codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.10

package/dist/src/workflow.js

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
+import { inspectDependencyProvenanceRecovery } from './dependency-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
@@ -9,24 +10,32 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
-import { applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { assessMilestoneInitialAssembly, applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
-import { buildCurrentStrictStepReviewCycle, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
+import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
+import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
-import { launchStrictStepReviewer } from './reviewer.js';
-import { WriterLockManager } from './state/lock.js';
+import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
+import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
+import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
+import { inspectCorrectiveYieldTaskTransactions } from './state/corrective-yield-transaction.js';
+import { createCorrectiveYieldExecutor } from './state/corrective-yield-executor.js';
+import { createCorrectiveReplanPublicController, } from './state/corrective-replan-public.js';
+import { inspectWorkflowObservationBoundary, } from './observation.js';
 import { createEntityId } from './ulid.js';
-import { PACKAGE_VERSION } from './version.js';
+import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
+import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
+const MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES = 2;
 export class WorkflowService {
     store;
     now;
@@ -34,13 +43,42 @@ export class WorkflowService {
         this.store = store;
         this.now = now;
     }
-    context(repository) {
+    #mutationContext(repository) {
         const identity = resolveRepositoryIdentity(repository);
         const projectRoot = this.store.projectRoot(identity.projectId);
+        const replanTransactions = inspectCorrectiveReplanTaskTransactions(projectRoot, this.store.root);
+        const yieldTransactions = inspectCorrectiveYieldTaskTransactions(projectRoot, this.store.root);
+        const taskTransactions = {
+            corrupt: [...replanTransactions.corrupt, ...yieldTransactions.corrupt],
+            pending: [...replanTransactions.pending, ...yieldTransactions.pending],
+        };
+        if (taskTransactions.corrupt.length > 0) {
+            throw new WorkflowError('STATE_CORRUPT', 'A Task transaction journal failed integrity validation.', {
+                transactions: taskTransactions.corrupt,
+            });
+        }
+        if (taskTransactions.pending.length > 0) {
+            throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'A Task transaction requires explicit recovery.', {
+                taskIds: [...new Set(taskTransactions.pending.map((transaction) => transaction.taskId))].sort(),
+                transactionIds: taskTransactions.pending.map((transaction) => transaction.transactionId).sort(),
+            });
+        }
+        const coreTaskOperations = listCoreTaskOperationMutexes(this.store.lockRoot(identity.projectId), this.store.root);
+        if (coreTaskOperations.length > 0) {
+            throw new WorkflowError('LOCKED', 'A Core Task operation owns the project mutation boundary.', {
+                taskIds: coreTaskOperations.map((operation) => operation.entityId).sort(),
+                operationIds: coreTaskOperations.map((operation) => operation.operationId).sort(),
+            });
+        }
         recoverProjectTransactions(projectRoot, identity.projectId);
         const projectFile = path.join(projectRoot, 'project.json');
         const projectAlreadyRegistered = existsSync(projectFile);
         if (!projectAlreadyRegistered) {
+            // The registration posture is a sidecar under the project root. A completely
+            // fresh CODEX_WORKFLOW_STATE_HOME has no project directory yet, so establish
+            // only that directory before writing the posture; project.json remains the
+            // final registration record written below.
+            ensureDirectory(projectRoot);
             initializeProjectRegistrationAdoption(this.store, {
                 projectId: identity.projectId,
                 repositoryIdentity: identity,
@@ -54,17 +92,103 @@ export class WorkflowService {
         return {
             identity,
             store: this.store,
-            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now),
+            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root),
+        };
+    }
+    inspectWriterLease(repository, entityId) {
+        const identity = resolveRepositoryIdentity(repository);
+        const lease = inspectRawWriterLease(this.store.lockRoot(identity.projectId), entityId, this.store.root);
+        return lease ? this.publicWriterLeaseDiagnostic(lease) : null;
+    }
+    repairStaleWriterLease(repository, entityId) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.repairStale(entityId);
+        return {
+            ...this.publicWriterLeaseDiagnostic(lease),
+            repaired: true,
+        };
+    }
+    prepareCorrectiveReplan(repository, taskId, candidate) {
+        return this.correctiveReplanController(repository).prepare({ taskId, candidate });
+    }
+    confirmCorrectiveReplan(repository, taskId, candidate, gate, confirmationCode) {
+        return this.correctiveReplanController(repository).confirm({ taskId, candidate, gate, confirmationCode });
+    }
+    executeCorrectiveReplan(repository, taskId, candidate, credential) {
+        return this.correctiveReplanController(repository).execute({ taskId, candidate, credential });
+    }
+    recoverCorrectiveReplan(repository, taskId, transactionId) {
+        return this.correctiveReplanController(repository).recover({ taskId, transactionId });
+    }
+    executeCorrectiveYield(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).execute({
+            projectId: identity.projectId,
+            taskId,
+            expectedTaskRevision,
+            actor,
+            writerToken,
+            reason,
+        });
+    }
+    recoverCorrectiveYield(repository, taskId, transactionId) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).recover({ taskId, transactionId });
+    }
+    correctiveReplanController(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveReplanPublicController({
+            store: this.store,
+            projectId: identity.projectId,
+            repositoryRoot: identity.repositoryRoot,
+            now: this.now,
+        });
+    }
+    observationSnapshot(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        const boundary = inspectWorkflowObservationBoundary({
+            store: this.store,
+            identity,
+            now: this.now(),
+        });
+        if (boundary.observation.kind !== 'assessment') {
+            return {
+                ...boundary,
+                discoveries: [],
+                tasks: [],
+                milestones: [],
+                delegations: [],
+                adoption: null,
+            };
+        }
+        const tasks = this.store.listTasks(identity.projectId);
+        const rawMilestones = this.store.listMilestones(identity.projectId);
+        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones, boundary.leases, boundary.currentAdoptionPosture);
+        return {
+            ...boundary,
+            discoveries: this.store.listDiscoveries(identity.projectId),
+            tasks,
+            milestones: this.listMilestonesObserved(identity.projectId, rawMilestones, adoption.currentPosture),
+            delegations: this.store.listDelegations(identity.projectId),
+            adoption,
         };
     }
     prepareDelegation(repository, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         return gate;
     }
     grantDelegation(repository, input, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         if (confirmationCode.trim() !== gate.confirmationCode) {
@@ -100,7 +224,7 @@ export class WorkflowService {
         }, null);
     }
     revokeDelegation(repository, grantId, expectedRevision, actor, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const grant = this.store.readDelegation(identity.projectId, grantId);
         assertExpectedRevision(grant, expectedRevision);
         if (grant.status !== 'active') {
@@ -124,7 +248,7 @@ export class WorkflowService {
     startDiscovery(repository, input) {
         if (!input.goal.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Discovery requires a substantive goal.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const timestamp = this.now().toISOString();
         const initial = {
             schemaVersion: STATE_SCHEMA_VERSION,
@@ -152,7 +276,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(initial, null);
     }
     updateDiscovery(repository, discoveryId, expectedRevision, patch) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readDiscovery(identity.projectId, discoveryId);
         if (current.status === 'materialized' || current.status === 'abandoned') {
             throw new WorkflowError('TRANSITION_BLOCKED', `Discovery ${discoveryId} is ${current.status}.`);
@@ -176,7 +300,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(updated, expectedRevision);
     }
     materializeTask(repository, discoveryId, expectedRevision, title, baseBranch = 'main', milestoneId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -253,7 +377,7 @@ export class WorkflowService {
         return { discovery: savedDiscovery, task: savedTask, taskRoot };
     }
     replaceSplitRequiredTask(repository, oldTaskId, expectedOldTaskRevision, discoveryId, expectedDiscoveryRevision, expectedMilestoneRevision, title, actor) {
-        const { identity, locks } = this.context(repository);
+        const { identity, locks } = this.#mutationContext(repository);
         const oldTask = this.store.readTask(identity.projectId, oldTaskId);
         assertExpectedRevision(oldTask, expectedOldTaskRevision);
         if (!oldTask.milestoneId) {
@@ -504,7 +628,7 @@ export class WorkflowService {
         };
     }
     materializeMilestone(repository, discoveryId, expectedRevision, title, baseBranch = 'main') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -552,7 +676,7 @@ export class WorkflowService {
         };
     }
     setMilestonePlan(repository, milestoneId, expectedRevision, plan) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['planning', 'awaiting_execution_authorization', 'active', 'blocked'].includes(milestone.status)) {
@@ -624,7 +748,7 @@ export class WorkflowService {
         return saved;
     }
     prepareMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -641,7 +765,7 @@ export class WorkflowService {
         };
     }
     applyMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -664,9 +788,10 @@ export class WorkflowService {
         });
     }
     prepareMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
+        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         return prepareMilestoneAutonomyContract({
             projectId: identity.projectId,
             milestone,
@@ -677,9 +802,10 @@ export class WorkflowService {
         });
     }
     grantMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
+        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         return applyMilestoneAutonomyContract({
             store: this.store,
             projectId: identity.projectId,
@@ -692,7 +818,7 @@ export class WorkflowService {
         });
     }
     evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -722,12 +848,13 @@ export class WorkflowService {
         });
     }
     authorizeMilestone(repository, milestoneId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not awaiting authorization.`);
         }
