@moretea-labs/forge 1.8.0 → 1.8.1

package/packages/kernel/controller/infrastructure/controller-round-store.ts

@@ -8,12 +8,23 @@ import {
   withControlPlaneTransaction,
   writeControlPlaneRecord,
   writeControlPlaneRecordWithinTransaction,
+  withControlPlaneReadDatabase,
   type ControlPlaneRecord,
 } from '../../../../src/runtime/control-plane/persistence/sqlite-store';
 import { workHasActiveExecution } from '../../../../src/runtime/execution/work-activity';
-import { controllerSessionBlocksRecovery, getControllerSession } from './controller-session-store';
+import {
+  assertControllerSessionWorkClaimable,
+  controllerSessionBlocksRecovery,
+  controllerSessionPrincipalId,
+  getControllerSession,
+  releaseObservedControllerSession,
+  resumeControllerSessionWithinTransaction,
+  withControllerSessionMutationLock,
+  type ClaimedControllerSession,
+  type ControllerSessionClaimInput,
+} from './controller-session-store';
 import { getHandoffItem, listHandoffItems } from '../../../../src/runtime/control-plane/facade/handoff-inbox-store';
-import { getWorkContract, readWorkContractStore, isTerminalWorkContractStatus, type WorkContract } from '../../work/api/index';
+import { currentTaskLineageWorkIds, getWorkContract, readActiveWorkCandidates, readWorkContractLineageSnapshot, readWorkContractStore, semanticWorkState, type WorkContract } from '../../work/api/index';
 import { isTerminalHandoffStatus } from '../../../protocols/handoff/index';
 import type { ControllerSession, ControllerType } from '../domain/types';
 import { deriveClosedRoundQualitySignals, type AssistantContextSnapshot, type AssistantContextUsage, type ClosedRoundObservation, type ExecutionQualityAdjustmentResult, type ExecutionQualityDecision, type ExecutionQualitySignal } from '../domain/execution-quality';
@@ -28,7 +39,9 @@ import {
 import {
   controllerRoundBlockerClass,
   controllerRoundProviderEffectId,
+  controllerRoundRelayClaimable,
   decideControllerRoundTransition,
+  type ControllerRoundBlockerClass,
   type ControllerRoundTransitionDecision,
   type ControllerRoundTransitionEvent,
 } from '../domain/controller-round-transition-policy';
@@ -54,6 +67,8 @@ export interface SubmitControllerRoundDispositionInput {
   handoffId?: string;
   stateFingerprint?: string;
   reason?: string;
+  /** Exact facade-authenticated authority for completed-Work provider-wait goal closure only. */
+  terminalAuthorityId?: string;
   /** Opaque provider binding owned by a ControllerHost adapter. */
   bindingId?: string;
   maxRounds?: number;
@@ -73,12 +88,24 @@ export interface BeginInitialControllerRoundDispatchInput {
   maxFailures?: number;
   /** Required for any later schedule/manual/replan occurrence after a prior semantic state exists. */
   occurrenceId?: string;
+  /**
+   * Scheduler-owned recovery may re-arm an unchanged semantic wait when the
+   * outer Workflow Supervisor task is no longer runnable. This is bounded by
+   * the existing repeated-state/round budgets and never applies to a user
+   * blocker or an unknown provider outcome.
+   */
+  allowSemanticWaitRecovery?: boolean;
+  /** Authenticated launcher evidence for a distinct occurrence after round-budget exhaustion. */
+  authorizeRoundBudgetOccurrence?: boolean;
 }
 
 export interface RecoverControllerRoundRelayAuthorityInput {
   workId: string;
   requestedBy?: string;
+  recoveryReason?: string;
   identity: ControllerRoundRelayIdentity;
+  /** Set only after the caller proves this identity is served by the live canonical Runtime. */
+  allowCanonicalRuntimeMigration?: boolean;
 }
 
 /** Legacy ControllerRound rows predate explicit controllerType and were ChatGPT-only. */
@@ -95,6 +122,14 @@ const DEFAULT_UNCLOSED_ROUND_GRACE_MS = 10 * 60_000;
 const MAX_UNCLOSED_ROUND_GRACE_MS = 60 * 60_000;
 const DEFAULT_STALLED_RECOVERY_BACKOFF_MS = 60_000;
 const MAX_STALLED_RECOVERY_BACKOFF_MS = 15 * 60_000;
+const MAX_LATEST_RELAY_CACHE_ENTRIES = 128;
+
+interface LatestRelayRecordsCacheEntry {
+  signature: string;
+  records: ControllerRoundRelayRecord[];
+}
+
+const latestRelayRecordsCache = new Map<string, LatestRelayRecordsCacheEntry>();
 
 
 function transitionDecisionOrThrow(decision: ControllerRoundTransitionDecision): { record: ControllerRoundRelayRecord; action?: string; changed: boolean } {
@@ -179,6 +214,18 @@ export function getControllerRoundRelay(
   return readRelayRecord(options, workId)?.value;
 }
 
+export function getRequirementControllerRoundRelay(
+  options: ControllerRoundRelayStoreOptions,
+  requirementId: string,
+): ControllerRoundRelayRecord | undefined {
+  const normalizedRequirementId = requirementId.trim();
+  if (!normalizedRequirementId) return undefined;
+  const relayScopeId = `requirement:${normalizedRequirementId}`;
+  return latestRelayRecordsByScope(options).find((entry) =>
+    entry.relayScopeId === relayScopeId
+    && entry.requirementId === normalizedRequirementId);
+}
+
 /**
  * Resolve an existing Requirement-scoped ControllerRound authority for another
  * Work that is mechanically part of the same durable Requirement/Work graph.
@@ -199,7 +246,11 @@ export function resolveRequirementControllerRoundRelayForWork(
     && Boolean(entry.requirementId)
     && `requirement:${entry.requirementId}` === relayScopeId);
   if (!candidate) return undefined;
-  return relevantWork(options, candidate).some((work) => work.workId === workId) ? candidate : undefined;
+  const target = getWorkContract(options, workId);
+  if (!target) return undefined;
+  if (candidate.requirementId && target.requirementId !== candidate.requirementId) return undefined;
+  const all = readWorkContractStore({ controllerHome: options.controllerHome, repoId: options.repoId }).contracts;
+  return currentTaskLineageWorkIds([candidate.originWorkId], all).has(workId) ? candidate : undefined;
 }
 
 function relayHistory(options: ControllerRoundRelayStoreOptions, relayScopeId: string): ControllerRoundRelayRecord[] {
@@ -214,7 +265,28 @@ function relayHistory(options: ControllerRoundRelayStoreOptions, relayScopeId: s
 }
 
 function latestRelayRecordsByScope(options: ControllerRoundRelayStoreOptions): ControllerRoundRelayRecord[] {
+  const cacheKey = `${options.controllerHome}\u0000${options.repoId}`;
+  const signature = withControlPlaneReadDatabase(options.controllerHome, (database) => {
+    const statement = database.prepare(`
+      SELECT COUNT(*) AS recordCount,
+             COALESCE(SUM(revision), 0) AS revisionSum,
+             MAX(updated_at) AS latestUpdatedAt
+      FROM control_plane_records
+      WHERE namespace = ? AND scope = ?
+    `);
+    try {
+      const row = statement.get(NAMESPACE, options.repoId) as { recordCount?: unknown; revisionSum?: unknown; latestUpdatedAt?: unknown } | undefined;
+      return `${String(row?.recordCount ?? 0)}:${String(row?.revisionSum ?? 0)}:${typeof row?.latestUpdatedAt === 'string' ? row.latestUpdatedAt : ''}`;
+    } finally {
+      statement.finalize?.();
+    }
+  });
+  const cached = latestRelayRecordsCache.get(cacheKey);
+  if (cached && cached.signature === signature) return cached.records;
+
   const latest = new Map<string, ControllerRoundRelayRecord>();
+  const retiredTerminalWork = (entry: ControllerRoundRelayRecord): boolean =>
+    entry.status === 'failed' && entry.failureClass === 'terminal_work';
   for (const entry of listControlPlaneRecords<ControllerRoundRelayRecord>(options.controllerHome, {
     namespace: NAMESPACE,
     scope: options.repoId,
@@ -222,48 +294,156 @@ function latestRelayRecordsByScope(options: ControllerRoundRelayStoreOptions): C
   }).map((record) => record.value)) {
     if (entry.status === 'handed_off') continue;
     const current = latest.get(entry.relayScopeId);
-    if (!current || entry.updatedAt > current.updatedAt) latest.set(entry.relayScopeId, entry);
+    if (!current) {
+      latest.set(entry.relayScopeId, entry);
+      continue;
+    }
+    const currentRetired = retiredTerminalWork(current);
+    const candidateRetired = retiredTerminalWork(entry);
+    if (currentRetired !== candidateRetired) {
+      if (currentRetired && !candidateRetired) latest.set(entry.relayScopeId, entry);
+      continue;
+    }
+    if (entry.updatedAt > current.updatedAt) latest.set(entry.relayScopeId, entry);
+  }
+  const records = [...latest.values()].sort((left, right) => left.updatedAt.localeCompare(right.updatedAt));
+  latestRelayRecordsCache.set(cacheKey, { signature, records });
+  while (latestRelayRecordsCache.size > MAX_LATEST_RELAY_CACHE_ENTRIES) {
+    const oldest = latestRelayRecordsCache.keys().next().value;
+    if (typeof oldest !== 'string') break;
+    latestRelayRecordsCache.delete(oldest);
   }
-  return [...latest.values()].sort((left, right) => left.updatedAt.localeCompare(right.updatedAt));
+  return records;
+}
+
+/** Read-only current relay projection for bounded lifecycle/resource reconciliation. */
+export function listControllerRoundRelaysByBlocker(
+  options: ControllerRoundRelayStoreOptions,
+  blocker: ControllerRoundBlockerClass,
+  limit = 16,
+): ControllerRoundRelayRecord[] {
+  const boundedLimit = Math.max(1, Math.min(Math.trunc(limit), 100));
+  return latestRelayRecordsByScope(options)
+    .filter((record) => controllerRoundBlockerClass(record) === blocker)
+    .slice(0, boundedLimit);
+}
+
+/** Read-only latest relay projection used by bounded lifecycle/resource reconciliation. */
+export function listCurrentControllerRoundRelays(
+  options: ControllerRoundRelayStoreOptions,
+  limit = 100,
+): ControllerRoundRelayRecord[] {
+  const boundedLimit = Math.max(1, Math.min(Math.trunc(limit), 100));
+  return latestRelayRecordsByScope(options).slice(0, boundedLimit);
+}
+
+/**
+ * Read-only dispatch candidate query. Filter mechanical provider-dispatch facts
+ * before applying the bounded result limit so unrelated historical relays cannot
+ * permanently hide a newer runnable continuation behind the projection window.
+ */
+export function listControllerRoundRelaysAwaitingProviderDispatch(
+  options: ControllerRoundRelayStoreOptions,
+  input: {
+    limit?: number;
+    controllerTypes?: readonly ControllerType[];
+    occurrenceIdPrefix?: string;
+  } = {},
+): ControllerRoundRelayRecord[] {
+  const boundedLimit = Math.max(1, Math.min(Math.trunc(input.limit ?? 100), 100));
+  const occurrenceIdPrefix = input.occurrenceIdPrefix?.trim();
+  return latestRelayRecordsByScope(options)
+    .filter((record) => {
+      if (record.status !== 'dispatching') return false;
+      // Attempt count is diagnostic history, not evidence that an external
+      // provider effect may have committed. A resolved user-action blocker clears
+      // the concrete effect facts below while preserving the retry count; that
+      // exact round must become runnable again without inventing a new occurrence.
+      if (record.providerDispatchEffectId
+        || record.providerDispatchStartedAt
+        || record.providerDispatchReceiptId
+        || record.dispatchedAt) return false;
+      if (input.controllerTypes && !input.controllerTypes.includes(relayControllerType(record))) return false;
+      if (occurrenceIdPrefix && !record.occurrenceId?.startsWith(occurrenceIdPrefix)) return false;
+      return true;
+    })
+    .slice(0, boundedLimit);
 }
 
