@moretea-labs/forge 1.7.2 → 1.8.0

package/src/runtime/control-plane/execution/work-finalization-service.ts

@@ -1,7 +1,7 @@
 import { listControllerChecks } from '../../../cli/controller/check-runner';
 import type { ControllerCheck } from '../../../cli/controller/check-runner';
 import type { CompletionReceipt } from '../../../cli/controller/types';
-import type { MultiRepositoryMcpToolContext } from '../../../cli/mcp/multi-repository';
+import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
 import { globMatches } from '../../../cli/mcp/paths';
 import { withControllerLock } from '../../../cli/repositories/locks';
 import { getRepository, selectRepositoryCheckout, setRepositoryCheckoutLifecycle } from '../../../cli/repositories/registry';
@@ -9,17 +9,28 @@ import { repositoryGitCommit, repositoryGitDeleteBranch, repositoryGitFinishWork
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { hasCurrentWorkValidationAuthority, markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
 import { markRepositoryProjectionDirty } from '../../projections/invalidation';
-import { withControllerSessionTerminalizationFence } from '../facade/controller-session-store';
+import { withControllerSessionTerminalizationFence } from '../../../../packages/kernel/controller/api/index';
 import type { VerificationRecord } from '../facade/types';
-import { appendVerificationRecord, appendWorkEvidence, listWorkContracts, transitionWorkContractPhase, updateWorkContract } from '../facade/work-contract-store';
+import { appendVerificationRecord, appendWorkEvidence, listWorkContracts, reconcileApprovedWorkImplementationReviewProjection, transitionWorkContractPhase, updateWorkContract } from '../../../../packages/kernel/work/api/index';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
 import { assertResolvedAuthorization, decideAuthorization } from '../governance/authorization';
 import { updateExecutionSession } from './session-store';
-import { validateWorkHandle } from './validation';
+import { validateWorkHandle, WorkHandleValidationError } from './validation';
+import { implementationReviewContentFingerprint } from './implementation-review-content';
+import { transferReviewedWorkAuthorityAcrossContentEquivalentCommit } from './content-equivalent-commit-authority';
+import {
+  assertImplementationReviewPreDeliveryBoundary,
+  authoritativeImplementationReviewVerificationEvidence,
+  latestImplementationReview,
+  implementationReviewChangedPathDigest,
+  normalizeImplementationReviewChangedPaths,
+  workRequiresImplementationReview,
+  type ImplementationReviewCandidateIdentity,
+} from '../../../../packages/kernel/work/api/index';
 import { effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from './verification-evidence';
 import { completeWorkWithReceipt } from './work-completion-authority';
-import { markWorkHandleFailed, readWorkHandle, transitionWorkHandle, workDeliveryBaseRevision, writeWorkHandle } from './work-handle-store';
-import type { WorkFinalizationStages, WorkHandleState } from './work-handle-store';
+import { adoptWorkHandleSuccessorCandidate, readWorkHandle, resolveWorkDeliveryTargetBranch, transitionWorkHandle, workDeliveryBaseRevision, writeWorkHandle } from './work-handle-store';
+import type { WorkFinalizationFailureCode, WorkFinalizationStages, WorkHandleState } from './work-handle-store';
 import { findWorkPathScopeViolation } from './work-path-scope';
 import type { WorkRemoteDeliveryReceipt } from './work-remote-delivery';
 import { pushExactWorkRemoteDelivery } from './work-remote-delivery';
@@ -28,16 +39,7 @@ import { createHash } from 'crypto';
 import { existsSync, realpathSync } from 'fs';
 import { basename, resolve } from 'path';
 import { assertWorkControllerOwnership, compactHandle, contractFor, gitChangedPaths, gitCommit, gitHead, gitMergeBase, gitRevision, identityFor, reconcileTerminalCleanup, releasePreparedWorkOwnership, requireSession, selectWorkFinalizationTarget, terminalCleanupOutcome, workForSession, workReturnCheckoutId } from './work-execution-support';
-
-function gitIsAncestor(root: string, ancestor: string, descendant: string): boolean {
-  const result = spawnSync('git', ['-C', root, 'merge-base', '--is-ancestor', ancestor, descendant], {
-    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
-  });
-  if (result.error || (result.status !== 0 && result.status !== 1)) {
-    throw new Error(`WORK_TARGET_ADVANCE_ANCESTRY_UNAVAILABLE: ${ancestor} -> ${descendant}`);
-  }
-  return result.status === 0;
-}
+import { gitIsAncestor } from './direct-canonical-work-reconciliation';
 
 export interface WorkTargetAdvanceInspection {
   relation: 'candidate_contains_target' | 'target_contains_candidate' | 'diverged_clean' | 'diverged_conflict';
@@ -97,6 +99,69 @@ export function targetAdvanceLinearMergeCommits(root: string, targetRevision: st
   return output.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
 }
 
+export interface FailedNonLinearTargetAdvanceRepairInspection {
+  eligible: boolean;
+  reason:
+    | 'equivalent_linear_repair'
+    | 'same_revision'
+    | 'target_not_ancestor_of_failed'
+    | 'failed_candidate_is_linear'
+    | 'target_not_ancestor_of_repair'
+    | 'repair_contains_merge'
+    | 'tree_mismatch';
+  failedHead: string;
+  repairedHead: string;
+  targetHead: string;
+  failedTree: string;
+  repairedTree: string;
+  failedMergeCommits: string[];
+  repairedMergeCommits: string[];
+}
+
+function gitTree(root: string, revision: string, label: string): string {
+  const result = spawnSync('git', ['-C', root, 'rev-parse', '--verify', `${revision}^{tree}`], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (result.status !== 0 || result.error || typeof result.stdout !== 'string' || !result.stdout.trim()) {
+    throw new Error(`WORK_TARGET_ADVANCE_${label}_TREE_UNAVAILABLE: ${revision}`);
+  }
+  return result.stdout.trim();
+}
+
+/**
+ * Inspect the only safe history-repair case after target-advance finalization
+ * rejected a controller-created merge commit. The repaired candidate may move
+ * backwards in commit ancestry only when it is a clean linear representation
+ * of the exact same Git tree above the same reconciled target. This proves a
+ * history-shape repair, not a source-content rewrite.
+ */
+export function inspectFailedNonLinearTargetAdvanceRepair(
+  root: string,
+  failedRevision: string,
+  repairedRevision: string,
+  targetRevision: string,
+): FailedNonLinearTargetAdvanceRepairInspection {
+  const failedHead = gitCommit(root, failedRevision, 'FAILED_NON_LINEAR_CANDIDATE');
+  const repairedHead = gitCommit(root, repairedRevision, 'REPAIRED_LINEAR_CANDIDATE');
+  const targetHead = gitCommit(root, targetRevision, 'REPAIRED_LINEAR_TARGET');
+  const failedTree = gitTree(root, failedHead, 'FAILED_NON_LINEAR');
+  const repairedTree = gitTree(root, repairedHead, 'REPAIRED_LINEAR');
+  const failedMergeCommits = gitIsAncestor(root, targetHead, failedHead)
+    ? targetAdvanceLinearMergeCommits(root, targetHead, failedHead)
+    : [];
+  const repairedMergeCommits = gitIsAncestor(root, targetHead, repairedHead)
+    ? targetAdvanceLinearMergeCommits(root, targetHead, repairedHead)
+    : [];
+  const base = { failedHead, repairedHead, targetHead, failedTree, repairedTree, failedMergeCommits, repairedMergeCommits };
+  if (failedHead === repairedHead) return { ...base, eligible: false, reason: 'same_revision' };
+  if (!gitIsAncestor(root, targetHead, failedHead)) return { ...base, eligible: false, reason: 'target_not_ancestor_of_failed' };
+  if (failedMergeCommits.length === 0) return { ...base, eligible: false, reason: 'failed_candidate_is_linear' };
+  if (!gitIsAncestor(root, targetHead, repairedHead)) return { ...base, eligible: false, reason: 'target_not_ancestor_of_repair' };
+  if (repairedMergeCommits.length > 0) return { ...base, eligible: false, reason: 'repair_contains_merge' };
+  if (failedTree !== repairedTree) return { ...base, eligible: false, reason: 'tree_mismatch' };
+  return { ...base, eligible: true, reason: 'equivalent_linear_repair' };
+}
+
 function normalizedReadScope(scope: string): string {
   return scope.replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '') || '.';
 }
@@ -195,7 +260,7 @@ export function targetAdvanceWorkScopeViolation(
 }
 
 function replaceTargetAdvanceScopeEvidence(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   contract: NonNullable<ReturnType<typeof contractFor>>,
   actualChangedPaths: string[],
 ): void {
@@ -283,6 +348,292 @@ function workOwnedDirtyPaths(
   return { dirtyPaths, ownedPaths };
 }
 
