@moretea-labs/forge 1.7.2 → 1.8.1

package/src/runtime/control-plane/facade/policy-gate.ts

@@ -14,13 +14,6 @@ export type PolicySideEffect =
   | 'destructive_remote'
   | 'raw_secret_config';
 
-export interface DirectEditBoundary {
-  scopeClear: boolean;
-  maxChangedFiles?: number;
-  maxChangedLines?: number;
-  pathsExplicit?: boolean;
-}
-
 export interface PolicyGateInput {
   capability?: CapabilityDescriptor;
   capabilityId?: string;
@@ -29,7 +22,6 @@ export interface PolicyGateInput {
   accessMode?: AccessMode;
   approvalConfirmed?: boolean;
   dryRun?: boolean;
-  directEditBoundary?: DirectEditBoundary;
 }
 
 function approvalAction(reason: string, capabilityId?: string): SuggestedNextAction {
@@ -62,11 +54,6 @@ function accessEffectFromSideEffect(sideEffect: PolicySideEffect): AccessEffect
   return 'secret_access';
 }
 
-function directEditWithinBoundary(boundary: DirectEditBoundary | undefined): boolean {
-  if (!boundary) return false;
-  return boundary.scopeClear && boundary.pathsExplicit === true && (boundary.maxChangedFiles ?? 99) <= 3 && (boundary.maxChangedLines ?? 9999) <= 200;
-}
-
 export function evaluatePolicyGate(input: PolicyGateInput): PolicyDecision {
   const capabilityId = input.capability?.capabilityId ?? input.capabilityId;
   const risk = input.risk ?? input.capability?.risk;
@@ -108,16 +95,6 @@ export function evaluatePolicyGate(input: PolicyGateInput): PolicyDecision {
     };
   }
 
-  if (sideEffect === 'local_repo_write' && directEditWithinBoundary(input.directEditBoundary)) {
-    return {
-      decision: 'allowed',
-      reason: 'Bounded direct edit is within the lightweight Direct Control policy boundary.',
-      capabilityId,
-      warnings,
-      suggestedNextActions: [],
-    };
-  }
-
   if (input.approvalConfirmed) {
     return {
       decision: 'allowed',

package/src/runtime/control-plane/facade/repository-work-admission.ts

@@ -1,19 +1,31 @@
 import type { AccessMode } from '../governance/access-policy';
-import type { RouteDecision } from '../routing/route-policy';
-import { createWorkContract, getWorkContract, updateWorkContract, type WorkContractStoreOptions } from './work-contract-store';
+import { createWorkContract, executionPlacementForWork, getWorkContract, updateWorkContract, type WorkContractStoreOptions } from '../../../../packages/kernel/work/api/index';
+import { executionPlacement, readForgeInstanceIdentity } from '../../../../packages/kernel/identity/api/index';
 import type { WorkContract } from './types';
 
+function repositoryExecutionPlacement(store: WorkContractStoreOptions, repoId: string, checkoutId?: string) {
+  const forgeInstanceId = store.controllerHome ? readForgeInstanceIdentity(store.controllerHome)?.instanceId : undefined;
+  return executionPlacement({
+    ...(forgeInstanceId ? { forgeInstanceId } : {}),
+    repositoryId: repoId,
+    ...(checkoutId?.trim() ? { checkoutId: checkoutId.trim() } : {}),
+  });
+}
+
 export interface PreparedRepositoryWorkAdmissionInput {
   workId: string;
   repoId: string;
   objective: string;
   acceptanceCriteria: string[];
-  allowedPaths: string[];
   checks: string[];
   accessMode: AccessMode;
   isolated: boolean;
   requestedBy: WorkContract['requestedBy'];
   requestId: string;
+  /** Legacy ingress-only path hints; concrete mutation scope is EditSession-owned. */
+  allowedPaths?: string[];
+  /** Legacy ingress-only path hints; concrete mutation scope is EditSession-owned. */
+  forbiddenPaths?: string[];
 }
 
