@moretea-labs/forge 1.8.0 → 1.8.2

package/src/runtime/control-plane/execution/work-head-settlement.ts

@@ -1,3 +1,4 @@
+import { commandExecutionScopeKey, type RepositoryCommandScopeTarget } from '../../../cli/repositories/command-scope';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
 import type { ResolvedExecutionIdentity } from './execution-identity';
@@ -30,7 +31,7 @@ export interface WorkHeadSettlementResult {
  */
 export function settleWorkHandleExpectedHeadAfterRepositoryCommand(input: {
   controllerHome: string;
-  repository: RepositoryRecord;
+  repository: RepositoryCommandScopeTarget;
   executionIdentity: ResolvedExecutionIdentity;
   workId?: string;
   ok?: boolean;
@@ -42,33 +43,65 @@ export function settleWorkHandleExpectedHeadAfterRepositoryCommand(input: {
   if (input.ok !== true || input.cancelled === true || input.timedOut === true) {
     return { settled: false, reason: 'command_not_successful' };
   }
-  const handle = readWorkHandle(input.controllerHome, input.repository.repoId, workId);
-  if (!handle) return { settled: false, reason: 'work_handle_missing' };
-  if (
-    handle.repositoryId !== input.executionIdentity.repositoryId
-    || handle.checkoutId !== input.executionIdentity.checkoutId
-    || handle.workId !== input.executionIdentity.workId
-    || handle.branch !== input.executionIdentity.branch
-    || (input.executionIdentity.expectedHead !== undefined && handle.expectedHead !== input.executionIdentity.expectedHead)
-  ) return { settled: false, reason: 'identity_mismatch' };
-  if (handle.state === 'merged' || handle.state === 'cleaned' || handle.state === 'failed_terminal_cleanup') {
+  const originalHandle = readWorkHandle(input.controllerHome, commandExecutionScopeKey(input.repository), workId);
+  if (!originalHandle) return { settled: false, reason: 'work_handle_missing' };
+  const sameStaticExecutionIdentity = (handle: typeof originalHandle): boolean => (
+    handle.repositoryId === input.executionIdentity.repositoryId
+    && handle.checkoutId === input.executionIdentity.checkoutId
+    && handle.workId === input.executionIdentity.workId
+    && handle.branch === input.executionIdentity.branch
+  );
+  if (!sameStaticExecutionIdentity(originalHandle)) return { settled: false, reason: 'identity_mismatch' };
+  if (originalHandle.state === 'merged' || originalHandle.state === 'cleaned' || originalHandle.state === 'failed_terminal_cleanup') {
     return { settled: false, reason: 'terminal_handle' };
   }
-  const status = repositoryGitStatus(input.repository);
-  if (!status.branch || status.branch !== handle.branch) {
-    return { settled: false, reason: 'branch_changed', previousHead: handle.expectedHead, currentHead: status.head ?? undefined };
+  // A Work head settlement only runs for a Work-bound (repository) command, so
+  // the scope target is a registered repository record at this point.
+  const status = repositoryGitStatus(input.repository as RepositoryRecord);
+  if (!status.branch || status.branch !== originalHandle.branch) {
+    return { settled: false, reason: 'branch_changed', previousHead: originalHandle.expectedHead, currentHead: status.head ?? undefined };
   }
   const currentHead = status.head?.trim();
-  if (!currentHead) return { settled: false, reason: 'head_unavailable', previousHead: handle.expectedHead };
-  if (currentHead === handle.expectedHead) {
-    return { settled: false, reason: 'head_unchanged', previousHead: handle.expectedHead, currentHead };
+  if (!currentHead) return { settled: false, reason: 'head_unavailable', previousHead: originalHandle.expectedHead };
+  const originalAuthorityHead = input.executionIdentity.expectedHead;
+  if (originalHandle.expectedHead === currentHead) {
+    if (originalAuthorityHead !== undefined && originalAuthorityHead !== currentHead) {
+      return { settled: true, reason: 'settled', previousHead: originalAuthorityHead, currentHead };
+    }
+    return { settled: false, reason: 'head_unchanged', previousHead: originalHandle.expectedHead, currentHead };
+  }
+  if (originalAuthorityHead !== undefined && originalHandle.expectedHead !== originalAuthorityHead) {
+    return { settled: false, reason: 'identity_mismatch', previousHead: originalHandle.expectedHead, currentHead };
+  }
+  try {
+    transitionWorkHandle(input.controllerHome, originalHandle, originalHandle.state, { expectedHead: currentHead });
+    return { settled: true, reason: 'settled', previousHead: originalHandle.expectedHead, currentHead };
+  } catch (error) {
+    if (!(error instanceof Error) || !error.message.includes('CONTROL_PLANE_REVISION_CONFLICT')) throw error;
+  }
+
+  // One concurrent lifecycle write is allowed to win the first CAS. Re-read the
+  // exact Work authority and converge only when identity/branch are unchanged.
+  const refreshedHandle = readWorkHandle(input.controllerHome, commandExecutionScopeKey(input.repository), workId);
+  if (!refreshedHandle) return { settled: false, reason: 'work_handle_missing', previousHead: originalHandle.expectedHead, currentHead };
+  if (!sameStaticExecutionIdentity(refreshedHandle)) {
+    return { settled: false, reason: 'identity_mismatch', previousHead: refreshedHandle.expectedHead, currentHead };
+  }
+  if (refreshedHandle.expectedHead !== currentHead && originalAuthorityHead !== undefined && refreshedHandle.expectedHead !== originalAuthorityHead) {
+    return { settled: false, reason: 'identity_mismatch', previousHead: refreshedHandle.expectedHead, currentHead };
+  }
+  if (refreshedHandle.state === 'merged' || refreshedHandle.state === 'cleaned' || refreshedHandle.state === 'failed_terminal_cleanup') {
+    return { settled: false, reason: 'terminal_handle', previousHead: refreshedHandle.expectedHead, currentHead };
+  }
+  if (refreshedHandle.expectedHead === currentHead) {
+    return { settled: true, reason: 'settled', previousHead: originalHandle.expectedHead, currentHead };
   }
   try {
-    transitionWorkHandle(input.controllerHome, handle, handle.state, { expectedHead: currentHead });
-    return { settled: true, reason: 'settled', previousHead: handle.expectedHead, currentHead };
+    transitionWorkHandle(input.controllerHome, refreshedHandle, refreshedHandle.state, { expectedHead: currentHead });
+    return { settled: true, reason: 'settled', previousHead: refreshedHandle.expectedHead, currentHead };
   } catch (error) {
     if (error instanceof Error && error.message.includes('CONTROL_PLANE_REVISION_CONFLICT')) {
-      return { settled: false, reason: 'concurrent_lifecycle_write', previousHead: handle.expectedHead, currentHead };
+      return { settled: false, reason: 'concurrent_lifecycle_write', previousHead: refreshedHandle.expectedHead, currentHead };
     }
     throw error;
   }

