@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/plugins/types.ts

@@ -90,6 +90,24 @@ export interface AssistantPluginManifest {
     duplicateStateAllowed: false;
     sourceOfTruth: string[];
   };
+  /**
+   * A temporary transport projection. It is descriptive only: the replacement
+   * owner remains the sole execution and persistence authority.
+   */
+  compatibility?: {
+    replacementOwner: string;
+    boundedConsumers: Array<{
+      surface: 'plugin_action_execute';
+      pluginId: string;
+      actionIds: string[];
+    }>;
+    removalCondition: {
+      kind: 'no_supported_frozen_contract_actions';
+      surface: 'plugin_action_execute';
+      pluginId: string;
+      actionIds: string[];
+    };
+  };
   enabled: boolean;
   lifecycle: {
     state: AssistantPluginLifecycleState;
@@ -140,6 +158,8 @@ export interface AssistantPluginActionRequest {
 
 export interface AssistantPluginActionExecutionInput {
   controllerHome: string;
+  /** Explicit per-invocation authorization for protected plugin actions. */
+  confirmAuthorization?: boolean;
   repoId: string;
   repoRoot: string;
   pluginId: string;

package/src/runtime/plugins/xiaohongshu-publish.ts

@@ -158,6 +158,22 @@ export function buildXiaohongshuPluginManifest(previousRevision = 0, previousUpd
         'browser-profile:authentication-and-session',
       ],
     },
+    compatibility: {
+      replacementOwner: 'Workflow Runtime (rh_work workflow_execute) and the versioned xiaohongshu Workflow assets',
+      boundedConsumers: [
+        {
+          surface: 'plugin_action_execute',
+          pluginId: PLUGIN_ID,
+          actionIds: ['get_publish_recipe', 'publish_note'],
+        },
+      ],
+      removalCondition: {
+        kind: 'no_supported_frozen_contract_actions',
+        surface: 'plugin_action_execute',
+        pluginId: PLUGIN_ID,
+        actionIds: ['get_publish_recipe', 'publish_note'],
+      },
+    },
     enabled: true,
     lifecycle: { state: 'enabled', reason: 'Compatibility translation is available; all publishing effects are Workflow-owned.' },
     health: health(), permissions: permissions(), capabilities: capabilities(), actions: actions(), updatedAt: previousUpdatedAt ?? now(),

package/src/runtime/projections/invalidation.ts

@@ -146,7 +146,7 @@ export function updateRepositoryProjectionRefreshRequest(
     sourceRevision?: string;
     nowMs?: number;
   },
-  options: { lock?: boolean } = {},
+  options: { lock?: boolean; supersedeAttempt?: boolean } = {},
 ): ProjectionDirtyMarker | undefined {
   try {
     const fence = assertRuntimeMayWrite('update_active_projection', controllerHome);
@@ -170,7 +170,11 @@ export function updateRepositoryProjectionRefreshRequest(
       ),
     );
 
-    if (current && sameSource) {
+    const supersedeAttempt = options.supersedeAttempt === true
+      && current?.refreshStatus !== undefined
+      && current.refreshStatus !== 'pending';
+
+    if (current && sameSource && !supersedeAttempt) {
       const normalized = normalizeMarker(current);
       const enriched: ProjectionDirtyMarker = {
         ...normalized,
@@ -214,7 +218,7 @@ export function markRepositoryProjectionDirty(
     reason,
     sourceRevision: options.sourceRevision,
     nowMs: options.nowMs,
-  });
+  }, { supersedeAttempt: true });
 }
 
 export function readRepositoryProjectionDirty(controllerHome: string, repoId: string): ProjectionDirtyMarker | undefined {

package/src/runtime/projections/materialized-view.ts

@@ -27,7 +27,7 @@ import type { ProjectionObservation, ProjectionSourceReconciliation } from '../h
 import { RUNTIME_HEALTH_THRESHOLDS } from '../health/evaluator';
 import { isProcessAlive } from '../shared/process-tree';
 import type { TaskLedgerProjection } from '../../cli/controller/task-ledger';
-import { collectWorkLifecycleAttention } from '../control-plane/execution/work-lifecycle-audit';
+import { collectWorkLifecycleAttention, workLifecycleAttentionBlocksReadiness } from '../control-plane/execution/work-lifecycle-audit';
 
