@moretea-labs/forge 1.6.0 → 1.7.0

package/src/runtime/gateway/mcp/runtime-tools.ts

@@ -5,9 +5,12 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import type { CallToolResult as SdkCallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import { collectRuntimePerformanceDiagnostics, inferLocalControllerProcess } from '../../diagnostics/performance';
+import { defaultSemanticProviderRegistry, type SemanticNavigationKind, type SemanticNavigationRequest } from '../../context/semantic-navigation';
 import type { McpToolDefinition, CallToolResult } from '../../../cli/mcp/tools';
 import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
 import { repositoryScopedToolArgs } from '../../../cli/mcp/multi-repository';
+import { resolveMcpPath } from '../../../cli/mcp/paths';
+import { freshGitIdentity } from '../../../cli/repository/inspector';
 import { reconcileReadinessProjectionSource } from '../../../cli/mcp/readiness-projection';
 import { listRepositories, repositorySummary, resolveRepositorySelection, selectRepositoryCheckout } from '../../../cli/repositories/registry';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
@@ -15,10 +18,14 @@ import { repositoryControllerRoot } from '../../../cli/repositories/controller-h
 import { cancelExecutionJob, findExecutionJob, getExecutionJob, getExecutionJobByRequestId, listExecutionJobs } from '../../execution/jobs/store';
 import { waitForExecutionJob } from '../../execution/jobs/wait';
 import type { ExecutionJob } from '../../execution/jobs/types';
-import { getProcessHandle, getProcessRecord, isManagedProcessActive, listProcessRecords, processCheckCompletionReceipt, processRuntimeResourceDiagnostics, readPersistedCheckResultReceipt, runPersistedCheckViaProcessRuntime, waitForProcess } from '../../execution/process-runtime';
+import { DEFAULT_WORK_CHECK_LEASE_WAIT_MS, checkRequiresDurableWorkflow, getProcessHandle, getProcessRecord, isManagedProcessActive, listProcessRecords, listRecoverableProcessRecords, processCheckCompletionReceipt, processRuntimeResourceDiagnostics, readPersistedCheckResultReceipt, runPersistedCheckViaProcessRuntime, waitForProcess } from '../../execution/process-runtime';
+import { getRepositoryCommandProcess, waitRepositoryCommandProcess } from '../../execution/process-runtime/command-facade';
 import { buildJobOperationDigest } from '../../control-plane/facade/operation-digest';
-import { readWorkHandle, transitionWorkHandle, writeWorkHandle, type WorkHandleState } from '../../control-plane/execution/work-handle-store';
+import { readWorkHandle, transitionWorkHandle, workDeliveryBaseRevision, writeWorkHandle, type WorkHandleState } from '../../control-plane/execution/work-handle-store';
+import { recoverTerminalWorkHandle } from '../../control-plane/execution/work-terminal-cleanup';
+import { gitCommitAtRef, gitWorktreeSnapshot } from '../../control-plane/execution/work-lifecycle-audit';
 import { executionIdentityForRepository } from '../../control-plane/execution/execution-identity';
+import { commandFingerprint, verificationInputFingerprint, workspaceValidationFingerprint } from '../../control-plane/execution/verification-evidence';
 import { acceptReviewedDirectEditWorkReconciliation, reconcileFinalizedDirectEditWorksAfterCommit } from '../../control-plane/execution/direct-edit-work-completion';
 import { readJobEvents } from '../../evidence/event-ledger';
 import { readExecutionArtifact } from '../../evidence/artifact-store';
@@ -41,26 +48,23 @@ import {
   type RuntimeOperationalView,
   type GradedObservation,
 } from '../../health';
-import { applyScheduleDedupe, buildScheduleDedupeReport, createSchedule, getSchedule, getScheduleDecision, listOccurrences, listSchedules, saveSchedule } from '../../workflow/schedules/store';
-import { evaluateSchedule } from '../../workflow/schedules/engine';
+import { applyScheduleDedupe, buildScheduleDedupeReport, deleteSchedule } from '../../workflow/schedules/store';
 import {
   createWorkContinuationSchedule,
+  getWorkContinuationSchedule,
+  listWorkContinuationSchedules,
+  pauseWorkContinuationSchedule,
+  resumeWorkContinuationSchedule,
+  triggerWorkContinuationSchedule,
   type ContinuationControllerType,
 } from '../../workflow/schedules/work-continuation';
-import { createPortfolioWorkflow, getPortfolioWorkflow, listPortfolioWorkflows } from '../../workflow/portfolio/store';
-import { claimsForMcpOperation } from './resource-policy';
 import {
   gatewayRouteBehaviorSnapshot,
   getMcpToolDefinition,
-  hashMcpToolArguments,
-  injectDurableCommandFields,
-  operationMetadataForTool,
   RETIRED_AGENT_OPERATIONS,
   routeDurableMcpCall,
-  validateMcpToolArguments,
 } from './router';
 import { assertAutomatedOperationAllowed } from '../../control-plane/governance/external-effects';
-import { getCandidateFinding, listCandidateFindings, recordCandidateFinding } from '../../workflow/findings/store';
 import { ensureRepositoryRuntimeStorage } from '../../../cli/repositories/runtime-storage';
 import { assessWorkMode, parseExplicitTaskMode } from '../../../cli/controller/work-mode';
 import { projectBoard } from '../../../cli/controller/issue-store';
@@ -68,10 +72,11 @@ import {
   buildControllerTaskLedgerProjection,
   writeControllerTaskLedgerArtifacts,
 } from '../../../cli/controller/task-ledger';
-import { buildControllerContextPack, CONTROLLER_CONTEXT_IMPACT_DOMAINS, type ControllerContextImpactDomain } from '../../../cli/controller/context-pack';
+import { buildControllerContextPack, buildControllerContextPackAsync, CONTROLLER_CONTEXT_IMPACT_DOMAINS, type ControllerContextImpactDomain } from '../../../cli/controller/context-pack';
 import { legacyIssueAuthorityRetired } from '../../../cli/controller/legacy-issue-cutover';
 import { buildControllerOperationalPlan } from '../../../cli/controller/operational-plan';
 import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
+import { buildCheckExecutionSchedule } from '../../execution/process-runtime/check-scheduling';
 import { repositoryChangeVerify } from '../../../cli/controller/composite-operations';
 import { listActiveAgentJobSnapshots } from '../../../cli/agent-jobs/job-manager';
 import { readAgentExecutableReadinessSnapshot } from '../../../cli/agent-jobs/executable-resolver';
@@ -102,7 +107,8 @@ import {
 } from '../../../cli/controller/runtime-config';
 import { redactMcpText } from '../../../cli/mcp/redaction';
 import { resolveLocalBridgeSurface, summarizeRecentJobs } from '../../shared/local-bridge-surface';
-import { assistantPluginScope, controllerPluginRepository, executeAssistantPluginReadDirect, getAssistantPluginManifest, isDirectPluginReadAction, listAssistantPluginManifests, submitAssistantPluginAction } from '../../plugins/store';
+import { assistantPluginScope, controllerPluginRepository, executeAssistantPluginReadDirect, finalizeRemoteEffectWorkFromActionReceipt, getAssistantPluginManifest, isDirectPluginReadAction, listAssistantPluginManifests, submitAssistantPluginAction } from '../../plugins/store';
+import { startLightweightPluginAction, waitLightweightPluginAction } from '../../plugins/lightweight-action';
 import { mcpPluginExecutionOrigin } from '../../plugins/execution-origin';
 import {
   summarizeExecutionJobForMcp,
@@ -114,28 +120,12 @@ import {
   prepareWorkspaceAuthLogin,
   previewExternalFilesystemGrant,
   readExternalFilesystemSnapshot,
-  iosXcodeStatus,
-  iosSimulatorsList,
-  iosProjectDiscover,
-  iosSchemesList,
-  iosSimulatorBoot,
-  iosAppBuild,
-  iosAppInstall,
-  iosAppLaunch,
-  iosSimulatorScreenshot,
-  iosSimulatorLogTail,
-  iosUiSmokeTest,
   buildReviewArtifactIndex,
   ensureReviewArtifactRoots,
   prepareBrowserReviewPacket,
   prepareIosReviewPacket,
 } from '../../safe-tooling';
 import { buildModelClientSummary, buildModelControlPlaneSummary, deepSeekControllerManifest, deepSeekFunctionToolManifest, prepareDeepSeekControllerHandoff, prepareDeepSeekControllerRequest, prepareDeepSeekToolCall } from '../../model-clients';
-import { buildAssistantReadinessReport } from '../../assistant/readiness';
-import { approveAssistantActionProposal, getAssistantActionProposal, listAssistantActionProposals, rejectAssistantActionProposal } from '../../assistant/action-proposals';
-import { assistantModelReadiness } from '../../assistant/model-provider';
-import { createAssistantStandingGrant, listAssistantStandingGrants, revokeAssistantStandingGrant } from '../../assistant/standing-grants';
-import { buildGmailTriagePlan, readGmailTriageRules, upsertGmailTriageRule } from '../../personal-assistant/gmail-triage-manager';
 import { sessionCacheGlobalDiagnostics } from '../../../cli/repository/session-cache';
 import { cachedGitIdentity, gitIdentityPerformanceSnapshot, gitSnapshot, gitSnapshotPerformanceSnapshot } from '../../../cli/repository/inspector';
 import { buildWorkflowWatchdogReport } from '../../watchdog/workflow-watchdog';
@@ -170,7 +160,9 @@ import {
   dismissHandoffItem,
   getHandoffItem,
   listCapabilityDescriptors,
+  getCapabilityDescriptor,
   getPluginActionCapabilitySchema,
+  searchCapabilityDescriptors,
   summarizeCapabilityGroups,
   listHandoffItems,
   normalizeCheckIds,
@@ -182,12 +174,18 @@ import {
   listWorkContracts,
   getWorkContract,
   getWorkContractByRequestId,
+  updateWorkContract,
+  resumeRetainedCancelledWorkContract,
   buildWorkContinuationSnapshot,
-  acceptSubmittedWorkContract,
-  approvePlanContract,
-  createPlanContract,
+  acceptPlanStepEvidence,
+  admitPlanContractAsync,
+  approvePlanContractAsync,
   getPlanContract,
   listPlanContracts,
+  resolvePlanAdmission,
+  withPrimaryWorkAdmissionLockAsync,
+  repairDanglingPlanStepWorkBinding,
+  completePlanStepForWork,
   summarizePlanContract,
   supersedePlanContract,
   verifyGoalWorkloop,
@@ -195,764 +193,44 @@ import {
   claimControllerSession,
   getControllerSession,
   releaseControllerSession,
+  releaseControllerSessionWithAuthority,
   resumeControllerSession,
+  withControllerSessionTerminalizationFence,
+  type ControllerTerminalizationAuthority,
 } from '../../control-plane/facade';
 import { currentControllerInstanceId, readExecutionSession, startExecutionSession, updateExecutionSession } from '../../control-plane/execution/session-store';
+import { changedPaths as workChangedPaths } from '../../control-plane/execution/work-task-receipt';
+import { createRequirement, readRequirement } from '../../control-plane/persistence/requirement-store';
 import { ensureManagedWorkspace } from '../../execution/managed-workspace';
 import { currentPermissionSnapshotVersion } from '../../control-plane/execution/validation';
 import { observeRuntimeStatus } from '../../root/status';
 import { reconcileWorkValidation } from './work-validation-reconciler';
 import { callExecutionTool } from './execution-tools';
 import { launchSuperController } from '../../control-plane/launcher/thin-launcher';
+import { runStandaloneChatgptPrompt, runWorkChatgptContinuation, settleWorkChatgptAutomationTab } from '../../control-plane/launcher/chatgpt-work-continuation';
+import { getChatgptWorkConversationBinding } from '../../control-plane/launcher/chatgpt-work-binding-store';
 import {
-  executorDispatch,
-  executorRoutePreview,
-  goalContinue,
-  goalCreate,
-  goalFinalize,
-  goalGet,
-  goalHandoffPacketCreate,
-  goalHandoffPacketGet,
-  goalList,
-  goalStart,
-  goalStatus,
-  goalStop,
-  goalTickOnce,
-  providerConfigStatusAction,
-  providerHealthAction,
-  providerListAction,
-  repairContinue,
-  repairPlan,
-  summarizeGoalContract,
-  tickActiveGoals,
-  type GoalContract,
-  type GoalLoopContext,
-  type GoalStatus,
-  type TaskIntent,
-} from '../../control-plane/goal-loop';
-
-function summarizeGoalPublic(goal: GoalContract) {
-  return summarizeGoalContract(goal);
-}
+  acknowledgeControllerRoundClaim,
+  beginControllerRoundRelayAfterRelease,
+  beginInitialControllerRoundDispatch,
+  buildControllerRoundRelayPrompt,
+  finishControllerRoundRelayDispatch,
+  getControllerRoundRelay,
+  parseControllerDispositionCompatibilityCapability,
+  recordControllerRoundTabSettlement,
+  submitControllerRoundDisposition,
+  type ControllerRoundDisposition,
+} from '../../control-plane/facade/controller-round-relay';
 
