@moretea-labs/forge 1.8.0 → 1.8.2

package/packages/kernel/work/infrastructure/work-contract-store.ts

@@ -1,38 +1,30 @@
 import { createHash, randomUUID } from 'crypto';
 import { existsSync, mkdirSync } from 'fs';
 import { join } from 'path';
-import { ensureControllerHome, repositoryControllerRoot } from '../../../../src/cli/repositories/controller-home';
+import { ensureControllerHome, scopedOperationRoot, SEMANTIC_SCOPE_KEY } from '../../../../src/cli/repositories/controller-home';
 import { withControllerLock } from '../../../../src/cli/repositories/locks';
 import { readJsonFile, sanitizeFileComponent, writeJsonAtomic } from '../../../../src/runtime/shared/json-files';
 import {
+  listControlPlaneRecordKeys,
   listControlPlaneRecords,
+  listControlPlaneRecordsWithinTransaction,
   listControlPlaneRecordsExcludingPayloadTextValues,
   initializeControlPlanePayloadTextExclusionIndex,
   readControlPlaneRecord,
   readControlPlaneRecordWithinTransaction,
   withControlPlaneTransaction,
   writeControlPlaneRecordWithinTransaction,
+  type SqliteDatabase,
 } from '../../../../src/runtime/control-plane/persistence/sqlite-store';
 import {
   MAX_IMPLEMENTATION_REVIEW_HISTORY,
-  authoritativeImplementationReviewVerificationEvidence,
-  implementationReviewDecisionTarget,
-  latestImplementationReview,
-  normalizeImplementationReviewEvidence,
   validateImplementationReviewRecord,
-  workRequiresImplementationReview,
   type WorkImplementationReviewRecord,
 } from '../domain/implementation-review';
-import { phaseIndex, suggestedActionsForStatus, transitionPhaseEvidence, validateWorkSemanticTransition, validateWorkSemantics } from '../domain/state-machine';
-import {
-  WORK_ADMISSION_POLICY_KEY,
-  WORK_ADMISSION_POLICY_NAMESPACE,
-  WORK_ADMISSION_POLICY_SCOPE,
-  assertWorkAdmissionPolicyAllows,
-  normalWorkAdmissionPolicy,
-  type WorkAdmissionPolicy,
-} from '../domain/admission-policy';
+import { phaseIndex, suggestedActionsForSemanticState, transitionPhaseEvidence, validateWorkSemanticTransition, validateWorkSemantics } from '../domain/state-machine';
+import { normalizeWorkObjectiveRelationIds, validateWorkObjectiveRelationShape } from '../domain/objective-graph';
 import {
+  WORK_PHASES,
   type EvidenceRef,
   type CompletionOutcome,
   type DispatchState,
@@ -43,7 +35,8 @@ import {
   type WorkReconciliationRecord,
   type SubmittedWorkOperation,
   type WorkContract,
-  type WorkContractStatus,
+  type WorkSemanticView,
+  type SemanticWorkState,
   type WorkRisk,
   type WorkKind,
   type WorkPhase,
@@ -54,8 +47,8 @@ import {
   executionPlacementForWork,
   isDirectEditWorkCompletionReceipt,
   isRepositoryCompletionReceipt,
-  isTerminalWorkContractStatus,
-  TERMINAL_WORK_CONTRACT_STATUSES,
+  isTerminalSemanticWorkState,
+  TERMINAL_SEMANTIC_WORK_STATES,
   semanticScopeRefForWork,
 } from '../domain/types';
 
@@ -64,10 +57,9 @@ export type { WorkContractStoreLocation, WorkContractStoreOptions } from '../por
 
 export type CreateWorkContractInput = Omit<
   WorkContract,
-  'schemaVersion' | 'status' | 'createdAt' | 'updatedAt' | 'risk' | 'workKind' | 'dispatchState' | 'evidenceState' | 'completionOutcome' | 'phase' | 'phaseEvidence' | 'completionReceipt' | 'evidenceRefs' | 'handoffRefs' | 'suggestedNextActions' | 'policyDecisions' | 'checkRefs' | 'implementationReviews' | 'reconciliations' | 'driver' | 'worktreePolicy' | 'evidencePolicy' | 'approvalPolicy' | 'recoveryPolicy'
+  'schemaVersion' | 'semanticState' | 'createdAt' | 'updatedAt' | 'risk' | 'workKind' | 'dispatchState' | 'evidenceState' | 'completionOutcome' | 'phase' | 'phaseEvidence' | 'completionReceipt' | 'evidenceRefs' | 'handoffRefs' | 'suggestedNextActions' | 'policyDecisions' | 'checkRefs' | 'implementationReviews' | 'reconciliations' | 'worktreePolicy' | 'evidencePolicy' | 'approvalPolicy' | 'recoveryPolicy'
 > & {
   risk?: WorkRisk;
-  status?: WorkContractStatus;
   createdAt?: string;
   updatedAt?: string;
   workKind?: WorkKind;
@@ -82,16 +74,32 @@ export type CreateWorkContractInput = Omit<
   policyDecisions?: PolicyDecision[];
   checkRefs?: VerificationRecord[];
   reconciliations?: WorkReconciliationRecord[];
-  driver?: WorkContract['driver'];
   worktreePolicy?: WorkContract['worktreePolicy'];
   evidencePolicy?: WorkContract['evidencePolicy'];
   approvalPolicy?: WorkContract['approvalPolicy'];
   recoveryPolicy?: WorkContract['recoveryPolicy'];
+  /**
+   * Legacy ingress-only fields, accepted only so a pre-20261004 frozen MCP
+   * client can still submit without the retired fields being recreated on the
+   * persisted Work contract.
+   *
+   * Replacement owner: concrete mutation scope belongs to the EditSession (and
+   * the execution resource bound to it); a Work carries semantic scope and
+   * evidence only. Bounded consumers: frozen MCP clients whose advertised
+   * `work_prepare` schema still includes `allowed_paths`. Removal condition:
+   * delete these fields (and the matching `AcceptSubmittedWorkInput` pair) as
+   * soon as no supported client sends them; a non-empty value is never
+   * enforced and must never be treated as authorization evidence.
+   */
+  allowedPaths?: string[];
+  forbiddenPaths?: string[];
 };
 
 export interface ListWorkContractOptions extends WorkContractStoreOptions {
-  status?: WorkContractStatus | 'active' | 'all';
+  state?: SemanticWorkState | 'active' | 'all';
   limit?: number;
+  /** Explicit pagination for complete internal historical inventory. */
+  offset?: number;
   detailLevel?: 'summary' | 'detail' | 'raw';
 }
 
@@ -112,12 +120,61 @@ export interface ActiveWorkCandidateSnapshot {
   invalid: InvalidActiveWorkCandidate[];
 }
 
+export interface WorkContractLineageSnapshot {
+  contracts: WorkContract[];
+  invalid: Array<{
+    workId: string;
+    requirementId?: string;
+    semanticParentWorkId?: string;
+    dependsOnWorkIds?: string[];
+    parentWorkId?: string;
+    predecessorWorkId?: string;
+    supersedes: string[];
+    supersededBy?: string;
+    error: string;
+  }>;
+}
+
+export interface WorkSemanticRevisionRecord extends WorkSemanticView {
+  schemaVersion: 1;
+  recordedAt: string;
+}
+
+export interface CreateWorkSemanticInput {
+  workId: string;
+  objective: string;
+  requestId?: string;
+  requirementId?: string;
+  requirementRevision?: number;
+  planId?: string;
+  planRevision?: number;
+  semanticParentWorkId?: string;
+  dependsOnWorkIds?: string[];
+  requestedBy?: 'chatgpt' | 'user' | 'system' | 'scheduler';
+}
+
+export interface ReviseWorkSemanticInput {
+  expectedRevision: number;
+  objective?: string;
+  state?: SemanticWorkState;
+  requirementRevision?: number;
+  planRevision?: number;
+  semanticParentWorkId?: string;
+  dependsOnWorkIds?: string[];
+  resultRefs?: string[];
+}
+
+interface WorkSemanticRevisionStore {
+  schemaVersion: 1;
+  records: WorkSemanticRevisionRecord[];
+}
+
 export interface WorkContractSummary {
   workId: string;
   repoId: string;
-  mode: WorkContract['mode'];
+  /** The one thin authored Work state. */
+  state: SemanticWorkState;
   phase: WorkContract['phase'];
-  status: WorkContractStatus;
   objective: string;
   updatedAt: string;
   handoffCount: number;
@@ -135,15 +192,21 @@ function nowIso(options: WorkContractStoreOptions): string {
   return options.now?.() ?? new Date().toISOString();
 }
 
+export function workContractStoreScopeKey(location: WorkContractStoreLocation): string {
+  const key = location.scopeKey?.trim() || location.repoId?.trim() || '';
+  if (!key) throw new Error('WORK_STORE_SCOPE_REQUIRED: controllerHome requires scopeKey or repoId');
+  return key;
+}
+
 export function workContractRoot(location: WorkContractStoreLocation): string {
   if (location.root) {
     mkdirSync(location.root, { recursive: true });
     return location.root;
   }
-  if (!location.controllerHome || !location.repoId) {
-    throw new Error('work contract store requires either root or controllerHome + repoId');
+  if (!location.controllerHome) {
+    throw new Error('work contract store requires either root or controllerHome + scopeKey/repoId');
   }
-  const root = join(repositoryControllerRoot(location.controllerHome, location.repoId), 'work-contracts');
+  const root = join(scopedOperationRoot(location.controllerHome, workContractStoreScopeKey(location)), 'work-contracts');
   mkdirSync(root, { recursive: true });
   return root;
 }
@@ -153,40 +216,98 @@ export function workContractStorePath(location: WorkContractStoreLocation): stri
 }
 
 export function emptyWorkContractStore(updatedAt: string): WorkContractStore {
-  return { schemaVersion: 3, updatedAt, contracts: [] };
+  return { schemaVersion: 4, updatedAt, contracts: [] };
 }
 
-function initialLifecycleForNewWork(status: WorkContractStatus): Pick<WorkContract, 'phase' | 'dispatchState' | 'evidenceState'> {
-  if (status === 'completed') throw new Error('WORK_COMPLETION_REQUIRES_RECORD_API');
-  if (status === 'running') return { phase: 'implementation', dispatchState: 'running', evidenceState: 'none' };
-  if (status === 'ready') return { phase: 'verification', dispatchState: 'not_dispatched', evidenceState: 'none' };
-  if (status === 'blocked') return { phase: 'implementation', dispatchState: 'blocked', evidenceState: 'none' };
-  if (status === 'failed') return { phase: 'implementation', dispatchState: 'terminal', evidenceState: 'failed' };
-  if (status === 'cancelled') return { phase: 'implementation', dispatchState: 'terminal', evidenceState: 'none' };
-  return { phase: 'implementation', dispatchState: 'not_dispatched', evidenceState: 'none' };
+function currentWorkSemanticRevision(work: WorkContract): number {
+  const revision = Number(work.semanticRevision);
+  return Number.isInteger(revision) && revision > 0 ? revision : 1;
+}
+
+/**
+ * Resolve the one thin semantic Work state. An explicit authored state is
+ * authoritative; a row that predates explicit semantic state derives only its
+ * terminal projection from mechanically recorded completion/cancellation.
+ * Execution/verification/review/delivery/cleanup vocabulary is never a semantic
+ * state: a mechanically blocked or failed Work stays semantically `open` until
+ * an explicit CAS close or cancellation.
+ */
+export function semanticWorkState(work: Pick<WorkContract, 'semanticState'>): SemanticWorkState {
+  return work.semanticState;
+}
+
+export function workSemanticView(work: WorkContract): WorkSemanticView {
+  const resultRefs = [...new Set((work.semanticResultRefs ?? []).map((value) => value.trim()).filter(Boolean))].slice(0, 100);
+  return {
+    workId: work.workId,
+    revision: currentWorkSemanticRevision(work),
+    semanticScope: semanticScopeRefForWork(work),
+    objective: work.objective,
+    state: semanticWorkState(work),
+    ...(work.requirementId?.trim() ? { requirementId: work.requirementId.trim() } : {}),
+    ...(Number.isInteger(work.requirementRevision) && Number(work.requirementRevision) > 0 ? { requirementRevision: Number(work.requirementRevision) } : {}),
+    ...(work.planId?.trim() ? { planId: work.planId.trim() } : {}),
+    ...(Number.isInteger(work.planRevision) && Number(work.planRevision) > 0 ? { planRevision: Number(work.planRevision) } : {}),
+    ...(work.semanticParentWorkId?.trim() ? { semanticParentWorkId: work.semanticParentWorkId.trim() } : {}),
+    ...(normalizeWorkObjectiveRelationIds(work.dependsOnWorkIds).length > 0 ? { dependsOnWorkIds: normalizeWorkObjectiveRelationIds(work.dependsOnWorkIds) } : {}),
+    resultRefs,
+    createdAt: work.createdAt,
+    updatedAt: work.semanticUpdatedAt ?? work.createdAt,
+  };
+}
+
+function workSemanticRevisionKey(workId: string, revision: number): string {
+  return `${sanitizeFileComponent(workId)}-r${revision}`;
+}
+
+function validateWorkObjectiveRelationIntegrity(candidate: WorkContract, contracts: readonly WorkContract[]): void {
+  validateWorkObjectiveRelationShape(candidate);
+  const parent = candidate.semanticParentWorkId?.trim();
+  const dependencies = normalizeWorkObjectiveRelationIds(candidate.dependsOnWorkIds);
+  if (!parent && dependencies.length === 0) return;
+  const byId = new Map(contracts.map((contract) => [contract.workId, contract] as const));
+  byId.set(candidate.workId, candidate);
+  for (const relatedWorkId of [...(parent ? [parent] : []), ...dependencies]) {
+    const related = byId.get(relatedWorkId);
+    if (!related) throw new Error(`WORK_OBJECTIVE_RELATION_NOT_FOUND: ${relatedWorkId}`);
+    if ((related.lifecycleRole ?? 'primary') !== 'primary') throw new Error(`WORK_OBJECTIVE_RELATION_TARGET_NOT_PRIMARY: ${relatedWorkId}`);
+  }
+  const seenParents = new Set<string>();
+  let parentCursor = parent;
+  while (parentCursor) {
+    if (parentCursor === candidate.workId) throw new Error('WORK_SEMANTIC_PARENT_CYCLE');
+    if (seenParents.has(parentCursor)) throw new Error('WORK_SEMANTIC_PARENT_TARGET_CYCLE');
+    seenParents.add(parentCursor);
+    parentCursor = byId.get(parentCursor)?.semanticParentWorkId?.trim();
+  }
+  const dependencyReachesCandidate = (workId: string, visiting: Set<string>): boolean => {
+    if (workId === candidate.workId) return true;
+    if (visiting.has(workId)) return false;
+    visiting.add(workId);
+    const work = byId.get(workId);
+    if (!work) return false;
+    return normalizeWorkObjectiveRelationIds(work.dependsOnWorkIds)
+      .some((dependency) => dependencyReachesCandidate(dependency, visiting));
+  };
+  for (const dependency of dependencies) {
+    if (dependencyReachesCandidate(dependency, new Set())) throw new Error('WORK_DEPENDENCY_CYCLE');
+  }
 }
 
