@moretea-labs/forge 1.5.1 → 1.7.0

package/src/runtime/gateway/mcp/execution-tools.ts

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from 'crypto';
-import { existsSync, readFileSync } from 'fs';
+import { existsSync, readFileSync, realpathSync } from 'fs';
 import { spawnSync } from 'child_process';
 import { basename, isAbsolute, relative, resolve } from 'path';
 import type { McpToolDefinition, CallToolResult } from '../../../cli/mcp/tools';
@@ -14,25 +14,26 @@ import {
   setRepositoryCheckoutLifecycle,
 } from '../../../cli/repositories/registry';
 import { withControllerLock } from '../../../cli/repositories/locks';
-import { repositoryGitCommit, repositoryGitDeleteBranch, repositoryGitFinishWorkflow, repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
+import { repositoryGitCommit, repositoryGitDeleteBranch, repositoryGitFinishWorkflow, repositoryGitMergeBranch, repositoryGitRebaseOnto, repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
 import { previewRepositoryCommandExecution } from '../../../cli/repositories/command-executor';
 import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
 import { globMatches } from '../../../cli/mcp/paths';
 import { ensureManagedWorkspace } from '../../execution/managed-workspace';
-import { listControllerChecks } from '../../../cli/controller/check-runner';
+import { listControllerChecks, type ControllerCheck } from '../../../cli/controller/check-runner';
 import { readRepositoryAccessPolicy } from '../../control-plane/governance/access-policy';
-import { appendWorkEvidence, createWorkContract, getWorkContract, recordWorkCompletionReceipt, updateWorkContract, appendVerificationRecord } from '../../control-plane/facade/work-contract-store';
+import { appendWorkEvidence, createWorkContract, getWorkContract, recordWorkCompletionReceipt, transitionWorkContractPhase, updateWorkContract, appendVerificationRecord } from '../../control-plane/facade/work-contract-store';
 import { completeRequirementFromWork } from '../../control-plane/persistence/requirement-store';
-import { isTerminalWorkContractStatus, type WorkReconciliationRecord } from '../../control-plane/facade/types';
+import { isTerminalWorkContractStatus, type VerificationRecord, type WorkReconciliationRecord } from '../../control-plane/facade/types';
 import { buildWorkContinuationSnapshot } from '../../control-plane/facade/work-continuation';
-import { claimControllerSession, getControllerSession, releaseControllerSession, resumeControllerSession } from '../../control-plane/facade/controller-session-store';
+import { claimControllerSession, getControllerSession, releaseControllerSession, releaseControllerSessionWithAuthority, resumeControllerSession, withControllerSessionTerminalizationFence } from '../../control-plane/facade/controller-session-store';
 import { currentControllerInstanceId, requireExecutionSession, startExecutionSession, updateExecutionSession, type ExecutionSessionContext, type SessionIdentity } from '../../control-plane/execution/session-store';
 import { currentPermissionSnapshotVersion, validateWorkHandle } from '../../control-plane/execution/validation';
-import { commandFingerprint, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from '../../control-plane/execution/verification-evidence';
+import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from '../../control-plane/execution/verification-evidence';
 import { assertExecutionIdentity, executionIdentityForWork, executionIdentityFromCoordinates, resolveLegacyWorkContractIdentity } from '../../control-plane/execution/execution-identity';
 import { withWorkPrepareRequest } from '../../control-plane/execution/work-prepare-request-store';
-import { markWorkHandleFailed, newWorkId, readWorkHandle, transitionWorkHandle, writeWorkHandle, type WorkFinalizationStages, type WorkHandleState, type WorkTerminalOutcome } from '../../control-plane/execution/work-handle-store';
+import { markWorkHandleFailed, newWorkId, readWorkHandle, transitionWorkHandle, workDeliveryBaseRevision, writeWorkHandle, type WorkFinalizationStages, type WorkHandleState, type WorkTerminalOutcome } from '../../control-plane/execution/work-handle-store';
 import { cleanupTerminalWork } from '../../control-plane/execution/work-terminal-cleanup';
+import { pushExactWorkRemoteDelivery, type WorkRemoteDeliveryReceipt } from '../../control-plane/execution/work-remote-delivery';
 import { assertResolvedAuthorization, createGoalDelegation, decideAuthorization, resolveAuthorizationRequest, type AuthorizationDecision, type AuthorizationRiskClass } from '../../control-plane/governance/authorization';
 import { readControllerResult, searchControllerResult, writeControllerResult } from '../../evidence/result-store';
 import { resumeExecutionJobAfterApproval } from '../../execution/jobs/store';
@@ -42,6 +43,7 @@ import { markRepositoryProjectionDirty } from '../../projections/invalidation';
 import { executeRepositoryCommandViaProcessRuntime } from '../../execution/process-runtime/command-facade';
 import { getCheckProcessHandle } from '../../execution/process-runtime/check-facade';
 import { processCheckCompletionReceipt } from '../../execution/process-runtime/check-receipt';
+import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
 import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
 import { runPersistedCheckViaProcessRuntime } from './persisted-check-process';
 import { hasCurrentWorkValidationAuthority, markWorkValidationPending, projectWorkValidationOutcome, reconcileWorkValidation } from './work-validation-reconciler';
@@ -62,7 +64,7 @@ export const executionToolDefinitions: McpToolDefinition[] = [
   definition('work_prepare', 'Prepare or reuse one controller-owned work handle and bind it to a WorkContract, checkout, branch, and permission snapshot.', {
     session_id: sessionId, repo_id: repoId, checkout_id: { type: 'string' }, work_id: workId,
     objective: { type: 'string' }, goal_id: { type: 'string' }, acceptance_criteria: { type: 'array', items: { type: 'string' } }, allowed_paths: { type: 'array', items: { type: 'string' } }, checks: { type: 'array', items: { type: 'string' } },
-    isolation: { type: 'string', enum: ['reuse', 'new_worktree', 'auto'] }, base_ref: { type: 'string' },
+    isolation: { type: 'string', enum: ['reuse', 'new_worktree', 'auto'] }, base_ref: { type: 'string' }, needs_dependencies: { type: 'boolean' },
     expected_previous_head: { type: 'string', description: 'Explicit prior WorkHandle HEAD required for audited successor adoption of an existing work_id.' },
     adopt_candidate_head: { type: 'string', description: 'Explicit current successor commit to adopt after exact identity, ownership, cleanliness, ancestry, and path-scope validation.' },
   }, [], false),
@@ -76,7 +78,7 @@ export const executionToolDefinitions: McpToolDefinition[] = [
     session_id: sessionId, controller_id: { type: 'string', description: 'Controller identity that holds the Work lease. Defaults to the authenticated principal.' }, repo_id: repoId, work_id: workId, check_ids: { type: 'array', items: { type: 'string' } }, commands: { type: 'array', items: { type: 'object' } },
   }, ['work_id'], false),
   definition('work_finalize', 'Idempotently validate, commit, merge, clean a managed worktree, and complete the existing WorkContract in independently recorded stages.', {
-    session_id: sessionId, controller_id: { type: 'string', description: 'Controller identity that holds the Work lease. Defaults to the authenticated principal.' }, repo_id: repoId, work_id: workId, commit: { type: 'boolean' }, message: { type: 'string' }, merge: { type: 'boolean' }, target_branch: { type: 'string' }, delete_branch: { type: 'boolean' }, cleanup: { type: 'boolean' }, no_ff: { type: 'boolean' }, approval_request_id: { type: 'string' },
+    session_id: sessionId, controller_id: { type: 'string', description: 'Controller identity that holds the Work lease. Defaults to the authenticated principal.' }, repo_id: repoId, work_id: workId, commit: { type: 'boolean' }, message: { type: 'string' }, merge: { type: 'boolean' }, target_branch: { type: 'string' }, remote_write: { type: 'boolean', description: 'When true, push the exact locally integrated target revision to origin before cleanup and Work terminalization.' }, delete_branch: { type: 'boolean' }, cleanup: { type: 'boolean' }, no_ff: { type: 'boolean' }, approval_request_id: { type: 'string' },
     completion_outcome: { type: 'string', enum: ['completed_changed', 'completed_no_change'] }, no_change_evidence: { type: 'string', description: 'Objective-specific proof that the requested state already holds; required for completed_no_change.' },
   }, ['work_id'], false, true),
   definition('approval_resolve', 'Resolve a controller approval request from the current conversation; GUI approval is optional and not required for continuation.', { session_id: sessionId, repo_id: repoId, work_id: workId, approval_request_id: { type: 'string' }, confirm_authorization: { type: 'boolean' } }, ['approval_request_id', 'confirm_authorization'], false),
@@ -158,11 +160,12 @@ function compactHandle(handle: WorkHandleState): Record<string, unknown> {
   return {
     workId: handle.workId, sessionId: handle.sessionId, repoId: handle.repositoryId, checkoutId: handle.checkoutId,
     worktreePath: handle.worktreePath, branch: handle.branch, sourceCheckoutId: handle.sourceCheckoutId, goalId: handle.goalId, delegationVersion: handle.delegationVersion,
-    workContractId: handle.workContractId, baseCommit: handle.baseCommit, expectedHead: handle.expectedHead,
+    workContractId: handle.workContractId, baseCommit: handle.baseCommit, deliveryBaseCommit: handle.deliveryBaseCommit, expectedHead: handle.expectedHead,
     permissionSnapshotVersion: handle.permissionSnapshotVersion, state: handle.state, managedWorktree: handle.managedWorktree,
     createdAt: handle.createdAt, updatedAt: handle.updatedAt, finalization: handle.finalization,
     ...(handle.failureReason ? { failureReason: handle.failureReason } : {}),
     ...(handle.cleanupResponsibility ? { cleanupResponsibility: handle.cleanupResponsibility } : {}),
+    ...(handle.terminalResourceDisposition ? { terminalResourceDisposition: handle.terminalResourceDisposition } : {}),
     ...(handle.cleanupReceipt ? { cleanupReceipt: handle.cleanupReceipt } : {}),
   };
 }
@@ -171,9 +174,13 @@ function initialStage(): WorkFinalizationStages {
   return { validation: 'pending', commit: 'pending', merge: 'pending', branchCleanup: 'pending', worktreeCleanup: 'pending' };
 }
 
+function gitRevision(root: string, revision: string): string | undefined {
+  const output = spawnSync('git', ['-C', root, 'rev-parse', '--verify', `${revision}^{commit}`], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000 });
+  return output.status === 0 && typeof output.stdout === 'string' && output.stdout.trim() ? output.stdout.trim() : undefined;
+}
+
 function gitHead(root: string): string | undefined {
-  const output = spawnSync('git', ['-C', root, 'rev-parse', '--verify', 'HEAD'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000 });
-  return output.status === 0 && typeof output.stdout === 'string' ? output.stdout.trim() : undefined;
+  return gitRevision(root, 'HEAD');
 }
 
 function gitCommit(root: string, revision: string, label: string): string {
@@ -196,6 +203,250 @@ function gitChangedPaths(root: string, previousHead: string, candidateHead: stri
   return [...new Set(output.stdout.split('\0').filter(Boolean))].sort((left, right) => left.localeCompare(right));
 }
 
