@moretea-labs/forge 1.6.0 → 1.7.1

package/src/runtime/control-plane/facade/goal-workloop.ts

@@ -1,8 +1,10 @@
 import { randomUUID } from 'crypto';
 import {
   createHandoffItem,
+  listHandoffItems,
   type HandoffInboxStoreOptions,
 } from './handoff-inbox-store';
+import { getControllerSession } from './controller-session-store';
 import {
   appendVerificationRecord,
   appendWorkEvidence,
@@ -10,6 +12,7 @@ import {
   createWorkContract,
   getWorkContract,
   listWorkContracts,
+  recordWorkScopeEvidence,
   summarizeWorkContract,
   transitionWorkContractPhase,
   updateWorkContract,
@@ -21,6 +24,10 @@ import {
   getPlanContract,
   type PlanContractStoreOptions,
 } from './plan-contract-store';
+import { withPrimaryWorkAdmissionLock } from './semantic-admission';
+import { completeWorkWithReceipt } from '../execution/work-completion-authority';
+import { evaluateReadOnlyReviewSourceIdentity, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence, verificationRecordAppliesToCurrentWorkspace } from '../execution/work-evidence-policy';
+import { readRequirement } from '../persistence/requirement-store';
 import {
   classifyVerificationOutcome,
   normalizeCheckIds,
@@ -41,9 +48,11 @@ import type {
   SuggestedNextAction,
   VerificationRecord,
   WorkContract,
+  WorkKind,
   WorkRisk,
 } from './types';
 import { selectExecutionMode } from './types';
+import { resolveWorkspaceAdmissionConstraint } from '../routing/workspace-admission';
 
 export type GoalWorkloopOperation = 'start' | 'continue' | 'verify' | 'finalize' | 'stop';
 
@@ -58,8 +67,14 @@ export interface GoalWorkloopContext {
   principalId?: string;
   controllerInstanceId?: string;
   workspaceFingerprint?: string;
+  /** Current net repository paths changed from the Work base plus dirty checkout paths. */
+  workspaceChangedPaths?: readonly string[];
+  /** Durable terminal repository Process ids explicitly bound to this Work + checkout. */
+  workBoundProcessEvidenceIds?: readonly string[];
   now?: () => string;
-  materializeIsolatedWorkspace?: (input: { workId: string; title: string; baseRef?: string }) => { checkoutId: string; root: string; baseRevision?: string | null; managed: true };
+  /** True only while a Gateway caller holds the cross-process primary Work admission lock. */
+  semanticAdmissionLocked?: boolean;
+  materializeIsolatedWorkspace?: (input: { workId: string; title: string; baseRef?: string; needsDependencies?: boolean }) => { checkoutId: string; root: string; baseRevision?: string | null; managed: true };
 }
 
 export type WorkAdmissionRelation = 'continue' | 'extend' | 'parallel' | 'new_goal';
@@ -68,6 +83,8 @@ export interface GoalWorkloopStartInput {
   objective: string;
   acceptanceCriteria?: string[];
   allowedPaths?: string[];
+  /** Non-authoritative first-pass discovery candidates. */
+  initialLikelyPaths?: string[];
   forbiddenPaths?: string[];
   checks?: string[];
   constraints?: WorkContract['constraints'];
@@ -83,16 +100,45 @@ export interface GoalWorkloopStartInput {
   forceMode?: WorkContract['mode'];
   planId?: string;
   planStepId?: string;
+  /** Explicit technical evidence shape chosen by the semantic Controller. Never inferred from objective/check text. */
+  workKind?: Extract<WorkKind, 'repository_change' | 'completed_no_change' | 'read_only_review' | 'investigation' | 'local_effect' | 'remote_effect' | 'reconciliation'>;
+}
+
+export interface GoalWorkloopAcceptanceEvidenceBinding {
+  criterion: string;
+  evidenceIds: string[];
+  rationale: string;
 }
 
 export interface GoalWorkloopContinueInput {
   workId: string;
   note?: string;
+  allowedPaths?: string[];
+  forbiddenPaths?: string[];
+  checks?: string[];
+  additionalLikelyPaths?: string[];
+  inspectedPaths?: string[];
+  /** Concise semantic findings discovered by a first-class read-only review. */
+  reviewFindings?: string[];
+  /** Explicit Controller-reviewed bindings from exact declared criteria to durable Work evidence. */
+  acceptanceEvidence?: GoalWorkloopAcceptanceEvidenceBinding[];
+  /** Explicit Controller decision after deterministic acceptance failure; never inferred from note text. */
+  acceptanceFailureDecision?: 'repair' | 'rescope';
 }
 
 export interface GoalWorkloopVerifyInput {
   workId: string;
   checkId: string;
+  /** Exact Git revision observed by the authoritative Work-bound verification Process. */
+  sourceRevision?: string;
+  /** Exact dirty-workspace content identity observed by the authoritative check. */
+  workspaceFingerprint?: string;
+  /** Stable semantic check-input identity used for exact evidence reuse. */
+  verificationInputFingerprint?: string;
+  /** Bounded command/invocation audit identity; not part of reusable semantic inputs. */
+  commandFingerprint?: string;
+  /** Persistence-safe Process receipt. Accepted only when its Work/repo/check identity matches this verification. */
+  receipt?: VerificationRecord['receipt'];
   /** When true, simulate infrastructure failure rather than acceptance fail. */
   infrastructureFailed?: boolean;
   /** When true and check is valid, record acceptance failure. */
@@ -131,6 +177,7 @@ function handoffIdFor(prefix: string): string {
 }
 
 function workRiskFor(input: GoalWorkloopStartInput): WorkRisk {
+  if (input.workKind === 'read_only_review') return 'readonly';
   const risk = input.modeInput.risk;
   if (input.modeInput.secretAccess === true || input.modeInput.destructive === true) return 'destructive';
   if (input.modeInput.remoteWrite === true) return 'high';
@@ -141,13 +188,13 @@ function workRiskFor(input: GoalWorkloopStartInput): WorkRisk {
   return 'medium';
 }
 
-function suggestedForWork(work: WorkContract, extras: SuggestedNextAction[] = []): SuggestedNextAction[] {
+function suggestedForWorkIdentity(workId: string, checks: string[], extras: SuggestedNextAction[] = []): SuggestedNextAction[] {
   const base: SuggestedNextAction[] = [
     {
       label: 'Continue workloop',
       tool: 'rh_work',
       operation: 'continue',
-      payload: { work_id: work.workId },
+      payload: { work_id: workId },
       risk: 'readonly',
       confidence: 'high',
     },
@@ -155,24 +202,28 @@ function suggestedForWork(work: WorkContract, extras: SuggestedNextAction[] = []
       label: 'Verify registered checks',
       tool: 'rh_work',
       operation: 'verify',
-      payload: { work_id: work.workId, check_id: work.checks[0] },
+      payload: { work_id: workId, check_id: checks[0] },
       risk: 'workspace_write',
-      confidence: work.checks[0] ? 'high' : 'low',
+      confidence: checks[0] ? 'high' : 'low',
     },
     {
       label: 'Finalize when ready',
       tool: 'rh_work',
       operation: 'finalize',
-      payload: { work_id: work.workId },
+      payload: { work_id: workId },
       risk: 'readonly',
       confidence: 'medium',
     },
   ];
   return validateSuggestedNextActions([...extras, ...base], {
-    validCheckIds: work.checks,
+    validCheckIds: checks,
   }).actions;
 }
 
+function suggestedForWork(work: WorkContract, extras: SuggestedNextAction[] = []): SuggestedNextAction[] {
+  return suggestedForWorkIdentity(work.workId, work.checks, extras);
+}
+
 function initialEvidence(objective: string): EvidenceRef {
   return {
     title: 'work contract created',
@@ -181,56 +232,6 @@ function initialEvidence(objective: string): EvidenceRef {
   };
 }
 