-function definition(name: string, description: string, properties: Record<string, unknown>, required: string[] = [], readOnly = true): McpToolDefinition {
-  return {
-    name,
-    description,
-    inputSchema: { type: 'object', properties, ...(required.length ? { required } : {}), additionalProperties: false },
-    annotations: { readOnlyHint: readOnly, openWorldHint: false, destructiveHint: false },
-  };
-}
-const repoId = { type: 'string', description: 'Stable repository id.' };
-export const runtimeToolDefinitions: McpToolDefinition[] = [
-  definition('rh_status', 'Preferred ChatGPT facade: bounded controller status, capability readiness, and self-healing diagnose/repair.', {
-    repo_id: repoId,
-    operation: { type: 'string', enum: ['list', 'get', 'repair'], description: 'Defaults to get.' },
-    detail_level: { type: 'string', enum: ['summary', 'detail'], description: 'Defaults to summary.' },
-    repair_operation: { type: 'string', enum: ['diagnose', 'repair', 'verify', 'handoff'] },
-    dry_run: { type: 'boolean', description: 'Defaults to true for repair/diagnose.' },
-    approval_confirmed: { type: 'boolean' },
-    chatgpt_pull_failed: { type: 'boolean' },
-    destructive: { type: 'boolean' },
-  }),
-  definition('rh_inbox', 'Preferred ChatGPT facade: pending handoff decisions only (not logs).', {
-    repo_id: repoId,
-    operation: { type: 'string', enum: ['list', 'get', 'ack', 'accept', 'resolve', 'dismiss', 'create'], description: 'Defaults to list (pending).' },
-    handoff_id: { type: 'string' },
-    work_id: { type: 'string' },
-    title: { type: 'string' },
-    reason: { type: 'string' },
-    summary: { type: 'string' },
-    recommended_decision: { type: 'string' },
-    recommended_prompt: { type: 'string' },
-    decision: { type: 'string', description: 'Recorded on resolve/dismiss.' },
-    resolver: { type: 'string', description: 'Who resolved or dismissed the handoff.' },
-    detail_level: { type: 'string', enum: ['summary', 'detail'] },
-    limit: { type: 'number' },
-  }),
-  definition('rh_context', 'Preferred ChatGPT facade: bounded repository context and the default code retrieval router, with optional CodeGraph structural augmentation.', {
-    repo_id: repoId,
-    checkout_id: { type: 'string', description: 'Optional checkout identity for repositories with multiple worktrees.' },
-    operation: { type: 'string', enum: ['list', 'get', 'search'], description: 'Defaults to get. Use search as the default code-location path when an exact file is unknown.' },
-    query: { type: 'string', description: 'Code/content intent for operation=search.' },
-    known_paths: { type: 'array', items: { type: 'string' }, description: 'Optional exact paths or globs that should receive highest retrieval priority.' },
-    include_globs: { type: 'array', items: { type: 'string' } },
-    exclude_globs: { type: 'array', items: { type: 'string' } },
-    retrieval_mode: { type: 'string', enum: ['implementation', 'plan', 'debug', 'review'], description: 'Defaults to implementation. Implementation returns current raw impact evidence for ChatGPT to judge; plan/debug/review intentionally widen evidence.' },
-    impact_domains: { type: 'array', items: { type: 'string', enum: [...CONTROLLER_CONTEXT_IMPACT_DOMAINS] }, description: 'Optional GPT-selected cross-cutting evidence dimensions. Forge expands these mechanically in the same retrieval call; it never treats them as proof of semantic completeness.' },
-    structural_context: { type: 'string', enum: ['off', 'auto', 'required'], description: 'Optional override. Defaults to auto for implementation/review and required for plan/debug.' },
-    max_files: { type: 'number' },
-    max_snippets: { type: 'number' },
-    requested_check_ids: { type: 'array', items: { type: 'string' } },
-    capability_id: { type: 'string', description: 'Optional capability identity. For plugin.<pluginId>.<actionId>, returns the exact typed action schema/policy for plugin_action_execute.' },
-    work_id: { type: 'string' },
-    detail_level: { type: 'string', enum: ['summary', 'detail', 'raw'], description: 'Defaults to summary; raw is still bounded.' },
-  }),
-  definition('rh_work', 'Preferred ChatGPT facade: bounded planning, direct control, controller ownership, and external SuperController launch.', {
-    repo_id: repoId,
-    operation: { type: 'string', enum: ['start', 'continue', 'verify', 'repair', 'finalize', 'stop', 'delegate', 'controller_claim', 'controller_release', 'controller_get_owner', 'launcher_start', 'plan_create', 'plan_get', 'plan_list', 'plan_approve', 'plan_supersede', 'schedule_create', 'schedule_list', 'schedule_get', 'schedule_pause', 'schedule_resume', 'schedule_trigger'], description: 'Defaults to start. Complex starts require plan_id and plan_step_id. schedule_* manages generic recurring ChatGPT workflow schedules plus Work-bound continuation/browser subtypes.' },
-    objective: { type: 'string' },
-    work_id: { type: 'string' },
-    related_work_id: { type: 'string', description: 'Optional explicit existing Work ownership target for continue/extend semantics. Unrelated active Work is never inferred as a semantic target.' },
-    work_relation: { type: 'string', enum: ['continue', 'extend', 'parallel', 'new_goal'], description: 'Optional semantic relation to an explicitly related Work. This field never selects Direct/Process/Durable execution depth; checkout conflicts are resolved by placement.' },
-    related_plan_id: { type: 'string', description: 'Existing active Plan selected when resolving another slice under the same Requirement.' },
-    plan_relation: { type: 'string', enum: ['extend', 'parallel'], description: 'Relationship to another active Plan under the same Requirement. Omit to receive candidates first. parallel explicitly permits a distinct Plan slice; extend reuses the existing Plan authority and requires replanning/supersession instead of creating another draft.' },
-    requested_by: { type: 'string', enum: ['chatgpt', 'user', 'system', 'scheduler'], description: 'Origin of the request. Scheduler-origin starts are continuation-only and cannot create new durable Work.' },
-    requirement_id: { type: 'string', description: 'Stable Requirement authority used to find related active Work before creation.' },
-    handoff_id: { type: 'string', description: 'Optional existing HandoffItem used to resume controller context.' },
-    controller_id: { type: 'string', description: 'Stable external SuperController identity for controller_claim/release.' },
-    controller_type: { type: 'string', enum: ['chatgpt', 'codex', 'grok', 'claude', 'human'], description: 'Controller kind for claims and launcher_start.' },
-    session_id: { type: 'string', description: 'Controller-owned session identity used for an exclusive Work lease.' },
-    lease_ms: { type: 'number', description: 'Authenticated Controller ownership lease duration, bounded to one hour. Legacy launcher callers may still use this as a launch-reservation TTL.' },
-    launch_reservation_ms: { type: 'number', description: 'Short duplicate-spawn reservation TTL for launcher_start or schedule_create; does not grant Work ownership.' },
-    executable: { type: 'string', description: 'External controller executable for launcher_start. This is owned by the Launcher, not the Kernel.' },
-    launch_args: { type: 'array', items: { type: 'string' }, description: 'Provider-specific arguments for launcher_start.' },
-    browser_session_id: { type: 'string', description: 'Saved Forge ChatGPT browser session to continue when controller_type=chatgpt.' },
-    conversation_url: { type: 'string', description: 'Explicit https://chatgpt.com conversation URL used when no saved Forge browser session exists.' },
-    continuation_prompt: { type: 'string', description: 'Bounded Work continuation instruction, or the recurring ChatGPT prompt when schedule_mode=workflow and objective is omitted.' },
-    schedule_id: { type: 'string', description: 'Schedule identity for schedule_get/pause/resume/trigger.' },
-    schedule_name: { type: 'string', description: 'Human-readable schedule name; generic workflow schedules use the objective/prompt when omitted.' },
-    schedule_request_id: { type: 'string', description: 'Stable idempotency key for schedule_create.' },
-    schedule_mode: { type: 'string', enum: ['workflow', 'continuation', 'browser_watch', 'browser_keepalive'], description: 'Defaults to workflow when work_id is omitted and continuation when work_id is present. workflow dispatches one bounded ChatGPT prompt per finite Occurrence without requiring Work; continuation/browser modes remain Work-bound.' },
-    probe_url: { type: 'string', description: 'Allowed URL to navigate or refresh for browser_watch/browser_keepalive.' },
-    probe_browser_session_id: { type: 'string', description: 'Existing Forge browser session used as the external observation target.' },
-    probe_selector: { type: 'string', description: 'Optional selector limiting text extraction for browser_watch.' },
-    probe_max_chars: { type: 'number', description: 'Bounded extracted text size for browser_watch.' },
-    probe_timeout_ms: { type: 'number', description: 'Bounded browser probe timeout.' },
-    include_terms: { type: 'array', items: { type: 'string' }, description: 'Optional case-insensitive terms; only matching normalized lines contribute to the observation fingerprint.' },
-    ignore_patterns: { type: 'array', items: { type: 'string' }, description: 'Optional regex patterns stripped before fingerprinting volatile text such as relative timestamps.' },
-    login_url_terms: { type: 'array', items: { type: 'string' }, description: 'Configured URL markers that classify the browser observation as authentication-required.' },
-    login_text_terms: { type: 'array', items: { type: 'string' }, description: 'Configured page-text markers that classify the browser observation as authentication-required.' },
-    wake_on_first_observation: { type: 'boolean', description: 'Defaults false so the first browser_watch occurrence records a silent baseline.' },
-    wake_on_auth_required: { type: 'boolean', description: 'Defaults true for Work-bound browser schedules.' },
-    auth_required_prompt: { type: 'string', description: 'Optional ChatGPT continuation instruction when the probe detects a login marker.' },
-    trigger_type: { type: 'string', enum: ['interval', 'cron', 'calendar', 'condition', 'repository-event', 'dependency-checkpoint', 'manual'] },
-    every_minutes: { type: 'number', description: 'Interval trigger cadence in minutes.' },
-    cron_expression: { type: 'string' },
-    schedule_timezone: { type: 'string' },
-    catch_up_minutes: { type: 'number' },
-    calendar_at: { type: 'string' },
-    condition: { type: 'object' },
-    event_name: { type: 'string' },
-    event_id: { type: 'string' },
-    event_data: { type: 'object' },
-    dependency_job_ids: { type: 'array', items: { type: 'string' } },
-    max_failures: { type: 'number' },
-    cooldown_minutes: { type: 'number' },
-    daily_budget_minutes: { type: 'number' },
-    shadow_mode: { type: 'boolean', description: 'Defaults to true. Set false only after the continuation path has been validated.' },
-    backoff_base_minutes: { type: 'number' },
-    backoff_max_minutes: { type: 'number' },
-    include_occurrences: { type: 'boolean' },
-    plan_id: { type: 'string' },
-    plan_step_id: { type: 'string', description: 'Approved PlanContract step to bind to a complex Goal Workloop start.' },
-    scope_key: { type: 'string', description: 'Stable normalized scope identity used to prevent overlapping active plans.' },
-    source_revision: { type: 'string', description: 'Repository revision observed during read-only planning preflight.' },
-    plan_steps: { type: 'array', items: { type: 'object' }, description: 'Bounded plan steps with id, objective, dependencies, authoritative_files, allowed_paths, forbidden_paths, check_ids, and acceptance_criteria.' },
-    non_goals: { type: 'array', items: { type: 'string' } },
-    assumptions: { type: 'array', items: { type: 'string' } },
-    resolved_decisions: { type: 'array', items: { type: 'string' } },
-    stop_conditions: { type: 'array', items: { type: 'string' } },
-    replan_conditions: { type: 'array', items: { type: 'string' } },
-    integration_strategy: { type: 'string' },
-    superseded_by: { type: 'string' },
-    expected_files: { type: 'number' },
-    expected_changed_lines: { type: 'number' },
-    scope_clear: { type: 'boolean' },
-    requires_investigation: { type: 'boolean' },
-    requires_long_running_checks: { type: 'boolean' },
-    requires_parallelism: { type: 'boolean' },
-    needs_dependencies: { type: 'boolean' },
-    requires_recovery: { type: 'boolean' },
-    requires_worker: { type: 'boolean', description: 'Opt-in only. Set true only when the user explicitly requests Codex/Claude or another agent worker; never infer it from task complexity.' },
-    requires_external_effect: { type: 'boolean' },
-    requires_approval: { type: 'boolean' },
-    requires_user_approval: { type: 'boolean' },
-    destructive: { type: 'boolean' },
-    remote_write: { type: 'boolean' },
-    secret_access: { type: 'boolean' },
-    capability_id: { type: 'string' },
-    approval_confirmed: { type: 'boolean' },
-    dry_run: { type: 'boolean', description: 'Defaults to true for repair.' },
-    check_ids: { type: 'array', items: { type: 'string' } },
-    check_id: { type: 'string' },
-    acceptance_criteria: { type: 'array', items: { type: 'string' } },
-    allowed_paths: { type: 'array', items: { type: 'string' } },
-    forbidden_paths: { type: 'array', items: { type: 'string' } },
-    constraints: { type: 'object' },
-    repair_operation: { type: 'string', enum: ['diagnose', 'repair', 'verify', 'handoff'] },
-    target: { type: 'string', enum: ['codex', 'grok', 'claude'], description: 'Explicit small-brain delegate target for operation=delegate. Delegation is never the default execution path.' },
-    available: { type: 'boolean', description: 'Whether the delegate target is currently available.' },
-    codex_available: { type: 'boolean' },
-    simulate_check: { type: 'boolean', description: 'Test hook: skip real check execution and use infrastructure_failed/check_failed flags.' },
-    infrastructure_failed: { type: 'boolean' },
-    check_failed: { type: 'boolean' },
-    authorize_destructive_cleanup: { type: 'boolean' },
-    commit: { type: 'boolean', description: 'Finalize override. Defaults to true only when the Work owns uncommitted changes.' },
-    merge: { type: 'boolean', description: 'Finalize override. Defaults to true for managed Work delivery.' },
-    cleanup: { type: 'boolean', description: 'Finalize/stop override. Defaults to true so managed worktrees close automatically.' },
-    target_branch: { type: 'string', description: 'Delivery branch; defaults to the repository default branch.' },
-    delete_branch: { type: 'boolean', description: 'Defaults to true after target-branch containment is proven.' },
-    no_ff: { type: 'boolean' },
-    completion_outcome: { type: 'string', enum: ['completed_changed', 'completed_no_change'] },
-    no_change_evidence: { type: 'string', description: 'Optional explicit proof for a no-change completion; otherwise the lifecycle coordinator derives proof only for an unchanged validated HEAD.' },
-    reconcile_historical_delivery: { type: 'boolean', description: 'Explicitly request reviewed reconciliation for a historically delivered Direct Edit Work whose original Work binding/receipt is missing.' },
-    reconcile_target_revision: { type: 'string', description: 'Exact already-integrated commit accepted by the reviewer.' },
-    reconcile_compared_paths: { type: 'array', items: { type: 'string' }, description: 'Complete exact path set changed from the Work base revision to reconcile_target_revision.' },
-    reconcile_rationale: { type: 'string', description: 'Bounded reviewer rationale for accepting the historical delivery.' },
-    reconcile_cleanup_proof: { type: 'string', description: 'Concrete proof that no owned cleanup remains or that cleanup is complete.' },
-    detail_level: { type: 'string', enum: ['summary', 'detail'] },
-    reason: { type: 'string', description: 'Bounded reason for a work stop or repair record.' },
-  }, [], false),
-  definition('work_submit', 'Submit one durable repository operation and return a resumable Work handle.', {
-    repo_id: repoId,
-    request_id: { type: 'string', description: 'Stable idempotency key used to resume the same execution-child Work after reconnecting.' },
-    parent_work_id: { type: 'string', description: 'Optional active primary Work that owns this low-level execution child. work_submit never creates a second business-workflow authority.' },
-    operation: { type: 'string', description: 'Existing durable controller operation, for example run_check, dispatch_task, or create_issue.' },
-    arguments: { type: 'object', description: 'Arguments passed to the durable operation.' },
-    timeout_ms: { type: 'number' },
-  }, ['request_id', 'operation'], false),
-  definition('work_get', 'Resume one Work by work_id or request_id. Repository scope is always enforced.', {
-    repo_id: repoId,
-    work_id: { type: 'string' },
-    request_id: { type: 'string' },
-    include_events: { type: 'boolean' },
-    wait: { type: 'boolean', description: 'When true, wait for terminal status before returning digest.' },
-    wait_ms: { type: 'number' },
-  }),
-  definition('work_list', 'List recent resumable Work for one repository.', {
-    repo_id: repoId,
-    limit: { type: 'number' },
-  }),
-  definition('work_cancel', 'Cancel one queued or running Work by work_id or request_id.', {
-    repo_id: repoId,
-    work_id: { type: 'string' },
-    request_id: { type: 'string' },
-    reason: { type: 'string' },
-  }, [], false),
-  definition('work_wait', 'Wait for one Work/ExecutionJob/managed process to reach a terminal status and return a bounded operation digest.', {
-    repo_id: repoId,
-    work_id: { type: 'string' },
-    request_id: { type: 'string' },
-    wait_ms: { type: 'number', description: 'Max wait in ms. Default 15000, max 120000.' },
-  }),
-  definition('git_diff_paths', 'Return a bounded Git diff and status for explicit repository-relative paths only.', {
-    repo_id: repoId,
-    paths: { type: 'array', items: { type: 'string' } },
-    staged: { type: 'boolean' },
-    max_bytes: { type: 'number' },
-  }, ['paths']),
-  definition('git_stage_paths', 'Stage explicit repository-relative paths only using git add --all -- <paths>.', {
-    repo_id: repoId,
-    paths: { type: 'array', items: { type: 'string' } },
-  }, ['paths'], false),
-  definition('git_commit_paths', 'Stage and commit explicit repository-relative paths only, leaving unrelated staged changes untouched.', {
-    repo_id: repoId,
-    paths: { type: 'array', items: { type: 'string' } },
-    message: { type: 'string' },
-  }, ['paths', 'message'], false),
-  definition('prepare_transfer_artifacts', 'Refresh rebuildable session continuation plus a selected-path patch transfer artifact when recovery context is needed.', {
-    repo_id: repoId,
-    reason: { type: 'string' },
-  }, [], false),
-  definition('get_job', 'Read one durable Execution Job. Summary is the default; opt in to full state only when needed.', {
-    job_id: { type: 'string' },
-    repo_id: repoId,
-    include_events: { type: 'boolean' },
-    detail_level: { type: 'string', enum: ['summary', 'full'] },
-    wait: { type: 'boolean', description: 'When true, wait for terminal status before returning digest.' },
-    wait_ms: { type: 'number' },
-  }, ['job_id']),
-  definition('get_artifact', 'Read one bounded Evidence Plane artifact by id. Large content remains bounded.', { artifact_id: { type: 'string' }, repo_id: repoId, max_bytes: { type: 'number' } }, ['artifact_id', 'repo_id']),
-  definition('repository_change_verify', 'Composite: verify checkout/SHA, apply bounded patch, run checks, return first failure inline without get_job/get_artifact follow-ups.', {
-    repo_id: repoId,
-    expected_branch: { type: 'string' },
-    expected_head: { type: 'string' },
-    expected_file_shas: { type: 'object', additionalProperties: { type: 'string' } },
-    patch: { type: 'string', description: 'Unified diff applied with git apply.' },
-    allowed_paths: { type: 'array', items: { type: 'string' } },
-    checks: { type: 'array', items: { type: 'string' } },
-    check_timeout_ms: { type: 'number' },
-  }, [], false),
-  definition('list_jobs', 'List durable Execution Jobs for one repository. Summary is the default.', {
-    repo_id: repoId,
-    limit: { type: 'number' },
-    detail_level: { type: 'string', enum: ['summary', 'full'] },
-  }),
-  definition('cancel_job', 'Cancel one queued or running durable Execution Job.', { job_id: { type: 'string' }, repo_id: repoId, reason: { type: 'string' } }, ['job_id'], false),
-  definition('controller_ready', 'Return one binary Runtime readiness decision with bounded diagnostic evidence.', {
-    repo_id: repoId,
-  }),
-  definition('repository_runtime_snapshot', 'Read the materialized runtime projection without scanning historical state.', { repo_id: repoId }),
-  definition('schedule_dedupe_report', 'Read-only report that groups duplicate schedules by semantic trigger/action identity.', {
-    repo_id: repoId,
-  }, ['repo_id']),
-  definition('schedule_dedupe_apply', 'Pause duplicate schedules after explicit authorization, keeping one canonical enabled schedule per semantic identity.', {
-    repo_id: repoId,
-    dry_run: { type: 'boolean', description: 'When true, only returns the proposed changes.' },
-    confirm_authorization: { type: 'boolean', description: 'Must be true unless dry_run is true.' },
-  }, ['repo_id']),
-  definition('runtime_performance_diagnostics', 'Diagnose forge host performance, orphan workers, Local Controller presence, and cleanup candidates.', {
-    repo_id: repoId,
-    include_processes: { type: 'boolean', description: 'Include bounded forge related process samples. Defaults to true.' },
-    include_temp_dirs: { type: 'boolean', description: 'Include bounded forge temporary directory scan. Defaults to true.' },
-    cleanup_preview: { type: 'boolean', description: 'Return a no-side-effect cleanup plan for orphan workers and stale temp entries.' },
-  }),
-  definition('capability_recovery_probe', 'Read-only Runtime diagnostic evidence. This tool never starts, stops, restarts, repairs, or replaces Runtime modules.', {
-    repo_id: repoId,
-    recent_errors: { type: 'array', items: { type: 'string' } },
-    command_preview_available: { type: 'boolean' },
-    command_execute_available: { type: 'boolean' },
-    issue_tools_available: { type: 'boolean' },
-    job_tools_available: { type: 'boolean' },
-  }),
-  definition('capability_recovery_plan', 'Return a diagnostic handoff plan without Runtime lifecycle actions or automatic source repair.', {
-    repo_id: repoId,
-    recent_errors: { type: 'array', items: { type: 'string' } },
-  }),
-  definition('capability_recovery_apply', 'Apply one currently supported bounded recovery action after explicit authorization. Runtime lifecycle actions are outside this surface.', {
-    repo_id: repoId,
-    action_id: { type: 'string' },
-    confirm_authorization: { type: 'boolean' },
-    authorization: { type: 'string', description: 'Must equal action_id for actions that require authorization.' },
-    reason: { type: 'string' },
-    min_age_minutes: { type: 'number' },
-    max_candidates: { type: 'number' },
-  }, ['action_id'], false),
-  definition('runtime_maintenance_status', 'Read the self-contained runtime maintenance plan without using repository_command_execute or Local Job tickets.', {
-    repo_id: repoId,
-    min_age_minutes: { type: 'number' },
-    max_candidates: { type: 'number' },
-    cancel_pending_approvals: { type: 'boolean' },
-  }),
-  definition('runtime_maintenance_apply', 'Apply one bounded runtime maintenance action without repository_command_execute or Local Job tickets.', {
-    repo_id: repoId,
-    action_id: { type: 'string', enum: ['local_jobs_reconcile', 'quarantine_unreadable_local_jobs', 'runtime_storage_finalize_relocation', 'rebuild_projection', 'full_maintenance_pass'] },
-    confirm_maintenance: { type: 'boolean' },
-    authorization: { type: 'string', description: 'Must equal action_id.' },
-    min_age_minutes: { type: 'number' },
-    max_candidates: { type: 'number' },
-    cancel_pending_approvals: { type: 'boolean' },
-  }, ['action_id', 'confirm_maintenance', 'authorization'], false),
-  definition('goal_create', 'Deprecated historical GoalContract creation. Use rh_work PlanContract/WorkContract instead.', {
-    repo_id: repoId,
-    title: { type: 'string' },
-    objective: { type: 'string' },
-    mode: { type: 'string', enum: ['manual', 'supervised', 'autonomous'] },
-    issue_id: { type: 'string' },
-    task_ids: { type: 'array', items: { type: 'string' } },
-    acceptance_criteria: { type: 'array', items: { type: 'string' } },
-    check_ids: { type: 'array', items: { type: 'string' } },
-    allowed_executors: { type: 'array', items: { type: 'string' } },
-    forbidden_executors: { type: 'array', items: { type: 'string' } },
-    retry_budget: { type: 'number' },
-  }, ['title', 'objective'], false),
-  definition('goal_list', 'List GoalContracts for a repository.', {
-    repo_id: repoId,
-    status: { type: 'string', enum: ['active', 'all', 'created', 'planning', 'ready', 'dispatching', 'running', 'verifying', 'repairing', 'waiting_for_user', 'handoff_ready', 'finalized', 'failed', 'stopped'] },
-    limit: { type: 'number' },
-  }),
-  definition('goal_get', 'Get one GoalContract by id.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-  }, ['goal_id']),
-  definition('goal_start', 'Deprecated historical GoalContract execution. Use controller_claim and launcher_start.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-  }, ['goal_id'], false),
-  definition('goal_continue', 'Deprecated historical GoalContract execution. Use WorkContract and HandoffItem.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-  }, ['goal_id'], false),
-  definition('goal_stop', 'Stop a GoalContract.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    reason: { type: 'string' },
-  }, ['goal_id'], false),
-  definition('goal_finalize', 'Finalize a GoalContract when verification evidence exists.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    force: { type: 'boolean' },
-  }, ['goal_id'], false),
-  definition('goal_status', 'User-facing goal loop status (active goals, stage, provider health, handoff).', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-  }),
-  definition('goal_tick_once', 'Deprecated. Kernel no longer ticks or dispatches Goal providers.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    task_intent: { type: 'string', enum: ['deterministic_edit', 'code_implementation', 'code_repair', 'architecture_planning', 'ios_build_or_sim', 'browser_automation', 'verification_repair', 'review', 'unknown'] },
-    verification_ok: { type: 'boolean' },
-    verification_check_id: { type: 'string' },
-    provider_failure: { type: 'boolean' },
-    external_write: { type: 'boolean' },
-    approval_confirmed: { type: 'boolean' },
-  }, [], false),
-  definition('goal_handoff_packet_create', 'Create a ChatGPT/supervisor continuation packet (handoff-only path).', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    blockers: { type: 'array', items: { type: 'string' } },
-    required_user_decision: { type: 'string' },
-    recommended_provider: { type: 'string' },
-  }, ['goal_id'], false),
-  definition('goal_handoff_packet_get', 'Read a durable goal handoff/continuation packet.', {
-    repo_id: repoId,
-    packet_id: { type: 'string' },
-  }, ['packet_id']),
-  definition('provider_list', 'List model/code executor providers (invokable vs handoff-only).', {
-    repo_id: repoId,
-  }),
-  definition('provider_health', 'Bounded redacted provider health (never returns tokens).', {
-    repo_id: repoId,
-    provider_id: { type: 'string' },
-  }),
-  definition('provider_config_status', 'Summarize invokable vs missing_auth vs handoff-only providers.', {
-    repo_id: repoId,
-  }),
-  definition('executor_route_preview', 'Preview which provider the ExecutorRouter would select.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    task_intent: { type: 'string', enum: ['deterministic_edit', 'code_implementation', 'code_repair', 'architecture_planning', 'ios_build_or_sim', 'browser_automation', 'verification_repair', 'review', 'unknown'] },
-    risk: { type: 'string', enum: ['readonly', 'local_repo_write', 'workspace_write', 'remote_write', 'destructive', 'raw_secret_config'] },
-    objective: { type: 'string' },
-  }),
-  definition('executor_dispatch', 'Policy-gated dispatch to an invokable provider; forge applies/verifies patches (no raw shell exposure).', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    provider_id: { type: 'string' },
-    task_intent: { type: 'string', enum: ['deterministic_edit', 'code_implementation', 'code_repair', 'architecture_planning', 'ios_build_or_sim', 'browser_automation', 'verification_repair', 'review', 'unknown'] },
-    risk: { type: 'string', enum: ['readonly', 'local_repo_write', 'workspace_write', 'remote_write', 'destructive', 'raw_secret_config'] },
-    approval_confirmed: { type: 'boolean' },
-    external_write: { type: 'boolean' },
-    strong_confirmation_text: { type: 'string' },
-  }, ['goal_id'], false),
-  definition('repair_plan', 'Classify goal failure and recommend repair provider/status.', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-  }, ['goal_id']),
-  definition('repair_continue', 'Continue the self-healing repair loop for a goal (one bounded transition).', {
-    repo_id: repoId,
-    goal_id: { type: 'string' },
-    force_failure_class: { type: 'string' },
-  }, ['goal_id'], false),
-  definition('workspace_auth_status', 'Summarize Workspace/Gmail auth readiness without returning or persisting secrets.', {
-    repo_id: repoId,
-  }),
-  definition('workspace_auth_login_prepare', 'Prepare a state-protected local Google Workspace/Gmail OAuth login with PKCE and Keychain persistence.', {
-    repo_id: repoId,
-    service: { type: 'string', enum: ['gmail', 'calendar', 'tasks', 'google-workspace'] },
-    scopes: { type: 'array', items: { type: 'string' } },
-    redirect_uri: { type: 'string' },
-  }),
-  definition('assistant_model_readiness', 'Read the optional bounded Assistant model provider configuration without returning secrets.', {
-    repo_id: repoId,
-  }),
-  definition('assistant_standing_grants', 'List scoped, expiring Assistant Standing Grants.', {
-    repo_id: repoId,
-    status: { type: 'string', enum: ['active', 'revoked', 'expired'] },
-    limit: { type: 'number' },
-  }),
-  definition('assistant_standing_grant_create', 'Create an explicitly authorized Standing Grant for a hardcoded low-risk action.', {
-    repo_id: repoId,
-    name: { type: 'string' },
-    plugin_id: { type: 'string' },
-    action_id: { type: 'string' },
-    routine_ids: { type: 'array', items: { type: 'string' } },
-    sender_allowlist: { type: 'array', items: { type: 'string' } },
-    subject_contains: { type: 'array', items: { type: 'string' } },
-    min_confidence: { type: 'number' },
-    max_per_run: { type: 'number' },
-    expires_in_days: { type: 'number' },
-    confirm_authorization: { type: 'boolean' },
-  }, ['plugin_id', 'action_id', 'confirm_authorization'], false),
-  definition('assistant_standing_grant_revoke', 'Revoke a Standing Grant with explicit authorization.', {
-    repo_id: repoId,
-    grant_id: { type: 'string' },
-    reason: { type: 'string' },
-    confirm_authorization: { type: 'boolean' },
-  }, ['grant_id', 'confirm_authorization'], false),
-  definition('assistant_action_proposals', 'List or get structured Assistant action proposals and execution status.', {
-    repo_id: repoId,
-    proposal_id: { type: 'string' },
-    status: { type: 'string', enum: ['proposed', 'approved', 'rejected', 'executed', 'failed', 'expired'] },
-    limit: { type: 'number' },
-  }),
-  definition('assistant_action_proposal_resolve', 'Approve or reject one Assistant action proposal. Approval submits a separate user-authorized plugin Job.', {
-    repo_id: repoId,
-    proposal_id: { type: 'string' },
-    decision: { type: 'string', enum: ['approve', 'reject'] },
-    request_id: { type: 'string' },
-    reason: { type: 'string' },
-    confirm_authorization: { type: 'boolean' },
-    confirmation_text: { type: 'string' },
-  }, ['proposal_id', 'decision'], false),
-  definition('external_filesystem_targets_list', 'List pre-authorized external filesystem targets. Does not expose arbitrary absolute-path access.', {
-    repo_id: repoId,
-  }),
-  definition('external_filesystem_grant_preview', 'Preview a read-only external filesystem grant for a narrow absolute directory without writing config.', {
-    repo_id: repoId,
-    grant_key: { type: 'string' },
-    root_path: { type: 'string' },
-    mode: { type: 'string', enum: ['read', 'copy_into_repo'] },
-    expires_in_minutes: { type: 'number', description: 'Optional expiry in minutes, capped at 24h. Defaults to 8h.' },
-    reason: { type: 'string' },
-  }, ['grant_key', 'root_path', 'reason']),
-  definition('external_filesystem_grant_apply', 'Apply a previously previewed read-only external filesystem grant with explicit authorization.', {
-    repo_id: repoId,
-    grant_key: { type: 'string' },
-    root_path: { type: 'string' },
-    mode: { type: 'string', enum: ['read', 'copy_into_repo'] },
-    expires_in_minutes: { type: 'number', description: 'Optional expiry in minutes, capped at 24h. Defaults to 8h.' },
-    reason: { type: 'string' },
-    preview_ticket_id: { type: 'string' },
-    confirm_authorization: { type: 'boolean' },
-  }, ['grant_key', 'root_path', 'reason', 'preview_ticket_id', 'confirm_authorization'], false),
-  definition('external_filesystem_text_snapshot', 'Read a bounded text/directory snapshot from a pre-authorized external filesystem target key.', {
-    repo_id: repoId,
-    target_key: { type: 'string' },
-    path: { type: 'string' },
-    max_chars: { type: 'number' },
-  }, ['target_key']),
-  definition('runtime_storage_repair_preview', 'Preview repo-scoped local-jobs runtime storage repair candidates without mutation.', {
-    repo_id: repoId,
-    min_age_minutes: { type: 'number' },
-    max_candidates: { type: 'number' },
-  }),
-  definition('runtime_storage_repair_apply', 'Apply safe repo-scoped local-jobs runtime storage repairs after explicit confirmation.', {
-    repo_id: repoId,
-    candidate_ids: { type: 'array', items: { type: 'string' } },
-    min_age_minutes: { type: 'number' },
-    max_candidates: { type: 'number' },
-    confirm_repair: { type: 'boolean' },
-  }, ['confirm_repair'], false),
-  definition('list_plugins', 'List repository plugins, or controller-scoped plugins when repo_id is omitted.', {
-    repo_id: repoId,
-  }),
-  definition('get_plugin', 'Read one repository or controller-scoped plugin manifest including action schemas and policy requirements.', {
-    repo_id: repoId,
-    plugin_id: { type: 'string' },
-  }, ['plugin_id']),
-  definition('plugin_action_execute', 'Submit one typed repository or controller-scoped plugin action through the durable execution layer.', {
-    repo_id: repoId,
-    plugin_id: { type: 'string' },
-    action_id: { type: 'string' },
-    request_id: { type: 'string' },
-    work_id: { type: 'string', description: 'Optional existing remote-effect Work that should own the successful typed plugin receipt.' },
-    arguments: { type: 'object' },
-    timeout_ms: { type: 'number' },
-    confirm_authorization: { type: 'boolean' },
-    confirmation_text: { type: 'string' },
-  }, ['plugin_id', 'action_id', 'request_id'], false),
-  definition('toolchain_plugin_summary', 'Return a redacted, low-interception plugin summary without raw config files or full action schemas.', {
-    repo_id: repoId,
-    plugin_id: { type: 'string' },
-  }, ['plugin_id']),
-  definition('work_result_summary', 'Return a redacted job result summary with failure class and suggested next actions. Does not return raw stdout or stderr.', {
-    repo_id: repoId,
-    job_id: { type: 'string' },
-  }, ['job_id']),
-  definition('work_status_digest', 'Return a redacted work status digest using a neutral work_ref. Does not return raw stdout or stderr.', {
-    repo_id: repoId,
-    work_ref: { type: 'string' },
-  }, ['work_ref']),
-  definition('model_clients_summary', 'List enabled model clients and DeepSeek adapter configuration state. Policy remains enforced by forge.', {
-    repo_id: repoId,
-  }),
-  definition('model_control_plane_summary', 'Summarize primary and backup model controllers, handoff modes, and concurrency policy.', {
-    repo_id: repoId,
-  }),
-  definition('deepseek_tool_manifest', 'Return DeepSeek function-calling tool manifests for the low-interception forge surface.', {
-    repo_id: repoId,
-  }),
-  definition('deepseek_tool_call_prepare', 'Translate one DeepSeek function call into a forge operation without executing it.', {
-    repo_id: repoId,
-    function_name: { type: 'string' },
-    function_arguments: { type: 'object' },
-  }, ['function_name', 'function_arguments']),
-  definition('deepseek_controller_manifest', 'Return DeepSeek backup-controller manifest, boundaries, and function tools.', {
-    repo_id: repoId,
-  }),
-  definition('deepseek_controller_handoff_prepare', 'Prepare a safe DeepSeek backup-controller handoff packet without calling the external model.', {
-    repo_id: repoId,
-    reason: { type: 'string', enum: ['manual', 'chatgpt_platform_blocked', 'chatgpt_unavailable', 'parallel_review', 'local_gui_request'] },
-    objective: { type: 'string' },
-    current_controller: { type: 'string' },
-    blocked_tool_name: { type: 'string' },
-    recent_safe_error: { type: 'string' },
-  }),
-  definition('deepseek_controller_request_prepare', 'Prepare a DeepSeek chat-completions request for backup controller mode without sending it.', {
-    repo_id: repoId,
-    reason: { type: 'string', enum: ['manual', 'chatgpt_platform_blocked', 'chatgpt_unavailable', 'parallel_review', 'local_gui_request'] },
-    objective: { type: 'string' },
-    user_message: { type: 'string' },
-    current_controller: { type: 'string' },
-    blocked_tool_name: { type: 'string' },
-    recent_safe_error: { type: 'string' },
-    model: { type: 'string' },
-  }),
-  definition('assistant_readiness', 'Summarize personal-assistant readiness, Google plugin state, routines, inbox, and recommended next actions.', {
-    repo_id: repoId,
-  }),
-  definition('gmail_triage_rules', 'Read repository-local Gmail triage rules used by the personal assistant manager.', { repo_id: repoId }),
-  definition('gmail_triage_rule_upsert', 'Create or update one repository-local Gmail triage rule. This only changes repo-local assistant configuration.', {
-    repo_id: repoId,
-    id: { type: 'string' },
-    enabled: { type: 'boolean' },
-    order: { type: 'number' },
-    match: { type: 'object' },
-    decision: { type: 'object' },
-  }, ['id', 'match', 'decision'], false),
-  definition('gmail_triage_plan', 'Build a safe Gmail triage plan from supplied message summaries and current Gmail plugin readiness. Does not mutate Gmail.', {
-    repo_id: repoId,
-    query: { type: 'string' },
-    items: { type: 'array', items: { type: 'object' } },
-  }),
-  definition('review_artifacts_prepare', 'Create bounded repo-local review artifact roots for browser/iOS screenshot review workflows.', { repo_id: repoId }, [], false),
-  definition('review_artifacts_index', 'Index bounded repo-local browser/iOS screenshots, logs, and build reports for visual review.', { repo_id: repoId, limit: { type: 'number' } }),
-  definition('browser_review_packet', 'Build a browser visual review packet from indexed browser screenshots.', { repo_id: repoId, limit: { type: 'number' } }),
-  definition('ios_review_packet', 'Build or capture an iOS visual review packet from simulator screenshots and logs.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    label: { type: 'string' },
-    capture: { type: 'boolean' },
-    limit: { type: 'number' },
-  }, [], false),
-  definition('workflow_watchdog_report', 'Diagnose stuck repository workflows across execution jobs, local bridge jobs, schedules, and runtime processes.', {
-    repo_id: repoId,
-    stale_minutes: { type: 'number' },
-    include_processes: { type: 'boolean' },
-  }),
-  definition('ios_xcode_status', 'Check local Xcode, xcodebuild, and simctl availability without mutation.', { repo_id: repoId }),
-  definition('ios_simulators_list', 'List available iOS Simulator devices using structured simctl JSON output.', {
-    repo_id: repoId,
-    runtime: { type: 'string' },
-    name: { type: 'string' },
-  }),
-  definition('ios_project_discover', 'Discover iOS workspaces, projects, Package.swift, and Info.plist files inside the repository.', { repo_id: repoId }),
-  definition('ios_schemes_list', 'List Xcode schemes for a repository-bounded workspace or project.', {
-    repo_id: repoId,
-    workspace: { type: 'string' },
-    project: { type: 'string' },
-  }),
-  definition('ios_simulator_boot', 'Boot an explicitly selected iOS Simulator UDID. Requires authorization.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    open_simulator: { type: 'boolean' },
-    confirm_authorization: { type: 'boolean' },
-    timeout_ms: { type: 'number' },
-  }, ['udid', 'confirm_authorization'], false),
-  definition('ios_app_build', 'Build an iOS app into .forge/ios/DerivedData using xcodebuild structured arguments.', {
-    repo_id: repoId,
-    scheme: { type: 'string' },
-    udid: { type: 'string' },
-    workspace: { type: 'string' },
-    project: { type: 'string' },
-    configuration: { type: 'string' },
-    timeout_ms: { type: 'number' },
-  }, ['scheme'], false),
-  definition('ios_app_install', 'Install a bounded .app product from .forge/ios/DerivedData into a booted simulator. Requires authorization.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    app_path: { type: 'string' },
-    confirm_authorization: { type: 'boolean' },
-  }, ['udid', 'app_path', 'confirm_authorization'], false),
-  definition('ios_app_launch', 'Launch a simulator app by bundle id with structured launch arguments. Requires authorization.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    bundle_id: { type: 'string' },
-    arguments: { type: 'array', items: { type: 'string' } },
-    confirm_authorization: { type: 'boolean' },
-  }, ['udid', 'bundle_id', 'confirm_authorization'], false),
-  definition('ios_simulator_screenshot', 'Capture a simulator screenshot to .forge/ios/screenshots as a bounded artifact.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    label: { type: 'string' },
-  }, ['udid'], false),
-  definition('ios_simulator_log_tail', 'Collect a bounded recent simulator log tail into .forge/ios/logs.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    process: { type: 'string' },
-    last: { type: 'string' },
-    max_bytes: { type: 'number' },
-  }),
-  definition('ios_ui_smoke_test', 'Compose build, boot, launch, screenshot, and bounded logs for simulator UI review. Requires authorization.', {
-    repo_id: repoId,
-    udid: { type: 'string' },
-    scheme: { type: 'string' },
-    bundle_id: { type: 'string' },
-    workspace: { type: 'string' },
-    project: { type: 'string' },
-    configuration: { type: 'string' },
-    app_path: { type: 'string' },
-    screenshot_label: { type: 'string' },
-    confirm_authorization: { type: 'boolean' },
-  }, ['udid', 'scheme', 'bundle_id', 'confirm_authorization'], false),
-  definition('runtime_cleanup_preview', 'Preview stale forge temp directories, terminal local jobs, and historical attention cleanup candidates.', {
-    repo_id: repoId,
-    min_age_minutes: { type: 'number' },
-    include_temp_dirs: { type: 'boolean' },
-    include_terminal_local_jobs: { type: 'boolean' },
-    include_legacy_runs: { type: 'boolean' },
-    include_historical_attention: { type: 'boolean' },
-    max_candidates: { type: 'number' },
-  }),
-  definition('runtime_cleanup_apply', 'Apply safe cleanup candidates. Requires confirm_cleanup=true and remains limited to explicit forge candidates.', {
-    repo_id: repoId,
-    min_age_minutes: { type: 'number' },
-    include_temp_dirs: { type: 'boolean' },
-    include_terminal_local_jobs: { type: 'boolean' },
-    include_legacy_runs: { type: 'boolean' },
-    include_historical_attention: { type: 'boolean' },
-    max_candidates: { type: 'number' },
-    confirm_cleanup: { type: 'boolean' },
-  }, [], false),
-  definition('create_schedule', 'Create a bounded repository Schedule. Shadow mode defaults to true.', {
-    repo_id: repoId,
-    request_id: { type: 'string' },
-    name: { type: 'string' },
-    trigger_type: { type: 'string', enum: ['interval', 'cron', 'calendar', 'condition', 'repository-event', 'dependency-checkpoint', 'manual'] },
-    every_minutes: { type: 'number' },
-    cron_expression: { type: 'string' },
-    calendar_at: { type: 'string' },
-    condition: { type: 'object' },
-    event_name: { type: 'string' },
-    dependency_job_ids: { type: 'array', items: { type: 'string' } },
-    operation: { type: 'string' },
-    arguments: { type: 'object' },
-    shadow_mode: { type: 'boolean' },
-    daily_budget_minutes: { type: 'number' },
-    cooldown_minutes: { type: 'number' },
-    backoff_base_minutes: { type: 'number' },
-    backoff_max_minutes: { type: 'number' },
-    max_failures: { type: 'number' },
-    stop_conditions: { type: 'array', items: { type: 'string' } },
-  }, ['name', 'operation'], false),
-  definition('list_schedules', 'List repository Schedules and recent bounded Occurrences.', { repo_id: repoId, include_occurrences: { type: 'boolean' } }),
-  definition('pause_schedule', 'Pause a repository Schedule.', { repo_id: repoId, schedule_id: { type: 'string' }, reason: { type: 'string' } }, ['schedule_id'], false),
-  definition('trigger_schedule', 'Create one idempotent bounded Occurrence for a Schedule or deliver a repository event.', {
-    repo_id: repoId,
-    schedule_id: { type: 'string' },
-    event_name: { type: 'string' },
-    event_id: { type: 'string' },
-    event_data: { type: 'object' },
-  }, ['schedule_id'], false),
-  definition('request_release_gate', 'Return an explicit external-Controller handoff for release evidence. Push, tag, and publish remain separately authorized.', { repo_id: repoId, request_id: { type: 'string' } }, [], false),
-  definition('create_portfolio_workflow', 'Create a cross-repository DAG with deterministic Saga stop/compensation semantics.', {
-    name: { type: 'string' }, request_id: { type: 'string' }, failure_policy: { type: 'string', enum: ['stop', 'compensate'] }, steps: { type: 'array', items: { type: 'object' } },
-  }, ['name', 'request_id', 'steps'], false),
-  definition('list_portfolio_workflows', 'List cross-repository Portfolio workflows.', { limit: { type: 'number' } }),
-  definition('get_portfolio_workflow', 'Read one Portfolio workflow and its repository DAG state.', { workflow_id: { type: 'string' } }, ['workflow_id']),
-  definition('record_candidate_finding', 'Record or refresh a deduplicated candidate requirement without creating an Issue automatically.', {
-    repo_id: repoId, request_id: { type: 'string' }, semantic_key: { type: 'string' }, title: { type: 'string' }, summary: { type: 'string' }, severity: { type: 'string', enum: ['low', 'medium', 'high', 'critical'] }, reference: { type: 'string' }, evidence: { type: 'object' },
-  }, ['semantic_key', 'title'], false),
-  definition('list_candidate_findings', 'List bounded candidate findings awaiting human promotion or dismissal.', { repo_id: repoId, include_terminal: { type: 'boolean' }, limit: { type: 'number' } }),
-  definition('promote_candidate_finding', 'Return the candidate finding and an explicit external-Controller handoff for Issue creation.', {
-    repo_id: repoId, finding_id: { type: 'string' }, request_id: { type: 'string' }, kind: { type: 'string', enum: ['bug', 'feature', 'governance', 'investigation'] }, goals: { type: 'array', items: { type: 'string' } }, acceptance_criteria: { type: 'array', items: { type: 'string' } },
-  }, ['finding_id'], false),
-];
-
-export const connectorExposedTools = runtimeToolDefinitions.map((tool) => tool.name);
-export const currentCallableTools = new Set(connectorExposedTools);
+export {
+  connectorExposedTools,
+  currentCallableTools,
+  runtimeToolDefinitions,
+} from './runtime-tool-definitions';
+import {
+  currentCallableTools,
+  runtimeToolDefinitions,
+} from './runtime-tool-definitions';
 
 const RH_CONTEXT_CURRENT_WINDOW_MS = 24 * 60 * 60 * 1_000;
 
@@ -971,6 +249,233 @@ function isCurrentRhContextWork(
   return timestampIsCurrent(contract.updatedAt, cutoffMs);
 }
 