+
+export function implementationReviewCommittedBaseRevision(
+  repository: Pick<RepositoryRecord, 'canonicalRoot' | 'defaultBranch'>,
+  handle: Pick<WorkHandleState, 'workId' | 'managedWorktree' | 'deliveryTargetBranch' | 'baseCommit' | 'deliveryBaseCommit'> & Partial<Pick<WorkHandleState, 'state'>>,
+  fallbackBaseRevision: string | undefined,
+  head: string | undefined,
+  explicitTargetBranch?: string,
+): string | undefined {
+  const base = workDeliveryBaseRevision(handle) ?? fallbackBaseRevision;
+  if (!base || !head || !handle.managedWorktree) return base;
+  const targetBranch = resolveWorkDeliveryTargetBranch(handle, repository.defaultBranch, explicitTargetBranch);
+  const targetHead = gitRevision(repository.canonicalRoot, targetBranch);
+  if (!targetHead || targetHead === base) return base;
+  // Once the delivery target has caught up to the exact candidate HEAD, using
+  // that target as the review baseline would erase the Work delta and make an
+  // unchanged approved review appear stale. Preserve only the already-durable
+  // delivery base in this exact catch-up state; without that durable fence, keep
+  // the previous fail-closed behavior below.
+  if (
+    targetHead === head
+    && (
+      handle.state === 'merged'
+      || (
+        handle.deliveryBaseCommit?.trim()
+        && handle.deliveryBaseCommit.trim() !== (handle.baseCommit?.trim() || fallbackBaseRevision?.trim())
+      )
+    )
+  ) return base;
+  // Review may exclude canonical target-only history only after proving that the
+  // recorded delivery base advances linearly to the exact target and that this
+  // target is already contained by the managed candidate. This is a read-only
+  // review baseline; deliveryBaseCommit remains persisted later by the existing
+  // target-advance delivery transition.
+  if (!gitIsAncestor(repository.canonicalRoot, base, targetHead)) return base;
+  if (!gitIsAncestor(repository.canonicalRoot, targetHead, head)) return base;
+  return targetHead;
+}
+
+function implementationReviewCommittedChangedPaths(input: {
+  repository: Pick<RepositoryRecord, 'canonicalRoot' | 'defaultBranch'>;
+  handle: WorkHandleState;
+  contract: NonNullable<ReturnType<typeof contractFor>>;
+  head: string | undefined;
+  explicitTargetBranch?: string;
+  review?: NonNullable<ReturnType<typeof latestImplementationReview>>;
+}): string[] {
+  const committedBase = implementationReviewCommittedBaseRevision(
+    input.repository,
+    input.handle,
+    input.contract.baseRevision,
+    input.head,
+    input.explicitTargetBranch,
+  );
+  if (!input.head || !committedBase) return [];
+  const pathsFrom = (base: string) => normalizeImplementationReviewChangedPaths(
+    input.head === base ? [] : gitChangedPaths(input.repository.canonicalRoot, base, input.head!),
+  );
+  const committedPaths = pathsFrom(committedBase);
+  if (!input.review) return committedPaths;
+
+  // Review preparation, pre-delivery finalization, branch-cleanup retry, and
+  // cleaned-completion catch-up must share one committed review-baseline
+  // authority. The canonical target may legitimately move after review because
+  // this candidate was merged (making the current helper base equal HEAD), or
+  // it may already have contained the candidate before review. Only select
+  // between the current proven helper base and the durable delivery base when
+  // one exactly reproduces the immutable reviewed changed-path identity. A real
+  // source/path drift therefore still fails closed in the caller.
+  const reviewedDigest = implementationReviewChangedPathDigest(
+    normalizeImplementationReviewChangedPaths(input.review.changedPaths),
+  );
+  if (implementationReviewChangedPathDigest(committedPaths) === reviewedDigest) return committedPaths;
+
+  const recordedBase = workDeliveryBaseRevision(input.handle) ?? input.contract.baseRevision;
+  if (recordedBase && recordedBase !== committedBase) {
+    const recordedPaths = pathsFrom(recordedBase);
+    if (implementationReviewChangedPathDigest(recordedPaths) === reviewedDigest) return recordedPaths;
+  }
+
+  // New reviews intentionally preserve the durable delivery base once target has
+  // caught the exact candidate (implementationReviewCommittedBaseRevision). A
+  // review already persisted by an older Runtime may, however, legitimately
+  // carry the former exact-target-relative empty identity. Recovery may honor
+  // that historical identity only when the current canonical target is exactly
+  // the immutable reviewed source HEAD and its path digest matches. This branch
+  // is review-only compatibility; it can never create a new empty review.
+  const targetBranch = resolveWorkDeliveryTargetBranch(
+    input.handle,
+    input.repository.defaultBranch,
+    input.explicitTargetBranch,
+  );
+  const targetHead = gitRevision(input.repository.canonicalRoot, targetBranch);
+  if (targetHead === input.head && input.review.sourceRevision === input.head) {
+    const exactTargetPaths = pathsFrom(targetHead);
+    if (implementationReviewChangedPathDigest(exactTargetPaths) === reviewedDigest) return exactTargetPaths;
+  }
+  return committedPaths;
+}
+
+function currentWorkReviewChangedPaths(
+  repository: RepositoryRecord,
+  handle: WorkHandleState,
+  contract: NonNullable<ReturnType<typeof contractFor>>,
+  explicitTargetBranch?: string,
+): string[] {
+  const status = repositoryGitStatus(repository);
+  const { dirtyPaths, ownedPaths } = workOwnedDirtyPaths(contract, status);
+  if (dirtyPaths.length !== ownedPaths.length) {
+    const unowned = dirtyPaths.filter((path) => !ownedPaths.includes(path));
+    throw new Error(`WORK_IMPLEMENTATION_REVIEW_UNOWNED_DIRTY_PATH: ${unowned.join(', ')}`);
+  }
+  const head = status.head?.trim();
+  const committedPaths = implementationReviewCommittedChangedPaths({
+    repository, handle, contract, head, explicitTargetBranch,
+  });
+  const observed = normalizeImplementationReviewChangedPaths([...committedPaths, ...ownedPaths]);
+  const scopeViolation = findWorkPathScopeViolation(contract, observed);
+  if (scopeViolation) {
+    throw new Error(`WORK_IMPLEMENTATION_REVIEW_SCOPE_VIOLATION: ${scopeViolation.kind}:${scopeViolation.path}`);
+  }
+  return observed;
+}
+
+function assertPhysicalImplementationReviewGate(input: {
+  ctx: McpExecutionContext;
+  repository: RepositoryRecord;
+  handle: WorkHandleState;
+  contract: NonNullable<ReturnType<typeof contractFor>>;
+  /** Use the exact strict verification identity observed before repository staging. */
+  verificationWorkspaceFingerprint?: string;
+  targetBranch?: string;
+}): ImplementationReviewCandidateIdentity {
+  const status = repositoryGitStatus(input.repository);
+  const sourceRevision = status.head?.trim();
+  if (!sourceRevision) throw new Error('WORK_IMPLEMENTATION_REVIEW_SOURCE_IDENTITY_REQUIRED');
+  const changedPaths = currentWorkReviewChangedPaths(input.repository, input.handle, input.contract, input.targetBranch);
+  const verificationWorkspaceFingerprint = input.verificationWorkspaceFingerprint?.trim()
+    || workspaceValidationFingerprint(input.repository.canonicalRoot, status);
+  const workspaceFingerprint = implementationReviewContentFingerprint(input.repository.canonicalRoot, changedPaths);
+  const verification = authoritativeImplementationReviewVerificationEvidence({
+    repoId: input.contract.repoId,
+    workId: input.contract.workId,
+    requiredCheckIds: input.contract.checks,
+    records: input.contract.checkRefs,
+    sourceRevision,
+    workspaceFingerprint: verificationWorkspaceFingerprint,
+  });
+  if (verification.missingCheckIds.length > 0) {
+    throw new Error(`WORK_IMPLEMENTATION_REVIEW_VERIFICATION_REQUIRED: ${verification.missingCheckIds.join(', ')}`);
+  }
+  const candidate: ImplementationReviewCandidateIdentity = {
+    sourceRevision,
+    workspaceFingerprint,
+    verificationWorkspaceFingerprint,
+    changedPaths,
+    verificationEvidence: verification.evidence,
+    architectureEvidence: [],
+  };
+  assertImplementationReviewPreDeliveryBoundary({
+    repoId: input.contract.repoId,
+    workId: input.contract.workId,
+    workKind: input.contract.workKind,
+    reviews: input.contract.implementationReviews,
+    candidate,
+    requiredCheckIds: input.contract.checks,
+    verificationRecords: input.contract.checkRefs,
+  });
+  return candidate;
+}
+
+/**
+ * A successful branch-cleanup retry can run after the reviewed worktree has
+ * already been removed. In that state filesystem content cannot be re-hashed,
+ * but the Work branch commit is immutable. Re-bind the shared review boundary
+ * to that exact branch HEAD and recompute current Work-bound verification
+ * evidence before deleting the ref. Cancelled/failed cleanup uses separate
+ * recovery authority and never calls this successful-delivery gate.
+ */
+function assertPhysicalBranchCleanupImplementationReviewGate(input: {
+  target: RepositoryRecord;
+  handle: WorkHandleState;
+  contract: NonNullable<ReturnType<typeof contractFor>>;
+  targetBranch?: string;
+}): void {
+  const branchHead = gitRevision(input.target.canonicalRoot, input.handle.branch);
+  if (!branchHead) throw new Error('WORK_IMPLEMENTATION_REVIEW_BRANCH_SOURCE_REQUIRED');
+  if (input.handle.expectedHead && branchHead !== input.handle.expectedHead) {
+    throw new Error('WORK_IMPLEMENTATION_REVIEW_BRANCH_SOURCE_CHANGED');
+  }
+  const review = latestImplementationReview(input.contract.implementationReviews);
+  const changedPaths = implementationReviewCommittedChangedPaths({
+    repository: input.target,
+    handle: input.handle,
+    contract: input.contract,
+    head: branchHead,
+    explicitTargetBranch: input.targetBranch,
+    review,
+  });
+  if (!workRequiresImplementationReview(input.contract.workKind, changedPaths)) return;
+  if (!review) throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRED');
+  if (review.sourceRevision !== branchHead) throw new Error('WORK_IMPLEMENTATION_REVIEW_STALE: branch source revision changed');
+  const verification = authoritativeImplementationReviewVerificationEvidence({
+    repoId: input.contract.repoId,
+    workId: input.contract.workId,
+    requiredCheckIds: input.contract.checks,
+    records: input.contract.checkRefs,
+    sourceRevision: branchHead,
+    workspaceFingerprint: review.verificationWorkspaceFingerprint,
+  });
+  if (verification.missingCheckIds.length > 0) {
+    throw new Error(`WORK_IMPLEMENTATION_REVIEW_VERIFICATION_REQUIRED: ${verification.missingCheckIds.join(', ')}`);
+  }
+  assertImplementationReviewPreDeliveryBoundary({
+    repoId: input.contract.repoId,
+    workId: input.contract.workId,
+    workKind: input.contract.workKind,
+    reviews: input.contract.implementationReviews,
+    candidate: {
+      sourceRevision: branchHead,
+      workspaceFingerprint: review.workspaceFingerprint,
+      verificationWorkspaceFingerprint: review.verificationWorkspaceFingerprint,
+      changedPaths,
+      verificationEvidence: verification.evidence,
+      architectureEvidence: review.architectureEvidence,
+    },
+    requiredCheckIds: input.contract.checks,
+    verificationRecords: input.contract.checkRefs,
+  });
+}
+
+/**
+ * Re-prove review authority from immutable Git + durable review/check identity
+ * after successful managed-worktree cleanup. This path never recreates a
+ * checkout and never authorizes commit/merge; it only allows a missing semantic
+ * completion receipt to catch up with already-durable physical finalization.
+ */
+function assertCleanedCompletionImplementationReviewGate(input: {
+  target: RepositoryRecord;
+  handle: WorkHandleState;
+  contract: NonNullable<ReturnType<typeof contractFor>>;
+}): NonNullable<ReturnType<typeof latestImplementationReview>> {
+  const deliveryRevision = input.handle.expectedHead ?? input.handle.baseCommit;
+  if (!deliveryRevision) throw new Error('WORK_IMPLEMENTATION_REVIEW_SOURCE_IDENTITY_REQUIRED');
+  const review = latestImplementationReview(input.contract.implementationReviews);
+  if (!review) throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRED');
+  if (review.sourceRevision !== deliveryRevision) {
+    throw new Error('WORK_IMPLEMENTATION_REVIEW_STALE: cleaned delivery source revision changed');
+  }
+  const changedPaths = implementationReviewCommittedChangedPaths({
+    repository: input.target, handle: input.handle, contract: input.contract, head: deliveryRevision, review,
+  });
+  const reviewedPaths = normalizeImplementationReviewChangedPaths(review.changedPaths);
+  if (implementationReviewChangedPathDigest(reviewedPaths) !== implementationReviewChangedPathDigest(changedPaths)) {
+    throw new Error('WORK_IMPLEMENTATION_REVIEW_STALE: cleaned delivery changed-path identity changed');
+  }
+  const verification = authoritativeImplementationReviewVerificationEvidence({
+    repoId: input.contract.repoId,
+    workId: input.contract.workId,
+    requiredCheckIds: input.contract.checks,
+    records: input.contract.checkRefs,
+    sourceRevision: deliveryRevision,
+    workspaceFingerprint: review.verificationWorkspaceFingerprint,
+  });
+  if (verification.missingCheckIds.length > 0) {
+    throw new Error(`WORK_IMPLEMENTATION_REVIEW_VERIFICATION_REQUIRED: ${verification.missingCheckIds.join(', ')}`);
+  }
+  assertImplementationReviewPreDeliveryBoundary({
+    repoId: input.contract.repoId,
+    workId: input.contract.workId,
+    workKind: input.contract.workKind,
+    reviews: input.contract.implementationReviews,
+    candidate: {
+      sourceRevision: deliveryRevision,
+      workspaceFingerprint: review.workspaceFingerprint,
+      verificationWorkspaceFingerprint: review.verificationWorkspaceFingerprint,
+      changedPaths,
+      verificationEvidence: verification.evidence,
+      architectureEvidence: review.architectureEvidence,
+    },
+    requiredCheckIds: input.contract.checks,
+    verificationRecords: input.contract.checkRefs,
+  });
+  return review;
+}
+
+
 export interface TargetDirtyWorkOwnershipInspection {
   owned: boolean;
   dirtyPaths: string[];
@@ -338,6 +689,26 @@ export function inspectTargetDirtyWorkOwnership(input: {
   };
 }
 