+function gitMergeBase(root: string, leftHead: string, rightHead: string): string {
+  const output = spawnSync('git', ['-C', root, 'merge-base', leftHead, rightHead], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (output.status !== 0 || output.error || typeof output.stdout !== 'string' || !output.stdout.trim()) {
+    throw new Error('WORK_HEAD_ADOPTION_SCOPE_BASE_UNAVAILABLE');
+  }
+  return output.stdout.trim();
+}
+
+function gitIsAncestor(root: string, ancestor: string, descendant: string): boolean {
+  const result = spawnSync('git', ['-C', root, 'merge-base', '--is-ancestor', ancestor, descendant], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (result.error || (result.status !== 0 && result.status !== 1)) {
+    throw new Error(`WORK_TARGET_ADVANCE_ANCESTRY_UNAVAILABLE: ${ancestor} -> ${descendant}`);
+  }
+  return result.status === 0;
+}
+
+export interface WorkTargetAdvanceInspection {
+  relation: 'candidate_contains_target' | 'target_contains_candidate' | 'diverged_clean' | 'diverged_conflict';
+  candidateHead: string;
+  targetHead: string;
+  mergeBase: string;
+  candidateChangedPaths: string[];
+  targetChangedPaths: string[];
+  mergedTree?: string;
+  detail?: string;
+}
+
+export function inspectWorkTargetAdvance(root: string, candidateRevision: string, targetRevision: string): WorkTargetAdvanceInspection {
+  const candidateHead = gitCommit(root, candidateRevision, 'TARGET_ADVANCE_CANDIDATE');
+  const targetHead = gitCommit(root, targetRevision, 'TARGET_ADVANCE_TARGET');
+  if (gitIsAncestor(root, targetHead, candidateHead)) {
+    return {
+      relation: 'candidate_contains_target', candidateHead, targetHead, mergeBase: targetHead,
+      candidateChangedPaths: gitChangedPaths(root, targetHead, candidateHead), targetChangedPaths: [],
+    };
+  }
+  if (gitIsAncestor(root, candidateHead, targetHead)) {
+    return {
+      relation: 'target_contains_candidate', candidateHead, targetHead, mergeBase: candidateHead,
+      candidateChangedPaths: [], targetChangedPaths: gitChangedPaths(root, candidateHead, targetHead),
+    };
+  }
+  const mergeBase = gitMergeBase(root, candidateHead, targetHead);
+  const candidateChangedPaths = gitChangedPaths(root, mergeBase, candidateHead);
+  const targetChangedPaths = gitChangedPaths(root, mergeBase, targetHead);
+  const preflight = spawnSync('git', ['-C', root, 'merge-tree', '--write-tree', candidateHead, targetHead], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000, maxBuffer: 512 * 1024,
+  });
+  if (preflight.error || (preflight.status !== 0 && preflight.status !== 1)) {
+    throw new Error(`WORK_TARGET_ADVANCE_PREFLIGHT_UNAVAILABLE: ${preflight.error?.message ?? preflight.stderr ?? 'merge-tree failed'}`);
+  }
+  if (preflight.status === 0) {
+    const mergedTree = typeof preflight.stdout === 'string' ? preflight.stdout.trim().split(/\s+/)[0] : undefined;
+    return {
+      relation: 'diverged_clean', candidateHead, targetHead, mergeBase, candidateChangedPaths, targetChangedPaths,
+      ...(mergedTree ? { mergedTree } : {}),
+    };
+  }
+  const detail = `${preflight.stdout ?? ''}\n${preflight.stderr ?? ''}`.trim().slice(0, 1_000);
+  return { relation: 'diverged_conflict', candidateHead, targetHead, mergeBase, candidateChangedPaths, targetChangedPaths, ...(detail ? { detail } : {}) };
+}
+
+export function targetAdvanceLinearMergeCommits(root: string, targetRevision: string, candidateRevision: string): string[] {
+  const targetHead = gitCommit(root, targetRevision, 'TARGET_ADVANCE_LINEAR_TARGET');
+  const candidateHead = gitCommit(root, candidateRevision, 'TARGET_ADVANCE_LINEAR_CANDIDATE');
+  const output = spawnSync('git', ['-C', root, 'rev-list', '--merges', `${targetHead}..${candidateHead}`], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000, maxBuffer: 512 * 1024,
+  });
+  if (output.status !== 0 || output.error || typeof output.stdout !== 'string') {
+    throw new Error('WORK_TARGET_ADVANCE_LINEAR_HISTORY_UNAVAILABLE: could not inspect candidate merge history');
+  }
+  return output.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+}
+
+function normalizedReadScope(scope: string): string {
+  return scope.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '') || '.';
+}
+
+function pathIsWithinReadScope(path: string, scope: string): boolean {
+  const normalized = normalizedReadScope(scope);
+  return normalized === '.' || path === normalized || path.startsWith(`${normalized}/`);
+}
+
+function stableCheckDefinition(check: ControllerCheck | undefined): string | undefined {
+  if (!check) return undefined;
+  return JSON.stringify({
+    id: check.id,
+    command: check.command,
+    cwd: check.cwd,
+    timeoutMs: check.timeoutMs,
+    source: check.source,
+    effects: check.effects ?? null,
+  });
+}
+
+export interface TargetAdvanceValidationTransferPlan {
+  transferredRecords: VerificationRecord[];
+  reusableCheckIds: string[];
+  invalidatedCheckIds: string[];
+}
+
+export function planTargetAdvanceValidationAuthority(input: {
+  checkIds: string[];
+  checkRefs: VerificationRecord[];
+  checksBefore: ControllerCheck[];
+  checksAfter: ControllerCheck[];
+  candidateHead: string;
+  candidateWorkspaceFingerprint: string;
+  integratedHead: string;
+  integratedWorkspaceFingerprint: string;
+  targetChangedPaths: string[];
+  recordedAt?: string;
+}): TargetAdvanceValidationTransferPlan {
+  const beforeById = new Map(input.checksBefore.map((check) => [check.id, check]));
+  const afterById = new Map(input.checksAfter.map((check) => [check.id, check]));
+  const transferredRecords: VerificationRecord[] = [];
+  const reusableCheckIds: string[] = [];
+  const invalidatedCheckIds: string[] = [];
+  const recordedAt = input.recordedAt ?? new Date().toISOString();
+  for (const checkId of input.checkIds) {
+    const before = beforeById.get(checkId);
+    const after = afterById.get(checkId);
+    const reads = before?.effects?.reads;
+    const definitionUnchanged = stableCheckDefinition(before) !== undefined
+      && stableCheckDefinition(before) === stableCheckDefinition(after);
+    const readsGitHistory = before?.effects?.git !== undefined;
+    const targetTouchesReadScope = !reads || reads.length === 0
+      || input.targetChangedPaths.some((path) => reads.some((scope) => pathIsWithinReadScope(path, scope)));
+    const sourcePass = effectiveVerificationEvidence(input.checkRefs, {
+      sourceRevision: input.candidateHead,
+      workspaceFingerprint: input.candidateWorkspaceFingerprint,
+      checkId,
+      requestedChecks: input.checkIds,
+    }).find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))?.record;
+    if (!definitionUnchanged || readsGitHistory || targetTouchesReadScope || !sourcePass) {
+      invalidatedCheckIds.push(checkId);
+      continue;
+    }
+    const transferred: VerificationRecord = {
+      ...sourcePass,
+      summary: `Validation authority transferred across target advancement because target-only changes did not intersect check ${checkId} read inputs.`,
+      recordedAt,
+      sourceRevision: input.integratedHead,
+      workspaceFingerprint: input.integratedWorkspaceFingerprint,
+      verificationInputFingerprint: verificationInputFingerprint({
+        sourceRevision: input.integratedHead,
+        workspaceFingerprint: input.integratedWorkspaceFingerprint,
+        checkId,
+        requestedChecks: input.checkIds,
+      }),
+      evidenceRef: {
+        title: checkId,
+        summary: `Reused prior valid receipt after proving target-only path changes do not affect this check's declared inputs.`,
+        detailLevel: 'summary',
+      },
+    };
+    transferredRecords.push(transferred);
+    reusableCheckIds.push(checkId);
+  }
+  return { transferredRecords, reusableCheckIds, invalidatedCheckIds };
+}
+
+export function targetAdvanceWorkScopeViolation(
+  scope: { allowedPaths: string[]; forbiddenPaths: string[] } | undefined,
+  changedPaths: string[],
+): { kind: 'forbidden' | 'out_of_scope'; path: string } | undefined {
+  if (!scope) return undefined;
+  for (const path of changedPaths) {
+    if (scope.forbiddenPaths.some((pattern) => globMatches(pattern, path))) return { kind: 'forbidden', path };
+    if (scope.allowedPaths.length > 0 && !scope.allowedPaths.some((pattern) => globMatches(pattern, path))) {
+      return { kind: 'out_of_scope', path };
+    }
+  }
+  return undefined;
+}
+
+function replaceTargetAdvanceScopeEvidence(
+  ctx: MultiRepositoryMcpToolContext,
+  contract: NonNullable<ReturnType<typeof contractFor>>,
+  actualChangedPaths: string[],
+): void {
+  updateWorkContract({ controllerHome: ctx.controllerHome, repoId: contract.repoId }, contract.workId, {
+    scopeEvidence: {
+      initialLikelyPaths: contract.scopeEvidence?.initialLikelyPaths ?? contract.allowedPaths,
+      inspectedPaths: contract.scopeEvidence?.inspectedPaths ?? [],
+      actualChangedPaths: [...new Set(actualChangedPaths)].sort((left, right) => left.localeCompare(right)).slice(0, 500),
+      recordedAt: new Date().toISOString(),
+    },
+  });
+}
+
+export interface DirectTargetDeliveryInspection {
+  integrated: boolean;
+  reason: 'not_direct_target' | 'path_mismatch' | 'branch_mismatch' | 'dirty' | 'revision_unavailable' | 'not_reachable' | 'integrated';
+  expectedHead?: string;
+  targetHead?: string;
+}
+
+/**
+ * Direct-edit Work may already be executing on the delivery branch. In that
+ * case Git merge is not a delivery operation at all: the Work commit is
+ * integrated once its exact expected revision remains reachable from the
+ * target branch. Keep this proof deliberately strict so a feature Work or a
+ * dirty/mismatched checkout still follows the normal fail-closed merge path.
+ */
+export function inspectDirectTargetDelivery(
+  root: string,
+  worktreePath: string,
+  managedWorktree: boolean,
+  workBranch: string,
+  targetBranch: string,
+  expectedRevision: string | undefined,
+): DirectTargetDeliveryInspection {
+  if (managedWorktree || workBranch !== targetBranch) return { integrated: false, reason: 'not_direct_target' };
+  try {
+    if (realpathSync(root) !== realpathSync(worktreePath)) return { integrated: false, reason: 'path_mismatch' };
+  } catch {
+    return { integrated: false, reason: 'path_mismatch' };
+  }
+  const branch = spawnSync('git', ['-C', root, 'branch', '--show-current'], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (branch.status !== 0 || typeof branch.stdout !== 'string' || branch.stdout.trim() !== targetBranch) {
+    return { integrated: false, reason: 'branch_mismatch' };
+  }
+  const status = spawnSync('git', ['-C', root, 'status', '--porcelain'], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (status.status !== 0 || typeof status.stdout !== 'string' || status.stdout.trim()) {
+    return { integrated: false, reason: 'dirty' };
+  }
+  const expectedHead = expectedRevision ? gitRevision(root, expectedRevision) : undefined;
+  const targetHead = gitRevision(root, targetBranch);
+  if (!expectedHead || !targetHead) return { integrated: false, reason: 'revision_unavailable' };
+  if (!gitIsAncestor(root, expectedHead, targetHead)) {
+    return { integrated: false, reason: 'not_reachable', expectedHead, targetHead };
+  }
+  return { integrated: true, reason: 'integrated', expectedHead, targetHead };
+}
+
 function normalizedRequiredString(args: Record<string, unknown>, key: string): string | undefined {
   return typeof args[key] === 'string' && args[key].trim() ? args[key].trim() : undefined;
 }
@@ -230,6 +481,42 @@ function workReturnCheckoutId(
   return target.activeCheckoutId ?? repository.activeCheckoutId ?? fallbackCheckoutId;
 }
 
