@zq-silk/yui 0.8.2 → 0.8.6

package/dist/commands/taskCommands.js

@@ -7,7 +7,8 @@ import { CliError, dataError, roleNotFound, runtimeError, taskNotFound, usageErr
 import { createTaskEvent } from "../event/taskEvent.js";
 import { clearMatchingLeaderStallAttention, isRoleRunStalled, RUN_PROGRESS_EVENT, RUN_RECOVERED_EVENT } from "../scheduler/roleRunStall.js";
 import { readCommandText } from "./textInput.js";
-import { createRoleSessionSet, roleAgentSessionResumeMode, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
+import { assertTaskCompletionPublishedTreeProof } from "./taskCompletionGate.js";
+import { createRoleSessionSet, retireTaskRoleSessionsForWorkspace, roleAgentSessionResumeMode, updateTaskRoleProviderRuntime } from "../executor/agentExecutor.js";
 import { currentProviderActivation, transferProviderAuthority } from "../runtime/providerRuntimeIdentity.js";
 import { resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { defaultTableWidth, renderTable } from "../output/table.js";
@@ -34,14 +35,17 @@ import { mailboxHasWork as workMailboxHasWork, nextPendingBatch } from "../coord
 import { RUNTIME_CLEANUP_REQUIRED_REASON, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { blockingProviderContinuations, projectProviderContinuations } from "../runtime/runtimeContinuationProjection.js";
 import { runtimeObservationFromTaskEvent } from "../runtime/runtimeObservation.js";
-import { activateTask, addTaskProjectBinding, archiveTask, completeTask, createTask, retireTask, reopenTask, updateTaskMetadata } from "../task/task.js";
+import { activateTask, addTaskProjectBinding, archiveTask, completeTask, createTask, retireTask, reopenTask, taskDeliveryPath, updateTaskMetadata } from "../task/task.js";
 import { resolveTaskRecordReference } from "../task/taskRecordReference.js";
+import { TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT } from "../task/publicationReference.js";
 import { projectCompletionReadiness } from "../task/completionReadiness.js";
 import { resolveProject } from "../repository/project.js";
 import { acquireProjectMaintenanceLocks } from "../repository/projectMaintenanceLock.js";
-import { currentWorkItemCandidate, currentWorkItemExecutionGroup, workItemExecutionGroupById, createWorkItem, attachWorkItemExecutionGroup, updateWorkItemExecutionGroup, retireWorkItem, retryFailedWorkItem, submitWorkItemCandidate, updateWorkItemWriteProjects, updateWorkItemStatus } from "../workItem/workItem.js";
+import { currentWorkItemCandidate, governingWorkItemCandidate, currentWorkItemExecutionGroup, workItemExecutionGroupById, createWorkItem, attachWorkItemExecutionGroup, updateWorkItemExecutionGroup, retireWorkItem, retryFailedWorkItem, submitWorkItemCandidate, updateWorkItemWriteProjects, updateWorkItemStatus } from "../workItem/workItem.js";
 import { addExecutionLane, createExecutionGroup, resolveExecutionGroup, restartExecutionLane, updateExecutionLane } from "../execution/executionGroup.js";
 import { sameTaskFinalReviewContract, taskFinalReviewConfig, validateTaskFinalReviewContract } from "../review/taskFinalReviewContract.js";
+import { classifyReviewRoundOutcome, isSemanticReviewRound } from "../review/reviewOutcomeClassifier.js";
+import { TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT, createTaskFinalReviewContractRebind, resolveRecordedTaskFinalReviewContract, taskFinalReviewContractRebindPayload } from "../review/taskFinalReviewContractRebind.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { hasAgentConfigOptions, parseRoleOptions, patchRoleAgentBinding, roleOptionSpecs, roleProfilePatch } from "./roleConfiguration.js";
 import { hasRoleLaunchContextOptions, validateConfiguredRoleSkills } from "./roleSkillValidation.js";
@@ -50,7 +54,7 @@ import { runTaskContextCommand } from "./taskContextCommand.js";
 import { runTaskNextActionCommand } from "./taskNextActionCommand.js";
 import { runDeliveryGuardPreflight, withGuardWarnings } from "./deliveryGuardPreflight.js";
 import { inspectTaskRoleRuntimeStatuses, renderTaskRoleRuntimeStatus, taskRoleActiveWorkLabel, taskRoleLastRunLabel, taskRoleNativeSessionLabel, taskRoleOpenInputLabel, taskRoleTmuxLabel } from "./taskRoleRuntimeStatus.js";
-import { assertNoOpenInputRequests, openInputRequestCount, runTaskInputCommand } from "./taskInputCommands.js";
+import { assertNoOpenInputRequests, isCurrentGlobalOperator, openInputRequestCount, runTaskInputCommand } from "./taskInputCommands.js";
 import { runGrantCommand } from "./grantCommands.js";
 import { runWorkflowCommand } from "./workflowCommands.js";
 import { taskActor as resolveTaskActor, taskLeaderActionRunId } from "./taskActor.js";
@@ -79,17 +83,17 @@ function legacyWorkItemReviewConfig(config) {
     return config?.trigger === "final" ? null : config;
 }
 function storedTaskFinalReviewContract(store, taskId) {
-    const contracts = store.listWorkItems(taskId)
-        .flatMap(({ candidates }) => candidates)
-        .flatMap(({ taskFinalReviewContract }) => (taskFinalReviewContract === undefined ? [] : [taskFinalReviewContract]));
-    const first = contracts[0];
-    if (first === undefined)
-        return undefined;
-    validateTaskFinalReviewContract(first);
-    if (contracts.some((contract) => !sameTaskFinalReviewContract(first, contract))) {
-        throw dataError(`Task ${taskId} contains conflicting final-review contracts.`);
+    return storedTaskFinalReviewContractResolution(store, taskId)?.effective;
+}
+function storedTaskFinalReviewContractResolution(store, taskId) {
+    try {
+        return resolveRecordedTaskFinalReviewContract(taskId, store.listWorkItems(taskId), store.listReviewRounds(taskId), store.listEvents(taskId));
+    }
+    catch (error) {
+        throw dataError(error instanceof Error
+            ? error.message
+            : `Task ${taskId} contains conflicting final-review contracts.`);
     }
-    return first;
 }
 /**
  * Resolve one exact Task-local contract before the caller performs any write.
@@ -97,7 +101,7 @@ function storedTaskFinalReviewContract(store, taskId) {
  * acceptance, and completion mutation must present the same verified
  * capability; shared review-config drift is intentionally irrelevant.
  */
-function taskFinalReviewContractForMutation(store, taskId, options) {
+function taskFinalReviewContractForMutation(store, taskId, options, authorization = {}) {
     const supplied = options.taskFinalReviewContract;
     if (supplied !== undefined) {
         validateTaskFinalReviewContract(supplied);
@@ -113,6 +117,8 @@ function taskFinalReviewContractForMutation(store, taskId, options) {
     if (stored === undefined)
         return supplied;
     if (supplied === undefined) {
+        if (authorization.allowStoredWithoutSupplied === true)
+            return stored;
         throw usageError(`Task final-review contract is missing for ${taskId}.`);
     }
     if (!sameTaskFinalReviewContract(stored, supplied)) {
@@ -121,8 +127,8 @@ function taskFinalReviewContractForMutation(store, taskId, options) {
     return stored;
 }
 export function parseTaskCompletionRequest(args, summaryOverride) {
-    const usage = "Task complete usage: yui task complete <id> (--summary <text>|--summary-file <path|->) [--refresh-remote].";
-    const parsed = parseTail(args, new Set(["--summary", "--summary-file"]), usage, new Set(["--refresh-remote"]));
+    const usage = "Task complete usage: yui task complete <id> (--summary <text>|--summary-file <path|->) [--refresh-remote] [--accept-published-tree <publication-id>].";
+    const parsed = parseTail(args, new Set(["--summary", "--summary-file", "--accept-published-tree"]), usage, new Set(["--refresh-remote"]));
     exactPositionals(parsed.positionals, 1, usage);
     const inlineSummary = parsed.options.get("--summary");
     const summaryFile = parsed.options.get("--summary-file");
@@ -130,7 +136,14 @@ export function parseTaskCompletionRequest(args, summaryOverride) {
         throw usageError(`Specify exactly one of --summary or --summary-file.`, usage);
     }
     const summary = summaryOverride ?? readCommandText(inlineSummary, summaryFile, "--summary", usage);
-    return { taskId: parsed.positionals[0], summary };
+    const acceptedPublishedTreePublicationId = parsed.options.get("--accept-published-tree");
+    return {
+        taskId: parsed.positionals[0],
+        summary,
+        ...(acceptedPublishedTreePublicationId === undefined
+            ? {}
+            : { acceptedPublishedTreePublicationId })
+    };
 }
 /**
  * Check every read-only completion blocker before a caller resolves remote
@@ -144,7 +157,7 @@ export function parseTaskCompletionRequest(args, summaryOverride) {
  * terminalization precondition before attempting completion.  All blockers
  * are reported in one error instead of one per attempt.
