chati-dev 4.5.28 → 4.5.29

package/src/orchestrator/session-manager.js

@@ -9,16 +9,35 @@ import * as yaml from 'js-yaml';
 import {
   closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync,
   openSync, readSync, realpathSync, renameSync, rmSync, rmdirSync,
-  unlinkSync, writeFileSync, readFileSync,
+  unlinkSync, writeFileSync, readFileSync, readdirSync,
 } from 'fs';
 import { basename, join, dirname, resolve } from 'path';
 import { randomUUID } from 'crypto';
 import { hostname } from 'node:os';
+import { canonicalize, canonicalSerialize } from '@chati/core';
+import { isPlanningQaOutcomeValid } from '../terminal/handoff-parser.js';
+import { getQaThreshold, resetPipelineTo, MAX_CORRECTION_CYCLES } from './pipeline-manager.js';
+import { AGENT_PIPELINE, assertV2PlanningPredecessors } from './agent-selector.js';
+import { pinCouncilQaRevalidation, pinPlanningQaSubject, pinPlanningQaReport } from './council-gate-runtime.js';
+import { pinPlanningReconciliation, readPlanningReconciliationDecision,
+  readAttestedPlanningReconciliationDecision } from './planning-reconciliation.js';
+import { PLANNING_CONTRACT_REVISION_OWNERS, PLANNING_CONTRACT_REVISION_TARGET, normalizePlanningContractDirection,
+  pinPlanningContractRevision, pinPlanningContractRevisionOwnerBaseline, pinPlanningContractRevisionOwnerOutput,
+  readAttestedPlanningContractRevision, planningContractRevisionHistory, planningRevisionResultDigest,
+  planningRevisionTerminalDigest, derivePlanningCorrectionSource,
+  authenticatePlanningContractRevisionHistory } from './planning-contract-revision.js';
+import { resolveRuntimeInvocationV2 } from './runtime-installation-v2.js';
 
 const SESSION_FILE = '.chati/session.yaml';
 const SESSION_MAX_BYTES = 4 * 1024 * 1024;
 const SESSION_LOCK_OWNER_MAX_BYTES = 16 * 1024;
 const SESSION_LOCK_STALE_AFTER_MS = 30_000;
+// Concurrent fsync-backed writers can legitimately queue longer than two
+// seconds. Bound the wait without stealing live locks or shortening stale leases.
+const SESSION_LOCK_WAIT_MS = 10_000;
+const RELAY_HISTORY_MAX_TURNS = 64;
+const RELAY_HISTORY_MAX_BYTES = 1024 * 1024;
+const INITIAL_TASK_CONTEXT_MAX_BYTES = 256 * 1024;
 const SESSION_TEST_HOOKS = Symbol.for('chati.session-manager.security-test-hooks');
 const UNSAFE_SESSION_LOCK_OWNER = Symbol('unsafe-session-lock-owner');
 
@@ -142,6 +161,7 @@ function readRegularFileBounded(opened) {
 function writeFileAtomic(path, content, encoding = 'utf-8', {
   expectedDestinationIdentity,
   expectedDirectoryIdentity,
+  beforeCommit,
 } = {}) {
   if (Buffer.byteLength(String(content), encoding) > SESSION_MAX_BYTES) {
     throw new Error('session.yaml exceeds the 4 MiB safety limit');
@@ -187,6 +207,7 @@ function writeFileAtomic(path, content, encoding = 'utf-8', {
       throw new Error('Session temporary changed before atomic rename');
     }
     runSecurityTestHook('beforeAtomicRenameCommit', { path, tmp });
+    beforeCommit?.();
     assertDirectoryIdentity(directoryPath, directory.stat);
     assertPathIdentity(destination, expectedDestination, { allowMissing: true });
     renameSync(tmp, destination);
@@ -352,7 +373,7 @@ function recoverAbandonedSessionLock(lockPath) {
   finally { if (electionFd !== undefined) closeSync(electionFd); }
 }
 
-function waitForSessionWriteLock(sessionPath, maxWaitMs = 2000) {
+function waitForSessionWriteLock(sessionPath, maxWaitMs = SESSION_LOCK_WAIT_MS) {
   const startedAt = Date.now();
   const lockPath = `${sessionPath}.lock`;
   const parentPath = dirname(lockPath);
@@ -641,6 +662,10 @@ const DEFAULT_SESSION = {
   // 2026-04-18: execution_profile + profile_transitions were folded into
   // execution_mode (set in DEFAULT_SESSION above as 'interactive'/'autonomous').
   providers_enabled: [],
+  // Content-addressed planning council outcomes. Each value points only to
+  // normalized evidence stored under .chati/v2/council/, never raw provider
+  // transcripts or credentials.
+  council_gates: {},
   // BUILD → DEPLOY preview state (user approves before devops ships).
   preview: {
     status: 'inactive',
@@ -1008,6 +1033,88 @@ export function updateSession(projectDir, updates) {
   });
 }
 
+/** Entries that can be stored RAIL handoffs. Hidden files dropped by the OS
+ * or editors (.DS_Store, swap files) are not handoffs and must not seal
+ * Planning corrections; anything else remains fail-closed. */
+function storedRailHandoffEntries(handoffs) {
+  return readdirSync(handoffs).filter((name) => !name.startsWith('.'));
+}
+
+/** Preview a negative Planning correction retarget, never an approval/reset of RAIL. */
+export function inspectPlanningCorrectionRollback(projectDir, session, targetAgent) {
+  const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+  if (session.mode !== 'plan' || session.rail_handoff_id || session.rail_handoff_path || session.rail_state) {
+    fail('PLANNING_CORRECTION_SEALED', 'Only unsealed Planning corrections may be retargeted.');
+  }
+  const handoffs = join(projectDir, '.chati/v2/rail/handoffs');
+  try {
+    const stat = lstatSync(handoffs);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || storedRailHandoffEntries(handoffs).length > 0) {
+      fail('PLANNING_CORRECTION_SEALED', 'Stored RAIL handoffs prohibit Planning rollback.');
+    }
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  const targets = ['detail', 'architect', 'ux'];
+  const current = session.current_agent;
+  if (!targets.includes(targetAgent) || !targets.includes(current)
+    || targets.indexOf(targetAgent) >= targets.indexOf(current)
+    || session.agents?.[targetAgent]?.status !== 'completed'
+    || !session.completed_agents?.includes(targetAgent)) {
+    fail('INVALID_QA_CORRECTION_TARGET', 'The target must be a completed upstream Planning agent.');
+  }
+  const targetIndex = AGENT_PIPELINE.findIndex(agent => agent.name === targetAgent);
+  const affectedAgents = AGENT_PIPELINE.slice(targetIndex)
+    .filter(agent => agent.phase === 'plan' && Object.hasOwn(session.agents || {}, agent.name))
+    .map(agent => agent.name);
+  for (const name of affectedAgents) {
+    const agent = session.agents[name];
+    if (agent.execution_claim_id || agent.execution_claim_state
+      || ['in_progress', 'awaiting_advance', 'waiting_for_user'].includes(agent.status)) {
+      fail('PLANNING_CORRECTION_IN_FLIGHT', `Agent ${name} must settle its claim, result or interaction first.`);
+    }
+  }
+  if (session.pending_interaction) {
+    fail('PLANNING_CORRECTION_IN_FLIGHT', 'A pending interaction must be settled before rollback.');
+  }
+  const cycle = session.correction_cycles?.[`qa-planning->${current}`];
+  if (session.last_handoff !== 'qa-planning' || session.agents[current].status !== 'pending_rework'
+    || session.agents['qa-planning']?.status !== 'pending'
+    || !Number.isSafeInteger(cycle) || cycle < 1 || cycle > 2
+    || !session.decision_trail?.some(entry => entry.resolved === false)) {
+    fail('PLANNING_CORRECTION_NOT_PENDING', 'Retargeting requires an unstarted, bounded negative QA correction with preserved findings.');
+  }
+  return { impact: 'high', affectedAgents, requiresConfirmation: true,
+    recommendation: `Reopen ${targetAgent} and invalidate ${affectedAgents.length} Planning statuses; preserve artifacts, findings and the recorded correction cycle.` };
+}
+
+/** Reuse the pipeline reset under the canonical writer lock; reserve nothing. */
+export function rollbackPlanningCorrection(projectDir, targetAgent) {
+  let impact;
+  let failureCode;
+  const saved = mutateSession(projectDir, session => {
+    try { impact = inspectPlanningCorrectionRollback(projectDir, session, targetAgent); }
+    catch (error) { failureCode = error.code; throw error; }
+    const previousAgents = Object.fromEntries(impact.affectedAgents.map(name => [name, { ...session.agents[name] }]));
+    const reset = resetPipelineTo({
+      agents: structuredClone(session.agents), completedAgents: [...session.completed_agents], history: [],
+    }, targetAgent);
+    for (const name of impact.affectedAgents) {
+      session.agents[name] = { ...session.agents[name], status: name === targetAgent ? 'pending_rework' : reset.agents[name].status,
+        score: null, criteria_count: 0, started_at: null, completed_at: null, startedAt: null, completedAt: null };
+    }
+    session.completed_agents = reset.completedAgents;
+    session.current_agent = targetAgent;
+    session.pipeline_position = reset.completedAgents.length;
+    session.deviations = [...(session.deviations || []), {
+      type: 'rollback', details: { targetAgent, source: 'pending_qa_correction' },
+      previous_agents: previousAgents, applied_at: new Date().toISOString(),
+      changes: impact.affectedAgents.map(name => `Reset agent: ${name}`),
+    }];
+    return session;
+  });
+  if (!saved.saved) return { ...saved, applied: false, code: failureCode || 'SESSION_WRITE_FAILED' };
+  return { ...saved, applied: true, impact, changes: impact.affectedAgents.map(name => `Reset agent: ${name}`) };
+}
+
 /**
  * Atomically transition conversation ownership and lifecycle state. Returning
  * the prior values lets callers record timeline evidence without performing a
@@ -1202,7 +1309,7 @@ export function updateContextUsage(projectDir, {
   };
 }
 
-function mutateSession(projectDir, mutator) {
+function mutateSession(projectDir, mutator, { beforeCommit } = {}) {
   let sessionPath;
   try {
     sessionPath = validateSessionPath(projectDir, { requireFile: true });
@@ -1222,10 +1329,11 @@ function mutateSession(projectDir, mutator) {
     writeFileAtomic(sessionPath, yamlContent, 'utf-8', {
       expectedDestinationIdentity: record.identity,
       expectedDirectoryIdentity: record.directoryIdentity,
+      beforeCommit,
     });
     outcome = { saved: true, session: nextSession };
   } catch (err) {
-    outcome = { saved: false, error: `Failed to update session: ${err.message}` };
+    outcome = { saved: false, error: `Failed to update session: ${err.message}`, ...(err.code ? { code: err.code } : {}) };
   } finally {
     if (releaseLock) {
       try {
@@ -1296,7 +1404,39 @@ export function recordModelSelection(projectDir, selection) {
   });
 }
 
