conversation, not a provider-wide
+   * outage or an outcome-unknown Send. The canonical migration transaction
+   * enforces the existing maximum of two unsuccessful conversation moves.
+   */
+  private maybeAutoMigrate(task: WorkflowSupervisorBrowserTask): boolean {
+    if (task.conversationId.startsWith('bootstrap:')
+      || chatgptProviderBackpressureRemainingMs(this.deps.providerScopeKey, this.deps.nowMs()) > 0) return false;
+    const evidence = this.control.store.automaticConversationFailureEvidence(task.taskId);
+    if (evidence.count < 3 || evidence.latestEventId <= 0) return false;
+    const key = `${task.taskId}:${task.conversationId}:${evidence.latestEventId}`;
+    const attempt = this.automaticMigrationAttempted.get(task.taskId);
+    if (attempt?.key === key && this.deps.nowMs() - attempt.atMs < TASK_TARGET_RETRY_MAX_MS) return false;
+    this.automaticMigrationAttempted.set(task.taskId, { key, atMs: this.deps.nowMs() });
+    try {
+      const migrated = this.control.migrateConversation({
+        taskId: task.taskId,
+        expectedConversationId: task.conversationId,
+        fresh: true,
+        requestId: `automatic-delivery-fuse:${task.conversationId}:${evidence.latestEventId}`,
+        reason: `The same Supervisor conversation failed ${evidence.count} task-local delivery/progress attempts without an applied effect or completion. The prior conversation is not reused; the exact effect journal and existing two-migration cap remain authoritative.`,
+        authorizedBy: 'supervisor-automatic-delivery-fuse',
+      });
+      if (migrated.migrated) {
+        this.clearTaskFailure(task.taskId);
+        this.awaitingReceiptObservedAtMs.delete(task.taskId);
+      }
+      return migrated.migrated;
+    } catch (error) {
+      // A pending unknown send, exhausted migration budget, or stale task is a
+      // true safety barrier: do not replay it or bypass the canonical store.
+      const code = consumerFailureCode(error, 'WORKFLOW_SUPERVISOR_AUTOMATIC_MIGRATION_DENIED');
+      this.noteFailure(code, task);
+      return false;
+    }
+  }
+
+  private noteTaskFailure(code: string, task: WorkflowSupervisorBrowserTask, effectId?: string, countTowardFuse = true): void {
     const nowMs = this.deps.nowMs();
     const previous = this.taskTransportFailures.get(task.taskId);
     const failure: TaskTransportFailure = {
@@ -275,6 +482,17 @@ export class WorkflowSupervisorNativeBrowserAdapter {
       });
     }
     this.taskTransportFailures.set(task.taskId, failure);
+    // Account-wide cooldown is not evidence that this *conversation* failed.
+    if (!countTowardFuse || chatgptProviderBackpressureRemainingMs(this.deps.providerScopeKey, nowMs) > 0) return;
+    // Preflight rejections are already one durable failed attempt in the
+    // Supervisor effect ledger; counting them again would double the fuse.
+    if (code !== SUPERVISOR_PRE_SEND_BLOCKED) {
+      this.control.store.recordBrowserDeliveryAttemptFailure({
+        taskId: task.taskId, conversationId: task.conversationId, code,
+        ...(effectId ? { effectId } : {}),
+      });
+    }
+    this.maybeAutoMigrate(task);
   }
 
   private clearTaskFailure(taskId: string, effectId?: string): void {
@@ -290,10 +508,14 @@ export class WorkflowSupervisorNativeBrowserAdapter {
   }
 
   private noteTargetUnavailable(task: WorkflowSupervisorBrowserTask, effectId: string | undefined, failure: { code: string; humanAction?: 'login' | 'grant_permission' }): void {
-    // Exact-target failure is task-local. It must not back off unrelated
-    // Supervisor conversations; only provider-wide inventory/backpressure does.
+    // A user login/grant problem cannot be fixed by a different conversation.