 /**
@@ -28,17 +40,13 @@ export function admitPreparedRepositoryWorkContract(
   return createWorkContract(store, {
     workId: input.workId,
     repoId: input.repoId,
-    mode: input.isolated ? 'goal_workloop' : 'direct_control',
+    executionPlacement: repositoryExecutionPlacement(store, input.repoId),
     objective: input.objective,
     acceptanceCriteria: input.acceptanceCriteria,
-    allowedPaths: input.allowedPaths,
-    forbiddenPaths: [],
     checks: input.checks,
     constraints: {
       accessMode: input.accessMode,
       workspaceMode: input.isolated ? 'isolated' : 'current',
-      requireWorktree: input.isolated,
-      directMainProhibited: input.isolated,
       allowCommit: true,
       allowMerge: true,
       allowCleanup: true,
@@ -60,49 +68,44 @@ export interface DirectEditWorkAdmissionInput {
   controllerInstanceId?: string;
   baseRevision?: string;
   workspaceFingerprint: string;
-  routeDecision: RouteDecision;
   objective: string;
   issueId?: string;
   taskId?: string;
-  allowedPaths: string[];
   checks: string[];
   requestedBy: WorkContract['requestedBy'];
+  /** Legacy ingress-only path hints; concrete mutation scope is EditSession-owned. */
+  allowedPaths?: string[];
+  /** Legacy ingress-only path hints; concrete mutation scope is EditSession-owned. */
+  forbiddenPaths?: string[];
 }
 
 /**
  * Canonical compatibility admission for an Edit Session bound to Direct Work.
- * The caller supplies the canonical Route Policy decision as evidence; this
- * boundary rejects any decision that requires isolation or a non-direct lane.
+ * Direct-edit admission is selected explicitly by this capability boundary;
+ * no route/mode token authorizes or rejects the operation.
  */
 export function admitDirectEditWorkContract(
   store: WorkContractStoreOptions,
   input: DirectEditWorkAdmissionInput,
 ): WorkContract {
-  if (input.routeDecision.executionMode !== 'direct_control' || input.routeDecision.requiresIsolation) {
-    throw new Error('DIRECT_EDIT_WORK_ROUTE_CONFLICT: canonical Route Policy does not permit Direct Control');
-  }
   return createWorkContract(store, {
     workId: input.workId,
     repoId: input.repoId,
     checkoutId: input.checkoutId,
+    executionPlacement: repositoryExecutionPlacement(store, input.repoId, input.checkoutId),
     principalId: input.principalId,
     controllerInstanceId: input.controllerInstanceId,
     baseRevision: input.baseRevision,
     workspaceFingerprint: input.workspaceFingerprint,
-    routeDecisionFingerprint: input.routeDecision.inputFingerprint,
-    routeDecision: input.routeDecision,
-    mode: 'direct_control',
     objective: input.objective,
     acceptanceCriteria: [],
-    constraints: { workspaceMode: 'current', requireWorktree: false, requireHandoffOnAmbiguity: true },
+    constraints: { workspaceMode: 'current' },
     risk: 'low',
-    status: 'running',
+    dispatchState: 'running',
     phase: 'implementation',
     issueId: input.issueId,
     taskId: input.taskId,
     scopeSummary: input.objective,
-    allowedPaths: input.allowedPaths,
-    forbiddenPaths: [],
     checks: input.checks,
     requestedBy: input.requestedBy,
     evidenceRefs: [],
@@ -138,10 +141,15 @@ export function materializeRepositoryWorkPlacement(
   if (!workspace.managed || !workspace.checkoutId || !workspace.root) {
     throw new Error('MANAGED_WORKSPACE_NOT_MATERIALIZED');
   }
+  const currentPlacement = executionPlacementForWork(contract);
   return updateWorkContract(store, workId, {
     checkoutId: workspace.checkoutId,
+    executionPlacement: executionPlacement({
+      ...(currentPlacement.forgeInstanceId ? { forgeInstanceId: currentPlacement.forgeInstanceId } : {}),
+      repositoryId: contract.repoId,
+      checkoutId: workspace.checkoutId,
+    }),
     baseRevision: workspace.baseRevision ?? contract.baseRevision,
     worktreeRef: workspace.root,
-    driver: { ...contract.driver, preferred: 'isolated_worktree', allowDirectEdit: false },
   });
 }

