@moretea-labs/forge 1.8.0 → 1.8.1

package/src/runtime/control-plane/facade/goal-workloop.ts

@@ -1,89 +1,64 @@
 import { createHash, randomUUID } from 'crypto';
-import { globMatches } from '../../../cli/mcp/paths';
 import {
   createHandoffItem,
-  listHandoffItems,
   type HandoffInboxStoreOptions,
 } from './handoff-inbox-store';
-import { getControllerSession } from '../../../../packages/kernel/controller/api/index';
 import { executionPlacement, readForgeInstanceIdentity } from '../../../../packages/kernel/identity/api/index';
-import { projectAutonomousGoalProgression, type ProgressionWorkSnapshot } from '../../../../packages/kernel/progression/api/index';
 import {
   applyEngineeringBlockerDisposition,
   buildEngineeringBlockerDispositionReceipt,
   buildEngineeringContextReceipt,
   engineeringWorkProfileForRisk,
-  evaluateEngineeringAdmission,
-  appendVerificationRecord,
   appendWorkEvidence,
   appendWorkHandoffRef,
-  cancelWorkContract,
   createWorkContract,
   failWorkContract,
   getWorkContract,
-  isTerminalWorkContractStatus,
+  semanticWorkState,
   listWorkContracts,
   readActiveWorkCandidates,
   recordWorkEvidenceState,
   recordWorkScopeEvidence,
-  recordWorkImplementationReview,
-  requestWorkImplementationReview,
+  reviseWorkSemanticContext,
   summarizeWorkContract,
   transitionWorkContractPhase,
   updateWorkContract,
   type EngineeringAdmissionEvidence,
+  type EvaluationPromotionReceipt,
   type WorkContractStoreOptions,
 } from '../../../../packages/kernel/work/api/index';
 import {
-  claimPlanStepForWork,
-  completePlanStepForWork,
   getPlanContract,
+  currentPlanSemanticRevision,
   type PlanContractStoreOptions,
 } from './plan-contract-store';
 import { withPrimaryWorkAdmissionLock } from './semantic-admission';
-import { completeWorkWithReceipt } from '../execution/work-completion-authority';
-import { effectiveCurrentWorkVerificationRecords, evaluateReadOnlyReviewSourceIdentity, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence } from '../execution/work-evidence-policy';
-import { readRequirement } from '../persistence/requirement-store';
+import { effectiveCurrentWorkVerificationRecords, evaluateWorkCompletionEvidence, evaluateWorkImplementationEvidence } from '../execution/work-evidence-policy';
+import { hasSettledWorkDeliveryReceipt } from '../execution/work-completion-authority';
+import { currentRequirementSemanticRevision, readRequirement } from '../persistence/requirement-store';
 import {
-  classifyVerificationOutcome,
   normalizeCheckIds,
   reconcileVerificationHistory,
   type CheckDefinitionLike,
 } from './check-normalization';
 import { evaluatePolicyGate } from './policy-gate';
-import {
-  assertImplementationReviewPreDeliveryBoundary,
-  authoritativeImplementationReviewVerificationEvidence,
-  implementationReviewChangedPathDigest,
-  latestImplementationReview,
-  normalizeImplementationReviewChangedPaths,
-  workRequiresImplementationReview,
-  type ImplementationReviewDecision,
-  type ImplementationReviewCandidateIdentity,
-  type WorkImplementationReviewFinding,
-  type WorkImplementationReviewRecord,
-} from '../../../../packages/kernel/work/api/index';
 import { buildFacadeResult } from './facade-result';
 import { validateSuggestedNextActions } from './suggested-actions';
 import { buildWorkContinuationSnapshot } from './work-continuation';
 import type {
   CapabilityRisk,
   EvidenceRef,
-  ExecutionModeSelectionInput,
   FacadeResult,
   PlanContract,
   PolicyDecision,
   SuggestedNextAction,
-  VerificationRecord,
   WorkContract,
+  WorkStartFacts,
   WorkKind,
   WorkRisk,
 } from './types';
-import { selectExecutionMode } from './types';
-import { resolveWorkspaceAdmissionConstraint } from '../routing/workspace-admission';
-import { resolveContextPlane, type ContextScope } from '../../context/context-plane';
 
-export type GoalWorkloopOperation = 'start' | 'continue' | 'verify' | 'review' | 'finalize' | 'stop';
+export type GoalWorkloopOperation = 'start' | 'continue' | 'stop';
 
 export interface GoalWorkloopContext {
   workStore: WorkContractStoreOptions;
@@ -125,7 +100,8 @@ export interface GoalWorkloopStartInput {
   forbiddenPaths?: string[];
   checks?: string[];
   constraints?: WorkContract['constraints'];
-  modeInput: ExecutionModeSelectionInput;
+  /** Concrete mechanical request facts. This capability is itself the explicit durable-Work choice. */
+  request: WorkStartFacts;
   requestedBy?: WorkContract['requestedBy'];
   /** Stable durable admission identity for system-originated Work such as recurrent incident repair. */
   requestId?: string;
@@ -136,7 +112,6 @@ export interface GoalWorkloopStartInput {
   issueId?: string;
   approvalConfirmed?: boolean;
   dryRun?: boolean;
-  forceMode?: WorkContract['mode'];
   planId?: string;
   planStepId?: string;
   /** Explicit technical evidence shape chosen by the semantic Controller. Never inferred from objective/check text. */
@@ -170,45 +145,14 @@ export interface GoalWorkloopContinueInput {
   /** Semantic Controller blocker classification; Forge derives the permitted action and persists the receipt. */
   engineeringBlocker?: {
     blockerId: string;
-    classification: 'same_root_cause' | 'unrelated';
+    classification: 'same_root_cause' | 'same_root_cause_scope_extension' | 'unrelated';
     rationale: string;
     semanticScopeKeys?: string[];
+    /** Required for classification=unrelated: the exact Work that already owns the blocker. */
+    linkedWorkId?: string;
   };
 }
 
-export interface GoalWorkloopVerifyInput {
-  workId: string;
-  checkId: string;
-  /** Exact Git revision observed by the authoritative Work-bound verification Process. */
-  sourceRevision?: string;
-  /** Exact dirty-workspace content identity observed by the authoritative check. */
-  workspaceFingerprint?: string;
-  /** Stable semantic check-input identity used for exact evidence reuse. */
-  verificationInputFingerprint?: string;
-  /** Bounded command/invocation audit identity; not part of reusable semantic inputs. */
-  commandFingerprint?: string;
-  /** Persistence-safe Process receipt. Accepted only when its Work/repo/check identity matches this verification. */
-  receipt?: VerificationRecord['receipt'];
-  /** When true, simulate infrastructure failure rather than acceptance fail. */
-  infrastructureFailed?: boolean;
-  /** When true and check is valid, record acceptance failure. */
-  checkFailed?: boolean;
-  /** When true, skip without acceptance implication. */
-  skipped?: boolean;
-}
-
-export interface GoalWorkloopReviewInput {
-  workId: string;
-  decision: ImplementationReviewDecision;
-  rationale: string;
-  findings?: WorkImplementationReviewFinding[];
-}
-
-export interface GoalWorkloopFinalizeInput {
-  workId: string;
-  forceFailed?: boolean;
-}
-
 export interface GoalWorkloopStopInput {
   workId: string;
   reason?: string;
@@ -220,57 +164,6 @@ function nowIso(ctx: GoalWorkloopContext): string {
   return ctx.now?.() ?? new Date().toISOString();
 }
 
-function currentImplementationReviewCandidate(
-  ctx: GoalWorkloopContext,
-  work: WorkContract,
-): ImplementationReviewCandidateIdentity {
-  const sourceRevision = ctx.sourceRevision?.trim() ?? '';
-  const verificationWorkspaceFingerprint = ctx.workspaceFingerprint?.trim() ?? '';
-  const workspaceFingerprint = ctx.implementationReviewWorkspaceFingerprint?.trim() ?? '';
-  const changedPaths = normalizeImplementationReviewChangedPaths(
-    ctx.workspaceChangedPaths ?? work.scopeEvidence?.actualChangedPaths ?? [],
-  );
-  if (!sourceRevision || !verificationWorkspaceFingerprint || !workspaceFingerprint) {
-    throw new Error('WORK_IMPLEMENTATION_REVIEW_SOURCE_IDENTITY_REQUIRED');
-  }
-  const verification = authoritativeImplementationReviewVerificationEvidence({
-    repoId: work.repoId,
-    workId: work.workId,
-    requiredCheckIds: work.checks,
-    records: work.checkRefs,
-    sourceRevision,
-    workspaceFingerprint: verificationWorkspaceFingerprint,
-  });
-  if (verification.missingCheckIds.length > 0) {
-    throw new Error(`WORK_IMPLEMENTATION_REVIEW_VERIFICATION_REQUIRED: ${verification.missingCheckIds.join(', ')}`);
-  }
-  return {
-    sourceRevision,
-    workspaceFingerprint,
-    verificationWorkspaceFingerprint,
-    changedPaths,
-    verificationEvidence: verification.evidence,
-    architectureEvidence: [],
-  };
-}
-
-function implementationReviewAcceptanceSummary(work: WorkContract): string {
-  const summary = work.acceptanceCriteria.map((criterion) => criterion.trim()).filter(Boolean).join(' | ');
-  return (summary || 'No explicit acceptance criteria; reviewer assessed the Work objective and exact current implementation evidence.').slice(0, 2_000);
-}
-
-function implementationReviewSuggestedAction(workId: string): SuggestedNextAction {
-  return {
-    label: 'Review implementation',
-    tool: 'rh_work',
-    operation: 'review',
-    payload: { work_id: workId },
-    risk: 'workspace_write',
-    confidence: 'high',
-    reason: 'Verification is complete; an explicit Controller implementation decision is required before delivery.',
-  };
-}
-
 function workIdFor(objective: string): string {
   const slug = objective
     .toLowerCase()
@@ -280,71 +173,47 @@ function workIdFor(objective: string): string {
   return `work-${slug}-${randomUUID().slice(0, 8)}`;
 }
 
-function linkedEngineeringBlockerWorkId(parentWorkId: string, blockerId: string): string {
-  const digest = createHash('sha256').update(`${parentWorkId}\0${blockerId.trim()}`).digest('hex').slice(0, 24);
-  return `work-linked-engineering-blocker-${digest}`;
-}
-
 function handoffIdFor(prefix: string): string {
   return `hnd-${prefix}-${randomUUID().slice(0, 8)}`;
 }
 
 function workRiskFor(input: GoalWorkloopStartInput): WorkRisk {
   if (input.workKind === 'read_only_review') return 'readonly';
-  const risk = input.modeInput.risk;
-  if (input.modeInput.secretAccess === true || input.modeInput.destructive === true) return 'destructive';
-  if (input.modeInput.remoteWrite === true) return 'high';
+  const risk = input.request.risk;
+  if (input.request.secretAccess === true || input.request.destructive === true) return 'destructive';
+  if (input.request.remoteWrite === true) return 'high';
   if (risk === 'readonly') return 'readonly';
   if (risk === 'destructive' || risk === 'destructive_remote' || risk === 'raw_secret_config') return 'destructive';
   if (risk === 'remote_write') return 'high';
   if (risk === 'local_repo_write') return 'low';
+  if (risk === undefined) return 'low';
   return 'medium';
 }
 
 function resolvedWorkKindFor(input: GoalWorkloopStartInput): WorkKind {
   if (input.workKind) return input.workKind;
-  // allowed_paths and discovery hints do not prove repository mutation. External
-  // effects become repository_change only when source-change intent is explicit.
-  const repositoryChangeIntent = (input.modeInput.expectedFiles ?? 0) > 0
-    || (input.modeInput.expectedChangedLines ?? 0) > 0;
-  const typedRecoverableReadOnlyReview = input.modeInput.mutation === false
-    && input.modeInput.requiresInvestigation === true
-    && input.modeInput.requiresRecovery === true;
-  if (typedRecoverableReadOnlyReview) return 'read_only_review';
-  if (input.modeInput.requiresExternalEffect === true && !repositoryChangeIntent) {
-    return input.modeInput.remoteWrite === true ? 'remote_effect' : 'local_effect';
+  if (input.request.requiresExternalEffect === true) {
+    // Mechanical effect classification only: a remote effect differs from a local
+    // effect in receipt identity. Predicted scope size is model strategy and is
+    // never consulted; callers declare `work_kind` when a repository change is
+    // also involved.
+    return input.request.remoteWrite === true ? 'remote_effect' : 'local_effect';
   }
   return 'repository_change';
 }
 