package/src/runtime/control-plane/execution/work-lifecycle-audit.ts

@@ -4,12 +4,10 @@ import { resolve } from 'path';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import {
   getWorkContract,
-  listWorkContracts,
   readActiveWorkCandidates,
   type WorkContract,
 } from '../../../../packages/kernel/work/api/index';
-import { isTerminalWorkContractStatus } from '../facade/types';
-import { listControlPlaneRecords } from '../persistence/sqlite-store';
+import { isTerminalSemanticWorkState } from '../facade/types';
 import { listWorkHandles } from './work-handle-store';
 
 export interface WorkLifecycleAttention {
@@ -18,6 +16,31 @@ export interface WorkLifecycleAttention {
   message: string;
 }
 
+const CURRENT_READINESS_LIFECYCLE_STATUSES = new Set([
+  'work_contract_invalid',
+  'active_checkout_missing',
+  'cleaned_worktree_still_present',
+  'dirty_linked_worktree_unregistered',
+  'linked_worktree_unregistered',
+]);
+
+/**
+ * Full lifecycle attention is durable audit evidence. Runtime readiness is narrower:
+ * only source-integrity contradictions that can affect the canonical checkout or
+ * release identity may block current execution. Active semantic Work and missing or
+ * retained isolated Work resources and orphaned historical branches remain visible in
+ * the audit and maintenance projections, but are not shared Runtime execution blockers.
+ * Legacy Work finalization stages are historical maintenance evidence after the Thin
+ * cutover; only independently observable contradictions that affect an active checkout
+ * or canonical source identity may block shared readiness.
+ * Isolated concurrent Work must not make an unrelated clean main release appear unhealthy.
+ */
+export function workLifecycleAttentionBlocksReadiness(
+  finding: Pick<WorkLifecycleAttention, 'status'>,
+): boolean {
+  return CURRENT_READINESS_LIFECYCLE_STATUSES.has(finding.status);
+}
+
 interface LinkedWorktree {
   path: string;
   head?: string;
@@ -147,31 +170,31 @@ interface LifecycleWorkSnapshot {
 }
 