-function legacyInferredDispatchState(status: WorkContractStatus): DispatchState {
-  if (status === 'open' || status === 'ready') return 'not_dispatched';
-  if (status === 'running') return 'running';
-  if (status === 'blocked') return 'blocked';
-  return 'terminal';
+function workSemanticRevisionStorePath(options: WorkContractStoreOptions): string {
+  return join(workContractRoot(options), 'semantic-revisions.json');
 }
 
-function legacyInferredPhase(status: WorkContractStatus): WorkContract['phase'] {
-  if (status === 'ready') return 'verification';
-  if (status === 'completed' || status === 'failed' || status === 'cancelled') return 'cleanup';
-  return 'implementation';
+function readWorkSemanticRevisionStore(options: WorkContractStoreOptions): WorkSemanticRevisionStore {
+  return readJsonFile<WorkSemanticRevisionStore>(workSemanticRevisionStorePath(options), { schemaVersion: 1, records: [] });
 }
 
-function legacyInferredEvidenceState(status: WorkContractStatus): EvidenceState {
-  if (status === 'failed') return 'failed';
-  if (status === 'completed') return 'partial';
-  return 'none';
+function initialLifecycleForNewWork(): Pick<WorkContract, 'phase' | 'dispatchState' | 'evidenceState'> {
+  return { phase: 'implementation', dispatchState: 'not_dispatched', evidenceState: 'none' };
 }
 
 function initialPhaseEvidenceForNewWork(
-  input: Pick<WorkContract, 'phase' | 'status' | 'evidenceRefs' | 'updatedAt'>,
+  input: Pick<WorkContract, 'phase' | 'evidenceRefs' | 'updatedAt'> & { phaseState?: WorkPhaseEvidenceState },
 ): WorkPhaseEvidenceMap {
   const currentIndex = phaseIndex(input.phase);
   return Object.fromEntries((['implementation', 'verification', 'review', 'delivery', 'cleanup'] as WorkPhase[]).map((phase) => {
@@ -195,13 +316,7 @@ function initialPhaseEvidenceForNewWork(
       ? 'satisfied'
       : index > currentIndex
         ? 'pending'
-        : input.status === 'failed'
-          ? 'failed'
-          : input.status === 'cancelled'
-            ? 'skipped'
-            : input.status === 'blocked' || input.status === 'ready'
-              ? 'blocked'
-              : 'active';
+        : input.phaseState ?? 'active';
     return [phase, {
       state,
       source: 'recorded' as const,
@@ -209,7 +324,7 @@ function initialPhaseEvidenceForNewWork(
         ? `Canonical Work was admitted after phase ${phase}.`
         : index > currentIndex
           ? `Waiting for Work phase ${phase}.`
-          : `Canonical Work admitted in ${phase} with status ${input.status}.`,
+          : `Canonical Work admitted in ${phase}.`,
       evidenceRefs: index <= currentIndex ? input.evidenceRefs.slice(0, 20) : [],
       recordedAt: input.updatedAt,
     } satisfies WorkPhaseEvidence];
@@ -217,7 +332,7 @@ function initialPhaseEvidenceForNewWork(
 }
 
 function legacyPhaseEvidence(
-  contract: Pick<WorkContract, 'phase' | 'status' | 'evidenceRefs' | 'completionReceipt' | 'updatedAt'>,
+  contract: Pick<WorkContract, 'phase' | 'evidenceRefs' | 'completionReceipt' | 'updatedAt'> & { legacyStatus?: 'open' | 'running' | 'blocked' | 'ready' | 'completed' | 'failed' | 'cancelled' },
   source: WorkPhaseEvidence['source'] = 'legacy_inferred',
 ): WorkPhaseEvidenceMap {
   const currentIndex = phaseIndex(contract.phase);
@@ -226,8 +341,8 @@ function legacyPhaseEvidence(
     const index = phaseIndex(phase);
     let state: WorkPhaseEvidenceState = index < currentIndex ? 'satisfied' : index === currentIndex ? 'active' : 'pending';
     if (completedByReceipt) state = phase === 'review' ? 'skipped' : 'satisfied';
-    else if (contract.status === 'failed' && phase === contract.phase) state = 'failed';
-    else if (contract.status === 'cancelled' && phase === contract.phase) state = 'skipped';
+    else if (contract.legacyStatus === 'failed' && phase === contract.phase) state = 'failed';
+    else if (contract.legacyStatus === 'cancelled' && phase === contract.phase) state = 'skipped';
     const receiptId = contract.completionReceipt && (phase === 'delivery' || phase === 'cleanup')
       ? contract.completionReceipt.receiptId
       : undefined;
@@ -248,26 +363,31 @@ function legacyPhaseEvidence(
   })) as WorkPhaseEvidenceMap;
 }
 
-function sqliteBacked(options: WorkContractStoreOptions): options is WorkContractStoreOptions & { controllerHome: string; repoId: string } {
-  // A caller-provided root is a test/portable compatibility store.  Runtime
-  // controller state always carries controllerHome + repoId and is SQLite.
-  return Boolean(!options.root && options.controllerHome?.trim() && options.repoId?.trim());
+function sqliteBacked(options: WorkContractStoreOptions): options is WorkContractStoreOptions & { controllerHome: string } {
+  // A caller-provided root is a test/portable compatibility store. Runtime
+  // control-plane state uses one explicit scope key: semantic scope for authored
+  // Work, repository scope for legacy/repository execution Work.
+  return Boolean(!options.root && options.controllerHome?.trim() && (options.scopeKey?.trim() || options.repoId?.trim()));
 }
 
 function migrateLegacyWorkContract(legacy: WorkContract): WorkContract {
-  const mappedStatus = ({ pending: 'open', waiting_for_review: 'ready', succeeded: 'completed' } as Record<string, WorkContractStatus>)[String(legacy.status)] ?? legacy.status;
-  // Historical terminal labels without the Work-owned receipt are not
-  // completion authority. Reopen them at delivery so callers can obtain an
-  // exact receipt instead of projecting an unproven success.
-  const status = mappedStatus === 'completed' && !legacy.completionReceipt ? 'ready' : mappedStatus;
+  // One-way schema migration only: v1-v3 rows may still carry retired status.
+  // v4 strips it permanently and keeps semanticState as the only Work lifecycle state.
+  // Removal condition: once supported Controller Homes contain no schema<4 Work rows for one full release boundary, delete legacyStatus handling entirely.
+  const legacyStatus = (legacy as WorkContract & { status?: 'open' | 'running' | 'blocked' | 'ready' | 'completed' | 'failed' | 'cancelled' }).status;
+  const semanticState: SemanticWorkState = legacy.semanticState
+    ?? (legacyStatus === 'completed' ? 'completed' : legacyStatus === 'cancelled' ? 'cancelled' : 'open');
+  // Phase is a mechanical checkpoint projection only. A legacy row without a
+  // persisted phase is admitted at the neutral first checkpoint; terminal
+  // status never advances phase, and status is never a phase-transition authority.
   const phase = legacy.completionReceipt
     ? 'cleanup'
-    : mappedStatus === 'completed'
+    : semanticState === 'completed'
       ? 'delivery'
-      : legacy.phase ?? legacyInferredPhase(status);
+      : legacy.phase ?? 'implementation';
   const legacyDefaults = legacyPhaseEvidence({
     phase,
-    status,
+    legacyStatus,
     evidenceRefs: legacy.evidenceRefs ?? [],
     completionReceipt: legacy.completionReceipt,
     updatedAt: legacy.updatedAt,
@@ -303,54 +423,92 @@ function migrateLegacyWorkContract(legacy: WorkContract): WorkContract {
             },
       }
     : legacyDefaults;
+  const {
+    status: _retiredStatus,
+    allowedPaths: _retiredAllowedPaths,
+    forbiddenPaths: _retiredForbiddenPaths,
+    ...legacyWithoutRetiredFields
+  } = legacy as WorkContract & { status?: unknown; allowedPaths?: unknown; forbiddenPaths?: unknown };
+  void _retiredStatus;
+  void _retiredAllowedPaths;
+  void _retiredForbiddenPaths;
+  // Before Work kind and completion outcome were made a single typed contract,
+  // delivery-reconciliation records retained their operational label even after
+  // a repository receipt proved that they advanced the target revision. The
+  // current contract rightly rejects that combination. Preserve the receipt and
+  // semantic terminal state, but migrate the obsolete label to the current
+  // repository-change classification so terminal history remains readable and
+  // cannot poison scheduler relay discovery forever.
+  const workKind = legacy.workKind === 'reconciliation'
+    && legacy.completionOutcome === 'completed_changed'
+    && legacy.completionReceipt
+    && isRepositoryCompletionReceipt(legacy.completionReceipt)
+    ? 'repository_change' as const
+    : legacy.workKind ?? 'repository_change';
   return validateWorkSemantics({
-    ...legacy,
-    schemaVersion: 3,
+    ...legacyWithoutRetiredFields,
+    schemaVersion: 4,
     scopeRef: semanticScopeRefForWork(legacy),
     executionPlacement: executionPlacementForWork(legacy),
-    status,
+    semanticState,
+    semanticRevision: legacy.semanticRevision && legacy.semanticRevision > 0 ? legacy.semanticRevision : 1,
+    semanticUpdatedAt: legacy.semanticUpdatedAt ?? legacy.updatedAt,
     phase,
     phaseEvidence,
     risk: legacy.risk ?? 'medium',
-    workKind: legacy.workKind ?? 'repository_change',
-    dispatchState: legacy.dispatchState ?? legacyInferredDispatchState(status),
-    evidenceState: legacy.evidenceState ?? legacyInferredEvidenceState(status),
-    suggestedNextActions: suggestedActionsForStatus(status, legacy.suggestedNextActions ?? []),
+    workKind,
+    dispatchState: legacy.dispatchState ?? 'not_dispatched',
+    evidenceState: legacy.evidenceState ?? 'none',
+    suggestedNextActions: suggestedActionsForSemanticState(semanticState, legacy.suggestedNextActions ?? []),
     implementationReviews: legacy.implementationReviews ?? [],
     reconciliations: legacy.reconciliations ?? [],
-    driver: (legacy.driver as unknown as { preferred?: string } | undefined)?.preferred === 'codex_worker'
-      ? { ...legacy.driver, preferred: 'external_controller', allowWorker: false }
-      : legacy.driver,
   });
 }
 
 function validateCanonicalWorkContract(contract: WorkContract): WorkContract {
-  if (contract.schemaVersion !== 3) {
+  if (contract.schemaVersion !== 4) {
     throw new Error(`WORK_CONTRACT_SCHEMA_MIGRATION_REQUIRED: ${contract.workId}:schema=${String(contract.schemaVersion)}`);
   }
   return validateWorkSemantics(contract);
 }
 
-function storedWorkContractNeedsMigration(contract: WorkContract): boolean {
+function storedWorkContractNeedsMigration(contract: WorkContract, persistedSchemaVersion: number = contract.schemaVersion): boolean {
   const phaseEvidence = contract.phaseEvidence as Partial<WorkPhaseEvidenceMap> | undefined;
   // Some pre-review-checkpoint rows were stamped with the current outer
   // schema while omitting only `review`. That exact historical shape remains
   // migration-compatible, but it must be persisted once rather than inferred
   // repeatedly by the normal read path.
-  const legacyReviewGap = contract.schemaVersion === 3
+  const legacyReviewGap = persistedSchemaVersion === 3
     && phaseEvidence
     && !phaseEvidence.review
     && phaseEvidence.implementation
     && phaseEvidence.verification
     && phaseEvidence.delivery
     && phaseEvidence.cleanup;
-  return contract.schemaVersion !== 3 || Boolean(legacyReviewGap);
+  return persistedSchemaVersion !== 4
+    || contract.semanticState === undefined
+    || Object.prototype.hasOwnProperty.call(contract as object, 'status')
+    || Object.prototype.hasOwnProperty.call(contract as object, 'allowedPaths')
+    || Object.prototype.hasOwnProperty.call(contract as object, 'forbiddenPaths')
+    || Boolean(legacyReviewGap);
+}
+
+function workContractAtPersistedSchema(contract: WorkContract, persistedSchemaVersion: number): WorkContract {
+  return contract.schemaVersion === persistedSchemaVersion
+    ? contract
+    : { ...contract, schemaVersion: persistedSchemaVersion as WorkContract['schemaVersion'] };
 }
 
-function canonicalizeStoredWorkContract(contract: WorkContract): WorkContract {
-  return storedWorkContractNeedsMigration(contract)
-    ? migrateLegacyWorkContract(contract)
-    : validateCanonicalWorkContract(contract);
+function canonicalizeStoredWorkContract(contract: WorkContract, persistedSchemaVersion: number = contract.schemaVersion): WorkContract {
+  // The control-plane record envelope is the persisted schema authority. Some
+  // historical writers advanced the payload first, leaving it stamped v4 under
+  // a v3 envelope. Read it as the envelope declares so the one-way migration
+  // repairs the whole stored row rather than accepting a partially migrated
+  // contract indefinitely.
+  const persisted = workContractAtPersistedSchema(contract, persistedSchemaVersion);
+  return storedWorkContractNeedsMigration(persisted, persistedSchemaVersion)
+    ? migrateLegacyWorkContract(persisted)
+    : validateCanonicalWorkContract(persisted);
 }
 