+
 function requirementForRelay(options: ControllerRoundRelayStoreOptions, requirementId: string | undefined) {
   return requirementId ? readRequirement({ controllerHome: options.controllerHome }, requirementId)?.value : undefined;
 }
 
-function relevantWork(options: ControllerRoundRelayStoreOptions, record: Pick<ControllerRoundRelayRecord, 'relayScopeId' | 'originWorkId' | 'requirementId'>): WorkContract[] {
-  const all = readWorkContractStore({ controllerHome: options.controllerHome, repoId: options.repoId }).contracts;
-  const linkedWorkIds = new Set([
-    record.originWorkId,
-    ...relayHistory(options, record.relayScopeId).map((entry) => entry.originWorkId),
-  ]);
-  if (record.requirementId) {
-    for (const work of all) {
-      if (work.requirementId === record.requirementId) linkedWorkIds.add(work.workId);
-    }
-  }
-  let expanded = true;
-  while (expanded) {
-    expanded = false;
-    for (const work of all) {
-      if (linkedWorkIds.has(work.workId)) {
-        if (work.parentWorkId && !linkedWorkIds.has(work.parentWorkId)) {
-          linkedWorkIds.add(work.parentWorkId);
-          expanded = true;
-        }
-        continue;
-      }
-      if (work.parentWorkId && linkedWorkIds.has(work.parentWorkId)) {
-        linkedWorkIds.add(work.workId);
-        expanded = true;
-      }
-    }
+function relevantWork(
+  options: ControllerRoundRelayStoreOptions,
+  record: Pick<ControllerRoundRelayRecord, 'relayScopeId' | 'originWorkId' | 'requirementId'>,
+  allWorkContracts?: readonly WorkContract[],
+): WorkContract[] {
+  const snapshot = allWorkContracts ? undefined : readWorkContractLineageSnapshot({
+    controllerHome: options.controllerHome,
+    repoId: options.repoId,
+  });
+  const all = allWorkContracts ?? snapshot!.contracts;
+  const invalid = snapshot?.invalid ?? [];
+  const candidates = invalid.length === 0
+    ? all
+    : [...all, ...invalid.map((work) => ({
+      workId: work.workId,
+      parentWorkId: work.parentWorkId,
+      predecessorWorkId: work.predecessorWorkId,
+      supersedes: work.supersedes,
+      supersededBy: work.supersededBy,
+    } as WorkContract))];
+  const linkedWorkIds = currentTaskLineageWorkIds([record.originWorkId], candidates);
+  const relatedInvalid = invalid.find((work) => linkedWorkIds.has(work.workId));
+  if (relatedInvalid) {
+    throw new Error(`WORK_LINEAGE_CONTRACT_INVALID: ${relatedInvalid.workId}: ${relatedInvalid.error}`);
   }
   return all
     .filter((work) => linkedWorkIds.has(work.workId))
     .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
 }
 
+function recoveryFenceWork(
+  options: ControllerRoundRelayStoreOptions,
+  record: Pick<ControllerRoundRelayRecord, 'relayScopeId' | 'originWorkId' | 'requirementId'>,
+  allWorkContracts: readonly WorkContract[] = readWorkContractStore({ controllerHome: options.controllerHome, repoId: options.repoId }).contracts,
+): WorkContract[] {
+  const explicit = relevantWork(options, record, allWorkContracts);
+  const requirementId = record.requirementId?.trim();
+  if (!requirementId || record.relayScopeId !== `requirement:${requirementId}`) return explicit;
+  const byId = new Map(explicit.map((work) => [work.workId, work] as const));
+  for (const work of allWorkContracts) {
+    if (work.requirementId?.trim() === requirementId) byId.set(work.workId, work);
+  }
+  return [...byId.values()].sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+}
+
+function relayMayHaveActiveWork(
+  options: ControllerRoundRelayStoreOptions,
+  record: Pick<ControllerRoundRelayRecord, 'relayScopeId' | 'originWorkId' | 'requirementId'>,
+  activeWorkSnapshot: ReturnType<typeof readActiveWorkCandidates>,
+): boolean {
+  const all = readWorkContractStore({ controllerHome: options.controllerHome, repoId: options.repoId }).contracts;
+  const recoveryFenceIds = new Set(recoveryFenceWork(options, record, all).map((work) => work.workId));
+  // Recovery is a destructive liveness decision. For Requirement-scoped relay
+  // authority it must conservatively fence every active Work in that Requirement,
+  // while normal semantic context continues to use exact current-task lineage.
+  if (activeWorkSnapshot.invalid.some((work) => recoveryFenceIds.has(work.workId))) return true;
+  return activeWorkSnapshot.contracts.some((work) => recoveryFenceIds.has(work.workId));
+}
+
+function relevantHandoffs(
+  options: ControllerRoundRelayStoreOptions,
+  works: readonly Pick<WorkContract, 'workId'>[],
+  explicitHandoffId?: string,
+) {
+  const linkedWorkIds = new Set(works.map((work) => work.workId));
+  return listHandoffItems({ controllerHome: options.controllerHome, repoId: options.repoId, status: 'active', limit: 100 })
+    .filter((handoff) => handoff.workId ? linkedWorkIds.has(handoff.workId) : handoff.id === explicitHandoffId);
+}
+
 function semanticVerificationFacts(work: WorkContract): Array<{
   checkId: string; verificationInputFingerprint: string; checkDefinitionDigest: string;
   checkEnvironmentFingerprint: string; checkCacheKey: string; outcome: string; status: string;
@@ -297,13 +477,15 @@ function mechanicalStateFingerprint(
   work: WorkContract,
   requirementId: string | undefined,
   relayScopeId: string,
+  explicitHandoffId?: string,
+  allWorkContracts?: readonly WorkContract[],
 ): string {
   const requirement = requirementForRelay(options, requirementId);
-  const works = relevantWork(options, { relayScopeId, originWorkId: work.workId, requirementId })
+  const works = relevantWork(options, { relayScopeId, originWorkId: work.workId, requirementId }, allWorkContracts)
     .map((entry) => ({
       workId: entry.workId,
       parentWorkId: entry.parentWorkId,
-      status: entry.status,
+      state: entry.semanticState,
       phase: entry.phase,
       dispatchState: entry.dispatchState,
       evidenceState: entry.evidenceState,
@@ -322,9 +504,7 @@ function mechanicalStateFingerprint(
       } : undefined,
     }))
     .sort((left, right) => left.workId.localeCompare(right.workId));
-  const linkedWorkIds = new Set(works.map((entry) => entry.workId));
-  const handoffs = listHandoffItems({ controllerHome: options.controllerHome, repoId: options.repoId, status: 'active', limit: 100 })
-    .filter((handoff) => !handoff.workId || linkedWorkIds.has(handoff.workId))
+  const handoffs = relevantHandoffs(options, works, explicitHandoffId)
     .map((handoff) => ({
       id: handoff.id,
       workId: handoff.workId,
@@ -355,7 +535,7 @@ export function readControllerRoundSemanticStateFingerprint(
   const work = getWorkContract(options, workId);
   const current = readRelayRecord(options, workId)?.value;
   if (!work || !current) return undefined;
-  return mechanicalStateFingerprint(options, work, current.requirementId, current.relayScopeId);
+  return mechanicalStateFingerprint(options, work, current.requirementId, current.relayScopeId, current.handoffId);
 }
 