+    if (failure.humanAction) {
+      this.noteTaskFailure(failure.code, task, effectId, false);
+      this.deps.requestHumanAction?.({ taskId: task.taskId, ...(effectId ? { effectId } : {}), action: failure.humanAction, code: failure.code });
+      return;
+    }
+    // Task-local failures are spaced independently of unrelated conversations.
     this.noteTaskFailure(failure.code, task, effectId);
-    if (failure.humanAction) this.deps.requestHumanAction?.({ taskId: task.taskId, ...(effectId ? { effectId } : {}), action: failure.humanAction, code: failure.code });
   }
 
   private syncTaskStallProjections(): void {
@@ -335,6 +557,14 @@ export class WorkflowSupervisorNativeBrowserAdapter {
       catch (error) { this.deps.onError(error); }
       this.projectedTaskStalls.delete(taskId);
     }
+    this.pruneAutomaticRecoveryProjections(activeTaskIds);
+  }
+
+  private pruneAutomaticRecoveryProjections(activeTaskIds: ReadonlySet<string>): void {
+    for (const id of this.automaticMigrationAttempted.keys())
+      if (!activeTaskIds.has(id)) this.automaticMigrationAttempted.delete(id);
+    for (const id of this.stalledProviderObservations.keys())
+      if (!activeTaskIds.has(id)) this.stalledProviderObservations.delete(id);
   }
 
   private dueCommand(nowMs: number): WorkflowSupervisorConsumerStatus['dueCommand'] {
@@ -403,7 +633,7 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     this.timer = undefined;
     await this.inflight?.catch(() => undefined);
     await this.deps.targetPort.close().catch(() => undefined);
-    this.observedAssistant.clear(); this.providerFailureSeen.clear(); this.providerFailureAwaitingClear.clear(); this.freshSendCheckedAt.clear(); this.taskTransportFailures.clear(); this.projectedTaskStalls.clear(); this.awaitingReceiptObservedAtMs.clear();
+    this.observedAssistant.clear(); this.providerFailureSeen.clear(); this.providerFailureAwaitingClear.clear(); this.freshSendCheckedAt.clear(); this.taskTransportFailures.clear(); this.projectedTaskStalls.clear(); this.awaitingReceiptObservedAtMs.clear(); this.idleResourceSinceMs.clear(); this.automaticMigrationAttempted.clear(); this.stalledProviderObservations.clear();
   }
 
   async runOnce(): Promise<void> {
@@ -412,7 +642,29 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     // Preserve fresh-send fairness across ticks. serviceFreshSend prunes
     // retired effect ids; resetting here repeatedly favors the first task.
     this.lastRunTransportUnavailable = false;
+    // One Supervisor terminal-event authority. A Work closed while this
+    // consumer was offline cannot keep delivering a stale effect on restart.
+    this.control.reconcileTerminalWorkBoundTasks();
     this.syncTaskStallProjections();
+    const previouslyObservedTasks = this.control.browserTasks();
+    // Read-only watchdog for a pre-send blocked task: after each bounded
+    // interval with no applied effect or completion, record a failed progress
+    // check in the same journal. This is not a Send/retry attempt.
+    for (const task of previouslyObservedTasks) {
+      const stall = this.control.taskStall(task.taskId);
+      if (stall.state === 'spaced' && stall.reason === 'pre_send_infrastructure_blocked') {
+        const evidence = this.control.store.automaticConversationFailureEvidence(task.taskId);
+        if (evidence.count > 0 && evidence.count < 3
+          && this.deps.nowMs() - evidence.lastFailureAtMs >= AWAITING_RECEIPT_OBSERVATION_MS
+          && chatgptProviderBackpressureRemainingMs(this.deps.providerScopeKey, this.deps.nowMs()) === 0) {
+          this.control.store.recordBrowserDeliveryAttemptFailure({ taskId: task.taskId,
+            conversationId: task.conversationId, effectId: stall.effectId, code: 'WORKFLOW_SUPERVISOR_NO_SEND_PROGRESS_WATCHDOG' });
+        }
+        this.maybeAutoMigrate(task);
+      }
+    }
+    // The watchdog may have changed the exact Task conversation identity.
+    // Never process a stale pre-migration browser task in this tick.
     const tasks = this.control.browserTasks();
     this.lastRunHadTasks = tasks.length > 0;
     let inventory;
@@ -428,15 +680,44 @@ export class WorkflowSupervisorNativeBrowserAdapter {
       ...(conversation.title ? { title: conversation.title } : {}), ...(conversation.projectTitle ? { projectTitle: conversation.projectTitle } : {}),
       ...(conversation.projectUrl ? { projectUrl: conversation.projectUrl } : {}), ...(conversation.isCurrent ? { is_current: true } : {}) }));
     if (!inventory.complete && tasks.length > 0) {
-      this.lastRunTransportUnavailable = true;
+      // Partial cross-browser discovery is degraded evidence, but must not
+      // throttle an independently healthy provider's exact-target delivery.
