@moretea-labs/forge 1.7.0 → 1.7.1

package/src/runtime/gateway/mcp/execution-tools.ts

@@ -1,54 +1,43 @@
-import { createHash, randomUUID } from 'crypto';
-import { existsSync, readFileSync, realpathSync } from 'fs';
-import { spawnSync } from 'child_process';
-import { basename, isAbsolute, relative, resolve } from 'path';
+import { existsSync, readFileSync } from 'fs';
 import type { McpToolDefinition, CallToolResult } from '../../../cli/mcp/tools';
-import type { CompletionReceipt } from '../../../cli/controller/types';
 import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
-import type { RepositoryRecord } from '../../../cli/repositories/types';
-import {
-  getRepository,
-  listRepositories,
-  resolveRepositorySelection,
-  selectRepositoryCheckout,
-  setRepositoryCheckoutLifecycle,
-} from '../../../cli/repositories/registry';
-import { withControllerLock } from '../../../cli/repositories/locks';
-import { repositoryGitCommit, repositoryGitDeleteBranch, repositoryGitFinishWorkflow, repositoryGitMergeBranch, repositoryGitRebaseOnto, repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
-import { previewRepositoryCommandExecution } from '../../../cli/repositories/command-executor';
-import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
-import { globMatches } from '../../../cli/mcp/paths';
-import { ensureManagedWorkspace } from '../../execution/managed-workspace';
-import { listControllerChecks, type ControllerCheck } from '../../../cli/controller/check-runner';
-import { readRepositoryAccessPolicy } from '../../control-plane/governance/access-policy';
-import { appendWorkEvidence, createWorkContract, getWorkContract, recordWorkCompletionReceipt, transitionWorkContractPhase, updateWorkContract, appendVerificationRecord } from '../../control-plane/facade/work-contract-store';
-import { completeRequirementFromWork } from '../../control-plane/persistence/requirement-store';
-import { isTerminalWorkContractStatus, type VerificationRecord, type WorkReconciliationRecord } from '../../control-plane/facade/types';
+import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
+import { listControllerChecks } from '../../../cli/controller/check-runner';
 import { buildWorkContinuationSnapshot } from '../../control-plane/facade/work-continuation';
-import { claimControllerSession, getControllerSession, releaseControllerSession, releaseControllerSessionWithAuthority, resumeControllerSession, withControllerSessionTerminalizationFence } from '../../control-plane/facade/controller-session-store';
-import { currentControllerInstanceId, requireExecutionSession, startExecutionSession, updateExecutionSession, type ExecutionSessionContext, type SessionIdentity } from '../../control-plane/execution/session-store';
+import { currentControllerInstanceId, startExecutionSession, type ExecutionSessionContext } from '../../control-plane/execution/session-store';
 import { currentPermissionSnapshotVersion, validateWorkHandle } from '../../control-plane/execution/validation';
-import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from '../../control-plane/execution/verification-evidence';
-import { assertExecutionIdentity, executionIdentityForWork, executionIdentityFromCoordinates, resolveLegacyWorkContractIdentity } from '../../control-plane/execution/execution-identity';
-import { withWorkPrepareRequest } from '../../control-plane/execution/work-prepare-request-store';
-import { markWorkHandleFailed, newWorkId, readWorkHandle, transitionWorkHandle, workDeliveryBaseRevision, writeWorkHandle, type WorkFinalizationStages, type WorkHandleState, type WorkTerminalOutcome } from '../../control-plane/execution/work-handle-store';
-import { cleanupTerminalWork } from '../../control-plane/execution/work-terminal-cleanup';
-import { pushExactWorkRemoteDelivery, type WorkRemoteDeliveryReceipt } from '../../control-plane/execution/work-remote-delivery';
-import { assertResolvedAuthorization, createGoalDelegation, decideAuthorization, resolveAuthorizationRequest, type AuthorizationDecision, type AuthorizationRiskClass } from '../../control-plane/governance/authorization';
-import { readControllerResult, searchControllerResult, writeControllerResult } from '../../evidence/result-store';
+import { resolveAuthorizationRequest } from '../../control-plane/governance/authorization';
+import { readControllerResult, searchControllerResult } from '../../evidence/result-store';
 import { resumeExecutionJobAfterApproval } from '../../execution/jobs/store';
 import { recordMcpTiming, type McpTimingTrace } from '../../diagnostics/mcp-timing';
-import { commandValue, normalizeRepositoryCommand, type RepositoryCommandValue } from '../../../cli/repositories/command-normalization';
-import { markRepositoryProjectionDirty } from '../../projections/invalidation';
-import { executeRepositoryCommandViaProcessRuntime } from '../../execution/process-runtime/command-facade';
-import { getCheckProcessHandle } from '../../execution/process-runtime/check-facade';
-import { processCheckCompletionReceipt } from '../../execution/process-runtime/check-receipt';
-import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
-import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
-import { runPersistedCheckViaProcessRuntime } from './persisted-check-process';
-import { hasCurrentWorkValidationAuthority, markWorkValidationPending, projectWorkValidationOutcome, reconcileWorkValidation } from './work-validation-reconciler';
-
-const MAX_INLINE_RESULT_BYTES = 64 * 1024;
+import { compactHandle, contractFor, identityFor, makeBoundedWorkResult, principalFor, requireSession, workForSession } from '../../control-plane/execution/work-execution-support';
+import { finalizeWork } from '../../control-plane/execution/work-finalization-service';
+import { bindSessionRepository, prepareWork } from '../../control-plane/execution/work-preparation-service';
+import { executeWork, validateWork } from '../../control-plane/execution/work-operation-service';
+
+
+// Compatibility exports: implementation authority lives in control-plane execution.
+export {
+  inspectWorkTargetAdvance,
+  targetAdvanceLinearMergeCommits,
+  planTargetAdvanceValidationAuthority,
+  targetAdvanceWorkScopeViolation,
+  inspectDirectTargetDelivery,
+  inspectTargetDirtyWorkOwnership,
+  inspectDirectCanonicalTargetAdvanceReconciliation,
+  completionReceiptChangedPaths,
+  inspectCleanupOnlyMergedHead,
+  resetFinalizationStagesForRequest,
+} from '../../control-plane/execution/work-finalization-service';
+export { releasePreparedWorkOwnership } from '../../control-plane/execution/work-execution-support';
+export { selectDefaultWorkValidationChecks } from '../../control-plane/execution/work-operation-service';
+export type {
+  DirectCanonicalTargetAdvanceInspection,
+  DirectTargetDeliveryInspection,
+  TargetAdvanceValidationTransferPlan,
+  TargetDirtyWorkOwnershipInspection,
+  WorkTargetAdvanceInspection,
+} from '../../control-plane/execution/work-finalization-service';
 
 function definition(name: string, description: string, properties: Record<string, unknown>, required: string[] = [], readOnlyHint = false, destructiveHint = false): McpToolDefinition {
   return { name, description, inputSchema: { type: 'object', properties, ...(required.length ? { required } : {}), additionalProperties: false }, annotations: { readOnlyHint, openWorldHint: false, destructiveHint } };
@@ -113,18 +102,6 @@ function failure(error: unknown): CallToolResult {
   return result({ error: { code, message } }, true);
 }
 
-function principalFor(ctx: MultiRepositoryMcpToolContext): string {
-  return ctx.principalId?.trim() || `controller-issued:${ctx.controllerInstanceId ?? currentControllerInstanceId()}`;
-}
-
-function identityFor(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): SessionIdentity {
-  return {
-    sessionId: typeof args.session_id === 'string' && args.session_id.trim() ? args.session_id.trim() : ctx.sessionId,
-    principalId: principalFor(ctx),
-    controllerInstanceId: ctx.controllerInstanceId ?? currentControllerInstanceId(),
-  };
-}
-
 function startOrResumeSession(ctx: MultiRepositoryMcpToolContext): ExecutionSessionContext {
   const permissionVersion = ctx.explicitRepository ? currentPermissionSnapshotVersion(ctx.controllerHome, ctx.explicitRepository.repoId) : 0;
   return startExecutionSession(ctx.controllerHome, {
@@ -136,1153 +113,6 @@ function startOrResumeSession(ctx: MultiRepositoryMcpToolContext): ExecutionSess
   });
 }
 
-function requireSession(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): ExecutionSessionContext {
-  return requireExecutionSession(ctx.controllerHome, identityFor(ctx, args));
-}
-
-function requireExplicitRepoId(args: Record<string, unknown>): string {
-  const value = typeof args.repo_id === 'string' ? args.repo_id.trim() : '';
-  if (!value) throw new Error('REPOSITORY_ID_REQUIRED: repository selection must be explicit for session binding');
-  return value;
-}
-
-function selectedRepository(ctx: MultiRepositoryMcpToolContext, session: ExecutionSessionContext, args: Record<string, unknown>, allowSession = true) {
-  const requested = typeof args.repo_id === 'string' && args.repo_id.trim() ? args.repo_id.trim() : undefined;
-  const selectedRepoId = requested ?? (allowSession ? session.activeRepositoryId : undefined);
-  if (!selectedRepoId) throw new Error('SESSION_REPOSITORY_REQUIRED: bind a repository before using this work tool');
-  if (session.activeRepositoryId && requested && session.activeRepositoryId !== requested) {
-    throw new Error('SESSION_REPOSITORY_MISMATCH: call session_bind_repository before switching repositories');
-  }
-  return resolveRepositorySelection({ repoId: selectedRepoId, checkoutId: typeof args.checkout_id === 'string' ? args.checkout_id : session.activeCheckoutId, controllerHome: ctx.controllerHome, allowSoleRepository: false });
-}
-
-function compactHandle(handle: WorkHandleState): Record<string, unknown> {
-  return {
-    workId: handle.workId, sessionId: handle.sessionId, repoId: handle.repositoryId, checkoutId: handle.checkoutId,
-    worktreePath: handle.worktreePath, branch: handle.branch, sourceCheckoutId: handle.sourceCheckoutId, goalId: handle.goalId, delegationVersion: handle.delegationVersion,
-    workContractId: handle.workContractId, baseCommit: handle.baseCommit, deliveryBaseCommit: handle.deliveryBaseCommit, expectedHead: handle.expectedHead,
-    permissionSnapshotVersion: handle.permissionSnapshotVersion, state: handle.state, managedWorktree: handle.managedWorktree,
-    createdAt: handle.createdAt, updatedAt: handle.updatedAt, finalization: handle.finalization,
-    ...(handle.failureReason ? { failureReason: handle.failureReason } : {}),
-    ...(handle.cleanupResponsibility ? { cleanupResponsibility: handle.cleanupResponsibility } : {}),
-    ...(handle.terminalResourceDisposition ? { terminalResourceDisposition: handle.terminalResourceDisposition } : {}),
-    ...(handle.cleanupReceipt ? { cleanupReceipt: handle.cleanupReceipt } : {}),
-  };
-}
-
-function initialStage(): WorkFinalizationStages {
-  return { validation: 'pending', commit: 'pending', merge: 'pending', branchCleanup: 'pending', worktreeCleanup: 'pending' };
-}
-
-function gitRevision(root: string, revision: string): string | undefined {
-  const output = spawnSync('git', ['-C', root, 'rev-parse', '--verify', `${revision}^{commit}`], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000 });
-  return output.status === 0 && typeof output.stdout === 'string' && output.stdout.trim() ? output.stdout.trim() : undefined;
-}
-
-function gitHead(root: string): string | undefined {
-  return gitRevision(root, 'HEAD');
-}
-
-function gitCommit(root: string, revision: string, label: string): string {
-  const output = spawnSync('git', ['-C', root, 'rev-parse', '--verify', `${revision}^{commit}`], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (output.status !== 0 || output.error || typeof output.stdout !== 'string' || !output.stdout.trim()) {
-    throw new Error(`WORK_HEAD_ADOPTION_${label}_INVALID: ${revision}`);
-  }
-  return output.stdout.trim();
-}
-
-function gitChangedPaths(root: string, previousHead: string, candidateHead: string): string[] {
-  const output = spawnSync('git', ['-C', root, 'diff', '--name-only', '-z', previousHead, candidateHead], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000, maxBuffer: 8 * 1024 * 1024,
-  });
-  if (output.status !== 0 || output.error || typeof output.stdout !== 'string') {
-    throw new Error('WORK_HEAD_ADOPTION_CHANGED_PATHS_UNAVAILABLE');
-  }
-  return [...new Set(output.stdout.split('\0').filter(Boolean))].sort((left, right) => left.localeCompare(right));
-}
-
-function gitMergeBase(root: string, leftHead: string, rightHead: string): string {
-  const output = spawnSync('git', ['-C', root, 'merge-base', leftHead, rightHead], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (output.status !== 0 || output.error || typeof output.stdout !== 'string' || !output.stdout.trim()) {
-    throw new Error('WORK_HEAD_ADOPTION_SCOPE_BASE_UNAVAILABLE');
-  }
-  return output.stdout.trim();
-}
-
-function gitIsAncestor(root: string, ancestor: string, descendant: string): boolean {
-  const result = spawnSync('git', ['-C', root, 'merge-base', '--is-ancestor', ancestor, descendant], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (result.error || (result.status !== 0 && result.status !== 1)) {
-    throw new Error(`WORK_TARGET_ADVANCE_ANCESTRY_UNAVAILABLE: ${ancestor} -> ${descendant}`);
-  }
-  return result.status === 0;
-}
-
-export interface WorkTargetAdvanceInspection {
-  relation: 'candidate_contains_target' | 'target_contains_candidate' | 'diverged_clean' | 'diverged_conflict';
-  candidateHead: string;
-  targetHead: string;
-  mergeBase: string;
-  candidateChangedPaths: string[];
-  targetChangedPaths: string[];
-  mergedTree?: string;
-  detail?: string;
-}
-
-export function inspectWorkTargetAdvance(root: string, candidateRevision: string, targetRevision: string): WorkTargetAdvanceInspection {
-  const candidateHead = gitCommit(root, candidateRevision, 'TARGET_ADVANCE_CANDIDATE');
-  const targetHead = gitCommit(root, targetRevision, 'TARGET_ADVANCE_TARGET');
-  if (gitIsAncestor(root, targetHead, candidateHead)) {
-    return {
-      relation: 'candidate_contains_target', candidateHead, targetHead, mergeBase: targetHead,
-      candidateChangedPaths: gitChangedPaths(root, targetHead, candidateHead), targetChangedPaths: [],
-    };
-  }
-  if (gitIsAncestor(root, candidateHead, targetHead)) {
-    return {
-      relation: 'target_contains_candidate', candidateHead, targetHead, mergeBase: candidateHead,
-      candidateChangedPaths: [], targetChangedPaths: gitChangedPaths(root, candidateHead, targetHead),
-    };
-  }
-  const mergeBase = gitMergeBase(root, candidateHead, targetHead);
-  const candidateChangedPaths = gitChangedPaths(root, mergeBase, candidateHead);
-  const targetChangedPaths = gitChangedPaths(root, mergeBase, targetHead);
-  const preflight = spawnSync('git', ['-C', root, 'merge-tree', '--write-tree', candidateHead, targetHead], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000, maxBuffer: 512 * 1024,
-  });
-  if (preflight.error || (preflight.status !== 0 && preflight.status !== 1)) {
-    throw new Error(`WORK_TARGET_ADVANCE_PREFLIGHT_UNAVAILABLE: ${preflight.error?.message ?? preflight.stderr ?? 'merge-tree failed'}`);
-  }
-  if (preflight.status === 0) {
-    const mergedTree = typeof preflight.stdout === 'string' ? preflight.stdout.trim().split(/\s+/)[0] : undefined;
-    return {
-      relation: 'diverged_clean', candidateHead, targetHead, mergeBase, candidateChangedPaths, targetChangedPaths,
-      ...(mergedTree ? { mergedTree } : {}),
-    };
-  }
-  const detail = `${preflight.stdout ?? ''}\n${preflight.stderr ?? ''}`.trim().slice(0, 1_000);
-  return { relation: 'diverged_conflict', candidateHead, targetHead, mergeBase, candidateChangedPaths, targetChangedPaths, ...(detail ? { detail } : {}) };
-}
-
-export function targetAdvanceLinearMergeCommits(root: string, targetRevision: string, candidateRevision: string): string[] {
-  const targetHead = gitCommit(root, targetRevision, 'TARGET_ADVANCE_LINEAR_TARGET');
-  const candidateHead = gitCommit(root, candidateRevision, 'TARGET_ADVANCE_LINEAR_CANDIDATE');
-  const output = spawnSync('git', ['-C', root, 'rev-list', '--merges', `${targetHead}..${candidateHead}`], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000, maxBuffer: 512 * 1024,
-  });
-  if (output.status !== 0 || output.error || typeof output.stdout !== 'string') {
-    throw new Error('WORK_TARGET_ADVANCE_LINEAR_HISTORY_UNAVAILABLE: could not inspect candidate merge history');
-  }
-  return output.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
-}
-
-function normalizedReadScope(scope: string): string {
-  return scope.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '') || '.';
-}
-
-function pathIsWithinReadScope(path: string, scope: string): boolean {
-  const normalized = normalizedReadScope(scope);
-  return normalized === '.' || path === normalized || path.startsWith(`${normalized}/`);
-}
-
-function stableCheckDefinition(check: ControllerCheck | undefined): string | undefined {
-  if (!check) return undefined;
-  return JSON.stringify({
-    id: check.id,
-    command: check.command,
-    cwd: check.cwd,
-    timeoutMs: check.timeoutMs,
-    source: check.source,
-    effects: check.effects ?? null,
-  });
-}
-
-export interface TargetAdvanceValidationTransferPlan {
-  transferredRecords: VerificationRecord[];
-  reusableCheckIds: string[];
-  invalidatedCheckIds: string[];
-}
-
-export function planTargetAdvanceValidationAuthority(input: {
-  checkIds: string[];
-  checkRefs: VerificationRecord[];
-  checksBefore: ControllerCheck[];
-  checksAfter: ControllerCheck[];
-  candidateHead: string;
-  candidateWorkspaceFingerprint: string;
-  integratedHead: string;
-  integratedWorkspaceFingerprint: string;
-  targetChangedPaths: string[];
-  recordedAt?: string;
-}): TargetAdvanceValidationTransferPlan {
-  const beforeById = new Map(input.checksBefore.map((check) => [check.id, check]));
-  const afterById = new Map(input.checksAfter.map((check) => [check.id, check]));
-  const transferredRecords: VerificationRecord[] = [];
-  const reusableCheckIds: string[] = [];
-  const invalidatedCheckIds: string[] = [];
-  const recordedAt = input.recordedAt ?? new Date().toISOString();
-  for (const checkId of input.checkIds) {
-    const before = beforeById.get(checkId);
-    const after = afterById.get(checkId);
-    const reads = before?.effects?.reads;
-    const definitionUnchanged = stableCheckDefinition(before) !== undefined
-      && stableCheckDefinition(before) === stableCheckDefinition(after);
-    const readsGitHistory = before?.effects?.git !== undefined;
-    const targetTouchesReadScope = !reads || reads.length === 0
-      || input.targetChangedPaths.some((path) => reads.some((scope) => pathIsWithinReadScope(path, scope)));
-    const sourcePass = effectiveVerificationEvidence(input.checkRefs, {
-      sourceRevision: input.candidateHead,
-      workspaceFingerprint: input.candidateWorkspaceFingerprint,
-      checkId,
-      requestedChecks: input.checkIds,
-    }).find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))?.record;
-    if (!definitionUnchanged || readsGitHistory || targetTouchesReadScope || !sourcePass) {
-      invalidatedCheckIds.push(checkId);
-      continue;
-    }
-    const transferred: VerificationRecord = {
-      ...sourcePass,
-      summary: `Validation authority transferred across target advancement because target-only changes did not intersect check ${checkId} read inputs.`,
-      recordedAt,
-      sourceRevision: input.integratedHead,
-      workspaceFingerprint: input.integratedWorkspaceFingerprint,
-      verificationInputFingerprint: verificationInputFingerprint({
-        sourceRevision: input.integratedHead,
-        workspaceFingerprint: input.integratedWorkspaceFingerprint,
-        checkId,
-        requestedChecks: input.checkIds,
-      }),
-      evidenceRef: {
-        title: checkId,
-        summary: `Reused prior valid receipt after proving target-only path changes do not affect this check's declared inputs.`,
-        detailLevel: 'summary',
-      },
-    };
-    transferredRecords.push(transferred);
-    reusableCheckIds.push(checkId);
-  }
-  return { transferredRecords, reusableCheckIds, invalidatedCheckIds };
-}
-
-export function targetAdvanceWorkScopeViolation(
-  scope: { allowedPaths: string[]; forbiddenPaths: string[] } | undefined,
-  changedPaths: string[],
-): { kind: 'forbidden' | 'out_of_scope'; path: string } | undefined {
-  if (!scope) return undefined;
-  for (const path of changedPaths) {
-    if (scope.forbiddenPaths.some((pattern) => globMatches(pattern, path))) return { kind: 'forbidden', path };
-    if (scope.allowedPaths.length > 0 && !scope.allowedPaths.some((pattern) => globMatches(pattern, path))) {
-      return { kind: 'out_of_scope', path };
-    }
-  }
-  return undefined;
-}
-
-function replaceTargetAdvanceScopeEvidence(
-  ctx: MultiRepositoryMcpToolContext,
-  contract: NonNullable<ReturnType<typeof contractFor>>,
-  actualChangedPaths: string[],
-): void {
-  updateWorkContract({ controllerHome: ctx.controllerHome, repoId: contract.repoId }, contract.workId, {
-    scopeEvidence: {
-      initialLikelyPaths: contract.scopeEvidence?.initialLikelyPaths ?? contract.allowedPaths,
-      inspectedPaths: contract.scopeEvidence?.inspectedPaths ?? [],
-      actualChangedPaths: [...new Set(actualChangedPaths)].sort((left, right) => left.localeCompare(right)).slice(0, 500),
-      recordedAt: new Date().toISOString(),
-    },
-  });
-}
-
-export interface DirectTargetDeliveryInspection {
-  integrated: boolean;
-  reason: 'not_direct_target' | 'path_mismatch' | 'branch_mismatch' | 'dirty' | 'revision_unavailable' | 'not_reachable' | 'integrated';
-  expectedHead?: string;
-  targetHead?: string;
-}
-
-/**
- * Direct-edit Work may already be executing on the delivery branch. In that
- * case Git merge is not a delivery operation at all: the Work commit is
- * integrated once its exact expected revision remains reachable from the
- * target branch. Keep this proof deliberately strict so a feature Work or a
- * dirty/mismatched checkout still follows the normal fail-closed merge path.