-/** Persist an interactive question so another harness resumes it verbatim. */
+export function validateInitialTaskContext(context) {
+  if (context !== undefined && context !== null && (typeof context !== 'string'
+    || Buffer.byteLength(context, 'utf8') > INITIAL_TASK_CONTEXT_MAX_BYTES)) {
+    throw Object.assign(new Error('Initial task context must be text of at most 256 KiB; no content was truncated.'),
+      { code: 'INITIAL_TASK_CONTEXT_INVALID' });
+  }
+}
+
+function validateRelayHistory(history, question = '', initialTaskContext = undefined) {
+  validateInitialTaskContext(initialTaskContext);
+  if (!Array.isArray(history) || history.some((entry) => !entry
+    || typeof entry.interaction_id !== 'string'
+    || !['user_answer', 'controller_instruction'].includes(entry.kind)
+    || typeof entry.response !== 'string'
+    || (entry.kind === 'user_answer' && typeof entry.question !== 'string'))) {
+    throw new Error('Invalid retained interactive history');
+  }
+  if (history.length > RELAY_HISTORY_MAX_TURNS
+    || Buffer.byteLength(JSON.stringify({ history, question, initialTaskContext })) > RELAY_HISTORY_MAX_BYTES) {
+    throw new Error('Interactive history exceeds its safety limit; no content was truncated');
+  }
+}
+
+/** Public diagnostics must not disclose retained answers or in-flight input. */
+export function summarizePendingInteraction(pending) {
+  if (!pending) return null;
+  const metadata = { ...pending };
+  for (const key of ['history', 'relay_response', 'relay_response_kind', 'relay_next_task_id', 'initial_task_context']) delete metadata[key];
+  return { ...metadata, history_turn_count: Array.isArray(pending.history) ? pending.history.length : 0,
+    history_complete: pending.history_complete === true };
+}
+
+/** Persist an interactive question and atomically commit only its owned relay. */
 export function recordPendingInteraction(projectDir, interaction) {
   const sessionProjectDir = findSessionProjectDir(projectDir);
   if (!sessionProjectDir) return { saved: false, error: 'Session file not found in working directory or its parents' };
@@ -1314,7 +1454,31 @@ export function recordPendingInteraction(projectDir, interaction) {
       catalog_snapshot_ref: interaction.catalogSnapshotRef || null,
     };
     const sameRelay = previous?.agent === interaction.agent && previous?.task_id === taskId;
-    const relayAdvanced = sameRelay && interaction.advanceRelay === true;
+    const relayAdvanced = interaction.advanceRelay === true;
+    if (relayAdvanced && (!previous || previous.status !== 'relay_in_flight'
+      || previous.agent !== interaction.agent
+      || previous.interaction_id !== interaction.interactionId
+      || !interaction.claimId || previous.relay_claim_id !== interaction.claimId
+      || previous.relay_next_task_id !== taskId
+      || typeof previous.relay_response !== 'string')) {
+      throw new Error('Pending interaction commit rejected: relay ownership mismatch');
+    }
+    if (!relayAdvanced && previous && (!sameRelay || previous.status !== 'waiting_for_user')) {
+      throw new Error('Pending interaction cannot replace another active interaction');
+    }
+    const expectedBinding = previous?.escalation_execution_binding || previous?.execution_binding;
+    if (previous && Object.entries(binding).some(([key, value]) => value !== (expectedBinding?.[key] || null))) {
+      throw new Error('Pending interaction commit rejected: execution binding mismatch');
+    }
+    const history = previous?.history || [];
+    const nextHistory = relayAdvanced ? [...history, {
+      interaction_id: previous.interaction_id,
+      kind: previous.relay_response_kind,
+      ...(previous.relay_response_kind === 'user_answer' ? { question: previous.question } : {}),
+      response: previous.relay_response,
+    }] : history;
+    const initialTaskContext = previous ? previous.initial_task_context : interaction.initialTaskContext;
+    validateRelayHistory(nextHistory, interaction.question, initialTaskContext);
     const interactionId = (!sameRelay || relayAdvanced || !previous?.interaction_id)
       ? randomUUID()
       : previous.interaction_id;
@@ -1323,6 +1487,23 @@ export function recordPendingInteraction(projectDir, interaction) {
     session.current_execution_binding = binding;
     session.agents = session.agents || {};
     const existingAgent = session.agents[interaction.agent] || {};
+    let qaBaseline;
+    let revisionBaseline;
+    if (hasPlanningQaRecovery(existingAgent, interaction.agent)) {
+      qaBaseline = assertPlanningQaReportBaseline(existingAgent, { binding, taskId,
+        ...(previous ? { pending: previous } : { claimId: existingAgent.execution_claim_id }) });
+      if (!previous && existingAgent.execution_claim_state !== 'running') {
+        throw Object.assign(new Error('Only a started QA may carry its report baseline into an interaction.'), { code: 'COUNCIL_QA_REPORT_BASELINE_INVALID' });
+      }
+    }
+    if (existingAgent.planning_contract_revision_id) {
+      revisionBaseline = assertPlanningContractRevisionExecutionBaseline(existingAgent, { binding, taskId,
+        ...(previous ? { pending: previous } : { claimId: existingAgent.execution_claim_id }) });
+      if (!previous && existingAgent.execution_claim_state !== 'running') {
+        throw Object.assign(new Error('Only a started Planning revision owner may carry its attempt baseline into an interaction.'),
+          { code: 'PLANNING_CONTRACT_REVISION_EXECUTION_BASELINE_INVALID' });
+      }
+    }
     session.agents[interaction.agent] = {
       ...existingAgent,
       status: 'waiting_for_user',
@@ -1332,6 +1513,7 @@ export function recordPendingInteraction(projectDir, interaction) {
     delete session.agents[interaction.agent].execution_claim_state;
     delete session.agents[interaction.agent].execution_claim_started_at;
     delete session.agents[interaction.agent].execution_claim_expires_at;
+    delete session.agents[interaction.agent].execution_resume_status;
     session.pending_interaction = {
       interaction_id: interactionId,
       status: 'waiting_for_user',
@@ -1339,15 +1521,102 @@ export function recordPendingInteraction(projectDir, interaction) {
       task_id: taskId,
       language: session.language || 'en',
       question: interaction.question,
-      relay_cycles: relayAdvanced ? (previous.relay_cycles || 1) + 1 : (sameRelay ? (previous.relay_cycles || 1) : 1),
+      history: nextHistory,
+      ...(initialTaskContext ? { initial_task_context: initialTaskContext } : {}),
+      history_complete: previous ? previous.history_complete === true : true,
+      relay_cycles: relayAdvanced && sameRelay ? (previous.relay_cycles || 1) + 1 : (sameRelay ? (previous.relay_cycles || 1) : 1),
       execution_binding: binding,
-      created_at: sameRelay ? previous.created_at : now,
+      ...(qaBaseline ? { qa_report_baseline: cloneSessionValue(qaBaseline) } : {}),
+      ...(revisionBaseline ? { planning_revision_baseline: cloneSessionValue(revisionBaseline) } : {}),
+      created_at: previous ? previous.created_at : now,
       updated_at: now,
     };
     return session;
   });
 }
 
+// Older releases lost pending_rework when a reserved/running command failed.
+// Recover only the recorded, still-open rollback. A negative QA handoff is
+// context, never proof that QA completed or that downstream work may start.
+export function getPendingPlanningRollbackTarget(session) {
+  if (session.mode !== 'plan' || session.last_handoff !== 'qa-planning'
+    || session.completed_agents?.includes('qa-planning')) return null;
+  const rollback = session.deviations?.findLast(entry => entry.type === 'rollback');
+  if (rollback?.details?.source !== 'pending_qa_correction') return null;
+  const target = rollback.details.targetAgent;
+  if (session.completed_agents?.includes(target) && session.agents?.[target]?.status === 'completed') return null;
+  const invalid = () => { throw Object.assign(new Error('Pending Planning rollback is inconsistent; no execution was reserved.'),
+    { code: 'PLANNING_CORRECTION_STATE_INVALID' }); };
+  if (!['detail', 'architect', 'ux'].includes(target)
+    || session.completed_agents?.includes(target)
+    || !['pending', 'pending_rework', 'in_progress', 'awaiting_advance'].includes(session.agents?.[target]?.status)
+    || session.agents?.['qa-planning']?.status !== 'pending'
+    || !session.decision_trail?.some(entry => entry.resolved === false)) invalid();
+  const source = Object.entries(rollback.previous_agents || {}).find(([name, state]) =>
+    ['detail', 'architect', 'ux'].includes(name) && state.status === 'pending_rework')?.[0];
+  const cycle = session.correction_cycles?.[`qa-planning->${source}`];
+  if (!source || !Number.isSafeInteger(cycle) || cycle < 1 || cycle > 2) invalid();
+  const affected = AGENT_PIPELINE.slice(AGENT_PIPELINE.findIndex(entry => entry.name === target))
+    .filter(entry => entry.phase === 'plan' && entry.name !== target);
+  if (session.pending_interaction || affected.some(({ name }) => {
+    const state = session.agents?.[name];
+    return state?.execution_claim_id || state?.execution_claim_state
+      || ['in_progress', 'awaiting_advance', 'waiting_for_user'].includes(state?.status);
+  })) {
+    throw Object.assign(new Error('Pending Planning rollback has conflicting execution or interaction ownership.'),
+      { code: 'PLANNING_CORRECTION_IN_FLIGHT' });
+  }
+  return target;
+}
+
+/** Revision owners consume each other's pinned output, so only one may run at a time. */
+export function getPlanningContractRevisionOwner(session, projectDir) {
+  const lineage = projectDir ? authenticatePlanningContractRevisionHistory(projectDir, session)
+    : planningContractRevisionHistory(session);
+  const { history } = lineage;
+  if (lineage.pending) throw Object.assign(new Error('The exact reserved Planning direction must settle before any owner may execute.'),
+    { code: 'PLANNING_CONTRACT_REVISION_PENDING' });
+  const active = history.filter(entry => entry.status === 'active');
+  const hasOwner = Object.values(session.agents || {}).some(agent => agent.planning_contract_revision_id);
+  if (!active.length && !hasOwner) return null;
+  const fail = () => { throw Object.assign(new Error('Planning contract revision requires one sequential owner with all prior completions recorded.'),
+    { code: 'PLANNING_CONTRACT_REVISION_ORDER_INVALID' }); };
+  const revision = active[0];
+  if (active.length !== 1 || lineage.tip !== revision || !revision.request?.revision_id
+    || revision.request.language !== session.language || !revision.owner_results
+    || Array.isArray(revision.owner_results)
+    || Object.keys(revision.owner_results).some(owner => !PLANNING_CONTRACT_REVISION_OWNERS.includes(owner))) fail();
+  let next = null;
+  for (const owner of PLANNING_CONTRACT_REVISION_OWNERS) {
+    const result = revision.owner_results[owner], agent = session.agents?.[owner];
+    if (result) {
+      if (next || agent?.status !== 'completed' || !session.completed_agents?.includes(owner)
+        || !result.execution_claim_id || !result.execution_finished_at || !result.subject?.artifacts?.length) fail();
+    } else {
+      next ||= owner;
+      if (!agent || agent.planning_contract_revision_id !== revision.request.revision_id
+        || !agent.content_review_pending || agent.status === 'completed' || session.completed_agents?.includes(owner)) fail();
+    }
+  }
+  if (!next || (session.pending_interaction && session.pending_interaction.agent !== next)) fail();
+  for (const owner of PLANNING_CONTRACT_REVISION_OWNERS) {
+    if (owner === next) continue;
+    const agent = session.agents[owner];
+    if (agent.execution_claim_id || agent.execution_claim_state
+      || ['in_progress', 'awaiting_advance', 'waiting_for_user'].includes(agent.status)) fail();
+  }
+  return next;
+}
+
+function assertPlanningContractRevisionOwner(session, agents, projectDir) {
+  const owner = getPlanningContractRevisionOwner(session, projectDir);
+  if (owner && (agents.length !== 1 || agents[0] !== owner)) {
+    throw Object.assign(new Error(`Planning contract revision must execute ${owner} alone before later owners.`),
+      { code: 'PLANNING_CONTRACT_REVISION_ORDER_INVALID' });
+  }
+  return owner;
+}
+
 /** Atomically reserve one or more agent executions before returning commands. */
 export function claimAgentExecutions(projectDir, executions = [], claim = {}) {
   const sessionProjectDir = findSessionProjectDir(projectDir);
@@ -1360,6 +1629,22 @@ export function claimAgentExecutions(projectDir, executions = [], claim = {}) {
   const expiresAt = new Date(now.getTime() + leaseMs).toISOString();
   const result = mutateSession(sessionProjectDir, (session) => {
     session.agents = session.agents || {};
+    // Recheck the recovery contract under the same writer lock as reservation.
+    // A sibling may have claimed work after the router's read-only selection.
+    assertPlanningContractRevisionOwner(session, requested.map(({ agent }) => agent), sessionProjectDir);
+    try {
+      const rollbackTarget = getPendingPlanningRollbackTarget(session);
+      if (rollbackTarget && (requested.length !== 1 || requested[0].agent !== rollbackTarget)) {
+        throw Object.assign(new Error('Pending Planning rollback must resume its recorded target first.'),
+          { code: 'PLANNING_CORRECTION_STATE_INVALID' });
+      }
+      if (session.runtime_version === 2 || existsSync(join(sessionProjectDir, '.chati', 'v2'))) {
+        for (const { agent } of requested) assertV2PlanningPredecessors(session, agent);
+      }
+    } catch (error) {
+      outcome = { claimed: false, code: error.code, error: error.message };
+      return session;
+    }
     for (const entry of requested) {
       const current = session.agents[entry.agent] || {};
       if (current.status === 'completed' || session.completed_agents?.includes(entry.agent)) {
@@ -1407,15 +1692,27 @@ export function claimAgentExecutions(projectDir, executions = [], claim = {}) {
     outcome.previous = snapshotAgentDispatch(session, requested.map(({ agent }) => agent));
     for (const entry of requested) {
       const claimId = randomUUID();
+      const previous = session.agents[entry.agent] || {};
+      const resumeStatus = previous.status === 'pending_rework'
+        || (previous.status === 'in_progress' && previous.execution_resume_status === 'pending_rework')
+        ? 'pending_rework' : 'pending';
       session.agents[entry.agent] = {
-        ...(session.agents[entry.agent] || {}),
+        ...previous,
         status: 'in_progress',
+        execution_resume_status: resumeStatus,
         execution_claim_id: claimId,
         execution_claim_state: 'reserved',
         execution_claim_started_at: now.toISOString(),
         execution_claim_expires_at: expiresAt,
+        ...(entry.taskId ? { execution_task_id: entry.taskId } : {}),
+        ...(entry.binding ? { execution_binding: cloneSessionValue(entry.binding) } : {}),
       };
+      if (session.agents[entry.agent].content_review_pending && !session.agents[entry.agent].content_review_task_id) {
+        session.agents[entry.agent].content_review_task_id = entry.taskId;
+      }
       outcome.claims[entry.agent] = claimId;
+      delete session.agents[entry.agent].execution_result_status;
+      delete session.agents[entry.agent].execution_qa_result;
     }
     session.current_agent = requested[0].agent;
     if (requested[0].binding) session.current_execution_binding = requested[0].binding;
@@ -1430,9 +1727,14 @@ export function startAgentExecution(projectDir, match = {}) {
   const sessionProjectDir = findSessionProjectDir(projectDir);
   if (!sessionProjectDir) return { saved: false, started: false, error: 'Session file not found in working directory or its parents' };
   let outcome = { started: false };
+  let subject;
+  let reportPin;
+  let revisionBaselinePin;
+  try {
   const result = mutateSession(sessionProjectDir, (session) => {
     const agent = session.agents?.[match.agent];
-    const expired = Date.parse(agent?.execution_claim_expires_at || '') <= Date.now();
+    const expiry = Date.parse(agent?.execution_claim_expires_at || '');
+    const expired = !Number.isFinite(expiry) || expiry <= Date.now();
     if (!agent || agent.execution_claim_id !== match.claimId || agent.execution_claim_state !== 'reserved' || expired) {
       outcome = {
         started: false,
@@ -1441,36 +1743,983 @@ export function startAgentExecution(projectDir, match = {}) {
       };
       return session;
     }
+    let contentReviewContext;
+    assertPlanningContractRevisionOwner(session, [match.agent], sessionProjectDir);
+    try {
+      if (session.runtime_version === 2 || existsSync(join(sessionProjectDir, '.chati', 'v2'))) {
+        assertV2PlanningPredecessors(session, match.agent);
+      }
+      contentReviewContext = claimContentReviewContext(sessionProjectDir, session, match);
+      if (agent.planning_contract_revision_id) {
+        const revision = session.planning_contract_revisions?.find(item => item.request?.revision_id === agent.planning_contract_revision_id);
+        if (!revision) throw Object.assign(new Error('The claimed Planning revision no longer exists.'),
+          { code: 'PLANNING_CONTRACT_REVISION_CONTEXT_INVALID' });
+        revisionBaselinePin = pinPlanningContractRevisionOwnerBaseline(sessionProjectDir, revision, match.agent);
+        agent.execution_planning_revision_baseline = { origin_claim_id: match.claimId, task_id: match.taskId,
+          binding: cloneSessionValue(match.binding),
+          owned_artifacts: cloneSessionValue(revisionBaselinePin.owned_artifacts),
+          subject_artifacts: cloneSessionValue(revisionBaselinePin.subject_artifacts),
+          handoff: cloneSessionValue(revisionBaselinePin.handoff) };
+        contentReviewContext.planning_contract_revision.execution_subject = cloneSessionValue(revisionBaselinePin.subject_artifacts);
+      }
+      if (hasPlanningQaRecovery(agent, match.agent)) {
+        subject = pinClaimedCouncilQa(sessionProjectDir, session, match.agent, { excludeQaReport: true });
+        reportPin = pinPlanningQaReport(sessionProjectDir);
+        agent.execution_qa_report_baseline = { origin_claim_id: match.claimId, task_id: match.taskId,
+          binding: cloneSessionValue(match.binding), sha256: reportPin.sha256 };
+      }
+    }
+    catch (error) { outcome = { started: false, code: error.code, error: error.message }; return session; }
     agent.execution_claim_state = 'running';
     agent.execution_started_at = match.timestamp || new Date().toISOString();
-    outcome = { started: true };
+    outcome = { started: true, expiresAt: agent.execution_claim_expires_at, contentReviewContext };
     return session;
-  });
-  return { ...result, ...outcome };
+  }, { beforeCommit: () => { subject?.assertCurrent(); reportPin?.assertCurrent(); revisionBaselinePin?.assertCurrent(); } });
+  return { ...result, ...outcome, started: result.saved && outcome.started };
+  } finally { subject?.close(); reportPin?.close(); revisionBaselinePin?.close(); }
 }
 