 /**
@@ -363,44 +521,45 @@ export function canonicalizeWorkContractForAuthority(contract: WorkContract): Wo
 }
 
 function normalizeWorkContractStore(store: WorkContractStore): WorkContractStore {
-  // v1/v2 compatibility is a one-way cutover. v3 records are validated as-is;
-  // no current lifecycle field is inferred from status during normal reads.
-  return { schemaVersion: 3, updatedAt: store.updatedAt, contracts: store.contracts.map(canonicalizeStoredWorkContract) };
+  // v1-v3 rows are a one-way schema migration into v4. v4 rows are validated as-is;
+  // retired status is never inferred or exposed during normal reads.
+  // Removal condition: delete this migration branch after supported Controller Homes report zero schema<4 Work rows across one full release boundary.
+  return { schemaVersion: 4, updatedAt: store.updatedAt, contracts: store.contracts.map((contract) => canonicalizeStoredWorkContract(contract)) };
 }
 
 export function readWorkContractStore(options: WorkContractStoreOptions): WorkContractStore {
   if (!sqliteBacked(options)) {
     const raw = readJsonFile<WorkContractStore>(workContractStorePath(options), emptyWorkContractStore(nowIso(options)));
     const normalized = normalizeWorkContractStore(raw);
-    if (raw.schemaVersion !== 3 || raw.contracts.some(storedWorkContractNeedsMigration)) {
+    if (raw.schemaVersion !== 4 || raw.contracts.some((contract) => storedWorkContractNeedsMigration(contract))) {
       writeJsonAtomic(workContractStorePath(options), normalized);
     }
     return normalized;
   }
   const records = listControlPlaneRecords<WorkContract>(options.controllerHome, {
     namespace: 'work_contract',
-    scope: options.repoId,
+    scope: workContractStoreScopeKey(options),
     limit: 5_000,
   });
   if (records.length > 0) {
     const normalized = normalizeWorkContractStore({
-      schemaVersion: 3,
+      schemaVersion: 4,
       updatedAt: records[0]?.updatedAt ?? nowIso(options),
-      contracts: records.map((record) => record.value),
+      contracts: records.map((record) => workContractAtPersistedSchema(record.value, record.schemaVersion)),
     });
     const legacyRows = records
       .map((record, index) => ({ record, contract: normalized.contracts[index]! }))
-      .filter(({ record }) => storedWorkContractNeedsMigration(record.value));
+      .filter(({ record }) => storedWorkContractNeedsMigration(record.value, record.schemaVersion));
     if (legacyRows.length > 0) {
       withControlPlaneTransaction(options.controllerHome, (database) => {
         for (const { record, contract } of legacyRows) {
           writeControlPlaneRecordWithinTransaction(database, {
             namespace: 'work_contract',
-            scope: options.repoId,
+            scope: workContractStoreScopeKey(options),
             key: contract.workId,
-            schemaVersion: 3,
+            schemaVersion: 4,
             value: contract,
-            action: 'work_contract_schema_v3_migrated',
+            action: 'work_contract_schema_v4_migrated',
             expectedRevision: record.revision,
           });
         }
@@ -414,7 +573,7 @@ export function readWorkContractStore(options: WorkContractStoreOptions): WorkCo
   const legacyRecord = readControlPlaneRecord<WorkContractStore>(
     options.controllerHome,
     'work_contract_store',
-    options.repoId,
+    workContractStoreScopeKey(options),
     'index',
   );
   const legacy = legacyRecord?.value
@@ -423,12 +582,12 @@ export function readWorkContractStore(options: WorkContractStoreOptions): WorkCo
   if (normalized.contracts.length > 0) {
     withControlPlaneTransaction(options.controllerHome, (database) => {
       for (const contract of normalized.contracts) {
-        if (readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', options.repoId, contract.workId)) continue;
+        if (readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', workContractStoreScopeKey(options), contract.workId)) continue;
         writeControlPlaneRecordWithinTransaction(database, {
           namespace: 'work_contract',
-          scope: options.repoId,
+          scope: workContractStoreScopeKey(options),
           key: contract.workId,
-          schemaVersion: 3,
+          schemaVersion: 4,
           value: contract,
           action: 'work_contract_legacy_import',
           expectedRevision: null,
@@ -439,6 +598,65 @@ export function readWorkContractStore(options: WorkContractStoreOptions): WorkCo
   return normalized;
 }
 
+/**
+ * Read valid Work rows without allowing an unrelated corrupt historical row to
+ * poison a lineage-scoped ControllerRound projection. Invalid rows retain only
+ * their identity and explicit lineage references so callers can fail closed if
+ * the malformed row may belong to the requested lineage.
+ */
+export function readWorkContractLineageSnapshot(options: WorkContractStoreOptions): WorkContractLineageSnapshot {
+  if (!sqliteBacked(options)) {
+    const store = readJsonFile<WorkContractStore>(workContractStorePath(options), emptyWorkContractStore(nowIso(options)));
+    const contracts: WorkContract[] = [];
+    const invalid: WorkContractLineageSnapshot['invalid'] = [];
+    for (const raw of store.contracts) {
+      try {
+        contracts.push(canonicalizeStoredWorkContract(raw));
+      } catch (error) {
+        invalid.push(lineageInvalidWork(raw, error));
+      }
+    }
+    return { contracts, invalid };
+  }
+
+  const records = listControlPlaneRecords<WorkContract>(options.controllerHome, {
+    namespace: 'work_contract',
+    scope: workContractStoreScopeKey(options),
+    limit: 5_000,
+  });
+  if (records.length === 0) return { contracts: readWorkContractStore(options).contracts, invalid: [] };
+
+  const contracts: WorkContract[] = [];
+  const invalid: WorkContractLineageSnapshot['invalid'] = [];
+  for (const record of records) {
+    try {
+      contracts.push(canonicalizeStoredWorkContract(record.value, record.schemaVersion));
+    } catch (error) {
+      invalid.push(lineageInvalidWork(record.value, error, record.key));
+    }
+  }
+  return { contracts, invalid };
+}
+
+function lineageInvalidWork(
+  raw: WorkContract,
+  error: unknown,
+  recordKey?: string,
+): WorkContractLineageSnapshot['invalid'][number] {
+  const clean = (id: unknown): string | undefined => typeof id === 'string' && id.trim() ? id.trim() : undefined;
+  return {
+    workId: clean(raw.workId) ?? recordKey ?? '',
+    ...(clean(raw.requirementId) ? { requirementId: clean(raw.requirementId) } : {}),
+    ...(clean(raw.semanticParentWorkId) ? { semanticParentWorkId: clean(raw.semanticParentWorkId) } : {}),
+    dependsOnWorkIds: Array.isArray(raw.dependsOnWorkIds) ? raw.dependsOnWorkIds.map(clean).filter((id): id is string => Boolean(id)) : [],
+    ...(clean(raw.parentWorkId) ? { parentWorkId: clean(raw.parentWorkId) } : {}),
+    ...(clean(raw.predecessorWorkId) ? { predecessorWorkId: clean(raw.predecessorWorkId) } : {}),
+    supersedes: Array.isArray(raw.supersedes) ? raw.supersedes.map(clean).filter((id): id is string => Boolean(id)) : [],
+    ...(clean(raw.supersededBy) ? { supersededBy: clean(raw.supersededBy) } : {}),
+    error: error instanceof Error ? error.message : String(error),
+  };
+}
+
 export function writeWorkContractStore(options: WorkContractStoreOptions, store: WorkContractStore): WorkContractStore {
   if (!sqliteBacked(options)) {
     writeJsonAtomic(workContractStorePath(options), store);
@@ -450,7 +668,7 @@ export function writeWorkContractStore(options: WorkContractStoreOptions, store:
       const current = readControlPlaneRecordWithinTransaction<WorkContract>(
         database,
         'work_contract',
-        options.repoId,
+        workContractStoreScopeKey(options),
         contract.workId,
       );
       // SQLite is authoritative per Work row. Aggregate-store callers may still
@@ -459,9 +677,9 @@ export function writeWorkContractStore(options: WorkContractStoreOptions, store:
       if (current && JSON.stringify(current.value) === JSON.stringify(value)) continue;
       writeControlPlaneRecordWithinTransaction(database, {
         namespace: 'work_contract',
-        scope: options.repoId,
+        scope: workContractStoreScopeKey(options),
         key: contract.workId,
-        schemaVersion: 3,
+        schemaVersion: 4,
         value,
         action: 'work_contract_write',
         expectedRevision: current?.revision ?? null,
@@ -475,44 +693,65 @@ function withWorkContractStoreWrite<T>(options: WorkContractStoreOptions, operat
   if (!sqliteBacked(options)) return operation();
   return withControllerLock(
     options.controllerHome,
-    { scope: 'global', resource: `work-contract-store-${sanitizeFileComponent(options.repoId)}` },
-    `work-contract-store:${options.repoId}`,
+    { scope: 'global', resource: `work-contract-store-${sanitizeFileComponent(workContractStoreScopeKey(options))}` },
+    `work-contract-store:${workContractStoreScopeKey(options)}`,
     operation,
     undefined,
     5_000,
   );
 }
 
-
-function assertCanonicalWorkAdmissionAllowed(
+function withExactWorkContractWrite<T>(
   options: WorkContractStoreOptions,
-  input: { operation: 'create' | 'continue' | 'maintenance'; workId?: string },
-): WorkAdmissionPolicy {
-  if (!options.controllerHome) return normalWorkAdmissionPolicy(nowIso(options));
-  const policy = readControlPlaneRecord<WorkAdmissionPolicy>(
+  workIdInput: string,
+  operation: () => T,
+): T {
+  if (!sqliteBacked(options)) return operation();
+  const workId = sanitizeFileComponent(workIdInput);
+  return withControllerLock(
     options.controllerHome,
-    WORK_ADMISSION_POLICY_NAMESPACE,
-    WORK_ADMISSION_POLICY_SCOPE,
-    WORK_ADMISSION_POLICY_KEY,
-  )?.value ?? normalWorkAdmissionPolicy(nowIso(options));
-  return assertWorkAdmissionPolicyAllows(policy, input);
+    { scope: 'global', resource: `work-contract-${workId}` },
+    `work-contract:${workId}`,
+    operation,
+    undefined,
+    5_000,
+  );
 }
 
-function defaultDriver(mode: WorkContract['mode']): WorkContract['driver'] {
-  if (mode === 'direct_control') {
-    return { preferred: 'direct_edit', allowWorker: false, allowDirectEdit: true };
-  }
-  if (mode === 'handoff_only') {
-    return { preferred: 'handoff_only', allowWorker: false, allowDirectEdit: false };
-  }
-  return { preferred: 'direct_edit', allowWorker: false, allowDirectEdit: true };
+
+export function createWorkSemanticContext(options: WorkContractStoreOptions, input: CreateWorkSemanticInput): WorkContract {
+  const semanticOptions = options.scopeKey?.trim() || !options.repoId?.trim()
+    ? options
+    : { ...options, scopeKey: options.repoId.trim() };
+  return createWorkContract(semanticOptions, {
+    workId: input.workId,
+    repoId: options.repoId?.trim() ?? '',
+    objective: input.objective,
+    acceptanceCriteria: [],
+    constraints: {},
+    workKind: 'investigation',
+    lifecycleRole: 'primary',
+    requestedBy: input.requestedBy ?? 'chatgpt',
+    checks: [],
+    ...(input.requirementId?.trim() ? { requirementId: input.requirementId.trim() } : {}),
+    ...(Number.isInteger(input.requirementRevision) ? { requirementRevision: input.requirementRevision } : {}),
+    ...(input.planId?.trim() ? { planId: input.planId.trim() } : {}),
+    ...(Number.isInteger(input.planRevision) ? { planRevision: input.planRevision } : {}),
+    ...(input.semanticParentWorkId !== undefined ? { semanticParentWorkId: input.semanticParentWorkId.trim() || undefined } : {}),
+    ...(input.dependsOnWorkIds !== undefined ? { dependsOnWorkIds: normalizeWorkObjectiveRelationIds(input.dependsOnWorkIds) } : {}),
+    ...(input.requestId?.trim() ? { requestId: input.requestId.trim() } : {}),
+  });
 }
 
 export function createWorkContract(options: WorkContractStoreOptions, input: CreateWorkContractInput): WorkContract {
-  if (options.controllerHome) {
-    assertCanonicalWorkAdmissionAllowed(options, { operation: 'create', workId: input.workId });
+  // Thin semantic Work is authored context. Repository execution and concurrency
+  // are fenced by placement/resource ownership rather than a global migration gate.
+  const runtimeInput = input as CreateWorkContractInput & Record<string, unknown>;
+  if (Object.prototype.hasOwnProperty.call(runtimeInput, 'status')) throw new Error('WORK_RETIRED_FIELD_REJECTED: status');
+  for (const field of ['semanticState', 'semanticRevision', 'semanticUpdatedAt']) {
+    if (Object.prototype.hasOwnProperty.call(runtimeInput, field)) throw new Error(`WORK_SEMANTIC_FIELDS_REQUIRE_REVISION_API: ${field}`);
   }
-  if (input.status === 'completed' || input.completionReceipt || input.completionOutcome) {
+  if (input.completionReceipt || input.completionOutcome) {
     throw new Error('WORK_COMPLETION_REQUIRES_RECORD_API');
   }
   const create = (): WorkContract => {
@@ -521,7 +760,7 @@ export function createWorkContract(options: WorkContractStoreOptions, input: Cre
     const predecessorWorkId = input.predecessorWorkId ? sanitizeFileComponent(input.predecessorWorkId) : undefined;
     if (predecessorWorkId === workId) throw new Error('WORK_PREDECESSOR_SELF_REFERENCE');
     const contract: WorkContract = validateWorkSemantics({
-      schemaVersion: 3,
+      schemaVersion: 4,
       workId,
       scopeRef: semanticScopeRefForWork({
         workId,
@@ -530,7 +769,8 @@ export function createWorkContract(options: WorkContractStoreOptions, input: Cre
         planId: input.planId,
         planStepId: input.planStepId,
       }),
-      executionPlacement: input.executionPlacement ?? executionPlacementForWork({ repoId: input.repoId, checkoutId: input.checkoutId }),
+      executionPlacement: input.executionPlacement
+        ?? (input.repoId?.trim() ? executionPlacementForWork({ repoId: input.repoId, checkoutId: input.checkoutId }) : undefined),
       repoId: input.repoId,
       checkoutId: input.checkoutId,
       principalId: input.principalId,
@@ -538,39 +778,41 @@ export function createWorkContract(options: WorkContractStoreOptions, input: Cre
       baseRevision: input.baseRevision,
       repositoryBaseState: input.repositoryBaseState,
       workspaceFingerprint: input.workspaceFingerprint,
-      routeDecisionFingerprint: input.routeDecisionFingerprint,
-      routeDecision: input.routeDecision,
-      mode: input.mode,
       objective: input.objective.slice(0, 2_000),
+      semanticRevision: 1,
+      semanticUpdatedAt: input.updatedAt ?? at,
+      semanticState: 'open',
       acceptanceCriteria: (input.acceptanceCriteria ?? []).slice(0, 20).map((item) => item.slice(0, 500)),
-      constraints: input.constraints ?? { requireHandoffOnAmbiguity: true },
+      constraints: input.constraints ?? {},
       risk: input.risk ?? 'medium',
       engineeringContext: input.engineeringContext,
       workKind: input.workKind ?? 'repository_change',
       lifecycleRole: input.lifecycleRole ?? 'primary',
       parentWorkId: input.parentWorkId?.trim() || undefined,
+      semanticParentWorkId: input.semanticParentWorkId?.trim() || undefined,
+      dependsOnWorkIds: normalizeWorkObjectiveRelationIds(input.dependsOnWorkIds),
       predecessorWorkId: predecessorWorkId && predecessorWorkId !== 'unknown' ? predecessorWorkId : undefined,
       supersedes: input.supersedes?.map((value) => sanitizeFileComponent(value)).filter((value) => value !== 'unknown').slice(0, 50),
       supersededBy: input.supersededBy ? sanitizeFileComponent(input.supersededBy) : undefined,
       supersessionReason: input.supersessionReason?.trim().slice(0, 500),
-      dispatchState: input.dispatchState ?? initialLifecycleForNewWork(input.status ?? 'open').dispatchState,
-      evidenceState: input.evidenceState ?? initialLifecycleForNewWork(input.status ?? 'open').evidenceState,
+      dispatchState: input.dispatchState ?? initialLifecycleForNewWork().dispatchState,
+      evidenceState: input.evidenceState ?? initialLifecycleForNewWork().evidenceState,
       completionOutcome: input.completionOutcome,
-      phase: input.phase ?? initialLifecycleForNewWork(input.status ?? 'open').phase,
+      phase: input.phase ?? initialLifecycleForNewWork().phase,
       phaseEvidence: initialPhaseEvidenceForNewWork({
-        phase: input.phase ?? initialLifecycleForNewWork(input.status ?? 'open').phase,
-        status: input.status ?? 'open',
+        phase: input.phase ?? initialLifecycleForNewWork().phase,
         evidenceRefs: input.evidenceRefs ?? [],
         updatedAt: input.updatedAt ?? at,
       }),
       completionReceipt: input.completionReceipt,
-      status: input.status ?? 'open',
       createdAt: at,
       updatedAt: input.updatedAt ?? at,
       issueId: input.issueId,
       taskId: input.taskId,
       requirementId: input.requirementId,
+      requirementRevision: input.requirementRevision,
       planId: input.planId,
+      planRevision: input.planRevision,
       planStepId: input.planStepId,
       planSourceRevision: input.planSourceRevision,
       scopeSummary: input.scopeSummary?.slice(0, 1_000),
@@ -580,13 +822,12 @@ export function createWorkContract(options: WorkContractStoreOptions, input: Cre
         actualChangedPaths: [...new Set(input.scopeEvidence.actualChangedPaths)].slice(0, 500),
         recordedAt: input.scopeEvidence.recordedAt,
       } : undefined,
-      allowedPaths: (input.allowedPaths ?? []).slice(0, 50),
-      forbiddenPaths: (input.forbiddenPaths ?? []).slice(0, 50),
       checks: (input.checks ?? []).slice(0, 30),
-      driver: input.driver ?? defaultDriver(input.mode),
       worktreePolicy: input.worktreePolicy ?? {
-        required: input.mode === 'goal_workloop',
-        reason: input.mode === 'goal_workloop' ? 'Goal workloop defaults to isolated worktree execution.' : undefined,
+        required: input.constraints?.workspaceMode === 'isolated',
+        reason: input.constraints?.workspaceMode === 'isolated'
+          ? 'Typed workspace placement requires an isolated worktree.'
+          : undefined,
       },
       evidencePolicy: input.evidencePolicy ?? {
         defaultDetailLevel: 'summary',
@@ -616,14 +857,21 @@ export function createWorkContract(options: WorkContractStoreOptions, input: Cre
 