 export interface ProjectionMetadata {
   contentRevision: number;
@@ -164,7 +164,9 @@ function projectionWithExecutionIndexOverlay(
   const activeJobIds = new Set(activeJobSummaries.map((job) => job.jobId));
   const attentionJobs = recentJobs?.filter((job) => ATTENTION_JOB_STATUSES.has(job.status));
   const materializedLifecycleAttention = base.attention.filter((entry) => entry.jobId.startsWith('lifecycle:'));
-  const materializedCurrentLifecycleAttention = base.currentAttention.filter((entry) => entry.jobId.startsWith('lifecycle:'));
+  const materializedCurrentLifecycleAttention = base.currentAttention
+    .filter((entry) => entry.jobId.startsWith('lifecycle:'))
+    .filter(workLifecycleAttentionBlocksReadiness);
   const attention = attentionJobs
     ? attentionJobs.map(attentionSummary)
     : base.attention.filter((entry) => !entry.jobId.startsWith('lifecycle:'));
@@ -190,6 +192,8 @@ function projectionWithExecutionIndexOverlay(
     // Lifecycle attention is producer-owned materialized state. Hot reads overlay
     // only lightweight ExecutionJob/Lease indexes and must never synchronously
     // re-run Git/Work lifecycle reconciliation on the MCP request event loop.
+    // Re-apply the current readiness classifier to persisted lifecycle entries so
+    // a policy cutover cannot leave obsolete blockers stuck in currentAttention.
     currentAttention: [...currentAttention, ...materializedCurrentLifecycleAttention].slice(0, 100),
     attention: [...attention, ...materializedLifecycleAttention].slice(0, 100),
   };
@@ -247,7 +251,7 @@ function buildRepositoryProjection(
     activeLeases: leases.length,
     currentAttention: [
       ...currentAttentionJobs.map((job) => ({ jobId: job.jobId, status: job.status, message: job.error?.message })),
-      ...lifecycleAttention,
+      ...lifecycleAttention.filter(workLifecycleAttentionBlocksReadiness),
     ].slice(0, 100),
     attention: [
       ...attentionJobs.map((job) => ({ jobId: job.jobId, status: job.status, message: job.error?.message })),
@@ -474,10 +478,15 @@ function refreshRepositoryProjection(
   const nowMs = options.nowMs ?? Date.now();
   const acquiredAt = nowIso(nowMs);
   const owner = refreshOwner(options, acquiredAt);
-  return withRepositoryProjectionRefreshLock(
+  const lockOwner = `projection-refresh:${owner.pid}`;
+
+  // Claim one refresh generation under the repository projection lock, then release
+  // it before the expensive materialization. Real jobs/leases/finalizers must be
+  // able to invalidate the projection while a refresh is building.
+  const claim = withRepositoryProjectionRefreshLock(
     controllerHome,
     repoId,
-    `projection-refresh:${owner.pid}`,
+    lockOwner,
     () => {
       dirtyProjectionReadCache.delete(dirtyProjectionReadCacheKey(controllerHome, repoId));
       const previous = readJsonFile<RepositoryRuntimeProjection | undefined>(projectionPath(controllerHome, repoId), undefined);
@@ -497,13 +506,26 @@ function refreshRepositoryProjection(
           sourceRevision,
           nowMs,
         }, { lock: false });
-        if (!marker) return { refreshed: false, skippedReason: 'passive_runtime' };
+        if (!marker) {
+          return {
+            kind: 'skip' as const,
+            result: { refreshed: false, skippedReason: 'passive_runtime' as const },
+          };
+        }
+      }
+      if (!marker) {
+        return {
+          kind: 'skip' as const,
+          result: { refreshed: false, skippedReason: 'clean' as const, projection: previous },
+        };
       }
-      if (!marker) return { refreshed: false, skippedReason: 'clean', projection: previous };
 
       const currentOwner = refreshOwner(options, acquiredAt);
       if (ownerStillOwnsRefresh(marker, nowMs, currentOwner)) {
-        return { refreshed: false, skippedReason: 'running', marker, projection: previous };
+        return {
+          kind: 'skip' as const,
+          result: { refreshed: false, skippedReason: 'running' as const, marker, projection: previous },
+        };
       }
       if (marker.refreshStatus === 'running' && !ownerStillOwnsRefresh(marker, nowMs, currentOwner)) {
         marker = recoverStaleOwner(controllerHome, repoId, marker, acquiredAt, 'stale_owner_or_restart');
@@ -514,42 +536,64 @@ function refreshRepositoryProjection(
         && marker.nextAttemptAt
         && Date.parse(marker.nextAttemptAt) > nowMs
       ) {
-        return { refreshed: false, skippedReason: 'retry_deferred', marker, projection: previous };
+        return {
+          kind: 'skip' as const,
+          result: { refreshed: false, skippedReason: 'retry_deferred' as const, marker, projection: previous },
+        };
       }
 