package/src/runtime/control-plane/facade/requirement-authority.ts

@@ -1,10 +1,14 @@
 import {
+  bindRequirementCandidateAuditRef,
   createRequirement,
+  listRequirements,
   readRequirement,
   type CreateRequirementInput,
   type Requirement,
   type RequirementStoreOptions,
 } from '../persistence/requirement-store';
+import { cognitionMemoryStore } from '../persistence/cognition-store';
+import { memoryAddressKey, type MemoryUnit } from '../../../../packages/kernel/cognition/api/index';
 
 export type RequirementAdmissionDecision = 'created' | 'reuse_existing' | 'existing_conflict';
 
@@ -37,6 +41,7 @@ export function normalizeRequirementAdmissionInput(input: CreateRequirementInput
     acceptanceCriteria: bounded(input.acceptanceCriteria, 50),
     requiredDeliveryReferences: bounded(input.requiredDeliveryReferences, 50),
     legacyAliases: bounded(input.legacyAliases, 20, 160),
+    auditRefs: bounded(input.auditRefs, 50),
   };
   if (!normalized.title || !normalized.outcomeStatement) throw new Error('REQUIREMENT_CONTENT_REQUIRED');
   return normalized;
@@ -81,3 +86,119 @@ export function admitRequirement(
     return existingDecision(raced, requested);
   }
 }
+
+export type RequirementCandidatePromotionDecision =
+  | RequirementAdmissionDecision
+  | 'candidate_already_promoted';
+
+export interface RequirementCandidatePromotionResult {
+  decision: RequirementCandidatePromotionDecision;
+  requirement: Requirement;
+  created: boolean;
+  candidateAuditRef: string;
+  candidateMemoryId: string;
+  workspaceId: string;
+}
+
+function activeRequirementCandidate(memory: MemoryUnit, at: string): boolean {
+  return !memory.retractedAt
+    && memory.validFrom <= at
+    && (!memory.expiresAt || memory.expiresAt > at)
+    && memory.facets.includes('candidate-finding')
+    && memory.facets.includes('requirement-candidate')
+    && memory.facets.includes('advisory')
+    && memory.concepts.includes('forge.requirement-candidate')
+    && memory.provenance.sourceKind === 'system'
+    && Boolean(memory.provenance.sourceId?.startsWith('cognitive-requirement-candidate:promoted:'))
+    && memory.provenance.evidenceRefs.length > 0;
+}
+
+function validatedRequirementCandidate(
+  options: RequirementStoreOptions,
+  workspaceId: string,
+  candidateMemoryId: string,
+): MemoryUnit {
+  const workspace = String(workspaceId ?? '').trim();
+  const memoryId = String(candidateMemoryId ?? '').trim();
+  if (!workspace || !memoryId) throw new Error('REQUIREMENT_CANDIDATE_SCOPE_REQUIRED');
+  const scope = { schemaVersion: 1 as const, kind: 'workspace' as const, id: workspace };
+  const store = cognitionMemoryStore(options.controllerHome);
+  const candidate = store.read(scope, memoryId);
+  if (!candidate || !activeRequirementCandidate(candidate, options.now?.() ?? new Date().toISOString())) {
+    throw new Error(`REQUIREMENT_CANDIDATE_INVALID: ${memoryId}`);
+  }
+  const sourceId = candidate.provenance.sourceId!.slice('cognitive-requirement-candidate:'.length);
+  const source = store.read(scope, sourceId);
+  if (!source
+    || !source.id.startsWith('promoted:')
+    || source.retractedAt
+    || !source.facets.includes('cross-project')
+    || !source.facets.includes('engineering-principle')
+    || candidate.provenance.evidenceRefs.some(ref => !source.provenance.evidenceRefs.includes(ref))) {
+    throw new Error(`REQUIREMENT_CANDIDATE_SOURCE_INVALID: ${memoryId}`);
+  }
+  return candidate;
+}
+
+export function requirementCandidateAuditRef(workspaceId: string, candidate: Pick<MemoryUnit, 'id' | 'revision'>): string {
+  const scope = { schemaVersion: 1 as const, kind: 'workspace' as const, id: String(workspaceId).trim() };
