codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.11

package/dist/src/workflow.js

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
+import { inspectDependencyProvenanceRecovery } from './dependency-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
@@ -9,24 +10,34 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
-import { appendCorrectiveDecisionEvent, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
-import { applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
+import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
+import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
+import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
-import { buildCurrentStrictStepReviewCycle, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
+import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
+import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
-import { launchStrictStepReviewer } from './reviewer.js';
-import { WriterLockManager } from './state/lock.js';
+import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
+import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
+import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
+import { inspectCorrectiveYieldTaskTransactions } from './state/corrective-yield-transaction.js';
+import { createCorrectiveYieldExecutor } from './state/corrective-yield-executor.js';
+import { createCorrectiveReplanPublicController, } from './state/corrective-replan-public.js';
+import { inspectWorkflowObservationBoundary, } from './observation.js';
 import { createEntityId } from './ulid.js';
-import { PACKAGE_VERSION } from './version.js';
+import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
+import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
+const MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES = 2;
 export class WorkflowService {
     store;
     now;
@@ -34,13 +45,42 @@ export class WorkflowService {
         this.store = store;
         this.now = now;
     }
-    context(repository) {
+    #mutationContext(repository) {
         const identity = resolveRepositoryIdentity(repository);
         const projectRoot = this.store.projectRoot(identity.projectId);
+        const replanTransactions = inspectCorrectiveReplanTaskTransactions(projectRoot, this.store.root);
+        const yieldTransactions = inspectCorrectiveYieldTaskTransactions(projectRoot, this.store.root);
+        const taskTransactions = {
+            corrupt: [...replanTransactions.corrupt, ...yieldTransactions.corrupt],
+            pending: [...replanTransactions.pending, ...yieldTransactions.pending],
+        };
+        if (taskTransactions.corrupt.length > 0) {
+            throw new WorkflowError('STATE_CORRUPT', 'A Task transaction journal failed integrity validation.', {
+                transactions: taskTransactions.corrupt,
+            });
+        }
+        if (taskTransactions.pending.length > 0) {
+            throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'A Task transaction requires explicit recovery.', {
+                taskIds: [...new Set(taskTransactions.pending.map((transaction) => transaction.taskId))].sort(),
+                transactionIds: taskTransactions.pending.map((transaction) => transaction.transactionId).sort(),
+            });
+        }
+        const coreTaskOperations = listCoreTaskOperationMutexes(this.store.lockRoot(identity.projectId), this.store.root);
+        if (coreTaskOperations.length > 0) {
+            throw new WorkflowError('LOCKED', 'A Core Task operation owns the project mutation boundary.', {
+                taskIds: coreTaskOperations.map((operation) => operation.entityId).sort(),
+                operationIds: coreTaskOperations.map((operation) => operation.operationId).sort(),
+            });
+        }
         recoverProjectTransactions(projectRoot, identity.projectId);
         const projectFile = path.join(projectRoot, 'project.json');
         const projectAlreadyRegistered = existsSync(projectFile);
         if (!projectAlreadyRegistered) {
+            // The registration posture is a sidecar under the project root. A completely
+            // fresh CODEX_WORKFLOW_STATE_HOME has no project directory yet, so establish
+            // only that directory before writing the posture; project.json remains the
+            // final registration record written below.
+            ensureDirectory(projectRoot);
             initializeProjectRegistrationAdoption(this.store, {
                 projectId: identity.projectId,
                 repositoryIdentity: identity,
@@ -54,17 +94,103 @@ export class WorkflowService {
         return {
             identity,
             store: this.store,
-            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now),
+            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root),
+        };
+    }
+    inspectWriterLease(repository, entityId) {
+        const identity = resolveRepositoryIdentity(repository);
+        const lease = inspectRawWriterLease(this.store.lockRoot(identity.projectId), entityId, this.store.root);
+        return lease ? this.publicWriterLeaseDiagnostic(lease) : null;
+    }
+    repairStaleWriterLease(repository, entityId) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.repairStale(entityId);
+        return {
+            ...this.publicWriterLeaseDiagnostic(lease),
+            repaired: true,
+        };
+    }
+    prepareCorrectiveReplan(repository, taskId, candidate) {
+        return this.correctiveReplanController(repository).prepare({ taskId, candidate });
+    }
+    confirmCorrectiveReplan(repository, taskId, candidate, gate, confirmationCode) {
+        return this.correctiveReplanController(repository).confirm({ taskId, candidate, gate, confirmationCode });
+    }
+    executeCorrectiveReplan(repository, taskId, candidate, credential) {
+        return this.correctiveReplanController(repository).execute({ taskId, candidate, credential });
+    }
+    recoverCorrectiveReplan(repository, taskId, transactionId) {
+        return this.correctiveReplanController(repository).recover({ taskId, transactionId });
+    }
+    executeCorrectiveYield(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).execute({
+            projectId: identity.projectId,
+            taskId,
+            expectedTaskRevision,
+            actor,
+            writerToken,
+            reason,
+        });
+    }
+    recoverCorrectiveYield(repository, taskId, transactionId) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).recover({ taskId, transactionId });
+    }
+    correctiveReplanController(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveReplanPublicController({
+            store: this.store,
+            projectId: identity.projectId,
+            repositoryRoot: identity.repositoryRoot,
+            now: this.now,
+        });
+    }