+function rhContextReadSessionId(ctx: MultiRepositoryMcpToolContext): string | undefined {
+  const principal = ctx.principalId?.trim();
+  if (principal) {
+    const controllerInstance = ctx.controllerInstanceId?.trim() || currentControllerInstanceId();
+    return `controller:${principal}:${controllerInstance}`;
+  }
+  const transportSession = ctx.sessionId?.trim();
+  return transportSession ? `transport:${transportSession}` : undefined;
+}
+
+const RH_CONTEXT_SEMANTIC_QUERY_LIMIT = 8;
+const RH_CONTEXT_SEMANTIC_LOCATION_LIMIT = 200;
+const RH_CONTEXT_LEGACY_SEMANTIC_SYNTAX = '@tsnav references <repo-path>:<line>:<column> | @swiftnav references <repo-path>:<line>:<column>';
+
+type RhContextSemanticNavigationRequest = {
+  navigation: SemanticNavigationKind;
+  path: string;
+  line: number;
+  column: number;
+  tsconfig_path?: string;
+  language?: string;
+};
+
+function rhContextLegacySemanticQuery(query: string): {
+  retrievalQuery: string;
+  requests: RhContextSemanticNavigationRequest[];
+} {
+  const requests: RhContextSemanticNavigationRequest[] = [];
+  const directive = /(?:^|\s)@(tsnav|swiftnav)\s+(definition|references|implementations)\s+([^\s]+):(\d+):(\d+)(?:\s+tsconfig=([^\s]+))?/gi;
+  const retrievalQuery = query.replace(directive, (_match, directiveKind, navigation, path, line, column, tsconfigPath) => {
+    const language = String(directiveKind).toLowerCase() === 'swiftnav' ? 'swift' : 'typescript';
+    requests.push({
+      navigation: String(navigation).toLowerCase() as SemanticNavigationKind,
+      path: String(path),
+      line: Number(line),
+      column: Number(column),
+      language,
+      ...(tsconfigPath ? { tsconfig_path: String(tsconfigPath) } : {}),
+    });
+    return ' ';
+  }).replace(/\s+/g, ' ').trim();
+  const fallback = requests.length > 0
+    ? `${requests[0]!.language === 'swift' ? 'Swift' : 'TypeScript'} ${requests[0]!.navigation} ${requests[0]!.path}`
+    : query;
+  return { retrievalQuery: retrievalQuery || fallback, requests };
+}
+
+interface RhContextSemanticNavigationProjection {
+  requested: number;
+  executed: number;
+  results: Record<string, unknown>[];
+  errors: Array<{ index: number; code: string; message: string }>;
+  providers: unknown[];
+  policyDeniedLocations: number;
+  policyDeniedReads: number;
+  policyDeniedReadSamples: string[];
+  requestTruncated: boolean;
+  freshness: 'not_requested' | 'changed_during_query' | 'current_at_query';
+  sourceIdentity?: Record<string, unknown>;
+  staticClosure: { scope: string; status: 'not_requested' | 'incomplete' | 'complete_for_requested_symbols'; limitations: string[] };
+}
+
+async function rhContextSemanticNavigation(
+  repoRoot: string,
+  policy: MultiRepositoryMcpToolContext['policy'],
+  value: unknown,
+  repositoryIdentity: { repoId: string; checkoutId: string },
+): Promise<RhContextSemanticNavigationProjection> {
+  const raw = Array.isArray(value) ? value : [];
+  const requests = raw.slice(0, RH_CONTEXT_SEMANTIC_QUERY_LIMIT);
+  const results: Record<string, unknown>[] = [];
+  const errors: Array<{ index: number; code: string; message: string }> = [];
+  let anyLocationTruncated = false;
+  let policyDeniedLocations = 0;
+  let policyDeniedReads = 0;
+  const policyDeniedReadSamples = new Set<string>();
+  const semanticAccessScope = createHash('sha256')
+    .update(JSON.stringify({ profile: policy.profile, readGlobs: policy.readGlobs, denyGlobs: policy.denyGlobs }))
+    .digest('hex')
+    .slice(0, 20);
+
+  const fingerprintOf = (identity: ReturnType<typeof freshGitIdentity> | undefined): string | undefined => identity
+    ? identity.workingTreeFingerprint
+      ?? createHash('sha256').update(`${identity.head ?? ''}\n${identity.branch ?? ''}`).digest('hex').slice(0, 24)
+    : undefined;
+  // Semantic providers are targeted/optional, so pay the stronger fresh identity
+  // sampling cost only when semantic evidence was explicitly requested.
+  const sourceBefore = requests.length > 0 ? freshGitIdentity(repoRoot) : undefined;
+  const sourceFingerprintBefore = fingerprintOf(sourceBefore);
+  const indexedRequests: Array<{ index: number; request: SemanticNavigationRequest }> = [];
+
+  requests.forEach((entry, index) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+      errors.push({ index, code: 'SEMANTIC_NAVIGATION_REQUEST_INVALID', message: 'semantic_navigation entries must be objects.' });
+      return;
+    }
+    const item = entry as Record<string, unknown>;
+    const navigation = String(item.navigation ?? '') as SemanticNavigationKind;
+    const path = String(item.path ?? '').trim();
+    const line = Number(item.line);
+    const column = Number(item.column);
+    const tsconfigPath = typeof item.tsconfig_path === 'string' && item.tsconfig_path.trim() ? item.tsconfig_path.trim() : undefined;
+    const language = typeof item.language === 'string' && item.language.trim() ? item.language.trim().toLowerCase() : undefined;
+    if (!['definition', 'references', 'implementations'].includes(navigation) || !path || !Number.isInteger(line) || line < 1 || !Number.isInteger(column) || column < 1) {
+      errors.push({ index, code: 'SEMANTIC_NAVIGATION_REQUEST_INVALID', message: 'navigation, path, and positive 1-based line/column are required.' });
+      return;
+    }
+    const targetDecision = resolveMcpPath(repoRoot, path, policy, 'read');
+    if (!targetDecision.ok) {
+      errors.push({ index, code: 'SEMANTIC_NAVIGATION_TARGET_DENIED', message: targetDecision.reason ?? 'target path denied by MCP read policy.' });
+      return;
+    }
+    indexedRequests.push({
+      index,
+      request: { navigation, path, line, column, ...(tsconfigPath ? { tsconfigPath } : {}), ...(language ? { language } : {}) },
+    });
+  });
+
+  const allowRepositoryPath = (relativePath: string): boolean => {
+    const decision = resolveMcpPath(repoRoot, relativePath, policy, 'read');
+    if (decision.ok) return true;
+    policyDeniedReads += 1;
+    if (policyDeniedReadSamples.size < 20) policyDeniedReadSamples.add(relativePath);
+    return false;
+  };
+
+  const navigationOutcomes = await defaultSemanticProviderRegistry.navigate(repoRoot, indexedRequests, {
+    cacheScope: `mcp:${semanticAccessScope}`,
+    sourceIdentity: sourceFingerprintBefore,
+    profile: policy.profile,
+    allowRepositoryPath,
+  });
+
+  for (const { index, outcome } of navigationOutcomes) {
+    if (!outcome.ok) {
+      errors.push({ index, code: outcome.code, message: outcome.message });
+      continue;
+    }
+    const semantic = outcome.result;
+    const allowedLocations = semantic.locations.filter((location) => {
+      const decision = resolveMcpPath(repoRoot, location.path, policy, 'read');
+      if (decision.ok) return true;
+      policyDeniedLocations += 1;
+      return false;
+    });
+    const truncated = allowedLocations.length > RH_CONTEXT_SEMANTIC_LOCATION_LIMIT;
+    anyLocationTruncated ||= truncated;
+    results.push({
+      provider: semantic.providerId,
+      ...(semantic.providerIdentity ? { providerIdentity: semantic.providerIdentity } : {}),
+      language: semantic.language,
+      navigation: semantic.navigation,
+      target: semantic.target,
+      locations: allowedLocations.slice(0, RH_CONTEXT_SEMANTIC_LOCATION_LIMIT),
+      totalLocations: allowedLocations.length,
+      returnedLocations: Math.min(allowedLocations.length, RH_CONTEXT_SEMANTIC_LOCATION_LIMIT),
+      truncated,
+      policyDeniedReads: semantic.policyDeniedReads ?? 0,
+      ...(semantic.details ?? {}),
+    });
+  }
+
+  results.sort((left, right) => {
+    const leftTarget = left.target as { path?: string; line?: number; column?: number } | undefined;
+    const rightTarget = right.target as { path?: string; line?: number; column?: number } | undefined;
+    return String(leftTarget?.path ?? '').localeCompare(String(rightTarget?.path ?? ''))
+      || Number(leftTarget?.line ?? 0) - Number(rightTarget?.line ?? 0)
+      || Number(leftTarget?.column ?? 0) - Number(rightTarget?.column ?? 0);
+  });
+
+  const sourceAfter = requests.length > 0 ? freshGitIdentity(repoRoot) : undefined;
+  const sourceFingerprintAfter = fingerprintOf(sourceAfter);
+  const sourceChangedDuringQuery = Boolean(
+    sourceBefore
+    && sourceAfter
+    && (sourceBefore.head !== sourceAfter.head || sourceFingerprintBefore !== sourceFingerprintAfter),
+  );
+  if (sourceChangedDuringQuery) {
+    errors.push({
+      index: -1,
+      code: 'SEMANTIC_SOURCE_CHANGED_DURING_QUERY',
+      message: 'Repository source identity changed while semantic providers were running. Returned locations are retained only as hints for the sampled source and are not proof for the newer source state.',
+    });
+  }
+
+  const requestTruncated = raw.length > RH_CONTEXT_SEMANTIC_QUERY_LIMIT;
+  const incomplete = requestTruncated || anyLocationTruncated || policyDeniedLocations > 0 || policyDeniedReads > 0 || errors.length > 0 || sourceChangedDuringQuery;
+  const languages = new Set(results.map((entry) => String(entry.language ?? '')).filter(Boolean));
+  const singleLanguage = languages.size === 1 ? [...languages][0] : undefined;
+  const scope = singleLanguage === 'typescript'
+    ? 'requested_typescript_static_relationships'
+    : singleLanguage === 'swift'
+      ? 'requested_swift_static_relationships'
+      : singleLanguage
+        ? `requested_${singleLanguage.replace(/[^a-z0-9_-]+/gi, '_').toLowerCase()}_static_relationships`
+        : languages.size > 1
+          ? 'requested_multilanguage_static_relationships'
+          : 'requested_semantic_static_relationships';
+  return {
+    requested: raw.length,
+    executed: requests.length,
+    results,
+    errors,
+    providers: defaultSemanticProviderRegistry.list(),
+    policyDeniedLocations,
+    policyDeniedReads,
+    policyDeniedReadSamples: Array.from(policyDeniedReadSamples),
+    requestTruncated,
+    freshness: raw.length === 0 ? 'not_requested' : sourceChangedDuringQuery ? 'changed_during_query' : 'current_at_query',
+    ...(sourceBefore ? {
+      sourceIdentity: {
+        repoId: repositoryIdentity.repoId,
+        checkoutId: repositoryIdentity.checkoutId,
+        branch: sourceBefore.branch,
+        head: sourceBefore.head,
+        workingTreeFingerprint: sourceFingerprintBefore,
+        sampledAt: new Date(sourceBefore.sampledAt).toISOString(),
+      },
+    } : {}),
+    staticClosure: {
+      scope,
+      status: raw.length === 0 ? 'not_requested' : incomplete ? 'incomplete' : 'complete_for_requested_symbols',
+      limitations: ['dynamic_registration', 'string_or_config_edges', 'reflection', 'runtime_dispatch', 'stale_or_missing_language_index'],
+    },
+  };
+}
+
 export function summarizeControllerReadyPayload(fullPayload: Record<string, unknown>): Record<string, unknown> {
   const health = (fullPayload.health ?? {}) as Record<string, unknown>;
   const workerLoop = (fullPayload.workerLoop ?? {}) as Record<string, unknown>;
@@ -1110,6 +615,32 @@ async function callStandaloneRecoveryTool(
   }
 }
 
+export const RH_WORK_VERIFY_LEASE_WAIT_MS = DEFAULT_WORK_CHECK_LEASE_WAIT_MS;
+
+type TerminalCheckEvidenceState = 'matched' | 'process_runtime_failed_before_result' | 'missing' | 'mismatch';
+
+export function classifyTerminalCheckEvidence(input: {
+  processError?: { code: string; message: string };
+  structuredPresent: boolean;
+  structuredMatches: boolean;
+  legacyPresent: boolean;
+  legacyMatches: boolean;
+}): { state: TerminalCheckEvidenceState; warning?: string; infrastructureReason?: string } {
+  if (input.structuredMatches || input.legacyMatches) return { state: 'matched' };
+  if (!input.structuredPresent && !input.legacyPresent && input.processError?.message?.trim()) {
+    const reason = input.processError.message.trim().slice(0, 512);
+    return {
+      state: 'process_runtime_failed_before_result',
+      warning: `check process failed before structured result receipt: ${reason}`,
+      infrastructureReason: reason,
+    };
+  }
+  if (input.structuredPresent || input.legacyPresent) {
+    return { state: 'mismatch', warning: 'check result receipt did not match the terminal Process semantic identity' };
+  }
+  return { state: 'missing', warning: 'check result receipt is missing for the terminal Check Process' };
+}
+
 function result(value: Record<string, unknown>, isError = false): CallToolResult {
   // Compact text channel by default (no pretty-print bloat).
   return { content: [{ type: 'text', text: JSON.stringify(value) }], structuredContent: value, ...(isError ? { isError: true } : {}) };
@@ -1293,6 +824,17 @@ function summarizePluginActionReceipt(manifest: ReturnType<typeof getAssistantPl
   };
 }
 
+function compactSubmittedPluginActionResult(value: Record<string, unknown> | undefined): Record<string, unknown> | undefined {
+  if (!value) return undefined;
+  const nested = value.result;
+  if (!nested || typeof nested !== 'object' || Array.isArray(nested)) return value;
+  const work = value.work;
+  return {
+    ...(nested as Record<string, unknown>),
+    ...(work && typeof work === 'object' && !Array.isArray(work) ? { work } : {}),
+  };
+}
+
 
 function stringList(value: unknown): string[] {
   return Array.isArray(value) ? value.map(String).map((entry) => entry.trim()).filter(Boolean) : [];
@@ -1636,6 +1178,7 @@ function ensureFacadeWorkHandle(
     managedWorktree,
     workContractId: contract.workId,
     baseCommit: contract.baseRevision ?? status.head ?? undefined,
+    deliveryBaseCommit: contract.baseRevision ?? status.head ?? undefined,
     expectedHead: status.head ?? contract.baseRevision,
     permissionSnapshotVersion: currentPermissionSnapshotVersion(ctx.controllerHome, repository.repoId),
     state: 'prepared',
@@ -1646,6 +1189,206 @@ function ensureFacadeWorkHandle(
   });
 }
 
+function materializeFacadeWorkPlacement(
+  ctx: MultiRepositoryMcpToolContext,
+  repository: ReturnType<typeof selected>,
+  workId: string,
+  args: Record<string, unknown>,
+) {
+  const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
+  const contract = getWorkContract(store, workId);
+  if (!contract || contract.worktreePolicy.required !== true || contract.worktreeRef) return contract;
+  const workspace = ensureManagedWorkspace(ctx.controllerHome, repository, {
+    requestId: workId,
+    title: contract.objective,
+    baseRef: contract.baseRevision,
+    prepareDependencies: args.needs_dependencies === true,
+  });
+  if (!workspace.managed || !workspace.checkoutId || !workspace.root || workspace.checkoutId === repository.activeCheckoutId) {
+    throw new Error('MANAGED_WORKSPACE_NOT_MATERIALIZED');
+  }
+  return updateWorkContract(store, workId, {
+    checkoutId: workspace.checkoutId,
+    baseRevision: workspace.baseRevision ?? contract.baseRevision,
+    worktreeRef: workspace.root,
+    driver: { ...contract.driver, preferred: 'isolated_worktree', allowDirectEdit: false },
+  });
+}
+
+function reauthorizeCancelledFacadeWork(
+  ctx: MultiRepositoryMcpToolContext,
+  repository: ReturnType<typeof selected>,
+  workId: string,
+  args: Record<string, unknown>,
+): { reconstructedCheckout: boolean } {
+  const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
+  let work = getWorkContract(store, workId);
+  if (!work || work.status !== 'cancelled') return { reconstructedCheckout: false };
+  if (args.approval_confirmed !== true || args.requested_by !== 'user') {
+    throw new Error(`WORK_CANCELLED_RESUME_REAUTHORIZATION_REQUIRED: ${workId}; use exact work_id with requested_by=user and approval_confirmed=true`);
+  }
+  const identity = authenticatedFacadeControllerIdentity(ctx, args);
+  if (!work.principalId?.trim() || work.principalId.trim() !== identity.principalId) {
+    throw new Error(`WORK_CANCELLED_RESUME_PRINCIPAL_MISMATCH: ${workId}`);
+  }
+  const owner = getControllerSession(store, workId);
+  if (owner && (owner.principalId?.trim() || owner.controllerId) !== identity.principalId) {
+    throw new Error(`WORK_CANCELLED_RESUME_CONTROLLER_OWNERSHIP_MISMATCH: ${workId}`);
+  }
+  if (work.completionReceipt || work.completionOutcome) throw new Error(`WORK_CANCELLED_RESUME_COMPLETION_CONFLICT: ${workId}`);
+  if (work.reconciliations.length > 0) throw new Error(`WORK_CANCELLED_RESUME_DELIVERY_HISTORY_AMBIGUOUS: ${workId}`);
+  if (work.phase !== 'cleanup' || work.phaseEvidence.cleanup.state !== 'skipped' || work.phaseEvidence.cleanup.source !== 'recorded') {
+    throw new Error(`WORK_CANCELLED_RESUME_HISTORY_AMBIGUOUS: ${workId}`);
+  }
+  if (work.workKind !== 'repository_change' || work.worktreePolicy.required !== true) {
+    throw new Error(`WORK_CANCELLED_RESUME_ISOLATED_REPOSITORY_WORK_REQUIRED: ${workId}`);
+  }
+
+  let handle = readWorkHandle(ctx.controllerHome, repository.repoId, workId);
+  if (handle) {
+    if (handle.repositoryId !== repository.repoId || (handle.workContractId && handle.workContractId !== workId)) {
+      throw new Error(`WORK_CANCELLED_RESUME_HANDLE_IDENTITY_MISMATCH: ${workId}`);
+    }
+    if (handle.principalId !== identity.principalId) throw new Error(`WORK_CANCELLED_RESUME_HANDLE_PRINCIPAL_MISMATCH: ${workId}`);
+    if (['committed', 'merged', 'cleaned', 'failed_terminal_cleanup'].includes(handle.state)
+      || handle.finalization.commit === 'done'
+      || handle.finalization.merge === 'done'
+      || handle.cleanupReceipt?.complete === true) {
+      throw new Error(`WORK_CANCELLED_RESUME_DELIVERY_OR_CLEANUP_CONFLICT: ${workId}`);
+    }
+  }
+
+  const registryRepository = listRepositories(ctx.controllerHome, { includeRemoved: true })
+    .find((candidate) => candidate.repoId === repository.repoId);
+  if (!registryRepository) throw new Error(`WORK_CANCELLED_RESUME_REPOSITORY_MISSING: ${workId}`);
+  const recordedCheckoutId = work.checkoutId?.trim();
+  const recordedWorktree = work.worktreeRef?.trim();
+  const checkoutRecord = recordedCheckoutId
+    ? registryRepository.checkouts.find((candidate) => candidate.checkoutId === recordedCheckoutId)
+    : undefined;
+  const checkoutActive = checkoutRecord?.lifecycle === 'active';
+  const worktreePresent = Boolean(recordedWorktree && existsSync(recordedWorktree));
+
+  if (checkoutActive && worktreePresent && recordedCheckoutId && recordedWorktree) {
+    const retained = selectRepositoryCheckout(registryRepository, recordedCheckoutId);
+    if (resolve(retained.canonicalRoot) !== resolve(recordedWorktree)) {
+      throw new Error(`WORK_CANCELLED_RESUME_CHECKOUT_REUSED: ${workId}`);
+    }
+    if (!handle) throw new Error(`WORK_CANCELLED_RESUME_HANDLE_REQUIRED: ${workId}`);
+    if (handle.checkoutId !== recordedCheckoutId || resolve(handle.worktreePath) !== resolve(recordedWorktree)) {
+      throw new Error(`WORK_CANCELLED_RESUME_CHECKOUT_OWNERSHIP_MISMATCH: ${workId}`);
+    }
+    const status = repositoryGitStatus(retained);
+    if (!status.branch || status.branch !== handle.branch) throw new Error(`WORK_CANCELLED_RESUME_BRANCH_OWNERSHIP_MISMATCH: ${workId}`);
+    writeWorkHandle(ctx.controllerHome, {
+      ...handle,
+      principalId: identity.principalId,
+      sessionId: identity.sessionId,
+      updatedAt: new Date().toISOString(),
+    });
+    resumeRetainedCancelledWorkContract(store, workId, {
+      principalId: identity.principalId,
+      controllerInstanceId: identity.controllerInstanceId,
+      summary: 'Explicit current user re-authorized the same retained cancelled Work; exact managed checkout ownership was revalidated.',
+    });
+    return { reconstructedCheckout: false };
+  }
+
+  if (checkoutActive) throw new Error(`WORK_CANCELLED_RESUME_PRESERVATION_AMBIGUOUS: ${workId}`);
+  if (!recordedCheckoutId || !recordedWorktree || !handle) throw new Error(`WORK_CANCELLED_RESUME_HANDLE_REQUIRED: ${workId}`);
+
+  const actualChangedPaths = work.scopeEvidence?.actualChangedPaths;
+  if (!actualChangedPaths || actualChangedPaths.length !== 0
+    || work.checks.length !== 0
+    || work.checkRefs.length !== 0
+    || work.evidenceState !== 'none') {
+    throw new Error(`WORK_CANCELLED_RESUME_ZERO_DELTA_PROOF_REQUIRED: ${workId}`);
+  }
+  const recordedBase = work.baseRevision?.trim();
+  if (!recordedBase) throw new Error(`WORK_CANCELLED_RESUME_BASE_REVISION_REQUIRED: ${workId}`);
+  const baseRevision = gitCommitAtRef(repository.canonicalRoot, recordedBase);
+  if (!baseRevision) throw new Error(`WORK_CANCELLED_RESUME_BASE_REVISION_MISSING: ${workId}`);
+  const handleBase = handle.baseCommit ? gitCommitAtRef(repository.canonicalRoot, handle.baseCommit) : undefined;
+  const handleHead = handle.expectedHead ? gitCommitAtRef(repository.canonicalRoot, handle.expectedHead) : undefined;
+  if ((handle.baseCommit && handleBase !== baseRevision) || (handle.expectedHead && handleHead !== baseRevision)) {
+    throw new Error(`WORK_CANCELLED_RESUME_REVISION_AMBIGUOUS: ${workId}`);
+  }
+  if (handle.checkoutId !== recordedCheckoutId || resolve(handle.worktreePath) !== resolve(recordedWorktree)) {
+    throw new Error(`WORK_CANCELLED_RESUME_CHECKOUT_OWNERSHIP_MISMATCH: ${workId}`);
+  }
+  if (handle.branch) {
+    const historicalBranchHead = gitCommitAtRef(repository.canonicalRoot, `refs/heads/${handle.branch}`);
+    if (historicalBranchHead && historicalBranchHead !== baseRevision) {
+      throw new Error(`WORK_CANCELLED_RESUME_UNIQUE_COMMIT_CONFLICT: ${workId}`);
+    }
+  }
+  if (worktreePresent) {
+    const retainedSnapshot = gitWorktreeSnapshot(recordedWorktree);
+    if (!retainedSnapshot || !retainedSnapshot.clean || retainedSnapshot.head !== baseRevision || (handle.branch && retainedSnapshot.branch !== handle.branch)) {
+      throw new Error(`WORK_CANCELLED_RESUME_ZERO_DELTA_PHYSICAL_CONFLICT: ${workId}`);
+    }
+  }
+
+  const branchName = `work/resume-${workId.replace(/[^A-Za-z0-9._-]+/g, '-').slice(0, 42)}-${baseRevision.slice(0, 12)}`;
+  const existingResumeBranch = gitCommitAtRef(repository.canonicalRoot, `refs/heads/${branchName}`);
+  if (existingResumeBranch && existingResumeBranch !== baseRevision) {
+    throw new Error(`WORK_CANCELLED_RESUME_RECONSTRUCTION_BRANCH_CONFLICT: ${workId}`);
+  }
+  const workspace = ensureManagedWorkspace(ctx.controllerHome, repository, {
+    requestId: `${workId}:explicit-user-resume:${baseRevision}`,
+    title: `${work.objective} explicit user resume`,
+    branchName,
+    baseRef: baseRevision,
+    prepareDependencies: args.needs_dependencies === true,
+  });
+  if (!workspace.managed || !workspace.checkoutId || !workspace.root || !workspace.branch) {
+    throw new Error(`WORK_CANCELLED_RESUME_RECONSTRUCTION_FAILED: ${workId}`);
+  }
+  const refreshedRepository = listRepositories(ctx.controllerHome, { includeRemoved: true })
+    .find((candidate) => candidate.repoId === repository.repoId);
+  if (!refreshedRepository) throw new Error(`WORK_CANCELLED_RESUME_REPOSITORY_MISSING: ${workId}`);
+  const reconstructed = selectRepositoryCheckout(refreshedRepository, workspace.checkoutId);
+  const reconstructedStatus = repositoryGitStatus(reconstructed);
+  if (!reconstructedStatus.clean || reconstructedStatus.head !== baseRevision || reconstructedStatus.branch !== workspace.branch) {
+    throw new Error(`WORK_CANCELLED_RESUME_RECONSTRUCTION_REVISION_MISMATCH: ${workId}`);
+  }
+
+  work = updateWorkContract(store, workId, {
+    checkoutId: workspace.checkoutId,
+    worktreeRef: workspace.root,
+    baseRevision,
+    controllerInstanceId: identity.controllerInstanceId,
+  });
+  const now = new Date().toISOString();
+  handle = writeWorkHandle(ctx.controllerHome, {
+    ...handle,
+    principalId: identity.principalId,
+    sessionId: identity.sessionId,
+    checkoutId: workspace.checkoutId,
+    worktreePath: workspace.root,
+    branch: workspace.branch,
+    sourceCheckoutId: repository.activeCheckoutId,
+    managedWorktree: true,
+    baseCommit: baseRevision,
+    deliveryBaseCommit: baseRevision,
+    expectedHead: baseRevision,
+    state: 'prepared',
+    validatedInputFingerprint: undefined,
+    failureReason: undefined,
+    cleanupReceipt: undefined,
+    finalization: { validation: 'pending', commit: 'pending', merge: 'pending', branchCleanup: 'pending', worktreeCleanup: 'pending' },
+    updatedAt: now,
+  });
+  resumeRetainedCancelledWorkContract(store, workId, {
+    principalId: identity.principalId,
+    controllerInstanceId: identity.controllerInstanceId,
+    summary: 'Explicit current user re-authorized the same cancelled Work; prior managed checkout was absent and a fresh isolated checkout was reconstructed at the exact zero-delta base revision.',
+    checkoutId: workspace.checkoutId,
+    worktreeRef: workspace.root,
+  });
+  return { reconstructedCheckout: true };
+}
+
 function claimNewFacadeWork(
   ctx: MultiRepositoryMcpToolContext,
   repository: ReturnType<typeof selected>,
@@ -1698,7 +1441,8 @@ async function finalizeFacadeWorkHandle(
 ): Promise<CallToolResult | undefined> {
   const workId = String(args.work_id ?? '').trim();
   if (!workId) return undefined;
-  const handle = readWorkHandle(ctx.controllerHome, repository.repoId, workId);
+  let handle = readWorkHandle(ctx.controllerHome, repository.repoId, workId)
+    ?? recoverTerminalWorkHandle(ctx.controllerHome, repository.repoId, workId);
   if (!handle) return undefined;
   const session = bindFacadeExecutionSession(ctx, repository, handle, args);
   const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
@@ -1726,11 +1470,45 @@ async function finalizeFacadeWorkHandle(
   const head = status.head ?? handle.expectedHead ?? handle.baseCommit;
   const committedDelta = Boolean(head && handle.baseCommit && head !== handle.baseCommit);
   const commit = typeof args.commit === 'boolean' ? args.commit : !status.clean;
-  const merge = typeof args.merge === 'boolean' ? args.merge : true;
+  const workContract = getWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, workId);
+  if (
+    status.clean
+    && committedDelta
+    && commit === false
+    && (workContract?.allowedPaths.length ?? 0) > 0
+    && head
+    && handle.expectedHead
+    && head !== handle.expectedHead
+    && (handle.state === 'prepared' || handle.state === 'editing')
+  ) {
+    const contract = getWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, workId);
+    if ((contract?.allowedPaths.length ?? 0) > 0 || (contract?.forbiddenPaths.length ?? 0) > 0) {
+      const adopted = await callExecutionTool(ctx, 'work_prepare', {
+        session_id: session.sessionId,
+        repo_id: repository.repoId,
+        checkout_id: handle.checkoutId,
+        work_id: workId,
+        expected_previous_head: handle.expectedHead,
+        adopt_candidate_head: head,
+      });
+      if (!adopted || adopted.isError === true) return adopted;
+      handle = readWorkHandle(ctx.controllerHome, repository.repoId, workId) ?? handle;
+    } else if (handle.state === 'prepared') {
+      // A Work without explicit path allow/deny constraints historically permits
+      // repository-scoped committed progress. Preserve that contract while moving
+      // the handle onto a legal lifecycle edge before the physical finalizer
+      // validates and adopts the exact delivery HEAD.
+      handle = transitionWorkHandle(ctx.controllerHome, handle, 'editing', { failureReason: undefined });
+    }
+  }
   const requestedOutcome = args.completion_outcome === 'completed_no_change' || args.completion_outcome === 'completed_changed'
     ? args.completion_outcome
     : undefined;
   const completionOutcome = requestedOutcome ?? (!commit && !committedDelta && status.clean ? 'completed_no_change' : 'completed_changed');
+  // A proven no-change completion has nothing to merge. Defaulting merge=true
+  // forced the generic Git delivery path to do unnecessary work and conflicted
+  // with work_finalize's explicit no-change contract.
+  const merge = typeof args.merge === 'boolean' ? args.merge : completionOutcome !== 'completed_no_change';
   const explicitNoChangeEvidence = typeof args.no_change_evidence === 'string' ? args.no_change_evidence.trim() : '';
   const noChangeEvidence = completionOutcome === 'completed_no_change'
     ? explicitNoChangeEvidence || `Validated Work ${workId} has no repository delta from base ${handle.baseCommit ?? 'unknown'} at clean HEAD ${head ?? 'unknown'}.`
@@ -1740,6 +1518,7 @@ async function finalizeFacadeWorkHandle(
     commit,
     merge,
     no_ff: args.no_ff === true,
+    remote_write: args.remote_write === true,
     completion_outcome: completionOutcome,
     ...(noChangeEvidence ? { no_change_evidence: noChangeEvidence } : {}),
   };
@@ -1796,27 +1575,6 @@ function selected(ctx: MultiRepositoryMcpToolContext, args: Record<string, unkno
   });
 }
 
-function schemaAwareWorkSubmitArguments(
-  name: string,
-  explicitArguments: Record<string, unknown>,
-  repository: ReturnType<typeof selected>,
-  definition: McpToolDefinition,
-  timeoutMs: unknown,
-): Record<string, unknown> {
-  const schema = definition.inputSchema as { properties?: Record<string, unknown> };
-  const declared = new Set(Object.keys(schema.properties ?? {}));
-  const candidates = repositoryScopedToolArgs(name, {
-    ...explicitArguments,
-    ...(declared.has('repo_id') ? { repo_id: repository.repoId } : {}),
-    ...(declared.has('timeout_ms') && typeof timeoutMs === 'number' ? { timeout_ms: timeoutMs } : {}),
-  }, repository);
-  const scoped: Record<string, unknown> = { ...explicitArguments };
-  for (const [key, value] of Object.entries(candidates)) {
-    if (Object.hasOwn(explicitArguments, key) || declared.has(key)) scoped[key] = value;
-  }
-  return scoped;
-}
-
 function pluginRepository(
   ctx: MultiRepositoryMcpToolContext,
   args: Record<string, unknown>,
@@ -1827,6 +1585,32 @@ function pluginRepository(
     : selected(ctx, args);
 }
 
+function definedArguments(value: Record<string, unknown>): Record<string, unknown> {
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+
+function legacyIosPluginAction(
+  ctx: MultiRepositoryMcpToolContext,
+  legacyTool: string,
+  args: Record<string, unknown>,
+  actionId: string,
+  actionArgs: Record<string, unknown>,
+): Promise<CallToolResult | undefined> {
+  const repository = selected(ctx, args);
+  const requestId = typeof args.request_id === 'string' && args.request_id.trim()
+    ? args.request_id.trim()
+    : `legacy-${legacyTool}-${Date.now()}`;
+  return callRuntimeTool(ctx, 'plugin_action_execute', {
+    repo_id: repository.repoId,
+    checkout_id: repository.activeCheckoutId,
+    plugin_id: 'ios',
+    action_id: actionId,
+    request_id: requestId,
+    arguments: definedArguments(actionArgs),
+    ...(args.confirm_authorization === true ? { confirm_authorization: true } : {}),
+  });
+}
+
 function expectedRevision(args: Record<string, unknown>, key = 'expected_revision'): number | undefined {
   return typeof args[key] === 'number' ? Math.trunc(args[key] as number) : undefined;
 }
@@ -2447,14 +2231,10 @@ function managedProcessOperationDigest(
     summary: terminal
       ? `Managed process ${handle.processId} completed with status ${handle.status}.`
       : `Managed process ${handle.processId} is still ${handle.status}.`,
-    suggestedNextActions: terminal ? [] : [{
-      label: 'Poll managed process',
-      tool: 'work_status_digest',
-      operation: 'get',
-      payload: { work_ref: handle.processId },
-      risk: 'readonly',
-      confidence: 'high',
-    }],
+    // A running Process is not itself a request to poll. The controller should
+    // keep making independent progress, then join only at its real dependency
+    // boundary through the Process lifecycle surface.
+    suggestedNextActions: [],
   };
 }
 