+  return `cognitive-requirement-candidate:${memoryAddressKey({ scope, id: candidate.id })}:r${candidate.revision}`;
+}
+
+function requirementByCandidateAuditRef(options: RequirementStoreOptions, candidateAuditRef: string): Requirement | undefined {
+  return listRequirements(options, 1000)
+    .map(record => record.value)
+    .find(requirement => requirement.auditRefs.includes(candidateAuditRef));
+}
+
+export function promoteRequirementCandidate(
+  options: RequirementStoreOptions,
+  input: Omit<CreateRequirementInput, 'auditRefs'> & {
+    workspaceId: string;
+    candidateMemoryId: string;
+  },
+): RequirementCandidatePromotionResult {
+  const candidate = validatedRequirementCandidate(options, input.workspaceId, input.candidateMemoryId);
+  const candidateAuditRef = requirementCandidateAuditRef(input.workspaceId, candidate);
+  const prior = requirementByCandidateAuditRef(options, candidateAuditRef);
+  if (prior && prior.requirementId !== String(input.requirementId ?? '').trim()) {
+    return {
+      decision: 'candidate_already_promoted',
+      requirement: prior,
+      created: false,
+      candidateAuditRef,
+      candidateMemoryId: candidate.id,
+      workspaceId: input.workspaceId,
+    };
+  }
+
+  try {
+    const admission = admitRequirement(options, {
+      ...input,
+      auditRefs: [candidateAuditRef],
+    });
+    const requirement = admission.decision === 'reuse_existing'
+      && !admission.requirement.auditRefs.includes(candidateAuditRef)
+      ? bindRequirementCandidateAuditRef(options, admission.requirement.requirementId, candidateAuditRef)
+      : admission.requirement;
+    return {
+      ...admission,
+      requirement,
+      candidateAuditRef,
+      candidateMemoryId: candidate.id,
+      workspaceId: input.workspaceId,
+    };
+  } catch (error) {
+    if (!(error instanceof Error) || error.message !== 'REQUIREMENT_CANDIDATE_ALREADY_PROMOTED') throw error;
+    const raced = requirementByCandidateAuditRef(options, candidateAuditRef);
+    if (!raced) throw error;
+    return {
+      decision: 'candidate_already_promoted',
+      requirement: raced,
+      created: false,
+      candidateAuditRef,
+      candidateMemoryId: candidate.id,
+      workspaceId: input.workspaceId,
+    };
+  }
+}

package/src/runtime/control-plane/facade/requirement-board.ts

@@ -1,12 +1,13 @@
 import {
   REQUIREMENT_STATES,
+  isLegacyMachineRequirementWait,
   listRequirements,
   type Requirement,
   type RequirementState,
 } from '../persistence/requirement-store';
 import { isRepositoryCompletionReceipt } from './types';
 import { listPlanContracts, summarizePlanContract } from './plan-contract-store';
-import { listWorkContracts, summarizeWorkContract } from './work-contract-store';
+import { listWorkContracts, summarizeWorkContract } from '../../../../packages/kernel/work/api/index';
 import type { PlanContract, WorkContract } from './types';
 
 const DEFAULT_REQUIREMENT_LIMIT = 12;
@@ -54,6 +55,10 @@ function boundedText(value: unknown, maxLength: number): string {
 function explicitUserDecision(requirement: Requirement): string | undefined {
   if (requirement.state !== 'waiting_for_user') return undefined;
   const decision = boundedText(requirement.attentionSummary, 1_000);
+  // Compatibility repair: older V2 Work completion projected a machine receipt
+  // as if the whole Requirement needed user acceptance. That message is not a
+  // user decision authority and must not hide still-active Plan slices.
+  if (isLegacyMachineRequirementWait(requirement)) return undefined;
   return decision || undefined;
 }
 