- */
-export function inspectDirectTargetDelivery(
-  root: string,
-  worktreePath: string,
-  managedWorktree: boolean,
-  workBranch: string,
-  targetBranch: string,
-  expectedRevision: string | undefined,
-): DirectTargetDeliveryInspection {
-  if (managedWorktree || workBranch !== targetBranch) return { integrated: false, reason: 'not_direct_target' };
-  try {
-    if (realpathSync(root) !== realpathSync(worktreePath)) return { integrated: false, reason: 'path_mismatch' };
-  } catch {
-    return { integrated: false, reason: 'path_mismatch' };
-  }
-  const branch = spawnSync('git', ['-C', root, 'branch', '--show-current'], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (branch.status !== 0 || typeof branch.stdout !== 'string' || branch.stdout.trim() !== targetBranch) {
-    return { integrated: false, reason: 'branch_mismatch' };
-  }
-  const status = spawnSync('git', ['-C', root, 'status', '--porcelain'], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (status.status !== 0 || typeof status.stdout !== 'string' || status.stdout.trim()) {
-    return { integrated: false, reason: 'dirty' };
-  }
-  const expectedHead = expectedRevision ? gitRevision(root, expectedRevision) : undefined;
-  const targetHead = gitRevision(root, targetBranch);
-  if (!expectedHead || !targetHead) return { integrated: false, reason: 'revision_unavailable' };
-  if (!gitIsAncestor(root, expectedHead, targetHead)) {
-    return { integrated: false, reason: 'not_reachable', expectedHead, targetHead };
-  }
-  return { integrated: true, reason: 'integrated', expectedHead, targetHead };
-}
-
-function normalizedRequiredString(args: Record<string, unknown>, key: string): string | undefined {
-  return typeof args[key] === 'string' && args[key].trim() ? args[key].trim() : undefined;
-}
-
-function selectWorkFinalizationTarget(
-  repository: ReturnType<typeof getRepository>,
-  handle: Pick<WorkHandleState, 'sourceCheckoutId' | 'checkoutId'>,
-) {
-  const preferredCheckoutId = handle.sourceCheckoutId?.trim();
-  if (preferredCheckoutId) {
-    try {
-      return selectRepositoryCheckout(repository, preferredCheckoutId, { allowArchived: true });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      // Legacy Work can outlive the registry entry for the source checkout after
-      // an earlier partial cleanup. Git refs/worktree administration are
-      // repository-common operations, so fall back only for a positively
-      // identified missing/removed source checkout; all other errors fail closed.
-      if (!message.startsWith('CHECKOUT_NOT_ACTIVE:') && !message.startsWith('checkout not found for ')) throw error;
-    }
-  }
-  return repository;
-}
-
-function workReturnCheckoutId(
-  ctx: MultiRepositoryMcpToolContext,
-  handle: Pick<WorkHandleState, 'repositoryId' | 'sourceCheckoutId' | 'checkoutId'>,
-  fallbackCheckoutId?: string,
-): string | undefined {
-  const repository = getRepository(handle.repositoryId, ctx.controllerHome, { includeRemoved: true });
-  const target = selectWorkFinalizationTarget(repository, handle);
-  return target.activeCheckoutId ?? repository.activeCheckoutId ?? fallbackCheckoutId;
-}
-
-function exactCommitChangedPaths(repoRoot: string, revision: string): string[] {
-  const result = spawnSync('git', ['-C', repoRoot, 'diff-tree', '--root', '--no-commit-id', '--name-only', '-r', revision], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (result.status !== 0 || result.error || typeof result.stdout !== 'string') {
-    throw new Error(`WORK_COMPLETION_RECEIPT_COMMIT_PATHS_UNAVAILABLE: ${revision}`);
-  }
-  return Array.from(new Set(result.stdout.split('\n').map((entry) => entry.trim()).filter(Boolean)))
-    .sort((left, right) => left.localeCompare(right));
-}
-
-function workOwnedDirtyPaths(
-  contract: ReturnType<typeof contractFor>,
-  status: ReturnType<typeof repositoryGitStatus>,
-): { dirtyPaths: string[]; ownedPaths: string[] } {
-  const dirtyPaths = [...new Set([...status.staged, ...status.unstaged, ...status.untracked])]
-    .sort((left, right) => left.localeCompare(right));
-  if (!contract) return { dirtyPaths, ownedPaths: dirtyPaths };
-  const ownedPaths = dirtyPaths.filter((path) => {
-    if (contract.forbiddenPaths.some((pattern) => globMatches(pattern, path))) return false;
-    return contract.allowedPaths.length === 0 || contract.allowedPaths.some((pattern) => globMatches(pattern, path));
-  });
-  return { dirtyPaths, ownedPaths };
-}
-
-export function completionReceiptChangedPaths(repoRoot: string, baseRevision: string, deliveryRevision: string): string[] {
-  const result = spawnSync('git', ['-C', repoRoot, 'diff', '--name-only', `${baseRevision}..${deliveryRevision}`], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (result.status !== 0 || result.error || typeof result.stdout !== 'string') {
-    throw new Error(`WORK_COMPLETION_RECEIPT_CHANGED_PATHS_UNAVAILABLE: ${baseRevision}..${deliveryRevision}`);
-  }
-  return Array.from(new Set(result.stdout.split('\n').map((entry) => entry.trim()).filter(Boolean)))
-    .sort((left, right) => left.localeCompare(right));
-}
-
-function completionReceiptForFinalizedWork(
-  ctx: MultiRepositoryMcpToolContext,
-  handle: WorkHandleState,
-  contract: ReturnType<typeof contractFor>,
-  args: Record<string, unknown>,
-): CompletionReceipt {
-  const repository = getRepository(handle.repositoryId, ctx.controllerHome, { includeRemoved: true });
-  const target = selectWorkFinalizationTarget(repository, handle);
-  const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : repository.defaultBranch || 'main';
-  const targetRevision = gitRevision(target.canonicalRoot, targetBranch);
-  if (!targetRevision) throw new Error(`WORK_COMPLETION_RECEIPT_TARGET_REQUIRED: target branch ${targetBranch} is unavailable`);
-  const noChange = args.completion_outcome === 'completed_no_change';
-  // Delivery authority is always the Work's own revision, never the target
-  // branch's newest HEAD. The target may have advanced because of unrelated
-  // concurrent Work; targetRevision records integration identity, while
-  // deliveryRevision owns path attribution and reachability proof.
-  const deliveryRevision = handle.expectedHead ?? handle.baseCommit;
-  if (!deliveryRevision) throw new Error('WORK_COMPLETION_RECEIPT_SOURCE_REQUIRED: Work delivery revision is unavailable');
-  const reachable = deliveryRevision === targetRevision || spawnSync('git', ['-C', target.canonicalRoot, 'merge-base', '--is-ancestor', deliveryRevision, targetBranch], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  }).status === 0;
-  if (!reachable) throw new Error(`WORK_COMPLETION_RECEIPT_DELIVERY_NOT_PROVEN: ${deliveryRevision} is not reachable from ${targetBranch}`);
-  const deliveryBaseRevision = workDeliveryBaseRevision(handle);
-  const changedPaths = noChange
-    ? []
-    : !handle.managedWorktree && handle.finalization.commit === 'done'
-      ? exactCommitChangedPaths(target.canonicalRoot, deliveryRevision)
-      : deliveryBaseRevision
-        ? completionReceiptChangedPaths(target.canonicalRoot, deliveryBaseRevision, deliveryRevision)
-        : (() => { throw new Error('WORK_COMPLETION_RECEIPT_BASE_REQUIRED: Work delivery provenance base is unavailable'); })();
-  const recordedAt = new Date().toISOString();
-  const retainsExplicitDeliveryBranch = args.merge !== true && targetBranch === handle.branch;
-  const warnings = [
-    ...(handle.finalization.branchCleanup === 'skipped' && !retainsExplicitDeliveryBranch ? [{ code: 'cleanup_retained_by_request' as const, message: 'Branch cleanup was skipped by the finalization request.', resourceKind: 'branch' as const, resourceId: handle.branch, recordedAt }] : []),
-    ...(handle.finalization.worktreeCleanup === 'skipped' && handle.managedWorktree ? [{ code: 'cleanup_retained_by_request' as const, message: 'Managed worktree cleanup was skipped by the finalization request.', resourceKind: 'worktree' as const, resourceId: handle.worktreePath, recordedAt }] : []),
-  ];
-  return {
-    schemaVersion: 1,
-    receiptId: `REC-controller_work-${createHash('sha256').update(`${handle.workId}\0${targetRevision}`).digest('hex').slice(0, 16)}`,
-    source: 'controller_work',
-    issueId: contract?.issueId ?? 'work',
-    taskId: contract?.taskId ?? handle.workId,
-    workId: handle.workId,
-    targetBranch,
-    targetRevision,
-    sourceRevision: deliveryRevision,
-    baseRevision: handle.baseCommit,
-    changedPaths,
-    delivery: {
-      kind: noChange ? 'no_change' : 'commit',
-      status: 'integrated',
-      strategy: noChange ? 'no_change' : handle.finalization.commit === 'done' ? 'edit_session_commit' : 'already_integrated',
-      reachable: true,
-      recordedAt,
-    },
-    cleanup: {
-      status: warnings.length > 0 ? 'maintenance_warning' : 'complete',
-      warnings,
-      blockers: [],
-      recordedAt,
-    },
-    verifiedAt: recordedAt,
-    recordedAt,
-  };
-}
-
-function boundedStringArray(value: unknown, limit: number): string[] {
-  return Array.isArray(value) ? value.map(String).slice(0, limit) : [];
-}
-
-function workPrepareFingerprint(input: {
-  repoId: string;
-  requestedCheckoutId?: string;
-  isolation: 'reuse' | 'new_worktree' | 'auto';
-  objective: string;
-  goalId?: string;
-  acceptanceCriteria: string[];
-  allowedPaths: string[];
-  checks: string[];
-  baseRef?: string;
-  needsDependencies: boolean;
-}): string {
-  return createHash('sha256').update(JSON.stringify({ schemaVersion: 1, operation: 'work_prepare', ...input })).digest('hex');
-}
-
-function makeBoundedResult(ctx: MultiRepositoryMcpToolContext, session: ExecutionSessionContext, repoId: string, workIdValue: string | undefined, kind: 'inspection' | 'command' | 'validation' | 'finalization' | 'generic', value: Record<string, unknown>): Record<string, unknown> {
-  const serialized = JSON.stringify(value);
-  if (Buffer.byteLength(serialized, 'utf8') <= MAX_INLINE_RESULT_BYTES) return value;
-  const started = performance.now();
-  const stored = writeControllerResult({ controllerHome: ctx.controllerHome, repoId, sessionId: session.sessionId, principalId: session.principalId, workId: workIdValue, kind, value });
-  return {
-    summary: { itemCount: Array.isArray(value.items) ? value.items.length : undefined, truncated: true, warnings: ['Full result is available through the secure result reference.'] },
-    items: Array.isArray(value.items) ? value.items.slice(0, 25) : { preview: serialized.slice(0, 16_384) },
-    resultRef: stored.resultRef,
-    resultId: stored.resultId,
-    byteLength: stored.byteLength,
-    _resultPersistenceMs: Math.round((performance.now() - started) * 100) / 100,
-  };
-}
-
-function contractFor(ctx: MultiRepositoryMcpToolContext, handle: WorkHandleState) {
-  return handle.workContractId ? getWorkContract({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, handle.workContractId) : undefined;
-}
-
-function findWorkHandle(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  args: Record<string, unknown>,
-): WorkHandleState {
-  const requested = typeof args.work_id === 'string' ? args.work_id.trim() : '';
-  const workIdValue = requested || session.activeWorkId || '';
-  if (!workIdValue) throw new Error('WORK_ID_REQUIRED: provide work_id or call work_prepare first');
-  const requestedRepoId = typeof args.repo_id === 'string' && args.repo_id.trim() ? args.repo_id.trim() : undefined;
-  const requestedCheckoutId = typeof args.checkout_id === 'string' && args.checkout_id.trim()
-    ? args.checkout_id.trim()
-    : undefined;
-  const repoCandidates = [
-    requestedRepoId,
-    session.activeRepositoryId,
-  ].filter((value, index, values): value is string => Boolean(value) && values.indexOf(value) === index);
-  for (const repositoryId of repoCandidates) {
-    const handle = readWorkHandle(ctx.controllerHome, repositoryId, workIdValue);
-    if (!handle) continue;
-    if (requestedCheckoutId && handle.checkoutId !== requestedCheckoutId) {
-      throw new Error(
-        `WORK_HANDLE_CHECKOUT_DRIFT: work ${workIdValue} is bound to checkout ${handle.checkoutId}, not ${requestedCheckoutId}`,
-      );
-    }
-    return handle;
-  }
-  const matches = listRepositories(ctx.controllerHome, { includeRemoved: true })
-    .map((repository) => readWorkHandle(ctx.controllerHome, repository.repoId, workIdValue))
-    .filter((handle): handle is WorkHandleState => Boolean(handle));
-  // Legacy incomplete identity: only a unique exact WorkHandle match may execute.