+      this.lastRunTransportUnavailable = inventory.providerInventoryReady !== true;
       this.noteFailure('WORKFLOW_SUPERVISOR_NATIVE_INVENTORY_INCOMPLETE');
     } else if (inventory.complete) {
       this.clearTransportFailure();
     }
-    // Due-work omits tasks during observation/retry spacing. Retention follows
-    // task lifetime; otherwise every cooldown closes the tab and the next
-    // observation reloads the same conversation from the provider.
-    const activeResourceKeys = this.control.listTasks(true).map((task) => task.conversationId.startsWith('bootstrap:') ? `chatgpt.bootstrap:${task.taskId}` : `chatgpt.conversation:${task.conversationId}`);
+    // Retire only disposable provider attachments. The durable Supervisor
+    // effect ledger (not textual DONE or a browser tab) proves protection: a
+    // queued/reconciling command and an applied turn awaiting its receipt both
+    // remain attached even during cooldown. A terminal task is absent here.
+    const taskResourceKeys = new Set<string>();
+    const protectedResourceKeys = new Set<string>();
+    for (const task of this.control.listTasks(true)) {
+      const key = task.conversationId.startsWith('bootstrap:')
+        ? `chatgpt.bootstrap:${task.taskId}`
+        : `chatgpt.conversation:${task.conversationId}`;
+      taskResourceKeys.add(key);
+      // Eligibility is time-dependent; an unresolved effect still owns its
+      // exact attachment during retry spacing or a blocked preparation.
+      if (this.control.store.currentUnappliedEffect(task.taskId)
+        || this.control.store.hasAppliedEffectAwaitingCompletion(task.taskId)) protectedResourceKeys.add(key);
+    }
+    for (const key of this.idleResourceSinceMs.keys()) {
+      if (!taskResourceKeys.has(key) || protectedResourceKeys.has(key)) this.idleResourceSinceMs.delete(key);
+    }
+    const now = this.deps.nowMs();
+    for (const key of taskResourceKeys) {
+      if (!protectedResourceKeys.has(key) && !this.idleResourceSinceMs.has(key)) this.idleResourceSinceMs.set(key, now);
+    }
+    // Enforce a bounded idle attachment budget. This does not cap truly active
+    // effects: they cannot be retired merely because tab pressure is high.
+    const graceKeys = [...this.idleResourceSinceMs.entries()]
+      .filter(([key, since]) => taskResourceKeys.has(key) && now - since < SUPERVISOR_IDLE_TAB_GRACE_MS)
+      .sort((left, right) => right[1] - left[1])
+      .slice(0, SUPERVISOR_IDLE_TAB_RETAIN_LIMIT)
+      .map(([key]) => key);
+    const activeResourceKeys = [...new Set([...protectedResourceKeys, ...graceKeys])];
     await this.deps.targetPort.cleanup(activeResourceKeys).catch((error) => this.deps.onError(error));
     for (const task of tasks) {
       if (this.closed) break;
@@ -486,7 +767,15 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     const transportFailure = this.taskTransportFailures.get(task.taskId);
     // Derived from the durable effect log, not this adapter's process memory.
     const stall = this.control.taskStall(task.taskId);
-    if (stall.state === 'spaced' && stall.reason === 'pre_send_infrastructure_blocked') return;
+    if (stall.state === 'spaced' && stall.reason === 'pre_send_infrastructure_blocked') {
+      // A blocked new recovery cannot authorize a Send, but it must not hide
+      // the completed final reply of its already-applied source effect.
+      // Probe read-only at the existing bounded receipt cadence.
+      if (!this.control.store.hasAppliedEffectAwaitingCompletion(task.taskId)) return;
+      const checkedAt = this.awaitingReceiptObservedAtMs.get(task.taskId) ?? 0;
+      if (this.deps.nowMs() - checkedAt < AWAITING_RECEIPT_OBSERVATION_MS) return;
+      this.awaitingReceiptObservedAtMs.set(task.taskId, this.deps.nowMs());
+    }
     if (transportFailure
       && TASK_TARGET_SPACED_FAILURE_CODES.has(transportFailure.code)
       && this.deps.nowMs() - transportFailure.observedAtMs < taskTargetRetryDelayMs(transportFailure.streak)) return;
@@ -510,7 +799,12 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     // strands the task.
     if (chatgptProviderBackpressureRemainingMs(this.deps.providerScopeKey, this.deps.nowMs()) > 0
       && !this.conversations.some((conversation) => conversation.conversation_id === task.conversationId)) return;
-    const ensured = await this.deps.targetPort.ensureExact(identityForTask(task));
+    // Only a new, explicitly admitted send may open a missing tab. A late
+    // receipt probe or unknown-effect reconciliation uses existing attachments
+    // and never resurrects a manually closed conversation by observation.