-type ReconciledVerificationHistory = ReturnType<typeof reconcileVerificationHistory>;
-
-interface WorkCompletionEvidenceEvaluation {
-  status: 'complete' | 'failed' | 'incomplete';
-  history: ReconciledVerificationHistory;
-  missingChecks: string[];
-  durableResultEvidence: boolean;
-  reasons: string[];
-}
-
-function evaluateWorkCompletionEvidence(
-  work: WorkContract,
-  history: ReconciledVerificationHistory = reconcileVerificationHistory(
-    work.checkRefs.map((record) => ({ checkId: record.checkId, outcome: record.outcome, recordedAt: record.recordedAt })),
-  ),
-): WorkCompletionEvidenceEvaluation {
-  const missingChecks = work.checks.filter((checkId) => !history.validPasses.includes(checkId));
-  const durableResultEvidence = work.evidenceRefs.some((evidence) => Boolean(evidence.evidenceId || evidence.artifactId));
-  const reasons: string[] = [];
-
-  if (history.acceptanceFailures.length > 0) {
-    reasons.push(`Acceptance checks failed: ${history.acceptanceFailures.join(', ')}.`);
-    return { status: 'failed', history, missingChecks, durableResultEvidence, reasons };
-  }
-  if (history.infrastructureIssues.length > 0) {
-    reasons.push(`Infrastructure issues remain: ${history.infrastructureIssues.join(', ')}.`);
-  }
-  if (history.invalidCheckIds.length > 0) {
-    reasons.push(`Invalid check ids remain: ${history.invalidCheckIds.join(', ')}.`);
-  }
-  if (missingChecks.length > 0) {
-    reasons.push(`Declared checks are missing valid_pass evidence: ${missingChecks.join(', ')}.`);
-  }
-  if (work.checks.length === 0 && !durableResultEvidence) {
-    reasons.push('No durable result evidence (evidenceId or artifactId) was recorded for this no-check WorkContract.');
-  }
-
-  const complete = history.infrastructureIssues.length === 0
-    && history.invalidCheckIds.length === 0
-    && missingChecks.length === 0
-    && (work.checks.length > 0 || durableResultEvidence);
-  return {
-    status: complete ? 'complete' : 'incomplete',
-    history,
-    missingChecks,
-    durableResultEvidence,
-    reasons,
-  };
-}
-
 /**
  * Mode selection for facade routing. Direct control never creates a WorkContract.
  * Goal workloop creates one. Handoff-only creates a handoff and stops.
@@ -239,19 +240,86 @@ export function routeWorkStart(
   ctx: GoalWorkloopContext,
   input: GoalWorkloopStartInput,
 ): FacadeResult {
+  const placementResolution = resolveWorkspaceAdmissionConstraint(input.constraints);
+  if (placementResolution.ok === false) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `${placementResolution.code}: ${placementResolution.message}`,
+      data: { executionStarted: false, workContractCreated: false, placementConstraintConflict: true },
+      rawAvailable: false,
+    });
+  }
+  const placementConstraint = placementResolution.constraint;
+  const canonicalConstraints: WorkContract['constraints'] = {
+    ...(input.constraints ?? {}),
+    workspaceMode: placementConstraint.workspaceMode,
+    requireWorktree: placementConstraint.requireWorktree,
+    directMainProhibited: placementConstraint.directMainProhibited,
+  };
   const strategyConflictRequiresApproval = input.constraints?.architectureStrategyChange === true
     || input.constraints?.conflictsWithThinHarnessPolicy === true
     || input.constraints?.changesDefaultExecutionStrategy === true;
+  const relatedLifecycleSource = input.relatedWorkId ? getWorkContract(ctx.workStore, input.relatedWorkId) : undefined;
+  const inheritedReadOnlyReview = Boolean(
+    input.workKind === undefined
+    && input.workRelation === 'new_goal'
+    && relatedLifecycleSource?.workKind === 'read_only_review'
+    && (relatedLifecycleSource.status === 'cancelled' || relatedLifecycleSource.status === 'completed' || relatedLifecycleSource.status === 'failed'),
+  );
+  if (
+    inheritedReadOnlyReview
+    && relatedLifecycleSource?.baseRevision
+    && ctx.sourceRevision
+    && relatedLifecycleSource.baseRevision !== ctx.sourceRevision
+  ) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `READ_ONLY_REVIEW_REPLACEMENT_SOURCE_DRIFT: replacement source ${ctx.sourceRevision} does not match frozen review base ${relatedLifecycleSource.baseRevision}.`,
+      data: { executionStarted: false, workContractCreated: false, relatedWorkId: relatedLifecycleSource.workId, sourceDrift: true },
+    });
+  }
+  const requestedWorkKind = input.workKind ?? (inheritedReadOnlyReview ? 'read_only_review' : undefined);
+  const typedReadOnlyReviewRequested = requestedWorkKind === undefined
+    && (input.modeInput.mutation === false || (input.modeInput.mutation === undefined && input.modeInput.risk === 'readonly'))
+    && input.modeInput.requiresInvestigation === true
+    && input.modeInput.requiresRecovery === true;
+  const effectiveWorkKind = requestedWorkKind ?? (typedReadOnlyReviewRequested ? 'read_only_review' : undefined);
+  const readOnlyReviewRequested = effectiveWorkKind === 'read_only_review';
+  const readOnlyMutationConflict = readOnlyReviewRequested && (
+    input.modeInput.mutation === true
+    || (input.modeInput.expectedFiles ?? 0) > 0
+    || (input.modeInput.expectedChangedLines ?? 0) > 0
+    || input.modeInput.requiresExternalEffect === true
+    || input.modeInput.remoteWrite === true
+    || input.modeInput.destructive === true
+  );
+  if (readOnlyMutationConflict) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: 'READ_ONLY_REVIEW_MUTATION_CONFLICT: read_only_review cannot request repository mutation, external effects, remote writes, or destructive execution.',
+      data: { executionStarted: false, workContractCreated: false, workKind: effectiveWorkKind },
+    });
+  }
   const effectiveModeInput: ExecutionModeSelectionInput = {
     ...input.modeInput,
     objective: input.objective,
     knownPaths: input.allowedPaths,
-    mutation: input.modeInput.mutation ?? input.modeInput.risk !== 'readonly',
+    workspacePlacement: placementConstraint.workspaceMode,
+    directMainProhibited: placementConstraint.directMainProhibited,
+    mutation: readOnlyReviewRequested ? false : input.modeInput.mutation ?? input.modeInput.risk !== 'readonly',
+    risk: readOnlyReviewRequested ? 'readonly' : input.modeInput.risk,
     approvalConfirmed: input.approvalConfirmed === true,
     requiresUserApproval: input.approvalConfirmed === true
       ? false
       : input.modeInput.requiresUserApproval === true || strategyConflictRequiresApproval,
   };
+  if (effectiveModeInput.explicitMode === 'scale' && (!input.planId || !input.planStepId || !ctx.planStore)) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: 'SCALE_PLAN_REQUIRED: explicit Scale execution requires a bound approved PlanContract step.',
+      data: { executionStarted: false, workContractCreated: false, planRequired: true, explicitMode: 'scale' },
+    });
+  }
   const applyForcedMode = (selected: ReturnType<typeof selectExecutionMode>) => input.forceMode
     ? {
         ...selected,
@@ -263,7 +331,7 @@ export function routeWorkStart(
     : selected;
   const evaluateAccessPolicy = (selected: ReturnType<typeof selectExecutionMode>) => evaluatePolicyGate({
     capabilityId: selected.mode === 'direct_control' ? 'repository.direct_edit' : selected.mode === 'goal_workloop' ? 'controller.goal_workloop' : 'controller.handoff_inbox',
-    risk: input.modeInput.risk
+    risk: effectiveModeInput.risk
       ?? (input.modeInput.secretAccess === true ? 'raw_secret_config'
         : input.modeInput.destructive === true ? 'destructive'
           : input.modeInput.remoteWrite === true ? 'remote_write'
@@ -283,12 +351,24 @@ export function routeWorkStart(
   });
 
   let selectedMode = selectExecutionMode(effectiveModeInput);
+  if (input.forceMode === 'direct_control' && selectedMode.routeDecision.requiresIsolation) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: 'WORKSPACE_PLACEMENT_DIRECT_CONTROL_FORBIDDEN: typed placement requires isolation, so force_mode=direct_control cannot override admission policy.',
+      data: { executionStarted: false, workContractCreated: false, routeDecision: selectedMode.routeDecision },
+      rawAvailable: false,
+    });
+  }
   let policy = evaluateAccessPolicy(selectedMode);
   if (policy.decision === 'allowed' && effectiveModeInput.requiresUserApproval !== true) {
     selectedMode = selectExecutionMode({ ...effectiveModeInput, approvalConfirmed: true });
     policy = evaluateAccessPolicy(selectedMode);
   }
   let mode = applyForcedMode(selectedMode);
+  const routeApprovalRequired = mode.routeDecision.requiresApproval
+    && mode.routeDecision.waitForUser
+    && mode.routeDecision.approvalState !== 'blocked_by_policy';
+  const approvalRequired = policy.decision === 'approval_required' || routeApprovalRequired;
 
   // Route Policy is the sole execution-depth authority. Existing Work is
   // ownership context, not a reason to upgrade an otherwise Direct operation
@@ -375,7 +455,7 @@ export function routeWorkStart(
       severity: policy.decision === 'denied' ? 'blocked' : 'needs_review',
       creationReason: !input.modeInput.scopeClear
         ? 'invalid_objective'
-        : policy.decision === 'approval_required'
+        : approvalRequired
           ? (input.modeInput.destructive ? 'destructive_action_requires_confirmation' : 'policy_approval_required')
           : 'missing_authorization',
       reason: mode.reason,
@@ -388,13 +468,13 @@ export function routeWorkStart(
       },
       attemptedActions: ['route_execution_mode'],
       evidenceRefs: [],
-      blockingDecision: policy.decision === 'approval_required'
+      blockingDecision: approvalRequired
         ? 'Approve side effects or restate a safer objective.'
         : 'Clarify objective, scope, and acceptance criteria.',
       recommendedDecision: 'Provide a clear objective and authorization, or cancel the request.',
       recommendedPrompt: `Resolve handoff and restate work for repo ${ctx.repoId}.`,
       recommendedContinuationPrompt: `After approval, start the approved work for ${ctx.repoId}.`,
-      approvalAction: policy.decision === 'approval_required'
+      approvalAction: approvalRequired
         ? {
             operation: 'start',
             label: 'Approve and start work',
@@ -415,6 +495,9 @@ export function routeWorkStart(
               requiresApproval: input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true,
               destructive: input.modeInput.destructive === true,
               accessMode: input.constraints?.accessMode,
+              workspaceMode: placementConstraint.workspaceMode,
+              requireWorktree: placementConstraint.requireWorktree,
+              directMainProhibited: placementConstraint.directMainProhibited,
               approvalConfirmed: true,
               forceMode: 'goal_workloop',
             },
@@ -432,7 +515,7 @@ export function routeWorkStart(
     });
 
     return buildFacadeResult({
-      status: policy.decision === 'denied' ? 'blocked' : policy.decision === 'approval_required' ? 'approval_required' : 'blocked',
+      status: policy.decision === 'denied' ? 'blocked' : approvalRequired ? 'approval_required' : 'blocked',
       summary: `Handoff-only: no WorkContract created and no execution started. ${mode.reason}`,
       data: {
         mode,
@@ -462,7 +545,12 @@ export function routeWorkStart(
     });
   }
 