+        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         const root = this.store.milestoneRoot(identity.projectId, milestoneId);
         const planHash = this.store.hashArtifact(root, 'plan.json');
         if (planHash !== milestone.planHash) {
@@ -751,7 +878,7 @@ export class WorkflowService {
         return this.store.writeMilestone({ ...milestone, status: 'active', planHash, authorizations: [...milestone.authorizations, event] }, expectedRevision);
     }
     validateMilestone(repository, milestoneId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
@@ -814,7 +941,7 @@ export class WorkflowService {
         return saved;
     }
     acceptMilestone(repository, milestoneId, expectedRevision, actor, confirmationCode, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_final_acceptance' || !milestone.resultHash || !milestone.evidenceHash) {
@@ -853,7 +980,7 @@ export class WorkflowService {
             resultHash,
             evidenceHash,
             headCommit: currentHead,
-            reason: `Confirmed with ${gate.confirmationCode}.`,
+            reason: 'Milestone final acceptance confirmed against the current validated state.',
             authorizationMode: delegation ? 'delegated' : 'human',
             ...(delegation ? { delegation } : {}),
         };
@@ -869,7 +996,7 @@ export class WorkflowService {
     cancelMilestone(repository, milestoneId, expectedRevision, reason) {
         if (!reason.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone cancellation requires a reason.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (['accepted', 'cancelled'].includes(milestone.status)) {
@@ -879,21 +1006,59 @@ export class WorkflowService {
     }
     setTaskPlan(repository, taskId, expectedRevision, plan, correctiveAudit = null, planRiskAudit = null) {
         validatePlan(plan);
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const knowledgeMap = this.assertKnowledgeMapBinding(identity.repositoryRoot, identity.projectId, plan.knowledgeMapRevision, plan.knowledgeMapHash);
         this.validateKnowledgeTargets(knowledgeMap, plan);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
-        }
+        const correctiveDecisionEvents = task.planHash ? readCorrectiveDecisionEvents(this.store, task) : [];
         const currentPlanCorrectiveDecisions = task.planHash
-            ? readCorrectiveDecisionEvents(this.store, task).filter((event) => event.planHash === task.planHash)
+            ? correctiveDecisionEvents.filter((event) => event.planHash === task.planHash)
             : [];
         const currentReplanDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'replan-required');
-        const currentContinueFixDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'continue-fix');
+        const currentContinueFixDecisions = currentPlanCorrectiveDecisions.filter((event) => {
+            if (event.decision !== 'continue-fix')
+                return false;
+            const passedBoundary = latestPassedVerifiedStepReviewEvent(this.store, task, event.stepId);
+            return !passedBoundary || passedBoundary.recordedAt <= event.recordedAt;
+        });
         const currentHardBlockingDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'split-required' || event.decision === 'stop-escalate');
-        const currentReplanRequiredStepIds = [...new Set(currentReplanDecisions.map((event) => event.stepId))];
+        const currentPlanRiskAudit = task.status === 'needs_fix' || currentReplanDecisions.length > 0
+            ? readCurrentPlanRiskAudit(this.store, task)
+            : null;
+        const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
+            ? findCurrentGuardedRemediationPosture(this.store, task, currentPlanRiskAudit)
+            : null;
+        const correctiveReplanPosture = classifiedCorrectivePosture?.posture === 'replan-required'
+            ? classifiedCorrectivePosture
+            : currentPlanRiskAudit
+                ? identifyCorrectiveReplanPosture(task, currentPlanRiskAudit.reviewRequiredStepIds, correctiveDecisionEvents, readRemediationEvents(this.store, task))
+                : null;
+        const correctiveReplanAvailability = correctiveReplanPosture?.posture === 'replan-required'
+            ? evaluateTaskCorrectiveReplanAvailability(task, correctiveReplanPosture)
+            : null;
+        if (currentReplanDecisions.length > 0) {
+            if (!correctiveReplanAvailability?.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} is blocked for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    posture: correctiveReplanPosture?.posture ?? null,
+                    evaluationPhase: correctiveReplanAvailability?.phase ?? 'availability',
+                    blockingGuardIds: correctiveReplanAvailability?.blockingGuardIds ?? [],
+                    pendingGuardIds: correctiveReplanAvailability?.pendingGuardIds ?? [],
+                    guardResults: correctiveReplanAvailability?.guardResults ?? [],
+                });
+            }
+            throw new WorkflowError('TRANSITION_BLOCKED', `Legacy task plan-set cannot execute ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID}.`, {
+                taskId: task.id,
+                transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                requiredAction: readTaskC1Posture(this.store, task).state === 'claimed'
+                    ? 'Run task corrective-yield first, then use task corrective-replan-prepare.'
+                    : 'Use task corrective-replan-prepare, confirm, and execute.',
+            });
+        }
+        else if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
+        }
         if (currentHardBlockingDecisions.length > 0) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has current corrective decisions that prohibit normal plan updates.`, {
                 taskId: task.id,
@@ -923,9 +1088,6 @@ export class WorkflowService {
                 })),
             });
         }
-        const currentPlanRiskAudit = task.status === 'needs_fix'
-            ? readCurrentPlanRiskAudit(this.store, task)
-            : null;
         const failedReviewAttempts = countFailedReviewAttempts(this.store.taskRoot(identity.projectId, taskId));
         if (task.status === 'needs_fix' && task.review.status === 'failed' && failedReviewAttempts >= 2) {
             validateCorrectivePlanAudit(task, correctiveAudit, failedReviewAttempts);
@@ -968,7 +1130,7 @@ export class WorkflowService {
             }
         }
         const root = this.store.taskRoot(identity.projectId, taskId);
-        const stagedPlan = this.store.stageArtifact(root, 'plan.md', renderPlan(task, plan));
+        const preparedPlan = prepareCorrectiveReplanCandidate(task, plan);
         const authorizations = task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
             ? { ...authorization, decision: 'superseded' }
             : authorization);
@@ -985,12 +1147,17 @@ export class WorkflowService {
             plannedSteps.every((step) => step.status === 'completed')) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'A failed review requires at least one new or changed remediation Step.');
         }
-        if (currentReplanRequiredStepIds.some((stepId) => !plannedSteps.some((step) => step.id === stepId))) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Replacement Plan under replan-required must retain every guarded Step targeted by the current corrective decision; removing or renaming one would reset remediation history.`, {
-                taskId: task.id,
-                requiredStepIds: currentReplanRequiredStepIds,
-                plannedStepIds: plannedSteps.map((step) => step.id),
-            });
+        if (correctiveReplanPosture?.posture === 'replan-required') {
+            const executionEvaluation = evaluateTaskCorrectiveReplanCandidate(task, correctiveReplanPosture, preparedPlan);
+            if (!executionEvaluation.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} rejected the candidate Plan for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    evaluationPhase: executionEvaluation.phase,
+                    blockingGuardIds: executionEvaluation.blockingGuardIds,
+                    pendingGuardIds: executionEvaluation.pendingGuardIds,
+                    guardResults: executionEvaluation.guardResults,
+                });
+            }
         }
         if (guardedRemediationGate && currentReplanDecisions.length === 0 && !plannedSteps.some((step) => step.id === guardedRemediationGate.stepId)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Continue-fix must retain guarded Step ${guardedRemediationGate.stepId}; removing or renaming it would reset the remediation breaker.`, {
@@ -998,14 +1165,10 @@ export class WorkflowService {
                 stepId: guardedRemediationGate.stepId,
             });
         }
-        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
-            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
-            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, stagedPlan.hash, this.now());
-        }
         const candidate = {
             ...task,
             status: 'awaiting_execution_authorization',
-            planHash: stagedPlan.hash,
+            planHash: preparedPlan.planHash,
             planObjective: plan.objective,
             requirements: plan.requirements,
             acceptance: plan.acceptance,
@@ -1025,6 +1188,18 @@ export class WorkflowService {
         };
         if (planRiskAudit)
             validatePlanRiskAuditCandidate(this.store, candidate, planRiskAudit);
+        const stagedPlan = this.store.stageArtifact(root, 'plan.md', preparedPlan.planBytes);
+        if (stagedPlan.hash !== preparedPlan.planHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Prepared candidate Plan hash changed during staging.', {
+                taskId: task.id,
+                preparedPlanHash: preparedPlan.planHash,
+                stagedPlanHash: stagedPlan.hash,
+            });
+        }
+        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
+            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
+            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, preparedPlan.planHash, this.now());
+        }
         const saved = this.store.writeTask(candidate, expectedRevision);
         this.store.publishArtifact(stagedPlan);
         if (planRiskAudit)
@@ -1035,7 +1210,7 @@ export class WorkflowService {
         return saved;
     }
     rebindTaskKnowledge(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.assertTaskContextChangeAllowed(task);
@@ -1120,7 +1295,7 @@ export class WorkflowService {
         if (!delegationGrantId) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Task context refresh combines approval transitions and therefore requires an explicit delegated approval grant.');
         }
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const currentMap = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(task, expectedTaskRevision);
@@ -1211,7 +1386,7 @@ export class WorkflowService {
         });
     }
     authorizeTask(repository, taskId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1241,7 +1416,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'ready', briefHash, planHash, authorizations: [...task.authorizations, event] }, expectedRevision);
     }
     recordPlanRiskAudit(repository, taskId, expectedRevision, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1249,7 +1424,7 @@ export class WorkflowService {
         return appendCurrentPlanRiskAudit(this.store, task, input, this.now());
     }
     showTaskHandoff(repository, taskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         return {
             task,
@@ -1257,8 +1432,8 @@ export class WorkflowService {
             claimTokenAvailable: false,
         };
     }
-    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null) {
-        const context = this.context(repository);