  */
-export function preflightTaskCompletion(taskId, store, options = {}) {
+export function preflightTaskCompletion(taskId, store, options = {}, request = {}) {
     const task = requireTask(store, taskId);
     const actor = taskActor(options, task.id);
     if (task.status === "completed") {
@@ -157,7 +170,15 @@ export function preflightTaskCompletion(taskId, store, options = {}) {
     // Resolve and authenticate the durable Task-local gate before any remote
     // fetch or Integration write.  All checks below mirror the transactional
     // completion path, which remains the final CAS fence after reconciliation.
-    const taskFinalReviewContract = taskFinalReviewContractForMutation(store, task.id, options);
+    // A human/global Operator cannot present the exact managed Leader contract.
+    // For the explicit published-tree path only, let that caller authenticate
+    // the stored contract far enough to persist an exact authorization fact.
+    // The same command must return before any contract-governed completion
+    // mutation; the exact Leader later consumes the authorization with the real
+    // contract capability.
+    const authorizingPublishedTree = request.acceptedPublishedTreePublicationId !== undefined
+        && actor !== "leader";
+    const taskFinalReviewContract = taskFinalReviewContractForMutation(store, task.id, options, { allowStoredWithoutSupplied: authorizingPublishedTree });
     const activeTaskReview = store.listReviewRounds(task.id).some((round) => ((round.scope ?? "work-item") === "task"
         && (round.status === "pending" || round.status === "running")));
     // Issue 06: one shared readiness projection enumerates every blocker.
@@ -344,12 +365,14 @@ function taskProjectCommand(args, store, options) {
     return output(`Added Project to ${updated.id}\n`, { task: updated });
 }
 function updateTaskCommand(args, store, options) {
-    const optionNames = new Set(["--title", "--description", "--priority", "--tags", "--due-at"]);
+    const optionNames = new Set([
+        "--title", "--description", "--priority", "--tags", "--due-at", "--delivery"
+    ]);
     const flagOptions = new Set([
         "--clear-description", "--clear-priority", "--clear-tags", "--clear-due-at",
         "--require-integration"
     ]);
-    const usage = "Task update usage: yui task update <id> [--title <text>] [--description <text>|--clear-description] [--priority <low|medium|high|urgent>|--clear-priority] [--tags <comma-separated>|--clear-tags] [--due-at <RFC3339>|--clear-due-at] [--require-integration].";
+    const usage = "Task update usage: yui task update <id> [--title <text>] [--description <text>|--clear-description] [--priority <low|medium|high|urgent>|--clear-priority] [--tags <comma-separated>|--clear-tags] [--due-at <RFC3339>|--clear-due-at] [--delivery <direct|integrated>] [--require-integration].";
     const parsed = parseTail(args, optionNames, usage, flagOptions);
     exactPositionals(parsed.positionals, 1, usage);
     if (parsed.options.size === 0)
@@ -373,19 +396,42 @@ function updateTaskCommand(args, store, options) {
     const tags = parsed.options.has("--tags")
         ? parseTaskTags(requiredOption(parsed.options, "--tags"))
         : undefined;
+    const requestedDelivery = parsed.options.has("--delivery")
+        ? parseTaskDelivery(requiredOption(parsed.options, "--delivery"))
+        : undefined;
+    if (requestedDelivery === "direct" && parsed.options.has("--require-integration")) {
+        throw usageError("--delivery direct conflicts with --require-integration.", usage);
+    }
+    const enableIntegration = requestedDelivery === "integrated"
+        || parsed.options.has("--require-integration");
     const now = clock(options);
     const result = store.transaction((tx) => {
         const current = requireTask(tx, parsed.positionals[0]);
         if (current.status === "archived")
             throw usageError(`Task is archived: ${current.id}.`);
-        if (parsed.options.has("--require-integration") && current.status === "completed") {
+        if ((requestedDelivery !== undefined || parsed.options.has("--require-integration"))
+            && current.projectBindings.length === 0) {
+            throw usageError(`Task ${current.id} has no Project; delivery selection is not applicable.`);
+        }
+        if (requestedDelivery === "direct" && current.requireIntegration === true) {
+            throw usageError(`Task ${current.id} already uses integrated delivery and cannot be downgraded to direct.`);
+        }
+        if (enableIntegration && current.status === "completed") {
             throw usageError(`Task ${current.id} is completed; use task reopen before enabling integration evidence.`);
         }
+        if (enableIntegration && current.requireIntegration !== true) {
+            assertTaskDeliveryPromotionEligible(tx, current, options.directTaskMainSnapshot);
+        }
         if (parsed.options.size === 1
-            && parsed.options.has("--require-integration")
+            && enableIntegration
             && current.requireIntegration === true) {
             return { task: current, integrationState: "already-enabled" };
         }
+        if (parsed.options.size === 1
+            && requestedDelivery === "direct"
+            && taskDeliveryPath(current) === "direct") {
+            return { task: current, integrationState: "already-direct" };
+        }
         const updated = updateTaskMetadata(current, {
             ...(parsed.options.has("--title") ? { title: requiredOption(parsed.options, "--title") } : {}),
             ...(parsed.options.has("--description")
@@ -400,31 +446,93 @@ function updateTaskCommand(args, store, options) {
             ...(dueAt === undefined
                 ? parsed.options.has("--clear-due-at") ? { dueAt: null } : {}
                 : { dueAt }),
-            ...(parsed.options.has("--require-integration") ? { requireIntegration: true } : {})
+            ...(enableIntegration ? { requireIntegration: true } : {})
         }, now);
         tx.saveTask(updated);
         recordTaskEvent(tx, updated.id, "task.updated", {
             status: updated.status,
-            ...(parsed.options.has("--require-integration")
-                ? { completionEvidence: "integration-required" }
-                : {})
+            ...(requestedDelivery === undefined && !parsed.options.has("--require-integration")
+                ? {}
+                : {
+                    completionEvidence: enableIntegration
+                        ? "integration-required"
+                        : "direct",
+                    deliveryPath: taskDeliveryPath(updated)
+                })
         }, now);
         enqueueWork(tx, taskMailbox(updated.id), "task-updated", now, [taskRef(updated.id)]);
         return {
             task: updated,
-            integrationState: parsed.options.has("--require-integration")
+            integrationState: enableIntegration
                 ? "enabled"
-                : "unchanged"
+                : requestedDelivery === "direct"
+                    ? "direct"
+                    : "unchanged"
         };
     });
-    if (result.integrationState !== "already-enabled") {
+    if (result.integrationState !== "already-enabled"
+        && result.integrationState !== "already-direct") {
         notifyMailbox(options.runtime, taskMailbox(result.task.id), result.task.id);
     }
     return result.integrationState === "enabled"
-        ? `Updated task ${result.task.id}\nCompletion evidence enabled: WorkItem, ChangeSet, and committed Integration required\n`
+        ? `Updated task ${result.task.id}\nDelivery: integrated (WorkItem, ChangeSet, and committed Integration required)\n`
         : result.integrationState === "already-enabled"
-            ? `Task ${result.task.id} completion evidence is already enabled\n`
-            : `Updated task ${result.task.id}\n`;
+            ? `Task ${result.task.id} already uses integrated delivery\n`
+            : result.integrationState === "already-direct"
+                ? `Task ${result.task.id} already uses direct delivery\n`
+                : result.integrationState === "direct"
+                    ? `Updated task ${result.task.id}\nDelivery: direct\n`
+                    : `Updated task ${result.task.id}\n`;