       const running = markRunning(controllerHome, repoId, {
         ...marker,
         sourceRevision: marker.sourceRevision ?? sourceRevision,
       }, owner, acquiredAt);
-      try {
-        const latestPrevious = readJsonFile<RepositoryRuntimeProjection | undefined>(projectionPath(controllerHome, repoId), undefined);
-        const buildRevision = normalizeGitRevision(running.sourceRevision) ?? sourceRevision;
-        const projection = buildRepositoryProjection(controllerHome, repoId, latestPrevious, buildRevision);
-        const current = readRepositoryProjectionDirty(controllerHome, repoId);
-        if (
-          !current
-          || current.nonce !== running.nonce
-          || (
-            running.sourceRevision
-            && current.sourceRevision
-            && !gitRevisionsEquivalent(running.sourceRevision, current.sourceRevision)
-          )
-        ) {
-          return { refreshed: false, skippedReason: 'superseded', marker: current, projection: latestPrevious };
-        }
-        writeJsonAtomic(projectionPath(controllerHome, repoId), projection);
-        clearRepositoryProjectionDirty(controllerHome, repoId, current, projection.metadata?.generatedFromRevision);
-        dirtyProjectionReadCache.delete(dirtyProjectionReadCacheKey(controllerHome, repoId));
-        return { refreshed: true, projection };
-      } catch (error) {
-        const current = readRepositoryProjectionDirty(controllerHome, repoId);
-        if (current?.nonce === running.nonce) {
-          markFailed(controllerHome, repoId, running, owner, error, options.nowMs ?? Date.now());
-        }
-        throw error;
-      }
+      return {
+        kind: 'build' as const,
+        running,
+        previous: readJsonFile<RepositoryRuntimeProjection | undefined>(projectionPath(controllerHome, repoId), undefined),
+        buildRevision: normalizeGitRevision(running.sourceRevision) ?? sourceRevision,
+      };
     },
   );
+
+  if (claim.kind === 'skip') return claim.result;
+
+  let projection: RepositoryRuntimeProjection;
+  try {
+    projection = buildRepositoryProjection(controllerHome, repoId, claim.previous, claim.buildRevision);
+  } catch (error) {
+    // Failure bookkeeping is another short CAS section. If a real mutation already
+    // superseded this nonce, it owns the dirty marker and must not be overwritten.
+    withRepositoryProjectionRefreshLock(controllerHome, repoId, lockOwner, () => {
+      const current = readRepositoryProjectionDirty(controllerHome, repoId);
+      if (current?.nonce === claim.running.nonce) {
+        markFailed(controllerHome, repoId, claim.running, owner, error, options.nowMs ?? Date.now());
+      }
+    });
+    throw error;
+  }
+
+  // Publish only if the exact claimed nonce still owns the refresh. A concurrent
+  // mutation either superseded it while build ran or will mark dirty after this
+  // short publish section, so no invalidation can be lost.
+  return withRepositoryProjectionRefreshLock(controllerHome, repoId, lockOwner, () => {
+    const current = readRepositoryProjectionDirty(controllerHome, repoId);
+    const currentProjection = readJsonFile<RepositoryRuntimeProjection | undefined>(projectionPath(controllerHome, repoId), undefined);
+    if (
+      !current
+      || current.nonce !== claim.running.nonce
+      || (
+        claim.running.sourceRevision
+        && current.sourceRevision
+        && !gitRevisionsEquivalent(claim.running.sourceRevision, current.sourceRevision)
+      )
+    ) {
+      return { refreshed: false, skippedReason: 'superseded', marker: current, projection: currentProjection };
+    }
+    writeJsonAtomic(projectionPath(controllerHome, repoId), projection);
+    clearRepositoryProjectionDirty(controllerHome, repoId, current, projection.metadata?.generatedFromRevision);
+    dirtyProjectionReadCache.delete(dirtyProjectionReadCacheKey(controllerHome, repoId));
+    return { refreshed: true, projection };
+  });
 }
 