 /** Keep a successful routed result durable until the canonical advance records completion. */
 export function holdAgentExecutionForAdvance(projectDir, match = {}) {
+  if (match.resultStatus !== 'complete') {
+    return { saved: false, held: false, code: 'AGENT_RESULT_NOT_COMPLETE', error: 'Only an explicit complete result can await advance.' };
+  }
+  if (match.qaResult !== undefined && (match.agent !== 'qa-planning'
+    || !isPlanningQaOutcomeValid(match.qaResult, getQaThreshold(match.agent, projectDir)))) {
+    return { saved: false, held: false, code: 'QA_RESULT_INVALID', error: 'Invalid normalized planning QA result.' };
+  }
   const sessionProjectDir = findSessionProjectDir(projectDir);
   if (!sessionProjectDir) return { saved: false, held: false, error: 'Session file not found in working directory or its parents' };
   let outcome = { held: false };
+  let failureCode;
+  let subject;
+  let revisionOutput;
+  let revisionAttemptBaseline;
+  try {
   const result = mutateSession(sessionProjectDir, (session) => {
     const agent = session.agents?.[match.agent];
     if (!agent) {
       outcome = { held: false, code: 'AGENT_EXECUTION_NOT_FOUND', error: `Agent ${match.agent || 'unknown'} is not present in the canonical session.` };
       return session;
     }
-    if (match.claimId && agent.execution_claim_id !== match.claimId) {
+    assertPlanningContractRevisionOwner(session, [match.agent], sessionProjectDir);
+    if (match.interactionId) {
+      const pending = session.pending_interaction;
+      const binding = pending?.escalation_execution_binding || pending?.execution_binding;
+      if (!pending || pending.status !== 'relay_in_flight' || !match.claimId
+        || pending.relay_claim_id !== match.claimId || pending.interaction_id !== match.interactionId
+        || pending.agent !== match.agent || pending.task_id !== match.taskId
+        || !sameContentReviewBinding(binding, match.binding, false)) {
+        failureCode = 'PENDING_INTERACTION_BINDING_MISMATCH';
+        throw new Error('Relay completion requires the exact claimed interaction, task and binding.');
+      }
+      if (hasPlanningQaRecovery(agent, match.agent)) assertPlanningQaReportBaseline(agent, { pending, binding, taskId: match.taskId });
+      if (agent.planning_contract_revision_id) {
+        revisionAttemptBaseline = assertPlanningContractRevisionExecutionBaseline(
+          agent, { pending, binding, taskId: match.taskId });
+        agent.execution_planning_revision_relay_claim_id = pending.relay_claim_id;
+      }
+      // Consume the real relay identity and install its complete hold in ONE
+      // atomic session commit. Never clear the answer first or mint a new ID.
+      agent.execution_claim_id = pending.relay_claim_id;
+      agent.execution_claim_started_at = pending.relay_started_at;
+      agent.execution_task_id = pending.task_id;
+      agent.execution_binding = cloneSessionValue(binding);
+      session.pending_interaction = null;
+    } else if (session.pending_interaction?.agent === match.agent
+      || (session.pending_interaction && !match.claimId)) {
+      failureCode = 'PENDING_INTERACTION_BINDING_MISMATCH';
+      throw new Error('A fresh completion cannot consume its own interaction or proceed unclaimed beside a pending peer.');
+    } else if (match.claimId && agent.execution_claim_id !== match.claimId) {
       outcome = { held: false, code: 'AGENT_EXECUTION_CLAIM_INVALID', error: `Execution claim for ${match.agent} does not own this result.` };
       return session;
     }
+    if (agent.planning_contract_revision_id && !match.interactionId) {
+      if (agent.execution_claim_state !== 'running') {
+        throw Object.assign(new Error('Planning revision completion requires a genuinely started claim.'),
+          { code: 'PLANNING_CONTRACT_REVISION_EXECUTION_REQUIRED' });
+      }
+      revisionAttemptBaseline = assertPlanningContractRevisionExecutionBaseline(
+        agent, { claimId: match.claimId, binding: agent.execution_binding, taskId: agent.execution_task_id });
+      delete agent.execution_planning_revision_relay_claim_id;
+    }
+    if (hasPlanningQaRecovery(agent, match.agent)) {
+      if (!match.claimId || (!match.interactionId && agent.execution_claim_state !== 'running')) {
+        throw Object.assign(new Error('Council QA must complete its genuinely started fresh claim.'), { code: 'COUNCIL_QA_EXECUTION_REQUIRED' });
+      }
+      subject = pinClaimedCouncilQa(sessionProjectDir, session, match.agent);
+      const baseline = match.interactionId ? agent.execution_qa_report_baseline
+        : assertPlanningQaReportBaseline(agent, { claimId: match.claimId, binding: agent.execution_binding, taskId: agent.execution_task_id });
+      const report = subject.plan.artifacts.find(item => item.path === 'artifacts/7-QA-Planning/qa-planning-report.md');
+      if (!report || report.sha256 === baseline.sha256) {
+        throw Object.assign(new Error('This QA execution must produce a report different from its own pre-spawn baseline.'), { code: 'COUNCIL_QA_REPORT_NOT_REGENERATED' });
+      }
+    }
+    if (agent.planning_contract_revision_id) {
+      const revision = session.planning_contract_revisions?.find(
+        item => item.request?.revision_id === agent.planning_contract_revision_id);
+      if (!revision || revision.status !== 'active') {
+        throw Object.assign(new Error('Planning revision output requires the single active direction.'),
+          { code: 'PLANNING_CONTRACT_REVISION_CONTEXT_INVALID' });
+      }
+      revisionOutput = pinPlanningContractRevisionOwnerOutput(sessionProjectDir, revision, match.agent,
+        revisionAttemptBaseline);
+    }
     agent.status = 'awaiting_advance';
     agent.execution_claim_state = 'awaiting_advance';
     agent.execution_finished_at = match.timestamp || new Date().toISOString();
+    agent.execution_result_status = match.resultStatus;
+    delete agent.execution_resume_status;
+    if (match.qaResult !== undefined) agent.execution_qa_result = { ...match.qaResult };
+    if (revisionOutput) {
+      agent.execution_planning_revision_result = {
+        execution_claim_id: agent.execution_claim_id,
+        execution_finished_at: agent.execution_finished_at,
+        subject: { gate_id: revisionOutput.plan.gate_id,
+          artifacts: cloneSessionValue(revisionOutput.plan.artifacts) },
+        owned_artifacts: cloneSessionValue(revisionOutput.owned_artifacts),
+        handoff: cloneSessionValue(revisionOutput.handoff),
+      };
+    }
+    if (subject) {
+      const active = activePlanningQaHistory(session, match.agent);
+      active.entry.result = {
+        execution_claim_id: agent.execution_claim_id, execution_finished_at: agent.execution_finished_at,
+        artifacts: cloneSessionValue(subject.plan.artifacts),
+        ...(match.qaResult ? { qa_result: cloneSessionValue(match.qaResult) } : {}),
+      };
+      if (active.kind === 'planning_contract_revision') {
+        const previousSubjects = session.planning_contract_revision_subjects || [];
+        if (!Array.isArray(previousSubjects)
+          || previousSubjects.some(item => item.revision_id === active.entry.request.revision_id)) {
+          throw Object.assign(new Error('The Planning revision already recorded its one genuine QA subject.'),
+            { code: 'PLANNING_CONTRACT_REVISION_SUBJECT_LIMIT' });
+        }
+        session.planning_contract_revision_subjects = [...previousSubjects, {
+          revision_id: active.entry.request.revision_id, gate_id: subject.plan.gate_id,
+          artifacts: cloneSessionValue(subject.plan.artifacts), execution_claim_id: agent.execution_claim_id,
+          execution_finished_at: agent.execution_finished_at, recorded_at: new Date().toISOString() }];
+      }
+    }
     delete agent.execution_claim_expires_at;
     delete agent.execution_started_at;
+    delete agent.execution_qa_report_baseline;
     outcome = { held: true };
     return session;
+  }, { beforeCommit: () => { subject?.assertCurrent(); revisionOutput?.assertCurrent(); match.verifySubject?.(); } });
+  return { ...result, ...outcome, held: result.saved && outcome.held,
+    ...(!result.saved ? { code: failureCode || result.code || 'SESSION_WRITE_FAILED' } : {}) };
+  } finally { subject?.close(); revisionOutput?.close(); }
+}
+
+const CONTENT_REVIEW_AGENTS = new Set(['detail', 'architect', 'ux', 'qa-planning']);
+const CONTENT_REVIEW_BINDING_KEYS = ['provider', 'provider_id', 'model', 'reasoning_configuration', 'catalog_snapshot_ref'];
+const CONTENT_REVIEW_REASON_MAX_BYTES = 8192;
+// Separate authority and history from content rejection, but retain a finite
+// total recovery budget. New gate ids or cosmetic edits cannot reset it.
+export const MAX_COUNCIL_QA_REVALIDATIONS = 1;
+
+function sameContentReviewBinding(left, right, requireCatalog = true) {
+  return Boolean(left && right && left.provider && left.model && (!requireCatalog || left.catalog_snapshot_ref)
+    && CONTENT_REVIEW_BINDING_KEYS.every(key => (left[key] || null) === (right[key] || null)));
+}
+
+function qaInvocationBinding(artifact) {
+  const invocation = resolveRuntimeInvocationV2({ artifact, agent: 'qa-planning' });
+  return { provider: invocation.harness_id, provider_id: invocation.provider_id,
+    model: invocation.model_pin.model_id, reasoning_configuration: invocation.model_pin.reasoning_configuration,
+    catalog_snapshot_ref: invocation.model_pin.catalog_snapshot_ref };
+}
+
+function hasPlanningQaRecovery(agent, agentName = 'qa-planning') {
+  return agentName === 'qa-planning' && Boolean(agent?.council_revalidation_pending || agent?.planning_reconciliation_pending
+    || agent?.planning_contract_revision_id);
+}
+
+function assertPlanningQaReportBaseline(agent, { claimId, pending, binding, taskId }) {
+  const baseline = agent.execution_qa_report_baseline;
+  if (!baseline || typeof baseline.origin_claim_id !== 'string' || !baseline.origin_claim_id
+    || !(baseline.sha256 === null || /^[a-f0-9]{64}$/.test(baseline.sha256 || ''))
+    || baseline.task_id !== taskId || !sameContentReviewBinding(baseline.binding, binding)
+    || (pending ? canonicalSerialize(pending.qa_report_baseline) !== canonicalSerialize(baseline)
+      : baseline.origin_claim_id !== claimId)) {
+    throw Object.assign(new Error('QA report baseline must belong to this exact started execution and relay lineage.'), { code: 'COUNCIL_QA_REPORT_BASELINE_INVALID' });
+  }
+  return baseline;
+}
+
+function assertPlanningContractRevisionExecutionBaseline(agent, { claimId, pending, binding, taskId }) {
+  const baseline = agent.execution_planning_revision_baseline;
+  if (!baseline || typeof baseline.origin_claim_id !== 'string' || !baseline.origin_claim_id
+    || baseline.task_id !== taskId || !sameContentReviewBinding(baseline.binding, binding)
+    || !Array.isArray(baseline.owned_artifacts) || baseline.owned_artifacts.length === 0
+    || !baseline.owned_artifacts.every(item => typeof item?.path === 'string' && /^[a-f0-9]{64}$/.test(item.sha256 || ''))
+    || !Array.isArray(baseline.subject_artifacts) || baseline.subject_artifacts.length < baseline.owned_artifacts.length
+    || !baseline.subject_artifacts.every(item => typeof item?.path === 'string' && /^[a-f0-9]{64}$/.test(item.sha256 || ''))
+    || typeof baseline.handoff?.path !== 'string' || !/^[a-f0-9]{64}$/.test(baseline.handoff.sha256 || '')
+    || (pending ? canonicalSerialize(pending.planning_revision_baseline) !== canonicalSerialize(baseline)
+      : baseline.origin_claim_id !== claimId)) {
+    throw Object.assign(new Error('Planning contract revision baseline must belong to this exact execution and relay lineage.'),
+      { code: 'PLANNING_CONTRACT_REVISION_EXECUTION_BASELINE_INVALID' });
+  }
+  return baseline;
+}
+
+/** Exactly one active authority, with separate immutable recovery histories. */
+function activePlanningQaHistory(session, agentName) {
+  const agent = session.agents?.[agentName];
+  const fail = message => { throw Object.assign(new Error(message), { code: 'COUNCIL_QA_EXECUTION_REQUIRED' }); };
+  if (agentName !== 'qa-planning' || !hasPlanningQaRecovery(agent)) {
+    fail('Exactly one active Planning QA recovery authority is required.');
+  }
+  if (agent.planning_contract_revision_id) {
+    const { history } = planningContractRevisionHistory(session);
+    const active = history.filter(item => item.status === 'active');
+    const entry = active[0];
+    if (active.length !== 1 || entry.request?.revision_id !== agent.planning_contract_revision_id
+      || agent.council_revalidation_pending || agent.planning_reconciliation_pending
+      || !Array.isArray(agent.council_revalidations) || agent.council_revalidations.length !== 1
+      || !Array.isArray(agent.planning_reconciliations)
+      || agent.planning_reconciliations.filter(item => item.authorization).length !== 1
+      || session.language !== entry.request.language
+      || !['detail', 'architect', 'ux'].every(owner => entry.owner_results?.[owner])) {
+      fail('Fresh QA requires the single active contract revision and genuine recompletion of every upstream owner.');
+    }
+    return { kind: 'planning_contract_revision', entry, binding: entry.request.source_held_qa.binding };
+  }
+  if ((agent.council_revalidation_pending && agent.planning_reconciliation_pending)
+    || !Array.isArray(agent.council_revalidations) || agent.council_revalidations.length !== 1) {
+    fail('Exactly one active Planning QA recovery authority is required.');
+  }
+  if (!agent.planning_reconciliation_pending) return { kind: 'council_revalidation', entry: agent.council_revalidations[0] };
+  const history = agent.planning_reconciliations;
+  const authorized = Array.isArray(history) ? history.filter(item => item.authorization) : [];
+  if (authorized.length !== 1 || history.length > MAX_PLANNING_RECONCILIATION_TARGETS) fail('A single consumed reconciliation authority is required.');
+  const entry = authorized[0], prior = agent.council_revalidations[0], held = entry.request?.held_qa;
+  if (entry.status !== 'authorized' || !entry.authorization.fresh_claim_id
+    || prior.result?.execution_claim_id !== held?.claim_id
+    || prior.result?.execution_finished_at !== held?.finished_at
+    || canonicalSerialize(prior.result?.artifacts) !== canonicalSerialize(entry.request?.source_artifacts)
+    || canonicalSerialize(prior.result?.qa_result) !== canonicalSerialize(held?.qa_result)
+    || !sameContentReviewBinding(prior.binding, held?.binding)) {
+    fail('Consumed reconciliation must retain the original held QA and source manifest.');
+  }
+  return { kind: 'planning_reconciliation', entry, artifacts: entry.request.target_artifacts, binding: held.binding };
+}
+
+function pinClaimedCouncilQa(projectDir, session, agentName, { allowOwnInteraction = false, expectedArtifacts, inputsOnly = true, excludeQaReport = false } = {}) {
+  const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+  const active = activePlanningQaHistory(session, agentName);
+  const subject = pinPlanningQaSubject(projectDir, expectedArtifacts || active.artifacts || active.entry.artifacts, { inputsOnly, excludeQaReport });
+  try {
+    const binding = qaInvocationBinding(subject.artifact);
+    if (!sameContentReviewBinding(binding, active.binding || active.entry.binding)) {
+      fail('CONTENT_REVIEW_BINDING_MISMATCH', 'The selected QA route changed after council revalidation.');
+    }
+    const verifyRecovery = () => {
+      if (active.kind === 'planning_contract_revision') {
+        authenticatePlanningContractRevisionHistory(projectDir, session);
+        readAttestedPlanningContractRevision(projectDir, active.entry.request,
+          active.entry.launch_nonce, active.entry.decision_sha256);
+        return;
+      }
+      if (active.kind === 'planning_reconciliation') {
+        const decision = readAttestedPlanningReconciliationDecision(projectDir, subject, active.entry.request, active.entry.authorization.decision_sha256);
+        if (decision.record.decision.decision !== 'authorize-qa-revalidation'
+          || decision.record.decision.launch_nonce !== active.entry.launch_nonce
+          || active.entry.request.language !== session.language) {
+          fail('PLANNING_RECONCILIATION_DECISION_UNTRUSTED', 'Fresh QA requires the exact consumed positive reconciliation and original language.');
+        }
+      }
+    };
+    verifyRecovery();
+    assertPlanningContentBoundary(projectDir, session, { agent: agentName, binding }, fail, { allowOwnInteraction });
+    assertV2PlanningPredecessors(session, agentName);
+    return Object.freeze({ ...subject, assertCurrent() { subject.assertCurrent(); verifyRecovery(); } });
+  } catch (error) { subject.close(); throw error; }
+}
+
+/** The fresh QA verdict is authority only for the exact bytes it actually held. */
+export function pinHeldCouncilQaSubject(projectDir, session) {
+  const agent = session?.agents?.['qa-planning'];
+  if (!hasPlanningQaRecovery(agent, 'qa-planning')) return null;
+  const active = activePlanningQaHistory(session, 'qa-planning');
+  const result = active.entry.result;
+  const revisionSubject = active.kind === 'planning_contract_revision'
+    ? session.planning_contract_revision_subjects?.filter(item => item.revision_id === active.entry.request.revision_id)
+    : null;
+  if (agent.status !== 'awaiting_advance' || agent.execution_claim_state !== 'awaiting_advance'
+    || agent.execution_result_status !== 'complete' || !result?.artifacts
+    || result.execution_claim_id !== agent.execution_claim_id || result.execution_finished_at !== agent.execution_finished_at
+    || !result.qa_result || !['score', 'gate_result', 'blocking_count'].every(key => result.qa_result[key] === agent.execution_qa_result?.[key])
+    || (revisionSubject && (revisionSubject.length !== 1
+      || revisionSubject[0].execution_claim_id !== result.execution_claim_id
+      || revisionSubject[0].execution_finished_at !== result.execution_finished_at
+      || canonicalSerialize(revisionSubject[0].artifacts) !== canonicalSerialize(result.artifacts)))) {
+    throw Object.assign(new Error('The new QA verdict must be held with its exact claim and result manifest.'), { code: 'COUNCIL_QA_HELD_RESULT_MISMATCH' });
+  }
+  return pinClaimedCouncilQa(projectDir, session, 'qa-planning', { expectedArtifacts: result.artifacts, inputsOnly: false });
+}
+
+/** Feedback is data for the validated next execution/relay, never an approval. */
+function claimContentReviewContext(projectDir, session, match) {
+  assertPlanningContractRevisionOwner(session, [match.agent], projectDir);
+  const agent = session.agents?.[match.agent];
+  if (!agent?.content_review_pending) return null;
+  const reviews = agent.content_rejections;
+  const revision = agent.planning_contract_revision_id
+    ? session.planning_contract_revisions?.find(item => item.request?.revision_id === agent.planning_contract_revision_id)
+    : null;
+  let historicalRejectionCount;
+  if (!match.claimId || !match.taskId || agent.content_review_task_id !== match.taskId
+    || !sameContentReviewBinding(agent.execution_binding, match.binding)
+    || (!revision && (!Array.isArray(reviews) || !reviews.length || reviews.length > MAX_CORRECTION_CYCLES
+      || !sameContentReviewBinding(reviews.at(-1).binding, match.binding)))) {
+    throw Object.assign(new Error('Content-review feedback does not match this claimed task and binding.'),
+      { code: 'CONTENT_REVIEW_BINDING_MISMATCH' });
+  }
+  if (revision) {
+    if (revision.status !== 'active' || planningContractRevisionHistory(session).tip !== revision
+      || !PLANNING_CONTRACT_REVISION_OWNERS.includes(match.agent)
+      || revision.request.language !== session.language) {
+      throw Object.assign(new Error('Planning contract direction is not active for this exact owner and language.'),
+        { code: 'PLANNING_CONTRACT_REVISION_CONTEXT_INVALID' });
+    }
+    readAttestedPlanningContractRevision(projectDir, revision.request, revision.launch_nonce, revision.decision_sha256);
+    // Settlement archives the exact rejection prefix. Later rejected owner
+    // results append to it; dates cannot distinguish inherited and current work.
+    const archivedOwner = revision.archived?.previous_agents?.[match.agent];
+    const historicalReviews = archivedOwner?.content_rejections === undefined ? [] : archivedOwner.content_rejections;
+    const currentReviews = reviews === undefined ? [] : reviews;
+    if (!archivedOwner || typeof archivedOwner !== 'object' || Array.isArray(archivedOwner)
+      || !Array.isArray(historicalReviews) || !Array.isArray(currentReviews)
+      || historicalReviews.length > currentReviews.length
+      || canonicalSerialize(currentReviews.slice(0, historicalReviews.length)) !== canonicalSerialize(historicalReviews)) {
+      throw Object.assign(new Error('Planning revision rejection history must retain its exact archived prefix.'),
+        { code: 'PLANNING_CONTRACT_REVISION_CONTEXT_INVALID' });
+    }
+    historicalRejectionCount = historicalReviews.length;
+  }
+  const revalidation = agent.council_revalidation_pending ? agent.council_revalidations?.at(-1) : null;
+  if (agent.council_revalidation_pending && (!revalidation || match.agent !== 'qa-planning'
+    || !sameContentReviewBinding(revalidation.binding, match.binding))) {
+    throw Object.assign(new Error('Council QA revalidation does not match this execution.'), { code: 'CONTENT_REVIEW_BINDING_MISMATCH' });
+  }
+  const reconciliation = agent.planning_reconciliation_pending ? activePlanningQaHistory(session, match.agent) : null;
+  if (reconciliation && !sameContentReviewBinding(reconciliation.binding, match.binding)) {
+    throw Object.assign(new Error('Planning reconciliation does not match this QA execution.'), { code: 'CONTENT_REVIEW_BINDING_MISMATCH' });
+  }
+  return { agent: match.agent, taskId: match.taskId, claimId: match.claimId,
+    binding: cloneSessionValue(match.binding),
+    rejections: (reviews || []).map(review => ({ reason: review.reason, rejected_at: review.rejected_at,
+      execution_claim_id: review.execution.execution_claim_id,
+      execution_finished_at: review.execution.execution_finished_at })),
+    ...(revalidation ? { council_revalidation: {
+      source_gate_id: revalidation.source_gate_id, artifacts: cloneSessionValue(revalidation.artifacts),
+      blockers: cloneSessionValue(revalidation.blockers),
+    } } : {}),
+    ...(reconciliation ? { planning_reconciliation: {
+      reconciliation_id: reconciliation.entry.request.reconciliation_id,
+      decision_sha256: reconciliation.entry.authorization.decision_sha256,
+      source_gate_id: reconciliation.entry.request.source_gate_id,
+      artifacts: cloneSessionValue(reconciliation.artifacts),
+      blockers: cloneSessionValue(reconciliation.entry.request.blockers),
+    } } : {}),
+    ...(revision ? { planning_contract_revision: {
+      revision_id: revision.request.revision_id, source_gate_id: revision.request.source_gate_id,
+      source_decision_sha256: revision.request.source_decision_sha256,
+      old_subject: cloneSessionValue(revision.request.old_subject),
+      accepted_blocker_ids: cloneSessionValue(revision.request.accepted_blocker_ids),
+      direction: cloneSessionValue(revision.request.direction), authority_scope: 'pipeline-reopening-only',
+      historical_rejection_count: historicalRejectionCount,
+    } } : {}),
+  };
+}
+
+function assertHeldPlanningContent(projectDir, session, match, fail) {
+    const agent = session.agents?.[match.agent];
+    if (!CONTENT_REVIEW_AGENTS.has(match.agent) || session.current_agent !== match.agent
+      || agent?.status !== 'awaiting_advance' || agent.execution_claim_state !== 'awaiting_advance'
+      || agent.execution_result_status !== 'complete' || session.completed_agents?.includes(match.agent)
+      || typeof match.claimId !== 'string' || !match.claimId || agent.execution_claim_id !== match.claimId
+      || typeof match.finishedAt !== 'string' || !Number.isFinite(Date.parse(match.finishedAt))
+      || agent.execution_finished_at !== match.finishedAt) {
+      fail('AGENT_RESULT_REJECTION_MISMATCH', 'Rejection requires the exact current, unapproved complete Planning result.');
+    }
+    assertPlanningContentBoundary(projectDir, session, match, fail);
+    return agent;
+}
+
+function assertPlanningContentBoundary(projectDir, session, match, fail, { allowOwnInteraction = false } = {}) {
+    const agent = session.agents?.[match.agent];
+    if (session.current_agent !== match.agent || session.completed_agents?.includes(match.agent)) {
+      fail('AGENT_RESULT_REJECTION_MISMATCH', 'The unapproved Planning agent must still own the session.');
+    }
+    if (session.mode !== 'plan' || session.rail_handoff_id || session.rail_handoff_path || session.rail_state) {
+      fail('CONTENT_REVIEW_SEALED', 'Content rejection cannot reopen sealed Planning or RAIL.');
+    }
+    const handoffs = join(projectDir, '.chati/v2/rail/handoffs');
+    try {
+      const stat = lstatSync(handoffs);
+      if (!stat.isDirectory() || stat.isSymbolicLink() || storedRailHandoffEntries(handoffs).length) {
+        fail('CONTENT_REVIEW_SEALED', 'Stored RAIL handoffs prohibit content rejection.');
+      }
+    } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (!sameContentReviewBinding(session.current_execution_binding, match.binding)
+      || (agent?.execution_binding && !sameContentReviewBinding(agent.execution_binding, match.binding))) {
+      fail('CONTENT_REVIEW_BINDING_MISMATCH', 'The held execution binding must match the validated installation route.');
+    }
+    const later = AGENT_PIPELINE.slice(AGENT_PIPELINE.findIndex(entry => entry.name === match.agent) + 1)
+      .filter(entry => entry.phase === 'plan').map(entry => entry.name);
+    if ((session.pending_interaction && !(allowOwnInteraction && session.pending_interaction.agent === match.agent))
+      || Object.entries(session.agents || {}).some(([name, state]) => name !== match.agent
+      && (state.execution_claim_id || state.execution_claim_state || ['in_progress', 'awaiting_advance', 'waiting_for_user'].includes(state.status)
+        || (later.includes(name) && (state.status === 'completed' || session.completed_agents?.includes(name)))))) {
+      fail('CONTENT_REVIEW_DEPENDENTS_ACTIVE', 'Settle other claims, interactions and dependent work before rejecting this result.');
+    }
+}
+
+/** Read-only precondition for a separately authenticated final QA recovery. */
+export function assertPlanningReconciliationBoundary(projectDir, session, match, binding) {
+  const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+  if (match.agent !== 'qa-planning') fail('PLANNING_RECONCILIATION_AGENT_REQUIRED', 'Planning reconciliation requires QA-Planning.');
+  const agent = assertHeldPlanningContent(projectDir, session, { ...match, binding }, fail);
+  assertV2PlanningPredecessors(session, match.agent);
+  if (agent.content_rejections?.length !== MAX_CORRECTION_CYCLES
+    || agent.council_revalidations?.length !== MAX_COUNCIL_QA_REVALIDATIONS
+    || !agent.council_revalidation_pending) {
+    fail('PLANNING_RECONCILIATION_HISTORY_REQUIRED', 'Planning reconciliation requires the exact exhausted QA recovery history.');
+  }
+  const prior = agent.council_revalidations[0];
+  const held = prior.result;
+  if (!held?.artifacts || held.execution_claim_id !== match.claimId
+    || held.execution_finished_at !== match.finishedAt
+    || !sameContentReviewBinding(prior.binding, binding)
+    || !isPlanningQaOutcomeValid(agent.execution_qa_result, getQaThreshold(match.agent, projectDir))
+    || agent.execution_qa_result.gate_result !== 'approved'
+    || !['score', 'gate_result', 'blocking_count'].every(key => held.qa_result?.[key] === agent.execution_qa_result[key])) {
+    fail('PLANNING_RECONCILIATION_HELD_QA_MISMATCH', 'The held QA must be the genuine result of the single prior council revalidation.');
+  }
+  return prior;
+}
+
+// A distinct recovery authority does not reset either existing correction budget.
+// At most three distinct targets may be assessed, and at most one may authorize QA.
+export const MAX_PLANNING_RECONCILIATION_TARGETS = 3;
+
+/** Reserve before inference; identical requests can only retrieve the same slot. */
+export function reservePlanningReconciliation(projectDir, match = {}) {
+  let subject;
+  let outcome;
+  try {
+    const result = mutateSession(projectDir, session => {
+      subject = pinPlanningReconciliation(projectDir, match, session);
+      const request = subject.request;
+      const qa = session.agents['qa-planning'];
+      const history = qa.planning_reconciliations || [];
+      if (!Array.isArray(history) || history.length > MAX_PLANNING_RECONCILIATION_TARGETS) {
+        throw Object.assign(new Error('Planning reconciliation history is invalid.'), { code: 'PLANNING_RECONCILIATION_HISTORY_INVALID' });
+      }
+      const previous = history.find(item => item.request?.reconciliation_id === request.reconciliation_id);
+      if (previous) {
+        if (canonicalSerialize(previous.request) !== canonicalSerialize(request)) {
+          throw Object.assign(new Error('Stored Planning reconciliation request differs from its recomputed subject.'), { code: 'PLANNING_RECONCILIATION_REQUEST_MISMATCH' });
+        }
+        outcome = { reservation: cloneSessionValue(previous), reused: true };
+        return session;
+      }
+      if (history.some(item => item.authorization)) {
+        throw Object.assign(new Error('The final Planning reconciliation QA authorization was already consumed.'), { code: 'PLANNING_RECONCILIATION_QA_LIMIT' });
+      }
+      if (history.some(item => ['reserved', 'running', 'outcome_unknown'].includes(item.status))) {
+        throw Object.assign(new Error('An unresolved Planning reconciliation cannot be replaced or relaunched by changing its target.'), { code: 'PLANNING_RECONCILIATION_IN_FLIGHT' });
+      }
+      if (history.length >= MAX_PLANNING_RECONCILIATION_TARGETS) {
+        throw Object.assign(new Error('Planning reconciliation target budget exhausted; new technical direction is required.'), { code: 'PLANNING_RECONCILIATION_TARGET_LIMIT' });
+      }
+      const reservation = { request: cloneSessionValue(request), status: 'reserved',
+        launch_nonce: randomUUID(), reserved_at: new Date().toISOString() };
+      qa.planning_reconciliations = [...history, reservation];
+      outcome = { reservation: cloneSessionValue(reservation), reused: false };
+      return session;
+    }, { beforeCommit: () => subject?.assertCurrent() });
+    return { ...result, reserved: result.saved, ...(result.saved ? outcome : {}) };
+  } finally { subject?.close(); }
+}
+
+/** Single pre-spawn admission. Expiration never resurrects an unknown launch. */
+export function startPlanningReconciliation(projectDir, match = {}) {
+  let subject;
+  let outcome;
+  try {
+    const result = mutateSession(projectDir, session => {
+      subject = pinPlanningReconciliation(projectDir, match, session);
+      const reservation = session.agents['qa-planning'].planning_reconciliations?.find(
+        item => item.request?.reconciliation_id === subject.request.reconciliation_id);
+      if (!reservation || reservation.status !== 'reserved'
+        || canonicalSerialize(reservation.request) !== canonicalSerialize(subject.request)
+        || reservation.launch_nonce !== match.launchNonce
+        || subject.request.reconciliation_id !== match.reconciliationId) {
+        throw Object.assign(new Error('Only the exact never-started Planning reconciliation reservation may launch.'), { code: 'PLANNING_RECONCILIATION_LAUNCH_MISMATCH' });
+      }
+      reservation.status = 'running';
+      reservation.started_at = new Date().toISOString();
+      outcome = { reservation: cloneSessionValue(reservation) };
+      return session;
+    }, { beforeCommit: () => subject?.assertCurrent() });
+    return { ...result, started: result.saved, ...(result.saved ? outcome : {}) };
+  } finally { subject?.close(); }
+}
+
+/** Consume a completed attested assessment atomically, never a caller's verdict. */
+export function settlePlanningReconciliation(projectDir, match = {}) {
+  let subject;
+  let outcome;
+  try {
+    const result = mutateSession(projectDir, session => {
+      const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+      const agent = session.agents?.['qa-planning'];
+      const entry = agent?.planning_reconciliations?.find(item => item.request?.reconciliation_id === match.reconciliationId);
+      if (match.agent !== 'qa-planning' || !entry || entry.launch_nonce !== match.launchNonce
+        || entry.request.held_qa.claim_id !== match.claimId || entry.request.held_qa.finished_at !== match.finishedAt
+        || entry.request.source_gate_id !== match.gateId) {
+        fail('PLANNING_RECONCILIATION_LAUNCH_MISMATCH', 'Settlement requires the exact reserved request, held result and nonce.');
+      }
+      if (entry.authorization) {
+        if (!agent.planning_reconciliation_pending || agent.status !== 'in_progress'
+          || agent.execution_claim_state !== 'reserved' || Date.parse(agent.execution_claim_expires_at) <= Date.now()
+          || !Number.isFinite(Date.parse(agent.execution_claim_expires_at))
+          || agent.execution_claim_id !== entry.authorization.fresh_claim_id) {
+          fail('PLANNING_RECONCILIATION_QA_LIMIT', 'Consumed authorization cannot create or resurrect another QA claim.');
+        }
+        subject = pinClaimedCouncilQa(projectDir, session, 'qa-planning', { excludeQaReport: true });
+        outcome = { authorized: true, claimId: agent.execution_claim_id, binding: qaInvocationBinding(subject.artifact), reused: true };
+        return session;
+      }
+      if (!['running', 'outcome_unknown', 'denied'].includes(entry.status)) {
+        fail('PLANNING_RECONCILIATION_LAUNCH_MISMATCH', 'Only a started assessment or its cached denial may settle.');
+      }
+      subject = pinPlanningReconciliation(projectDir, match, session);
+      if (canonicalSerialize(entry.request) !== canonicalSerialize(subject.request)) {
+        fail('PLANNING_RECONCILIATION_REQUEST_MISMATCH', 'Reconciliation target changed before settlement.');
+      }
+      const decision = readPlanningReconciliationDecision(subject);
+      if (decision.record.decision.launch_nonce !== entry.launch_nonce) {