+    observationSnapshot(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        const boundary = inspectWorkflowObservationBoundary({
+            store: this.store,
+            identity,
+            now: this.now(),
+        });
+        if (boundary.observation.kind !== 'assessment') {
+            return {
+                ...boundary,
+                discoveries: [],
+                tasks: [],
+                milestones: [],
+                delegations: [],
+                adoption: null,
+            };
+        }
+        const tasks = this.store.listTasks(identity.projectId);
+        const rawMilestones = this.store.listMilestones(identity.projectId);
+        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones, boundary.leases, boundary.currentAdoptionPosture);
+        return {
+            ...boundary,
+            discoveries: this.store.listDiscoveries(identity.projectId),
+            tasks,
+            milestones: this.listMilestonesObserved(identity.projectId, rawMilestones, adoption.currentPosture),
+            delegations: this.store.listDelegations(identity.projectId),
+            adoption,
         };
     }
     prepareDelegation(repository, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         return gate;
     }
     grantDelegation(repository, input, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         if (confirmationCode.trim() !== gate.confirmationCode) {
@@ -100,7 +226,7 @@ export class WorkflowService {
         }, null);
     }
     revokeDelegation(repository, grantId, expectedRevision, actor, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const grant = this.store.readDelegation(identity.projectId, grantId);
         assertExpectedRevision(grant, expectedRevision);
         if (grant.status !== 'active') {
@@ -124,7 +250,7 @@ export class WorkflowService {
     startDiscovery(repository, input) {
         if (!input.goal.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Discovery requires a substantive goal.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const timestamp = this.now().toISOString();
         const initial = {
             schemaVersion: STATE_SCHEMA_VERSION,
@@ -152,7 +278,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(initial, null);
     }
     updateDiscovery(repository, discoveryId, expectedRevision, patch) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readDiscovery(identity.projectId, discoveryId);
         if (current.status === 'materialized' || current.status === 'abandoned') {
             throw new WorkflowError('TRANSITION_BLOCKED', `Discovery ${discoveryId} is ${current.status}.`);
@@ -176,7 +302,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(updated, expectedRevision);
     }
     materializeTask(repository, discoveryId, expectedRevision, title, baseBranch = 'main', milestoneId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -253,7 +379,7 @@ export class WorkflowService {
         return { discovery: savedDiscovery, task: savedTask, taskRoot };
     }
     replaceSplitRequiredTask(repository, oldTaskId, expectedOldTaskRevision, discoveryId, expectedDiscoveryRevision, expectedMilestoneRevision, title, actor) {
-        const { identity, locks } = this.context(repository);
+        const { identity, locks } = this.#mutationContext(repository);
         const oldTask = this.store.readTask(identity.projectId, oldTaskId);
         assertExpectedRevision(oldTask, expectedOldTaskRevision);
         if (!oldTask.milestoneId) {
@@ -270,6 +396,32 @@ export class WorkflowService {
                 disposition: membership?.disposition ?? null,
             });
         }
+        const incidentDependencies = milestone.memberships.flatMap((candidate) => {
+            if (!Array.isArray(candidate.dependsOnTaskIds))
+                return [];
+            return [
+                ...(candidate.taskId === oldTask.id
+                    ? candidate.dependsOnTaskIds.map((predecessorTaskId) => ({
+                        predecessorTaskId,
+                        consumerTaskId: candidate.taskId,
+                    }))
+                    : []),
+                ...(candidate.dependsOnTaskIds.includes(oldTask.id)
+                    ? [{ predecessorTaskId: oldTask.id, consumerTaskId: candidate.taskId }]
+                    : []),
+            ];
+        });
+        if (structuralReplacementIsDisabled()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Structural replacement is disabled until a topology-preserving replacement transaction is implemented.', {
+                diagnosticCode: 'STRUCTURAL_REPLACEMENT_REQUIRED',
+                milestoneId: milestone.id,
+                oldTaskId: oldTask.id,
+                incidentDependencies,
+                requiredAction: 'Materialize P04-B/P05 before replacing this split-required Task.',
+            });
+        }
+        /* P04-B retains the existing one-for-one transaction below as implementation evidence,
+           but this route must remain unreachable until dependency rewiring is specified. */
         const riskAudit = readCurrentPlanRiskAudit(this.store, oldTask);
         if (!riskAudit)
             throw new WorkflowError('STATE_CORRUPT', 'The terminal Task has no current Plan Risk Audit.');
@@ -379,9 +531,19 @@ export class WorkflowService {
             checks: milestone.checks,
             memberships: [
                 ...milestone.memberships.map((candidate) => candidate.taskId === oldTask.id
-                    ? { ...candidate, disposition: 'cancelled', reason: replacementReason }
-                    : candidate),
-                { taskId: replacementTaskId, disposition: 'required', reason: replacementReason },
+                    ? {
+                        ...candidate,
+                        disposition: 'cancelled',
+                        reason: replacementReason,
+                        dependsOnTaskIds: [...(candidate.dependsOnTaskIds ?? [])],
+                    }
+                    : { ...candidate, dependsOnTaskIds: [...(candidate.dependsOnTaskIds ?? [])] }),
+                {
+                    taskId: replacementTaskId,
+                    disposition: 'required',
+                    reason: replacementReason,
+                    dependsOnTaskIds: [...(membership.dependsOnTaskIds ?? [])],
+                },
             ],
         };
         if (autonomyContractEventHash) {
@@ -504,7 +666,7 @@ export class WorkflowService {
         };
     }
     materializeMilestone(repository, discoveryId, expectedRevision, title, baseBranch = 'main') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -552,7 +714,7 @@ export class WorkflowService {
         };
     }
     setMilestonePlan(repository, milestoneId, expectedRevision, plan) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['planning', 'awaiting_execution_authorization', 'active', 'blocked'].includes(milestone.status)) {
@@ -590,41 +752,18 @@ export class WorkflowService {
