@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/context/typescript-navigation.ts

@@ -26,6 +26,14 @@ export interface TypeScriptNavigationResult {
   locations: TypeScriptNavigationLocation[];
 }
 
+export interface TypeScriptSourceSymbolRange {
+  startLine: number;
+  endLine: number;
+  kind: string;
+  name?: string;
+  enclosing?: string;
+}
+
 export interface TypeScriptNavigationAccess {
   /** Stable identity for one read-policy scope. Restricted and unrestricted projects must never share a Language Service. */
   cacheScope: string;
@@ -38,11 +46,13 @@ export interface TypeScriptNavigationAccess {
 interface CachedProject {
   repoRoot: string;
   configPath: string;
+  configVersion: string;
+  sourceIdentity: string;
   service: ts.LanguageService;
 }
 
 const projects = new Map<string, CachedProject>();
-const MAX_CACHED_TYPESCRIPT_PROJECTS = 32;
+const MAX_CACHED_TYPESCRIPT_PROJECTS = 1;
 
 function normalizePath(path: string): string {
   return path.replace(/\\/g, '/');
@@ -71,13 +81,19 @@ function loadProject(repoRoot: string, tsconfigPath = 'tsconfig.json', access?:
   if (access && !access.allowRepositoryPath(configRelative)) {
     throw new Error(`TypeScript navigation tsconfig is denied by read policy: ${configRelative}.`);
   }
-  const cacheKey = `${root}\0${configPath}\0${scriptVersion(configPath)}\0${access?.cacheScope ?? 'unrestricted'}\0${access?.sourceIdentity ?? 'unbound-source'}`;
+  const configVersion = scriptVersion(configPath);
+  const sourceIdentity = access?.sourceIdentity ?? 'unbound-source';
+  const cacheKey = `${root}\0${configPath}\0${access?.cacheScope ?? 'unrestricted'}`;
   const cached = projects.get(cacheKey);
-  if (cached) {
+  if (cached && cached.configVersion === configVersion && cached.sourceIdentity === sourceIdentity) {
     projects.delete(cacheKey);
     projects.set(cacheKey, cached);
     return cached;
   }
+  if (cached) {
+    projects.delete(cacheKey);
+    cached.service.dispose();
+  }
 
   const canReadAbsolute = (fileName: string): boolean => {
     if (!access) return true;
@@ -129,6 +145,8 @@ function loadProject(repoRoot: string, tsconfigPath = 'tsconfig.json', access?:
   const project = {
     repoRoot: root,
     configPath,
+    configVersion,
+    sourceIdentity,
     service: ts.createLanguageService(host, ts.createDocumentRegistry()),
   };
   projects.set(cacheKey, project);
@@ -176,6 +194,70 @@ function location(
   };
 }
 