 export function refreshRepositoryProjectionForRepository(

package/src/runtime/recovery/actions.ts

@@ -93,13 +93,13 @@ export const RECOVERY_ACTIONS = {
   },
   stageAndActivateRuntimeRelease: {
     id: 'recovery.stage_and_activate_runtime_release',
-    title: 'Stage and activate canonical Runtime release',
-    description: 'Build one immutable Runtime release from the selected registered repository, then hand lifecycle activation to the standalone Recovery transaction.',
+    title: 'Prepare isolated Runtime ReleaseSession',
+    description: 'Compatibility action id: ask standalone Recovery to freeze its configured source and Stable A authority, create isolated Candidate B, and build a portable release. It no longer activates Stable A.',
     class: 'stale_runtime_state',
     risk: 'medium',
     confirmation: 'authorization',
     localOnly: true,
-    boundedTo: ['registered_repository', 'runtime_release_storage', 'external_runtime_lifecycle'],
+    boundedTo: ['registered_repository', 'runtime_release_storage'],
   },
   restartPrimaryConnector: {
     id: 'recovery.restart_primary_connector',

package/src/runtime/recovery/capability-action-application.ts

@@ -3,15 +3,14 @@ import { ensureRepositoryRuntimeStorage } from '../../cli/repositories/runtime-s
 import { prepareTransferArtifacts } from '../../cli/repositories/selected-path-actions';
 import { applyRuntimeCleanup, previewRuntimeCleanup } from '../maintenance/cleanup';
 import { rebuildRepositoryProjection } from '../projections/materialized-view';
-import { assertRuntimeReleaseFiles, stageRuntimeReleaseFromCandidateSource } from '../root/release-materialize';
 import { recoveryActionById } from './actions';
 import { assertRecoveryAuthorized, buildRecoveryAuditRecord } from './audit';
 import { applyRuntimeMaintenance } from './maintenance-executor';
-import { writeRecoveryAuditRecord } from './store';
+import { writeInstanceRecoveryAuditRecord, writeRecoveryAuditRecord } from './store';
 
 export interface CapabilityRecoveryApplicationInput {
   controllerHome: string;
-  repository: RepositoryRecord;
+  repository?: RepositoryRecord;
   actionId: string;
   reason: string;
   confirmAuthorization: boolean;
@@ -23,17 +22,30 @@ export interface CapabilityRecoveryApplicationInput {
 }
 
 export interface CapabilityRecoveryApplicationResult {
-  repoId: string;
+  repoId?: string;
+  scope: 'forge_instance' | 'repository';
   action: NonNullable<ReturnType<typeof recoveryActionById>>;
   audit: ReturnType<typeof writeRecoveryAuditRecord>;
   result: Record<string, unknown>;
 }
 
+const INSTANCE_RECOVERY_ACTION_IDS = new Set([
+  'recovery.stage_and_activate_runtime_release',
+  'recovery.restart_primary_connector',
+  'recovery.probe_again',
+  'recovery.workspace_auth_login_prepare',
+  'recovery.external_filesystem_grant_preview',
+]);
+
+export function recoveryActionScope(actionId: string): 'forge_instance' | 'repository' {
+  return INSTANCE_RECOVERY_ACTION_IDS.has(actionId) ? 'forge_instance' : 'repository';
+}
+
 export class RecoveryApplicationError extends Error {
-  readonly code: 'RECOVERY_ACTION_UNKNOWN';
+  readonly code: 'RECOVERY_ACTION_UNKNOWN' | 'RECOVERY_REPOSITORY_CONTEXT_REQUIRED';
   readonly actionId: string;
 
-  constructor(code: 'RECOVERY_ACTION_UNKNOWN', actionId: string) {
+  constructor(code: RecoveryApplicationError['code'], actionId: string) {
     super(`${code}: ${actionId}`);
     this.name = 'RecoveryApplicationError';
     this.code = code;
@@ -85,29 +97,19 @@ export async function executeCapabilityRecoveryAction(
         : undefined,
   );
 
