@moretea-labs/forge 1.8.1 → 1.8.2

package/src/runtime/context/semantic-navigation-contract.ts

@@ -25,6 +25,8 @@ export interface SemanticNavigationResult {
   target: { path: string; line: number; column: number };
   locations: SemanticNavigationLocation[];
   policyDeniedReads?: number;
+  /** Denied requested/material reads, excluding incidental dependency probes. */
+  materialPolicyDeniedReads?: number;
   details?: Record<string, unknown>;
 }
 
@@ -68,3 +70,8 @@ export interface IndexedSemanticNavigationOutcome {
   index: number;
   outcome: SemanticNavigationOutcome;
 }
+
+/** Dependency probes rejected by policy cannot certify missing requested source relationships. */
+export function isIncidentalSemanticDependencyProbe(path: string): boolean {
+  return /(?:^|\/)node_modules\/[^/]+/.test(path.replace(/\\/g, '/'));
+}

package/src/runtime/context/semantic-navigation.ts

@@ -45,7 +45,7 @@ const swiftProvider: SemanticNavigationProvider = {
       if (request.tsconfigPath) {
         invalid.set(index, { ok: false, code: 'SWIFT_SEMANTIC_TSCONFIG_UNSUPPORTED', message: 'tsconfig_path applies only to TypeScript semantic navigation.' });
       } else if (access.profile !== 'controller') {
-        invalid.set(index, { ok: false, code: 'SWIFT_SEMANTIC_READ_SCOPE_UNSUPPORTED', message: 'External SourceKit-LSP navigation is restricted to the controller read profile; use lexical/CodeGraph evidence under narrower read policies.' });
+        invalid.set(index, { ok: false, code: 'SWIFT_SEMANTIC_READ_SCOPE_UNSUPPORTED', message: 'External SourceKit-LSP navigation is restricted to the controller read profile; use bounded lexical/raw source evidence under narrower read policies.' });
       } else {
         eligible.push({ index, request });
       }

package/src/runtime/control-plane/cleanup-artifact-retention.ts

@@ -107,14 +107,14 @@ function treeEntry(root: string, ref: string, path: string): string | undefined
 
 export function proveWorkPreservationContained(
   repositoryRoot: string,
-  handle: Pick<WorkHandleState, 'baseCommit' | 'deliveryBaseCommit' | 'expectedHead' | 'cleanupReceipt'>,
+  handle: Pick<WorkHandleState, 'baseCommit' | 'deliveryBaseCommit'>,
   targetBranch: string,
+  protectedCandidate: string | undefined,
 ): WorkPreservationContainmentProof {
   const base = workDeliveryBaseRevision(handle);
   if (!base || !revision(repositoryRoot, base)) {
     return { contained: false, reason: 'base_revision_unavailable', comparedPaths: [] };
   }
-  const protectedCandidate = handle.cleanupReceipt?.preservation.checkpointCommit?.trim() || handle.expectedHead?.trim();
   if (!protectedCandidate) {
     return { contained: false, reason: 'protected_revision_unavailable', comparedPaths: [] };
   }
@@ -336,7 +336,7 @@ export function cleanupWorkPreservationArtifacts(
         skip(report, 'retention_grace');
         continue;
       }
-      const proof = proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch);
+      const proof = proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch, bundleProtectedRevision(repository.canonicalRoot, bundlePath));
       if (!proof.contained) {
         report.retained += 1;
         skip(report, `containment_${proof.reason}`);
@@ -468,7 +468,7 @@ export function cleanupWorkPreservationArtifacts(
 
       const receipt = handle?.cleanupReceipt;
       const handleProof = handle && receipt?.complete
-        ? proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch)
+        ? proveWorkPreservationContained(repository.canonicalRoot, handle, receipt.targetBranch, bundleProtectedRevision(repository.canonicalRoot, bundlePath))
         : undefined;
       const orphanProof = !handle && repository.defaultBranch
         ? proveOrphanBundleContained(repository.canonicalRoot, bundlePath, repository.defaultBranch)