+function exactCommitChangedPaths(repoRoot: string, revision: string): string[] {
+  const result = spawnSync('git', ['-C', repoRoot, 'diff-tree', '--root', '--no-commit-id', '--name-only', '-r', revision], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (result.status !== 0 || result.error || typeof result.stdout !== 'string') {
+    throw new Error(`WORK_COMPLETION_RECEIPT_COMMIT_PATHS_UNAVAILABLE: ${revision}`);
+  }
+  return Array.from(new Set(result.stdout.split('\n').map((entry) => entry.trim()).filter(Boolean)))
+    .sort((left, right) => left.localeCompare(right));
+}
+
+function workOwnedDirtyPaths(
+  contract: ReturnType<typeof contractFor>,
+  status: ReturnType<typeof repositoryGitStatus>,
+): { dirtyPaths: string[]; ownedPaths: string[] } {
+  const dirtyPaths = [...new Set([...status.staged, ...status.unstaged, ...status.untracked])]
+    .sort((left, right) => left.localeCompare(right));
+  if (!contract) return { dirtyPaths, ownedPaths: dirtyPaths };
+  const ownedPaths = dirtyPaths.filter((path) => {
+    if (contract.forbiddenPaths.some((pattern) => globMatches(pattern, path))) return false;
+    return contract.allowedPaths.length === 0 || contract.allowedPaths.some((pattern) => globMatches(pattern, path));
+  });
+  return { dirtyPaths, ownedPaths };
+}
+
+export function completionReceiptChangedPaths(repoRoot: string, baseRevision: string, deliveryRevision: string): string[] {
+  const result = spawnSync('git', ['-C', repoRoot, 'diff', '--name-only', `${baseRevision}..${deliveryRevision}`], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (result.status !== 0 || result.error || typeof result.stdout !== 'string') {
+    throw new Error(`WORK_COMPLETION_RECEIPT_CHANGED_PATHS_UNAVAILABLE: ${baseRevision}..${deliveryRevision}`);
+  }
+  return Array.from(new Set(result.stdout.split('\n').map((entry) => entry.trim()).filter(Boolean)))
+    .sort((left, right) => left.localeCompare(right));
+}
+
 function completionReceiptForFinalizedWork(
   ctx: MultiRepositoryMcpToolContext,
   handle: WorkHandleState,
@@ -241,21 +528,31 @@ function completionReceiptForFinalizedWork(
   const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
     ? args.target_branch.trim()
     : repository.defaultBranch || 'main';
-  const targetRevision = gitHead(target.canonicalRoot);
-  if (!targetRevision) throw new Error('WORK_COMPLETION_RECEIPT_TARGET_REQUIRED: target HEAD is unavailable');
-  const reachable = spawnSync('git', ['-C', target.canonicalRoot, 'merge-base', '--is-ancestor', targetRevision, targetBranch], {
+  const targetRevision = gitRevision(target.canonicalRoot, targetBranch);
+  if (!targetRevision) throw new Error(`WORK_COMPLETION_RECEIPT_TARGET_REQUIRED: target branch ${targetBranch} is unavailable`);
+  const noChange = args.completion_outcome === 'completed_no_change';
+  // Delivery authority is always the Work's own revision, never the target
+  // branch's newest HEAD. The target may have advanced because of unrelated
+  // concurrent Work; targetRevision records integration identity, while
+  // deliveryRevision owns path attribution and reachability proof.
+  const deliveryRevision = handle.expectedHead ?? handle.baseCommit;
+  if (!deliveryRevision) throw new Error('WORK_COMPLETION_RECEIPT_SOURCE_REQUIRED: Work delivery revision is unavailable');
+  const reachable = deliveryRevision === targetRevision || spawnSync('git', ['-C', target.canonicalRoot, 'merge-base', '--is-ancestor', deliveryRevision, targetBranch], {
     encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
   }).status === 0;
-  if (!reachable) throw new Error(`WORK_COMPLETION_RECEIPT_DELIVERY_NOT_PROVEN: ${targetRevision} is not reachable from ${targetBranch}`);
-  const changedPaths = handle.baseCommit
-    ? Array.from(new Set(String(spawnSync('git', ['-C', target.canonicalRoot, 'diff', '--name-only', `${handle.baseCommit}..${targetRevision}`], {
-        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-      }).stdout ?? '').split('\n').map((entry) => entry.trim()).filter(Boolean))).sort((left, right) => left.localeCompare(right))
-    : [];
+  if (!reachable) throw new Error(`WORK_COMPLETION_RECEIPT_DELIVERY_NOT_PROVEN: ${deliveryRevision} is not reachable from ${targetBranch}`);
+  const deliveryBaseRevision = workDeliveryBaseRevision(handle);
+  const changedPaths = noChange
+    ? []
+    : !handle.managedWorktree && handle.finalization.commit === 'done'
+      ? exactCommitChangedPaths(target.canonicalRoot, deliveryRevision)
+      : deliveryBaseRevision
+        ? completionReceiptChangedPaths(target.canonicalRoot, deliveryBaseRevision, deliveryRevision)
+        : (() => { throw new Error('WORK_COMPLETION_RECEIPT_BASE_REQUIRED: Work delivery provenance base is unavailable'); })();
   const recordedAt = new Date().toISOString();
-  const noChange = args.completion_outcome === 'completed_no_change';
+  const retainsExplicitDeliveryBranch = args.merge !== true && targetBranch === handle.branch;
   const warnings = [
-    ...(handle.finalization.branchCleanup === 'skipped' ? [{ code: 'cleanup_retained_by_request' as const, message: 'Branch cleanup was skipped by the finalization request.', resourceKind: 'branch' as const, resourceId: handle.branch, recordedAt }] : []),
+    ...(handle.finalization.branchCleanup === 'skipped' && !retainsExplicitDeliveryBranch ? [{ code: 'cleanup_retained_by_request' as const, message: 'Branch cleanup was skipped by the finalization request.', resourceKind: 'branch' as const, resourceId: handle.branch, recordedAt }] : []),
     ...(handle.finalization.worktreeCleanup === 'skipped' && handle.managedWorktree ? [{ code: 'cleanup_retained_by_request' as const, message: 'Managed worktree cleanup was skipped by the finalization request.', resourceKind: 'worktree' as const, resourceId: handle.worktreePath, recordedAt }] : []),
   ];
   return {
@@ -267,7 +564,7 @@ function completionReceiptForFinalizedWork(
     workId: handle.workId,
     targetBranch,
     targetRevision,
-    sourceRevision: handle.baseCommit,
+    sourceRevision: deliveryRevision,
     baseRevision: handle.baseCommit,
     changedPaths,
     delivery: {
@@ -302,6 +599,7 @@ function workPrepareFingerprint(input: {
   allowedPaths: string[];
   checks: string[];
   baseRef?: string;
+  needsDependencies: boolean;
 }): string {
   return createHash('sha256').update(JSON.stringify({ schemaVersion: 1, operation: 'work_prepare', ...input })).digest('hex');
 }
@@ -363,14 +661,30 @@ function findWorkHandle(
   });
 }
 
+function currentControllerClaimAuthorizesTerminalCleanup(
+  ctx: MultiRepositoryMcpToolContext,
+  session: ExecutionSessionContext,
+  handle: WorkHandleState,
+): boolean {
+  if (!terminalCleanupOutcome(ctx, handle)) return false;
+  const workIdValue = handle.workContractId ?? handle.workId;
+  const owner = getControllerSession({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, workIdValue);
+  if (!owner) return false;
+  return (owner.principalId?.trim() || owner.controllerId) === session.principalId
+    && owner.controllerInstanceId === session.controllerInstanceId;
+}
+
 function workForSession(
   ctx: MultiRepositoryMcpToolContext,
   session: ExecutionSessionContext,
   args: Record<string, unknown>,
-  options: { reconcileValidation?: boolean } = {},
+  options: { reconcileValidation?: boolean; allowClaimedTerminalCleanup?: boolean } = {},
 ): WorkHandleState {
   let handle = findWorkHandle(ctx, session, args);
-  if (handle.principalId !== session.principalId) throw new Error('WORK_HANDLE_PRINCIPAL_MISMATCH: work handle belongs to another principal');
+  if (
+    handle.principalId !== session.principalId
+    && !(options.allowClaimedTerminalCleanup === true && currentControllerClaimAuthorizesTerminalCleanup(ctx, session, handle))
+  ) throw new Error('WORK_HANDLE_PRINCIPAL_MISMATCH: work handle belongs to another principal');
   if (options.reconcileValidation !== false) handle = reconcileWorkValidation(ctx.controllerHome, handle).handle;
   if (
     session.activeRepositoryId !== handle.repositoryId
@@ -393,27 +707,53 @@ function assertWorkControllerOwnership(
   session: ExecutionSessionContext,
   handle: WorkHandleState,
   args: Record<string, unknown>,
-): void {
+) {
   const workIdValue = handle.workContractId ?? handle.workId;
-  const owner = getControllerSession({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, workIdValue);
+  const options = { controllerHome: ctx.controllerHome, repoId: handle.repositoryId };
+  const owner = getControllerSession(options, workIdValue);
   const controllerId = typeof args.controller_id === 'string' && args.controller_id.trim()
     ? args.controller_id.trim()
     : session.principalId;
   if (controllerId !== session.principalId) {
     throw new Error('WORK_CONTROLLER_IDENTITY_MISMATCH: controller_id must match the authenticated principal');
   }
-  const resumed = resumeControllerSession({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, {
+  if (owner) {
+    const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
+    const ownerInstanceId = owner.controllerInstanceId?.trim() || '';
+    if (owner.controllerId !== controllerId) throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workIdValue} is owned by ${owner.controllerId}`);
+    if (ownerPrincipal !== session.principalId) throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workIdValue}`);
+    if (!ownerInstanceId || ownerInstanceId !== session.controllerInstanceId) throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workIdValue}`);
+    if (typeof owner.claimGeneration !== 'number' || owner.claimGeneration < 1) throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workIdValue}`);
+    const resumed = resumeControllerSession(options, {
+      workId: workIdValue,
+      controllerId,
+      controllerType: owner.controllerType,
+      sessionId: session.sessionId,
+      principalId: session.principalId,
+      controllerInstanceId: session.controllerInstanceId,
+      expectedClaimGeneration: owner.claimGeneration,
+      leaseMs: 3_600_000,
+    });
+    if (
+      resumed.controllerId !== controllerId
+      || resumed.principalId !== session.principalId
+      || resumed.controllerInstanceId !== session.controllerInstanceId
+      || resumed.claimGeneration !== owner.claimGeneration
+    ) {
+      throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workIdValue} ownership epoch changed during resume`);
+    }
+    return resumed;
+  }
+  return claimControllerSession(options, {
     workId: workIdValue,
     controllerId,
-    controllerType: owner?.controllerType ?? 'chatgpt',
+    controllerType: 'chatgpt',
     sessionId: session.sessionId,
     principalId: session.principalId,
     controllerInstanceId: session.controllerInstanceId,
+    expectedClaimGeneration: 0,
     leaseMs: 3_600_000,
   });
-  if (resumed.controllerId !== controllerId || resumed.sessionId !== session.sessionId) {
-    throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workIdValue} is owned by ${resumed.controllerId}/${resumed.sessionId}`);
-  }
 }
 
 function claimPreparedWorkOwnership(
@@ -552,7 +892,16 @@ function adoptExistingWorkHead(
   if (isTerminalWorkContractStatus(contract.status) || contract.completionReceipt) {
     throw new Error('WORK_HEAD_ADOPTION_CONTRACT_TERMINAL');
   }
-  const changedPaths = gitChangedPaths(handle.worktreePath, previousHead, candidateHead);
+  // expectedHead can predate unrelated commits that landed on the source checkout
+  // before this Work was rebased. Scope adoption to the candidate's unique delta
+  // from the current source-checkout merge-base; otherwise those target-branch
+  // commits are incorrectly attributed to the Work and fail its allow-list.
+  const sourceRepository = selectWorkFinalizationTarget(registered, handle);
+  const sourceHead = handle.sourceCheckoutId && handle.sourceCheckoutId !== handle.checkoutId
+    ? repositoryGitStatus(sourceRepository).head
+    : undefined;
+  const scopeBaseHead = sourceHead ? gitMergeBase(handle.worktreePath, sourceHead, candidateHead) : previousHead;
+  const changedPaths = gitChangedPaths(handle.worktreePath, scopeBaseHead, candidateHead);
   for (const path of changedPaths) {
     if (contract.forbiddenPaths.some((pattern) => globMatches(pattern, path))) {
       throw new Error(`WORK_HEAD_ADOPTION_FORBIDDEN_PATH: ${path}`);
@@ -587,6 +936,7 @@ function adoptExistingWorkHead(
   };
 
   const adopted = transitionWorkHandle(ctx.controllerHome, handle, 'editing', {
+    deliveryBaseCommit: scopeBaseHead,
     expectedHead: candidateHead,
     failureReason: undefined,
     finalization: initialStage(),
@@ -604,7 +954,7 @@ function adoptExistingWorkHead(
     });
     appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, contract.workId, {
       title: 'audited WorkHandle successor HEAD adoption',
-      summary: `${previousHead} -> ${candidateHead}; ${changedPaths.length} changed path(s) remained within the WorkContract allow-list. Historical validation and completion receipts were not rewritten.`,
+      summary: `${previousHead} -> ${candidateHead}; ${changedPaths.length} candidate-unique path(s) from scope base ${scopeBaseHead} remained within the WorkContract allow-list. Historical validation and completion receipts were not rewritten.`,
       detailLevel: 'summary',
     });
   } catch (error) {
@@ -632,21 +982,43 @@ function adoptExistingWorkHead(
   };
 }
 