+function sourceScriptKind(path: string): ts.ScriptKind | undefined {
+  if (/\.tsx$/i.test(path)) return ts.ScriptKind.TSX;
+  if (/\.jsx$/i.test(path)) return ts.ScriptKind.JSX;
+  if (/\.(?:mts|cts|ts)$/i.test(path)) return ts.ScriptKind.TS;
+  if (/\.(?:mjs|cjs|js)$/i.test(path)) return ts.ScriptKind.JS;
+  return undefined;
+}
+
+function sourceDeclarationName(node: ts.Node): string | undefined {
+  const named = node as ts.Node & { name?: ts.Node };
+  return named.name ? named.name.getText().slice(0, 200) : undefined;
+}
+
+function sourceDeclarationKind(node: ts.Node): string | undefined {
+  if (ts.isFunctionDeclaration(node)) return 'function';
+  if (ts.isMethodDeclaration(node)) return 'method';
+  if (ts.isConstructorDeclaration(node)) return 'constructor';
+  if (ts.isGetAccessorDeclaration(node)) return 'getter';
+  if (ts.isSetAccessorDeclaration(node)) return 'setter';
+  if (ts.isClassDeclaration(node) || ts.isClassExpression(node)) return 'class';
+  if (ts.isInterfaceDeclaration(node)) return 'interface';
+  if (ts.isTypeAliasDeclaration(node)) return 'type';
+  if (ts.isEnumDeclaration(node)) return 'enum';
+  if (ts.isModuleDeclaration(node)) return 'module';
+  if (ts.isVariableStatement(node) && node.declarationList.declarations.some((declaration) =>
+    declaration.initializer && (ts.isArrowFunction(declaration.initializer) || ts.isFunctionExpression(declaration.initializer)))) return 'function-variable';
+  return undefined;
+}
+
+function sourceEnclosingName(node: ts.Node): string | undefined {
+  let current = node.parent;
+  while (current) {
+    if (ts.isClassDeclaration(current) || ts.isClassExpression(current) || ts.isInterfaceDeclaration(current) || ts.isModuleDeclaration(current)) {
+      const kind = sourceDeclarationKind(current) ?? 'container';
+      const name = sourceDeclarationName(current);
+      return name ? `${kind}:${name}` : kind;
+    }
+    current = current.parent;
+  }
+  return undefined;
+}
+
+export function extractTypeScriptSourceSymbols(path: string, source: string): TypeScriptSourceSymbolRange[] {
+  const kind = sourceScriptKind(path);
+  if (kind === undefined) return [];
+  const sourceFile = ts.createSourceFile(path, source, ts.ScriptTarget.Latest, true, kind);
+  const declarations: TypeScriptSourceSymbolRange[] = [];
+  const visit = (node: ts.Node): void => {
+    const declarationKind = sourceDeclarationKind(node);
+    if (declarationKind) {
+      declarations.push({
+        startLine: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
+        endLine: sourceFile.getLineAndCharacterOfPosition(node.end).line + 1,
+        kind: declarationKind,
+        ...(sourceDeclarationName(node) ? { name: sourceDeclarationName(node) } : {}),
+        ...(sourceEnclosingName(node) ? { enclosing: sourceEnclosingName(node) } : {}),
+      });
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sourceFile);
+  return declarations;
+}
+
 function dedupe(locations: TypeScriptNavigationLocation[]): TypeScriptNavigationLocation[] {
   const seen = new Set<string>();
   return locations.filter((entry) => {
@@ -220,6 +302,10 @@ export function navigateTypeScriptSymbol(
   };
 }
 
+export function typeScriptNavigationCachedProjectCount(): number {
+  return projects.size;
+}
+
 export function clearTypeScriptNavigationCache(): void {
   for (const project of projects.values()) project.service.dispose();
   projects.clear();

package/src/runtime/control-plane/cleanup-artifact-retention.ts

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, rmSync, statSync } from 'fs';
+import { existsSync, lstatSync, readdirSync, rmdirSync, rmSync, statSync } from 'fs';
 import { spawnSync } from 'child_process';
 import { join, relative, resolve } from 'path';
 import { repositoryControllerRoot } from '../../cli/repositories/controller-home';
@@ -37,6 +37,8 @@ export interface CleanupArtifactRetentionOptions {
   graceMs?: number;
   maxEntries?: number;
   maxRemovals?: number;
+  scanSequence?: number;
+  repositoryIds?: readonly string[];
 }
 
 export interface CleanupArtifactRetentionReport {
@@ -105,14 +107,14 @@ function treeEntry(root: string, ref: string, path: string): string | undefined
 
 export function proveWorkPreservationContained(
   repositoryRoot: string,
-  handle: Pick<WorkHandleState, 'baseCommit' | 'deliveryBaseCommit' | 'expectedHead' | 'cleanupReceipt'>,
+  handle: Pick<WorkHandleState, 'baseCommit' | 'deliveryBaseCommit'>,
   targetBranch: string,
+  protectedCandidate: string | undefined,
 ): WorkPreservationContainmentProof {
   const base = workDeliveryBaseRevision(handle);
   if (!base || !revision(repositoryRoot, base)) {
     return { contained: false, reason: 'base_revision_unavailable', comparedPaths: [] };
   }
-  const protectedCandidate = handle.cleanupReceipt?.preservation.checkpointCommit?.trim() || handle.expectedHead?.trim();
   if (!protectedCandidate) {
     return { contained: false, reason: 'protected_revision_unavailable', comparedPaths: [] };
   }
@@ -190,6 +192,48 @@ function retentionTimestamp(receipt: WorkCleanupReceipt, bundlePath: string): nu
   }
 }
 