-  return startGoalWorkloop(ctx, input, policy, 'goal_workloop', mode.routeDecision);
+  return startGoalWorkloop(ctx, {
+    ...input,
+    constraints: canonicalConstraints,
+    modeInput: effectiveModeInput,
+    workKind: effectiveWorkKind,
+  }, policy, 'goal_workloop', mode.routeDecision);
 }
 
 export function startGoalWorkloop(
@@ -472,9 +560,35 @@ export function startGoalWorkloop(
   executionMode: 'direct_control' | 'goal_workloop' = 'goal_workloop',
   routeDecision = selectExecutionMode({ ...input.modeInput, objective: input.objective, knownPaths: input.allowedPaths }).routeDecision,
 ): FacadeResult {
+  const placementResolution = resolveWorkspaceAdmissionConstraint(input.constraints);
+  if (placementResolution.ok === false) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `${placementResolution.code}: ${placementResolution.message}`,
+      data: { executionStarted: false, workContractCreated: false, placementConstraintConflict: true },
+      rawAvailable: false,
+    });
+  }
+  const placementConstraint = placementResolution.constraint;
+  const canonicalConstraints: WorkContract['constraints'] = {
+    ...(input.constraints ?? {}),
+    workspaceMode: placementConstraint.workspaceMode,
+    requireWorktree: placementConstraint.requireWorktree,
+    directMainProhibited: placementConstraint.directMainProhibited,
+  };
+  const hasStrongAdmissionBinding = Boolean(input.planId || input.planStepId || input.requirementId || input.relatedWorkId || input.workRelation);
+  if (hasStrongAdmissionBinding && !ctx.semanticAdmissionLocked) {
+    return withPrimaryWorkAdmissionLock(ctx.workStore, () => startGoalWorkloop(
+      { ...ctx, semanticAdmissionLocked: true },
+      input,
+      policy,
+      executionMode,
+      routeDecision,
+    ));
+  }
   const at = nowIso(ctx);
   const available = ctx.availableChecks ?? [];
-  const workspaceMode = input.constraints?.workspaceMode ?? 'auto';
+  const workspaceMode = placementConstraint.workspaceMode;
   const activeWorks = listWorkContracts({ ...ctx.workStore, status: 'active', limit: 100 })
     .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary');
   const workspaceOwner = ctx.checkoutId
@@ -487,6 +601,26 @@ export function startGoalWorkloop(
     : undefined;
   const plan = input.planId && ctx.planStore ? getPlanContract(ctx.planStore, input.planId) : undefined;
   const planStep = plan && input.planStepId ? plan.steps.find((step) => step.id === input.planStepId) : undefined;
+  const requestedRequirementId = input.requirementId?.trim() || undefined;
+  if (plan && requestedRequirementId && requestedRequirementId !== plan.requirementId) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `PLAN_REQUIREMENT_MISMATCH: ${plan.planId} is bound to ${plan.requirementId ?? 'no Requirement'}, not ${requestedRequirementId}. Use the Plan relationship authority or replan explicitly.`,
+      data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planRequirementId: plan.requirementId, requestedRequirementId },
+    });
+  }
+  const effectiveRequirementId = requestedRequirementId || plan?.requirementId;
+  if (
+    effectiveRequirementId
+    && ctx.workStore.controllerHome
+    && !readRequirement({ controllerHome: ctx.workStore.controllerHome }, effectiveRequirementId)
+  ) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `${plan ? 'PLAN' : 'WORK'}_REQUIREMENT_NOT_FOUND: ${effectiveRequirementId}. Create or reconcile the Requirement authority before admitting Work.`,
+      data: { executionStarted: false, workContractCreated: false, requirementId: effectiveRequirementId, planId: plan?.planId },
+    });
+  }
   const sameStringSet = (provided: string[] | undefined, frozen: string[]): boolean => {
     if (provided === undefined) return true;
     const actual = [...new Set(provided)].sort();
@@ -513,17 +647,23 @@ export function startGoalWorkloop(
   const effectiveForbiddenPaths = planStep?.forbiddenPaths ?? input.forbiddenPaths ?? [];
   const effectiveChecks = planStep?.checks ?? input.checks ?? [];
   const normalized = normalizeCheckIds(effectiveChecks, available);
-  const planStepWork = planStep?.workId ? activeWorks.find((candidate) => candidate.workId === planStep.workId) : undefined;
-  const requirementWorks = input.requirementId
-    ? activeWorks.filter((candidate) => candidate.requirementId === input.requirementId)
+  const boundPlanStepWorks = input.planId && input.planStepId
+    ? activeWorks.filter((candidate) => candidate.planId === input.planId && candidate.planStepId === input.planStepId)
+    : [];
+  const explicitPlanStepWork = planStep?.workId ? activeWorks.find((candidate) => candidate.workId === planStep.workId) : undefined;
+  const planStepWork = explicitPlanStepWork ?? (boundPlanStepWorks.length === 1 ? boundPlanStepWorks[0] : undefined);
+  const requirementWorks = effectiveRequirementId
+    ? activeWorks.filter((candidate) => candidate.requirementId === effectiveRequirementId)
     : [];
-  const deterministicTarget = explicitRelatedWork ?? planStepWork ?? (requirementWorks.length === 1 ? requirementWorks[0] : undefined);
+  const deterministicTarget = input.relatedWorkId
+    ? explicitRelatedWork
+    : planStepWork ?? (requirementWorks.length === 1 ? requirementWorks[0] : undefined);
   const requestedRelation = input.workRelation ?? (input.modeInput.requiresParallelism === true ? 'parallel' : undefined);
   // Only strong semantic bindings participate in ownership resolution. An
   // unrelated active Work or a checkout writer is a placement fact, not a
   // semantic candidate for continue/extend/parallel/new_goal.
   const candidateWorks = [...new Map(
-    [explicitRelatedWork, planStepWork, ...requirementWorks]
+    [explicitRelatedWork, planStepWork, ...boundPlanStepWorks, ...requirementWorks]
       .filter((candidate): candidate is WorkContract => Boolean(candidate))
       .map((candidate) => [candidate.workId, candidate]),
   ).values()].slice(0, 8);
@@ -556,6 +696,27 @@ export function startGoalWorkloop(
     rawAvailable: false,
   });
 
+  if (boundPlanStepWorks.length > 1) {
+    return resolutionRequired(`PLAN_STEP_MULTIPLE_PRIMARY_WORKS: ${input.planId}/${input.planStepId} has ${boundPlanStepWorks.length} active primary Work records and requires repair before execution.`);
+  }
+  if (planStep?.workId && !explicitPlanStepWork) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `PLAN_STEP_BOUND_WORK_MISSING: ${input.planId}/${input.planStepId} is bound to ${planStep.workId}, but that Work is not active. Repair the exact binding; do not create a replacement Work.`,
+      data: { executionStarted: false, workContractCreated: false, planId: input.planId, planStepId: input.planStepId, boundWorkId: planStep.workId, repairRequired: true },
+      suggestedNextActions: [{
+        label: 'Diagnose exact Plan step binding',
+        tool: 'rh_work',
+        operation: 'repair',
+        payload: { plan_id: input.planId, plan_step_id: input.planStepId, repair_operation: 'diagnose', dry_run: true },
+        risk: 'readonly',
+        confidence: 'high',
+        reason: 'The Plan step has an exact Work identity but the active Work view cannot resolve it. Diagnose that binding before any replacement Work can be admitted.',
+      }],
+      rawAvailable: false,
+    });
+  }
+
   if ((input.requestedBy ?? 'chatgpt') === 'scheduler') {
     return resolutionRequired(
       deterministicTarget
@@ -587,7 +748,7 @@ export function startGoalWorkloop(
     }
     if (requestedRelation === 'extend' && deterministicTarget.planId) {
       return resolutionRequired(
-        `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${deterministicTarget.workId} is governed by Plan ${deterministicTarget.planId}; extend the authoritative Plan/Requirement before continuing rather than silently widening Work scope.`,
+        `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${deterministicTarget.workId} is governed by Plan ${deterministicTarget.planId}; record additional discovery in scopeEvidence, but update the authoritative Plan before widening policy or acceptance scope.`,
         deterministicTarget,
       );
     }
@@ -597,6 +758,15 @@ export function startGoalWorkloop(
           allowedPaths: [...new Set([...deterministicTarget.allowedPaths, ...(input.allowedPaths ?? [])])].slice(0, 50),
           forbiddenPaths: [...new Set([...deterministicTarget.forbiddenPaths, ...(input.forbiddenPaths ?? [])])].slice(0, 50),
           checks: [...new Set([...deterministicTarget.checks, ...normalized.validCheckIds])].slice(0, 30),
+          scopeEvidence: {
+            initialLikelyPaths: [...new Set([
+              ...(deterministicTarget.scopeEvidence?.initialLikelyPaths ?? deterministicTarget.allowedPaths),
+              ...(input.initialLikelyPaths ?? input.allowedPaths ?? []),
+            ])].slice(0, 100),
+            inspectedPaths: deterministicTarget.scopeEvidence?.inspectedPaths ?? [],
+            actualChangedPaths: deterministicTarget.scopeEvidence?.actualChangedPaths ?? [],
+            recordedAt: at,
+          },
           scopeSummary: `Extended serially: ${input.objective}`.slice(0, 500),
           continuationPrompt: `Continue work ${ctx.repoId}: ${deterministicTarget.objective.slice(0, 160)}. Additional requested scope: ${input.objective.slice(0, 500)}`,
         })
@@ -624,10 +794,10 @@ export function startGoalWorkloop(
   }
 