package/src/runtime/control-plane/execution/work-delivery-service.ts

@@ -1,10 +1,12 @@
-import { createHash } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { spawnSync } from 'child_process';
 import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
 import {
   getWorkContract,
   isRepositoryCompletionReceipt,
+  reviseWorkSemanticContext,
   semanticWorkState,
+  workSemanticView,
   type CompletionMaintenanceWarning,
   type RepositoryCompletionReceipt,
 } from '../../../../packages/kernel/work/api/index';
@@ -15,6 +17,8 @@ import {
 } from '../../../cli/repositories/registry';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
 import { listActiveLeases } from '../../resources/leases/store';
+import { withCheckoutMutationGate } from '../../execution/thin-harness/mutation-gate';
+import { runBoundedGit } from '../../execution/thin-harness/async-process';
 import { assertRuntimeMayWriteOrThrow, isRuntimeWriteFenceError } from '../../root/write-fence';
 import { cleanupTerminalWork } from './work-terminal-cleanup';
 import { recordWorkDeliveryReceipt } from './work-completion-authority';
@@ -141,9 +145,11 @@ function assertTargetMutationAvailable(
   targetBranch: string,
   expectedTargetHead: string,
   targetRoot: string,
+  ownedLeaseJobId?: string,
 ): void {
   const blockingLease = listActiveLeases(controllerHome, handle.repositoryId)
-    .find((lease) => lease.checkoutId === targetCheckoutId && lease.workId !== handle.workId);
+    .find((lease) => lease.checkoutId === targetCheckoutId
+      && lease.ownerJobId !== ownedLeaseJobId && lease.workId !== handle.workId);
   if (blockingLease) {
     throw new Error(`WORK_DELIVERY_TARGET_LEASE_ACTIVE: ${blockingLease.leaseId}`);
   }
@@ -239,6 +245,33 @@ function cleanupEvidence(receipt: WorkCleanupReceipt, recordedAt: string): Repos
   return { status: 'maintenance_warning', warnings, blockers: [], recordedAt };
 }
 
+/** Explicit model-selected semantic completion; physical Git delivery alone never closes Work. */
+function semanticCompletionAfterDelivery(
+  ctx: McpExecutionContext,
+  handle: WorkHandleState,
+  receipt: RepositoryCompletionReceipt,
+  completeWork: boolean,
+  expectedSemanticRevision: number,
+): Record<string, unknown> {
+  if (!completeWork) return { semanticCompletionRequired: true };
+  if (receipt.cleanup.status !== 'complete' || receipt.cleanup.blockers.length > 0) {
+    // Git can already be integrated. Leave the semantic Work open for recovery.
+    return { semanticCompletionRequired: true, semanticCompletionBlocked: 'WORK_DELIVERY_CLEANUP_INCOMPLETE' };
+  }
+  const store = { controllerHome: ctx.controllerHome, repoId: handle.repositoryId };
+  const workId = handle.workContractId ?? handle.workId;
+  const current = getWorkContract(store, workId);
+  if (!current || semanticWorkState(current) !== 'open') {
+    throw new Error(`WORK_DELIVERY_SEMANTIC_WORK_NOT_OPEN: ${current ? semanticWorkState(current) : 'missing'}`);
+  }
+  const completed = reviseWorkSemanticContext(store, workId, {
+    // Do not close a Work whose objective changed while Git delivery was running.
+    expectedRevision: expectedSemanticRevision,
+    state: 'completed',
+  });
+  return { semanticCompletionRequired: false, semanticWork: workSemanticView(completed) };
+}
+
 function recordDelivery(
   ctx: McpExecutionContext,
   handle: WorkHandleState,
@@ -249,7 +282,8 @@ function recordDelivery(
   strategy: RepositoryCompletionReceipt['delivery']['strategy'],
   cleanupReceipt: WorkCleanupReceipt,
 ): RepositoryCompletionReceipt {
-  const baseRevision = handle.deliveryBaseCommit ?? handle.baseCommit;
+  // Receipt scope is the immutable Work origin, not a movable integration baseline.
+  const baseRevision = handle.baseCommit;
   const paths = baseRevision ? changedPaths(targetRoot, baseRevision, sourceRevision) : [];
   const recordedAt = new Date().toISOString();
   const receipt: RepositoryCompletionReceipt = {
@@ -292,6 +326,8 @@ async function reconcileDeliveredWork(
   targetBranch: string,
   targetRoot: string,
   sourceRevision: string,
+  completeWork: boolean,
+  expectedSemanticRevision: number,
 ): Promise<Record<string, unknown>> {
   const targetRevision = exactRevision(targetRoot, targetBranch, 'TARGET_HEAD');
   if (!git(targetRoot, ['merge-base', '--is-ancestor', sourceRevision, targetRevision]).ok) {
@@ -328,7 +364,7 @@ async function reconcileDeliveredWork(
     delivery: receipt,
     cleanup: cleanup.receipt,
     recoveredAfterDelivery: true,
-    semanticCompletionRequired: true,
+    ...semanticCompletionAfterDelivery(ctx, handle, receipt, completeWork, expectedSemanticRevision),
   });
 }
 