-  return resolveLegacyWorkContractIdentity({
-    workId: workIdValue,
-    repoId: requestedRepoId,
-    checkoutId: requestedCheckoutId,
-    candidates: matches,
-  });
-}
-
-function currentControllerClaimAuthorizesTerminalCleanup(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  handle: WorkHandleState,
-): boolean {
-  if (!terminalCleanupOutcome(ctx, handle)) return false;
-  const workIdValue = handle.workContractId ?? handle.workId;
-  const owner = getControllerSession({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, workIdValue);
-  if (!owner) return false;
-  return (owner.principalId?.trim() || owner.controllerId) === session.principalId
-    && owner.controllerInstanceId === session.controllerInstanceId;
-}
-
-function workForSession(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  args: Record<string, unknown>,
-  options: { reconcileValidation?: boolean; allowClaimedTerminalCleanup?: boolean } = {},
-): WorkHandleState {
-  let handle = findWorkHandle(ctx, session, args);
-  if (
-    handle.principalId !== session.principalId
-    && !(options.allowClaimedTerminalCleanup === true && currentControllerClaimAuthorizesTerminalCleanup(ctx, session, handle))
-  ) throw new Error('WORK_HANDLE_PRINCIPAL_MISMATCH: work handle belongs to another principal');
-  if (options.reconcileValidation !== false) handle = reconcileWorkValidation(ctx.controllerHome, handle).handle;
-  if (
-    session.activeRepositoryId !== handle.repositoryId
-    || session.activeCheckoutId !== handle.checkoutId
-    || session.activeWorkId !== handle.workId
-  ) {
-    updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
-      activeRepositoryId: handle.repositoryId,
-      activeCheckoutId: handle.checkoutId,
-      activeWorkId: handle.workId,
-      permissionSnapshotVersion: handle.permissionSnapshotVersion,
-      lastValidatedAt: new Date().toISOString(),
-    });
-  }
-  return handle;
-}
-
-function assertWorkControllerOwnership(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  handle: WorkHandleState,
-  args: Record<string, unknown>,
-) {
-  const workIdValue = handle.workContractId ?? handle.workId;
-  const options = { controllerHome: ctx.controllerHome, repoId: handle.repositoryId };
-  const owner = getControllerSession(options, workIdValue);
-  const controllerId = typeof args.controller_id === 'string' && args.controller_id.trim()
-    ? args.controller_id.trim()
-    : session.principalId;
-  if (controllerId !== session.principalId) {
-    throw new Error('WORK_CONTROLLER_IDENTITY_MISMATCH: controller_id must match the authenticated principal');
-  }
-  if (owner) {
-    const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
-    const ownerInstanceId = owner.controllerInstanceId?.trim() || '';
-    if (owner.controllerId !== controllerId) throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workIdValue} is owned by ${owner.controllerId}`);
-    if (ownerPrincipal !== session.principalId) throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workIdValue}`);
-    if (!ownerInstanceId || ownerInstanceId !== session.controllerInstanceId) throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workIdValue}`);
-    if (typeof owner.claimGeneration !== 'number' || owner.claimGeneration < 1) throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workIdValue}`);
-    const resumed = resumeControllerSession(options, {
-      workId: workIdValue,
-      controllerId,
-      controllerType: owner.controllerType,
-      sessionId: session.sessionId,
-      principalId: session.principalId,
-      controllerInstanceId: session.controllerInstanceId,
-      expectedClaimGeneration: owner.claimGeneration,
-      leaseMs: 3_600_000,
-    });
-    if (
-      resumed.controllerId !== controllerId
-      || resumed.principalId !== session.principalId
-      || resumed.controllerInstanceId !== session.controllerInstanceId
-      || resumed.claimGeneration !== owner.claimGeneration
-    ) {
-      throw new Error(`WORK_CONTROLLER_OWNER_MISMATCH: ${workIdValue} ownership epoch changed during resume`);
-    }
-    return resumed;
-  }
-  return claimControllerSession(options, {
-    workId: workIdValue,
-    controllerId,
-    controllerType: 'chatgpt',
-    sessionId: session.sessionId,
-    principalId: session.principalId,
-    controllerInstanceId: session.controllerInstanceId,
-    expectedClaimGeneration: 0,
-    leaseMs: 3_600_000,
-  });
-}
-
-function claimPreparedWorkOwnership(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  handle: WorkHandleState,
-  args: Record<string, unknown>,
-): void {
-  const workIdValue = handle.workContractId ?? handle.workId;
-  const controllerId = typeof args.controller_id === 'string' && args.controller_id.trim()
-    ? args.controller_id.trim()
-    : session.principalId;
-  claimControllerSession({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, {
-    workId: workIdValue,
-    controllerId,
-    controllerType: 'chatgpt',
-    sessionId: session.sessionId,
-    principalId: session.principalId,
-    controllerInstanceId: session.controllerInstanceId,
-    leaseMs: 3_600_000,
-  });
-}
-
-function claimHeadAdoptionOwnership(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  handle: WorkHandleState,
-  args: Record<string, unknown>,
-): void {
-  const workIdValue = handle.workContractId ?? handle.workId;
-  const controllerId = normalizedRequiredString(args, 'controller_id') ?? session.principalId;
-  if (controllerId !== session.principalId) {
-    throw new Error('WORK_CONTROLLER_IDENTITY_MISMATCH: controller_id must match the authenticated principal');
-  }
-  const options = { controllerHome: ctx.controllerHome, repoId: handle.repositoryId };
-  const current = getControllerSession(options, workIdValue);
-  const input = {
-    workId: workIdValue,
-    controllerId,
-    controllerType: current?.controllerType ?? 'chatgpt' as const,
-    sessionId: session.sessionId,
-    principalId: session.principalId,
-    controllerInstanceId: session.controllerInstanceId,
-    expectedClaimGeneration: current?.claimGeneration ?? 0,
-    leaseMs: 3_600_000,
-  };
-  const claimed = current
-    ? resumeControllerSession(options, input)
-    : claimControllerSession(options, input);
-  if (
-    claimed.controllerId !== controllerId
-    || claimed.sessionId !== session.sessionId
-    || claimed.principalId !== session.principalId
-    || claimed.controllerInstanceId !== session.controllerInstanceId
-    || (claimed.claimGeneration ?? 0) < 1
-  ) {
-    throw new Error('WORK_HEAD_ADOPTION_OWNERSHIP_FENCE_MISMATCH');
-  }
-}
-
-function adoptExistingWorkHead(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  repository: RepositoryRecord,
-  handle: WorkHandleState,
-  args: Record<string, unknown>,
-): Record<string, unknown> | undefined {
-  const previousInput = normalizedRequiredString(args, 'expected_previous_head');
-  const candidateInput = normalizedRequiredString(args, 'adopt_candidate_head');
-  if (!previousInput && !candidateInput) return undefined;
-  if (!previousInput || !candidateInput) {
-    throw new Error('WORK_HEAD_ADOPTION_ARGUMENTS_REQUIRED: expected_previous_head and adopt_candidate_head must be provided together');
-  }
-  const requestedCheckoutId = normalizedRequiredString(args, 'checkout_id');
-  if (!requestedCheckoutId) throw new Error('WORK_HEAD_ADOPTION_CHECKOUT_REQUIRED: checkout_id must be explicit');
-  if (repository.repoId !== handle.repositoryId) throw new Error('WORK_HEAD_ADOPTION_REPOSITORY_MISMATCH');
-  if (requestedCheckoutId !== handle.checkoutId || repository.activeCheckoutId !== handle.checkoutId) {
-    throw new Error(`WORK_HEAD_ADOPTION_CHECKOUT_MISMATCH: expected ${handle.checkoutId}, found ${requestedCheckoutId}`);
-  }
-  if (!handle.managedWorktree) throw new Error('WORK_HEAD_ADOPTION_MANAGED_WORKTREE_REQUIRED');
-  if (handle.principalId !== session.principalId) throw new Error('WORK_HANDLE_PRINCIPAL_MISMATCH: work handle belongs to another principal');
-  if (handle.state !== 'prepared' && handle.state !== 'editing') {
-    throw new Error(`WORK_HEAD_ADOPTION_STATE_INVALID: ${handle.state}`);
-  }
-  const finalizationStages = [
-    handle.finalization.validation,
-    handle.finalization.commit,
-    handle.finalization.merge,
-    handle.finalization.branchCleanup,
-    handle.finalization.worktreeCleanup,
-  ];
-  if (finalizationStages.some((stage) => stage !== 'pending')) {
-    throw new Error('WORK_HEAD_ADOPTION_FINALIZATION_ALREADY_STARTED');
-  }
-
-  const registered = getRepository(handle.repositoryId, ctx.controllerHome, { includeRemoved: true });
-  const registeredCheckout = registered.checkouts.find((entry) => entry.checkoutId === handle.checkoutId);
-  if (!registeredCheckout || registeredCheckout.lifecycle !== 'active' || registeredCheckout.worktree !== true) {
-    throw new Error('WORK_HEAD_ADOPTION_CHECKOUT_NOT_ACTIVE_MANAGED');
-  }
-  const worktreeRepository = selectRepositoryCheckout(registered, handle.checkoutId);
-  const guarded = assertExecutionIdentity({
-    controllerHome: ctx.controllerHome,
-    identity: executionIdentityFromCoordinates({
-      repositoryId: handle.repositoryId,
-      checkoutId: handle.checkoutId,
-      canonicalRoot: handle.worktreePath,
-      workId: handle.workId,
-      worktreePath: handle.worktreePath,
-      branch: handle.branch,
-    }),
-    cwd: handle.worktreePath,
-    requestedRepoId: repository.repoId,
-    requestedCheckoutId,
-  });
-  const status = repositoryGitStatus(worktreeRepository);
-  if (!status.clean) throw new Error('WORK_HEAD_ADOPTION_WORKTREE_DIRTY');
-
-  const previousHead = gitCommit(handle.worktreePath, previousInput, 'PREVIOUS_HEAD');
-  const candidateHead = gitCommit(handle.worktreePath, candidateInput, 'CANDIDATE_HEAD');
-  const authoritativePrevious = handle.expectedHead ? gitCommit(handle.worktreePath, handle.expectedHead, 'AUTHORITATIVE_PREVIOUS_HEAD') : undefined;
-  if (!authoritativePrevious || authoritativePrevious !== previousHead) {
-    throw new Error(`WORK_HEAD_ADOPTION_PREVIOUS_HEAD_MISMATCH: expected ${authoritativePrevious ?? 'missing'}, found ${previousHead}`);
-  }
-  if (guarded.currentHead !== candidateHead || status.head !== candidateHead) {
-    throw new Error(`WORK_HEAD_ADOPTION_CANDIDATE_NOT_CURRENT: expected current HEAD ${candidateHead}, found ${guarded.currentHead ?? status.head ?? 'missing'}`);
-  }
-  if (previousHead === candidateHead) throw new Error('WORK_HEAD_ADOPTION_SUCCESSOR_REQUIRED');
-  const ancestry = spawnSync('git', ['-C', handle.worktreePath, 'merge-base', '--is-ancestor', previousHead, candidateHead], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (ancestry.status !== 0 || ancestry.error) throw new Error('WORK_HEAD_ADOPTION_NOT_DESCENDANT');
-
-  const contract = contractFor(ctx, handle);
-  if (!contract || contract.repoId !== handle.repositoryId) throw new Error('WORK_HEAD_ADOPTION_CONTRACT_MISSING');
-  if (isTerminalWorkContractStatus(contract.status) || contract.completionReceipt) {
-    throw new Error('WORK_HEAD_ADOPTION_CONTRACT_TERMINAL');
-  }
-  // expectedHead can predate unrelated commits that landed on the source checkout
-  // before this Work was rebased. Scope adoption to the candidate's unique delta
-  // from the current source-checkout merge-base; otherwise those target-branch
-  // commits are incorrectly attributed to the Work and fail its allow-list.
-  const sourceRepository = selectWorkFinalizationTarget(registered, handle);
-  const sourceHead = handle.sourceCheckoutId && handle.sourceCheckoutId !== handle.checkoutId
-    ? repositoryGitStatus(sourceRepository).head
-    : undefined;
-  const scopeBaseHead = sourceHead ? gitMergeBase(handle.worktreePath, sourceHead, candidateHead) : previousHead;
-  const changedPaths = gitChangedPaths(handle.worktreePath, scopeBaseHead, candidateHead);
-  for (const path of changedPaths) {
-    if (contract.forbiddenPaths.some((pattern) => globMatches(pattern, path))) {
-      throw new Error(`WORK_HEAD_ADOPTION_FORBIDDEN_PATH: ${path}`);
-    }
-    if (contract.allowedPaths.length === 0 || !contract.allowedPaths.some((pattern) => globMatches(pattern, path))) {
-      throw new Error(`WORK_HEAD_ADOPTION_PATH_OUT_OF_SCOPE: ${path}`);
-    }
-  }
-
-  claimHeadAdoptionOwnership(ctx, session, handle, args);
-
-  const reviewedAt = new Date().toISOString();
-  const reconciliationId = `RECNC-${createHash('sha256').update([
-    handle.repositoryId, handle.workId, previousHead, candidateHead, handle.checkoutId, handle.branch,
-  ].join('\0')).digest('hex').slice(0, 16)}`;
-  const reconciliation: WorkReconciliationRecord = {
-    schemaVersion: 1,
-    reconciliationId,
-    originalExpectedRevision: previousHead,
-    observedTargetRevision: candidateHead,
-    baseRevision: gitCommit(handle.worktreePath, handle.baseCommit ?? previousHead, 'BASE_HEAD'),
-    targetBranch: handle.branch,
-    reachable: true,
-    method: 'exact_commit',
-    comparedPaths: changedPaths,
-    reviewer: session.principalId.slice(0, 200),
-    reviewedAt,
-    unrecoverableStages: [],
-    cleanupOwnershipProof: `No cleanup was performed; managed checkout ${handle.checkoutId} remains owned by Work finalizer.`,
-    rationale: 'Adopted an exact clean successor commit after repository, checkout, worktree, branch, controller ownership, ancestry, and WorkContract path-scope verification. This reconciliation is not completion evidence.',
-    outcome: 'accepted_equivalence',
-  };
-
-  const adopted = transitionWorkHandle(ctx.controllerHome, handle, 'editing', {
-    deliveryBaseCommit: scopeBaseHead,
-    expectedHead: candidateHead,
-    failureReason: undefined,
-    finalization: initialStage(),
-    validationRun: undefined,
-    validatedInputFingerprint: undefined,
-  });
-  try {
-    updateWorkContract({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, contract.workId, {
-      evidenceState: contract.checkRefs.length === 0
-        ? contract.evidenceState
-        : contract.evidenceState === 'valid' || contract.evidenceState === 'stale'
-          ? 'stale'
-          : 'partial',
-      reconciliations: [reconciliation, ...contract.reconciliations.filter((entry) => entry.reconciliationId !== reconciliationId)],
-    });
-    appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, contract.workId, {
-      title: 'audited WorkHandle successor HEAD adoption',
-      summary: `${previousHead} -> ${candidateHead}; ${changedPaths.length} candidate-unique path(s) from scope base ${scopeBaseHead} remained within the WorkContract allow-list. Historical validation and completion receipts were not rewritten.`,
-      detailLevel: 'summary',
-    });
-  } catch (error) {
-    try {
-      writeWorkHandle(ctx.controllerHome, { ...handle, recordRevision: adopted.recordRevision });
-    } catch (rollbackError) {
-      throw new Error(`WORK_HEAD_ADOPTION_AUDIT_WRITE_FAILED_AND_ROLLBACK_FAILED: ${String(error)}; ${String(rollbackError)}`);
-    }
-    throw error;
-  }
-  const nextSession = updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
-    activeRepositoryId: handle.repositoryId,
-    activeCheckoutId: handle.checkoutId,
-    activeWorkId: handle.workId,
-    permissionSnapshotVersion: handle.permissionSnapshotVersion,
-    lastValidatedAt: reviewedAt,
-  });
-  return {
-    session: nextSession,
-    work: compactHandle(adopted),
-    reused: true,
-    adopted: true,
-    adoption: { previousHead, candidateHead, changedPaths, reconciliationId },
-    controllerClaimed: true,
-  };
-}
-
-export function releasePreparedWorkOwnership(
-  ctx: MultiRepositoryMcpToolContext,
-  handle: WorkHandleState,
-): 'released' | 'already_released' {
-  const workIdValue = handle.workContractId ?? handle.workId;
-  const options = { controllerHome: ctx.controllerHome, repoId: handle.repositoryId };
-  const current = getControllerSession(options, workIdValue);
-  if (!current) return 'already_released';
-
-  const callerPrincipal = principalFor(ctx);
-  const callerInstanceId = ctx.controllerInstanceId ?? currentControllerInstanceId();
-  const ownerPrincipal = current.principalId?.trim() || current.controllerId;
-  const ownerInstanceId = current.controllerInstanceId?.trim() || '';
-  if (ownerPrincipal !== callerPrincipal) {
-    throw new Error(`WORK_CONTROLLER_PRINCIPAL_MISMATCH: ${workIdValue}`);
-  }
-  if (!ownerInstanceId || ownerInstanceId !== callerInstanceId) {
-    throw new Error(`WORK_CONTROLLER_INSTANCE_MISMATCH: ${workIdValue}`);
-  }
-  if (typeof current.claimGeneration !== 'number' || current.claimGeneration < 1) {
-    throw new Error(`WORK_CONTROLLER_CLAIM_GENERATION_REQUIRED: ${workIdValue}`);
-  }
-
-  const released = releaseControllerSessionWithAuthority(options, {
-    workId: workIdValue,
-    actor: `legacy-work-release:${callerPrincipal}:${callerInstanceId}`,
-    authority: {
-      controllerId: current.controllerId,
-      controllerType: current.controllerType,
-      principalId: ownerPrincipal,
-      controllerInstanceId: ownerInstanceId,
-      claimGeneration: current.claimGeneration,
-    },
-  });
-  if (!released.allowed) {
-    throw new Error(`WORK_CONTROLLER_RELEASE_FENCED: ${workIdValue}:${released.reason}`);
-  }
-  return 'released';
-}
-
-function terminalCleanupOutcome(
-  ctx: MultiRepositoryMcpToolContext,
-  handle: WorkHandleState,
-): WorkTerminalOutcome | undefined {
-  if (handle.cleanupReceipt) return handle.cleanupReceipt.terminalOutcome;
-  const contract = contractFor(ctx, handle);
-  if (contract?.status === 'cancelled') return 'cancelled';
-  if (contract?.status === 'completed') return 'completed_cleanup';
-  const reason = `${handle.failureReason ?? ''} ${handle.finalization.lastError ?? ''}`.toLowerCase();
-  if (contract?.status === 'blocked' && reason.includes('terminal')) return 'blocked_terminal';
-  // `failed` is a retryable execution-handle state (its transition table allows
-  // failed -> validating/editing). Do not reinterpret it as terminal cleanup
-  // unless the durable Work itself is terminal. `failed_terminal_cleanup` is
-  // the explicit point of no return for resource cleanup reconciliation.