+export interface TargetDirtyPreservationPlan {
+  preserveDirtyTargetPaths: string[];
+  ownership: TargetDirtyWorkOwnershipInspection;
+}
+
+/**
+ * Dirty target content is a Git preservation concern first. Semantic Work
+ * ownership remains useful provenance, but it is not required when the
+ * integration candidate is disjoint. repositoryGitFinishWorkflow owns the
+ * exact overlap fence and fails before target mutation when a preserved path
+ * conflicts with the candidate.
+ */
+export function planTargetDirtyPreservation(input: Parameters<typeof inspectTargetDirtyWorkOwnership>[0]): TargetDirtyPreservationPlan {
+  const ownership = inspectTargetDirtyWorkOwnership(input);
+  return {
+    preserveDirtyTargetPaths: ownership.dirtyPaths,
+    ownership,
+  };
+}
+
 export interface DirectCanonicalTargetAdvanceInspection {
   reconcilable: boolean;
   reason:
@@ -474,6 +845,169 @@ export function inspectDirectCanonicalTargetAdvanceReconciliation(input: {
   };
 }
 
+export interface DirectCanonicalTargetAdvanceReconciliationCommandResult {
+  reconciled: boolean;
+  handle: WorkHandleState;
+  inspection: DirectCanonicalTargetAdvanceInspection;
+}
+
+/**
+ * Application command for advancing Direct canonical Work delivery identity.
+ * The pure inspector remains the admission authority; this command is the only
+ * place shared review/finalization callers persist the approved identity move
+ * and its evidence. Gateway callers consume the returned handle and never write
+ * lifecycle/evidence records themselves.
+ */
+export function reconcileDirectCanonicalTargetAdvanceCommand(input: {
+  controllerHome: string;
+  repoId: string;
+  workId: string;
+  handle: WorkHandleState;
+  root: string;
+  targetBranch: string;
+  status: ReturnType<typeof repositoryGitStatus>;
+  scope?: { allowedPaths: string[]; forbiddenPaths: string[] };
+  checkIds: string[];
+  checkRefs: VerificationRecord[];
+  persistHandle?: (patch: { deliveryBaseCommit: string; expectedHead: string; failureReason: undefined }) => WorkHandleState;
+  evidenceTitle?: string;
+}): DirectCanonicalTargetAdvanceReconciliationCommandResult {
+  if (input.handle.repositoryId !== input.repoId) {
+    throw new Error(`WORK_DIRECT_TARGET_ADVANCE_REPOSITORY_MISMATCH: expected ${input.handle.repositoryId}, found ${input.repoId}`);
+  }
+  const boundWorkId = input.handle.workContractId ?? input.handle.workId;
+  if (boundWorkId !== input.workId) {
+    throw new Error(`WORK_DIRECT_TARGET_ADVANCE_IDENTITY_MISMATCH: expected ${boundWorkId}, found ${input.workId}`);
+  }
+  const inspection = inspectDirectCanonicalTargetAdvanceReconciliation({
+    root: input.root,
+    worktreePath: input.handle.worktreePath,
+    managedWorktree: input.handle.managedWorktree,
+    workBranch: input.handle.branch,
+    targetBranch: input.targetBranch,
+    expectedRevision: input.handle.expectedHead,
+    status: input.status,
+    scope: input.scope,
+    checkIds: input.checkIds,
+    checkRefs: input.checkRefs,
+  });
+  if (!inspection.reconcilable || !inspection.targetHead) {
+    return { reconciled: false, handle: input.handle, inspection };
+  }
+
+  const previousHead = input.handle.expectedHead;
+  const patch = {
+    deliveryBaseCommit: inspection.targetHead,
+    expectedHead: inspection.targetHead,
+    failureReason: undefined,
+  } as const;
+  const handle = input.persistHandle
+    ? input.persistHandle(patch)
+    : transitionWorkHandle(input.controllerHome, input.handle, input.handle.state, patch);
+  appendWorkEvidence({ controllerHome: input.controllerHome, repoId: input.repoId }, input.workId, {
+    title: input.evidenceTitle ?? 'direct canonical target advancement reconciled',
+    summary: `Canonical ${input.targetBranch} advanced linearly ${previousHead} -> ${inspection.targetHead}. Delivery identity adopted only the target revision after proving all ${inspection.dirtyPaths.length} dirty path(s) are Work-owned, ${inspection.targetChangedPaths.length} target-only path(s) are disjoint, and fresh exact verification bound [${inspection.freshCheckIds.join(', ')}] to source ${inspection.targetHead} plus workspace ${inspection.workspaceFingerprint?.slice(0, 16) ?? 'unknown'}.`,
+    detailLevel: 'summary',
+  });
+  return { reconciled: true, handle, inspection };
+}
+
+export interface ManagedWorkSuccessorAdoptionInspection {
+  adoptable: boolean;
+  reason:
+    | 'not_managed_worktree'
+    | 'path_mismatch'
+    | 'branch_mismatch'
+    | 'workspace_dirty'
+    | 'revision_unavailable'
+    | 'no_head_change'
+    | 'descendant_progress'
+    | 'target_not_advanced'
+    | 'target_history_rewritten'
+    | 'target_not_candidate_ancestor'
+    | 'non_linear_candidate'
+    | 'scope_violation'
+    | 'adoptable';
+  previousHead?: string;
+  previousDeliveryBase?: string;
+  candidateHead?: string;
+  targetHead?: string;
+  candidateChangedPaths: string[];
+  detail?: string;
+}
+
+/**
+ * Inspect a manually conflict-repaired managed Work candidate before changing
+ * WorkHandle authority. This is intentionally narrower than ordinary
+ * descendant progress: canonical target must have advanced linearly from the
+ * recorded delivery base, and the rewritten clean candidate must contain that
+ * exact target with only Work-scoped target-relative changes.
+ */
+export function inspectManagedWorkSuccessorAdoption(input: {
+  root: string;
+  worktreePath: string;
+  managedWorktree: boolean;
+  workBranch: string;
+  targetBranch: string;
+  expectedRevision?: string;
+  deliveryBaseRevision?: string;
+  status: ReturnType<typeof repositoryGitStatus>;
+  scope?: { allowedPaths: string[]; forbiddenPaths: string[] };
+}): ManagedWorkSuccessorAdoptionInspection {
+  const empty = (reason: ManagedWorkSuccessorAdoptionInspection['reason'], detail?: string): ManagedWorkSuccessorAdoptionInspection => ({
+    adoptable: false,
+    reason,
+    candidateChangedPaths: [],
+    ...(detail ? { detail } : {}),
+  });
+  if (!input.managedWorktree) return empty('not_managed_worktree');
+  try {
+    if (realpathSync(input.root) !== realpathSync(input.worktreePath)) return empty('path_mismatch');
+  } catch {
+    return empty('path_mismatch');
+  }
+  const branch = spawnSync('git', ['-C', input.root, 'branch', '--show-current'], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (branch.status !== 0 || String(branch.stdout ?? '').trim() !== input.workBranch) return empty('branch_mismatch');
+  if (!input.status.clean) return empty('workspace_dirty');
+
+  const previousHead = input.expectedRevision ? gitRevision(input.root, input.expectedRevision) : undefined;
+  const previousDeliveryBase = input.deliveryBaseRevision ? gitRevision(input.root, input.deliveryBaseRevision) : undefined;
+  const candidateHead = input.status.head ? gitRevision(input.root, input.status.head) : undefined;
+  const targetHead = gitRevision(input.root, input.targetBranch);
+  if (!previousHead || !previousDeliveryBase || !candidateHead || !targetHead) return empty('revision_unavailable');
+  const base = { previousHead, previousDeliveryBase, candidateHead, targetHead, candidateChangedPaths: [] as string[] };
+  if (candidateHead === previousHead) return { ...base, adoptable: false, reason: 'no_head_change' };
+  if (gitIsAncestor(input.root, previousHead, candidateHead)) return { ...base, adoptable: false, reason: 'descendant_progress' };
+  if (targetHead === previousDeliveryBase) return { ...base, adoptable: false, reason: 'target_not_advanced' };
+  if (!gitIsAncestor(input.root, previousDeliveryBase, targetHead)) {
+    return { ...base, adoptable: false, reason: 'target_history_rewritten' };
+  }
+  if (!gitIsAncestor(input.root, targetHead, candidateHead)) {
+    return { ...base, adoptable: false, reason: 'target_not_candidate_ancestor' };
+  }
+  const mergeCommits = targetAdvanceLinearMergeCommits(input.root, targetHead, candidateHead);
+  if (mergeCommits.length > 0) {
+    return { ...base, adoptable: false, reason: 'non_linear_candidate', detail: mergeCommits.slice(0, 8).join(', ') };
+  }
+  const candidateChangedPaths = gitChangedPaths(input.root, targetHead, candidateHead);
+  if (!input.scope) {
+    return { ...base, candidateChangedPaths, adoptable: false, reason: 'scope_violation', detail: 'WorkContract scope unavailable' };
+  }
+  const scopeViolation = findWorkPathScopeViolation(input.scope, candidateChangedPaths);
+  if (scopeViolation) {
+    return {
+      ...base,
+      candidateChangedPaths,
+      adoptable: false,
+      reason: 'scope_violation',
+      detail: `${scopeViolation.kind}:${scopeViolation.path}`,
+    };
+  }
+  return { ...base, candidateChangedPaths, adoptable: true, reason: 'adoptable' };
+}
+
 export function completionReceiptChangedPaths(repoRoot: string, baseRevision: string, deliveryRevision: string): string[] {
   const result = spawnSync('git', ['-C', repoRoot, 'diff', '--name-only', `${baseRevision}..${deliveryRevision}`], {
     encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
@@ -486,16 +1020,18 @@ export function completionReceiptChangedPaths(repoRoot: string, baseRevision: st
 }
 
 function completionReceiptForFinalizedWork(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   handle: WorkHandleState,
   contract: ReturnType<typeof contractFor>,
   args: Record<string, unknown>,
 ): CompletionReceipt {
   const repository = getRepository(handle.repositoryId, ctx.controllerHome, { includeRemoved: true });
   const target = selectWorkFinalizationTarget(repository, handle);
-  const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : repository.defaultBranch || 'main';
+  const targetBranch = resolveWorkDeliveryTargetBranch(
+    handle,
+    repository.defaultBranch,
+    typeof args.target_branch === 'string' ? args.target_branch : undefined,
+  );
   const targetRevision = gitRevision(target.canonicalRoot, targetBranch);
   if (!targetRevision) throw new Error(`WORK_COMPLETION_RECEIPT_TARGET_REQUIRED: target branch ${targetBranch} is unavailable`);
   const noChange = args.completion_outcome === 'completed_no_change';
@@ -577,7 +1113,7 @@ function runCleanup(targetRoot: string, worktreePath: string): { ok: boolean; me
  * crash without turning a missing checkout into proof of safety.
  */
 export function inspectCleanupOnlyMergedHead(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   current: WorkHandleState,
   args: Record<string, unknown>,
 ): { currentHead: string; cancelledContract: boolean; worktreeMissing: boolean } | undefined {
@@ -587,9 +1123,11 @@ export function inspectCleanupOnlyMergedHead(
 