+        fail('PLANNING_RECONCILIATION_LAUNCH_MISMATCH', 'Decision does not belong to the started reservation.');
+      }
+      if (decision.record.decision.decision === 'deny-qa-revalidation') {
+        entry.status = 'denied';
+        entry.decision_sha256 = decision.sha256;
+        entry.settled_at ||= new Date().toISOString();
+        outcome = { authorized: false, decision: 'deny-qa-revalidation', decision_path: decision.path,
+          assessments: cloneSessionValue(decision.record.decision.assessments) };
+        return session;
+      }
+      if (!['running', 'outcome_unknown'].includes(entry.status) || agent.planning_reconciliations.some(item => item.authorization)) {
+        fail('PLANNING_RECONCILIATION_QA_LIMIT', 'Only one positive reconciliation may authorize fresh QA.');
+      }
+      const now = new Date(), claimId = randomUUID(), binding = subject.binding;
+      const execution = Object.fromEntries(Object.entries(agent).filter(([key]) => key.startsWith('execution_') || key === 'status' || key === 'score'));
+      entry.status = 'authorized';
+      entry.authorization = { decision_sha256: decision.sha256, consumed_at: now.toISOString(), fresh_claim_id: claimId,
+        execution: cloneSessionValue(execution) };
+      // Keep the original council history untouched. The new history becomes
+      // the sole active authority, without resetting either earlier budget.
+      delete agent.council_revalidation_pending;
+      agent.planning_reconciliation_pending = true;
+      agent.content_review_pending = true;
+      agent.content_review_task_id = 'qa-planning-task';
+      agent.status = 'in_progress';
+      agent.execution_resume_status = 'pending_rework';
+      agent.execution_claim_id = claimId;
+      agent.execution_claim_state = 'reserved';
+      agent.execution_claim_started_at = now.toISOString();
+      agent.execution_claim_expires_at = new Date(now.getTime() + 30 * 60 * 1000).toISOString();
+      agent.execution_task_id = 'qa-planning-task';
+      agent.execution_binding = binding;
+      for (const key of ['execution_started_at', 'execution_finished_at', 'execution_result_status', 'execution_qa_result']) delete agent[key];
+      outcome = { authorized: true, claimId, binding, reused: false };
+      return session;
+    }, { beforeCommit: () => subject?.assertCurrent() });
+    return { ...result, settled: result.saved, ...(result.saved ? outcome : {}) };
+  } finally { subject?.close(); }
+}
+
+/** A lost/unverifiable result never makes a started assessment launchable again. */
+export function recordPlanningReconciliationFailure(projectDir, match = {}, code = 'PLANNING_RECONCILIATION_FAILED') {
+  const result = mutateSession(projectDir, session => {
+    const entry = session.agents?.['qa-planning']?.planning_reconciliations?.find(
+      item => item.request?.reconciliation_id === match.reconciliationId);
+    if (!entry || entry.status !== 'running' || entry.launch_nonce !== match.launchNonce
+      || entry.request.held_qa.claim_id !== match.claimId || entry.request.held_qa.finished_at !== match.finishedAt
+      || entry.request.source_gate_id !== match.gateId || match.agent !== 'qa-planning') {
+      throw Object.assign(new Error('Failure does not match a started reconciliation.'), { code: 'PLANNING_RECONCILIATION_LAUNCH_MISMATCH' });
+    }
+    entry.status = 'outcome_unknown';
+    entry.failure = { code: /^[A-Z][A-Z0-9_]{0,100}$/.test(code) ? code : 'PLANNING_RECONCILIATION_FAILED',
+      recorded_at: new Date().toISOString() };
+    return session;
+  });
+  return { ...result, recorded: result.saved };
+}
+
+/** Exact exhausted hold required before a controller may reopen Planning ownership. */
+export function assertPlanningContractRevisionBoundary(projectDir, session, match, binding, subject) {
+  const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+  if (match.agent !== 'qa-planning') {
+    fail('PLANNING_CONTRACT_REVISION_AGENT_REQUIRED', 'Planning contract revision requires the held QA-Planning result.');
+  }
+  const agent = assertHeldPlanningContent(projectDir, session, { ...match, binding }, fail);
+  assertV2PlanningPredecessors(session, 'qa-planning');
+  if (match.previousRevisionId !== undefined) {
+    const lineage = authenticatePlanningContractRevisionHistory(projectDir, session);
+    const previous = lineage.pending ? lineage.history.at(-2) : lineage.tip;
+    if (previous?.status === 'completed' && previous.request.revision_id === match.previousRevisionId) {
+      if (agent.planning_contract_revision_id || agent.council_revalidation_pending || agent.planning_reconciliation_pending
+        || agent.execution_planning_revision_result || session.language !== previous.request.language
+        || !sameContentReviewBinding(previous.request.source_held_qa.binding, binding)
+        || !isPlanningQaOutcomeValid(agent.execution_qa_result, getQaThreshold('qa-planning', projectDir))
+        || agent.execution_qa_result.gate_result !== 'approved'
+        || agent.content_rejections?.length !== MAX_CORRECTION_CYCLES
+        || agent.council_revalidations?.length !== MAX_COUNCIL_QA_REVALIDATIONS
+        || !Array.isArray(agent.planning_reconciliations)
+        || agent.planning_reconciliations.some(item => !['authorized', 'denied'].includes(item.status))
+        || agent.planning_reconciliations.filter(item => item.authorization).length !== 1) {
+        fail('PLANNING_CONTRACT_REVISION_HELD_QA_MISMATCH', 'Post-correction continuation requires a fresh normal approved QA on the original route and language with exhausted, terminal recovery history.');
+      }
+      const held = canonicalize({ claim_id: match.claimId, finished_at: match.finishedAt, binding, qa_result: agent.execution_qa_result });
+      const correction = derivePlanningCorrectionSource(projectDir, session, previous, held);
+      for (const owner of correction.owners) {
+        if (!sameContentReviewBinding(owner.binding, previous.owner_results[owner.agent]?.execution_binding)) {
+          fail('CONTENT_REVIEW_BINDING_MISMATCH', 'Corrected owners must retain their preceding installed execution bindings.');
+        }
+      }
+      return { agent, held, correction, reconciliation: cloneSessionValue(previous.request.source_reconciliation),
+        previous: canonicalize({ revision_id: previous.request.revision_id, launch_nonce: previous.launch_nonce,
+          decision_sha256: previous.decision_sha256, result_sha256: planningRevisionTerminalDigest(session, previous) }) };
+    }
+    if (!previous || previous.request.revision_id !== match.previousRevisionId
+      || previous !== lineage.active
+      || agent.planning_contract_revision_id !== previous.request.revision_id
+      || (lineage.pending && lineage.pending.request.previous_revision?.revision_id !== previous.request.revision_id)
+      || (!lineage.pending && lineage.tip !== previous)
+      || agent.council_revalidation_pending || agent.planning_reconciliation_pending
+      || agent.planning_reconciliations?.some(item => ['reserved', 'running', 'outcome_unknown'].includes(item.status))) {
+      fail('PLANNING_CONTRACT_REVISION_PREDECESSOR_INVALID', 'Explicit continuation requires the active predecessor with a terminal held QA and no unresolved recovery.');
+    }
+    const active = activePlanningQaHistory(session, 'qa-planning');
+    const held = active.entry.result;
+    if (active.kind !== 'planning_contract_revision' || active.entry !== previous
+      || held?.execution_claim_id !== match.claimId || held.execution_finished_at !== match.finishedAt
+      || !sameContentReviewBinding(active.binding, binding)
+      || !isPlanningQaOutcomeValid(agent.execution_qa_result, getQaThreshold('qa-planning', projectDir))
+      || agent.execution_qa_result.gate_result !== 'approved'
+      || canonicalSerialize(held.qa_result) !== canonicalSerialize(agent.execution_qa_result)
+      || canonicalSerialize(held.artifacts) !== canonicalSerialize(subject.plan.artifacts)
+      || agent.content_rejections?.length !== MAX_CORRECTION_CYCLES
+      || agent.council_revalidations?.length !== MAX_COUNCIL_QA_REVALIDATIONS) {
+      fail('PLANNING_CONTRACT_REVISION_HELD_QA_MISMATCH', 'Continuation must consume the exact genuine QA subject of the preceding direction.');
+    }
+    const resultDigest = planningRevisionResultDigest(session, previous);
+    if (session.planning_contract_revision_subjects.find(item => item.revision_id === previous.request.revision_id).gate_id !== subject.plan.gate_id) {
+      fail('PLANNING_CONTRACT_REVISION_HELD_QA_MISMATCH', 'The preceding QA subject must name this exact council gate.');
+    }
+    const ownedHold = agent.execution_planning_revision_result;
+    if (ownedHold?.execution_claim_id !== match.claimId || ownedHold.execution_finished_at !== match.finishedAt
+      || canonicalSerialize(ownedHold.subject) !== canonicalSerialize({ gate_id: subject.plan.gate_id, artifacts: subject.plan.artifacts })) {
+      fail('PLANNING_CONTRACT_REVISION_HELD_QA_MISMATCH', 'Continuation cannot replace the produced QA subject with caller-authored bytes.');
+    }
+    return { agent, held: canonicalize({ claim_id: match.claimId, finished_at: match.finishedAt, binding, qa_result: held.qa_result }),
+      reconciliation: cloneSessionValue(previous.request.source_reconciliation),
+      previous: canonicalize({ revision_id: previous.request.revision_id, launch_nonce: previous.launch_nonce,
+        decision_sha256: previous.decision_sha256, result_sha256: resultDigest }) };
+  }
+  const active = activePlanningQaHistory(session, 'qa-planning');
+  const reconciliation = agent.planning_reconciliations;
+  if (active.kind !== 'planning_reconciliation' || !agent.planning_reconciliation_pending
+    || agent.content_rejections?.length !== MAX_CORRECTION_CYCLES
+    || agent.council_revalidations?.length !== MAX_COUNCIL_QA_REVALIDATIONS
+    || !Array.isArray(reconciliation) || reconciliation.filter(item => item.authorization).length !== 1
+    || reconciliation.find(item => item.authorization)?.status !== 'authorized') {
+    fail('PLANNING_CONTRACT_REVISION_HISTORY_REQUIRED', 'Contract revision requires the exact exhausted rejection, council revalidation and consumed reconciliation history.');
+  }
+  const held = active.entry.result;
+  if (!held?.artifacts || held.execution_claim_id !== match.claimId
+    || held.execution_finished_at !== match.finishedAt
+    || canonicalSerialize(held.artifacts) !== canonicalSerialize(subject.plan.artifacts)
+    || !sameContentReviewBinding(active.binding, binding)
+    || !isPlanningQaOutcomeValid(agent.execution_qa_result, getQaThreshold('qa-planning', projectDir))
+    || !['score', 'gate_result', 'blocking_count'].every(key => held.qa_result?.[key] === agent.execution_qa_result?.[key])) {
+    fail('PLANNING_CONTRACT_REVISION_HELD_QA_MISMATCH', 'Contract revision requires the exact held QA claim, result and council subject.');
+  }
+  const positive = readAttestedPlanningReconciliationDecision(projectDir, subject, active.entry.request,
+    active.entry.authorization.decision_sha256);
+  if (positive.record.decision.decision !== 'authorize-qa-revalidation'
+    || positive.record.decision.launch_nonce !== active.entry.launch_nonce) {
+    fail('PLANNING_CONTRACT_REVISION_RECONCILIATION_UNTRUSTED',
+      'Contract revision requires the exact immutable positive reconciliation and launch nonce.');
+  }
+  return { agent, held: canonicalize({ claim_id: match.claimId, finished_at: match.finishedAt,
+    binding, qa_result: held.qa_result }), reconciliation: canonicalize({ request: active.entry.request,
+    launch_nonce: active.entry.launch_nonce, decision_sha256: positive.sha256 }) };
+}
+
+/** Reserve one content-addressed controller direction before its host record is persisted. */
+export function reservePlanningContractRevision(projectDir, match = {}) {
+  let subject;
+  let outcome;
+  try {
+    const result = mutateSession(projectDir, session => {
+      const direction = normalizePlanningContractDirection(match.direction);
+      const { history, tip } = authenticatePlanningContractRevisionHistory(projectDir, session);
+      if (!history.length && session.planning_contract_revision_subjects !== undefined
+        && (!Array.isArray(session.planning_contract_revision_subjects)
+          || session.planning_contract_revision_subjects.length)) {
+        throw Object.assign(new Error('Planning contract revision subject history exists without its immutable direction.'),
+          { code: 'PLANNING_CONTRACT_REVISION_HISTORY_INVALID' });
+      }
+      const previous = history.find(item => item.request.source_gate_id === match.gateId);
+      if (previous) {
+        const same = previous.request?.source_gate_id === match.gateId
+          && previous.request?.source_held_qa?.claim_id === match.claimId
+          && previous.request?.source_held_qa?.finished_at === match.finishedAt
+          && canonicalSerialize(previous.request?.direction) === canonicalSerialize(direction)
+          && (previous.request.previous_revision?.revision_id ?? undefined) === match.previousRevisionId;
+        if (!same) {
+          throw Object.assign(new Error('Only one bounded Planning contract direction is allowed for this history.'), { code: 'PLANNING_CONTRACT_REVISION_LIMIT' });
+        }
+        if (previous !== tip) throw Object.assign(new Error('A superseded direction cannot be replayed as current authority.'),
+          { code: 'PLANNING_CONTRACT_REVISION_SUPERSEDED' });
+        if (previous.status === 'reserved' && previous.request.schema_version === 3) {
+          subject = pinPlanningContractRevision(projectDir, { ...match, direction }, session);
+          if (canonicalSerialize(subject.request) !== canonicalSerialize(previous.request)) {
+            throw Object.assign(new Error('The reserved normal correction source changed before retry.'),
+              { code: 'PLANNING_CONTRACT_REVISION_SUBJECT_CHANGED' });
+          }
+        }
+        outcome = { reservation: cloneSessionValue(previous), reused: true };
+        return session;
+      }
+      if (history.length && match.previousRevisionId === undefined) {
+        throw Object.assign(new Error('Automatic recovery is exhausted. A new controller direction requires the exact --previous-revision; no budget was renewed.'),
+          { code: 'PLANNING_CONTRACT_REVISION_LIMIT' });
+      }
+      if (match.previousRevisionId !== undefined && (!tip || !['active', 'completed'].includes(tip.status)
+        || tip.request.revision_id !== match.previousRevisionId
+        || tip.request.direction.instruction === direction.instruction
+        || history.some(item => item.request.source_held_qa.claim_id === match.claimId))) {
+        throw Object.assign(new Error('Continuation requires a distinct explicit direction, a qualified tip and a previously unconsumed genuine QA result.'),
+          { code: 'PLANNING_CONTRACT_REVISION_PREDECESSOR_INVALID' });
+      }
+      subject = pinPlanningContractRevision(projectDir, { ...match, direction }, session);
+      const reservation = { kind: 'planning_contract_revision', request: cloneSessionValue(subject.request),
+        status: 'reserved', launch_nonce: randomUUID(), reserved_at: new Date().toISOString() };
+      session.planning_contract_revisions = [...history, reservation];
+      outcome = { reservation: cloneSessionValue(reservation), reused: false };
+      return session;
+    }, { beforeCommit: () => subject?.assertCurrent() });
+    return { ...result, reserved: result.saved, ...(result.saved ? outcome : {}) };
+  } finally { subject?.close(); }
+}
+
+/** Consume the immutable controller record and reopen real owners without resetting history. */
+export function settlePlanningContractRevision(projectDir, match = {}) {
+  let subject;
+  let outcome;
+  try {
+    const result = mutateSession(projectDir, session => {
+      const lineage = authenticatePlanningContractRevisionHistory(projectDir, session);
+      const entry = lineage.tip;
+      if (!entry || entry.request?.revision_id !== match.revisionId
+        || entry.launch_nonce !== match.launchNonce
+        || entry.request.source_gate_id !== match.gateId
+        || entry.request.source_held_qa.claim_id !== match.claimId
+        || entry.request.source_held_qa.finished_at !== match.finishedAt
+        || (entry.request.previous_revision?.revision_id ?? undefined) !== match.previousRevisionId) {
+        throw Object.assign(new Error('Settlement requires the exact reserved Planning contract direction.'), { code: 'PLANNING_CONTRACT_REVISION_RESERVATION_MISMATCH' });
+      }
+      if (['active', 'completed'].includes(entry.status)) {
+        readAttestedPlanningContractRevision(projectDir, entry.request, entry.launch_nonce, entry.decision_sha256);
+        outcome = { revision: cloneSessionValue(entry), reused: true };
+        return session;
+      }
+      if (entry.status !== 'reserved') {
+        throw Object.assign(new Error('Only the never-consumed Planning contract direction may settle.'), { code: 'PLANNING_CONTRACT_REVISION_RESERVATION_MISMATCH' });
+      }
+      subject = pinPlanningContractRevision(projectDir, { agent: 'qa-planning', claimId: match.claimId,
+        finishedAt: match.finishedAt, gateId: match.gateId, direction: entry.request.direction,
+        ...(match.previousRevisionId === undefined ? {} : { previousRevisionId: match.previousRevisionId }) }, session);
+      if (canonicalSerialize(subject.request) !== canonicalSerialize(entry.request)) {
+        throw Object.assign(new Error('Planning contract revision subject changed before settlement.'), { code: 'PLANNING_CONTRACT_REVISION_SUBJECT_CHANGED' });
+      }
+      const decision = readAttestedPlanningContractRevision(projectDir, entry.request, entry.launch_nonce, match.decisionSha256);
+      const affected = [...PLANNING_CONTRACT_REVISION_OWNERS];
+      const previousAgents = Object.fromEntries(affected.map(name => [name, cloneSessionValue(session.agents[name])]));
+      const previousResults = Object.fromEntries(affected.filter(name => session.agent_results?.[name])
+        .map(name => [name, cloneSessionValue(session.agent_results[name])]));
+      if ([2, 3].includes(entry.request.schema_version)) {
+        const previous = lineage.history.at(-2);
+        previous.status = 'superseded';
+        previous.superseded_by = entry.request.revision_id;
+      }
+      entry.status = 'active';
+      entry.decision_path = decision.path;
+      entry.decision_sha256 = decision.sha256;
+      entry.applied_at = new Date().toISOString();
+      entry.owner_results = {};
+      entry.archived = { previous_agents: previousAgents, previous_agent_results: previousResults,
+        completed_agents: [...(session.completed_agents || [])], last_handoff: session.last_handoff || null,
+        current_execution_binding: cloneSessionValue(session.current_execution_binding || null) };
+      const reset = resetPipelineTo({ agents: structuredClone(session.agents),
+        completedAgents: [...(session.completed_agents || [])], history: [] }, PLANNING_CONTRACT_REVISION_TARGET);
+      for (const name of affected) {
+        if (session.agent_results) delete session.agent_results[name];
+        const agent = session.agents[name] || {};
+        for (const key of Object.keys(agent)) {
+          if (key.startsWith('execution_')) delete agent[key];
+        }
+        for (const key of ['started_at', 'completed_at', 'startedAt', 'completedAt',
+          'council_revalidation_pending', 'planning_reconciliation_pending']) delete agent[key];
+        agent.status = name === PLANNING_CONTRACT_REVISION_TARGET ? 'pending_rework' : reset.agents[name].status;
+        agent.score = null;
+        agent.criteria_count = 0;
+        agent.content_review_pending = true;
+        agent.content_review_task_id = `${name}-task`;
+        agent.planning_contract_revision_id = entry.request.revision_id;
+        session.agents[name] = agent;
+      }
+      session.completed_agents = reset.completedAgents;
+      session.current_agent = PLANNING_CONTRACT_REVISION_TARGET;
+      session.pipeline_position = reset.completedAgents.length;
+      session.last_handoff = 'brief';
+      // Persist the normalized empty binding so exact retries are byte-idempotent.
+      if (entry.request.schema_version === 3) session.current_execution_binding = null;
+      else delete session.current_execution_binding;
+      session.deviations = [...(session.deviations || []), { type: 'rollback',
+        details: { targetAgent: PLANNING_CONTRACT_REVISION_TARGET, source: 'planning_contract_revision',
+          revision_id: entry.request.revision_id, source_gate_id: entry.request.source_gate_id },
+        applied_at: entry.applied_at, changes: affected.map(name => `Reopen agent: ${name}`) }];
+      outcome = { revision: cloneSessionValue(entry), reused: false };
+      return session;
+    }, { beforeCommit: () => subject?.assertCurrent() });
+    return { ...result, settled: result.saved, ...(result.saved ? outcome : {}) };
+  } finally { subject?.close(); }
+}
+
+/** Reject only unapproved complete Planning content, without inventing an execution failure. */
+export function rejectAgentResult(projectDir, match = {}) {
+  let failureCode;
+  const result = mutateSession(projectDir, session => {
+    const fail = (code, message) => { failureCode = code; throw new Error(message); };
+    const agent = assertHeldPlanningContent(projectDir, session, match, fail);
+    if (typeof match.reason !== 'string' || !match.reason.trim()
+      || Buffer.byteLength(match.reason, 'utf8') > CONTENT_REVIEW_REASON_MAX_BYTES) {
+      fail('CONTENT_REVIEW_REASON_INVALID', 'A nonempty content-review reason of at most 8192 UTF-8 bytes is required.');
+    }
+    const reviews = agent.content_rejections || [];
+    if (!Array.isArray(reviews) || reviews.length >= MAX_CORRECTION_CYCLES) {
+      fail('CONTENT_REJECTION_LIMIT', `At most ${MAX_CORRECTION_CYCLES} content rejections per agent are allowed; direction is required.`);
+    }
+    const execution = Object.fromEntries(Object.entries(agent).filter(([key]) => key.startsWith('execution_') || key === 'status' || key === 'score'));
+    agent.content_rejections = [...reviews, { kind: 'content_rejection', reason: match.reason,
+      rejected_at: new Date().toISOString(), binding: cloneSessionValue(match.binding), execution: cloneSessionValue(execution) }];
+    agent.content_review_pending = true;
+    if (agent.execution_task_id) agent.content_review_task_id = agent.execution_task_id;
+    agent.status = 'pending_rework';
+    for (const key of ['execution_claim_id', 'execution_claim_state', 'execution_claim_started_at',
+      'execution_claim_expires_at', 'execution_started_at', 'execution_finished_at', 'execution_result_status',
+      'execution_qa_result']) delete agent[key];
+    return session;
+  });
+  return result.saved ? { ...result, rejected: true } : { ...result, rejected: false, code: failureCode || 'SESSION_WRITE_FAILED' };
+}
+
+/** Council-directed QA is a fresh execution, never a third content rejection. */
+export function revalidateQaAfterCouncil(projectDir, match = {}) {
+  let proof;
+  let outcome;
+  try {
+    const result = mutateSession(projectDir, session => {
+      const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+      if (match.agent !== 'qa-planning') fail('COUNCIL_QA_AGENT_REQUIRED', 'Only QA-Planning can revalidate a Planning council.');
+      proof = pinCouncilQaRevalidation(projectDir, match.gateId);
+      const binding = qaInvocationBinding(proof.artifact);
+      assertPlanningContentBoundary(projectDir, session, { ...match, binding }, fail);
+      assertV2PlanningPredecessors(session, match.agent);
+      const pending = session.agents?.[match.agent];
+      const previous = pending?.council_revalidations?.at(-1);
+      // A lost response can retrieve the same still-reserved command. It may
+      // neither allocate a second claim nor resurrect one already started.
+      if (pending?.council_revalidation_pending && pending.status === 'in_progress'
+        && pending.execution_claim_state === 'reserved' && Date.parse(pending.execution_claim_expires_at) > Date.now()
+        && previous?.execution?.execution_claim_id === match.claimId
+        && previous.execution.execution_finished_at === match.finishedAt
+        && previous.source_gate_id === match.gateId && previous.subject_gate_id === proof.evidence.subject_gate_id
+        && previous.fresh_claim_id === pending.execution_claim_id
+        && sameContentReviewBinding(binding, pending.execution_binding)
+        && sameContentReviewBinding(binding, session.current_execution_binding)) {
+        outcome = { claimId: pending.execution_claim_id, binding, reused: true };
+        return session;
+      }
+      const agent = assertHeldPlanningContent(projectDir, session, { ...match, binding }, fail);
+      assertV2PlanningPredecessors(session, match.agent);
+      if (agent.content_rejections?.length !== MAX_CORRECTION_CYCLES) {
+        fail('COUNCIL_QA_CONTENT_LIMIT_REQUIRED', 'Use the existing content-rejection route before its finite limit is reached.');
+      }
+      if (!isPlanningQaOutcomeValid(agent.execution_qa_result, getQaThreshold(match.agent, projectDir))
+        || agent.execution_qa_result.gate_result !== 'approved') {
+        fail('COUNCIL_QA_HELD_VERDICT_REQUIRED', 'Revalidation requires the genuine held QA approval, not an unresolved negative result.');
+      }
+      const history = agent.council_revalidations || [];
+      if (!Array.isArray(history) || history.length >= MAX_COUNCIL_QA_REVALIDATIONS) {
+        fail('COUNCIL_QA_REVALIDATION_LIMIT', 'Council-directed QA revalidation budget exhausted; adjudicate the remaining findings.');
+      }
+      if (history.some(item => item.source_gate_id === match.gateId
+        || item.execution?.execution_claim_id === match.claimId
+        || item.subject_gate_id === proof.evidence.subject_gate_id)) {
+        fail('COUNCIL_QA_REVALIDATION_REPLAY', 'This council decision, held result or corrected subject was already consumed.');
+      }
+      const execution = Object.fromEntries(Object.entries(agent).filter(([key]) => key.startsWith('execution_') || key === 'status' || key === 'score'));
+      const now = new Date();
+      const claimId = randomUUID();
+      agent.council_revalidations = [...history, { kind: 'council_qa_revalidation', ...proof.evidence,
+        requested_at: now.toISOString(), binding, execution: cloneSessionValue(execution), fresh_claim_id: claimId }];
+      agent.council_revalidation_pending = true;
+      agent.content_review_pending = true;
+      agent.content_review_task_id = 'qa-planning-task';
+      agent.status = 'in_progress';
+      agent.execution_resume_status = 'pending_rework';
+      agent.execution_claim_id = claimId;
+      agent.execution_claim_state = 'reserved';
+      agent.execution_claim_started_at = now.toISOString();
+      agent.execution_claim_expires_at = new Date(now.getTime() + 30 * 60 * 1000).toISOString();
+      agent.execution_task_id = 'qa-planning-task';
+      agent.execution_binding = binding;
+      for (const key of ['execution_started_at', 'execution_finished_at', 'execution_result_status', 'execution_qa_result']) delete agent[key];
+      outcome = { claimId, binding };
+      return session;
+    }, { beforeCommit: () => proof?.assertCurrent() });
+    return { ...result, revalidated: result.saved, ...(result.saved ? outcome : {}) };
+  } finally { proof?.close(); }
+}
+
+/** Negatively settle a legacy ambiguous hold. Never converts it to completion. */
+export function rejectLegacyAgentResult(projectDir, match = {}) {
+  let outcome = { recovered: false, code: 'AGENT_RESULT_RECOVERY_MISMATCH',
+    error: 'Recovery requires the exact unfinished legacy result identity.' };
+  const result = mutateSession(projectDir, (session) => {
+    const agent = session.agents?.[match.agent];
+    if (!agent || agent.status !== 'awaiting_advance' || agent.execution_claim_state !== 'awaiting_advance'
+      || agent.execution_result_status !== undefined || session.completed_agents?.includes(match.agent)
+      || typeof match.finishedAt !== 'string' || !Number.isFinite(Date.parse(match.finishedAt))
+      || agent.execution_finished_at !== match.finishedAt) return session;
+    agent.execution_failure = { status: 'error', reason: 'legacy_ambiguous_result_rejected',
+      execution_finished_at: agent.execution_finished_at, rejected_at: new Date().toISOString() };
+    agent.status = 'pending';
+    for (const key of ['execution_claim_id', 'execution_claim_state', 'execution_claim_started_at',
+      'execution_claim_expires_at', 'execution_started_at', 'execution_finished_at']) delete agent[key];
+    outcome = { recovered: true };
+    return session;
   });
   return { ...result, ...outcome };
 }
@@ -1484,12 +2733,17 @@ export function releaseAgentExecution(projectDir, match = {}) {
     const agent = session.agents?.[match.agent];
     if (!agent || agent.execution_claim_id !== match.claimId) return session;
     if (agent.execution_claim_state === 'awaiting_advance' || agent.status === 'awaiting_advance') return session;
-    if (agent.status === 'in_progress') agent.status = 'pending';
+    if (agent.status === 'in_progress') agent.status = agent.content_review_pending
+      || agent.execution_resume_status === 'pending_rework' ? 'pending_rework' : 'pending';
+    delete agent.execution_resume_status;
     delete agent.execution_claim_id;
     delete agent.execution_claim_state;
     delete agent.execution_claim_started_at;
     delete agent.execution_claim_expires_at;
     delete agent.execution_started_at;
+    delete agent.execution_qa_report_baseline;
+    delete agent.execution_planning_revision_baseline;
+    delete agent.execution_planning_revision_relay_claim_id;
     released = true;
     return session;
   });
@@ -1504,7 +2758,12 @@ export function releaseReservedAgentExecutions(projectDir) {
   const result = mutateSession(sessionProjectDir, (session) => {
     for (const agent of Object.values(session.agents || {})) {
       if (agent.execution_claim_state !== 'reserved') continue;
-      if (agent.status === 'in_progress') agent.status = 'pending';
+      if (agent.status === 'in_progress') agent.status = agent.content_review_pending
+        || agent.execution_resume_status === 'pending_rework' ? 'pending_rework' : 'pending';
+      delete agent.execution_resume_status;
+      delete agent.execution_qa_report_baseline;
+      delete agent.execution_planning_revision_baseline;
+      delete agent.execution_planning_revision_relay_claim_id;
       delete agent.execution_claim_id;
       delete agent.execution_claim_state;
       delete agent.execution_claim_started_at;
@@ -1550,6 +2809,8 @@ export function claimPendingInteraction(projectDir, claim = {}) {
   const sessionProjectDir = findSessionProjectDir(projectDir);
   if (!sessionProjectDir) return { saved: false, claimed: false, error: 'Session file not found in working directory or its parents' };
   let outcome = { allowed: true, claimed: false };
+  let subject;
+  try {
   const result = mutateSession(sessionProjectDir, (session) => {
     const pending = session.pending_interaction;
     if (!pending) {
@@ -1583,8 +2844,8 @@ export function claimPendingInteraction(projectDir, claim = {}) {
       };
       return session;
     }
-    const response = typeof claim.response === 'string' ? claim.response.trim() : '';
-    if (!response) {
+    const response = typeof claim.response === 'string' ? claim.response : '';
+    if (!response.trim()) {
       outcome = {
         allowed: false, claimed: false, code: 'PENDING_INTERACTION_REQUIRES_RESPONSE',
         error: `Agent ${pending.agent} is waiting for the user's response.`,
@@ -1615,19 +2876,45 @@ export function claimPendingInteraction(projectDir, claim = {}) {
       };
       return session;
     }
+    const history = pending.history || [];
+    const responseKind = reasoningEscalation ? 'controller_instruction' : 'user_answer';
+    validateRelayHistory([...history, {
+      interaction_id: pending.interaction_id, kind: responseKind,
+      ...(reasoningEscalation ? {} : { question: pending.question }), response,
+    }], pending.question, pending.initial_task_context);
     const claimId = randomUUID();
+    const contentReviewContext = claimContentReviewContext(projectDir, session, {
+      agent: pending.agent, taskId: pending.task_id, claimId, binding,
+    });
+    if (hasPlanningQaRecovery(session.agents?.[pending.agent], pending.agent)) {
+      assertPlanningQaReportBaseline(session.agents[pending.agent], { pending, binding, taskId: pending.task_id });
+      subject = pinClaimedCouncilQa(sessionProjectDir, session, pending.agent, { allowOwnInteraction: true, excludeQaReport: true });
+    }
+    if (session.agents?.[pending.agent]?.planning_contract_revision_id) {
+      const baseline = assertPlanningContractRevisionExecutionBaseline(session.agents[pending.agent], { pending, binding, taskId: pending.task_id });
+      contentReviewContext.planning_contract_revision.execution_subject = cloneSessionValue(baseline.subject_artifacts);
+    }
     session.pending_interaction = {
       ...pending,
       status: 'relay_in_flight',
       ...(reasoningEscalation ? { escalation_execution_binding: binding } : {}),
       relay_claim_id: claimId,
+      relay_response: response,
+      relay_response_kind: responseKind,
+      relay_next_task_id: reasoningEscalation ? `${pending.task_id}-post-escalation` : pending.task_id,
       relay_started_at: claim.timestamp || new Date().toISOString(),
       relay_lease_expires_at: claim.leaseExpiresAt || null,
     };
-    outcome = { allowed: true, claimed: true, claimId };
+    outcome = { allowed: true, claimed: true, claimId, contentReviewContext, relayContext: {
+      agent: pending.agent, taskId: pending.task_id, interactionId: pending.interaction_id,
+      binding, history, historyComplete: pending.history_complete === true,
+      initialTaskContext: pending.initial_task_context,
+      question: pending.question, response, responseKind,
+    } };
     return session;
-  });
-  return { ...result, ...outcome };
+  }, { beforeCommit: () => subject?.assertCurrent() });
+  return { ...result, ...outcome, claimed: result.saved && outcome.claimed };
+  } finally { subject?.close(); }
 }
 