     if (sqliteBacked(options)) {
       withControlPlaneTransaction(options.controllerHome, (database) => {
-        if (readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', options.repoId, contract.workId)) {
+        const scope = workContractStoreScopeKey(options);
+        if (readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', scope, contract.workId)) {
           throw new Error(`work contract already exists: ${contract.workId}`);
         }
+        if (contract.semanticParentWorkId?.trim() || contract.dependsOnWorkIds?.length) {
+          const relationContracts = listControlPlaneRecordsWithinTransaction<WorkContract>(database, {
+            namespace: 'work_contract', scope, limit: 5_000,
+          }).map((record) => canonicalizeStoredWorkContract(record.value));
+          validateWorkObjectiveRelationIntegrity(contract, relationContracts);
+        }
         writeControlPlaneRecordWithinTransaction(database, {
           namespace: 'work_contract',
-          scope: options.repoId,
+          scope,
           key: contract.workId,
-          schemaVersion: 3,
+          schemaVersion: 4,
           value: contract,
           action: 'work_contract_created',
           expectedRevision: null,
@@ -635,15 +883,19 @@ export function createWorkContract(options: WorkContractStoreOptions, input: Cre
     if (store.contracts.some((existing) => existing.workId === contract.workId)) {
       throw new Error(`work contract already exists: ${contract.workId}`);
     }
+    if (contract.semanticParentWorkId?.trim() || contract.dependsOnWorkIds?.length) {
+      validateWorkObjectiveRelationIntegrity(contract, store.contracts);
+    }
     const nextStore: WorkContractStore = {
-      schemaVersion: 3,
+      schemaVersion: 4,
       updatedAt: contract.updatedAt,
       contracts: [contract, ...store.contracts],
     };
     writeWorkContractStore(options, nextStore);
     return contract;
   };
-  return create();
+  const relationAware = Boolean(input.semanticParentWorkId?.trim() || input.dependsOnWorkIds?.length);
+  return withExactWorkContractWrite(options, input.workId, () => relationAware ? withWorkContractStoreWrite(options, create) : create());
 }
 
 interface WorkRequestIndexRecord {
@@ -700,7 +952,7 @@ export function acceptSubmittedWorkContract(
   if (parentWorkId) {
     const parent = getWorkContract({ controllerHome: home, repoId: input.repoId, now: options.now }, parentWorkId);
     if (!parent) throw new Error(`PARENT_WORK_NOT_FOUND: ${parentWorkId}`);
-    if (isTerminalWorkContractStatus(parent.status)) throw new Error(`PARENT_WORK_TERMINAL: ${parentWorkId}:${parent.status}`);
+    if (semanticWorkState(parent) !== 'open') throw new Error(`PARENT_WORK_TERMINAL: ${parentWorkId}:${semanticWorkState(parent)}`);
     if ((parent.lifecycleRole ?? 'primary') !== 'primary') throw new Error(`PARENT_WORK_NOT_PRIMARY: ${parentWorkId}`);
   }
   const lockId = createHash('sha256').update(requestId).digest('hex').slice(0, 24);
@@ -719,30 +971,18 @@ export function acceptSubmittedWorkContract(
       repoId: input.repoId,
       principalId: input.principalId,
       controllerInstanceId: input.controllerInstanceId,
-      mode: input.mode ?? 'direct_control',
       lifecycleRole: 'execution_child',
       parentWorkId,
       objective: (input.objective ?? `Typed operation ${input.operation.name}`).slice(0, 2_000),
       acceptanceCriteria: input.acceptanceCriteria ?? [],
       workKind: input.workKind,
       risk: input.risk,
-      constraints: input.constraints ?? { requireHandoffOnAmbiguity: true },
-      allowedPaths: input.allowedPaths ?? [],
-      forbiddenPaths: input.forbiddenPaths ?? [],
+      constraints: input.constraints ?? {},
       checks: input.checks ?? [],
       requestedBy: input.requestedBy ?? 'chatgpt',
-      status: 'open',
       requestId,
       submittedOperation: input.operation,
-      driver: { preferred: 'external_controller', allowWorker: false, allowDirectEdit: input.operation.mode === 'readonly' || input.operation.mode === 'mutating' },
-      suggestedNextActions: [{
-        label: 'Claim controller ownership',
-        tool: 'rh_work',
-        operation: 'controller_claim',
-        risk: 'readonly',
-        confidence: 'high',
-        reason: 'Claim this Work before launching an external SuperController or Process Runtime command.',
-      }],
+      suggestedNextActions: [],
     });
     writeJsonAtomic(recordPath, { requestId, repoId: input.repoId, workId: contract.workId, semanticKey, createdAt: contract.createdAt } satisfies WorkRequestIndexRecord);
     return { contract, deduplicated: false };
@@ -750,24 +990,36 @@ export function acceptSubmittedWorkContract(
 }
 
 export function isCurrentWorkContract(contract: WorkContract): boolean {
-  return !isTerminalWorkContractStatus(contract.status)
+  return semanticWorkState(contract) === 'open'
     && !contract.supersededBy?.trim()
     && contract.workKind !== 'superseded'
     && contract.completionOutcome !== 'superseded';
 }
 
 export function listWorkContracts(options: ListWorkContractOptions): WorkContract[] {
-  const store = readWorkContractStore(options);
-  const status = options.status ?? 'active';
+  const state = options.state ?? 'active';
   const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 50), 100));
+  const offset = Math.max(0, Math.trunc(options.offset ?? 0));
+  if (state === 'active' && offset > 0) throw new Error('WORK_ACTIVE_PAGINATION_UNSUPPORTED');
+  if (state === 'active' && sqliteBacked(options)) {
+    const active = readActiveWorkCandidates({ ...options, limit });
+    if (active.invalid.length > 0) {
+      // Preserve the aggregate list API's fail-closed semantics. Callers that
+      // intentionally need row-isolated corruption diagnostics use
+      // readActiveWorkCandidates() directly and can inspect every invalid row.
+      throw new Error(active.invalid[0]!.error);
+    }
+    return active.contracts;
+  }
+  const store = readWorkContractStore(options);
   return store.contracts
     .filter((contract) => {
-      if (status === 'all') return true;
-      if (status === 'active') return isCurrentWorkContract(contract);
-      return contract.status === status;
+      if (state === 'all') return true;
+      if (state === 'active') return isCurrentWorkContract(contract);
+      return semanticWorkState(contract) === state;
     })
     .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
-    .slice(0, limit);
+    .slice(offset, offset + limit);
 }
 
 function workExecutionSemanticScopeKeys(contract: WorkContract): string[] {
@@ -784,13 +1036,12 @@ function workExecutionSemanticScopeKeys(contract: WorkContract): string[] {
 function workExecutionIsolation(contract: WorkContract): 'shared' | 'isolated' {
   return contract.worktreePolicy?.required === true
     || contract.constraints?.workspaceMode === 'isolated'
-    || contract.constraints?.requireWorktree === true
     ? 'isolated'
     : 'shared';
 }
 
 function rawWorkMayBeCurrent(contract: WorkContract): boolean {
-  return !isTerminalWorkContractStatus(contract.status)
+  return semanticWorkState(contract) === 'open'
     && !contract.supersededBy?.trim()
     && contract.workKind !== 'superseded'
     && contract.completionOutcome !== 'superseded';
@@ -805,7 +1056,7 @@ function rawWorkMayBeCurrent(contract: WorkContract): boolean {
  */
 export function initializeWorkCandidateIndex(controllerHome: string): void {
   initializeControlPlanePayloadTextExclusionIndex(controllerHome, {
-    namespace: 'work_contract', field: 'status', excludedValues: TERMINAL_WORK_CONTRACT_STATUSES,
+    namespace: 'work_contract', field: 'semanticState', excludedValues: TERMINAL_SEMANTIC_WORK_STATES,
   });
 }
 
@@ -814,24 +1065,36 @@ export function readActiveWorkCandidates(
 ): ActiveWorkCandidateSnapshot {
   const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 1_000), 1_000));
   if (!sqliteBacked(options)) {
-    return { contracts: listWorkContracts({ ...options, status: 'active', limit }), invalid: [] };
+    return { contracts: listWorkContracts({ ...options, state: 'active', limit }), invalid: [] };
   }
+  const requestedScope = workContractStoreScopeKey(options);
   const records = listControlPlaneRecordsExcludingPayloadTextValues<WorkContract>(options.controllerHome, {
     namespace: 'work_contract',
-    scope: options.repoId,
-    field: 'status',
-    excludedValues: TERMINAL_WORK_CONTRACT_STATUSES,
+    scope: requestedScope,
+    field: 'semanticState',
+    excludedValues: TERMINAL_SEMANTIC_WORK_STATES,
     limit: 5_000,
   });
+  const semanticAuthorityWorkIds = requestedScope === SEMANTIC_SCOPE_KEY
+    ? new Set<string>()
+    : new Set(listControlPlaneRecordKeys(options.controllerHome, {
+        namespace: 'work_contract',
+        scope: SEMANTIC_SCOPE_KEY,
+        limit: 5_000,
+      }));
   const contracts: WorkContract[] = [];
   const invalid: InvalidActiveWorkCandidate[] = [];
   const migrations: Array<{ record: (typeof records)[number]; contract: WorkContract }> = [];
   for (const record of records) {
+    // Exact Work reads already prefer semantic scope over repository-scoped
+    // compatibility rows. Collection reads must preserve the same one-authority
+    // rule or a stale open compatibility shadow can resurrect terminal Work.
+    if (semanticAuthorityWorkIds.has(record.key)) continue;
     const raw = record.value;
     if (!rawWorkMayBeCurrent(raw)) continue;
     try {
-      const normalized = canonicalizeStoredWorkContract(raw);
-      if (storedWorkContractNeedsMigration(raw)) migrations.push({ record, contract: normalized });
+      const normalized = canonicalizeStoredWorkContract(raw, record.schemaVersion);
+      if (storedWorkContractNeedsMigration(raw, record.schemaVersion)) migrations.push({ record, contract: normalized });
       if (isCurrentWorkContract(normalized)) contracts.push(normalized);
     } catch (error) {
       invalid.push({
@@ -852,11 +1115,11 @@ export function readActiveWorkCandidates(
       for (const { record, contract } of migrations) {
         writeControlPlaneRecordWithinTransaction(database, {
           namespace: 'work_contract',
-          scope: options.repoId,
+          scope: workContractStoreScopeKey(options),
           key: contract.workId,
-          schemaVersion: 3,
+          schemaVersion: 4,
           value: contract,
-          action: 'work_contract_schema_v3_migrated',
+          action: 'work_contract_schema_v4_migrated',
           expectedRevision: record.revision,
         });
       }
@@ -867,35 +1130,201 @@ export function readActiveWorkCandidates(
   return { contracts: contracts.slice(0, limit), invalid };
 }
 