@@ -347,8 +383,12 @@ export async function deliverWork(ctx: McpExecutionContext, args: Record<string,
     handle.workContractId ?? handle.workId,
   );
   if (!contract) throw new Error(`WORK_CONTRACT_MISSING: ${handle.workContractId ?? handle.workId}`);
-  if (semanticWorkState(contract) !== 'open') {
-    throw new Error(`WORK_DELIVERY_SEMANTIC_WORK_NOT_OPEN: ${semanticWorkState(contract)}`);
+  const completeWork = args.complete_work === true;
+  const allowMergeCommit = args.allow_merge_commit === true;
+  const semanticState = semanticWorkState(contract);
+  const expectedSemanticRevision = workSemanticView(contract).revision;
+  if (semanticState !== 'open' && !(completeWork && semanticState === 'completed')) {
+    throw new Error(`WORK_DELIVERY_SEMANTIC_WORK_NOT_OPEN: ${semanticState}`);
   }
   if (contract.workKind !== 'repository_change') {
     throw new Error(`WORK_DELIVERY_WORK_KIND_INVALID: ${contract.workKind}`);
@@ -360,6 +400,22 @@ export async function deliverWork(ctx: McpExecutionContext, args: Record<string,
   const targetRoot = target.canonicalRoot;
   const targetHead = exactRevision(targetRoot, targetStatus.head ?? 'HEAD', 'TARGET_HEAD');
 
+  // Repeated explicit delivery after a successful semantic close is read-only.
+  // Never rewrite a terminal Work receipt or reopen its managed worktree.
+  if (semanticState === 'completed') {
+    const receipt = contract.completionReceipt;
+    if (!receipt || !isRepositoryCompletionReceipt(receipt) || !receipt.sourceRevision
+      || receipt.delivery.status !== 'integrated' || receipt.cleanup.status !== 'complete'
+      || receipt.targetBranch !== targetBranch || receipt.sourceRevision !== handle.expectedHead
+      || !git(targetRoot, ['merge-base', '--is-ancestor', receipt.sourceRevision, targetHead]).ok) {
+      throw new Error('WORK_DELIVERY_TERMINAL_RECEIPT_UNPROVEN');
+    }
+    return makeBoundedWorkResult(ctx, session, handle.repositoryId, handle.workId, 'finalization', {
+      work: compactHandle(handle), delivery: receipt, cleanup: handle.cleanupReceipt,
+      recoveredAfterDelivery: true, semanticCompletionRequired: false, semanticWork: workSemanticView(contract),
+    });
+  }
+
   if (
     (handle.state === 'merged' || handle.state === 'failed_terminal_cleanup' || handle.state === 'cleaned')
     && handle.expectedHead
@@ -371,6 +427,8 @@ export async function deliverWork(ctx: McpExecutionContext, args: Record<string,
       targetBranch,
       targetRoot,
       exactRevision(targetRoot, handle.expectedHead, 'SOURCE_REVISION'),
+      completeWork,
+      expectedSemanticRevision,
     );
   }
 