   const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
   const target = selectWorkFinalizationTarget(repository, current);
-  const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : repository.defaultBranch || 'main';
+  const targetBranch = resolveWorkDeliveryTargetBranch(
+    current,
+    repository.defaultBranch,
+    typeof args.target_branch === 'string' ? args.target_branch : undefined,
+  );
   const branchHeadResult = spawnSync('git', ['-C', target.canonicalRoot, 'rev-parse', '--verify', `refs/heads/${current.branch}`], {
     encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
   });
@@ -624,7 +1162,11 @@ export function inspectCleanupOnlyMergedHead(
     encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
   });
   if (currentBranch.status !== 0 || String(currentBranch.stdout ?? '').trim() !== current.branch) return undefined;
-  if (current.expectedHead && currentHead !== current.expectedHead && cancelledContract) return undefined;
+  // Cleanup reconciliation proves the exact Work-owned revision, regardless of
+  // terminal contract status. A same-named branch may be advanced later by a
+  // different controller or manual Git operation; reachability from the target
+  // is not authority to adopt that newer HEAD as this Work's delivery.
+  if (current.expectedHead && currentHead !== current.expectedHead) return undefined;
   return { currentHead, cancelledContract, worktreeMissing: false };
 }
 
@@ -640,7 +1182,7 @@ interface FailedCleanupProof {
  * cleanup only; it never proves successful verification or delivery.
  */
 function failedCleanupOnlyHead(
-  ctx: MultiRepositoryMcpToolContext,
+  ctx: McpExecutionContext,
   current: WorkHandleState,
   args: Record<string, unknown>,
 ): FailedCleanupProof | undefined {
@@ -658,9 +1200,11 @@ function failedCleanupOnlyHead(
   if (!expectedHead) return undefined;
   const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
   const target = selectWorkFinalizationTarget(repository, current);
-  const targetBranch = typeof args.target_branch === 'string' && args.target_branch.trim()
-    ? args.target_branch.trim()
-    : repository.defaultBranch || 'main';
+  const targetBranch = resolveWorkDeliveryTargetBranch(
+    current,
+    repository.defaultBranch,
+    typeof args.target_branch === 'string' ? args.target_branch : undefined,
+  );
   const merged = spawnSync('git', ['-C', target.canonicalRoot, 'merge-base', '--is-ancestor', expectedHead, targetBranch], {
     encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
   });
@@ -708,6 +1252,98 @@ function retryHandleStateForFinalization(stages: WorkFinalizationStages): WorkHa
   return 'validating';
 }
 
+function reconcileFailedNonLinearTargetAdvanceRepair(
+  ctx: McpExecutionContext,
+  current: WorkHandleState,
+  args: Record<string, unknown>,
+): WorkHandleState {
+  if (
+    current.state !== 'failed'
+    || current.finalization.merge !== 'failed'
+    || current.finalization.failureCode !== 'WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION'
+    || args.merge !== true
+    || !current.managedWorktree
+    || !current.expectedHead
+  ) return current;
+
+  const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
+  const worktree = selectRepositoryCheckout(repository, current.checkoutId);
+  const status = repositoryGitStatus(worktree);
+  const repairedHead = status.head;
+  if (!status.clean || !repairedHead || repairedHead === current.expectedHead) return current;
+  const branch = spawnSync('git', ['-C', worktree.canonicalRoot, 'branch', '--show-current'], {
+    encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
+  });
+  if (branch.status !== 0 || String(branch.stdout ?? '').trim() !== current.branch) {
+    throw new Error('WORK_TARGET_ADVANCE_REPAIR_BRANCH_MISMATCH');
+  }
+
+  const targetRevision = workDeliveryBaseRevision(current);
+  if (!targetRevision) throw new Error('WORK_TARGET_ADVANCE_REPAIR_TARGET_MISSING');
+  const inspection = inspectFailedNonLinearTargetAdvanceRepair(
+    worktree.canonicalRoot,
+    current.expectedHead,
+    repairedHead,
+    targetRevision,
+  );
+  if (!inspection.eligible) {
+    throw new Error(`WORK_TARGET_ADVANCE_REPAIR_UNSAFE: ${inspection.reason}`);
+  }
+
+  const contract = contractFor(ctx, current);
+  if (!contract) throw new Error(`WORK_TARGET_ADVANCE_REPAIR_CONTRACT_MISSING: ${current.workContractId ?? current.workId}`);
+  const changedPaths = gitChangedPaths(worktree.canonicalRoot, inspection.targetHead, inspection.repairedHead);
+  const scopeViolation = targetAdvanceWorkScopeViolation(contract, changedPaths);
+  if (scopeViolation) {
+    throw new Error(`WORK_TARGET_ADVANCE_REPAIR_SCOPE_VIOLATION: Work-owned ${scopeViolation.kind} path ${scopeViolation.path}`);
+  }
+
+  const repaired = withControllerLock(
+    ctx.controllerHome,
+    { scope: 'worktree', repoId: current.repositoryId, worktreeId: current.checkoutId },
+    `work-finalize:${current.workId}:repair-non-linear-target-advance`,
+    () => {
+      const fresh = readWorkHandle(ctx.controllerHome, current.repositoryId, current.workId) ?? current;
+      if (fresh.state !== 'failed' || fresh.expectedHead !== inspection.failedHead || fresh.finalization.merge !== 'failed') {
+        throw new Error('WORK_TARGET_ADVANCE_REPAIR_STALE_HANDLE');
+      }
+      return transitionWorkHandle(ctx.controllerHome, fresh, 'validating', {
+        expectedHead: inspection.repairedHead,
+        deliveryBaseCommit: inspection.targetHead,
+        failureReason: undefined,
+        validationRun: undefined,
+        validatedInputFingerprint: undefined,
+        finalization: {
+          ...fresh.finalization,
+          validation: 'pending',
+          commit: fresh.finalization.commit === 'failed' ? 'pending' : fresh.finalization.commit,
+          merge: 'pending',
+          failureCode: undefined, lastError: undefined,
+        },
+      });
+    },
+    10_000,
+  );
+  replaceTargetAdvanceScopeEvidence(ctx, contract, changedPaths);
+  transitionWorkContractPhase(
+    { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+    contract.workId,
+    {
+      phase: 'delivery',
+      status: 'running',
+      state: 'active',
+      summary: `Repaired non-linear target-advance history ${inspection.failedHead} -> ${inspection.repairedHead} with identical Git tree; exact validation is required again before delivery.`,
+    },
+  );
+  appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, contract.workId, {
+    title: 'non-linear target-advance candidate repaired',
+    summary: `Replaced failed merge candidate ${inspection.failedHead} with linear candidate ${inspection.repairedHead} above target ${inspection.targetHead} only after exact Git-tree equality, zero repaired merge commits, clean exact Work checkout/branch ownership, and Work path-scope verification. Prior validation identity was invalidated and must be re-established.`,
+    detailLevel: 'summary',
+  });
+  markRepositoryProjectionDirty(ctx.controllerHome, current.repositoryId, `finalize:${current.workId}:non-linear-target-repair`);
+  return repaired;
+}
+
 export function resetFinalizationStagesForRequest(
   stages: WorkFinalizationStages,
   wants: { commit: boolean; merge: boolean; cleanup: boolean },
@@ -761,6 +1397,48 @@ export function resetFinalizationStagesForRequest(
   return next;
 }
 
+function completeFinalizedWorkContract(input: {
+  ctx: McpExecutionContext;
+  handle: WorkHandleState;
+  contract: NonNullable<ReturnType<typeof contractFor>>;
+  args: Record<string, unknown>;
+  terminalizationOwner: ReturnType<typeof assertWorkControllerOwnership>;
+  outcome: 'completed_changed' | 'completed_no_change';
+}): CompletionReceipt {
+  const receipt = completionReceiptForFinalizedWork(input.ctx, input.handle, input.contract, input.args);
+  const ownerPrincipal = input.terminalizationOwner.principalId?.trim() || input.terminalizationOwner.controllerId;
+  const ownerInstanceId = input.terminalizationOwner.controllerInstanceId?.trim() || '';
+  const ownerClaimGeneration = input.terminalizationOwner.claimGeneration;
+  if (!ownerInstanceId || typeof ownerClaimGeneration !== 'number' || ownerClaimGeneration < 1) {
+    throw new Error(`WORK_CONTROLLER_TERMINALIZATION_AUTHORITY_INVALID: ${input.contract.workId}`);
+  }
+  const fencedCompletion = withControllerSessionTerminalizationFence(
+    { controllerHome: input.ctx.controllerHome, repoId: input.handle.repositoryId },
+    {
+      workId: input.contract.workId,
+      actor: `work-finalize-completion:${input.terminalizationOwner.controllerId}:${ownerInstanceId}`,
+      authority: {
+        controllerId: input.terminalizationOwner.controllerId,
+        controllerType: input.terminalizationOwner.controllerType,
+        principalId: ownerPrincipal,
+        controllerInstanceId: ownerInstanceId,
+        claimGeneration: ownerClaimGeneration,
+      },
+    },
+    () => completeWorkWithReceipt(
+      { controllerHome: input.ctx.controllerHome, repoId: input.handle.repositoryId },
+      input.contract.workId,
+      receipt,
+      input.outcome,
+      input.outcome === 'completed_changed' ? 'repository_change' : input.contract.workKind,
+    ),
+  );
+  if (!fencedCompletion.allowed) {
+    throw new Error(`WORK_TERMINALIZATION_AUTHORITY_FENCED: ${input.contract.workId}:${fencedCompletion.reason}`);
+  }
+  return receipt;
+}
+
 function finalizationComplete(stages: WorkFinalizationStages): boolean {
   return stages.validation === 'done'
     && stages.commit !== 'pending'
@@ -797,17 +1475,15 @@ function currentWorkValidationInput(
   };
 }
 