+  const scope = recoveryActionScope(action.id);
+  const repository = scope === 'repository'
+    ? input.repository ?? (() => { throw new RecoveryApplicationError('RECOVERY_REPOSITORY_CONTEXT_REQUIRED', action.id); })()
+    : undefined;
+
   let payload: Record<string, unknown>;
   let affectedPaths: string[] = [];
   switch (action.id) {
     case 'recovery.stage_and_activate_runtime_release': {
-      const staged = stageRuntimeReleaseFromCandidateSource({
-        controllerHome: input.controllerHome,
-        sourceRoot: input.repository.canonicalRoot,
-        sourceRepositoryId: input.repository.repoId,
+      payload = await input.callStandaloneRecoveryTool('prepare_runtime_release_session', {
+        request_id: `runtime-release-session-${Date.now()}`,
       });
-      assertRuntimeReleaseFiles(staged);
-      payload = {
-        staged: {
-          releaseId: staged.releaseId,
-          sourceCommit: staged.sourceCommit,
-          artifactIdentity: staged.artifactIdentity,
-          manifestSha256: staged.manifestSha256,
-        },
-        activation: await input.callStandaloneRecoveryTool('activate_runtime_release', {
-          request_id: `runtime-cutover-${Date.now()}`,
-          release_path: staged.manifestPath,
-        }),
-      };
-      affectedPaths = ['controllerHome/runtime/releases', 'controllerHome/runtime/releases/authority.json'];
+      affectedPaths = ['controllerHome/recovery/state/release-sessions', 'candidate-runtime-lanes'];
       break;
     }
     case 'recovery.restart_primary_connector': {
@@ -121,20 +123,20 @@ export async function executeCapabilityRecoveryAction(
       payload = { recovery: await input.recoverySnapshot() };
       break;
     case 'recovery.rebuild_projection': {
-      const projection = rebuildRepositoryProjection(input.controllerHome, input.repository.repoId);
+      const projection = rebuildRepositoryProjection(input.controllerHome, repository!.repoId);
       payload = { projection };
       affectedPaths = ['.ai/harness/controller/projections'];
       break;
     }
     case 'recovery.refresh_repository': {
-      const runtimeStorage = ensureRepositoryRuntimeStorage(input.repository, input.controllerHome);
-      const projection = rebuildRepositoryProjection(input.controllerHome, input.repository.repoId);
+      const runtimeStorage = ensureRepositoryRuntimeStorage(repository!, input.controllerHome);
+      const projection = rebuildRepositoryProjection(input.controllerHome, repository!.repoId);
       payload = { runtimeStorage, projection };
       affectedPaths = ['.ai/harness/controller', '.ai/harness/local-bridge'];
       break;
     }
     case 'recovery.cleanup_preview': {
-      payload = previewRuntimeCleanup(input.repository.canonicalRoot, {
+      payload = previewRuntimeCleanup(repository!.canonicalRoot, {
         minAgeMinutes: input.minAgeMinutes,
         includeTempDirs: true,
         includeTerminalLocalJobs: true,
@@ -145,7 +147,7 @@ export async function executeCapabilityRecoveryAction(
       break;
     }
     case 'recovery.cleanup_apply': {
-      payload = applyRuntimeCleanup(input.repository.canonicalRoot, {
+      payload = applyRuntimeCleanup(repository!.canonicalRoot, {
         minAgeMinutes: input.minAgeMinutes,
         includeTempDirs: true,
         includeTerminalLocalJobs: true,
@@ -159,7 +161,7 @@ export async function executeCapabilityRecoveryAction(
     }
     case 'recovery.reconcile_jobs':
     case 'recovery.local_jobs_reconcile': {
-      const maintenance = applyRuntimeMaintenance(input.repository, input.controllerHome, {
+      const maintenance = applyRuntimeMaintenance(repository!, input.controllerHome, {
         actionId: 'local_jobs_reconcile',
         confirmMaintenance: true,
         minAgeMinutes: input.minAgeMinutes ?? 10,
@@ -170,7 +172,7 @@ export async function executeCapabilityRecoveryAction(
       break;
     }
     case 'recovery.local_jobs_quarantine_unreadable': {
-      const maintenance = applyRuntimeMaintenance(input.repository, input.controllerHome, {
+      const maintenance = applyRuntimeMaintenance(repository!, input.controllerHome, {
         actionId: 'quarantine_unreadable_local_jobs',
         confirmMaintenance: true,
         minAgeMinutes: input.minAgeMinutes ?? 0,
@@ -181,7 +183,7 @@ export async function executeCapabilityRecoveryAction(
       break;
     }
     case 'recovery.runtime_storage_finalize_relocation': {
-      const maintenance = applyRuntimeMaintenance(input.repository, input.controllerHome, {
+      const maintenance = applyRuntimeMaintenance(repository!, input.controllerHome, {
         actionId: 'runtime_storage_finalize_relocation',
         confirmMaintenance: true,
         minAgeMinutes: input.minAgeMinutes ?? 0,
@@ -192,7 +194,7 @@ export async function executeCapabilityRecoveryAction(
       break;
     }
     case 'recovery.create_patch_handoff':
-      payload = prepareTransferArtifacts(input.repository, { reason: input.reason }) as unknown as Record<string, unknown>;
+      payload = prepareTransferArtifacts(repository!, { reason: input.reason }) as unknown as Record<string, unknown>;
       affectedPaths = ['.ai/harness/transfers', '.ai/harness/session'];
       break;
     case 'recovery.workspace_auth_login_prepare':
@@ -213,16 +215,15 @@ export async function executeCapabilityRecoveryAction(
       payload = { skipped: true, reason: `No executor is registered for ${action.id}.` };
   }
 