-function releasePreparedWorkOwnership(
+export function releasePreparedWorkOwnership(
   ctx: MultiRepositoryMcpToolContext,
   handle: WorkHandleState,
 ): 'released' | 'already_released' {
   const workIdValue = handle.workContractId ?? handle.workId;
-  const current = getControllerSession(
-    { controllerHome: ctx.controllerHome, repoId: handle.repositoryId },
-    workIdValue,
-  );
+  const options = { controllerHome: ctx.controllerHome, repoId: handle.repositoryId };
+  const current = getControllerSession(options, workIdValue);
   if (!current) return 'already_released';
-  releaseControllerSession(
-    { controllerHome: ctx.controllerHome, repoId: handle.repositoryId },
-    workIdValue,
-    current.controllerId,
-  );
+
+  const callerPrincipal = principalFor(ctx);
+  const callerInstanceId = ctx.controllerInstanceId ?? currentControllerInstanceId();
+  const ownerPrincipal = current.principalId?.trim() || current.controllerId;
+  const ownerInstanceId = current.controllerInstanceId?.trim() || '';
+  if (ownerPrincipal !== callerPrincipal) {
+    throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workIdValue}`);
+  }
+  if (!ownerInstanceId || ownerInstanceId !== callerInstanceId) {
+    throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workIdValue}`);
+  }
+  if (typeof current.claimGeneration !== 'number' || current.claimGeneration < 1) {
+    throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workIdValue}`);
+  }
+
+  const released = releaseControllerSessionWithAuthority(options, {
+    workId: workIdValue,
+    actor: `legacy-work-release:${callerPrincipal}:${callerInstanceId}`,
+    authority: {
+      controllerId: current.controllerId,
+      controllerType: current.controllerType,
+      principalId: ownerPrincipal,
+      controllerInstanceId: ownerInstanceId,
+      claimGeneration: current.claimGeneration,
+    },
+  });
+  if (!released.allowed) {
+    throw new Error(`WORK_CONTROLLER_RELEASE_FENCED: ${workIdValue}:${released.reason}`);
+  }
   return 'released';
 }
 
@@ -657,9 +1029,14 @@ function terminalCleanupOutcome(
   if (handle.cleanupReceipt) return handle.cleanupReceipt.terminalOutcome;
   const contract = contractFor(ctx, handle);
   if (contract?.status === 'cancelled') return 'cancelled';
+  if (contract?.status === 'completed') return 'completed_cleanup';
   const reason = `${handle.failureReason ?? ''} ${handle.finalization.lastError ?? ''}`.toLowerCase();
   if (contract?.status === 'blocked' && reason.includes('terminal')) return 'blocked_terminal';
-  if (contract?.status === 'failed' || handle.state === 'failed' || handle.state === 'failed_terminal_cleanup') {
+  // `failed` is a retryable execution-handle state (its transition table allows
+  // failed -> validating/editing). Do not reinterpret it as terminal cleanup
+  // unless the durable Work itself is terminal. `failed_terminal_cleanup` is
+  // the explicit point of no return for resource cleanup reconciliation.
+  if (contract?.status === 'failed' || handle.state === 'failed_terminal_cleanup') {
     if (reason.includes('infrastructure') || reason.includes('timed out') || reason.includes('unavailable')) {
       return 'infrastructure_failed';
     }
@@ -772,6 +1149,7 @@ function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, un
   const checks = boundedStringArray(args.checks, 30);
   const baseRef = typeof args.base_ref === 'string' && args.base_ref.trim() ? args.base_ref.trim() : undefined;
   const requestedCheckoutId = typeof args.checkout_id === 'string' && args.checkout_id.trim() ? args.checkout_id.trim() : undefined;
+  const needsDependencies = args.needs_dependencies === true;
   const baseCheckoutId = repository.activeCheckoutId;
   const baseStatus = repositoryGitStatus(repository);
   if (isolation === 'reuse' && !baseStatus.clean) throw new Error('WORKTREE_DIRTY: reuse was requested but the selected checkout is dirty; choose new_worktree or auto');
@@ -787,6 +1165,7 @@ function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, un
     allowedPaths,
     checks,
     baseRef,
+    needsDependencies,
   });
 
   return withWorkPrepareRequest({
@@ -872,7 +1251,12 @@ function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, un
     });
     try {
       const workspace = useWorktree
-        ? ensureManagedWorkspace(ctx.controllerHome, repository, { requestId: createdWorkId, title: objective, baseRef })
+        ? ensureManagedWorkspace(ctx.controllerHome, repository, {
+          requestId: createdWorkId,
+          title: objective,
+          baseRef,
+          prepareDependencies: needsDependencies,
+        })
         : { mode: 'current' as const, checkoutId: baseCheckoutId, root: repository.canonicalRoot, branch: baseStatus.branch ?? 'detached', baseRevision: baseStatus.head ?? undefined, managed: false };
       const refreshed = getRepository(repository.repoId, ctx.controllerHome);
       const checkout = selectRepositoryCheckout(refreshed, workspace.checkoutId);
@@ -883,7 +1267,7 @@ function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, un
         schemaVersion: 1, workId: createdWorkId, sessionId: session.sessionId, principalId: session.principalId,
         repositoryId: repository.repoId, checkoutId: checkout.activeCheckoutId, worktreePath: checkout.canonicalRoot, branch,
         sourceCheckoutId: baseCheckoutId, managedWorktree: workspace.managed, workContractId: contract.workId, goalId, delegationVersion: delegation.version,
-        baseCommit: workspace.baseRevision ?? head, expectedHead: head, permissionSnapshotVersion: policy.revision,
+        baseCommit: workspace.baseRevision ?? head, deliveryBaseCommit: workspace.baseRevision ?? head, expectedHead: head, permissionSnapshotVersion: policy.revision,
         state: 'prepared', createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), finalization: initialStage(),
         cleanupResponsibility: { owner: 'work_finalizer', registeredAt: new Date().toISOString() },
       };
@@ -1040,15 +1424,16 @@ async function executeWork(ctx: MultiRepositoryMcpToolContext, args: Record<stri
       maxOutputBytes: typeof args.max_output_bytes === 'number' ? args.max_output_bytes : undefined,
     });
     const process = execution.process;
-    const completed = process?.completed === true || execution.route === 'process_direct';
     const ok = process ? process.ok === true : execution.ok === true;
     const status = process
       ? (process.completed
         ? (process.cancelled ? 'cancelled' : process.timedOut ? 'timed_out' : ok ? 'executed' : 'failed')
         : 'running')
-      : execution.route === 'durable'
-        ? 'deferred_durable'
-        : 'rejected';
+      : execution.route === 'process_direct'
+        ? (ok ? 'executed' : 'failed')
+        : execution.route === 'durable'
+          ? 'deferred_durable'
+          : 'rejected';
     return {
       processId: process?.processId,
       commandId,
@@ -1082,8 +1467,9 @@ async function executeWork(ctx: MultiRepositoryMcpToolContext, args: Record<stri
       for (const [index, entry] of inputs.entries()) {
         const execution = await run(entry, index);
         ordered.push(execution);
-        // Do not launch another mutating command while this Work-owned Process
-        // still owns workspace leases. The caller resumes through process_wait.
+        // Do not launch another mutating command while a Work-owned Lightweight
+        // process is still changing the workspace. This is sequencing, not a
+        // durable Lease boundary; the caller resumes through process_wait.
         if (execution.process && !execution.process.completed) break;
       }
       return ordered;
@@ -1130,7 +1516,10 @@ export function selectDefaultWorkValidationChecks(
 
 async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
-  const handle = workForSession(ctx, session, args, { reconcileValidation: false });
+  const handle = workForSession(ctx, session, args, {
+    reconcileValidation: false,
+    allowClaimedTerminalCleanup: args.cleanup !== false,
+  });
   const terminalOutcome = terminalCleanupOutcome(ctx, handle);
   if (terminalOutcome && args.cleanup !== false) {
     return await reconcileTerminalCleanup(ctx, session, handle, args, terminalOutcome);
@@ -1182,6 +1571,24 @@ async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       checks.push({ checkId, ok: false, status: 'missing', summary: `Check not found: ${checkId}` });
       break;
     }
+    const reusablePass = contract
+      ? [...effectiveVerificationEvidence(contract.checkRefs, {
+          sourceRevision: validationHead,
+          workspaceFingerprint,
+          checkId,
+          requestedChecks,
+        })].reverse().find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))
+      : undefined;
+    if (reusablePass) {
+      checks.push({
+        checkId,
+        ok: true,
+        status: 'passed',
+        reusedEvidence: true,
+        receipt: reusablePass.record.receipt,
+      });
+      continue;
+    }
     const existingBinding = validationRun.processes[checkId];
     let process = existingBinding
       ? getCheckProcessHandle(ctx.controllerHome, handle.repositoryId, existingBinding.processId)
@@ -1202,23 +1609,36 @@ async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         repoId: handle.repositoryId,
         checkoutId: handle.checkoutId,
         repoRoot: validated.worktreeRepository.canonicalRoot,
-        executionIdentity: executionIdentityForWork(validated.worktreeRepository, handle),
+        executionIdentity: Object.freeze({
+          ...executionIdentityForWork(validated.worktreeRepository, handle),
+          expectedHead: validationHead === 'unknown' ? handle.expectedHead : validationHead,
+        }),
         checkId,
         requestId: processRequestId,
         workId: handle.workId,
         commandId: processRequestId,
         verificationBinding: { executionSessionId: session.sessionId },
+        verificationSnapshot: contract && contract.allowedPaths.length > 0 ? {
+          workId: contract.workId,
+          allowedPaths: contract.allowedPaths,
+          forbiddenPaths: contract.forbiddenPaths,
+        } : undefined,
       });
       if (executed.mode === 'durable') {
         checks.push({ checkId, ok: undefined, status: 'deferred', summary: executed.durable?.reason, durable: executed.durable });
         break;
       }
       process = executed.process!;
+      const launchedRecord = getProcessRecord(ctx.controllerHome, handle.repositoryId, process.processId);
       validationRun = {
         ...validationRun,
         processes: {
           ...validationRun.processes,
-          [checkId]: { processId: process.processId, requestId: processRequestId },
+          [checkId]: {
+            processId: process.processId,
+            requestId: processRequestId,
+            ...(launchedRecord?.checkExecution ? { checkExecution: { ...launchedRecord.checkExecution } } : {}),
+          },
         },
       };
       current = transitionWorkHandle(ctx.controllerHome, current, 'validating', { validationRun });
@@ -1232,17 +1652,32 @@ async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       checks.push({ checkId, ok: false, status: 'infrastructure_failure', summary: `Validation process record is unavailable: ${process.processId}` });
       break;
     }
+    const boundCheckExecution = validationRun.processes[checkId]?.checkExecution;
     const receipt = processCheckCompletionReceipt(record, {
       repoId: handle.repositoryId,
       checkoutId: handle.checkoutId,
       workId: handle.workId,
-      executionSessionId: session.sessionId,
       checkId,
       processId: process.processId,
+      ...(boundCheckExecution ? {
+        checkExecution: {
+          cacheKey: boundCheckExecution.cacheKey,
+          revision: boundCheckExecution.revision,
+          definitionDigest: boundCheckExecution.definitionDigest,
+          environmentFingerprint: boundCheckExecution.environmentFingerprint,
+          timeoutMs: boundCheckExecution.timeoutMs,
+          scopeKey: boundCheckExecution.scopeKey,
+        },
+      } : {}),
     });
+    const terminalEvidence = classifyPersistedCheckTerminalEvidence(record, checkId);
+    const infrastructureFailed = receipt.timedOut
+      || receipt.cancelled
+      || terminalEvidence.state !== 'matched'
+      || (!receipt.ok && terminalEvidence.failureClass !== 'acceptance_failure');
     appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, handle.workId, {
       checkId,
-      outcome: receipt.ok ? 'valid_pass' : receipt.status === 'timed_out' || receipt.status === 'cancelled' ? 'infrastructure_failure' : 'valid_fail',
+      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
       summary: receipt.summary,
       recordedAt: receipt.finishedAt,
       sourceRevision: validationHead,
@@ -1252,7 +1687,6 @@ async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         workspaceFingerprint,
         checkId,
         requestedChecks,
-        commandId: receipt.commandId,
       }),
       commandFingerprint: commandFingerprint(checkId, receipt.commandId),
       resultArtifactId: receipt.receiptId,
@@ -1264,9 +1698,10 @@ async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
     checks.push({
       checkId,
       ok: receipt.ok,
-      status: receipt.ok ? 'passed' : receipt.status === 'timed_out' || receipt.status === 'cancelled' ? 'infrastructure_failure' : 'failed',
+      status: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'passed' : 'failed',
       process,
       receipt,
+      ...(terminalEvidence.warning ? { warning: terminalEvidence.warning } : {}),
     });
     if (!receipt.ok) break;
   }
@@ -1311,21 +1746,25 @@ async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       failureSummary,
     );
   }
-  if (completed && !passed) {
-    const cleanup = await reconcileTerminalCleanup(
-      ctx,
-      session,
-      next,
-      args,
-      infrastructureFailure ? 'infrastructure_failed' : 'validation_failed',
-    );
+  if (completed && acceptedFailure) {
+    const cleanup = await reconcileTerminalCleanup(ctx, session, next, args, 'validation_failed');
     const value = {
       ...cleanup,
       validation: { passed, completed, checks, targeted: true, changedPaths, cleanupTriggered: true },
     };
     return makeBoundedResult(ctx, session, handle.repositoryId, handle.workId, 'validation', value);
   }
-  const value = { work: compactHandle(next), validation: { passed, completed, checks, targeted: true, changedPaths } };
+  const value = {
+    work: compactHandle(next),
+    validation: {
+      passed,
+      completed,
+      checks,
+      targeted: true,
+      changedPaths,
+      ...(infrastructureFailure ? { retryable: true, cleanupTriggered: false } : {}),
+    },
+  };
   return makeBoundedResult(ctx, session, handle.repositoryId, handle.workId, 'validation', value);
 }
 