+    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null, replacePending = false) {
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
@@ -1316,6 +1491,7 @@ export class WorkflowService {
                 expectedNext: String(nextForTask(task).action ?? 'task show'),
                 grantId,
                 expiresAt: expiresAt ?? new Date(this.now().getTime() + 24 * 60 * 60 * 1000).toISOString(),
+                replacePending,
             }, this.now());
             releaseLease();
             return { task, event: prepared.event, bundle: prepared.bundle };
@@ -1327,15 +1503,15 @@ export class WorkflowService {
         }
     }
     claimTask(repository, taskId, expectedRevision, actor, claimToken, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
         if (!normalizedActor) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Claim actor is required.');
         }
-        const pendingHandoff = readTaskC1Posture(this.store, task);
-        if (pendingHandoff.state === 'pending' && pendingHandoff.latestEvent.grantId) {
+        const pendingHandoff = assertTaskClaimAllowed(this.store, task, normalizedActor, claimToken, this.now());
+        if (pendingHandoff.latestEvent.grantId) {
             this.assertHandoffGrant(context.identity.projectId, task, normalizedActor, pendingHandoff.latestEvent.grantId);
         }
         const existingLease = context.locks.inspect(taskId);
@@ -1368,7 +1544,14 @@ export class WorkflowService {
         }
         try {
             const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now());
-            return { task, event, lease };
+            return {
+                task,
+                event,
+                lease: toPublicWriterLease(lease, this.now()),
+                writerCredential: acquiredHere
+                    ? { disposition: 'issued', token: lease.token }
+                    : { disposition: 'renewed' },
+            };
         }
         catch (error) {
             if (acquiredHere)
@@ -1376,8 +1559,45 @@ export class WorkflowService {
             throw error;
         }
     }
+    replaceClaimedWriterCredential(repository, taskId, expectedRevision, actor) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const normalizedActor = actor.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Writer credential replacement actor is required.');
+        const posture = readTaskC1Posture(this.store, task);
+        const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const action = String(navigation.action);
+        const currentLease = context.locks.inspect(taskId);
+        const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed');
+        const requiredActor = writerTokenContract
+            ? this.writerCredentialRecoveryActor(task, action, posture.state === 'claimed' ? posture.claimant : null, currentLease?.owner ?? null)
+            : null;
+        if (!requiredActor || requiredActor !== normalizedActor) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} writer credential replacement requires the exact advertised recovery actor.`, {
+                taskId,
+                posture: posture.state,
+                claimant: posture.state === 'claimed' ? posture.claimant : null,
+                actor: normalizedActor,
+                requiredActor,
+                nextAction: action,
+            });
+        }
+        const lease = currentLease
+            ? context.locks.replaceCredential(taskId, normalizedActor)
+            : context.locks.acquire(taskId, normalizedActor);
+        if (posture.state === 'claimed') {
+            appendTaskWriterCredentialReplacement(this.store, task, normalizedActor, lease.token, this.now());
+        }
+        return {
+            task,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: 'issued', token: lease.token },
+        };
+    }
     handbackTask(repository, taskId, expectedRevision, actor, reason, writerToken = null, limitations = [], recommendedNext = 'Coordinator reviews the terminal Task result and recorded evidence.') {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = task.status === 'merged' || task.status === 'cancelled'
@@ -1389,7 +1609,7 @@ export class WorkflowService {
         return { task, event };
     }
     startTask(repository, taskId, expectedRevision, workspaceOwner) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(identity, taskId);
@@ -1441,7 +1661,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, baseCommit, taskBranch, workspaceOwner, blockReason: null }, expectedRevision);
     }
     runStep(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
@@ -1470,6 +1690,7 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} cannot start from ${step.status}.`);
         }
         const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        let resumesCorrectiveReplan = false;
         if (remediationHistoryForStep.length > 0 && (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds))) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} has remediation history but is no longer marked for guarded review by the current Plan Risk Audit; execution is blocked until the audit and Step posture are reconciled.`, {
                 taskId,
@@ -1484,20 +1705,21 @@ export class WorkflowService {
                 && guardedPosture.correctiveDecision.planHash !== task.planHash
                 ? guardedPosture.correctiveDecision
                 : null;
-            const recovery = staleDecision
+            const recovery = staleDecision?.decision === 'continue-fix'
                 ? requireCorrectiveDecisionRecoveryForRun(this.store, task, stepId, actor, writerToken)
                 : null;
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            const gate = assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            resumesCorrectiveReplan = gate.posture === 'replan-ready';
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        if (step.status === 'planned' && dirty.length > 0) {
+        if (step.status === 'planned' && dirty.length > 0 && !resumesCorrectiveReplan) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
-        if (step.status === 'failed' && dirtyOutsideStep.length > 0) {
+        if ((step.status === 'failed' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} retry has changes outside allowedWrites.`, {
                 changedFiles: dirtyOutsideStep,
             });
@@ -1555,7 +1777,8 @@ export class WorkflowService {
         }
         return {
             task: saved,
-            lease,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: acquiredHere ? 'issued' : 'renewed' },
             envelope: {
                 protocolVersion: PROTOCOL_VERSION,
                 packageVersion: PACKAGE_VERSION,
@@ -1591,14 +1814,14 @@ export class WorkflowService {
                 taskId,
                 stepId,
                 expectedRevision: saved.revision,
-                writerToken: lease.token,
+                writerToken: acquiredHere ? lease.token : null,
                 knowledgeMap: knowledgeSummary(knowledgeMap),
                 knowledgeSources: selectKnowledgeSources(knowledgeMap, 'worker', task.knowledgeTargets.map((target) => target.path)),
             },
         };
     }
     taskContext(repository, taskId, role) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const historicalStrictReview = role === 'independent-reviewer'
             && task.steps.some((step) => step.status === 'in_progress' && step.evidence !== null);
@@ -1677,7 +1900,7 @@ export class WorkflowService {
         };
     }
     completeStep(repository, taskId, stepId, expectedRevision, writerToken, notes, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
@@ -1763,7 +1986,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'in_progress', steps, blockReason: null }, expectedRevision);
     }
     reviewStep(repository, taskId, stepId, expectedRevision, runner, actor, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1819,10 +2042,18 @@ export class WorkflowService {
                     resolution: currentCycle.resolution,
                 });
             }
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit);
+            const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+            if (infrastructureFailures >= MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review exhausted its bounded infrastructure retries.', {
+                    taskId: task.id,
+                    stepId,
+                    infrastructureFailures,
+                    requiredAction: 'Use an external sealed reviewer or run doctor; do not start another local reviewer process.',
+                });
+            }
         }
         else if (currentCycle.resolution !== 'pending') {
-            if (currentCycle.resolution === 'failed' || currentCycle.resolution === 'unverified') {
+            if (currentCycle.resolution === 'failed') {
                 if (!currentCycle.reviewRecordedEvent || !currentCycle.reviewerAttestationEvent) {
                     throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review recovery requires exact review and attestation sidecars.', {
                         taskId: task.id,
@@ -1830,7 +2061,7 @@ export class WorkflowService {
                         resolution: currentCycle.resolution,
                     });
                 }
-                appendRemediationEvent(this.store, task, stepId, currentCycle.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+                appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                     completionCommit: currentCycle.reviewRecordedEvent.completionCommit,
                     checksHash: currentCycle.reviewRecordedEvent.checksHash,
                     reviewEventHash: currentCycle.reviewRecordedEvent.eventHash,
@@ -1848,7 +2079,7 @@ export class WorkflowService {
             reviewedCommit: launch.reviewedCommit,
             isolationResult: launch.verifiedIsolation ? 'verified' : 'unverified',
         }, this.now());
-        if (recorded.resolution === 'failed' || recorded.resolution === 'unverified') {
+        if (recorded.resolution === 'failed') {
             const reviewRecordedEvent = recorded.reviewRecordedEvent;
             const reviewerAttestationEvent = recorded.reviewerAttestationEvent;
             if (!reviewRecordedEvent || !reviewerAttestationEvent) {
@@ -1858,7 +2089,7 @@ export class WorkflowService {
                     resolution: recorded.resolution,
                 });
             }
-            appendRemediationEvent(this.store, task, stepId, recorded.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                 completionCommit: reviewRecordedEvent.completionCommit,
                 checksHash: reviewRecordedEvent.checksHash,
                 reviewEventHash: reviewRecordedEvent.eventHash,
@@ -1867,8 +2098,132 @@ export class WorkflowService {
         }
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
+    prepareExternalStepReview(repository, taskId, stepId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (task.status !== 'in_progress' && task.status !== 'blocked') {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} is not marked for strict review by the current Plan Risk Audit.`);
+        }
+        const step = requireStep(task, stepId);
+        if (step.status !== 'in_progress' || !step.evidence) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review requires ${stepId} in progress with canonical evidence.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot) || headCommit(identity.repositoryRoot) !== step.evidence.commitSha) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Step Review requires a clean checkout at the completion commit.');
+        }
+        const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
+        return prepareExternalStrictStepReviewPacket(identity.repositoryRoot, task, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence);
+    }