 function resolveRequirementId(
@@ -416,8 +596,8 @@ function assertControllerRoundSuccessorLineage(
 ): WorkContract {
   const successor = getWorkContract(options, successorWorkId);
   if (!successor) throw new Error(`CONTROLLER_RELAY_SUCCESSOR_WORK_NOT_FOUND: ${successorWorkId}`);
-  if (isTerminalWorkContractStatus(successor.status)) {
-    throw new Error(`CONTROLLER_RELAY_SUCCESSOR_WORK_TERMINAL: ${successor.workId}:${successor.status}`);
+  if (semanticWorkState(successor) !== 'open') {
+    throw new Error(`CONTROLLER_RELAY_SUCCESSOR_WORK_TERMINAL: ${successor.workId}:${semanticWorkState(successor)}`);
   }
   if (successor.predecessorWorkId !== predecessor.workId) {
     throw new Error(`CONTROLLER_RELAY_SUCCESSOR_LINEAGE_MISMATCH: ${successor.workId}:predecessor=${successor.predecessorWorkId ?? 'none'}:expected=${predecessor.workId}`);
@@ -444,16 +624,17 @@ export function bindControllerRoundSuccessorWork(
 ): ControllerRoundRelayRecord {
   const predecessor = getWorkContract(options, input.workId);
   if (!predecessor) throw new Error(`WORK_NOT_FOUND: ${input.workId}`);
-  if (predecessor.status !== 'completed') {
-    throw new Error(`CONTROLLER_RELAY_SUCCESSOR_PREDECESSOR_NOT_COMPLETED: ${predecessor.workId}:${predecessor.status}`);
+  if (semanticWorkState(predecessor) !== 'completed') {
+    throw new Error(`CONTROLLER_RELAY_SUCCESSOR_PREDECESSOR_NOT_COMPLETED: ${predecessor.workId}:${semanticWorkState(predecessor)}`);
   }
   const initial = readRelayRecord(options, predecessor.workId);
   if (!initial) throw new Error(`CONTROLLER_RELAY_ROUND_NOT_OPEN: ${predecessor.workId}`);
   return relayLock(options, initial.value.relayScopeId, `controller-relay-bind-successor:${input.identity.controllerId}`, () => {
     const current = readRelayRecord(options, predecessor.workId);
-    if (!current || current.value.status !== 'claimed') {
-      throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_REQUIRES_CLAIMED_ROUND: ${predecessor.workId}:${current?.value.status ?? 'missing'}`);
+    if (!current || !['claimed', 'failed'].includes(current.value.status)) {
+      throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_REQUIRES_ACTIVE_OR_FAILED_PRECLAIM_ROUND: ${predecessor.workId}:${current?.value.status ?? 'missing'}`);
     }
+    const failedPreclaim = current.value.status === 'failed';
     const expectedAuthorityId = current.value.authorityId?.trim() || '';
     const requestedAuthorityId = input.controllerAuthorityId?.trim() || '';
     if (expectedAuthorityId) {
@@ -463,19 +644,29 @@ export function bindControllerRoundSuccessorWork(
       if (!principalId || current.value.controllerId !== input.identity.controllerId || current.value.principalId !== principalId) {
         throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_AUTHORITY_MISMATCH: ${predecessor.workId}`);
       }
-      if (relayControllerType(current.value) !== input.identity.controllerType || current.value.claimGeneration < 1) {
+      if (relayControllerType(current.value) !== input.identity.controllerType) {
         throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_AUTHORITY_MISMATCH: ${predecessor.workId}`);
       }
       const liveOwner = getControllerSession(options, predecessor.workId);
-      if (liveOwner) {
-        const livePrincipal = liveOwner.principalId?.trim() || liveOwner.controllerId;
-        if (liveOwner.controllerId !== input.identity.controllerId
-          || liveOwner.controllerType !== input.identity.controllerType
-          || livePrincipal !== principalId) {
+      if (failedPreclaim) {
+        if (current.value.lifecycleStage !== 'dispatching' || current.value.claimGeneration !== 0 || liveOwner) {
+          throw new Error(`CONTROLLER_RELAY_FAILED_SUCCESSOR_HANDOFF_PRECLAIM_REQUIRED: ${predecessor.workId}`);
+        }
+      } else {
+        if (current.value.claimGeneration < 1) {
           throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_AUTHORITY_MISMATCH: ${predecessor.workId}`);
         }
+        if (liveOwner) {
+          const livePrincipal = liveOwner.principalId?.trim() || liveOwner.controllerId;
+          if (liveOwner.controllerId !== input.identity.controllerId
+            || liveOwner.controllerType !== input.identity.controllerType
+            || livePrincipal !== principalId) {
+            throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_AUTHORITY_MISMATCH: ${predecessor.workId}`);
+          }
+        }
       }
     } else {
+        if (failedPreclaim) throw new Error(`CONTROLLER_RELAY_SUCCESSOR_BIND_AUTHORITY_REQUIRED: ${predecessor.workId}`);
       // Legacy claimed rounds have no opaque per-round capability. Preserve only
       // their exact live owner epoch; rollover is available after the round has
       // been upgraded by the canonical launcher/recovery path.
@@ -487,6 +678,44 @@ export function bindControllerRoundSuccessorWork(
       }
     }
     const successor = assertControllerRoundSuccessorLineage(options, predecessor, input.successorWorkId.trim());
+    if (failedPreclaim) {
+      const at = nowIso(options);
+      const successorStateFingerprint = mechanicalStateFingerprint(options, successor, current.value.requirementId, current.value.relayScopeId, current.value.handoffId);
+      return withControlPlaneTransaction(options.controllerHome, (database) => {
+        const predecessorRelay = readControlPlaneRecordWithinTransaction<ControllerRoundRelayRecord>(
+          database, NAMESPACE, options.repoId, predecessor.workId,
+        );
+        if (!predecessorRelay || predecessorRelay.value.status !== 'failed' || predecessorRelay.value.claimGeneration !== 0) {
+          throw new Error(`CONTROLLER_RELAY_FAILED_SUCCESSOR_HANDOFF_STALE: ${predecessor.workId}`);
+        }
+        const existingSuccessorRelay = readControlPlaneRecordWithinTransaction<ControllerRoundRelayRecord>(
+          database, NAMESPACE, options.repoId, successor.workId,
+        );
+        if (existingSuccessorRelay) {
+          if (existingSuccessorRelay.value.relayScopeId === current.value.relayScopeId
+            && ['dispatching', 'dispatched', 'claimed'].includes(existingSuccessorRelay.value.status)) {
+            return existingSuccessorRelay.value;
+          }
+          throw new Error(`CONTROLLER_RELAY_SUCCESSOR_ALREADY_HAS_ROUND: ${successor.workId}`);
+        }
+        const decision = atomicTransitionDecisionOrThrow(decideControllerRoundTransition(predecessorRelay.value, {
+          type: 'failed_dispatch_successor_handoff',
+          at,
+          successorWorkId: successor.workId,
+          successorStateFingerprint,
+          proposedAuthorityId: newControllerRoundAuthorityId(),
+        }));
+        writeControlPlaneRecordWithinTransaction(database, {
+          namespace: NAMESPACE, scope: options.repoId, key: predecessor.workId, schemaVersion: SCHEMA_VERSION,
+          value: decision.next, action: decision.action, expectedRevision: predecessorRelay.revision,
+        });
+        writeControlPlaneRecordWithinTransaction(database, {
+          namespace: NAMESPACE, scope: options.repoId, key: decision.relatedWorkId, schemaVersion: SCHEMA_VERSION,
+          value: decision.relatedNext, action: decision.relatedAction, expectedRevision: null,
+        });
+        return decision.relatedNext;
+      });
+    }
     return applyControllerRoundTransition(options, current, {
       type: 'successor_bound', at: nowIso(options), successorWorkId: successor.workId,
     });
@@ -518,13 +747,21 @@ function validatedAssistantContextUsage(
   for (const item of usage) {
     const key = `${item.kind}:${item.itemId}`;
     if (!expected.has(key) || seen.has(key) || !['used', 'rejected'].includes(item.decision)
-      || typeof item.reason !== 'string' || !item.reason.trim() || item.reason.length > 1_000) {
+      || typeof item.reason !== 'string' || !item.reason.trim() || item.reason.length > 1_000
+      || (item.rejectionKind !== undefined && !['irrelevant', 'stale', 'contradicted'].includes(item.rejectionKind))
+      || (item.decision === 'used' && item.rejectionKind !== undefined)) {
       throw new Error('CONTROLLER_ASSISTANT_CONTEXT_USAGE_INVALID');
     }
     seen.add(key);
   }
   if (seen.size !== expected.size) throw new Error('CONTROLLER_ASSISTANT_CONTEXT_USAGE_INCOMPLETE');
-  return usage.map((item) => ({ ...item, reason: item.reason.trim() }));
+  return usage.map((item) => ({
+    ...item,
+    reason: item.reason.trim(),
+    // Missing rejectionKind is accepted only for frozen clients and means ordinary
+    // irrelevance. Forge never derives stale/contradicted semantics from prose.
+    ...(item.decision === 'rejected' ? { rejectionKind: item.rejectionKind ?? 'irrelevant' as const } : {}),
+  }));
 }
 
 function persistClaimedAssistantContextSnapshot(
@@ -603,7 +840,7 @@ export function submitControllerRoundDisposition(
   if (!work) throw new Error(`WORK_NOT_FOUND: ${input.workId}`);
   const requirementId = resolveRequirementId(options, work, input.requirementId);
   const relayScopeId = resolveRelayScope(work, requirementId, input.relayScopeId);
-  const terminal = isTerminalWorkContractStatus(work.status);
+  const terminal = semanticWorkState(work) !== 'open';
 