                 throw new WorkflowError('TRANSITION_BLOCKED', `Started Task ${task.id} cannot be removed from a Milestone.`);
             }
         }
-        const authorizations = milestone.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
-            ? { ...authorization, decision: 'superseded' }
-            : authorization);
-        const root = this.store.milestoneRoot(identity.projectId, milestoneId);
-        const stagedPlan = this.store.stageArtifact(root, 'plan.json', JSON.stringify({
-            outcome: normalized.outcome,
-            successSignal: normalized.successSignal,
-            acceptance: normalized.acceptance,
-            memberships: normalized.memberships,
-            checks: normalized.checks,
-        }, null, 2));
-        const candidate = {
-            ...milestone,
-            status: 'awaiting_execution_authorization',
-            outcome: normalized.outcome,
-            successSignal: normalized.successSignal,
-            acceptance: normalized.acceptance,
-            taskIds,
-            memberships: normalized.memberships,
-            checks: normalized.checks,
-            membershipRevision: milestone.membershipRevision + 1,
-            authorizations,
-            planHash: stagedPlan.hash,
-            resultHash: null,
-            evidenceHash: null,
-            acceptedHead: null,
-            cancellationReason: null,
-        };
-        assertMilestoneMembershipIntegrity(candidate, (taskId) => this.store.readTask(identity.projectId, taskId), {}, () => this.store.listTasks(identity.projectId));
-        const saved = this.store.writeMilestone(candidate, expectedRevision);
-        this.store.publishArtifact(stagedPlan);
-        return saved;
+        return applyInitialMilestonePlanTransaction({
+            store: this.store,
+            milestone,
+            expectedRevision,
+            normalizedPlan: normalized,
+            now: this.now(),
+            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
+            listTasks: () => this.store.listTasks(identity.projectId),
+        });
     }
     prepareMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -641,7 +780,7 @@ export class WorkflowService {
         };
     }
     applyMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -664,9 +803,10 @@ export class WorkflowService {
         });
     }
     prepareMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
+        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         return prepareMilestoneAutonomyContract({
             projectId: identity.projectId,
             milestone,
@@ -677,9 +817,10 @@ export class WorkflowService {
         });
     }
     grantMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
+        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         return applyMilestoneAutonomyContract({
             store: this.store,
             projectId: identity.projectId,
@@ -692,7 +833,7 @@ export class WorkflowService {
         });
     }
     evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -722,12 +863,14 @@ export class WorkflowService {
         });
     }
     authorizeMilestone(repository, milestoneId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not awaiting authorization.`);
         }
+        assertMilestoneDependenciesDeclared(milestone);
+        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         const root = this.store.milestoneRoot(identity.projectId, milestoneId);
         const planHash = this.store.hashArtifact(root, 'plan.json');
         if (planHash !== milestone.planHash) {
@@ -751,7 +894,7 @@ export class WorkflowService {
         return this.store.writeMilestone({ ...milestone, status: 'active', planHash, authorizations: [...milestone.authorizations, event] }, expectedRevision);
     }
     validateMilestone(repository, milestoneId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
@@ -814,7 +957,7 @@ export class WorkflowService {
         return saved;
     }
     acceptMilestone(repository, milestoneId, expectedRevision, actor, confirmationCode, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_final_acceptance' || !milestone.resultHash || !milestone.evidenceHash) {
@@ -853,7 +996,7 @@ export class WorkflowService {
             resultHash,
             evidenceHash,
             headCommit: currentHead,
-            reason: `Confirmed with ${gate.confirmationCode}.`,
+            reason: 'Milestone final acceptance confirmed against the current validated state.',
             authorizationMode: delegation ? 'delegated' : 'human',
             ...(delegation ? { delegation } : {}),
         };
@@ -869,7 +1012,7 @@ export class WorkflowService {
     cancelMilestone(repository, milestoneId, expectedRevision, reason) {
         if (!reason.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone cancellation requires a reason.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (['accepted', 'cancelled'].includes(milestone.status)) {
@@ -879,21 +1022,59 @@ export class WorkflowService {
     }
     setTaskPlan(repository, taskId, expectedRevision, plan, correctiveAudit = null, planRiskAudit = null) {
         validatePlan(plan);
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const knowledgeMap = this.assertKnowledgeMapBinding(identity.repositoryRoot, identity.projectId, plan.knowledgeMapRevision, plan.knowledgeMapHash);
         this.validateKnowledgeTargets(knowledgeMap, plan);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
-        }
+        const correctiveDecisionEvents = task.planHash ? readCorrectiveDecisionEvents(this.store, task) : [];
         const currentPlanCorrectiveDecisions = task.planHash
-            ? readCorrectiveDecisionEvents(this.store, task).filter((event) => event.planHash === task.planHash)
+            ? correctiveDecisionEvents.filter((event) => event.planHash === task.planHash)
             : [];
         const currentReplanDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'replan-required');
-        const currentContinueFixDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'continue-fix');
+        const currentContinueFixDecisions = currentPlanCorrectiveDecisions.filter((event) => {
+            if (event.decision !== 'continue-fix')
+                return false;
+            const passedBoundary = latestPassedVerifiedStepReviewEvent(this.store, task, event.stepId);
+            return !passedBoundary || passedBoundary.recordedAt <= event.recordedAt;
+        });
         const currentHardBlockingDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'split-required' || event.decision === 'stop-escalate');
-        const currentReplanRequiredStepIds = [...new Set(currentReplanDecisions.map((event) => event.stepId))];
+        const currentPlanRiskAudit = task.status === 'needs_fix' || currentReplanDecisions.length > 0
+            ? readCurrentPlanRiskAudit(this.store, task)
+            : null;