-  if (contract?.status === 'failed' || handle.state === 'failed_terminal_cleanup') {
-    if (reason.includes('infrastructure') || reason.includes('timed out') || reason.includes('unavailable')) {
-      return 'infrastructure_failed';
-    }
-    if (handle.finalization.validation === 'failed') return 'validation_failed';
-    return 'failed';
-  }
-  return undefined;
-}
-
-async function reconcileTerminalCleanup(
-  ctx: MultiRepositoryMcpToolContext,
-  session: ExecutionSessionContext,
-  handle: WorkHandleState,
-  args: Record<string, unknown>,
-  outcome: WorkTerminalOutcome,
-): Promise<Record<string, unknown>> {
-  const wasComplete = handle.cleanupReceipt?.complete === true;
-  const cleaned = await cleanupTerminalWork({
-    controllerHome: ctx.controllerHome,
-    handle,
-    targetBranch: typeof args.target_branch === 'string' ? args.target_branch : undefined,
-    deleteBranch: args.delete_branch !== false,
-    terminalOutcome: outcome,
-    failureReason: handle.failureReason ?? handle.finalization.lastError,
-  });
-  const ownership = releasePreparedWorkOwnership(ctx, cleaned.handle);
-  cleaned.receipt.ownership.controllerLease = ownership;
-  const persisted = writeWorkHandle(ctx.controllerHome, {
-    ...cleaned.handle,
-    cleanupReceipt: cleaned.receipt,
-  });
-  updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
-    activeWorkId: undefined,
-    activeCheckoutId: workReturnCheckoutId(ctx, persisted, session.activeCheckoutId),
-  });
-  if (cleaned.receipt.complete && !wasComplete) {
-    appendWorkEvidence(
-      { controllerHome: ctx.controllerHome, repoId: persisted.repositoryId },
-      persisted.workContractId ?? persisted.workId,
-      {
-        title: 'terminal cleanup receipt',
-        summary: `Cleanup ${cleaned.receipt.receiptId} completed for ${outcome}; Work outcome was preserved and no completion receipt was fabricated.`,
-        detailLevel: 'summary',
-      },
-    );
-  }
-  return {
-    work: compactHandle(persisted),
-    stages: persisted.finalization,
-    completed: false,
-    cleanupCompleted: cleaned.receipt.complete,
-    cleanupPartial: cleaned.receipt.partial,
-    failurePreserved: true,
-    cleanupReceipt: cleaned.receipt,
-    idempotent: wasComplete,
-  };
-}
-
-function invalidateActiveWork(ctx: MultiRepositoryMcpToolContext, session: ExecutionSessionContext, reason: string): void {
-  if (!session.activeRepositoryId || !session.activeWorkId) return;
-  const handle = readWorkHandle(ctx.controllerHome, session.activeRepositoryId, session.activeWorkId);
-  if (!handle || handle.state === 'cleaned') return;
-  const contract = contractFor(ctx, handle);
-  if (contract?.status === 'completed') return;
-  markWorkHandleFailed(ctx.controllerHome, handle, reason);
-}
-
-function bindSessionRepository(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Record<string, unknown> {
-  const session = requireSession(ctx, args);
-  const repository = resolveRepositorySelection({ repoId: requireExplicitRepoId(args), checkoutId: typeof args.checkout_id === 'string' ? args.checkout_id : undefined, controllerHome: ctx.controllerHome, allowSoleRepository: false });
-  const switching = session.activeRepositoryId !== undefined && (session.activeRepositoryId !== repository.repoId || session.activeCheckoutId !== repository.activeCheckoutId);
-  if (switching) invalidateActiveWork(ctx, session, 'explicit repository or checkout switch invalidated the previous active work handle');
-  const next = updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
-    activeRepositoryId: repository.repoId,
-    activeCheckoutId: repository.activeCheckoutId,
-    activeWorkId: undefined,
-    goalDelegation: undefined,
-    permissionSnapshotVersion: currentPermissionSnapshotVersion(ctx.controllerHome, repository.repoId),
-    lastValidatedAt: new Date().toISOString(),
-  });
-  return { session: next, repository: { repoId: repository.repoId, checkoutId: repository.activeCheckoutId, canonicalRoot: repository.canonicalRoot, branch: repository.checkouts.find((entry) => entry.checkoutId === repository.activeCheckoutId)?.branch ?? null }, switched: switching };
-}
-
-function prepareWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Record<string, unknown> {
-  const session = requireSession(ctx, args);
-  const repository = selectedRepository(ctx, session, args, true);
-  if (!session.activeRepositoryId) {
-    updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), { activeRepositoryId: repository.repoId, activeCheckoutId: repository.activeCheckoutId, permissionSnapshotVersion: currentPermissionSnapshotVersion(ctx.controllerHome, repository.repoId) });
-  }
-  const existingId = typeof args.work_id === 'string' ? args.work_id.trim() : '';
-  if (existingId) {
-    const existing = readWorkHandle(ctx.controllerHome, repository.repoId, existingId)
-      ?? findWorkHandle(ctx, session, { ...args, work_id: existingId, repo_id: repository.repoId });
-    if (existing.principalId !== session.principalId) throw new Error('WORK_HANDLE_ACCESS_DENIED');
-    const adopted = adoptExistingWorkHead(ctx, session, repository, existing, args);
-    if (adopted) return adopted;
-    validateWorkHandle(ctx.controllerHome, existing, identityFor(ctx, args), 'cheap', 'inspect');
-    updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), { activeRepositoryId: existing.repositoryId, activeCheckoutId: existing.checkoutId, activeWorkId: existing.workId, permissionSnapshotVersion: existing.permissionSnapshotVersion });
-    claimPreparedWorkOwnership(ctx, session, existing, args);
-    return { session: requireSession(ctx, args), work: compactHandle(existing), reused: true, controllerClaimed: true };
-  }
-
-  const requestId = typeof args.request_id === 'string' ? args.request_id.trim() : '';
-  if (!requestId) throw new Error('WORK_PREPARE_REQUEST_ID_REQUIRED: new work preparation requires request_id');
-  const isolation = args.isolation === 'reuse' || args.isolation === 'new_worktree' || args.isolation === 'auto' ? args.isolation : 'auto';
-  const objective = String(args.objective ?? 'Controller-managed repository work').trim().slice(0, 2_000);
-  const goalId = typeof args.goal_id === 'string' && args.goal_id.trim() ? args.goal_id.trim() : undefined;
-  const acceptanceCriteria = boundedStringArray(args.acceptance_criteria, 20);
-  const allowedPaths = boundedStringArray(args.allowed_paths, 50);
-  const checks = boundedStringArray(args.checks, 30);
-  const baseRef = typeof args.base_ref === 'string' && args.base_ref.trim() ? args.base_ref.trim() : undefined;
-  const requestedCheckoutId = typeof args.checkout_id === 'string' && args.checkout_id.trim() ? args.checkout_id.trim() : undefined;
-  const needsDependencies = args.needs_dependencies === true;
-  const baseCheckoutId = repository.activeCheckoutId;
-  const baseStatus = repositoryGitStatus(repository);
-  if (isolation === 'reuse' && !baseStatus.clean) throw new Error('WORKTREE_DIRTY: reuse was requested but the selected checkout is dirty; choose new_worktree or auto');
-  const useWorktree = isolation === 'new_worktree' || (isolation === 'auto' && !baseStatus.clean);
-  const policy = readRepositoryAccessPolicy(ctx.controllerHome, repository.repoId);
-  const fingerprint = workPrepareFingerprint({
-    repoId: repository.repoId,
-    requestedCheckoutId,
-    isolation,
-    objective,
-    goalId,
-    acceptanceCriteria,
-    allowedPaths,
-    checks,
-    baseRef,
-    needsDependencies,
-  });
-
-  return withWorkPrepareRequest({
-    controllerHome: ctx.controllerHome,
-    repoId: repository.repoId,
-    sessionId: session.sessionId,
-    principalId: session.principalId,
-    requestId,
-    fingerprint,
-    proposedWorkId: newWorkId(),
-  }, (request, requestReused) => {
-    const createdWorkId = request.workId;
-    const existingHandle = readWorkHandle(ctx.controllerHome, repository.repoId, createdWorkId);
-    if (existingHandle) {
-      if (existingHandle.principalId !== session.principalId || existingHandle.sessionId !== session.sessionId) {
-        throw new Error(`WORK_PREPARE_REQUEST_INDEX_CORRUPT: ${requestId}`);
-      }
-      const existingContract = getWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, createdWorkId);
-      if (!existingContract) throw new Error(`WORK_PREPARE_RESULT_LOST: ${requestId} has a Work handle without its WorkContract`);
-      const terminal = isTerminalWorkContractStatus(existingContract.status)
-        && !(existingContract.status === 'failed' && request.status === 'claimed');
-      if (terminal) {
-        return {
-          session: requireSession(ctx, args),
-          work: compactHandle(existingHandle),
-          reused: true,
-          terminal: true,
-          workContractStatus: existingContract.status,
-          controllerClaimed: false,
-        };
-      }
-      if (existingContract.status === 'open' || existingContract.status === 'failed') {
-        updateWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, createdWorkId, { status: 'running', worktreeRef: existingHandle.worktreePath });
-      }
-      const delegation = createGoalDelegation({
-        sessionId: session.sessionId,
-        repositoryId: repository.repoId,
-        workId: createdWorkId,
-        goalId,
-        allowedRiskClasses: ['readonly', 'local_repo_write', 'workspace_write', 'local_command', 'dependency_change', 'local_git'],
-        deniedRiskClasses: ['remote_write', 'destructive', 'secret_access', 'outside_repository'],
-        permissionSnapshotVersion: policy.revision,
-        source: 'gpt_risk_delegate',
-      });
-      const nextSession = updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), { activeRepositoryId: repository.repoId, activeCheckoutId: existingHandle.checkoutId, activeWorkId: createdWorkId, permissionSnapshotVersion: policy.revision, goalDelegation: delegation, lastValidatedAt: new Date().toISOString() });
-      claimPreparedWorkOwnership(ctx, nextSession, existingHandle, args);
-      return { session: nextSession, work: compactHandle(existingHandle), reused: true, isolation: existingHandle.managedWorktree ? 'isolated' : 'current', controllerClaimed: true };
-    }
-
-    let contract = getWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, createdWorkId);
-    if (contract?.requestId && contract.requestId !== requestId) throw new Error(`WORK_PREPARE_REQUEST_INDEX_CORRUPT: ${requestId}`);
-    if (request.status === 'prepared') {
-      throw new Error(`WORK_PREPARE_RESULT_LOST: ${requestId} completed without a readable Work handle`);
-    }
-    if (contract && (contract.status === 'completed' || contract.status === 'cancelled')) {
-      throw new Error(`WORK_PREPARE_REQUEST_TERMINAL: ${requestId} belongs to ${contract.status} Work ${createdWorkId}`);
-    }
-    if (!contract) {
-      contract = createWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, {
-        workId: createdWorkId,
-        repoId: repository.repoId,
-        mode: useWorktree ? 'goal_workloop' : 'direct_control',
-        objective,
-        acceptanceCriteria,
-        allowedPaths,
-        forbiddenPaths: [],
-        checks,
-        constraints: { accessMode: policy.mode, workspaceMode: useWorktree ? 'isolated' : 'current', requireWorktree: useWorktree, allowCommit: true, allowMerge: true, allowCleanup: true },
-        worktreePolicy: { required: useWorktree, reason: useWorktree ? 'work_prepare selected isolated worktree execution' : 'explicitly reused a registered checkout' },
-        requestedBy: 'chatgpt',
-        requestId,
-      });
-    }
-    const delegation = createGoalDelegation({
-      sessionId: session.sessionId,
-      repositoryId: repository.repoId,
-      workId: createdWorkId,
-      goalId,
-      allowedRiskClasses: ['readonly', 'local_repo_write', 'workspace_write', 'local_command', 'dependency_change', 'local_git'],
-      deniedRiskClasses: ['remote_write', 'destructive', 'secret_access', 'outside_repository'],
-      permissionSnapshotVersion: policy.revision,
-      source: 'gpt_risk_delegate',
-    });
-    try {
-      const workspace = useWorktree
-        ? ensureManagedWorkspace(ctx.controllerHome, repository, {
-          requestId: createdWorkId,
-          title: objective,
-          baseRef,
-          prepareDependencies: needsDependencies,
-        })
-        : { mode: 'current' as const, checkoutId: baseCheckoutId, root: repository.canonicalRoot, branch: baseStatus.branch ?? 'detached', baseRevision: baseStatus.head ?? undefined, managed: false };
-      const refreshed = getRepository(repository.repoId, ctx.controllerHome);
-      const checkout = selectRepositoryCheckout(refreshed, workspace.checkoutId);
-      const branch = workspace.branch || repositoryGitStatus(checkout).branch;
-      if (!branch) throw new Error('WORKTREE_DETACHED: selected worktree has no branch');
-      const head = gitHead(checkout.canonicalRoot);
-      const handle: WorkHandleState = {
-        schemaVersion: 1, workId: createdWorkId, sessionId: session.sessionId, principalId: session.principalId,
-        repositoryId: repository.repoId, checkoutId: checkout.activeCheckoutId, worktreePath: checkout.canonicalRoot, branch,
-        sourceCheckoutId: baseCheckoutId, managedWorktree: workspace.managed, workContractId: contract.workId, goalId, delegationVersion: delegation.version,
-        baseCommit: workspace.baseRevision ?? head, deliveryBaseCommit: workspace.baseRevision ?? head, expectedHead: head, permissionSnapshotVersion: policy.revision,
-        state: 'prepared', createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), finalization: initialStage(),
-        cleanupResponsibility: { owner: 'work_finalizer', registeredAt: new Date().toISOString() },
-      };
-      writeWorkHandle(ctx.controllerHome, handle);
-      updateWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId, { status: 'running', worktreeRef: checkout.canonicalRoot });
-      const nextSession = updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), { activeRepositoryId: repository.repoId, activeCheckoutId: checkout.activeCheckoutId, activeWorkId: createdWorkId, permissionSnapshotVersion: policy.revision, goalDelegation: delegation, lastValidatedAt: new Date().toISOString() });
-      claimPreparedWorkOwnership(ctx, nextSession, handle, args);
-      return { session: nextSession, work: compactHandle(handle), reused: requestReused, isolation: workspace.mode, controllerClaimed: true };
-    } catch (error) {
-      updateWorkContract({ controllerHome: ctx.controllerHome, repoId: repository.repoId }, contract.workId, { status: 'failed' });
-      throw error;
-    }
-  });
-}
-
 function inspectWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Record<string, unknown> {
   const session = requireSession(ctx, args);
   // work_inspect is authorized read-only evidence; it must not require the write lease.
@@ -1317,1737 +147,12 @@ function inspectWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, un
     checks: checks.map((checkId) => ({ checkId, registered: listControllerChecks(validated.worktreeRepository.canonicalRoot).some((check) => check.id === checkId) })),
     package: packageManifest ? { name: packageManifest.name, scripts: packageManifest.scripts } : undefined,
   };
-  const response = makeBoundedResult(ctx, session, handle.repositoryId, handle.workId, 'inspection', value);
+  const response = makeBoundedWorkResult(ctx, session, handle.repositoryId, handle.workId, 'inspection', value);
   const trace: McpTimingTrace = { tool: 'work_inspect', sessionResolutionMs: 0, repositoryResolutionMs: 0, workHandleValidationMs: Math.round(validationMs * 100) / 100, resultSerializationMs: 0, totalToolDurationMs: Math.round((performance.now() - started) * 100) / 100, sessionId: session.sessionId, repoId: handle.repositoryId, workId: handle.workId };
   recordMcpTiming(ctx.controllerHome, trace);
   return response;
 }
 
-function commandInputs(args: Record<string, unknown>): Array<Record<string, unknown>> {
-  if (Array.isArray(args.commands)) return args.commands.filter((value): value is Record<string, unknown> => Boolean(value && typeof value === 'object' && !Array.isArray(value)));
-  if (args.command !== undefined) return [{ command: args.command, cwd: args.cwd, approval_token: args.approval_token, timeout_ms: args.timeout_ms, max_output_bytes: args.max_output_bytes }];
-  throw new Error('COMMAND_REQUIRED: provide command or commands');
-}
-
-function authorizationRisk(command: RepositoryCommandValue, classification: ReturnType<typeof classifyRepositoryCommand>): AuthorizationRiskClass {
-  if (classification.risk === 'readonly') return 'readonly';
-  if (classification.risk === 'remote_write') return 'remote_write';
-  if (classification.risk === 'destructive') return 'destructive';
-  const executable = typeof command === 'string' ? command : command[0] ?? '';
-  if (typeof command === 'string' && /\b(?:npm|bun|pnpm|yarn)\s+(?:install|add|remove|update)\b/i.test(command)) return 'dependency_change';
-  if (/^\s*(?:git|.*[\\/]git)(?:\s|$)/i.test(executable)) return 'local_git';
-  return 'workspace_write';
-}
-
-async function executeWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
-  const session = requireSession(ctx, args);
-  const handle = workForSession(ctx, session, args);
-  assertWorkControllerOwnership(ctx, session, handle, args);
-  const commands = commandInputs(args);
-  if (commands.length > 16) throw new Error('COMMAND_BATCH_TOO_LARGE: at most 16 commands per work_execute');
-  const cheap = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'cheap', 'execute');
-  const inputs = commands.map((entry) => ({
-    command: commandValue(normalizeRepositoryCommand(entry.command)),
-    cwd: typeof entry.cwd === 'string' ? entry.cwd : undefined,
-    approvalToken: typeof entry.approval_token === 'string' ? entry.approval_token : undefined,
-  }));
-  const classifications = inputs.map((entry) => classifyRepositoryCommand(entry.command, cheap.repository.defaultBranch));
-  const requiresFull = classifications.some((classification) => classification.risk !== 'readonly');
-  if (requiresFull) validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'full', 'execute');
-  const decisions: AuthorizationDecision[] = [];
-  const approvalRequestId = typeof args.approval_request_id === 'string' ? args.approval_request_id.trim() : '';
-  const resolvedRequest = approvalRequestId
-    ? assertResolvedAuthorization({ controllerHome: ctx.controllerHome, repositoryId: handle.repositoryId, approvalRequestId, sessionId: session.sessionId, principalId: session.principalId, workId: handle.workId, permissionSnapshotVersion: handle.permissionSnapshotVersion, command: inputs[0]?.command })
-    : undefined;
-  for (const [index, entry] of inputs.entries()) {
-    const classification = classifications[index]!;
-    const outsideCwd = Boolean(entry.cwd && (isAbsolute(entry.cwd) || (() => {
-      const rel = relative(resolve(handle.worktreePath), resolve(handle.worktreePath, entry.cwd));
-      return rel === '..' || rel.startsWith('../') || rel.startsWith('..\\');
-    })()));
-    const risk = outsideCwd ? 'outside_repository' : authorizationRisk(entry.command, classification);
-    const decision = resolvedRequest
-      ? { decision: 'allow', source: 'user_confirmation', reason: 'The user resolved the exact approval request for this command.' } as const
-      : decideAuthorization({
-        controllerHome: ctx.controllerHome,
-        accessMode: readRepositoryAccessPolicy(ctx.controllerHome, handle.repositoryId).mode,
-        risk,
-        repositoryId: handle.repositoryId,
-        currentRepositoryId: handle.repositoryId,
-        workId: handle.workId,
-        boundWorkId: handle.workId,
-        goalId: handle.goalId,
-        boundGoalId: handle.goalId,
-        sessionId: session.sessionId,
-        principalId: session.principalId,
-        permissionSnapshotVersion: handle.permissionSnapshotVersion,
-        delegation: session.goalDelegation,
-        worktreePath: handle.worktreePath,
-        cwd: entry.cwd,
-        command: entry.command,
-        approvedByUser: Boolean(resolvedRequest),
-      });
-    decisions.push(decision);
-    if (decision.decision !== 'allow') return { authorization: decision, work: compactHandle(handle), command: entry.command };
-  }
-  const invocationId = typeof args.request_id === 'string' && args.request_id.trim()
-    ? args.request_id.trim()
-    : `invoke-${session.sessionId}-${handle.workId}-${Date.now()}-${randomUUID().slice(0, 8)}`;
-  const invocationFingerprint = createHash('sha256')
-    .update(JSON.stringify({
-      tool: 'work_execute',
-      workId: handle.workId,
-      commands: inputs.map((entry) => ({ command: entry.command, cwd: entry.cwd ?? null })),
-      timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : null,
-      maxOutputBytes: typeof args.max_output_bytes === 'number' ? args.max_output_bytes : null,
-    }))
-    .digest('hex');
-  claimProcessInvocation({
-    controllerHome: ctx.controllerHome,
-    repoId: handle.repositoryId,
-    checkoutId: handle.checkoutId,
-    requestId: invocationId,
-    invocationFingerprint,
-  });
-  const run = async (entry: typeof inputs[number], index: number) => {
-    const commandId = `${invocationId}:command:${index + 1}`;
-    const execution = await executeRepositoryCommandViaProcessRuntime({
-      controllerHome: ctx.controllerHome,
-      repository: cheap.worktreeRepository,
-      executionIdentity: executionIdentityForWork(cheap.worktreeRepository, handle),
-      command: entry.command,
-      cwd: entry.cwd,
-      workId: handle.workId,
-      commandId,
-      requestId: commandId,
-      timeoutMs: typeof args.timeout_ms === 'number' ? args.timeout_ms : undefined,
-      maxOutputBytes: typeof args.max_output_bytes === 'number' ? args.max_output_bytes : undefined,
-    });
-    const process = execution.process;
-    const ok = process ? process.ok === true : execution.ok === true;
-    const status = process
-      ? (process.completed
-        ? (process.cancelled ? 'cancelled' : process.timedOut ? 'timed_out' : ok ? 'executed' : 'failed')
-        : 'running')
-      : execution.route === 'process_direct'
-        ? (ok ? 'executed' : 'failed')
-        : execution.route === 'durable'
-          ? 'deferred_durable'
-          : 'rejected';
-    return {
-      processId: process?.processId,
-      commandId,
-      requestId: commandId,
-      status,
-      ok,
-      exitCode: process?.exitCode ?? execution.exitCode,
-      timedOut: process?.timedOut === true,
-      cancelled: process?.cancelled === true,
-      startedAt: process?.startedAt,
-      finishedAt: process?.completed ? process.startedAt : undefined,
-      stdout: process?.stdout ?? execution.stdout,
-      stderr: process?.stderr ?? execution.stderr,
-      logArtifact: process?.processId ? { processId: process.processId, kind: 'process_logs' } : undefined,
-      route: execution.route,
-      reason: execution.reason,
-      authorizationDecision: decisions[index],
-      approvalRequestId: resolvedRequest?.approvalRequestId,
-      authorization: decisions[index]?.decision === 'allow'
-        ? (resolvedRequest ? 'confirmed_plan' : decisions[index]?.source)
-        : 'explicit_user_request',
-      durableSideEffects: execution.durableSideEffects,
-      process,
-    };
-  };
-  const started = performance.now();
-  const executions = classifications.every((classification) => classification.risk === 'readonly')
-    ? await Promise.all(inputs.map((entry, index) => run(entry, index)))
-    : await (async () => {
-      const ordered: Awaited<ReturnType<typeof run>>[] = [];
-      for (const [index, entry] of inputs.entries()) {
-        const execution = await run(entry, index);
-        ordered.push(execution);
-        // Do not launch another mutating command while a Work-owned Lightweight
-        // process is still changing the workspace. This is sequencing, not a
-        // durable Lease boundary; the caller resumes through process_wait.