+}
+function assertTaskDeliveryPromotionEligible(store, task, snapshot) {
+    const evidence = [
+        ...store.listWorkItems(task.id).map(({ id }) => `WorkItem ${id}`),
+        ...store.listChangeSets(task.id).map(({ id }) => `ChangeSet ${id}`),
+        ...store.listIntegrationAttempts(task.id).map(({ id }) => `IntegrationAttempt ${id}`),
+        ...store.listReviewRounds(task.id).map(({ id }) => `ReviewRound ${id}`)
+    ];
+    if (evidence.length > 0) {
+        throw usageError(`Task ${task.id} cannot promote to integrated delivery after delivery evidence exists: `
+            + `${evidence.join(", ")}. Create an integrated replacement Task or keep the current direct contract.`);
+    }
+    if (task.status !== "draft" && task.status !== "active") {
+        throw usageError(`Task ${task.id} must be Draft or Active to promote delivery; current status is ${task.status}.`);
+    }
+    const workspace = store.getTaskWorkspace(task.id);
+    if (task.status === "draft" && workspace === null)
+        return;
+    if (snapshot === undefined) {
+        throw usageError(`Task ${task.id} delivery promotion requires a CLI-verified clean Task-main snapshot.`);
+    }
+    if (workspace === null
+        || workspace.owner.type !== "task"
+        || workspace.owner.taskId !== task.id) {
+        throw usageError(`Task has no authoritative main workspace: ${task.id}.`);
+    }
+    const snapshotIds = snapshot.schemaVersion === 1 && Array.isArray(snapshot.projects)
+        ? snapshot.projects.map(({ projectId }) => projectId)
+        : [];
+    if (snapshotIds.length !== task.projectBindings.length
+        || new Set(snapshotIds).size !== snapshotIds.length) {
+        throw usageError(`Task-main promotion snapshot does not match bound Projects: ${task.id}.`);
+    }
+    for (const binding of task.projectBindings) {
+        const project = snapshot.projects.find(({ projectId }) => projectId === binding.projectId);
+        const entry = workspace.entries.find(({ projectId }) => projectId === binding.projectId);
+        if (project === undefined
+            || entry === undefined
+            || entry.access !== "write"
+            || project.directory !== entry.directory
+            || project.branch !== entry.branch
+            || project.baseCommit !== entry.baseCommit) {
+            throw usageError(`Task-main promotion snapshot changed before mutation: ${task.id}/${binding.projectId}.`);
+        }
+        if (project.headCommit !== project.baseCommit) {
+            throw usageError(`Task ${task.id} main already advanced for Project ${binding.projectId}; `
+                + "cannot promote without losing ChangeSet provenance. Create an integrated replacement "
+                + "Task or keep the current direct contract.");
+        }
+    }
 }
 /** Compatibility helper for call sites that cannot yet handle foreground enter. */
 export function runTaskOutputCommand(args, store, options = {}) {
@@ -465,13 +573,20 @@ function createTaskCommand(args, store, options) {
     notifyMailbox(options.runtime, taskMailbox(created.task.id), created.task.id);
     return output(`Created Draft task ${created.task.id}: ${created.task.title}\n`
         + `Assigned role: ${created.leader.name}\n`
+        + `Delivery: ${taskDeliveryPath(created.task)}\n`
         + (created.task.requireIntegration
             ? "Completion: WorkItem, ChangeSet, and committed Integration required\n"
-            : "Completion: delivery integration not required\n"), { task: created.task, leader: created.leader });
+            : created.task.projectBindings.length > 0
+                ? "Completion: clean committed Task main required; no WorkItem, ChangeSet, IntegrationAttempt, or managed ReviewRound required\n"
+                : "Completion: no Project delivery evidence required\n"), {
+        task: created.task,
+        leader: created.leader,
+        deliveryPath: taskDeliveryPath(created.task)
+    });
 }
 function parseTaskCreation(args, store) {
-    const usage = "Task create usage: yui task create <title> [--project <project> ...] [--base <project>=<ref> ...] [--require-integration].";
-    const parsed = parseMultiValueTail(args, new Set(), new Set(["--project", "--base"]), usage, new Set(["--require-integration"]));
+    const usage = "Task create usage: yui task create <title> [--project <project> ...] [--base <project>=<ref> ...] [--delivery <direct|integrated>] [--require-integration].";
+    const parsed = parseMultiValueTail(args, new Set(["--delivery"]), new Set(["--project", "--base"]), usage, new Set(["--require-integration"]));
     exactPositionals(parsed.positionals, 1, usage);
     const projectReferences = parsed.multiOptions.get("--project") ?? [];
     const baseOptions = parsed.multiOptions.get("--base") ?? [];
@@ -487,6 +602,16 @@ function parseTaskCreation(args, store) {
     if (new Set(projects.map(({ id }) => id)).size !== projects.length) {
         throw usageError("A Task cannot bind the same Project more than once.");
     }
+    const requestedDelivery = parsed.options.has("--delivery")
+        ? parseTaskDelivery(requiredOption(parsed.options, "--delivery"))
+        : undefined;
+    if ((requestedDelivery !== undefined || parsed.options.has("--require-integration"))
+        && projects.length === 0) {
+        throw usageError("Delivery selection requires at least one --project.", usage);
+    }
+    if (requestedDelivery === "direct" && parsed.options.has("--require-integration")) {
+        throw usageError("--delivery direct conflicts with --require-integration.", usage);
+    }
     const bases = new Map();
     for (const option of baseOptions) {
         const separator = option.indexOf("=");
@@ -517,7 +642,8 @@ function parseTaskCreation(args, store) {
             baseRef: bases.get(project.id) ?? project.developmentBranch
         })),
         defaultProjectIds,
-        requireIntegration: parsed.options.has("--require-integration")
+        requireIntegration: requestedDelivery === "integrated"
+            || parsed.options.has("--require-integration")
     };
 }
 function createTaskAggregate(store, title, metadata, now, defaultProjectIds = []) {
@@ -527,6 +653,7 @@ function createTaskAggregate(store, title, metadata, now, defaultProjectIds = []
     store.saveRole(task.id, leader);
     recordTaskEvent(store, task.id, "task.created", {
         status: task.status,
+        deliveryPath: taskDeliveryPath(task),
         ...(defaultProjectIds.length === 0
             ? {}
             : { defaultProjectIds: defaultProjectIds.join(",") })
@@ -575,11 +702,16 @@ function showTaskCommand(args, store) {
         `Task: ${task.id}`,
         `Title: ${task.title}`,
         `Status: ${task.status}`,
+        `Delivery: ${taskDeliveryPath(task)}`,
         ...(task.description === undefined ? [] : [`Description: ${task.description}`]),
         ...(task.priority === undefined ? [] : [`Priority: ${task.priority}`]),
         ...(task.tags === undefined ? [] : [`Tags: ${task.tags.join(", ")}`]),
         ...(task.dueAt === undefined ? [] : [`Due: ${presentTime(task.dueAt, timeZone)}`]),
-        `Completion evidence: ${task.requireIntegration === true ? "required" : "not required"}`,
+        `Completion evidence: ${task.requireIntegration === true
+            ? "WorkItem, ChangeSet, and committed Integration required"
+            : task.projectBindings.length > 0
+                ? "clean committed Task main required"
+                : "no Project evidence required"}`,
         ...(task.completedAt === undefined ? [] : [`Completed: ${presentTime(task.completedAt, timeZone)}`]),
         ...(task.completedBy === undefined ? [] : [`Completed by: ${task.completedBy}`]),
         ...(task.completionSummary === undefined ? [] : [`Completion summary: ${task.completionSummary}`]),
@@ -608,7 +740,12 @@ function showTaskCommand(args, store) {
         `Created: ${presentTime(task.createdAt, timeZone)}`,
         `Updated: ${presentTime(task.updatedAt, timeZone)}`
     ].join("\n").concat("\n");
-    return output(rendered, { task, counts, hasBrief: brief !== null });
+    return output(rendered, {
+        task,
+        deliveryPath: taskDeliveryPath(task),
+        counts,
+        hasBrief: brief !== null
+    });
 }