-  const audit = writeRecoveryAuditRecord(
-    input.controllerHome,
-    input.repository.repoId,
-    buildRecoveryAuditRecord({
-      actor: 'capability_recovery_apply',
-      action,
-      result: payload.skipped === true ? 'skipped' : 'succeeded',
-      reason: input.reason,
-      affectedPaths,
-    }),
-  );
-  return { repoId: input.repository.repoId, action, audit, result: payload };
+  const auditRecord = buildRecoveryAuditRecord({
+    actor: 'capability_recovery_apply',
+    action,
+    result: payload.skipped === true ? 'skipped' : 'succeeded',
+    reason: input.reason,
+    affectedPaths,
+  });
+  const audit = repository
+    ? writeRecoveryAuditRecord(input.controllerHome, repository.repoId, auditRecord)
+    : writeInstanceRecoveryAuditRecord(input.controllerHome, auditRecord);
+  return { ...(repository ? { repoId: repository.repoId } : {}), scope, action, audit, result: payload };
 }

package/src/runtime/recovery/lifecycle-inventory.ts

@@ -44,31 +44,31 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
   lifecycle({
     id: 'requirement', owner: 'Goal / Requirement authority', scope: 'controller', dataClass: 'semantic_authority',
     storage: 'Controller Home SQLite requirement namespace',
-    terminalCondition: 'Requirement reaches done or cancelled through canonical semantic transition.',
-    activeProtection: 'The canonical transition table never returns done/cancelled Requirements to active authority, and optimistic revision fencing serializes every mutation.',
+    terminalCondition: 'Requirement semantic state reaches completed or cancelled through revisioned Requirement CAS.',
+    activeProtection: 'Stable Requirement identity plus expected-revision CAS serializes authored semantic updates; execution evidence and Controller dispositions cannot mutate Requirement state.',
     retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: SQLite stores exactly one current row per requirementId and revisions update that row in place. Cardinality grows only when a new Requirement identity is deliberately admitted, never from retry/recovery cycles.',
     cleanupAuthority: 'Requirement authority owns semantic retention. Runtime GC does not delete Requirement rows; replaceable execution evidence is reclaimed by its own lifecycle classes.',
-    recoverySemantics: 'done may only remain done or become cancelled; cancelled may only remain cancelled. Recovery consumes the retained identity instead of reconstructing or reopening it.',
+    recoverySemantics: 'Recovery reads the retained Requirement identity/revision and never infers completion, continuation or reopening from Work, Plan, Controller or provider state.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/control-plane/persistence/requirement-store.ts','packages/kernel/goal/api/index.ts','tests/runtime/requirement-portfolio-migration.test.ts'],
   }),
   lifecycle({
     id: 'plan', owner: 'Goal / Plan authority', scope: 'repository', dataClass: 'semantic_authority',
     storage: 'Controller Home SQLite plan namespace',
-    terminalCondition: 'Plan is finalized, superseded, cancelled or invalidated by drift.',
-    activeProtection: 'Current-plan queries exclude terminal/superseded authority, successor obligation continuity is fenced explicitly, and every same-plan mutation is revision-CAS protected.',
-    retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: SQLite stores one current row per planId and revisions update that row in place. Only an explicit successor creates another Plan identity, so retries do not multiply Plan rows.',
-    cleanupAuthority: 'Plan authority owns semantic retention. Runtime GC does not delete Plan rows; predecessor/successor lineage remains queryable while disposable validation/process evidence is reclaimed elsewhere.',
-    recoverySemantics: 'Recovery preserves predecessor/successor and obligation disposition facts and cannot make a terminal predecessor current.',
-    closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/control-plane/facade/plan-contract-store.ts','packages/kernel/goal/api/index.ts','tests/runtime/plan-contract-store.test.ts'],
+    terminalCondition: 'Plan has no Runtime-owned terminal lifecycle; it remains model-authored revisioned working memory until the model/user revises or stops referencing it.',
+    activeProtection: 'Stable Plan identity plus expected-revision CAS protects each authored revision. Approval, PlanStep acceptance, supersession and predecessor obligations are not execution authority.',
+    retentionCapacity: 'Permanent semantic/audit retention stores one current semantic row per planId plus bounded revision history; retries/recovery do not create replacement Plan identities.',
+    cleanupAuthority: 'Plan semantic retention is independent from disposable execution/process evidence; Runtime cleanup never rewrites Plan progress.',