 function suggestedForWorkIdentity(workId: string, checks: string[], extras: SuggestedNextAction[] = []): SuggestedNextAction[] {
-  const base: SuggestedNextAction[] = [
-    {
-      label: 'Continue workloop',
-      tool: 'rh_work',
-      operation: 'continue',
-      payload: { work_id: workId },
-      risk: 'readonly',
-      confidence: 'high',
-    },
-    {
-      label: 'Verify registered checks',
-      tool: 'rh_work',
-      operation: 'verify',
-      payload: { work_id: workId, check_id: checks[0] },
-      risk: 'workspace_write',
-      confidence: checks[0] ? 'high' : 'low',
-    },
-    {
-      label: 'Finalize when ready',
-      tool: 'rh_work',
-      operation: 'finalize',
-      payload: { work_id: workId },
-      risk: 'readonly',
-      confidence: 'medium',
-    },
-  ];
-  return validateSuggestedNextActions([...extras, ...base], {
+  const semanticRead: SuggestedNextAction = {
+    label: 'Read current Work semantic context',
+    tool: 'rh_work',
+    operation: 'get',
+    payload: { work_id: workId },
+    risk: 'readonly',
+    confidence: 'high',
+  };
+  // Suggested actions expose facts/capabilities only. The model decides whether
+  // implementation, checks, review, delivery, or semantic completion is next.
+  return validateSuggestedNextActions([...extras, semanticRead], {
     validCheckIds: checks,
   }).actions;
 }
@@ -369,21 +238,10 @@ export function routeWorkStart(
   ctx: GoalWorkloopContext,
   input: GoalWorkloopStartInput,
 ): FacadeResult {
-  const placementResolution = resolveWorkspaceAdmissionConstraint(input.constraints);
-  if (placementResolution.ok === false) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `${placementResolution.code}: ${placementResolution.message}`,
-      data: { executionStarted: false, workContractCreated: false, placementConstraintConflict: true },
-      rawAvailable: false,
-    });
-  }
-  const placementConstraint = placementResolution.constraint;
+  const workspaceMode: 'current' | 'isolated' = input.constraints?.workspaceMode === 'isolated' || input.constraints?.workspaceMode === 'auto' ? 'isolated' : 'current';
   const canonicalConstraints: WorkContract['constraints'] = {
     ...(input.constraints ?? {}),
-    workspaceMode: placementConstraint.workspaceMode,
-    requireWorktree: placementConstraint.requireWorktree,
-    directMainProhibited: placementConstraint.directMainProhibited,
+    workspaceMode,
   };
   const strategyConflictRequiresApproval = input.constraints?.architectureStrategyChange === true
     || input.constraints?.conflictsWithThinHarnessPolicy === true
@@ -409,7 +267,7 @@ export function routeWorkStart(
     input.workKind === undefined
     && input.workRelation === 'new_goal'
     && relatedLifecycleSource?.workKind === 'read_only_review'
-    && (relatedLifecycleSource.status === 'cancelled' || relatedLifecycleSource.status === 'completed' || relatedLifecycleSource.status === 'failed'),
+    && semanticWorkState(relatedLifecycleSource) !== 'open',
   );
   if (
     inheritedReadOnlyReview
@@ -430,24 +288,17 @@ export function routeWorkStart(
       const normalized = value.trim().replace(/\\/g, '/');
       return normalized === '*' || normalized === '**' || normalized === '**/*';
     });
-  const typedReadOnlyReviewRequested = requestedWorkKind === undefined
-    && (
-      explicitSourceMutationFence
-      || (
-        (input.modeInput.mutation === false || (input.modeInput.mutation === undefined && input.modeInput.risk === 'readonly'))
-        && input.modeInput.requiresInvestigation === true
-        && input.modeInput.requiresRecovery === true
-      )
-    );
+  // A read-only review is an explicit `work_kind`, or an explicit source-mutation
+  // fence that proves no repository path may change. Forge never infers it from
+  // caller hints about investigation depth or recovery needs.
+  const typedReadOnlyReviewRequested = requestedWorkKind === undefined && explicitSourceMutationFence;
   const effectiveWorkKind = requestedWorkKind ?? (typedReadOnlyReviewRequested ? 'read_only_review' : undefined);
   const readOnlyReviewRequested = effectiveWorkKind === 'read_only_review';
   const readOnlyMutationConflict = readOnlyReviewRequested && (
-    input.modeInput.mutation === true
-    || (input.modeInput.expectedFiles ?? 0) > 0
-    || (input.modeInput.expectedChangedLines ?? 0) > 0
-    || input.modeInput.requiresExternalEffect === true
-    || input.modeInput.remoteWrite === true
-    || input.modeInput.destructive === true
+    input.request.mutation === true
+    || input.request.requiresExternalEffect === true
+    || input.request.remoteWrite === true
+    || input.request.destructive === true
   );
   if (readOnlyMutationConflict) {
     return buildFacadeResult({
@@ -456,185 +307,49 @@ export function routeWorkStart(
       data: { executionStarted: false, workContractCreated: false, workKind: effectiveWorkKind },
     });
   }
-  const contextScopes: ContextScope[] = [];
-  if (input.requirementId?.trim()) contextScopes.push({ schemaVersion: 1, kind: 'requirement', id: input.requirementId.trim() });
-  if (input.planId?.trim()) contextScopes.push({ schemaVersion: 1, kind: 'plan', id: input.planId.trim() });
-  if (input.relatedWorkId?.trim()) contextScopes.push({ schemaVersion: 1, kind: 'work', id: input.relatedWorkId.trim() });
-  const resolvedContext = ctx.workStore.controllerHome
-    ? resolveContextPlane({
-        controllerHome: ctx.workStore.controllerHome,
-        scopes: contextScopes,
-        intent: input.modeInput.routePolicyInput?.intent.taskIntent ?? 'implementation',
-        now: nowIso(ctx),
-      })
-    : undefined;
   // A terminal continuation is not a new semantic request. Its durable predecessor
   // and Plan lineage already define the goal scope, while the successor Plan step
-  // becomes the Work objective later in startGoalWorkloop. Do not force the external
-  // Controller to duplicate semantic text merely to satisfy generic route selection.
-  // This fallback is routing context only and never becomes successor Work authority.
+  // becomes the Work objective later in startGoalWorkloop.
   const routeObjective = input.objective.trim()
-    || (input.workRelation === 'continue' && relatedLifecycleSource?.status === 'completed'
+    || (input.workRelation === 'continue' && relatedLifecycleSource && semanticWorkState(relatedLifecycleSource) === 'completed'
       ? relatedLifecycleSource.objective.trim()
       : '');
-  const effectiveModeInput: ExecutionModeSelectionInput = {
-    ...input.modeInput,
-    contextRouteHints: input.modeInput.contextRouteHints ?? resolvedContext?.routeHints,
+  const effectiveRequest: WorkStartFacts = {
+    ...input.request,
     objective: routeObjective,
-    knownPaths: input.allowedPaths,
-    workspacePlacement: placementConstraint.workspaceMode,
-    directMainProhibited: placementConstraint.directMainProhibited,
-    workspaceDirty: ctx.workspaceDirty ?? input.modeInput.workspaceDirty,
-    mutation: readOnlyReviewRequested ? false : input.modeInput.mutation ?? input.modeInput.risk !== 'readonly',
-    risk: readOnlyReviewRequested ? 'readonly' : input.modeInput.risk,
+    workspaceDirty: ctx.workspaceDirty ?? input.request.workspaceDirty,
+    mutation: readOnlyReviewRequested ? false : input.request.mutation ?? input.request.risk !== 'readonly',
+    risk: readOnlyReviewRequested ? 'readonly' : input.request.risk,
     approvalConfirmed: input.approvalConfirmed === true,
     requiresUserApproval: input.approvalConfirmed === true
       ? false
-      : input.modeInput.requiresUserApproval === true || strategyConflictRequiresApproval,
+      : input.request.requiresUserApproval === true || strategyConflictRequiresApproval,
   };
-  if (effectiveModeInput.explicitMode === 'scale' && (!input.planId || !input.planStepId || !ctx.planStore)) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: 'SCALE_PLAN_REQUIRED: explicit Scale execution requires a bound approved PlanContract step.',
-      data: { executionStarted: false, workContractCreated: false, planRequired: true, explicitMode: 'scale' },
-    });
-  }
-  const applyForcedMode = (selected: ReturnType<typeof selectExecutionMode>) => input.forceMode
-    ? {
-        ...selected,
-        mode: input.forceMode,
-        reason: `Forced mode: ${input.forceMode}. ${selected.reason}`,
-        createWorkContract: input.forceMode === 'handoff_only' ? false : selected.requiresWork,
-        createHandoff: input.forceMode === 'handoff_only',
-      }
-    : selected;
-  const evaluateAccessPolicy = (selected: ReturnType<typeof selectExecutionMode>) => evaluatePolicyGate({
-    capabilityId: selected.mode === 'direct_control' ? 'repository.direct_edit' : selected.mode === 'goal_workloop' ? 'controller.goal_workloop' : 'controller.handoff_inbox',
-    risk: effectiveModeInput.risk
-      ?? (input.modeInput.secretAccess === true ? 'raw_secret_config'
-        : input.modeInput.destructive === true ? 'destructive'
-          : input.modeInput.remoteWrite === true ? 'remote_write'
-            : input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true ? 'workspace_write'
-              : selected.mode === 'direct_control' ? 'local_repo_write'
-                : selected.mode === 'goal_workloop' ? 'workspace_write'
-                  : 'readonly'),
+  const evaluateAccessPolicy = () => evaluatePolicyGate({
+    capabilityId: 'controller.work_contract',
+    risk: effectiveRequest.risk
+      ?? (input.request.secretAccess === true ? 'raw_secret_config'
+        : input.request.destructive === true ? 'destructive'
+          : input.request.remoteWrite === true ? 'remote_write'
+            : input.request.requiresApproval === true || input.request.requiresUserApproval === true ? 'workspace_write'
+              : 'workspace_write'),
     accessMode: input.constraints?.accessMode,
     approvalConfirmed: input.approvalConfirmed === true,
     dryRun: input.dryRun === true,
-    directEditBoundary: {
-      scopeClear: effectiveModeInput.scopeClear,
-      maxChangedFiles: effectiveModeInput.expectedFiles,
-      maxChangedLines: effectiveModeInput.expectedChangedLines,
-      pathsExplicit: effectiveModeInput.scopeClear,
-    },
   });
+  // Missing mechanical admission fields are reported to the caller verbatim.
+  // Forge does not translate them into an engineering-mode recommendation.
+  const missingContractFields: string[] = [];
+  if (!input.request.scopeClear) missingContractFields.push('scopeSummary', 'acceptanceCriteria', 'allowedPaths');
+  if (input.objective.trim().length === 0) missingContractFields.push('objective');
 
-  let selectedMode = selectExecutionMode(effectiveModeInput);
-  if (input.forceMode === 'direct_control' && selectedMode.routeDecision.requiresIsolation) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: 'WORKSPACE_PLACEMENT_DIRECT_CONTROL_FORBIDDEN: typed placement requires isolation, so force_mode=direct_control cannot override admission policy.',
-      data: { executionStarted: false, workContractCreated: false, routeDecision: selectedMode.routeDecision },
-      rawAvailable: false,
-    });
-  }
-  let policy = evaluateAccessPolicy(selectedMode);
-  if (policy.decision === 'allowed' && effectiveModeInput.requiresUserApproval !== true) {
-    selectedMode = selectExecutionMode({ ...effectiveModeInput, approvalConfirmed: true });
-    policy = evaluateAccessPolicy(selectedMode);
-  }
-  let mode = applyForcedMode(selectedMode);
-  const routeApprovalRequired = mode.routeDecision.requiresApproval
-    && mode.routeDecision.waitForUser
-    && mode.routeDecision.approvalState !== 'blocked_by_policy';
-  const approvalRequired = policy.decision === 'approval_required' || routeApprovalRequired;
-
-  // Route Policy is the sole execution-depth authority. Existing Work is
-  // ownership context, not a reason to upgrade an otherwise Direct operation
-  // into Durable Work. Explicit Work/Plan ownership is resolved only after a
-  // durable route has already been selected; checkout writer conflicts affect
-  // placement, not semantic task identity.
+  const policy = evaluateAccessPolicy();
+  const approvalRequired = policy.decision === 'approval_required';
 
-  if (mode.mode === 'direct_control') {
-    const available = ctx.availableChecks ?? [];
-    const normalized = normalizeCheckIds(input.checks ?? [], available);
-    // Explicit ownership may annotate a Direct operation, but it never changes
-    // the RouteDecision. The actual repository mutation can pass this Work id
-    // to repository_safe_patch_apply / repository_command_execute for evidence
-    // attribution while staying on the Direct/Process path.
-    const directAdmissionSnapshot = input.relatedWorkId || (input.planId && input.planStepId)
-      ? readActiveWorkCandidates({ ...ctx.workStore, limit: 100 })
-      : { contracts: [], invalid: [] };
-    const invalidDirectOwner = directAdmissionSnapshot.invalid.find((candidate) =>
-      candidate.workId === input.relatedWorkId
-      || (input.planId && input.planStepId && candidate.planId === input.planId && candidate.planStepId === input.planStepId));
-    if (invalidDirectOwner) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `WORK_ADMISSION_INVALID_OWNER: ${invalidDirectOwner.workId} is malformed and cannot be used as Direct Control ownership authority.`,
-        data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidDirectOwner.workId, invalidWorkError: invalidDirectOwner.error },
-      });
-    }
-    const directOwnershipCandidates = directAdmissionSnapshot.contracts
-      .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary');
-    const directPlan = input.planId && ctx.planStore ? getPlanContract(ctx.planStore, input.planId) : undefined;
-    const directPlanStep = directPlan && input.planStepId ? directPlan.steps.find((step) => step.id === input.planStepId) : undefined;
-    const directOwner = (input.relatedWorkId
-      ? directOwnershipCandidates.find((candidate) => candidate.workId === input.relatedWorkId)
-      : undefined)
-      ?? (directPlanStep?.workId
-        ? directOwnershipCandidates.find((candidate) => candidate.workId === directPlanStep.workId)
-        : undefined);
-    const suggested = validateSuggestedNextActions([
-      {
-        label: 'Apply bounded direct edit',
-        tool: 'rh_work',
-        operation: 'start',
-        payload: { mode: 'direct_control', objective: input.objective.slice(0, 200) },
-        risk: 'local_repo_write',
-        confidence: 'high',
-        reason: 'Small supervised task stays on Direct Control; no WorkContract created.',
-      },
-      ...normalized.suggestedNextActions,
-      {
-        label: 'Read repository context',
-        tool: 'rh_context',
-        operation: 'get',
-        risk: 'readonly',
-        confidence: 'medium',
-      },
-    ], { validCheckIds: normalized.validCheckIds }).actions;
-
-    return buildFacadeResult({
-      status: policy.decision === 'denied' ? 'blocked' : 'ok',
-      summary: `Direct control recommended. No WorkContract created. ${mode.reason}`,
-      data: {
-        mode,
-        policy,
-        workContractCreated: false,
-        directControlPreserved: true,
-        objective: input.objective.slice(0, 1_000),
-        normalizedChecks: normalized,
-        ...(directOwner ? {
-          ownership: {
-            workId: directOwner.workId,
-            relation: input.workRelation ?? 'continue',
-            executionDepthPreserved: true,
-          },
-        } : {}),
-      },
-      warnings: [...policy.warnings, ...normalized.warnings],
-      suggestedNextActions: suggested,
-      rawAvailable: false,
-    });
-  }
-
-  // Policy approval decisions stop before Work creation. Ordinary host-managed local work
-  // reaches this point only after the same Route Policy has been replayed with the Access
-  // Policy's explicit allowed decision as authorization evidence.
+  // Policy approval decisions stop before Work creation. Ordinary host-managed
+  // local work reaches this point only after the Access Policy authorized it.
   const blockForHandoff =
-    mode.mode === 'handoff_only'
-    || policy.decision === 'denied'
+    policy.decision === 'denied'
     || policy.decision === 'approval_required';
 
   if (blockForHandoff) {
@@ -643,20 +358,19 @@ export function routeWorkStart(
       repoId: ctx.repoId,
       title: 'Work blocked pending decision',
       severity: policy.decision === 'denied' ? 'blocked' : 'needs_review',
-      creationReason: !input.modeInput.scopeClear
+      creationReason: !input.request.scopeClear
         ? 'invalid_objective'
         : approvalRequired
-          ? (input.modeInput.destructive ? 'destructive_action_requires_confirmation' : 'policy_approval_required')
+          ? (input.request.destructive ? 'destructive_action_requires_confirmation' : 'policy_approval_required')
           : 'missing_authorization',
-      reason: mode.reason,
-      summary: `Handoff-only routing: ${mode.reason}`,
+      reason: policy.reason,
+      summary: `Execution blocked by access policy: ${policy.reason}`,
       currentState: {
         repoId: ctx.repoId,
-        mode: 'handoff_only',
         statusSummary: 'waiting for ChatGPT or user decision; no execution started',
-        blockedBy: mode.missingContractFields,
+        blockedBy: missingContractFields,
       },
-      attemptedActions: ['route_execution_mode'],
+      attemptedActions: ['work_start'],
       evidenceRefs: [],
       blockingDecision: approvalRequired
         ? 'Approve side effects or restate a safer objective.'
@@ -669,27 +383,19 @@ export function routeWorkStart(
             operation: 'start',
             label: 'Approve and start work',
             summary: 'Create the work contract with the original scope and explicit approval.',
-            risk: input.modeInput.destructive ? 'destructive' : 'workspace_write',
+            risk: input.request.destructive ? 'destructive' : 'workspace_write',
             payload: {
               objective: input.objective,
               acceptanceCriteria: input.acceptanceCriteria,
               allowedPaths: input.allowedPaths,
               forbiddenPaths: input.forbiddenPaths,
               checkIds: input.checks,
-              expectedFiles: input.modeInput.expectedFiles,
-              expectedChangedLines: input.modeInput.expectedChangedLines,
-              scopeClear: input.modeInput.scopeClear,
-              requiresInvestigation: input.modeInput.requiresInvestigation,
-              requiresLongRunningChecks: input.modeInput.requiresLongRunningChecks,
-              requiresWorker: input.modeInput.requiresWorker,
-              requiresApproval: input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true,
-              destructive: input.modeInput.destructive === true,
+              scopeClear: input.request.scopeClear,
+              requiresApproval: input.request.requiresApproval === true || input.request.requiresUserApproval === true,
+              destructive: input.request.destructive === true,
               accessMode: input.constraints?.accessMode,
-              workspaceMode: placementConstraint.workspaceMode,
-              requireWorktree: placementConstraint.requireWorktree,
-              directMainProhibited: placementConstraint.directMainProhibited,
+              workspaceMode,
               approvalConfirmed: true,
-              forceMode: 'goal_workloop',
             },
           }
         : undefined,
@@ -706,9 +412,8 @@ export function routeWorkStart(
 
     return buildFacadeResult({
       status: policy.decision === 'denied' ? 'blocked' : approvalRequired ? 'approval_required' : 'blocked',
-      summary: `Handoff-only: no WorkContract created and no execution started. ${mode.reason}`,
+      summary: 'Blocked: no WorkContract created and no execution started until the policy decision is resolved.',
       data: {
-        mode,
         policy,
         workContractCreated: false,
         handoffId: handoff.id,
@@ -738,33 +443,20 @@ export function routeWorkStart(
   return startGoalWorkloop(ctx, {
     ...input,
     constraints: canonicalConstraints,
-    modeInput: effectiveModeInput,
+    request: effectiveRequest,
     workKind: effectiveWorkKind,
-  }, policy, 'goal_workloop', mode.routeDecision);
+  }, policy);
 }
 