 function activateTaskCommand(args, store, options) {
     exactPositionals(args, 1, "Task activate usage: yui task activate <task>.");
@@ -647,17 +784,47 @@ function completeTaskCommand(args, store, options) {
     const summary = request.summary;
     const now = clock(options);
     const result = store.transaction((tx) => {
-        const preflight = preflightTaskCompletion(request.taskId, tx, options);
+        const preflight = preflightTaskCompletion(request.taskId, tx, options, request);
         const { task, actor } = preflight;
         if (preflight.completed) {
             return {
                 task,
                 changed: false,
                 runtimeCleanupTargets: [],
-                finalReview: undefined
+                completionAdvisories: [],
+                finalReview: undefined,
+                publishedTreeAuthorization: undefined
             };
         }
         const taskFinalContract = preflight.taskFinalReviewContract;
+        const actualTaskCandidate = task.projectBindings.length === 0
+            ? undefined
+            : actualTaskReviewCandidateForMutation(tx, task, options);
+        const publishedTreeProof = request.acceptedPublishedTreePublicationId === undefined
+            ? undefined
+            : assertTaskCompletionPublishedTreeProof(tx, task, request.acceptedPublishedTreePublicationId, options.completionPublishedTreeProof, actualTaskCandidate);
+        const requiresContractHandoff = publishedTreeProof !== undefined
+            && taskFinalContract !== undefined;
+        if (requiresContractHandoff && actor !== "leader") {
+            const existing = matchingPublishedTreeAuthorization(tx, publishedTreeProof);
+            const event = existing ?? recordTaskEventRecord(tx, task.id, TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT, publishedTreeAuthorizationPayload(actor, publishedTreeProof), now);
+            enqueueWork(tx, leaderMailbox(task.id), wakeReason("published-tree-authorized", event.id), now, [eventRef(task.id, event.id)]);
+            return {
+                task,
+                changed: false,
+                runtimeCleanupTargets: [],
+                completionAdvisories: [],
+                finalReview: undefined,
+                publishedTreeAuthorization: {
+                    event,
+                    proof: publishedTreeProof,
+                    created: existing === undefined
+                }
+            };
+        }
+        if (publishedTreeProof !== undefined && actor === "leader") {
+            requirePublishedTreeAuthorization(tx, publishedTreeProof);
+        }
         const roles = tx.listRoles(task.id);
         const activeRuns = roles
             .map((role) => ({ role, run: tx.getActiveAgentRun(task.id, role.name) }))
@@ -704,9 +871,11 @@ function completeTaskCommand(args, store, options) {
                 task,
                 changed: false,
                 runtimeCleanupTargets: [],
+                completionAdvisories: [],
                 finalReview,
                 resumedPendingFinalReview: pendingFinalReviewIds.has(finalReview.id),
-                terminalizedLeaderRun
+                terminalizedLeaderRun,
+                publishedTreeAuthorization: undefined
             };
         }
         // Issue 06: re-validate the full completion readiness inside the
@@ -729,7 +898,34 @@ function completeTaskCommand(args, store, options) {
         tx.clearOperatorNotification(task.id);
         tx.saveOperatorNotification(createTaskTerminalNotification(task.id, "completed", actor, summary, now));
         enqueueWork(tx, { kind: "operator" }, "task-terminal", now, [taskRef(task.id)]);
-        recordTaskEvent(tx, task.id, "task.completed", { by: actor, summary }, now);
+        if (publishedTreeProof !== undefined) {
+            recordTaskEvent(tx, task.id, "task.completion-published-tree-accepted", {
+                by: actor,
+                projectId: publishedTreeProof.projectId,
+                publicationId: publishedTreeProof.publicationId,
+                ...(publishedTreeProof.reviewRoundId === undefined
+                    ? {}
+                    : { reviewRoundId: publishedTreeProof.reviewRoundId }),
+                localCommit: publishedTreeProof.localCommit,
+                remoteCommit: publishedTreeProof.remoteCommit,
+                tree: publishedTreeProof.tree
+            }, now);
+        }
+        recordTaskEvent(tx, task.id, "task.completed", {
+            by: actor,
+            summary,
+            deliveryPath: taskDeliveryPath(task),
+            ...(actualTaskCandidate === undefined
+                ? {}
+                : {
+                    projectHeads: actualTaskCandidate.projects
+                        .map(({ projectId, commit }) => `${projectId}@${commit}`)
+                        .join(",")
+                }),
+            ...(readiness.advisories.length === 0
+                ? {}
+                : { cleanupAdvisories: String(readiness.advisories.length) })
+        }, now);
         // A terminal Task must never leave a Task-lane signal that can wake it.
         // The durable records remain intact; only the derived mailbox work is
         // discarded at this lifecycle boundary.
@@ -745,11 +941,24 @@ function completeTaskCommand(args, store, options) {
             task: completed,
             changed: true,
             runtimeCleanupTargets,
+            completionAdvisories: readiness.advisories,
             finalReview: undefined,
             resumedPendingFinalReview: false,
-            terminalizedLeaderRun
+            terminalizedLeaderRun,
+            publishedTreeAuthorization: undefined
         };
     });
+    if (result.publishedTreeAuthorization !== undefined) {
+        notifyMailbox(options.runtime, leaderMailbox(result.task.id), result.task.id);
+        const authorization = result.publishedTreeAuthorization;
+        return output(authorization.created
+            ? `Authorized published-tree completion for ${result.task.id} as ${authorization.event.id}; exact Task Leader completion is required.\n`
+            : `Published-tree completion is already authorized for ${result.task.id} as ${authorization.event.id}; exact Task Leader completion is required.\n`, {
+            task: result.task,
+            authorizationEvent: authorization.event,
+            publishedTreeProof: authorization.proof
+        });
+    }
     if (result.changed) {
         for (const target of result.runtimeCleanupTargets) {
             // Cleanup owns an independent lifecycle lane. Never fall back to the
@@ -769,9 +978,17 @@ function completeTaskCommand(args, store, options) {
             [TERMINALIZED_LEADER_BEFORE_FINAL_REVIEW]: result.terminalizedLeaderRun
         });
     }
-    return output(result.changed
+    const completionOutput = result.changed
         ? `Completed task ${result.task.id}\n`
-        : `Task ${result.task.id} is already completed\n`);
+        : `Task ${result.task.id} is already completed\n`;
+    const advisoryOutput = result.completionAdvisories.length === 0
+        ? ""
+        : `Cleanup advisories (non-blocking; settle before archive):\n`
+            + result.completionAdvisories.map((advisory) => (`- ${advisory.code} (${advisory.ref.kind} ${advisory.ref.id}): ${advisory.fix}`)).join("\n").concat("\n");
+    return output(completionOutput + advisoryOutput, {
+        task: result.task,
+        completionAdvisories: result.completionAdvisories
+    });
 }
 function reopenTaskCommand(args, store, options) {
     exactPositionals(args, 1, "Task reopen usage: yui task reopen <id>.");
@@ -2606,8 +2823,12 @@ function reviewWork(args, store, options) {
  */
 function taskReviewCommand(args, store, options) {
     const [command, ...rest] = args;
+    if (command === "rebind")
+        return rebindTaskFinalReviewContract(rest, store, options);
     if (command === "request")
         return requestTaskReviewRound(rest, store, options);
+    if (command === "force-fresh")
+        return forceFreshTaskReviewRound(rest, store, options);
     if (command === "retry")
         return retryFailedTaskReviewRound(rest, store, options);
     if (command === "group")
@@ -2618,6 +2839,115 @@ function taskReviewCommand(args, store, options) {
         ? "Task review command is required."