@@ -416,33 +474,94 @@ export async function deliverWork(ctx: McpExecutionContext, args: Record<string,
   if (git(targetRoot, ['merge-base', '--is-ancestor', sourceRevision, targetHead]).ok) {
     strategy = 'already_integrated';
   } else {
-    if (!git(targetRoot, ['merge-base', '--is-ancestor', targetHead, sourceRevision]).ok) {
+    const targetIsAncestor = git(targetRoot, ['merge-base', '--is-ancestor', targetHead, sourceRevision]).ok;
+    if (!targetIsAncestor && !allowMergeCommit) {
       throw new Error(`WORK_DELIVERY_NON_FAST_FORWARD: target ${targetHead} and source ${sourceRevision} diverged`);
     }
-    assertTargetMutationAvailable(
-      ctx.controllerHome,
-      handle,
-      target.activeCheckoutId,
-      targetBranch,
-      targetHead,
-      targetRoot,
-    );
-    if (handle.state !== 'committed') {
-      handle = transitionWorkHandle(ctx.controllerHome, handle, 'committed', {
-        expectedHead: sourceRevision,
-        failureReason: undefined,
-        finalization: { ...handle.finalization, commit: 'done', lastError: undefined },
-      });
-    }
-    const merged = git(targetRoot, ['merge', '--ff-only', sourceRevision], 60_000);
-    if (!merged.ok) {
-      throw new Error(`WORK_DELIVERY_FAST_FORWARD_FAILED: ${merged.stderr || merged.stdout || 'git merge failed'}`);
-    }
-    integratedTargetHead = exactRevision(targetRoot, 'HEAD', 'TARGET_HEAD');
-    if (integratedTargetHead !== sourceRevision) {
-      throw new Error(`WORK_DELIVERY_TARGET_HEAD_UNEXPECTED: expected ${sourceRevision}, found ${integratedTargetHead}`);
+    // Only the actual Git write owns the shared target. An unrelated source Work
+    // never holds this lease throughout planning, review or build validation.
+    const gated = await withCheckoutMutationGate({
+      controllerHome: ctx.controllerHome,
+      repoId: handle.repositoryId,
+      checkoutId: target.activeCheckoutId,
+      repoRoot: targetRoot,
+      owner: `deliver-work:${handle.workId}:${randomUUID()}`,
+      ttlMs: 120_000,
+      ownership: { mutatesGitIndex: true, mutatesGitRefs: true },
+      ownerIdentity: {
+        repositoryId: handle.repositoryId,
+        checkoutId: target.activeCheckoutId,
+        worktreeId: targetRoot,
+        branch: targetBranch,
+        principalId: session.principalId,
+      },
+    }, async (gate, ownership) => {
+      assertTargetMutationAvailable(ctx.controllerHome, handle, target.activeCheckoutId,
+        targetBranch, targetHead, targetRoot, gate.ownerJobId);
+      ownership.assert();
+      const preview = !targetIsAncestor
+        ? await runBoundedGit(targetRoot, ['merge-tree', '--write-tree', targetHead, sourceRevision], {
+          timeoutMs: 30_000, maxOutputBytes: 128 * 1024, signal: ownership.signal,
+        })
+        : undefined;
+      if (preview && !preview.ok) {
+        throw new Error(`WORK_DELIVERY_MERGE_CONFLICT: ${preview.stderr || preview.stdout || 'merge-tree failed'}`);
+      }
+      if (handle.state !== 'committed') {
+        handle = transitionWorkHandle(ctx.controllerHome, handle, 'committed', {