+        const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
+            ? findCurrentGuardedRemediationPosture(this.store, task, currentPlanRiskAudit)
+            : null;
+        const correctiveReplanPosture = classifiedCorrectivePosture?.posture === 'replan-required'
+            ? classifiedCorrectivePosture
+            : currentPlanRiskAudit
+                ? identifyCorrectiveReplanPosture(task, currentPlanRiskAudit.reviewRequiredStepIds, correctiveDecisionEvents, readRemediationEvents(this.store, task))
+                : null;
+        const correctiveReplanAvailability = correctiveReplanPosture?.posture === 'replan-required'
+            ? evaluateTaskCorrectiveReplanAvailability(task, correctiveReplanPosture)
+            : null;
+        if (currentReplanDecisions.length > 0) {
+            if (!correctiveReplanAvailability?.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} is blocked for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    posture: correctiveReplanPosture?.posture ?? null,
+                    evaluationPhase: correctiveReplanAvailability?.phase ?? 'availability',
+                    blockingGuardIds: correctiveReplanAvailability?.blockingGuardIds ?? [],
+                    pendingGuardIds: correctiveReplanAvailability?.pendingGuardIds ?? [],
+                    guardResults: correctiveReplanAvailability?.guardResults ?? [],
+                });
+            }
+            throw new WorkflowError('TRANSITION_BLOCKED', `Legacy task plan-set cannot execute ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID}.`, {
+                taskId: task.id,
+                transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                requiredAction: readTaskC1Posture(this.store, task).state === 'claimed'
+                    ? 'Run task corrective-yield first, then use task corrective-replan-prepare.'
+                    : 'Use task corrective-replan-prepare, confirm, and execute.',
+            });
+        }
+        else if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
+        }
         if (currentHardBlockingDecisions.length > 0) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has current corrective decisions that prohibit normal plan updates.`, {
                 taskId: task.id,
@@ -923,9 +1104,6 @@ export class WorkflowService {
                 })),
             });
         }
-        const currentPlanRiskAudit = task.status === 'needs_fix'
-            ? readCurrentPlanRiskAudit(this.store, task)
-            : null;
         const failedReviewAttempts = countFailedReviewAttempts(this.store.taskRoot(identity.projectId, taskId));
         if (task.status === 'needs_fix' && task.review.status === 'failed' && failedReviewAttempts >= 2) {
             validateCorrectivePlanAudit(task, correctiveAudit, failedReviewAttempts);
@@ -968,7 +1146,7 @@ export class WorkflowService {
             }
         }
         const root = this.store.taskRoot(identity.projectId, taskId);
-        const stagedPlan = this.store.stageArtifact(root, 'plan.md', renderPlan(task, plan));
+        const preparedPlan = prepareCorrectiveReplanCandidate(task, plan);
         const authorizations = task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
             ? { ...authorization, decision: 'superseded' }
             : authorization);
@@ -985,12 +1163,17 @@ export class WorkflowService {
             plannedSteps.every((step) => step.status === 'completed')) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'A failed review requires at least one new or changed remediation Step.');
         }
-        if (currentReplanRequiredStepIds.some((stepId) => !plannedSteps.some((step) => step.id === stepId))) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Replacement Plan under replan-required must retain every guarded Step targeted by the current corrective decision; removing or renaming one would reset remediation history.`, {
-                taskId: task.id,
-                requiredStepIds: currentReplanRequiredStepIds,
-                plannedStepIds: plannedSteps.map((step) => step.id),
-            });
+        if (correctiveReplanPosture?.posture === 'replan-required') {
+            const executionEvaluation = evaluateTaskCorrectiveReplanCandidate(task, correctiveReplanPosture, preparedPlan);
+            if (!executionEvaluation.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} rejected the candidate Plan for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    evaluationPhase: executionEvaluation.phase,
+                    blockingGuardIds: executionEvaluation.blockingGuardIds,
+                    pendingGuardIds: executionEvaluation.pendingGuardIds,
+                    guardResults: executionEvaluation.guardResults,
+                });
+            }
         }
         if (guardedRemediationGate && currentReplanDecisions.length === 0 && !plannedSteps.some((step) => step.id === guardedRemediationGate.stepId)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Continue-fix must retain guarded Step ${guardedRemediationGate.stepId}; removing or renaming it would reset the remediation breaker.`, {
@@ -998,14 +1181,10 @@ export class WorkflowService {
                 stepId: guardedRemediationGate.stepId,
             });
         }
-        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
-            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
-            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, stagedPlan.hash, this.now());
-        }
         const candidate = {
             ...task,
             status: 'awaiting_execution_authorization',
-            planHash: stagedPlan.hash,
+            planHash: preparedPlan.planHash,
             planObjective: plan.objective,
             requirements: plan.requirements,
             acceptance: plan.acceptance,
@@ -1025,6 +1204,18 @@ export class WorkflowService {
         };
         if (planRiskAudit)
             validatePlanRiskAuditCandidate(this.store, candidate, planRiskAudit);
+        const stagedPlan = this.store.stageArtifact(root, 'plan.md', preparedPlan.planBytes);
+        if (stagedPlan.hash !== preparedPlan.planHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Prepared candidate Plan hash changed during staging.', {
+                taskId: task.id,
+                preparedPlanHash: preparedPlan.planHash,
+                stagedPlanHash: stagedPlan.hash,
+            });
+        }
+        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
+            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
+            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, preparedPlan.planHash, this.now());
+        }
         const saved = this.store.writeTask(candidate, expectedRevision);
         this.store.publishArtifact(stagedPlan);
         if (planRiskAudit)
@@ -1035,7 +1226,7 @@ export class WorkflowService {
         return saved;
     }