-export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
+export async function finalizeWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   let current = workForSession(ctx, session, args, { allowClaimedTerminalCleanup: args.cleanup !== false });
   const requestedWants = { commit: args.commit === true, merge: args.merge === true, cleanup: args.cleanup === true };
-  const retryStage = current.state === 'failed'
-    ? requestedFailedFinalizationRetry(current.finalization, requestedWants)
-    : undefined;
+  let retryStage = requestedFailedFinalizationRetry(current.finalization, requestedWants);
   const retryContract = retryStage ? contractFor(ctx, current) : undefined;
   if (
     retryStage
-    && retryContract?.status === 'failed'
+    && (retryContract?.status === 'failed' || retryContract?.status === 'blocked')
     && !retryContract.completionOutcome
     && !retryContract.completionReceipt
   ) {
@@ -827,6 +1503,8 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     return await reconcileTerminalCleanup(ctx, session, current, args, terminalOutcome);
   }
   const terminalizationOwner = assertWorkControllerOwnership(ctx, session, current, args);
+  current = reconcileFailedNonLinearTargetAdvanceRepair(ctx, current, args);
+  if (retryStage && current.finalization[retryStage] !== 'failed') retryStage = undefined;
   if (terminalOutcome && args.cleanup === false) {
     const recordedAt = new Date().toISOString();
     current = withControllerLock(
@@ -844,6 +1522,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
             merge: fresh.finalization.merge === 'pending' ? 'skipped' : fresh.finalization.merge,
             branchCleanup: 'skipped',
             worktreeCleanup: 'skipped',
+            failureCode: fresh.finalization.validation === 'failed' ? fresh.finalization.failureCode : undefined,
             lastError: fresh.finalization.validation === 'failed' ? fresh.finalization.lastError : undefined,
           },
           terminalResourceDisposition: {
@@ -901,6 +1580,53 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         failurePreserved: true,
       };
     }
+    if (terminalContract?.status === 'completed' && terminalContract.completionReceipt) {
+      updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
+        activeWorkId: undefined,
+        activeCheckoutId: workReturnCheckoutId(ctx, current, session.activeCheckoutId),
+      });
+      return { idempotent: true, work: compactHandle(current), stages: current.finalization, completed: true };
+    }
+    const cleanedCompletionRecovery = finalizationComplete(current.finalization)
+      && args.cleanup === true
+      && args.commit !== true
+      && args.merge !== true
+      && args.completion_outcome === 'completed_changed'
+      && terminalContract
+      && terminalContract.status !== 'cancelled'
+      && terminalContract.status !== 'failed'
+      && !terminalContract.completionReceipt;
+    if (cleanedCompletionRecovery && terminalContract) {
+      const terminalizationOwner = assertWorkControllerOwnership(ctx, session, current, args);
+      const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
+      const target = selectWorkFinalizationTarget(repository, current);
+      const durableReview = assertCleanedCompletionImplementationReviewGate({ target, handle: current, contract: terminalContract });
+      const reconciledContract = reconcileApprovedWorkImplementationReviewProjection(
+        { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+        terminalContract.workId,
+        {
+          reviewId: durableReview.reviewId,
+          sourceRevision: durableReview.sourceRevision,
+          changedPathDigest: durableReview.changedPathDigest,
+        },
+      );
+      completeFinalizedWorkContract({
+        ctx, handle: current, contract: reconciledContract, args, terminalizationOwner, outcome: 'completed_changed',
+      });
+      releasePreparedWorkOwnership(ctx, current);
+      updateExecutionSession(ctx.controllerHome, identityFor(ctx, args), {
+        activeWorkId: undefined,
+        activeCheckoutId: workReturnCheckoutId(ctx, current, session.activeCheckoutId),
+      });
+      return {
+        idempotent: true,
+        recoveredCompletionReceipt: true,
+        work: compactHandle(current),
+        stages: current.finalization,
+        completed: true,
+        cleanupCompleted: true,
+      };
+    }
     validateWorkHandle(ctx.controllerHome, current, identityFor(ctx, args), 'none', 'finalize');
     return { idempotent: true, work: compactHandle(current) };
   }
@@ -931,14 +1657,36 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
       return update(fresh);
     }, 10_000);
 
-  const failStage = (stage: keyof WorkFinalizationStages, reason: string): Record<string, unknown> => {
+  const failStage = (
+    stage: keyof WorkFinalizationStages,
+    reason: string,
+    failureCode?: WorkFinalizationFailureCode,
+  ): Record<string, unknown> => {
     current = transact(`fail:${String(stage)}`, (fresh) => {
-      const finalization = { ...fresh.finalization, [stage]: 'failed', lastError: reason } as WorkFinalizationStages;
-      return markWorkHandleFailed(ctx.controllerHome, { ...fresh, finalization }, reason);
+      const finalization = { ...fresh.finalization, [stage]: 'failed', failureCode, lastError: reason } as WorkFinalizationStages;
+      const retryableState = stage === 'validation'
+        ? 'validating'
+        : retryHandleStateForFinalization(finalization);
+      return transitionWorkHandle(ctx.controllerHome, fresh, retryableState, {
+        failureReason: reason,
+        finalization,
+        ...(stage === 'validation' ? { validationRun: undefined, validatedInputFingerprint: undefined } : {}),
+      });
     });
     if (current.workContractId) {
       if (stage === 'validation') {
-        updateWorkContract({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId, { status: 'failed' });
+        transitionWorkContractPhase(
+          { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+          current.workContractId,
+          {
+            phase: 'verification',
+            status: 'blocked',
+            state: 'blocked',
+            dispatchState: 'blocked',
+            summary: `Retryable Work finalization validation failed; exact verification/review authority must be re-established: ${reason}`,
+          },
+        );
+        markWorkValidationPending(ctx.controllerHome, current);
       } else if (stage === 'commit' || stage === 'merge' || stage === 'branchCleanup' || stage === 'worktreeCleanup') {
         transitionWorkContractPhase(
           { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
@@ -947,6 +1695,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
             phase: retryPhaseForFinalizationStage(stage),
             status: 'blocked',
             state: 'blocked',
+            dispatchState: 'blocked',
             summary: `Retryable Work finalization stage ${stage} failed: ${reason}`,
           },
         );
@@ -1006,44 +1755,92 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     });
   if (gitAuthorization.decision !== 'allow') return { authorization: gitAuthorization, work: compactHandle(current), stages: current.finalization };
 
-  // A direct Work can share canonical main with another Work's preserved dirty
-  // delta. If main advanced after this Work was prepared, keep the global
-  // execution-identity fence strict and reconcile only here, where delivery
-  // ownership plus exact current verification can be proven together.
-  if (wants.commit && !current.managedWorktree && current.expectedHead) {
+  // A conflict-repaired managed candidate rewrites commit identity, so the
+  // normal descendant-HEAD fence cannot authorize it. Re-adopt only an exact,
+  // clean, scope-contained candidate that has reconciled the linearly advanced
+  // target. The transition returns before delivery, so the successor must gain
+  // current-source verification/review authority before merge can resume.
+  if (wants.merge && current.managedWorktree && current.expectedHead) {
     const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
     const worktree = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
     const target = selectWorkFinalizationTarget(repository, current);
-    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
+    const targetBranch = resolveWorkDeliveryTargetBranch(current, target.defaultBranch, explicitTargetBranch);
     const contract = contractFor(ctx, current);
-    const advance = inspectDirectCanonicalTargetAdvanceReconciliation({
-      root: target.canonicalRoot,
+    const adoption = inspectManagedWorkSuccessorAdoption({
+      root: worktree.canonicalRoot,
       worktreePath: current.worktreePath,
       managedWorktree: current.managedWorktree,
       workBranch: current.branch,
       targetBranch,
       expectedRevision: current.expectedHead,
+      deliveryBaseRevision: workDeliveryBaseRevision(current),
       status: repositoryGitStatus(worktree),
       scope: contract ? { allowedPaths: contract.allowedPaths, forbiddenPaths: contract.forbiddenPaths } : undefined,
-      checkIds: contract?.checks ?? [],
-      checkRefs: contract?.checkRefs ?? [],
     });
-    if (advance.reconcilable && advance.targetHead) {
+    if (adoption.adoptable && adoption.candidateHead && adoption.targetHead) {
       const previousHead = current.expectedHead;
-      current = transact('direct-canonical-target-advance-reconciled', (fresh) => writeWorkHandle(ctx.controllerHome, {
-        ...fresh,
-        deliveryBaseCommit: advance.targetHead,
-        expectedHead: advance.targetHead,
-        failureReason: undefined,
-      }));
+      current = transact('managed-successor-adopted', (fresh) => adoptWorkHandleSuccessorCandidate(
+        ctx.controllerHome,
+        fresh,
+        { candidateHead: adoption.candidateHead!, targetHead: adoption.targetHead! },
+      ));
+      if (contract) {
+        transitionWorkContractPhase(
+          { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
+          contract.workId,
+          {
+            phase: 'verification',
+            status: 'running',
+            state: 'active',
+            summary: `Conflict-repaired successor ${adoption.candidateHead} adopted after canonical ${targetBranch} advanced to ${adoption.targetHead}; current-source verification is required before delivery resumes.`,
+          },
+        );
+      }
       appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-        title: 'direct canonical target advancement reconciled',
-        summary: `Canonical ${targetBranch} advanced linearly ${previousHead} -> ${advance.targetHead}. ${advance.targetChangedPaths.length} target-only path(s) were disjoint from all ${advance.dirtyPaths.length} positively Work-owned dirty path(s), and fresh exact verification bound [${advance.freshCheckIds.join(', ')}] to source ${advance.targetHead} plus workspace ${advance.workspaceFingerprint?.slice(0, 16) ?? 'unknown'}. Delivery identity advanced without adopting target-only commits or unrelated dirty paths.`,
+        title: 'managed Work successor candidate adopted',
+        summary: `WorkHandle authority moved ${previousHead} -> ${adoption.candidateHead} only after proving clean exact checkout ownership, canonical target ancestry at ${adoption.targetHead}, linear candidate history, and ${adoption.candidateChangedPaths.length} scope-contained target-relative path(s). Validation/delivery authority was re-armed; no canonical target mutation occurred.`,
         detailLevel: 'summary',
       });
+      markWorkValidationPending(ctx.controllerHome, current);
+      return {
+        work: compactHandle(current),
+        stages: current.finalization,
+        completed: false,
+        successorAdopted: true,
+        continuation: `WORK_SUCCESSOR_REVALIDATION_REQUIRED: successor ${adoption.candidateHead} is now the exact Work candidate after target ${adoption.targetHead}; verify/review this source revision before retrying delivery`,
+      };
     }
   }
 