 export function startGoalWorkloop(
   ctx: GoalWorkloopContext,
   input: GoalWorkloopStartInput,
   policy?: PolicyDecision,
-  executionMode: 'direct_control' | 'goal_workloop' = 'goal_workloop',
-  routeDecision = selectExecutionMode({ ...input.modeInput, objective: input.objective, knownPaths: input.allowedPaths }).routeDecision,
 ): FacadeResult {
-  const placementResolution = resolveWorkspaceAdmissionConstraint(input.constraints);
-  if (placementResolution.ok === false) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `${placementResolution.code}: ${placementResolution.message}`,
-      data: { executionStarted: false, workContractCreated: false, placementConstraintConflict: true },
-      rawAvailable: false,
-    });
-  }
-  const placementConstraint = placementResolution.constraint;
+  const workspaceMode: 'current' | 'isolated' = input.constraints?.workspaceMode === 'isolated' || input.constraints?.workspaceMode === 'auto' ? 'isolated' : 'current';
   const canonicalConstraints: WorkContract['constraints'] = {
     ...(input.constraints ?? {}),
-    workspaceMode: placementConstraint.workspaceMode,
-    requireWorktree: placementConstraint.requireWorktree,
-    directMainProhibited: placementConstraint.directMainProhibited,
+    workspaceMode,
   };
   const hasStrongAdmissionBinding = Boolean(input.planId || input.planStepId || input.requirementId || input.relatedWorkId || input.workRelation);
   if (hasStrongAdmissionBinding && !ctx.semanticAdmissionLocked) {
@@ -772,12 +464,20 @@ export function startGoalWorkloop(
       { ...ctx, semanticAdmissionLocked: true },
       input,
       policy,
-      executionMode,
-      routeDecision,
     ));
   }
   const at = nowIso(ctx);
-  const resolvedWorkKind = resolvedWorkKindFor(input);
+  let resolvedWorkKind: WorkKind;
+  try {
+    resolvedWorkKind = resolvedWorkKindFor(input);
+  } catch (error) {
+    return buildFacadeResult({
+      status: 'blocked',
+      summary: error instanceof Error ? error.message : 'WORK_KIND_RESOLUTION_INVALID',
+      data: { executionStarted: false, workContractCreated: false },
+      rawAvailable: false,
+    });
+  }
   const workRisk = workRiskFor(input);
   // External-effect risk is governed by authorization/confirmation/receipt
   // semantics. Engineering admission is specifically for repository mutation.
@@ -804,27 +504,11 @@ export function startGoalWorkloop(
     });
   }
   const engineeringMutation = resolvedWorkKind === 'repository_change'
-    && (input.modeInput.mutation ?? input.modeInput.risk !== 'readonly');
-  const engineeringAdmission = evaluateEngineeringAdmission({
-    profile: engineeringProfile,
-    receipt: engineeringContext,
-    mutation: engineeringMutation,
-  });
-  if (!engineeringAdmission.allowed) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `${engineeringAdmission.code}: ${engineeringProfile.riskClass} mutation is missing required pre-mutation engineering evidence.`,
-      data: {
-        executionStarted: false,
-        workContractCreated: false,
-        engineeringProfile,
-        engineeringContext,
-        missingEngineeringEvidence: engineeringAdmission.missing,
-      },
-    });
-  }
+    && (input.request.mutation ?? input.request.risk !== 'readonly');
+  // Engineering context is durable model/project guidance only. Safety and
+  // capability admission is enforced by the concrete executor, never here.
+  void engineeringMutation;
   const available = ctx.availableChecks ?? [];
-  const workspaceMode = placementConstraint.workspaceMode;
   const activeAdmissionSnapshot = readActiveWorkCandidates({ ...ctx.workStore, limit: 100 });
   const activeWorks = activeAdmissionSnapshot.contracts
     .filter((candidate) => (candidate.lifecycleRole ?? 'primary') === 'primary');
@@ -841,14 +525,9 @@ export function startGoalWorkloop(
   const relatedLifecycleSource = input.relatedWorkId
     ? getWorkContract(ctx.workStore, input.relatedWorkId)
     : undefined;
-  const workspaceOwner = ctx.checkoutId
-    ? activeWorks.find((candidate) => candidate.checkoutId === ctx.checkoutId
-      && candidate.worktreePolicy.required !== true
-      && !candidate.worktreeRef)
-    : undefined;
   const terminalContinuationSource = input.workRelation === 'continue'
     && relatedLifecycleSource
-    && isTerminalWorkContractStatus(relatedLifecycleSource.status)
+    && semanticWorkState(relatedLifecycleSource) !== 'open'
     ? relatedLifecycleSource
     : undefined;
   if (terminalContinuationSource && !terminalContinuationSource.requirementId && !terminalContinuationSource.planId) {
@@ -863,7 +542,7 @@ export function startGoalWorkloop(
     : undefined;
 
   let resolvedPlanId = input.planId?.trim() || undefined;
-  let resolvedPlanStepId = input.planStepId?.trim() || undefined;
+  const resolvedPlanStepId = input.planStepId?.trim() || undefined;
   if (terminalContinuationSource?.planId) {
     if (resolvedPlanId && resolvedPlanId !== terminalContinuationSource.planId) {
       return buildFacadeResult({
@@ -874,109 +553,25 @@ export function startGoalWorkloop(
     }
     resolvedPlanId = terminalContinuationSource.planId;
   }
+  // Plan and Plan item references are recorded provenance for this Work. They
+  // never select the successor, own the scope, gate admission or require
+  // acceptance; only the Plan's existence is validated so a Work cannot record a
+  // reference to a Plan authority that does not exist.
   const plan = resolvedPlanId && ctx.planStore ? getPlanContract(ctx.planStore, resolvedPlanId) : undefined;
-  if (terminalContinuationSource?.planId && !plan) {
+  if (resolvedPlanId && !plan) {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `WORK_SUCCESSOR_PLAN_NOT_FOUND: ${terminalContinuationSource.planId}. Recover the durable Plan authority before creating a successor Work.`,
-      data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: terminalContinuationSource.planId },
-    });
-  }
-  if (terminalContinuationSource?.planStepId && plan && !resolvedPlanStepId) {
-    const predecessorStep = plan.steps.find((step) => step.id === terminalContinuationSource.planStepId);
-    if (!predecessorStep) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `WORK_SUCCESSOR_PLAN_STEP_NOT_FOUND: predecessor ${terminalContinuationSource.workId} references ${terminalContinuationSource.planStepId}.`,
-        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, predecessorPlanStepId: terminalContinuationSource.planStepId },
-      });
-    }
-    const requirementRecord = plan.requirementId && ctx.workStore.controllerHome
-      ? readRequirement({ controllerHome: ctx.workStore.controllerHome }, plan.requirementId)
-      : undefined;
-    const progressionWorks: ProgressionWorkSnapshot[] = plan.steps
-      .flatMap((candidate) => candidate.workId ? [getWorkContract(ctx.workStore, candidate.workId)] : [])
-      .filter((candidate): candidate is NonNullable<typeof candidate> => Boolean(candidate))
-      .map((candidate) => ({
-        workId: candidate.workId,
-        requirementId: candidate.requirementId,
-        planId: candidate.planId,
-        planStepId: candidate.planStepId,
-        status: candidate.status,
-        baseRevision: candidate.baseRevision,
-        completionTargetRevision: candidate.completionReceipt && 'targetRevision' in candidate.completionReceipt
-          ? candidate.completionReceipt.targetRevision
-          : undefined,
-      }));
-    const progression = projectAutonomousGoalProgression({
-      requirement: {
-        requirementId: plan.requirementId ?? terminalContinuationSource.requirementId ?? `plan:${plan.planId}`,
-        state: requirementRecord?.value.state ?? 'active',
-        revision: requirementRecord?.revision ?? 0,
-      },
-      plan: {
-        planId: plan.planId,
-        requirementId: plan.requirementId,
-        sourceRevision: plan.sourceRevision,
-        status: plan.status,
-        steps: plan.steps.map((candidate) => ({ id: candidate.id, dependencies: candidate.dependencies, status: candidate.status, workId: candidate.workId })),
+      summary: terminalContinuationSource?.planId
+        ? `WORK_SUCCESSOR_PLAN_NOT_FOUND: ${terminalContinuationSource.planId}. Recover the durable Plan authority before creating a successor Work.`
+        : `PLAN_NOT_FOUND: ${resolvedPlanId}. Recover or create the semantic Plan before using it as Work provenance.`,
+      data: {
+        executionStarted: false,
+        workContractCreated: false,
+        planId: resolvedPlanId,
+        ...(terminalContinuationSource?.planId ? { predecessorWorkId: terminalContinuationSource.workId } : {}),
       },
-      currentSourceRevision: ctx.sourceRevision ?? plan.sourceRevision,
-      works: progressionWorks,
-      controllerRounds: [],
     });
-    if (progression.kind === 'request_controller_acceptance') {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_STEP_SEMANTIC_ACCEPTANCE_REQUIRED: ${plan.planId}/${progression.planStepId ?? predecessorStep.id} has machine-complete delivery. Accept the delivered step before advancing the same semantic goal.`,
-        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, planStepId: progression.planStepId ?? predecessorStep.id, semanticAcceptanceRequired: true, progression },
-      });
-    }
-    if (progression.reasonCode === 'PLAN_STEP_TERMINAL_WORK_RECONCILIATION_REQUIRED') {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_STEP_TERMINAL_WORK_RECONCILIATION_REQUIRED: ${plan.planId}/${progression.planStepId ?? predecessorStep.id} must project terminal Work ${terminalContinuationSource.workId} before semantic progression.`,
-        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, planStepId: progression.planStepId ?? predecessorStep.id, repairRequired: true, progression },
-      });
-    }
-    if (progression.kind === 'start_next_plan_step' && progression.planStepId) {
-      resolvedPlanStepId = progression.planStepId;
-    } else if (progression.kind === 'request_requirement_acceptance') {
-      return buildFacadeResult({
-        status: 'ok',
-        summary: `CONTINUATION_REQUIREMENT_ACCEPTANCE_REQUIRED: ${plan.planId} is finalized; the semantic Controller must record goal_complete before the Requirement becomes done.`,
-        data: { executionStarted: false, workContractCreated: false, admissionDecision: 'requirement_acceptance_required', requirementAcceptanceRequired: true, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, requirementId: plan.requirementId, progression },
-      });
-    } else if (progression.kind === 'goal_complete') {
-      return buildFacadeResult({
-        status: 'ok',
-        summary: `CONTINUATION_GOAL_COMPLETE: ${plan.planId} Requirement is already semantically complete; no successor Work was created.`,
-        data: { executionStarted: false, workContractCreated: false, admissionDecision: 'goal_complete', goalComplete: true, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, requirementId: plan.requirementId, progression },
-      });
-    } else if (progression.reasonCode === 'MULTIPLE_READY_PLAN_STEPS') {
-      const candidates = (progression.dependencyStepIds ?? [])
-        .map((stepId) => plan.steps.find((candidate) => candidate.id === stepId))
-        .filter((candidate): candidate is NonNullable<typeof candidate> => Boolean(candidate));
-      return buildFacadeResult({
-        status: 'ok',
-        summary: `PLAN_SUCCESSOR_STEP_RESOLUTION_REQUIRED: ${plan.planId} has ${candidates.length} executable successor steps. The semantic Controller must select one; Forge will not invent ordering.`,
-        data: { executionStarted: false, workContractCreated: false, admissionDecision: 'resolution_required', resolutionRequired: true, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, candidatePlanSteps: candidates.map((candidate) => ({ id: candidate.id, objective: candidate.objective })), progression },
-      });
-    } else if (progression.kind === 'request_replan') {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_SUCCESSOR_REPLAN_REQUIRED: ${plan.planId} ${progression.reasonCode}.`,
-        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, progression },
-      });
-    } else if (progression.kind !== 'start_next_plan_step') {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_SUCCESSOR_PROGRESSION_BLOCKED: ${plan.planId} ${progression.reasonCode}.`,
-        data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, planId: plan.planId, progression },
-      });
-    }
   }
-  const planStep = plan && resolvedPlanStepId ? plan.steps.find((step) => step.id === resolvedPlanStepId) : undefined;
   const requestedRequirementId = input.requirementId?.trim() || undefined;
   const predecessorRequirementId = terminalContinuationSource?.requirementId;
   if (predecessorRequirementId && requestedRequirementId && predecessorRequirementId !== requestedRequirementId) {
@@ -986,25 +581,17 @@ export function startGoalWorkloop(
       data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource.workId, predecessorRequirementId, requestedRequirementId },
     });
   }
-  if (plan && requestedRequirementId && requestedRequirementId !== plan.requirementId) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `PLAN_REQUIREMENT_MISMATCH: ${plan.planId} is bound to ${plan.requirementId ?? 'no Requirement'}, not ${requestedRequirementId}. Use the Plan relationship authority or replan explicitly.`,
-      data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planRequirementId: plan.requirementId, requestedRequirementId },
-    });
-  }
-  if (plan?.requirementId && predecessorRequirementId && plan.requirementId !== predecessorRequirementId) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `WORK_SUCCESSOR_PLAN_REQUIREMENT_MISMATCH: predecessor ${terminalContinuationSource!.workId} belongs to ${predecessorRequirementId}, while ${plan.planId} belongs to ${plan.requirementId}.`,
-      data: { executionStarted: false, workContractCreated: false, predecessorWorkId: terminalContinuationSource!.workId, predecessorRequirementId, planId: plan.planId, planRequirementId: plan.requirementId },
-    });
+  // A selected Plan supplies its Requirement when no explicit/predecessor link exists.
+  // Requirement membership alone never selects sibling Plans or successor Works.
+  const effectiveRequirementId = requestedRequirementId || predecessorRequirementId || plan?.requirementId;
+  if (plan?.requirementId && effectiveRequirementId && plan.requirementId !== effectiveRequirementId) {
+    return buildFacadeResult({ status: 'blocked', summary: `WORK_PLAN_REQUIREMENT_MISMATCH: ${resolvedPlanId} belongs to ${plan.requirementId}, not ${effectiveRequirementId}.`, data: { executionStarted: false, workContractCreated: false } });
   }
-  const effectiveRequirementId = requestedRequirementId || plan?.requirementId || predecessorRequirementId;
+  const effectiveRequirementRecord = effectiveRequirementId && ctx.workStore.controllerHome ? readRequirement({ controllerHome: ctx.workStore.controllerHome }, effectiveRequirementId) : undefined;
   if (
     effectiveRequirementId
     && ctx.workStore.controllerHome
-    && !readRequirement({ controllerHome: ctx.workStore.controllerHome }, effectiveRequirementId)
+    && !effectiveRequirementRecord
   ) {
     return buildFacadeResult({
       status: 'blocked',
@@ -1012,36 +599,16 @@ export function startGoalWorkloop(
       data: { executionStarted: false, workContractCreated: false, requirementId: effectiveRequirementId, planId: plan?.planId },
     });
   }
-  const sameStringSet = (provided: string[] | undefined, frozen: string[]): boolean => {
-    if (provided === undefined) return true;
-    const actual = [...new Set(provided)].sort();
-    const expected = [...new Set(frozen)].sort();
-    return actual.length === expected.length && actual.every((value, index) => value === expected[index]);
-  };
-  if (planStep) {
-    const mismatches = [
-      !sameStringSet(input.acceptanceCriteria, planStep.acceptanceCriteria) && 'acceptance_criteria',
-      !sameStringSet(input.allowedPaths, planStep.allowedPaths) && 'allowed_paths',
-      !sameStringSet(input.forbiddenPaths, planStep.forbiddenPaths) && 'forbidden_paths',
-      !sameStringSet(input.checks, planStep.checks) && 'check_ids',
-    ].filter((value): value is string => Boolean(value));
-    if (mismatches.length > 0) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_STEP_WORK_CONTRACT_MISMATCH: ${resolvedPlanId}/${resolvedPlanStepId} conflicts with frozen Plan step field(s): ${mismatches.join(', ')}. Replan instead of widening or narrowing Work admission.`,
-        data: { executionStarted: false, workContractCreated: false, planId: resolvedPlanId, planStepId: resolvedPlanStepId, mismatches },
-      });
-    }
-  }
-  const effectiveObjective = planStep?.objective ?? input.objective;
-  const effectiveAcceptanceCriteria = planStep?.acceptanceCriteria ?? input.acceptanceCriteria ?? [];
-  const effectiveAllowedPaths = planStep?.allowedPaths ?? input.allowedPaths ?? [];
-  const effectiveForbiddenPaths = planStep?.forbiddenPaths ?? input.forbiddenPaths ?? [];
-  const effectiveChecks = planStep?.checks ?? input.checks ?? [];
+  // Work scope is authored by the caller. A referenced Plan item contributes no
+  // objective, paths, checks or acceptance criteria.
+  const effectiveObjective = input.objective;
+  const effectiveAcceptanceCriteria = input.acceptanceCriteria ?? [];
+  const effectiveAllowedPaths = input.allowedPaths ?? [];
+  const effectiveForbiddenPaths = input.forbiddenPaths ?? [];
+  const effectiveChecks = input.checks ?? [];
   const normalized = normalizeCheckIds(effectiveChecks, available);
   const invalidLineageWork = activeAdmissionSnapshot.invalid.find((candidate) =>
-    (input.relatedWorkId && candidate.workId === input.relatedWorkId)
-    || (resolvedPlanId && resolvedPlanStepId && candidate.planId === resolvedPlanId && candidate.planStepId === resolvedPlanStepId));
+    (input.relatedWorkId && candidate.workId === input.relatedWorkId));
   if (invalidLineageWork) {
     return buildFacadeResult({
       status: 'blocked',
@@ -1057,10 +624,7 @@ export function startGoalWorkloop(
       },
     });
   }
-  const newWorkWillBeIsolated = placementConstraint.requireWorktree
-    || placementConstraint.workspaceMode === 'isolated'
-    || input.modeInput.requiresParallelism === true
-    || routeDecision.requiresIsolation === true;
+  const newWorkWillBeIsolated = workspaceMode === 'isolated';
   const invalidSharedWorkspaceOwner = !newWorkWillBeIsolated
     ? activeAdmissionSnapshot.invalid.find((candidate) => candidate.isolation === 'shared'
       && (!candidate.checkoutId || candidate.checkoutId === ctx.checkoutId))
@@ -1072,24 +636,18 @@ export function startGoalWorkloop(
       data: { executionStarted: false, workContractCreated: false, invalidWorkId: invalidSharedWorkspaceOwner.workId, invalidWorkError: invalidSharedWorkspaceOwner.error },
     });
   }
-  const boundPlanStepWorks = resolvedPlanId && resolvedPlanStepId
-    ? activeWorks.filter((candidate) => candidate.planId === resolvedPlanId && candidate.planStepId === resolvedPlanStepId)
-    : [];
-  const explicitPlanStepWork = planStep?.workId ? activeWorks.find((candidate) => candidate.workId === planStep.workId) : undefined;
-  const planStepWork = explicitPlanStepWork ?? (boundPlanStepWorks.length === 1 ? boundPlanStepWorks[0] : undefined);
   // Requirement membership is portfolio ownership, not semantic Work identity.
-  // Only an explicit related Work or the exact bound Plan step may select an
-  // existing Work authority. Siblings under one Requirement remain unrelated
-  // for semantic admission and meet only in placement/resource arbitration.
-  const deterministicTarget = input.relatedWorkId
-    ? explicitRelatedWork
-    : planStepWork;
-  const requestedRelation = input.workRelation ?? (input.modeInput.requiresParallelism === true ? 'parallel' : undefined);
+  // Only an explicit related Work may select an existing Work authority. A Plan
+  // item never selects, owns or reuses Work. Siblings under one Requirement
+  // remain unrelated for semantic admission and meet only in
+  // placement/resource arbitration.
+  const deterministicTarget = input.relatedWorkId ? explicitRelatedWork : undefined;
+  const requestedRelation = input.workRelation;
   // Only strong semantic bindings participate in ownership resolution. An
   // unrelated active Work or a checkout writer is a placement fact, not a
   // semantic candidate for continue/extend/parallel/new_goal.
   const candidateWorks = [...new Map(
-    [explicitRelatedWork, planStepWork, ...boundPlanStepWorks]
+    [explicitRelatedWork]
       .filter((candidate): candidate is WorkContract => Boolean(candidate))
       .map((candidate) => [candidate.workId, candidate]),
   ).values()].slice(0, 8);
@@ -1110,63 +668,18 @@ export function startGoalWorkloop(
     evidenceRefs: target?.evidenceRefs ?? [],
     suggestedNextActions: target
       ? [{
-          label: 'Continue existing Work',
+          label: 'Inspect existing Work',
           tool: 'rh_work',
-          operation: 'continue',
+          operation: 'get',
           payload: { work_id: target.workId },
           risk: 'readonly',
-          confidence: planStepWork || explicitRelatedWork ? 'high' : 'medium',
-          reason: 'Resolve intent before execution; do not create a second Work until the relationship is explicit.',
+          confidence: explicitRelatedWork ? 'high' : 'medium',
+          reason: 'Resolve intent before execution; semantic Work inspection does not progress lifecycle state.',
         }]
       : [],
     rawAvailable: false,
   });
 