-        if (execution.process && !execution.process.completed) break;
-      }
-      return ordered;
-    })();
-  const branch = repositoryGitStatus(cheap.worktreeRepository).branch;
-  const head = gitHead(cheap.worktreeRepository.canonicalRoot);
-  let nextHandle = handle;
-  if (branch !== handle.branch) nextHandle = markWorkHandleFailed(ctx.controllerHome, handle, `command changed the bound branch to ${branch ?? 'detached'}`);
-  else nextHandle = transitionWorkHandle(ctx.controllerHome, handle, 'editing', { expectedHead: head, failureReason: undefined });
-  const value = {
-    work: compactHandle(nextHandle),
-    commands: executions,
-    executedCount: executions.filter((entry) => entry.status === 'executed' && entry.ok === true).length,
-    managedProcessCount: executions.filter((entry) => entry.process && !entry.process.completed).length,
-    deferredCommandCount: Math.max(0, inputs.length - executions.length),
-    authorization: decisions[0],
-    requestId: invocationId,
-  };
-  const response = makeBoundedResult(ctx, session, handle.repositoryId, handle.workId, 'command', value);
-  recordMcpTiming(ctx.controllerHome, { tool: 'work_execute', workHandleValidationMs: 0, commandExecutionMs: Math.round((performance.now() - started) * 100) / 100, totalToolDurationMs: Math.round((performance.now() - started) * 100) / 100, sessionId: session.sessionId, repoId: handle.repositoryId, workId: handle.workId });
-  return response;
-}
-
-export function selectDefaultWorkValidationChecks(
-  contract: ReturnType<typeof contractFor>,
-  changedPaths: string[],
-): string[] {
-  if (!contract || changedPaths.length === 0) return [];
-  if (contract.risk === 'medium' || contract.risk === 'high' || contract.risk === 'destructive') {
-    return [...contract.checks];
-  }
-  const sourceTypeScriptChanged = changedPaths.some((path) =>
-    /\.(?:ts|tsx|mts|cts)$/.test(path)
-    && !/(?:^|\/)(?:tests?|__tests__|fixtures)(?:\/|$)/.test(path));
-  return contract.checks.filter((checkId) => {
-    const normalized = checkId.toLowerCase();
-    if (normalized.includes('package:test') || normalized.includes('full') || normalized.includes('architecture') || normalized.includes('release') || normalized.includes('runtime')) {
-      return false;
-    }
-    if (normalized.includes('type')) return sourceTypeScriptChanged;
-    return normalized.includes('focused') || normalized.includes('unit') || normalized.includes('changed') || normalized.includes('target');
-  });
-}
-
-async function validateWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
-  const session = requireSession(ctx, args);
-  const handle = workForSession(ctx, session, args, {
-    reconcileValidation: false,
-    allowClaimedTerminalCleanup: args.cleanup !== false,
-  });
-  const terminalOutcome = terminalCleanupOutcome(ctx, handle);
-  if (terminalOutcome && args.cleanup !== false) {
-    return await reconcileTerminalCleanup(ctx, session, handle, args, terminalOutcome);
-  }
-  const validated = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'full', 'validate');
-  const contract = contractFor(ctx, handle);
-  const changed = repositoryGitDiff(validated.worktreeRepository, { maxBytes: 64 * 1024 });
-  const changedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
-  const requestedChecks = Array.isArray(args.check_ids)
-    ? args.check_ids.map(String).filter(Boolean)
-    : selectDefaultWorkValidationChecks(contract, changedPaths);
-  const validationInvocationId = typeof args.request_id === 'string' && args.request_id.trim()
-    ? args.request_id.trim()
-    : `validate-${session.sessionId}-${handle.workId}-${Date.now()}-${randomUUID().slice(0, 8)}`;
-  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
-  const validationHead = validationStatus.head
-    ?? handle.expectedHead
-    ?? handle.baseCommit
-    ?? 'unknown';
-  const workspaceFingerprint = workspaceValidationFingerprint(
-    validated.worktreeRepository.canonicalRoot,
-    validationStatus,
-  );
-  const validationFingerprint = workValidationInputFingerprint(
-    validationHead,
-    workspaceFingerprint,
-    requestedChecks,
-  );
-  const previousRun = handle.validationRun?.fingerprint === validationFingerprint
-    ? handle.validationRun
-    : undefined;
-  let validationRun: NonNullable<WorkHandleState['validationRun']> = previousRun ?? {
-    fingerprint: validationFingerprint,
-    head: validationHead,
-    workspaceFingerprint,
-    requestedChecks,
-    resumeState: handle.state === 'committed' || handle.state === 'merged' ? handle.state : 'editing',
-    processes: {},
-  };
-  let current = transitionWorkHandle(ctx.controllerHome, handle, 'validating', {
-    finalization: { ...handle.finalization, validation: 'pending', lastError: undefined },
-    validationRun,
-  });
-  markWorkValidationPending(ctx.controllerHome, current);
-  const available = new Set(listControllerChecks(validated.worktreeRepository.canonicalRoot).map((check) => check.id));
-  const checks: Array<Record<string, unknown>> = [];
-  for (const [index, checkId] of requestedChecks.entries()) {
-    if (!available.has(checkId)) {
-      checks.push({ checkId, ok: false, status: 'missing', summary: `Check not found: ${checkId}` });
-      break;
-    }
-    const reusablePass = contract
-      ? [...effectiveVerificationEvidence(contract.checkRefs, {
-          sourceRevision: validationHead,
-          workspaceFingerprint,
-          checkId,
-          requestedChecks,
-        })].reverse().find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))
-      : undefined;
-    if (reusablePass) {
-      checks.push({
-        checkId,
-        ok: true,
-        status: 'passed',
-        reusedEvidence: true,
-        receipt: reusablePass.record.receipt,
-      });
-      continue;
-    }
-    const existingBinding = validationRun.processes[checkId];
-    let process = existingBinding
-      ? getCheckProcessHandle(ctx.controllerHome, handle.repositoryId, existingBinding.processId)
-      : undefined;
-    if (existingBinding && !process) {
-      checks.push({
-        checkId,
-        ok: false,
-        status: 'infrastructure_failure',
-        summary: `Validation process record is unavailable: ${existingBinding.processId}`,
-      });
-      break;
-    }
-    if (!process) {
-      const processRequestId = `${validationInvocationId}:check:${index + 1}`;
-      const executed = await runPersistedCheckViaProcessRuntime({
-        controllerHome: ctx.controllerHome,
-        repoId: handle.repositoryId,
-        checkoutId: handle.checkoutId,
-        repoRoot: validated.worktreeRepository.canonicalRoot,
-        executionIdentity: Object.freeze({
-          ...executionIdentityForWork(validated.worktreeRepository, handle),
-          expectedHead: validationHead === 'unknown' ? handle.expectedHead : validationHead,
-        }),
-        checkId,
-        requestId: processRequestId,
-        workId: handle.workId,
-        commandId: processRequestId,
-        verificationBinding: { executionSessionId: session.sessionId },
-        verificationSnapshot: contract && contract.allowedPaths.length > 0 ? {
-          workId: contract.workId,
-          allowedPaths: contract.allowedPaths,
-          forbiddenPaths: contract.forbiddenPaths,
-        } : undefined,
-      });
-      if (executed.mode === 'durable') {
-        checks.push({ checkId, ok: undefined, status: 'deferred', summary: executed.durable?.reason, durable: executed.durable });
-        break;
-      }
-      process = executed.process!;
-      const launchedRecord = getProcessRecord(ctx.controllerHome, handle.repositoryId, process.processId);
-      validationRun = {
-        ...validationRun,
-        processes: {
-          ...validationRun.processes,
-          [checkId]: {
-            processId: process.processId,
-            requestId: processRequestId,
-            ...(launchedRecord?.checkExecution ? { checkExecution: { ...launchedRecord.checkExecution } } : {}),
-          },
-        },
-      };
-      current = transitionWorkHandle(ctx.controllerHome, current, 'validating', { validationRun });
-    }
-    if (!process.completed) {
-      checks.push({ checkId, ok: undefined, status: 'running', process });
-      break;
-    }
-    const record = getProcessRecord(ctx.controllerHome, handle.repositoryId, process.processId);
-    if (!record) {
-      checks.push({ checkId, ok: false, status: 'infrastructure_failure', summary: `Validation process record is unavailable: ${process.processId}` });
-      break;
-    }
-    const boundCheckExecution = validationRun.processes[checkId]?.checkExecution;
-    const receipt = processCheckCompletionReceipt(record, {
-      repoId: handle.repositoryId,
-      checkoutId: handle.checkoutId,
-      workId: handle.workId,
-      checkId,
-      processId: process.processId,
-      ...(boundCheckExecution ? {
-        checkExecution: {
-          cacheKey: boundCheckExecution.cacheKey,
-          revision: boundCheckExecution.revision,
-          definitionDigest: boundCheckExecution.definitionDigest,
-          environmentFingerprint: boundCheckExecution.environmentFingerprint,
-          timeoutMs: boundCheckExecution.timeoutMs,
-          scopeKey: boundCheckExecution.scopeKey,
-        },
-      } : {}),
-    });
-    const terminalEvidence = classifyPersistedCheckTerminalEvidence(record, checkId);
-    const infrastructureFailed = receipt.timedOut
-      || receipt.cancelled
-      || terminalEvidence.state !== 'matched'
-      || (!receipt.ok && terminalEvidence.failureClass !== 'acceptance_failure');
-    appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, handle.workId, {
-      checkId,
-      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
-      summary: receipt.summary,
-      recordedAt: receipt.finishedAt,
-      sourceRevision: validationHead,
-      workspaceFingerprint,
-      verificationInputFingerprint: verificationInputFingerprint({
-        sourceRevision: validationHead,
-        workspaceFingerprint,
-        checkId,
-        requestedChecks,
-      }),
-      commandFingerprint: commandFingerprint(checkId, receipt.commandId),
-      resultArtifactId: receipt.receiptId,
-      startedAt: receipt.startedAt,
-      completedAt: receipt.finishedAt,
-      evidenceRef: { title: checkId, summary: `${receipt.receiptId}; artifact=${receipt.artifactPath}`, detailLevel: 'summary' },
-      receipt,
-    });
-    checks.push({
-      checkId,
-      ok: receipt.ok,
-      status: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'passed' : 'failed',
-      process,
-      receipt,
-      ...(terminalEvidence.warning ? { warning: terminalEvidence.warning } : {}),
-    });
-    if (!receipt.ok) break;
-  }
-  const infrastructureFailure = checks.find((check) => (
-    check.status === 'missing'
-    || check.status === 'infrastructure_failure'
-    || check.status === 'deferred'
-  ));
-  const acceptedFailure = checks.find((check) => check.status === 'failed');
-  const allObserved = checks.length === requestedChecks.length && checks.every((check) => check.ok !== undefined);
-  const completed = Boolean(infrastructureFailure || acceptedFailure || allObserved);
-  const passed = completed
-    && !infrastructureFailure
-    && !acceptedFailure
-    && checks.every((check) => check.ok === true);
-  const failureSummary = infrastructureFailure
-    ? String(infrastructureFailure.summary ?? 'validation infrastructure failure')
-    : acceptedFailure
-      ? String(acceptedFailure.summary ?? 'targeted validation failed')
-      : undefined;
-  const nextState = !completed
-    ? 'validating'
-    : passed
-      ? validationRun.resumeState
-      : 'failed';
-  const validation = !completed ? 'pending' : passed ? 'done' : 'failed';
-  const next = transitionWorkHandle(ctx.controllerHome, current, nextState, {
-    finalization: {
-      ...current.finalization,
-      validation,
-      lastError: failureSummary,
-    },
-    validationRun: completed ? undefined : validationRun,
-    ...(passed ? { validatedInputFingerprint: validationFingerprint } : {}),
-    ...(failureSummary ? { failureReason: failureSummary } : { failureReason: undefined }),
-  });
-  if (completed) {
-    projectWorkValidationOutcome(
-      ctx.controllerHome,
-      next,
-      infrastructureFailure ? 'infrastructure_failure' : passed ? 'passed' : 'failed',
-      failureSummary,
-    );
-  }
-  if (completed && acceptedFailure) {
-    const cleanup = await reconcileTerminalCleanup(ctx, session, next, args, 'validation_failed');
-    const value = {
-      ...cleanup,
-      validation: { passed, completed, checks, targeted: true, changedPaths, cleanupTriggered: true },
-    };
-    return makeBoundedResult(ctx, session, handle.repositoryId, handle.workId, 'validation', value);
-  }
-  const value = {
-    work: compactHandle(next),
-    validation: {
-      passed,
-      completed,
-      checks,
-      targeted: true,
-      changedPaths,
-      ...(infrastructureFailure ? { retryable: true, cleanupTriggered: false } : {}),
-    },
-  };
-  return makeBoundedResult(ctx, session, handle.repositoryId, handle.workId, 'validation', value);
-}
-
-function runCleanup(targetRoot: string, worktreePath: string): { ok: boolean; message?: string } {
-  if (targetRoot === worktreePath) return { ok: true };
-  if (!existsSync(worktreePath)) return { ok: true, message: 'managed worktree already removed' };
-  const status = repositoryGitStatus({ repoId: 'cleanup', activeCheckoutId: 'cleanup', canonicalRoot: worktreePath, localRoot: worktreePath, checkouts: [], schemaVersion: 1, displayName: basename(worktreePath), repositoryType: 'git', enabled: true, createdAt: '', updatedAt: '', lastSeenAt: '', configurationPath: '', stateStorageStrategy: 'controller-home' });
-  if (!status.clean) return { ok: false, message: 'managed worktree is dirty; cleanup preserved it' };
-  const process = spawnSync('git', ['-C', targetRoot, 'worktree', 'remove', worktreePath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 30_000 });
-  return process.status === 0 ? { ok: true } : { ok: false, message: String(process.stderr ?? 'git worktree remove failed').trim() };
-}
-
-/**
- * Reconcile a stale Work Handle only for a cleanup-only request whose exact
- * branch HEAD is already reachable from the requested target branch.
- *
- * Two bounded recovery cases are supported:
- * 1. an older controller committed/merged successfully but failed before
- *    recording the finalization stages; and
- * 2. a terminal cancelled WorkContract owns an unchanged, clean duplicate
- *    worktree created by an idempotency defect.
- *
- * Missing worktrees are accepted only when this handle already recorded a
- * successful worktree cleanup. This lets a retry finish branch cleanup after a
- * crash without turning a missing checkout into proof of safety.
- */
-function cleanupOnlyMergedHead(
-  ctx: MultiRepositoryMcpToolContext,
-  current: WorkHandleState,
-  args: Record<string, unknown>,
-): { currentHead: string; cancelledContract: boolean; worktreeMissing: boolean } | undefined {
-  if (args.cleanup !== true || args.commit === true || args.merge === true || !current.managedWorktree) return undefined;
-  const contract = contractFor(ctx, current);
-  const cancelledContract = contract?.status === 'cancelled';
-
-  const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
-  const target = selectWorkFinalizationTarget(repository, current);
-  const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : repository.defaultBranch || 'main';
-  const branchHeadResult = spawnSync('git', ['-C', target.canonicalRoot, 'rev-parse', '--verify', `refs/heads/${current.branch}`], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  const currentHead = branchHeadResult.status === 0 ? String(branchHeadResult.stdout ?? '').trim() : '';
-  if (!currentHead) return undefined;
-  const merged = spawnSync('git', ['-C', target.canonicalRoot, 'merge-base', '--is-ancestor', currentHead, targetBranch], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (merged.status !== 0) return undefined;
-
-  const worktreeMissing = !existsSync(current.worktreePath);
-  if (worktreeMissing) {
-    if (!cancelledContract || current.finalization.worktreeCleanup !== 'done') return undefined;
-    return { currentHead, cancelledContract, worktreeMissing: true };
-  }
-
-  const worktree = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
-  if (!repositoryGitStatus(worktree).clean) return undefined;
-  const worktreeHead = gitHead(worktree.canonicalRoot);
-  if (!worktreeHead || worktreeHead !== currentHead) return undefined;
-  const currentBranch = spawnSync('git', ['-C', worktree.canonicalRoot, 'branch', '--show-current'], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (currentBranch.status !== 0 || String(currentBranch.stdout ?? '').trim() !== current.branch) return undefined;
-  if (current.expectedHead && currentHead !== current.expectedHead && cancelledContract) return undefined;
-  return { currentHead, cancelledContract, worktreeMissing: false };
-}
-
-interface FailedCleanupProof {
-  currentHead: string;
-  worktreeMissing: boolean;
-  targetBranch: string;
-}
-
-/**
- * Prove that a failed Work owns an unchanged, clean managed worktree whose
- * branch is already contained in the target branch. This authorizes resource
- * cleanup only; it never proves successful verification or delivery.