 /**
- * Keep lifecycle diagnostics available when one historical active Work row is malformed.
- * Active Work semantics come only from the Kernel row-isolated projection. When that
- * projection reports corruption, enumerate bounded durable identities and re-read each
- * remaining row through exact Kernel authority so terminal receipt/cleanup diagnostics
- * are preserved without reimplementing Work normalization here.
+ * Lifecycle attention is a projection consumer, not a historical Work scanner.
+ * Active authority comes from the row-isolated Kernel candidate projection.
+ * Terminal diagnostics are bounded to Work that still has a WorkHandle because
+ * that handle owns the physical delivery/cleanup state inspected below. Orphaned
+ * terminal Work is reconstructed by terminal-cleanup reconciliation before it
+ * becomes projection-owned cleanup state.
  */
-function readLifecycleWorkSnapshot(controllerHome: string, repoId: string): LifecycleWorkSnapshot {
+function readLifecycleWorkSnapshot(
+  controllerHome: string,
+  repoId: string,
+  handles: ReturnType<typeof listWorkHandles>,
+): LifecycleWorkSnapshot {
   const store = { controllerHome, repoId };
   const active = readActiveWorkCandidates({ ...store, limit: 100 });
-  if (active.invalid.length === 0) {
-    return { contracts: listWorkContracts({ ...store, status: 'all', limit: 100 }), invalid: [] };
-  }
-
   const contractsById = new Map(active.contracts.map((contract) => [contract.workId, contract]));
   const invalidById = new Map(active.invalid.map((entry) => [entry.workId, { workId: entry.workId, error: entry.error }]));
-  const identities = listControlPlaneRecords<WorkContract>(controllerHome, {
-    namespace: 'work_contract',
-    scope: repoId,
-    limit: 5_000,
-  })
-    .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
-    .slice(0, 100);
 
-  for (const record of identities) {
-    const workId = record.key;
+  const handledWorkIds = [...new Set(
+    [...handles]
+      .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt))
+      .map((handle) => handle.workContractId ?? handle.workId),
+  )];
+
+  for (const workId of handledWorkIds) {
+    if (contractsById.size >= 100) break;
     if (contractsById.has(workId) || invalidById.has(workId)) continue;
     try {
       const contract = getWorkContract(store, workId);
@@ -203,9 +226,9 @@ export function collectWorkLifecycleAttention(
   controllerHome: string,
   repository: RepositoryRecord,
 ): WorkLifecycleAttention[] {
-  const workSnapshot = readLifecycleWorkSnapshot(controllerHome, repository.repoId);
-  const contracts = workSnapshot.contracts;
   const handles = listWorkHandles(controllerHome, repository.repoId, 5_000);
+  const workSnapshot = readLifecycleWorkSnapshot(controllerHome, repository.repoId, handles);
+  const contracts = workSnapshot.contracts;
   const contractsByWork = new Map(contracts.map((contract) => [contract.workId, contract]));
   const handlesByWork = new Map(handles.map((handle) => [handle.workContractId ?? handle.workId, handle]));
   const findings: WorkLifecycleAttention[] = workSnapshot.invalid.map((entry) => attention(
@@ -225,7 +248,7 @@ export function collectWorkLifecycleAttention(
 
   for (const contract of contracts) {
     const handle = handlesByWork.get(contract.workId);
-    const terminal = isTerminalWorkContractStatus(contract.status);
+    const terminal = isTerminalSemanticWorkState(contract.semanticState);
     if (!terminal) {
       // Repository lifecycle attention is release-facing. A source-neutral Work
       // (for example local UI automation) may legitimately remain active while
@@ -236,7 +259,7 @@ export function collectWorkLifecycleAttention(
         findings.push(attention(
           'work_active',
           contract.workId,
-          `Work ${contract.workId} is ${contract.status} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
+          `Work ${contract.workId} is ${contract.semanticState} in ${contract.phase}; continue, block with a handoff, or finalize it explicitly.`,
         ));
       }
       if (contract.workKind === 'repository_change' && !handle) {
@@ -256,14 +279,14 @@ export function collectWorkLifecycleAttention(
       continue;
     }
 