+export function listWorkSemanticRevisionRecords(
+  options: WorkContractStoreOptions,
+  workId?: string,
+  limit = 200,
+): WorkSemanticRevisionRecord[] {
+  const normalizedId = workId ? sanitizeFileComponent(workId) : undefined;
+  const boundedLimit = Math.max(1, Math.min(Math.trunc(limit), 1000));
+  const authoritativeOptions = normalizedId
+    ? authoritativeExistingWorkStoreOptions(options, normalizedId)
+    : options;
+  const records = sqliteBacked(authoritativeOptions)
+    ? listControlPlaneRecords<WorkSemanticRevisionRecord>(authoritativeOptions.controllerHome, {
+        namespace: 'work_semantic_revision', scope: workContractStoreScopeKey(authoritativeOptions), limit: 5_000,
+      }).map((record) => record.value)
+    : readWorkSemanticRevisionStore(authoritativeOptions).records;
+  return records
+    .filter((record) => !normalizedId || record.workId === normalizedId)
+    .map((record) => ({
+      ...record,
+      semanticScope: record.semanticScope ?? semanticScopeRefForWork({
+        workId: record.workId,
+        requirementId: record.requirementId,
+        planId: record.planId,
+        planStepId: undefined,
+      }),
+    }))
+    .sort((left, right) => right.revision - left.revision)
+    .slice(0, boundedLimit);
+}
+
+function authoritativeExistingWorkStoreOptions(
+  options: WorkContractStoreOptions,
+  workIdInput: string,
+): WorkContractStoreOptions {
+  if (!sqliteBacked(options)) return options;
+  const requestedScope = workContractStoreScopeKey(options);
+  if (requestedScope === SEMANTIC_SCOPE_KEY) return options;
+  const workId = sanitizeFileComponent(workIdInput);
+  const semantic = readControlPlaneRecord<WorkContract>(
+    options.controllerHome,
+    'work_contract',
+    SEMANTIC_SCOPE_KEY,
+    workId,
+  );
+  return semantic ? { ...options, scopeKey: SEMANTIC_SCOPE_KEY } : options;
+}
+
+export function reviseWorkSemanticContext(
+  options: WorkContractStoreOptions,
+  workIdInput: string,
+  input: ReviseWorkSemanticInput,
+): WorkContract {
+  if (!Number.isInteger(input.expectedRevision) || input.expectedRevision < 1) throw new Error('WORK_EXPECTED_REVISION_INVALID');
+  return withExactWorkContractWrite(options, workIdInput, () => {
+    const authoritativeOptions = authoritativeExistingWorkStoreOptions(options, workIdInput);
+    return withWorkContractStoreWrite(authoritativeOptions, () => {
+    const workId = sanitizeFileComponent(workIdInput);
+    const relationRevisionRequested = input.semanticParentWorkId !== undefined || input.dependsOnWorkIds !== undefined;
+    const applyRevision = (current: WorkContract, at: string, relationContracts: readonly WorkContract[] = []): WorkContract => {
+      const semanticRevision = currentWorkSemanticRevision(current);
+      if (semanticRevision !== input.expectedRevision) {
+        throw new Error(`WORK_REVISION_CONFLICT:${workId}:expected=${input.expectedRevision}:actual=${semanticRevision}`);
+      }
+      const currentSemanticState = semanticWorkState(current);
+      if (currentSemanticState !== 'open' && input.state === 'open') {
+        throw new Error(`WORK_SEMANTIC_REOPEN_FORBIDDEN:${workId}:${currentSemanticState}`);
+      }
+      const objective = input.objective === undefined ? current.objective : String(input.objective).trim().slice(0, 2_000);
+      if (!objective) throw new Error('WORK_OBJECTIVE_REQUIRED');
+      const positiveRevision = (value: number | undefined, code: string): number | undefined => {
+        if (value === undefined) return undefined;
+        if (!Number.isInteger(value) || value < 1) throw new Error(code);
+        return value;
+      };
+      const nextSemanticState = input.state ?? currentSemanticState;
+      if (currentSemanticState !== 'open' && (input.semanticParentWorkId !== undefined || input.dependsOnWorkIds !== undefined)) {
+        throw new Error(`WORK_OBJECTIVE_RELATION_TERMINAL_IMMUTABLE:${workId}:${currentSemanticState}`);
+      }
+      const next = validateWorkSemantics({
+        ...current,
+        objective,
+        semanticRevision: semanticRevision + 1,
+        semanticUpdatedAt: at,
+        semanticState: nextSemanticState,
+        ...(input.requirementRevision !== undefined ? { requirementRevision: positiveRevision(input.requirementRevision, 'WORK_REQUIREMENT_REVISION_INVALID') } : {}),
+        ...(input.planRevision !== undefined ? { planRevision: positiveRevision(input.planRevision, 'WORK_PLAN_REVISION_INVALID') } : {}),
+        ...(input.semanticParentWorkId !== undefined ? { semanticParentWorkId: input.semanticParentWorkId.trim() || undefined } : {}),
+        ...(input.dependsOnWorkIds !== undefined ? { dependsOnWorkIds: normalizeWorkObjectiveRelationIds(input.dependsOnWorkIds) } : {}),
+        ...(input.resultRefs !== undefined ? { semanticResultRefs: [...new Set(input.resultRefs.map(String).map((value) => value.trim()).filter(Boolean))].slice(0, 100) } : {}),
+        updatedAt: at,
+      });
+      if (relationRevisionRequested) validateWorkObjectiveRelationIntegrity(next, relationContracts);
+      return next;
+    };
+
+    if (sqliteBacked(authoritativeOptions)) {
+      return withControlPlaneTransaction(authoritativeOptions.controllerHome, (database) => {
+        const scope = workContractStoreScopeKey(authoritativeOptions);
+        const currentRecord = readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', scope, workId);
+        if (!currentRecord) throw new Error(`work contract not found: ${workId}`);
+        const current = canonicalizeStoredWorkContract(currentRecord.value);
+        const at = nowIso(authoritativeOptions);
+        const relationContracts = relationRevisionRequested
+          ? listControlPlaneRecordsWithinTransaction<WorkContract>(database, {
+              namespace: 'work_contract', scope, limit: 5_000,
+            }).map((record) => canonicalizeStoredWorkContract(record.value))
+          : [];
+        const next = applyRevision(current, at, relationContracts);
+        const semanticRevision = currentWorkSemanticRevision(current);
+        const revisionKey = workSemanticRevisionKey(workId, semanticRevision);
+        if (!readControlPlaneRecordWithinTransaction<WorkSemanticRevisionRecord>(database, 'work_semantic_revision', scope, revisionKey)) {
+          writeControlPlaneRecordWithinTransaction(database, {
+            namespace: 'work_semantic_revision', scope, key: revisionKey, schemaVersion: 1,
+            value: { schemaVersion: 1, ...workSemanticView(current), recordedAt: at },
+            action: 'work_semantic_revision_archived', expectedRevision: null,
+          });
+        }
+        return writeControlPlaneRecordWithinTransaction(database, {
+          namespace: 'work_contract', scope, key: workId, schemaVersion: 4,
+          value: next, action: 'work_semantic_revised', expectedRevision: currentRecord.revision,
+        }).value;
+      });
+    }
+
+    // Semantic CAS validation must be side-effect free. The public read path may
+    // persist a one-way legacy migration, so normalize the file-backed store only
+    // in memory here and write it exactly once after the requested revision has
+    // been validated successfully.
+    const rawStore = readJsonFile<WorkContractStore>(
+      workContractStorePath(authoritativeOptions),
+      emptyWorkContractStore(nowIso(authoritativeOptions)),
+    );
+    const store = normalizeWorkContractStore(rawStore);
+    const index = store.contracts.findIndex((contract) => contract.workId === workId);
+    if (index < 0) throw new Error(`work contract not found: ${workId}`);
+    const current = store.contracts[index]!;
+    const at = nowIso(authoritativeOptions);
+    const next = applyRevision(current, at, relationRevisionRequested ? store.contracts : []);
+    const archived = { schemaVersion: 1 as const, ...workSemanticView(current), recordedAt: at };
+    const history = readWorkSemanticRevisionStore(authoritativeOptions);
+    if (!history.records.some((record) => record.workId === workId && record.revision === archived.revision)) {
+      writeJsonAtomic(workSemanticRevisionStorePath(authoritativeOptions), { schemaVersion: 1, records: [...history.records, archived].slice(-5_000) });
+    }
+    const contracts = [...store.contracts];
+    contracts[index] = next;
+    writeWorkContractStore(authoritativeOptions, { schemaVersion: 4, updatedAt: at, contracts });
+    return next;
+    });
+  });
+}
+
+function readExactSqliteWorkContract(
+  options: WorkContractStoreOptions & { controllerHome: string },
+  scope: string,
+  sanitizedId: string,
+): WorkContract | undefined {
+  const exact = readControlPlaneRecord<WorkContract>(options.controllerHome, 'work_contract', scope, sanitizedId);
+  if (!exact) return undefined;
+  const canonical = canonicalizeStoredWorkContract(exact.value, exact.schemaVersion);
+  if (storedWorkContractNeedsMigration(exact.value, exact.schemaVersion)) {
+    withControlPlaneTransaction(options.controllerHome, (database) => {
+      writeControlPlaneRecordWithinTransaction(database, {
+        namespace: 'work_contract',
+        scope,
+        key: canonical.workId,
+        schemaVersion: 4,
+        value: canonical,
+        action: 'work_contract_schema_v4_migrated',
+        expectedRevision: exact.revision,
+      });
+    });
+  }
+  return canonical;
+}
+
 export function getWorkContract(options: WorkContractStoreOptions, workId: string): WorkContract | undefined {
   const sanitizedId = sanitizeFileComponent(workId);
   if (!sqliteBacked(options)) {
     return readWorkContractStore(options).contracts.find((contract) => contract.workId === sanitizedId);
   }
-  const exact = readControlPlaneRecord<WorkContract>(options.controllerHome, 'work_contract', options.repoId, sanitizedId);
-  if (exact) {
-    const canonical = canonicalizeStoredWorkContract(exact.value);
-    if (storedWorkContractNeedsMigration(exact.value)) {
-      withControlPlaneTransaction(options.controllerHome, (database) => {
-        writeControlPlaneRecordWithinTransaction(database, {
-          namespace: 'work_contract',
-          scope: options.repoId,
-          key: canonical.workId,
-          schemaVersion: 3,
-          value: canonical,
-          action: 'work_contract_schema_v3_migrated',
-          expectedRevision: exact.revision,
-        });
-      });
-    }
-    return canonical;
+  const requestedScope = workContractStoreScopeKey(options);
+  if (requestedScope !== SEMANTIC_SCOPE_KEY) {
+    const semantic = readExactSqliteWorkContract(options, SEMANTIC_SCOPE_KEY, sanitizedId);
+    if (semantic) return semantic;
   }
-  // Preserve the one-time legacy import path only while this repository has no
-  // per-Work rows. Once any per-Work row exists, absence of this exact key is
-  // authoritative and unrelated rows must never be normalized for an exact get.
+  const exact = readExactSqliteWorkContract(options, requestedScope, sanitizedId);
+  if (exact) return exact;
+
+  // Preserve the one-time legacy import path only while this requested scope has
+  // no per-Work rows. Canonical semantic rows are checked first and never copied
+  // into repository scope; repository-scoped rows remain a read-only compatibility
+  // fallback until their consumers are retired.
   const hasPerWorkRows = listControlPlaneRecords<WorkContract>(options.controllerHome, {
     namespace: 'work_contract',
-    scope: options.repoId,
+    scope: requestedScope,
     limit: 1,
   }).length > 0;
   if (hasPerWorkRows) return undefined;
@@ -949,13 +1378,13 @@ export function supersedeWorkContract(
     contracts[predecessorIndex] = predecessorNext;
     contracts[successorIndex] = successorNext;
     if (!sqliteBacked(options)) {
-      writeJsonAtomic(workContractStorePath(options), { schemaVersion: 3, updatedAt: at, contracts });
+      writeJsonAtomic(workContractStorePath(options), { schemaVersion: 4, updatedAt: at, contracts });
     } else {
       withControlPlaneTransaction(options.controllerHome, (database) => {
         for (const contract of [predecessorNext, successorNext]) {
-          const current = readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', options.repoId, contract.workId);
+          const current = readControlPlaneRecordWithinTransaction<WorkContract>(database, 'work_contract', workContractStoreScopeKey(options), contract.workId);
           if (!current) throw new Error(`WORK_LINEAGE_RECORD_MISSING: ${contract.workId}`);
-          writeControlPlaneRecordWithinTransaction(database, { namespace: 'work_contract', scope: options.repoId, key: contract.workId, schemaVersion: 3, value: contract, action: 'work_contract_supersession_linked', expectedRevision: current.revision });
+          writeControlPlaneRecordWithinTransaction(database, { namespace: 'work_contract', scope: workContractStoreScopeKey(options), key: contract.workId, schemaVersion: 4, value: contract, action: 'work_contract_supersession_linked', expectedRevision: current.revision });
         }
       });
     }
@@ -967,9 +1396,8 @@ export function summarizeWorkContract(contract: WorkContract): WorkContractSumma
   return {
     workId: contract.workId,
     repoId: contract.repoId,
-    mode: contract.mode,
+    state: semanticWorkState(contract),
     phase: contract.phase,
-    status: contract.status,
     objective: contract.objective.slice(0, 240),
     updatedAt: contract.updatedAt,
     handoffCount: contract.handoffRefs.length,
@@ -995,32 +1423,62 @@ function updateWorkContractInternal(
   mutation: WorkContractMutation,
   allowCompletionWrite: boolean,
   allowLifecycleWrite = false,
-  allowRetainedCancelledResume = false,
   allowImplementationReviewWrite = false,
   allowPhaseRegression = false,
+  atomicPlacementEffect?: (database: SqliteDatabase, contract: WorkContract) => void,
 ): WorkContract {
-  return withWorkContractStoreWrite(options, () => {
+  return withExactWorkContractWrite(options, workId, () => {
+    const authoritativeOptions = authoritativeExistingWorkStoreOptions(options, workId);
+    return withWorkContractStoreWrite(authoritativeOptions, () => {
     const sanitizedId = sanitizeFileComponent(workId);
-    const store = readWorkContractStore(options);
-    const index = store.contracts.findIndex((contract) => contract.workId === sanitizedId);
-    if (index < 0) throw new Error(`work contract not found: ${sanitizedId}`);
-    const at = nowIso(options);
-    const current = store.contracts[index];
-    const patch = typeof mutation === 'function' ? mutation(current, at) : mutation;
-    if (!patch) return current;
-    if (options.controllerHome) {
-      assertCanonicalWorkAdmissionAllowed(options, {
-        operation: patch.status !== undefined && isTerminalWorkContractStatus(patch.status)
-          ? 'maintenance'
-          : 'continue',
-        workId: sanitizedId,
-      });
+    const exact = sqliteBacked(authoritativeOptions)
+      ? readControlPlaneRecord<WorkContract>(
+          authoritativeOptions.controllerHome,
+          'work_contract',
+          workContractStoreScopeKey(authoritativeOptions),
+          sanitizedId,
+        )
+      : undefined;
+    const store = exact ? undefined : readWorkContractStore(authoritativeOptions);
+    const index = store?.contracts.findIndex((contract) => contract.workId === sanitizedId) ?? -1;
+    if (!exact && index < 0) throw new Error(`work contract not found: ${sanitizedId}`);
+    const at = nowIso(authoritativeOptions);
+    // A per-Work SQLite row is the mutable authority. Do not normalize every
+    // sibling just to update this row: malformed historical evidence must stay
+    // visible and fenced, but cannot prevent a different terminal Work from
+    // recording its physical cleanup.
+    const current = exact
+      ? canonicalizeStoredWorkContract(exact.value)
+      : store!.contracts[index]!;
+    const mutationPatch = typeof mutation === 'function' ? mutation(current, at) : mutation;
+    if (!mutationPatch) return current;
+    const placementChanged = (
+      Object.prototype.hasOwnProperty.call(mutationPatch, 'checkoutId')
+      && mutationPatch.checkoutId !== current.checkoutId
+    ) || (
+      Object.prototype.hasOwnProperty.call(mutationPatch, 'worktreeRef')
+      && mutationPatch.worktreeRef !== current.worktreeRef
+    ) || (
+      Object.prototype.hasOwnProperty.call(mutationPatch, 'executionPlacement')
+      && JSON.stringify(mutationPatch.executionPlacement) !== JSON.stringify(current.executionPlacement)
+    );
+    // executionConcurrency is only a projection of the concrete placement that
+    // existed when an execution attempt was admitted. A checkout/worktree move
+    // makes that projection stale; clear it centrally unless the same atomic
+    // mutation explicitly supplies a replacement projection for the new target.
+    const patch = placementChanged && !Object.prototype.hasOwnProperty.call(mutationPatch, 'executionConcurrency')
+      ? { ...mutationPatch, executionConcurrency: undefined }
+      : mutationPatch;
+    if (Object.prototype.hasOwnProperty.call(patch, 'status')) throw new Error('WORK_RETIRED_FIELD_REJECTED: status');
+    for (const field of ['semanticState', 'semanticRevision', 'semanticUpdatedAt']) {
+      if (!allowLifecycleWrite && Object.prototype.hasOwnProperty.call(patch, field)) {
+        throw new Error(`WORK_SEMANTIC_FIELDS_REQUIRE_REVISION_API: ${field}`);
+      }
     }
     const writesCompletionReceipt = Object.prototype.hasOwnProperty.call(patch, 'completionReceipt');
     const changesCompletionOutcome = patch.completionOutcome !== undefined && patch.completionOutcome !== current.completionOutcome;
     const writesPhase = Object.prototype.hasOwnProperty.call(patch, 'phase') || Object.prototype.hasOwnProperty.call(patch, 'phaseEvidence');
     const writesLifecycle = writesPhase
-      || Object.prototype.hasOwnProperty.call(patch, 'status')
       || Object.prototype.hasOwnProperty.call(patch, 'dispatchState')
       || Object.prototype.hasOwnProperty.call(patch, 'evidenceState')
       || Object.prototype.hasOwnProperty.call(patch, 'workKind');
@@ -1029,19 +1487,16 @@ function updateWorkContractInternal(
     if (!allowImplementationReviewWrite && writesImplementationReviews) throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRES_RECORD_API');
     const projectedPhase = patch.phase ?? current.phase;
     const projectedPhaseEvidence = patch.phaseEvidence ?? current.phaseEvidence;
-    if (!allowCompletionWrite && (writesCompletionReceipt || changesCompletionOutcome || (patch.status === 'completed' && current.status !== 'completed'))) {
+    if (!allowCompletionWrite && (writesCompletionReceipt || changesCompletionOutcome)) {
       throw new Error('WORK_COMPLETION_REQUIRES_RECORD_API');
     }
-    if (patch.status === 'completed' && !current.completionReceipt && !patch.completionReceipt) {
-      throw new Error('WORK_COMPLETION_RECEIPT_REQUIRED');
-    }
     if (writesCompletionReceipt && patch.completionReceipt === undefined && current.completionReceipt) {
       throw new Error('WORK_COMPLETION_RECEIPT_IMMUTABLE');
     }
     const next: WorkContract = validateWorkSemanticTransition(current, validateWorkSemantics({
     ...current,
     ...patch,
-    schemaVersion: 3,
+    schemaVersion: 4,
     workId: current.workId,
     repoId: current.repoId,
     createdAt: current.createdAt,
@@ -1055,206 +1510,85 @@ function updateWorkContractInternal(
     completionOutcome: patch.completionOutcome ?? current.completionOutcome,
     evidenceRefs: (patch.evidenceRefs ?? current.evidenceRefs).slice(0, current.evidencePolicy.maxEvidenceRefs),
     handoffRefs: (patch.handoffRefs ?? current.handoffRefs).slice(0, 20),
-    suggestedNextActions: suggestedActionsForStatus(patch.status ?? current.status, patch.suggestedNextActions ?? current.suggestedNextActions),
+    suggestedNextActions: suggestedActionsForSemanticState(current.semanticState, patch.suggestedNextActions ?? current.suggestedNextActions),
     policyDecisions: (patch.policyDecisions ?? current.policyDecisions).slice(0, 20),
     checkRefs: (patch.checkRefs ?? current.checkRefs).slice(0, 50),
     implementationReviews: (patch.implementationReviews ?? current.implementationReviews ?? []).slice(-MAX_IMPLEMENTATION_REVIEW_HISTORY),
     reconciliations: (patch.reconciliations ?? current.reconciliations ?? []).slice(0, 20),
     objective: (patch.objective ?? current.objective).slice(0, 2_000),
     continuationPrompt: (patch.continuationPrompt ?? current.continuationPrompt)?.slice(0, 2_000),
-    }), { allowRetainedCancelledResume, allowPhaseRegression });
-    const contracts = [...store.contracts];
+    }), { allowPhaseRegression });
+    if (exact && sqliteBacked(authoritativeOptions)) {
+      withControlPlaneTransaction(authoritativeOptions.controllerHome, (database) => {
+        writeControlPlaneRecordWithinTransaction(database, {
+          namespace: 'work_contract',
+          scope: workContractStoreScopeKey(authoritativeOptions),
+          key: next.workId,
+          schemaVersion: 4,
+          value: next,
+          action: 'work_contract_updated',
+          expectedRevision: exact.revision,
+        });
+        atomicPlacementEffect?.(database, next);
+      });
+      return next;
+    }
+    if (atomicPlacementEffect) throw new Error('WORK_PLACEMENT_ATOMIC_SQLITE_REQUIRED');
+    const contracts = [...store!.contracts];
     contracts[index] = next;
-    writeWorkContractStore(options, { schemaVersion: 3, updatedAt: at, contracts });
+    writeWorkContractStore(authoritativeOptions, { schemaVersion: 4, updatedAt: at, contracts });
     return next;
+    });
   });
 }
 