     rebindTaskKnowledge(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.assertTaskContextChangeAllowed(task);
@@ -1120,7 +1311,7 @@ export class WorkflowService {
         if (!delegationGrantId) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Task context refresh combines approval transitions and therefore requires an explicit delegated approval grant.');
         }
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const currentMap = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(task, expectedTaskRevision);
@@ -1211,7 +1402,7 @@ export class WorkflowService {
         });
     }
     authorizeTask(repository, taskId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1222,7 +1413,24 @@ export class WorkflowService {
         const root = this.store.taskRoot(identity.projectId, taskId);
         const briefHash = this.store.hashArtifact(root, 'brief.md');
         const planHash = this.store.hashArtifact(root, 'plan.md');
+        if (task.briefHash !== briefHash || task.planHash !== planHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Task Plan authority does not match its stored artifacts.', {
+                taskId: task.id,
+                stateBriefHash: task.briefHash,
+                artifactBriefHash: briefHash,
+                statePlanHash: task.planHash,
+                artifactPlanHash: planHash,
+            });
+        }
         readCurrentPlanRiskAudit(this.store, task, { requireCurrentTaskRevision: true });
+        const mechanicalFeasibility = evaluateMechanicalFeasibility(identity.repositoryRoot, task, briefHash, planHash);
+        if (mechanicalFeasibility.decision === 'blocked') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task Plan contains a proven mechanical contradiction.', {
+                diagnosticCode: 'MECHANICAL_PLAN_INFEASIBILITY',
+                mechanicalFeasibility,
+                requiredAction: 'task plan-set',
+            });
+        }
         const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
         const event = {
             kind: 'execution',
@@ -1232,16 +1440,17 @@ export class WorkflowService {
             briefHash,
             planHash,
             resultHash: null,
-            evidenceHash: null,
-            headCommit: null,
+            evidenceHash: hashMechanicalFeasibilityEvidence(mechanicalFeasibility),
+            headCommit: mechanicalFeasibility.evaluatedHead,
             reason,
             authorizationMode: delegation ? 'delegated' : 'human',
             ...(delegation ? { delegation } : {}),
+            mechanicalFeasibility,
         };
         return this.store.writeTask({ ...task, status: 'ready', briefHash, planHash, authorizations: [...task.authorizations, event] }, expectedRevision);
     }
     recordPlanRiskAudit(repository, taskId, expectedRevision, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1249,7 +1458,7 @@ export class WorkflowService {
         return appendCurrentPlanRiskAudit(this.store, task, input, this.now());
     }
     showTaskHandoff(repository, taskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         return {
             task,
@@ -1257,8 +1466,8 @@ export class WorkflowService {
             claimTokenAvailable: false,
         };
     }
-    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null) {
-        const context = this.context(repository);
+    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null, replacePending = false) {
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
@@ -1268,6 +1477,9 @@ export class WorkflowService {
         if (grantId)
             this.assertHandoffGrant(context.identity.projectId, task, targetActor, grantId);
         const milestone = task.milestoneId ? this.readMilestoneCurrent(task.projectId, task.milestoneId) : null;
+        const dependencyBinding = milestone
+            ? this.currentMilestoneDependencyBinding(milestone, task.id)
+            : null;
         const milestones = milestone ? this.listMilestonesCurrent(task.projectId) : [];
         const milestoneDisplayNumber = milestone
             ? milestones.findIndex((candidate) => candidate.id === milestone.id) + 1
@@ -1313,9 +1525,11 @@ export class WorkflowService {
                 writerToken: lease.token,
                 milestoneDisplayNumber,
                 taskDisplayNumber,
+                dependencyBinding,
                 expectedNext: String(nextForTask(task).action ?? 'task show'),
                 grantId,
                 expiresAt: expiresAt ?? new Date(this.now().getTime() + 24 * 60 * 60 * 1000).toISOString(),
+                replacePending,
             }, this.now());
             releaseLease();
             return { task, event: prepared.event, bundle: prepared.bundle };
@@ -1327,15 +1541,19 @@ export class WorkflowService {
         }
     }
     claimTask(repository, taskId, expectedRevision, actor, claimToken, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
         if (!normalizedActor) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Claim actor is required.');
         }
-        const pendingHandoff = readTaskC1Posture(this.store, task);
-        if (pendingHandoff.state === 'pending' && pendingHandoff.latestEvent.grantId) {
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
+        const dependencyBinding = task.milestoneId
+            ? this.currentMilestoneDependencyBinding(this.readMilestoneCurrent(task.projectId, task.milestoneId), task.id)
+            : null;
+        const pendingHandoff = assertTaskClaimAllowed(this.store, task, normalizedActor, claimToken, this.now(), dependencyBinding);
+        if (pendingHandoff.latestEvent.grantId) {
             this.assertHandoffGrant(context.identity.projectId, task, normalizedActor, pendingHandoff.latestEvent.grantId);
         }
         const existingLease = context.locks.inspect(taskId);
@@ -1367,8 +1585,15 @@ export class WorkflowService {
             lease = context.locks.acquire(taskId, normalizedActor);
         }
         try {
-            const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now());
-            return { task, event, lease };
+            const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now(), dependencyBinding);
+            return {
+                task,
+                event,
+                lease: toPublicWriterLease(lease, this.now()),
+                writerCredential: acquiredHere
+                    ? { disposition: 'issued', token: lease.token }
+                    : { disposition: 'renewed' },
+            };
         }
         catch (error) {
             if (acquiredHere)
@@ -1376,8 +1601,61 @@ export class WorkflowService {
             throw error;
         }
     }
+    replaceClaimedWriterCredential(repository, taskId, expectedRevision, actor) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const normalizedActor = actor.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Writer credential replacement actor is required.');