 /** Restore a claimed relay after a controlled provider or contract failure. */
@@ -1654,6 +2941,10 @@ export function releasePendingInteraction(projectDir, match = {}) {
     delete session.pending_interaction.relay_claim_id;
     delete session.pending_interaction.relay_started_at;
     delete session.pending_interaction.relay_lease_expires_at;
+    delete session.pending_interaction.relay_response;
+    delete session.pending_interaction.relay_response_kind;
+    delete session.pending_interaction.relay_next_task_id;
+    delete session.pending_interaction.escalation_execution_binding;
     released = true;
     settled = true;
     return session;
@@ -1668,6 +2959,12 @@ export function clearPendingInteraction(projectDir, match = {}) {
   let cleared = false;
   const result = mutateSession(sessionProjectDir, (session) => {
     const pending = session.pending_interaction;
+    if (match.requireClaim && (!pending || pending.status !== 'relay_in_flight'
+      || !match.claimId || pending.relay_claim_id !== match.claimId
+      || pending.interaction_id !== match.interactionId
+      || pending.agent !== match.agent || pending.task_id !== match.taskId)) {
+      throw new Error('Pending interaction completion rejected: relay ownership mismatch');
+    }
     if (!pending) return session;
     if (match.agent && pending.agent !== match.agent) return session;
     if (match.taskId && pending.task_id !== match.taskId) return session;
@@ -1710,13 +3007,65 @@ export function recordModeTransition(projectDir, transition) {
  * @param {string} projectDir
  * @param {object} completion - { agent, status, score, outputs, handoffData }
  *   handoffData may include:
- *     - decision_trail_entries: array of new Decision Trail objects to append
+ *     - decision_trail_entries: new findings or compatible repeated findings
  *     - resolved_decision_trail: array of DT entry IDs to mark resolved: true
  * @returns {{ saved: boolean }}
  */
 export function recordAgentCompletion(projectDir, completion) {
   const { agent, status, score, outputs = [], handoffData = {} } = completion;
-  return mutateSession(projectDir, (session) => {
+  let failureCode;
+  let subject;
+  let revisionOutput;
+  let revisionHeldResult;
+  try {
+  const result = mutateSession(projectDir, (session) => {
+  // Consume the SAME hold validated before any async artifact/council checks.
+  // A concurrent content rejection must win without later DT merges or events.
+  const expected = completion.expectedResult;
+  const held = session.agents?.[agent];
+  assertPlanningContractRevisionOwner(session, [agent], projectDir);
+  if (expected && (held?.status !== 'awaiting_advance' || held.execution_claim_state !== 'awaiting_advance'
+    || held.execution_result_status !== 'complete' || held.execution_claim_id !== expected.claimId
+    || held.execution_finished_at !== expected.finishedAt || session.completed_agents?.includes(agent))) {
+    failureCode = 'AGENT_RESULT_HOLD_CHANGED';
+    throw new Error('The complete result changed or was consumed before canonical advance.');
+  }
+  if (agent === 'qa-planning') subject = pinHeldCouncilQaSubject(projectDir, session);
+  const revision = held?.planning_contract_revision_id
+    ? session.planning_contract_revisions?.find(item => item.request?.revision_id === held.planning_contract_revision_id)
+    : null;
+  if (revision) {
+    if (!expected || status !== 'completed' || revision.status !== 'active'
+      || planningContractRevisionHistory(session).tip !== revision) {
+      failureCode = 'PLANNING_CONTRACT_REVISION_CONTEXT_INVALID';
+      throw new Error('Planning owner completion requires its exact held claim and the single active contract revision.');
+    }
+    const relayClaimId = held.execution_planning_revision_relay_claim_id;
+    if (relayClaimId && relayClaimId !== expected.claimId) {
+      failureCode = 'PLANNING_CONTRACT_REVISION_EXECUTION_BASELINE_INVALID';
+      throw new Error('Planning owner completion does not belong to the recorded relay lineage.');
+    }
+    const attemptBaseline = assertPlanningContractRevisionExecutionBaseline(held, {
+      ...(relayClaimId
+        ? { pending: { planning_revision_baseline: held.execution_planning_revision_baseline } }
+        : { claimId: expected.claimId }),
+      binding: held.execution_binding, taskId: held.execution_task_id,
+    });
+    revisionOutput = pinPlanningContractRevisionOwnerOutput(projectDir, revision, agent, attemptBaseline);
+    revisionHeldResult = cloneSessionValue(held.execution_planning_revision_result);
+    if (!revisionHeldResult || revisionHeldResult.execution_claim_id !== expected.claimId
+      || revisionHeldResult.execution_finished_at !== expected.finishedAt
+      || canonicalSerialize(revisionHeldResult.subject) !== canonicalSerialize({ gate_id: revisionOutput.plan.gate_id,
+        artifacts: revisionOutput.plan.artifacts })
+      || canonicalSerialize(revisionHeldResult.owned_artifacts) !== canonicalSerialize(revisionOutput.owned_artifacts)
+      || canonicalSerialize(revisionHeldResult.handoff) !== canonicalSerialize(revisionOutput.handoff)) {
+      failureCode = 'PLANNING_CONTRACT_REVISION_HELD_OUTPUT_CHANGED';
+      throw new Error('Planning owner artifacts or handoff changed after the genuine execution was held.');
+    }
+  }
+  const heldExecution = revision ? { execution_claim_id: held.execution_claim_id,
+    execution_finished_at: held.execution_finished_at,
+    execution_binding: cloneSessionValue(held.execution_binding || null) } : null;
 