         : `Unknown command: task review ${command}`);
 }
+export function parseTaskFinalReviewContractRebindRequest(args) {
+    const usage = "Task review rebind usage: yui task review rebind <task> "
+        + "--from-control <digest> --to-control <digest> "
+        + "--from-release <release-id> --to-release <release-id>.";
+    const parsed = parseTail(args, new Set(["--from-control", "--to-control", "--from-release", "--to-release"]), usage);
+    exactPositionals(parsed.positionals, 1, usage);
+    return {
+        taskId: parsed.positionals[0],
+        fromControlPlaneDigest: requiredOption(parsed.options, "--from-control"),
+        toControlPlaneDigest: requiredOption(parsed.options, "--to-control"),
+        fromReleaseId: requiredOption(parsed.options, "--from-release"),
+        toReleaseId: requiredOption(parsed.options, "--to-release")
+    };
+}
+function rebindTaskFinalReviewContract(args, store, options) {
+    const request = parseTaskFinalReviewContractRebindRequest(args);
+    const environment = options.environment ?? {};
+    const usage = "Task review rebind usage: yui task review rebind <task> "
+        + "--from-control <digest> --to-control <digest> "
+        + "--from-release <release-id> --to-release <release-id>.";
+    if (!isCurrentGlobalOperator(store, environment)) {
+        throw usageError("Task-final Review contract rebind requires the authenticated global Operator session.", usage);
+    }
+    const proof = options.taskFinalReviewRebindProof;
+    if (proof === undefined
+        || proof.schemaVersion !== 1
+        || proof.taskId !== request.taskId
+        || proof.fromControlPlaneDigest !== request.fromControlPlaneDigest
+        || proof.toControlPlaneDigest !== request.toControlPlaneDigest
+        || proof.fromRelease.releaseId !== request.fromReleaseId
+        || proof.toRelease.releaseId !== request.toReleaseId) {
+        throw usageError("Task-final Review contract rebind proof is missing or does not match the explicit request.", usage);
+    }
+    const now = clock(options);
+    const result = store.transaction((tx) => {
+        const task = requireTask(tx, request.taskId);
+        if (task.status !== "active") {
+            throw usageError(`Task is not active: ${task.id}.`);
+        }
+        if (task.projectBindings.length === 0) {
+            throw usageError(`Task final-review contract requires a Project-backed Task: ${task.id}.`);
+        }
+        if (!isCurrentGlobalOperator(tx, environment)) {
+            throw usageError("Task-final Review contract rebind Operator identity drifted before commit.");
+        }
+        const resolution = storedTaskFinalReviewContractResolution(tx, task.id);
+        if (resolution === undefined) {
+            throw usageError(`Task final-review contract is missing for ${task.id}.`);
+        }
+        const exactExisting = resolution.rebinds.at(-1);
+        if (resolution.effective.controlPlaneDigest === request.toControlPlaneDigest) {
+            if (exactExisting !== undefined
+                && exactExisting.fromContract.controlPlaneDigest === request.fromControlPlaneDigest
+                && exactExisting.toContract.controlPlaneDigest === request.toControlPlaneDigest
+                && exactExisting.fromRelease.releaseId === request.fromReleaseId
+                && exactExisting.toRelease.releaseId === request.toReleaseId
+                && exactExisting.handoverId === proof.handoverId) {
+                return { rebind: exactExisting, changed: false };
+            }
+            throw usageError(`Task final-review contract already targets ${request.toControlPlaneDigest} without the requested proof tuple.`);
+        }
+        if (resolution.effective.controlPlaneDigest !== request.fromControlPlaneDigest) {
+            throw usageError(`Task final-review contract source control-plane digest drifted for ${task.id}.`);
+        }
+        const activeRound = tx.listReviewRounds(task.id).find((round) => ((round.scope ?? "work-item") === "task"
+            && (round.status === "pending" || round.status === "running")));
+        if (activeRound !== undefined) {
+            throw usageError(`Task final-review contract cannot rebind while ReviewRound ${activeRound.id} is ${activeRound.status}.`);
+        }
+        const activeLeaderRun = tx.getActiveAgentRun(task.id, "leader");
+        if (activeLeaderRun !== null) {
+            throw usageError(`Task final-review contract cannot rebind while Leader Run ${activeLeaderRun.id} is active.`);
+        }
+        const leaderSessions = tx.getTaskRoleSessionSet(task.id, "leader");
+        if (leaderSessions !== null) {
+            if (leaderSessions.inFlight !== null) {
+                throw usageError("Task final-review contract cannot rebind while the Leader runtime has unsettled Run state.");
+            }
+            const liveLeaderSession = Object.values(leaderSessions.sessions).find(({ status }) => status !== "stopped" && status !== "broken");
+            if (liveLeaderSession !== undefined) {
+                throw usageError(`Task final-review contract cannot rebind while Leader Session ${liveLeaderSession.agentId} is ${liveLeaderSession.status}.`);
+            }
+            if (Object.keys(leaderSessions.sessions).length > 0
+                || leaderSessions.providerBinding !== null) {
+                tx.saveTaskRoleSessionSet(retireTaskRoleSessionsForWorkspace(leaderSessions, now));
+            }
+        }
+        const rebind = createTaskFinalReviewContractRebind({
+            taskId: task.id,
+            reviewerRoleName: resolution.effective.reviewerRoleName,
+            fromContract: resolution.effective,
+            toControlPlaneDigest: proof.toControlPlaneDigest,
+            fromRelease: proof.fromRelease,
+            toRelease: proof.toRelease,
+            handoverId: proof.handoverId,
+            authorizedBy: `operator:${environment.YUI_AGENT_ID ?? "unknown"}`
+        });
+        const event = recordTaskEventRecord(tx, task.id, TASK_FINAL_REVIEW_CONTRACT_REBOUND_EVENT, taskFinalReviewContractRebindPayload(rebind), now);
+        enqueueWork(tx, leaderMailbox(task.id), wakeReason("review-contract-rebound", event.id), now, [eventRef(task.id, event.id)]);
+        return { rebind, event, changed: true };
+    });
+    if (result.changed) {
+        notifyMailbox(options.runtime, leaderMailbox(request.taskId), request.taskId);
+    }
+    return output(result.changed
+        ? `Rebound Task-final Review contract for ${request.taskId} from `
+            + `${request.fromControlPlaneDigest} to ${request.toControlPlaneDigest}.\n`
+        : `Task-final Review contract rebind is already recorded for ${request.taskId}.\n`, result);
+}
 function resolveReviewExecutionGroup(args, store, options) {
     const usage = "Task review group resolve usage: yui task review group resolve <task>/<review-round> --decision <accept|reject|blocked> --summary <text> [--lane <lane-id> ...].";
     if (args[0] !== "resolve")
@@ -2712,8 +3042,8 @@ function resolveReviewExecutionGroup(args, store, options) {
 /**
  * Issue 06: `yui task review finding` — the cross-Round finding ledger CLI.
  * Findings are extracted automatically from completed Rounds; these commands
- * let the Leader inspect the ledger, disposition each finding, and plan the
- * parallel repair wave.