@@ -72,7 +77,7 @@ function loadScopedWork(options: RequirementBoardOptions): WorkContract[] {
   return listWorkContracts({
     controllerHome: options.controllerHome,
     repoId: options.repoId,
-    status: 'all',
+    state: 'all',
     limit: 100,
   });
 }
@@ -219,7 +224,7 @@ function summarizeDiagnosticWork(work: WorkContract): Record<string, unknown> {
       worktreeRef: work.worktreeRef,
       handoffRefs: work.handoffRefs.slice(-3),
     },
-    detailPointer: { tool: 'work_get', arguments: { work_id: work.workId, include_events: true } },
+    detailPointer: { tool: 'rh_work', arguments: { operation: 'get', work_id: work.workId, detail_level: 'detail' } },
   };
 }
 
@@ -287,7 +292,7 @@ export function buildExecutionDiagnostics(
     maintenanceFindingTruncatedCount: Math.max(0, requirements.filter((requirement) => requirement.needsAttention).length - maintenanceFindings.length),
     projectionWarnings,
     technicalDetailPointers: [
-      { tool: 'work_list', arguments: { limit: 50 } },
+      { tool: 'rh_context', arguments: { operation: 'list', detail_level: 'detail' } },
       { tool: 'controller_ready', arguments: {} },
       { tool: 'workflow_watchdog_report', arguments: { include_processes: true } },
       { tool: 'get_project_governance', arguments: {} },

package/src/runtime/control-plane/facade/rh-work-operation-contract.ts

@@ -0,0 +1,85 @@
+/*
+ * Stable rh_work operation ABI.
+ *
+ * The MCP input schema and server-generated SuggestedNextAction validation must
+ * consume this single registry. Keeping separate handwritten operation lists
+ * lets the Runtime advertise transitions that a client contract cannot express,
+ * or reject valid lifecycle actions that the schema already exposes.
+ */
+export const RH_WORK_OPERATIONS = [
+  'start',
+  'repair',
+  'list',
+  'get',
+  'revise',
+  'complete',
+  'launcher_start',
+  'requirement_create',
+  'requirement_get',
+  'requirement_revise',
+  'requirement_promote_candidate',
+  'plan_create',
+  'plan_get',
+  'plan_revise',
+  'plan_list',
+  'schedule_create',
+  'schedule_list',
+  'schedule_get',
+  'schedule_pause',
+  'schedule_resume',
+  'schedule_delete',
+  'schedule_trigger',
+  'workflow_execute',
+  'workflow_reconcile',
+  'learning_record',
+  'learning_feedback',
+  'outcome_record',
+  'experience_record',
+] as const;
+
+/**
+ * There is intentionally no legacy lifecycle operation set.  A Runtime that
+ * has rolled over to Thin Forge rejects the former verify/review/finalize and
+ * controller-claim vocabulary instead of silently translating it.
+ */
+
+export const RH_WORK_MODEL_OPERATIONS = [
+  'start',
+  'repair',
+  'list',
+  'get',
+  'revise',
+  'complete',
+  'launcher_start',
+  'requirement_create',
+  'requirement_get',
+  'requirement_revise',
+  'requirement_promote_candidate',
+  'plan_create',
+  'plan_get',
+  'plan_revise',
+  'plan_list',
+  'schedule_create',
+  'schedule_list',
+  'schedule_get',
+  'schedule_pause',
+  'schedule_resume',
+  'schedule_delete',
+  'schedule_trigger',
+  'workflow_execute',
+  'workflow_reconcile',
+  'learning_record',
+  'learning_feedback',
+  'outcome_record',
+  'experience_record',
+] as const;
+
+export type RhWorkOperation = (typeof RH_WORK_OPERATIONS)[number];
+
+export function isRhWorkOperation(operation: string): operation is RhWorkOperation {
+  return (RH_WORK_OPERATIONS as readonly string[]).includes(operation);
+}
+
+export function isRhWorkAcceptedOperation(operation: string): boolean {
+  return isRhWorkOperation(operation);
+}