@@ -2525,6 +2305,90 @@ async function runFacadeRepair(
     : 'diagnose';
   const dryRun = args.dry_run === undefined ? true : args.dry_run === true;
   const elevatedRepair = args.destructive === true || args.remote_write === true || args.remote_effect === true;
+  const planId = typeof args.plan_id === 'string' ? args.plan_id.trim() : '';
+  const planStepId = typeof args.plan_step_id === 'string' ? args.plan_step_id.trim() : '';
+
+  if (planId || planStepId) {
+    if (!planId || !planStepId) {
+      const facade = buildFacadeResult({ status: 'blocked', summary: 'PLAN_STEP_REPAIR_CONTEXT_REQUIRED: plan_id and plan_step_id are both required.', data: { operation: repairOperation, dryRun, repaired: false } });
+      return result(facade as unknown as Record<string, unknown>, true);
+    }
+    const plan = getPlanContract(store, planId);
+    const step = plan?.steps.find((candidate) => candidate.id === planStepId);
+    if (!plan || !step) {
+      const facade = buildFacadeResult({ status: 'not_found', summary: !plan ? `PlanContract ${planId} not found.` : `PLAN_STEP_NOT_FOUND: ${planStepId}`, data: { operation: repairOperation, dryRun, planId, planStepId, repaired: false } });
+      return result(facade as unknown as Record<string, unknown>, true);
+    }
+    if (!step.workId) {
+      const facade = buildFacadeResult({ summary: `Plan step ${planId}/${planStepId} has no Work binding to repair.`, data: { operation: repairOperation, dryRun, planId, planStepId, repaired: false, repairRequired: false } });
+      return result(facade as unknown as Record<string, unknown>);
+    }
+    const boundWork = getWorkContract(store, step.workId);
+    if (boundWork) {
+      if (['completed', 'failed', 'cancelled'].includes(boundWork.status)) {
+        if (repairOperation !== 'repair' || dryRun) {
+          const facade = buildFacadeResult({
+            summary: `PLAN_STEP_TERMINAL_WORK_RECONCILIABLE: ${planId}/${planStepId} is bound to existing terminal Work ${boundWork.workId}. Explicit repair can project that exact Work without creating a replacement.`,
+            data: { operation: repairOperation, dryRun, planId, planStepId, boundWorkId: boundWork.workId, repaired: false, repairRequired: true, reusedExistingWork: true },
+            suggestedNextActions: [{ label: 'Project existing terminal Work', tool: 'rh_work', operation: 'repair', payload: { plan_id: planId, plan_step_id: planStepId, repair_operation: 'repair', dry_run: false }, risk: 'workspace_write', confidence: 'high' }],
+          });
+          return result(facade as unknown as Record<string, unknown>);
+        }
+        try {
+          const reconciledPlan = completePlanStepForWork(store, { planId, stepId: planStepId, work: boundWork });
+          const facade = buildFacadeResult({
+            summary: `Reconciled Plan step ${planId}/${planStepId} from its existing terminal Work ${boundWork.workId}; no replacement Work was created.`,
+            data: { operation: repairOperation, dryRun: false, plan: summarizePlanContract(reconciledPlan), boundWorkId: boundWork.workId, repaired: true, reusedExistingWork: true },
+          });
+          return result(facade as unknown as Record<string, unknown>);
+        } catch (error) {
+          const facade = buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'PLAN_STEP_TERMINAL_WORK_RECONCILIATION_FAILED', data: { operation: repairOperation, dryRun: false, planId, planStepId, boundWorkId: boundWork.workId, repaired: false } });
+          return result(facade as unknown as Record<string, unknown>, true);
+        }
+      }
+      const facade = buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_STEP_BOUND_WORK_STILL_EXISTS: ${planId}/${planStepId} is bound to active Work ${boundWork.workId}; continue that exact Work instead of repairing or replacing it.`,
+        data: { operation: repairOperation, dryRun, planId, planStepId, boundWorkId: boundWork.workId, repaired: false, repairRequired: false },
+        suggestedNextActions: [{ label: 'Continue existing Work', tool: 'rh_work', operation: 'continue', payload: { work_id: boundWork.workId }, risk: 'readonly', confidence: 'high' }],
+      });
+      return result(facade as unknown as Record<string, unknown>, true);
+    }
+    const conflicting = listWorkContracts({ ...store, status: 'active', limit: 200 })
+      .filter((candidate) => candidate.planId === planId && candidate.planStepId === planStepId && candidate.workId !== step.workId);
+    if (conflicting.length > 0) {
+      const facade = buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_STEP_REPAIR_CONFLICT: ${planId}/${planStepId} is bound to missing Work ${step.workId}, but ${conflicting.length} other active Work record(s) claim the same step. Resolve the conflicting authority before changing the Plan binding.`,
+        data: { operation: repairOperation, dryRun, planId, planStepId, boundWorkId: step.workId, conflictingWorkIds: conflicting.map((candidate) => candidate.workId), repaired: false },
+      });
+      return result(facade as unknown as Record<string, unknown>, true);
+    }
+    if (repairOperation !== 'repair' || dryRun) {
+      const facade = buildFacadeResult({
+        summary: `PLAN_STEP_DANGLING_WORK_BINDING: ${planId}/${planStepId} points to missing Work ${step.workId}. Exact repair is available and will clear only this unchanged ghost binding.`,
+        data: { operation: repairOperation, dryRun, planId, planStepId, boundWorkId: step.workId, repaired: false, repairRequired: true },
+        suggestedNextActions: [{ label: 'Repair exact dangling binding', tool: 'rh_work', operation: 'repair', payload: { plan_id: planId, plan_step_id: planStepId, repair_operation: 'repair', dry_run: false }, risk: 'workspace_write', confidence: 'high' }],
+      });
+      return result(facade as unknown as Record<string, unknown>);
+    }
+    try {
+      const repairedPlan = repairDanglingPlanStepWorkBinding(store, {
+        planId,
+        stepId: planStepId,
+        expectedWorkId: step.workId,
+        reason: 'Explicit Controller repair confirmed that the exact bound Work record is absent and no other active primary Work claims this Plan step.',
+      });
+      const facade = buildFacadeResult({
+        summary: `Repaired dangling Plan step binding ${planId}/${planStepId}; ${step.workId} was cleared without creating a replacement Work.`,
+        data: { operation: repairOperation, dryRun: false, plan: summarizePlanContract(repairedPlan), boundWorkId: step.workId, repaired: true, replacementWorkCreated: false },
+      });
+      return result(facade as unknown as Record<string, unknown>);
+    } catch (error) {
+      const facade = buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'PLAN_STEP_DANGLING_WORK_REPAIR_FAILED', data: { operation: repairOperation, dryRun: false, planId, planStepId, boundWorkId: step.workId, repaired: false } });
+      return result(facade as unknown as Record<string, unknown>, true);
+    }
+  }
 
   // The self-healing facade is a policy/planning surface; the authoritative
   // maintenance executor owns mutations. Execute it here only for an explicit,
@@ -2632,6 +2496,144 @@ async function runFacadeRepair(
   return result(facade as unknown as Record<string, unknown>, facade.status === 'blocked' || facade.status === 'approval_required' || facade.status === 'failed');
 }
 
+function reconcileTerminalFacadeWorkVerifications(
+  ctx: MultiRepositoryMcpToolContext,
+  repository: ReturnType<typeof selected>,
+  workId: string,
+): { sourceRevision?: string; workspaceFingerprint?: string; workspaceChangedPaths?: string[]; reconciledProcessIds: string[] } {
+  const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
+  const workContract = getWorkContract(store, workId);
+  if (!workContract || workContract.completionReceipt) return { reconciledProcessIds: [] };
+
+  let verificationRepository: ReturnType<typeof selectRepositoryCheckout>;
+  try {
+    verificationRepository = workContract.checkoutId
+      ? selectRepositoryCheckout(repository, workContract.checkoutId, { allowArchived: true })
+      : repository;
+  } catch {
+    return { reconciledProcessIds: [] };
+  }
+  const verificationStatus = repositoryGitStatus(verificationRepository);
+  const sourceRevision = verificationStatus.head ?? undefined;
+  if (!sourceRevision) return { reconciledProcessIds: [] };
+  const verificationHandle = readWorkHandle(ctx.controllerHome, repository.repoId, workId);
+  const deliveryBaseRevision = verificationHandle
+    ? workDeliveryBaseRevision(verificationHandle)
+    : workContract.baseRevision;
+  const committedPaths = deliveryBaseRevision
+    ? workChangedPaths(verificationRepository.canonicalRoot, deliveryBaseRevision, sourceRevision)
+    : [];
+  const workspaceChangedPaths = [...new Set([
+    ...committedPaths,
+    ...verificationStatus.staged,
+    ...verificationStatus.unstaged,
+    ...verificationStatus.untracked,
+  ])].sort();
+  const workspaceFingerprint = workspaceValidationFingerprint(verificationRepository.canonicalRoot, verificationStatus);
+  const availableChecks = listControllerChecks(repository.canonicalRoot);
+  const workloopCtx = {
+    workStore: store,
+    handoffStore: store,
+    repoId: repository.repoId,
+    availableChecks,
+  };
+  const seenChecks = new Set<string>();
+  const reconciledProcessIds: string[] = [];
+  const candidates = listProcessRecords(ctx.controllerHome, repository.repoId, 500)
+    .filter((record) => (
+      record.workId === workId
+      && record.checkoutId === verificationRepository.activeCheckoutId
+      && !isManagedProcessActive(record)
+      && record.origin?.workVerificationSnapshot === true
+      && typeof record.origin?.checkId === 'string'
+      && typeof record.origin?.requestSemanticFingerprint === 'string'
+    ));
+
+  for (const record of candidates) {
+    const checkId = record.origin?.checkId?.trim() ?? '';
+    if (!checkId || seenChecks.has(checkId)) continue;
+    seenChecks.add(checkId);
+    const classified = classifyVerificationOutcome({ checkId, available: availableChecks });
+    if (classified.outcome === 'invalid_check_id' || !classified.normalizedCheckId) continue;
+    const normalizedCheckId = classified.normalizedCheckId;
+    const requestedChecks = workContract.checks.length ? workContract.checks : [normalizedCheckId];
+    const currentFingerprint = verificationInputFingerprint({
+      sourceRevision,
+      workspaceFingerprint,
+      checkId: normalizedCheckId,
+      requestedChecks,
+    });
+    if (record.origin?.requestSemanticFingerprint !== currentFingerprint || !record.checkExecution) continue;
+
+    try {
+      const receipt = processCheckCompletionReceipt(record, {
+        repoId: verificationRepository.repoId,
+        checkoutId: verificationRepository.activeCheckoutId,
+        workId,
+        checkId: normalizedCheckId,
+        processId: record.processId,
+        requestId: record.origin?.requestId,
+        checkExecution: {
+          cacheKey: record.checkExecution.cacheKey,
+          revision: record.checkExecution.revision,
+          definitionDigest: record.checkExecution.definitionDigest,
+          environmentFingerprint: record.checkExecution.environmentFingerprint,
+          timeoutMs: record.checkExecution.timeoutMs,
+          scopeKey: record.checkExecution.scopeKey,
+        },
+      });
+      const latestContract = getWorkContract(store, workId);
+      if (latestContract?.checkRefs.some((entry) => entry.receipt?.receiptId === receipt.receiptId)) continue;
+
+      const structuredCheckResult = readPersistedCheckResultReceipt(record.origin?.checkResultReceiptPath);
+      const structuredResultMatchesProcess = Boolean(
+        structuredCheckResult
+        && structuredCheckResult.checkId === normalizedCheckId
+        && structuredCheckResult.cacheKey === record.checkExecution.cacheKey,
+      );
+      const legacyEvidence = record.origin?.checkResultReceiptPath
+        ? undefined
+        : readLatestControllerCheckEvidence(verificationRepository.canonicalRoot, normalizedCheckId);
+      const legacyEvidenceMatchesProcess = Boolean(
+        legacyEvidence?.cacheKey
+        && legacyEvidence.cacheKey === record.checkExecution.cacheKey,
+      );
+      const evidenceState = classifyTerminalCheckEvidence({
+        processError: record.error,
+        structuredPresent: Boolean(structuredCheckResult),
+        structuredMatches: structuredResultMatchesProcess,
+        legacyPresent: Boolean(legacyEvidence),
+        legacyMatches: legacyEvidenceMatchesProcess,
+      });
+      const failureClass = structuredResultMatchesProcess
+        ? structuredCheckResult?.failureClass
+        : legacyEvidenceMatchesProcess ? legacyEvidence?.failureClass : undefined;
+      const infrastructureFailed = receipt.timedOut
+        || receipt.cancelled
+        || evidenceState.state !== 'matched'
+        || (!receipt.ok && failureClass !== 'acceptance_failure');
+      const checkFailed = !receipt.ok && !infrastructureFailed;
+      verifyGoalWorkloop(workloopCtx, {
+        workId,
+        checkId: normalizedCheckId,
+        sourceRevision,
+        workspaceFingerprint,
+        verificationInputFingerprint: currentFingerprint,
+        commandFingerprint: commandFingerprint(normalizedCheckId, receipt.commandId),
+        receipt,
+        infrastructureFailed,
+        checkFailed,
+      });
+      reconciledProcessIds.push(record.processId);
+    } catch {
+      // Exact receipt/process identity is mandatory. Any malformed, stale, or
+      // mismatched terminal Process remains non-authoritative and is ignored.
+    }
+  }
+
+  return { sourceRevision, workspaceFingerprint, workspaceChangedPaths, reconciledProcessIds };
+}
+
 async function runFacadeVerify(
   ctx: MultiRepositoryMcpToolContext,
   repository: ReturnType<typeof selected>,
@@ -2646,7 +2648,30 @@ async function runFacadeVerify(
     availableChecks: checks,
   };
   const workId = typeof args.work_id === 'string' ? args.work_id : '';
-  const checkId = String(args.check_id ?? args.checkId ?? '');
+  const checkId = String(args.check_id ?? args.checkId ?? '').trim();
+  if (!checkId) {
+    return result(buildFacadeResult({
+      status: 'blocked',
+      summary: 'rh_work verify requires a registered check_id.',
+      data: {
+        verification: {
+          outcome: 'check_id_required',
+          isAcceptanceFailure: false,
+          isInfrastructureIssue: true,
+          doesNotRequestTaskChanges: true,
+        },
+        registeredCheckCount: checks.length,
+      },
+      warnings: ['CHECK_ID_REQUIRED: pass check_id for one registered repository check.'],
+      suggestedNextActions: normalizeCheckIds(checks.slice(0, 3).map((check) => check.id), checks).suggestedNextActions,
+    }) as unknown as Record<string, unknown>, true);
+  }
+  const workContract = workId ? getWorkContract(store, workId) : undefined;
+  if (workId && (!workContract || workContract.status === 'completed' || workContract.status === 'cancelled' || workContract.status === 'failed')) {
+    const facade = verifyGoalWorkloop(workloopCtx, { workId, checkId });
+    return result(facade as unknown as Record<string, unknown>, facade.status === 'failed');
+  }
+
   const classified = classifyVerificationOutcome({
     checkId,
     available: checks,
@@ -2708,12 +2733,39 @@ async function runFacadeVerify(
     const requestId = typeof args.request_id === 'string' && args.request_id.trim()
       ? args.request_id.trim()
       : undefined;
-    const workContract = workId ? getWorkContract(store, workId) : undefined;
-    if (workId && !workContract) throw new Error(`WORK_NOT_FOUND: ${workId}`);
     const verificationRepository = workContract?.checkoutId
       ? selectRepositoryCheckout(repository, workContract.checkoutId, { allowArchived: true })
       : repository;
-    const observedGitHead = repositoryGitStatus(verificationRepository).head;
+    const verificationStatus = repositoryGitStatus(verificationRepository);
+    const observedGitHead = verificationStatus.head;
+    const workspaceFingerprint = workspaceValidationFingerprint(verificationRepository.canonicalRoot, verificationStatus);
+    const requestedChecks = workContract?.checks.length ? workContract.checks : [normalizedCheckId];
+    const verificationRequestFingerprint = observedGitHead ? verificationInputFingerprint({
+      sourceRevision: observedGitHead,
+      workspaceFingerprint,
+      checkId: normalizedCheckId,
+      requestedChecks,
+    }) : undefined;
+    const registeredCheck = checks.find((entry) => entry.id === normalizedCheckId);
+    const durableClassCheck = checkRequiresDurableWorkflow(normalizedCheckId, registeredCheck);
+    let allowDurableCheckExecution = false;
+    if (durableClassCheck && workContract?.checks.includes(normalizedCheckId) && !workContract.completionReceipt && workContract.status === 'running') {
+      try {
+        const identity = authenticatedFacadeControllerIdentity(ctx, args);
+        const owner = getControllerSession(store, workId);
+        const ownerPrincipal = owner?.principalId?.trim() || owner?.controllerId;
+        allowDurableCheckExecution = Boolean(
+          owner
+          && owner.controllerId === identity.controllerId
+          && ownerPrincipal === identity.principalId
+          && owner.controllerInstanceId === identity.controllerInstanceId,
+        );
+      } catch {
+        // Durable-class checks remain deferred when the authenticated claim cannot
+        // be proven exactly. The lower Process Runtime never infers authority.
+        allowDurableCheckExecution = false;
+      }
+    }
     const executed = await runPersistedCheckViaProcessRuntime({
       controllerHome: ctx.controllerHome,
       repoId: verificationRepository.repoId,
@@ -2724,8 +2776,13 @@ async function runFacadeVerify(
       timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
       // rh_work.verify is a control-plane continuation primitive: callers should
       // be able to keep working and later reattach to the exact same Process.
+      // Absorb brief shared build-cache/resource contention during admission so
+      // a lifecycle verification does not turn a few seconds of contention into
+      // a terminal failed Check that the controller must manually retry.
       interactiveWaitMs: 0,
+      leaseWaitMs: RH_WORK_VERIFY_LEASE_WAIT_MS,
       requestId,
+      requestSemanticFingerprint: verificationRequestFingerprint,
       workId: workId || undefined,
       commandId: requestId,
       verificationSnapshot: workContract ? {
@@ -2733,6 +2790,7 @@ async function runFacadeVerify(
         allowedPaths: workContract.allowedPaths,
         forbiddenPaths: workContract.forbiddenPaths,
       } : undefined,
+      allowDurableCheckExecution,
     });
 
     if (executed.mode === 'durable') {
@@ -2825,7 +2883,14 @@ async function runFacadeVerify(
       && record.checkExecution?.cacheKey
       && legacyEvidence.cacheKey === record.checkExecution.cacheKey,
     );
-    const resultMatchesProcess = structuredResultMatchesProcess || legacyEvidenceMatchesProcess;
+    const evidenceState = classifyTerminalCheckEvidence({
+      processError: record.error,
+      structuredPresent: Boolean(structuredCheckResult),
+      structuredMatches: structuredResultMatchesProcess,
+      legacyPresent: Boolean(legacyEvidence),
+      legacyMatches: legacyEvidenceMatchesProcess,
+    });
+    const resultMatchesProcess = evidenceState.state === 'matched';
     const failureClass = structuredResultMatchesProcess
       ? structuredCheckResult?.failureClass
       : legacyEvidenceMatchesProcess ? legacyEvidence?.failureClass : undefined;
@@ -2858,12 +2923,21 @@ async function runFacadeVerify(
       checkResultReceiptId: structuredCheckResult?.receiptId,
       verificationIsolation: record.origin?.workVerificationSnapshot ? 'work_snapshot' : 'shared_checkout',
       boundedStatus,
+      evidenceState: evidenceState.state,
+      ...(evidenceState.infrastructureReason ? { infrastructureReason: evidenceState.infrastructureReason } : {}),
+      ...(record.error?.code ? { processErrorCode: record.error.code } : {}),
     };
 
     if (workId) {
+      const sourceRevision = observedGitHead ?? undefined;
       const facade = verifyGoalWorkloop(workloopCtx, {
         workId,
         checkId: normalizedCheckId,
+        sourceRevision,
+        workspaceFingerprint,
+        verificationInputFingerprint: sourceRevision ? verificationRequestFingerprint : undefined,
+        commandFingerprint: commandFingerprint(normalizedCheckId, receipt.commandId),
+        receipt,
         infrastructureFailed,
         checkFailed,
       });
@@ -2878,7 +2952,7 @@ async function runFacadeVerify(
           },
         },
         warnings: infrastructureFailed
-          ? [...facade.warnings, resultMatchesProcess ? 'infrastructure_failure is distinct from acceptance failure' : 'check result receipt did not match the terminal Process semantic identity']
+          ? [...facade.warnings, evidenceState.warning ?? 'infrastructure_failure is distinct from acceptance failure']
           : facade.warnings,
       } as unknown as Record<string, unknown>, facade.status === 'failed');
     }
@@ -2892,7 +2966,7 @@ async function runFacadeVerify(
           : `Check ${normalizedCheckId} failed acceptance.`,
       data: { verification: commonVerification },
       warnings: infrastructureFailed
-        ? [resultMatchesProcess ? 'infrastructure_failure is distinct from acceptance failure' : 'check result receipt did not match the terminal Process semantic identity']
+        ? [evidenceState.warning ?? 'infrastructure_failure is distinct from acceptance failure']
         : [],
       rawAvailable: false,
     }) as unknown as Record<string, unknown>, checkFailed);
@@ -2957,6 +3031,90 @@ export function runtimeSourceSnapshotStatus(
   };
 }
 