+function bundleProtectedRevision(repositoryRoot: string, bundlePath: string): string | undefined {
+  if (!git(repositoryRoot, ['bundle', 'verify', bundlePath]).ok) return undefined;
+  const heads = git(repositoryRoot, ['bundle', 'list-heads', bundlePath]);
+  if (!heads.ok) return undefined;
+  const revisions = [...new Set(heads.stdout.split('\n').map((line) => line.trim().split(/\s+/, 1)[0]).filter((value) => /^[a-f0-9]{40,64}$/i.test(value ?? '')))];
+  return revisions.length === 1 ? revisions[0] : undefined;
+}
+
+function proveOrphanBundleContained(
+  repositoryRoot: string,
+  bundlePath: string,
+  targetBranch: string,
+): { contained: boolean; reason: string } {
+  const protectedRevision = bundleProtectedRevision(repositoryRoot, bundlePath);
+  if (!protectedRevision) return { contained: false, reason: 'orphan_bundle_invalid_or_ambiguous' };
+  if (!revision(repositoryRoot, protectedRevision)) {
+    return { contained: false, reason: 'orphan_protected_revision_unavailable' };
+  }
+  const targetRevision = revision(repositoryRoot, `refs/heads/${targetBranch}`);
+  if (!targetRevision) return { contained: false, reason: 'orphan_target_revision_unavailable' };
+  const remoteRevision = revision(repositoryRoot, `refs/remotes/origin/${targetBranch}`);
+  if (!remoteRevision) return { contained: false, reason: 'orphan_remote_revision_unavailable' };
+  // Anchor the inferred delta against the durable remote target. Using the
+  // local target here could collapse the delta to empty when only the local
+  // branch contains the preserved tip, falsely treating an undelivered bundle
+  // as redundant.
+  const base = git(repositoryRoot, ['merge-base', protectedRevision, remoteRevision]);
+  if (!base.ok || !base.stdout) return { contained: false, reason: 'orphan_merge_base_unavailable' };
+  const paths = changedPaths(repositoryRoot, base.stdout, protectedRevision);
+  if (!paths) return { contained: false, reason: 'orphan_diff_unavailable' };
+  for (const path of paths) {
+    const protectedEntry = treeEntry(repositoryRoot, protectedRevision, path);
+    const targetEntry = treeEntry(repositoryRoot, targetRevision, path);
+    const remoteEntry = treeEntry(repositoryRoot, remoteRevision, path);
+    if (protectedEntry === undefined || targetEntry === undefined || remoteEntry === undefined
+      || protectedEntry !== targetEntry || protectedEntry !== remoteEntry) {
+      return { contained: false, reason: 'orphan_content_mismatch' };
+    }
+  }
+  return { contained: true, reason: paths.length === 0 ? 'orphan_no_source_delta' : 'orphan_target_and_remote_content_contained' };
+}
+
 function retirementFromProof(
   proof: WorkPreservationContainmentProof,
   status: 'eligible' | 'removed' | 'not_needed',
@@ -232,27 +276,36 @@ export function cleanupWorkPreservationArtifacts(
   const repositoriesRoot = join(controllerHome, 'repositories');
   let repositoryIds: string[] = [];
   try {
+    const repositoryFilter = options.repositoryIds ? new Set(options.repositoryIds.map((id) => id.trim()).filter(Boolean)) : undefined;
     repositoryIds = readdirSync(repositoriesRoot, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory())
+      .filter((entry) => entry.isDirectory() && (!repositoryFilter || repositoryFilter.has(entry.name)))
       .map((entry) => entry.name)
       .sort();
   } catch {
     return report;
   }
+  const scanSequence = Math.trunc(options.scanSequence ?? Math.floor(nowMs / 60_000));
+  if (repositoryIds.length > 1) {
+    const offset = ((scanSequence % repositoryIds.length) + repositoryIds.length) % repositoryIds.length;
+    repositoryIds.push(...repositoryIds.splice(0, offset));
+  }
+  let handleInspected = 0;
+  let physicalInspected = 0;
 