 
 /**
  * Build the only permitted in-place Plan rebind for an active Work: the same
- * Work and Plan step may move to an explicit successor Plan after a scope-only
- * replan. This is deliberately pure so the Plan store can persist predecessor,
- * successor, and Work in one SQLite transaction.
- */
-export function rebindPlanBoundWorkContract(
-  current: WorkContract,
-  input: {
-    predecessorPlanId: string;
-    successorPlanId: string;
-    planStepId: string;
-    planSourceRevision: string;
-    allowedPaths: string[];
-    forbiddenPaths: string[];
-    checks: string[];
-    recordedAt: string;
-    reason: string;
-  },
-): WorkContract {
-  const canonicalCurrent = validateCanonicalWorkContract(current);
-  if (isTerminalWorkContractStatus(canonicalCurrent.status) || canonicalCurrent.completionReceipt || canonicalCurrent.completionOutcome) {
-    throw new Error(`WORK_PLAN_REBIND_TERMINAL: ${canonicalCurrent.workId}`);
-  }
-  if (canonicalCurrent.planId !== input.predecessorPlanId || canonicalCurrent.planStepId !== input.planStepId) {
-    throw new Error(`WORK_PLAN_REBIND_SOURCE_MISMATCH: ${canonicalCurrent.workId}`);
-  }
-  const successorPlanId = sanitizeFileComponent(input.successorPlanId);
-  const planStepId = sanitizeFileComponent(input.planStepId);
-  if (!successorPlanId || successorPlanId === 'unknown' || successorPlanId === canonicalCurrent.planId) {
-    throw new Error('WORK_PLAN_REBIND_SUCCESSOR_INVALID');
-  }
-  const planSourceRevision = input.planSourceRevision.trim();
-  if (!planSourceRevision) throw new Error('WORK_PLAN_REBIND_SOURCE_REVISION_REQUIRED');
-  const allowedPaths = [...new Set(input.allowedPaths.map((value) => value.trim()).filter(Boolean))].slice(0, 50);
-  const forbiddenPaths = [...new Set(input.forbiddenPaths.map((value) => value.trim()).filter(Boolean))].slice(0, 50);
-  const checks = [...new Set(input.checks.map((value) => value.trim()).filter(Boolean))].slice(0, 30);
-  for (const path of canonicalCurrent.allowedPaths) {
-    if (!allowedPaths.includes(path)) throw new Error(`WORK_PLAN_REBIND_SCOPE_NARROWING_FORBIDDEN: ${path}`);
-  }
-  if (JSON.stringify(forbiddenPaths) !== JSON.stringify(canonicalCurrent.forbiddenPaths)) {
-    throw new Error('WORK_PLAN_REBIND_FORBIDDEN_SCOPE_CHANGE');
-  }
-  if (JSON.stringify(checks) !== JSON.stringify(canonicalCurrent.checks)) {
-    throw new Error('WORK_PLAN_REBIND_CHECK_CHANGE');
-  }
-  const evidenceRefs = [{
-    title: 'Plan-bound Work scope replanned',
-    summary: `${canonicalCurrent.planId} -> ${successorPlanId}: ${input.reason.trim().slice(0, 1_000)}`,
-    detailLevel: 'summary' as const,
-  }, ...canonicalCurrent.evidenceRefs].slice(0, canonicalCurrent.evidencePolicy.maxEvidenceRefs);
-  const next = validateWorkSemantics({
-    ...canonicalCurrent,
-    scopeRef: semanticScopeRefForWork({
-      workId: canonicalCurrent.workId,
-      requirementId: canonicalCurrent.requirementId,
-      planId: successorPlanId,
-      planStepId,
-    }),
-    planId: successorPlanId,
-    planStepId,
-    planSourceRevision,
-    allowedPaths,
-    forbiddenPaths,
-    checks,
-    evidenceRefs,
-    updatedAt: input.recordedAt,
-  });
-  return validateWorkSemanticTransition(canonicalCurrent, next);
-}
-
-/**
- * Refresh one active Work against a newer revision of the same stable Plan.
- * This deliberately does not change Plan identity or semantic scope. Only the
- * source fence and an allowed-path widening may change; forbidden paths and
- * machine checks remain exact.
- */
-export function refreshPlanBoundWorkRevision(
+function cancellationPhaseEvidence(
   current: WorkContract,
-  input: {
-    planId: string;
-    planStepId: string;
-    planSourceRevision: string;
-    allowedPaths: string[];
-    forbiddenPaths: string[];
-    checks: string[];
-    recordedAt: string;
-    reason: string;
-  },
-): WorkContract {
-  const canonicalCurrent = validateCanonicalWorkContract(current);
-  if (isTerminalWorkContractStatus(canonicalCurrent.status) || canonicalCurrent.completionReceipt || canonicalCurrent.completionOutcome) {
-    throw new Error(`WORK_PLAN_REVISION_REFRESH_TERMINAL: ${canonicalCurrent.workId}`);
-  }
-  const planId = sanitizeFileComponent(input.planId);
-  const planStepId = sanitizeFileComponent(input.planStepId);
-  if (!planId || planId === 'unknown' || canonicalCurrent.planId !== planId || canonicalCurrent.planStepId !== planStepId) {
-    throw new Error(`WORK_PLAN_REVISION_REFRESH_SOURCE_MISMATCH: ${canonicalCurrent.workId}`);
-  }
-  const planSourceRevision = input.planSourceRevision.trim();
-  if (!planSourceRevision) throw new Error('WORK_PLAN_REVISION_REFRESH_SOURCE_REVISION_REQUIRED');
-  const allowedPaths = [...new Set(input.allowedPaths.map((value) => value.trim()).filter(Boolean))].slice(0, 50);
-  const forbiddenPaths = [...new Set(input.forbiddenPaths.map((value) => value.trim()).filter(Boolean))].slice(0, 50);
-  const checks = [...new Set(input.checks.map((value) => value.trim()).filter(Boolean))].slice(0, 30);
-  for (const path of canonicalCurrent.allowedPaths) {
-    if (!allowedPaths.includes(path)) throw new Error(`WORK_PLAN_REVISION_REFRESH_SCOPE_NARROWING_FORBIDDEN: ${path}`);
-  }
-  if (JSON.stringify(forbiddenPaths) !== JSON.stringify(canonicalCurrent.forbiddenPaths)) {
-    throw new Error('WORK_PLAN_REVISION_REFRESH_FORBIDDEN_SCOPE_CHANGE');
-  }
-  if (JSON.stringify(checks) !== JSON.stringify(canonicalCurrent.checks)) {
-    throw new Error('WORK_PLAN_REVISION_REFRESH_CHECK_CHANGE');
-  }
-  const reason = input.reason.trim().slice(0, 1_000);
-  if (!reason) throw new Error('WORK_PLAN_REVISION_REFRESH_REASON_REQUIRED');
-  const evidenceRefs = [{
-    title: 'Plan revision refreshed Work authority',
-    summary: `${planId}@${canonicalCurrent.planSourceRevision ?? 'unknown'} -> ${planId}@${planSourceRevision}: ${reason}`,
-    detailLevel: 'summary' as const,
-  }, ...canonicalCurrent.evidenceRefs].slice(0, canonicalCurrent.evidencePolicy.maxEvidenceRefs);
-  const next = validateWorkSemantics({
-    ...canonicalCurrent,
-    planSourceRevision,
-    allowedPaths,
-    forbiddenPaths,
-    checks,
-    evidenceRefs,
-    updatedAt: input.recordedAt,
-  });
-  return validateWorkSemanticTransition(canonicalCurrent, next);
+  input: { summary: string; evidenceRefs?: EvidenceRef[]; recordedAt: string },
+): WorkPhaseEvidenceMap {
+  const evidenceRefs = (input.evidenceRefs ?? current.evidenceRefs).slice(0, current.evidencePolicy.maxEvidenceRefs);
+  const existing = current.phaseEvidence[current.phase];
+  if (!['pending', 'active'].includes(existing.state)) return current.phaseEvidence;
+  return {
+    ...current.phaseEvidence,
+    [current.phase]: {
+      state: 'skipped',
+      source: 'recorded',
+      summary: input.summary.trim().slice(0, 1_000) || 'Work cancelled.',
+      evidenceRefs,
+      recordedAt: input.recordedAt,
+    },
+  };
 }
 
 /**
  * Retire technical Work authority when its owning Plan is no longer current.
  *
  * This is authority retirement, not history deletion. The cancelled Work and
- * its evidence stay durable for audit/recovery/retention, while status and
+ * its evidence stay durable for audit/recovery/retention, while semantic state and
  * dispatch become terminal immediately so schedulers, concurrency admission,
  * and UI current-state projections cannot keep executing an obsolete Plan.
  */
-export function retirePlanBoundWorkContract(
+function cancellationPhaseEvidence(
   current: WorkContract,
-  input: {
-    predecessorPlanId: string;
-    successorPlanId?: string;
-    recordedAt: string;
-    reason: string;
-  },
-): WorkContract {
-  const canonicalCurrent = validateCanonicalWorkContract(current);
-  if (isTerminalWorkContractStatus(canonicalCurrent.status)) return canonicalCurrent;
-  if (canonicalCurrent.planId !== input.predecessorPlanId) {
-    throw new Error(`WORK_PLAN_RETIRE_SOURCE_MISMATCH: ${canonicalCurrent.workId}:expected=${input.predecessorPlanId}:actual=${canonicalCurrent.planId ?? 'none'}`);
-  }
-  if (canonicalCurrent.completionReceipt || canonicalCurrent.completionOutcome) {
-    throw new Error(`WORK_PLAN_RETIRE_COMPLETION_CONFLICT: ${canonicalCurrent.workId}`);
-  }
-  const reason = input.reason.trim().slice(0, 1_000);
-  if (!reason) throw new Error('WORK_PLAN_RETIRE_REASON_REQUIRED');
-  const successor = input.successorPlanId?.trim();
-  const summary = successor
-    ? `Plan authority retired ${canonicalCurrent.planId} -> ${successor}: ${reason}`
-    : `Plan authority retired ${canonicalCurrent.planId}: ${reason}`;
-  const evidenceRefs = [{
-    title: 'Plan-bound Work authority retired',
-    summary,
-    detailLevel: 'summary' as const,
-  }, ...canonicalCurrent.evidenceRefs].slice(0, canonicalCurrent.evidencePolicy.maxEvidenceRefs);
-  const next = validateWorkSemantics({
-    ...canonicalCurrent,
-    status: 'cancelled',
-    phase: 'cleanup',
-    phaseEvidence: transitionPhaseEvidence(canonicalCurrent, 'cleanup', {
-      status: 'cancelled',
-      summary,
+  input: { summary: string; evidenceRefs?: EvidenceRef[]; recordedAt: string },
+): WorkPhaseEvidenceMap {
+  const evidenceRefs = (input.evidenceRefs ?? current.evidenceRefs).slice(0, current.evidencePolicy.maxEvidenceRefs);
+  const existing = current.phaseEvidence[current.phase];
+  if (!['pending', 'active'].includes(existing.state)) return current.phaseEvidence;
+  return {
+    ...current.phaseEvidence,
+    [current.phase]: {
+      state: 'skipped',
+      source: 'recorded',
+      summary: input.summary.trim().slice(0, 1_000) || 'Work cancelled.',
       evidenceRefs,
       recordedAt: input.recordedAt,
-    }),
-    dispatchState: 'terminal',
-    evidenceRefs,
-    suggestedNextActions: [],
-    updatedAt: input.recordedAt,
-  });
-  return validateWorkSemanticTransition(canonicalCurrent, next);
+    },
+  };
 }
 
 export type WorkContractMetadataPatch = Partial<Omit<
@@ -1264,7 +1598,9 @@ export type WorkContractMetadataPatch = Partial<Omit<
   | 'repoId'
   | 'createdAt'
   | 'updatedAt'
-  | 'status'
+  | 'semanticState'
+  | 'semanticRevision'
+  | 'semanticUpdatedAt'
   | 'phase'
   | 'phaseEvidence'
   | 'dispatchState'
@@ -1282,18 +1618,31 @@ export function updateWorkContract(
 ): WorkContract {
   return updateWorkContractInternal(options, workId, patch, false);
 }
+export function updateWorkContractPlacementAtomically(
+  options: WorkContractStoreOptions,
+  workId: string,
+  patch: Pick<WorkContractMetadataPatch, 'checkoutId' | 'worktreeRef' | 'executionPlacement' | 'worktreePolicy'>,
+  effect: (database: SqliteDatabase, contract: WorkContract) => void,
+): WorkContract {
+  // The WorkContract writer remains the sole semantic metadata authority.
+  // An execution WorkHandle is committed inside the same SQLite transaction,
+  // never as a second step that could leave conflicting checkout ownership.
+  return updateWorkContractInternal(options, workId, patch, false, false, false, false, effect);
+}
+
+
 