   const placementConflict = Boolean(workspaceOwner);
-  const needsWorktree = executionMode === 'goal_workloop' && (input.constraints?.requireWorktree
-    ?? (workspaceMode === 'isolated'
-      || placementConflict
-      || (workspaceMode === 'auto' && routeDecision.requiresIsolation === true)));
+  const needsWorktree = executionMode === 'goal_workloop' && (placementConstraint.requireWorktree
+    || placementConflict
+    || input.modeInput.requiresParallelism === true
+    || routeDecision.requiresIsolation === true);
   if (!needsWorktree && workspaceOwner) {
     return buildFacadeResult({
       status: 'blocked',
@@ -643,74 +813,98 @@ export function startGoalWorkloop(
     });
   }
   const generatedWorkId = workIdFor(input.objective);
-  let isolatedWorkspace: ReturnType<NonNullable<GoalWorkloopContext['materializeIsolatedWorkspace']>> | undefined;
-  if (needsWorktree) {
-    if (!ctx.materializeIsolatedWorkspace) {
-      return buildFacadeResult({ status: 'blocked', summary: 'ISOLATED_WORKSPACE_MATERIALIZER_REQUIRED: isolated Work cannot enter running state without a concrete managed checkout.', data: { executionStarted: false, workContractCreated: false, worktreeRequired: true } });
-    }
-    try {
-      isolatedWorkspace = ctx.materializeIsolatedWorkspace({ workId: generatedWorkId, title: input.objective, baseRef: ctx.sourceRevision });
-      if (!isolatedWorkspace.checkoutId || !isolatedWorkspace.root || isolatedWorkspace.checkoutId === ctx.checkoutId) {
-        throw new Error('ISOLATED_WORKSPACE_NOT_DISTINCT');
-      }
-    } catch (error) {
-      return buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? `ISOLATED_WORKSPACE_MATERIALIZATION_FAILED: ${error.message}` : 'ISOLATED_WORKSPACE_MATERIALIZATION_FAILED', data: { executionStarted: false, workContractCreated: false, worktreeRequired: true } });
-    }
-  }
   if (input.planId || input.planStepId) {
-    if (!input.planId || !input.planStepId || !ctx.planStore || !ctx.sourceRevision) {
-      return buildFacadeResult({ status: 'blocked', summary: 'PLAN_CONTEXT_REQUIRED: plan_id, plan_step_id and a current source revision are required.', data: { executionStarted: false } });
+    if (!input.planId || !input.planStepId || !ctx.planStore || !ctx.sourceRevision || !plan || !planStep) {
+      return buildFacadeResult({ status: 'blocked', summary: 'PLAN_CONTEXT_REQUIRED: plan_id, plan_step_id, an executable Plan step and a current source revision are required.', data: { executionStarted: false } });
     }
-    let claimed: PlanContract;
-    try {
-      claimed = claimPlanStepForWork(ctx.planStore, {
+    if (plan.status !== 'approved' && plan.status !== 'executing') {
+      return buildFacadeResult({ status: 'blocked', summary: `PLAN_NOT_EXECUTABLE: ${plan.planId} is ${plan.status}`, data: { executionStarted: false, planId: plan.planId } });
+    }
+    if (plan.sourceRevision !== ctx.sourceRevision) {
+      const invalidated = claimPlanStepForWork(ctx.planStore, {
         planId: input.planId,
         stepId: input.planStepId,
         workId: generatedWorkId,
         sourceRevision: ctx.sourceRevision,
       });
-    } catch (error) {
       return buildFacadeResult({
         status: 'blocked',
-        summary: error instanceof Error ? error.message : 'PLAN_STEP_CLAIM_FAILED',
-        data: { planId: input.planId, planStepId: input.planStepId, executionStarted: false },
+        summary: `PLAN_SOURCE_DRIFT: ${invalidated.planId} was invalidated because its source revision no longer matches. Replan before execution.`,
+        data: { planId: invalidated.planId, executionStarted: false, workContractCreated: false, replanRequired: true },
       });
     }
-    if (claimed.status === 'invalidated_by_drift') {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_SOURCE_DRIFT: ${claimed.planId} was invalidated because its source revision no longer matches. Replan before execution.`,
-        data: { planId: claimed.planId, executionStarted: false, replanRequired: true },
-      });
+    const unresolved = planStep.dependencies.filter((dependency) => plan.steps.find((candidate) => candidate.id === dependency)?.status !== 'completed');
+    if (unresolved.length > 0) {
+      return buildFacadeResult({ status: 'blocked', summary: `PLAN_STEP_DEPENDENCIES_PENDING: ${unresolved.join(', ')}`, data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planStepId: planStep.id } });
+    }
+    if (planStep.status === 'completed') {
+      return buildFacadeResult({ status: 'blocked', summary: `PLAN_STEP_ALREADY_COMPLETED: ${planStep.id}`, data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planStepId: planStep.id } });
     }
   }
+  const initialSuggestedNextActions = suggestedForWorkIdentity(
+    generatedWorkId,
+    normalized.validCheckIds,
+    normalized.suggestedNextActions,
+  );
+  // allowed_paths and initial_likely_paths are policy/discovery fences, not proof
+  // that this Work owns a repository mutation. External-effect Work therefore
+  // needs either an explicit repository_change semantic choice or concrete
+  // expected source-change evidence before Forge treats it as repository_change.
+  const repositoryChangeIntent = input.workKind === 'repository_change'
+    || (input.modeInput.expectedFiles ?? 0) > 0
+    || (input.modeInput.expectedChangedLines ?? 0) > 0;
+  const typedRecoverableReadOnlyReview = input.workKind === undefined
+    && input.modeInput.mutation === false
+    && input.modeInput.requiresInvestigation === true
+    && input.modeInput.requiresRecovery === true;
+  const resolvedWorkKind = input.workKind ?? (
+    typedRecoverableReadOnlyReview
+      ? 'read_only_review'
+      : input.modeInput.requiresExternalEffect === true
+        && !repositoryChangeIntent
+        ? (input.modeInput.remoteWrite === true ? 'remote_effect' : 'local_effect')
+        : 'repository_change'
+  );
+  const remoteDeliveryRequired = resolvedWorkKind === 'repository_change'
+    && input.modeInput.requiresExternalEffect === true
+    && input.modeInput.remoteWrite === true;
   const work = createWorkContract(ctx.workStore, {
     workId: generatedWorkId,
     repoId: ctx.repoId,
-    checkoutId: isolatedWorkspace?.checkoutId ?? ctx.checkoutId,
+    checkoutId: needsWorktree ? undefined : ctx.checkoutId,
     principalId: ctx.principalId,
     controllerInstanceId: ctx.controllerInstanceId,
-    baseRevision: isolatedWorkspace?.baseRevision ?? ctx.sourceRevision,
-    workspaceFingerprint: isolatedWorkspace ? undefined : ctx.workspaceFingerprint,
+    baseRevision: ctx.sourceRevision,
+    workspaceFingerprint: needsWorktree ? undefined : ctx.workspaceFingerprint,
     routeDecisionFingerprint: routeDecision.inputFingerprint,
     routeDecision,
     mode: executionMode,
     objective: input.objective,
     acceptanceCriteria: effectiveAcceptanceCriteria,
-    constraints: input.constraints ?? { requireHandoffOnAmbiguity: true },
+    constraints: {
+      ...canonicalConstraints,
+      ...(remoteDeliveryRequired ? { remoteDeliveryRequired: true } : {}),
+    },
     risk: workRiskFor(input),
-    workKind: input.modeInput.requiresExternalEffect === true && input.modeInput.remoteWrite === true
-      ? 'remote_effect'
-      : undefined,
+    // Remote delivery is a risk/effect dimension, not a reason to erase a
+    // repository-change Work's semantic identity. Pure external actions with no
+    // repository-change signal remain remote_effect and keep plugin receipt semantics.
+    workKind: resolvedWorkKind,
     status: 'running',
     phase: 'implementation',
     issueId: input.issueId,
     taskId: input.taskId,
-    requirementId: input.requirementId,
+    requirementId: effectiveRequirementId,
     planId: input.planId,
     planStepId: input.planStepId,
     planSourceRevision: input.planId ? ctx.sourceRevision : undefined,
     scopeSummary: input.modeInput.scopeClear ? 'scope declared at start' : 'scope incomplete',
+    scopeEvidence: {
+      initialLikelyPaths: [...new Set(input.initialLikelyPaths ?? effectiveAllowedPaths)].slice(0, 100),
+      inspectedPaths: [],
+      actualChangedPaths: [],
+      recordedAt: at,
+    },
     allowedPaths: effectiveAllowedPaths,
     forbiddenPaths: effectiveForbiddenPaths,
     checks: normalized.validCheckIds,
@@ -727,7 +921,7 @@ export function startGoalWorkloop(
         ? 'Isolation was explicitly requested or required for parallel execution.'
         : 'Current workspace is the stability-first default; isolation remains opt-in.',
     },
-    worktreeRef: isolatedWorkspace?.root,
+    worktreeRef: undefined,
     evidencePolicy: {
       defaultDetailLevel: 'summary',
       allowRawOptIn: true,
@@ -746,21 +940,39 @@ export function startGoalWorkloop(
     requestedBy: input.requestedBy ?? 'chatgpt',
     evidenceRefs: [initialEvidence(input.objective)],
     policyDecisions: policy ? [policy] : [],
-    suggestedNextActions: [],
+    suggestedNextActions: initialSuggestedNextActions,
     continuationPrompt: `Continue work ${ctx.repoId}: ${input.objective.slice(0, 200)}`,
   });
 