-  outer: for (const repositoryId of repositoryIds) {
+  for (const repositoryId of repositoryIds) {
     let repository;
     try {
       repository = getRepository(repositoryId, controllerHome, { includeRemoved: true });
     } catch {
       continue;
     }
-    for (let handle of listWorkHandles(controllerHome, repositoryId)) {
-      if (report.inspected >= maxEntries) {
-        report.budgetExhausted = true;
-        break outer;
-      }
-      report.inspected += 1;
+    const repositoryHandles = listWorkHandles(controllerHome, repositoryId)
+      .sort((left, right) => left.workId.localeCompare(right.workId));
+    if (repositoryHandles.length > 1) {
+      const offset = ((scanSequence % repositoryHandles.length) + repositoryHandles.length) % repositoryHandles.length;
+      repositoryHandles.push(...repositoryHandles.splice(0, offset));
+    }
+    for (let handle of repositoryHandles) {
       const receipt = handle.cleanupReceipt;
       const bundlePath = receipt?.preservation.bundlePath;
       const retirement = receipt?.preservation.bundleRetirement;
@@ -265,6 +318,12 @@ export function cleanupWorkPreservationArtifacts(
         }
       }
       if (!receipt || !bundlePath) continue;
+      if (handleInspected >= maxEntries) {
+        report.budgetExhausted = true;
+        break;
+      }
+      handleInspected += 1;
+      report.inspected += 1;
       const expectedPath = resolve(expectedBundlePath(controllerHome, handle));
       if (resolve(bundlePath) !== expectedPath) {
         report.retained += 1;
@@ -277,7 +336,7 @@ export function cleanupWorkPreservationArtifacts(
         skip(report, 'retention_grace');
         continue;
       }
-      const proof = proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch);
+      const proof = proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch, bundleProtectedRevision(repository.canonicalRoot, bundlePath));
       if (!proof.contained) {
         report.retained += 1;
         skip(report, `containment_${proof.reason}`);
@@ -303,6 +362,7 @@ export function cleanupWorkPreservationArtifacts(
         handle = writeWorkHandle(controllerHome, { ...handle, cleanupReceipt: eligibleReceipt, updatedAt: nowIso });
         const measurement = existsSync(bundlePath) ? measureReclaimablePath(bundlePath) : { bytes: 0, entries: 0, complete: true };
         if (existsSync(bundlePath)) rmSync(bundlePath, { force: true });
+        try { rmdirSync(join(bundlePath, '..')); } catch { /* Preserve non-empty or concurrently changed directories. */ }
         if (measurement.complete) report.reclaimedBytes += measurement.bytes;
         else report.unknownReclaimedByteCount += 1;
         const currentReceipt = handle.cleanupReceipt!;
@@ -323,6 +383,149 @@ export function cleanupWorkPreservationArtifacts(
         report.errors.push(`${handle.workId}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
+
+    // WorkHandle metadata is not physical-retention authority. Discover direct
+    // preservation directories as well so a missing or drifted handle cannot
+    // make an owned bundle immortal. This pass remains fail-closed: only the
+    // canonical direct child containing exactly branch.bundle is considered;
+    // symlinks and extra content are retained, and source containment still
+    // requires proof.
+    const artifactRoot = join(repositoryControllerRoot(controllerHome, repositoryId), 'cleanup-artifacts');
+    let artifactEntries;
+    try {
+      if (!lstatSync(artifactRoot).isDirectory()) continue;
+      artifactEntries = readdirSync(artifactRoot, { withFileTypes: true })
+        .sort((left, right) => left.name.localeCompare(right.name));
+      if (artifactEntries.length > 1) {
+        const offset = ((scanSequence % artifactEntries.length) + artifactEntries.length) % artifactEntries.length;
+        artifactEntries.push(...artifactEntries.splice(0, offset));
+      }
+    } catch {
+      continue;
+    }
+    const physicalHandles = repositoryHandles;
+    const handles = new Map(physicalHandles.map((handle) => [handle.workId, handle]));
+    const referencedBundlePaths = new Set(physicalHandles.flatMap((handle) => {
+      const path = handle.cleanupReceipt?.preservation.bundlePath;
+      return path ? [resolve(path)] : [];
+    }));
+    for (const entry of artifactEntries) {
+      if (!entry.isDirectory()) continue;
+      const directoryPath = join(artifactRoot, entry.name);
+      const handle = handles.get(entry.name);
+      const canonicalBundlePath = resolve(join(directoryPath, 'branch.bundle'));
+      if (referencedBundlePaths.has(canonicalBundlePath)) continue;
+      if (physicalInspected >= maxEntries) {
+        report.budgetExhausted = true;
+        break;
+      }
+      physicalInspected += 1;
+      report.inspected += 1;