-/** Explicit semantic transition used only when an effect Work begins governed repository mutation. */
+/** Explicit execution-classification transition when an open Work begins governed repository mutation. */
 export function promoteWorkToRepositoryChange(
   options: WorkContractStoreOptions,
   workId: string,
 ): WorkContract {
   return updateWorkContractInternal(options, workId, (current) => {
-    if (isTerminalWorkContractStatus(current.status) || current.completionReceipt || current.completionOutcome) {
+    if (semanticWorkState(current) !== 'open' || current.completionReceipt || current.completionOutcome) {
       throw new Error(`WORK_KIND_PROMOTION_TERMINAL: ${workId}`);
     }
     if (current.workKind === 'repository_change') return undefined;
-    if (current.workKind !== 'local_effect' && current.workKind !== 'remote_effect') {
+    if (!['investigation', 'local_effect', 'remote_effect'].includes(current.workKind)) {
       throw new Error(`WORK_KIND_PROMOTION_INVALID: ${workId}:${current.workKind}`);
     }
     return { workKind: 'repository_change' };
@@ -1319,12 +1668,12 @@ export function activateWorkContract(
   },
 ): WorkContract {
   return updateWorkContractInternal(options, workId, (current, at) => {
-    if (current.status === 'completed' || current.status === 'cancelled') {
-      throw new Error(`WORK_ACTIVATION_TERMINAL: ${workId}:${current.status}`);
+    if (current.semanticState !== 'open') {
+      throw new Error(`WORK_ACTIVATION_TERMINAL: ${workId}:${current.semanticState}`);
     }
     const phase = input.phase ?? current.phase;
     const phaseEvidence = transitionPhaseEvidence(current, phase, {
-      status: 'running',
+      state: 'active',
       summary: input.summary,
       recordedAt: at,
       source: 'recorded',
@@ -1332,14 +1681,13 @@ export function activateWorkContract(
     const evidenceState = input.evidenceState
       ?? (current.evidenceState === 'failed' ? 'partial' : current.evidenceState);
     return {
-      status: 'running',
       phase,
       phaseEvidence,
       dispatchState: 'running',
       evidenceState,
       worktreeRef: input.worktreeRef ?? current.worktreeRef,
     };
-  }, false, true, false, false, true);
+  }, false, true, false, true);
 }
 
 export function failWorkContract(
@@ -1348,24 +1696,23 @@ export function failWorkContract(
   input: { phase: WorkPhase; summary: string; evidenceRefs?: EvidenceRef[] },
 ): WorkContract {
   return updateWorkContractInternal(options, workId, (current, at) => {
-    if (current.status === 'completed' || current.status === 'cancelled') {
-      throw new Error(`WORK_FAILURE_TERMINAL: ${workId}:${current.status}`);
+    if (current.semanticState !== 'open') {
+      throw new Error(`WORK_FAILURE_TERMINAL: ${workId}:${current.semanticState}`);
     }
     if (input.phase !== current.phase) {
       throw new Error(`WORK_FAILURE_PHASE_MISMATCH: ${workId}:expected=${current.phase}:actual=${input.phase}`);
     }
     const phaseEvidence = transitionPhaseEvidence(current, current.phase, {
-      status: 'failed',
+      state: 'failed',
       summary: input.summary,
       evidenceRefs: input.evidenceRefs,
       recordedAt: at,
       source: 'recorded',
     });
     return {
-      status: 'failed',
       phase: current.phase,
       phaseEvidence,
-      dispatchState: 'terminal',
+      dispatchState: 'blocked',
       evidenceState: 'failed',
       ...(input.evidenceRefs ? { evidenceRefs: input.evidenceRefs } : {}),
     };
@@ -1377,19 +1724,27 @@ export function cancelWorkContract(
   workId: string,
   input: { summary: string; evidenceRefs?: EvidenceRef[] },
 ): WorkContract {
-  return updateWorkContractInternal(options, workId, (current, at) => {
-    if (current.status === 'completed') throw new Error(`WORK_CANCEL_COMPLETED: ${workId}`);
-    if (current.status === 'cancelled') return undefined;
-    const phaseEvidence = transitionPhaseEvidence(current, current.phase, {
-      status: 'cancelled',
+  const current = getWorkContract(options, workId);
+  if (!current) throw new Error(`work contract not found: ${sanitizeFileComponent(workId)}`);
+  if (current.semanticState === 'completed') throw new Error(`WORK_CANCEL_COMPLETED: ${workId}`);
+  if (current.semanticState === 'cancelled') return current;
+
+  reviseWorkSemanticContext(options, workId, {
+    expectedRevision: currentWorkSemanticRevision(current),
+    state: 'cancelled',
+  });
+
+  return updateWorkContractInternal(options, workId, (cancelled, at) => {
+    if (cancelled.semanticState !== 'cancelled') {
+      throw new Error(`WORK_CANCEL_SEMANTIC_STATE_REQUIRED: ${workId}:${cancelled.semanticState}`);
+    }
+    const phaseEvidence = cancellationPhaseEvidence(cancelled, {
       summary: input.summary,
       evidenceRefs: input.evidenceRefs,
       recordedAt: at,
-      source: 'recorded',
     });
     return {
-      status: 'cancelled',
-      phase: current.phase,
+      phase: cancelled.phase,
       phaseEvidence,
       dispatchState: 'terminal',
       ...(input.evidenceRefs ? { evidenceRefs: input.evidenceRefs } : {}),
@@ -1399,58 +1754,54 @@ export function cancelWorkContract(
 }
 
 /**
- * Reopen one explicitly retained cancelled repository Work after the facade has
- * reauthenticated the same principal and revalidated physical Work ownership.
- * Generic mutation APIs intentionally cannot perform terminal -> running.
+ * Record verified physical cleanup for an already-cancelled Work without
+ * inventing semantic success. Phases that never ran are skipped, while prior
+ * satisfied/skipped/blocked/failed evidence remains immutable. The cleanup
+ * receipt is the authority for the only newly satisfied phase.
  */
-export function resumeRetainedCancelledWorkContract(
+export function recordCancelledWorkCleanupCompleted(
   options: WorkContractStoreOptions,
   workId: string,
-  input: {
-    principalId: string;
-    controllerInstanceId: string;
-    summary: string;
-    checkoutId?: string;
-    worktreeRef?: string;
-  },
+  input: { summary: string; receiptId: string; evidenceRefs?: EvidenceRef[] },
 ): WorkContract {
   return updateWorkContractInternal(options, workId, (current, at) => {
-    if (current.status !== 'cancelled' || current.dispatchState !== 'terminal') {
-      throw new Error(`WORK_CANCELLED_RESUME_STATUS_INVALID: ${workId}`);
-    }
-    if (current.workKind !== 'repository_change') throw new Error(`WORK_CANCELLED_RESUME_KIND_INVALID: ${workId}`);
-    if (current.completionReceipt || current.completionOutcome) throw new Error(`WORK_CANCELLED_RESUME_COMPLETION_CONFLICT: ${workId}`);
-    if (current.phaseEvidence[current.phase].state !== 'skipped' || current.phaseEvidence[current.phase].source !== 'recorded') {
-      throw new Error(`WORK_CANCELLED_RESUME_HISTORY_AMBIGUOUS: ${workId}`);
+    if (current.semanticState !== 'cancelled') {
+      throw new Error(`WORK_CANCELLED_CLEANUP_STATE_REQUIRED: ${workId}:${current.semanticState}`);
     }
-    const originalPrincipal = current.principalId?.trim();
-    if (!originalPrincipal || originalPrincipal !== input.principalId.trim()) {
-      throw new Error(`WORK_CANCELLED_RESUME_PRINCIPAL_MISMATCH: ${workId}`);
+    const summary = input.summary.trim().slice(0, 1_000);
+    if (!summary) throw new Error('WORK_CANCELLED_CLEANUP_SUMMARY_REQUIRED');
+    const receiptId = input.receiptId.trim();
+    if (!receiptId) throw new Error('WORK_CANCELLED_CLEANUP_RECEIPT_REQUIRED');
+    const evidenceRefs = (input.evidenceRefs ?? current.evidenceRefs).slice(0, current.evidencePolicy.maxEvidenceRefs);
+    const phaseEvidence: WorkPhaseEvidenceMap = { ...current.phaseEvidence };
+    for (const phase of WORK_PHASES) {
+      if (phase === 'cleanup') continue;
+      const existing = phaseEvidence[phase];
+      if (!['pending', 'active'].includes(existing.state)) continue;
+      phaseEvidence[phase] = {
+        state: 'skipped',
+        source: 'recorded',
+        summary: `Skipped after Work cancellation: ${summary}`.slice(0, 1_000),
+        evidenceRefs,
+        recordedAt: at,
+      };
     }
-    const evidenceRefs = [...current.evidenceRefs, {
-      title: 'explicit current-user Work reauthorization',
-      summary: input.summary.trim().slice(0, 1_000),
-      detailLevel: 'summary' as const,
-    }].slice(-current.evidencePolicy.maxEvidenceRefs);
-    const phaseEvidence = transitionPhaseEvidence({ ...current, evidenceRefs }, 'implementation', {
-      status: 'running',
-      summary: input.summary,
+    phaseEvidence.cleanup = {
+      state: 'satisfied',
+      source: 'recorded',
+      summary,
       evidenceRefs,
       recordedAt: at,
-      source: 'recorded',
-    });
+      receiptId,
+    };
     return {
-      status: 'running',
-      phase: 'implementation',
+      phase: 'cleanup',
       phaseEvidence,
-      dispatchState: 'running',
+      dispatchState: 'terminal',
       evidenceRefs,
-      checkoutId: input.checkoutId ?? current.checkoutId,
-      worktreeRef: input.worktreeRef ?? current.worktreeRef,
-      controllerInstanceId: input.controllerInstanceId,
-      continuationPrompt: input.summary,
+      suggestedNextActions: [],
     };
-  }, false, true, true, false, true);
+  }, false, true);
 }
 
 /** Merge non-authoritative discovery/change evidence without changing policy fences. */
@@ -1479,7 +1830,6 @@ export function transitionWorkContractPhase(
   workId: string,
   input: {
     phase: WorkPhase;
-    status: WorkContractStatus;
     state?: Exclude<WorkPhaseEvidenceState, 'pending'>;
     summary: string;
     evidenceRefs?: EvidenceRef[];
@@ -1488,56 +1838,25 @@ export function transitionWorkContractPhase(
   },
 ): WorkContract {
   return updateWorkContractInternal(options, workId, (current, at) => {
-    if (input.phase === 'review') {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRES_REQUEST_API');
-    }
-    if (input.phase === 'delivery'
-      && current.phase !== 'delivery'
-      && workRequiresImplementationReview(current.workKind, current.scopeEvidence?.actualChangedPaths ?? [])) {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRES_RECORD_API');
-    }
     const phaseEvidence = transitionPhaseEvidence(current, input.phase, {
-      status: input.status,
+      state: input.state,
       summary: input.summary,
       evidenceRefs: input.evidenceRefs,
       recordedAt: at,
     });
-    if (input.state) phaseEvidence[input.phase] = { ...phaseEvidence[input.phase], state: input.state };
     return {
       phase: input.phase,
       phaseEvidence,
-      status: input.status,
       dispatchState: input.dispatchState ?? current.dispatchState,
       evidenceState: input.evidenceState ?? current.evidenceState,
     };
-  }, false, true, false, false, true);
+  }, false, true, false, true);
 }
 