-  const suggested = suggestedForWork(work, normalized.suggestedNextActions);
-  const updated = updateWorkContract(ctx.workStore, work.workId, {
-    suggestedNextActions: suggested,
-    updatedAt: at,
-  });
+  if (input.planId && input.planStepId && ctx.planStore && ctx.sourceRevision) {
+    try {
+      const claimed = claimPlanStepForWork(ctx.planStore, {
+        planId: input.planId,
+        stepId: input.planStepId,
+        workId: work.workId,
+        sourceRevision: ctx.sourceRevision,
+      });
+      if (claimed.status === 'invalidated_by_drift') {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: `PLAN_SOURCE_DRIFT: ${claimed.planId} was invalidated because its source revision no longer matches. Repair or replan before execution.`,
+          data: { executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), planId: claimed.planId, canonicalWorkRetained: true, replanRequired: true },
+        });
+      }
+    } catch (error) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: error instanceof Error ? error.message : 'PLAN_STEP_CLAIM_FAILED',
+        data: { planId: input.planId, planStepId: input.planStepId, executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), canonicalWorkRetained: true },
+      });
+    }
+  }
 
   return buildFacadeResult({
     status: 'ok',
     summary: executionMode === 'direct_control'
-      ? `Direct-control Work lineage started as ${updated.workId}.`
-      : `Goal workloop started as ${updated.workId}.`,
+      ? `Direct-control Work lineage started as ${work.workId}.`
+      : `Goal workloop started as ${work.workId}.`,
     data: {
       mode: {
         mode: executionMode,
@@ -774,20 +986,20 @@ export function startGoalWorkloop(
         routeDecision,
       },
       workContractCreated: true,
-      work: summarizeWorkContract(updated),
-      worktreeRequired: updated.worktreePolicy.required,
+      work: summarizeWorkContract(work),
+      worktreeRequired: work.worktreePolicy.required,
       normalizedChecks: normalized,
       policy,
     },
-    evidenceRefs: updated.evidenceRefs,
+    evidenceRefs: work.evidenceRefs,
     warnings: normalized.warnings,
-    suggestedNextActions: suggested,
+    suggestedNextActions: initialSuggestedNextActions,
     rawAvailable: false,
   });
 }
 
 export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopContinueInput): FacadeResult {
-  const work = getWorkContract(ctx.workStore, input.workId);
+  let work = getWorkContract(ctx.workStore, input.workId);
   if (!work) {
     return buildFacadeResult({
       status: 'not_found',
@@ -814,78 +1026,339 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
+  if ((input.reviewFindings?.length ?? 0) > 0 && work.workKind !== 'read_only_review') {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `READ_ONLY_REVIEW_FINDINGS_KIND_REQUIRED: ${work.workId} is ${work.workKind}, not read_only_review.`,
+      data: { work: summarizeWorkContract(work), reviewFindingsRecorded: false },
+    });
+  }
+  if (work.workKind === 'read_only_review') {
+    const sourceIdentity = evaluateReadOnlyReviewSourceIdentity(work, ctx.sourceRevision, ctx.workspaceChangedPaths);
+    if (sourceIdentity.status !== 'complete') {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `READ_ONLY_REVIEW_SOURCE_IDENTITY_REQUIRED: ${sourceIdentity.reasons.join(' ')}`,
+        data: { work: summarizeWorkContract(work), sourceIdentityProven: false },
+      });
+    }
+  }
+
+  const explicitPolicyScope = input.allowedPaths !== undefined
+    || input.forbiddenPaths !== undefined
+    || input.checks !== undefined;
+  if (explicitPolicyScope) {
+    if (work.planId) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${work.workId} is governed by Plan ${work.planId}; continue cannot widen frozen policy scope. Replan the authoritative Plan instead.`,
+        data: { work: summarizeWorkContract(work), planId: work.planId, policyScopeUpdated: false },
+      });
+    }
+    const normalizedChecks = normalizeCheckIds(input.checks ?? [], ctx.availableChecks ?? []);
+    if (normalizedChecks.invalidCheckIds.length > 0) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_CHECKS_INVALID: ${normalizedChecks.invalidCheckIds.join(', ')}. Work scope was not updated.`,
+        data: { work: summarizeWorkContract(work), policyScopeUpdated: false, normalizedChecks },
+      });
+    }
+    work = updateWorkContract(ctx.workStore, work.workId, {
+      allowedPaths: [...new Set([...work.allowedPaths, ...(input.allowedPaths ?? [])])].slice(0, 50),
+      forbiddenPaths: [...new Set([...work.forbiddenPaths, ...(input.forbiddenPaths ?? [])])].slice(0, 50),
+      checks: [...new Set([...work.checks, ...normalizedChecks.validCheckIds])].slice(0, 30),
+      scopeEvidence: {
+        initialLikelyPaths: [...new Set([
+          ...(work.scopeEvidence?.initialLikelyPaths ?? work.allowedPaths),
+          ...(input.allowedPaths ?? []),
+        ])].slice(0, 100),
+        inspectedPaths: work.scopeEvidence?.inspectedPaths ?? [],
+        actualChangedPaths: work.scopeEvidence?.actualChangedPaths ?? [],
+        recordedAt: nowIso(ctx),
+      },
+      scopeSummary: `Continue adopted explicit policy scope for ${work.workId}.`.slice(0, 500),
+    });
+  }
+
+  if ((input.additionalLikelyPaths?.length ?? 0) > 0 || (input.inspectedPaths?.length ?? 0) > 0) {
+    work = recordWorkScopeEvidence(ctx.workStore, work.workId, {
+      initialLikelyPaths: input.additionalLikelyPaths,
+      inspectedPaths: input.inspectedPaths,
+    });
+  }
+  if ((input.acceptanceEvidence?.length ?? 0) > 0) {
+    if (work.workKind !== 'local_effect') {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_SEMANTIC_ACCEPTANCE_LOCAL_EFFECT_REQUIRED: ${work.workId} is ${work.workKind}.`,
+        data: { work: summarizeWorkContract(work), semanticAcceptanceRecorded: false },
+      });
+    }
+    const declaredCriteria = new Map(work.acceptanceCriteria.map((criterion) => [criterion.trim(), criterion]));
+    const availableEvidenceIds = new Set([
+      ...work.evidenceRefs.flatMap((evidence) => [evidence.evidenceId, evidence.artifactId])
+        .map((value) => value?.trim())
+        .filter((value): value is string => Boolean(value)),
+      ...(ctx.workBoundProcessEvidenceIds ?? []).map((value) => value.trim()).filter(Boolean),
+    ]);
+    const normalizedBindings: Array<{ criterion: string; evidenceIds: string[]; rationale: string }> = [];
+    for (const binding of input.acceptanceEvidence ?? []) {
+      const requestedCriterion = binding.criterion.trim();
+      const criterion = declaredCriteria.get(requestedCriterion);
+      if (!criterion) {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: `WORK_SEMANTIC_ACCEPTANCE_CRITERION_UNKNOWN: ${requestedCriterion || '<empty>'}.`,
+          data: { work: summarizeWorkContract(work), semanticAcceptanceRecorded: false },
+        });
+      }
+      const evidenceIds = [...new Set(binding.evidenceIds.map((value) => value.trim()).filter(Boolean))];
+      if (evidenceIds.length === 0) {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: `WORK_SEMANTIC_ACCEPTANCE_EVIDENCE_REQUIRED: ${criterion}.`,
+          data: { work: summarizeWorkContract(work), semanticAcceptanceRecorded: false },
+        });
+      }
+      const unknownEvidenceIds = evidenceIds.filter((evidenceId) => !availableEvidenceIds.has(evidenceId));
+      if (unknownEvidenceIds.length > 0) {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: `WORK_SEMANTIC_ACCEPTANCE_EVIDENCE_UNKNOWN: ${unknownEvidenceIds.join(', ')}.`,
+          data: { work: summarizeWorkContract(work), semanticAcceptanceRecorded: false },
+        });
+      }
+      const rationale = binding.rationale.trim();
+      if (!rationale) {
+        return buildFacadeResult({
+          status: 'blocked',
+          summary: `WORK_SEMANTIC_ACCEPTANCE_RATIONALE_REQUIRED: ${criterion}.`,
+          data: { work: summarizeWorkContract(work), semanticAcceptanceRecorded: false },
+        });
+      }
+      normalizedBindings.push({ criterion, evidenceIds, rationale: rationale.slice(0, 1_000) });
+    }
+    const recordedAt = nowIso(ctx);
+    const byCriterion = new Map((work.semanticAcceptanceEvidence ?? []).map((review) => [review.criterion, review]));
+    for (const binding of normalizedBindings) {
+      const previous = byCriterion.get(binding.criterion);
+      byCriterion.set(binding.criterion, {
+        criterion: binding.criterion,
+        evidenceIds: [...new Set([...(previous?.evidenceIds ?? []), ...binding.evidenceIds])].slice(0, 50),
+        rationale: binding.rationale,
+        recordedAt,
+      });
+    }
+    work = updateWorkContract(ctx.workStore, work.workId, {
+      semanticAcceptanceEvidence: [...byCriterion.values()].slice(0, 20),
+    });
+    work = appendWorkEvidence(ctx.workStore, work.workId, {
+      title: 'Controller semantic acceptance review',
+      summary: `Controller reviewed ${normalizedBindings.length} exact acceptance criterion binding(s) against durable Work evidence.`,
+      detailLevel: 'summary',
+    });
+  }
+
+  if (work.workKind === 'read_only_review' && ((input.inspectedPaths?.length ?? 0) > 0 || input.reviewFindings !== undefined)) {
+    const findings = [...new Set([
+      ...(work.readOnlyReviewEvidence?.findings ?? []),
+      ...(input.reviewFindings ?? []).map((finding) => finding.trim()).filter(Boolean),
+    ])].slice(0, 50);
+    const inspectedPaths = [...new Set(work.scopeEvidence?.inspectedPaths ?? [])].slice(0, 200);
+    work = updateWorkContract(ctx.workStore, work.workId, {
+      readOnlyReviewEvidence: {
+        sourceRevision: ctx.sourceRevision!,
+        ...(ctx.workspaceFingerprint ? { workspaceFingerprint: ctx.workspaceFingerprint } : {}),
+        inspectedPaths,
+        findings,
+        recordedAt: nowIso(ctx),
+      },
+    });
+    for (const finding of input.reviewFindings ?? []) {
+      const summary = finding.trim();
+      if (!summary) continue;
+      work = appendWorkEvidence(ctx.workStore, work.workId, {
+        title: 'read-only review finding',
+        summary: summary.slice(0, 1_500),
+        detailLevel: 'summary',
+      });
+    }
+  }
+
+  const currentCheckRefs = work.checkRefs.filter((record) =>
+    verificationRecordAppliesToCurrentWorkspace(record, ctx.sourceRevision, ctx.workspaceFingerprint));
   const history = reconcileVerificationHistory(
-    work.checkRefs.map((record) => ({ checkId: record.checkId, outcome: record.outcome, recordedAt: record.recordedAt })),
+    currentCheckRefs.map((record) => ({ checkId: record.checkId, outcome: record.outcome, recordedAt: record.recordedAt })),
   );
 