+        const posture = readTaskC1Posture(this.store, task);
+        if (posture.state === 'claimed' && task.milestoneId) {
+            const dependencyBinding = this.currentMilestoneDependencyBinding(this.readMilestoneCurrent(task.projectId, task.milestoneId), task.id);
+            const claimedBinding = posture.latestEvent.dependencyBinding ?? null;
+            if (claimedBinding === null
+                || claimedBinding.milestoneRevision !== dependencyBinding.milestoneRevision
+                || claimedBinding.membershipRevision !== dependencyBinding.membershipRevision
+                || claimedBinding.milestonePlanHash !== dependencyBinding.milestonePlanHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Writer credential replacement requires a current Milestone dependency binding.', {
+                    diagnosticCode: 'MILESTONE_DEPENDENCY_BINDING_STALE',
+                    taskId: task.id,
+                    milestoneId: task.milestoneId,
+                    claimDependencyBinding: claimedBinding,
+                    currentDependencyBinding: dependencyBinding,
+                });
+            }
+        }
+        const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const action = String(navigation.action);
+        const currentLease = context.locks.inspect(taskId);
+        const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed');
+        const requiredActor = writerTokenContract
+            ? this.writerCredentialRecoveryActor(task, action, posture.state === 'claimed' ? posture.claimant : null, currentLease?.owner ?? null)
+            : null;
+        if (!requiredActor || requiredActor !== normalizedActor) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} writer credential replacement requires the exact advertised recovery actor.`, {
+                taskId,
+                posture: posture.state,
+                claimant: posture.state === 'claimed' ? posture.claimant : null,
+                actor: normalizedActor,
+                requiredActor,
+                nextAction: action,
+            });
+        }
+        const lease = currentLease
+            ? context.locks.replaceCredential(taskId, normalizedActor)
+            : context.locks.acquire(taskId, normalizedActor);
+        if (posture.state === 'claimed') {
+            appendTaskWriterCredentialReplacement(this.store, task, normalizedActor, lease.token, this.now());
+        }
+        return {
+            task,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: 'issued', token: lease.token },
+        };
+    }
     handbackTask(repository, taskId, expectedRevision, actor, reason, writerToken = null, limitations = [], recommendedNext = 'Coordinator reviews the terminal Task result and recorded evidence.') {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = task.status === 'merged' || task.status === 'cancelled'
@@ -1389,23 +1667,16 @@ export class WorkflowService {
         return { task, event };
     }
     startTask(repository, taskId, expectedRevision, workspaceOwner) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(identity, taskId);
         if (task.status !== 'ready')
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} is ${task.status}.`);
-        this.assertExecutionAuthorizationFresh(task);
+        const executionAuthorization = this.assertExecutionAuthorizationFresh(task, identity.repositoryRoot);
         if (task.milestoneId) {
             const milestone = this.readMilestoneCurrent(identity.projectId, task.milestoneId);
-            const membership = milestone.memberships.find((candidate) => candidate.taskId === taskId);
-            if (milestone.status !== 'active' || membership?.disposition !== 'required') {
-                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone-linked Task requires an active, authorized membership.', {
-                    milestoneId: milestone.id,
-                    milestoneStatus: milestone.status,
-                    disposition: membership?.disposition ?? null,
-                });
-            }
+            const dependencyBinding = this.currentMilestoneDependencyBinding(milestone, task.id);
             const handoffPosture = readTaskC1Posture(this.store, task);
             if (handoffPosture.state !== 'claimed') {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone-linked Task start requires a prepared and claimed C1 handoff bundle.', {
@@ -1415,6 +1686,20 @@ export class WorkflowService {
                     requiredAction: handoffPosture.state === 'pending' ? 'Claim the prepared handoff.' : 'Prepare and claim a C1 handoff.',
                 });
             }
+            const claimBinding = handoffPosture.latestEvent.dependencyBinding ?? null;
+            if (claimBinding === null
+                || claimBinding.milestoneRevision !== dependencyBinding.milestoneRevision
+                || claimBinding.membershipRevision !== dependencyBinding.membershipRevision
+                || claimBinding.milestonePlanHash !== dependencyBinding.milestonePlanHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone-linked Task start requires a current dependency-bound C1 claim.', {
+                    diagnosticCode: 'MILESTONE_DEPENDENCY_BINDING_STALE',
+                    taskId: task.id,
+                    milestoneId: milestone.id,
+                    claimDependencyBinding: handoffPosture.latestEvent.dependencyBinding ?? null,
+                    currentDependencyBinding: dependencyBinding,
+                    requiredAction: 'Prepare and claim a new C1 handoff from the current Milestone Plan.',
+                });
+            }
         }
         if (!isClean(identity.repositoryRoot)) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Task start requires a clean checkout.', {
@@ -1424,12 +1709,22 @@ export class WorkflowService {
         const branch = `codex/task-${task.id.slice(5, 15).toLowerCase()}-${task.slug}`;
         let baseCommit;
         let taskBranch;
+        const authorizedBaseCommit = executionAuthorization.mechanicalFeasibility?.sourceKind === 'pre-start-base'
+            ? executionAuthorization.mechanicalFeasibility.evaluatedHead
+            : null;
         if (workspaceOwner === 'local') {
-            baseCommit = startLocalTaskBranch(identity.repositoryRoot, branch, task.baseBranch);
+            baseCommit = startLocalTaskBranch(identity.repositoryRoot, branch, task.baseBranch, authorizedBaseCommit);
             taskBranch = branch;
         }
         else {
             baseCommit = runGit(identity.repositoryRoot, ['rev-parse', task.baseBranch]);
+            if (authorizedBaseCommit !== null && baseCommit !== authorizedBaseCommit) {
+                throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Task start base moved after execution authorization.', {
+                    baseBranch: task.baseBranch,
+                    authorizedBaseCommit,