-/** Enter the first-class implementation-review phase without recording a decision. */
-export function requestWorkImplementationReview(
-  options: WorkContractStoreOptions,
-  workId: string,
-  summary: string,
-): WorkContract {
-  return updateWorkContractInternal(options, workId, (current, at) => {
-    if (isTerminalWorkContractStatus(current.status)) throw new Error(`WORK_IMPLEMENTATION_REVIEW_TERMINAL: ${workId}`);
-    if (current.phase !== 'verification' || current.phaseEvidence.verification.state !== 'satisfied') {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_VERIFIED_CANDIDATE_REQUIRED');
-    }
-    const phaseEvidence = transitionPhaseEvidence(current, 'review', {
-      status: 'running',
-      summary,
-      recordedAt: at,
-    });
-    return {
-      phase: 'review',
-      phaseEvidence,
-      status: 'running',
-    };
-  }, false, true);
-}
-
-/** The only writer for durable Controller implementation-review authority. */
+/**
+ * Append immutable historical review evidence. This is evidence storage only:
+ * the decision never changes semantic state or phase and never authorizes delivery.
+ */
 export function recordWorkImplementationReview(
   options: WorkContractStoreOptions,
   workId: string,
@@ -1548,198 +1867,14 @@ export function recordWorkImplementationReview(
     throw new Error('WORK_IMPLEMENTATION_REVIEW_DERIVATION_REQUIRES_TRANSFER_API');
   }
   return updateWorkContractInternal(options, workId, (current, at) => {
-    if (isTerminalWorkContractStatus(current.status)) throw new Error(`WORK_IMPLEMENTATION_REVIEW_TERMINAL: ${workId}`);
+    if (semanticWorkState(current) !== 'open') throw new Error(`WORK_IMPLEMENTATION_REVIEW_TERMINAL: ${workId}`);
     if (review.workId !== current.workId) throw new Error('WORK_IMPLEMENTATION_REVIEW_WORK_ID_MISMATCH');
-    if (current.phase !== 'review') {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_PHASE_REQUIRED');
-    }
-    const target = implementationReviewDecisionTarget(review.decision);
     const history = [...(current.implementationReviews ?? []), review];
     if (history.length > MAX_IMPLEMENTATION_REVIEW_HISTORY) throw new Error('WORK_IMPLEMENTATION_REVIEW_HISTORY_LIMIT');
-    const phaseEvidence = transitionPhaseEvidence(current, target.phase, {
-      status: target.status,
-      summary: `Implementation review ${review.reviewId}: ${review.decision}. ${review.rationale}`,
-      recordedAt: at,
-    });
-    if (review.decision === 'approved') {
-      phaseEvidence.review = {
-        state: 'satisfied',
-        source: 'recorded',
-        summary: `Controller approved exact implementation candidate in ${review.reviewId}.`,
-        evidenceRefs: current.evidenceRefs.slice(0, 20),
-        recordedAt: review.recordedAt,
-      };
-    } else if (review.decision === 'blocked') {
-      phaseEvidence.review = { ...phaseEvidence.review, state: 'blocked', recordedAt: review.recordedAt };
-    }
     return {
-      phase: target.phase,
-      phaseEvidence,
-      status: target.status,
-      dispatchState: target.status === 'blocked'
-        ? 'blocked'
-        : current.dispatchState === 'blocked'
-          ? 'running'
-          : current.dispatchState,
-      implementationReviews: history,
-    };
-  }, false, true, false, true, review.decision === 'changes_required');
-}
-
-export interface ContentEquivalentCommitAuthorityTransferInput {
-  transferredVerificationRecords: VerificationRecord[];
-  derivedReview: WorkImplementationReviewRecord;
-}
-
-/**
- * Persist the representation-only commit authority transfer in one Work-store
- * transaction. The immutable parent review plus exact post-commit verification
- * evidence authorize this write; mutable lifecycle phase is only a projection.
- */
-export function recordContentEquivalentCommitAuthorityTransfer(
-  options: WorkContractStoreOptions,
-  workId: string,
-  input: ContentEquivalentCommitAuthorityTransferInput,
-): WorkContract {
-  return withWorkContractStoreWrite(options, () => {
-    const sanitizedId = sanitizeFileComponent(workId);
-    if (options.controllerHome) assertCanonicalWorkAdmissionAllowed(options, { operation: 'continue', workId: sanitizedId });
-    const store = readWorkContractStore(options);
-    const index = store.contracts.findIndex((contract) => contract.workId === sanitizedId);
-    if (index < 0) throw new Error(`work contract not found: ${sanitizedId}`);
-    const current = store.contracts[index]!;
-    if (current.completionReceipt || isTerminalWorkContractStatus(current.status)) {
-      throw new Error(`WORK_IMPLEMENTATION_REVIEW_TRANSFER_TERMINAL: ${sanitizedId}`);
-    }
-
-    const review = input.derivedReview;
-    validateImplementationReviewRecord(review);
-    if (review.workId !== current.workId) throw new Error('WORK_IMPLEMENTATION_REVIEW_WORK_ID_MISMATCH');
-    if (review.derivation !== 'content_equivalent_commit'
-      || review.decision !== 'approved'
-      || !review.derivedFromReviewId) {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_DERIVATION_REQUIRED');
-    }
-    const parent = latestImplementationReview(current.implementationReviews);
-    if (!parent || parent.reviewId !== review.derivedFromReviewId || parent.decision !== 'approved') {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_PARENT_REQUIRED');
-    }
-    if (!['verification', 'review', 'delivery'].includes(current.phase)) {
-      throw new Error(`WORK_IMPLEMENTATION_REVIEW_TRANSFER_PHASE_INVALID: ${current.phase}`);
-    }
-
-    const requestedCheckIds = new Set(current.checks);
-    for (const record of input.transferredVerificationRecords) {
-      if (!requestedCheckIds.has(record.checkId)) {
-        throw new Error(`WORK_VERIFICATION_TRANSFER_UNDECLARED_CHECK: ${record.checkId}`);
-      }
-    }
-    const transferredVerificationRecords = input.transferredVerificationRecords.filter((record) =>
-      !current.checkRefs.some((existing) => sameSuccessfulVerificationExecutionFact(existing, record)));
-    const checkRefs = [...transferredVerificationRecords, ...current.checkRefs].slice(0, 50);
-    const postVerification = authoritativeImplementationReviewVerificationEvidence({
-      repoId: current.repoId,
-      workId: current.workId,
-      requiredCheckIds: current.checks,
-      records: checkRefs,
-      sourceRevision: review.sourceRevision,
-      workspaceFingerprint: review.verificationWorkspaceFingerprint,
-    });
-    if (postVerification.missingCheckIds.length > 0) {
-      throw new Error(`WORK_IMPLEMENTATION_REVIEW_TRANSFER_VERIFICATION_REQUIRED: ${postVerification.missingCheckIds.join(', ')}`);
-    }
-    const expectedEvidence = normalizeImplementationReviewEvidence(review.verificationEvidence);
-    if (JSON.stringify(postVerification.evidence) !== JSON.stringify(expectedEvidence)) {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_TRANSFER_VERIFICATION_IDENTITY_MISMATCH');
-    }
-
-    const history = [...current.implementationReviews, review];
-    if (history.length > MAX_IMPLEMENTATION_REVIEW_HISTORY) throw new Error('WORK_IMPLEMENTATION_REVIEW_HISTORY_LIMIT');
-    const at = nowIso(options);
-    const summary = `Transferred verification and implementation-review authority to content-equivalent commit ${review.sourceRevision}.`;
-    const phaseEvidence = transitionPhaseEvidence(current, 'delivery', {
-      status: 'running',
-      summary,
-      evidenceRefs: current.evidenceRefs,
-      recordedAt: at,
-    });
-    phaseEvidence.verification = {
-      ...phaseEvidence.verification,
-      state: 'satisfied',
-      source: 'recorded',
-      summary: `Exact post-commit verification authority supports derived review ${review.reviewId}.`,
-      evidenceRefs: current.evidenceRefs.slice(0, 20),
-      recordedAt: review.recordedAt,
-    };
-    phaseEvidence.review = {
-      state: 'satisfied',
-      source: 'recorded',
-      summary: `Controller approval ${parent.reviewId} was transferred as ${review.reviewId} after content-equivalence proof.`,
-      evidenceRefs: current.evidenceRefs.slice(0, 20),
-      recordedAt: review.recordedAt,
-    };
-    const next = validateWorkSemanticTransition(current, validateWorkSemantics({
-      ...current,
-      updatedAt: at,
-      status: 'running',
-      phase: 'delivery',
-      phaseEvidence,
-      evidenceState: 'valid',
-      checkRefs,
       implementationReviews: history,
-    }));
-    const contracts = [...store.contracts];
-    contracts[index] = next;
-    writeWorkContractStore(options, { schemaVersion: 3, updatedAt: at, contracts });
-    return next;
-  });
-}
-
-/**
- * Repair only the lifecycle projection for an already-durable exact approved
- * implementation review. This never appends or derives review authority. The
- * caller must first independently prove that the immutable delivery candidate
- * still matches the durable review/check boundary.
- */
-export function reconcileApprovedWorkImplementationReviewProjection(
-  options: WorkContractStoreOptions,
-  workId: string,
-  expected: { reviewId: string; sourceRevision: string; changedPathDigest: string },
-): WorkContract {
-  return updateWorkContractInternal(options, workId, (current, at) => {
-    if (current.completionReceipt) return undefined;
-    if (isTerminalWorkContractStatus(current.status)) throw new Error(`WORK_IMPLEMENTATION_REVIEW_PROJECTION_TERMINAL: ${workId}`);
-    const review = latestImplementationReview(current.implementationReviews);
-    if (!review || review.decision !== 'approved') throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRED');
-    if (review.reviewId !== expected.reviewId
-      || review.sourceRevision !== expected.sourceRevision
-      || review.changedPathDigest !== expected.changedPathDigest) {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_PROJECTION_IDENTITY_MISMATCH');
-    }
-    if (current.phase === 'delivery' && current.phaseEvidence.review.state === 'satisfied') return undefined;
-    if (!['verification', 'review', 'delivery'].includes(current.phase)) {
-      throw new Error(`WORK_IMPLEMENTATION_REVIEW_PROJECTION_PHASE_INVALID: ${current.phase}`);
-    }
-    const summary = `Recovered lifecycle projection from durable approved implementation review ${review.reviewId}; review authority was not rewritten.`;
-    const phaseEvidence = transitionPhaseEvidence(current, 'delivery', {
-      status: 'running',
-      summary,
-      evidenceRefs: current.evidenceRefs,
-      recordedAt: at,
-    });
-    phaseEvidence.review = {
-      state: 'satisfied',
-      source: 'recorded',
-      summary: `Controller approved exact implementation candidate in ${review.reviewId}.`,
-      evidenceRefs: current.evidenceRefs.slice(0, 20),
-      recordedAt: review.recordedAt,
-    };
-    return {
-      phase: 'delivery',
-      phaseEvidence,
-      status: 'running',
     };
-  }, false, true);
+  }, false, false, true, false);
 }
 
 export function appendWorkEvidence(
@@ -1797,63 +1932,45 @@ export function appendVerificationRecord(
 }
 
 /**
- * The only supported path for turning Work evidence into a completion receipt.
- * Task/Run/Process callers may supply evidence, but they cannot manufacture a
- * receipt or a terminal Work projection without this identity and cleanup gate.
+ * Legacy field name retained for storage compatibility. This records durable
+ * delivery/effect evidence only. It MUST NOT complete semantic Work, advance a
+ * Work lifecycle/phase, satisfy review policy, or infer the next action.
+ * Semantic completion is exclusively reviseWorkSemanticContext/complete CAS.
  */
 export function recordWorkCompletionReceipt(
   options: WorkContractStoreOptions,
   workId: string,
   receipt: NonNullable<WorkContract['completionReceipt']>,
   completionOutcome: NonNullable<WorkContract['completionOutcome']>,
-  completionWorkKind?: WorkKind,
+  _completionWorkKind?: WorkKind,
 ): WorkContract {
   return updateWorkContractInternal(options, workId, (current) => {
     if (receipt.workId !== current.workId) throw new Error('WORK_COMPLETION_RECEIPT_IDENTITY_MISMATCH');
     if (current.completionReceipt) {
-      if (current.completionReceipt.receiptId !== receipt.receiptId) throw new Error('WORK_COMPLETION_RECEIPT_ALREADY_RECORDED');
-      return undefined;
+      if (current.completionReceipt.receiptId === receipt.receiptId) return undefined;
+      // Legacy field names store current mechanical delivery evidence. An open
+      // semantic Work may legitimately deliver again after a retained production
+      // canary repair. Terminal semantic Work keeps its delivery receipt immutable.
+      if (semanticWorkState(current) !== 'open') throw new Error('WORK_COMPLETION_RECEIPT_ALREADY_RECORDED');
+      if ((isRepositoryCompletionReceipt(receipt) || isDirectEditWorkCompletionReceipt(receipt)) && current.evidenceState !== 'valid') {
+        throw new Error('WORK_DELIVERY_RECEIPT_REPLACEMENT_VALIDATION_REQUIRED');
+      }
     }
     const recordedAt = receipt.recordedAt;
     const receiptChangedPaths = isRepositoryCompletionReceipt(receipt) || isDirectEditWorkCompletionReceipt(receipt)
       ? receipt.changedPaths
       : [];
-    const historicalReconciliationException = isDirectEditWorkCompletionReceipt(receipt)
-      && Boolean(receipt.reconciliationId?.trim())
-      && current.reconciliations.some((entry) => entry.reconciliationId === receipt.reconciliationId && entry.outcome === 'accepted_equivalence');
-    const reviewRequired = workRequiresImplementationReview(completionWorkKind ?? current.workKind, receiptChangedPaths);
-    if (reviewRequired && !historicalReconciliationException && !['satisfied', 'skipped'].includes(current.phaseEvidence.review.state)) {
-      throw new Error('WORK_IMPLEMENTATION_REVIEW_REQUIRED');
-    }
-    const phaseEvidence: WorkPhaseEvidenceMap = {
-      ...current.phaseEvidence,
-      implementation: { ...current.phaseEvidence.implementation, state: 'satisfied' },
-      verification: { ...current.phaseEvidence.verification, state: 'satisfied' },
-      review: reviewRequired
-        ? historicalReconciliationException
-          ? { state: 'skipped', source: 'recorded', summary: `Historical reviewed reconciliation ${receipt.reconciliationId} is the narrow compatibility authority for this already-delivered Direct Edit Work.`, evidenceRefs: current.evidenceRefs.slice(0, 20), recordedAt }
-          : { ...current.phaseEvidence.review, state: 'satisfied' }
-        : { state: 'skipped', source: 'recorded', summary: 'Implementation review is not required for this source-free Work completion.', evidenceRefs: [], recordedAt },
-      delivery: { state: 'satisfied', source: 'recorded', summary: `Phase delivery accepted by Work completion receipt ${receipt.receiptId}.`, evidenceRefs: current.evidenceRefs.slice(0, 20), recordedAt, receiptId: receipt.receiptId },
-      cleanup: { state: 'satisfied', source: 'recorded', summary: `Phase cleanup accepted by Work completion receipt ${receipt.receiptId}.`, evidenceRefs: current.evidenceRefs.slice(0, 20), recordedAt, receiptId: receipt.receiptId },
-    };
     return {
-      phase: 'cleanup',
-      phaseEvidence,
-      status: 'completed',
-      dispatchState: 'terminal',
-      evidenceState: 'valid',
       completionOutcome,
-      ...(completionWorkKind ? { workKind: completionWorkKind } : {}),
       completionReceipt: receipt,
       scopeEvidence: {
-        initialLikelyPaths: current.scopeEvidence?.initialLikelyPaths ?? current.allowedPaths,
+        initialLikelyPaths: current.scopeEvidence?.initialLikelyPaths ?? [],
         inspectedPaths: current.scopeEvidence?.inspectedPaths ?? [],
         actualChangedPaths: [...new Set(receiptChangedPaths)].slice(0, 500),
         recordedAt,
       },
     };
-  }, true, true);
+  }, true, false);
 }
 export interface AcceptSubmittedWorkInput {
   requestId: string;
@@ -1862,13 +1979,14 @@ export interface AcceptSubmittedWorkInput {
   semanticKey: string;
   operation: SubmittedWorkOperation;
   objective?: string;
-  mode?: WorkContract['mode'];
   requestedBy?: WorkContract['requestedBy'];
   principalId?: string;
   controllerInstanceId?: string;
   workKind?: WorkKind;
   risk?: WorkRisk;
+  /** Compatibility input only; execution scope is owned by EditSession/resources. */
   allowedPaths?: string[];
+  /** Compatibility input only; execution scope is owned by EditSession/resources. */
   forbiddenPaths?: string[];
   checks?: string[];
   acceptanceCriteria?: string[];