-  // Ambiguous: acceptance failure present → handoff for ChatGPT review rather than pretend progress.
-  if (history.acceptanceFailures.length > 0 && work.recoveryPolicy.handoffOnAmbiguity) {
-    const continuation = buildWorkContinuationSnapshot(work);
-    const handoff = createHandoffItem(ctx.handoffStore, {
-      id: handoffIdFor('continue'),
-      repoId: ctx.repoId,
-      workId: work.workId,
-      title: 'Acceptance failure needs review',
-      severity: 'needs_review',
-      creationReason: 'ambiguous_outcome',
-      reason: `Acceptance checks failed: ${history.acceptanceFailures.join(', ')}`,
-      summary: 'Continue paused; ChatGPT must decide repair vs re-scope.',
-      currentState: {
-        repoId: ctx.repoId,
-        workId: work.workId,
-        mode: work.mode,
-        statusSummary: 'waiting_for_review after acceptance failure',
-        checks: history.acceptanceFailures.map((checkId) => ({ checkId, ok: false, outcome: 'valid_fail' as const })),
-        workSemantics: continuation.semantics,
-        reconciliationRequired: continuation.reconciliationRequired,
-        nextSafeAction: continuation.nextSafeAction,
-      },
-      attemptedActions: ['continue'],
-      evidenceRefs: work.evidenceRefs.slice(0, 5),
-      blockingDecision: 'Decide whether to repair code, adjust acceptance criteria, or stop.',
-      recommendedDecision: 'Inspect evidence and either repair or stop the workloop.',
-      recommendedPrompt: work.continuationPrompt ?? `Continue from work ${work.workId}.`,
-      recommendedContinuationPrompt: continuation.continuationPrompt,
-      suggestedNextActions: [
-        {
-          label: 'Read work context',
-          tool: 'rh_context',
-          operation: 'get',
-          payload: { work_id: work.workId },
-          risk: 'readonly',
-        },
-      ],
+  const explicitAcceptanceRepair = history.acceptanceFailures.length > 0
+    && (input.acceptanceFailureDecision === 'repair' || input.acceptanceFailureDecision === 'rescope');
+  if (explicitAcceptanceRepair) {
+    const decision = input.acceptanceFailureDecision!;
+    work = appendWorkEvidence(ctx.workStore, work.workId, {
+      title: 'Controller acceptance-failure continuation decision',
+      summary: `Controller explicitly chose bounded ${decision} after deterministic acceptance failure: ${history.acceptanceFailures.join(', ')}.`,
+      detailLevel: 'summary',
     });
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'ready',
-      phase: 'verification',
-      state: 'blocked',
-      summary: `Acceptance failure requires review through handoff ${handoff.id}.`,
+      status: 'running',
+      phase: 'implementation',
+      state: 'active',
+      summary: `Controller chose bounded ${decision} after acceptance failure; implementation may resume before re-verification.`,
       evidenceRefs: work.evidenceRefs,
     });
-    const updated = appendWorkHandoffRef(ctx.workStore, work.workId, handoff.id);
-
+    work = getWorkContract(ctx.workStore, work.workId) ?? work;
     return buildFacadeResult({
-      status: 'blocked',
-      summary: `Continue paused for ChatGPT review; handoff ${handoff.id} created. No background execution pretended.`,
+      status: 'ok',
+      summary: `Continue accepted explicit bounded ${decision} decision after acceptance failure; implementation may resume.`,
       data: {
-        work: summarizeWorkContract(updated),
-        handoffId: handoff.id,
+        work: summarizeWorkContract(work),
         acceptanceFailures: history.acceptanceFailures,
         infrastructureIssues: history.infrastructureIssues,
         backgroundCompleted: false,
+        nextStep: work.workKind === 'read_only_review' ? 'review' : 'execute',
+        acceptanceFailureDecision: decision,
       },
       evidenceRefs: work.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [
-        {
+      suggestedNextActions: suggestedForWork(work),
+    });
+  }
+
+  // Ambiguous acceptance failure without an explicit bounded Controller decision →
+  // ask once per distinct failure evidence. Repeated continue calls must not
+  // manufacture an unbounded handoff loop. A resolved handoff remains the decision
+  // authority until newer valid-fail evidence; an unresolved matching handoff is reused.
+  if (history.acceptanceFailures.length > 0 && !explicitAcceptanceRepair && work.recoveryPolicy.handoffOnAmbiguity) {
+    const failureReason = `Acceptance checks failed: ${history.acceptanceFailures.join(', ')}`;
+    const latestFailureAt = work.checkRefs
+      .filter((record) => record.outcome === 'valid_fail' && history.acceptanceFailures.includes(record.checkId))
+      .map((record) => record.recordedAt)
+      .sort((left, right) => right.localeCompare(left))[0];
+    const matchingHandoffs = listHandoffItems({ ...ctx.handoffStore, status: 'all', limit: 100 })
+      .filter((item) => (
+        item.workId === input.workId
+        && item.creationReason === 'ambiguous_outcome'
+        && item.title === 'Acceptance failure needs review'
+        && item.reason === failureReason
+        && (!latestFailureAt || item.createdAt >= latestFailureAt)
+      ));
+    const activeHandoff = matchingHandoffs.find((item) => item.status === 'pending' || item.status === 'acknowledged');
+    if (activeHandoff) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `Continue remains paused for ChatGPT review through existing handoff ${activeHandoff.id}.`,
+        data: {
+          work: summarizeWorkContract(work),
+          handoffId: activeHandoff.id,
+          acceptanceFailures: history.acceptanceFailures,
+          infrastructureIssues: history.infrastructureIssues,
+          backgroundCompleted: false,
+        },
+        evidenceRefs: work.evidenceRefs.slice(0, 5),
+        suggestedNextActions: [{
           label: 'Get handoff',
           tool: 'rh_inbox',
           operation: 'get',
-          payload: { handoff_id: handoff.id },
+          payload: { handoff_id: activeHandoff.id },
           risk: 'readonly',
           confidence: 'high',
+        }],
+      });
+    }
+
+    const resolvedHandoff = matchingHandoffs.find((item) => item.status === 'resolved');
+    if (!resolvedHandoff) {
+      const continuation = buildWorkContinuationSnapshot(work);
+      const handoff = createHandoffItem(ctx.handoffStore, {
+        id: handoffIdFor('continue'),
+        repoId: ctx.repoId,
+        workId: work.workId,
+        title: 'Acceptance failure needs review',
+        severity: 'needs_review',
+        creationReason: 'ambiguous_outcome',
+        reason: failureReason,
+        summary: 'Continue paused; ChatGPT must decide repair vs re-scope.',
+        currentState: {
+          repoId: ctx.repoId,
+          workId: work.workId,
+          mode: work.mode,
+          statusSummary: 'waiting_for_review after acceptance failure',
+          checks: history.acceptanceFailures.map((checkId) => ({ checkId, ok: false, outcome: 'valid_fail' as const })),
+          workSemantics: continuation.semantics,
+          reconciliationRequired: continuation.reconciliationRequired,
+          nextSafeAction: continuation.nextSafeAction,
         },
-      ],
+        attemptedActions: ['continue'],
+        evidenceRefs: work.evidenceRefs.slice(0, 5),
+        blockingDecision: 'Decide whether to repair code, adjust acceptance criteria, or stop.',
+        recommendedDecision: 'Inspect evidence and either repair or stop the workloop.',
+        recommendedPrompt: work.continuationPrompt ?? `Continue from work ${work.workId}.`,
+        recommendedContinuationPrompt: continuation.continuationPrompt,
+        suggestedNextActions: [
+          {
+            label: 'Read work context',
+            tool: 'rh_context',
+            operation: 'get',
+            payload: { work_id: work.workId },
+            risk: 'readonly',
+          },
+        ],
+      });
+      transitionWorkContractPhase(ctx.workStore, work.workId, {
+        status: 'ready',
+        phase: 'verification',
+        state: 'blocked',
+        summary: `Acceptance failure requires review through handoff ${handoff.id}.`,
+        evidenceRefs: work.evidenceRefs,
+      });
+      const updated = appendWorkHandoffRef(ctx.workStore, work.workId, handoff.id);
+
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `Continue paused for ChatGPT review; handoff ${handoff.id} created. No background execution pretended.`,
+        data: {
+          work: summarizeWorkContract(updated),
+          handoffId: handoff.id,
+          acceptanceFailures: history.acceptanceFailures,
+          infrastructureIssues: history.infrastructureIssues,
+          backgroundCompleted: false,
+        },
+        evidenceRefs: work.evidenceRefs.slice(0, 5),
+        suggestedNextActions: [
+          {
+            label: 'Get handoff',
+            tool: 'rh_inbox',
+            operation: 'get',
+            payload: { handoff_id: handoff.id },
+            risk: 'readonly',
+            confidence: 'high',
+          },
+        ],
+      });
+    }
+
+    transitionWorkContractPhase(ctx.workStore, work.workId, {
+      status: 'running',
+      phase: 'verification',
+      state: 'active',
+      summary: `Resolved acceptance-failure handoff ${resolvedHandoff.id} authorizes bounded continuation to re-verification.`,
+      evidenceRefs: work.evidenceRefs,
+    });
+    work = getWorkContract(ctx.workStore, work.workId) ?? work;
+    return buildFacadeResult({
+      status: 'ok',
+      summary: `Continue accepted resolved acceptance-failure handoff ${resolvedHandoff.id}; re-verification may resume.`,
+      data: {
+        work: summarizeWorkContract(work),
+        handoffId: resolvedHandoff.id,
+        acceptanceFailures: history.acceptanceFailures,
+        infrastructureIssues: history.infrastructureIssues,
+        backgroundCompleted: false,
+        nextStep: 'verify',
+        remainingChecks: history.acceptanceFailures,
+      },
+      evidenceRefs: work.evidenceRefs.slice(0, 5),
+      suggestedNextActions: suggestedForWork(work),
     });
   }
 