+export function repositoryExecutionReadiness(
+  repoRoot: string,
+  availableChecks: ReturnType<typeof listControllerChecks>,
+  requestedCheckIds: string[] = [],
+  schedulingScope: { repoId?: string; checkoutId?: string } = {},
+): Record<string, unknown> {
+  const git = gitSnapshot(repoRoot);
+  const registeredCheckIds = availableChecks.map((check) => check.id);
+  const normalizedChecks = normalizeCheckIds(requestedCheckIds, availableChecks);
+  const hasPackageJson = existsSync(join(repoRoot, 'package.json'));
+  const nodeModulesReady = !hasPackageJson || existsSync(join(repoRoot, 'node_modules'));
+  const lockCandidates = [
+    ['bun', 'bun.lock'],
+    ['bun', 'bun.lockb'],
+    ['pnpm', 'pnpm-lock.yaml'],
+    ['npm', 'package-lock.json'],
+    ['yarn', 'yarn.lock'],
+  ] as const;
+  const detectedLock = lockCandidates.find(([, path]) => existsSync(join(repoRoot, path)));
+  const packageManager = detectedLock?.[0];
+  const bootstrapCommand = hasPackageJson && !nodeModulesReady
+    ? packageManager === 'bun' ? ['bun', 'install', '--frozen-lockfile']
+      : packageManager === 'pnpm' ? ['pnpm', 'install', '--frozen-lockfile']
+        : packageManager === 'npm' ? ['npm', 'ci']
+          : packageManager === 'yarn' ? ['yarn', 'install', '--frozen-lockfile']
+            : undefined
+    : undefined;
+  const hasPythonManifest = existsSync(join(repoRoot, 'pyproject.toml'))
+    || existsSync(join(repoRoot, 'requirements.txt'))
+    || existsSync(join(repoRoot, 'requirements-dev.txt'));
+  const localPythonReady = !hasPythonManifest
+    || existsSync(join(repoRoot, '.venv', 'bin', 'python'))
+    || existsSync(join(repoRoot, '.venv', 'Scripts', 'python.exe'));
+  const checkScheduling = buildCheckExecutionSchedule({
+    checks: availableChecks,
+    requestedCheckIds,
+    repoId: schedulingScope.repoId?.trim() || 'selected-repository',
+    checkoutId: schedulingScope.checkoutId?.trim() || 'active',
+  });
+  const blockers = [
+    ...(!nodeModulesReady ? [{ code: 'NODE_DEPENDENCIES_MISSING', message: 'package.json is present but node_modules is not materialized in this checkout.' }] : []),
+    ...normalizedChecks.invalidCheckIds.map((checkId) => ({ code: 'CHECK_NOT_REGISTERED', message: `Requested check is not registered: ${checkId}`, checkId })),
+  ];
+  return {
+    readyForFocusedExecution: blockers.length === 0,
+    git: { head: git.head, branch: git.branch, dirty: git.dirty },
+    checks: {
+      registeredCount: registeredCheckIds.length,
+      registeredCheckIds: registeredCheckIds.slice(0, 80),
+      requestedCheckIds: requestedCheckIds.slice(0, 40),
+      normalized: normalizedChecks,
+    },
+    checkScheduling: {
+      waveCount: checkScheduling.waves.length,
+      maxParallel: checkScheduling.maxParallel,
+      waveSummaries: checkScheduling.waves.map((wave) => `wave ${wave.wave}: ${wave.checkIds.join(', ')}`),
+      conflictSummaries: checkScheduling.conflicts.map((conflict) => {
+        const resources = [...new Set(conflict.resources.flatMap(({ left, right }) => [left.resourceKey, right.resourceKey]))];
+        return `${conflict.leftCheckId} <> ${conflict.rightCheckId}: ${resources.join(', ')}`;
+      }),
+      invalidCheckIds: checkScheduling.invalidCheckIds,
+      guidance: checkScheduling.guidance,
+    },
+    dependencies: {
+      node: {
+        applicable: hasPackageJson,
+        ready: nodeModulesReady,
+        packageManager: packageManager ?? null,
+        lockfile: detectedLock?.[1] ?? null,
+        ...(bootstrapCommand ? { bootstrapCommand } : {}),
+      },
+      python: {
+        applicable: hasPythonManifest,
+        localVirtualEnvReady: localPythonReady,
+        advisoryOnly: true,
+      },
+    },
+    blockers,
+    guidance: bootstrapCommand
+      ? [`Materialize checkout dependencies before tests/builds: ${bootstrapCommand.join(' ')}`]
+      : [],
+  };
+}
+
 export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name: string, args: Record<string, unknown>): Promise<CallToolResult | undefined> {
   try {
     switch (name) {
@@ -2970,16 +3128,167 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         if (operation === 'repair') {
           return await runFacadeRepair(ctx, repository, args);
         }
-        const readiness = await controllerReadinessEvidence(ctx, repository);
-        const liveGit = gitSnapshot(repository.canonicalRoot);
-        // Compare startup Runtime Source against the Controller package authority —
-        // never against the selected execution repository.
+        const detailLevel = args.detail_level === 'detail' ? 'detail' : 'summary';
+        if (detailLevel === 'summary') {
+          const startedAt = performance.now();
+          const observation = observeRuntimeStatus(ctx.controllerHome);
+          // Summary answers only whether this repository can work now. Reuse one
+          // porcelain-v2 sample for branch/HEAD/dirty and avoid the full Git
+          // status/diff-stat, access-policy, and inventory construction paths.
+          const repositoryIdentity = cachedGitIdentity(repository.canonicalRoot);
+          const runtimeGeneration = readRuntimeGeneration(ctx.controllerHome);
+          const runtimeSource = runtimeSourceSnapshotStatus(
+            runtimeGeneration?.source,
+            ctx.runtimeSourceRoot,
+          );
+          const sourceSnapshotStale = runtimeSource.restartRequired;
+          const toolset = await import('../../../cli/mcp/toolset');
+          const exposure = toolset.controllerToolSurfaceStatus(ctx);
+          const toolSurfaceReady = exposure.ready && exposure.missingToolNames.length === 0;
+          const ready = observation.ready && toolSurfaceReady && !sourceSnapshotStale;
+          const reasonCodes = [...observation.reasonCodes];
+          if (!toolSurfaceReady) reasonCodes.push('MCP_TOOL_SURFACE_INCOMPLETE');
+          if (sourceSnapshotStale) reasonCodes.push(runtimeSource.code === 'RUNTIME_SOURCE_SNAPSHOT_MISSING'
+            ? 'RUNTIME_SOURCE_SNAPSHOT_MISSING'
+            : runtimeSource.code === 'RUNTIME_SOURCE_CURRENT_UNAVAILABLE'
+              ? 'RUNTIME_SOURCE_CURRENT_UNAVAILABLE'
+              : 'RUNTIME_SOURCE_SNAPSHOT_STALE');
+          const runtimeReadiness = observation.snapshot?.readiness;
+          const releaseDiagnostic = runtimeReadiness?.diagnostics.releaseCoherence;
+          const activeWorkSnapshot = listWorkContracts({ ...store, status: 'active', limit: 3 }).map((entry) => ({
+            workId: entry.workId,
+            status: entry.status,
+            mode: entry.mode,
+            objective: entry.objective.slice(0, 160),
+            semantics: buildWorkContinuationSnapshot(entry).semantics,
+            nextSafeAction: buildWorkContinuationSnapshot(entry).nextSafeAction,
+          }));
+          const activePlanSnapshot = listPlanContracts({ ...store, status: 'active', limit: 3 }).map(summarizePlanContract);
+          const pendingHandoffSnapshot = listHandoffItems({ ...store, status: 'pending', limit: 4 });
+          const preferredFacadeTools = ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'] as const;
+          const facade = buildFacadeResult({
+            status: ready ? 'ok' : 'blocked',
+            summary: ready ? 'Controller and MCP tool surface are ready for bounded work.' : 'Controller or MCP tool surface needs attention before work.',
+            data: {
+              operation,
+              repoId: repository.repoId,
+              readiness: {
+                ready,
+                reasonCodes: [...new Set(reasonCodes)],
+                diagnostics: {
+                  runtime: { ready: observation.ready },
+                  runtimeReadiness: runtimeReadiness ? {
+                    observedAt: runtimeReadiness.observedAt,
+                    database: runtimeReadiness.diagnostics.database,
+                    scheduler: runtimeReadiness.diagnostics.scheduler,
+                    releaseCoherence: runtimeReadiness.diagnostics.releaseCoherence,
+                    mcpEndToEnd: runtimeReadiness.diagnostics.mcpEndToEnd,
+                  } : undefined,
+                  toolSurface: {
+                    ready: toolSurfaceReady,
+                    expectedToolCount: exposure.expectedToolNames.length,
+                    actualToolCount: exposure.actualToolNames.length,
+                    observation: 'computed',
+                    missingTools: exposure.missingToolNames,
+                    unexpectedTools: exposure.unexpectedToolNames,
+                    duplicateTools: exposure.duplicateToolNames,
+                    fingerprint: exposure.fingerprint,
+                    schemaStableAcrossAccessModes: exposure.schemaStableAcrossAccessModes,
+                  },
+                  semantics: {
+                    executionReady: observation.ready,
+                    maintenanceHealthy: null,
+                    maintenanceCandidateCount: 0,
+                    releaseReady: releaseDiagnostic?.outcome === 'pass',
+                    executionBlockers: observation.ready ? [] : observation.reasonCodes,
+                    releaseBlockers: releaseDiagnostic?.outcome === 'fail' && releaseDiagnostic.reasonCode ? [releaseDiagnostic.reasonCode] : [],
+                  },
+                  sourceCoherence: { ready: !sourceSnapshotStale, reasons: runtimeSource.reasons },
+                },
+                observedAt: observation.observedAt,
+              },
+              repositoryState: {
+                branch: repositoryIdentity.branch,
+                head: repositoryIdentity.head,
+                dirty: repositoryIdentity.dirty,
+                observedAt: new Date().toISOString(),
+                sourceSnapshotAgeMs: runtimeGeneration?.source.observedAt
+                  ? Math.max(0, Date.now() - Date.parse(runtimeGeneration.source.observedAt))
+                  : undefined,
+                sourceSnapshotStale,
+                sourceSnapshotReasons: runtimeSource.reasons,
+                runtimeSourceDirty: runtimeSource.current?.dirty === true,
+              },
+              toolArchitecture: {
+                facadeTools: [...preferredFacadeTools],
+                domainSchemaLoading: 'status_summary_runtime_snapshot',
+              },
+              toolSurface: preferredFacadeTools.filter((tool) => exposure.actualToolNames.includes(tool)),
+              toolSurfaceStatus: {
+                ready: toolSurfaceReady,
+                expectedToolCount: exposure.expectedToolNames.length,
+                actualToolCount: exposure.actualToolNames.length,
+                observation: 'computed',
+                missingTools: exposure.missingToolNames,
+                unexpectedTools: exposure.unexpectedToolNames,
+                duplicateTools: exposure.duplicateToolNames,
+                fingerprint: exposure.fingerprint,
+                schemaStableAcrossAccessModes: exposure.schemaStableAcrossAccessModes,
+              },
+              controllerSnapshot: {
+                activeWork: activeWorkSnapshot,
+                activePlans: activePlanSnapshot,
+                pendingHandoffCount: pendingHandoffSnapshot.length,
+                pendingHandoffs: pendingHandoffSnapshot.slice(0, 3).map((item) => ({
+                  id: item.id,
+                  workId: item.workId,
+                  title: item.title.slice(0, 96),
+                  severity: item.severity,
+                  updatedAt: item.updatedAt,
+                })),
+                bounded: true,
+                nextDetail: 'Use rh_context(work_id=...) or rh_work(plan_get) only when the next decision requires more detail.',
+              },
+            },
+            suggestedNextActions: [{
+              label: 'Read repository context',
+              tool: 'rh_context',
+              operation: 'get',
+              risk: 'readonly',
+              confidence: 'medium',
+            }],
+            rawAvailable: false,
+            detailLevel,
+          });
+          const payload = facade as unknown as Record<string, unknown>;
+          payload.responseMeta = {
+            serverDurationMs: Number((performance.now() - startedAt).toFixed(2)),
+            structuredPayloadBytes: 0,
+          };
+          (payload.responseMeta as { structuredPayloadBytes: number }).structuredPayloadBytes = Buffer.byteLength(JSON.stringify(payload), 'utf8');
+          return result(payload, facade.status !== 'ok');
+        }
+        const detailTimingStartedAt = performance.now();
+        let detailTimingMark = detailTimingStartedAt;
+        const detailPhaseTimingsMs: Record<string, number> = {};
+        const markDetailPhase = (phase: string): void => {
+          const now = performance.now();
+          detailPhaseTimingsMs[phase] = Number((now - detailTimingMark).toFixed(2));
+          detailTimingMark = now;
+        };
+        const readiness = await controllerReadinessEvidence(ctx, repository);
+        markDetailPhase('readiness');
+        const liveGit = gitSnapshot(repository.canonicalRoot);
+        markDetailPhase('git');
+        // Compare startup Runtime Source against the Controller package authority —
+        // never against the selected execution repository.
         const runtimeSource = runtimeSourceSnapshotStatus(readiness.daemon.source, ctx.runtimeSourceRoot);
         const sourceSnapshotStale = runtimeSource.restartRequired;
         // Dynamic import avoids a static cycle: toolset.ts composes runtimeToolDefinitions.
         const toolset = await import('../../../cli/mcp/toolset');
         const exposure = toolset.controllerExposureSnapshot(ctx);
         const localRegisteredToolNames = toolset.allControllerToolDefinitions(ctx).map((tool) => tool.name).sort();
+        markDetailPhase('tool_surface');
         const toolSurfaceReady = exposure.ready && exposure.missingToolNames.length === 0;
         // Ordinary interactive execution depends on the execution axis only.
         // Maintenance debt / durable queue debt are reported as separate
@@ -2999,6 +3308,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             maintenanceHealthy = null;
           }
         }
+        markDetailPhase('maintenance');
         const effectiveReady = executionReady && toolSurfaceReady && !sourceSnapshotStale;
         const readinessReasons = [...readiness.reasons];
         if (!toolSurfaceReady) {
@@ -3056,22 +3366,29 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           },
           observedAt: new Date().toISOString(),
         };
-        const detailLevel = args.detail_level === 'detail' ? 'detail' : 'summary';
-        // Always prefer stored plugin manifests on rh_status get. Live host probes
+        // Always prefer stored plugin manifests on rh_status detail. Live host probes
         // (Xcode/simctl, etc.) must not stall Managed MCP gateways on reconnect/status.
         const manifests = listAssistantPluginManifests(ctx.controllerHome, repository, {
           preferStored: true,
         });
         const capabilities = listCapabilityDescriptors(manifests);
+        markDetailPhase('plugins');
         const pendingHandoffs = listHandoffItems({ ...store, status: 'pending', limit: 20 });
         const activeContracts = listWorkContracts({ ...store, status: 'active', limit: 200 });
+        markDetailPhase('work_state');
         const activePrimaryWork = activeContracts.filter((contract) => (contract.lifecycleRole ?? 'primary') === 'primary');
         const activeExecutionChildren = activeContracts.filter((contract) => contract.lifecycleRole === 'execution_child');
-        const activeRuntimeInstanceId = currentControllerInstanceId();
-        const activeProcessRecords = listProcessRecords(ctx.controllerHome, repository.repoId, 500).filter((process) => isManagedProcessActive(process) && (!process.runtimeInstanceId || process.runtimeInstanceId === activeRuntimeInstanceId));
+        // Current Runtime activity is owned by the in-memory Process monitor set.
+        // Do not route an interactive status read through the retired cross-restart
+        // recovery index, which may contain historical starting/running records.
+        const activeProcessRecords = processRuntimeResourceDiagnostics().activeProcessIds
+          .map((processId) => getProcessRecord(ctx.controllerHome, repository.repoId, processId))
+          .filter((process): process is NonNullable<typeof process> => Boolean(process && isManagedProcessActive(process)));
+        markDetailPhase('process_state');
         const activeProcessWorkIds = new Set(activeProcessRecords.map((process) => process.workId).filter((workId): workId is string => Boolean(workId)));
         const activeControllerWorkIds = new Set(activePrimaryWork.filter((contract) => Boolean(getControllerSession({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId))).map((contract) => contract.workId));
         const executingPrimaryWorkIds = new Set([...activeProcessWorkIds, ...activeControllerWorkIds].filter((workId) => activePrimaryWork.some((contract) => contract.workId === workId)));
+        markDetailPhase('controller_sessions');
         const preferredFacadeTools = ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'] as const;
         const facade = buildFacadeResult({
           status: effectiveReady ? 'ok' : 'blocked',
@@ -3132,7 +3449,13 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           rawAvailable: detailLevel === 'detail',
           detailLevel,
         });
-        return result(facade as unknown as Record<string, unknown>, facade.status !== 'ok');
+        markDetailPhase('response_build');
+        const payload = facade as unknown as Record<string, unknown>;
+        payload.responseMeta = {
+          serverDurationMs: Number((performance.now() - detailTimingStartedAt).toFixed(2)),
+          phaseTimingsMs: detailPhaseTimingsMs,
+        };
+        return result(payload, facade.status !== 'ok');
       }
       case 'rh_inbox': {
         const repository = selected(ctx, args);
@@ -3234,6 +3557,8 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             });
             return result(facade as unknown as Record<string, unknown>, true);
           }
+          const legacySemanticQuery = rhContextLegacySemanticQuery(query);
+          const retrievalQuery = legacySemanticQuery.retrievalQuery;
           const list = (value: unknown): string[] => Array.isArray(value)
             ? value.map(String).map((entry) => entry.trim()).filter(Boolean)
             : [];
@@ -3247,9 +3572,27 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             : retrievalMode === 'plan' || retrievalMode === 'debug'
               ? 'required'
               : 'auto';
-          const pack = buildControllerContextPack(repository.canonicalRoot, ctx.policy, {
-            description: query,
-            searchTerms: [query],
+          const requestedCheckIds = list(args.requested_check_ids);
+          // Source retrieval is the default Context responsibility. Check
+          // readiness is only meaningful when the controller has named the
+          // checks it is about to use, so do not pay its Git/dependency/schedule
+          // preflight cost for every broad search.
+          const checks = requestedCheckIds.length > 0
+            ? listControllerChecks(repository.canonicalRoot)
+            : [];
+          const executionReadiness = requestedCheckIds.length > 0
+            ? repositoryExecutionReadiness(repository.canonicalRoot, checks, requestedCheckIds, {
+                repoId: repository.repoId,
+                checkoutId: repository.activeCheckoutId,
+              })
+            : undefined;
+          const pack = await buildControllerContextPackAsync(repository.canonicalRoot, ctx.policy, {
+            description: retrievalQuery,
+            // Short code-like queries remain useful exact lexical needles. Long
+            // semantic prompts are already tokenized from description; adding the
+            // whole prompt as an exact needle prevents batch-search early exit and
+            // forces a full bounded repository scan for a phrase that will not match.
+            searchTerms: retrievalQuery.length <= 160 ? [retrievalQuery] : undefined,
             knownPaths: list(args.known_paths),
             includeGlobs: list(args.include_globs),
             excludeGlobs: list(args.exclude_globs),
@@ -3259,7 +3602,55 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             structuralIndexRoot: structuralContext === 'off' ? undefined : structuralIndexRoot(repository),
             retrievalMode,
             impactDomains,
+            session: rhContextReadSessionId(ctx)
+              ? { sessionId: rhContextReadSessionId(ctx)!, repoId: repository.repoId, checkoutId: repository.activeCheckoutId }
+              : undefined,
           });
+          const explicitSemanticNavigation = Array.isArray(args.semantic_navigation) ? args.semantic_navigation : [];
+          const semanticRequests = [...explicitSemanticNavigation, ...legacySemanticQuery.requests];
+          const semanticNavigation = {
+            ...await rhContextSemanticNavigation(repository.canonicalRoot, ctx.policy, semanticRequests, { repoId: repository.repoId, checkoutId: repository.activeCheckoutId }),
+            requestSource: explicitSemanticNavigation.length > 0 && legacySemanticQuery.requests.length > 0
+              ? 'schema_and_query'
+              : explicitSemanticNavigation.length > 0
+                ? 'semantic_navigation'
+                : legacySemanticQuery.requests.length > 0
+                  ? 'query_compatibility'
+                  : 'none',
+            compatibilityQuerySyntax: RH_CONTEXT_LEGACY_SEMANTIC_SYNTAX,
+          };
+          const semanticReasonCodes = Array.from(new Set([
+            ...semanticNavigation.errors.map((entry) => `semantic.${String(entry.code ?? 'provider_error').toLowerCase()}`),
+            ...(semanticNavigation.requestTruncated ? ['semantic.request_truncated'] : []),
+            ...(semanticNavigation.policyDeniedLocations > 0 || semanticNavigation.policyDeniedReads > 0 ? ['semantic.policy_denied'] : []),
+            ...(semanticNavigation.freshness === 'changed_during_query' ? ['semantic.source_changed_during_query'] : []),
+            ...(semanticNavigation.requested > 0 && semanticNavigation.staticClosure.status !== 'complete_for_requested_symbols' ? ['semantic.static_closure_incomplete'] : []),
+          ]));
+          const semanticUnavailable = semanticNavigation.requested > 0
+            && semanticNavigation.results.length === 0
+            && semanticNavigation.errors.length > 0
+            && semanticNavigation.errors.every((entry) => /UNAVAILABLE|NOT_AVAILABLE|NOT_READY|MISSING|NOT_FOUND|BUILD_SETTINGS|BUILD_SERVER/i.test(String(entry.code ?? '')));
+          const semanticReadinessStatus = semanticNavigation.requested === 0
+            ? 'not_requested' as const
+            : semanticNavigation.results.length === 0 && semanticNavigation.errors.length > 0
+              ? semanticUnavailable ? 'unavailable' as const : 'error' as const
+              : semanticNavigation.staticClosure.status === 'complete_for_requested_symbols' && semanticReasonCodes.length === 0
+                ? 'ready' as const
+                : 'partial' as const;
+          const readinessStatus = pack.readiness.status === 'insufficient'
+            ? 'insufficient' as const
+            : semanticReadinessStatus === 'unavailable' || semanticReadinessStatus === 'error'
+              ? 'insufficient' as const
+              : pack.readiness.status === 'degraded' || semanticReadinessStatus === 'partial'
+                ? 'degraded' as const
+                : 'ready' as const;
+          const readiness = {
+            ...pack.readiness,
+            status: readinessStatus,
+            semantic: { status: semanticReadinessStatus, reasonCodes: semanticReasonCodes },
+            unresolvedReasonCodes: Array.from(new Set([...pack.readiness.unresolvedReasonCodes, ...semanticReasonCodes])).slice(0, 80),
+            readyForHighConfidenceMutation: readinessStatus === 'ready',
+          };
           const warnings = structuralContext === 'required' && !pack.structuralContext.requiredSatisfied
             ? [pack.structuralContext.fallbackReason ?? 'Required structural context is not ready; lexical retrieval results are returned as degraded evidence.']
             : [];
@@ -3275,16 +3666,27 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               search: pack.search,
               structuralContext: pack.structuralContext,
               impactContext: pack.impactContext,
+              semanticNavigation,
+              readiness,
+              expansion: pack.expansion,
               files: pack.files,
+              coverage: pack.coverage,
+              cache: pack.cache,
+              timingsMs: pack.timingsMs,
               deniedPaths: pack.deniedPaths,
               omitted: pack.omitted,
               limits: pack.limits,
               contextContract: pack.contextContract,
+              ...(executionReadiness ? {
+                executionReadiness,
+                registeredChecks: checks.slice(0, 80).map((check) => ({ id: check.id, description: check.description, source: check.source, effects: check.effects })),
+              } : {}),
               retrievalPolicy: {
                 defaultBackend: 'bounded_lexical',
                 structuralBackend: 'codegraph',
                 rawReadTool: 'read_repository_file',
                 shellSearchFallbackOnly: true,
+                executionReadiness: 'requested_check_ids_only',
               },
             },
             warnings,
@@ -3294,8 +3696,116 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           });
           return result(facade as unknown as Record<string, unknown>);
         }
-        const checks = listControllerChecks(repository.canonicalRoot);
+        const startedAt = performance.now();
+        const requestedCapabilityId = typeof args.capability_id === 'string' ? args.capability_id.trim() : '';
+        if (requestedCapabilityId) {
+          const pluginMatch = /^plugin\.([^.]+)\.(.+)$/.exec(requestedCapabilityId);
+          const manifests = pluginMatch ? (() => {
+            const pluginId = pluginMatch[1];
+            const targets = [repository];
+            const controllerRepository = controllerPluginRepository(ctx.controllerHome);
+            if (controllerRepository.repoId !== repository.repoId) targets.push(controllerRepository);
+            for (const target of targets) {
+              try {
+                return [getAssistantPluginManifest(ctx.controllerHome, target, pluginId)];
+              } catch (error) {
+                if (error instanceof Error && error.message.startsWith('PLUGIN_NOT_FOUND:')) continue;
+                throw error;
+              }
+            }
+            return [];
+          })() : [];
+          const descriptor = getCapabilityDescriptor(requestedCapabilityId, manifests);
+          const pluginAction = getPluginActionCapabilitySchema(requestedCapabilityId, manifests);
+          const facade = buildFacadeResult({
+            status: 'ok',
+            summary: descriptor
+              ? `Exact capability ${requestedCapabilityId} is available.`
+              : `Capability ${requestedCapabilityId} was not found.`,
+            data: {
+              operation,
+              repoId: repository.repoId,
+              repository: {
+                repoId: repository.repoId,
+                displayName: repository.displayName,
+                defaultBranch: repository.defaultBranch,
+                repositoryType: repository.repositoryType,
+              },
+              capabilityLookup: {
+                requestedCapabilityId,
+                found: Boolean(descriptor),
+                descriptor,
+                pluginAction,
+              },
+              toolArchitecture: {
+                facadeTools: ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'],
+                domainSchemaLoading: 'exact_capability_fast_path',
+              },
+              bounded: true,
+            },
+            warnings: [],
+            suggestedNextActions: [],
+            detailLevel: args.detail_level === 'detail' || args.detail_level === 'raw' ? args.detail_level : 'summary',
+            rawAvailable: false,
+          });
+          const payload = facade as unknown as Record<string, unknown>;
+          payload.responseMeta = {
+            serverDurationMs: Number((performance.now() - startedAt).toFixed(2)),
+            structuredPayloadBytes: 0,
+          };
+          (payload.responseMeta as { structuredPayloadBytes: number }).structuredPayloadBytes = Buffer.byteLength(JSON.stringify(payload), 'utf8');
+          return result(payload);
+        }
+        const capabilityIntentQuery = operation === 'list' && typeof args.query === 'string'
+          ? args.query.trim()
+          : '';
+        if (capabilityIntentQuery) {
+          const manifestOptions = { preferStored: true };
+          const repositoryManifests = listAssistantPluginManifests(ctx.controllerHome, repository, manifestOptions);
+          const controllerRepository = controllerPluginRepository(ctx.controllerHome);
+          const controllerManifests = repository.repoId === controllerRepository.repoId
+            ? []
+            : listAssistantPluginManifests(ctx.controllerHome, controllerRepository, manifestOptions);
+          const manifests = [...new Map(
+            [...repositoryManifests, ...controllerManifests].map((manifest) => [manifest.pluginId, manifest] as const),
+          ).values()];
+          const matches = searchCapabilityDescriptors(capabilityIntentQuery, manifests, 12)
+            .map((match) => ({
+              ...match,
+              pluginAction: getPluginActionCapabilitySchema(match.capabilityId, manifests),
+            }));
+          const facade = buildFacadeResult({
+            status: 'ok',
+            summary: matches.length > 0
+              ? `Found ${matches.length} capability candidate(s) for intent: ${capabilityIntentQuery}`
+              : `No capability candidates matched intent: ${capabilityIntentQuery}`,
+            data: {
+              operation,
+              repoId: repository.repoId,
+              capabilitySearch: {
+                query: capabilityIntentQuery,
+                matches,
+                readOnlyDiscovery: true,
+                executeWith: 'plugin_action_execute',
+              },
+              toolArchitecture: {
+                facadeTools: ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'],
+                domainSchemaLoading: 'intent_ranked_capability_search',
+                exactCapabilityLookupStillAvailable: true,
+              },
+              bounded: true,
+            },
+            warnings: [],
+            suggestedNextActions: [],
+            detailLevel: args.detail_level === 'detail' || args.detail_level === 'raw' ? args.detail_level : 'summary',
+            rawAvailable: false,
+          });
+          return result(facade as unknown as Record<string, unknown>);
+        }
         const requested = Array.isArray(args.requested_check_ids) ? args.requested_check_ids.map(String) : [];
+        const detailLevel = args.detail_level === 'detail' || args.detail_level === 'raw' ? args.detail_level : 'summary';
+        const isSummary = detailLevel === 'summary';
+        const checks = requested.length > 0 || !isSummary ? listControllerChecks(repository.canonicalRoot) : [];
         const normalizedChecks = normalizeCheckIds(requested, checks);
         const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
         const workId = typeof args.work_id === 'string' ? args.work_id : undefined;
@@ -3310,9 +3820,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           });
           return result(facade as unknown as Record<string, unknown>, true);
         }
-        const startedAt = performance.now();
-        const detailLevel = args.detail_level === 'detail' || args.detail_level === 'raw' ? args.detail_level : 'summary';
-        const isSummary = detailLevel === 'summary';
         const activeContractScan = operation === 'list' || !workId
           ? listWorkContracts({ ...store, status: 'active', limit: 20 })
           : [];
@@ -3326,36 +3833,29 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             .filter((job) => timestampIsCurrent(job.updatedAt, currentCutoffMs))
             .slice(0, 5)
           : [];
-        const processScan = listProcessRecords(ctx.controllerHome, repository.repoId, workId ? 100 : 50);
+        const processScan = isSummary
+          ? listRecoverableProcessRecords(ctx.controllerHome, repository.repoId)
+          : listProcessRecords(ctx.controllerHome, repository.repoId, workId ? 100 : 50);
         const relevantProcesses = processScan.filter((process) => workId ? process.workId === workId : timestampIsCurrent(process.updatedAt, currentCutoffMs));
-        const activeRuntimeInstanceId = currentControllerInstanceId();
-        const activeProcesses = relevantProcesses.filter((process) => isManagedProcessActive(process) && (!process.runtimeInstanceId || process.runtimeInstanceId === activeRuntimeInstanceId));
+        const liveProcessIds = new Set(processRuntimeResourceDiagnostics().activeProcessIds);
+        const activeProcesses = relevantProcesses.filter((process) => liveProcessIds.has(process.processId) && isManagedProcessActive(process));
         const workController = work ? getControllerSession(store, work.workId) : undefined;
-        const repositoryManifests = listAssistantPluginManifests(ctx.controllerHome, repository, {
-          preferStored: true,
-        });
-        const controllerRepository = controllerPluginRepository(ctx.controllerHome);
-        const controllerManifests = repository.repoId === controllerRepository.repoId
+        const manifestOptions = { preferStored: true };
+        const manifests = isSummary
           ? []
-          : listAssistantPluginManifests(ctx.controllerHome, controllerRepository, { preferStored: true });
-        const manifests = [...new Map(
-          [...repositoryManifests, ...controllerManifests].map((manifest) => [manifest.pluginId, manifest] as const),
-        ).values()];
-        const capabilities = listCapabilityDescriptors(manifests);
-        const capabilityGroups = summarizeCapabilityGroups(manifests);
-        const requestedCapabilityId = typeof args.capability_id === 'string' ? args.capability_id.trim() : '';
-        const selectedCapability = requestedCapabilityId
-          ? capabilities.find((descriptor) => descriptor.capabilityId === requestedCapabilityId)
-          : undefined;
-        const pluginActionSchema = requestedCapabilityId
-          ? getPluginActionCapabilitySchema(requestedCapabilityId, manifests)
-          : undefined;
-        const capabilityLookup = requestedCapabilityId ? {
-          requestedCapabilityId,
-          found: Boolean(selectedCapability),
-          descriptor: selectedCapability,
-          pluginAction: pluginActionSchema,
-        } : undefined;
+          : (() => {
+              const repositoryManifests = listAssistantPluginManifests(ctx.controllerHome, repository, manifestOptions);
+              const controllerRepository = controllerPluginRepository(ctx.controllerHome);
+              const controllerManifests = repository.repoId === controllerRepository.repoId
+                ? []
+                : listAssistantPluginManifests(ctx.controllerHome, controllerRepository, manifestOptions);
+              return [...new Map(
+                [...repositoryManifests, ...controllerManifests].map((manifest) => [manifest.pluginId, manifest] as const),
+              ).values()];
+            })();
+        const capabilities = isSummary ? [] : listCapabilityDescriptors(manifests);
+        const capabilityGroups = isSummary ? [] : summarizeCapabilityGroups(manifests);
+        const capabilityLookup = undefined;
         const selectedChecks = normalizedChecks.validCheckIds
           .map((id) => checks.find((check) => check.id === id))
           .filter((check): check is (typeof checks)[number] => Boolean(check))
@@ -3407,8 +3907,11 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           requestedCheckIds: requested,
           normalizedChecks,
           invalidCheckIdsAreNotFailures: true,
-          capabilityCount: capabilities.length,
-          capabilityGroups: capabilityGroups.map((group) => ({ group: group.group, capabilityCount: group.capabilityCount })),
+          capabilityInventory: {
+            mode: 'detail_only',
+            deferred: true,
+            reason: 'Work/repository summary does not hydrate plugin manifests; request capability_id or detail/raw only when schema/policy detail is needed.',
+          },
           capabilityLookup,
           toolArchitecture: {
             facadeTools: ['rh_access', 'rh_status', 'rh_inbox', 'rh_context', 'rh_work'],
@@ -3441,8 +3944,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           counts: {
             availableChecks: checks.length,
             selectedChecks: selectedChecks.length,
-            capabilities: capabilities.length,
-            capabilityGroups: capabilityGroups.length,
+            capabilityInventoryDeferred: true,
             activeWork: currentContractScan.length,
             activeWorkShown: activeContracts.length,
             storedNonTerminalWork: activeContractScan.length,
@@ -3452,6 +3954,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             currentAttentionShown: attention.length,
             activeProcesses: activeProcesses.length,
             recentProcesses: relevantProcesses.length,
+            historicalProcessScanDeferred: true,
             pendingAttentionScanned: pendingAttention.length,
             historicalPendingAttention: Math.max(0, pendingAttention.length - currentAttentionScan.length),
             omittedCurrentAttention: Math.max(0, currentAttentionScan.length - attention.length),
@@ -3547,14 +4050,30 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
       case 'rh_work': {
         const repository = selected(ctx, args);
         const store = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
-        const operation = String(args.operation ?? 'start');
+        const requestedOperation = String(args.operation ?? 'start');
+        const frozenScheduleDeleteId = requestedOperation === 'repair' && typeof args.capability_id === 'string' && args.capability_id.startsWith('schedule.delete:')
+          ? args.capability_id.slice('schedule.delete:'.length).trim()
+          : '';
+        let frozenControllerDisposition: ReturnType<typeof parseControllerDispositionCompatibilityCapability>;
+        try {
+          frozenControllerDisposition = parseControllerDispositionCompatibilityCapability(requestedOperation, args.capability_id);
+        } catch (error) {
+          return result(buildFacadeResult({
+            status: 'blocked',
+            summary: error instanceof Error ? error.message : 'Controller disposition compatibility input is invalid.',
+            data: {},
+          }) as unknown as Record<string, unknown>, true);
+        }
+        const operation = frozenControllerDisposition
+          ? 'controller_disposition'
+          : frozenScheduleDeleteId ? 'schedule_delete' : requestedOperation;
         if (!allowedFacadeOperations('rh_work').includes(operation)) {
           return invalidFacadeOperation('rh_work', operation);
         }
         if (operation.startsWith('schedule_')) {
           try {
             const workId = String(args.work_id ?? '').trim();
-            const scheduleId = String(args.schedule_id ?? '').trim();
+            const scheduleId = frozenScheduleDeleteId || String(args.schedule_id ?? '').trim();
             if (operation === 'schedule_create') {
               const controllerType = String(args.controller_type ?? 'chatgpt').trim();
               if (!['chatgpt', 'codex', 'claude', 'grok'].includes(controllerType)) throw new Error('CONTROLLER_TYPE_INVALID');
@@ -3562,56 +4081,8 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               const triggerType = ['interval', 'cron', 'calendar', 'condition', 'repository-event', 'dependency-checkpoint', 'manual'].includes(triggerTypeRaw)
                 ? triggerTypeRaw as 'interval' | 'cron' | 'calendar' | 'condition' | 'repository-event' | 'dependency-checkpoint' | 'manual'
                 : undefined;
-              const scheduleModeRaw = String(args.schedule_mode ?? (workId ? 'continuation' : 'workflow')).trim();
-              if (!['workflow', 'continuation', 'browser_watch', 'browser_keepalive'].includes(scheduleModeRaw)) throw new Error('SCHEDULE_MODE_INVALID');
-              if (scheduleModeRaw === 'workflow') {
-                if (controllerType !== 'chatgpt') throw new Error('WORKFLOW_SCHEDULE_CONTROLLER_TYPE_UNSUPPORTED');
-                const prompt = (typeof args.objective === 'string' ? args.objective : typeof args.continuation_prompt === 'string' ? args.continuation_prompt : '').trim();
-                if (!prompt) throw new Error('WORKFLOW_SCHEDULE_PROMPT_REQUIRED');
-                const trigger = {
-                  type: triggerType ?? (typeof args.every_minutes === 'number' ? 'interval' : 'manual'),
-                  everyMinutes: typeof args.every_minutes === 'number' ? Math.max(1, Math.trunc(args.every_minutes)) : undefined,
-                  cronExpression: typeof args.cron_expression === 'string' ? args.cron_expression : undefined,
-                  timezone: typeof args.schedule_timezone === 'string' ? args.schedule_timezone : undefined,
-                  catchUpMinutes: typeof args.catch_up_minutes === 'number' ? Math.max(0, Math.trunc(args.catch_up_minutes)) : undefined,
-                  calendarAt: typeof args.calendar_at === 'string' ? args.calendar_at : undefined,
-                  condition: args.condition && typeof args.condition === 'object' && !Array.isArray(args.condition) ? args.condition as never : undefined,
-                  eventName: typeof args.event_name === 'string' ? args.event_name : undefined,
-                  dependencyJobIds: Array.isArray(args.dependency_job_ids) ? args.dependency_job_ids.map(String) : undefined,
-                };
-                const policy = {
-                  maxActiveOccurrences: 1,
-                  maxFailures: typeof args.max_failures === 'number' ? Math.max(1, Math.trunc(args.max_failures)) : 3,
-                  cooldownMinutes: typeof args.cooldown_minutes === 'number' ? Math.max(0, Math.trunc(args.cooldown_minutes)) : 120,
-                  dailyBudgetMinutes: typeof args.daily_budget_minutes === 'number' ? Math.max(1, Math.trunc(args.daily_budget_minutes)) : 180,
-                  shadowMode: args.shadow_mode !== false,
-                  backoffBaseMinutes: typeof args.backoff_base_minutes === 'number' ? Math.max(1, Math.trunc(args.backoff_base_minutes)) : 5,
-                  backoffMaxMinutes: typeof args.backoff_max_minutes === 'number' ? Math.max(1, Math.trunc(args.backoff_max_minutes)) : 24 * 60,
-                };
-                const actionArguments = {
-                  prompt,
-                  ...(typeof args.browser_session_id === 'string' && args.browser_session_id.trim() ? { browser_session_id: args.browser_session_id.trim() } : {}),
-                  ...(typeof args.conversation_url === 'string' && args.conversation_url.trim() ? { conversation_url: args.conversation_url.trim() } : {}),
-                };
-                assertAutomatedOperationAllowed('chatgpt_browser_prompt', actionArguments);
-                const name = typeof args.schedule_name === 'string' && args.schedule_name.trim() ? args.schedule_name.trim() : `Workflow: ${prompt.slice(0, 80)}`;
-                const stopConditions = Array.isArray(args.stop_conditions) ? args.stop_conditions.map(String) : [];
-                const semantic = JSON.stringify({ repoId: repository.repoId, name, trigger, policy, actionArguments, stopConditions });
-                const requestId = typeof args.schedule_request_id === 'string' && args.schedule_request_id.trim()
-                  ? args.schedule_request_id.trim()
-                  : `workflow-schedule:${repository.repoId}:${createHash('sha256').update(semantic).digest('hex').slice(0, 20)}`;
-                const schedule = createSchedule(ctx.controllerHome, {
-                  requestId,
-                  repoId: repository.repoId,
-                  name,
-                  enabled: true,
-                  trigger,
-                  policy,
-                  action: { operation: 'chatgpt_browser_prompt', target: 'runtime', arguments: actionArguments, resourceClaims: [] },
-                  stopConditions,
-                });
-                return result(buildFacadeResult({ summary: `Workflow schedule ${schedule.scheduleId} is configured without a durable Work.`, data: { schedule } }) as unknown as Record<string, unknown>);
-              }
+              const scheduleModeRaw = String(args.schedule_mode ?? (workId ? 'continuation' : '')).trim();
+              if (!['continuation', 'browser_watch', 'browser_keepalive'].includes(scheduleModeRaw)) throw new Error('SCHEDULE_MODE_REQUIRES_WORK_OR_EXPLICIT_BROWSER_KEEPALIVE');
               const created = createWorkContinuationSchedule(ctx.controllerHome, repository.repoId, {
                 workId,
                 scheduleMode: scheduleModeRaw as 'continuation' | 'browser_watch' | 'browser_keepalive',
@@ -3654,38 +4125,53 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
                 backoffMaxMinutes: typeof args.backoff_max_minutes === 'number' ? args.backoff_max_minutes : undefined,
                 stopConditions: Array.isArray(args.stop_conditions) ? args.stop_conditions.map(String) : undefined,
               });
-              return result(buildFacadeResult({ summary: `Work schedule ${created.schedule.scheduleId} is configured for Work ${workId}.`, data: { schedule: created.schedule, work: buildWorkContinuationSnapshot(created.work) } }) as unknown as Record<string, unknown>);
+              return result(buildFacadeResult({
+                summary: created.work
+                  ? `Work schedule ${created.schedule.scheduleId} is configured for Work ${created.work.workId}.`
+                  : `Browser keepalive schedule ${created.schedule.scheduleId} is configured without a durable Work.`,
+                data: {
+                  schedule: created.schedule,
+                  ...(created.work ? { work: buildWorkContinuationSnapshot(created.work) } : {}),
+                },
+              }) as unknown as Record<string, unknown>);
             }
             if (operation === 'schedule_list') {
-              const schedules = listSchedules(ctx.controllerHome, repository.repoId)
-                .filter((entry) => !workId || entry.action.arguments?.work_id === workId);
-              const data = args.include_occurrences === true
-                ? { schedules, occurrences: listOccurrences(ctx.controllerHome, repository.repoId, undefined, 100).filter((entry) => schedules.some((schedule) => schedule.scheduleId === entry.scheduleId)) }
-                : { schedules };
-              return result(buildFacadeResult({ summary: `Found ${schedules.length} schedule(s).`, data }) as unknown as Record<string, unknown>);
+              const schedules = listWorkContinuationSchedules(ctx.controllerHome, repository.repoId, {
+                workId: workId || undefined,
+                includeOccurrences: args.include_occurrences === true,
+              });
+              const data = args.include_occurrences === true ? schedules : { schedules: schedules.schedules };
+              return result(buildFacadeResult({ summary: `Found ${schedules.schedules.length} schedule(s).`, data }) as unknown as Record<string, unknown>);
             }
             if (!scheduleId) throw new Error('SCHEDULE_ID_REQUIRED');
             if (operation === 'schedule_get') {
-              const schedule = getSchedule(ctx.controllerHome, repository.repoId, scheduleId);
-              const data = args.include_occurrences === true ? { schedule, occurrences: listOccurrences(ctx.controllerHome, repository.repoId, scheduleId, 50) } : { schedule };
+              const data = getWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId, args.include_occurrences === true);
               return result(buildFacadeResult({ summary: `Schedule ${scheduleId}.`, data }) as unknown as Record<string, unknown>);
             }
             if (operation === 'schedule_pause') {
-              const schedule = getSchedule(ctx.controllerHome, repository.repoId, scheduleId);
-              const saved = saveSchedule(ctx.controllerHome, { ...schedule, enabled: false, pausedReason: typeof args.reason === 'string' && args.reason.trim() ? args.reason.trim() : 'Paused by ChatGPT.' });
+              const saved = pauseWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId, typeof args.reason === 'string' ? args.reason : undefined);
               return result(buildFacadeResult({ summary: `Schedule ${scheduleId} is paused.`, data: { schedule: saved } }) as unknown as Record<string, unknown>);
             }
             if (operation === 'schedule_resume') {
-              const schedule = getSchedule(ctx.controllerHome, repository.repoId, scheduleId);
-              const saved = saveSchedule(ctx.controllerHome, { ...schedule, enabled: true, pausedReason: undefined, consecutiveFailures: 0, nextEligibleAt: undefined });
+              const saved = resumeWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId);
               return result(buildFacadeResult({ summary: `Schedule ${scheduleId} is resumed.`, data: { schedule: saved } }) as unknown as Record<string, unknown>);
             }
+            if (operation === 'schedule_delete') {
+              const schedule = getWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId).schedule;
+              deleteSchedule(ctx.controllerHome, repository.repoId, scheduleId);
+              return result(buildFacadeResult({
+                summary: `Schedule ${scheduleId} is deleted; historical occurrences and evidence are retained.`,
+                data: { scheduleId, deleted: true, requestId: schedule.requestId },
+              }) as unknown as Record<string, unknown>);
+            }
             if (operation === 'schedule_trigger') {
-              const schedule = getSchedule(ctx.controllerHome, repository.repoId, scheduleId);
-              const occurrence = await evaluateSchedule(ctx.controllerHome, schedule, true, {
-                source: typeof args.event_name === 'string' && args.event_name.trim() ? 'repository-event' : 'manual',
+              const repositoryEvent = typeof args.event_name === 'string' && args.event_name.trim().length > 0;
+              const explicitEventId = typeof args.event_id === 'string' ? args.event_id.trim() : '';
+              const manualRequestId = !repositoryEvent && typeof args.request_id === 'string' ? args.request_id.trim() : '';
+              const occurrence = await triggerWorkContinuationSchedule(ctx.controllerHome, repository.repoId, scheduleId, {
+                source: repositoryEvent ? 'repository-event' : 'manual',
                 eventName: typeof args.event_name === 'string' ? args.event_name : undefined,
-                eventId: typeof args.event_id === 'string' ? args.event_id : undefined,
+                eventId: explicitEventId || manualRequestId || undefined,
                 data: args.event_data && typeof args.event_data === 'object' && !Array.isArray(args.event_data) ? args.event_data as Record<string, unknown> : undefined,
               });
               return result(buildFacadeResult({ summary: occurrence ? `Schedule ${scheduleId} produced ${occurrence.decision}.` : `Schedule ${scheduleId} produced no occurrence.`, data: { occurrence } }) as unknown as Record<string, unknown>);
@@ -3731,25 +4217,210 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               permissionSnapshotVersion,
               lastValidatedAt: new Date().toISOString(),
             });
-            return result(buildFacadeResult({ summary: `Controller ${session.controllerId} claimed ${session.workId}.`, data: { session } }) as unknown as Record<string, unknown>);
+            const relay = acknowledgeControllerRoundClaim(
+              { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+              { workId, session },
+            );
+            return result(buildFacadeResult({
+              summary: relay?.status === 'claimed'
+                ? `Controller ${session.controllerId} claimed ${session.workId}; the dispatched ChatGPT round is mechanically acknowledged and still requires an explicit semantic disposition.`
+                : `Controller ${session.controllerId} claimed ${session.workId}.`,
+              data: { session, relay },
+            }) as unknown as Record<string, unknown>);
           } catch (error) {
             return result(buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Controller claim failed.', data: {} }) as unknown as Record<string, unknown>, true);
           }
         }
+        if (operation === 'controller_disposition') {
+          try {
+            const workId = String(args.work_id ?? '').trim();
+            const disposition = frozenControllerDisposition?.disposition ?? String(args.disposition ?? '').trim();
+            if (!['continue_immediately', 'wait', 'wait_for_user', 'goal_complete'].includes(disposition)) {
+              throw new Error('CONTROLLER_RELAY_DISPOSITION_INVALID');
+            }
+            const identity = authenticatedFacadeControllerIdentity(ctx, args);
+            const work = getWorkContract(store, workId);
+            if (!work) throw new Error(`WORK_NOT_FOUND: ${workId}`);
+            const terminalGoalComplete = work.status === 'completed' && disposition === 'goal_complete';
+            const currentOwner = getControllerSession(store, workId);
+            if (!currentOwner && !terminalGoalComplete) {
+              if (work.status === 'failed' || work.status === 'cancelled' || work.status === 'completed') {
+                throw new Error(`CONTROLLER_RELAY_WORK_TERMINAL: ${work.status}`);
+              }
+              throw new Error(`CONTROLLER_RELAY_ACTIVE_CLAIM_REQUIRED: ${workId}`);
+            }
+            if (currentOwner) {
+              if (currentOwner.controllerType !== 'chatgpt') throw new Error(`CONTROLLER_RELAY_CHATGPT_ONLY: ${workId}`);
+              if (currentOwner.controllerId !== identity.controllerId) throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workId}`);
+              if ((currentOwner.principalId?.trim() || currentOwner.controllerId) !== identity.principalId) {
+                throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workId}`);
+              }
+              // Finalization may terminalize the Work before the prompt-required
+              // goal_complete disposition is submitted. A frozen MCP client may also
+              // rotate transport sessions between those two calls. Never resume or
+              // rewrite a terminal Work lease here; terminal authorization is fenced
+              // by the already-claimed relay lineage in submitControllerRoundDisposition.
+              if (!terminalGoalComplete) {
+                if (!currentOwner.controllerInstanceId?.trim() || currentOwner.controllerInstanceId.trim() !== identity.controllerInstanceId) {
+                  throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workId}`);
+                }
+                if (currentOwner.sessionId !== identity.sessionId) {
+                  resumeControllerSession(store, {
+                    workId,
+                    controllerId: identity.controllerId,
+                    controllerType: 'chatgpt',
+                    sessionId: identity.sessionId,
+                    principalId: identity.principalId,
+                    controllerInstanceId: identity.controllerInstanceId,
+                    expectedClaimGeneration: currentOwner.claimGeneration,
+                    leaseMs: 3_600_000,
+                  });
+                }
+              }
+            }
+            const chatgptBinding = getChatgptWorkConversationBinding(store, workId);
+            const relay = submitControllerRoundDisposition({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, {
+              workId,
+              identity,
+              disposition: disposition as ControllerRoundDisposition,
+              relayScopeId: frozenControllerDisposition?.relayScopeId ?? (typeof args.relay_scope_id === 'string' ? args.relay_scope_id : undefined),
+              requirementId: typeof args.requirement_id === 'string' ? args.requirement_id : undefined,
+              handoffId: typeof args.handoff_id === 'string' ? args.handoff_id : undefined,
+              stateFingerprint: typeof args.state_fingerprint === 'string' ? args.state_fingerprint : undefined,
+              reason: typeof args.reason === 'string' ? args.reason : undefined,
+              browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : chatgptBinding?.latestBrowserSessionId,
+              conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : chatgptBinding?.conversationUrl,
+              maxRounds: typeof args.max_rounds === 'number' ? args.max_rounds : undefined,
+              maxRepeatedState: typeof args.max_repeated_state === 'number' ? args.max_repeated_state : undefined,
+              maxFailures: typeof args.max_failures === 'number' ? args.max_failures : undefined,
+            });
+            return result(buildFacadeResult({
+              status: relay.status === 'blocked' ? 'blocked' : 'ok',
+              summary: relay.status === 'pending_release'
+                ? `Controller disposition ${relay.disposition} recorded; relay will dispatch only after the current lease is released.`
+                : `Controller disposition ${relay.disposition} recorded with status ${relay.status}.`,
+              data: { relay },
+            }) as unknown as Record<string, unknown>, relay.status === 'blocked');
+          } catch (error) {
+            return result(buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Controller disposition failed.', data: {} }) as unknown as Record<string, unknown>, true);
+          }
+        }
         if (operation === 'controller_release') {
           try {
             const workId = String(args.work_id ?? '').trim();
             const identity = authenticatedFacadeControllerIdentity(ctx, args);
             const owner = getControllerSession(store, workId);
-            if (owner && owner.controllerId !== identity.controllerId) {
-              throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workId} is owned by ${owner.controllerId}`);
+            if (owner) {
+              const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
+              const ownerInstanceId = owner.controllerInstanceId?.trim() || '';
+              if (owner.controllerId !== identity.controllerId) {
+                throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workId} is owned by ${owner.controllerId}`);
+              }
+              if (ownerPrincipal !== identity.principalId) {
+                throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workId}`);
+              }
+              if (!ownerInstanceId || ownerInstanceId !== identity.controllerInstanceId) {
+                throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workId}`);
+              }
+              if (typeof owner.claimGeneration !== 'number' || owner.claimGeneration < 1) {
+                throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workId}`);
+              }
+              const released = releaseControllerSessionWithAuthority(store, {
+                workId,
+                actor: `controller-release:${identity.controllerId}:${identity.controllerInstanceId}`,
+                authority: {
+                  controllerId: owner.controllerId,
+                  controllerType: owner.controllerType,
+                  principalId: ownerPrincipal,
+                  controllerInstanceId: ownerInstanceId,
+                  claimGeneration: owner.claimGeneration,
+                },
+              });
+              if (!released.allowed) {
+                throw new Error(`WORK_CONTROLLER_RELEASE_FENCED: ${workId}:${released.reason}`);
+              }
             }
-            releaseControllerSession(store, workId, identity.controllerId);
             const executionSession = readExecutionSession(ctx.controllerHome, identity);
             if (executionSession?.activeWorkId === workId) {
               updateExecutionSession(ctx.controllerHome, identity, { activeWorkId: undefined, lastValidatedAt: new Date().toISOString() });
             }
-            return result(buildFacadeResult({ summary: 'Controller lease released.', data: {} }) as unknown as Record<string, unknown>);
+            const relayStore = { controllerHome: ctx.controllerHome, repoId: repository.repoId };
+            const relay = owner ? beginControllerRoundRelayAfterRelease(
+              relayStore,
+              { workId, releasedSession: owner },
+            ) : undefined;
+            if (relay?.status === 'dispatching') {
+              try {
+                assertAutomatedOperationAllowed('external_controller_wake', {
+                  controller_type: 'chatgpt',
+                  relay_scope_id: relay.relayScopeId,
+                  requirement_id: relay.requirementId,
+                });
+                const prompt = buildControllerRoundRelayPrompt(relayStore, relay);
+                const dispatched = await runWorkChatgptContinuation({
+                  controllerHome: ctx.controllerHome,
+                  repoId: repository.repoId,
+                  repoRoot: repository.canonicalRoot,
+                  workId,
+                  prompt,
+                  browserSessionId: relay.browserSessionId,
+                  conversationUrl: relay.conversationUrl,
+                  tabPolicy: 'reuse',
+                });
+                if (dispatched.status === 'failed') throw new Error(dispatched.error?.message ?? 'CONTROLLER_RELAY_DISPATCH_FAILED');
+                // The next prompt is externally committed before this transition is
+                // recorded. Contiguous immediate rounds intentionally retain one
+                // Forge-owned tab, avoiding a close/reopen race and duplicate prompt.
+                recordControllerRoundTabSettlement(relayStore, {
+                  workId,
+                  status: 'retained_for_immediate_continuation',
+                });
+                const completed = finishControllerRoundRelayDispatch(
+                  relayStore,
+                  { workId, ok: true, browserSessionId: dispatched.browserSessionId, conversationUrl: dispatched.conversationUrl },
+                );
+                return result(buildFacadeResult({
+                  summary: `Controller lease released and immediate relay ${relay.relayScopeId} dispatched through the canonical ChatGPT launcher.`,
+                  data: { relay: completed, dispatch: dispatched },
+                }) as unknown as Record<string, unknown>);
+              } catch (relayError) {
+                const failed = finishControllerRoundRelayDispatch(
+                  relayStore,
+                  { workId, ok: false, error: relayError instanceof Error ? relayError.message : String(relayError) },
+                );
+                return result(buildFacadeResult({
+                  status: 'blocked',
+                  summary: `Controller lease released, but immediate relay dispatch failed: ${relayError instanceof Error ? relayError.message : String(relayError)}`,
+                  data: { relay: failed },
+                }) as unknown as Record<string, unknown>, true);
+              }
+            }
+            const settledRelay = getControllerRoundRelay(relayStore, workId);
+            let tabSettlement;
+            if (
+              owner?.controllerType === 'chatgpt'
+              && settledRelay
+              && ['waiting', 'waiting_for_user', 'goal_complete', 'blocked', 'failed'].includes(settledRelay.status)
+            ) {
+              const binding = getChatgptWorkConversationBinding(store, workId);
+              const browserSessionId = settledRelay.browserSessionId ?? binding?.latestBrowserSessionId;
+              if (browserSessionId) {
+                tabSettlement = await settleWorkChatgptAutomationTab({
+                  controllerHome: ctx.controllerHome,
+                  workId,
+                  browserSessionId,
+                });
+                recordControllerRoundTabSettlement(relayStore, {
+                  workId,
+                  status: tabSettlement.status,
+                  error: tabSettlement.error?.message,
+                });
+              }
+            }
+            return result(buildFacadeResult({
+              summary: 'Controller lease released.',
+              data: { relay: getControllerRoundRelay(relayStore, workId) ?? relay, tabSettlement },
+            }) as unknown as Record<string, unknown>);
           } catch (error) {
             return result(buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Controller release failed.', data: {} }) as unknown as Record<string, unknown>, true);
           }
@@ -3758,11 +4429,101 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           try {
             const controllerType = String(args.controller_type ?? 'codex');
             if (!['chatgpt', 'codex', 'grok', 'claude'].includes(controllerType)) throw new Error('CONTROLLER_TYPE_INVALID');
-            const launched = launchSuperController({ work: store, handoff: store }, {
-              controllerType: controllerType as 'chatgpt' | 'codex' | 'grok' | 'claude',
+            const workId = String(args.work_id ?? '').trim();
+            const launchArgs = Array.isArray(args.launch_args) ? args.launch_args.map(String) : [];
+            if (controllerType === 'chatgpt') {
+              const work = getWorkContract(store, workId);
+              if (!work) throw new Error(`WORK_NOT_FOUND: ${workId}`);
+              const handoffId = typeof args.handoff_id === 'string' ? args.handoff_id.trim() : '';
+              const handoff = handoffId ? getHandoffItem(store, handoffId) : undefined;
+              const valueForFlag = (flag: string): string | undefined => {
+                const index = launchArgs.indexOf(flag);
+                if (index < 0) return undefined;
+                const value = launchArgs[index + 1];
+                if (!value || value.startsWith('--')) throw new Error(`CHATGPT_LAUNCH_ARG_VALUE_REQUIRED: ${flag}`);
+                return value;
+              };
+              const supportedFlags = new Set(['--model', '--reasoning', '--tab-policy', '--timeout-ms']);
+              for (let index = 0; index < launchArgs.length; index += 2) {
+                const flag = launchArgs[index];
+                if (!flag || !supportedFlags.has(flag)) throw new Error(`CHATGPT_LAUNCH_ARG_UNSUPPORTED: ${flag ?? ''}`);
+                if (!launchArgs[index + 1] || launchArgs[index + 1]!.startsWith('--')) throw new Error(`CHATGPT_LAUNCH_ARG_VALUE_REQUIRED: ${flag}`);
+              }
+              const reasoning = valueForFlag('--reasoning') ?? 'high';
+              if (!['medium', 'high', 'xhigh'].includes(reasoning)) throw new Error(`CHATGPT_LAUNCH_REASONING_INVALID: ${reasoning}`);
+              const tabPolicy = valueForFlag('--tab-policy') ?? 'auto';
+              if (!['auto', 'reuse', 'new'].includes(tabPolicy)) throw new Error(`CHATGPT_LAUNCH_TAB_POLICY_INVALID: ${tabPolicy}`);
+              const timeoutValue = valueForFlag('--timeout-ms');
+              const timeoutMs = timeoutValue === undefined ? undefined : Number(timeoutValue);
+              if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) throw new Error(`CHATGPT_LAUNCH_TIMEOUT_INVALID: ${timeoutValue}`);
+              const continuationPrompt = typeof args.continuation_prompt === 'string' ? args.continuation_prompt.trim() : '';
+              const relay = beginInitialControllerRoundDispatch(
+                { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+                {
+                  workId,
+                  identity: authenticatedFacadeControllerIdentity(ctx, args),
+                  requirementId: work.requirementId,
+                  browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
+                  conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
+                },
+              );
+              if (relay.status === 'blocked') {
+                throw new Error(`CONTROLLER_RELAY_LAUNCH_BLOCKED: ${relay.blockedReason ?? relay.relayScopeId}`);
+              }
+              const prompt = [
+                `Continue Forge Work ${work.workId} in repo ${work.repoId}.`,
+                `Objective: ${work.objective}`,
+                `Acceptance: ${work.acceptanceCriteria.join('; ') || 'none declared'}`,
+                `Current status: ${work.status}`,
+                `Controller round: ${relay.relayScopeId}. launcher_start opened this durable round; dispatch success is not semantic completion.`,
+                handoff ? `Handoff: ${handoff.summary}\nNext: ${handoff.recommendedContinuationPrompt ?? handoff.recommendedPrompt}` : '',
+                continuationPrompt ? `Continuation: ${continuationPrompt}` : '',
+                'Treat Forge Work/Plan/evidence as source of truth. Claim the exact Work before any mutation; if ownership cannot be established, do not mutate.',
+                `Before this ChatGPT round ends, submit exactly one rh_work controller_disposition for Work ${work.workId} and relay_scope_id=${relay.relayScopeId}: continue_immediately, wait, wait_for_user (with an active Handoff), or goal_complete. If this client schema is frozen and omits controller_disposition, use rh_work operation=repair with capability_id=controller.disposition:<disposition>:${relay.relayScopeId}; it is mapped to the same canonical disposition path. Ending the response without a disposition does not close the round and may trigger bounded mechanical recovery.`,
+              ].filter(Boolean).join('\n');
+              let dispatched: Awaited<ReturnType<typeof runWorkChatgptContinuation>>;
+              try {
+                dispatched = await runWorkChatgptContinuation({
+                  controllerHome: ctx.controllerHome,
+                  repoId: repository.repoId,
+                  repoRoot: repository.canonicalRoot,
+                  workId,
+                  prompt,
+                  browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
+                  conversationUrl: typeof args.conversation_url === 'string' ? args.conversation_url : undefined,
+                  model: valueForFlag('--model') ?? 'gpt-5.6',
+                  reasoning: reasoning as 'medium' | 'high' | 'xhigh',
+                  tabPolicy: tabPolicy as 'auto' | 'reuse' | 'new',
+                  timeoutMs,
+                });
+                if (dispatched.status === 'failed') throw new Error(dispatched.error?.message ?? 'CHATGPT_WORK_CONTINUATION_FAILED');
+              } catch (launchError) {
+                finishControllerRoundRelayDispatch(
+                  { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+                  { workId, ok: false, error: launchError instanceof Error ? launchError.message : String(launchError) },
+                );
+                throw launchError;
+              }
+              const completedRelay = finishControllerRoundRelayDispatch(
+                { controllerHome: ctx.controllerHome, repoId: repository.repoId },
+                { workId, ok: true, browserSessionId: dispatched.browserSessionId, conversationUrl: dispatched.conversationUrl },
+              );
+              return result(buildFacadeResult({
+                summary: 'ChatGPT continuation dispatched; wake completion remains pending until the new ChatGPT Controller claims the Work, and semantic closure still requires an explicit disposition.',
+                data: {
+                  workId,
+                  relay: completedRelay,
+                  browserSessionId: dispatched.browserSessionId,
+                  conversationUrl: dispatched.conversationUrl,
+                  executionPreferenceVerified: dispatched.executionPreferenceVerified,
+                },
+              }) as unknown as Record<string, unknown>);
+            }
+            const launched = await launchSuperController({ work: store, handoff: store }, {
+              controllerType: controllerType as 'codex' | 'grok' | 'claude',
               executable: typeof args.executable === 'string' && args.executable.trim() ? args.executable.trim() : undefined,
-              args: Array.isArray(args.launch_args) ? args.launch_args.map(String) : [],
-              workId: String(args.work_id ?? '').trim(),
+              args: launchArgs,
+              workId,
               launchReservationMs: typeof args.launch_reservation_ms === 'number' ? args.launch_reservation_ms : typeof args.lease_ms === 'number' ? args.lease_ms : undefined,
               handoffId: typeof args.handoff_id === 'string' ? args.handoff_id : undefined,
               browserSessionId: typeof args.browser_session_id === 'string' ? args.browser_session_id : undefined,
@@ -3770,11 +4531,27 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               continuationPrompt: typeof args.continuation_prompt === 'string' ? args.continuation_prompt : undefined,
               cwd: repository.canonicalRoot,
             });
-            return result(buildFacadeResult({ summary: `Thin Launcher started ${launched.controllerType}.`, data: { pid: launched.pid, executable: launched.executable, workId: String(args.work_id ?? ''), reservationId: launched.reservationId } }) as unknown as Record<string, unknown>);
+            return result(buildFacadeResult({ summary: `Thin Launcher started ${launched.controllerType}.`, data: { pid: launched.pid, executable: launched.executable, workId, reservationId: launched.reservationId } }) as unknown as Record<string, unknown>);
           } catch (error) {
             return result(buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Launcher failed.', data: {} }) as unknown as Record<string, unknown>, true);
           }
         }
+        if (operation === 'plan_list') {
+          const plans = listPlanContracts({ ...store, status: 'active', limit: typeof args.limit === 'number' ? args.limit : 20 });
+          const facade = buildFacadeResult({
+            summary: `${plans.length} active PlanContract(s) in this repository.`,
+            data: { plans: plans.map(summarizePlanContract), bounded: true },
+          });
+          return result(facade as unknown as Record<string, unknown>);
+        }
+        if (operation === 'plan_get') {
+          const plan = getPlanContract(store, String(args.plan_id ?? ''));
+          const facade = plan
+            ? buildFacadeResult({ summary: `PlanContract ${plan.planId} retrieved.`, data: { plan: args.detail_level === 'detail' ? plan : summarizePlanContract(plan) }, detailLevel: args.detail_level === 'detail' ? 'detail' : 'summary' })
+            : buildFacadeResult({ status: 'not_found', summary: `PlanContract ${String(args.plan_id ?? '')} not found.`, data: { planId: String(args.plan_id ?? '') } });
+          return result(facade as unknown as Record<string, unknown>, !plan);
+        }
+
         const checks = listControllerChecks(repository.canonicalRoot);
         const workloopCtx = {
           workStore: store,
@@ -3786,82 +4563,173 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           controllerInstanceId: ctx.controllerInstanceId,
           availableChecks: checks,
           sourceRevision: gitSnapshot(repository.canonicalRoot).head ?? undefined,
-          materializeIsolatedWorkspace: ({ workId, title, baseRef }: { workId: string; title: string; baseRef?: string }) => {
-            const workspace = ensureManagedWorkspace(ctx.controllerHome, repository, { requestId: workId, title, baseRef });
+          materializeIsolatedWorkspace: ({ workId, title, baseRef, needsDependencies }: { workId: string; title: string; baseRef?: string; needsDependencies?: boolean }) => {
+            const workspace = ensureManagedWorkspace(ctx.controllerHome, repository, {
+              requestId: workId,
+              title,
+              baseRef,
+              prepareDependencies: needsDependencies === true,
+            });
             if (!workspace.managed || !workspace.checkoutId || !workspace.root) throw new Error('MANAGED_WORKSPACE_NOT_MATERIALIZED');
             return { checkoutId: workspace.checkoutId, root: workspace.root, baseRevision: workspace.baseRevision, managed: true as const };
           },
         };
 
