# Orchestrator Dogfood — Execution Continuity

Status: qualified / landing pending
Date: 2026-08-21

## Run identity

- Run ID: `run_7a9a2217-edc1-41ed-9eb6-7dfda2048eba`
- Recovered root worker: `wrk_83b1154e-a9e8-44ca-b7c2-b7fc11e071a1`
- Root conversation name: `Execution Continuity Root`
- Root integration branch: `impl/continuity-root-integration`
- Owner architecture baseline merged during recovery: `980d1b21e9367712db9a255d2c08196c1363a0ea`
- Final qualified implementation candidate: `7865e579794783bfaa2a4ff337d968da90d11680`

This is the original dogfood run. Recovery attached the replacement visible `/root` conversation to the existing logical root worker; no replacement run was created.

## Terminal lane reconciliation

| Lane | Worker ID | Durable state | Branch / handoff head | Root disposition |
|---|---|---|---|---|
| A — domain/protocol/persistence | `wrk_52d2fcf8-cefa-4827-8db3-88f67a72cbaa` | completed | `impl/continuity-a-domain` / `f397c4db85d7a5304414ff7736d5a1e9852bf5f2` | consumed and integrated |
| B — scheduler/MCP | `wrk_ded360f4-06e2-44cb-adad-eba50100f268` | completed | `impl/continuity-b-scheduler` / `47c71e2c8fe0caf64da041fd0944ef505434929d` | consumed, shared protocol seam reconciled |
| C — browser executor | `wrk_a76c7819-e375-4e43-bfbd-f761f023601e` | completed | `impl/continuity-c-executor` / `bc53a229adf355cd712d9723b6192b123a859a17` | consumed and integrated |
| C9–C11 UI final | `wrk_65ebe5e1-9dcd-44b0-9141-e318d451c216` | completed | `impl/continuity-ui-final` / `6fc33aa748252cba2ce58236d7de9427e2e156a0` | terminal handoff reviewed; valid UI structure integrated, stale disabled-C11 assumption corrected in root |

Git commits were treated as progress/evidence only. Root reconciled terminal worker state and handoff content before integration.

## Recovered convergence checkpoints

- `534e836` — preserved previously interrupted continuity-root WIP.
- `4feec73` — merged owner architecture commit `980d1b2`.
- `9967c6a` / `d6e257e` — reconciled recovered convergence and internal mid-turn steering transport.
- `9173663` — locked checkpoint/delivery semantics in tests.
- `21d30d2` — exposed live operator run/stall/provenance state and backend-authoritative run actions.
- `cd9875d` — backend-authorized dead-man recovery and tests.
- `cca37f3` — integrated valid C9–C11 UI lane work after terminal review.
- `c78ed3a` — integrated adaptive ChatGPT launch throttling/rate-limit cooldown with continuity.
- `5b15903` — finalized operator/developer/dogfood documentation.
- `7191971` / `d77b68d` — merged main event-storm hardening and corrected the conversation-report cache merge seam.
- `57e2479` / `9c7e318` — made dedupe lifecycle-aware and preserved explicit restart durability without undoing main's persistence debounce.
- `551ca6c` / `7865e57` — integrated duplicate-executor reconnect-war hardening and produced the final qualified candidate.

## Owner architecture proven in convergence

### Durable communication first

`message.send` is the public inter-worker primitive and creates the durable message/event before delivery. Delivery policies are `record_only`, `next_turn` and `steer_now`; priority is `normal` or `corrective`.

`conversation.steer` exists only as internal executor transport. Generating `steer_now` uses it after durability is established; idle delivery uses normal conversation send. Failed delivery preserves the original durable intent. Ambiguous mid-turn acceptance fails closed instead of silently resending.

### Checkpoint/control loop

The recurring active-worker wake is an orchestrator checkpoint, not a blind `continue` ping. It requests a durable lane report containing latest commits, completed/current/remaining work, blockers/risks/dependency or contract changes, then tells the worker to continue the same assignment.

Routine non-idle live checkpoint delivery has a >=15-minute floor per worker. Early normal wakes are durable and receive `notBefore`; idle may bypass the floor. Material corrective steering may bypass the floor but remains durable, deduplicated and idempotent.

Material worker progress creates a root wake. Root reviews lane reports against the whole run objective, ownership/scope, contracts, dependency state, convergence state and acceptance criteria rather than acknowledging liveness only.

### Dead-man defense in depth

Normal scheduling remains backend event/idle/checkpoint authority. The extension may only issue a bounded dead-man recovery request when every locally observed unfinished conversation for an enabled run is dead/missing. Backend independently validates active run state, effective dead-man policy, all relevant managed conversation states, threshold age and pending attempts before authorizing one idempotent recovery. A dead conversation may be replaced while retaining the same logical worker.

## Dogfood defects and recovery observations

### D001 — initial fresh managed-conversation launch failure

The first Wave-1 launches created `about:blank` tabs and failed before the content script receiver was reachable (`Could not establish connection. Receiving end does not exist.`). The executor launch path was hardened and the same logical workers were recovered; the run was not replaced.

### D002 — logical root had no visible conversation

A/B/C could make durable progress while `/root` initially had no bound visible ChatGPT conversation. This exposed the requirement that logical worker identity outlive conversation leases and that root progress/report wakes must be durable. The current recovered root is bound to the original logical `/root` worker.

### D003 — Git progress is not terminal state

During convergence, lane commits could exist before authoritative terminal handoffs. Root therefore treats Git heads as wake/progress evidence only and uses `worker.complete` / durable lifecycle state as completion authority.

### D004 — UI lane completed on stale backend contract

The C9–C11 UI worker correctly avoided fabricating unavailable backend run/stall state, but completed from baseline `9173663` before root's additive live contract `21d30d2`. Root terminal reconciliation integrated its valid popup/overlay/dashboard structure, then replaced permanent disabled C11 controls with backend-authoritative run actions and telemetry.

## Qualification evidence

Final isolated qualification is recorded in [`docs/qualification/2026-08-21-execution-continuity-final.md`](../qualification/2026-08-21-execution-continuity-final.md). Candidate `7865e579794783bfaa2a4ff337d968da90d11680` passed on `debian1`:

- `CI=true pnpm gate`: PASS;
- protocol 11/11; adapter 22/22; extension 35/35; persistence 9/9; core 33/33; MCP/executor 43/43;
- all typechecks/builds: PASS;
- extension package build: PASS;
- Firefox `web-ext` lint: 0 errors / 0 warnings / 0 notices;
- Firefox 154 executor-shell smoke: PASS for authenticated hello, ACK, unmanaged rejection, managed tab creation and Firefox identity;
- Chromium 150 clean-profile MV3/service-worker compatibility smoke: PASS.

Chromium's full loopback executor smoke was not forced because Local Network Access requires an interactive permission flow; this is the explicit permitted compatibility path in `docs/QUALIFICATION.md`.

## Remaining root actions

1. Fetch and reconcile the latest `origin/main`.
2. If no new code changed the qualified tree, fast-forward/land the qualified lineage and verify the remote head.
3. Update this durable record with the final landing SHA if it differs from the qualified candidate because of documentation-only landing metadata.
4. Call authoritative `worker.complete` for `/root`.