@@ -927,6 +1400,47 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
+  const implementationEvidence = evaluateWorkImplementationEvidence(work, ctx.workspaceChangedPaths);
+  if (implementationEvidence.status !== 'complete') {
+    const suggested = validateSuggestedNextActions([
+      {
+        label: 'Implement the repository change before verification',
+        tool: 'rh_context',
+        operation: 'get',
+        payload: { work_id: work.workId },
+        risk: 'readonly',
+        confidence: 'high',
+        reason: 'Verification proves behavior only after the repository-change Work has current source changes.',
+      },
+    ]).actions;
+    transitionWorkContractPhase(ctx.workStore, work.workId, {
+      status: 'running',
+      phase: 'implementation',
+      state: 'active',
+      summary: implementationEvidence.reasons.join(' '),
+      evidenceRefs: work.evidenceRefs,
+    });
+    const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: `Continue requires implementation before verification. ${implementationEvidence.reasons.join(' ')}`,
+      data: {
+        work: summarizeWorkContract(updated),
+        backgroundCompleted: false,
+        nextStep: 'execute',
+        implementationEvidencePresent: false,
+        workspaceChangedPaths: implementationEvidence.changedPaths,
+      },
+      suggestedNextActions: suggested,
+    });
+  }
+
+  if (implementationEvidence.changedPaths.length > 0) {
+    recordWorkScopeEvidence(ctx.workStore, work.workId, {
+      actualChangedPaths: implementationEvidence.changedPaths,
+    });
+  }
+
   if (work.checks.length > 0 && history.validPasses.length < work.checks.length) {
     const remaining = work.checks.filter((checkId) => !history.validPasses.includes(checkId));
     const suggested = validateSuggestedNextActions(
@@ -966,7 +1480,13 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  const completionEvidence = evaluateWorkCompletionEvidence(work, history);
+  const completionEvidence = evaluateWorkCompletionEvidence(
+    work,
+    ctx.sourceRevision,
+    ctx.workspaceFingerprint,
+    ctx.workBoundProcessEvidenceIds,
+    ctx.workspaceChangedPaths,
+  );
   if (completionEvidence.status !== 'complete') {
     const suggested = validateSuggestedNextActions([
       {
@@ -981,9 +1501,11 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     ]).actions;
     transitionWorkContractPhase(ctx.workStore, work.workId, {
       status: 'running',
-      phase: 'implementation',
+      phase: work.workKind === 'read_only_review' ? 'verification' : 'implementation',
       state: 'active',
-      summary: `Meaningful implementation evidence is still missing: ${completionEvidence.reasons.join(' ')}`,
+      summary: work.workKind === 'read_only_review'
+        ? `Read-only review completion evidence is incomplete: ${completionEvidence.reasons.join(' ')}`
+        : `Meaningful implementation evidence is still missing: ${completionEvidence.reasons.join(' ')}`,
       evidenceRefs: work.evidenceRefs,
     });
     const updated = updateWorkContract(ctx.workStore, work.workId, {
@@ -996,7 +1518,7 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
         work: summarizeWorkContract(updated),
         backgroundCompleted: false,
         nextStep: 'execute',
-        executionEvidencePresent: false,
+        executionEvidencePresent: Boolean(ctx.workBoundProcessEvidenceIds?.length),
         missingChecks: completionEvidence.missingChecks,
         durableResultEvidence: completionEvidence.durableResultEvidence,
         ignoredWeakReferences: {
@@ -1022,7 +1544,9 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     status: 'running',
     phase: 'delivery',
     state: 'active',
-    summary: 'Implementation and verification evidence are sufficient; exact delivery and cleanup receipt is next.',
+    summary: work.workKind === 'read_only_review'
+      ? 'Read-only review evidence is source-bound and clean; semantic no-change finalization is next.'
+      : 'Implementation and verification evidence are sufficient; exact delivery and cleanup receipt is next.',
     evidenceRefs: work.evidenceRefs,
   });
   const updated = updateWorkContract(ctx.workStore, work.workId, {
@@ -1058,16 +1582,60 @@ export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloop
     checkFailed: input.checkFailed,
     skipped: input.skipped,
   });
+  if (work.status === 'completed' || work.status === 'cancelled' || work.status === 'failed') {
+    const resolvedCheckId = classified.normalizedCheckId ?? classified.checkId;
+    const existing = [...work.checkRefs].reverse().find((record) => record.checkId === resolvedCheckId);
+    const completed = work.status === 'completed';
+    return buildFacadeResult({
+      status: completed ? 'ok' : 'blocked',
+      summary: `WorkContract ${work.workId} is terminal (${work.status}); verification was not re-executed.`,
+      data: {
+        work: summarizeWorkContract(work),
+        verification: {
+          checkId: resolvedCheckId,
+          ...(existing ? { outcome: existing.outcome } : {}),
+          terminal: true,
+          idempotent: true,
+          reexecuted: false,
+          isAcceptanceFailure: existing?.outcome === 'valid_fail',
+          isInfrastructureIssue: existing?.outcome === 'invalid_check_id' || existing?.outcome === 'infrastructure_failure',
+          doesNotRequestTaskChanges: existing?.outcome !== 'valid_fail',
+        },
+        backgroundCompleted: false,
+      },
+      evidenceRefs: existing?.evidenceRef ? [existing.evidenceRef] : [],
+      warnings: classified.warnings,
+      suggestedNextActions: [{ label: 'Inspect work via context', tool: 'rh_context', operation: 'get', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high' }],
+    });
+  }
 
   const at = nowIso(ctx);
+  const resolvedCheckId = classified.normalizedCheckId ?? classified.checkId;
+  const receipt = input.receipt
+    && input.receipt.repoId === work.repoId
+    && input.receipt.workId === work.workId
+    && input.receipt.checkId === resolvedCheckId
+    ? input.receipt
+    : undefined;
+  const sourceRevision = receipt && input.sourceRevision?.trim() ? input.sourceRevision.trim() : undefined;
+  const verificationSummary = receipt
+    ? `${classified.summary} Durable Process receipt ${receipt.receiptId}.`
+    : classified.summary;
   const record: VerificationRecord = {
-    checkId: classified.normalizedCheckId ?? classified.checkId,
+    checkId: resolvedCheckId,
     outcome: classified.outcome,
-    summary: classified.summary,
+    summary: verificationSummary,
     recordedAt: at,
+    sourceRevision,
+    workspaceFingerprint: receipt && sourceRevision ? input.workspaceFingerprint : undefined,
+    verificationInputFingerprint: receipt && sourceRevision ? input.verificationInputFingerprint : undefined,
+    commandFingerprint: receipt && sourceRevision ? input.commandFingerprint : undefined,
+    startedAt: receipt?.startedAt,
+    completedAt: receipt?.finishedAt,
+    receipt,
     evidenceRef: {
       title: `verification:${classified.outcome}`,
-      summary: classified.summary,
+      summary: verificationSummary,
       detailLevel: 'summary',
     },
   };
@@ -1097,12 +1665,16 @@ export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloop
         ? 'failed'
         : 'ok';
 
+  const completionEvidence = classified.outcome === 'valid_pass'
+    ? evaluateWorkCompletionEvidence(updated, sourceRevision, input.workspaceFingerprint)
+    : undefined;
+  const validPassReadyToFinalize = completionEvidence?.status === 'complete';
   const suggested = validateSuggestedNextActions(
     classified.outcome === 'valid_pass'
       ? [{
-          label: 'Continue workloop',
+          label: validPassReadyToFinalize ? 'Finalize work' : 'Continue workloop',
           tool: 'rh_work',
-          operation: 'continue',
+          operation: validPassReadyToFinalize ? 'finalize' : 'continue',
           payload: { work_id: work.workId },
           risk: 'readonly',
           confidence: 'high',
@@ -1141,6 +1713,9 @@ export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloop
         doesNotRequestTaskChanges: !classified.isAcceptanceFailure,
       },
       backgroundCompleted: false,
+      ...(classified.outcome === 'valid_pass'
+        ? { nextStep: validPassReadyToFinalize ? 'finalize' : 'continue' }
+        : {}),
     },
     warnings: classified.warnings,
     evidenceRefs: record.evidenceRef ? [record.evidenceRef] : [],
@@ -1189,7 +1764,13 @@ export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  const completionEvidence = evaluateWorkCompletionEvidence(work);
+  const completionEvidence = evaluateWorkCompletionEvidence(
+    work,
+    ctx.sourceRevision,
+    ctx.workspaceFingerprint,
+    ctx.workBoundProcessEvidenceIds,
+    ctx.workspaceChangedPaths,
+  );
   const history = completionEvidence.history;
 