+    recordExternalStepReview(repository, taskId, stepId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalStepReview(repository, taskId, stepId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictStepReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Step reviewer must differ from the lifecycle mutation actor.');
+        }
+        const currentCycle = buildCurrentStrictStepReviewCycle(this.store, task, stepId);
+        if (task.status === 'blocked' && currentCycle.resolution !== 'unverified') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue requires an unverified prior review cycle.', {
+                taskId,
+                stepId,
+                resolution: currentCycle.resolution,
+            });
+        }
+        const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+        if (infrastructureFailures > MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue exceeded its bounded infrastructure history.', {
+                taskId,
+                stepId,
+                infrastructureFailures,
+            });
+        }
+        ensurePendingStrictStepReview(this.store, task, stepId, this.now());
+        const recorded = recordStrictStepReview(this.store, task, stepId, {
+            review,
+            reviewerOutputHash: strictReviewInputHash(review),
+            reviewedCommit: packet.reviewedCommit,
+            isolationResult: 'verified',
+        }, this.now());
+        if (recorded.resolution === 'failed') {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
+                completionCommit: recorded.reviewRecordedEvent.completionCommit,
+                checksHash: recorded.reviewRecordedEvent.checksHash,
+                reviewEventHash: recorded.reviewRecordedEvent.eventHash,
+                reviewerAttestationHash: recorded.reviewerAttestationEvent.eventHash,
+            }, readCurrentPlanRiskAudit(this.store, task), this.now());
+        }
+        const saved = this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, review.summary), expectedRevision);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
+    prepareExternalTaskReview(repository, taskId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
+        if (task.status !== 'validating' && !retryingUnverified) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Task Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        assertTaskBranch(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Task Review requires a clean Task checkout.');
+        }
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        if (!task.evidenceHash || this.store.hashArtifact(taskRoot, 'evidence.json') !== task.evidenceHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'External Strict Task Review requires the exact submitted evidence artifact.');
+        }
+        return prepareExternalStrictTaskReviewPacket(identity.repositoryRoot, task, taskRoot, this.taskContext(repository, taskId, 'independent-reviewer'));
+    }
+    recordExternalTaskReview(repository, taskId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalTaskReview(repository, taskId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictTaskReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict Task review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Task reviewer must differ from the lifecycle mutation actor.');
+        }
+        const saved = this.recordReview(repository, taskId, expectedRevision, review, actor, writerToken);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
     submitTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1900,11 +2255,11 @@ export class WorkflowService {
         return saved;
     }
     recordReview(repository, taskId, expectedRevision, review, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
         if (task.status !== 'validating' && !retryingUnverified) {
@@ -1942,7 +2297,7 @@ export class WorkflowService {
         return saved;
     }
     recoverStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
@@ -1954,18 +2309,18 @@ export class WorkflowService {
         return appendCorrectiveDecisionRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recoverRemediationMode(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         return appendRemediationModeRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recordStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, correctiveAudit, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         if (!['ready', 'needs_fix', 'blocked'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot record a corrective decision while ${task.status}.`);
@@ -2007,7 +2362,7 @@ export class WorkflowService {
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
     setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
@@ -2021,7 +2376,7 @@ export class WorkflowService {
         return saved;
     }
     acceptTask(repository, taskId, expectedRevision, actor, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'awaiting_final_acceptance' || !task.resultHash || !task.evidenceHash) {
@@ -2059,7 +2414,7 @@ export class WorkflowService {
         }, expectedRevision);
     }
     syncTaskBase(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.taskBranch || !task.baseCommit) {
@@ -2111,7 +2466,7 @@ export class WorkflowService {
         return saved;
     }
     mergeTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2133,7 +2488,7 @@ export class WorkflowService {
         return saved;
     }
     confirmExternalMerge(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2150,21 +2505,22 @@ export class WorkflowService {
         return saved;
     }
     status(repository) {
-        const { identity } = this.context(repository);
-        const tasks = this.store.listTasks(identity.projectId);
-        const rawMilestones = this.store.listMilestones(identity.projectId);
-        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones);
+        const snapshot = this.observationSnapshot(repository);
         return {
-            projectId: identity.projectId,
-            discoveries: this.store.listDiscoveries(identity.projectId),
-            tasks,
-            milestones: this.listMilestonesCurrent(identity.projectId, adoption.currentPosture),
-            delegations: this.store.listDelegations(identity.projectId),
-            adoption,
+            projectId: snapshot.identity.projectId,
+            discoveries: snapshot.discoveries,
+            tasks: snapshot.tasks,
+            milestones: snapshot.milestones,
+            milestoneInitialAssembly: snapshot.milestones
+                .map((milestone) => this.describeMilestoneInitialAssembly(snapshot.identity.projectId, milestone, snapshot.tasks))
+                .filter((value) => value !== null),
+            delegations: snapshot.delegations,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
         };
     }
     recoverMilestoneTransactions(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestones = this.listMilestonesCurrent(identity.projectId, readCurrentAdoptionPosture(this.store, identity.projectId));
         return {
             projectId: identity.projectId,
@@ -2172,11 +2528,11 @@ export class WorkflowService {
         };
     }
     prepareAdoption(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.inspectAdoptionPreparation(identity, this.store.listTasks(identity.projectId), this.store.listMilestones(identity.projectId));
     }
     applyAdoption(repository, actor, confirmationCode) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const tasks = context.store.listTasks(context.identity.projectId);
         const milestones = context.store.listMilestones(context.identity.projectId);
         return applyAdoptionPosture(this.store, {
@@ -2193,19 +2549,19 @@ export class WorkflowService {
         }, actor, confirmationCode);
     }
     updatePreflight(repository) {
-        const context = this.context(repository);
-        const tasks = context.store.listTasks(context.identity.projectId);
-        const milestones = context.store.listMilestones(context.identity.projectId);
-        const dirty = changedFiles(context.identity.repositoryRoot);
+        const snapshot = this.observationSnapshot(repository);
+        const tasks = snapshot.tasks;
+        const milestones = snapshot.milestones;
+        const dirty = changedFiles(snapshot.identity.repositoryRoot);
         const runningSteps = tasks.flatMap((task) => task.steps
             .filter((step) => step.status === 'in_progress')
             .map((step) => ({ taskId: task.id, stepId: step.id })));
-        const leases = context.locks.list();
+        const leases = snapshot.leases;
         const now = this.now().getTime();
         const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
         const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
         const activeMilestones = milestones.filter((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
-        const inspectedVersions = inspectWorkflowVersions(context.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
+        const inspectedVersions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
         const milestoneBases = inspectedVersions.milestoneBases.map((base) => ({
             ...base,
             milestoneIds: activeMilestones.filter((milestone) => milestone.baseBranch === base.branch).map((milestone) => milestone.id),
@@ -2232,31 +2588,20 @@ export class WorkflowService {
             ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
             ...(staleLeases.length > 0 ? ['At least one stale writer lease requires explicit repair.'] : []),
             ...versionBlockers,
+            ...observationPreflightBlockers(snapshot.observation),
         ];
-        const adoption = buildAdoptionPreparation({
-            projectId: context.identity.projectId,
-            repositoryIdentity: context.identity,
-            packageVersion: PACKAGE_VERSION,
-            protocolVersion: PROTOCOL_VERSION,
-            stateSchemaVersion: STATE_SCHEMA_VERSION,
-            tasks,
-            milestones,
-            sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
-            blockers,
-            now: this.now(),
-        }, readCurrentAdoptionPosture(this.store, context.identity.projectId));
         return {
             safe: blockers.length === 0,
             packageVersion: PACKAGE_VERSION,
             protocolVersion: PROTOCOL_VERSION,
             stateSchemaVersion: STATE_SCHEMA_VERSION,
-            projectId: context.identity.projectId,
-            repositoryRoot: context.identity.repositoryRoot,
+            projectId: snapshot.identity.projectId,
+            repositoryRoot: snapshot.identity.repositoryRoot,
             clean: dirty.length === 0,
             changedFiles: dirty,
             runningSteps,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             blockers,
             workflowVersions: {
                 runtime: inspectedVersions.runtime,
@@ -2272,11 +2617,118 @@ export class WorkflowService {
                     ? null
                     : 'Land only package.json/package-lock.json dependency changes on every active Milestone base; do not transport unrelated product commits.',
             },
-            adoption,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
+        };
+    }
+    dependencyProvenanceRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Dependency provenance recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        return this.inspectDependencyProvenanceCandidate(snapshot, task);
+    }
+    recoverDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        const normalizedActor = actor.trim();
+        const normalizedReason = reason.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Dependency provenance recovery requires an actor.');
+        if (!normalizedReason)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Dependency provenance recovery requires a reason.');