@@ -1390,7 +1829,6 @@ function cleanupOnlyMergedHead(
     encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
   });
   if (currentBranch.status !== 0 || String(currentBranch.stdout ?? '').trim() !== current.branch) return undefined;
-  if (current.expectedHead && currentHead === current.expectedHead && !cancelledContract) return undefined;
   if (current.expectedHead && currentHead !== current.expectedHead && cancelledContract) return undefined;
   return { currentHead, cancelledContract, worktreeMissing: false };
 }
@@ -1451,7 +1889,35 @@ function failedCleanupOnlyHead(
   return { currentHead: expectedHead, worktreeMissing: false, targetBranch };
 }
 
-function resetFailedFinalizationStages(stages: WorkFinalizationStages, wants: { commit: boolean; merge: boolean; cleanup: boolean }): WorkFinalizationStages {
+type RetryableFinalizationStage = 'commit' | 'merge' | 'branchCleanup' | 'worktreeCleanup';
+
+function requestedFailedFinalizationRetry(
+  stages: WorkFinalizationStages,
+  wants: { commit: boolean; merge: boolean; cleanup: boolean },
+): RetryableFinalizationStage | undefined {
+  if (stages.validation === 'failed') return undefined;
+  if (wants.commit && stages.commit === 'failed') return 'commit';
+  if (wants.merge && stages.merge === 'failed') return 'merge';
+  if (wants.cleanup && stages.worktreeCleanup === 'failed') return 'worktreeCleanup';
+  if (wants.cleanup && stages.branchCleanup === 'failed') return 'branchCleanup';
+  return undefined;
+}
+
+function retryPhaseForFinalizationStage(stage: RetryableFinalizationStage): 'delivery' | 'cleanup' {
+  return stage === 'commit' || stage === 'merge' ? 'delivery' : 'cleanup';
+}
+
+function retryHandleStateForFinalization(stages: WorkFinalizationStages): WorkHandleState['state'] {
+  if (stages.merge === 'done') return 'merged';
+  if (stages.commit === 'done') return 'committed';
+  return 'validating';
+}
+
+export function resetFinalizationStagesForRequest(
+  stages: WorkFinalizationStages,
+  wants: { commit: boolean; merge: boolean; cleanup: boolean },
+  options: { managedWorktree?: boolean; deleteBranchRequested?: boolean; retainedByRequest?: boolean; workspaceDirty?: boolean } = {},
+): WorkFinalizationStages {
   const next = { ...stages };
   let reset = false;
   if (next.validation === 'failed') {
@@ -1474,6 +1940,28 @@ function resetFailedFinalizationStages(stages: WorkFinalizationStages, wants: {
     next.branchCleanup = 'pending';
     reset = true;
   }
+  // A Work may be semantically repaired and revalidated after an earlier delivery
+  // attempt already marked commit/merge done. Exact validation of a dirty current
+  // workspace proves there is new Work-owned content still requiring delivery;
+  // re-arm only the requested Git stages instead of letting cleanup discard it.
+  if (options.workspaceDirty === true && wants.commit && next.commit === 'done') {
+    next.commit = 'pending';
+    reset = true;
+    if (wants.merge && next.merge === 'done') next.merge = 'pending';
+  }
+  // A prior finalize(cleanup=false) intentionally records managed resources as
+  // skipped/retained. A later explicit cleanup=true is a new resource-disposal
+  // request, not an idempotent replay of the earlier retention decision. Re-arm
+  // only cleanup stages that are applicable to this managed Work; commit/merge
+  // skipped states keep their original delivery semantics.
+  if (wants.cleanup && options.retainedByRequest === true && options.managedWorktree === true && next.worktreeCleanup === 'skipped') {
+    next.worktreeCleanup = 'pending';
+    reset = true;
+  }
+  if (wants.cleanup && options.retainedByRequest === true && options.managedWorktree === true && options.deleteBranchRequested === true && next.branchCleanup === 'skipped') {
+    next.branchCleanup = 'pending';
+    reset = true;
+  }
   if (reset) delete next.lastError;
   return next;
 }
@@ -1516,12 +2004,87 @@ function currentWorkValidationInput(
 
 async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
-  let current = workForSession(ctx, session, args);
+  let current = workForSession(ctx, session, args, { allowClaimedTerminalCleanup: args.cleanup !== false });
+  const requestedWants = { commit: args.commit === true, merge: args.merge === true, cleanup: args.cleanup === true };
+  const retryStage = current.state === 'failed'
+    ? requestedFailedFinalizationRetry(current.finalization, requestedWants)
+    : undefined;
+  const retryContract = retryStage ? contractFor(ctx, current) : undefined;
+  if (
+    retryStage
+    && retryContract?.status === 'failed'
+    && !retryContract.completionOutcome
+    && !retryContract.completionReceipt
+  ) {
+    transitionWorkContractPhase(
+      { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+      retryContract.workId,
+      {
+        phase: retryPhaseForFinalizationStage(retryStage),
+        status: 'running',
+        state: 'active',
+        summary: `Retrying previously failed Work finalization stage ${retryStage}.`,
+      },
+    );
+  }
   const terminalOutcome = terminalCleanupOutcome(ctx, current);
   if (terminalOutcome && args.cleanup !== false) {
     return await reconcileTerminalCleanup(ctx, session, current, args, terminalOutcome);
   }
-  assertWorkControllerOwnership(ctx, session, current, args);
+  const terminalizationOwner = assertWorkControllerOwnership(ctx, session, current, args);
+  if (terminalOutcome && args.cleanup === false) {
+    const recordedAt = new Date().toISOString();
+    current = withControllerLock(
+      ctx.controllerHome,
+      { scope: 'worktree', repoId: current.repositoryId, worktreeId: current.checkoutId },
+      `work-finalize:${current.workId}:retain-terminal-resources`,
+      () => {
+        const fresh = readWorkHandle(ctx.controllerHome, current.repositoryId, current.workId) ?? current;
+        return writeWorkHandle(ctx.controllerHome, {
+          ...fresh,
+          finalization: {
+            ...fresh.finalization,
+            validation: fresh.finalization.validation === 'failed' ? 'failed' : 'done',
+            commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
+            merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
+            branchCleanup: 'skipped',
+            worktreeCleanup: 'skipped',
+            lastError: fresh.finalization.validation === 'failed' ? fresh.finalization.lastError : undefined,
+          },
+          terminalResourceDisposition: {
+            mode: 'retained_by_request',
+            retainWorktree: fresh.managedWorktree,
+            retainBranch: true,
+            recordedAt,
+          },
+        });
+      },
+      10_000,
+    );
+    appendWorkEvidence(
+      { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+      current.workContractId ?? current.workId,
+      {
+        title: 'terminal resources retained by request',
+        summary: `Controller explicitly retained ${current.managedWorktree ? 'the managed worktree and ' : ''}local branch after terminal Work; automatic terminal cleanup must not reclaim them.`,
+        detailLevel: 'summary',
+      },
+    );
+    releasePreparedWorkOwnership(ctx, current);
+    updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
+      activeWorkId: undefined,
+      activeCheckoutId: current.sourceCheckoutId ?? session.activeCheckoutId,
+    });
+    return {
+      work: compactHandle(current),
+      stages: current.finalization,
+      completed: true,
+      cleanupCompleted: false,
+      cleanupRetained: true,
+      cleanupPending: false,
+      idempotent: true,
+    };
+  }
   if (current.state === 'cleaned') {
     const terminalContract = contractFor(ctx, current);
     if (
@@ -1554,7 +2117,18 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
   if (requestedOutcome === 'completed_no_change' && (!noChangeProof || args.commit === true || args.merge === true)) {
     throw new Error('WORK_NO_CHANGE_PROOF_REQUIRED: completed_no_change requires objective-specific evidence and forbids commit/merge');
   }
-  const wants = { commit: args.commit === true, merge: args.merge === true, cleanup: args.cleanup === true };
+  const wants = requestedWants;
+  const explicitTargetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
+    ? args.target_branch.trim()
+    : undefined;
+  // With merge=false an explicitly selected Work branch is the delivery target,
+  // not a disposable feature branch. Keep the ref reachable for the receipt.
+  const retainExplicitWorkTargetBranch = !wants.merge && explicitTargetBranch === current.branch;
+  const deleteBranchRequested = args.delete_branch !== false && !retainExplicitWorkTargetBranch;
+  const noChangeFastPath = requestedOutcome === 'completed_no_change'
+    && !wants.commit
+    && !wants.merge
+    && current.state !== 'failed';
 
   const transact = (label: string, update: (fresh: WorkHandleState) => WorkHandleState): WorkHandleState =>
     withControllerLock(ctx.controllerHome, { scope: 'worktree', repoId: current.repositoryId, worktreeId: current.checkoutId }, `work-finalize:${current.workId}:${label}`, () => {
@@ -1567,15 +2141,31 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       const finalization = { ...fresh.finalization, [stage]: 'failed', lastError: reason } as WorkFinalizationStages;
       return markWorkHandleFailed(ctx.controllerHome, { ...fresh, finalization }, reason);
     });
-    if (current.workContractId) updateWorkContract({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId, { status: 'failed' });
-    markRepositoryProjectionDirty(ctx.controllerHome, current.repositoryId, `cleanup:${current.workId}:failed`);
+    if (current.workContractId) {
+      if (stage === 'validation') {
+        updateWorkContract({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId, { status: 'failed' });
+      } else if (stage === 'commit' || stage === 'merge' || stage === 'branchCleanup' || stage === 'worktreeCleanup') {
+        transitionWorkContractPhase(
+          { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+          current.workContractId,
+          {
+            phase: retryPhaseForFinalizationStage(stage),
+            status: 'blocked',
+            state: 'blocked',
+            summary: `Retryable Work finalization stage ${stage} failed: ${reason}`,
+          },
+        );
+      }
+    }
+    markRepositoryProjectionDirty(ctx.controllerHome, current.repositoryId, `finalize:${current.workId}:${String(stage)}-failed`);
     return { work: compactHandle(current), stages: current.finalization, completed: false };
   };
 
   const failedCleanupRequested = current.state === 'failed'
     && wants.cleanup
     && !wants.commit
-    && !wants.merge;
+    && !wants.merge
+    && retryStage === undefined;
   const failedCleanupProof = failedCleanupRequested
     ? failedCleanupOnlyHead(ctx, current, args)
     : undefined;
@@ -1583,12 +2173,17 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
     throw new Error('WORK_FAILED_CLEANUP_UNSAFE: failed Work cleanup requires exact checkout/branch ownership and an unchanged clean controller-owned managed worktree whose exact HEAD is already contained in the target branch');
   }
 
-  if (!failedCleanupRequested) {
+  if (!failedCleanupRequested && !noChangeFastPath) {
     current = transact('begin', (fresh) => writeWorkHandle(ctx.controllerHome, {
       ...fresh,
-      state: fresh.state === 'failed' ? 'validating' : fresh.state,
+      state: fresh.state === 'failed' ? retryHandleStateForFinalization(fresh.finalization) : fresh.state,
       failureReason: undefined,
-      finalization: resetFailedFinalizationStages(fresh.finalization, wants),
+      finalization: resetFinalizationStagesForRequest(fresh.finalization, wants, {
+        managedWorktree: fresh.managedWorktree,
+        deleteBranchRequested,
+        retainedByRequest: fresh.terminalResourceDisposition?.mode === 'retained_by_request',
+      }),
+      ...(wants.cleanup && fresh.terminalResourceDisposition?.mode === 'retained_by_request' ? { terminalResourceDisposition: undefined } : {}),
     }));
   }
 