+    const ensured = await this.deps.targetPort.ensureExact(identityForTask(task), {
+      createIfMissing: poll.command?.mode === 'send',
+    });
     if (ensured.state !== 'ready') { this.noteTargetUnavailable(task, poll.command?.effectId, ensured.failure); return; }
     const target = ensured.target;
     const snapshot = ensured.observation ?? await target.observe({ includeUserHistory: false, includePageText: false });
@@ -522,6 +816,26 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     this.conversations.push({ conversation_id: task.conversationId, canonical_url: task.conversationUrl,
       ...(snapshot.title.trim() ? { title: snapshot.title.trim().slice(0, 512) } : {}), ...projectMetadataFromConversationUrl(snapshot.url) });
     const providerBusy = snapshot.isGenerating;
+    // Recovery-exhausted tasks can otherwise remain visibly stalled without a
+    // new exception. Three spaced, unchanged exact-page observations trip the
+    // same durable fuse; changing assistant activity resets this observation.
+    if (!poll.command && this.control.taskStall(task.taskId).state === 'provider_resume_exhausted') {
+      const fingerprint = sha256(JSON.stringify({ text: snapshot.latestAssistantResponse,
+        activity: snapshot.providerActivityText, failure: snapshot.providerFailureText, generating: providerBusy }));
+      const previous = this.stalledProviderObservations.get(task.taskId);
+      if (!previous || previous.fingerprint !== fingerprint) {
+        this.stalledProviderObservations.set(task.taskId, {
+          fingerprint, changedAtMs: this.deps.nowMs(), failedProbeAtMs: this.deps.nowMs(),
+        });
+      } else if (this.deps.nowMs() - previous.changedAtMs >= 2 * AWAITING_RECEIPT_OBSERVATION_MS
+        && this.deps.nowMs() - previous.failedProbeAtMs >= AWAITING_RECEIPT_OBSERVATION_MS
+        && chatgptProviderBackpressureRemainingMs(this.deps.providerScopeKey, this.deps.nowMs()) === 0) {
+        previous.failedProbeAtMs = this.deps.nowMs();
+        this.control.store.recordBrowserDeliveryAttemptFailure({ taskId: task.taskId,
+          conversationId: task.conversationId, code: 'WORKFLOW_SUPERVISOR_PROVIDER_NO_PROGRESS_WATCHDOG' });
+        if (this.maybeAutoMigrate(task)) return;
+      }
+    } else this.stalledProviderObservations.delete(task.taskId);
     const latestRoleStillUser = snapshot.latestTurnRole === 'user';
     // Capacity is only authoritative on dedicated live provider UI. A model
     // can quote the same phrase in an ordinary assistant turn; historical
@@ -556,7 +870,11 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     let providerBackpressureMs = chatgptProviderBackpressureRemainingMs(this.deps.providerScopeKey, this.deps.nowMs());
     if (poll.command?.mode !== 'reconcile' && providerFailureCode === CHATGPT_AUTOMATION_RATE_LIMITED && providerBackpressureMs > 0) return;
     let missingReceiptForAppliedTurn = false;
-    if (!poll.command && !providerBusy && snapshot.latestTurnRole === 'assistant' && snapshot.latestAssistantResponse.trim()) {
+    // A queued, never-dispatched recovery still leaves its source reply eligible
+    // for completion. Consume that reply before preparing an unnecessary Send.