   if (input.forceFailed || completionEvidence.status === 'failed') {
@@ -1264,6 +1845,91 @@ export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
+  // Read-only review completion is semantic no-change authority, not Git delivery.
+  // The exact source/workspace fence is re-evaluated above at finalize time; only
+  // a clean review with persisted inspected paths and zero findings can close.
+  if (work.workKind === 'read_only_review' && !work.completionReceipt) {
+    const reviewEvidence = work.readOnlyReviewEvidence!;
+    const recordedAt = nowIso(ctx);
+    const completed = completeWorkWithReceipt(
+      ctx.workStore,
+      work.workId,
+      {
+        schemaVersion: 1,
+        receiptId: `ROR-WORK-${randomUUID()}`,
+        source: 'read_only_review',
+        workId: work.workId,
+        baseRevision: work.baseRevision!,
+        sourceRevision: ctx.sourceRevision!,
+        ...(ctx.workspaceFingerprint ? { workspaceFingerprint: ctx.workspaceFingerprint } : {}),
+        workspaceChangedPaths: [],
+        inspectedPaths: reviewEvidence.inspectedPaths,
+        findingCount: 0,
+        recordedAt,
+      },
+      'completed_no_change',
+      'read_only_review',
+    );
+    if (completed.planId && completed.planStepId && ctx.planStore) {
+      completePlanStepForWork(ctx.planStore, { planId: completed.planId, stepId: completed.planStepId, work: completed });
+    }
+    return buildFacadeResult({
+      status: 'ok',
+      summary: `Finalize result: clean read-only review completed with no source change for ${work.workId}.`,
+      data: {
+        work: summarizeWorkContract(completed),
+        finalStatus: 'completed',
+        completionOutcome: 'completed_no_change',
+        completionReceipt: completed.completionReceipt,
+        inspectedPathCount: reviewEvidence.inspectedPaths.length,
+        hiddenFailure: false,
+      },
+      evidenceRefs: completed.evidenceRefs.slice(0, 5),
+      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
+    });
+  }
+
+  // For a controller-local effect Work, the semantic Controller's explicit
+  // finalize call is the terminalization decision, but it is admissible only
+  // after durable result evidence exists. Record one canonical Work receipt here
+  // instead of routing an effect-only Work through Git delivery. Remote effects
+  // remain bound to their durable plugin action receipt in the plugin layer.
+  if (work.workKind === 'local_effect' && !work.completionReceipt && completionEvidence.durableResultEvidence) {
+    const recordedAt = nowIso(ctx);
+    const completed = completeWorkWithReceipt(
+      ctx.workStore,
+      work.workId,
+      {
+        schemaVersion: 1,
+        receiptId: `LFX-WORK-${randomUUID()}`,
+        source: 'local_effect',
+        workId: work.workId,
+        operation: 'controller_work/local_effect',
+        target: { kind: 'controller_local', id: work.workId },
+        changed: true,
+        recordedAt,
+      },
+      'completed_local',
+      'local_effect',
+    );
+    if (completed.planId && completed.planStepId && ctx.planStore) {
+      completePlanStepForWork(ctx.planStore, { planId: completed.planId, stepId: completed.planStepId, work: completed });
+    }
+    return buildFacadeResult({
+      status: 'ok',
+      summary: `Finalize result: succeeded for ${work.workId}.`,
+      data: {
+        work: summarizeWorkContract(completed),
+        finalStatus: 'completed',
+        completionReceipt: completed.completionReceipt,
+        validPasses: history.validPasses,
+        hiddenFailure: false,
+      },
+      evidenceRefs: completed.evidenceRefs.slice(0, 5),
+      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
+    });
+  }
+
   // Checks and result evidence are necessary but not sufficient. Delivery and
   // cleanup must produce the exact Work-owned receipt before Work can become
   // terminal; a Run exit or a missing receipt is never completion authority.
@@ -1318,6 +1984,38 @@ export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopSt
     });
   }
 
+  const owner = ctx.workStore.controllerHome
+    ? getControllerSession({ controllerHome: ctx.workStore.controllerHome, repoId: ctx.repoId }, work.workId)
+    : undefined;
+  if (owner) {
+    const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
+    const ownerInstanceId = owner.controllerInstanceId?.trim();
+    const callerPrincipal = ctx.principalId?.trim();
+    const callerInstanceId = ctx.controllerInstanceId?.trim();
+    const sameAuthority = Boolean(
+      callerPrincipal
+      && ownerPrincipal === callerPrincipal
+      && (!ownerInstanceId || ownerInstanceId === callerInstanceId),
+    );
+    if (!sameAuthority) {
+      return buildFacadeResult({
+        status: 'blocked',
+        summary: `WORK_TERMINALIZATION_ACTIVE_CONTROLLER_FENCE: ${work.workId} has a newer active Controller claim generation ${owner.claimGeneration ?? 1}.`,
+        data: {
+          work: summarizeWorkContract(work),
+          activeController: {
+            controllerId: owner.controllerId,
+            principalId: ownerPrincipal,
+            controllerInstanceId: owner.controllerInstanceId,
+            sessionId: owner.sessionId,
+            claimGeneration: owner.claimGeneration ?? 1,
+          },
+          finalStatus: work.status,
+        },
+      });
+    }
+  }
+
   const destructiveCleanup = input.authorizeDestructiveCleanup === true;
   transitionWorkContractPhase(ctx.workStore, work.workId, {
     status: 'cancelled',
@@ -1334,9 +2032,17 @@ export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopSt
     // cleanup handler verifies ownership, cleanliness and successful removal.
     worktreeRef: work.worktreeRef,
   });
-  const plan = updated.planId && updated.planStepId && ctx.planStore
-    ? completePlanStepForWork(ctx.planStore, { planId: updated.planId, stepId: updated.planStepId, work: updated })
+  const planId = updated.planId;
+  const planStepId = updated.planStepId;
+  let plan = planId && ctx.planStore
+    ? getPlanContract(ctx.planStore, planId)
     : undefined;
+  if (plan && planId && planStepId && ctx.planStore) {
+    const step = plan.steps.find((entry) => entry.id === planStepId);
+    if (step?.workId === updated.workId) {
+      plan = completePlanStepForWork(ctx.planStore, { planId, stepId: planStepId, work: updated });
+    }
+  }
 
   return buildFacadeResult({
     status: 'ok',
@@ -1373,6 +2079,7 @@ export function runGoalWorkloop(
         objective: String(args.objective ?? ''),
         acceptanceCriteria: Array.isArray(args.acceptance_criteria) ? args.acceptance_criteria.map(String) : undefined,
         allowedPaths: Array.isArray(args.allowed_paths) ? args.allowed_paths.map(String) : undefined,
+        initialLikelyPaths: Array.isArray(args.initial_likely_paths) ? args.initial_likely_paths.map(String) : undefined,
         forbiddenPaths: Array.isArray(args.forbidden_paths) ? args.forbidden_paths.map(String) : undefined,
         checks: Array.isArray(args.check_ids) ? args.check_ids.map(String) : undefined,
         modeInput: {
@@ -1383,6 +2090,7 @@ export function runGoalWorkloop(
           requiresInvestigation: args.requires_investigation === true,
           requiresLongRunningChecks: args.requires_long_running_checks === true,
           requiresParallelism: args.requires_parallelism === true,
+          explicitMode: args.mode === 'scale' ? 'scale' : undefined,
           needsDependencies: args.needs_dependencies === true,
           requiresRecovery: args.requires_recovery === true,
           requiresWorker: args.requires_worker === true,
@@ -1402,13 +2110,43 @@ export function runGoalWorkloop(
         forceMode: args.force_mode === 'direct_control' || args.force_mode === 'goal_workloop' || args.force_mode === 'handoff_only'
           ? args.force_mode
           : undefined,
+        relatedWorkId: typeof args.related_work_id === 'string' ? args.related_work_id : undefined,
+        workRelation: args.work_relation === 'continue' || args.work_relation === 'extend' || args.work_relation === 'parallel' || args.work_relation === 'new_goal'
+          ? args.work_relation
+          : undefined,
+        requirementId: typeof args.requirement_id === 'string' ? args.requirement_id : undefined,
         planId: typeof args.plan_id === 'string' ? args.plan_id : undefined,
         planStepId: typeof args.plan_step_id === 'string' ? args.plan_step_id : undefined,
+        workKind: args.work_kind === 'repository_change'
+          || args.work_kind === 'completed_no_change'
+          || args.work_kind === 'read_only_review'
+          || args.work_kind === 'investigation'
+          || args.work_kind === 'local_effect'
+          || args.work_kind === 'remote_effect'
+          || args.work_kind === 'reconciliation'
+          ? args.work_kind
+          : undefined,
       });
     case 'continue':
       return continueGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),
         note: typeof args.note === 'string' ? args.note : undefined,
+        allowedPaths: Array.isArray(args.allowed_paths) ? args.allowed_paths.map(String) : undefined,
+        forbiddenPaths: Array.isArray(args.forbidden_paths) ? args.forbidden_paths.map(String) : undefined,
+        checks: Array.isArray(args.check_ids) ? args.check_ids.map(String) : undefined,
+        additionalLikelyPaths: Array.isArray(args.additional_likely_paths) ? args.additional_likely_paths.map(String) : undefined,
+        inspectedPaths: Array.isArray(args.inspected_paths) ? args.inspected_paths.map(String) : undefined,
+        reviewFindings: Array.isArray(args.review_findings) ? args.review_findings.map(String) : undefined,
+        acceptanceEvidence: Array.isArray(args.acceptance_evidence)
+          ? args.acceptance_evidence.filter((value): value is Record<string, unknown> => Boolean(value) && typeof value === 'object').map((value) => ({
+              criterion: typeof value.criterion === 'string' ? value.criterion : '',
+              evidenceIds: Array.isArray(value.evidence_ids) ? value.evidence_ids.map(String) : [],
+              rationale: typeof value.rationale === 'string' ? value.rationale : '',
+            }))
+          : undefined,
+        acceptanceFailureDecision: args.acceptance_failure_decision === 'repair' || args.acceptance_failure_decision === 'rescope'
+          ? args.acceptance_failure_decision
+          : undefined,
       });
     case 'verify':
       return verifyGoalWorkloop(ctx, {