@@ -1627,7 +2222,7 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         validation: 'failed',
         commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
         merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
-        branchCleanup: args.delete_branch === false ? 'skipped' : fresh.finalization.branchCleanup,
+        branchCleanup: deleteBranchRequested ? fresh.finalization.branchCleanup : 'skipped',
         lastError: preservedFailure,
       },
     }));
@@ -1659,7 +2254,7 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       });
     }
 
-    if (args.delete_branch !== false && current.finalization.branchCleanup !== 'done') {
+    if (deleteBranchRequested && current.finalization.branchCleanup !== 'done') {
       const target = selectWorkFinalizationTarget(
         getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true }),
         current,
@@ -1713,14 +2308,14 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         validation: 'failed',
         commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
         merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
-        branchCleanup: args.delete_branch === false ? 'skipped' : fresh.finalization.branchCleanup,
+        branchCleanup: deleteBranchRequested ? fresh.finalization.branchCleanup : 'skipped',
         worktreeCleanup: 'done',
         lastError: preservedFailure,
       },
     }));
     appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
       title: 'failed work cleanup completed',
-      summary: `Controller preserved the failed Work outcome while removing its unchanged clean managed worktree and ${args.delete_branch === false ? 'retaining' : 'removing'} the local branch after proving ${failedCleanupProof.currentHead} is contained in ${failedCleanupProof.targetBranch}.`,
+      summary: `Controller preserved the failed Work outcome while removing its unchanged clean managed worktree and ${deleteBranchRequested ? 'removing' : 'retaining'} the local branch after proving ${failedCleanupProof.currentHead} is contained in ${failedCleanupProof.targetBranch}.`,
       detailLevel: 'summary',
     });
     releasePreparedWorkOwnership(ctx, current);
@@ -1743,7 +2338,9 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
     && wants.cleanup
     && !wants.commit
     && !wants.merge;
-  const cleanupReconciliation = cleanupOnlyMergedHead(ctx, current, args);
+  const cleanupReconciliation = requestedOutcome === 'completed_no_change'
+    ? undefined
+    : cleanupOnlyMergedHead(ctx, current, args);
   if (cancelledCleanupRequested && !cleanupReconciliation) {
     throw new Error('WORK_CANCELLED_CLEANUP_UNSAFE: cancelled Work cleanup requires an unchanged clean managed worktree (or a previously recorded cleanup) and a branch HEAD already contained in the target branch');
   }
@@ -1758,13 +2355,24 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         validation: cleanupReconciliation.worktreeMissing ? 'done' : fresh.finalization.validation,
         commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
         merge: 'done',
-        branchCleanup: args.delete_branch === false ? 'skipped' : 'pending',
+        branchCleanup: deleteBranchRequested ? 'pending' : 'skipped',
         lastError: undefined,
       },
     }));
   }
 
+  const changedCleanupOnly = wants.cleanup
+    && !wants.commit
+    && !wants.merge
+    && requestedOutcome !== 'completed_no_change'
+    && current.state !== 'merged'
+    && current.state !== 'cleaned';
+  if (changedCleanupOnly && !cleanupReconciliation) {
+    throw new Error('WORK_CLEANUP_DELIVERY_NOT_PROVEN: cleanup-only completion requires the exact Work branch HEAD to already be contained in the target branch before any managed worktree is removed');
+  }
+
   const terminalCleanupOnly = Boolean(cleanupReconciliation && wants.cleanup && !wants.commit && !wants.merge);
+  let exactValidationInput: ReturnType<typeof currentWorkValidationInput> | undefined;
   if (terminalCleanupOnly) {
     current = transact('terminal-cleanup-validation-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, {
       ...fresh,
@@ -1780,12 +2388,15 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
     const validationContract = contractFor(ctx, current);
     if (!validationContract) throw new Error(`WORK_VALIDATION_CONTRACT_MISSING: ${current.workContractId ?? current.workId}`);
     const validationInput = currentWorkValidationInput(validatedRepository, current, validationContract.checks);
+    exactValidationInput = validationInput;
     if (validationContract.checks.length === 0) {
-      current = transact('validation-no-checks', (fresh) => writeWorkHandle(ctx.controllerHome, {
-        ...fresh,
-        validatedInputFingerprint: validationInput.fingerprint,
-        finalization: { ...fresh.finalization, validation: 'done', lastError: undefined },
-      }));
+      if (!noChangeFastPath) {
+        current = transact('validation-no-checks', (fresh) => writeWorkHandle(ctx.controllerHome, {
+          ...fresh,
+          validatedInputFingerprint: validationInput.fingerprint,
+          finalization: { ...fresh.finalization, validation: 'done', lastError: undefined },
+        }));
+      }
       projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required.');
     } else if (!hasCurrentWorkValidationAuthority({
       finalizationValidation: current.finalization.validation,
@@ -1801,16 +2412,52 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       markWorkValidationPending(ctx.controllerHome, current);
       throw new Error('WORK_VALIDATION_REQUIRED: run work_validate against the exact current workspace before finalization');
     }
-    if (wants.merge && !wants.commit && current.finalization.commit !== 'done' && !validationInput.clean) {
+    if (!validationInput.clean && wants.commit && current.finalization.commit === 'done') {
+      current = transact('rearm-delivery-after-validated-repair', (fresh) => writeWorkHandle(ctx.controllerHome, {
+        ...fresh,
+        state: 'validating',
+        failureReason: undefined,
+        finalization: resetFinalizationStagesForRequest(fresh.finalization, wants, {
+          managedWorktree: fresh.managedWorktree,
+          deleteBranchRequested,
+          retainedByRequest: fresh.terminalResourceDisposition?.mode === 'retained_by_request',
+          workspaceDirty: true,
+        }),
+      }));
+    }
+    if (wants.merge && !wants.commit && !validationInput.clean) {
       throw new Error('WORK_MERGE_UNCOMMITTED_CHANGES: commit the validated workspace before merging');
     }
   }
 
-  if (requestedOutcome === 'completed_no_change') {
-    const inspected = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize');
-    if (!repositoryGitStatus(inspected.worktreeRepository).clean) {
+  if (noChangeFastPath) {
+    if (!exactValidationInput?.clean) {
       throw new Error('WORK_NO_CHANGE_DIRTY: completed_no_change cannot retain an owned dirty worktree');
     }
+    const noChangeFinalization: WorkFinalizationStages = {
+      ...current.finalization,
+      validation: 'done',
+      commit: 'skipped',
+      merge: 'skipped',
+      branchCleanup: wants.cleanup && deleteBranchRequested ? 'pending' : 'skipped',
+      lastError: undefined,
+    };
+    // Collapse the no-op Git stages into the same durable lifecycle write used
+    // to enter/establish the delivery boundary. Physical cleanup remains
+    // separately persisted because it has real side effects and crash semantics.
+    if (current.state === 'prepared') {
+      current = transact('no-change-validated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'validating', {
+        finalization: noChangeFinalization,
+        validatedInputFingerprint: exactValidationInput.fingerprint,
+        failureReason: undefined,
+      }));
+    } else if (current.state === 'editing' || current.state === 'validating' || current.state === 'committed') {
+      current = transact('no-change-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
+        finalization: noChangeFinalization,
+        validatedInputFingerprint: exactValidationInput.fingerprint,
+        failureReason: undefined,
+      }));
+    }
   }
 
   if (wants.commit && current.finalization.commit === 'pending') {
@@ -1818,58 +2465,454 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
     const contract = contractFor(ctx, current);
     if (contract?.constraints.allowCommit === false) throw new Error('WORK_COMMIT_NOT_ALLOWED: WorkContract disallows commit');
     const status = repositoryGitStatus(validated.worktreeRepository);
-    const commitPaths = [...new Set([...status.staged, ...status.unstaged, ...status.untracked])];
+    const { dirtyPaths, ownedPaths: commitPaths } = workOwnedDirtyPaths(contract, status);
+    if (dirtyPaths.length > 0 && commitPaths.length === 0) {
+      throw new Error(`WORK_COMMIT_NO_OWNED_DIRTY_PATHS: ${current.workId} has ${dirtyPaths.length} dirty path(s), but none are owned by its WorkContract path scope`);
+    }
     const committed = repositoryGitCommit(ctx.controllerHome, validated.worktreeRepository, { message: String(args.message ?? `Complete ${current.workId}`), paths: commitPaths, allowEmpty: false, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
     const pendingAuthorization = [committed.stage, committed.commit].find((execution) => execution?.authorizationDecision?.decision === 'user_confirmation_required')?.authorizationDecision;
     if (pendingAuthorization) return { authorization: pendingAuthorization, work: compactHandle(current), stages: current.finalization };
     if (!committed.committed) return { ...failStage('commit', committed.error?.message ?? 'commit failed'), commit: committed };
+    const checks = contract?.checks ?? [];
+    const committedValidatedWorkspaceFingerprint = exactValidationInput && committed.after.clean
+      ? workspaceValidationFingerprint(validated.worktreeRepository.canonicalRoot, committed.before)
+      : undefined;
+    const validationPreservedAcrossCommit = Boolean(
+      checks.length > 0
+      && exactValidationInput
+      && committedValidatedWorkspaceFingerprint === exactValidationInput.workspaceFingerprint
+    );
+    const committedHead = gitHead(validated.worktreeRepository.canonicalRoot);
+    const postCommitInput = currentWorkValidationInput(validated.worktreeRepository, { ...current, expectedHead: committedHead }, checks);
     current = transact('commit-done', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'committed', {
-      expectedHead: gitHead(validated.worktreeRepository.canonicalRoot),
+      expectedHead: committedHead,
       finalization: {
         ...fresh.finalization,
-        validation: contract?.checks.length ? 'pending' : 'done',
+        validation: checks.length ? (validationPreservedAcrossCommit ? 'done' : 'pending') : 'done',
         commit: 'done',
         lastError: undefined,
       },
-      validatedInputFingerprint: contract?.checks.length ? undefined : fresh.validatedInputFingerprint,
+      validatedInputFingerprint: checks.length
+        ? (validationPreservedAcrossCommit ? postCommitInput.fingerprint : undefined)
+        : postCommitInput.fingerprint,
       failureReason: undefined,
     }));
-    if (contract?.checks.length) {
+    if (checks.length && !validationPreservedAcrossCommit) {
       markWorkValidationPending(ctx.controllerHome, current);
       return {
         work: compactHandle(current),
         stages: current.finalization,
         completed: false,
-        continuation: 'WORK_COMMITTED_REVALIDATION_REQUIRED: run work_validate on the exact committed HEAD before merge or completion',
+        continuation: 'WORK_COMMITTED_REVALIDATION_REQUIRED: committed content changed from the exact validated workspace; run work_validate on the committed HEAD before merge or completion',
       };
     }
-    const postCommitInput = currentWorkValidationInput(validated.worktreeRepository, current, []);
-    current = transact('commit-no-checks-validation', (fresh) => writeWorkHandle(ctx.controllerHome, {
-      ...fresh,
-      expectedHead: postCommitInput.head,
-      validatedInputFingerprint: postCommitInput.fingerprint,
-    }));
-    projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required after commit.');
+    if (validationPreservedAcrossCommit && exactValidationInput) {
+      const checkDefinitions = listControllerChecks(validated.worktreeRepository.canonicalRoot);
+      for (const checkId of checks) {
+        const check = checkDefinitions.find((entry) => entry.id === checkId);
+        if (check?.effects?.git !== undefined) continue;
+        const sourcePass = contract
+          ? effectiveVerificationEvidence(contract.checkRefs, {
+              sourceRevision: exactValidationInput.head,
+              workspaceFingerprint: exactValidationInput.workspaceFingerprint,
+              checkId,
+              requestedChecks: checks,
+            }).find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))?.record
+          : undefined;
+        if (!sourcePass) continue;
+        appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
+          ...sourcePass,
+          summary: `Validation authority transferred across content-equivalent commit for ${checkId}.`,
+          recordedAt: new Date().toISOString(),
+          sourceRevision: postCommitInput.head,
+          workspaceFingerprint: postCommitInput.workspaceFingerprint,
+          verificationInputFingerprint: verificationInputFingerprint({
+            sourceRevision: postCommitInput.head,
+            workspaceFingerprint: postCommitInput.workspaceFingerprint,
+            checkId,
+            requestedChecks: checks,
+          }),
+          evidenceRef: {
+            title: checkId,
+            summary: 'Reused prior valid receipt after proving the validated filesystem content was committed without drift.',
+            detailLevel: 'summary',
+          },
+        });
+      }
+      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
+        title: 'validation authority preserved across content-equivalent commit',
+        summary: `Exact validated workspace ${exactValidationInput.workspaceFingerprint.slice(0, 16)} was committed without content/status drift; non-Git-sensitive per-check authority transferred to committed HEAD ${postCommitInput.head}.`,
+        detailLevel: 'summary',
+      });
+    } else if (checks.length === 0) {
+      projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required after commit.');
+    }
   } else if (!wants.commit && current.finalization.commit === 'pending') {
     current = transact('commit-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, commit: 'skipped' } }));
   }
 