+      let contents: string[];
+      let bundlePath: string;
+      try {
+        contents = readdirSync(directoryPath).sort();
+        if (contents.length !== 1 || contents[0] !== 'branch.bundle') {
+          report.retained += 1;
+          skip(report, 'physical_bundle_unrecognized_content');
+          continue;
+        }
+        bundlePath = join(directoryPath, 'branch.bundle');
+        const bundleStat = lstatSync(bundlePath);
+        if (!bundleStat.isFile() || bundleStat.isSymbolicLink()) {
+          report.retained += 1;
+          skip(report, 'physical_bundle_unrecognized_content');
+          continue;
+        }
+      } catch (error) {
+        report.retained += 1;
+        skip(report, 'physical_bundle_unreadable');
+        report.errors.push(`${repositoryId}:${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+        continue;
+      }
+      if (handle?.cleanupReceipt?.preservation.bundlePath
+        && resolve(handle.cleanupReceipt.preservation.bundlePath) !== resolve(bundlePath)) {
+        report.retained += 1;
+        skip(report, 'bundle_metadata_conflict');
+        continue;
+      }
+      let timestamp: number | undefined;
+      try {
+        timestamp = handle?.cleanupReceipt
+          ? retentionTimestamp(handle.cleanupReceipt, bundlePath)
+          : statSync(bundlePath).mtimeMs;
+      } catch (error) {
+        report.retained += 1;
+        skip(report, 'physical_bundle_unreadable');
+        report.errors.push(`${repositoryId}:${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+        continue;
+      }
+      if (timestamp === undefined || nowMs - timestamp < graceMs) {
+        report.retained += 1;
+        skip(report, 'retention_grace');
+        continue;
+      }
+
+      const receipt = handle?.cleanupReceipt;
+      const handleProof = handle && receipt?.complete
+        ? proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch, bundleProtectedRevision(repository.canonicalRoot, bundlePath))
+        : undefined;
+      const orphanProof = !handle && repository.defaultBranch
+        ? proveOrphanBundleContained(repository.canonicalRoot, bundlePath, repository.defaultBranch)
+        : undefined;
+      if (handle && (!receipt?.complete || !handleProof?.contained)) {
+        report.retained += 1;
+        skip(report, !receipt?.complete ? 'physical_bundle_incomplete_handle' : `containment_${handleProof!.reason}`);
+        continue;
+      }
+      if (!handle && !orphanProof?.contained) {
+        report.retained += 1;
+        skip(report, orphanProof?.reason ?? (repository.defaultBranch
+          ? 'orphan_source_containment_unproven'
+          : 'orphan_target_branch_unavailable'));
+        continue;
+      }
+      report.eligible += 1;
+      if (remaining <= 0) {
+        report.budgetExhausted = true;
+        skip(report, 'cleanup_budget_exhausted');
+        continue;
+      }
+      report.attempted += 1;
+      remaining -= 1;
+      try {
+        const measurement = measureReclaimablePath(bundlePath);
+        if (handle && receipt && handleProof) {
+          const eligibleReceipt: WorkCleanupReceipt = {
+            ...receipt,
+            preservation: { ...receipt.preservation, bundlePath, bundleRetirement: retirementFromProof(handleProof, 'eligible', nowIso) },
+            updatedAt: nowIso,
+          };
+          const updated = writeWorkHandle(controllerHome, { ...handle, cleanupReceipt: eligibleReceipt, updatedAt: nowIso });
+          rmSync(bundlePath, { force: true });
+          const removedReceipt: WorkCleanupReceipt = {
+            ...updated.cleanupReceipt!,
+            preservation: {
+              ...updated.cleanupReceipt!.preservation,
+              bundlePath: undefined,
+              bundleSha256: undefined,
+              bundleRetirement: retirementFromProof(handleProof, 'removed', nowIso),
+              recoveryInstructions: `Preservation bundle retired after ${handleProof.reason}; exact proof is stored in cleanupReceipt.preservation.bundleRetirement.`,
+            },
+            updatedAt: nowIso,
+          };
+          writeWorkHandle(controllerHome, { ...updated, cleanupReceipt: removedReceipt, updatedAt: nowIso });
+        } else {
+          rmSync(bundlePath, { force: true });
+        }
+        try { rmdirSync(directoryPath); } catch { /* Preserve concurrently populated directories. */ }
+        if (measurement.complete) report.reclaimedBytes += measurement.bytes;
+        else report.unknownReclaimedByteCount += 1;
+        report.removedPaths.push(relative(controllerHome, bundlePath).replace(/\\/g, '/'));
+      } catch (error) {
+        report.errors.push(`${repositoryId}:${entry.name}: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    }
   }
   return report;
 }