+ * let the Leader inspect the ledger, disposition each finding, and plan one
+ * convergent repair unit by default. Parallel fan-out is explicit.
  */
 function reviewFindingCommand(args, store, options) {
     const [command, ...rest] = args;
@@ -2784,11 +3114,15 @@ function disposeReviewFindingCommand(args, store, options) {
     return output(`Dispositioned ${result.id} as ${result.disposition}.\n`);
 }
 function planReviewRepairWave(args, store, options) {
-    const usage = "Task review finding repair-wave usage: yui task review finding repair-wave <task> [--create].";
-    const parsed = parseTail(args, new Set(), usage, new Set(["--create"]));
+    const usage = "Task review finding repair-wave usage: yui task review finding repair-wave <task> [--strategy <consolidated|parallel>] [--create].";
+    const parsed = parseTail(args, new Set(["--strategy"]), usage, new Set(["--create"]));
     exactPositionals(parsed.positionals, 1, usage);
     const task = requireTask(store, parsed.positionals[0]);
-    const groups = planRepairGroups(store, task.id);
+    const strategy = parsed.options.get("--strategy") ?? "consolidated";
+    if (strategy !== "consolidated" && strategy !== "parallel") {
+        throw usageError(`Review repair strategy is invalid: ${strategy}.`, usage);
+    }
+    const groups = repairGroupsForStrategy(planRepairGroups(store, task.id), strategy);
     if (groups.length === 0) {
         return output(`No open P1/P2 findings need repair for ${task.id}.\n`);
     }
@@ -2829,7 +3163,7 @@ function planReviewRepairWave(args, store, options) {
         });
         const lines = created.map(({ group, item, changed }) => (`wave ${group.groupKey}: ${item.id} ${changed ? "created" : "already open"} `
             + `(${group.findingIds.join(", ")})`));
-        return output(`Review repair wave for ${task.id} (${groups.length} group(s)):\n${lines.join("\n")}\n`, { groups: created });
+        return output(`Review repair wave for ${task.id} (${strategy}, ${groups.length} group(s)):\n${lines.join("\n")}\n`, { strategy, groups: created });
     }
     const lines = groups.map((group, index) => {
         const findings = group.findings
@@ -2838,7 +3172,24 @@ function planReviewRepairWave(args, store, options) {
         return `wave ${index + 1}: ${findings}`
             + ` (paths: ${group.affectedPaths.join(", ") || "none"}; invariants: ${group.invariants.join(", ")})`;
     });
-    return output(`Repair wave for ${task.id} (${groups.length} group(s), run disjoint groups in parallel):\n${lines.join("\n")}\n`);
+    return output(`Repair wave for ${task.id} (${strategy}, ${groups.length} group(s)):\n${lines.join("\n")}\n`
+        + (strategy === "consolidated"
+            ? "Default: keep all findings in one WorkItem; use --strategy parallel only for proven independent ownership.\n"
+            : "Parallel strategy explicitly selected; each disjoint group may become one WorkItem.\n"));
+}
+function repairGroupsForStrategy(groups, strategy) {
+    if (strategy === "parallel" || groups.length <= 1)
+        return groups;
+    const findings = groups.flatMap(({ findings }) => findings)
+        .sort((left, right) => left.id.localeCompare(right.id, undefined, { numeric: true }));
+    return [{
+            groupKey: findings.map(({ id }) => id).join("+"),
+            findings,
+            findingIds: findings.map(({ id }) => id),
+            affectedPaths: [...new Set(groups.flatMap(({ affectedPaths }) => affectedPaths))].sort(),
+            affectedSymbols: [...new Set(groups.flatMap(({ affectedSymbols }) => affectedSymbols))].sort(),
+            invariants: [...new Set(groups.flatMap(({ invariants }) => invariants))].sort()
+        }];
 }
 function reviewRepairProjectIds(task, affectedPaths) {
     const bindings = task.projectBindings;
@@ -3078,6 +3429,156 @@ function requestTaskReviewRound(args, store, options) {
             : `Task-final delta-recheck requested as ${round.id} (rechecks ${round.deltaRecheck.previousReviewRoundId})\n`
         : `Task-final Review is already ${round.status}: ${round.id}\n`, { reviewRound: round });
 }
+const TASK_FINAL_FORCE_FRESH_EVENT = "review.task-final-force-fresh-requested";
+/**
+ * Creates a distinct full Task-final ReviewRound only when the exact previous
+ * terminal Round durably proves that no semantic review was produced. The
+ * source Round, Run, findings, workspace, and terminal report remain immutable
+ * history; the linking Event is both the audit record and the idempotence key.
+ */
+function forceFreshTaskReviewRound(args, store, options) {
+    const usage = "Task review force-fresh usage: yui task review force-fresh <task>/<review-round>.";
+    exactPositionals(args, 1, usage);
+    const reference = taskRecordReference(args[0], "reviewRound", "ReviewRound reference", options);
+    const now = clock(options);
+    const result = store.transaction((tx) => {
+        const source = tx.getReviewRound(reference.taskId, reference.localId);
+        if (source === null) {
+            throw dataError(`ReviewRound not found: ${reference.taskId}/${reference.localId}.`);
+        }
+        const task = requireTask(tx, reference.taskId);
+        if (task.status !== "active")
+            throw usageError(`Task is not active: ${task.id}.`);
+        if (taskActor(options, task.id) !== "leader") {
+            throw usageError("Only the Task Leader may force a fresh Task-final ReviewRound.");
+        }
+        if ((source.scope ?? "work-item") !== "task") {
+            throw usageError(`ReviewRound ${source.id} is not a Task-final ReviewRound.`);
+        }
+        const replacementEvents = tx.listEvents(task.id).filter((event) => (event.type === TASK_FINAL_FORCE_FRESH_EVENT
+            && event.payload.sourceReviewRoundId === source.id));
+        if (replacementEvents.length > 1) {
+            throw dataError(`ReviewRound ${source.id} has duplicate force-fresh audit events.`);
+        }
+        const replacementEvent = replacementEvents[0];
+        if (replacementEvent !== undefined) {
+            const replacementId = replacementEvent.payload.reviewRoundId;
+            const replacement = replacementId === undefined
+                ? null
+                : tx.getReviewRound(task.id, replacementId);
+            if (replacement === null
+                || replacement.id === source.id
+                || (replacement.scope ?? "work-item") !== "task"
+                || replacement.workItemId !== source.workItemId
+                || replacement.candidateId !== source.candidateId
+                || replacement.reviewerRoleName !== source.reviewerRoleName
+                || replacement.deltaRecheck !== undefined
+                || !sameTaskFinalReviewContract(replacement.taskFinalReviewContract, source.taskFinalReviewContract)
+                || !isSameTaskReviewCandidate(replacement.taskCandidate, source.taskCandidate)
+                || replacementEvent.payload.workItemId !== replacement.workItemId
+                || replacementEvent.payload.candidateId !== replacement.candidateId
+                || replacementEvent.payload.reviewerRoleName !== replacement.reviewerRoleName
+                || replacementEvent.payload.taskCandidate !== JSON.stringify(replacement.taskCandidate)) {
+                throw dataError(`Force-fresh audit for ${source.id} does not match its replacement Round.`);
+            }
+            return { round: replacement, source, created: false };
+        }
+        const recovery = classifyForceFreshReviewRecovery(tx, source);
+        if (recovery.kind === "semantic-or-ambiguous") {
+            throw usageError(`ReviewRound ${source.id} is not eligible for force-fresh: ${recovery.reason}`);
+        }
+        if (source.taskCandidate === undefined) {
+            throw dataError(`ReviewRound ${source.id} has no frozen Task candidate.`);
+        }
+        const taskFinalContract = taskFinalReviewContractForMutation(tx, task.id, options);
+        if (!sameTaskFinalReviewContract(source.taskFinalReviewContract, taskFinalContract)) {
+            throw usageError(`Task final-review contract does not match ReviewRound ${source.id}.`);
+        }
+        if (source.executionGroup !== undefined