-  if (boundPlanStepWorks.length > 1) {
-    return resolutionRequired(`PLAN_STEP_MULTIPLE_PRIMARY_WORKS: ${resolvedPlanId}/${resolvedPlanStepId} has ${boundPlanStepWorks.length} active primary Work records and requires repair before execution.`);
-  }
-  if (terminalContinuationSource && requestedRelation === 'continue' && planStepWork) {
-    if (planStepWork.predecessorWorkId !== terminalContinuationSource.workId) {
-      return resolutionRequired(
-        `PLAN_STEP_SUCCESSOR_LINEAGE_CONFLICT: ${resolvedPlanId}/${resolvedPlanStepId} is already owned by ${planStepWork.workId}, but its predecessor is ${planStepWork.predecessorWorkId ?? 'none'} rather than ${terminalContinuationSource.workId}.`,
-        planStepWork,
-      );
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `PLAN_STEP_REUSES_SUCCESSOR_WORK: ${resolvedPlanId}/${resolvedPlanStepId} already continues terminal ${terminalContinuationSource.workId} as ${planStepWork.workId}.`,
-      data: {
-        executionStarted: false,
-        workContractCreated: false,
-        admissionDecision: 'reuse_existing',
-        resolutionRequired: false,
-        predecessorWorkId: terminalContinuationSource.workId,
-        work: summarizeWorkContract(planStepWork),
-      },
-      evidenceRefs: planStepWork.evidenceRefs,
-      suggestedNextActions: [{ label: 'Continue successor Work', tool: 'rh_work', operation: 'continue', payload: { work_id: planStepWork.workId }, risk: 'readonly', confidence: 'high' }],
-      rawAvailable: false,
-    });
-  }
-
-  if (planStep?.workId && !explicitPlanStepWork) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `PLAN_STEP_BOUND_WORK_MISSING: ${resolvedPlanId}/${resolvedPlanStepId} is bound to ${planStep.workId}, but that Work is not active. Repair the exact binding; do not create a replacement Work.`,
-      data: { executionStarted: false, workContractCreated: false, planId: resolvedPlanId, planStepId: resolvedPlanStepId, boundWorkId: planStep.workId, repairRequired: true },
-      suggestedNextActions: [{
-        label: 'Diagnose exact Plan step binding',
-        tool: 'rh_work',
-        operation: 'repair',
-        payload: { plan_id: resolvedPlanId, plan_step_id: resolvedPlanStepId, repair_operation: 'diagnose', dry_run: true },
-        risk: 'readonly',
-        confidence: 'high',
-        reason: 'The Plan step has an exact Work identity but the active Work view cannot resolve it. Diagnose that binding before any replacement Work can be admitted.',
-      }],
-      rawAvailable: false,
-    });
-  }
-
   if ((input.requestedBy ?? 'chatgpt') === 'scheduler') {
     return resolutionRequired(
       deterministicTarget
@@ -1175,42 +688,17 @@ export function startGoalWorkloop(
     );
   }
 
-  if (planStepWork && !requestedRelation) {
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `PLAN_STEP_REUSES_ACTIVE_WORK: ${resolvedPlanId}/${resolvedPlanStepId} already executes as ${planStepWork.workId}; reuse that Work instead of creating another.`,
-      data: {
-        executionStarted: false,
-        workContractCreated: false,
-        admissionDecision: 'reuse_existing',
-        resolutionRequired: false,
-        work: summarizeWorkContract(planStepWork),
-      },
-      evidenceRefs: planStepWork.evidenceRefs,
-      suggestedNextActions: [{ label: 'Continue existing Work', tool: 'rh_work', operation: 'continue', payload: { work_id: planStepWork.workId }, risk: 'readonly', confidence: 'high' }],
-      rawAvailable: false,
-    });
-  }
-
   if ((requestedRelation === 'continue' || requestedRelation === 'extend') && !terminalContinuationSource) {
     if (!deterministicTarget) {
-      return resolutionRequired(`${requestedRelation.toUpperCase()}_TARGET_REQUIRED: select related_work_id or bind the request to an exact active Plan step before execution.`);
-    }
-    if (requestedRelation === 'extend' && deterministicTarget.planId) {
-      return resolutionRequired(
-        `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${deterministicTarget.workId} is governed by Plan ${deterministicTarget.planId}; record additional discovery in scopeEvidence, but update the authoritative Plan before widening policy or acceptance scope.`,
-        deterministicTarget,
-      );
+      return resolutionRequired(`${requestedRelation.toUpperCase()}_TARGET_REQUIRED: select related_work_id before execution.`);
     }
     const selected = requestedRelation === 'extend'
       ? updateWorkContract(ctx.workStore, deterministicTarget.workId, {
           acceptanceCriteria: [...new Set([...deterministicTarget.acceptanceCriteria, ...(input.acceptanceCriteria ?? [])])].slice(0, 30),
-          allowedPaths: [...new Set([...deterministicTarget.allowedPaths, ...(input.allowedPaths ?? [])])].slice(0, 50),
-          forbiddenPaths: [...new Set([...deterministicTarget.forbiddenPaths, ...(input.forbiddenPaths ?? [])])].slice(0, 50),
           checks: [...new Set([...deterministicTarget.checks, ...normalized.validCheckIds])].slice(0, 30),
           scopeEvidence: {
             initialLikelyPaths: [...new Set([
-              ...(deterministicTarget.scopeEvidence?.initialLikelyPaths ?? deterministicTarget.allowedPaths),
+              ...(deterministicTarget.scopeEvidence?.initialLikelyPaths ?? []),
               ...(input.initialLikelyPaths ?? input.allowedPaths ?? []),
             ])].slice(0, 100),
             inspectedPaths: deterministicTarget.scopeEvidence?.inspectedPaths ?? [],
@@ -1232,7 +720,7 @@ export function startGoalWorkloop(
         work: summarizeWorkContract(selected),
       },
       evidenceRefs: selected.evidenceRefs,
-      suggestedNextActions: [{ label: 'Continue existing Work', tool: 'rh_work', operation: 'continue', payload: { work_id: selected.workId }, risk: 'readonly', confidence: 'high' }],
+      suggestedNextActions: [{ label: 'Read existing Work context', tool: 'rh_work', operation: 'get', payload: { work_id: selected.workId }, risk: 'readonly', confidence: 'high' }],
       rawAvailable: false,
     });
   }
@@ -1243,51 +731,10 @@ export function startGoalWorkloop(
     );
   }
 
-  // Pure remote effects do not participate in repository workspace ownership.
-  // An unrelated canonical writer, dirty checkout, or repository parallelism must
-  // not manufacture a Git worktree for browser/API work that has no source authority.
-  // Explicit typed isolation remains authoritative for the rare remote effect that
-  // genuinely declares a repository workspace requirement.
-  const repositoryWorkspaceParticipant = resolvedWorkKind !== 'remote_effect';
-  const placementConflict = repositoryWorkspaceParticipant && Boolean(workspaceOwner);
-  const trustedDirtyPaths = ctx.workspaceChangedPaths
-    ? [...new Set(ctx.workspaceChangedPaths.map((path) => path.trim()).filter(Boolean))].sort()
-    : undefined;
-  const dirtyWorkspaceOwnershipConflict = repositoryWorkspaceParticipant
-    && input.modeInput.workspaceDirty === true
-    && (
-      !trustedDirtyPaths
-      || trustedDirtyPaths.length === 0
-      || effectiveAllowedPaths.length === 0
-      || trustedDirtyPaths.some((path) => (
-        effectiveForbiddenPaths.some((pattern) => globMatches(pattern, path))
-        || !effectiveAllowedPaths.some((pattern) => globMatches(pattern, path))
-      ))
-    );
-  const automaticRepositoryIsolation = repositoryWorkspaceParticipant && (
-    placementConflict
-    || dirtyWorkspaceOwnershipConflict
-    || input.modeInput.requiresParallelism === true
-  );
-  const needsWorktree = executionMode === 'goal_workloop' && (
-    placementConstraint.requireWorktree
-    || automaticRepositoryIsolation
-    || routeDecision.requiresIsolation === true
-  );
-  if (!needsWorktree && workspaceOwner && repositoryWorkspaceParticipant) {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `WORKSPACE_OWNERSHIP_INVARIANT: unresolved admission reached checkout ${ctx.checkoutId} while active Work ${workspaceOwner.workId} owns it. This is an internal routing invariant, not a normal fallback path.`,
-      data: {
-        executionStarted: false,
-        workContractCreated: false,
-        conflictType: 'workspace_single_writer_invariant',
-        existingWork: summarizeWorkContract(workspaceOwner),
-      },
-      evidenceRefs: workspaceOwner.evidenceRefs,
-      rawAvailable: false,
-    });
-  }
+  // Repository topology is caller-owned. Forge records the selected placement
+  // and lets concrete WorkHandle/Lease/Git authorities report real conflicts at
+  // the mutation boundary instead of inferring isolation from semantic context.
+  const needsWorktree = workspaceMode === 'isolated';
   const requestedWorkId = input.workId?.trim();
   if (requestedWorkId && !/^work-[a-z0-9][a-z0-9-]{0,199}$/i.test(requestedWorkId)) {
     return buildFacadeResult({
@@ -1297,56 +744,21 @@ export function startGoalWorkloop(
     });
   }
   const generatedWorkId = requestedWorkId ?? workIdFor(effectiveObjective);
-  if (resolvedPlanId || resolvedPlanStepId) {
-    if (!resolvedPlanId || !resolvedPlanStepId || !ctx.planStore || !ctx.sourceRevision || !plan || !planStep) {
-      return buildFacadeResult({ status: 'blocked', summary: 'PLAN_CONTEXT_REQUIRED: plan_id, plan_step_id, an executable Plan step and a current source revision are required.', data: { executionStarted: false } });
-    }
-    if (plan.status !== 'approved' && plan.status !== 'executing') {
-      return buildFacadeResult({ status: 'blocked', summary: `PLAN_NOT_EXECUTABLE: ${plan.planId} is ${plan.status}`, data: { executionStarted: false, planId: plan.planId } });
-    }
-    if (plan.sourceRevision !== ctx.sourceRevision) {
-      const invalidated = claimPlanStepForWork(ctx.planStore, {
-        planId: resolvedPlanId,
-        stepId: resolvedPlanStepId,
-        workId: generatedWorkId,
-        sourceRevision: ctx.sourceRevision,
-      });
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_SOURCE_DRIFT: ${invalidated.planId} was invalidated because its source revision no longer matches. Replan before execution.`,
-        data: { planId: invalidated.planId, executionStarted: false, workContractCreated: false, replanRequired: true },
-      });
-    }
-    const unresolved = planStep.dependencies.filter((dependency) => plan.steps.find((candidate) => candidate.id === dependency)?.status !== 'completed');
-    if (unresolved.length > 0) {
-      return buildFacadeResult({ status: 'blocked', summary: `PLAN_STEP_DEPENDENCIES_PENDING: ${unresolved.join(', ')}`, data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planStepId: planStep.id } });
-    }
-    if (planStep.status === 'completed') {
-      return buildFacadeResult({ status: 'blocked', summary: `PLAN_STEP_ALREADY_COMPLETED: ${planStep.id}`, data: { executionStarted: false, workContractCreated: false, planId: plan.planId, planStepId: planStep.id } });
-    }
-  }
   const initialSuggestedNextActions = suggestedForWorkIdentity(
     generatedWorkId,
     normalized.validCheckIds,
     normalized.suggestedNextActions,
   );
   const remoteDeliveryRequired = resolvedWorkKind === 'repository_change'
-    && input.modeInput.requiresExternalEffect === true
-    && input.modeInput.remoteWrite === true;
+    && input.request.requiresExternalEffect === true
+    && input.request.remoteWrite === true;
   const effectiveConstraints: WorkContract['constraints'] = {
     ...canonicalConstraints,
-    ...(needsWorktree ? { workspaceMode: 'isolated' as const, requireWorktree: true } : {}),
     ...(remoteDeliveryRequired ? { remoteDeliveryRequired: true } : {}),
   };
-  const worktreeReason = placementConstraint.requireWorktree || routeDecision.requiresIsolation === true
-    ? 'Typed placement or Route Policy requires isolated execution.'
-    : dirtyWorkspaceOwnershipConflict
-      ? 'Trusted repository observation found dirty paths outside or ambiguous to the Work path fence; isolated placement prevents unrelated changes from entering Work ownership or verification.'
-      : placementConflict
-        ? 'The selected checkout is already owned by another active Work; this Work requires isolated placement.'
-        : repositoryWorkspaceParticipant && input.modeInput.requiresParallelism === true
-          ? 'Parallel Work requires isolated placement.'
-          : 'Current workspace is the stability-first default; isolation remains opt-in.';
+  const worktreeReason = needsWorktree
+    ? 'Caller explicitly selected isolated repository placement.'
+    : 'Caller selected the current repository checkout.';
   const forgeInstanceId = ctx.workStore.controllerHome
     ? readForgeInstanceIdentity(ctx.workStore.controllerHome)?.instanceId
     : undefined;
@@ -1364,9 +776,6 @@ export function startGoalWorkloop(
     baseRevision: ctx.sourceRevision,
     repositoryBaseState: ctx.sourceBaseState ?? (ctx.sourceRevision ? 'revision' : undefined),
     workspaceFingerprint: needsWorktree ? undefined : ctx.workspaceFingerprint,
-    routeDecisionFingerprint: routeDecision.inputFingerprint,
-    routeDecision,
-    mode: executionMode,
     objective: effectiveObjective,
     acceptanceCriteria: effectiveAcceptanceCriteria,
     constraints: effectiveConstraints,
@@ -1376,16 +785,18 @@ export function startGoalWorkloop(
     // repository-change Work's semantic identity. Pure external actions with no
     // repository-change signal remain remote_effect and keep plugin receipt semantics.
     workKind: resolvedWorkKind,
-    status: 'running',
+    dispatchState: 'running',
     phase: 'implementation',
     issueId: input.issueId,
     taskId: input.taskId,
     requirementId: effectiveRequirementId,
+    requirementRevision: effectiveRequirementRecord ? currentRequirementSemanticRevision(effectiveRequirementRecord.value) : undefined,
     predecessorWorkId: terminalContinuationSource?.workId,
     planId: resolvedPlanId,
+    planRevision: plan ? currentPlanSemanticRevision(plan) : undefined,
     planStepId: resolvedPlanStepId,
-    planSourceRevision: resolvedPlanId ? ctx.sourceRevision : undefined,
-    scopeSummary: input.modeInput.scopeClear ? 'scope declared at start' : 'scope incomplete',
+    planSourceRevision: resolvedPlanStepId ? plan?.sourceRevision : undefined,
+    scopeSummary: input.request.scopeClear ? 'scope declared at start' : 'scope incomplete',
     scopeEvidence: {
       initialLikelyPaths: [...new Set(input.initialLikelyPaths ?? effectiveAllowedPaths)].slice(0, 100),
       inspectedPaths: [],
@@ -1395,13 +806,6 @@ export function startGoalWorkloop(
     allowedPaths: effectiveAllowedPaths,
     forbiddenPaths: effectiveForbiddenPaths,
     checks: normalized.validCheckIds,
-    driver: {
-      preferred: executionMode === 'direct_control'
-        ? 'direct_edit'
-        : input.modeInput.requiresWorker === true ? 'external_controller' : needsWorktree ? 'isolated_worktree' : 'direct_edit',
-      allowWorker: false,
-      allowDirectEdit: executionMode === 'direct_control' || (input.modeInput.requiresWorker !== true && !needsWorktree),
-    },
     worktreePolicy: {
       required: needsWorktree,
       reason: worktreeReason,
@@ -1413,8 +817,8 @@ export function startGoalWorkloop(
       maxEvidenceRefs: 20,
     },
     approvalPolicy: {
-      required: input.modeInput.requiresApproval === true || input.modeInput.requiresUserApproval === true,
-      reasons: input.modeInput.requiresApproval || input.modeInput.requiresUserApproval ? ['approval requested at start'] : [],
+      required: input.request.requiresApproval === true || input.request.requiresUserApproval === true,
+      reasons: input.request.requiresApproval || input.request.requiresUserApproval ? ['approval requested at start'] : [],
       confirmed: input.approvalConfirmed === true,
     },
     recoveryPolicy: {
@@ -1430,48 +834,19 @@ export function startGoalWorkloop(
     continuationPrompt: `Continue work ${ctx.repoId}: ${effectiveObjective.slice(0, 200)}`,
   });
 