+        if (operation === 'requirement_create') {
+          const requirementId = typeof args.requirement_id === 'string' ? args.requirement_id.trim() : '';
+          const title = typeof args.requirement_title === 'string' ? args.requirement_title.trim().slice(0, 500) : '';
+          const outcomeStatement = typeof args.requirement_outcome === 'string' ? args.requirement_outcome.trim().slice(0, 2_000) : '';
+          const acceptanceCriteria = Array.isArray(args.requirement_acceptance_criteria)
+            ? args.requirement_acceptance_criteria.map((value) => String(value).trim()).filter(Boolean).slice(0, 50).map((value) => value.slice(0, 500))
+            : [];
+          const requiredDeliveryReferences = Array.isArray(args.requirement_delivery_references)
+            ? args.requirement_delivery_references.map((value) => String(value).trim()).filter(Boolean).slice(0, 50).map((value) => value.slice(0, 500))
+            : [];
+          const legacyAliases = Array.isArray(args.requirement_legacy_aliases)
+            ? args.requirement_legacy_aliases.map((value) => String(value).trim()).filter(Boolean).slice(0, 20).map((value) => value.slice(0, 160))
+            : [];
+          if (!requirementId || !title || !outcomeStatement) {
+            return result(buildFacadeResult({
+              status: 'blocked',
+              summary: 'REQUIREMENT_CREATE_INPUT_REQUIRED: requirement_id, requirement_title, and requirement_outcome are required.',
+              data: { requirementCreated: false },
+            }) as unknown as Record<string, unknown>, true);
+          }
+          const existing = readRequirement({ controllerHome: ctx.controllerHome }, requirementId)?.value;
+          if (existing) {
+            const identical = existing.title === title
+              && existing.outcomeStatement === outcomeStatement
+              && JSON.stringify(existing.acceptanceCriteria) === JSON.stringify(acceptanceCriteria)
+              && JSON.stringify(existing.requiredDeliveryReferences) === JSON.stringify(requiredDeliveryReferences)
+              && JSON.stringify(existing.legacyAliases) === JSON.stringify(legacyAliases);
+            if (!identical) {
+              return result(buildFacadeResult({
+                status: 'blocked',
+                summary: `REQUIREMENT_ALREADY_EXISTS_CONFLICT: ${requirementId}. Existing Requirement authority was not changed.`,
+                data: { requirement: existing, requirementCreated: false, admissionDecision: 'existing_conflict' },
+                suggestedNextActions: [],
+              }) as unknown as Record<string, unknown>, true);
+            }
+            return result(buildFacadeResult({
+              summary: `REQUIREMENT_AUTHORITY_REUSED: ${requirementId}. Requirement authority does not imply a Plan; Controller chooses the next action.`,
+              data: { requirement: existing, requirementCreated: false, admissionDecision: 'reuse_existing' },
+              suggestedNextActions: [],
+            }) as unknown as Record<string, unknown>);
+          }
+          const requirement = createRequirement({ controllerHome: ctx.controllerHome }, {
+            requirementId,
+            title,
+            outcomeStatement,
+            acceptanceCriteria,
+            requiredDeliveryReferences,
+            legacyAliases,
+          });
+          return result(buildFacadeResult({
+            summary: `Requirement ${requirementId} created. Requirement authority does not imply a Plan; Controller chooses the next action.`,
+            data: { requirement, requirementCreated: true, admissionDecision: 'created' },
+            suggestedNextActions: [],
+          }) as unknown as Record<string, unknown>);
+        }
+
         if (operation.startsWith('plan_')) {
           try {
             if (operation === 'plan_create') {
               const rawSteps = Array.isArray(args.plan_steps) ? args.plan_steps : [];
               const requestedRequirementId = typeof args.requirement_id === 'string' && args.requirement_id.trim() ? args.requirement_id.trim() : undefined;
-              const requestedScopeKey = String(args.scope_key ?? '').trim().toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 160);
-              const activePlans = listPlanContracts({ ...store, status: 'active', limit: 100 });
-              const exactScopeAuthority = requestedScopeKey
-                ? activePlans.find((candidate) => candidate.scopeKey === requestedScopeKey)
-                : undefined;
-              if (exactScopeAuthority) {
-                const facade = buildFacadeResult({
-                  summary: `PLAN_AUTHORITY_REUSED: active Plan ${exactScopeAuthority.planId} already owns scope ${requestedScopeKey}; no duplicate draft was created.`,
-                  data: {
-                    plan: summarizePlanContract(exactScopeAuthority),
-                    executionStarted: false,
-                    planContractCreated: false,
-                    admissionDecision: 'reuse_existing',
-                    resolutionRequired: false,
-                  },
-                  suggestedNextActions: [{ label: 'Read active Plan', tool: 'rh_work', operation: 'plan_get', payload: { plan_id: exactScopeAuthority.planId }, risk: 'readonly', confidence: 'high' }],
-                });
-                return result(facade as unknown as Record<string, unknown>);
-              }
-              const requirementPlans = requestedRequirementId
-                ? activePlans.filter((candidate) => candidate.requirementId === requestedRequirementId)
-                : [];
-              const requestedPlanRelation = args.plan_relation === 'extend' || args.plan_relation === 'parallel'
+              const requestedPlanRelation: 'extend' | 'parallel' | undefined = args.plan_relation === 'extend' || args.plan_relation === 'parallel'
                 ? args.plan_relation
                 : undefined;
               const relatedPlanId = typeof args.related_plan_id === 'string' && args.related_plan_id.trim() ? args.related_plan_id.trim() : undefined;
-              const relatedPlan = relatedPlanId
-                ? requirementPlans.find((candidate) => candidate.planId === relatedPlanId)
-                : requirementPlans.length === 1 ? requirementPlans[0] : undefined;
-              if (requirementPlans.length > 0 && !requestedPlanRelation) {
+              if (requestedRequirementId && !readRequirement({ controllerHome: ctx.controllerHome }, requestedRequirementId)) {
                 const facade = buildFacadeResult({
-                  summary: `PLAN_RELATION_RESOLUTION_REQUIRED: Requirement ${requestedRequirementId} already has ${requirementPlans.length} active Plan slice(s). Decide whether this scope extends one of them or is an intentional parallel slice before creating a draft.`,
-                  data: {
-                    executionStarted: false,
-                    planContractCreated: false,
-                    admissionDecision: 'resolution_required',
-                    resolutionRequired: true,
-                    candidates: requirementPlans.slice(0, 8).map(summarizePlanContract),
-                    allowedPlanRelations: ['extend', 'parallel'],
-                  },
-                  suggestedNextActions: requirementPlans.slice(0, 3).map((candidate) => ({ label: `Read ${candidate.planId}`, tool: 'rh_work', operation: 'plan_get', payload: { plan_id: candidate.planId }, risk: 'readonly' as const, confidence: 'high' as const })),
+                  status: 'failed',
+                  summary: `PLAN_REQUIREMENT_NOT_FOUND: ${requestedRequirementId}. Plan was not persisted; create or reconcile the Requirement authority first.`,
+                  data: { executionStarted: false, planContractCreated: false, admissionDecision: 'missing_requirement', requirementId: requestedRequirementId },
                 });
-                return result(facade as unknown as Record<string, unknown>);
+                return result(facade as unknown as Record<string, unknown>, true);
               }
-              if (requirementPlans.length > 0 && requestedPlanRelation === 'extend') {
-                if (!relatedPlan) {
+              const admissionInput = {
+                requirementId: requestedRequirementId,
+                scopeKey: String(args.scope_key ?? ''),
+                planRelation: requestedPlanRelation,
+                relatedPlanId,
+              };
+              const renderPlanAdmission = (admission: ReturnType<typeof resolvePlanAdmission>): CallToolResult | undefined => {
+                if (admission.admissionDecision === 'create_new') return undefined;
+                if (admission.reason === 'exact_scope_authority' && admission.plan) {
+                  const facade = buildFacadeResult({
+                    summary: `PLAN_AUTHORITY_REUSED: active Plan ${admission.plan.planId} already owns scope ${admission.normalizedScopeKey}; no duplicate draft was created.`,
+                    data: {
+                      plan: summarizePlanContract(admission.plan),
+                      executionStarted: false,
+                      planContractCreated: false,
+                      admissionDecision: 'reuse_existing',
+                      resolutionRequired: false,
+                    },
+                    suggestedNextActions: [{ label: 'Read active Plan', tool: 'rh_work', operation: 'plan_get', payload: { plan_id: admission.plan.planId }, risk: 'readonly', confidence: 'high' }],
+                  });
+                  return result(facade as unknown as Record<string, unknown>);
+                }
+                if (admission.reason === 'requirement_relation_required') {
+                  const facade = buildFacadeResult({
+                    summary: `PLAN_RELATION_RESOLUTION_REQUIRED: Requirement ${requestedRequirementId} already has ${admission.candidates.length} active Plan slice(s). Decide whether this scope extends one of them or is an intentional parallel slice before creating a draft.`,
+                    data: {
+                      executionStarted: false,
+                      planContractCreated: false,
+                      admissionDecision: 'resolution_required',
+                      resolutionRequired: true,
+                      candidates: admission.candidates.map(summarizePlanContract),
+                      allowedPlanRelations: admission.allowedPlanRelations ?? ['extend', 'parallel'],
+                    },
+                    suggestedNextActions: admission.candidates.slice(0, 3).map((candidate) => ({ label: `Read ${candidate.planId}`, tool: 'rh_work', operation: 'plan_get', payload: { plan_id: candidate.planId }, risk: 'readonly' as const, confidence: 'high' as const })),
+                  });
+                  return result(facade as unknown as Record<string, unknown>);
+                }
+                if (admission.reason === 'extension_target_required') {
                   const facade = buildFacadeResult({
                     summary: `PLAN_EXTENSION_TARGET_REQUIRED: select related_plan_id from the active Plan slices for Requirement ${requestedRequirementId}.`,
-                    data: { executionStarted: false, planContractCreated: false, admissionDecision: 'resolution_required', resolutionRequired: true, candidates: requirementPlans.slice(0, 8).map(summarizePlanContract) },
+                    data: { executionStarted: false, planContractCreated: false, admissionDecision: 'resolution_required', resolutionRequired: true, candidates: admission.candidates.map(summarizePlanContract) },
                   });
                   return result(facade as unknown as Record<string, unknown>);
                 }
+                if (admission.reason === 'extend_existing' && admission.plan) {
+                  // plan_create + plan_relation=extend is the atomic serial-replan
+                  // path. Admission continues under the same lock so successor
+                  // creation and predecessor supersession are persisted together.
+                  return undefined;
+                }
+                throw new Error(`PLAN_ADMISSION_RESULT_INVALID: ${admission.admissionDecision}:${admission.reason}`);
+              };
+              const activePlans = listPlanContracts({ ...store, status: 'active', limit: 100 });
+              const preflightAdmission = resolvePlanAdmission(activePlans, admissionInput);
+              const preflightResult = renderPlanAdmission(preflightAdmission);
+              if (preflightResult) return preflightResult;
+              const requestedPlanCheckIds = rawSteps
+                .filter((step): step is Record<string, unknown> => Boolean(step) && typeof step === 'object' && !Array.isArray(step))
+                .flatMap((step) => Array.isArray(step.check_ids) ? step.check_ids.map(String) : []);
+              const normalizedPlanChecks = normalizeCheckIds(requestedPlanCheckIds, checks);
+              if (normalizedPlanChecks.invalidCheckIds.length > 0) {
                 const facade = buildFacadeResult({
-                  summary: `PLAN_EXTENSION_REQUIRES_REPLAN: ${relatedPlan.planId} remains the serial authority. Extend/replan and supersede that authority rather than creating a second active Plan draft.`,
-                  data: { plan: summarizePlanContract(relatedPlan), executionStarted: false, planContractCreated: false, admissionDecision: 'extend_existing', resolutionRequired: false },
-                  suggestedNextActions: [{ label: 'Read active Plan', tool: 'rh_work', operation: 'plan_get', payload: { plan_id: relatedPlan.planId }, risk: 'readonly', confidence: 'high' }],
+                  status: 'failed',
+                  summary: `PLAN_CHECKS_INVALID: ${normalizedPlanChecks.invalidCheckIds.join(', ')}. Plan was not persisted; select replacement IDs from registeredCheckIds in this response, then request readiness only for the checks you choose.`,
+                  data: {
+                    executionStarted: false,
+                    planContractCreated: false,
+                    admissionDecision: 'invalid_checks',
+                    normalizedChecks: normalizedPlanChecks,
+                    registeredCheckIds: checks.map((check) => check.id).slice(0, 80),
+                  },
+                  suggestedNextActions: [],
                 });
-                return result(facade as unknown as Record<string, unknown>);
+                return result(facade as unknown as Record<string, unknown>, true);
               }
-              const plan = createPlanContract(store, {
+              const admitted = await admitPlanContractAsync(store, {
                 planId: String(args.plan_id ?? ''),
                 repoId: repository.repoId,
                 requirementId: requestedRequirementId,
                 scopeKey: String(args.scope_key ?? ''),
+                planRelation: requestedPlanRelation,
+                relatedPlanId,
                 sourceRevision: String(args.source_revision ?? ''),
                 goal: String(args.objective ?? ''),
                 nonGoals: Array.isArray(args.non_goals) ? args.non_goals.map(String) : undefined,
@@ -3881,33 +4749,43 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
                   acceptanceCriteria: Array.isArray(step.acceptance_criteria) ? step.acceptance_criteria.map(String) : [],
                 })),
               });
+              const racedAdmissionResult = renderPlanAdmission(admitted);
+              if (racedAdmissionResult) return racedAdmissionResult;
+              if (!admitted.plan) throw new Error('PLAN_ADMISSION_CREATE_MISSING_PLAN');
+              const plan = admitted.plan;
               const facade = buildFacadeResult({
-                summary: `PlanContract ${plan.planId} created as draft after authority preflight; no execution was started.`,
+                summary: `PlanContract ${plan.planId} created as draft after atomic authority admission; no execution was started.`,
                 data: { plan: summarizePlanContract(plan), executionStarted: false, planContractCreated: true, admissionDecision: 'create_new' },
                 suggestedNextActions: [{ label: 'Approve reviewed plan', tool: 'rh_work', operation: 'plan_approve', payload: { plan_id: plan.planId }, risk: 'workspace_write', confidence: 'medium' }],
               });
               return result(facade as unknown as Record<string, unknown>);
             }
-            if (operation === 'plan_list') {
-              const plans = listPlanContracts({ ...store, status: 'active', limit: typeof args.limit === 'number' ? args.limit : 20 });
+            if (operation === 'plan_approve') {
+              const plan = await approvePlanContractAsync(store, String(args.plan_id ?? ''));
               const facade = buildFacadeResult({
-                summary: `${plans.length} active PlanContract(s) in this repository.`,
-                data: { plans: plans.map(summarizePlanContract), bounded: true },
+                summary: `PlanContract ${plan.planId} approved at source revision ${plan.sourceRevision}; execution remains explicit.`,
+                data: { plan: summarizePlanContract(plan), executionStarted: false },
               });
               return result(facade as unknown as Record<string, unknown>);
             }
-            if (operation === 'plan_get') {
-              const plan = getPlanContract(store, String(args.plan_id ?? ''));
-              const facade = plan
-                ? buildFacadeResult({ summary: `PlanContract ${plan.planId} retrieved.`, data: { plan: args.detail_level === 'detail' ? plan : summarizePlanContract(plan) }, detailLevel: args.detail_level === 'detail' ? 'detail' : 'summary' })
-                : buildFacadeResult({ status: 'not_found', summary: `PlanContract ${String(args.plan_id ?? '')} not found.`, data: { planId: String(args.plan_id ?? '') } });
-              return result(facade as unknown as Record<string, unknown>, !plan);
-            }
-            if (operation === 'plan_approve') {
-              const plan = approvePlanContract(store, String(args.plan_id ?? ''));
+            if (operation === 'plan_accept_step') {
+              const identity = authenticatedFacadeControllerIdentity(ctx, args);
+              const planId = String(args.plan_id ?? '').trim();
+              const stepId = String(args.plan_step_id ?? '').trim();
+              const rationale = String(args.acceptance_rationale ?? '').trim();
+              const plan = acceptPlanStepEvidence(store, {
+                planId,
+                stepId,
+                reviewer: identity.principalId,
+                rationale,
+                acceptedSourceRevision: workloopCtx.sourceRevision,
+              });
               const facade = buildFacadeResult({
-                summary: `PlanContract ${plan.planId} approved at source revision ${plan.sourceRevision}; execution remains explicit.`,
-                data: { plan: summarizePlanContract(plan), executionStarted: false },
+                summary: `Plan step ${stepId} semantically accepted by the current Controller.`,
+                data: { plan: summarizePlanContract(plan), semanticAcceptanceRecorded: true, reviewer: identity.principalId },
+                suggestedNextActions: plan.status === 'finalized'
+                  ? []
+                  : [{ label: 'Continue the next approved Plan step', tool: 'rh_work', operation: 'plan_get', payload: { plan_id: plan.planId }, risk: 'readonly', confidence: 'high' }],
               });
               return result(facade as unknown as Record<string, unknown>);
             }
@@ -3949,7 +4827,69 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         }
 