+            && (source.executionGroup.strategy.mode !== "fixed"
+                || source.executionGroup.strategy.count !== 1
+                || source.executionGroup.lanes.length !== 1
+                || source.executionGroup.lanes[0].roleName !== source.reviewerRoleName)) {
+            throw usageError(`ReviewRound ${source.id} is not a single-Reviewer full Review; force-fresh is refused.`);
+        }
+        const item = tx.getWorkItem(task.id, source.workItemId);
+        const candidate = item?.candidates.find(({ id }) => id === source.candidateId);
+        if (item === null || item === undefined || candidate === undefined) {
+            throw dataError(`Final Review anchor Candidate is no longer available: `
+                + `${source.workItemId}/${source.candidateId}.`);
+        }
+        const provenance = taskReviewProvenance(tx, task, options);
+        if (!isSameTaskReviewCandidate(source.taskCandidate, provenance.candidate)) {
+            throw usageError(`Final ReviewRound ${source.id} freezes a candidate that is no longer the current Task candidate.`);
+        }
+        const producerCollision = taskReviewProducerCollision(provenance, source.reviewerRoleName);
+        if (producerCollision !== null)
+            throw usageError(producerCollision);
+        const taskRounds = reviewRoundsByIdentity(tx.listReviewRounds(task.id)
+            .filter((entry) => (entry.scope ?? "work-item") === "task"));
+        const sourceIndex = taskRounds.findIndex(({ id }) => id === source.id);
+        if (sourceIndex < 0) {
+            throw dataError(`Final ReviewRound is not in Task history: ${source.id}.`);
+        }
+        const laterRound = taskRounds.slice(sourceIndex + 1).at(-1);
+        if (laterRound !== undefined) {
+            throw usageError(`A newer Task-final ReviewRound already exists after ${source.id}: `
+                + `${laterRound.id}/${laterRound.status}.`);
+        }
+        assertNoConflictingTaskReviewRound(taskRounds, source.id);
+        assertTaskReviewRequestLane(tx, task.id, source.reviewerRoleName);
+        let reviewer = tx.getRole(task.id, source.reviewerRoleName);
+        if (reviewer === null) {
+            if (tx.getGlobalRole(source.reviewerRoleName) === null) {
+                throw usageError(`Global Role not found: ${source.reviewerRoleName}.`);
+            }
+            reviewer = createTaskRole(tx, task, source.reviewerRoleName, undefined, now, source.reviewerRoleName);
+            tx.saveRole(task.id, reviewer);
+        }
+        let created = createTaskReviewRound(tx.nextReviewRoundId(task.id), task.id, source.workItemId, source.candidateId, source.reviewerRoleName, "leader", source.taskCandidate, now, taskFinalContract);
+        const group = createExecutionGroup(`execution-group-${created.id}`, task.id, {
+            purpose: "review",
+            target: executionTargetForReviewRound(task, created, item, candidate),
+            strategy: { mode: "fixed", count: 1 },
+            lanes: [{ roleName: reviewer.name, reviewRoundId: created.id }]
+        }, now);
+        created = { ...created, executionGroup: group };
+        tx.saveReviewRound(task.id, created);
+        recordTaskEvent(tx, task.id, TASK_FINAL_FORCE_FRESH_EVENT, {
+            sourceReviewRoundId: source.id,
+            ...(source.reviewerRunId === undefined ? {} : { sourceReviewerRunId: source.reviewerRunId }),
+            reviewRoundId: created.id,
+            workItemId: created.workItemId,
+            candidateId: created.candidateId,
+            reviewerRoleName: created.reviewerRoleName,
+            taskCandidate: JSON.stringify(created.taskCandidate),
+            reason: "source-round-terminal-without-semantic-review",
+            leaderActionRunId: taskLeaderActionRunId(tx, task.id, options.environment, options.yuiHome) ?? "leader"
+        }, now);
+        return { round: created, source, created: true };
+    });
+    return output(result.created
+        ? `Fresh Task-final Review requested as ${result.round.id} after ${result.source.id}\n`
+        : `Fresh Task-final Review already requested as ${result.round.id} after ${result.source.id}\n`, { reviewRound: result.round, sourceReviewRound: result.source });
+}
+/**
+ * Conservatively classifies an immutable Task-final Review as replaceable.
+ * A failed Round keeps the existing no-semantic-evidence behavior. A completed
+ * Round needs stronger, mutually corroborating evidence: an explicit internal
+ * context/workspace failure, its exact yielded Run and receipt, matching Lane
+ * output, and the mechanically emitted empty completion Event.
+ * This is command eligibility only; it never rewrites the source outcome or
+ * changes the global semantic classifier used by the finding ledger.
+ */
+export function classifyForceFreshReviewRecovery(store, round) {
+    const classification = classifyReviewRoundOutcome(round, store);
+    return classification?.kind === "non-semantic"
+        ? { kind: "non-semantic-terminal", reason: classification.reason }
+        : {
+            kind: "semantic-or-ambiguous",
+            reason: classification?.reason ?? `source status is ${round.status}, not terminal.`
+        };
+}
 /**
  * Issue 07: re-validates the CLI-computed delta preflight inside the store
  * transaction.  The previous Round must be a completed acceptance (a full
@@ -3092,8 +3593,8 @@ function validateDeltaRecheckRequest(store, taskId, reviewerRoleName, candidate,
     const previous = store.getReviewRound(taskId, preflight.record.previousReviewRoundId);
     if (previous === null
         || (previous.scope ?? "work-item") !== "task"
-        || previous.status !== "completed") {
-        throw usageError(`Delta-recheck previous ReviewRound is not a completed Task-final Review: `
+        || !isSemanticReviewRound(previous, store)) {
+        throw usageError(`Delta-recheck previous ReviewRound is not a semantic completed Task-final Review: `
             + `${preflight.record.previousReviewRoundId}.`);
     }
     if (previous.reviewerRoleName !== reviewerRoleName) {
@@ -3307,13 +3808,16 @@ function taskRunCommand(args, store, options) {
 function runContextCommand(args, store, options) {
     const [first, ...rest] = args;
     if (first === "expand") {
-        if (rest.length < 2 || rest.length > 4 || (rest.length > 2
-            && !(rest.length === 4 && rest[2] === "--mode" && rest[3] === "full"))) {
-            throw usageError("Task run context expand usage: yui task run context expand <task>/<run> <ref-id> [--mode full].");
+        const usage = "Task run context expand usage: yui task run context expand <task>/<run> <ref-id> [--store <store>] [--mode full].";
+        const parsed = parseTail(rest, new Set(["--store", "--mode"]), usage);
+        exactPositionals(parsed.positionals, 2, usage);
+        const mode = parsed.options.get("--mode");
+        if (mode !== undefined && mode !== "full") {
+            throw usageError("Run Context expansion mode must be full.", usage);
         }
-        const { taskId, runId } = parseRunContextReference(rest[0]);
+        const { taskId, runId } = parseRunContextReference(parsed.positionals[0]);
         authorizeRunContext(store, taskId, runId, options.environment);
-        const expanded = store.transaction((tx) => expandRunContextRef(tx, taskId, runId, rest[1]));
+        const expanded = store.transaction((tx) => expandRunContextRef(tx, taskId, runId, parsed.positionals[1], optionalNonEmptyOption(parsed.options, "--store")));
         return output(`${JSON.stringify(expanded, null, 2)}\n`, { context: expanded });
     }
     if (first === "delta") {
@@ -3706,7 +4210,7 @@ function retryRun(args, store, options) {
 }
 function actualTaskReviewCandidateForMutation(store, task, options) {
     if (options.actualTaskReviewCandidate === undefined) {
-        throw usageError(`Actual Task Project heads were not verified for final Review: ${task.id}.`);
+        throw usageError(`Actual Task Project heads were not verified for delivery: ${task.id}.`);
     }
     let actual;
     try {
@@ -3922,8 +4426,8 @@ function prepareFinalTaskReview(store, task, now, taskFinalContract, options) {
     // Any Task-final ReviewRound is durable completion evidence/obligation.