+    recoverySemantics: 'Recovery re-reads the same Plan identity/revision and never derives Plan progress or execution admission from receipts, Work lifecycle, ControllerRound or compatibility fields.',
+    closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/control-plane/facade/plan-contract-store.ts','tests/runtime/goal-authority-convergence.test.ts'],
   }),
   lifecycle({
-    id: 'work', owner: 'Kernel Work authority', scope: 'work', dataClass: 'execution_authority',
-    storage: 'Controller Home SQLite / Work authority records plus WorkHandle placement state',
-    terminalCondition: 'Work reaches completed, failed or cancelled with delivery/cleanup evidence as required.',
-    activeProtection: 'Work state machine, controller ownership, leases, delivery containment, active Plan bindings and revision-CAS updates protect live or explicitly resumable Work.',
-    retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: SQLite stores one current row per workId and lifecycle mutations update that row in place. New rows correspond only to deliberately admitted Work identities; Process/log/check-result/artifact growth is bounded by separate lifecycle classes.',
-    cleanupAuthority: 'Work finalization/terminal cleanup releases owned execution resources, but Runtime GC does not delete the durable Work row or its completion identity.',
-    recoverySemantics: 'A retained cancelled Work can resume only through the explicit canonical resume contract; completed delivery identity and successor lineage remain durable and are never synthesized from deleted detail.',
+    id: 'work', owner: 'Kernel Work semantic authority', scope: 'work', dataClass: 'semantic_authority',
+    storage: 'Controller Home SQLite Work semantic records; concrete checkout/process/resource placement is owned by its domain stores',
+    terminalCondition: 'Work semantic state is exactly open, completed or cancelled; only revisioned work_revise/work_complete CAS changes that semantic state.',
+    activeProtection: 'Stable Work identity plus expected-revision CAS protects model-authored objective/state/result refs. Controller claims, delivery receipts, verification/review evidence and Plan provenance cannot complete Work.',
+    retentionCapacity: 'SQLite stores one current semantic row per workId plus bounded revision history. Retry, delivery, provider recovery and resource cleanup do not manufacture successor Work identities.',
+    cleanupAuthority: 'OwnedResource/process/worktree domains clean up their own physical resources. Cleanup and delivery never rewrite semantic Work completion.',
+    recoverySemantics: 'Recovery resumes mechanical operations around the same retained Work when appropriate; it never infers semantic completion/cancellation/reopen from physical evidence.',
     closureStatus: 'existing_bounded', evidencePaths: ['packages/kernel/work/api/index.ts','src/runtime/control-plane/execution/work-terminal-cleanup.ts','tests/runtime/repository-work-admission.test.ts'],
   }),
   lifecycle({
@@ -95,20 +95,20 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
     id: 'check_receipt', owner: 'Verification / Process evidence authority', scope: 'work', dataClass: 'evidence',
     storage: 'Controller Home Process/check receipt evidence',
     terminalCondition: 'Check Process reaches terminal outcome and receipt is bound to exact input/source identity.',
-    activeProtection: 'Receipts required by active validation, completion, review or Operational Memory support evidence are protected.',
+    activeProtection: 'Receipts referenced by active Work evidence or Operational Memory are protected; they are evidence only and never completion/review authority.',
     retentionCapacity: 'A Process check receipt has no separate mutable authority: it is derived from one terminal Process record and copied into Work VerificationRecord when consumed. Process records are bounded by the 7-day/500 policy; persisted check-result sidecars use 30-day/500 retention, a 5000-entry scan bound and at most 50 removals per selected-repository cleanup pass.',
     cleanupAuthority: 'Process GC owns terminal Process/log source, Scheduler maintenance owns replaceable check-result sidecars, and Work lifecycle owns accepted VerificationRecord copies; none becomes a second receipt authority.',
     recoverySemantics: 'Active Work cache identities protect required sidecars; truncated/malformed scans fail closed, and missing or changed evidence becomes stale/replay-gap rather than synthetic success.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/execution/process-runtime/check-receipt.ts','src/runtime/execution/process-runtime/gc.ts','src/runtime/execution/process-runtime/check-result-retention.ts','packages/kernel/work/api/index.ts','tests/runtime/check-result-retention.test.ts'],