         if (operation === 'stop') {
-          const facade = runGoalWorkloop({ ...workloopCtx, sourceRevision: workloopCtx.sourceRevision ?? undefined }, 'stop', args);
+          const workId = String(args.work_id ?? '').trim();
+          const currentOwner = workId ? getControllerSession(store, workId) : undefined;
+          let terminalizationAuthority: ControllerTerminalizationAuthority | undefined;
+          if (currentOwner) {
+            try {
+              const identity = authenticatedFacadeControllerIdentity(ctx, args);
+              const ownerPrincipal = currentOwner.principalId?.trim() || currentOwner.controllerId;
+              const ownerInstanceId = currentOwner.controllerInstanceId?.trim() || '';
+              if (currentOwner.controllerId !== identity.controllerId || ownerPrincipal !== identity.principalId) {
+                throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workId}`);
+              }
+              if (!ownerInstanceId || ownerInstanceId !== identity.controllerInstanceId) {
+                throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workId}`);
+              }
+              if (typeof currentOwner.claimGeneration !== 'number' || currentOwner.claimGeneration < 1) {
+                throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workId}`);
+              }
+              terminalizationAuthority = {
+                controllerId: currentOwner.controllerId,
+                controllerType: currentOwner.controllerType,
+                principalId: ownerPrincipal,
+                controllerInstanceId: ownerInstanceId,
+                claimGeneration: currentOwner.claimGeneration,
+              };
+            } catch (error) {
+              const blocked = buildFacadeResult({
+                status: 'blocked',
+                summary: error instanceof Error ? error.message : `Work ${workId} terminalization authority check failed.`,
+                data: { workId, terminalizationApplied: false },
+              });
+              return result(blocked as unknown as Record<string, unknown>, true);
+            }
+          } else if (!['user', 'system'].includes(String(args.requested_by ?? ''))) {
+            const blocked = buildFacadeResult({
+              status: 'blocked',
+              summary: `WORK_CONTROLLER_OWNER_REQUIRED: ${workId}; unclaimed stop requires explicit requested_by=user or requested_by=system authority.`,
+              data: { workId, terminalizationApplied: false },
+            });
+            return result(blocked as unknown as Record<string, unknown>, true);
+          }
+
+          const fenced = withControllerSessionTerminalizationFence(
+            store,
+            {
+              workId,
+              actor: `rh-work-stop:${terminalizationAuthority?.controllerId ?? String(args.requested_by ?? 'explicit')}`,
+              authority: terminalizationAuthority,
+            },
+            () => runGoalWorkloop({ ...workloopCtx, sourceRevision: workloopCtx.sourceRevision ?? undefined }, 'stop', args),
+          );
+          if (!fenced.allowed) {
+            const blocked = buildFacadeResult({
+              status: 'blocked',
+              summary: `WORK_TERMINALIZATION_AUTHORITY_FENCED: ${workId}:${fenced.reason}`,
+              data: {
+                workId,
+                terminalizationApplied: false,
+                currentClaimGeneration: fenced.owner?.claimGeneration,
+              },
+            });
+            return result(blocked as unknown as Record<string, unknown>, true);
+          }
+          const facade = fenced.value;
           if (facade.status !== 'ok') {
             return result(facade as unknown as Record<string, unknown>, true);
           }
@@ -3958,20 +4898,25 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             if (!physical) return result(facade as unknown as Record<string, unknown>);
             const cleanup = contextRecord(physical.structuredContent);
             const cleanupCompleted = cleanup.cleanupCompleted === true || contextRecord(cleanup.work).state === 'cleaned';
+            const cleanupRetained = cleanup.cleanupRetained === true;
+            const cleanupSettled = cleanupCompleted || cleanupRetained;
             const response = {
               ...facade,
-              status: cleanupCompleted ? 'ok' : 'blocked',
+              status: cleanupSettled ? 'ok' : 'blocked',
               summary: cleanupCompleted
                 ? `${facade.summary} Managed worktree and branch cleanup completed automatically.`
-                : `${facade.summary} Automatic managed-resource cleanup is incomplete and remains visible for retry.`,
+                : cleanupRetained
+                  ? `${facade.summary} Managed worktree and branch retention was recorded durably; automatic cleanup is disabled for this terminal Work.`
+                  : `${facade.summary} Automatic managed-resource cleanup is incomplete and remains visible for retry.`,
               data: {
                 ...(facade.data && typeof facade.data === 'object' ? facade.data : {}),
                 worktreeDeleted: cleanupCompleted,
-                cleanupPending: !cleanupCompleted,
+                cleanupPending: !cleanupSettled,
+                cleanupRetained,
                 lifecycleCleanup: cleanup,
               },
             };
-            return result(response as unknown as Record<string, unknown>, !cleanupCompleted || physical.isError === true);
+            return result(response as unknown as Record<string, unknown>, !cleanupSettled || physical.isError === true);
           } catch (error) {
             const response = {
               ...facade,
@@ -3989,6 +4934,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
 
         if (operation === 'finalize') {
           const workId = String(args.work_id ?? '').trim();
+          if (workId) reconcileTerminalFacadeWorkVerifications(ctx, repository, workId);
           let before = workId ? getWorkContract(store, workId) : undefined;
           if (before && !before.completionReceipt && args.reconcile_historical_delivery === true) {
             try {
@@ -3998,7 +4944,13 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
                 throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_CONTROLLER_CLAIM_REQUIRED: ${workId}`);
               }
               const historicalHandle = readWorkHandle(ctx.controllerHome, repository.repoId, workId);
-              if (historicalHandle?.managedWorktree) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_MANAGED_CLEANUP_REQUIRED: ${workId}`);
+              if (historicalHandle?.managedWorktree) {
+                const managedCleanupComplete = historicalHandle.finalization.merge === 'done'
+                  && historicalHandle.finalization.branchCleanup === 'done'
+                  && historicalHandle.finalization.worktreeCleanup === 'done'
+                  && !existsSync(historicalHandle.worktreePath);
+                if (!managedCleanupComplete) throw new Error(`DIRECT_EDIT_WORK_RECONCILIATION_MANAGED_CLEANUP_REQUIRED: ${workId}`);
+              }
               const reconciliation = acceptReviewedDirectEditWorkReconciliation({
                 controllerHome: ctx.controllerHome,
                 repoId: repository.repoId,
@@ -4013,7 +4965,9 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
                 cleanupOwnershipProof: String(args.reconcile_cleanup_proof ?? ''),
               });
               if (historicalHandle && historicalHandle.state !== 'cleaned') {
-                const finalization: WorkHandleState['finalization'] = { validation: 'done', commit: 'done', merge: 'skipped', branchCleanup: 'skipped', worktreeCleanup: 'skipped' };
+                const finalization: WorkHandleState['finalization'] = historicalHandle.managedWorktree
+                  ? historicalHandle.finalization
+                  : { validation: 'done', commit: 'done', merge: 'skipped', branchCleanup: 'skipped', worktreeCleanup: 'skipped' };
                 const delivered = historicalHandle.state === 'committed' || historicalHandle.state === 'merged' || historicalHandle.state === 'failed_terminal_cleanup'
                   ? historicalHandle
                   : transitionWorkHandle(ctx.controllerHome, historicalHandle, 'committed', { expectedHead: reconciliation.receipt.targetRevision, finalization, failureReason: undefined });
@@ -4026,7 +4980,33 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               return result(blocked as unknown as Record<string, unknown>, true);
             }
           }
-          if (before && !before.completionReceipt) {
+          // Legacy callers could classify repository mutation + Git remote delivery
+          // as remote_effect. A physical WorkHandle proves this is repository delivery,
+          // so keep it on work_finalize instead of demanding a plugin action receipt.
+          // Pure plugin remote effects have no repository WorkHandle and retain the
+          // action-receipt finalization contract.
+          const repositoryDeliveryHandle = workId
+            ? readWorkHandle(ctx.controllerHome, repository.repoId, workId)
+            : undefined;
+          if (before?.workKind === 'remote_effect' && !before.completionReceipt && !repositoryDeliveryHandle) {
+            try {
+              before = finalizeRemoteEffectWorkFromActionReceipt(ctx.controllerHome, repository.repoId, workId);
+            } catch (error) {
+              const blocked = buildFacadeResult({
+                status: 'blocked',
+                summary: error instanceof Error ? error.message : 'Remote-effect semantic finalization failed.',
+                data: { workId, lifecycleClosed: false },
+              });
+              return result(blocked as unknown as Record<string, unknown>, true);
+            }
+          }
+          const completedCleanupPending = Boolean(
+            before?.completionReceipt
+            && args.cleanup !== false
+            && before.worktreeRef?.trim()
+            && existsSync(before.worktreeRef),
+          );
+          if (before && before.workKind !== 'local_effect' && (!before.completionReceipt || completedCleanupPending)) {
             try {
               const physical = await finalizeFacadeWorkHandle(ctx, repository, args, 'finalize');
               if (physical?.isError === true) return physical;
@@ -4041,8 +5021,66 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               return result(blocked as unknown as Record<string, unknown>, true);
             }
           }
-          const facade = runGoalWorkloop({ ...workloopCtx, sourceRevision: workloopCtx.sourceRevision ?? undefined }, 'finalize', args);
+          const semanticWork = getWorkContract(store, workId);
+          let facade;
+          if (semanticWork && !['completed', 'failed', 'cancelled'].includes(semanticWork.status)) {
+            try {
+              const identity = authenticatedFacadeControllerIdentity(ctx, args);
+              let owner = getControllerSession(store, workId);
+              if (!owner) {
+                owner = claimControllerSession(store, {
+                  workId,
+                  controllerId: identity.controllerId,
+                  controllerType: identity.controllerType,
+                  sessionId: identity.sessionId,
+                  principalId: identity.principalId,
+                  controllerInstanceId: identity.controllerInstanceId,
+                  expectedClaimGeneration: 0,
+                  leaseMs: 3_600_000,
+                });
+              }
+              const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
+              const ownerInstanceId = owner.controllerInstanceId?.trim() || '';
+              if (owner.controllerId !== identity.controllerId) throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workId}`);
+              if (ownerPrincipal !== identity.principalId) throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workId}`);
+              if (!ownerInstanceId || ownerInstanceId !== identity.controllerInstanceId) throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workId}`);
+              if (typeof owner.claimGeneration !== 'number' || owner.claimGeneration < 1) throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workId}`);
+              const fenced = withControllerSessionTerminalizationFence(
+                store,
+                {
+                  workId,
+                  actor: `rh-work-finalize:${identity.controllerId}:${identity.controllerInstanceId}`,
+                  authority: {
+                    controllerId: owner.controllerId,
+                    controllerType: owner.controllerType,
+                    principalId: ownerPrincipal,
+                    controllerInstanceId: ownerInstanceId,
+                    claimGeneration: owner.claimGeneration,
+                  },
+                },
+                () => runGoalWorkloop({ ...workloopCtx, sourceRevision: workloopCtx.sourceRevision ?? undefined }, 'finalize', args),
+              );
+              if (!fenced.allowed) {
+                throw new Error(`WORK_TERMINALIZATION_AUTHORITY_FENCED: ${workId}:${fenced.reason}`);
+              }
+              facade = fenced.value;
+            } catch (error) {
+              const blocked = buildFacadeResult({
+                status: 'blocked',
+                summary: error instanceof Error ? error.message : `Work ${workId} semantic finalization authority check failed.`,
+                data: { workId, terminalizationApplied: false, lifecycleClosed: false },
+              });
+              return result(blocked as unknown as Record<string, unknown>, true);
+            }
+          } else {
+            facade = runGoalWorkloop({ ...workloopCtx, sourceRevision: workloopCtx.sourceRevision ?? undefined }, 'finalize', args);
+          }
           const completed = getWorkContract(store, workId);
+          // Finalizing a Work proves the Work lifecycle only. A Plan step may aggregate
+          // acceptance criteria that are broader than this Work (for example, a canary
+          // plus a later stabilization soak), so finalize must never synthesize semantic
+          // Plan acceptance. Only the explicit plan_accept_step operation may promote a
+          // validating step to completed after the Controller reviews all criteria.
           const lifecycleClosed = Boolean(completed?.completionReceipt)
             && (!readWorkHandle(ctx.controllerHome, repository.repoId, workId)
               || readWorkHandle(ctx.controllerHome, repository.repoId, workId)?.finalization.worktreeCleanup !== 'pending');
@@ -4057,13 +5095,23 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         }
 
         let resumedControllerSession: ReturnType<typeof resumeControllerSession> | undefined;
+        let cancelledWorkReauthorized = false;
+        let reconstructedCancelledCheckout = false;
+        let continuationSourceRevision = workloopCtx.sourceRevision;
+        let continuationWorkspaceFingerprint: string | undefined;
+        let continuationWorkspaceChangedPaths: string[] | undefined;
         if (operation === 'continue') {
           try {
             const workId = String(args.work_id ?? '').trim();
-            const work = getWorkContract(store, workId);
+            let work = getWorkContract(store, workId);
+            if (work?.status === 'cancelled') {
+              const resumed = reauthorizeCancelledFacadeWork(ctx, repository, workId, args);
+              cancelledWorkReauthorized = true;
+              reconstructedCancelledCheckout = resumed.reconstructedCheckout;
+              work = getWorkContract(store, workId);
+            }
             if (work && !['cancelled', 'completed', 'failed'].includes(work.status)) {
               const identity = authenticatedFacadeControllerIdentity(ctx, args);
-              const currentOwner = getControllerSession(store, workId);
               resumedControllerSession = resumeControllerSession(store, {
                 workId,
                 controllerId: identity.controllerId,
@@ -4073,6 +5121,23 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
                 controllerInstanceId: identity.controllerInstanceId,
                 leaseMs: 3_600_000,
               });
+              const existingHandle = readWorkHandle(ctx.controllerHome, repository.repoId, workId);
+              if (existingHandle && (existingHandle.principalId !== identity.principalId || existingHandle.sessionId !== identity.sessionId)) {
+                writeWorkHandle(ctx.controllerHome, {
+                  ...existingHandle,
+                  principalId: identity.principalId,
+                  sessionId: identity.sessionId,
+                });
+              }
+              if (work.worktreePolicy.required === true && !work.worktreeRef) {
+                materializeFacadeWorkPlacement(ctx, repository, workId, args);
+              }
+            }
+            if (workId) {
+              const reconciled = reconcileTerminalFacadeWorkVerifications(ctx, repository, workId);
+              continuationSourceRevision = reconciled.sourceRevision ?? continuationSourceRevision;
+              continuationWorkspaceFingerprint = reconciled.workspaceFingerprint ?? continuationWorkspaceFingerprint;
+              continuationWorkspaceChangedPaths = reconciled.workspaceChangedPaths ?? continuationWorkspaceChangedPaths;
             }
           } catch (error) {
             const facade = buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'Controller resume failed.', data: { operation, executionStarted: false, ownershipResumed: false } });
@@ -4080,11 +5145,30 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           }
         }
 
