# Orchestrator Continuous Wake + Root Recovery

Status: implementation converged; final isolated qualification / landing pending
Date: 2026-08-21
Run: `run_7a9a2217-edc1-41ed-9eb6-7dfda2048eba`
Recovered root: `wrk_83b1154e-a9e8-44ca-b7c2-b7fc11e071a1`

## Original correctness defect

The first Execution Continuity dogfood run proved that logical child workers could make durable progress while logical `/root` had no bound visible ChatGPT conversation. A terminal lane handoff or blocker could therefore exist durably without a visible coordinator conversation guaranteed to consume it.

Recovery attached the current visible root conversation to the existing logical `/root` worker and preserved the original run, assignments, lane handoffs and branch state. No replacement run was created.

## Durable architecture now implemented

1. Logical worker identity survives browser/conversation replacement. Conversation bindings are execution leases, not worker identity.
2. Run/root/worker provenance is owner-readable and persisted.
3. Primary continuity authority is the backend: event wakes, idle wakes and jittered active checkpoints.
4. The ~20–21 minute active wake is a checkpoint/control message requesting durable lane status and telling the lane to continue, not a blind `continue`.
5. Public communication is durable `message.send`; live steering is a delivery policy. No live steering exists without a corresponding durable run message.
6. `delivery=steer_now` uses internal `conversation.steer` only when ChatGPT is generating; idle uses normal send.
7. Routine non-idle live delivery observes the >=15-minute floor. Early wakes persist/coalesce with durable `notBefore`; idle may bypass.
8. Corrective steering may bypass the routine floor when delay would knowingly allow conflicting/out-of-scope work, but remains durable/deduplicated/idempotent.
9. Material lane progress wakes root. Root reviews the lane against whole-run objective, scope, contracts, dependencies, convergence and acceptance criteria.
10. Git commits remain progress evidence, never completion authority; `worker.complete` is authoritative.
11. Ambiguous browser submission/steering fails closed; the executor never blindly presses Retry.
12. C9–C11 operator UI projects live backend run/worker policy, stall state, recent events and run actions without simulating backend authority in browser tabs.
13. LibreWolf dead-man recovery is final defense-in-depth only: extension detection/request, backend authorization/threshold/dedupe, same logical worker recovery. Disabling it leaves normal scheduling intact.
14. The output-only `durable-continuation-output` skill remains deliberately ignorant of browser/scheduler/MCP mechanics; strict parsing is one bounded signal and durable state remains authoritative.

## Reconciled lane state

All child lanes are terminal in the authoritative run:

- A domain/protocol/persistence: `f397c4d` — consumed.
- B scheduler/MCP: `47c71e2` — consumed; B/C protocol seam corrected during root convergence.
- C browser executor: `bc53a22` — consumed.
- UI final: `6fc33aa` — terminally reviewed; valid UI work consumed and stale disabled-C11 assumption corrected by root.

Root convergence is on `impl/continuity-root-integration`; current implementation checkpoint before final documentation/qualification is `c78ed3a`.

## Verification already obtained

Before the last extension convergence patch, workspace typecheck/build passed and the MCP/executor continuity suite passed 42/42, including generating checkpoint steering, routine floor/notBefore, idle/corrective bypass, message idempotency, retry preservation, ambiguous fail-closed delivery, root progress wake and backend dead-man authorization.

The UI worker separately qualified its earlier extension baseline on `debian1` (typecheck/build, 29/29 tests, Firefox/Chromium package build). Because root subsequently added live C11 and dead-man extension behavior, the final complete tree still requires isolated buildbox qualification.

## Final gate

The implementation is not considered complete until the final tree passes the repository/build/browser qualification required by `docs/QUALIFICATION.md`, is reconciled with latest `origin/main`, pushed to `origin/main`, remote head is verified, the dogfood qualification receipt is updated, and `/root` is terminally completed through the orchestrator.