+        const context = this.#mutationContext(repository);
+        const current = context.store.readTask(context.identity.projectId, taskId);
+        const currentHead = headCommit(context.identity.repositoryRoot);
+        const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead && record.packageVersion === PACKAGE_VERSION);
+        if (prior && current.systemCommits.includes(currentHead))
+            return current;
+        assertExpectedRevision(current, expectedRevision);
+        const snapshot = this.observationSnapshot(repository);
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task);
+        if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
+                taskId,
+                blockers: preflight.blockers,
+            });
+        }
+        return context.store.writeTask({
+            ...task,
+            systemCommits: [...task.systemCommits, preflight.commitSha],
+            dependencyProvenanceRecoveries: [
+                ...(task.dependencyProvenanceRecoveries ?? []),
+                {
+                    commitSha: preflight.commitSha,
+                    parentCommitSha: preflight.parentCommitSha,
+                    packageName: PACKAGE_NAME,
+                    packageVersion: PACKAGE_VERSION,
+                    files: ['package-lock.json', 'package.json'],
+                    actor: normalizedActor,
+                    reason: normalizedReason,
+                    recordedAt: this.now().toISOString(),
+                    retainedHistoricalCommits: preflight.retainedHistoricalCommits,
+                },
+            ],
+        }, expectedRevision);
+    }
+    milestoneProgress(repository, milestoneId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone progress requires a coherent read-only observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const milestone = snapshot.milestones.find((candidate) => candidate.id === milestoneId);
+        if (!milestone)
+            throw new WorkflowError('NOT_FOUND', `Milestone ${milestoneId} was not found in this repository.`);
+        const tasksById = new Map(snapshot.tasks.map((task) => [task.id, task]));
+        const tasks = milestone.memberships.map((membership, index) => {
+            const task = tasksById.get(membership.taskId);
+            if (!task)
+                throw new WorkflowError('STATE_CORRUPT', `Milestone member ${membership.taskId} does not exist.`);
+            const stepsCompleted = task.steps.filter((step) => ['completed', 'skipped'].includes(step.status)).length;
+            return {
+                ordinal: `T${String(index + 1).padStart(2, '0')}`,
+                taskId: task.id,
+                title: task.title,
+                status: task.status,
+                revision: task.revision,
+                disposition: membership.disposition,
+                membershipReason: membership.reason,
+                replacementForTaskId: task.replacementForTaskId ?? null,
+                replacedByTaskId: task.replacedByTaskId ?? null,
+                stepsCompleted,
+                stepsTotal: task.steps.length,
+                steps: task.steps.map((step, stepIndex) => ({
+                    ordinal: `S${String(stepIndex + 1).padStart(2, '0')}`,
+                    stepId: step.id,
+                    title: step.title,
+                    status: step.status,
+                })),
+            };
+        });
+        const required = tasks.filter((task) => task.disposition === 'required');
+        return {
+            readOnly: true,
+            projectId: snapshot.identity.projectId,
+            milestoneId: milestone.id,
+            milestoneTitle: milestone.title,
+            milestoneStatus: milestone.status,
+            milestoneRevision: milestone.revision,
+            membershipRevision: milestone.membershipRevision,
+            tasksCompleted: required.filter((task) => task.status === 'merged').length,
+            tasksRequired: required.length,
+            tasks,
         };
     }
     alpha6StrictReviewRescuePreflight(repository) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const dependency = inspectLocalDependency(context.identity.repositoryRoot);
         const tasks = context.store.listTasks(context.identity.projectId);
         const leases = context.locks.list();
@@ -2371,15 +2823,15 @@ export class WorkflowService {
             projectId: context.identity.projectId,
             repositoryRoot: context.identity.repositoryRoot,
             clean: dirty.length === 0,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             candidate,
             blockers,
             requiredActions,
         };
     }
     scanKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         try {
             const current = this.store.readKnowledgeMap(identity.projectId);
@@ -2392,11 +2844,11 @@ export class WorkflowService {
         }
     }
     showKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.store.readKnowledgeMap(identity.projectId);
     }
     knowledgeMapStatus(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         return inspectKnowledgeMap(current, scanned);
@@ -2405,7 +2857,7 @@ export class WorkflowService {
         return this.approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, null);
     }
     approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, autonomyTaskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const inspected = inspectKnowledgeMap(current, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
@@ -2422,43 +2874,35 @@ export class WorkflowService {
         return this.store.writeKnowledgeMap(approved, expectedRevision);
     }
     reconcileKnowledgeMap(repository, expectedRevision, allowAtomicTaskRefresh = false) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         if (!allowAtomicTaskRefresh && current.status === 'active' && current.approval) {
             const milestonesById = new Map(this.listMilestonesCurrent(identity.projectId).map((milestone) => [milestone.id, milestone]));
-            const activeTask = this.store
-                .listTasks(identity.projectId)
-                .find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
-            if (activeTask?.planHash
-                && taskCanRebindKnowledge(activeTask)
-                && !this.taskHasTerminalCorrectiveDecision(activeTask)) {
-                const inspected = inspectKnowledgeMap(current, scanned);
-                const assessment = assessDelegatedKnowledgeRefresh(current, inspected, activeTask, this.store.hashArtifact(this.store.taskRoot(identity.projectId, activeTask.id), 'plan.md'));
-                if (assessment.eligible
-                    && this.delegatedContextRefreshOptions(identity.projectId, activeTask, inspected, assessment.mode).length > 0) {
-                    throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
-                        taskId: activeTask.id,
-                        requiredAction: 'Run the exact task context-refresh action returned by next.',
-                    });
-                }
+            const inspected = inspectKnowledgeMap(current, scanned);
+            const refreshOwner = this.findDelegatedContextRefreshOwner(identity.projectId, this.store.listTasks(identity.projectId), milestonesById, current, inspected);
+            if (refreshOwner) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
+                    taskId: refreshOwner.task.id,
+                    requiredAction: 'Run the exact task context-refresh action returned by next.',
+                });
             }
         }
         return this.store.writeKnowledgeMap(reconcileKnowledgeMap(current, scanned), expectedRevision);
     }
     graphRefreshRequest(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
     }
     graphStatus(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const binding = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return { request, binding: binding ? inspectGraphBinding(binding, request) : null };
     }
     bindGraph(repository, expectedRevision, request, evidence) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const currentRequest = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, request.graphKind, request.mode, this.now());
         validateGraphRequestCurrent(request, currentRequest);
         const existing = this.readGraphBindingOrNull(identity.projectId, request.graphKind);
@@ -2466,13 +2910,78 @@ export class WorkflowService {
         return this.store.writeGraphBinding(binding, expectedRevision);
     }
     recordGraphFallback(repository, graphKind, mode, expectedRevision, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const existing = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
-    next(repository) {
+    next(repository, taskId = null) {
         const status = this.status(repository);
+        if (status.observation.kind === 'blocked') {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
+        if (status.observation.kind === 'repair') {
+            const repair = status.observation.repair;
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'repair-required',
+                action: repair?.command ?? 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: repair ? 'repair' : 'blocked',
+                    transitionId: null,
+                    availableRepairTransitionId: null,
+                    ...(repair ? {
+                        command: repair.command,
+                        cataloged: repair.cataloged,
+                        ...('available' in repair ? { available: repair.available } : {}),
+                        bindings: repair.command === 'milestone recover'
+                            ? {
+                                projectId: repair.projectId,
+                                milestoneIds: repair.milestoneIds,
+                                transactionIds: repair.transactionIds,
+                            }
+                            : 'taskIds' in repair
+                                ? {
+                                    projectId: repair.projectId,
+                                    taskIds: repair.taskIds,
+                                    transactionIds: repair.transactionIds,
+                                }
+                                : {
+                                    projectId: repair.projectId,
+                                    entityIds: repair.entityIds,
+                                },
+                    } : {}),
+                    reasonCodes: status.observation.reasonCodes,
+                },
+            };
+        }
+        if (!status.adoption) {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
         const adoptionInfo = {
             status: status.adoption.status,
             safe: status.adoption.safe,
@@ -2490,19 +2999,117 @@ export class WorkflowService {
                 status: status.adoption.status,
                 action: status.adoption.safe ? 'state adoption-apply' : 'restore safe boundary, then state adoption-prepare',
                 adoption: adoptionInfo,
+                observation: status.observation,
+                navigation: status.adoption.safe
+                    ? {
+                        kind: 'human-gate',
+                        transitionId: null,
+                        cataloged: false,
+                        command: 'state adoption-apply',
+                        bindings: {
+                            projectId: status.projectId,
+                            confirmationCode: status.adoption.confirmationCode,
+                            confirmationCodeBindingHash: status.adoption.confirmationCodeBindingHash,
+                            actorRequired: true,
+                        },
+                    }
+                    : {
+                        kind: 'blocked',
+                        transitionId: null,
+                        availableRepairTransitionId: null,
+                        reasonCodes: ['ADOPTION_MISSING'],