-  if (resolvedPlanId && resolvedPlanStepId && ctx.planStore && ctx.sourceRevision) {
-    try {
-      const claimed = claimPlanStepForWork(ctx.planStore, {
-        planId: resolvedPlanId,
-        stepId: resolvedPlanStepId,
-        workId: work.workId,
-        sourceRevision: ctx.sourceRevision,
-      });
-      if (claimed.status === 'invalidated_by_drift') {
-        return buildFacadeResult({
-          status: 'blocked',
-          summary: `PLAN_SOURCE_DRIFT: ${claimed.planId} was invalidated because its source revision no longer matches. Repair or replan before execution.`,
-          data: { executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), planId: claimed.planId, canonicalWorkRetained: true, replanRequired: true },
-        });
-      }
-    } catch (error) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: error instanceof Error ? error.message : 'PLAN_STEP_CLAIM_FAILED',
-        data: { planId: resolvedPlanId, planStepId: resolvedPlanStepId, executionStarted: false, workContractCreated: true, work: summarizeWorkContract(work), canonicalWorkRetained: true },
-      });
-    }
-  }
-
   return buildFacadeResult({
     status: 'ok',
     summary: terminalContinuationSource
       ? `Successor Work ${work.workId} continues semantic lineage from terminal ${terminalContinuationSource.workId}${resolvedPlanId && resolvedPlanStepId ? ` at ${resolvedPlanId}/${resolvedPlanStepId}` : ''}.`
-      : executionMode === 'direct_control'
-        ? `Direct-control Work lineage started as ${work.workId}.`
-        : `Goal workloop started as ${work.workId}.`,
+      : `Work started as ${work.workId}.`,
     data: {
-      mode: {
-        mode: executionMode,
-        reason: executionMode === 'direct_control'
-          ? 'A lightweight WorkContract records the mutation while execution stays on Direct Control.'
-          : 'WorkContract created for multi-step recoverable work.',
-        createWorkContract: true,
-        createHandoff: false,
-        missingContractFields: [],
-        requiresWork: true,
-        routeDecision,
+      // Caller-visible placement facts only. Execution mode tokens, route reasons
+      // and RouteDecision are legacy orchestration metadata, not Work semantics.
+      placement: {
+        workContractCreated: true,
+        worktreeRequired: work.worktreePolicy.required,
+        isolated: work.worktreePolicy.required,
+        requiresRecovery: work.recoveryPolicy.allowSelfHealing === true || false,
       },
       workContractCreated: true,
       work: summarizeWorkContract(work),
@@ -1497,10 +872,10 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  if (work.status === 'cancelled' || work.status === 'completed' || work.status === 'failed') {
+  if (semanticWorkState(work) !== 'open') {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `WorkContract ${work.workId} is terminal (${work.status}); continue is not allowed.`,
+      summary: `WorkContract ${work.workId} is terminal (${semanticWorkState(work)}); continue is not allowed.`,
       data: { work: summarizeWorkContract(work) },
       suggestedNextActions: [
         {
@@ -1514,6 +889,21 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
+  if (semanticWorkState(work) === 'open' && hasSettledWorkDeliveryReceipt(work)) {
+    return buildFacadeResult({
+      status: 'ok',
+      summary: `Continue: physical delivery is settled for ${work.workId}; semantic Work remains open for explicit Controller judgment.`,
+      data: {
+        work: summarizeWorkContract(work),
+        backgroundCompleted: false,
+        nextStep: 'semantic_decision',
+        deliverySettled: true,
+        semanticWorkState: 'open',
+      },
+      evidenceRefs: work.evidenceRefs.slice(0, 5),
+    });
+  }
+
   if (input.verifiedEngineeringEvidence) {
     const sourceIdentity = ctx.sourceRevision?.trim()
       ? { kind: 'revision' as const, revision: ctx.sourceRevision.trim() }
@@ -1535,42 +925,9 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
         data: { work: summarizeWorkContract(work), engineeringEvidenceUpdated: false },
       });
     }
-    const priorDesign = work.engineeringContext?.evidence.designDecisionReceipt;
-    if (work.engineeringContext?.designState === 'revisit_required' && priorDesign) {
-      const nextDesign = refreshedEngineeringContext.evidence.designDecisionReceipt;
-      if (!nextDesign || nextDesign.supersedesReceiptId !== priorDesign.receiptId) {
-        return buildFacadeResult({
-          status: 'blocked',
-          summary: 'ENGINEERING_DESIGN_SUPERSESSION_REQUIRED: same-root-cause re-entry requires a new design receipt that explicitly supersedes the prior design.',
-          data: { work: summarizeWorkContract(work), priorDesignReceiptId: priorDesign.receiptId },
-        });
-      }
-      if (refreshedEngineeringContext.evidence.independentCritiqueReceipt?.decision !== 'approved') {
-        return buildFacadeResult({
-          status: 'blocked',
-          summary: 'ENGINEERING_DESIGN_CRITIQUE_APPROVAL_REQUIRED: same-root-cause re-entry requires an independently approved critique of the superseding design.',
-          data: { work: summarizeWorkContract(work), priorDesignReceiptId: priorDesign.receiptId, nextDesignReceiptId: nextDesign.receiptId },
-        });
-      }
-    }
     work = updateWorkContract(ctx.workStore, work.workId, { engineeringContext: refreshedEngineeringContext });
   }
 
-  if (work.engineeringContext?.designState === 'revisit_required') {
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: 'ENGINEERING_DESIGN_REVISIT_REQUIRED: same-root-cause design authority must be explicitly superseded and independently approved before further Work mutation.',
-      data: { work: summarizeWorkContract(work) },
-      suggestedNextActions: [{
-        label: 'Refresh design evidence',
-        tool: 'rh_context',
-        operation: 'search',
-        payload: { work_id: work.workId, query: 'Refresh current source and design evidence for this Work before engineering re-entry.' },
-        risk: 'readonly',
-      }],
-    });
-  }
-
   if (input.engineeringBlocker) {
     if (!work.engineeringContext || work.engineeringContext.sourceIdentity.kind !== 'revision') {
       return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_SOURCE_IDENTITY_REQUIRED', data: { work: summarizeWorkContract(work) } });
@@ -1580,43 +937,34 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     try {
       let linkedWorkId: string | undefined;
       if (input.engineeringBlocker.classification === 'unrelated') {
-        linkedWorkId = linkedEngineeringBlockerWorkId(work.workId, input.engineeringBlocker.blockerId);
-        linkedWork = getWorkContract(ctx.workStore, linkedWorkId);
+        // Forge does not decompose work on the model's behalf. An unrelated blocker
+        // must name the Work that already owns it; the caller creates that Work
+        // explicitly (rh_work start) and passes its exact id here.
+        const declaredLinkedWorkId = input.engineeringBlocker.linkedWorkId?.trim();
+        if (!declaredLinkedWorkId) {
+          return buildFacadeResult({
+            status: 'blocked',
+            summary: 'ENGINEERING_BLOCKER_LINKED_WORK_REQUIRED: an unrelated blocker must name the Work that owns it via linked_work_id; Forge never creates a child Work automatically.',
+            data: { work: summarizeWorkContract(work), linkedWorkCreated: false },
+            suggestedNextActions: [{
+              label: 'Start the owning Work explicitly',
+              tool: 'rh_work',
+              operation: 'start',
+              payload: { objective: `Resolve unrelated blocker ${input.engineeringBlocker.blockerId}: ${input.engineeringBlocker.rationale}` },
+              risk: 'readonly',
+              confidence: 'medium',
+            }],
+          });
+        }
+        linkedWork = getWorkContract(ctx.workStore, declaredLinkedWorkId);
         if (!linkedWork) {
-          const linked = routeWorkStart(ctx, {
-            workId: linkedWorkId,
-            objective: `Resolve unrelated blocker ${input.engineeringBlocker.blockerId}: ${input.engineeringBlocker.rationale}`,
-            acceptanceCriteria: [
-              `Resolve blocker ${input.engineeringBlocker.blockerId} without widening Work ${work.workId}.`,
-              'Return bounded evidence or a precise wake/blocker condition to the owning Controller.',
-            ],
-            allowedPaths: [],
-            initialLikelyPaths: [],
-            forbiddenPaths: [],
-            checks: [],
-            modeInput: {
-              scopeClear: false,
-              mutation: false,
-              requiresInvestigation: true,
-              requiresRecovery: true,
-              requiresParallelism: true,
-            },
-            requestedBy: 'chatgpt',
-            relatedWorkId: work.workId,
-            workRelation: 'parallel',
-            requirementId: work.requirementId,
-            workKind: 'investigation',
-            constraints: { accessMode: work.constraints.accessMode },
+          return buildFacadeResult({
+            status: 'blocked',
+            summary: `ENGINEERING_BLOCKER_LINKED_WORK_UNKNOWN: ${declaredLinkedWorkId} is not a readable Work.`,
+            data: { work: summarizeWorkContract(work), linkedWorkId: declaredLinkedWorkId, linkedWorkCreated: false },
           });
-          linkedWork = getWorkContract(ctx.workStore, linkedWorkId);
-          if (linked.status !== 'ok' || !linkedWork) {
-            return buildFacadeResult({
-              status: 'blocked',
-              summary: `ENGINEERING_LINKED_WORK_ADMISSION_FAILED: ${linked.summary}`,
-              data: { work: summarizeWorkContract(work), linkedWorkId, linkedWorkCreated: false },
-            });
-          }
         }
+        linkedWorkId = linkedWork.workId;
       }
       blocker = buildEngineeringBlockerDispositionReceipt({
         sourceRevision: work.engineeringContext.sourceIdentity.revision,
@@ -1632,30 +980,19 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     } catch (error) {
       return buildFacadeResult({ status: 'blocked', summary: error instanceof Error ? error.message : 'ENGINEERING_BLOCKER_INVALID', data: { work: summarizeWorkContract(work) } });
     }
-    const returnToDesign = blocker.action === 'return_to_design';
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: returnToDesign
-        ? `Same-root-cause blocker ${blocker.blockerId} requires Product/Design re-entry before further mutation.`
-        : `Unrelated blocker ${blocker.blockerId} is linked to ${blocker.linkedWorkId}; current Work semantic scope is unchanged.`,
-      data: {
-        work: summarizeWorkContract(work),
-        engineeringBlocker: blocker,
-        ...(linkedWork ? { linkedWork: summarizeWorkContract(linkedWork), linkedWorkCreated: true } : {}),
-        nextStep: blocker.action,
-      },
-      suggestedNextActions: returnToDesign
-        ? [{
-            label: 'Refresh design evidence',
-            tool: 'rh_context',
-            operation: 'search',
-            payload: { work_id: work.workId, query: 'Refresh current source and design evidence for this Work before engineering re-entry.' },
-            risk: 'readonly',
-          }]
-        : linkedWork
-          ? [{ label: 'Continue linked Work', tool: 'rh_work', operation: 'continue', payload: { work_id: linkedWork.workId }, risk: 'workspace_write' }]
-          : [],
-    });
+    if (blocker.action === 'extend_candidate') {
+      work = appendWorkEvidence(ctx.workStore, work.workId, {
+        title: 'same-root candidate scope extension',
+        summary: `Blocker ${blocker.blockerId} remains inside the current architecture authority; continue the exact candidate without Design re-entry or sibling Work.`,
+        detailLevel: 'summary',
+      });
+    } else {
+      work = appendWorkEvidence(ctx.workStore, work.workId, {
+        title: 'engineering blocker observation',
+        summary: `Recorded ${blocker.classification} blocker ${blocker.blockerId}; it is model guidance, not a Work continuation gate.`,
+        detailLevel: 'summary',
+      });
+    }
   }
 