+  // A direct Work can share canonical main with another Work's preserved dirty
+  // delta. If main advanced after this Work was prepared, keep the global
+  // execution-identity fence strict and reconcile only here, where delivery
+  // ownership plus exact current verification can be proven together.
+  if (wants.commit && !current.managedWorktree && current.expectedHead) {
+    const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
+    const worktree = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
+    const target = selectWorkFinalizationTarget(repository, current);
+    const targetBranch = resolveWorkDeliveryTargetBranch(current, repository.defaultBranch, explicitTargetBranch);
+    const contract = contractFor(ctx, current);
+    const reconciliation = reconcileDirectCanonicalTargetAdvanceCommand({
+      controllerHome: ctx.controllerHome,
+      repoId: current.repositoryId,
+      workId: current.workContractId ?? current.workId,
+      handle: current,
+      root: target.canonicalRoot,
+      targetBranch,
+      status: repositoryGitStatus(worktree),
+      scope: contract ? { allowedPaths: contract.allowedPaths, forbiddenPaths: contract.forbiddenPaths } : undefined,
+      checkIds: contract?.checks ?? [],
+      checkRefs: contract?.checkRefs ?? [],
+      persistHandle: (patch) => transact('direct-canonical-target-advance-reconciled', (fresh) => writeWorkHandle(ctx.controllerHome, {
+        ...fresh,
+        ...patch,
+      })),
+    });
+    if (reconciliation.reconciled) current = reconciliation.handle;
+  }
+
   if (failedCleanupProof) {
     const preservedFailure = current.failureReason ?? current.finalization.lastError ?? 'Work validation failed.';
     current = transact('failed-cleanup-begin', (fresh) => writeWorkHandle(ctx.controllerHome, {
@@ -1171,6 +1968,16 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     && wants.cleanup
     && !wants.commit
     && !wants.merge;
+  const noChangeCleanupReconciliation = requestedOutcome === 'completed_no_change'
+    ? inspectCleanupOnlyMergedHead(ctx, current, args)
+    : undefined;
+  const noChangeRemovedWorktreeRecovery = Boolean(
+    noChangeCleanupReconciliation?.worktreeMissing
+    && current.finalization.worktreeCleanup === 'done'
+    && current.finalization.validation === 'done'
+    && current.validatedInputFingerprint
+    && (current.state === 'merged' || current.state === 'cleaned'),
+  );
   const cleanupReconciliation = requestedOutcome === 'completed_no_change'
     ? undefined
     : inspectCleanupOnlyMergedHead(ctx, current, args);
@@ -1194,7 +2001,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         branchCleanup: deleteBranchRequested
           ? (fresh.finalization.branchCleanup === 'done' ? 'done' : 'pending')
           : 'skipped',
-        lastError: undefined,
+        failureCode: undefined, lastError: undefined,
       },
     }));
   }
@@ -1214,14 +2021,22 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
   if (terminalCleanupOnly) {
     current = transact('terminal-cleanup-validation-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, {
       ...fresh,
-      finalization: { ...fresh.finalization, validation: 'done', lastError: undefined },
+      finalization: { ...fresh.finalization, validation: 'done', failureCode: undefined, lastError: undefined },
     }));
+  } else if (noChangeRemovedWorktreeRecovery) {
+    // A prior no-change finalize may have durably recorded validation and physical
+    // worktree cleanup before terminal Work completion. Target containment above
+    // re-proves the exact expected HEAD; do not recreate mutable workspace state
+    // merely to repeat a validation whose fingerprint is already durable.
   } else {
     let validatedRepository: RepositoryRecord;
     try {
       validatedRepository = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize').worktreeRepository;
     } catch (error) {
-      return failStage('validation', error instanceof Error ? error.message : String(error));
+      const failureCode = error instanceof WorkHandleValidationError && error.code === 'WORK_HANDLE_HEAD_CHANGED'
+        ? error.code
+        : undefined;
+      return failStage('validation', error instanceof Error ? error.message : String(error), failureCode);
     }
     const validationContract = contractFor(ctx, current);
     if (!validationContract) throw new Error(`WORK_VALIDATION_CONTRACT_MISSING: ${current.workContractId ?? current.workId}`);
@@ -1232,7 +2047,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         current = transact('validation-no-checks', (fresh) => writeWorkHandle(ctx.controllerHome, {
           ...fresh,
           validatedInputFingerprint: validationInput.fingerprint,
-          finalization: { ...fresh.finalization, validation: 'done', lastError: undefined },
+          finalization: { ...fresh.finalization, validation: 'done', failureCode: undefined, lastError: undefined },
         }));
       }
       projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required.');
@@ -1245,7 +2060,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
       current = transact('validation-required', (fresh) => writeWorkHandle(ctx.controllerHome, {
         ...fresh,
         validatedInputFingerprint: undefined,
-        finalization: { ...fresh.finalization, validation: 'pending', lastError: undefined },
+        finalization: { ...fresh.finalization, validation: 'pending', failureCode: undefined, lastError: undefined },
       }));
       markWorkValidationPending(ctx.controllerHome, current);
       throw new Error('WORK_VALIDATION_REQUIRED: run work_validate against the exact current workspace before finalization');
@@ -1269,16 +2084,20 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
   }
 
   if (noChangeFastPath) {
-    if (!exactValidationInput?.clean) {
+    if (!exactValidationInput?.clean && !noChangeRemovedWorktreeRecovery) {
       throw new Error('WORK_NO_CHANGE_DIRTY: completed_no_change cannot retain an owned dirty worktree');
     }
+    const noChangeValidationFingerprint = exactValidationInput?.fingerprint ?? current.validatedInputFingerprint;
+    if (!noChangeValidationFingerprint) {
+      throw new Error('WORK_NO_CHANGE_VALIDATION_AUTHORITY_REQUIRED: completed_no_change requires retained exact validation authority');
+    }
     const noChangeFinalization: WorkFinalizationStages = {
       ...current.finalization,
       validation: 'done',
       commit: 'skipped',
       merge: 'skipped',
       branchCleanup: wants.cleanup && deleteBranchRequested ? 'pending' : 'skipped',
-      lastError: undefined,
+      failureCode: undefined, lastError: undefined,
     };
     // Collapse the no-op Git stages into the same durable lifecycle write used
     // to enter/establish the delivery boundary. Physical cleanup remains
@@ -1286,13 +2105,13 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     if (current.state === 'prepared') {
       current = transact('no-change-validated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'validating', {
         finalization: noChangeFinalization,
-        validatedInputFingerprint: exactValidationInput.fingerprint,
+        validatedInputFingerprint: noChangeValidationFingerprint,
         failureReason: undefined,
       }));
     } else if (current.state === 'editing' || current.state === 'validating' || current.state === 'committed') {
       current = transact('no-change-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
         finalization: noChangeFinalization,
-        validatedInputFingerprint: exactValidationInput.fingerprint,
+        validatedInputFingerprint: noChangeValidationFingerprint,
         failureReason: undefined,
       }));
     }
@@ -1307,28 +2126,53 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     if (dirtyPaths.length > 0 && commitPaths.length === 0) {
       throw new Error(`WORK_COMMIT_NO_OWNED_DIRTY_PATHS: ${current.workId} has ${dirtyPaths.length} dirty path(s), but none are owned by its WorkContract path scope`);
     }
+    if (!contract) throw new Error(`WORK_IMPLEMENTATION_REVIEW_CONTRACT_REQUIRED: ${current.workId}`);
+    const preCommitReviewCandidate = assertPhysicalImplementationReviewGate({
+      ctx,
+      repository: validated.worktreeRepository,
+      handle: current,
+      contract,
+      verificationWorkspaceFingerprint: exactValidationInput?.workspaceFingerprint,
+      targetBranch: resolveWorkDeliveryTargetBranch(current, validated.worktreeRepository.defaultBranch, explicitTargetBranch),
+    });
+    const reviewedCommitPaths = normalizeImplementationReviewChangedPaths(preCommitReviewCandidate.changedPaths);
+    const exactCommitPaths = normalizeImplementationReviewChangedPaths(commitPaths);
+    if (JSON.stringify(reviewedCommitPaths) !== JSON.stringify(exactCommitPaths)) {
+      throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_COMMIT_SCOPE_MISMATCH: commit must materialize the complete reviewed Work path set');
+    }
     const committed = repositoryGitCommit(ctx.controllerHome, validated.worktreeRepository, { message: String(args.message ?? `Complete ${current.workId}`), paths: commitPaths, allowEmpty: false, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
     const pendingAuthorization = [committed.stage, committed.commit].find((execution) => execution?.authorizationDecision?.decision === 'user_confirmation_required')?.authorizationDecision;
     if (pendingAuthorization) return { authorization: pendingAuthorization, work: compactHandle(current), stages: current.finalization };
     if (!committed.committed) return { ...failStage('commit', committed.error?.message ?? 'commit failed'), commit: committed };
     const checks = contract?.checks ?? [];
-    const committedValidatedWorkspaceFingerprint = exactValidationInput && committed.after.clean
-      ? workspaceValidationFingerprint(validated.worktreeRepository.canonicalRoot, committed.before)
-      : undefined;
+    const committedHead = gitHead(validated.worktreeRepository.canonicalRoot);
+    if (!committedHead) throw new Error('WORK_COMMIT_HEAD_REQUIRED: committed revision is unavailable');
+    const postCommitInput = currentWorkValidationInput(validated.worktreeRepository, { ...current, expectedHead: committedHead }, checks);
+    const postCommitContentFingerprint = implementationReviewContentFingerprint(
+      validated.worktreeRepository.canonicalRoot,
+      preCommitReviewCandidate.changedPaths,
+    );
+    const committedPaths = exactCommitChangedPaths(validated.worktreeRepository.canonicalRoot, committedHead);
+    const reviewedCommitPathsAfterCommit = normalizeImplementationReviewChangedPaths(preCommitReviewCandidate.changedPaths);
+    const exactCommittedPaths = normalizeImplementationReviewChangedPaths(committedPaths);
+    const reviewedContentPreservedAcrossCommit = JSON.stringify(reviewedCommitPathsAfterCommit) === JSON.stringify(exactCommittedPaths)
+      && postCommitContentFingerprint === preCommitReviewCandidate.workspaceFingerprint;
+    // Git staging/commit changes workspace-status shape even when the reviewed bytes
+    // are identical. Preserve validation from exact reviewed content equivalence;
+    // transferWorkVerificationAcrossContentEquivalentCommit remains responsible
+    // for invalidating checks whose semantics are genuinely Git-sensitive.
     const validationPreservedAcrossCommit = Boolean(
       checks.length > 0
       && exactValidationInput
-      && committedValidatedWorkspaceFingerprint === exactValidationInput.workspaceFingerprint
+      && reviewedContentPreservedAcrossCommit
     );
-    const committedHead = gitHead(validated.worktreeRepository.canonicalRoot);
-    const postCommitInput = currentWorkValidationInput(validated.worktreeRepository, { ...current, expectedHead: committedHead }, checks);
     current = transact('commit-done', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'committed', {
       expectedHead: committedHead,
       finalization: {
         ...fresh.finalization,
         validation: checks.length ? (validationPreservedAcrossCommit ? 'done' : 'pending') : 'done',
         commit: 'done',
-        lastError: undefined,
+        failureCode: undefined, lastError: undefined,
       },
       validatedInputFingerprint: checks.length
         ? (validationPreservedAcrossCommit ? postCommitInput.fingerprint : undefined)
@@ -1344,55 +2188,64 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         continuation: 'WORK_COMMITTED_REVALIDATION_REQUIRED: committed content changed from the exact validated workspace; run work_validate on the committed HEAD before merge or completion',
       };
     }
-    if (validationPreservedAcrossCommit && exactValidationInput) {
-      const checkDefinitions = listControllerChecks(validated.worktreeRepository.canonicalRoot);
-      for (const checkId of checks) {
-        const check = checkDefinitions.find((entry) => entry.id === checkId);
-        if (check?.effects?.git !== undefined) continue;
-        const sourcePass = contract
-          ? effectiveVerificationEvidence(contract.checkRefs, {
-              sourceRevision: exactValidationInput.head,
-              workspaceFingerprint: exactValidationInput.workspaceFingerprint,
-              checkId,
-              requestedChecks: checks,
-            }).find((entry) => entry.current && entry.record.outcome === 'valid_pass' && Boolean(entry.record.receipt))?.record
-          : undefined;
-        if (!sourcePass) continue;
-        appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-          ...sourcePass,
-          summary: `Validation authority transferred across content-equivalent commit for ${checkId}.`,
-          recordedAt: new Date().toISOString(),
-          sourceRevision: postCommitInput.head,
-          workspaceFingerprint: postCommitInput.workspaceFingerprint,
-          verificationInputFingerprint: verificationInputFingerprint({
-            sourceRevision: postCommitInput.head,
-            workspaceFingerprint: postCommitInput.workspaceFingerprint,
-            checkId,
-            requestedChecks: checks,
-          }),
-          evidenceRef: {
-            title: checkId,
-            summary: 'Reused prior valid receipt after proving the validated filesystem content was committed without drift.',
-            detailLevel: 'summary',
-          },
-        });
-      }
-      appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-        title: 'validation authority preserved across content-equivalent commit',
-        summary: `Exact validated workspace ${exactValidationInput.workspaceFingerprint.slice(0, 16)} was committed without content/status drift; non-Git-sensitive per-check authority transferred to committed HEAD ${postCommitInput.head}.`,
-        detailLevel: 'summary',
-      });
-    } else if (checks.length === 0) {
-      projectWorkValidationOutcome(ctx.controllerHome, current, 'passed', 'No validation checks were required after commit.');
+    const authorityTransfer = transferReviewedWorkAuthorityAcrossContentEquivalentCommit({
+      controllerHome: ctx.controllerHome,
+      repository: validated.worktreeRepository,
+      workId: current.workContractId ?? current.workId,
+      preCommitCandidate: preCommitReviewCandidate,
+      preCommitDirtyPaths: commitPaths,
+      committedPaths,
+      preCommitContentDigest: preCommitReviewCandidate.workspaceFingerprint,
+      postCommitSourceRevision: postCommitInput.head,
+      postCommitContentDigest: postCommitContentFingerprint,
+      postCommitVerificationWorkspaceFingerprint: postCommitInput.workspaceFingerprint,
+      postCommitChangedPaths: preCommitReviewCandidate.changedPaths,
+    });
+    if (authorityTransfer.invalidatedCheckIds.length > 0) {
+      current = transact('commit-review-revalidation-required', (fresh) => writeWorkHandle(ctx.controllerHome, {
+        ...fresh,
+        finalization: { ...fresh.finalization, validation: 'pending', failureCode: undefined, lastError: undefined },
+        validatedInputFingerprint: undefined,
+      }));
+      markWorkValidationPending(ctx.controllerHome, current);
+      return {
+        work: compactHandle(current),
+        stages: current.finalization,
+        completed: false,
+        continuation: `WORK_COMMITTED_REVALIDATION_REQUIRED: content-equivalent verification transfer invalidated [${authorityTransfer.invalidatedCheckIds.join(', ')}]`,
+      };
+    }
+    if (!authorityTransfer.transferred || !authorityTransfer.derivedReview) {
+      throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_REQUIRED');
     }
+    appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
+      title: 'verification and implementation-review authority preserved across content-equivalent commit',
+      summary: `The exact reviewed Work content was committed as ${postCommitInput.head}; ${authorityTransfer.reusableCheckIds.length}/${checks.length} non-Git-sensitive Process receipt(s) and review ${authorityTransfer.derivedReview.reviewId} were transferred atomically.`,
+      detailLevel: 'summary',
+    });
   } else if (!wants.commit && current.finalization.commit === 'pending') {
-    current = transact('commit-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, commit: 'skipped' } }));
+    const committedRepository = validateWorkHandle(ctx.controllerHome, current, identity, 'full', 'finalize').worktreeRepository;
+    const committedStatus = repositoryGitStatus(committedRepository);
+    const alreadyMaterializedCommit = Boolean(
+      committedStatus.clean
+      && committedStatus.head
+      && current.expectedHead
+      && current.baseCommit
+      && committedStatus.head === current.expectedHead
+      && committedStatus.head !== current.baseCommit,
+    );
+    current = alreadyMaterializedCommit
+      ? transact('commit-already-materialized', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'committed', {
+          finalization: { ...fresh.finalization, commit: 'done', failureCode: undefined, lastError: undefined },
+          failureReason: undefined,
+        }))
+      : transact('commit-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, commit: 'skipped' } }));
   }
 