+          expectedHead: sourceRevision,
+          failureReason: undefined,
+          finalization: { ...handle.finalization, commit: 'done', lastError: undefined },
+        });
+      }
+      ownership.assert();
+      const merged = await runBoundedGit(targetRoot,
+        targetIsAncestor
+          ? ['merge', '--ff-only', sourceRevision]
+          : ['merge', '--no-ff', '--no-edit', sourceRevision],
+        { timeoutMs: 60_000, maxOutputBytes: 128 * 1024, signal: ownership.signal });
+      if (!merged.ok) {
+        if (ownership.ownershipLost()) throw new Error('WORK_DELIVERY_MUTATION_OWNERSHIP_LOST');
+        // A conflicted merge must never strand the shared integration checkout.
+        // Abort only our own in-progress merge while retaining the same lease.
+        const mergeHead = git(targetRoot, ['rev-parse', '--verify', 'MERGE_HEAD']);
+        if (mergeHead.ok) {
+          const aborted = await runBoundedGit(targetRoot, ['merge', '--abort'], {
+            timeoutMs: 30_000, maxOutputBytes: 128 * 1024, signal: ownership.signal,
+          });
+          if (!aborted.ok) {
+            throw new Error(`WORK_DELIVERY_MERGE_ABORT_FAILED: ${aborted.stderr || aborted.stdout}; merge error: ${merged.stderr || merged.stdout}`);
+          }
+        }
+        throw new Error(`WORK_DELIVERY_GIT_MERGE_FAILED: ${merged.stderr || merged.stdout || 'git merge failed'}`);
+      }
+      ownership.assert();
+      const afterMergeStatus = git(targetRoot, ['status', '--porcelain=v1']);
+      if (!afterMergeStatus.ok || afterMergeStatus.stdout) {
+        throw new Error('WORK_DELIVERY_TARGET_DIRTY_AFTER_MERGE');
+      }
+      const newHead = exactRevision(targetRoot, 'HEAD', 'TARGET_HEAD');
+      if (targetIsAncestor && newHead !== sourceRevision) {
+        throw new Error(`WORK_DELIVERY_TARGET_HEAD_UNEXPECTED: expected ${sourceRevision}, found ${newHead}`);
+      }
+      if (!targetIsAncestor) {
+        const ancestry = git(targetRoot, ['rev-list', '--parents', '-n', '1', newHead]);
+        const [, firstParent, secondParent, ...extraParents] = ancestry.stdout.split(/\s+/);
+        if (!ancestry.ok || firstParent !== targetHead || secondParent !== sourceRevision || extraParents.length > 0) {
+          throw new Error('WORK_DELIVERY_MERGE_PARENT_MISMATCH');
+        }
+        const actualTree = git(targetRoot, ['rev-parse', `${newHead}^{tree}`]);
+        if (!actualTree.ok || actualTree.stdout !== preview!.stdout.split(/\s+/)[0]) {
+          throw new Error('WORK_DELIVERY_MERGE_TREE_MISMATCH');
+        }
+      }
+      return { newHead, mergeStrategy: (targetIsAncestor ? 'work_fast_forward' : 'work_merge_commit') as RepositoryCompletionReceipt['delivery']['strategy'] };
+    });
+    if (!gated.ok) {
+      throw new Error(`WORK_DELIVERY_TARGET_LEASE_ACTIVE: ${gated.busy.blockers.map((blocker) => blocker.owner).join(', ')}`);
     }
-    strategy = 'work_fast_forward';
+    integratedTargetHead = gated.value.newHead;
+    strategy = gated.value.mergeStrategy;
   }
 