   if ((input.reviewFindings?.length ?? 0) > 0 && work.workKind !== 'read_only_review') {
@@ -1665,28 +1002,10 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       data: { work: summarizeWorkContract(work), reviewFindingsRecorded: false },
     });
   }
-  if (work.workKind === 'read_only_review') {
-    const sourceIdentity = evaluateReadOnlyReviewSourceIdentity(work, ctx.sourceRevision, ctx.workspaceChangedPaths);
-    if (sourceIdentity.status !== 'complete') {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `READ_ONLY_REVIEW_SOURCE_IDENTITY_REQUIRED: ${sourceIdentity.reasons.join(' ')}`,
-        data: { work: summarizeWorkContract(work), sourceIdentityProven: false },
-      });
-    }
-  }
-
   const explicitPolicyScope = input.allowedPaths !== undefined
     || input.forbiddenPaths !== undefined
     || input.checks !== undefined;
   if (explicitPolicyScope) {
-    if (work.planId) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `PLAN_EXTENSION_REQUIRES_REPLAN: Work ${work.workId} is governed by Plan ${work.planId}; continue cannot widen frozen policy scope. Replan the authoritative Plan instead.`,
-        data: { work: summarizeWorkContract(work), planId: work.planId, policyScopeUpdated: false },
-      });
-    }
     const normalizedChecks = normalizeCheckIds(input.checks ?? [], ctx.availableChecks ?? []);
     if (normalizedChecks.invalidCheckIds.length > 0) {
       return buildFacadeResult({
@@ -1696,12 +1015,10 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       });
     }
     work = updateWorkContract(ctx.workStore, work.workId, {
-      allowedPaths: [...new Set([...work.allowedPaths, ...(input.allowedPaths ?? [])])].slice(0, 50),
-      forbiddenPaths: [...new Set([...work.forbiddenPaths, ...(input.forbiddenPaths ?? [])])].slice(0, 50),
       checks: [...new Set([...work.checks, ...normalizedChecks.validCheckIds])].slice(0, 30),
       scopeEvidence: {
         initialLikelyPaths: [...new Set([
-          ...(work.scopeEvidence?.initialLikelyPaths ?? work.allowedPaths),
+          ...(work.scopeEvidence?.initialLikelyPaths ?? []),
           ...(input.allowedPaths ?? []),
         ])].slice(0, 100),
         inspectedPaths: work.scopeEvidence?.inspectedPaths ?? [],
@@ -1836,7 +1153,6 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       detailLevel: 'summary',
     });
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: 'implementation',
       state: 'active',
       summary: `Controller chose bounded ${decision} after acceptance failure; implementation may resume before re-verification.`,
@@ -1859,148 +1175,36 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  // Ambiguous acceptance failure without an explicit bounded Controller decision →
-  // ask once per distinct failure evidence. Repeated continue calls must not
-  // manufacture an unbounded handoff loop. A resolved handoff remains the decision
-  // authority until newer valid-fail evidence; an unresolved matching handoff is reused.
-  if (history.acceptanceFailures.length > 0 && !explicitAcceptanceRepair && work.recoveryPolicy.handoffOnAmbiguity) {
+  // Acceptance failure is a model/controller decision point, not a human blocker.
+  // Do not manufacture Handoff/UserRequest state for repair vs re-scope.
+  if (history.acceptanceFailures.length > 0 && !explicitAcceptanceRepair) {
     const failureReason = `Acceptance checks failed: ${history.acceptanceFailures.join(', ')}`;
-    const latestFailureAt = work.checkRefs
-      .filter((record) => record.outcome === 'valid_fail' && history.acceptanceFailures.includes(record.checkId))
-      .map((record) => record.recordedAt)
-      .sort((left, right) => right.localeCompare(left))[0];
-    const matchingHandoffs = listHandoffItems({ ...ctx.handoffStore, status: 'all', limit: 100 })
-      .filter((item) => (
-        item.workId === input.workId
-        && item.creationReason === 'ambiguous_outcome'
-        && item.title === 'Acceptance failure needs review'
-        && item.reason === failureReason
-        && (!latestFailureAt || item.createdAt >= latestFailureAt)
-      ));
-    const activeHandoff = matchingHandoffs.find((item) => item.status === 'pending' || item.status === 'acknowledged');
-    if (activeHandoff) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `Continue remains paused for ChatGPT review through existing handoff ${activeHandoff.id}.`,
-        data: {
-          work: summarizeWorkContract(work),
-          handoffId: activeHandoff.id,
-          acceptanceFailures: history.acceptanceFailures,
-          infrastructureIssues: history.infrastructureIssues,
-          backgroundCompleted: false,
-        },
-        evidenceRefs: work.evidenceRefs.slice(0, 5),
-        suggestedNextActions: [{
-          label: 'Get handoff',
-          tool: 'rh_inbox',
-          operation: 'get',
-          payload: { handoff_id: activeHandoff.id },
-          risk: 'readonly',
-          confidence: 'high',
-        }],
-      });
-    }
-
-    const resolvedHandoff = matchingHandoffs.find((item) => item.status === 'resolved');
-    if (!resolvedHandoff) {
-      const continuation = buildWorkContinuationSnapshot(work);
-      const handoff = createHandoffItem(ctx.handoffStore, {
-        id: handoffIdFor('continue'),
-        repoId: ctx.repoId,
-        workId: work.workId,
-        title: 'Acceptance failure needs review',
-        severity: 'needs_review',
-        creationReason: 'ambiguous_outcome',
-        reason: failureReason,
-        summary: 'Continue paused; ChatGPT must decide repair vs re-scope.',
-        currentState: {
-          repoId: ctx.repoId,
-          workId: work.workId,
-          mode: work.mode,
-          statusSummary: 'waiting_for_review after acceptance failure',
-          checks: history.acceptanceFailures.map((checkId) => ({ checkId, ok: false, outcome: 'valid_fail' as const })),
-          workSemantics: continuation.semantics,
-          reconciliationRequired: continuation.reconciliationRequired,
-          nextSafeAction: continuation.nextSafeAction,
-        },
-        attemptedActions: ['continue'],
-        evidenceRefs: work.evidenceRefs.slice(0, 5),
-        blockingDecision: 'Decide whether to repair code, adjust acceptance criteria, or stop.',
-        recommendedDecision: 'Inspect evidence and either repair or stop the workloop.',
-        recommendedPrompt: work.continuationPrompt ?? `Continue from work ${work.workId}.`,
-        recommendedContinuationPrompt: continuation.continuationPrompt,
-        suggestedNextActions: [
-          {
-            label: 'Read work context',
-            tool: 'rh_context',
-            operation: 'get',
-            payload: { work_id: work.workId },
-            risk: 'readonly',
-          },
-        ],
-      });
-      transitionWorkContractPhase(ctx.workStore, work.workId, {
-        status: 'ready',
-        phase: 'verification',
-        state: 'blocked',
-        summary: `Acceptance failure requires review through handoff ${handoff.id}.`,
-        evidenceRefs: work.evidenceRefs,
-      });
-      const updated = appendWorkHandoffRef(ctx.workStore, work.workId, handoff.id);
-
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `Continue paused for ChatGPT review; handoff ${handoff.id} created. No background execution pretended.`,
-        data: {
-          work: summarizeWorkContract(updated),
-          handoffId: handoff.id,
-          acceptanceFailures: history.acceptanceFailures,
-          infrastructureIssues: history.infrastructureIssues,
-          backgroundCompleted: false,
-        },
-        evidenceRefs: work.evidenceRefs.slice(0, 5),
-        suggestedNextActions: [
-          {
-            label: 'Get handoff',
-            tool: 'rh_inbox',
-            operation: 'get',
-            payload: { handoff_id: handoff.id },
-            risk: 'readonly',
-            confidence: 'high',
-          },
-        ],
-      });
-    }
-
-    transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
-      phase: 'verification',
-      state: 'active',
-      summary: `Resolved acceptance-failure handoff ${resolvedHandoff.id} authorizes bounded continuation to re-verification.`,
-      evidenceRefs: work.evidenceRefs,
-    });
-    work = getWorkContract(ctx.workStore, work.workId) ?? work;
     return buildFacadeResult({
-      status: 'ok',
-      summary: `Continue accepted resolved acceptance-failure handoff ${resolvedHandoff.id}; re-verification may resume.`,
+      status: 'blocked',
+      summary: `${failureReason}. The model must explicitly choose bounded repair or re-scope before continuing; no human Handoff was created.`,
       data: {
         work: summarizeWorkContract(work),
-        handoffId: resolvedHandoff.id,
         acceptanceFailures: history.acceptanceFailures,
         infrastructureIssues: history.infrastructureIssues,
         backgroundCompleted: false,
-        nextStep: 'verify',
-        remainingChecks: history.acceptanceFailures,
+        acceptanceFailureDecisionRequired: true,
       },
       evidenceRefs: work.evidenceRefs.slice(0, 5),
-      suggestedNextActions: suggestedForWork(work),
+      suggestedNextActions: [{
+        label: 'Inspect Work before repair or re-scope',
+        tool: 'rh_context',
+        operation: 'get',
+        payload: { work_id: work.workId },
+        risk: 'readonly',
+        confidence: 'high',
+        reason: 'Acceptance evidence is factual input; the model chooses the next capability without a Work lifecycle transition.',
+      }],
     });
   }
 
   // Infrastructure issues: suggest self-healing, not acceptance failure.
   if (history.infrastructureIssues.length > 0) {
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: 'implementation',
       state: 'active',
       summary: `Infrastructure issues require repair: ${history.infrastructureIssues.join(', ')}.`,
@@ -2049,7 +1253,6 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       },
     ]).actions;
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: 'implementation',
       state: 'active',
       summary: implementationEvidence.reasons.join(' '),
@@ -2078,24 +1281,15 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
 