+    const unsentRecovery = poll.command?.mode === 'send'
+      && poll.command.kind === 'recovery' && poll.command.dispatchGeneration === 1;
+    if ((!poll.command || unsentRecovery) && !providerBusy && snapshot.latestTurnRole === 'assistant' && snapshot.latestAssistantResponse.trim()) {
       const responseFingerprint = sha256(snapshot.latestAssistantResponse);
       const pending = this.control.taskStall(task.taskId);
       // Text-only replies are not receipts. Observe their stable idle digest,
@@ -631,14 +949,45 @@ export class WorkflowSupervisorNativeBrowserAdapter {
       });
       return;
     }
+    if (preflightComposerObservation(beforeSend, command.effectId).classification === 'unattributed'
+      && beforeSend.composerReplacementContract !== 'exact-backed-up-project-draft-v1') {
+      // Not a draft conflict or a Send attempt: Chrome retained a stale content script.
+      this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId,
+        reasonCode: 'COMPUTER_CHATGPT_BOOTSTRAP_LOADED_SCRIPT_STALE',
+        composerObservation: preflightComposerObservation(beforeSend, command.effectId) });
+      this.noteTaskFailure(SUPERVISOR_PRE_SEND_BLOCKED, task, command.effectId);
+      return;
+    }
     let prepared: Awaited<ReturnType<ComputerChatgptConversationTarget['prepare']>>;
-    try { prepared = await target.prepare(command.prompt, { reasoning: 'xhigh' }); }
-    catch (error) {
-      this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: consumerFailureCode(error, 'COMPUTER_PREPARE_FAILED') });
+    const exactReplacement = authorizedDraftReplacementPrompt(this.deps.providerScopeKey, task.taskId,
+      command.effectId, this.control.bootstrapProjectUrl(task.taskId), beforeSend, command.prompt);
+    const retiredReplacement = exactReplacement ? undefined
+      : retiredBootstrapDraftReplacementPrompt(this.control, task, beforeSend, command.prompt);
+    try {
+      prepared = await target.prepare(exactReplacement ?? retiredReplacement ?? command.prompt);
+      if (!prepared.ready && prepared.reasonCode === 'composer_not_empty'
+        && !exactReplacement && !retiredReplacement) {
+        // ChatGPT may hydrate an old Project draft after the initial tab-ready
+        // observation. A refused prepare never clicked Send. Read the SAME
+        // pinned target once more and offer a second prepare only when the
+        // STOPPED effect's canonical ledger proves this exact editor safe.
+        const hydrated = await target.observe({ includeUserHistory: false, includePageText: false }).catch(() => undefined);
+        const verifiedRetirement = hydrated
+          ? retiredBootstrapDraftReplacementPrompt(this.control, task, hydrated, command.prompt) : undefined;
+        if (verifiedRetirement) prepared = await target.prepare(verifiedRetirement);
+      }
+    } catch (error) {
+      this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: consumerFailureCode(error, 'COMPUTER_PREPARE_FAILED'), composerObservation: preflightComposerObservation(beforeSend, command.effectId) });
       this.noteTaskFailure(SUPERVISOR_PRE_SEND_BLOCKED, task, command.effectId); this.deps.onError(error); return;
     }
     if (!prepared.ready) {
-      this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: consumerFailureCode(new Error(prepared.reasonCode), 'COMPUTER_PREPARE_REJECTED') });
+      const observed = await target.observe({ includeUserHistory: false, includePageText: false }).catch(() => beforeSend);
+      if (prepared.reasonCode === 'composer_not_empty') {
+        // Snapshot backups require an exact, separately authorized fingerprint.