- */
-function failedCleanupOnlyHead(
-  ctx: MultiRepositoryMcpToolContext,
-  current: WorkHandleState,
-  args: Record<string, unknown>,
-): FailedCleanupProof | undefined {
-  if (
-    current.state !== 'failed'
-    || args.cleanup !== true
-    || args.commit === true
-    || args.merge === true
-    || !current.managedWorktree
-  ) return undefined;
-  const contract = contractFor(ctx, current);
-  if (contract?.status !== 'failed') return undefined;
-
-  const expectedHead = current.expectedHead ?? current.baseCommit;
-  if (!expectedHead) return undefined;
-  const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
-  const target = selectWorkFinalizationTarget(repository, current);
-  const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : repository.defaultBranch || 'main';
-  const merged = spawnSync('git', ['-C', target.canonicalRoot, 'merge-base', '--is-ancestor', expectedHead, targetBranch], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (merged.status !== 0) return undefined;
-
-  const worktreeMissing = !existsSync(current.worktreePath);
-  if (worktreeMissing) {
-    return current.finalization.worktreeCleanup === 'done'
-      ? { currentHead: expectedHead, worktreeMissing: true, targetBranch }
-      : undefined;
-  }
-
-  const worktree = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
-  if (resolve(worktree.canonicalRoot) !== resolve(current.worktreePath)) return undefined;
-  if (!repositoryGitStatus(worktree).clean) return undefined;
-  if (gitHead(worktree.canonicalRoot) !== expectedHead) return undefined;
-  const currentBranch = spawnSync('git', ['-C', worktree.canonicalRoot, 'branch', '--show-current'], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (currentBranch.status !== 0 || String(currentBranch.stdout ?? '').trim() !== current.branch) return undefined;
-  return { currentHead: expectedHead, worktreeMissing: false, targetBranch };
-}
-
-type RetryableFinalizationStage = 'commit' | 'merge' | 'branchCleanup' | 'worktreeCleanup';
-
-function requestedFailedFinalizationRetry(
-  stages: WorkFinalizationStages,
-  wants: { commit: boolean; merge: boolean; cleanup: boolean },
-): RetryableFinalizationStage | undefined {
-  if (stages.validation === 'failed') return undefined;
-  if (wants.commit && stages.commit === 'failed') return 'commit';
-  if (wants.merge && stages.merge === 'failed') return 'merge';
-  if (wants.cleanup && stages.worktreeCleanup === 'failed') return 'worktreeCleanup';
-  if (wants.cleanup && stages.branchCleanup === 'failed') return 'branchCleanup';
-  return undefined;
-}
-
-function retryPhaseForFinalizationStage(stage: RetryableFinalizationStage): 'delivery' | 'cleanup' {
-  return stage === 'commit' || stage === 'merge' ? 'delivery' : 'cleanup';
-}
-
-function retryHandleStateForFinalization(stages: WorkFinalizationStages): WorkHandleState['state'] {
-  if (stages.merge === 'done') return 'merged';
-  if (stages.commit === 'done') return 'committed';
-  return 'validating';
-}
-
-export function resetFinalizationStagesForRequest(
-  stages: WorkFinalizationStages,
-  wants: { commit: boolean; merge: boolean; cleanup: boolean },
-  options: { managedWorktree?: boolean; deleteBranchRequested?: boolean; retainedByRequest?: boolean; workspaceDirty?: boolean } = {},
-): WorkFinalizationStages {
-  const next = { ...stages };
-  let reset = false;
-  if (next.validation === 'failed') {
-    next.validation = 'pending';
-    reset = true;
-  }
-  if (wants.commit && next.commit === 'failed') {
-    next.commit = 'pending';
-    reset = true;
-  }
-  if (wants.merge && next.merge === 'failed') {
-    next.merge = 'pending';
-    reset = true;
-  }
-  if (wants.cleanup && next.worktreeCleanup === 'failed') {
-    next.worktreeCleanup = 'pending';
-    reset = true;
-  }
-  if (wants.cleanup && next.branchCleanup === 'failed') {
-    next.branchCleanup = 'pending';
-    reset = true;
-  }
-  // A Work may be semantically repaired and revalidated after an earlier delivery
-  // attempt already marked commit/merge done. Exact validation of a dirty current
-  // workspace proves there is new Work-owned content still requiring delivery;
-  // re-arm only the requested Git stages instead of letting cleanup discard it.
-  if (options.workspaceDirty === true && wants.commit && next.commit === 'done') {
-    next.commit = 'pending';
-    reset = true;
-    if (wants.merge && next.merge === 'done') next.merge = 'pending';
-  }
-  // A prior finalize(cleanup=false) intentionally records managed resources as
-  // skipped/retained. A later explicit cleanup=true is a new resource-disposal
-  // request, not an idempotent replay of the earlier retention decision. Re-arm
-  // only cleanup stages that are applicable to this managed Work; commit/merge
-  // skipped states keep their original delivery semantics.
-  if (wants.cleanup && options.retainedByRequest === true && options.managedWorktree === true && next.worktreeCleanup === 'skipped') {
-    next.worktreeCleanup = 'pending';
-    reset = true;
-  }
-  if (wants.cleanup && options.retainedByRequest === true && options.managedWorktree === true && options.deleteBranchRequested === true && next.branchCleanup === 'skipped') {
-    next.branchCleanup = 'pending';
-    reset = true;
-  }
-  if (reset) delete next.lastError;
-  return next;
-}
-
-function finalizationComplete(stages: WorkFinalizationStages): boolean {
-  return stages.validation === 'done'
-    && stages.commit !== 'pending'
-    && stages.merge !== 'pending'
-    && stages.branchCleanup !== 'pending'
-    && stages.worktreeCleanup !== 'pending'
-    && stages.commit !== 'failed'
-    && stages.merge !== 'failed'
-    && stages.branchCleanup !== 'failed'
-    && stages.worktreeCleanup !== 'failed'
-    && !stages.lastError;
-}
-
-function finalStateForStages(stages: WorkFinalizationStages, fallback: WorkHandleState['state']): WorkHandleState['state'] {
-  if (stages.worktreeCleanup === 'done') return 'cleaned';
-  if (stages.merge === 'done') return 'merged';
-  if (stages.commit === 'done') return 'committed';
-  return fallback === 'failed' ? 'editing' : fallback;
-}
-
-function currentWorkValidationInput(
-  repository: RepositoryRecord,
-  handle: WorkHandleState,
-  requestedChecks: string[],
-): { head: string; workspaceFingerprint: string; fingerprint: string; clean: boolean } {
-  const status = repositoryGitStatus(repository);
-  const head = status.head ?? handle.expectedHead ?? handle.baseCommit ?? 'unknown';
-  const workspaceFingerprint = workspaceValidationFingerprint(repository.canonicalRoot, status);
-  return {
-    head,
-    workspaceFingerprint,
-    fingerprint: workValidationInputFingerprint(head, workspaceFingerprint, requestedChecks),
-    clean: status.clean,
-  };
-}
-
-async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
-  const session = requireSession(ctx, args);
-  let current = workForSession(ctx, session, args, { allowClaimedTerminalCleanup: args.cleanup !== false });
-  const requestedWants = { commit: args.commit === true, merge: args.merge === true, cleanup: args.cleanup === true };
-  const retryStage = current.state === 'failed'
-    ? requestedFailedFinalizationRetry(current.finalization, requestedWants)
-    : undefined;
-  const retryContract = retryStage ? contractFor(ctx, current) : undefined;
-  if (
-    retryStage
-    && retryContract?.status === 'failed'
-    && !retryContract.completionOutcome
-    && !retryContract.completionReceipt
-  ) {
-    transitionWorkContractPhase(
-      { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-      retryContract.workId,
-      {
-        phase: retryPhaseForFinalizationStage(retryStage),
-        status: 'running',
-        state: 'active',
-        summary: `Retrying previously failed Work finalization stage ${retryStage}.`,
-      },
-    );
-  }
-  const terminalOutcome = terminalCleanupOutcome(ctx, current);
-  if (terminalOutcome && args.cleanup !== false) {
-    return await reconcileTerminalCleanup(ctx, session, current, args, terminalOutcome);
-  }
-  const terminalizationOwner = assertWorkControllerOwnership(ctx, session, current, args);
-  if (terminalOutcome && args.cleanup === false) {
-    const recordedAt = new Date().toISOString();
-    current = withControllerLock(
-      ctx.controllerHome,
-      { scope: 'worktree', repoId: current.repositoryId, worktreeId: current.checkoutId },
-      `work-finalize:${current.workId}:retain-terminal-resources`,
-      () => {
-        const fresh = readWorkHandle(ctx.controllerHome, current.repositoryId, current.workId) ?? current;
-        return writeWorkHandle(ctx.controllerHome, {
-          ...fresh,
-          finalization: {
-            ...fresh.finalization,
-            validation: fresh.finalization.validation === 'failed' ? 'failed' : 'done',
-            commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
-            merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
-            branchCleanup: 'skipped',
-            worktreeCleanup: 'skipped',
-            lastError: fresh.finalization.validation === 'failed' ? fresh.finalization.lastError : undefined,
-          },
-          terminalResourceDisposition: {
-            mode: 'retained_by_request',
-            retainWorktree: fresh.managedWorktree,
-            retainBranch: true,
-            recordedAt,
-          },
-        });
-      },
-      10_000,
-    );
-    appendWorkEvidence(
-      { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-      current.workContractId ?? current.workId,
-      {
-        title: 'terminal resources retained by request',
-        summary: `Controller explicitly retained ${current.managedWorktree ? 'the managed worktree and ' : ''}local branch after terminal Work; automatic terminal cleanup must not reclaim them.`,
-        detailLevel: 'summary',
-      },
-    );
-    releasePreparedWorkOwnership(ctx, current);
-    updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
-      activeWorkId: undefined,
-      activeCheckoutId: current.sourceCheckoutId ?? session.activeCheckoutId,
-    });
-    return {
-      work: compactHandle(current),
-      stages: current.finalization,
-      completed: true,
-      cleanupCompleted: false,
-      cleanupRetained: true,
-      cleanupPending: false,
-      idempotent: true,
-    };
-  }
-  if (current.state === 'cleaned') {
-    const terminalContract = contractFor(ctx, current);
-    if (
-      terminalContract?.status === 'failed'
-      && current.finalization.validation === 'failed'
-      && current.finalization.worktreeCleanup === 'done'
-    ) {
-      releasePreparedWorkOwnership(ctx, current);
-      updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
-        activeWorkId: undefined,
-        activeCheckoutId: workReturnCheckoutId(ctx, current, session.activeCheckoutId),
-      });
-      return {
-        idempotent: true,
-        work: compactHandle(current),
-        stages: current.finalization,
-        completed: false,
-        cleanupCompleted: true,
-        failurePreserved: true,
-      };
-    }
-    validateWorkHandle(ctx.controllerHome, current, identityFor(ctx, args), 'none', 'finalize');
-    return { idempotent: true, work: compactHandle(current) };
-  }
-  const identity = identityFor(ctx, args);
-  const requestedOutcome = args.completion_outcome === 'completed_no_change' || args.completion_outcome === 'completed_changed'
-    ? args.completion_outcome
-    : undefined;
-  const noChangeProof = typeof args.no_change_evidence === 'string' ? args.no_change_evidence.trim().slice(0, 1_000) : '';
-  if (requestedOutcome === 'completed_no_change' && (!noChangeProof || args.commit === true || args.merge === true)) {
-    throw new Error('WORK_NO_CHANGE_PROOF_REQUIRED: completed_no_change requires objective-specific evidence and forbids commit/merge');
-  }
-  const wants = requestedWants;
-  const explicitTargetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : undefined;
-  // With merge=false an explicitly selected Work branch is the delivery target,
-  // not a disposable feature branch. Keep the ref reachable for the receipt.
-  const retainExplicitWorkTargetBranch = !wants.merge && explicitTargetBranch === current.branch;
-  const deleteBranchRequested = args.delete_branch !== false && !retainExplicitWorkTargetBranch;
-  const noChangeFastPath = requestedOutcome === 'completed_no_change'
-    && !wants.commit
-    && !wants.merge
-    && current.state !== 'failed';
-
-  const transact = (label: string, update: (fresh: WorkHandleState) => WorkHandleState): WorkHandleState =>
-    withControllerLock(ctx.controllerHome, { scope: 'worktree', repoId: current.repositoryId, worktreeId: current.checkoutId }, `work-finalize:${current.workId}:${label}`, () => {
-      const fresh = readWorkHandle(ctx.controllerHome, current.repositoryId, current.workId) ?? current;
-      return update(fresh);
-    }, 10_000);
-
-  const failStage = (stage: keyof WorkFinalizationStages, reason: string): Record<string, unknown> => {
-    current = transact(`fail:${String(stage)}`, (fresh) => {
-      const finalization = { ...fresh.finalization, [stage]: 'failed', lastError: reason } as WorkFinalizationStages;
-      return markWorkHandleFailed(ctx.controllerHome, { ...fresh, finalization }, reason);
-    });
-    if (current.workContractId) {
-      if (stage === 'validation') {
-        updateWorkContract({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId, { status: 'failed' });
-      } else if (stage === 'commit' || stage === 'merge' || stage === 'branchCleanup' || stage === 'worktreeCleanup') {
-        transitionWorkContractPhase(
-          { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-          current.workContractId,
-          {
-            phase: retryPhaseForFinalizationStage(stage),
-            status: 'blocked',
-            state: 'blocked',
-            summary: `Retryable Work finalization stage ${stage} failed: ${reason}`,
-          },
-        );
-      }
-    }
-    markRepositoryProjectionDirty(ctx.controllerHome, current.repositoryId, `finalize:${current.workId}:${String(stage)}-failed`);
-    return { work: compactHandle(current), stages: current.finalization, completed: false };
-  };
-
-  const failedCleanupRequested = current.state === 'failed'
-    && wants.cleanup
-    && !wants.commit
-    && !wants.merge
-    && retryStage === undefined;
-  const failedCleanupProof = failedCleanupRequested
-    ? failedCleanupOnlyHead(ctx, current, args)
-    : undefined;
-  if (failedCleanupRequested && !failedCleanupProof) {
-    throw new Error('WORK_FAILED_CLEANUP_UNSAFE: failed Work cleanup requires exact checkout/branch ownership and an unchanged clean controller-owned managed worktree whose exact HEAD is already contained in the target branch');
-  }
-
-  if (!failedCleanupRequested && !noChangeFastPath) {
-    current = transact('begin', (fresh) => writeWorkHandle(ctx.controllerHome, {
-      ...fresh,
-      state: fresh.state === 'failed' ? retryHandleStateForFinalization(fresh.finalization) : fresh.state,
-      failureReason: undefined,
-      finalization: resetFinalizationStagesForRequest(fresh.finalization, wants, {
-        managedWorktree: fresh.managedWorktree,
-        deleteBranchRequested,
-        retainedByRequest: fresh.terminalResourceDisposition?.mode === 'retained_by_request',
-      }),
-      ...(wants.cleanup && fresh.terminalResourceDisposition?.mode === 'retained_by_request' ? { terminalResourceDisposition: undefined } : {}),
-    }));
-  }
-
-  const approvalRequestId = typeof args.approval_request_id === 'string' ? args.approval_request_id.trim() : '';
-  const resolvedAuthorization = approvalRequestId
-    ? assertResolvedAuthorization({ controllerHome: ctx.controllerHome, repositoryId: current.repositoryId, approvalRequestId, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, permissionSnapshotVersion: current.permissionSnapshotVersion, command: 'work_finalize' })
-    : undefined;
-  const gitAuthorization = resolvedAuthorization
-    ? { decision: 'allow', source: 'user_confirmation', reason: 'The user resolved the exact finalization approval request.' } as const
-    : decideAuthorization({
-      controllerHome: ctx.controllerHome,
-      accessMode: readRepositoryAccessPolicy(ctx.controllerHome, current.repositoryId).mode,
-      risk: 'local_git',
-      repositoryId: current.repositoryId,
-      currentRepositoryId: current.repositoryId,
-      workId: current.workId,
-      boundWorkId: current.workId,
-      goalId: current.goalId,
-      boundGoalId: current.goalId,
-      sessionId: session.sessionId,
-      principalId: session.principalId,
-      permissionSnapshotVersion: current.permissionSnapshotVersion,
-      delegation: session.goalDelegation,
-      command: 'work_finalize',
-    });
-  if (gitAuthorization.decision !== 'allow') return { authorization: gitAuthorization, work: compactHandle(current), stages: current.finalization };
-
-  if (failedCleanupProof) {
-    const preservedFailure = current.failureReason ?? current.finalization.lastError ?? 'Work validation failed.';
-    current = transact('failed-cleanup-begin', (fresh) => writeWorkHandle(ctx.controllerHome, {
-      ...fresh,
-      state: 'failed',
-      failureReason: preservedFailure,
-      finalization: {
-        ...fresh.finalization,
-        validation: 'failed',
-        commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
-        merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
-        branchCleanup: deleteBranchRequested ? fresh.finalization.branchCleanup : 'skipped',
-        lastError: preservedFailure,
-      },
-    }));
-
-    if (!failedCleanupProof.worktreeMissing && current.finalization.worktreeCleanup !== 'done') {
-      const target = selectWorkFinalizationTarget(
-        getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true }),
-        current,
-      );
-      const cleanup = runCleanup(target.canonicalRoot, current.worktreePath);
-      if (!cleanup.ok) {
-        throw new Error(`WORK_FAILED_CLEANUP_UNSAFE: ${cleanup.message ?? 'managed worktree cleanup failed'}`);
-      }
-      current = transact('failed-worktree-cleanup-done', (fresh) => {
-        setRepositoryCheckoutLifecycle({
-          controllerHome: ctx.controllerHome,
-          repoId: fresh.repositoryId,
-          checkoutId: fresh.checkoutId,
-          lifecycle: 'removed',
-          reason: `Failed Work ${fresh.workId} cleanup completed without changing delivery state.`,
-        });
-        markRepositoryProjectionDirty(ctx.controllerHome, fresh.repositoryId, `cleanup:${fresh.workId}:failed-worktree`);
-        return writeWorkHandle(ctx.controllerHome, {
-          ...fresh,
-          state: 'failed',
-          failureReason: preservedFailure,
-          finalization: { ...fresh.finalization, worktreeCleanup: 'done', lastError: preservedFailure },
-        });
-      });
-    }
-
-    if (deleteBranchRequested && current.finalization.branchCleanup !== 'done') {
-      const target = selectWorkFinalizationTarget(
-        getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true }),
-        current,
-      );
-      const deleted = repositoryGitDeleteBranch(ctx.controllerHome, target, {
-        branch: current.branch,
-        force: false,
-        authorizationDecision: gitAuthorization,
-        sessionId: session.sessionId,
-        principalId: session.principalId,
-        workId: current.workId,
-        goalId: current.goalId,
-      });
-      if (deleted.execution.authorizationDecision?.decision === 'user_confirmation_required') {
-        return { authorization: deleted.execution.authorizationDecision, work: compactHandle(current), stages: current.finalization };
-      }
-      if (deleted.execution.status !== 'executed' || deleted.execution.ok !== true) {
-        current = transact('failed-branch-cleanup-failed', (fresh) => writeWorkHandle(ctx.controllerHome, {
-          ...fresh,
-          state: 'failed',
-          failureReason: preservedFailure,
-          finalization: {
-            ...fresh.finalization,
-            branchCleanup: 'failed',
-            lastError: String(deleted.execution.stderr || 'feature branch cleanup failed').slice(0, 1_000),
-          },
-        }));
-        return {
-          work: compactHandle(current),
-          stages: current.finalization,
-          completed: false,
-          cleanupCompleted: false,
-          failurePreserved: true,
-        };
-      }
-      current = transact('failed-branch-cleanup-done', (fresh) => {
-        markRepositoryProjectionDirty(ctx.controllerHome, fresh.repositoryId, `cleanup:${fresh.workId}:failed-branch`);
-        return writeWorkHandle(ctx.controllerHome, {
-          ...fresh,