+                        blockers: status.adoption.blockers,
+                    },
             };
         }
-        const withAdoption = (value) => ({ ...value, adoption: adoptionInfo });
+        const withAdoption = (value) => ({
+            ...value,
+            adoption: adoptionInfo,
+            observation: status.observation,
+        });
         const repositoryRoot = resolveRepositoryIdentity(repository).repositoryRoot;
+        const inspectCurrentKnowledgeMap = () => inspectKnowledgeMap(this.store.readKnowledgeMap(status.projectId), scanProjectKnowledge(repositoryRoot, status.projectId, this.now()));
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
-        const activeTask = status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
+        const requestedTask = taskId === null
+            ? null
+            : status.tasks.find((task) => task.id === taskId) ?? null;
+        if (taskId !== null && !requestedTask) {
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        }
+        if (requestedTask && !taskIsActionableFromRepositoryNext(requestedTask, milestonesById)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} is not actionable from repository next.`, {
+                taskId: requestedTask.id,
+                taskStatus: requestedTask.status,
+                milestoneId: requestedTask.milestoneId,
+            });
+        }
+        const activeTask = requestedTask
+            ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
         if (activeTask) {
-            const activePlanRiskAudit = activeTask.planHash
-                ? readCurrentPlanRiskAudit(this.store, activeTask)
+            const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (dependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update dependency-provenance-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: dependencyRecovery,
+                });
+            }
+            const activeTaskMilestone = activeTask.milestoneId
+                ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
+            const milestoneCancellationSafe = Boolean(activeTaskMilestone
+                && !activeTask.steps.some((step) => step.status === 'in_progress')
+                && status.observation.leases.length === 0
+                && status.observation.coreTaskOperations.length === 0
+                && status.observation.pendingProjectTransactions.length === 0
+                && status.observation.pendingMilestoneTransactions.length === 0
+                && status.observation.pendingTaskTransactions.length === 0
+                && status.observation.corruptTaskTransactions.length === 0);
+            const withMilestoneCancellation = (value) => (milestoneCancellationSafe
+                ? {
+                    ...value,
+                    milestoneCancellationOption: {
+                        command: 'milestone cancel',
+                        milestoneId: activeTaskMilestone.id,
+                        expectedRevision: activeTaskMilestone.revision,
+                        reasonRequired: true,
+                        taskDisposition: 'retained-historical',
+                    },
+                }
+                : value);
+            let activePlanRiskAudit = null;
+            let planRiskAuditRecovery = null;
+            if (activeTask.planHash) {
+                try {
+                    activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
+                        throw error;
+                    planRiskAuditRecovery = {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'task plan-risk-audit',
+                        revision: activeTask.revision,
+                        planRiskAuditRecovery: {
+                            state: 'required',
+                            reason: error.message,
+                            currentBriefHash: activeTask.briefHash,
+                            currentPlanHash: activeTask.planHash,
+                            knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                            knowledgeMapHash: activeTask.knowledgeMapHash,
+                        },
+                    };
+                }
+            }
             const taskNext = activeTask.status === 'planning'
                 ? null
-                : this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
+                : planRiskAuditRecovery
+                    ?? this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -2514,12 +3121,27 @@ export class WorkflowService {
                 || hardStop
                 || terminalCorrectiveDecision === 'split-required'
                 || terminalCorrectiveDecision === 'stop-escalate') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
             }
             if (!taskCanRebindKnowledge(activeTask) && activeTask.status !== 'planning') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
+            }
+            let knowledgeMap;
+            try {
+                knowledgeMap = inspectCurrentKnowledgeMap();
+            }
+            catch (error) {
+                if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                    throw error;
+                return withAdoption(withMilestoneCancellation({
+                    scope: 'project-memory',
+                    status: 'missing',
+                    action: 'project-memory scan',
+                    stalenessOriginTaskId: activeTask.id,
+                    authorizesTask: false,
+                    provenanceNotice: 'This Task identifier is diagnostic provenance only; the Project Knowledge action does not authorize or resume it.',
+                }));
             }
-            const knowledgeMap = this.knowledgeMapStatus(repository);
             if (knowledgeMap.status !== 'active' || !knowledgeMap.approval) {
                 const action = knowledgeMap.status === 'stale' ? 'project-memory reconcile' : 'project-memory approve';
                 const delegatedApprovalOptions = action === 'project-memory approve'
@@ -2535,7 +3157,17 @@ export class WorkflowService {
                 const contextRefreshOptions = action === 'project-memory reconcile' && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
-                return withAdoption({
+                if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
+                    const refreshOwner = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, storedKnowledgeMap, knowledgeMap);
+                    if (refreshOwner && refreshOwner.task.id !== requestedTask.id) {
+                        throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} cannot be selected while Task ${refreshOwner.task.id} requires an atomic context refresh.`, {
+                            taskId: requestedTask.id,
+                            blockingTaskId: refreshOwner.task.id,
+                            requiredAction: 'Run repository next and its exact task context-refresh action first.',
+                        });
+                    }
+                }
+                return withAdoption(withMilestoneCancellation({
                     scope: contextRefreshOptions.length > 0 ? 'task' : 'project-memory',
                     status: knowledgeMap.status,
                     action: contextRefreshOptions.length > 0 ? 'task context-refresh' : action,
@@ -2567,14 +3199,14 @@ export class WorkflowService {
                             },
                         }
                         : {}),
-                });
+                }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
             if (taskCanRebindKnowledge(activeTask) &&
                 activeTask.planHash &&
                 (activeTask.knowledgeMapRevision !== knowledgeMap.revision ||
                     activeTask.knowledgeMapHash !== knowledgeMapHash)) {
-                return withAdoption({
+                return withAdoption(withMilestoneCancellation({
                     scope: 'task',
                     id: activeTask.id,
                     status: activeTask.status,
@@ -2582,12 +3214,69 @@ export class WorkflowService {
                     revision: activeTask.revision,
                     knowledgeMapRevision: knowledgeMap.revision,
                     knowledgeMapHash,
-                });
+                }));
             }
-            return withAdoption(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null));
+            return withAdoption(withMilestoneCancellation(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null)));
+        }
+        let repositoryKnowledgeMap;
+        try {
+            repositoryKnowledgeMap = inspectCurrentKnowledgeMap();
+        }
+        catch (error) {
+            if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                throw error;
+            return withAdoption({
+                scope: 'project-memory',
+                status: 'missing',
+                action: 'project-memory scan',
+                authorizesMilestone: false,
+                provenanceNotice: 'Project Knowledge must be current before Discovery or Milestone authorization.',
+            });
+        }
+        if (repositoryKnowledgeMap.status !== 'active' || !repositoryKnowledgeMap.approval) {
+            const action = repositoryKnowledgeMap.status === 'stale'
+                ? 'project-memory reconcile'
+                : 'project-memory approve';
+            const delegatedApprovalOptions = action === 'project-memory approve'
+                ? this.delegatedApprovalOptions(status.projectId, 'project_memory.approve', repositoryKnowledgeMap)
+                : [];
+            return withAdoption({
+                scope: 'project-memory',
+                status: repositoryKnowledgeMap.status,
+                action,
+                revision: repositoryKnowledgeMap.revision,
+                authorizesMilestone: false,
+                provenanceNotice: 'Project Knowledge must be reconciled and approved before Discovery or Milestone authorization.',
+                ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
+            });
         }
         const activeMilestone = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         if (activeMilestone) {
+            const initialAssembly = status.milestoneInitialAssembly
+                .find((candidate) => candidate.milestoneId === activeMilestone.id) ?? null;
+            if (initialAssembly) {
+                const activeDiscovery = status.discoveries.find((discovery) => !['materialized', 'abandoned'].includes(discovery.status));
+                if (activeDiscovery) {
+                    return withAdoption({
+                        scope: 'discovery',
+                        id: activeDiscovery.id,
+                        status: activeDiscovery.status,
+                        action: activeDiscovery.status === 'ready_to_materialize' ? 'discovery materialize' : 'discovery update',
+                        readiness: assessDiscovery(activeDiscovery),
+                        milestoneInitialAssembly: initialAssembly,
+                    });
+                }
+                return withAdoption({
+                    scope: 'milestone',
+                    id: activeMilestone.id,
+                    status: activeMilestone.status,
+                    action: 'milestone initial-assembly',
+                    revision: activeMilestone.revision,
+                    linkedTaskIds: initialAssembly.linkedTaskIds,
+                    executionAvailable: initialAssembly.executionAvailable,
+                    milestoneInitialAssembly: initialAssembly,
+                });
+            }
             if (activeMilestone.status === 'awaiting_final_acceptance') {
                 const root = this.store.milestoneRoot(activeMilestone.projectId, activeMilestone.id);
                 const evidence = JSON.parse(readFileSync(path.join(root, 'evidence.json'), 'utf8'));