+        backupAuthorizedBlockedComposer(this.deps.providerScopeKey, task.taskId, command.effectId,
+          this.control.bootstrapProjectUrl(task.taskId), observed);
+      }
+      this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: prepared.reasonCode, composerObservation: preflightComposerObservation(observed, command.effectId) });
       this.noteTaskFailure(SUPERVISOR_PRE_SEND_BLOCKED, task, command.effectId);
       this.deps.onError(new Error(prepared.reasonCode));
       return;
@@ -646,10 +995,12 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     this.clearTaskFailure(task.taskId, command.effectId);
     if (!this.control.bootstrapBeginEffect({ taskId: task.taskId, effectId: command.effectId, dispatchId: `bootstrap-${randomUUID()}`, dispatchGeneration: command.dispatchGeneration })) return;
     try {
-      const dispatch = await withChatgptProviderDispatchLane(this.deps.providerScopeKey, () => target.dispatch(command.prompt, { reasoning: 'xhigh' }),
+      const dispatch = await withChatgptProviderDispatchLane(this.deps.providerScopeKey, () => target.dispatch(command.prompt),
         (result) => result.mutation === 'attempted' ? { providerAccepted: result.confirmed === true } : { code: result.reasonCode, message: result.reasonCode });
       if (dispatch.mutation === 'not_attempted') {
-        this.control.bootstrapObserveEffect({ taskId: task.taskId, effectId: command.effectId, observationId: `bootstrap-${randomUUID()}`, outcome: 'not_applied', evidence: { pre_send_rejection: true, reason: dispatch.reasonCode } });
+        this.control.bootstrapObserveEffect({ taskId: task.taskId, effectId: command.effectId, observationId: `bootstrap-${randomUUID()}`, outcome: 'not_applied', evidence: { dispatch_mutation: 'not_attempted', send_clicked: false, reason: dispatch.reasonCode } });
+        this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId,
+          reasonCode: dispatch.reasonCode ?? 'COMPUTER_CHATGPT_DISPATCH_NOT_ATTEMPTED', composerObservation: preflightComposerObservation(beforeSend, command.effectId) });
         await this.deps.targetPort.release(target.targetId).catch(() => undefined);
         return;
       }
@@ -689,8 +1040,17 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     let identity;
     try { identity = parseChatgptConversationIdentity(snapshot.url); } catch { observeUnknown('bootstrap_conversation_identity_unavailable'); return; }
     if (!snapshotTargetMarkerPresent(snapshot, command.effectId)) { observeUnknown('bootstrap_effect_marker_not_observed'); return; }
-    const promoted = await this.deps.targetPort.promoteBootstrap(match.target.targetId, { namespace: 'chatgpt.conversation', conversationId: identity.conversationId, canonicalUrl: identity.canonicalUrl });
-    if (promoted.state !== 'ready') { observeUnknown(promoted.failure.code); return; }
+    // Marker recovery may already return a Computer target with this exact
+    // conversation identity. Promoting it again would tombstone its own binding.
+    // Only a still-bootstrap target needs the provider's identity transition.
+    if (match.target.identity.namespace === 'chatgpt.conversation') {
+      if (match.target.identity.conversationId !== identity.conversationId) {
+        observeUnknown('bootstrap_reconcile_target_identity_mismatch'); return;
+      }
+    } else {
+      const promoted = await this.deps.targetPort.promoteBootstrap(match.target.targetId, { namespace: 'chatgpt.conversation', conversationId: identity.conversationId, canonicalUrl: identity.canonicalUrl });
+      if (promoted.state !== 'ready') { observeUnknown(promoted.failure.code); return; }
+    }
     this.control.bindBootstrapConversation({ taskId: task.taskId, conversationId: identity.conversationId, conversationUrl: identity.canonicalUrl });
     this.control.bootstrapObserveEffect({ taskId: task.taskId, effectId: command.effectId, observationId: `bootstrap-reconcile-${randomUUID()}`, outcome: 'applied' });
     this.clearTaskFailure(task.taskId, command.effectId);
@@ -707,14 +1067,19 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     if (mode === 'send') {
       let prepared: Awaited<ReturnType<ComputerChatgptConversationTarget['prepare']>>;
       try { prepared = await target.prepare(command.prompt, {
-        ...(command.kind === 'recovery' ? { mode: 'recover' as const } : {}), reasoning: 'xhigh',
+        ...(command.kind === 'recovery' ? { mode: 'recover' as const } : {}),
       }); }
       catch (error) {
       this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: consumerFailureCode(error, 'COMPUTER_PREPARE_FAILED') });
       this.noteTaskFailure(SUPERVISOR_PRE_SEND_BLOCKED, task, command.effectId); this.deps.onError(error); return;
     }
       if (!prepared.ready) {
-        this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: consumerFailureCode(new Error(prepared.reasonCode), 'COMPUTER_PREPARE_REJECTED') });
+        // The exact recovery target still exposes its Stop control. That is a
+        // provider-turn observation, not an infrastructure preparation failure:
+        // preserve this one reserved recovery effect without spending a send
+        // generation or the bounded preflight-failure budget.