   return relayLock(options, relayScopeId, `controller-relay-submit:${input.identity.controllerId}`, () => {
     const existing = readRelayRecord(options, work.workId);
@@ -611,20 +848,30 @@ export function submitControllerRoundDisposition(
     if (existing.value.relayScopeId !== relayScopeId) {
       throw new Error(`CONTROLLER_RELAY_SCOPE_MISMATCH: Work ${work.workId} is already bound to ${existing.value.relayScopeId}`);
     }
-    if (existing.value.status !== 'claimed') {
+    const terminalAuthorityId = bounded(input.terminalAuthorityId, 256);
+    const providerWaitTerminalGoalComplete = terminal
+      && semanticWorkState(work) === 'completed'
+      && input.disposition === 'goal_complete'
+      && existing.value.status === 'waiting_for_user'
+      && controllerRoundBlockerClass(existing.value) === 'provider_user_action_required';
+    if (providerWaitTerminalGoalComplete) {
+      if (!terminalAuthorityId || terminalAuthorityId !== existing.value.authorityId) {
+        throw new Error(`CONTROLLER_RELAY_TERMINAL_AUTHORITY_MISMATCH: ${work.workId}`);
+      }
+    } else if (existing.value.status !== 'claimed') {
       throw new Error(`CONTROLLER_RELAY_ROUND_NOT_CLAIMED: ${existing.value.status}`);
     }
     const terminalSuccessor = terminal
-      && work.status === 'completed'
+      && semanticWorkState(work) === 'completed'
       && input.disposition === 'continue_immediately'
       && existing.value.successorWorkId
       ? assertControllerRoundSuccessorLineage(options, work, existing.value.successorWorkId)
       : undefined;
     const terminalRoundClosureAllowed = terminal
-      && work.status === 'completed'
+      && semanticWorkState(work) === 'completed'
       && (input.disposition === 'goal_complete' || Boolean(terminalSuccessor));
     if (terminal && !terminalRoundClosureAllowed) {
-      throw new Error(`CONTROLLER_RELAY_WORK_TERMINAL: ${work.status}`);
+      throw new Error(`CONTROLLER_RELAY_WORK_TERMINAL: ${semanticWorkState(work)}`);
     }
 
     const liveOwner = getControllerSession(options, work.workId);
@@ -650,7 +897,7 @@ export function submitControllerRoundDisposition(
           }
           if (existing.value.controllerId !== input.identity.controllerId) throw new Error(`CONTROLLER_RELAY_CLAIM_CONTROLLER_MISMATCH: ${work.workId}`);
           if (existing.value.principalId !== principalId) throw new Error(`CONTROLLER_RELAY_CLAIM_PRINCIPAL_MISMATCH: ${work.workId}`);
-          if (existing.value.claimGeneration < 1) throw new Error(`CONTROLLER_RELAY_CLAIM_GENERATION_REQUIRED: ${work.workId}`);
+          if (existing.value.claimGeneration < 1 && !providerWaitTerminalGoalComplete) throw new Error(`CONTROLLER_RELAY_CLAIM_GENERATION_REQUIRED: ${work.workId}`);
           return {
             controllerId: existing.value.controllerId,
             controllerType: expectedControllerType,
@@ -730,9 +977,10 @@ export function submitControllerRoundDisposition(
     const requestedMaxRounds = boundedInteger(input.maxRounds, DEFAULT_MAX_ROUNDS, 1, 32);
     const requestedMaxRepeatedState = boundedInteger(input.maxRepeatedState, DEFAULT_MAX_REPEATED_STATE, 1, 8);
     const requestedMaxFailures = boundedInteger(input.maxFailures, DEFAULT_MAX_FAILURES, 1, 8);
-    const stateFingerprint = bounded(input.stateFingerprint, 256) ?? mechanicalStateFingerprint(options, terminalSuccessor ?? work, requirementId, relayScopeId);
-    const bindingId = bounded(input.bindingId, 500) ?? existing.value.bindingId;
     const handoffId = bounded(input.handoffId, 200);
+    const stateFingerprint = bounded(input.stateFingerprint, 256)
+      ?? mechanicalStateFingerprint(options, terminalSuccessor ?? work, requirementId, relayScopeId, handoffId ?? existing.value.handoffId);
+    const bindingId = bounded(input.bindingId, 500) ?? existing.value.bindingId;
     if (input.disposition === 'wait_for_user') {
       if (!handoffId) throw new Error('CONTROLLER_RELAY_WAIT_FOR_USER_HANDOFF_REQUIRED');
       const handoff = getHandoffItem(options, handoffId);
@@ -750,6 +998,7 @@ export function submitControllerRoundDisposition(
       type: 'semantic_disposition_submitted', at, disposition: input.disposition, stateFingerprint,
       maxRounds: requestedMaxRounds, maxRepeatedState: requestedMaxRepeatedState, maxFailures: requestedMaxFailures,
       controllerSession: authority,
+      ...(providerWaitTerminalGoalComplete ? { terminalGoalComplete: true } : {}),
       qualityDecisions: accumulatedQualityDecisions, qualityAdjustmentResults: accumulatedQualityAdjustmentResults, observationWindow,
       ...(handoffId ? { handoffId } : {}),
       ...(bounded(input.reason, 1_000) ? { reason: bounded(input.reason, 1_000) } : {}),
@@ -758,35 +1007,94 @@ export function submitControllerRoundDisposition(
   });
 }
 
+/**
+ * Observe that the exact provider Controller turn has settled. If the Work is
+ * still nonterminal and the Controller did not explicitly close the round,
+ * canonical Kernel policy creates the continuation obligation. Provider
+ * adapters supply only completion evidence; they do not choose the disposition.
+ */
+export function settleControllerRoundAfterTurn(
+  options: ControllerRoundRelayStoreOptions,
+  input: { workId: string; completionEvidenceId: string },
+): ControllerRoundRelayRecord | undefined {
+  const initial = readRelayRecord(options, input.workId);
+  if (!initial) return undefined;
+  return relayLock(options, initial.value.relayScopeId, `controller-turn-settled:${input.workId}`, () => {
+    const current = readRelayRecord(options, input.workId);
+    if (!current) return undefined;
+    const completionEvidenceId = bounded(input.completionEvidenceId, 500);
+    if (!completionEvidenceId) throw new Error('CONTROLLER_RELAY_TURN_COMPLETION_EVIDENCE_REQUIRED');
+    const work = getWorkContract(options, input.workId);
+    if (!work) throw new Error(`WORK_NOT_FOUND: ${input.workId}`);
+    const at = nowIso(options);
+    const successor = semanticWorkState(work) === 'completed' && current.value.successorWorkId
+      ? getWorkContract(options, current.value.successorWorkId)
+      : undefined;
+    const terminalSuccessorContinuation = Boolean(successor && semanticWorkState(successor) === 'open');
+    if (semanticWorkState(work) !== 'open' && !terminalSuccessorContinuation) {
+      return applyControllerRoundTransition(options, current, {
+        type: 'terminal_work_observed', at, error: `Controller turn settled after terminal Work ${semanticWorkState(work)}`,
+      });
+    }
+    const semanticWork = successor ?? work;
+    const blockingHandoff = relevantHandoffs(options, relevantWork(options, current.value), current.value.handoffId)
+      .find((handoff) => Boolean(handoff.blockingDecision?.trim())
+        && (handoff.workId === semanticWork.workId || handoff.id === current.value.handoffId));
+    const stateFingerprint = mechanicalStateFingerprint(options, semanticWork, current.value.requirementId, current.value.relayScopeId, current.value.handoffId);
+    return applyControllerRoundTransition(options, current, {
+      type: 'controller_turn_settled', at, stateFingerprint, completionEvidenceId,
+      ...(blockingHandoff ? { blockingHandoffId: blockingHandoff.id } : {}),
+    });
+  });
+}
+
 export function beginInitialControllerRoundDispatch(
   options: ControllerRoundRelayStoreOptions,
   input: BeginInitialControllerRoundDispatchInput,
 ): ControllerRoundRelayRecord {
   const work = getWorkContract(options, input.workId);
   if (!work) throw new Error(`WORK_NOT_FOUND: ${input.workId}`);
-  if (isTerminalWorkContractStatus(work.status)) throw new Error(`CONTROLLER_RELAY_WORK_TERMINAL: ${work.status}`);
+  if (semanticWorkState(work) !== 'open') throw new Error(`CONTROLLER_RELAY_WORK_TERMINAL: ${semanticWorkState(work)}`);
   const requirementId = resolveRequirementId(options, work, input.requirementId);
   const requirement = requirementForRelay(options, requirementId);
   if (requirement && !['planned', 'active'].includes(requirement.state)) {
     throw new Error(`CONTROLLER_RELAY_REQUIREMENT_TERMINAL: ${requirement.state}`);
   }
   const relayScopeId = resolveRelayScope(work, requirementId, input.relayScopeId);
+  const occurrenceId = bounded(input.occurrenceId, 500);
 