package/src/runtime/control-plane/facade/self-healing-loop.ts

@@ -325,7 +325,7 @@ export function runSelfHealingLoop(ctx: SelfHealingContext, input: SelfHealingIn
   if (operation === 'verify') {
     return buildFacadeResult({
       status: 'ok',
-      summary: 'Self-healing verification suggestion only; run real registered checks via rh_work verify or rh_status.',
+      summary: 'Self-healing verification is a maintenance observation; run registered repository checks through run_check when code verification is needed.',
       data: {
         operation: 'verify',
         dryRun,
@@ -333,64 +333,29 @@ export function runSelfHealingLoop(ctx: SelfHealingContext, input: SelfHealingIn
       },
       suggestedNextActions: validateSuggestedNextActions([
         verificationSuggestion(input.workId),
-        {
-          label: 'Run work verify if work_id known',
-          tool: 'rh_work',
-          operation: 'verify',
-          payload: { work_id: input.workId },
-          risk: 'workspace_write',
-          confidence: input.workId ? 'medium' : 'low',
-        },
       ]).actions,
     });
   }
 
   if (operation === 'handoff') {
-    const handoff = createHandoffItem(ctx.handoffStore, {
-      id: `hnd-heal-${randomUUID().slice(0, 8)}`,
-      repoId: ctx.repoId,
-      workId: input.workId,
-      title: 'Self-healing needs judgement',
-      severity: 'needs_review',
-      creationReason: 'repeated_infrastructure_failure',
-      reason: 'Self-healing could not safely complete without ChatGPT or user decision.',
-      summary: issues.map((issue) => issue.summary).join(' | ').slice(0, 500) || 'Manual recovery decision required.',
-      currentState: {
-        repoId: ctx.repoId,
-        workId: input.workId,
-        statusSummary: 'self-healing handoff pending',
-      },
-      attemptedActions: ['self_healing_diagnose', 'self_healing_repair'],
-      evidenceRefs: [],
-      blockingDecision: 'Choose bounded metadata repair, external lifecycle handoff, retry later, or re-scope work.',
-      recommendedDecision: 'Prefer safe dry-run repairs; Runtime lifecycle changes belong to the external lifecycle owner.',
-      recommendedPrompt: 'Review self-healing handoff and choose repair or stop.',
-      suggestedNextActions: [
-        {
-          label: 'Diagnose again (dry-run)',
-          tool: 'rh_work',
-          operation: 'repair',
-          payload: { repair_operation: 'diagnose', dry_run: true },
-          risk: 'readonly',
-        },
-      ],
-    });
-
+    // Infrastructure recovery is internal execution state. Escalate only when a
+    // concrete user authorization or product decision has actually been found.
     return buildFacadeResult({
       status: 'blocked',
-      summary: `Self-healing handoff ${handoff.id} created.`,
+      summary: 'Self-healing could not safely complete automatically; keep the exact Work blocked for bounded internal recovery rather than escalating infrastructure failure to the user.',
       data: {
         operation: 'handoff',
-        handoffId: handoff.id,
+        internalRecoveryRequired: true,
         isAcceptanceFailure: false,
       },
       suggestedNextActions: [
         {
-          label: 'Get handoff',
-          tool: 'rh_inbox',
-          operation: 'get',
-          payload: { handoff_id: handoff.id },
-          risk: 'readonly',
+          label: 'Diagnose again (dry-run)',
+          tool: 'rh_work',
+          operation: 'repair',
+          payload: { repair_operation: 'diagnose', dry_run: true, work_id: input.workId },
+          risk: 'workspace_write',
+          confidence: 'low',
         },
       ],
     });
@@ -541,14 +506,14 @@ export function runSelfHealingLoop(ctx: SelfHealingContext, input: SelfHealingIn
     },
     suggestedNextActions: validateSuggestedNextActions([
       verificationSuggestion(input.workId),
-      {
-        label: 'Continue work if applicable',
-        tool: 'rh_work',
-        operation: 'continue',
+      ...(input.workId ? [{
+        label: 'Read current Work semantic state',
+        tool: 'rh_work' as const,
+        operation: 'get',
         payload: { work_id: input.workId },
-        risk: 'readonly',
-        confidence: input.workId ? 'medium' : 'low',
-      },
+        risk: 'readonly' as const,
+        confidence: 'medium' as const,
+      }] : []),
     ]).actions,
     rawAvailable: false,
   });