@@ -2638,6 +3327,19 @@ export class WorkflowService {
                 status: activeMilestone.status,
                 action: nextForMilestone(activeMilestone),
                 revision: activeMilestone.revision,
+                ...(activeMilestone.status === 'awaiting_execution_authorization' && activeMilestone.planHash
+                    ? {
+                        milestoneAuthorizationOptions: [
+                            { action: 'milestone authorize', mode: 'direct-human' },
+                            {
+                                action: 'milestone autonomy-prepare',
+                                mode: 'delegated',
+                                requiresExactHumanConfirmation: true,
+                                maximumDurationHours: 72,
+                            },
+                        ],
+                    }
+                    : {}),
                 ...(activeMilestone.status === 'active'
                     ? {
                         completionPolicy: {
@@ -2794,7 +3496,20 @@ export class WorkflowService {
                     throw error;
             }
         }
-        const next = nextForTask(task);
+        let catalogCorrectiveReplanPosture = guardedCorrectivePosture?.posture === 'replan-required'
+            ? guardedCorrectivePosture
+            : null;
+        if (!remediationModeRecovery && planRiskAudit && guardedCorrectivePosture === null) {
+            try {
+                catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
+            }
+            catch (error) {
+                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task);
+                if (!remediationModeRecovery)
+                    throw error;
+            }
+        }
+        const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const handoffPosture = readTaskC1Posture(this.store, task);
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
@@ -2806,6 +3521,11 @@ export class WorkflowService {
                 return buildCurrentStrictStepReviewCycle(this.store, task, step.id).resolution === 'unverified';
             }) ?? null
             : null;
+        const strictReviewInfrastructureFailures = strictStepReviewStep
+            ? countUnverifiedStrictStepReviews(this.store, task, strictStepReviewStep.id)
+            : 0;
+        const strictTaskReviewRequired = (task.status === 'validating' && task.review.status === 'pending')
+            || (task.status === 'blocked' && task.review.status === 'unverified');
         const handoffOverlay = handoffPosture.state === 'pending'
             ? {
                 action: 'task claim',
@@ -2814,6 +3534,15 @@ export class WorkflowService {
                     state: 'pending',
                     targetActor: handoffPosture.targetActor,
                     eventId: handoffPosture.latestEvent.eventId,
+                    credentialRecovery: {
+                        action: 'task handoff-replace',
+                        when: 'claim credential is unavailable',
+                        requiredActor: handoffPosture.latestEvent.actor,
+                        targetActor: handoffPosture.targetActor,
+                        grantId: handoffPosture.latestEvent.grantId,
+                        expectedRevision: task.revision,
+                        invalidatesPriorCredential: true,
+                    },
                 },
             }
             : handoffPosture.state === 'claimed'
@@ -2836,6 +3565,63 @@ export class WorkflowService {
                         },
                     }
                     : {};
+        const correctiveReplanOverlay = (posture) => {
+            const evaluation = evaluateTaskCorrectiveReplanAvailability(task, posture);
+            const writerLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+            const command = handoffPosture.state === 'claimed'
+                ? 'task corrective-yield'
+                : writerLease
+                    ? 'doctor'
+                    : 'task corrective-replan-prepare';
+            if (evaluation.allowed && handoffPosture.state === 'none' && writerLease) {
+                const navigation = correctiveReplanNavigation(evaluation);
+                return {
+                    action: command,
+                    blockedAction: 'task corrective-replan-prepare',
+                    stepId: posture.stepId,
+                    navigation: {
+                        kind: 'blocked',
+                        transitionId: navigation.transitionId,
+                        semanticFingerprint: navigation.semanticFingerprint,
+                        command: navigation.command,
+                        blockingGuardIds: ['task.corrective-replan.no-writer-lease'],
+                        pendingInputGuardIds: navigation.pendingInputGuardIds,
+                        reasonCode: 'ACTIVE_WRITER_LEASE',
+                    },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: 'The active non-C1 writer lease must expire and be explicitly repaired before corrective replan preparation.',
+                        writerLease: {
+                            owner: writerLease.owner,
+                            expiresAt: writerLease.expiresAt,
+                        },
+                    },
+                };
+            }
+            return evaluation.allowed
+                ? {
+                    action: command,
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: { ...correctiveReplanNavigation(evaluation), command },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: handoffPosture.state === 'claimed'
+                            ? 'Yield the exact C1 claim and writer lease before preparing replacement authority.'
+                            : 'Prepare a state-bound candidate, confirm the Human gate, then execute its exact receipt.',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: correctiveReplanBlockedNavigation(evaluation),
+                };
+        };
         let guardedCorrectiveOverlay = {};
         if (remediationModeRecovery) {
             guardedCorrectiveOverlay = {
@@ -2854,7 +3640,12 @@ export class WorkflowService {
                 },
             };
         }
-        if (!remediationModeRecovery && !strictStepReviewStep && guardedCorrectivePosture) {
+        if (!remediationModeRecovery && guardedCorrectivePosture === null && catalogCorrectiveReplanPosture) {
+            guardedCorrectiveOverlay = correctiveReplanOverlay(catalogCorrectiveReplanPosture);
+        }
+        if (!remediationModeRecovery
+            && guardedCorrectivePosture
+            && (!strictStepReviewStep || guardedCorrectivePosture.posture === 'replan-required')) {
             switch (guardedCorrectivePosture.posture) {
                 case 'decision-required':
                     if (guardedCorrectivePosture.correctiveDecision
@@ -2929,16 +3720,7 @@ export class WorkflowService {
                     };
                     break;
                 case 'replan-required':
-                    guardedCorrectiveOverlay = {
-                        action: 'task plan-set',
-                        stepId: guardedCorrectivePosture.stepId,
-                        correctiveDecisionGate: {
-                            attemptCount: guardedCorrectivePosture.attemptCount,
-                            decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
-                            decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
-                            requiredAction: 'Record an actual new Plan posture before another remediation run.',
-                        },
-                    };
+                    guardedCorrectiveOverlay = correctiveReplanOverlay(guardedCorrectivePosture);
                     break;
                 case 'split-required':
                     {
@@ -3022,6 +3804,30 @@ export class WorkflowService {
                     strictStepReview: {
                         reviewRequired: true,
                         completionCommit: strictStepReviewStep.evidence.commitSha,
+                        infrastructureFailures: strictReviewInfrastructureFailures,
+                        maxLocalInfrastructureFailures: MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES,
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task step-review-packet',
+                            recordCommand: 'task step-review-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
+                    },
+                }
+                : {}),
+            ...(strictTaskReviewRequired
+                ? {
+                    strictTaskReview: {
+                        reviewRequired: true,
+                        localInfrastructureFailureObserved: task.review.status === 'unverified',
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task review-packet',
+                            recordCommand: 'task review-sealed-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
                     },
                 }
                 : {}),
@@ -3051,13 +3857,37 @@ export class WorkflowService {
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
         };
         if (handoffPosture.state === 'pending') {
-            return {
+            return this.withTaskNavigationContracts(task, {
                 ...result,
                 action: 'task claim',
                 blockedAction: next.action,
-            };
+            });
         }
-        return result;
+        const navigableResult = ['task plan-set', 'task plan-set with independent corrective audit']
+            .includes(String(result.action))
+            ? {
+                ...result,
+                taskPlanContract: this.taskPlanContract(projectId, task),
+            }
+            : result;
+        return this.withTaskNavigationContracts(task, navigableResult);
+    }
+    taskPlanContract(projectId, task) {
+        const map = this.store.readKnowledgeMap(projectId);
+        return {
+            requiredRequirementIds: [...task.requirements],
+            requiredAcceptanceIds: [...task.acceptance],
+            currentRisks: [...task.risks],
+            exactInclusionRequired: true,
+            briefHash: task.briefHash,
+            knowledgeMap: knowledgeSummary(map),
+            planRiskAuditContract: {
+                required: true,
+                option: '--risk-audit-file',
+                atomicWithPlanSet: true,
+                plannerAuditorSeparationRequired: true,
+            },
+        };
     }
     assertTaskContextChangeAllowed(task) {
         const posture = this.taskTerminalCorrectivePosture(task);
@@ -3136,6 +3966,22 @@ export class WorkflowService {
             policyHash: grant.policyHash,
         }));
     }
+    findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected) {
+        for (const task of tasks) {
+            if (!taskIsActionableFromRepositoryNext(task, milestonesById)
+                || !task.planHash
+                || !taskCanRebindKnowledge(task)
+                || this.taskHasTerminalCorrectiveDecision(task))
+                continue;
+            const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
+            if (!assessment.eligible)
+                continue;
+            const options = this.delegatedContextRefreshOptions(projectId, task, inspected, assessment.mode);
+            if (options.length > 0)
+                return { task, assessment, options };
+        }
+        return null;
+    }
     assertPlanBoundedSupportingSourceGrant(projectId, grantId, actor, task) {
         const grant = this.store.readDelegation(projectId, grantId);
         if (!task.milestoneId || grant.scope.kind !== 'milestone' || grant.scope.id !== task.milestoneId) {
@@ -3205,6 +4051,130 @@ export class WorkflowService {
             ? milestone
             : readMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
     }
+    listMilestonesObserved(projectId, milestones, posture) {
+        if (!posture)