package/src/runtime/control-plane/concurrency/work-execution-concurrency.ts

@@ -2,7 +2,7 @@ import {
   buildWorkExecutionConcurrencyContract,
   evaluateWorkExecutionCompatibility,
   getWorkContract,
-  isTerminalWorkContractStatus,
+  semanticWorkState,
   readActiveWorkCandidates,
   workExecutionLaneMutates,
   updateWorkContract,
@@ -16,7 +16,6 @@ import type { ResourceClaimSpec } from '../../execution/jobs/types';
 import { listProcessRecords } from '../../execution/process-runtime/store';
 import { listActiveLeases } from '../../resources/leases/store';
 import { claimsConflict } from '../../resources/claims/conflicts';
-import { getControllerSession } from '../../../../packages/kernel/controller/api/index';
 import {
   isManagedProcessActive,
   type ExecutionConcurrencyWaitProjection,
@@ -101,34 +100,6 @@ export interface RuntimeWorkCompatibilityDecision {
   wait?: ExecutionConcurrencyWaitProjection;
 }
 
-function invalidActiveWorkCompatibility(
-  candidate: WorkExecutionConcurrencyContract,
-  invalid: ReturnType<typeof readActiveWorkCandidates>['invalid'],
-): ExecutionConcurrencyWaitProjection | undefined {
-  if (!workExecutionLaneMutates(candidate.lane)) return undefined;
-  for (const current of invalid) {
-    if (current.workId === candidate.workId) continue;
-    const currentScope = new Set(current.semanticScopeKeys);
-    const overlap = candidate.semanticScopeKeys.filter((key) => currentScope.has(key));
-    if (overlap.length === 0
-      && candidate.lane === 'isolated_write'
-      && candidate.isolation === 'isolated'
-      && current.isolation === 'isolated') continue;
-    return executionConcurrencyWaitProjection({
-      source: 'work_compatibility',
-      blockerCode: 'work_contract_invalid',
-      disposition: 'invalid',
-      blockingWorkId: current.workId,
-      semanticScopeKeys: overlap.length > 0 ? overlap : current.semanticScopeKeys,
-      resourceKeys: candidate.resourceIntents
-        .filter((intent) => intent.mode !== 'read')
-        .map((intent) => intent.resourceKey),
-      wakeTrigger: { kind: 'work_contract_change', workId: current.workId },
-    });
-  }
-  return undefined;
-}
-
 function contractForProcess(
   controllerHome: string,
   repoId: string,
@@ -181,18 +152,12 @@ export function evaluateManagedProcessWorkCompatibility(input: {
     .filter((record) => record.processId !== input.processId && record.workId && isManagedProcessActive(record))
     .map((record) => contractForProcess(input.controllerHome, input.repoId, record))
     .filter((value): value is WorkExecutionConcurrencyContract => Boolean(value));
-  const worksWithActiveProcesses = new Set(activeProcessContracts.map((contract) => contract.workId));
-  const activeSnapshot = readActiveWorkCandidates({
-    controllerHome: input.controllerHome,
-    repoId: input.repoId,
-    limit: 1_000,
-  });
-  const invalidWait = invalidActiveWorkCompatibility(candidate, activeSnapshot.invalid);
-  if (invalidWait) return { compatible: false, hardBlocked: true, wait: invalidWait };