   }),
   lifecycle({
-    id: 'controller_round', owner: 'Kernel ControllerRound authority', scope: 'work', dataClass: 'semantic_authority',
+    id: 'controller_round', owner: 'Kernel autonomous-continuation mechanics', scope: 'work', dataClass: 'execution_authority',
     storage: 'Controller Home SQLite controller-round relay records',
-    terminalCondition: 'Exactly one semantic disposition settles the round: continue_immediately, wait, wait_for_user or goal_complete; failed/blocked are explicit recovery states.',
-    activeProtection: 'Relay scope, claim generation and opaque authority fence each live semantic round.',
-    retentionCapacity: 'Permanent semantic/audit retention is the explicit policy: controller_round_relay uses workId as its stable key and each round/recovery transition revision-updates that row. Round history lives in durable audit, so retries and additional semantic rounds do not create parallel current relay authority.',
-    cleanupAuthority: 'ControllerRound authority owns relay retention. Runtime GC does not delete relay rows; ControllerSession/lease and provider/browser artifacts are separate bounded lifecycle classes.',
-    recoverySemantics: 'failed and blocked remain explicit recoverable states, so their relay identity is retained. Transport/session replacement and ambiguous provider effect reconcile against the same fenced relay instead of fabricating a new semantic round.',
+    terminalCondition: 'One explicit continuation attempt reaches a mechanical disposition/dispatch boundary; no disposition changes Requirement, Plan or Work semantic state.',
+    activeProtection: 'Relay scope, claim generation, stable provider-effect identity and opaque authority fence only continuation dispatch/recovery mechanics.',
+    retentionCapacity: 'controller_round_relay uses one current row per continuation scope/work and revision-updates it; audit/effect evidence records history without creating a parallel semantic authority.',
+    cleanupAuthority: 'Controller continuation mechanics own relay retention; session leases and provider/browser artifacts remain separate concrete-resource/effect domains.',
+    recoverySemantics: 'Transport/session replacement and ambiguous provider effect reconcile against the same fenced continuation/effect identity; outcome_unknown is never blind-replayed and recovery never fabricates semantic progress.',
     closureStatus: 'existing_bounded', evidencePaths: ['packages/kernel/controller/api/index.ts','tests/runtime/autonomous-continuation-lifecycle.test.ts'],
   }),
   lifecycle({
@@ -313,12 +313,12 @@ export const RUNTIME_LIFECYCLE_INVENTORY: readonly RuntimeLifecycleClassDefiniti
   }),
   lifecycle({
     id: 'runtime_temp', owner: 'Runtime diagnostics/process scratch lifecycle', scope: 'process', dataClass: 'temporary',
-    storage: 'OS temporary roots / Controller-observed Runtime temp entries',
-    terminalCondition: 'Owning live Process is gone and entry exceeds the runtime temp retention threshold.',
-    activeProtection: 'collectRuntimeProcesses protects scratch still owned by a live Runtime process.',
-    retentionCapacity: 'RUNTIME_TEMP_RETENTION_MINUTES age threshold and bounded maintenance candidate scan.',
-    cleanupAuthority: 'Central Runtime maintenance removeRuntimeTempEntry.',
-    recoverySemantics: 'Temp cleanup is disposable and never participates in semantic completion or effect replay.',
+    storage: 'OS temporary roots / Controller-observed Runtime temp entries, including forge-runtime-release-source-* detached release snapshot containers.',
+    terminalCondition: 'Normal release snapshot scope removes its worktree/container immediately; orphaned Runtime temp is terminal after the owning live Process is gone and the retention threshold is exceeded.',
+    activeProtection: 'Release snapshot callbacks own their temp container until finally cleanup; collectRuntimeProcesses protects longer-lived scratch still attributable to a live Runtime process.',
+    retentionCapacity: 'Immediate release-snapshot finally cleanup plus RUNTIME_TEMP_RETENTION_MINUTES age threshold and bounded maintenance candidate scan for crash leftovers.',
+    cleanupAuthority: 'Release materialization owns immediate snapshot cleanup; Central Runtime maintenance removeRuntimeTempEntry owns stale crash-leftover cleanup.',
+    recoverySemantics: 'Release snapshot/temp cleanup is disposable, lives outside repository workspace authority, prunes stale Git worktree metadata after failed materialization/removal, and never participates in semantic completion or effect replay.',
     closureStatus: 'existing_bounded', evidencePaths: ['src/runtime/diagnostics/performance.ts','src/runtime/recovery/maintenance-executor.ts'],
   }),
 ]);