+                    currentBaseCommit: baseCommit,
+                });
+            }
             taskBranch = currentBranch(identity.repositoryRoot);
             if (!taskBranch || taskBranch === task.baseBranch) {
                 throw new WorkflowError('GIT_PRECONDITION_FAILED', `Externally owned execution requires a dedicated branch different from ${task.baseBranch}.`);
@@ -1441,14 +1736,14 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, baseCommit, taskBranch, workspaceOwner, blockReason: null }, expectedRevision);
     }
     runStep(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         if (!['ready', 'in_progress', 'needs_fix'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot run a Step while ${task.status}.`);
         }
-        this.assertExecutionAuthorizationFresh(task);
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
         const currentPlanBlockingDecisions = readCorrectiveDecisionEvents(this.store, task)
             .filter((event) => event.planHash === task.planHash && event.decision !== 'continue-fix');
         if (currentPlanBlockingDecisions.length > 0) {
@@ -1470,6 +1765,7 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} cannot start from ${step.status}.`);
         }
         const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        let resumesCorrectiveReplan = false;
         if (remediationHistoryForStep.length > 0 && (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds))) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} has remediation history but is no longer marked for guarded review by the current Plan Risk Audit; execution is blocked until the audit and Step posture are reconciled.`, {
                 taskId,
@@ -1484,20 +1780,21 @@ export class WorkflowService {
                 && guardedPosture.correctiveDecision.planHash !== task.planHash
                 ? guardedPosture.correctiveDecision
                 : null;
-            const recovery = staleDecision
+            const recovery = staleDecision?.decision === 'continue-fix'
                 ? requireCorrectiveDecisionRecoveryForRun(this.store, task, stepId, actor, writerToken)
                 : null;
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            const gate = assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            resumesCorrectiveReplan = gate.posture === 'replan-ready';
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        if (step.status === 'planned' && dirty.length > 0) {
+        if (step.status === 'planned' && dirty.length > 0 && !resumesCorrectiveReplan) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
-        if (step.status === 'failed' && dirtyOutsideStep.length > 0) {
+        if ((step.status === 'failed' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} retry has changes outside allowedWrites.`, {
                 changedFiles: dirtyOutsideStep,
             });
@@ -1555,7 +1852,8 @@ export class WorkflowService {
         }
         return {
             task: saved,
-            lease,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: acquiredHere ? 'issued' : 'renewed' },
             envelope: {
                 protocolVersion: PROTOCOL_VERSION,
                 packageVersion: PACKAGE_VERSION,
@@ -1591,14 +1889,14 @@ export class WorkflowService {
                 taskId,
                 stepId,
                 expectedRevision: saved.revision,
-                writerToken: lease.token,
+                writerToken: acquiredHere ? lease.token : null,
                 knowledgeMap: knowledgeSummary(knowledgeMap),
                 knowledgeSources: selectKnowledgeSources(knowledgeMap, 'worker', task.knowledgeTargets.map((target) => target.path)),
             },
         };
     }
     taskContext(repository, taskId, role) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const historicalStrictReview = role === 'independent-reviewer'
             && task.steps.some((step) => step.status === 'in_progress' && step.evidence !== null);
@@ -1677,7 +1975,7 @@ export class WorkflowService {
         };
     }
     completeStep(repository, taskId, stepId, expectedRevision, writerToken, notes, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
@@ -1763,7 +2061,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'in_progress', steps, blockReason: null }, expectedRevision);
     }
     reviewStep(repository, taskId, stepId, expectedRevision, runner, actor, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1819,10 +2117,18 @@ export class WorkflowService {
                     resolution: currentCycle.resolution,
                 });
             }
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit);
+            const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+            if (infrastructureFailures >= MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review exhausted its bounded infrastructure retries.', {
+                    taskId: task.id,
+                    stepId,
+                    infrastructureFailures,
+                    requiredAction: 'Use an external sealed reviewer or run doctor; do not start another local reviewer process.',
+                });
+            }
         }
         else if (currentCycle.resolution !== 'pending') {
-            if (currentCycle.resolution === 'failed' || currentCycle.resolution === 'unverified') {
+            if (currentCycle.resolution === 'failed') {
                 if (!currentCycle.reviewRecordedEvent || !currentCycle.reviewerAttestationEvent) {
                     throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review recovery requires exact review and attestation sidecars.', {
                         taskId: task.id,
@@ -1830,7 +2136,7 @@ export class WorkflowService {
                         resolution: currentCycle.resolution,
                     });
                 }
-                appendRemediationEvent(this.store, task, stepId, currentCycle.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+                appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                     completionCommit: currentCycle.reviewRecordedEvent.completionCommit,
                     checksHash: currentCycle.reviewRecordedEvent.checksHash,
                     reviewEventHash: currentCycle.reviewRecordedEvent.eventHash,
@@ -1848,7 +2154,7 @@ export class WorkflowService {
             reviewedCommit: launch.reviewedCommit,
             isolationResult: launch.verifiedIsolation ? 'verified' : 'unverified',
         }, this.now());
-        if (recorded.resolution === 'failed' || recorded.resolution === 'unverified') {
+        if (recorded.resolution === 'failed') {
             const reviewRecordedEvent = recorded.reviewRecordedEvent;
             const reviewerAttestationEvent = recorded.reviewerAttestationEvent;
             if (!reviewRecordedEvent || !reviewerAttestationEvent) {
@@ -1858,7 +2164,7 @@ export class WorkflowService {