+            return milestones;
+        const grandfatheredMilestones = new Set(posture.terminalMilestones.map((milestone) => `${milestone.milestoneId}:${milestone.revision}:${milestone.status}`));
+        return milestones.map((milestone) => (grandfatheredMilestones.has(`${milestone.id}:${milestone.revision}:${milestone.status}`)
+            ? milestone
+            : inspectMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
+    }
+    taskGitNavigationOverride(task) {
+        if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.baseCommit || !task.taskBranch) {
+            return null;
+        }
+        const currentBase = runGit(task.repositoryRoot, ['rev-parse', task.baseBranch]);
+        if (currentBase === task.baseCommit)
+            return null;
+        return {
+            scope: 'task',
+            id: task.id,
+            status: task.status,
+            action: 'task sync-base',
+            revision: task.revision,
+            baseSyncRequired: {
+                baseBranch: task.baseBranch,
+                recordedBaseCommit: task.baseCommit,
+                currentBaseCommit: currentBase,
+            },
+        };
+    }
+    inspectDependencyProvenanceCandidate(snapshot, task) {
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const now = this.now().getTime();
+        return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
+            activeLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now).length,
+            staleLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now).length,
+            pendingTransactionCount: snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length,
+            corruptTransactionCount: snapshot.observation.corruptTaskTransactions.length,
+            coreOperationCount: snapshot.observation.coreTaskOperations.length,
+            verifiedHistoricalStepCommits: verifiedHistoricalStepReviewCommits(this.store, task),
+            versions: {
+                runtime: versions.runtime,
+                declared: versions.declared,
+                locked: versions.locked,
+                installed: versions.installed,
+                currentBranch: versions.currentBranch,
+                baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+            },
+        });
+    }
+    withTaskNavigationContracts(task, next) {
+        const action = typeof next.action === 'string' ? next.action : null;
+        if (!action)
+            return next;
+        const policy = gitMutationPolicyForAction(task, action);
+        const c1Posture = readTaskC1Posture(this.store, task);
+        const claimedC1Posture = c1Posture.state === 'claimed';
+        const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture);
+        const activeLease = writerTokenContract
+            ? inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root)
+            : null;
+        const writerCredentialRecoveryActor = this.writerCredentialRecoveryActor(task, action, claimedC1Posture ? c1Posture.claimant : null, activeLease?.owner ?? null);
+        const writerCredentialRecovery = writerTokenContract && writerCredentialRecoveryActor
+            ? {
+                action: 'task writer-credential-replace',
+                when: 'the active writer credential is unavailable',
+                requiredActor: writerCredentialRecoveryActor,
+                expectedRevision: task.revision,
+                invalidatesPriorCredential: true,
+                acquiresLeaseWhenAbsent: true,
+            }
+            : null;
+        return {
+            ...next,
+            ...(policy ? { gitMutationPolicy: policy } : {}),
+            ...(writerTokenContract ? { writerTokenContract } : {}),
+            ...(writerCredentialRecovery ? { writerCredentialRecovery } : {}),
+        };
+    }
+    writerCredentialRecoveryActor(task, action, claimedActor, activeLeaseOwner) {
+        if (claimedActor)
+            return claimedActor;
+        if (activeLeaseOwner)
+            return activeLeaseOwner;
+        const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
+            ? 'final_acceptance'
+            : ['task step-complete', 'task submit'].includes(action)
+                ? 'execution'
+                : null;
+        if (!authorizationKind)
+            return null;
+        return [...task.authorizations].reverse().find((authorization) => authorization.kind === authorizationKind && authorization.decision === 'approved')?.actor ?? null;
+    }
+    describeMilestoneInitialAssembly(projectId, milestone, tasks) {
+        const assessment = assessMilestoneInitialAssembly({
+            store: this.store,
+            projectId,
+            milestone,
+            listTasks: () => tasks,
+        });
+        if (!assessment.eligible)
+            return null;
+        const options = [
+            {
+                action: 'linked-task-assembly',
+                commands: ['discovery start', 'discovery materialize'],
+                description: 'Start or materialize the next linked Task Discovery for this Milestone before closing the initial membership Plan.',
+            },
+        ];
+        if (assessment.orphanTaskIds.length > 0) {
+            options.push({
+                action: 'milestone plan-set',
+                commands: ['milestone plan-set'],
+                description: 'Record one complete initial Milestone Plan that classifies every currently linked Task.',
+            });
+        }
+        return {
+            milestoneId: milestone.id,
+            revision: milestone.revision,
+            linkedTaskIds: assessment.orphanTaskIds,
+            executionAvailable: false,
+            options,
+        };
+    }
     prepareMilestoneScopeChangeCandidate(projectId, milestone, plan, actor) {
         validateMilestonePlan(plan);
         return prepareMilestoneScopeChangeCandidate({
@@ -3214,6 +4184,12 @@ export class WorkflowService {
             actor,
         });
     }
+    publicWriterLeaseDiagnostic(lease) {
+        return {
+            ...toPublicWriterLease(lease, this.now()),
+            tokenFingerprint: createHash('sha256').update(lease.token).digest('hex').slice(0, 16),
+        };
+    }
     proveWriterLeaseTokenForHandoff(context, taskId, writerToken) {
         const currentLease = context.locks.inspect(taskId);
         if (!currentLease) {
@@ -3303,9 +4279,12 @@ export class WorkflowService {
             storedKnowledgeMapHash: storedHash,
         });
     }
-    inspectAdoptionPreparation(identity, tasks, milestones) {
-        const locks = new WriterLockManager(this.store.lockRoot(identity.projectId), this.now);
-        const currentPosture = readCurrentAdoptionPosture(this.store, identity.projectId);
+    inspectAdoptionPreparation(identity, tasks, milestones, observedLeases, observedPosture) {
+        const leases = observedLeases
+            ?? new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root).list();
+        const currentPosture = observedPosture === undefined
+            ? readCurrentAdoptionPosture(this.store, identity.projectId)
+            : observedPosture;
         if (currentPosture) {
             assertAdoptionBaselinePreserved(currentPosture, tasks, milestones);
         }
@@ -3318,7 +4297,7 @@ export class WorkflowService {
             tasks,
             milestones,
             sidecarInventory: this.collectAdoptionSidecarInventory(identity.projectId, tasks, milestones),
-            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, locks.list()),
+            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, leases),
             now: this.now(),
         }, currentPosture);
     }
@@ -3860,13 +4839,13 @@ function nextForTask(task) {
         awaiting_execution_authorization: 'task authorize',
         ready: task.workspaceOwner ? (stepsComplete ? 'task submit' : 'task run') : 'task start',
         in_progress: activeStep ? 'task step-complete' : stepsComplete ? 'task submit' : 'task run',
-        validating: task.review.status === 'passed' ? 'task result-set' : 'task review-record',
+        validating: task.review.status === 'passed' ? 'task result-set' : 'task review-launch',
         needs_fix: task.steps.some((step) => step.status === 'failed') ? 'task run' : 'task plan-set',
         awaiting_final_acceptance: 'task accept',
         merging: 'task merge',
         ready_to_merge: 'task merge-confirm',
         merged: 'none',
-        blocked: task.review.status === 'unverified' ? 'task review-record' : 'doctor',
+        blocked: task.review.status === 'unverified' ? 'task review-launch' : 'doctor',
         cancelled: 'none',
     };
     const selectedStep = activeStep ?? failedStep ?? runnableStep;
@@ -3888,6 +4867,95 @@ function nextForTask(task) {
             : {}),
     };
 }
+function gitMutationPolicyForAction(task, action) {
+    const metadataWrites = ['.git/index', '.git/index.lock', '.git/HEAD', '.git/refs', '.git/logs'];
+    switch (action) {
+        case 'task start':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task start',
+                appliesWhen: { workspaceOwner: 'local' },
+                metadataWrites,
+            };
+        case 'task step-complete':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task step-complete',
+                metadataWrites,
+            };
+        case 'task merge':
+            if (task.workspaceOwner !== 'local')
+                return null;
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task merge',
+                metadataWrites,
+            };
+        case 'task sync-base':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task sync-base',
+                metadataWrites,
+            };
+        default:
+            return null;
+    }
+}
+function writerTokenContractForAction(action, claimedC1Posture = false) {
+    const alwaysLeaseBound = ['task step-complete', 'task submit', 'task merge', 'task merge-confirm'];
+    const claimedC1LeaseBound = [
+        'task run',
+        'task step-review',
+        'task step-review-record',
+        'task review-record',
+        'task review-launch',
+        'task review-sealed-record',
+        'task corrective-decision-recover',
+        'task remediation-mode-recover',
+        'task corrective-decision',
+        'task corrective-yield',
+        'task handoff',
+        'task handoff-prepare',
+        'task handback',
+        'task handback-create',
+    ];
+    if (!alwaysLeaseBound.includes(action) && !(claimedC1Posture && claimedC1LeaseBound.includes(action))) {
+        return null;
+    }
+    return {
+        required: true,
+        option: '--writer-token',
+        source: 'active-writer-lease',
+        sensitive: true,
+        renewalDisposition: 'reuse-presented-token',
+        tokenReissuedOnRenewal: false,
+    };
+}
+function observationPreflightBlockers(observation) {
+    const messages = {
+        PROJECT_REGISTRATION_MISSING: 'Workflow project registration is missing.',
+        PROJECT_REPOSITORY_ROOT_UNBOUND: 'The current repository root is not bound to the Workflow project.',
+        PROJECT_RECOVERY_REQUIRED: 'A project transaction requires explicit recovery.',
+        MILESTONE_RECOVERY_REQUIRED: 'A Milestone transaction requires explicit recovery.',
+        TASK_RECOVERY_REQUIRED: 'A Task corrective-replan transaction requires explicit recovery.',
+        TASK_TRANSACTION_INTEGRITY_FAILED: 'A Task transaction journal failed integrity validation.',
+        TASK_OPERATION_IN_PROGRESS: 'A Core Task operation is in progress.',
+        STALE_TASK_OPERATION: 'A stale Core Task operation requires bounded repair.',
+        ADOPTION_MISSING: 'Workflow lifecycle adoption is missing.',
+    };
+    return observation.reasonCodes.flatMap((reasonCode) => {
+        const message = messages[reasonCode];
+        return message ? [message] : [];
+    });
+}
 function knowledgeSummary(map) {
     return {
         revision: map.revision,