   return relayLock(options, relayScopeId, `controller-relay-launch:${input.identity.controllerId}`, () => {
     const existing = readRelayRecord(options, work.workId);
     if (existing && existing.value.relayScopeId !== relayScopeId) {
       throw new Error(`CONTROLLER_RELAY_SCOPE_MISMATCH: Work ${work.workId} is already bound to ${existing.value.relayScopeId}`);
     }
+    if (existing) {
+      const requestedControllerId = input.identity.controllerId.trim().slice(0, 240) || 'controller-host';
+      const requestedPrincipalId = input.identity.principalId.trim().slice(0, 240) || requestedControllerId;
+      const reusableUnsubmittedRelay = existing.value.originWorkId === work.workId
+        && ['pending_release', 'dispatching'].includes(existing.value.status)
+        && existing.value.controllerId === requestedControllerId
+        && relayControllerType(existing.value) === input.identity.controllerType
+        && existing.value.principalId === requestedPrincipalId
+        && Boolean(existing.value.authorityId?.trim())
+        && !existing.value.providerDispatchEffectId
+        && !existing.value.providerDispatchStartedAt
+        && !existing.value.providerDispatchReceiptId
+        && (existing.value.providerDispatchAttempt ?? 0) === 0
+        && (existing.value.occurrenceId ?? '') === (occurrenceId ?? '');
+      if (reusableUnsubmittedRelay) return existing.value;
+    }
     const previous = relayHistory(options, relayScopeId)[0];
     const abandonedReleasedRound = previous?.status === 'failed' && previous.failureClass === 'abandoned_release';
     const stateFingerprint = mechanicalStateFingerprint(options, work, requirementId, relayScopeId);
-    const occurrenceId = bounded(input.occurrenceId, 500);
     return applyControllerRoundTransition(options, existing, {
       type: 'occurrence_requested', at: nowIso(options), repoId: options.repoId, relayScopeId, originWorkId: work.workId,
       ...(requirementId ? { requirementId } : {}), identity: input.identity, stateFingerprint, proposedAuthorityId: newControllerRoundAuthorityId(),
       maxRounds: boundedInteger(input.maxRounds, DEFAULT_MAX_ROUNDS, 1, 32), maxRepeatedState: boundedInteger(input.maxRepeatedState, DEFAULT_MAX_REPEATED_STATE, 1, 8),
       maxFailures: boundedInteger(input.maxFailures, DEFAULT_MAX_FAILURES, 1, 8),
       ...(bounded(input.bindingId, 500) ? { bindingId: bounded(input.bindingId, 500) } : {}), ...(occurrenceId ? { occurrenceId } : {}),
+      ...(input.allowSemanticWaitRecovery ? { allowSemanticWaitRecovery: true } : {}),
+      ...(input.authorizeRoundBudgetOccurrence ? { authorizeRoundBudgetOccurrence: true } : {}),
       abandonedReleaseRecovery: Boolean(abandonedReleasedRound),
     });
   });
@@ -813,11 +1121,11 @@ export function beginControllerRoundRelayAfterRelease(
     const at = nowIso(options);
     if (record.successorWorkId) {
       const predecessor = getWorkContract(options, input.workId);
-      if (!predecessor || predecessor.status !== 'completed') {
-        throw new Error(`CONTROLLER_RELAY_SUCCESSOR_PREDECESSOR_NOT_COMPLETED: ${input.workId}:${predecessor?.status ?? 'missing'}`);
+      if (!predecessor || semanticWorkState(predecessor) !== 'completed') {
+        throw new Error(`CONTROLLER_RELAY_SUCCESSOR_PREDECESSOR_NOT_COMPLETED: ${input.workId}:${predecessor ? semanticWorkState(predecessor) : 'missing'}`);
       }
       const successor = assertControllerRoundSuccessorLineage(options, predecessor, record.successorWorkId);
-      const successorStateFingerprint = mechanicalStateFingerprint(options, successor, record.requirementId, record.relayScopeId);
+      const successorStateFingerprint = mechanicalStateFingerprint(options, successor, record.requirementId, record.relayScopeId, record.handoffId);
       return withControlPlaneTransaction(options.controllerHome, (database) => {
         const predecessorRelay = readControlPlaneRecordWithinTransaction<ControllerRoundRelayRecord>(
           database, NAMESPACE, options.repoId, input.workId,
@@ -885,10 +1193,10 @@ export function reconcileControllerRoundAfterAbandonedRelease(
     }
     const work = getWorkContract(options, input.workId);
     // Completed Work still requires semantic goal_complete or a valid terminal
-    // successor. Failed/cancelled Work has no legal semantic continuation, so
+    // successor. Cancelled Work has no legal semantic continuation, so
     // its exact released controller epoch may mechanically abandon the claimed
     // round and free the relay scope for later recovery/replanning.
-    if (!work || work.status === 'completed') return undefined;
+    if (!work || semanticWorkState(work) === 'completed') return undefined;
 
     return applyControllerRoundTransition(options, current, {
       type: 'abandoned_release_observed', at: nowIso(options), error: CONTROLLER_RELAY_ABANDONED_RELEASE_ERROR,
@@ -898,7 +1206,7 @@ export function reconcileControllerRoundAfterAbandonedRelease(
 
 /**
  * Mechanically retire any surviving ControllerRound once Work lifecycle authority
- * is durably failed/cancelled and no Controller lease remains. This is cleanup,
+ * is durably cancelled and no Controller lease remains. This is cleanup,
  * not a semantic disposition: completed Work is intentionally excluded.
  */
 export function reconcileControllerRoundAfterTerminalWork(
@@ -908,7 +1216,7 @@ export function reconcileControllerRoundAfterTerminalWork(
   const initial = readRelayRecord(options, input.workId);
   if (!initial) return undefined;
   const work = getWorkContract(options, input.workId);
-  if (!work || !['failed', 'cancelled'].includes(work.status)) return undefined;
+  if (!work || semanticWorkState(work) !== 'cancelled') return undefined;
   if (getControllerSession(options, input.workId)) {
     throw new Error(`CONTROLLER_RELAY_TERMINAL_WORK_ACTIVE_CLAIM: ${input.workId}`);
   }
@@ -917,7 +1225,7 @@ export function reconcileControllerRoundAfterTerminalWork(
     const current = readRelayRecord(options, input.workId);
     if (!current) return undefined;
     const currentWork = getWorkContract(options, input.workId);
-    if (!currentWork || !['failed', 'cancelled'].includes(currentWork.status)) return undefined;
+    if (!currentWork || semanticWorkState(currentWork) !== 'cancelled') return undefined;
     if (getControllerSession(options, input.workId)) {
       throw new Error(`CONTROLLER_RELAY_TERMINAL_WORK_ACTIVE_CLAIM: ${input.workId}`);
     }
@@ -928,15 +1236,47 @@ export function reconcileControllerRoundAfterTerminalWork(
   });
 }
 
+export function beginControllerRoundProviderDispatch(
+  options: ControllerRoundRelayStoreOptions,
+  input: { workId: string; authorityId: string; expectedUpdatedAt: string; bindingId?: string },
+): ControllerRoundRelayRecord {
+  const initial = readRelayRecord(options, input.workId);
+  if (!initial) throw new Error(`CONTROLLER_RELAY_PROVIDER_DISPATCH_RELAY_REQUIRED: ${input.workId}`);
+  return relayLock(options, initial.value.relayScopeId, `controller-provider-dispatch-start:${input.workId}`, () => {
+    const current = readRelayRecord(options, input.workId);
+    if (!current) throw new Error(`CONTROLLER_RELAY_PROVIDER_DISPATCH_RELAY_REQUIRED: ${input.workId}`);
+    if (current.value.status !== 'dispatching') throw new Error(`CONTROLLER_RELAY_DISPATCH_STATE_INVALID:${current.value.status}`);
+    if (current.value.authorityId !== input.authorityId.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_DISPATCH_AUTHORITY_MISMATCH: ${input.workId}`);
+    if (current.value.updatedAt !== input.expectedUpdatedAt.trim()) {
+      if (current.value.providerDispatchStartedAt) throw new Error(`CONTROLLER_CONTINUATION_ALREADY_DISPATCHING:${input.workId}`);
+      throw new Error(`CONTROLLER_RELAY_PROVIDER_DISPATCH_STALE: ${input.workId}`);
+    }
+    if (current.value.providerDispatchStartedAt) throw new Error(`CONTROLLER_CONTINUATION_ALREADY_DISPATCHING:${input.workId}`);
+    const providerDispatchEffectId = current.value.providerDispatchEffectId ?? controllerRoundProviderEffectId(current.value);
+    return applyControllerRoundTransition(options, current, {
+      type: 'provider_dispatch_started', at: nowIso(options), providerDispatchEffectId,
+      ...(bounded(input.bindingId, 500) ? { bindingId: bounded(input.bindingId, 500) } : {}),
+    });
+  });
+}
+
 export function finishControllerRoundRelayDispatch(
   options: ControllerRoundRelayStoreOptions,
   input: { workId: string; ok: boolean; bindingId?: string; providerDispatchEffectId?: string; providerDispatchReceiptId?: string; error?: string; recovery?: boolean; outcomeUnknown?: boolean; waitForUser?: boolean; handoffId?: string; nowMs?: number },
 ): ControllerRoundRelayRecord | undefined {
   const initial = readRelayRecord(options, input.workId);
-  if (!initial || initial.value.status !== 'dispatching') return initial?.value;
+  const initialCanFinish = Boolean(initial && (
+    initial.value.status === 'dispatching'
+    || (input.ok && initial.value.status === 'blocked' && controllerRoundBlockerClass(initial.value) === 'provider_dispatch_outcome_unknown')
+  ));
+  if (!initial || !initialCanFinish) return initial?.value;
   return relayLock(options, initial.value.relayScopeId, `controller-relay-finish:${input.workId}`, () => {
     const current = readRelayRecord(options, input.workId);
-    if (!current || current.value.status !== 'dispatching') return current?.value;
+    const currentCanFinish = Boolean(current && (
+      current.value.status === 'dispatching'
+      || (input.ok && current.value.status === 'blocked' && controllerRoundBlockerClass(current.value) === 'provider_dispatch_outcome_unknown')
+    ));
+    if (!current || !currentCanFinish) return current?.value;
     const at = typeof input.nowMs === 'number' ? new Date(input.nowMs).toISOString() : nowIso(options);
     const handoffId = bounded(input.handoffId, 200);
     if (input.waitForUser) {
@@ -954,7 +1294,8 @@ export function finishControllerRoundRelayDispatch(
           ? 'CONTROLLER_RELAY_RECOVERY_FAILED'
           : 'CONTROLLER_RELAY_DISPATCH_FAILED');
     const providerDispatchEffectId = bounded(input.providerDispatchEffectId, 500)
-      ?? (current.value.authorityId ? controllerRoundProviderEffectId(current.value.relayScopeId, current.value.authorityId) : undefined);
+      ?? current.value.providerDispatchEffectId
+      ?? controllerRoundProviderEffectId(current.value);
     let event: ControllerRoundTransitionEvent;
     if (input.ok) {
       if (!providerDispatchEffectId) throw new Error('CONTROLLER_RELAY_PROVIDER_EFFECT_ID_REQUIRED');
@@ -974,6 +1315,92 @@ export function finishControllerRoundRelayDispatch(
   });
 }
 