   if (work.checks.length > 0 && history.validPasses.length < work.checks.length) {
     const remaining = work.checks.filter((checkId) => !history.validPasses.includes(checkId));
-    const suggested = validateSuggestedNextActions(
-      remaining.map((checkId) => ({
-        label: `Verify ${checkId}`,
-        tool: 'rh_work' as const,
-        operation: 'verify',
-        payload: { work_id: work.workId, check_id: checkId },
-        risk: 'workspace_write' as const,
-        confidence: 'high' as const,
-      })),
-      { validCheckIds: work.checks },
-    ).actions;
-    transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
-      phase: 'verification',
-      state: 'active',
-      summary: `Verification remains for: ${remaining.join(', ')}.`,
-      evidenceRefs: work.evidenceRefs,
-    });
+    const suggested = validateSuggestedNextActions([{
+      label: 'Inspect Work and check evidence',
+      tool: 'rh_context',
+      operation: 'get',
+      payload: { work_id: work.workId },
+      risk: 'readonly',
+      confidence: 'high',
+      reason: 'Registered checks are independent execution evidence; they do not progress Work lifecycle state.',
+    }]).actions;
     const updated = updateWorkContract(ctx.workStore, work.workId, {
       suggestedNextActions: suggested,
       continuationPrompt: input.note
@@ -2104,12 +1298,12 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
     return buildFacadeResult({
       status: 'ok',
-      summary: `Continue: next step is verification of ${remaining[0]}. No background work was completed.`,
+      summary: `Registered check evidence is still missing for: ${remaining.join(', ')}. Run checks through the check capability; Work semantic state is unchanged.`,
       data: {
         work: summarizeWorkContract(updated),
         remainingChecks: remaining,
         backgroundCompleted: false,
-        nextStep: 'verify',
+        nextStep: 'run_check',
       },
       suggestedNextActions: suggested,
     });
@@ -2135,7 +1329,6 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
       },
     ]).actions;
     transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
       phase: work.workKind === 'read_only_review' ? 'verification' : 'implementation',
       state: 'active',
       summary: work.workKind === 'read_only_review'
@@ -2165,293 +1358,13 @@ export function continueGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  const changedPaths = normalizeImplementationReviewChangedPaths(ctx.workspaceChangedPaths ?? work.scopeEvidence?.actualChangedPaths ?? []);
-  if (workRequiresImplementationReview(work.workKind, changedPaths)) {
-    recordWorkScopeEvidence(ctx.workStore, work.workId, { actualChangedPaths: changedPaths });
-    transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'running',
-      phase: 'verification',
-      state: 'satisfied',
-      summary: 'Exact Work completion evidence proves the current candidate is verified and eligible for implementation review.',
-      evidenceRefs: work.evidenceRefs,
-    });
-    requestWorkImplementationReview(ctx.workStore, work.workId, 'Implementation and verification evidence are complete; explicit Controller implementation review is required before delivery.');
-    const suggested = validateSuggestedNextActions([implementationReviewSuggestedAction(work.workId)]).actions;
-    const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
-    return buildFacadeResult({
-      status: 'ok',
-      summary: 'Continue: implementation and verification evidence are complete; explicit implementation review is next.',
-      data: { work: summarizeWorkContract(updated), backgroundCompleted: false, nextStep: 'review' },
-      suggestedNextActions: suggested,
-    });
-  }
-  const suggested = validateSuggestedNextActions([{
-    label: 'Finalize work', tool: 'rh_work', operation: 'finalize', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high',
-  }]).actions;
-  transitionWorkContractPhase(ctx.workStore, work.workId, {
-    status: 'running', phase: 'delivery', state: 'active',
-    summary: 'Source-free Work evidence is complete; implementation review is not required and semantic finalization is next.', evidenceRefs: work.evidenceRefs,
-  });
-  const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
-  return buildFacadeResult({ status: 'ok', summary: 'Continue: evidence is complete; ready to finalize.', data: { work: summarizeWorkContract(updated), backgroundCompleted: false, nextStep: 'finalize' }, suggestedNextActions: suggested });
-}
-
-export function verifyGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopVerifyInput): FacadeResult {
-  const work = getWorkContract(ctx.workStore, input.workId);
-  if (!work) {
-    return buildFacadeResult({
-      status: 'not_found',
-      summary: `WorkContract ${input.workId} not found.`,
-      data: { workId: input.workId },
-    });
-  }
-
-  const available = ctx.availableChecks ?? work.checks.map((id) => ({ id }));
-  const classified = classifyVerificationOutcome({
-    checkId: input.checkId,
-    available,
-    infrastructureFailed: input.infrastructureFailed,
-    checkFailed: input.checkFailed,
-    skipped: input.skipped,
-  });
-  if (work.status === 'completed' || work.status === 'cancelled' || work.status === 'failed') {
-    const resolvedCheckId = classified.normalizedCheckId ?? classified.checkId;
-    const existing = [...work.checkRefs].reverse().find((record) => record.checkId === resolvedCheckId);
-    const completed = work.status === 'completed';
-    return buildFacadeResult({
-      status: completed ? 'ok' : 'blocked',
-      summary: `WorkContract ${work.workId} is terminal (${work.status}); verification was not re-executed.`,
-      data: {
-        work: summarizeWorkContract(work),
-        verification: {
-          checkId: resolvedCheckId,
-          ...(existing ? { outcome: existing.outcome } : {}),
-          terminal: true,
-          idempotent: true,
-          reexecuted: false,
-          isAcceptanceFailure: existing?.outcome === 'valid_fail',
-          isInfrastructureIssue: existing?.outcome === 'invalid_check_id' || existing?.outcome === 'infrastructure_failure',
-          doesNotRequestTaskChanges: existing?.outcome !== 'valid_fail',
-        },
-        backgroundCompleted: false,
-      },
-      evidenceRefs: existing?.evidenceRef ? [existing.evidenceRef] : [],
-      warnings: classified.warnings,
-      suggestedNextActions: [{ label: 'Inspect work via context', tool: 'rh_context', operation: 'get', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high' }],
-    });
-  }
-
-  const at = nowIso(ctx);
-  const resolvedCheckId = classified.normalizedCheckId ?? classified.checkId;
-  const receipt = input.receipt
-    && input.receipt.repoId === work.repoId
-    && input.receipt.workId === work.workId
-    && input.receipt.checkId === resolvedCheckId
-    ? input.receipt
-    : undefined;
-  const sourceRevision = receipt && input.sourceRevision?.trim() ? input.sourceRevision.trim() : undefined;
-  const verificationSummary = receipt
-    ? `${classified.summary} Durable Process receipt ${receipt.receiptId}.`
-    : classified.summary;
-  const record: VerificationRecord = {
-    checkId: resolvedCheckId,
-    outcome: classified.outcome,
-    summary: verificationSummary,
-    recordedAt: at,
-    sourceRevision,
-    workspaceFingerprint: receipt && sourceRevision ? input.workspaceFingerprint : undefined,
-    verificationInputFingerprint: receipt && sourceRevision ? input.verificationInputFingerprint : undefined,
-    commandFingerprint: receipt && sourceRevision ? input.commandFingerprint : undefined,
-    startedAt: receipt?.startedAt,
-    completedAt: receipt?.finishedAt,
-    receipt,
-    evidenceRef: {
-      title: `verification:${classified.outcome}`,
-      summary: verificationSummary,
-      detailLevel: 'summary',
-    },
-  };
-
-  // Supersede prior invalid/infrastructure noise when a valid outcome arrives for the same check.
-  let checkRefs = work.checkRefs;
-  if (classified.outcome === 'valid_pass' || classified.outcome === 'valid_fail') {
-    checkRefs = work.checkRefs.map((existing) => {
-      if (
-        existing.checkId === record.checkId
-        && (existing.outcome === 'invalid_check_id' || existing.outcome === 'infrastructure_failure')
-      ) {
-        return { ...existing, outcome: 'superseded' as const, summary: `Superseded by ${classified.outcome} at ${at}` };
-      }
-      return existing;
-    });
-    updateWorkContract(ctx.workStore, work.workId, { checkRefs });
-  }
-
-  const updated = appendVerificationRecord(ctx.workStore, work.workId, record);
-  if (record.evidenceRef) appendWorkEvidence(ctx.workStore, work.workId, record.evidenceRef);
-
-  const status =
-    classified.outcome === 'invalid_check_id' || classified.outcome === 'infrastructure_failure'
-      ? 'ok'
-      : classified.outcome === 'valid_fail'
-        ? 'failed'
-        : 'ok';
-
-  const completionEvidence = classified.outcome === 'valid_pass'
-    ? evaluateWorkCompletionEvidence(updated, sourceRevision, input.workspaceFingerprint)
-    : undefined;
-  const validPassReadyForNextBoundary = completionEvidence?.status === 'complete';
-  const currentChangedPaths = normalizeImplementationReviewChangedPaths(ctx.workspaceChangedPaths ?? updated.scopeEvidence?.actualChangedPaths ?? []);
-  const latestReview = latestImplementationReview(updated.implementationReviews);
-  const approvedReviewRemainsAuthoritative = Boolean(
-    validPassReadyForNextBoundary
-    && updated.phase === 'delivery'
-    && updated.phaseEvidence.review.state === 'satisfied'
-    && latestReview?.decision === 'approved'
-    && sourceRevision
-    && input.workspaceFingerprint
-    && latestReview.sourceRevision === sourceRevision
-    && latestReview.verificationWorkspaceFingerprint === input.workspaceFingerprint
-    && latestReview.changedPathDigest === implementationReviewChangedPathDigest(currentChangedPaths)
-  );
-  const reviewRequiredAfterPass = validPassReadyForNextBoundary
-    && !approvedReviewRemainsAuthoritative
-    && workRequiresImplementationReview(updated.workKind, currentChangedPaths);
-  if (approvedReviewRemainsAuthoritative && updated.evidenceState !== 'valid') {
-    recordWorkEvidenceState(ctx.workStore, updated.workId, 'valid');
-  }
-  if (reviewRequiredAfterPass) {
-    recordWorkScopeEvidence(ctx.workStore, updated.workId, { actualChangedPaths: [...(ctx.workspaceChangedPaths ?? [])] });
-    transitionWorkContractPhase(ctx.workStore, updated.workId, {
-      status: 'running',
-      phase: 'verification',
-      state: 'satisfied',
-      summary: 'All required exact Work verification receipts are current; implementation review admission is now allowed.',
-      evidenceRefs: updated.evidenceRefs,
-    });
-    requestWorkImplementationReview(ctx.workStore, updated.workId, 'Verification is complete; explicit Controller implementation review is required before delivery.');
-  }
-  const suggested = validateSuggestedNextActions(
-    classified.outcome === 'valid_pass'
-      ? [reviewRequiredAfterPass
-          ? implementationReviewSuggestedAction(work.workId)
-          : {
-              label: validPassReadyForNextBoundary ? 'Finalize work' : 'Continue workloop',
-              tool: 'rh_work',
-              operation: validPassReadyForNextBoundary ? 'finalize' : 'continue',
-              payload: { work_id: work.workId },
-              risk: 'readonly',
-              confidence: 'high',
-            }]
-      : classified.outcome === 'valid_fail'
-        ? [{
-            label: 'Continue for review handoff',
-            tool: 'rh_work',
-            operation: 'continue',
-            payload: { work_id: work.workId },
-            risk: 'readonly',
-            confidence: 'high',
-          }]
-        : [{
-            label: 'Diagnose infrastructure (dry-run)',
-            tool: 'rh_work',
-            operation: 'repair',
-            payload: { work_id: work.workId, repair_operation: 'diagnose', dry_run: true },
-            risk: 'readonly',
-            confidence: 'high',
-          }],
-    { validCheckIds: work.checks },
-  ).actions;
-
-  return buildFacadeResult({
-    status: status === 'failed' ? 'failed' : 'ok',
-    summary: classified.summary,
-    data: {
-      work: summarizeWorkContract(updated),
-      verification: {
-        checkId: record.checkId,
-        outcome: classified.outcome,
-        isAcceptanceFailure: classified.isAcceptanceFailure,
-        isInfrastructureIssue: classified.isInfrastructureIssue,
-        // Explicitly separate pollution classes for ChatGPT.
-        doesNotRequestTaskChanges: !classified.isAcceptanceFailure,
-      },
-      backgroundCompleted: false,
-      ...(classified.outcome === 'valid_pass'
-        ? { nextStep: reviewRequiredAfterPass ? 'review' : validPassReadyForNextBoundary ? 'finalize' : 'continue' }
-        : {}),
-    },
-    warnings: classified.warnings,
-    evidenceRefs: record.evidenceRef ? [record.evidenceRef] : [],
-    suggestedNextActions: suggested,
-  });
-}
-
-export function reviewGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopReviewInput): FacadeResult {
-  let work = getWorkContract(ctx.workStore, input.workId);
-  if (!work) return buildFacadeResult({ status: 'not_found', summary: `WorkContract ${input.workId} not found.`, data: { workId: input.workId } });
-  if (work.status === 'completed' || work.status === 'cancelled' || work.status === 'failed') {
-    return buildFacadeResult({ status: 'blocked', summary: `WorkContract ${work.workId} is terminal (${work.status}); implementation review was not recorded.`, data: { work: summarizeWorkContract(work) } });
-  }
-  const reviewerPrincipalId = ctx.principalId?.trim() ?? '';
-  if (!reviewerPrincipalId) {
-    return buildFacadeResult({ status: 'blocked', summary: 'WORK_IMPLEMENTATION_REVIEW_REVIEWER_REQUIRED: authenticated reviewer principal is required.', data: { work: summarizeWorkContract(work) } });
-  }
-  if (!input.rationale?.trim()) {
-    return buildFacadeResult({ status: 'blocked', summary: 'WORK_IMPLEMENTATION_REVIEW_RATIONALE_REQUIRED: explicit review rationale is required.', data: { work: summarizeWorkContract(work) } });
-  }
-  try {
-    const candidate = currentImplementationReviewCandidate(ctx, work);
-    recordWorkScopeEvidence(ctx.workStore, work.workId, { actualChangedPaths: [...candidate.changedPaths] });
-    work = getWorkContract(ctx.workStore, work.workId) ?? work;
-    if (work.phase !== 'review') {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_PHASE_REQUIRED: verify or continue the exact candidate into review before recording a decision.');
-    }
-    const at = nowIso(ctx);
-    const review: WorkImplementationReviewRecord = {
-      schemaVersion: 1,
-      reviewId: `impl-review-${randomUUID().slice(0, 12)}`,
-      workId: work.workId,
-      reviewerPrincipalId,
-      decision: input.decision,
-      rationale: input.rationale.trim().slice(0, 4_000),
-      findings: (input.findings ?? []).slice(0, 100).map((finding) => ({
-        severity: finding.severity,
-        category: finding.category.trim().slice(0, 160),
-        summary: finding.summary.trim().slice(0, 1_000),
-        ...(finding.path?.trim() ? { path: finding.path.trim() } : {}),
-        ...(finding.symbol?.trim() ? { symbol: finding.symbol.trim().slice(0, 240) } : {}),
-      })),
-      sourceRevision: candidate.sourceRevision,
-      workspaceFingerprint: candidate.workspaceFingerprint,
-      verificationWorkspaceFingerprint: candidate.verificationWorkspaceFingerprint,
-      changedPaths: [...candidate.changedPaths],
-      changedPathDigest: implementationReviewChangedPathDigest(candidate.changedPaths),
-      acceptanceCriteriaSummary: implementationReviewAcceptanceSummary(work),
-      verificationEvidence: [...candidate.verificationEvidence],
-      architectureEvidence: [...(candidate.architectureEvidence ?? [])],
-      recordedAt: at,
-    };
-    const updated = recordWorkImplementationReview(ctx.workStore, work.workId, review);
-    const suggested = validateSuggestedNextActions(input.decision === 'approved'
-      ? [{ label: 'Finalize reviewed work', tool: 'rh_work', operation: 'finalize', payload: { work_id: work.workId }, risk: 'workspace_write', confidence: 'high' }]
-      : input.decision === 'changes_required'
-        ? [{ label: 'Continue implementation repairs', tool: 'rh_work', operation: 'continue', payload: { work_id: work.workId }, risk: 'workspace_write', confidence: 'high' }]
-        : [{ label: 'Inspect blocked review evidence', tool: 'rh_context', operation: 'get', payload: { work_id: work.workId }, risk: 'readonly', confidence: 'high' }]).actions;
-    const persisted = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
-    return buildFacadeResult({
-      status: input.decision === 'blocked' ? 'blocked' : 'ok',
-      summary: `Implementation review ${review.reviewId}: ${input.decision}.`,
-      data: { work: summarizeWorkContract(persisted), review, nextStep: input.decision === 'approved' ? 'finalize' : input.decision === 'changes_required' ? 'continue' : 'blocked' },
-      suggestedNextActions: suggested,
-    });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return buildFacadeResult({ status: 'blocked', summary: message, data: { work: summarizeWorkContract(work) }, suggestedNextActions: suggestedForWork(work) });
-  }
+  // Completion evidence is observational. It cannot choose a review/finalize
+  // transition or tell the model which capability to invoke next.
+  const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: [] });
+  return buildFacadeResult({ status: 'ok', summary: 'Continue: current Work evidence recorded.', data: { work: summarizeWorkContract(updated), backgroundCompleted: false }, suggestedNextActions: [] });
 }
 
-export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopFinalizeInput): FacadeResult {
+export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopStopInput): FacadeResult {
   const work = getWorkContract(ctx.workStore, input.workId);
   if (!work) {
     return buildFacadeResult({
@@ -2461,380 +1374,38 @@ export function finalizeGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorklo
     });
   }
 