-        const facade = runGoalWorkloop({ ...workloopCtx, sourceRevision: workloopCtx.sourceRevision ?? undefined }, operation as 'start' | 'continue', args);
+        const semanticAdmissionRequired = operation === 'start' && Boolean(
+          (typeof args.plan_id === 'string' && args.plan_id.trim())
+          || (typeof args.plan_step_id === 'string' && args.plan_step_id.trim())
+          || (typeof args.requirement_id === 'string' && args.requirement_id.trim())
+          || (typeof args.related_work_id === 'string' && args.related_work_id.trim())
+          || (typeof args.work_relation === 'string' && args.work_relation.trim()),
+        );
+        const startContext = {
+          ...workloopCtx,
+          sourceRevision: continuationSourceRevision ?? undefined,
+          workspaceFingerprint: continuationWorkspaceFingerprint,
+          workspaceChangedPaths: continuationWorkspaceChangedPaths,
+          semanticAdmissionLocked: semanticAdmissionRequired,
+        };
+        const facade = semanticAdmissionRequired
+          ? await withPrimaryWorkAdmissionLockAsync(store, () => runGoalWorkloop(startContext, 'start', args))
+          : runGoalWorkloop(startContext, operation as 'start' | 'continue', args);
         const facadeData = facade.data && typeof facade.data === 'object' ? facade.data as Record<string, unknown> : {};
         const facadeWorkId = contextText(contextRecord(facadeData.work).workId, 200);
         if (facade.status === 'ok' && facadeWorkId) {
           try {
+            if (facadeData.workContractCreated === true) {
+              materializeFacadeWorkPlacement(ctx, repository, facadeWorkId, args);
+            }
             const handle = ensureFacadeWorkHandle(ctx, repository, facadeWorkId, args);
             if (handle) facadeData.executionHandle = { workId: handle.workId, checkoutId: handle.checkoutId, managedWorktree: handle.managedWorktree, state: handle.state };
             if (facadeData.workContractCreated === true) {
@@ -4093,112 +5177,33 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               facadeData.ownershipClaimed = true;
             }
           } catch (error) {
-            const blocked = buildFacadeResult({ status: 'blocked', summary: `WORK_HANDLE_MATERIALIZATION_FAILED: ${error instanceof Error ? error.message : String(error)}`, data: { ...facadeData, workId: facadeWorkId, executionStarted: false } });
+            const blocked = buildFacadeResult({ status: 'blocked', summary: `WORK_HANDLE_MATERIALIZATION_FAILED: ${error instanceof Error ? error.message : String(error)}`, data: { ...facadeData, workId: facadeWorkId, executionStarted: false, canonicalWorkRetained: true } });
             return result(blocked as unknown as Record<string, unknown>, true);
           }
         }
         const response = resumedControllerSession
           ? {
               ...facade,
-              summary: `Controller ownership resumed for ${resumedControllerSession.workId}. ${facade.summary}`,
+              ...(cancelledWorkReauthorized
+                ? {
+                    status: 'ok' as const,
+                    summary: `Explicit current-user reauthorization resumed ${resumedControllerSession.workId}; implementation may continue on the exact Work identity.`,
+                  }
+                : { summary: `Controller ownership resumed for ${resumedControllerSession.workId}. ${facade.summary}` }),
               data: {
                 ...facadeData,
                 ownershipResumed: true,
                 controllerSession: resumedControllerSession,
+                ...(cancelledWorkReauthorized ? {
+                  cancelledWorkReauthorized: true,
+                  reconstructedCancelledCheckout,
+                  nextStep: 'execute',
+                } : {}),
               },
             }
           : facade;
         return result(response as unknown as Record<string, unknown>, response.status === 'blocked' || response.status === 'failed' || response.status === 'not_found');
       }
-      case 'work_submit': {
-        const operationArgs = args.arguments && typeof args.arguments === 'object' && !Array.isArray(args.arguments)
-          ? { ...(args.arguments as Record<string, unknown>) }
-          : {};
-        const requestedCheckoutId = typeof operationArgs.checkout_id === 'string' && operationArgs.checkout_id.trim()
-          ? operationArgs.checkout_id.trim()
-          : undefined;
-        const repository = selected(ctx, requestedCheckoutId ? { ...args, checkout_id: requestedCheckoutId } : args);
-        const requestId = String(args.request_id ?? '').trim();
-        const operation = String(args.operation ?? '').trim();
-        if (!requestId) throw new Error('INVALID_ARGUMENT: work_submit is missing required argument(s): request_id');
-        if (!operation) throw new Error('INVALID_ARGUMENT: work_submit is missing required argument(s): operation');
-        if (operation.startsWith('work_')) {
-          throw new Error('WORK_OPERATION_INVALID: choose an existing durable controller operation');
-        }
-        if (RETIRED_AGENT_OPERATIONS.has(operation)) {
-          throw new Error('AGENT_RUN_RETIRED: Kernel-managed Agent Runs are retired. Accept a WorkContract and launch an external SuperController instead.');
-        }
-        const definition = getMcpToolDefinition(ctx, operation);
-        if (!definition) {
-          throw new Error(`WORK_OPERATION_INVALID: ${operation} is unknown or not eligible for durable execution`);
-        }
-
-        const isRepositoryTool = operation.startsWith('repository_');
-        const workerArgs = schemaAwareWorkSubmitArguments(
-          operation,
-          operationArgs,
-          repository,
-          definition,
-          args.timeout_ms,
-        );
-        // Validate the target operation before any WorkContract / index write.
-        validateMcpToolArguments(operation, injectDurableCommandFields(definition), workerArgs);
-        delete workerArgs.request_id;
-        delete workerArgs.apply_mode;
-        delete workerArgs.wait;
-        delete workerArgs.wait_ms;
-        delete workerArgs.await_result;
-        delete workerArgs.wait_for_result;
-
-        const existingRequest = getWorkContractByRequestId(ctx.controllerHome, requestId);
-        if (existingRequest && existingRequest.repoId !== repository.repoId) {
-          throw new Error(`REQUEST_ID_REPO_CONFLICT: ${requestId} already belongs to repository ${existingRequest.repoId}`);
-        }
-
-        const argumentHash = hashMcpToolArguments(workerArgs);
-        const semanticKey = `${isRepositoryTool ? 'repository-tool' : 'mcp-tool'}:${operation}:${repository.repoId}:${argumentHash}`;
-        const claims = claimsForMcpOperation(operation, workerArgs, repository.repoId, repository.activeCheckoutId);
-        const operationMetadata = operationMetadataForTool(
-          operation,
-          definition,
-          claims,
-          typeof args.timeout_ms === 'number' ? args.timeout_ms : 30_000,
-          workerArgs,
-          repository.defaultBranch,
-        );
-
-        const accepted = acceptSubmittedWorkContract(ctx.controllerHome, {
-          requestId,
-          repoId: repository.repoId,
-          parentWorkId: typeof args.parent_work_id === 'string' && args.parent_work_id.trim() ? args.parent_work_id.trim() : undefined,
-          semanticKey,
-          operation: {
-            name: operation,
-            semanticKey,
-            argumentHash,
-            mode: operationMetadata.mode,
-            idempotent: operationMetadata.idempotent,
-            replayable: operationMetadata.replayable,
-            resourceClaims: operationMetadata.resourceClaims.map((claim) => ({
-              resourceKey: claim.resourceKey,
-              mode: claim.mode,
-              ...(claim.quantity !== undefined ? { quantity: claim.quantity } : {}),
-            })),
-          },
-          objective: `Accepted operation ${operation}`,
-          mode: 'direct_control',
-        });
-
-        const work = summarizeSubmittedWorkContract(accepted.contract);
-        return result({
-          accepted: true,
-          deduplicated: accepted.deduplicated,
-          operation,
-          nextAction: work.nextAction,
-          work,
-          workContract: accepted.contract,
-        });
-      }
       case 'work_get': {
         const repository = selected(ctx, args);
         const workId = typeof args.work_id === 'string' ? args.work_id.trim() : '';
@@ -4318,9 +5323,9 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         const job = resolveWorkJob(ctx, repository.repoId, args);
         if (!job) {
           const processRef = String(args.work_id ?? args.request_id ?? '').trim();
-          const process = getProcessHandle(ctx.controllerHome, repository.repoId, processRef);
+          const process = getRepositoryCommandProcess(ctx.controllerHome, repository.repoId, processRef);
           if (!process) return result({ error: { code: 'WORK_NOT_FOUND', message: 'No Work or managed process matched this repository and identifier.', errorClass: 'not_found', summary: '未找到对应任务。' } }, true);
-          const waitedProcess = await waitForProcess(ctx.controllerHome, repository.repoId, processRef, { timeoutMs: waitMs });
+          const waitedProcess = await waitRepositoryCommandProcess(ctx.controllerHome, repository.repoId, processRef, { timeoutMs: waitMs });
           const digest = managedProcessOperationDigest(waitedProcess);
           return result({
             work: { kind: 'managed_process', processId: processRef },
@@ -4642,27 +5647,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           nonBlocking: true,
         });
       }
-      case 'controller_context_pack': {
-        const repository = selected(ctx, args);
-        const pack = buildControllerContextPack(repository.canonicalRoot, ctx.policy, {
-          description: typeof args.description === 'string' ? args.description : undefined,
-          issueId: typeof args.issue_id === 'string' ? args.issue_id : undefined,
-          taskId: typeof args.task_id === 'string' ? args.task_id : undefined,
-          knownPaths: stringList(args.known_paths),
-          includeGlobs: stringList(args.include_globs),
-          excludeGlobs: stringList(args.exclude_globs),
-          searchTerms: stringList(args.search_terms),
-          maxFiles: typeof args.max_files === 'number' ? args.max_files : undefined,
-          maxSnippets: typeof args.max_snippets === 'number' ? args.max_snippets : undefined,
-          maxCharsPerSnippet: typeof args.max_chars_per_snippet === 'number' ? args.max_chars_per_snippet : undefined,
-          structuralContext: args.structural_context === 'auto' || args.structural_context === 'required' ? args.structural_context : 'off',
-        });
-        return result({
-          repoId: repository.repoId,
-          repository: repositorySummary(repository),
-          contextPack: pack,
-        });
-      }
       case 'controller_context': {
         const responseStartedAt = performance.now();
         const phaseTimingsMs: Record<string, number> = {};
@@ -4679,6 +5663,9 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
               structuralContext: 'required',
               maxFiles: 8,
               maxSnippets: 20,
+              session: ctx.sessionId?.trim()
+                ? { sessionId: ctx.sessionId.trim(), repoId: repository.repoId, checkoutId: repository.activeCheckoutId }
+                : undefined,
             })
           : undefined;
         markPhase('repositoryRouting', repositoryStartedAt);
@@ -5041,7 +6028,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             ? 'Raw job state is intentionally not returned through MCP. Use the bounded job summary, events, and get_artifact with artifactId (ART-...), not evidenceId (EVD-...).'
             : jobSummary.terminal
               ? String(jobSummary.summary ?? '')
-              : 'Job is still active. Poll get_job without waiting, or use work_wait only when blocking is explicitly required.',
+              : 'Historical Job is still active. Continue independent work; read it only if an observation can change the next decision, and use work_wait only when this exact result becomes a dependency. Do not periodically poll.',
         }, jobSummary.phase === 'failed' || jobSummary.phase === 'timed_out');
       }
       case 'repository_change_verify': {
@@ -5289,154 +6276,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           cancelPendingApprovals: args.cancel_pending_approvals === true,
         }) as unknown as Record<string, unknown>);
       }
-      case 'goal_create':
-      case 'goal_list':
-      case 'goal_get':
-      case 'goal_start':
-      case 'goal_continue':
-      case 'goal_stop':
-      case 'goal_finalize':
-      case 'goal_status':
-      case 'goal_tick_once':
-      case 'goal_handoff_packet_create':
-      case 'goal_handoff_packet_get':
-      case 'provider_list':
-      case 'provider_health':
-      case 'provider_config_status':
-      case 'executor_route_preview':
-      case 'executor_dispatch':
-      case 'repair_plan':
-      case 'repair_continue': {
-        const repository = selected(ctx, args);
-        if (['goal_create', 'goal_start', 'goal_continue', 'goal_tick_once', 'executor_dispatch', 'repair_continue'].includes(name)) {
-          return result({
-            error: {
-              code: 'GOAL_LOOP_DEPRECATED',
-              message: 'Goal provider dispatch is retired. Use rh_work.plan_create/plan_approve, rh_work.controller_claim, rh_work.launcher_start, and rh_inbox for continuation.',
-            },
-            deprecated: true,
-            migration: ['rh_work.plan_create', 'rh_work.controller_claim', 'rh_work.launcher_start', 'rh_inbox.create'],
-          }, true);
-        }
-        const goalCtx: GoalLoopContext = {
-          goalStore: { controllerHome: ctx.controllerHome, repoId: repository.repoId },
-          packetStore: { controllerHome: ctx.controllerHome, repoId: repository.repoId },
-          repoId: repository.repoId,
-        };
-        const goalId = typeof args.goal_id === 'string' ? args.goal_id : '';
-        const taskIntent = typeof args.task_intent === 'string' ? args.task_intent as TaskIntent : undefined;
-        switch (name) {
-          case 'goal_create': {
-            const goal = goalCreate(goalCtx, {
-              title: String(args.title ?? ''),
-              objective: String(args.objective ?? ''),
-              mode: args.mode === 'manual' || args.mode === 'supervised' || args.mode === 'autonomous' ? args.mode : 'autonomous',
-              issueId: typeof args.issue_id === 'string' ? args.issue_id : undefined,
-              taskIds: Array.isArray(args.task_ids) ? args.task_ids.map(String) : undefined,
-              acceptanceCriteria: Array.isArray(args.acceptance_criteria) ? args.acceptance_criteria.map(String) : undefined,
-              checkIds: Array.isArray(args.check_ids) ? args.check_ids.map(String) : undefined,
-              allowedExecutors: Array.isArray(args.allowed_executors) ? args.allowed_executors.map(String) : undefined,
-              forbiddenExecutors: Array.isArray(args.forbidden_executors) ? args.forbidden_executors.map(String) : undefined,
-              retryBudget: typeof args.retry_budget === 'number' ? args.retry_budget : undefined,
-            });
-            return result({ goal, summary: summarizeGoalPublic(goal) });
-          }
-          case 'goal_list': {
-            const status = typeof args.status === 'string' ? args.status as GoalStatus | 'active' | 'all' : 'active';
-            const goals = goalList(goalCtx, status, typeof args.limit === 'number' ? args.limit : 50);
-            return result({ goals: goals.map(summarizeGoalPublic), count: goals.length });
-          }
-          case 'goal_get': {
-            const goal = goalGet(goalCtx, goalId);
-            if (!goal) return result({ error: { code: 'GOAL_NOT_FOUND', message: `Goal not found: ${goalId}` } }, true);
-            return result({ goal, summary: summarizeGoalPublic(goal) });
-          }
-          case 'goal_start':
-            return result({ tick: goalStart(goalCtx, goalId) });
-          case 'goal_continue':
-            return result({ tick: goalContinue(goalCtx, goalId) });
-          case 'goal_stop':
-            return result({ goal: summarizeGoalPublic(goalStop(goalCtx, goalId, typeof args.reason === 'string' ? args.reason : undefined)) });
-          case 'goal_finalize': {
-            const finalized = goalFinalize(goalCtx, goalId, { force: args.force === true });
-            return result({ ok: finalized.ok, reason: finalized.reason, goal: summarizeGoalPublic(finalized.goal) }, !finalized.ok);
-          }
-          case 'goal_status':
-            return result(goalStatus(goalCtx, goalId || undefined));
-          case 'goal_tick_once': {
-            if (goalId) {
-              return result({
-                tick: goalTickOnce(goalCtx, goalId, {
-                  taskIntent,
-                  providerFailure: args.provider_failure === true,
-                  externalWrite: args.external_write === true,
-                  approvalConfirmed: args.approval_confirmed === true,
-                  verificationResult: typeof args.verification_check_id === 'string'
-                    ? {
-                        checkId: args.verification_check_id,
-                        ok: args.verification_ok === true,
-                      }
-                    : undefined,
-                }),
-              });
-            }
-            return result({ ticks: tickActiveGoals(goalCtx) });
-          }
-          case 'goal_handoff_packet_create':
-            return result({
-              packet: goalHandoffPacketCreate(goalCtx, goalId, {
-                blockers: Array.isArray(args.blockers) ? args.blockers.map(String) : undefined,
-                requiredUserDecision: typeof args.required_user_decision === 'string' ? args.required_user_decision : undefined,
-                recommendedProvider: typeof args.recommended_provider === 'string' ? args.recommended_provider : undefined,
-              }),
-            });
-          case 'goal_handoff_packet_get': {
-            const packet = goalHandoffPacketGet(goalCtx, String(args.packet_id ?? ''));
-            if (!packet) return result({ error: { code: 'PACKET_NOT_FOUND', message: 'Handoff packet not found.' } }, true);
-            return result({ packet });
-          }
-          case 'provider_list':
-            return result({ providers: providerListAction(goalCtx), policyOwner: 'forge' });
-          case 'provider_health':
-            return result({
-              health: providerHealthAction(goalCtx, typeof args.provider_id === 'string' ? args.provider_id : undefined),
-              redacted: true,
-            });
-          case 'provider_config_status':
-            return result(providerConfigStatusAction(goalCtx));
-          case 'executor_route_preview':
-            return result({
-              route: executorRoutePreview(goalCtx, {
-                goalId: goalId || undefined,
-                taskIntent,
-                risk: typeof args.risk === 'string' ? args.risk as 'readonly' | 'local_repo_write' | 'workspace_write' | 'remote_write' | 'destructive' | 'raw_secret_config' : undefined,
-                objective: typeof args.objective === 'string' ? args.objective : undefined,
-              }),
-            });
-          case 'executor_dispatch':
-            return result(executorDispatch(goalCtx, {
-              goalId,
-              providerId: typeof args.provider_id === 'string' ? args.provider_id : undefined,
-              taskIntent,
-              risk: typeof args.risk === 'string' ? args.risk as 'readonly' | 'local_repo_write' | 'workspace_write' | 'remote_write' | 'destructive' | 'raw_secret_config' : undefined,
-              approvalConfirmed: args.approval_confirmed === true,
-              externalWrite: args.external_write === true,
-              strongConfirmationText: typeof args.strong_confirmation_text === 'string' ? args.strong_confirmation_text : undefined,
-            }));
-          case 'repair_plan':
-            return result(repairPlan(goalCtx, goalId));
-          case 'repair_continue':
-            return result({
-              tick: repairContinue(goalCtx, goalId, {
-                forceFailureClass: typeof args.force_failure_class === 'string'
-                  ? args.force_failure_class as import('../../control-plane/goal-loop').FailureClass
-                  : undefined,
-              }),
-            });
-          default:
-            return result({ error: { code: 'GOAL_LOOP_UNKNOWN', message: name } }, true);
-        }
-      }
       case 'workspace_auth_status': {
         const repository = selected(ctx, args);
         return result(buildWorkspaceAuthStatus(listAssistantPluginManifests(ctx.controllerHome, repository)));
@@ -5449,66 +6288,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           redirectUri: typeof args.redirect_uri === 'string' ? args.redirect_uri : undefined,
         }));
       }
-      case 'assistant_model_readiness': {
-        return result(assistantModelReadiness());
-      }
-      case 'assistant_standing_grants': {
-        const repository = selected(ctx, args);
-        return result(listAssistantStandingGrants(ctx.controllerHome, repository, {
-          status: typeof args.status === 'string' ? args.status as any : undefined,
-          limit: typeof args.limit === 'number' ? args.limit : undefined,
-        }));
-      }
-      case 'assistant_standing_grant_create': {
-        const repository = selected(ctx, args);
-        return result({ grant: createAssistantStandingGrant(ctx.controllerHome, repository, {
-          name: typeof args.name === 'string' ? args.name : undefined,
-          pluginId: String(args.plugin_id ?? '').trim(),
-          actionId: String(args.action_id ?? '').trim(),
-          routineIds: Array.isArray(args.routine_ids) ? args.routine_ids.map(String) : undefined,
-          senderAllowlist: Array.isArray(args.sender_allowlist) ? args.sender_allowlist.map(String) : undefined,
-          subjectContains: Array.isArray(args.subject_contains) ? args.subject_contains.map(String) : undefined,
-          minConfidence: typeof args.min_confidence === 'number' ? args.min_confidence : undefined,
-          maxPerRun: typeof args.max_per_run === 'number' ? args.max_per_run : undefined,
-          expiresInDays: typeof args.expires_in_days === 'number' ? args.expires_in_days : undefined,
-          confirmAuthorization: args.confirm_authorization === true,
-          origin: { surface: 'mcp', actor: 'assistant_standing_grant_create' },
-        }) });
-      }
-      case 'assistant_standing_grant_revoke': {
-        const repository = selected(ctx, args);
-        return result({ grant: revokeAssistantStandingGrant(ctx.controllerHome, repository, {
-          grantId: String(args.grant_id ?? '').trim(),
-          reason: typeof args.reason === 'string' ? args.reason : undefined,
-          confirmAuthorization: args.confirm_authorization === true,
-          origin: { surface: 'mcp', actor: 'assistant_standing_grant_revoke' },
-        }) });
-      }
-      case 'assistant_action_proposals': {
-        const repository = selected(ctx, args);
-        const proposalId = typeof args.proposal_id === 'string' ? args.proposal_id.trim() : '';
-        return result(proposalId
-          ? { proposal: getAssistantActionProposal(ctx.controllerHome, repository, proposalId) }
-          : listAssistantActionProposals(ctx.controllerHome, repository, {
-              status: typeof args.status === 'string' ? args.status as any : undefined,
-              limit: typeof args.limit === 'number' ? args.limit : undefined,
-            }));
-      }
-      case 'assistant_action_proposal_resolve': {
-        const repository = selected(ctx, args);
-        const proposalId = String(args.proposal_id ?? '').trim();
-        if (args.decision === 'reject') {
-          return result({ proposal: rejectAssistantActionProposal(ctx.controllerHome, repository, proposalId, typeof args.reason === 'string' ? args.reason : undefined) });
-        }
-        if (args.confirm_authorization !== true) throw new Error('ASSISTANT_ACTION_APPROVAL_REQUIRED: confirm_authorization=true');
-        const requestId = String(args.request_id ?? `assistant-proposal:${proposalId}`).trim();
-        return result({ proposal: await approveAssistantActionProposal(ctx.controllerHome, repository, {
-          proposalId,
-          requestId,
-          confirmationText: typeof args.confirmation_text === 'string' ? args.confirmation_text : undefined,
-          origin: { surface: 'mcp', actor: 'assistant_action_proposal_resolve' },
-        }) });
-      }
       case 'external_filesystem_targets_list': {
         const repository = selected(ctx, args);
         return result(listExternalFilesystemTargets(repository.canonicalRoot));
@@ -5711,27 +6490,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           plugin: summarizePlugin(getAssistantPluginManifest(ctx.controllerHome, repository, pluginId)),
         });
       }
-      case 'assistant_readiness': {
-        const repository = selected(ctx, args);
-        const readiness = buildAssistantReadinessReport(ctx.controllerHome, repository);
-        return result({ ...readiness });
-      }
-
-      case 'gmail_triage_rules': {
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, checkoutId: repository.activeCheckoutId, path: '.forge/assistant/gmail-triage-rules.json', ...readGmailTriageRules(repository) });
-      }
-      case 'gmail_triage_rule_upsert': {
-        const repository = selected(ctx, args);
-        const upserted = upsertGmailTriageRule(repository, args);
-        return result({ repoId: repository.repoId, checkoutId: repository.activeCheckoutId, ...upserted });
-      }
-      case 'gmail_triage_plan': {
-        const repository = selected(ctx, args);
-        let manifest;
-        try { manifest = getAssistantPluginManifest(ctx.controllerHome, repository, 'gmail'); } catch (_error) { manifest = undefined; }
-        return result(buildGmailTriagePlan(repository, { manifest, items: args.items, query: args.query }) as unknown as Record<string, unknown>);
-      }
       case 'review_artifacts_prepare': {
         const repository = selected(ctx, args);
         return result(ensureReviewArtifactRoots(repository));
@@ -5752,93 +6510,64 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
         const repository = selected(ctx, args);
         return result(buildWorkflowWatchdogReport(ctx.controllerHome, repository, { staleMinutes: args.stale_minutes, includeProcesses: args.include_processes }) as unknown as Record<string, unknown>);
       }
-      case 'ios_xcode_status': {
-        return result({ ...iosXcodeStatus() });
-      }
-      case 'ios_simulators_list': {
-        return result({ ...iosSimulatorsList({
+      case 'ios_xcode_status':
+        return legacyIosPluginAction(ctx, name, args, 'xcode_status', {});
+      case 'ios_simulators_list':
+        return legacyIosPluginAction(ctx, name, args, 'list_simulators', {
           runtime: typeof args.runtime === 'string' ? args.runtime : undefined,
           name: typeof args.name === 'string' ? args.name : undefined,
-        }) });
-      }
-      case 'ios_project_discover': {
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosProjectDiscover(repository) });
-      }
-      case 'ios_schemes_list': {
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosSchemesList(repository, {
+        });
+      case 'ios_project_discover':
+        return legacyIosPluginAction(ctx, name, args, 'discover_project', {});
+      case 'ios_schemes_list':
+        return legacyIosPluginAction(ctx, name, args, 'list_schemes', {
           workspace: typeof args.workspace === 'string' ? args.workspace : undefined,
           project: typeof args.project === 'string' ? args.project : undefined,
-        }) });
-      }
-      case 'ios_simulator_boot': {
-        if (args.confirm_authorization !== true) throw new Error('IOS_AUTHORIZATION_REQUIRED: confirm_authorization must be true');
-        return result({ ...iosSimulatorBoot({
+        });
+      case 'ios_simulator_boot':
+        return legacyIosPluginAction(ctx, name, args, 'launch_simulator', {
           udid: String(args.udid ?? '').trim(),
-          openSimulator: args.open_simulator !== false,
-          timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
-        }) });
-      }
-      case 'ios_app_build': {
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosAppBuild(repository, {
+          open_simulator: args.open_simulator !== false,
+          timeout_ms: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
+        });
+      case 'ios_app_build':
+        return legacyIosPluginAction(ctx, name, args, 'build', {
           scheme: String(args.scheme ?? '').trim(),
           udid: typeof args.udid === 'string' ? args.udid : undefined,
-          simulatorName: typeof args.simulator_name === 'string' ? args.simulator_name : undefined,
+          simulator_name: typeof args.simulator_name === 'string' ? args.simulator_name : undefined,
           workspace: typeof args.workspace === 'string' ? args.workspace : undefined,
           project: typeof args.project === 'string' ? args.project : undefined,
           configuration: typeof args.configuration === 'string' ? args.configuration : undefined,
-          timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
-        }) });
-      }
-      case 'ios_app_install': {
-        if (args.confirm_authorization !== true) throw new Error('IOS_AUTHORIZATION_REQUIRED: confirm_authorization must be true');
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosAppInstall(repository, {
-          udid: String(args.udid ?? '').trim(),
-          appPath: String(args.app_path ?? '').trim(),
-        }) });
-      }
-      case 'ios_app_launch': {
-        if (args.confirm_authorization !== true) throw new Error('IOS_AUTHORIZATION_REQUIRED: confirm_authorization must be true');
-        return result({ ...iosAppLaunch({
-          udid: String(args.udid ?? '').trim(),
-          bundleId: String(args.bundle_id ?? '').trim(),
-          arguments: Array.isArray(args.arguments) ? args.arguments.map(String) : undefined,
-        }) });
-      }
-      case 'ios_simulator_screenshot': {
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosSimulatorScreenshot(repository, {
+          timeout_ms: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
+        });
+      case 'ios_simulator_screenshot':
+        return legacyIosPluginAction(ctx, name, args, 'capture_screenshot', {
           udid: String(args.udid ?? '').trim(),
           label: typeof args.label === 'string' ? args.label : undefined,
-        }) });
-      }
-      case 'ios_simulator_log_tail': {
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosSimulatorLogTail(repository, {
-          udid: String(args.udid ?? '').trim(),
-          process: typeof args.process === 'string' ? args.process : undefined,
-          last: typeof args.last === 'string' ? args.last : undefined,
-          maxBytes: typeof args.max_bytes === 'number' ? args.max_bytes : undefined,
-        }) });
-      }
-      case 'ios_ui_smoke_test': {
-        if (args.confirm_authorization !== true) throw new Error('IOS_AUTHORIZATION_REQUIRED: confirm_authorization must be true');
-        const repository = selected(ctx, args);
-        return result({ repoId: repository.repoId, ...iosUiSmokeTest(repository, {
-          udid: typeof args.udid === 'string' ? args.udid : undefined,
-          simulatorName: typeof args.simulator_name === 'string' ? args.simulator_name : undefined,
+        });
+      case 'ios_ui_smoke_test':
+        return legacyIosPluginAction(ctx, name, args, 'smoke_review', {
           scheme: typeof args.scheme === 'string' ? args.scheme : undefined,
-          bundleId: typeof args.bundle_id === 'string' ? args.bundle_id : undefined,
+          bundle_id: typeof args.bundle_id === 'string' ? args.bundle_id : undefined,
+          udid: typeof args.udid === 'string' ? args.udid : undefined,
+          simulator_name: typeof args.simulator_name === 'string' ? args.simulator_name : undefined,
           workspace: typeof args.workspace === 'string' ? args.workspace : undefined,
           project: typeof args.project === 'string' ? args.project : undefined,
           configuration: typeof args.configuration === 'string' ? args.configuration : undefined,
-          appPath: typeof args.app_path === 'string' ? args.app_path : undefined,
-          screenshotLabel: typeof args.screenshot_label === 'string' ? args.screenshot_label : undefined,
-        }) });
-      }
+          app_path: typeof args.app_path === 'string' ? args.app_path : undefined,
+          screenshot_label: typeof args.screenshot_label === 'string' ? args.screenshot_label : undefined,
+        });
+      case 'ios_app_install':
+      case 'ios_app_launch':
+      case 'ios_simulator_log_tail':
+        return result({
+          accepted: false,
+          mode: 'compatibility_migration',
+          path: 'plugin_action_execute',
+          rejectCode: 'LEGACY_IOS_ATOMIC_RETIRED',
+          message: `${name} no longer owns an independent iOS execution path. Use plugin_action_execute with plugin_id=ios and action_id=smoke_review for staged simulator validation.`,
+          migration: { tool: 'plugin_action_execute', plugin_id: 'ios', action_id: 'smoke_review' },
+        }, true);
       case 'runtime_cleanup_preview': {
         const repository = selected(ctx, args);
         const preview = previewRuntimeCleanup(repository.canonicalRoot, {
@@ -5912,7 +6641,63 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           };
           return resultWithPluginArtifactImages(value, ctx.controllerHome, repository.repoId, direct.result);
         }
+        if (repository.repoId !== '__controller__' && action?.executionMode === 'lightweight_process') {
+          const timeoutMs = Math.max(1_000, request.timeoutMs ?? action?.defaultTimeoutMs ?? 10 * 60_000);
+          let { handle } = await startLightweightPluginAction({
+            controllerHome: ctx.controllerHome,
+            repository,
+            request,
+            interactiveWaitMs: typeof args.interactive_wait_ms === 'number' ? args.interactive_wait_ms : 750,
+            timeoutMs,
+          });
+          if (!handle.completed && args.wait === true) {
+            handle = await waitLightweightPluginAction(
+              ctx.controllerHome,
+              repository.repoId,
+              handle.processId,
+              typeof args.wait_ms === 'number' ? Math.max(1, args.wait_ms) : 15_000,
+              ctx.signal,
+            );
+          }
+          if (!handle.completed) {
+            return result({
+              accepted: true,
+              direct: false,
+              durable: false,
+              mode: 'lightweight_process',
+              plugin: summarizePluginActionReceipt(manifest),
+              action: action ? {
+                actionId: action.actionId,
+                risk: action.risk,
+                confirmation: action.confirmation,
+                requiredConfirmationText: action.requiredConfirmationText,
+              } : { actionId },
+              scope: 'repository',
+              requestId,
+              process: handle,
+              resultRef: { kind: 'process_logs', processId: handle.processId },
+              next: 'The typed plugin action is isolated from the Canonical Runtime. Use process_wait on processId; after completion, call plugin_action_execute again with the same request_id to retrieve the deduplicated structured receipt.',
+            });
+          }
+          if (!handle.ok) {
+            return result({
+              accepted: true,
+              direct: false,
+              durable: false,
+              mode: 'lightweight_process',
+              requestId,
+              process: handle,
+              error: {
+                code: handle.timedOut ? 'PLUGIN_ACTION_TIMEOUT' : handle.cancelled ? 'PLUGIN_ACTION_CANCELLED' : 'PLUGIN_ACTION_FAILED',
+                message: handle.stderrTail || handle.stdoutTail || `Plugin action process exited with code ${String(handle.exitCode)}`,
+              },
+            }, true);
+          }
+        }
+        // The sidecar writes the authoritative receipt. Re-entering the store
+        // with the same request id is a bounded deduplicated read of that result.
         const submitted = await submitAssistantPluginAction(ctx.controllerHome, repository, request);
+        const compactResult = compactSubmittedPluginActionResult(submitted.result);
         const value = {
           accepted: true,
           deduplicated: submitted.deduplicated,
@@ -5929,7 +6714,8 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           receiptId: submitted.receipt.receiptId,
           requestId: submitted.receipt.requestId,
           ...(submitted.receipt.workId ? { workId: submitted.receipt.workId } : {}),
-          result: submitted.result,
+          authorization: submitted.authorization,
+          result: compactResult,
           detail: {
             tool: 'rh_context',
             arguments: {
@@ -5940,7 +6726,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           },
           next: 'Continue with the returned bounded plugin result; use rh_context capability detail only when the typed action schema/policy is needed.',
         };
-        return resultWithPluginArtifactImages(value, ctx.controllerHome, repository.repoId, submitted.result);
+        return resultWithPluginArtifactImages(value, ctx.controllerHome, repository.repoId, compactResult);
       }
       case 'toolchain_plugin_summary': {
         const pluginId = String(args.plugin_id ?? '').trim();
@@ -5990,7 +6776,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
             next: continuation.nextSafeAction,
           }, contract.status === 'failed' || continuation.reconciliationRequired);
         }
-        const process = getProcessHandle(ctx.controllerHome, repository.repoId, workRef);
+        const process = getRepositoryCommandProcess(ctx.controllerHome, repository.repoId, workRef);
         if (!process) return result({ error: { code: 'WORK_NOT_FOUND', message: 'No Work or managed process matched work_ref.', errorClass: 'not_found', summary: '未找到对应任务。' } }, true);
         const digest = managedProcessOperationDigest(process);
         return result({
@@ -5999,7 +6785,7 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           taskLedgerStatus: taskLedger.status,
           next: process.completed === true
             ? 'Managed process is terminal; inspect the bounded digest above.'
-            : `Poll process_get or process_wait with process_id=${workRef}; do not re-run the original operation.`,
+            : `Continue independent work. Use process_get only if an observation can change the next decision; join once with process_wait when this exact result becomes a dependency. Do not re-run the original operation.`,
         }, digest.phase === 'failed' || digest.phase === 'timed_out');
       }
       case 'model_clients_summary': {
@@ -6044,70 +6830,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           model: typeof args.model === 'string' ? args.model : undefined,
         }) });
       }
-      case 'create_schedule': {
-        const repository = selected(ctx, args);
-        const operation = String(args.operation ?? '').trim();
-        const operationArgs = args.arguments && typeof args.arguments === 'object' ? args.arguments as Record<string, unknown> : {};
-        assertAutomatedOperationAllowed(operation, operationArgs);
-        const scheduleRequestId = typeof args.request_id === 'string' && args.request_id.trim()
-          ? args.request_id.trim()
-          : `schedule:auto:${repository.repoId}:${createHash('sha256').update(JSON.stringify({ name: args.name, operation, arguments: operationArgs, everyMinutes: args.every_minutes })).digest('hex').slice(0, 20)}:${Math.floor(Date.now() / (5 * 60_000))}`;
-        const schedule = createSchedule(ctx.controllerHome, {
-          requestId: scheduleRequestId,
-          repoId: repository.repoId,
-          name: String(args.name ?? '').trim(),
-          enabled: true,
-          trigger: {
-            type: ['interval', 'cron', 'calendar', 'condition', 'repository-event', 'dependency-checkpoint', 'manual'].includes(String(args.trigger_type))
-              ? String(args.trigger_type) as 'interval' | 'cron' | 'calendar' | 'condition' | 'repository-event' | 'dependency-checkpoint' | 'manual'
-              : typeof args.every_minutes === 'number' ? 'interval' : 'manual',
-            everyMinutes: typeof args.every_minutes === 'number' ? Math.max(1, args.every_minutes) : undefined,
-            cronExpression: typeof args.cron_expression === 'string' ? args.cron_expression : undefined,
-            calendarAt: typeof args.calendar_at === 'string' ? args.calendar_at : undefined,
-            condition: args.condition && typeof args.condition === 'object' ? args.condition as never : undefined,
-            eventName: typeof args.event_name === 'string' ? args.event_name : undefined,
-            dependencyJobIds: Array.isArray(args.dependency_job_ids) ? args.dependency_job_ids.map(String) : undefined,
-          },
-          policy: {
-            maxActiveOccurrences: 1,
-            maxFailures: typeof args.max_failures === 'number' ? Math.max(1, args.max_failures) : 3,
-            cooldownMinutes: typeof args.cooldown_minutes === 'number' ? Math.max(0, args.cooldown_minutes) : 120,
-            dailyBudgetMinutes: typeof args.daily_budget_minutes === 'number' ? Math.max(1, args.daily_budget_minutes) : 180,
-            shadowMode: args.shadow_mode !== false,
-            backoffBaseMinutes: typeof args.backoff_base_minutes === 'number' ? Math.max(1, args.backoff_base_minutes) : 5,
-            backoffMaxMinutes: typeof args.backoff_max_minutes === 'number' ? Math.max(1, args.backoff_max_minutes) : 24 * 60,
-          },
-          action: { operation, arguments: operationArgs, resourceClaims: claimsForMcpOperation(operation, operationArgs, repository.repoId, repository.activeCheckoutId) },
-          stopConditions: Array.isArray(args.stop_conditions) ? args.stop_conditions.map(String) : ['release_ready', 'external_blocker', 'human_review_required'],
-        });
-        return result({ schedule });
-      }
-      case 'list_schedules': {
-        const repository = selected(ctx, args);
-        const schedules = listSchedules(ctx.controllerHome, repository.repoId);
-        if (args.include_occurrences !== true) return result({ schedules });
-        const occurrences = listOccurrences(ctx.controllerHome, repository.repoId, undefined, 100);
-        const decisions = occurrences.flatMap((occurrence) => occurrence.decisionId
-          ? [getScheduleDecision(ctx.controllerHome, repository.repoId, occurrence.decisionId)].filter(Boolean)
-          : []);
-        return result({ schedules, occurrences, decisions });
-      }
-      case 'pause_schedule': {
-        const repository = selected(ctx, args);
-        const schedule = getSchedule(ctx.controllerHome, repository.repoId, String(args.schedule_id ?? ''));
-        return result({ schedule: saveSchedule(ctx.controllerHome, { ...schedule, enabled: false, pausedReason: typeof args.reason === 'string' ? args.reason : 'Paused by user.' }) });
-      }
-      case 'trigger_schedule': {
-        const repository = selected(ctx, args);
-        const schedule = getSchedule(ctx.controllerHome, repository.repoId, String(args.schedule_id ?? ''));
-        const occurrence = await evaluateSchedule(ctx.controllerHome, schedule, true, {
-          source: typeof args.event_name === 'string' ? 'repository-event' : 'manual',
-          eventName: typeof args.event_name === 'string' ? args.event_name : undefined,
-          eventId: typeof args.event_id === 'string' ? args.event_id : undefined,
-          data: args.event_data && typeof args.event_data === 'object' ? args.event_data as Record<string, unknown> : undefined,
-        });
-        return result({ occurrence });
-      }
       case 'request_release_gate': {
         const repository = selected(ctx, args);
         const requestId = typeof args.request_id === 'string' && args.request_id.trim()
@@ -6123,93 +6845,6 @@ export async function callRuntimeTool(ctx: MultiRepositoryMcpToolContext, name:
           suggestedOperation: 'rh_work.controller_claim followed by Process Runtime checks and explicit release authorization.',
         });
       }
-      case 'create_portfolio_workflow': {
-        const rawSteps = Array.isArray(args.steps) ? args.steps : [];
-        const workflow = createPortfolioWorkflow(ctx.controllerHome, {
-          name: String(args.name ?? '').trim(),
-          requestId: String(args.request_id ?? '').trim(),
-          failurePolicy: args.failure_policy === 'compensate' ? 'compensate' : 'stop',
-          steps: rawSteps.map((raw, index) => {
-            if (!raw || typeof raw !== 'object') throw new Error(`PORTFOLIO_STEP_INVALID: step ${index + 1}`);
-            const step = raw as Record<string, unknown>;
-            const stepRepoId = String(step.repo_id ?? '').trim();
-            const operation = String(step.operation ?? '').trim();
-            const operationArgs = step.arguments && typeof step.arguments === 'object' ? step.arguments as Record<string, unknown> : {};
-            if (!stepRepoId || !operation) throw new Error(`PORTFOLIO_STEP_INVALID: step ${index + 1} requires repo_id and operation`);
-            assertAutomatedOperationAllowed(operation, operationArgs);
-            const checkoutId = resolveRepositorySelection({ repoId: stepRepoId, controllerHome: ctx.controllerHome, allowSoleRepository: false }).activeCheckoutId;
-            const compensation = step.compensation && typeof step.compensation === 'object'
-              ? step.compensation as Record<string, unknown>
-              : undefined;
-            if (compensation) {
-              const compensationOperation = String(compensation.operation ?? '').trim();
-              const compensationArguments = compensation.arguments && typeof compensation.arguments === 'object'
-                ? compensation.arguments as Record<string, unknown>
-                : {};
-              assertAutomatedOperationAllowed(compensationOperation, compensationArguments);
-            }
-            return {
-              stepId: String(step.step_id ?? `step-${index + 1}`),
-              repoId: stepRepoId,
-              operation,
-              arguments: operationArgs,
-              dependsOn: Array.isArray(step.depends_on) ? step.depends_on.map(String) : [],
-              priority: ['P0', 'P1', 'P2', 'P3', 'P4'].includes(String(step.priority)) ? String(step.priority) as 'P0' | 'P1' | 'P2' | 'P3' | 'P4' : 'P2',
-              resourceClaims: claimsForMcpOperation(operation, operationArgs, stepRepoId, checkoutId),
-              compensation: compensation ? { operation: String(compensation.operation ?? ''), arguments: compensation.arguments && typeof compensation.arguments === 'object' ? compensation.arguments as Record<string, unknown> : undefined } : undefined,
-              status: 'pending' as const,
-            };
-          }),
-        });
-        return result({ workflow });
-      }
-      case 'list_portfolio_workflows':
-        return result({ workflows: listPortfolioWorkflows(ctx.controllerHome, typeof args.limit === 'number' ? args.limit : 100) });
-      case 'get_portfolio_workflow':
-        return result({ workflow: getPortfolioWorkflow(ctx.controllerHome, String(args.workflow_id ?? '')) });
-      case 'record_candidate_finding': {
-        const repository = selected(ctx, args);
-        const semanticKey = String(args.semantic_key ?? '').trim();
-        const requestId = typeof args.request_id === 'string' && args.request_id.trim()
-          ? args.request_id.trim()
-          : `candidate:${repository.repoId}:${createHash('sha256').update(semanticKey).digest('hex').slice(0, 20)}:${Math.floor(Date.now() / (5 * 60_000))}`;
-        const finding = recordCandidateFinding(ctx.controllerHome, {
-          repoId: repository.repoId,
-          requestId,
-          semanticKey,
-          title: String(args.title ?? '').trim(),
-          summary: typeof args.summary === 'string' ? args.summary : undefined,
-          severity: ['low', 'medium', 'high', 'critical'].includes(String(args.severity))
-            ? String(args.severity) as 'low' | 'medium' | 'high' | 'critical'
-            : 'medium',
-          evidence: {
-            source: 'mcp',
-            reference: typeof args.reference === 'string' ? args.reference : undefined,
-            details: args.evidence && typeof args.evidence === 'object' ? args.evidence as Record<string, unknown> : undefined,
-          },
-        });
-        return result({ finding });
-      }
-      case 'list_candidate_findings': {
-        const repository = selected(ctx, args);
-        return result({ findings: listCandidateFindings(ctx.controllerHome, repository.repoId, {
-          includeTerminal: args.include_terminal === true,
-          limit: typeof args.limit === 'number' ? args.limit : 100,
-        }) });
-      }
-      case 'promote_candidate_finding': {
-        const repository = selected(ctx, args);
-        const finding = getCandidateFinding(ctx.controllerHome, repository.repoId, String(args.finding_id ?? ''));
-        return result({
-          accepted: false,
-          mode: 'external_controller_required',
-          repoId: repository.repoId,
-          finding,
-          rejectCode: 'EXECUTION_JOB_RETIRED',
-          message: 'Candidate promotion no longer creates an ExecutionJob. An external Controller must create the Issue after claiming the related Work.',
-          suggestedOperation: 'Create or claim WorkContract, then use the explicit issue-creation tool from the external Controller session.',
-        });
-      }
       default: return undefined;
     }
   } catch (error) {