+export interface ClaimControllerRoundSessionInput {
+  workId: string;
+  relayWorkId: string;
+  sessionClaim: ControllerSessionClaimInput & { principalId: string; controllerInstanceId: string };
+  assistantContextSnapshot?: AssistantContextSnapshot | null;
+  allowUserResume?: boolean;
+}
+
+/**
+ * Atomically claim one relay-bound Work. Relay claimability is rechecked inside
+ * the same BEGIN IMMEDIATE transaction that persists ControllerSession ownership.
+ * A Requirement-scope inherited relay is fenced but not rewritten for a sibling Work.
+ */
+export function claimControllerRoundSession(
+  options: ControllerRoundRelayStoreOptions,
+  input: ClaimControllerRoundSessionInput,
+): { session: ClaimedControllerSession; relay?: ControllerRoundRelayRecord } {
+  const relayWorkId = input.relayWorkId.trim();
+  const initial = readRelayRecord(options, relayWorkId);
+  if (!initial) throw new Error(`CONTROLLER_RELAY_ROUND_NOT_OPEN: ${relayWorkId}`);
+  return relayLock(options, initial.value.relayScopeId, `controller-relay-session-claim:${input.sessionClaim.controllerId}`, () => {
+    const lockedRelay = readRelayRecord(options, relayWorkId);
+    if (!lockedRelay || !controllerRoundRelayClaimable(lockedRelay.value, { allowUserResume: input.allowUserResume })) {
+      throw new Error(`CONTROLLER_RELAY_CLAIM_STATE_INVALID:${lockedRelay?.value.status ?? 'missing'}`);
+    }
+    const repeatedStateFingerprint = controllerRoundBlockerClass(lockedRelay.value) === 'repeated_state'
+      ? (() => {
+          const work = getWorkContract(options, input.workId);
+          if (!work) throw new Error(`WORK_CONTROLLER_CONTEXT_MISSING: ${input.workId}`);
+          return mechanicalStateFingerprint(options, work, lockedRelay.value.requirementId, lockedRelay.value.relayScopeId, lockedRelay.value.handoffId);
+        })()
+      : undefined;
+    return withControllerSessionMutationLock(options, input.workId, `controller-relay-session-claim:${input.sessionClaim.controllerId}`, () => {
+      assertControllerSessionWorkClaimable(options, input.workId);
+      return withControlPlaneTransaction(options.controllerHome, (database) => {
+        const current = readControlPlaneRecordWithinTransaction<ControllerRoundRelayRecord>(
+          database, NAMESPACE, options.repoId, relayWorkId,
+        );
+        if (!current || !controllerRoundRelayClaimable(current.value, { allowUserResume: input.allowUserResume })) {
+          throw new Error(`CONTROLLER_RELAY_CLAIM_STATE_INVALID:${current?.value.status ?? 'missing'}`);
+        }
+        if (input.sessionClaim.controllerType !== relayControllerType(current.value)) {
+          throw new Error(`CONTROLLER_RELAY_CONTROLLER_TYPE_MISMATCH: ${input.workId}`);
+        }
+        const session = resumeControllerSessionWithinTransaction(database, options, input.sessionClaim);
+        if (relayWorkId !== input.workId) return { session };
+
+        const at = nowIso(options);
+        const blocker = controllerRoundBlockerClass(current.value);
+        const event: ControllerRoundTransitionEvent = blocker === 'repeated_state'
+          ? {
+              type: 'semantic_state_changed', at,
+              stateFingerprint: repeatedStateFingerprint!, session,
+              principalId: input.sessionClaim.principalId,
+              controllerInstanceId: input.sessionClaim.controllerInstanceId,
+            }
+          : {
+              type: 'controller_claim_observed', at, session,
+              principalId: input.sessionClaim.principalId,
+              controllerInstanceId: input.sessionClaim.controllerInstanceId,
+              ...(input.allowUserResume ? { userResume: true } : {}),
+            };
+        const decided = transitionDecisionOrThrow(decideControllerRoundTransition(current.value, event));
+        let next = decided.record;
+        const requested = input.assistantContextSnapshot;
+        if (requested !== undefined && !sameAssistantContextSnapshot(next.assistantContextSnapshot, requested)) {
+          if (next.assistantContextSnapshot) throw new Error(`CONTROLLER_ASSISTANT_CONTEXT_CLAIM_MISMATCH: ${input.workId}`);
+          if (requested !== null) next = { ...next, assistantContextSnapshot: requested, updatedAt: at };
+        }
+        if (decided.changed || next !== decided.record) {
+          writeControlPlaneRecordWithinTransaction(database, {
+            namespace: NAMESPACE,
+            scope: options.repoId,
+            key: relayWorkId,
+            schemaVersion: SCHEMA_VERSION,
+            value: next,
+            action: decided.action ?? 'controller_round_relay_claim_acknowledged',
+            expectedRevision: current.revision,
+          });
+        }
+        return { session, relay: next };
+      });
+    });
+  });
+}
+
 export function acknowledgeControllerRoundClaim(
   options: ControllerRoundRelayStoreOptions,
   input: { workId: string; session: ControllerSession; assistantContextSnapshot?: AssistantContextSnapshot | null },
@@ -993,10 +1420,7 @@ export function acknowledgeControllerRoundClaim(
       && sameAssistantContextSnapshot(current.value.assistantContextSnapshot, input.assistantContextSnapshot)) return current.value;
 
     const blocker = controllerRoundBlockerClass(current.value);
-    const policyClaimable = ['dispatching', 'dispatched', 'claimed'].includes(current.value.status)
-      || blocker === 'provider_dispatch_outcome_unknown'
-      || blocker === 'repeated_state';
-    if (!policyClaimable) return current.value;
+    if (!controllerRoundRelayClaimable(current.value)) return current.value;
 
     const owner = getControllerSession(options, input.workId);
     const ownerPrincipal = owner?.principalId?.trim() || owner?.controllerId;
@@ -1024,8 +1448,8 @@ export function acknowledgeControllerRoundClaim(
 
     if (blocker === 'repeated_state') {
       const work = getWorkContract(options, input.workId);
-      if (!work || isTerminalWorkContractStatus(work.status)) return current.value;
-      const stateFingerprint = mechanicalStateFingerprint(options, work, current.value.requirementId, current.value.relayScopeId);
+      if (!work || semanticWorkState(work) !== 'open') return current.value;
+      const stateFingerprint = mechanicalStateFingerprint(options, work, current.value.requirementId, current.value.relayScopeId, current.value.handoffId);
       const transitioned = applyControllerRoundTransition(options, current, {
         type: 'semantic_state_changed', at, stateFingerprint, session, principalId: ownerPrincipal!, controllerInstanceId,
       });
@@ -1058,8 +1482,8 @@ export function recoverControllerRoundRelayAuthority(
   }
   const work = getWorkContract(options, workId);
   if (!work) throw new Error(`WORK_NOT_FOUND: ${workId}`);
-  if (isTerminalWorkContractStatus(work.status)) {
-    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${work.status}`);
+  if (semanticWorkState(work) !== 'open') {
+    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${semanticWorkState(work)}`);
   }
   const initial = readRelayRecord(options, workId);
   if (!initial) throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_RELAY_REQUIRED: ${workId}`);
@@ -1070,8 +1494,14 @@ export function recoverControllerRoundRelayAuthority(
   if (initial.value.controllerId !== input.identity.controllerId || initial.value.principalId !== input.identity.principalId) {
     throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_PRINCIPAL_MISMATCH: ${workId}`);
   }
-  const recoverableStatuses: readonly ControllerRoundRelayStatus[] = ['pending_release', 'dispatching', 'dispatched', 'claimed', 'failed'];
-  if (!recoverableStatuses.includes(initial.value.status)) {
+  const recoverableStatuses: readonly ControllerRoundRelayStatus[] = ['pending_release', 'dispatching', 'dispatched', 'claimed', 'waiting_for_user', 'failed'];
+  const initialRepeatedStateBlock = initial.value.status === 'blocked' && initial.value.blockedReason?.startsWith('repeated_state:');
+  const initialConsecutiveFailureBlock = controllerRoundBlockerClass(initial.value) === 'consecutive_failures';
+  const initialRecoveryReason = input.recoveryReason?.trim() ?? '';
+  if (initialRepeatedStateBlock && !initialRecoveryReason) {
+    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_REASON_REQUIRED: ${workId}; repeated-state recovery must state why the bounded recovery is being opened.`);
+  }
+  if (!recoverableStatuses.includes(initial.value.status) && !initialRepeatedStateBlock && !initialConsecutiveFailureBlock) {
     throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_RELAY_STATE_INVALID: ${workId}:${initial.value.status}`);
   }
 