   // Update agent data
   if (!session.agents[agent]) {
@@ -1735,8 +3084,19 @@ export function recordAgentCompletion(projectDir, completion) {
   delete session.agents[agent].execution_claim_state;
   delete session.agents[agent].execution_claim_started_at;
   delete session.agents[agent].execution_claim_expires_at;
+  delete session.agents[agent].execution_resume_status;
   delete session.agents[agent].execution_started_at;
   delete session.agents[agent].execution_finished_at;
+  delete session.agents[agent].execution_result_status;
+  delete session.agents[agent].content_review_pending;
+  delete session.agents[agent].content_review_task_id;
+  delete session.agents[agent].council_revalidation_pending;
+  delete session.agents[agent].planning_reconciliation_pending;
+  delete session.agents[agent].execution_qa_report_baseline;
+  delete session.agents[agent].execution_planning_revision_baseline;
+  delete session.agents[agent].execution_planning_revision_relay_claim_id;
+  delete session.agents[agent].execution_planning_revision_result;
+  delete session.agents[agent].planning_contract_revision_id;
 
   // Add to completed agents list
   session.completed_agents = session.completed_agents || [];
@@ -1751,7 +3111,18 @@ export function recordAgentCompletion(projectDir, completion) {
     score,
     outputs,
     completed_at: session.agents[agent].completed_at,
+    ...(session.agents[agent].execution_qa_result ? { qa_result: session.agents[agent].execution_qa_result } : {}),
   };
+  if (revision) {
+    revision.owner_results[agent] = { ...heldExecution,
+      subject: cloneSessionValue(revisionHeldResult.subject), owned_artifacts: cloneSessionValue(revisionHeldResult.owned_artifacts),
+      handoff: cloneSessionValue(revisionHeldResult.handoff), completed_at: session.agents[agent].completed_at };
+    if (agent === 'qa-planning') {
+      revision.status = 'completed';
+      revision.completed_at = session.agents[agent].completed_at;
+    }
+  }
+  delete session.agents[agent].execution_qa_result;
 