-          state: 'failed',
-          failureReason: preservedFailure,
-          finalization: { ...fresh.finalization, branchCleanup: 'done', lastError: preservedFailure },
-        });
-      });
-    }
-
-    current = transact('failed-cleanup-complete', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'cleaned', {
-      failureReason: preservedFailure,
-      finalization: {
-        ...fresh.finalization,
-        validation: 'failed',
-        commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
-        merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
-        branchCleanup: deleteBranchRequested ? fresh.finalization.branchCleanup : 'skipped',
-        worktreeCleanup: 'done',
-        lastError: preservedFailure,
-      },
-    }));
-    appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-      title: 'failed work cleanup completed',
-      summary: `Controller preserved the failed Work outcome while removing its unchanged clean managed worktree and ${deleteBranchRequested ? 'removing' : 'retaining'} the local branch after proving ${failedCleanupProof.currentHead} is contained in ${failedCleanupProof.targetBranch}.`,
-      detailLevel: 'summary',
-    });
-    releasePreparedWorkOwnership(ctx, current);
-    updateExecutionSession(ctx.controllerHome, identity, {
-      activeWorkId: undefined,
-      activeCheckoutId: current.sourceCheckoutId ?? session.activeCheckoutId,
-    });
-    return {
-      work: compactHandle(current),
-      stages: current.finalization,
-      completed: false,
-      cleanupCompleted: true,
-      failurePreserved: true,
-      idempotent: false,
-    };
-  }
-
-  const contractAtStart = contractFor(ctx, current);
-  const cancelledCleanupRequested = contractAtStart?.status === 'cancelled'
-    && wants.cleanup
-    && !wants.commit
-    && !wants.merge;
-  const cleanupReconciliation = requestedOutcome === 'completed_no_change'
-    ? undefined
-    : cleanupOnlyMergedHead(ctx, current, args);
-  if (cancelledCleanupRequested && !cleanupReconciliation) {
-    throw new Error('WORK_CANCELLED_CLEANUP_UNSAFE: cancelled Work cleanup requires an unchanged clean managed worktree (or a previously recorded cleanup) and a branch HEAD already contained in the target branch');
-  }
-  if (cleanupReconciliation) {
-    current = transact('cleanup-reconcile-merged-head', (fresh) => writeWorkHandle(ctx.controllerHome, {
-      ...fresh,
-      expectedHead: cleanupReconciliation.currentHead,
-      state: 'merged',
-      failureReason: undefined,
-      finalization: {
-        ...fresh.finalization,
-        validation: cleanupReconciliation.worktreeMissing ? 'done' : fresh.finalization.validation,
-        commit: fresh.finalization.commit === 'pending' ? 'skipped' : fresh.finalization.commit,
-        merge: 'done',
-        branchCleanup: deleteBranchRequested ? 'pending' : 'skipped',
-        lastError: undefined,
-      },
-    }));
-  }
-
-  const changedCleanupOnly = wants.cleanup
-    && !wants.commit
-    && !wants.merge
-    && requestedOutcome !== 'completed_no_change'
-    && current.state !== 'merged'
-    && current.state !== 'cleaned';
-  if (changedCleanupOnly && !cleanupReconciliation) {
-    throw new Error('WORK_CLEANUP_DELIVERY_NOT_PROVEN: cleanup-only completion requires the exact Work branch HEAD to already be contained in the target branch before any managed worktree is removed');
-  }
-
-  const terminalCleanupOnly = Boolean(cleanupReconciliation && wants.cleanup && !wants.commit && !wants.merge);
-  let exactValidationInput: ReturnType<typeof currentWorkValidationInput> | undefined;
-  if (terminalCleanupOnly) {
-    current = transact('terminal-cleanup-validation-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, {
-      ...fresh,
-      finalization: { ...fresh.finalization, validation: 'done', lastError: undefined },
-    }));
-  } else {
-    let validatedRepository: RepositoryRecord;
-    try {
-      validatedRepository = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize').worktreeRepository;
-    } catch (error) {
-      return failStage('validation', error instanceof Error ? error.message : String(error));
-    }
-    const validationContract = contractFor(ctx, current);
-    if (!validationContract) throw new Error(`WORK_VALIDATION_CONTRACT_MISSING: ${current.workContractId ?? current.workId}`);
-    const validationInput = currentWorkValidationInput(validatedRepository, current, validationContract.checks);
-    exactValidationInput = validationInput;
-    if (validationContract.checks.length === 0) {
-      if (!noChangeFastPath) {
-        current = transact('validation-no-checks', (fresh) => writeWorkHandle(ctx.controllerHome, {
-          ...fresh,
-          validatedInputFingerprint: validationInput.fingerprint,
-          finalization: { ...fresh.finalization, validation: 'done', lastError: undefined },
-        }));
-      }
-      projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required.');
-    } else if (!hasCurrentWorkValidationAuthority({
-      finalizationValidation: current.finalization.validation,
-      validatedInputFingerprint: current.validatedInputFingerprint,
-      evidenceState: validationContract.evidenceState,
-      expectedFingerprint: validationInput.fingerprint,
-    })) {
-      current = transact('validation-required', (fresh) => writeWorkHandle(ctx.controllerHome, {
-        ...fresh,
-        validatedInputFingerprint: undefined,
-        finalization: { ...fresh.finalization, validation: 'pending', lastError: undefined },
-      }));
-      markWorkValidationPending(ctx.controllerHome, current);
-      throw new Error('WORK_VALIDATION_REQUIRED: run work_validate against the exact current workspace before finalization');
-    }
-    if (!validationInput.clean && wants.commit && current.finalization.commit === 'done') {
-      current = transact('rearm-delivery-after-validated-repair', (fresh) => writeWorkHandle(ctx.controllerHome, {
-        ...fresh,
-        state: 'validating',
-        failureReason: undefined,
-        finalization: resetFinalizationStagesForRequest(fresh.finalization, wants, {
-          managedWorktree: fresh.managedWorktree,
-          deleteBranchRequested,
-          retainedByRequest: fresh.terminalResourceDisposition?.mode === 'retained_by_request',
-          workspaceDirty: true,
-        }),
-      }));
-    }
-    if (wants.merge && !wants.commit && !validationInput.clean) {
-      throw new Error('WORK_MERGE_UNCOMMITTED_CHANGES: commit the validated workspace before merging');
-    }
-  }
-
-  if (noChangeFastPath) {
-    if (!exactValidationInput?.clean) {
-      throw new Error('WORK_NO_CHANGE_DIRTY: completed_no_change cannot retain an owned dirty worktree');
-    }
-    const noChangeFinalization: WorkFinalizationStages = {
-      ...current.finalization,
-      validation: 'done',
-      commit: 'skipped',
-      merge: 'skipped',
-      branchCleanup: wants.cleanup && deleteBranchRequested ? 'pending' : 'skipped',
-      lastError: undefined,
-    };
-    // Collapse the no-op Git stages into the same durable lifecycle write used
-    // to enter/establish the delivery boundary. Physical cleanup remains
-    // separately persisted because it has real side effects and crash semantics.
-    if (current.state === 'prepared') {
-      current = transact('no-change-validated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'validating', {
-        finalization: noChangeFinalization,
-        validatedInputFingerprint: exactValidationInput.fingerprint,
-        failureReason: undefined,
-      }));
-    } else if (current.state === 'editing' || current.state === 'validating' || current.state === 'committed') {
-      current = transact('no-change-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-        finalization: noChangeFinalization,
-        validatedInputFingerprint: exactValidationInput.fingerprint,
-        failureReason: undefined,
-      }));
-    }
-  }
-
-  if (wants.commit && current.finalization.commit === 'pending') {
-    const validated = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize');
-    const contract = contractFor(ctx, current);
-    if (contract?.constraints.allowCommit === false) throw new Error('WORK_COMMIT_NOT_ALLOWED: WorkContract disallows commit');
-    const status = repositoryGitStatus(validated.worktreeRepository);
-    const { dirtyPaths, ownedPaths: commitPaths } = workOwnedDirtyPaths(contract, status);
-    if (dirtyPaths.length > 0 && commitPaths.length === 0) {
-      throw new Error(`WORK_COMMIT_NO_OWNED_DIRTY_PATHS: ${current.workId} has ${dirtyPaths.length} dirty path(s), but none are owned by its WorkContract path scope`);
-    }
-    const committed = repositoryGitCommit(ctx.controllerHome, validated.worktreeRepository, { message: String(args.message ?? `Complete ${current.workId}`), paths: commitPaths, allowEmpty: false, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
-    const pendingAuthorization = [committed.stage, committed.commit].find((execution) => execution?.authorizationDecision?.decision === 'user_confirmation_required')?.authorizationDecision;
-    if (pendingAuthorization) return { authorization: pendingAuthorization, work: compactHandle(current), stages: current.finalization };
-    if (!committed.committed) return { ...failStage('commit', committed.error?.message ?? 'commit failed'), commit: committed };
-    const checks = contract?.checks ?? [];
-    const committedValidatedWorkspaceFingerprint = exactValidationInput && committed.after.clean
-      ? workspaceValidationFingerprint(validated.worktreeRepository.canonicalRoot, committed.before)
-      : undefined;
-    const validationPreservedAcrossCommit = Boolean(
-      checks.length > 0
-      && exactValidationInput
-      && committedValidatedWorkspaceFingerprint === exactValidationInput.workspaceFingerprint
-    );
-    const committedHead = gitHead(validated.worktreeRepository.canonicalRoot);
-    const postCommitInput = currentWorkValidationInput(validated.worktreeRepository, { ...current, expectedHead: committedHead }, checks);
-    current = transact('commit-done', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'committed', {
-      expectedHead: committedHead,
-      finalization: {
-        ...fresh.finalization,
-        validation: checks.length ? (validationPreservedAcrossCommit ? 'done' : 'pending') : 'done',
-        commit: 'done',
-        lastError: undefined,
-      },
-      validatedInputFingerprint: checks.length
-        ? (validationPreservedAcrossCommit ? postCommitInput.fingerprint : undefined)
-        : postCommitInput.fingerprint,
-      failureReason: undefined,
-    }));
-    if (checks.length && !validationPreservedAcrossCommit) {
-      markWorkValidationPending(ctx.controllerHome, current);
-      return {
-        work: compactHandle(current),
-        stages: current.finalization,
-        completed: false,
-        continuation: 'WORK_COMMITTED_REVALIDATION_REQUIRED: committed content changed from the exact validated workspace; run work_validate on the committed HEAD before merge or completion',
-      };
-    }
-    if (validationPreservedAcrossCommit && exactValidationInput) {
-      const checkDefinitions = listControllerChecks(validated.worktreeRepository.canonicalRoot);
-      for (const checkId of checks) {
-        const check = checkDefinitions.find((entry) => entry.id === checkId);
-        if (check?.effects?.git !== undefined) continue;
-        const sourcePass = contract
-          ? effectiveVerificationEvidence(contract.checkRefs, {
-              sourceRevision: exactValidationInput.head,
-              workspaceFingerprint: exactValidationInput.workspaceFingerprint,
-              checkId,
-              requestedChecks: checks,
-            }).find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))?.record
-          : undefined;
-        if (!sourcePass) continue;
-        appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-          ...sourcePass,
-          summary: `Validation authority transferred across content-equivalent commit for ${checkId}.`,
-          recordedAt: new Date().toISOString(),
-          sourceRevision: postCommitInput.head,
-          workspaceFingerprint: postCommitInput.workspaceFingerprint,
-          verificationInputFingerprint: verificationInputFingerprint({
-            sourceRevision: postCommitInput.head,
-            workspaceFingerprint: postCommitInput.workspaceFingerprint,
-            checkId,
-            requestedChecks: checks,
-          }),
-          evidenceRef: {
-            title: checkId,
-            summary: 'Reused prior valid receipt after proving the validated filesystem content was committed without drift.',
-            detailLevel: 'summary',
-          },
-        });
-      }
-      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-        title: 'validation authority preserved across content-equivalent commit',
-        summary: `Exact validated workspace ${exactValidationInput.workspaceFingerprint.slice(0, 16)} was committed without content/status drift; non-Git-sensitive per-check authority transferred to committed HEAD ${postCommitInput.head}.`,
-        detailLevel: 'summary',
-      });
-    } else if (checks.length === 0) {
-      projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required after commit.');
-    }
-  } else if (!wants.commit && current.finalization.commit === 'pending') {
-    current = transact('commit-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, commit: 'skipped' } }));
-  }
-
-  if (wants.merge && current.finalization.merge === 'pending' && current.finalization.commit === 'done') {
-    const repository = getRepository(current.repositoryId, ctx.controllerHome);
-    const target = selectWorkFinalizationTarget(repository, current);
-    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
-    const directTarget = inspectDirectTargetDelivery(
-      target.canonicalRoot,
-      current.worktreePath,
-      current.managedWorktree,
-      current.branch,
-      targetBranch,
-      current.expectedHead,
-    );
-    if (directTarget.integrated) {
-      current = transact('direct-target-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-        finalization: { ...fresh.finalization, merge: 'done', branchCleanup: 'skipped', lastError: undefined },
-        failureReason: undefined,
-      }));
-      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-        title: 'direct target delivery already integrated',
-        summary: `Work ${current.workId} runs directly on ${targetBranch}; exact delivery revision ${directTarget.expectedHead} is reachable from current target ${directTarget.targetHead}, so no self-merge or target-branch deletion is required.`,
-        detailLevel: 'summary',
-      });
-    }
-  }
-
-  if (wants.merge && current.finalization.merge === 'pending') {
-    const mergeValidated = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize');
-    if (mergeValidated.currentHead && mergeValidated.currentHead !== current.expectedHead) {
-      current = transact('merge-adopt-work-delivery-head', (fresh) => writeWorkHandle(ctx.controllerHome, {
-        ...fresh,
-        expectedHead: mergeValidated.currentHead,
-        failureReason: undefined,
-      }));
-    }
-    const contract = contractFor(ctx, current);
-    if (contract?.constraints.allowMerge === false) throw new Error('WORK_MERGE_NOT_ALLOWED: WorkContract disallows merge');
-    const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
-    const deleteAfterWorktreeCleanup = current.managedWorktree && deleteBranchRequested;
-    const targetBranch = explicitTargetBranch ?? target.defaultBranch ?? 'main';
-    const activeMergeHead = retryStage === 'merge' ? gitRevision(target.canonicalRoot, 'MERGE_HEAD') : undefined;
-    if (!activeMergeHead && current.managedWorktree && current.expectedHead) {
-      const targetHead = gitRevision(target.canonicalRoot, targetBranch);
-      if (targetHead) {
-        const advance = inspectWorkTargetAdvance(mergeValidated.worktreeRepository.canonicalRoot, current.expectedHead, targetHead);
-        if (advance.relation === 'diverged_conflict') {
-          if (contract) {
-            transitionWorkContractPhase(
-              { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-              contract.workId,
-              {
-                phase: 'delivery',
-                status: 'blocked',
-                state: 'blocked',
-                summary: `Target branch ${targetBranch} advanced to ${advance.targetHead} and conflicts with candidate ${advance.candidateHead}; canonical target was not mutated.`,
-              },
-            );
-          }
-          return {
-            work: compactHandle(current),
-            stages: current.finalization,
-            completed: false,
-            blocked: true,
-            recoverable: true,
-            error: {
-              code: 'WORK_TARGET_ADVANCE_CONFLICT',
-              message: `Target branch ${targetBranch} advanced and cannot be integrated cleanly into the isolated Work candidate. Canonical target was left unchanged.${advance.detail ? ` ${advance.detail}` : ''}`,
-            },
-            continuation: 'WORK_TARGET_ADVANCE_REVIEW_REQUIRED: inspect the target/candidate conflict, repair only inside the managed Work checkout, then revalidate before retrying finalize.',
-          };
-        }
-        if (advance.relation === 'candidate_contains_target') {
-          const nonLinearCommits = targetAdvanceLinearMergeCommits(
-            mergeValidated.worktreeRepository.canonicalRoot,
-            advance.targetHead,
-            advance.candidateHead,
-          );
-          if (nonLinearCommits.length > 0) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: candidate already contains merge commit(s) above reconciled target ${advance.targetHead}: ${nonLinearCommits.slice(0, 8).join(', ')}`);
-          }
-          const scopeViolation = targetAdvanceWorkScopeViolation(contract, advance.candidateChangedPaths);
-          if (scopeViolation) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_SCOPE_VIOLATION: Work-owned ${scopeViolation.kind} path ${scopeViolation.path}`);
-          }
-          if (contract) replaceTargetAdvanceScopeEvidence(ctx, contract, advance.candidateChangedPaths);
-          current = transact('target-advance-provenance-confirmed', (fresh) => writeWorkHandle(ctx.controllerHome, {
-            ...fresh,
-            deliveryBaseCommit: advance.targetHead,
-          }));
-        }
-        if (advance.relation === 'diverged_clean') {
-          const preIntegrationScopeViolation = targetAdvanceWorkScopeViolation(contract, advance.candidateChangedPaths);
-          if (preIntegrationScopeViolation) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_SCOPE_VIOLATION: Work-owned ${preIntegrationScopeViolation.kind} path ${preIntegrationScopeViolation.path}`);
-          }
-          const checks = contract?.checks ?? [];
-          const candidateInput = currentWorkValidationInput(mergeValidated.worktreeRepository, current, checks);
-          const checksBefore = checks.length > 0 ? listControllerChecks(mergeValidated.worktreeRepository.canonicalRoot) : [];
-          const integrated = repositoryGitRebaseOnto(ctx.controllerHome, mergeValidated.worktreeRepository, {
-            onto: advance.targetHead,
-            upstream: advance.mergeBase,
-            abortOnFailure: true,
-            authorizationDecision: gitAuthorization,
-            sessionId: session.sessionId,
-            principalId: session.principalId,
-            workId: current.workId,
-            goalId: current.goalId,
-          });
-          if (!integrated.rebased) {
-            if (contract) {
-              transitionWorkContractPhase(
-                { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-                contract.workId,
-                {
-                  phase: 'delivery',
-                  status: 'blocked',
-                  state: 'blocked',
-                  summary: `Linear target-advance integration failed inside the isolated Work checkout; canonical ${targetBranch} was not mutated.`,
-                },
-              );
-            }
-            return {
-              work: compactHandle(current),
-              stages: current.finalization,
-              completed: false,
-              blocked: true,
-              recoverable: integrated.restored,
-              error: {
-                code: 'WORK_TARGET_ADVANCE_LINEAR_INTEGRATION_FAILED',
-                message: integrated.restored
-                  ? 'Target advancement could not be rebased safely; the isolated Work checkout was restored to its original candidate HEAD.'