package/src/runtime/control-plane/facade/semantic-admission.ts

@@ -2,12 +2,15 @@ import { withControllerLock, withControllerLockAsync } from '../../../cli/reposi
 import { sanitizeFileComponent } from '../../shared/json-files';
 import { isTerminalPlanContractStatus, type PlanContract } from './types';
 
+export function isPlanExtensionPredecessor(plan: PlanContract): boolean {
+  return !isTerminalPlanContractStatus(plan.status) || plan.status === 'invalidated_by_drift';
+}
+
 export const PLAN_ADMISSION_RELATIONS = ['extend', 'parallel'] as const;
 export type PlanAdmissionRelation = (typeof PLAN_ADMISSION_RELATIONS)[number];
 
 export type PlanAdmissionReason =
   | 'exact_scope_authority'
-  | 'requirement_relation_required'
   | 'extension_target_required'
   | 'extend_existing'
   | 'create_new';
@@ -48,7 +51,7 @@ export function resolvePlanAdmission(
     : [];
   const relatedPlanId = input.relatedPlanId?.trim() || undefined;
   const explicitlyRelatedPlan = relatedPlanId
-    ? activePlans.find((candidate) => candidate.planId === relatedPlanId)
+    ? plans.find((candidate) => candidate.planId === relatedPlanId && isPlanExtensionPredecessor(candidate))
     : undefined;
   const relatedPlan = explicitlyRelatedPlan && (!requirementId || explicitlyRelatedPlan.requirementId === requirementId)
     ? explicitlyRelatedPlan
@@ -57,9 +60,9 @@ export function resolvePlanAdmission(
     ? activePlans.find((candidate) => candidate.scopeKey === normalizedScopeKey)
     : undefined;
 
-  // An explicit extension is a serial replan, not a second active Plan. Resolve
-  // it before exact-scope reuse so a successor may retain the predecessor scope.
-  // If another Plan owns the requested successor scope, preserve that authority.
+  // An explicit extension is a serial replan of one stable Plan identity, not a
+  // second active Plan. Resolve it before exact-scope reuse so the same Plan may
+  // revise its semantic scope. If another Plan owns that scope, preserve it.
   if (input.planRelation === 'extend') {
     if (!relatedPlan) {
       return {
@@ -102,17 +105,6 @@ export function resolvePlanAdmission(
     };
   }
 
-  if (requirementPlans.length > 0 && !input.planRelation) {
-    return {
-      admissionDecision: 'resolution_required',
-      resolutionRequired: true,
-      reason: 'requirement_relation_required',
-      normalizedScopeKey,
-      candidates: requirementPlans.slice(0, 8),
-      allowedPlanRelations: PLAN_ADMISSION_RELATIONS,
-    };
-  }
-
   return {
     admissionDecision: 'create_new',
     resolutionRequired: false,