   // Update last handoff
   session.last_handoff = agent;
@@ -1761,10 +3132,20 @@ export function recordAgentCompletion(projectDir, completion) {
   // document instead of directly editing session.yaml (which is blocked by the
   // mode-governance hook). The CLI reads them here and merges into session.yaml.
   if (Array.isArray(handoffData.decision_trail_entries) && handoffData.decision_trail_entries.length > 0) {
-    session.decision_trail = [
-      ...(session.decision_trail || []),
-      ...handoffData.decision_trail_entries,
-    ];
+    const trail = [...(session.decision_trail || [])];
+    for (const incoming of handoffData.decision_trail_entries) {
+      const existing = trail.find(entry => entry.id === incoming.id);
+      if (!existing) { trail.push(incoming); continue; }
+      // A negative recheck must keep its open finding for QA/FVP routing, but
+      // recurrence is not a new identity and must not overwrite its history.
+      // In particular, do not silently reopen or resolve a prior record.
+      if (existing.fault_origin !== incoming.fault_origin
+        || (existing.resolved === true) !== (incoming.resolved === true)) {
+        failureCode = 'DECISION_TRAIL_ID_CONFLICT';
+        throw new Error(`Decision Trail identity ${incoming.id} conflicts with its canonical origin or resolution.`);
+      }
+    }
+    session.decision_trail = trail;
   }
 