-  if (work.status === 'cancelled') {
+  const destructiveCleanup = input.authorizeDestructiveCleanup === true;
+  if (semanticWorkState(work) === 'completed') {
     return buildFacadeResult({
       status: 'blocked',
-      summary: `WorkContract ${work.workId} was cancelled; finalize is not allowed.`,
+      summary: `WORK_CANCEL_COMPLETED: ${work.workId}`,
       data: { work: summarizeWorkContract(work) },
     });
   }
-
-  // A Work-owned completion receipt is the strongest delivery/cleanup authority.
-  // Physical finalization records status=completed + receipt atomically. A facade
-  // retry must be idempotent and must never re-run weaker pre-delivery evidence
-  // evaluation that could attempt to demote an already completed Work.
-  if (work.status === 'completed' && work.completionReceipt) {
-    if (work.planId && work.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: work.planId, stepId: work.planStepId, work });
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `Finalize result: succeeded for ${work.workId}.`,
-      data: {
-        work: summarizeWorkContract(work),
-        finalStatus: 'completed',
-        completionReceipt: work.completionReceipt,
-        idempotent: true,
-        hiddenFailure: false,
-      },
-      evidenceRefs: work.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
-    });
-  }
-
-  const currentChangedPaths = normalizeImplementationReviewChangedPaths(ctx.workspaceChangedPaths ?? work.scopeEvidence?.actualChangedPaths ?? []);
-  if (workRequiresImplementationReview(work.workKind, currentChangedPaths)) {
-    try {
-      const candidate = currentImplementationReviewCandidate(ctx, work);
-      assertImplementationReviewPreDeliveryBoundary({
-        repoId: work.repoId,
-        workId: work.workId,
-        workKind: work.workKind,
-        reviews: work.implementationReviews,
-        candidate,
-        requiredCheckIds: work.checks,
-        verificationRecords: work.checkRefs,
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      const reviewDecisionBlocked = /WORK_IMPLEMENTATION_REVIEW_(REQUIRED|STALE|CHANGES_REQUIRED|BLOCKED)/.test(message);
-      if (reviewDecisionBlocked) {
-        transitionWorkContractPhase(ctx.workStore, work.workId, {
-          status: 'running',
-          phase: 'verification',
-          state: 'satisfied',
-          summary: `Current exact verification remains authoritative, but implementation review must be renewed before delivery: ${message}`,
-          evidenceRefs: work.evidenceRefs,
-        });
-        requestWorkImplementationReview(ctx.workStore, work.workId, `Pre-delivery implementation review gate requires a renewed Controller decision: ${message}`);
-        const suggested = validateSuggestedNextActions([implementationReviewSuggestedAction(work.workId)]).actions;
-        const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
-        return buildFacadeResult({
-          status: 'blocked',
-          summary: message,
-          data: { work: summarizeWorkContract(updated), nextStep: 'review' },
-          suggestedNextActions: suggested,
-        });
-      }
-      transitionWorkContractPhase(ctx.workStore, work.workId, {
-        status: 'running',
-        phase: 'verification',
-        state: 'active',
-        summary: `Pre-delivery review could not prove an exact verified candidate: ${message}`,
-        evidenceRefs: work.evidenceRefs,
-      });
-      const suggested = validateSuggestedNextActions([{
-        label: 'Verify exact candidate',
-        tool: 'rh_work',
-        operation: 'verify',
-        payload: { work_id: work.workId, check_id: work.checks[0] },
-        risk: 'workspace_write',
-        confidence: work.checks[0] ? 'high' : 'medium',
-      }], { validCheckIds: work.checks }).actions;
-      const updated = updateWorkContract(ctx.workStore, work.workId, { suggestedNextActions: suggested });
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: message,
-        data: { work: summarizeWorkContract(updated), nextStep: 'verify' },
-        suggestedNextActions: suggested,
-      });
-    }
-  }
-
-  const completionEvidence = evaluateWorkCompletionEvidence(
-    work,
-    ctx.sourceRevision,
-    ctx.workspaceFingerprint,
-    ctx.workBoundProcessEvidenceIds,
-    ctx.workspaceChangedPaths,
-  );
-  const history = completionEvidence.history;
-
-  if (input.forceFailed || completionEvidence.status === 'failed') {
-    const updated = failWorkContract(ctx.workStore, work.workId, {
-      phase: work.phase,
-      summary: `Work failed acceptance/finalization while in ${work.phase}: ${history.acceptanceFailures.join(', ') || 'forced failure'}.`,
-      evidenceRefs: work.evidenceRefs,
-    });
-    if (updated.planId && updated.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: updated.planId, stepId: updated.planStepId, work: updated });
-    }
-    return buildFacadeResult({
-      status: 'failed',
-      summary: `Finalize result: failed. Acceptance failures: ${history.acceptanceFailures.join(', ') || 'forced'}.`,
-      data: {
-        work: summarizeWorkContract(updated),
-        finalStatus: 'failed',
-        acceptanceFailures: history.acceptanceFailures,
-        infrastructureIssues: history.infrastructureIssues,
-        invalidCheckIds: history.invalidCheckIds,
-        // Failures are not hidden.
-        hiddenFailure: false,
-      },
-      suggestedNextActions: [
-        {
-          label: 'List handoffs',
-          tool: 'rh_inbox',
-          operation: 'list',
-          risk: 'readonly',
-        },
-      ],
-    });
-  }
-
-  // Weak refs, partial checks, invalid ids, and infrastructure issues never imply successful completion.
-  if (completionEvidence.status === 'incomplete') {
-    const updated = transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'ready',
-      phase: 'verification',
-      state: 'blocked',
-      summary: `Completion evidence remains incomplete: ${completionEvidence.reasons.join(' ')}`,
-      evidenceRefs: work.evidenceRefs,
-    });
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `Finalize result: waiting_for_review. ${completionEvidence.reasons.join(' ')}`,
-      data: {
-        work: summarizeWorkContract(updated),
-        finalStatus: 'ready',
-        infrastructureIssues: history.infrastructureIssues,
-        invalidCheckIds: history.invalidCheckIds,
-        validPasses: history.validPasses,
-        missingChecks: completionEvidence.missingChecks,
-        durableResultEvidence: completionEvidence.durableResultEvidence,
-        ignoredWeakReferences: {
-          workerRef: Boolean(work.workerRef),
-          worktreeRef: Boolean(work.worktreeRef),
-        },
-        hiddenFailure: false,
-      },
-      suggestedNextActions: [
-        {
-          label: 'Continue workloop',
-          tool: 'rh_work',
-          operation: 'continue',
-          payload: { work_id: work.workId },
-          risk: 'readonly',
-        },
-      ],
-    });
-  }
-
-  // Read-only review completion is semantic no-change authority, not Git delivery.
-  // The exact source/workspace fence is re-evaluated above at finalize time; only
-  // a clean review with persisted inspected paths and zero findings can close.
-  if (work.workKind === 'read_only_review' && !work.completionReceipt) {
-    const reviewEvidence = work.readOnlyReviewEvidence!;
-    const recordedAt = nowIso(ctx);
-    const completed = completeWorkWithReceipt(
-      ctx.workStore,
-      work.workId,
-      {
-        schemaVersion: 1,
-        receiptId: `ROR-WORK-${randomUUID()}`,
-        source: 'read_only_review',
-        workId: work.workId,
-        baseRevision: work.baseRevision!,
-        sourceRevision: ctx.sourceRevision!,
-        ...(ctx.workspaceFingerprint ? { workspaceFingerprint: ctx.workspaceFingerprint } : {}),
-        workspaceChangedPaths: [],
-        inspectedPaths: reviewEvidence.inspectedPaths,
-        findingCount: 0,
-        recordedAt,
-      },
-      'completed_no_change',
-      'read_only_review',
-    );
-    if (completed.planId && completed.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: completed.planId, stepId: completed.planStepId, work: completed });
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `Finalize result: clean read-only review completed with no source change for ${work.workId}.`,
-      data: {
-        work: summarizeWorkContract(completed),
-        finalStatus: 'completed',
-        completionOutcome: 'completed_no_change',
-        completionReceipt: completed.completionReceipt,
-        inspectedPathCount: reviewEvidence.inspectedPaths.length,
-        hiddenFailure: false,
-      },
-      evidenceRefs: completed.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
-    });
-  }
-
-  // For a controller-local effect Work, the semantic Controller's explicit
-  // finalize call is the terminalization decision, but it is admissible only
-  // after durable result evidence exists. Record one canonical Work receipt here
-  // instead of routing an effect-only Work through Git delivery. Remote effects
-  // remain bound to their durable plugin action receipt in the plugin layer.
-  if (work.workKind === 'local_effect' && !work.completionReceipt && completionEvidence.durableResultEvidence) {
-    const recordedAt = nowIso(ctx);
-    const completed = completeWorkWithReceipt(
-      ctx.workStore,
-      work.workId,
-      {
-        schemaVersion: 1,
-        receiptId: `LFX-WORK-${randomUUID()}`,
-        source: 'local_effect',
-        workId: work.workId,
-        operation: 'controller_work/local_effect',
-        target: { kind: 'controller_local', id: work.workId },
-        changed: true,
-        recordedAt,
-      },
-      'completed_local',
-      'local_effect',
-    );
-    if (completed.planId && completed.planStepId && ctx.planStore) {
-      completePlanStepForWork(ctx.planStore, { planId: completed.planId, stepId: completed.planStepId, work: completed });
-    }
-    return buildFacadeResult({
-      status: 'ok',
-      summary: `Finalize result: succeeded for ${work.workId}.`,
-      data: {
-        work: summarizeWorkContract(completed),
-        finalStatus: 'completed',
-        completionReceipt: completed.completionReceipt,
-        validPasses: history.validPasses,
-        hiddenFailure: false,
-      },
-      evidenceRefs: completed.evidenceRefs.slice(0, 5),
-      suggestedNextActions: [{ label: 'Read controller status', tool: 'rh_status', operation: 'get', risk: 'readonly' }],
-    });
-  }
-
-  // Checks and result evidence are necessary but not sufficient. Delivery and
-  // cleanup must produce the exact Work-owned receipt before Work can become
-  // terminal; a Run exit or a missing receipt is never completion authority.
-  if (!work.completionReceipt) {
-    const updated = transitionWorkContractPhase(ctx.workStore, work.workId, {
-      status: 'ready',
-      phase: 'delivery',
-      state: 'blocked',
-      summary: 'Exact delivery and cleanup completion receipt is required.',
-      evidenceRefs: work.evidenceRefs,
-    });
-    return buildFacadeResult({
-      status: 'blocked',
-      summary: `Finalize blocked for ${work.workId}: an exact delivery and cleanup completion receipt is required.`,
-      data: { work: summarizeWorkContract(updated), finalStatus: 'ready', completionReceiptRequired: true },
-      suggestedNextActions: [{ label: 'Complete Work delivery and cleanup', tool: 'rh_work', operation: 'finalize', payload: { work_id: work.workId }, risk: 'local_repo_write' }],
-    });
-  }
-
-  const updated = getWorkContract(ctx.workStore, work.workId)!;
-  if (updated.planId && updated.planStepId && ctx.planStore) {
-    completePlanStepForWork(ctx.planStore, { planId: updated.planId, stepId: updated.planStepId, work: updated });
-  }
-  return buildFacadeResult({
-    status: 'ok',
-    summary: `Finalize result: succeeded for ${work.workId}.`,
-    data: {
-      work: summarizeWorkContract(updated),
-      finalStatus: 'completed',
-      validPasses: history.validPasses,
-      hiddenFailure: false,
-    },
-    evidenceRefs: work.evidenceRefs.slice(0, 5),
-    suggestedNextActions: [
-      {
-        label: 'Read controller status',
-        tool: 'rh_status',
-        operation: 'get',
-        risk: 'readonly',
-      },
-    ],
-  });
-}
-
-export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopStopInput): FacadeResult {
-  const work = getWorkContract(ctx.workStore, input.workId);
-  if (!work) {
-    return buildFacadeResult({
-      status: 'not_found',
-      summary: `WorkContract ${input.workId} not found.`,
-      data: { workId: input.workId },
-    });
-  }
-
-  const owner = ctx.workStore.controllerHome
-    ? getControllerSession({ controllerHome: ctx.workStore.controllerHome, repoId: ctx.repoId }, work.workId)
-    : undefined;
-  if (owner) {
-    const ownerPrincipal = owner.principalId?.trim() || owner.controllerId;
-    const ownerInstanceId = owner.controllerInstanceId?.trim();
-    const callerPrincipal = ctx.principalId?.trim();
-    const callerInstanceId = ctx.controllerInstanceId?.trim();
-    const sameAuthority = Boolean(
-      callerPrincipal
-      && ownerPrincipal === callerPrincipal
-      && (!ownerInstanceId || ownerInstanceId === callerInstanceId),
-    );
-    if (!sameAuthority) {
-      return buildFacadeResult({
-        status: 'blocked',
-        summary: `WORK_TERMINALIZATION_ACTIVE_CONTROLLER_FENCE: ${work.workId} has a newer active Controller claim generation ${owner.claimGeneration ?? 1}.`,
-        data: {
-          work: summarizeWorkContract(work),
-          activeController: {
-            controllerId: owner.controllerId,
-            principalId: ownerPrincipal,
-            controllerInstanceId: owner.controllerInstanceId,
-            sessionId: owner.sessionId,
-            claimGeneration: owner.claimGeneration ?? 1,
-          },
-          finalStatus: work.status,
-        },
-      });
-    }
-  }
-
-  const destructiveCleanup = input.authorizeDestructiveCleanup === true;
-  cancelWorkContract(ctx.workStore, work.workId, {
-    summary: input.reason ? `Stopped: ${input.reason}` : 'Work stopped without destructive cleanup.',
-    evidenceRefs: work.evidenceRefs,
-  });
-  const updated = updateWorkContract(ctx.workStore, work.workId, {
-    continuationPrompt: input.reason
-      ? `Stopped: ${input.reason}`.slice(0, 2_000)
-      : work.continuationPrompt,
-    // Authorization is not proof of cleanup. Preserve the reference until a real
-    // cleanup handler verifies ownership, cleanliness and successful removal.
-    worktreeRef: work.worktreeRef,
+  const semanticRevision = Number.isInteger(work.semanticRevision) && Number(work.semanticRevision) > 0
+    ? Number(work.semanticRevision)
+    : 1;
+  const updated = reviseWorkSemanticContext(ctx.workStore, work.workId, {
+    expectedRevision: semanticRevision,
+    state: 'cancelled',
+    resultRefs: work.evidenceRefs
+      .flatMap((evidence) => [evidence.evidenceId, evidence.artifactId])
+      .map((value) => value?.trim())
+      .filter((value): value is string => Boolean(value)),
   });
   const planId = updated.planId;
   const planStepId = updated.planStepId;
   let plan = planId && ctx.planStore
     ? getPlanContract(ctx.planStore, planId)
     : undefined;
-  if (plan && planId && planStepId && ctx.planStore) {
-    const step = plan.steps.find((entry) => entry.id === planStepId);
-    if (step?.workId === updated.workId) {
-      plan = completePlanStepForWork(ctx.planStore, { planId, stepId: planStepId, work: updated });
-    }
-  }
 
   return buildFacadeResult({
     status: 'ok',
-    summary: `WorkContract ${work.workId} cancelled/stopped. Evidence retained. Worktree cleanup ${destructiveCleanup ? 'authorized but pending verification' : 'not performed'}.`,
+    summary: `WorkContract ${work.workId} cancelled/stopped. Evidence retained. Managed resource cleanup/retention is settled by the canonical Work finalization service.`,
     data: {
       work: summarizeWorkContract(updated),
       finalStatus: 'cancelled',
       evidenceRetained: true,
-      worktreeDeleted: false,
-      cleanupPending: destructiveCleanup && Boolean(work.worktreeRef),
       destructiveCleanupAuthorized: destructiveCleanup,
       ...(plan ? { plan } : {}),
     },
@@ -2853,6 +1424,11 @@ export function stopGoalWorkloop(ctx: GoalWorkloopContext, input: GoalWorkloopSt
 export interface GoalWorkloopTrustedInput {
   /** Runtime-composed source-bound evidence. This channel is intentionally separate from raw MCP/tool arguments. */
   verifiedEngineeringEvidence?: EngineeringAdmissionEvidence;
+  /**
+   * Evaluator-minted evidence for one exact candidate. Kept off the raw MCP
+   * argument surface so callers cannot manufacture architecture evidence.
+   */
+  evaluationPromotionReceipt?: EvaluationPromotionReceipt;
 }
 
 export function runGoalWorkloop(
@@ -2871,18 +1447,10 @@ export function runGoalWorkloop(
         initialLikelyPaths: Array.isArray(args.initial_likely_paths) ? args.initial_likely_paths.map(String) : undefined,
         forbiddenPaths: Array.isArray(args.forbidden_paths) ? args.forbidden_paths.map(String) : undefined,
         checks: Array.isArray(args.check_ids) ? args.check_ids.map(String) : undefined,
-        modeInput: {
+        request: {
           objective: typeof args.objective === 'string' ? args.objective : undefined,
-          expectedFiles: typeof args.expected_files === 'number' ? args.expected_files : undefined,
-          expectedChangedLines: typeof args.expected_changed_lines === 'number' ? args.expected_changed_lines : undefined,
           scopeClear: args.scope_clear === undefined ? true : args.scope_clear === true,
-          requiresInvestigation: args.requires_investigation === true,
-          requiresLongRunningChecks: args.requires_long_running_checks === true,
-          requiresParallelism: args.requires_parallelism === true,
-          explicitMode: args.mode === 'plan' || args.mode === 'scale' ? args.mode : undefined,
-          needsDependencies: args.needs_dependencies === true,
           requiresRecovery: args.requires_recovery === true,
-          requiresWorker: args.requires_worker === true,
           requiresExternalEffect: args.requires_external_effect === true,
           requiresApproval: args.requires_approval === true,
           requiresUserApproval: args.requires_user_approval === true,
@@ -2896,9 +1464,6 @@ export function runGoalWorkloop(
         issueId: typeof args.issue_id === 'string' ? args.issue_id : undefined,
         approvalConfirmed: args.approval_confirmed === true,
         dryRun: args.dry_run === true,
-        forceMode: args.force_mode === 'direct_control' || args.force_mode === 'goal_workloop' || args.force_mode === 'handoff_only'
-          ? args.force_mode
-          : undefined,
         relatedWorkId: typeof args.related_work_id === 'string' ? args.related_work_id : undefined,
         workRelation: args.work_relation === 'continue' || args.work_relation === 'extend' || args.work_relation === 'parallel' || args.work_relation === 'new_goal'
           ? args.work_relation
@@ -2925,7 +1490,7 @@ export function runGoalWorkloop(
         }
         const rawBlocker = args.engineering_blocker as Record<string, unknown>;
         const classification = rawBlocker.classification;
-        if (classification !== 'same_root_cause' && classification !== 'unrelated') {
+        if (classification !== 'same_root_cause' && classification !== 'same_root_cause_scope_extension' && classification !== 'unrelated') {
           return buildFacadeResult({ status: 'blocked', summary: 'ENGINEERING_BLOCKER_CLASSIFICATION_INVALID', data: { workId: String(args.work_id ?? '') } });
         }
         engineeringBlocker = {
@@ -2933,6 +1498,7 @@ export function runGoalWorkloop(
           classification,
           rationale: String(rawBlocker.rationale ?? ''),
           semanticScopeKeys: Array.isArray(rawBlocker.semantic_scope_keys) ? rawBlocker.semantic_scope_keys.map(String) : undefined,
+          linkedWorkId: typeof rawBlocker.linked_work_id === 'string' ? rawBlocker.linked_work_id : undefined,
         };
       }
       return continueGoalWorkloop(ctx, {
@@ -2958,44 +1524,6 @@ export function runGoalWorkloop(
         engineeringBlocker,
       });
     }
-    case 'verify':
-      return verifyGoalWorkloop(ctx, {
-        workId: String(args.work_id ?? ''),
-        checkId: String(args.check_id ?? args.checkId ?? ''),
-        infrastructureFailed: args.infrastructure_failed === true,
-        checkFailed: args.check_failed === true,
-        skipped: args.skipped === true,
-      });
-    case 'review': {
-      if (args.review_decision !== 'approved' && args.review_decision !== 'changes_required' && args.review_decision !== 'blocked') {
-        return buildFacadeResult({
-          status: 'blocked',
-          summary: 'WORK_IMPLEMENTATION_REVIEW_DECISION_REQUIRED: operation=review requires an explicit approved, changes_required, or blocked decision.',
-          data: { workId: String(args.work_id ?? '') },
-        });
-      }
-      return reviewGoalWorkloop(ctx, {
-        workId: String(args.work_id ?? ''),
-        decision: args.review_decision,
-        rationale: typeof args.review_rationale === 'string' ? args.review_rationale : '',
-        findings: Array.isArray(args.implementation_review_findings)
-          ? args.implementation_review_findings
-              .filter((value): value is Record<string, unknown> => Boolean(value) && typeof value === 'object')
-              .map((value) => ({
-                severity: value.severity === 'critical' || value.severity === 'high' || value.severity === 'medium' || value.severity === 'low' || value.severity === 'info' ? value.severity : 'info',
-                category: typeof value.category === 'string' ? value.category : '',
-                summary: typeof value.summary === 'string' ? value.summary : '',
-                ...(typeof value.path === 'string' ? { path: value.path } : {}),
-                ...(typeof value.symbol === 'string' ? { symbol: value.symbol } : {}),
-              }))
-          : undefined,
-      });
-    }
-    case 'finalize':
-      return finalizeGoalWorkloop(ctx, {
-        workId: String(args.work_id ?? ''),
-        forceFailed: args.force_failed === true,
-      });
     case 'stop':
       return stopGoalWorkloop(ctx, {
         workId: String(args.work_id ?? ''),