-    if (contract.status === 'completed' && !contract.completionReceipt) {
+    if (contract.semanticState === 'completed' && !contract.completionReceipt) {
       findings.push(attention(
         'completed_work_receipt_missing',
         contract.workId,
         `Completed Work ${contract.workId} has no Completion Receipt.`,
       ));
     }
-    if (contract.status === 'completed' && contract.completionReceipt?.source === 'controller_work') {
+    if (contract.semanticState === 'completed' && contract.completionReceipt?.source === 'controller_work') {
       const receiptTargetRevision = contract.completionReceipt.targetRevision?.trim();
       const receiptTargetBranch = contract.completionReceipt.targetBranch?.trim() || targetBranch;
       if (!receiptTargetRevision || exactCommitReachableFromTarget(
@@ -308,7 +331,7 @@ export function collectWorkLifecycleAttention(
     handles
       .filter((handle) => {
         const contract = contractsByWork.get(handle.workContractId ?? handle.workId);
-        return contract ? !isTerminalWorkContractStatus(contract.status) : false;
+        return contract ? !isTerminalSemanticWorkState(contract.semanticState) : false;
       })
       .map((handle) => handle.branch),
   );

package/src/runtime/control-plane/execution/work-operation-service.ts

@@ -1,12 +1,13 @@
 import { createHash, randomUUID } from 'crypto';
 import { isAbsolute, relative, resolve } from 'path';
 import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
-import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
+import { repositoryGitStatus, repositoryGitWorkspaceChanges } from '../../../cli/repositories/structured-git';
 import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
-import { listControllerChecks } from '../../../cli/controller/check-runner';
+import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
 import { appendVerificationRecord } from '../../../../packages/kernel/work/api/index';
 import { validateWorkHandle } from './validation';
+import { changedPaths as revisionChangedPaths } from './work-revision-diff';
 import { commandFingerprint, effectiveVerificationEvidence, verificationInputFingerprint, workspaceValidationFingerprint, workValidationInputFingerprint } from './verification-evidence';
 import { executionIdentityForWork } from './execution-identity';
 import { markWorkHandleFailed, transitionWorkHandle, type WorkHandleState } from './work-handle-store';
@@ -14,13 +15,13 @@ import { assertResolvedAuthorization, decideAuthorization, type AuthorizationDec
 import { recordMcpTiming } from '../../diagnostics/mcp-timing';
 import { commandValue, normalizeRepositoryCommand, type RepositoryCommandValue } from '../../../cli/repositories/command-normalization';
 import { executeRepositoryCommandViaProcessRuntime } from '../../execution/process-runtime/command-facade';
-import { getCheckProcessHandle } from '../../execution/process-runtime/check-facade';
+import { getCheckProcessHandle, waitForCheckProcess } from '../../execution/process-runtime/check-facade';
 import { processCheckCompletionReceipt } from '../../execution/process-runtime/check-receipt';
-import { classifyPersistedCheckTerminalEvidence } from '../../execution/process-runtime/check-result';
+import { projectTerminalCheckVerification } from '../../execution/process-runtime/check-result';
 import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
 import { runPersistedCheckViaProcessRuntime } from '../../execution/process-runtime/persisted-check';
 import { markWorkValidationCurrentFromReusedEvidence, markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
-import { assertWorkControllerOwnership, compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
+import { compactHandle, contractFor, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
 