   if (wants.merge && current.finalization.merge === 'pending' && current.finalization.commit === 'done') {
     const repository = getRepository(current.repositoryId, ctx.controllerHome);
     const target = selectWorkFinalizationTarget(repository, current);
-    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
+    const targetBranch = resolveWorkDeliveryTargetBranch(current, repository.defaultBranch, explicitTargetBranch);
     const directTarget = inspectDirectTargetDelivery(
       target.canonicalRoot,
       current.worktreePath,
@@ -1403,7 +2256,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     );
     if (directTarget.integrated) {
       current = transact('direct-target-delivery-integrated', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-        finalization: { ...fresh.finalization, merge: 'done', branchCleanup: 'skipped', lastError: undefined },
+        finalization: { ...fresh.finalization, merge: 'done', branchCleanup: 'skipped', failureCode: undefined, lastError: undefined },
         failureReason: undefined,
       }));
       appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
@@ -1425,9 +2278,16 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     }
     const contract = contractFor(ctx, current);
     if (contract?.constraints.allowMerge === false) throw new Error('WORK_MERGE_NOT_ALLOWED: WorkContract disallows merge');
+    if (!contract) throw new Error(`WORK_IMPLEMENTATION_REVIEW_CONTRACT_REQUIRED: ${current.workId}`);
     const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
     const deleteAfterWorktreeCleanup = current.managedWorktree && deleteBranchRequested;
-    const targetBranch = explicitTargetBranch ?? target.defaultBranch ?? 'main';
+    const targetBranch = resolveWorkDeliveryTargetBranch(current, target.defaultBranch, explicitTargetBranch);
+    // Re-read the exact Work candidate immediately before any merge-path mutation
+    // (including target-advance rebase). The finalizer is an independent physical
+    // gate; semantic finalize authority is not trusted as a cached boolean.
+    assertPhysicalImplementationReviewGate({
+      ctx, repository: mergeValidated.worktreeRepository, handle: current, contract, targetBranch,
+    });
     const activeMergeHead = retryStage === 'merge' ? gitRevision(target.canonicalRoot, 'MERGE_HEAD') : undefined;
     if (!activeMergeHead && current.managedWorktree && current.expectedHead) {
       const targetHead = gitRevision(target.canonicalRoot, targetBranch);
@@ -1442,6 +2302,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
                 phase: 'delivery',
                 status: 'blocked',
                 state: 'blocked',
+                dispatchState: 'blocked',
                 summary: `Target branch ${targetBranch} advanced to ${advance.targetHead} and conflicts with candidate ${advance.candidateHead}; canonical target was not mutated.`,
               },
             );
@@ -1466,7 +2327,11 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
             advance.candidateHead,
           );
           if (nonLinearCommits.length > 0) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: candidate already contains merge commit(s) above reconciled target ${advance.targetHead}: ${nonLinearCommits.slice(0, 8).join(', ')}`);
+            return failStage(
+              'merge',
+              `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: candidate already contains merge commit(s) above reconciled target ${advance.targetHead}: ${nonLinearCommits.slice(0, 8).join(', ')}`,
+              'WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION',
+            );
           }
           const scopeViolation = targetAdvanceWorkScopeViolation(contract, advance.candidateChangedPaths);
           if (scopeViolation) {
@@ -1505,6 +2370,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
                   phase: 'delivery',
                   status: 'blocked',
                   state: 'blocked',
+                  dispatchState: 'blocked',
                   summary: `Linear target-advance integration failed inside the isolated Work checkout; canonical ${targetBranch} was not mutated.`,
                 },
               );
@@ -1537,7 +2403,11 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
             encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000,
           });
           if (mergeCommits.length > 0) {
-            return failStage('merge', `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: integrated candidate contains merge commit(s): ${mergeCommits.slice(0, 8).join(', ')}`);
+            return failStage(
+              'merge',
+              `WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION: integrated candidate contains merge commit(s): ${mergeCommits.slice(0, 8).join(', ')}`,
+              'WORK_TARGET_ADVANCE_LINEAR_HISTORY_VIOLATION',
+            );
           }
           if (
             !advance.mergedTree
@@ -1585,7 +2455,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
               deliveryBaseCommit: advance.targetHead,
               expectedHead: integratedHead,
               failureReason: undefined,
-              finalization: { ...fresh.finalization, validation: validationPreserved ? 'done' : 'pending', merge: 'pending', lastError: undefined },
+              finalization: { ...fresh.finalization, validation: validationPreserved ? 'done' : 'pending', merge: 'pending', failureCode: undefined, lastError: undefined },
               validationRun: undefined,
               validatedInputFingerprint: validationPreserved ? integratedInput.fingerprint : undefined,
             },
@@ -1610,6 +2480,31 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
         }
       }
     }
+    const deliveryContract = contractFor(ctx, current);
+    if (!deliveryContract) throw new Error(`WORK_IMPLEMENTATION_REVIEW_CONTRACT_REQUIRED: ${current.workId}`);
+    try {
+      const deliveryRepository = selectRepositoryCheckout(
+        getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true }),
+        current.checkoutId,
+        { allowArchived: true },
+      );
+      assertPhysicalImplementationReviewGate({
+        ctx, repository: deliveryRepository, handle: current, contract: deliveryContract, targetBranch,
+      });
+    } catch (error) {
+      return {
+        work: compactHandle(current),
+        stages: current.finalization,
+        completed: false,
+        blocked: true,
+        recoverable: true,
+        error: {
+          code: 'WORK_IMPLEMENTATION_REVIEW_REQUIRED',
+          message: error instanceof Error ? error.message : String(error),
+        },
+        continuation: 'WORK_IMPLEMENTATION_REVIEW_REQUIRED: target integration changed the Work delivery candidate; verify/review the exact current candidate before mutating the canonical target.',
+      };
+    }
     let merged: ReturnType<typeof repositoryGitFinishWorkflow>;
     if (activeMergeHead) {
       const expectedMergeHead = current.expectedHead ? gitRevision(target.canonicalRoot, current.expectedHead) : undefined;
@@ -1691,29 +2586,26 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
             ])].sort();
             let preserveDirtyTargetPaths: string[] | undefined;
             if (lockedDirtyPaths.length > 0) {
-              const ownership = inspectTargetDirtyWorkOwnership({
+              const preservation = planTargetDirtyPreservation({
                 dirtyPaths: lockedDirtyPaths,
                 targetCheckoutId: target.activeCheckoutId,
                 currentWorkId: current.workId,
                 activeWorks: listWorkContracts({ controllerHome: ctx.controllerHome, repoId: current.repositoryId, status: 'active', limit: 200 }),
               });
-              if (!ownership.owned) {
-                const detail = [
-                  ownership.unownedPaths.length ? `unowned=[${ownership.unownedPaths.join(', ')}]` : '',
-                  ownership.ambiguousPaths.length ? `ambiguous=[${ownership.ambiguousPaths.join(', ')}]` : '',
-                ].filter(Boolean).join(' ');
-                throw new Error(`WORK_TARGET_DIRTY_OWNERSHIP_REQUIRED: target ${targetBranch} has dirty path(s) that cannot be attributed uniquely to another active Work. ${detail}`.trim());
-              }
-              preserveDirtyTargetPaths = ownership.dirtyPaths;
+              const ownership = preservation.ownership;
+              preserveDirtyTargetPaths = preservation.preserveDirtyTargetPaths;
+              const attribution = ownership.owned
+                ? 'all preserved paths are attributed uniquely to other active Work'
+                : `preserved paths include unattributed or ambiguous content (unowned=${ownership.unownedPaths.length}, ambiguous=${ownership.ambiguousPaths.length})`;
               appendWorkEvidence({ controllerHome: ctx.controllerHome, repoId: current.repositoryId }, current.workContractId ?? current.workId, {
-                title: 'concurrent target dirty ownership preserved',
-                summary: `Target ${targetBranch} retained ${ownership.dirtyPaths.length} dirty path(s) owned by other active Work while this Work entered only the target-branch mutation critical section.`,
+                title: 'concurrent target dirty content preserved',
+                summary: `Target ${targetBranch} retained ${preserveDirtyTargetPaths.length} dirty path(s) in place; ${attribution}. Git integration remains fail-closed before target mutation if the candidate overlaps any preserved path.`,
                 detailLevel: 'summary',
               });
             }
             return repositoryGitFinishWorkflow(ctx.controllerHome, target, {
               featureBranch: current.branch,
-              targetBranch: explicitTargetBranch,
+              targetBranch,
               deleteBranch: !deleteAfterWorktreeCleanup && deleteBranchRequested,
               noFf: args.no_ff === true,
               preserveDirtyTargetPaths,
@@ -1735,7 +2627,7 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     if (pendingAuthorization) return { authorization: pendingAuthorization, work: compactHandle(current), stages: current.finalization };
     if (!merged.completed) return { ...failStage('merge', merged.error?.message ?? 'merge failed'), merge: merged };
     current = transact('merge-done', (fresh) => transitionWorkHandle(ctx.controllerHome, fresh, 'merged', {
-      finalization: { ...fresh.finalization, merge: 'done', branchCleanup: !deleteBranchRequested ? 'skipped' : deleteAfterWorktreeCleanup ? 'pending' : 'done', lastError: undefined },
+      finalization: { ...fresh.finalization, merge: 'done', branchCleanup: !deleteBranchRequested ? 'skipped' : deleteAfterWorktreeCleanup ? 'pending' : 'done', failureCode: undefined, lastError: undefined },
       failureReason: undefined,
     }));
   } else if (!wants.merge && current.finalization.merge === 'pending') {
@@ -1755,10 +2647,15 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
   if (remoteDeliveryRequired && requestedOutcome !== 'completed_no_change') {
     const repository = getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true });
     const target = selectWorkFinalizationTarget(repository, current);
-    const targetBranch = explicitTargetBranch ?? repository.defaultBranch ?? 'main';
+    const targetBranch = resolveWorkDeliveryTargetBranch(current, repository.defaultBranch, explicitTargetBranch);
     const targetRevision = gitRevision(target.canonicalRoot, targetBranch);
     if (!targetRevision) throw new Error(`WORK_REMOTE_DELIVERY_TARGET_REQUIRED: target branch ${targetBranch} is unavailable`);
     const authorityRepository = selectRepositoryCheckout(repository, current.checkoutId, { allowArchived: true });
+    const remoteDeliveryContract = contractFor(ctx, current);
+    if (!remoteDeliveryContract) throw new Error(`WORK_IMPLEMENTATION_REVIEW_CONTRACT_REQUIRED: ${current.workId}`);
+    assertPhysicalImplementationReviewGate({
+      ctx, repository: authorityRepository, handle: current, contract: remoteDeliveryContract, targetBranch,
+    });
     remoteDelivery = await pushExactWorkRemoteDelivery({
       controllerHome: ctx.controllerHome,
       repository: authorityRepository,
@@ -1806,19 +2703,50 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     }
   }
 