+        if (command.kind === 'recovery' && prepared.reasonCode === 'provider_recovery_stop_pending') return;
+        this.control.recordProviderPreparationFailure({ taskId: task.taskId, effectId: command.effectId, reasonCode: prepared.reasonCode });
         this.noteTaskFailure(SUPERVISOR_PRE_SEND_BLOCKED, task, command.effectId);
         this.deps.onError(new Error(prepared.reasonCode));
         return;
@@ -726,7 +1091,7 @@ export class WorkflowSupervisorNativeBrowserAdapter {
       if (!begin.started) mode = 'reconcile';
     }
     if (mode === 'reconcile') {
-      const exact = normalize(snapshot.latestUserText) === normalize(command.prompt);
+      const exact = normalize(snapshot.latestUserText) === normalize(command.prompt.replace(/^@forge\s+(?=<<<FORGE_WORKFLOW_EFFECT_V1:(?:fx|crpe)_[a-zA-Z0-9_-]{8,120}>>>)/, ''));
       const markerPresent = snapshotTargetMarkerPresent(snapshot, command.effectId);
       if (exact || markerPresent) {
         this.control.browserObserveEffect({ conversationId: command.conversationId, conversationUrl: command.conversationUrl, effectId: command.effectId,
@@ -743,7 +1108,7 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     }
     let dispatch: Awaited<ReturnType<ComputerChatgptConversationTarget['dispatch']>>;
     try {
-      dispatch = await withChatgptProviderDispatchLane(this.deps.providerScopeKey, () => target.dispatch(command.prompt, { ...(command.kind === 'recovery' ? { mode: 'recover' as const } : {}), reasoning: 'xhigh' }),
+      dispatch = await withChatgptProviderDispatchLane(this.deps.providerScopeKey, () => target.dispatch(command.prompt, { ...(command.kind === 'recovery' ? { mode: 'recover' as const } : {}) }),
         (result) => result.mutation === 'attempted' ? { providerAccepted: result.confirmed === true } : { code: result.reasonCode, message: result.reasonCode });
     } catch (error) {
       this.control.browserObserveEffect({ conversationId: command.conversationId, conversationUrl: command.conversationUrl, effectId: command.effectId,
@@ -758,19 +1123,19 @@ export class WorkflowSupervisorNativeBrowserAdapter {
     }
     if (dispatch.confirmed) {
       this.control.browserObserveEffect({ conversationId: command.conversationId, conversationUrl: command.conversationUrl, effectId: command.effectId,
-        observationId: `computer-observe-${randomUUID()}`, outcome: 'applied', evidence: { surface: 'computer-chatgpt-target', target_id: target.targetId, provider_confirmed: true, ...(dispatch.reasoningVerified ? { reasoning_verified: dispatch.reasoningVerified } : {}) } });
+        observationId: `computer-observe-${randomUUID()}`, outcome: 'applied', evidence: { surface: 'computer-chatgpt-target', target_id: target.targetId, provider_confirmed: true } });
       return;
     }
     let exact = false; let markerPresent = false;
     for (let attempt = 1; attempt <= MAX_LOCAL_OBSERVATION_ATTEMPTS; attempt += 1) {
       snapshot = await target.observe({ includeUserHistory: true, includePageText: true });
-      exact = normalize(snapshot.latestUserText) === normalize(command.prompt); markerPresent = snapshotTargetMarkerPresent(snapshot, command.effectId);
+      exact = normalize(snapshot.latestUserText) === normalize(command.prompt.replace(/^@forge\s+(?=<<<FORGE_WORKFLOW_EFFECT_V1:(?:fx|crpe)_[a-zA-Z0-9_-]{8,120}>>>)/, '')); markerPresent = snapshotTargetMarkerPresent(snapshot, command.effectId);
       if (exact || markerPresent || attempt >= MAX_LOCAL_OBSERVATION_ATTEMPTS) break;
       await this.deps.sleep(localObservationDelayMs(attempt, 1_000, 4_000));
     }
     this.control.browserObserveEffect({ conversationId: command.conversationId, conversationUrl: command.conversationUrl, effectId: command.effectId,
       observationId: `computer-observe-${randomUUID()}`, outcome: exact || markerPresent ? 'applied' : 'unknown',
-      evidence: { surface: 'computer-chatgpt-target', target_id: target.targetId, exact_user_message: exact, target_marker_present: markerPresent, ...(dispatch.reasoningVerified ? { reasoning_verified: dispatch.reasoningVerified } : {}),
+      evidence: { surface: 'computer-chatgpt-target', target_id: target.targetId, exact_user_message: exact, target_marker_present: markerPresent,
         ...(!exact && !markerPresent ? { reason: 'outbound_not_confirmed', observation_fingerprint: unknownObservationFingerprint(command.effectId, 'outbound_not_confirmed', snapshot) } : {}) } });
   }
 }