   if (!git(targetRoot, ['merge-base', '--is-ancestor', sourceRevision, integratedTargetHead]).ok) {
@@ -492,6 +611,6 @@ export async function deliverWork(ctx: McpExecutionContext, args: Record<string,
     work: compactHandle(refreshed),
     delivery: receipt,
     cleanup: cleanup.receipt,
-    semanticCompletionRequired: true,
+    ...semanticCompletionAfterDelivery(ctx, handle, receipt, completeWork, expectedSemanticRevision),
   });
 }

package/src/runtime/control-plane/execution/work-handle-authority.ts

@@ -2,7 +2,7 @@ import { resolve } from 'path';
 import type { RepositoryRecord } from '../../../cli/repositories/types';
 import { getRepository, resolveRepositorySelection, selectRepositoryCheckout } from '../../../cli/repositories/registry';
 import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
-import { appendWorkEvidence, getWorkContract, recordWorkEvidenceState, semanticWorkState } from '../../../../packages/kernel/work/api/index';
+import { appendWorkEvidence, getWorkContract, promoteWorkToRepositoryChange, recordWorkEvidenceState, semanticWorkState } from '../../../../packages/kernel/work/api/index';
 import { currentPermissionSnapshotVersion } from './validation';
 import { listWorkHandles, readWorkHandle, transitionWorkHandle, writeWorkHandle, type WorkHandleState } from './work-handle-store';
 import { gitIsAncestor } from './work-execution-support';
@@ -371,7 +371,7 @@ export function ensureRepositoryMutationWorkHandle(input: {
   principalId: string;
   sessionId?: string;
   deferEffectPromotion?: boolean;
-}): { handle: WorkHandleState; promotedFrom?: 'local_effect' | 'remote_effect' } {
+}): { handle: WorkHandleState; promotedFrom?: 'investigation' | 'local_effect' | 'remote_effect' } {
   const store = { controllerHome: input.controllerHome, repoId: input.repository.repoId };
   const contract = getWorkContract(store, input.workId);
   if (!contract) throw new Error(`WORK_NOT_FOUND: ${input.workId}`);
@@ -421,6 +421,14 @@ export function ensureRepositoryMutationWorkHandle(input: {
     handle,
   });
   assertManagedRepositoryMutationAuthority({ repository: input.repository, handle });
-  return { handle };
+  // This is the first point at which concrete repository mutation has passed
+  // the exact WorkHandle checkout, ownership, and managed-worktree fences.
+  // WorkContract remains the sole writer for its semantic classification.
+  const promotedFrom = contract.workKind === 'investigation'
+    || contract.workKind === 'local_effect'
+    || contract.workKind === 'remote_effect'
+    ? contract.workKind
+    : undefined;
+  promoteWorkToRepositoryChange(store, input.workId);
+  return promotedFrom ? { handle, promotedFrom } : { handle };
 }
-

package/src/runtime/control-plane/execution/work-handle-store.ts

@@ -4,7 +4,8 @@ import { join } from 'path';
 import { scopedOperationRoot } from '../../../cli/repositories/controller-home';
 import { readJsonFile, sanitizeFileComponent } from '../../shared/json-files';
 import type { ProcessCheckExecutionIdentity } from '../../evidence/process-check-execution';
-import { listControlPlaneRecords, mutateControlPlaneRecord, readOrImportControlPlaneRecord, writeControlPlaneRecord } from '../persistence/sqlite-store';
+import { listControlPlaneRecords, listControlPlaneRecordsWithinTransaction, mutateControlPlaneRecord, readControlPlaneRecordWithinTransaction, readOrImportControlPlaneRecord, writeControlPlaneRecord, writeControlPlaneRecordWithinTransaction } from '../persistence/sqlite-store';
+import { updateWorkContractPlacementAtomically } from '../../../../packages/kernel/work/api/index';
 
 export const WORK_HANDLE_STATES = [
   'prepared',
@@ -304,6 +305,9 @@ function updateValidationIndexMembership(
   validating: boolean,
 ): void {
   const existing = readValidationIndex(controllerHome, repositoryId);
+  // The index describes pending validation membership, not WorkHandle activity.
+  // Other lifecycle writes do not change its membership or need an index CAS.
+  if (existing && existing.workIds.includes(workId) === validating) return;
   if (!existing) {
     // The WorkHandle write is already durable. Rebuild once from authoritative
     // handles so legacy repositories establish an exact index without a scan
@@ -376,6 +380,54 @@ export function writeWorkHandle(controllerHome: string, handle: WorkHandleState)
   return { ...record.value, recordRevision: record.revision };
 }
 