     // Once one exists, later changes to the mutable global review config cannot
     // weaken the requirement or change its reviewer. Before the first such
-    // Round, the current global `final` config is still the supported way to
-    // establish the policy and queue that initial Round.
+    // Round, the current global `final` config establishes the initial Round
+    // only for integrated delivery.
     const taskRounds = reviewRoundsByIdentity(store.listReviewRounds(task.id))
         .filter((round) => ((round.scope ?? "work-item") === "task"
         && (taskFinalContract === undefined || sameTaskFinalReviewContract(round.taskFinalReviewContract, taskFinalContract))));
@@ -3934,7 +4438,15 @@ function prepareFinalTaskReview(store, task, now, taskFinalContract, options) {
     }
     else if (establishedRound === undefined) {
         const globalConfig = store.getReviewConfig();
-        config = globalConfig?.trigger === "final" ? globalConfig : null;
+        // Direct delivery is an explicit low-overhead contract. Mutable global
+        // policy must not create a managed Round during direct completion; risk
+        // that warrants one promotes the Task to integrated delivery. Any already-
+        // established Task Round or immutable contract remains authoritative
+        // through the branches above.
+        config = taskDeliveryPath(task) === "integrated"
+            && globalConfig?.trigger === "final"
+            ? globalConfig
+            : null;
     }
     else {
         config = { roleName: establishedRound.reviewerRoleName, trigger: "final" };
@@ -3979,7 +4491,10 @@ function prepareFinalTaskReview(store, task, now, taskFinalContract, options) {
             return escalated;
         }
         else {
-            return latest.status === "completed" ? null : latest;
+            return latest.status === "completed"
+                && classifyReviewRoundOutcome(latest, store)?.kind === "semantic"
+                ? null
+                : latest;
         }
     }
     const anchor = taskFinalContract === undefined
@@ -4051,15 +4566,20 @@ function assertPendingFinalReviewWorkspaceEvidence(store, task, round) {
     }
 }
 function latestTaskReviewContractAnchor(store, task, taskFinalContract) {
-    const item = [...store.listWorkItems(task.id)]
-        .filter(({ candidates }) => candidates.some(({ taskFinalReviewContract: candidateContract }) => (sameTaskFinalReviewContract(candidateContract, taskFinalContract))))
-        .sort((left, right) => (left.updatedAt.localeCompare(right.updatedAt) || left.id.localeCompare(right.id)))
+    const anchor = store.listWorkItems(task.id)
+        .flatMap((item) => {
+        const candidate = governingWorkItemCandidate(item);
+        return candidate !== undefined && sameTaskFinalReviewContract(candidate.taskFinalReviewContract, taskFinalContract)
+            ? [{ item, candidate }]
+            : [];
+    })
+        .sort((left, right) => (left.item.updatedAt.localeCompare(right.item.updatedAt)
+        || left.item.id.localeCompare(right.item.id)))
         .at(-1);
-    const candidate = item?.candidates.filter(({ taskFinalReviewContract: candidateContract }) => (sameTaskFinalReviewContract(candidateContract, taskFinalContract))).at(-1);
-    if (item === undefined || candidate === undefined) {
+    if (anchor === undefined) {
         throw usageError(`Task ${task.id} has no WorkItem Candidate to anchor its final Review.`);
     }
-    return { item, candidate };
+    return anchor;
 }
 /**
  * Leader-only retry of an exact failed Task-final review Run. The old failed
@@ -5095,8 +5615,8 @@ export function dispatchPreparedReviewRound(taskId, reviewRoundId, store, option
         let deltaContext = "";
         if (taskScope && round.deltaRecheck !== undefined) {
             const previousRound = tx.getReviewRound(taskId, round.deltaRecheck.previousReviewRoundId);
-            if (previousRound === null || previousRound.status !== "completed") {
-                throw new TaskFinalReviewDispatchDriftError(`Delta-recheck previous ReviewRound is unavailable: ${round.deltaRecheck.previousReviewRoundId}.`);
+            if (previousRound === null || !isSemanticReviewRound(previousRound, tx)) {
+                throw new TaskFinalReviewDispatchDriftError(`Delta-recheck previous semantic ReviewRound is unavailable: ${round.deltaRecheck.previousReviewRoundId}.`);
             }
             const diffByProject = options.deltaRecheckDiff;
             if (diffByProject === undefined) {
@@ -5379,6 +5899,52 @@ function recordTaskEventRecord(store, taskId, type, payload, now) {
     store.saveEvent(taskId, event);
     return event;
 }
+function publishedTreeAuthorizationPayload(actor, proof) {
+    return {
+        by: actor,
+        projectId: proof.projectId,
+        publicationId: proof.publicationId,
+        ...(proof.reviewRoundId === undefined
+            ? { reviewAnchor: publishedTreeReviewAnchor(proof) }
+            : { reviewRoundId: proof.reviewRoundId }),
+        localCommit: proof.localCommit,
+        remoteCommit: proof.remoteCommit,
+        tree: proof.tree
+    };
+}
+function matchingPublishedTreeAuthorization(store, proof) {
+    const events = store.listEvents(proof.taskId);
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.type === "task.completed" || event.type === "task.reopened")
+            return undefined;
+        if (event.type === TASK_COMPLETION_PUBLISHED_TREE_AUTHORIZED_EVENT
+            && (event.payload.by === "user" || event.payload.by === "operator")
+            && event.payload.projectId === proof.projectId
+            && event.payload.publicationId === proof.publicationId
+            && (event.payload.reviewAnchor ?? event.payload.reviewRoundId)
+                === publishedTreeReviewAnchor(proof)
+            && event.payload.localCommit === proof.localCommit
+            && event.payload.remoteCommit === proof.remoteCommit
+            && event.payload.tree === proof.tree) {
+            return event;
+        }
+    }
+    return undefined;
+}
+function requirePublishedTreeAuthorization(store, proof) {
+    const authorization = matchingPublishedTreeAuthorization(store, proof);
+    if (authorization === undefined) {
+        throw usageError(`Published-tree completion requires explicit user or global Operator authorization for `
+            + `${proof.taskId}/${proof.publicationId} at ${proof.reviewRoundId === undefined
+                ? "the direct Task-main head"
+                : `Task-final Review ${proof.reviewRoundId}`}.`);
+    }
+    return authorization;
+}
+function publishedTreeReviewAnchor(proof) {
+    return proof.reviewRoundId ?? "direct";
+}
 /** Keeps a free-text run-fact note bounded so an event payload stays compact. */
 function truncateEventNote(note) {
     const normalized = note.trim();
@@ -5639,6 +6205,11 @@ function parseTaskPriority(value) {
         return value;
     throw usageError(`Invalid Task priority: ${value}.`);
 }
+function parseTaskDelivery(value) {
+    if (value === "direct" || value === "integrated")
+        return value;
+    throw usageError(`Task delivery is invalid: ${value}. Use direct or integrated.`);
+}
 function parseTaskTags(value) {
     const tags = [...new Set(value.split(",").map((tag) => tag.trim()).filter(Boolean))];
     if (tags.length === 0)
@@ -6327,6 +6898,9 @@ function workItemRef(taskId, id) {
 function messageRef(taskId, id) {
     return { type: "message", taskId, id };
 }
+function eventRef(taskId, id) {
+    return { type: "event", taskId, id };
+}
 function notifyMailbox(runtime, target, compatibilityTaskId) {
     if (runtime?.notifyMailboxChanged !== undefined) {
         runtime.notifyMailboxChanged(target);