 function commandInputs(args: Record<string, unknown>): Array<Record<string, unknown>> {
   if (Array.isArray(args.commands)) return args.commands.filter((value): value is Record<string, unknown> => Boolean(value && typeof value === 'object' && !Array.isArray(value)));
@@ -41,7 +42,6 @@ function authorizationRisk(command: RepositoryCommandValue, classification: Retu
 export async function executeWork(ctx: McpExecutionContext, args: Record<string, unknown>): Promise<Record<string, unknown>> {
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args);
-  assertWorkControllerOwnership(ctx, session, handle, args);
   const commands = commandInputs(args);
   if (commands.length > 16) throw new Error('COMMAND_BATCH_TOO_LARGE: at most 16 commands per work_execute');
   const cheap = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'cheap', 'execute');
@@ -173,11 +173,18 @@ export async function executeWork(ctx: McpExecutionContext, args: Record<string,
       }
       return ordered;
     })();
-  const branch = repositoryGitStatus(cheap.worktreeRepository).branch;
-  const head = gitHead(cheap.worktreeRepository.canonicalRoot);
+  // Reuse the exact post-command Git snapshot for both branch and HEAD.
+  // A second rev-parse can observe a different instant during concurrent writes.
+  const postCommandStatus = repositoryGitStatus(cheap.worktreeRepository);
+  const branch = postCommandStatus.branch;
+  const head = postCommandStatus.head ?? undefined;
   let nextHandle = handle;
   if (branch !== handle.branch) nextHandle = markWorkHandleFailed(ctx.controllerHome, handle, `command changed the bound branch to ${branch ?? 'detached'}`);
-  else nextHandle = transitionWorkHandle(ctx.controllerHome, handle, 'editing', { expectedHead: head, failureReason: undefined });
+  else if (handle.state !== 'editing' || handle.expectedHead !== head || handle.failureReason !== undefined) {
+    // A read-only command on an already-current Work must not consume a CAS
+    // revision (or rewrite the validation index) just to reaffirm the same HEAD.
+    nextHandle = transitionWorkHandle(ctx.controllerHome, handle, 'editing', { expectedHead: head, failureReason: undefined });
+  }
   const value = {
     work: compactHandle(nextHandle),
     commands: executions,
@@ -230,7 +237,6 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
   const session = requireSession(ctx, args);
   const handle = workForSession(ctx, session, args, {
     reconcileValidation: false,
-    allowClaimedTerminalCleanup: args.cleanup !== false,
   });
   const terminalOutcome = terminalCleanupOutcome(ctx, handle);
   if (terminalOutcome && args.cleanup !== false) {
@@ -238,19 +244,28 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
   }
   const validated = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'full', 'validate');
   const contract = contractFor(ctx, handle);
-  const changed = repositoryGitDiff(validated.worktreeRepository, { maxBytes: 64 * 1024 });
-  const changedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
+  const workspaceChanges = repositoryGitWorkspaceChanges(validated.worktreeRepository);
+  const workspaceChangedPaths = workspaceChanges.changedPaths;
+  const validationStatus = workspaceChanges.status;
+  const validationHead = validationStatus.head
+    ?? handle.expectedHead
+    ?? handle.baseCommit
+    ?? 'unknown';
+  const baseRevision = handle.deliveryBaseCommit ?? handle.baseCommit;
+  const committedChangedPaths = baseRevision && validationHead !== 'unknown'
+    ? revisionChangedPaths(validated.worktreeRepository.canonicalRoot, baseRevision, validationHead)
+    : [];
+  const changedPaths = [...new Set([...committedChangedPaths, ...workspaceChangedPaths])].sort();
   const requestedChecks = Array.isArray(args.check_ids)
     ? args.check_ids.map(String).filter(Boolean)
     : selectDefaultWorkValidationChecks(contract, changedPaths);
+  const interactiveWaitBudgetMs = typeof args.interactive_wait_ms === 'number' && Number.isFinite(args.interactive_wait_ms)
+    ? Math.max(0, Math.min(30_000, Math.floor(args.interactive_wait_ms)))
+    : 0;
+  const interactiveWaitDeadline = interactiveWaitBudgetMs > 0 ? Date.now() + interactiveWaitBudgetMs : 0;
   const validationInvocationId = typeof args.request_id === 'string' && args.request_id.trim()
     ? args.request_id.trim()
     : `validate-${session.sessionId}-${handle.workId}-${Date.now()}-${randomUUID().slice(0, 8)}`;
-  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
-  const validationHead = validationStatus.head
-    ?? handle.expectedHead
-    ?? handle.baseCommit
-    ?? 'unknown';
   const workspaceFingerprint = workspaceValidationFingerprint(