-  const activeWorkContracts = activeSnapshot.contracts
-    .filter((activeWork) => activeWork.workId !== input.workId && !worksWithActiveProcesses.has(activeWork.workId))
-    .map((activeWork) => buildWorkExecutionConcurrencyContract(activeWork));
-  const decision = evaluateWorkExecutionCompatibility(candidate, [...activeProcessContracts, ...activeWorkContracts]);
+  // Thin Work is semantic context, not a physical execution lease. An open Work
+  // with no running Process must not reserve the shared checkout or make another
+  // Process wait for semantic terminalization. Concrete Process contracts own
+  // in-flight compatibility here; durable WorkHandle and resource-lease fences
+  // separately protect repository mutation across Process lifetimes.
+  const decision = evaluateWorkExecutionCompatibility(candidate, activeProcessContracts);
   const blocker = decision.blockers[0];
   return blocker
     ? { compatible: false, hardBlocked: blocker.disposition === 'invalid', wait: blockerProjection(blocker) }
@@ -225,7 +190,7 @@ export function recordWorkExecutionConcurrencyWait(input: {
   const workId = input.workId?.trim();
   if (!workId) return undefined;
   const work = getWorkContract({ controllerHome: input.controllerHome, repoId: input.repoId }, workId);
-  if (!work || isTerminalWorkContractStatus(work.status)) return undefined;
+  if (!work || semanticWorkState(work) !== 'open') return undefined;
   const projection: WorkExecutionConcurrencyProjection = {
     schemaVersion: 1,
     status: input.wait.disposition === 'invalid' ? 'invalid' : 'waiting',
@@ -275,10 +240,7 @@ function workConcurrencyWakeResolved(input: {
   if (input.projection.status === 'invalid' || wake.kind === 'work_contract_change' || wake.kind === 'scheduler_capacity') return false;
   if (wake.kind === 'work_terminal') {
     const blocking = getWorkContract({ controllerHome: input.controllerHome, repoId: input.repoId }, wake.workId);
-    return Boolean(blocking && isTerminalWorkContractStatus(blocking.status));
-  }
-  if (wake.kind === 'controller_release') {
-    return !getControllerSession({ controllerHome: input.controllerHome, repoId: input.repoId }, wake.workId);
+    return Boolean(blocking && semanticWorkState(blocking) !== 'open');
   }
   const activeLeases = listActiveLeases(input.controllerHome, input.projection.leaseRepoId?.trim() || input.repoId);
   return !input.projection.resourceIntents.some((claim) => activeLeases.some((lease) => claimsConflict(claim, lease)));

package/src/runtime/control-plane/execution/controller-authority-recovery.ts

@@ -12,7 +12,7 @@ import {
   type ControllerTerminalizationAuthority,
   type ControllerType,
 } from '../../../../packages/kernel/controller/api/index';
-import { getWorkContract } from '../../../../packages/kernel/work/api/index';
+import { getWorkContract, semanticWorkState } from '../../../../packages/kernel/work/api/index';
 import { currentPermissionSnapshotVersion } from './validation';
 import { startExecutionSession, updateExecutionSession } from './session-store';
 