-                  : 'Target advancement rebase failed and exact checkout restoration could not be proven; inspect the isolated Work checkout before retrying.',
-              },
-              continuation: 'WORK_TARGET_ADVANCE_REVIEW_REQUIRED: inspect the isolated Work checkout and retry only after its exact branch/HEAD/cleanliness are proven.',
-            };
-          }
-          const integratedHead = gitHead(mergeValidated.worktreeRepository.canonicalRoot);
-          if (!integratedHead || !gitIsAncestor(mergeValidated.worktreeRepository.canonicalRoot, advance.targetHead, integratedHead)) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_ANCESTRY_MISMATCH: target ${advance.targetHead} is not an ancestor of ${integratedHead ?? 'unavailable'}`);
-          }
-          const mergeCommits = targetAdvanceLinearMergeCommits(
-            mergeValidated.worktreeRepository.canonicalRoot,
-            advance.targetHead,
-            integratedHead,
-          );
-          const integratedTree = spawnSync('git', ['-C', mergeValidated.worktreeRepository.canonicalRoot, 'rev-parse', '--verify', `${integratedHead}^{tree}`], {
-            encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-          });
-          if (mergeCommits.length > 0) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: integrated candidate contains merge commit(s): ${mergeCommits.slice(0, 8).join(', ')}`);
-          }
-          if (
-            !advance.mergedTree
-            || integratedTree.status !== 0
-            || integratedTree.error
-            || typeof integratedTree.stdout !== 'string'
-            || integratedTree.stdout.trim() !== advance.mergedTree
-          ) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_TREE_MISMATCH: rebased candidate tree does not equal the preflight clean integration tree ${advance.mergedTree ?? 'unavailable'}`);
-          }
-          const workOwnedChangedPaths = gitChangedPaths(mergeValidated.worktreeRepository.canonicalRoot, advance.targetHead, integratedHead);
-          const postIntegrationScopeViolation = targetAdvanceWorkScopeViolation(contract, workOwnedChangedPaths);
-          if (postIntegrationScopeViolation) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_SCOPE_VIOLATION: integrated Work-owned ${postIntegrationScopeViolation.kind} path ${postIntegrationScopeViolation.path}`);
-          }
-          const integratedInput = currentWorkValidationInput(
-            mergeValidated.worktreeRepository,
-            { ...current, expectedHead: integratedHead },
-            checks,
-          );
-          const checksAfter = checks.length > 0 ? listControllerChecks(mergeValidated.worktreeRepository.canonicalRoot) : [];
-          const transferPlan = contract
-            ? planTargetAdvanceValidationAuthority({
-                checkIds: checks,
-                checkRefs: contract.checkRefs,
-                checksBefore,
-                checksAfter,
-                candidateHead: advance.candidateHead,
-                candidateWorkspaceFingerprint: candidateInput.workspaceFingerprint,
-                integratedHead,
-                integratedWorkspaceFingerprint: integratedInput.workspaceFingerprint,
-                targetChangedPaths: advance.targetChangedPaths,
-              })
-            : { transferredRecords: [], reusableCheckIds: [], invalidatedCheckIds: checks };
-          for (const record of transferPlan.transferredRecords) {
-            appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, record);
-          }
-          if (contract) replaceTargetAdvanceScopeEvidence(ctx, contract, workOwnedChangedPaths);
-          const validationPreserved = transferPlan.invalidatedCheckIds.length === 0;
-          current = transact('target-advance-integrated', (fresh) => transitionWorkHandle(
-            ctx.controllerHome,
-            fresh,
-            validationPreserved ? 'committed' : 'validating',
-            {
-              deliveryBaseCommit: advance.targetHead,
-              expectedHead: integratedHead,
-              failureReason: undefined,
-              finalization: { ...fresh.finalization, validation: validationPreserved ? 'done' : 'pending', merge: 'pending', lastError: undefined },
-              validationRun: undefined,
-              validatedInputFingerprint: validationPreserved ? integratedInput.fingerprint : undefined,
-            },
-          ));
-          appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-            title: 'target advancement linearly integrated into isolated Work candidate',
-            summary: `Canonical ${targetBranch} at ${advance.targetHead} advanced independently. Forge rebased Work candidate ${advance.candidateHead} onto it as ${integratedHead} with no merge commits; Work scope is ${workOwnedChangedPaths.length} target-relative path(s). Validation authority transferred for ${transferPlan.reusableCheckIds.length}/${checks.length} check(s); ${transferPlan.invalidatedCheckIds.length} check(s) require fresh evidence.`,
-            detailLevel: 'summary',
-          });
-          if (!validationPreserved) {
-            markWorkValidationPending(ctx.controllerHome, current);
-            return {
-              work: compactHandle(current),
-              stages: current.finalization,
-              completed: false,
-              continuation: `WORK_COMMITTED_REVALIDATION_REQUIRED: target branch ${targetBranch} changed inputs for [${transferPlan.invalidatedCheckIds.join(', ')}]; unaffected check evidence was transferred to ${integratedHead} and may be reused`,
-            };
-          }
-          projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', checks.length === 0
-            ? 'Target advancement was linearly integrated and no validation checks were required.'
-            : `Target advancement was linearly integrated; all ${checks.length} check result(s) retained authority because target-only changes did not affect their declared inputs.`);
-        }
-      }
-    }
-    let merged: ReturnType<typeof repositoryGitFinishWorkflow>;
-    if (activeMergeHead) {
-      const expectedMergeHead = current.expectedHead ? gitRevision(target.canonicalRoot, current.expectedHead) : undefined;
-      const featureHead = gitRevision(target.canonicalRoot, current.branch);
-      const currentBranchResult = spawnSync('git', ['-C', target.canonicalRoot, 'branch', '--show-current'], {
-        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-      });
-      const currentBranchName = currentBranchResult.status === 0 && typeof currentBranchResult.stdout === 'string'
-        ? currentBranchResult.stdout.trim()
-        : '';
-      if (!expectedMergeHead || activeMergeHead !== expectedMergeHead || featureHead !== expectedMergeHead || currentBranchName !== targetBranch) {
-        return failStage(
-          'merge',
-          `WORK_MERGE_HEAD_OWNERSHIP_MISMATCH: retry may conclude only Work ${current.workId} merge head ${expectedMergeHead ?? 'unavailable'} from ${current.branch} while on ${targetBranch}; observed MERGE_HEAD ${activeMergeHead}, feature ${featureHead ?? 'unavailable'}, branch ${currentBranchName || 'unavailable'}`,
-        );
-      }
-      const unmerged = spawnSync('git', ['-C', target.canonicalRoot, 'diff', '--name-only', '--diff-filter=U'], {
-        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-      });
-      if (unmerged.status !== 0 || unmerged.error || typeof unmerged.stdout !== 'string') {
-        return failStage('merge', 'WORK_MERGE_CONFLICT_STATE_UNAVAILABLE: unable to prove that the owned merge has no unmerged paths');
-      }
-      if (unmerged.stdout.trim()) {
-        return failStage('merge', `WORK_MERGE_CONFLICTS_UNRESOLVED: resolve and stage all paths before retrying finalize (${unmerged.stdout.trim().split('\n').filter(Boolean).join(', ')})`);
-      }
-      const beforeConclude = repositoryGitStatus(target);
-      const concluded = repositoryGitCommit(ctx.controllerHome, target, {
-        message: `Merge ${current.branch} into ${targetBranch}`,
-        allowEmpty: true,
-        authorizationDecision: gitAuthorization,
-        sessionId: session.sessionId,
-        principalId: session.principalId,
-        workId: current.workId,
-        goalId: current.goalId,
-      });
-      if (!concluded.committed || !concluded.commit) {
-        return failStage('merge', concluded.error?.message ?? 'WORK_MERGE_CONCLUDE_FAILED: git commit did not conclude the owned merge');
-      }
-      const concludedSecondParent = gitRevision(target.canonicalRoot, 'HEAD^2');
-      if (concludedSecondParent !== expectedMergeHead || gitRevision(target.canonicalRoot, 'MERGE_HEAD')) {
-        return failStage('merge', `WORK_MERGE_CONCLUSION_OWNERSHIP_MISMATCH: concluded merge must retain ${expectedMergeHead} as its second parent and clear MERGE_HEAD`);
-      }
-      const steps: ReturnType<typeof repositoryGitFinishWorkflow>['steps'] = [{ name: 'conclude_owned_merge', execution: concluded.commit }];
-      if (!deleteAfterWorktreeCleanup && deleteBranchRequested) {
-        const deleted = repositoryGitDeleteBranch(ctx.controllerHome, target, { branch: current.branch, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
-        steps.push({ name: 'delete_feature_branch', execution: deleted.execution });
-        if (deleted.execution.status !== 'executed' || deleted.execution.ok !== true) {
-          return failStage('merge', deleted.execution.stderr || 'WORK_MERGE_BRANCH_CLEANUP_FAILED: owned merge concluded but feature branch deletion failed');
-        }
-      }
-      merged = {
-        repoId: target.repoId,
-        checkoutId: target.activeCheckoutId,
-        featureBranch: current.branch,
-        targetBranch,
-        before: beforeConclude,
-        steps,
-        after: repositoryGitStatus(target),
-        completed: true,
-      };
-      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-        title: 'owned resolved merge concluded',
-        summary: `Finalizer retry proved MERGE_HEAD ${activeMergeHead} belongs to the exact Work delivery head, found no unmerged paths, and concluded the existing merge instead of replaying git merge.`,
-        detailLevel: 'summary',
-      });
-    } else {
-      merged = repositoryGitFinishWorkflow(ctx.controllerHome, target, { featureBranch: current.branch, targetBranch: explicitTargetBranch, deleteBranch: !deleteAfterWorktreeCleanup && deleteBranchRequested, noFf: args.no_ff === true, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
-    }
-    const pendingAuthorization = merged.steps.find((step) => step.execution.authorizationDecision?.decision === 'user_confirmation_required')?.execution.authorizationDecision;
-    if (pendingAuthorization) return { authorization: pendingAuthorization, work: compactHandle(current), stages: current.finalization };
-    if (!merged.completed) return { ...failStage('merge', merged.error?.message ?? 'merge failed'), merge: merged };
-    current = transact('merge-done', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-      finalization: { ...fresh.finalization, merge: 'done', branchCleanup: !deleteBranchRequested ? 'skipped' : deleteAfterWorktreeCleanup ? 'pending' : 'done', lastError: undefined },
-      failureReason: undefined,
-    }));
-  } else if (!wants.merge && current.finalization.merge === 'pending') {
-    current = transact('merge-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, {
-      ...fresh,
-      finalization: {
-        ...fresh.finalization,
-        merge: 'skipped',
-        branchCleanup: requestedOutcome === 'completed_no_change' && wants.cleanup && deleteBranchRequested ? 'pending' : 'skipped',
-      },
-    }));
-  }
-
-  let remoteDelivery: WorkRemoteDeliveryReceipt | undefined;
-  const remoteDeliveryRequired = args.remote_write === true
-    || contractFor(ctx, current)?.constraints.remoteDeliveryRequired === true;
-  if (remoteDeliveryRequired && requestedOutcome !== 'completed_no_change') {
-    const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
-    const target = selectWorkFinalizationTarget(repository, current);
-    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
-    const targetRevision = gitRevision(target.canonicalRoot, targetBranch);
-    if (!targetRevision) throw new Error(`WORK_REMOTE_DELIVERY_TARGET_REQUIRED: target branch ${targetBranch} is unavailable`);
-    const authorityRepository = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
-    remoteDelivery = await pushExactWorkRemoteDelivery({
-      controllerHome: ctx.controllerHome,
-      repository: authorityRepository,
-      workId: current.workId,
-      targetBranch,
-      targetRevision,
-    });
-    appendWorkEvidence(
-      { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-      current.workContractId ?? current.workId,
-      {
-        title: 'remote delivery verified before Work terminalization',
-        summary: remoteDelivery.pushed
-          ? `Exact integrated revision ${remoteDelivery.targetRevision} was pushed to origin/${targetBranch} while Work ${current.workId} still held active delivery authority.`
-          : `origin/${targetBranch} already contained exact integrated revision ${remoteDelivery.targetRevision}; remote delivery was verified idempotently before Work terminalization.`,
-        detailLevel: 'summary',
-      },
-    );
-  }
-
-  if (
-    requestedOutcome === 'completed_no_change'
-    && current.finalization.validation === 'done'
-    && current.finalization.commit === 'skipped'
-    && current.finalization.merge === 'skipped'
-    && current.state !== 'merged'
-    && current.state !== 'cleaned'
-  ) {
-    // `merged` is the WorkHandle's durable integrated-delivery boundary. A
-    // no-change completion has no Git merge, but it must cross that boundary
-    // before physical cleanup so an earlier failure preserves retryability.
-    if (current.state === 'prepared') {
-      current = transact('no-change-validation-state', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'validating', {
-        finalization: fresh.finalization,
-        failureReason: undefined,
-      }));
-    }
-    if (current.state === 'editing' || current.state === 'validating' || current.state === 'committed') {
-      current = transact('no-change-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-        finalization: fresh.finalization,
-        failureReason: undefined,
-      }));
-    } else if (current.state !== 'merged') {
-      throw new Error(`WORK_NO_CHANGE_DELIVERY_STATE_INVALID: cannot establish no-change delivery from ${current.state}`);
-    }
-  }
-
-  if (wants.cleanup && current.finalization.worktreeCleanup === 'pending') {
-    const contract = contractFor(ctx, current);
-    if (contract?.constraints.allowCleanup === false) throw new Error('WORK_CLEANUP_NOT_ALLOWED: WorkContract disallows cleanup');
-    if (!current.managedWorktree) {
-      current = transact('worktree-cleanup-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'skipped' } }));
-    } else {
-      const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
-      const cleanup = runCleanup(target.canonicalRoot, current.worktreePath);
-      if (!cleanup.ok) return failStage('worktreeCleanup', cleanup.message ?? 'worktree cleanup failed');
-      current = transact('worktree-cleanup-done', (fresh) => {
-        setRepositoryCheckoutLifecycle({ controllerHome: ctx.controllerHome, repoId: fresh.repositoryId, checkoutId: fresh.checkoutId, lifecycle: 'removed', reason: `Work ${fresh.workId} cleanup completed.` });
-        markRepositoryProjectionDirty(ctx.controllerHome, fresh.repositoryId, `cleanup:${fresh.workId}:worktree`);
-        return writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'done', lastError: undefined } });
-      });
-    }
-  } else if (!wants.cleanup && current.finalization.worktreeCleanup === 'pending') {
-    current = transact('worktree-cleanup-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'skipped' } }));
-  }
-
-  if (
-    wants.cleanup
-    && current.finalization.branchCleanup === 'pending'
-    && (current.finalization.merge === 'done' || requestedOutcome === 'completed_no_change')
-  ) {
-    const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
-    const deleted = repositoryGitDeleteBranch(ctx.controllerHome, target, { branch: current.branch, force: false, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
-    if (deleted.execution.authorizationDecision?.decision === 'user_confirmation_required') return { authorization: deleted.execution.authorizationDecision, work: compactHandle(current), stages: current.finalization };
-    if (deleted.execution.status !== 'executed' || deleted.execution.ok !== true) return failStage('branchCleanup', deleted.execution.stderr || 'feature branch cleanup failed');
-    current = transact('branch-cleanup-done', (fresh) => {
-      markRepositoryProjectionDirty(ctx.controllerHome, fresh.repositoryId, `cleanup:${fresh.workId}:branch`);
-      return writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, branchCleanup: 'done', lastError: undefined } });
-    });
-  }
-
-  const complete = finalizationComplete(current.finalization);
-  if (complete) {
-    const finalState = finalStateForStages(current.finalization, current.state);
-    current = transact('complete', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, finalState, { finalization: current.finalization, failureReason: undefined }));
-    const completedContract = contractFor(ctx, current);
-    if (completedContract?.status === 'cancelled') {
-      appendWorkEvidence(
-        { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-        completedContract.workId,
-        {
-          title: 'cancelled work cleanup completed',
-          summary: 'Controller verified terminal ownership, a clean or previously removed managed worktree, and a branch HEAD already contained in the target branch before deleting retained workspace references.',
-          detailLevel: 'summary',
-        },
-      );
-    } else {
-      const workId = current.workContractId ?? current.workId;
-      const completionContract = contractFor(ctx, current);
-      if (!completionContract) throw new Error(`WORK_COMPLETION_CONTRACT_MISSING: ${workId}`);
-      if (requestedOutcome === 'completed_no_change') {
-        appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, workId, {
-          title: 'objective-specific no-change proof',
-          summary: noChangeProof,
-          detailLevel: 'summary',
-        });
-      }
-      const receipt = completionReceiptForFinalizedWork(ctx, current, completionContract, args);
-      const ownerPrincipal = terminalizationOwner.principalId?.trim() || terminalizationOwner.controllerId;
-      const ownerInstanceId = terminalizationOwner.controllerInstanceId?.trim() || '';
-      const ownerClaimGeneration = terminalizationOwner.claimGeneration;
-      if (!ownerInstanceId || typeof ownerClaimGeneration !== 'number' || ownerClaimGeneration < 1) {
-        throw new Error(`WORK_CONTROLLER_TERMINALIZATION_AUTHORITY_INVALID: ${workId}`);
-      }
-      const fencedCompletion = withControllerSessionTerminalizationFence(
-        { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-        {
-          workId,
-          actor: `work-finalize-completion:${terminalizationOwner.controllerId}:${ownerInstanceId}`,
-          authority: {
-            controllerId: terminalizationOwner.controllerId,
-            controllerType: terminalizationOwner.controllerType,
-            principalId: ownerPrincipal,
-            controllerInstanceId: ownerInstanceId,
-            claimGeneration: ownerClaimGeneration,
-          },
-        },
-        () => recordWorkCompletionReceipt(
-          { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-          workId,
-          receipt,
-          requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'completed_changed',
-          requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'repository_change',
-        ),
-      );
-      if (!fencedCompletion.allowed) {
-        throw new Error(`WORK_TERMINALIZATION_AUTHORITY_FENCED: ${workId}:${fencedCompletion.reason}`);
-      }
-      const recorded = fencedCompletion.value;
-      if (recorded.requirementId) {
-        try {
-          completeRequirementFromWork(
-            { controllerHome: ctx.controllerHome },
-            { requirementId: recorded.requirementId, work: recorded },
-          );
-        } catch (error) {
-          // Work completion + its receipt are the canonical machine-delivery facts.
-          // Requirement completion is a downstream projection and may legitimately
-          // be absent for callers that use requirement_id only as a semantic
-          // identity. Never turn an already integrated/cleaned Work back into a
-          // failed finalize because this projection is missing or stale.
-          try {
-            appendWorkEvidence(
-              { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-              workId,
-              {
-                title: 'requirement completion projection pending',
-                summary: `Work completion remains authoritative; Requirement projection could not be applied: ${error instanceof Error ? error.message : String(error)}`.slice(0, 2_000),
-                detailLevel: 'summary',
-              },
-            );
-          } catch {
-            // Diagnostic persistence is also downstream of the completion
-            // receipt and therefore cannot invalidate the terminal Work fact.
-          }
-        }
-      }
-    }
-    // Successful WorkContract completion always ends controller ownership.
-    // Physical branch/worktree retention is represented by finalization stages
-    // and completion-receipt warnings; it must not keep a mutation owner live.
-    releasePreparedWorkOwnership(ctx, current);
-    updateExecutionSession(ctx.controllerHome, identity, {
-      activeWorkId: undefined,
-      activeCheckoutId: current.sourceCheckoutId ?? session.activeCheckoutId,
-    });
-  }
-  return { work: compactHandle(current), stages: current.finalization, completed: complete, ...(remoteDelivery ? { remoteDelivery } : {}), idempotent: !wants.commit && !wants.merge && !wants.cleanup && current.finalization.validation === 'done' };
-}
-
 export async function callExecutionTool(ctx: MultiRepositoryMcpToolContext, name: string, args: Record<string, unknown>): Promise<CallToolResult | undefined> {
   if (!executionToolNames.has(name)) return undefined;
   try {