@@ -1082,7 +1512,12 @@ export function recoverControllerRoundRelayAuthority(
     if (!latest || latest.originWorkId !== workId || latest.updatedAt !== current.value.updatedAt) {
       throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_RELAY_NOT_CURRENT: ${workId}`);
     }
-    if (!recoverableStatuses.includes(current.value.status)) {
+    const currentRepeatedStateBlock = current.value.status === 'blocked' && current.value.blockedReason?.startsWith('repeated_state:');
+    const currentConsecutiveFailureBlock = controllerRoundBlockerClass(current.value) === 'consecutive_failures';
+    if (currentRepeatedStateBlock && !initialRecoveryReason) {
+      throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_REASON_REQUIRED: ${workId}; repeated-state recovery must state why the bounded recovery is being opened.`);
+    }
+    if (!recoverableStatuses.includes(current.value.status) && !currentRepeatedStateBlock && !currentConsecutiveFailureBlock) {
       throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_RELAY_STATE_INVALID: ${workId}:${current.value.status}`);
     }
     if (relayControllerType(current.value) !== input.identity.controllerType
@@ -1092,20 +1527,86 @@ export function recoverControllerRoundRelayAuthority(
     }
     const currentWork = getWorkContract(options, workId);
     if (!currentWork) throw new Error(`WORK_NOT_FOUND: ${workId}`);
-    if (isTerminalWorkContractStatus(currentWork.status)) {
-      throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${currentWork.status}`);
+    if (semanticWorkState(currentWork) !== 'open') {
+      throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${semanticWorkState(currentWork)}`);
     }
-    const activeWorks = relevantWork(options, current.value).filter((entry) => !isTerminalWorkContractStatus(entry.status));
+    const activeWorks = recoveryFenceWork(options, current.value).filter((entry) => semanticWorkState(entry) === 'open');
     if (activeWorks.some((entry) => workHasActiveExecution(options.controllerHome, options.repoId, entry.workId))) {
       throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_ACTIVE_EXECUTION: ${workId}`);
     }
-    if (activeWorks.some((entry) => Boolean(getControllerSession(options, entry.workId)))) {
+    const claimedWorks = activeWorks
+      .map((entry) => ({ work: entry, owner: getControllerSession(options, entry.workId) }))
+      .filter((entry): entry is typeof entry & { owner: NonNullable<typeof entry.owner> } => Boolean(entry.owner));
+    if (claimedWorks.some((entry) => entry.work.workId !== workId)) {
+      throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_ACTIVE_CLAIM: ${workId}`);
+    }
+    const currentOwner = claimedWorks.find((entry) => entry.work.workId === workId)?.owner;
+    if (currentConsecutiveFailureBlock && currentOwner) {
       throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_ACTIVE_CLAIM: ${workId}`);
     }
+    if (currentOwner) {
+      const ownerPrincipal = controllerSessionPrincipalId(currentOwner);
+      const ownerInstanceId = currentOwner.controllerInstanceId?.trim() || '';
+      const samePrincipalOwner = currentOwner.controllerId === input.identity.controllerId
+        && currentOwner.controllerType === input.identity.controllerType
+        && ownerPrincipal === input.identity.principalId;
+      const sameRuntimeOwner = ownerInstanceId === input.identity.controllerInstanceId;
+      const canonicalRuntimeMigration = input.allowCanonicalRuntimeMigration === true
+        && ownerInstanceId !== input.identity.controllerInstanceId;
+      if (!samePrincipalOwner || (!sameRuntimeOwner && !canonicalRuntimeMigration)) {
+        throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_ACTIVE_CLAIM: ${workId}`);
+      }
+      const released = releaseObservedControllerSession(options, {
+        workId,
+        actor: `controller-relay-explicit-authority-recovery:${workId}`,
+        owner: currentOwner,
+      });
+      if (!released.allowed) {
+        throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_ACTIVE_CLAIM: ${workId}:${released.reason}`);
+      }
+    }
 
     return applyControllerRoundTransition(options, current, {
       type: 'authority_recovery_requested', at: nowIso(options), proposedAuthorityId: newControllerRoundAuthorityId(),
       keepsConfirmedDispatch: current.value.status === 'dispatched',
+      preserveBlockedState: currentConsecutiveFailureBlock,
+      preserveWaitingForUserState: current.value.status === 'waiting_for_user',
+      ...(initialRecoveryReason ? { reason: initialRecoveryReason } : {}),
+    });
+  });
+}
+
+export interface RetryFailedControllerRoundProviderDispatchInput {
+  workId: string;
+  relayScopeId: string;
+  authorityId: string;
+  expectedUpdatedAt: string;
+  occurrenceId?: string;
+}
+
+/** Retry one known, non-ambiguous provider failure without creating a new semantic round or authority. */
+export function retryFailedControllerRoundProviderDispatch(
+  options: ControllerRoundRelayStoreOptions,
+  input: RetryFailedControllerRoundProviderDispatchInput,
+): ControllerRoundRelayRecord {
+  const workId = input.workId.trim();
+  const initial = readRelayRecord(options, workId);
+  if (!initial) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_RELAY_REQUIRED:${workId}`);
+  if (initial.value.relayScopeId !== input.relayScopeId.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_SCOPE_MISMATCH:${workId}`);
+  return relayLock(options, initial.value.relayScopeId, `controller-relay-provider-retry:${workId}`, () => {
+    const current = readRelayRecord(options, workId);
+    if (!current) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_RELAY_REQUIRED:${workId}`);
+    if (current.value.updatedAt !== input.expectedUpdatedAt.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_STALE:${workId}`);
+    if (current.value.relayScopeId !== input.relayScopeId.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_SCOPE_MISMATCH:${workId}`);
+    if ((current.value.authorityId?.trim() || '') !== input.authorityId.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_AUTHORITY_MISMATCH:${workId}`);
+    const work = getWorkContract(options, workId);
+    if (!work || semanticWorkState(work) !== 'open') throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_WORK_TERMINAL:${workId}:${work ? semanticWorkState(work) : 'missing'}`);
+    const requirement = requirementForRelay(options, current.value.requirementId);
+    if (requirement && !['planned', 'active'].includes(requirement.state)) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_REQUIREMENT_TERMINAL:${requirement.state}`);
+    if (workHasActiveExecution(options.controllerHome, options.repoId, workId)) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_ACTIVE_EXECUTION:${workId}`);
+    if (getControllerSession(options, workId)) throw new Error(`CONTROLLER_RELAY_PROVIDER_RETRY_ACTIVE_CLAIM:${workId}`);
+    return applyControllerRoundTransition(options, current, {
+      type: 'provider_retry_requested', at: nowIso(options), occurrenceId: input.occurrenceId?.trim() || undefined,
     });
   });
 }
@@ -1127,6 +1628,51 @@ export interface BindLegacyControllerRoundOccurrenceInput {
   identity: Pick<ControllerRoundRelayIdentity, 'controllerId' | 'controllerType' | 'principalId'>;
 }
 
+export interface RearmControllerRoundAfterProviderUserActionInput {
+  workId: string;
+  handoffId: string;
+  /** Compatibility fence for explicit callers; automatic Handoff resolution reads durable authority internally. */
+  authorityId?: string;
+  /** Compatibility CAS for explicit callers; automatic Handoff resolution validates current state under the relay lock. */
+  expectedUpdatedAt?: string;
+  /** Compatibility override only. Omit to preserve the existing semantic occurrence identity. */
+  occurrenceId?: string;
+}
+
+/** Rearm the same provider dispatch responsibility only after its exact user-action Handoff is resolved. */
+export function rearmControllerRoundAfterProviderUserAction(
+  options: ControllerRoundRelayStoreOptions,
+  input: RearmControllerRoundAfterProviderUserActionInput,
+): ControllerRoundRelayRecord {
+  const workId = input.workId.trim();
+  const initial = readRelayRecord(options, workId);
+  if (!initial) throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_RELAY_REQUIRED: ${workId}`);
+  return relayLock(options, initial.value.relayScopeId, `controller-relay-provider-user-action-resolved:${workId}`, () => {
+    const current = readRelayRecord(options, workId);
+    if (!current) throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_RELAY_REQUIRED: ${workId}`);
+    if (input.expectedUpdatedAt?.trim() && current.value.updatedAt !== input.expectedUpdatedAt.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_STALE: ${workId}`);
+    if (input.authorityId?.trim() && (current.value.authorityId?.trim() || '') !== input.authorityId.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_AUTHORITY_MISMATCH: ${workId}`);
+    if (controllerRoundBlockerClass(current.value) !== 'provider_user_action_required') throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_BLOCKER_MISMATCH: ${workId}`);
+    const handoffId = bounded(input.handoffId, 200);
+    if (!handoffId || current.value.handoffId !== handoffId) throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_HANDOFF_MISMATCH: ${workId}`);
+    const handoff = getHandoffItem(options, handoffId);
+    if (!handoff) throw new Error(`HANDOFF_NOT_FOUND: ${handoffId}`);
+    if (handoff.workId && handoff.workId !== workId) throw new Error(`CONTROLLER_RELAY_HANDOFF_WORK_MISMATCH: ${handoffId}`);
+    if (handoff.status !== 'resolved') throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_HANDOFF_NOT_RESOLVED: ${handoff.status}`);
+    const requestedOccurrenceId = bounded(input.occurrenceId, 240);
+    if (requestedOccurrenceId && current.value.occurrenceId && requestedOccurrenceId !== current.value.occurrenceId) {
+      throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_OCCURRENCE_MISMATCH: ${workId}`);
+    }
+    const occurrenceId = requestedOccurrenceId ?? current.value.occurrenceId;
+    if (!occurrenceId) throw new Error('CONTROLLER_RELAY_OCCURRENCE_ID_REQUIRED');
+    const work = getWorkContract(options, workId);
+    if (!work || semanticWorkState(work) !== 'open') throw new Error(`CONTROLLER_RELAY_PROVIDER_USER_ACTION_WORK_TERMINAL: ${workId}:${work ? semanticWorkState(work) : 'missing'}`);
+    return applyControllerRoundTransition(options, current, {
+      type: 'provider_user_action_resolved', at: nowIso(options), handoffId, occurrenceId,
+    });
+  });
+}
+
 /** Exact evidence-gated provider/environment recovery for one exhausted same-round dispatch responsibility. */
 export function rearmControllerRoundAfterProviderRecovery(
   options: ControllerRoundRelayStoreOptions,
@@ -1144,10 +1690,10 @@ export function rearmControllerRoundAfterProviderRecovery(
     if ((current.value.authorityId?.trim() || '') !== input.authorityId.trim()) throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_AUTHORITY_MISMATCH: ${workId}`);
     if (controllerRoundBlockerClass(current.value) !== 'consecutive_failures') throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_BLOCKER_MISMATCH: ${workId}`);
     const work = getWorkContract(options, workId);
-    if (!work || isTerminalWorkContractStatus(work.status)) throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_WORK_TERMINAL: ${workId}:${work?.status ?? 'missing'}`);
+    if (!work || semanticWorkState(work) !== 'open') throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_WORK_TERMINAL: ${workId}:${work ? semanticWorkState(work) : 'missing'}`);
     const requirement = requirementForRelay(options, current.value.requirementId);
     if (requirement && !['planned', 'active'].includes(requirement.state)) throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_REQUIREMENT_TERMINAL: ${requirement.state}`);
-    const activeWorks = relevantWork(options, current.value).filter((entry) => !isTerminalWorkContractStatus(entry.status));
+    const activeWorks = recoveryFenceWork(options, current.value).filter((entry) => semanticWorkState(entry) === 'open');
     if (activeWorks.some((entry) => workHasActiveExecution(options.controllerHome, options.repoId, entry.workId))) throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_ACTIVE_EXECUTION: ${workId}`);
     if (activeWorks.some((entry) => Boolean(getControllerSession(options, entry.workId)))) throw new Error(`CONTROLLER_RELAY_PROVIDER_RECOVERY_ACTIVE_CLAIM: ${workId}`);
     const evidenceId = bounded(input.evidenceId, 500);
@@ -1189,7 +1735,7 @@ export function bindLegacyControllerRoundOccurrence(
       throw new Error(`CONTROLLER_RELAY_LEGACY_OCCURRENCE_CONTROLLER_MISMATCH: ${workId}`);
     }
     const work = getWorkContract(options, workId);
-    if (!work || isTerminalWorkContractStatus(work.status)) throw new Error(`CONTROLLER_RELAY_LEGACY_OCCURRENCE_WORK_TERMINAL: ${workId}:${work?.status ?? 'missing'}`);
+    if (!work || semanticWorkState(work) !== 'open') throw new Error(`CONTROLLER_RELAY_LEGACY_OCCURRENCE_WORK_TERMINAL: ${workId}:${work ? semanticWorkState(work) : 'missing'}`);
     const requirement = requirementForRelay(options, current.value.requirementId);
     if (requirement && !['planned', 'active'].includes(requirement.state)) throw new Error(`CONTROLLER_RELAY_LEGACY_OCCURRENCE_REQUIREMENT_TERMINAL: ${requirement.state}`);
     return applyControllerRoundTransition(options, current, { type: 'legacy_occurrence_bound', at: nowIso(options), occurrenceId });
@@ -1204,6 +1750,20 @@ export function claimStalledControllerRoundRelays(
   const graceMs = Math.max(60_000, Math.min(input.graceMs ?? DEFAULT_UNCLOSED_ROUND_GRACE_MS, MAX_UNCLOSED_ROUND_GRACE_MS));
   const limit = Math.max(1, Math.min(Math.trunc(input.limit ?? 2), 16));
   const claimed: ControllerRoundRelayRecord[] = [];
+  // A recovery pass evaluates many relay candidates for the same repository.
+  // Work contracts are immutable for this read phase, so share one snapshot
+  // across candidates. The locked transition below still refreshes the Work
+  // snapshot before deriving the durable recovery decision.
+  let scanWorkContracts: readonly WorkContract[] | undefined;
+  let scanActiveWorkSnapshot: ReturnType<typeof readActiveWorkCandidates> | undefined;
+  const activeWorkSnapshotForScan = (): ReturnType<typeof readActiveWorkCandidates> => {
+    scanActiveWorkSnapshot ??= readActiveWorkCandidates({ controllerHome: options.controllerHome, repoId: options.repoId, limit: 1_000 });
+    return scanActiveWorkSnapshot;
+  };
+  const workSnapshotForScan = (): readonly WorkContract[] => {
+    scanWorkContracts ??= readWorkContractStore({ controllerHome: options.controllerHome, repoId: options.repoId }).contracts;
+    return scanWorkContracts;
+  };
 