   // Mark resolved Decision Trail entries from agent handoff document.
@@ -1803,7 +3184,9 @@ export function recordAgentCompletion(projectDir, completion) {
   }
 
     return session;
-  });
+  }, { beforeCommit: () => { subject?.assertCurrent(); revisionOutput?.assertCurrent(); } });
+  return result.saved ? result : { ...result, code: failureCode || result.code || 'SESSION_WRITE_FAILED' };
+  } finally { subject?.close(); revisionOutput?.close(); }
 }
 
 /**
@@ -1824,6 +3207,41 @@ export function parseHandoffDecisionTrail(handoffMarkdown) {
     return { decision_trail_entries, resolved_decision_trail };
   }
 
+  const invalid = message => Object.assign(new Error(message), { code: 'INVALID_HANDOFF_DECISION_TRAIL' });
+  // Read the structured field, not an incidental heading chosen by a model.
+  // The normal writer contract nests this YAML inside Summary/Outputs/Deep Context.
+  for (const match of handoffMarkdown.matchAll(/^```(?:yaml|yml)\s*\r?\n([\s\S]*?)^```\s*$/gm)) {
+    if (!/^(?:decision_trail|resolved_decision_trail):/m.test(match[1])) continue;
+    let document;
+    try { document = yaml.load(match[1], { schema: yaml.JSON_SCHEMA }); }
+    catch (error) { throw invalid(`Malformed Decision Trail YAML: ${error.message}`); }
+    if (!document || typeof document !== 'object' || Array.isArray(document)) throw invalid('Decision Trail requires a mapping.');
+    if (Object.hasOwn(document, 'decision_trail')) {
+      const entries = document.decision_trail;
+      if (!Array.isArray(entries) || entries.length > 256) throw invalid('decision_trail must be a bounded array.');
+      for (const entry of entries) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry)
+          || typeof entry.id !== 'string' || !/^DT-[A-Za-z0-9][A-Za-z0-9-]*$/.test(entry.id)
+          || !['INTENT', 'SPEC', 'CODE', 'DEFER', 'UNKNOWN'].includes(entry.fault_origin)
+          || typeof entry.resolved !== 'boolean') throw invalid('Decision Trail entry identity, fault_origin, or resolved type is invalid.');
+        for (const [key, value] of Object.entries(entry)) {
+          if (['id', 'fault_origin', 'resolved'].includes(key)) continue;
+          if (key === 'correction_loop') {
+            if (!Number.isSafeInteger(value) || value < 0) throw invalid('correction_loop must be a nonnegative integer.');
+          } else if (typeof value !== 'string') throw invalid(`Decision Trail ${key} must be a string.`);
+        }
+        decision_trail_entries.push(entry);
+      }
+    }
+    if (Object.hasOwn(document, 'resolved_decision_trail')) {
+      if (!Array.isArray(document.resolved_decision_trail)
+        || !document.resolved_decision_trail.every(id => typeof id === 'string' && /^DT-[A-Za-z0-9][A-Za-z0-9-]*$/.test(id))) {
+        throw invalid('resolved_decision_trail must contain Decision Trail IDs.');
+      }
+      resolved_decision_trail.push(...document.resolved_decision_trail);
+    }
+  }
+
   // Extract ## Decision Trail section (stop at next ## heading or end of input).
   // Note: JS regex does not support \z (end-of-input anchor). Using $(?![\s\S])
   // — an $ followed by negative lookahead "no more chars" — gives the same
@@ -1833,7 +3251,10 @@ export function parseHandoffDecisionTrail(handoffMarkdown) {
     /^## Decision Trail\s*\n([\s\S]*?)(?=^## |$(?![\s\S]))/m,
   );
   if (dtMatch) {
-    const block = dtMatch[1];
+    // Structured fences were consumed above, including when placed under the
+    // legacy heading. Do not parse those same entries a second time.
+    const block = dtMatch[1].replace(/^```(?:yaml|yml)\s*\r?\n([\s\S]*?)^```\s*$/gm,
+      (fence, body) => /^(?:decision_trail|resolved_decision_trail):/m.test(body) ? '' : fence);
     // Parse YAML-like bullet blocks: lines starting with "  id: DT-"
     // Split on entries that start a new id: field
     const entryBlocks = block.split(/(?=^\s*-?\s*id:\s*DT-)/m).filter(Boolean);
@@ -1877,6 +3298,13 @@ export function parseHandoffDecisionTrail(handoffMarkdown) {
     }
   }
 
+  const ids = decision_trail_entries.map(entry => entry.id);
+  if (new Set(ids).size !== ids.length || new Set(resolved_decision_trail).size !== resolved_decision_trail.length) {
+    throw invalid('Duplicate Decision Trail IDs are ambiguous.');
+  }
+  if (decision_trail_entries.some(entry => entry.resolved === false && resolved_decision_trail.includes(entry.id))) {
+    throw invalid('A Decision Trail entry cannot be both unresolved and resolved in the same handoff.');
+  }
   return { decision_trail_entries, resolved_decision_trail };
 }