+  if (wants.merge && current.finalization.merge === 'pending' && current.finalization.commit === 'done') {
+    const repository = getRepository(current.repositoryId, ctx.controllerHome);
+    const target = selectWorkFinalizationTarget(repository, current);
+    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
+    const directTarget = inspectDirectTargetDelivery(
+      target.canonicalRoot,
+      current.worktreePath,
+      current.managedWorktree,
+      current.branch,
+      targetBranch,
+      current.expectedHead,
+    );
+    if (directTarget.integrated) {
+      current = transact('direct-target-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
+        finalization: { ...fresh.finalization, merge: 'done', branchCleanup: 'skipped', lastError: undefined },
+        failureReason: undefined,
+      }));
+      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
+        title: 'direct target delivery already integrated',
+        summary: `Work ${current.workId} runs directly on ${targetBranch}; exact delivery revision ${directTarget.expectedHead} is reachable from current target ${directTarget.targetHead}, so no self-merge or target-branch deletion is required.`,
+        detailLevel: 'summary',
+      });
+    }
+  }
+
   if (wants.merge && current.finalization.merge === 'pending') {
-    validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize');
+    const mergeValidated = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize');
+    if (mergeValidated.currentHead && mergeValidated.currentHead !== current.expectedHead) {
+      current = transact('merge-adopt-work-delivery-head', (fresh) => writeWorkHandle(ctx.controllerHome, {
+        ...fresh,
+        expectedHead: mergeValidated.currentHead,
+        failureReason: undefined,
+      }));
+    }
     const contract = contractFor(ctx, current);
     if (contract?.constraints.allowMerge === false) throw new Error('WORK_MERGE_NOT_ALLOWED: WorkContract disallows merge');
     const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
-    const deleteAfterWorktreeCleanup = current.managedWorktree && args.delete_branch !== false;
-    const merged = repositoryGitFinishWorkflow(ctx.controllerHome, target, { featureBranch: current.branch, targetBranch: typeof args.target_branch === 'string' ? args.target_branch : undefined, deleteBranch: !deleteAfterWorktreeCleanup && args.delete_branch !== false, noFf: args.no_ff === true, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
+    const deleteAfterWorktreeCleanup = current.managedWorktree && deleteBranchRequested;
+    const targetBranch = explicitTargetBranch ?? target.defaultBranch ?? 'main';
+    const activeMergeHead = retryStage === 'merge' ? gitRevision(target.canonicalRoot, 'MERGE_HEAD') : undefined;
+    if (!activeMergeHead && current.managedWorktree && current.expectedHead) {
+      const targetHead = gitRevision(target.canonicalRoot, targetBranch);
+      if (targetHead) {
+        const advance = inspectWorkTargetAdvance(mergeValidated.worktreeRepository.canonicalRoot, current.expectedHead, targetHead);
+        if (advance.relation === 'diverged_conflict') {
+          if (contract) {
+            transitionWorkContractPhase(
+              { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+              contract.workId,
+              {
+                phase: 'delivery',
+                status: 'blocked',
+                state: 'blocked',
+                summary: `Target branch ${targetBranch} advanced to ${advance.targetHead} and conflicts with candidate ${advance.candidateHead}; canonical target was not mutated.`,
+              },
+            );
+          }
+          return {
+            work: compactHandle(current),
+            stages: current.finalization,
+            completed: false,
+            blocked: true,
+            recoverable: true,
+            error: {
+              code: 'WORK_TARGET_ADVANCE_CONFLICT',
+              message: `Target branch ${targetBranch} advanced and cannot be integrated cleanly into the isolated Work candidate. Canonical target was left unchanged.${advance.detail ? ` ${advance.detail}` : ''}`,
+            },
+            continuation: 'WORK_TARGET_ADVANCE_REVIEW_REQUIRED: inspect the target/candidate conflict, repair only inside the managed Work checkout, then revalidate before retrying finalize.',
+          };
+        }
+        if (advance.relation === 'candidate_contains_target') {
+          const nonLinearCommits = targetAdvanceLinearMergeCommits(
+            mergeValidated.worktreeRepository.canonicalRoot,
+            advance.targetHead,
+            advance.candidateHead,
+          );
+          if (nonLinearCommits.length > 0) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: candidate already contains merge commit(s) above reconciled target ${advance.targetHead}: ${nonLinearCommits.slice(0, 8).join(', ')}`);
+          }
+          const scopeViolation = targetAdvanceWorkScopeViolation(contract, advance.candidateChangedPaths);
+          if (scopeViolation) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_SCOPE_VIOLATION: Work-owned ${scopeViolation.kind} path ${scopeViolation.path}`);
+          }
+          if (contract) replaceTargetAdvanceScopeEvidence(ctx, contract, advance.candidateChangedPaths);
+          current = transact('target-advance-provenance-confirmed', (fresh) => writeWorkHandle(ctx.controllerHome, {
+            ...fresh,
+            deliveryBaseCommit: advance.targetHead,
+          }));
+        }
+        if (advance.relation === 'diverged_clean') {
+          const preIntegrationScopeViolation = targetAdvanceWorkScopeViolation(contract, advance.candidateChangedPaths);
+          if (preIntegrationScopeViolation) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_SCOPE_VIOLATION: Work-owned ${preIntegrationScopeViolation.kind} path ${preIntegrationScopeViolation.path}`);
+          }
+          const checks = contract?.checks ?? [];
+          const candidateInput = currentWorkValidationInput(mergeValidated.worktreeRepository, current, checks);
+          const checksBefore = checks.length > 0 ? listControllerChecks(mergeValidated.worktreeRepository.canonicalRoot) : [];
+          const integrated = repositoryGitRebaseOnto(ctx.controllerHome, mergeValidated.worktreeRepository, {
+            onto: advance.targetHead,
+            upstream: advance.mergeBase,
+            abortOnFailure: true,
+            authorizationDecision: gitAuthorization,
+            sessionId: session.sessionId,
+            principalId: session.principalId,
+            workId: current.workId,
+            goalId: current.goalId,
+          });
+          if (!integrated.rebased) {
+            if (contract) {
+              transitionWorkContractPhase(
+                { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+                contract.workId,
+                {
+                  phase: 'delivery',
+                  status: 'blocked',
+                  state: 'blocked',
+                  summary: `Linear target-advance integration failed inside the isolated Work checkout; canonical ${targetBranch} was not mutated.`,
+                },
+              );
+            }
+            return {
+              work: compactHandle(current),
+              stages: current.finalization,
+              completed: false,
+              blocked: true,
+              recoverable: integrated.restored,
+              error: {
+                code: 'WORK_TARGET_ADVANCE_LINEAR_INTEGRATION_FAILED',
+                message: integrated.restored
+                  ? 'Target advancement could not be rebased safely; the isolated Work checkout was restored to its original candidate HEAD.'
+                  : 'Target advancement rebase failed and exact checkout restoration could not be proven; inspect the isolated Work checkout before retrying.',
+              },
+              continuation: 'WORK_TARGET_ADVANCE_REVIEW_REQUIRED: inspect the isolated Work checkout and retry only after its exact branch/HEAD/cleanliness are proven.',
+            };
+          }
+          const integratedHead = gitHead(mergeValidated.worktreeRepository.canonicalRoot);
+          if (!integratedHead || !gitIsAncestor(mergeValidated.worktreeRepository.canonicalRoot, advance.targetHead, integratedHead)) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_ANCESTRY_MISMATCH: target ${advance.targetHead} is not an ancestor of ${integratedHead ?? 'unavailable'}`);
+          }
+          const mergeCommits = targetAdvanceLinearMergeCommits(
+            mergeValidated.worktreeRepository.canonicalRoot,
+            advance.targetHead,
+            integratedHead,
+          );
+          const integratedTree = spawnSync('git', ['-C', mergeValidated.worktreeRepository.canonicalRoot, 'rev-parse', '--verify', `${integratedHead}^{tree}`], {
+            encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+          });
+          if (mergeCommits.length > 0) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: integrated candidate contains merge commit(s): ${mergeCommits.slice(0, 8).join(', ')}`);
+          }
+          if (
+            !advance.mergedTree
+            || integratedTree.status !== 0
+            || integratedTree.error
+            || typeof integratedTree.stdout !== 'string'
+            || integratedTree.stdout.trim() !== advance.mergedTree
+          ) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_TREE_MISMATCH: rebased candidate tree does not equal the preflight clean integration tree ${advance.mergedTree ?? 'unavailable'}`);
+          }
+          const workOwnedChangedPaths = gitChangedPaths(mergeValidated.worktreeRepository.canonicalRoot, advance.targetHead, integratedHead);
+          const postIntegrationScopeViolation = targetAdvanceWorkScopeViolation(contract, workOwnedChangedPaths);
+          if (postIntegrationScopeViolation) {
+            return failStage('merge', `WORK_TARGET_ADVANCE_SCOPE_VIOLATION: integrated Work-owned ${postIntegrationScopeViolation.kind} path ${postIntegrationScopeViolation.path}`);
+          }
+          const integratedInput = currentWorkValidationInput(
+            mergeValidated.worktreeRepository,
+            { ...current, expectedHead: integratedHead },
+            checks,
+          );
+          const checksAfter = checks.length > 0 ? listControllerChecks(mergeValidated.worktreeRepository.canonicalRoot) : [];
+          const transferPlan = contract
+            ? planTargetAdvanceValidationAuthority({
+                checkIds: checks,
+                checkRefs: contract.checkRefs,
+                checksBefore,
+                checksAfter,
+                candidateHead: advance.candidateHead,
+                candidateWorkspaceFingerprint: candidateInput.workspaceFingerprint,
+                integratedHead,
+                integratedWorkspaceFingerprint: integratedInput.workspaceFingerprint,
+                targetChangedPaths: advance.targetChangedPaths,
+              })
+            : { transferredRecords: [], reusableCheckIds: [], invalidatedCheckIds: checks };
+          for (const record of transferPlan.transferredRecords) {
+            appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, record);
+          }
+          if (contract) replaceTargetAdvanceScopeEvidence(ctx, contract, workOwnedChangedPaths);
+          const validationPreserved = transferPlan.invalidatedCheckIds.length === 0;
+          current = transact('target-advance-integrated', (fresh) => transitionWorkHandle(
+            ctx.controllerHome,
+            fresh,
+            validationPreserved ? 'committed' : 'validating',
+            {
+              deliveryBaseCommit: advance.targetHead,
+              expectedHead: integratedHead,
+              failureReason: undefined,
+              finalization: { ...fresh.finalization, validation: validationPreserved ? 'done' : 'pending', merge: 'pending', lastError: undefined },
+              validationRun: undefined,
+              validatedInputFingerprint: validationPreserved ? integratedInput.fingerprint : undefined,
+            },
+          ));
+          appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
+            title: 'target advancement linearly integrated into isolated Work candidate',
+            summary: `Canonical ${targetBranch} at ${advance.targetHead} advanced independently. Forge rebased Work candidate ${advance.candidateHead} onto it as ${integratedHead} with no merge commits; Work scope is ${workOwnedChangedPaths.length} target-relative path(s). Validation authority transferred for ${transferPlan.reusableCheckIds.length}/${checks.length} check(s); ${transferPlan.invalidatedCheckIds.length} check(s) require fresh evidence.`,
+            detailLevel: 'summary',
+          });
+          if (!validationPreserved) {
+            markWorkValidationPending(ctx.controllerHome, current);
+            return {
+              work: compactHandle(current),
+              stages: current.finalization,
+              completed: false,
+              continuation: `WORK_COMMITTED_REVALIDATION_REQUIRED: target branch ${targetBranch} changed inputs for [${transferPlan.invalidatedCheckIds.join(', ')}]; unaffected check evidence was transferred to ${integratedHead} and may be reused`,
+            };
+          }
+          projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', checks.length === 0
+            ? 'Target advancement was linearly integrated and no validation checks were required.'
+            : `Target advancement was linearly integrated; all ${checks.length} check result(s) retained authority because target-only changes did not affect their declared inputs.`);
+        }
+      }
+    }
+    let merged: ReturnType<typeof repositoryGitFinishWorkflow>;
+    if (activeMergeHead) {
+      const expectedMergeHead = current.expectedHead ? gitRevision(target.canonicalRoot, current.expectedHead) : undefined;
+      const featureHead = gitRevision(target.canonicalRoot, current.branch);
+      const currentBranchResult = spawnSync('git', ['-C', target.canonicalRoot, 'branch', '--show-current'], {
+        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+      });
+      const currentBranchName = currentBranchResult.status === 0 && typeof currentBranchResult.stdout === 'string'
+        ? currentBranchResult.stdout.trim()
+        : '';
+      if (!expectedMergeHead || activeMergeHead !== expectedMergeHead || featureHead !== expectedMergeHead || currentBranchName !== targetBranch) {
+        return failStage(
+          'merge',
+          `WORK_MERGE_HEAD_OWNERSHIP_MISMATCH: retry may conclude only Work ${current.workId} merge head ${expectedMergeHead ?? 'unavailable'} from ${current.branch} while on ${targetBranch}; observed MERGE_HEAD ${activeMergeHead}, feature ${featureHead ?? 'unavailable'}, branch ${currentBranchName || 'unavailable'}`,
+        );
+      }
+      const unmerged = spawnSync('git', ['-C', target.canonicalRoot, 'diff', '--name-only', '--diff-filter=U'], {
+        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+      });
+      if (unmerged.status !== 0 || unmerged.error || typeof unmerged.stdout !== 'string') {
+        return failStage('merge', 'WORK_MERGE_CONFLICT_STATE_UNAVAILABLE: unable to prove that the owned merge has no unmerged paths');
+      }
+      if (unmerged.stdout.trim()) {
+        return failStage('merge', `WORK_MERGE_CONFLICTS_UNRESOLVED: resolve and stage all paths before retrying finalize (${unmerged.stdout.trim().split('\n').filter(Boolean).join(', ')})`);
+      }
+      const beforeConclude = repositoryGitStatus(target);
+      const concluded = repositoryGitCommit(ctx.controllerHome, target, {
+        message: `Merge ${current.branch} into ${targetBranch}`,
+        allowEmpty: true,
+        authorizationDecision: gitAuthorization,
+        sessionId: session.sessionId,
+        principalId: session.principalId,
+        workId: current.workId,
+        goalId: current.goalId,
+      });
+      if (!concluded.committed || !concluded.commit) {
+        return failStage('merge', concluded.error?.message ?? 'WORK_MERGE_CONCLUDE_FAILED: git commit did not conclude the owned merge');
+      }
+      const concludedSecondParent = gitRevision(target.canonicalRoot, 'HEAD^2');
+      if (concludedSecondParent !== expectedMergeHead || gitRevision(target.canonicalRoot, 'MERGE_HEAD')) {
+        return failStage('merge', `WORK_MERGE_CONCLUSION_OWNERSHIP_MISMATCH: concluded merge must retain ${expectedMergeHead} as its second parent and clear MERGE_HEAD`);
+      }
+      const steps: ReturnType<typeof repositoryGitFinishWorkflow>['steps'] = [{ name: 'conclude_owned_merge', execution: concluded.commit }];
+      if (!deleteAfterWorktreeCleanup && deleteBranchRequested) {
+        const deleted = repositoryGitDeleteBranch(ctx.controllerHome, target, { branch: current.branch, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
+        steps.push({ name: 'delete_feature_branch', execution: deleted.execution });
+        if (deleted.execution.status !== 'executed' || deleted.execution.ok !== true) {
+          return failStage('merge', deleted.execution.stderr || 'WORK_MERGE_BRANCH_CLEANUP_FAILED: owned merge concluded but feature branch deletion failed');
+        }
+      }
+      merged = {
+        repoId: target.repoId,
+        checkoutId: target.activeCheckoutId,
+        featureBranch: current.branch,
+        targetBranch,
+        before: beforeConclude,
+        steps,
+        after: repositoryGitStatus(target),
+        completed: true,
+      };
+      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
+        title: 'owned resolved merge concluded',
+        summary: `Finalizer retry proved MERGE_HEAD ${activeMergeHead} belongs to the exact Work delivery head, found no unmerged paths, and concluded the existing merge instead of replaying git merge.`,
+        detailLevel: 'summary',
+      });
+    } else {
+      merged = repositoryGitFinishWorkflow(ctx.controllerHome, target, { featureBranch: current.branch, targetBranch: explicitTargetBranch, deleteBranch: !deleteAfterWorktreeCleanup && deleteBranchRequested, noFf: args.no_ff === true, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
+    }
     const pendingAuthorization = merged.steps.find((step) => step.execution.authorizationDecision?.decision === 'user_confirmation_required')?.execution.authorizationDecision;
     if (pendingAuthorization) return { authorization: pendingAuthorization, work: compactHandle(current), stages: current.finalization };
     if (!merged.completed) return { ...failStage('merge', merged.error?.message ?? 'merge failed'), merge: merged };
     current = transact('merge-done', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-      finalization: { ...fresh.finalization, merge: 'done', branchCleanup: args.delete_branch === false ? 'skipped' : deleteAfterWorktreeCleanup ? 'pending' : 'done', lastError: undefined },
+      finalization: { ...fresh.finalization, merge: 'done', branchCleanup: !deleteBranchRequested ? 'skipped' : deleteAfterWorktreeCleanup ? 'pending' : 'done', lastError: undefined },
       failureReason: undefined,
     }));
   } else if (!wants.merge && current.finalization.merge === 'pending') {
-    current = transact('merge-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, merge: 'skipped', branchCleanup: 'skipped' } }));
+    current = transact('merge-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, {
+      ...fresh,
+      finalization: {
+        ...fresh.finalization,
+        merge: 'skipped',
+        branchCleanup: requestedOutcome === 'completed_no_change' && wants.cleanup && deleteBranchRequested ? 'pending' : 'skipped',
+      },
+    }));
+  }
+
+  let remoteDelivery: WorkRemoteDeliveryReceipt | undefined;
+  const remoteDeliveryRequired = args.remote_write === true
+    || contractFor(ctx, current)?.constraints.remoteDeliveryRequired === true;
+  if (remoteDeliveryRequired && requestedOutcome !== 'completed_no_change') {
+    const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
+    const target = selectWorkFinalizationTarget(repository, current);
+    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
+    const targetRevision = gitRevision(target.canonicalRoot, targetBranch);
+    if (!targetRevision) throw new Error(`WORK_REMOTE_DELIVERY_TARGET_REQUIRED: target branch ${targetBranch} is unavailable`);
+    const authorityRepository = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
+    remoteDelivery = await pushExactWorkRemoteDelivery({
+      controllerHome: ctx.controllerHome,
+      repository: authorityRepository,
+      workId: current.workId,
+      targetBranch,
+      targetRevision,
+    });
+    appendWorkEvidence(
+      { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+      current.workContractId ?? current.workId,
+      {
+        title: 'remote delivery verified before Work terminalization',
+        summary: remoteDelivery.pushed
+          ? `Exact integrated revision ${remoteDelivery.targetRevision} was pushed to origin/${targetBranch} while Work ${current.workId} still held active delivery authority.`
+          : `origin/${targetBranch} already contained exact integrated revision ${remoteDelivery.targetRevision}; remote delivery was verified idempotently before Work terminalization.`,
+        detailLevel: 'summary',
+      },
+    );
+  }
+
+  if (
+    requestedOutcome === 'completed_no_change'
+    && current.finalization.validation === 'done'
+    && current.finalization.commit === 'skipped'
+    && current.finalization.merge === 'skipped'
+    && current.state !== 'merged'
+    && current.state !== 'cleaned'
+  ) {
+    // `merged` is the WorkHandle's durable integrated-delivery boundary. A
+    // no-change completion has no Git merge, but it must cross that boundary
+    // before physical cleanup so an earlier failure preserves retryability.
+    if (current.state === 'prepared') {
+      current = transact('no-change-validation-state', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'validating', {
+        finalization: fresh.finalization,
+        failureReason: undefined,
+      }));
+    }
+    if (current.state === 'editing' || current.state === 'validating' || current.state === 'committed') {
+      current = transact('no-change-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
+        finalization: fresh.finalization,
+        failureReason: undefined,
+      }));
+    } else if (current.state !== 'merged') {
+      throw new Error(`WORK_NO_CHANGE_DELIVERY_STATE_INVALID: cannot establish no-change delivery from ${current.state}`);
+    }
   }
 