     validated.worktreeRepository.canonicalRoot,
     validationStatus,
@@ -354,11 +369,8 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
         workId: handle.workId,
         commandId: processRequestId,
         verificationBinding: { executionSessionId: session.sessionId },
-        verificationSnapshot: contract && contract.allowedPaths.length > 0 ? {
-          workId: contract.workId,
-          allowedPaths: contract.allowedPaths,
-          forbiddenPaths: contract.forbiddenPaths,
-        } : undefined,
+        // Work is not a path-scope owner. Only an EditSession can bind a
+        // candidate snapshot to concrete mutation scope.
       });
       if (executed.mode === 'durable') {
         checks.push({ checkId, ok: undefined, status: 'deferred', summary: executed.durable?.reason, durable: executed.durable });
@@ -379,6 +391,17 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
       };
       current = transitionWorkHandle(ctx.controllerHome, current, 'validating', { validationRun });
     }
+    if (!process.completed && interactiveWaitDeadline > 0) {
+      const remainingWaitMs = Math.max(0, interactiveWaitDeadline - Date.now());
+      if (remainingWaitMs > 0) {
+        process = await waitForCheckProcess(
+          ctx.controllerHome,
+          handle.repositoryId,
+          process.processId,
+          remainingWaitMs,
+        );
+      }
+    }
     if (!process.completed) {
       checks.push({ checkId, ok: undefined, status: 'running', process });
       break;
@@ -406,14 +429,13 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
         },
       } : {}),
     });
-    const terminalEvidence = classifyPersistedCheckTerminalEvidence(record, checkId);
-    const infrastructureFailed = receipt.timedOut
-      || receipt.cancelled
-      || terminalEvidence.state !== 'matched'
-      || (!receipt.ok && terminalEvidence.failureClass !== 'acceptance_failure');
+    const legacyEvidence = record.origin?.checkResultReceiptPath
+      ? undefined
+      : readLatestControllerCheckEvidence(validated.worktreeRepository.canonicalRoot, checkId);
+    const projection = projectTerminalCheckVerification(record, checkId, receipt, { legacyEvidence });
     appendVerificationRecord({ controllerHome: ctx.controllerHome, repoId: handle.repositoryId }, handle.workId, {
       checkId,
-      outcome: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'valid_pass' : 'valid_fail',
+      outcome: projection.outcome,
       summary: receipt.summary,
       recordedAt: receipt.finishedAt,
       sourceRevision: validationHead,
@@ -428,13 +450,14 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
     });
     checks.push({
       checkId,
-      ok: receipt.ok,
-      status: infrastructureFailed ? 'infrastructure_failure' : receipt.ok ? 'passed' : 'failed',
+      ok: projection.outcome === 'valid_pass' ? true : projection.outcome === 'valid_fail' ? false : undefined,
+      status: projection.outcome === 'valid_pass' ? 'passed' : projection.outcome === 'valid_fail' ? 'failed' : 'infrastructure_failure',
       process,
       receipt,
-      ...(terminalEvidence.warning ? { warning: terminalEvidence.warning } : {}),
+      ...(projection.evidence.warning ? { warning: projection.evidence.warning } : {}),
+      ...(projection.infrastructureReason ? { infrastructureReason: projection.infrastructureReason } : {}),
     });
-    if (!receipt.ok) break;
+    if (projection.outcome !== 'valid_pass') break;
   }
   const infrastructureFailure = checks.find((check) => (
     check.status === 'missing'
@@ -453,9 +476,12 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
     : acceptedFailure
       ? String(acceptedFailure.summary ?? 'targeted validation failed')
       : undefined;
+  // A missing/stale Check receipt is retryable validation evidence, not a
+  // failed Work execution. Keep the original Work state so repair commands
+  // remain authorized; accepted test failures retain the existing failed path.
   const nextState = !completed
     ? 'validating'
-    : passed
+    : passed || infrastructureFailure
       ? validationRun.resumeState
       : 'failed';
   const validation = !completed ? 'pending' : passed ? 'done' : 'failed';
@@ -466,7 +492,7 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
       lastError: failureSummary,
     },
     validationRun: completed ? undefined : validationRun,
-    ...(passed ? { validatedInputFingerprint: validationFingerprint } : {}),
+    validatedInputFingerprint: passed ? validationFingerprint : undefined,
     ...(failureSummary ? { failureReason: failureSummary } : { failureReason: undefined }),
   });
   if (completed) {