+/**
+ * Atomically rebind the one existing execution handle and its Kernel Work
+ * placement. The application service already proved exact Git ancestry and
+ * clean exclusive target; this store owns only the two-record CAS mutation.
+ */
+export function relocateWorkHandlePlacementAtomically(
+  controllerHome: string,
+  prior: WorkHandleState,
+  target: { checkoutId: string; root: string; branch: string; head: string },
+): WorkHandleState {
+  const moved: WorkHandleState = {
+    ...prior, checkoutId: target.checkoutId, worktreePath: target.root, branch: target.branch,
+    expectedHead: target.head, managedWorktree: true,
+    validationRun: undefined, validatedInputFingerprint: undefined,
+    finalization: { validation: 'pending', commit: 'pending', merge: 'pending', branchCleanup: 'pending', worktreeCleanup: 'pending' },
+  };
+  updateWorkContractPlacementAtomically({ controllerHome, repoId: prior.repositoryId }, prior.workId, {
+    checkoutId: target.checkoutId,
+    worktreeRef: target.root,
+    executionPlacement: { schemaVersion: 1, repositoryId: prior.repositoryId, checkoutId: target.checkoutId },
+    worktreePolicy: { required: true, reason: 'Explicit identity-preserving managed checkout relocation', ref: target.root },
+  }, (database, updatedContract) => {
+    if (updatedContract.checkoutId !== moved.checkoutId) throw new Error('WORK_RELOCATION_TRANSACTION_CONTRACT_MISMATCH');
+    const row = readControlPlaneRecordWithinTransaction<WorkHandleState>(
+      database, 'execution_work_handle', prior.repositoryId, prior.workId,
+    );
+    if (!row || row.revision !== prior.recordRevision || row.value.checkoutId !== prior.checkoutId
+        || row.value.expectedHead !== prior.expectedHead) {
+      throw new Error('WORK_RELOCATION_HANDLE_CAS_CONFLICT');
+    }
+    const competing = listControlPlaneRecordsWithinTransaction<WorkHandleState>(database, {
+      namespace: 'execution_work_handle', scope: prior.repositoryId, limit: 5000,
+    }).some((entry) => entry.value.workId !== prior.workId && entry.value.checkoutId === target.checkoutId
+      && entry.value.state !== 'cleaned');
+    if (competing) throw new Error('WORK_RELOCATION_TARGET_OWNED');
+    const { recordRevision: _revision, ...persisted } = moved;
+    writeControlPlaneRecordWithinTransaction(database, {
+      namespace: 'execution_work_handle', scope: prior.repositoryId, key: prior.workId,
+      schemaVersion: 1, expectedRevision: row.revision,
+      value: { ...persisted, updatedAt: new Date().toISOString() },
+      action: 'work_handle_checkout_relocated',
+    });
+  });
+  const refreshed = readWorkHandle(controllerHome, prior.repositoryId, prior.workId);
+  if (!refreshed || refreshed.checkoutId !== target.checkoutId) throw new Error('WORK_RELOCATION_COMMIT_NOT_VERIFIED');
+  return refreshed;
+}
+
 /**
  * Refresh legacy controller identity fields as provenance only. Repository
  * mutation authority remains WorkHandle CAS plus concrete checkout/resource fences.

package/src/runtime/control-plane/execution/work-operation-service.ts

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from 'crypto';
 import { isAbsolute, relative, resolve } from 'path';
 import type { McpExecutionContext } from '../../../../packages/protocols/mcp/execution-context';
-import { repositoryGitStatus, repositoryGitDiff } from '../../../cli/repositories/structured-git';
+import { repositoryGitStatus, repositoryGitWorkspaceChanges } from '../../../cli/repositories/structured-git';
 import { classifyRepositoryCommand } from '../../../cli/repositories/command-classifier';
 import { listControllerChecks, readLatestControllerCheckEvidence } from '../../../cli/controller/check-runner';
 import { readRepositoryAccessPolicy } from '../governance/access-policy';
@@ -21,7 +21,7 @@ import { projectTerminalCheckVerification } from '../../execution/process-runtim
 import { claimProcessInvocation, getProcessRecord } from '../../execution/process-runtime/store';
 import { runPersistedCheckViaProcessRuntime } from '../../execution/process-runtime/persisted-check';
 import { markWorkValidationCurrentFromReusedEvidence, markWorkValidationPending, projectWorkValidationOutcome } from './work-validation-reconciler';
-import { compactHandle, contractFor, gitHead, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
+import { compactHandle, contractFor, identityFor, makeBoundedWorkResult, reconcileTerminalCleanup, requireSession, terminalCleanupOutcome, workForSession } from './work-execution-support';
 