   if (wants.cleanup && current.finalization.worktreeCleanup === 'pending') {
@@ -1891,7 +2934,11 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
     current = transact('worktree-cleanup-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'skipped' } }));
   }
 
-  if (wants.cleanup && current.finalization.branchCleanup === 'pending' && current.finalization.merge === 'done') {
+  if (
+    wants.cleanup
+    && current.finalization.branchCleanup === 'pending'
+    && (current.finalization.merge === 'done' || requestedOutcome === 'completed_no_change')
+  ) {
     const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
     const deleted = repositoryGitDeleteBranch(ctx.controllerHome, target, { branch: current.branch, force: false, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
     if (deleted.execution.authorizationDecision?.decision === 'user_confirmation_required') return { authorization: deleted.execution.authorizationDecision, work: compactHandle(current), stages: current.finalization };
@@ -1929,18 +2976,64 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
         });
       }
       const receipt = completionReceiptForFinalizedWork(ctx, current, completionContract, args);
-      const recorded = recordWorkCompletionReceipt(
+      const ownerPrincipal = terminalizationOwner.principalId?.trim() || terminalizationOwner.controllerId;
+      const ownerInstanceId = terminalizationOwner.controllerInstanceId?.trim() || '';
+      const ownerClaimGeneration = terminalizationOwner.claimGeneration;
+      if (!ownerInstanceId || typeof ownerClaimGeneration !== 'number' || ownerClaimGeneration < 1) {
+        throw new Error(`WORK_CONTROLLER_TERMINALIZATION_AUTHORITY_INVALID: ${workId}`);
+      }
+      const fencedCompletion = withControllerSessionTerminalizationFence(
         { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-        workId,
-        receipt,
-        requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'completed_changed',
-        requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'repository_change',
+        {
+          workId,
+          actor: `work-finalize-completion:${terminalizationOwner.controllerId}:${ownerInstanceId}`,
+          authority: {
+            controllerId: terminalizationOwner.controllerId,
+            controllerType: terminalizationOwner.controllerType,
+            principalId: ownerPrincipal,
+            controllerInstanceId: ownerInstanceId,
+            claimGeneration: ownerClaimGeneration,
+          },
+        },
+        () => recordWorkCompletionReceipt(
+          { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+          workId,
+          receipt,
+          requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'completed_changed',
+          requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'repository_change',
+        ),
       );
+      if (!fencedCompletion.allowed) {
+        throw new Error(`WORK_TERMINALIZATION_AUTHORITY_FENCED: ${workId}:${fencedCompletion.reason}`);
+      }
+      const recorded = fencedCompletion.value;
       if (recorded.requirementId) {
-        completeRequirementFromWork(
-          { controllerHome: ctx.controllerHome },
-          { requirementId: recorded.requirementId, work: recorded },
-        );
+        try {
+          completeRequirementFromWork(
+            { controllerHome: ctx.controllerHome },
+            { requirementId: recorded.requirementId, work: recorded },
+          );
+        } catch (error) {
+          // Work completion + its receipt are the canonical machine-delivery facts.
+          // Requirement completion is a downstream projection and may legitimately
+          // be absent for callers that use requirement_id only as a semantic
+          // identity. Never turn an already integrated/cleaned Work back into a
+          // failed finalize because this projection is missing or stale.
+          try {
+            appendWorkEvidence(
+              { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+              workId,
+              {
+                title: 'requirement completion projection pending',
+                summary: `Work completion remains authoritative; Requirement projection could not be applied: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2_000),
+                detailLevel: 'summary',
+              },
+            );
+          } catch {
+            // Diagnostic persistence is also downstream of the completion
+            // receipt and therefore cannot invalidate the terminal Work fact.
+          }
+        }
       }
     }
     // Successful WorkContract completion always ends controller ownership.
@@ -1952,7 +3045,7 @@ async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<str
       activeCheckoutId: current.sourceCheckoutId ?? session.activeCheckoutId,
     });
   }
-  return { work: compactHandle(current), stages: current.finalization, completed: complete, idempotent: !wants.commit && !wants.merge && !wants.cleanup && current.finalization.validation === 'done' };
+  return { work: compactHandle(current), stages: current.finalization, completed: complete, ...(remoteDelivery ? { remoteDelivery } : {}), idempotent: !wants.commit && !wants.merge && !wants.cleanup && current.finalization.validation === 'done' };
 }
 
 export async function callExecutionTool(ctx: MultiRepositoryMcpToolContext, name: string, args: Record<string, unknown>): Promise<CallToolResult | undefined> {