   for (const candidate of latestRelayRecordsByScope(options)) {
     if (claimed.length >= limit) break;
@@ -1219,14 +1779,15 @@ export function claimStalledControllerRoundRelays(
     }
     const requirement = requirementForRelay(options, candidate.requirementId);
     if (requirement && !['planned', 'active'].includes(requirement.state)) continue;
-    const candidateWorks = relevantWork(options, candidate);
-    const activeCandidateWorks = candidateWorks.filter((work) => !isTerminalWorkContractStatus(work.status));
+    if (!relayMayHaveActiveWork(options, candidate, activeWorkSnapshotForScan())) continue;
+    const candidateWorks = recoveryFenceWork(options, candidate, workSnapshotForScan());
+    const activeCandidateWorks = candidateWorks.filter((work) => semanticWorkState(work) === 'open');
     if (activeCandidateWorks.length === 0) continue;
     if (activeCandidateWorks.some((work) => workHasActiveExecution(options.controllerHome, options.repoId, work.workId) || controllerSessionBlocksRecovery(options, work.workId, { nowMs, graceMs }))) continue;
     if (repeatedStateBlocked) {
       const fingerprintWork = activeCandidateWorks[0] ?? getWorkContract(options, candidate.originWorkId);
       const currentFingerprint = fingerprintWork
-        ? mechanicalStateFingerprint(options, fingerprintWork, candidate.requirementId, candidate.relayScopeId)
+        ? mechanicalStateFingerprint(options, fingerprintWork, candidate.requirementId, candidate.relayScopeId, candidate.handoffId)
         : candidate.stateFingerprint;
       if (currentFingerprint === candidate.stateFingerprint) continue;
     }
@@ -1246,16 +1807,35 @@ export function claimStalledControllerRoundRelays(
       }
       const latestRequirement = requirementForRelay(options, latest.requirementId);
       if (latestRequirement && !['planned', 'active'].includes(latestRequirement.state)) return undefined;
-      const works = relevantWork(options, latest);
-      const activeWorks = works.filter((work) => !isTerminalWorkContractStatus(work.status));
+      const lockedWorkContracts = readWorkContractStore({ controllerHome: options.controllerHome, repoId: options.repoId }).contracts;
+      const works = recoveryFenceWork(options, latest, lockedWorkContracts);
+      const activeWorks = works.filter((work) => semanticWorkState(work) === 'open');
       if (activeWorks.length === 0) return undefined;
       if (activeWorks.some((work) => workHasActiveExecution(options.controllerHome, options.repoId, work.workId) || controllerSessionBlocksRecovery(options, work.workId, { nowMs, graceMs }))) return undefined;
 
+      // A claimed ControllerRound may become recoverable after its execution
+      // activity grace expires while the durable owner lease itself is still
+      // unexpired. Never rotate the opaque per-round capability while leaving
+      // that old owner authoritative: doing so makes release/recovery mutually
+      // inaccessible. Fence the exact observed stale owner first. A crash after
+      // this release but before relay transition is safe and retryable because
+      // the old relay authority remains unchanged and no stale writer survives.
+      for (const work of activeWorks) {
+        const staleOwner = getControllerSession(options, work.workId);
+        if (!staleOwner) continue;
+        const released = releaseObservedControllerSession(options, {
+          workId: work.workId,
+          actor: `controller-relay-stalled-recovery:${latest.originWorkId}`,
+          owner: staleOwner,
+        });
+        if (!released.allowed) return undefined;
+      }
+
       const currentRecord = readRelayRecord(options, latest.originWorkId);
       if (!currentRecord || currentRecord.value.updatedAt !== latest.updatedAt || currentRecord.value.status !== latest.status) return undefined;
       const fingerprintWork = activeWorks[0] ?? getWorkContract(options, latest.originWorkId);
       const stateFingerprint = fingerprintWork
-        ? mechanicalStateFingerprint(options, fingerprintWork, latest.requirementId, latest.relayScopeId)
+        ? mechanicalStateFingerprint(options, fingerprintWork, latest.requirementId, latest.relayScopeId, latest.handoffId, lockedWorkContracts)
         : latest.stateFingerprint;
       const at = new Date(nowMs).toISOString();
       const lastError = latestRepeatedStateBlocked
@@ -1267,6 +1847,15 @@ export function claimStalledControllerRoundRelays(
             : latest.status === 'dispatching'
               ? 'CONTROLLER_RELAY_DISPATCH_TRANSITION_INCOMPLETE'
               : latest.status === 'claimed' ? 'CONTROLLER_RELAY_CLAIMED_ROUND_UNCLOSED' : 'CONTROLLER_RELAY_ROUND_UNCLOSED';
+      if (latest.status === 'dispatching' && latest.providerDispatchStartedAt && latest.providerDispatchEffectId) {
+        applyControllerRoundTransition(options, currentRecord, {
+          type: 'provider_dispatch_outcome_unknown',
+          at,
+          error: 'CONTROLLER_RELAY_PROVIDER_DISPATCH_STALLED_AFTER_EFFECT_START',
+          providerDispatchEffectId: latest.providerDispatchEffectId,
+        });
+        return undefined;
+      }
       const recovered = applyControllerRoundTransition(options, currentRecord, {
         type: 'stalled_round_observed', at, stateFingerprint, proposedAuthorityId: newControllerRoundAuthorityId(),
         ...(lastError ? { lastError } : {}),
@@ -1294,7 +1883,7 @@ export interface ControllerRoundContextSnapshot {
   };
   works: Array<{
     workId: string;
-    status: string;
+    state: string;
     phase: string;
     updatedAt: string;
     objective: string;
@@ -1328,10 +1917,7 @@ export function readControllerRoundContextSnapshot(
   const requirement = requirementForRelay(options, record.requirementId);
   const relevantWorks = relevantWork(options, record);
   const works = relevantWorks.slice(0, 8);
-  const workIds = new Set(relevantWorks.map((work) => work.workId));
-  const handoffs = listHandoffItems({ controllerHome: options.controllerHome, repoId: options.repoId, status: 'active', limit: 100 })
-    .filter((handoff) => !handoff.workId || workIds.has(handoff.workId))
-    .slice(0, 8);
+  const handoffs = relevantHandoffs(options, relevantWorks, record.handoffId).slice(0, 8);
   return {
     repoId: record.repoId,
     relayScopeId: record.relayScopeId,
@@ -1349,7 +1935,7 @@ export function readControllerRoundContextSnapshot(
       const origin = work.workId === record.originWorkId;
       return {
         workId: work.workId,
-        status: work.status,
+        state: semanticWorkState(work),
         phase: work.phase,
         updatedAt: work.updatedAt,
         objective: work.objective.slice(0, origin