+  let prevalidatedNoChangeReceipt: CompletionReceipt | undefined;
+  if (requestedOutcome === 'completed_no_change'
+    && current.finalization.validation === 'done'
+    && current.finalization.commit === 'skipped'
+    && current.finalization.merge === 'skipped'
+    && (current.state === 'merged' || current.state === 'cleaned')) {
+    const completionContract = contractFor(ctx, current);
+    if (!completionContract) throw new Error(`WORK_COMPLETION_CONTRACT_MISSING: ${current.workContractId ?? current.workId}`);
+    // Delivery/target identity is semantic completion evidence. Prove it before
+    // deleting any managed worktree or branch so a wrong target remains safely
+    // retryable with the exact workspace intact.
+    prevalidatedNoChangeReceipt = completionReceiptForFinalizedWork(ctx, current, completionContract, args);
+  }
+
   if (wants.cleanup && current.finalization.worktreeCleanup === 'pending') {
     const contract = contractFor(ctx, current);
     if (contract?.constraints.allowCleanup === false) throw new Error('WORK_CLEANUP_NOT_ALLOWED: WorkContract disallows cleanup');
     if (!current.managedWorktree) {
       current = transact('worktree-cleanup-skipped', (fresh) => writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'skipped' } }));
     } else {
+      const cleanupContract = contractFor(ctx, current);
+      if (!cleanupContract) throw new Error(`WORK_IMPLEMENTATION_REVIEW_CONTRACT_REQUIRED: ${current.workId}`);
+      if (cleanupContract.status !== 'cancelled' && cleanupContract.status !== 'failed') {
+        const cleanupRepository = selectRepositoryCheckout(
+          getRepository(current.repositoryId, ctx.controllerHome, { includeRemoved: true }),
+          current.checkoutId,
+          { allowArchived: true },
+        );
+        const cleanupTargetBranch = resolveWorkDeliveryTargetBranch(
+          current,
+          cleanupRepository.defaultBranch,
+          explicitTargetBranch,
+        );
+        assertPhysicalImplementationReviewGate({
+          ctx, repository: cleanupRepository, handle: current, contract: cleanupContract, targetBranch: cleanupTargetBranch,
+        });
+      }
       const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
       const cleanup = runCleanup(target.canonicalRoot, current.worktreePath);
       if (!cleanup.ok) return failStage('worktreeCleanup', cleanup.message ?? 'worktree cleanup failed');
       current = transact('worktree-cleanup-done', (fresh) => {
         setRepositoryCheckoutLifecycle({ controllerHome: ctx.controllerHome, repoId: fresh.repositoryId, checkoutId: fresh.checkoutId, lifecycle: 'removed', reason: `Work ${fresh.workId} cleanup completed.` });
         markRepositoryProjectionDirty(ctx.controllerHome, fresh.repositoryId, `cleanup:${fresh.workId}:worktree`);
-        return writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'done', lastError: undefined } });
+        return writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, worktreeCleanup: 'done', failureCode: undefined, lastError: undefined } });
       });
     }
   } else if (!wants.cleanup && current.finalization.worktreeCleanup === 'pending') {
@@ -1831,12 +2759,23 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
     && (current.finalization.merge === 'done' || requestedOutcome === 'completed_no_change')
   ) {
     const target = selectWorkFinalizationTarget(getRepository(current.repositoryId, ctx.controllerHome), current);
+    const branchCleanupContract = contractFor(ctx, current);
+    if (!branchCleanupContract) throw new Error(`WORK_IMPLEMENTATION_REVIEW_CONTRACT_REQUIRED: ${current.workId}`);
+    if (branchCleanupContract.status !== 'cancelled' && branchCleanupContract.status !== 'failed') {
+      const targetBranch = resolveWorkDeliveryTargetBranch(current, target.defaultBranch, explicitTargetBranch);
+      assertPhysicalBranchCleanupImplementationReviewGate({
+        target,
+        handle: current,
+        contract: branchCleanupContract,
+        targetBranch,
+      });
+    }
     const deleted = repositoryGitDeleteBranch(ctx.controllerHome, target, { branch: current.branch, force: false, authorizationDecision: gitAuthorization, sessionId: session.sessionId, principalId: session.principalId, workId: current.workId, goalId: current.goalId });
     if (deleted.execution.authorizationDecision?.decision === 'user_confirmation_required') return { authorization: deleted.execution.authorizationDecision, work: compactHandle(current), stages: current.finalization };
     if (deleted.execution.status !== 'executed' || deleted.execution.ok !== true) return failStage('branchCleanup', deleted.execution.stderr || 'feature branch cleanup failed');
     current = transact('branch-cleanup-done', (fresh) => {
       markRepositoryProjectionDirty(ctx.controllerHome, fresh.repositoryId, `cleanup:${fresh.workId}:branch`);
-      return writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, branchCleanup: 'done', lastError: undefined } });
+      return writeWorkHandle(ctx.controllerHome, { ...fresh, finalization: { ...fresh.finalization, branchCleanup: 'done', failureCode: undefined, lastError: undefined } });
     });
   }
 
@@ -1866,36 +2805,34 @@ export async function finalizeWork(ctx: MultiRepositoryMcpToolContext, args: Rec
           detailLevel: 'summary',
         });
       }
-      const receipt = completionReceiptForFinalizedWork(ctx, current, completionContract, args);
-      const ownerPrincipal = terminalizationOwner.principalId?.trim() || terminalizationOwner.controllerId;
-      const ownerInstanceId = terminalizationOwner.controllerInstanceId?.trim() || '';
-      const ownerClaimGeneration = terminalizationOwner.claimGeneration;
-      if (!ownerInstanceId || typeof ownerClaimGeneration !== 'number' || ownerClaimGeneration < 1) {
-        throw new Error(`WORK_CONTROLLER_TERMINALIZATION_AUTHORITY_INVALID: ${workId}`);
-      }
-      const fencedCompletion = withControllerSessionTerminalizationFence(
-        { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-        {
-          workId,
-          actor: `work-finalize-completion:${terminalizationOwner.controllerId}:${ownerInstanceId}`,
-          authority: {
-            controllerId: terminalizationOwner.controllerId,
-            controllerType: terminalizationOwner.controllerType,
-            principalId: ownerPrincipal,
-            controllerInstanceId: ownerInstanceId,
-            claimGeneration: ownerClaimGeneration,
-          },
-        },
-        () => completeWorkWithReceipt(
+      if (prevalidatedNoChangeReceipt) {
+        const ownerPrincipal = terminalizationOwner.principalId?.trim() || terminalizationOwner.controllerId;
+        const ownerInstanceId = terminalizationOwner.controllerInstanceId?.trim() || '';
+        const ownerClaimGeneration = terminalizationOwner.claimGeneration;
+        if (!ownerInstanceId || typeof ownerClaimGeneration !== 'number' || ownerClaimGeneration < 1) {
+          throw new Error(`WORK_CONTROLLER_TERMINALIZATION_AUTHORITY_INVALID: ${workId}`);
+        }
+        const fencedCompletion = withControllerSessionTerminalizationFence(
           { controllerHome: ctx.controllerHome, repoId: current.repositoryId },
-          workId,
-          receipt,
-          requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'completed_changed',
-          requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'repository_change',
-        ),
-      );
-      if (!fencedCompletion.allowed) {
-        throw new Error(`WORK_TERMINALIZATION_AUTHORITY_FENCED: ${workId}:${fencedCompletion.reason}`);
+          {
+            workId,
+            actor: `work-finalize-completion:${terminalizationOwner.controllerId}:${ownerInstanceId}`,
+            authority: {
+              controllerId: terminalizationOwner.controllerId, controllerType: terminalizationOwner.controllerType,
+              principalId: ownerPrincipal, controllerInstanceId: ownerInstanceId, claimGeneration: ownerClaimGeneration,
+            },
+          },
+          () => completeWorkWithReceipt(
+            { controllerHome: ctx.controllerHome, repoId: current.repositoryId }, workId, prevalidatedNoChangeReceipt,
+            'completed_no_change', 'completed_no_change',
+          ),
+        );
+        if (!fencedCompletion.allowed) throw new Error(`WORK_TERMINALIZATION_AUTHORITY_FENCED: ${workId}:${fencedCompletion.reason}`);
+      } else {
+        completeFinalizedWorkContract({
+          ctx, handle: current, contract: completionContract, args, terminalizationOwner,
+          outcome: requestedOutcome === 'completed_no_change' ? 'completed_no_change' : 'completed_changed',
+        });
       }
     }
     // Successful WorkContract completion always ends controller ownership.