 function commandInputs(args: Record<string, unknown>): Array<Record<string, unknown>> {
   if (Array.isArray(args.commands)) return args.commands.filter((value): value is Record<string, unknown> => Boolean(value && typeof value === 'object' && !Array.isArray(value)));
@@ -173,11 +173,18 @@ export async function executeWork(ctx: McpExecutionContext, args: Record<string,
       }
       return ordered;
     })();
-  const branch = repositoryGitStatus(cheap.worktreeRepository).branch;
-  const head = gitHead(cheap.worktreeRepository.canonicalRoot);
+  // Reuse the exact post-command Git snapshot for both branch and HEAD.
+  // A second rev-parse can observe a different instant during concurrent writes.
+  const postCommandStatus = repositoryGitStatus(cheap.worktreeRepository);
+  const branch = postCommandStatus.branch;
+  const head = postCommandStatus.head ?? undefined;
   let nextHandle = handle;
   if (branch !== handle.branch) nextHandle = markWorkHandleFailed(ctx.controllerHome, handle, `command changed the bound branch to ${branch ?? 'detached'}`);
-  else nextHandle = transitionWorkHandle(ctx.controllerHome, handle, 'editing', { expectedHead: head, failureReason: undefined });
+  else if (handle.state !== 'editing' || handle.expectedHead !== head || handle.failureReason !== undefined) {
+    // A read-only command on an already-current Work must not consume a CAS
+    // revision (or rewrite the validation index) just to reaffirm the same HEAD.
+    nextHandle = transitionWorkHandle(ctx.controllerHome, handle, 'editing', { expectedHead: head, failureReason: undefined });
+  }
   const value = {
     work: compactHandle(nextHandle),
     commands: executions,
@@ -237,9 +244,9 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
   }
   const validated = validateWorkHandle(ctx.controllerHome, handle, identityFor(ctx, args), 'full', 'validate');
   const contract = contractFor(ctx, handle);
-  const changed = repositoryGitDiff(validated.worktreeRepository, { maxBytes: 64 * 1024 });
-  const workspaceChangedPaths = Array.isArray(changed.nameOnly) ? changed.nameOnly.map(String) : [];
-  const validationStatus = repositoryGitStatus(validated.worktreeRepository);
+  const workspaceChanges = repositoryGitWorkspaceChanges(validated.worktreeRepository);
+  const workspaceChangedPaths = workspaceChanges.changedPaths;
+  const validationStatus = workspaceChanges.status;
   const validationHead = validationStatus.head
     ?? handle.expectedHead
     ?? handle.baseCommit
@@ -469,9 +476,12 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
     : acceptedFailure
       ? String(acceptedFailure.summary ?? 'targeted validation failed')
       : undefined;
+  // A missing/stale Check receipt is retryable validation evidence, not a
+  // failed Work execution. Keep the original Work state so repair commands
+  // remain authorized; accepted test failures retain the existing failed path.
   const nextState = !completed
     ? 'validating'
-    : passed
+    : passed || infrastructureFailure
       ? validationRun.resumeState
       : 'failed';
   const validation = !completed ? 'pending' : passed ? 'done' : 'failed';
@@ -482,7 +492,7 @@ export async function validateWork(ctx: McpExecutionContext, args: Record<string
       lastError: failureSummary,
     },
     validationRun: completed ? undefined : validationRun,
-    ...(passed ? { validatedInputFingerprint: validationFingerprint } : {}),
+    validatedInputFingerprint: passed ? validationFingerprint : undefined,
     ...(failureSummary ? { failureReason: failureSummary } : { failureReason: undefined }),
   });
   if (completed) {