@@ -55,8 +55,8 @@ export function recoverDirectControllerAuthority(input: {
   const store = { controllerHome: input.controllerHome, repoId: input.repoId };
   const work = getWorkContract(store, workId);
   if (!work) throw new Error(`WORK_NOT_FOUND: ${workId}`);
-  if (['completed', 'failed', 'cancelled'].includes(work.status)) {
-    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${work.status}`);
+  if (semanticWorkState(work) !== 'open') {
+    throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_TERMINAL: ${workId}:${semanticWorkState(work)}`);
   }
   if (getControllerRoundRelay(store, workId)) {
     throw new Error(`WORK_CONTROLLER_AUTHORITY_RECOVERY_RELAY_CONFLICT: ${workId}; relay-bound Work must recover through its exact per-round authority.`);
@@ -130,6 +130,7 @@ export function recoverControllerAuthority(input: {
   repositoryActiveCheckoutId?: string;
   workId: string;
   requestedBy?: string;
+  recoveryReason?: string;
   identity: DirectControllerAuthorityRecoveryIdentity;
   runtime: { running?: boolean; runtimeInstanceId?: string };
   leaseMs?: number;
@@ -142,6 +143,8 @@ export function recoverControllerAuthority(input: {
   const relay = recoverControllerRoundRelayAuthority(store, {
     workId: input.workId,
     requestedBy: input.requestedBy,
+    recoveryReason: input.recoveryReason,
+    allowCanonicalRuntimeMigration: true,
     identity: {
       controllerId: input.identity.controllerId,
       controllerType: input.identity.controllerType,
@@ -258,6 +261,31 @@ function assertControllerLifecycleInvocationAuthority(
   return undefined;
 }
 
+/**
+ * Modern sessionless MCP replaces its request binding on every call. For a
+ * direct Work, omission of an opaque capability is not a semantic ownership
+ * change when the exact Work, authenticated controller/principal/type and live
+ * canonical Runtime still agree. Relay-bound rounds remain capability-scoped,
+ * and an explicitly supplied wrong capability never uses this path.
+ */
+export function controllerInvocationCanMechanicallyRebindDirectOwnership(
+  input: ControllerInvocationAuthorityContext & { runtime: { running?: boolean; runtimeInstanceId?: string } },
+  owner: ControllerSession | undefined = getControllerSession(
+    { controllerHome: input.controllerHome, repoId: input.repoId },
+    input.workId.trim(),
+  ),
+): boolean {
+  const workId = input.workId.trim();
+  const store = { controllerHome: input.controllerHome, repoId: input.repoId };
+  if (!owner || getControllerRoundRelay(store, workId)) return false;
+  if (input.identity.transportSessionId || input.identity.controllerAuthorityId) return false;
+  if (owner.controllerId !== input.identity.controllerId || owner.controllerType !== input.identity.controllerType) return false;
+  if (controllerSessionPrincipalId(owner) !== input.identity.principalId) return false;
+  const requestedInstanceId = input.identity.controllerInstanceId.trim();
+  const canonicalRuntimeInstanceId = input.runtime.running ? input.runtime.runtimeInstanceId?.trim() || '' : '';
+  return Boolean(requestedInstanceId && canonicalRuntimeInstanceId === requestedInstanceId);
+}
+
 /** Bind one exact Work owner to the current transport/runtime without changing semantic ownership. */
 export function bindControllerOwnershipForInvocation(input: ControllerInvocationAuthorityContext & {
   runtime: { running?: boolean; runtimeInstanceId?: string };
@@ -267,7 +295,9 @@ export function bindControllerOwnershipForInvocation(input: ControllerInvocation
   const store = { controllerHome: input.controllerHome, repoId: input.repoId };
   const workId = input.workId.trim();
   const existingOwner = getControllerSession(store, workId);
-  assertControllerLifecycleInvocationAuthority(input, existingOwner);
+  if (!controllerInvocationCanMechanicallyRebindDirectOwnership(input, existingOwner)) {
+    assertControllerLifecycleInvocationAuthority(input, existingOwner);
+  }
   return bindControllerSessionToCurrentRuntime(store, {
     workId,
     controllerId: input.identity.controllerId,