                     resolution: recorded.resolution,
                 });
             }
-            appendRemediationEvent(this.store, task, stepId, recorded.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                 completionCommit: reviewRecordedEvent.completionCommit,
                 checksHash: reviewRecordedEvent.checksHash,
                 reviewEventHash: reviewRecordedEvent.eventHash,
@@ -1867,8 +2173,132 @@ export class WorkflowService {
         }
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
+    prepareExternalStepReview(repository, taskId, stepId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (task.status !== 'in_progress' && task.status !== 'blocked') {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} is not marked for strict review by the current Plan Risk Audit.`);
+        }
+        const step = requireStep(task, stepId);
+        if (step.status !== 'in_progress' || !step.evidence) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review requires ${stepId} in progress with canonical evidence.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot) || headCommit(identity.repositoryRoot) !== step.evidence.commitSha) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Step Review requires a clean checkout at the completion commit.');
+        }
+        const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
+        return prepareExternalStrictStepReviewPacket(identity.repositoryRoot, task, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence);
+    }
+    recordExternalStepReview(repository, taskId, stepId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalStepReview(repository, taskId, stepId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictStepReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Step reviewer must differ from the lifecycle mutation actor.');
+        }
+        const currentCycle = buildCurrentStrictStepReviewCycle(this.store, task, stepId);
+        if (task.status === 'blocked' && currentCycle.resolution !== 'unverified') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue requires an unverified prior review cycle.', {
+                taskId,
+                stepId,
+                resolution: currentCycle.resolution,
+            });
+        }
+        const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+        if (infrastructureFailures > MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue exceeded its bounded infrastructure history.', {
+                taskId,
+                stepId,
+                infrastructureFailures,
+            });
+        }
+        ensurePendingStrictStepReview(this.store, task, stepId, this.now());
+        const recorded = recordStrictStepReview(this.store, task, stepId, {
+            review,
+            reviewerOutputHash: strictReviewInputHash(review),
+            reviewedCommit: packet.reviewedCommit,
+            isolationResult: 'verified',
+        }, this.now());
+        if (recorded.resolution === 'failed') {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
+                completionCommit: recorded.reviewRecordedEvent.completionCommit,
+                checksHash: recorded.reviewRecordedEvent.checksHash,
+                reviewEventHash: recorded.reviewRecordedEvent.eventHash,
+                reviewerAttestationHash: recorded.reviewerAttestationEvent.eventHash,
+            }, readCurrentPlanRiskAudit(this.store, task), this.now());
+        }
+        const saved = this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, review.summary), expectedRevision);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
+    prepareExternalTaskReview(repository, taskId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
+        if (task.status !== 'validating' && !retryingUnverified) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Task Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        assertTaskBranch(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Task Review requires a clean Task checkout.');
+        }
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        if (!task.evidenceHash || this.store.hashArtifact(taskRoot, 'evidence.json') !== task.evidenceHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'External Strict Task Review requires the exact submitted evidence artifact.');
+        }
+        return prepareExternalStrictTaskReviewPacket(identity.repositoryRoot, task, taskRoot, this.taskContext(repository, taskId, 'independent-reviewer'));
+    }
+    recordExternalTaskReview(repository, taskId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalTaskReview(repository, taskId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictTaskReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict Task review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Task reviewer must differ from the lifecycle mutation actor.');
+        }
+        const saved = this.recordReview(repository, taskId, expectedRevision, review, actor, writerToken);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
     submitTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1900,11 +2330,11 @@ export class WorkflowService {
         return saved;
     }
     recordReview(repository, taskId, expectedRevision, review, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
         if (task.status !== 'validating' && !retryingUnverified) {
@@ -1942,30 +2372,71 @@ export class WorkflowService {
         return saved;
     }
     recoverStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         if (!['ready', 'in_progress', 'needs_fix'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot recover a corrective decision while ${task.status}.`);
         }
-        this.assertExecutionAuthorizationFresh(task);
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
         this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         return appendCorrectiveDecisionRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recoverRemediationMode(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         return appendRemediationModeRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
+    recoverPlanIntegrity(repository, taskId, stepId, expectedRevision, actor, writerToken) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.requireExecutionAdoptionPosture(context.identity, taskId);
+        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
+        this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
+        assertTaskBranch(context.identity.repositoryRoot, task);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const handoff = readTaskC1Posture(this.store, task);
+        const requiredActor = handoff.state === 'claimed'
+            ? handoff.claimant
+            : defaultPlanIntegrityRecoveryActor(task.id);
+        if (actor.trim() !== requiredActor) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity recovery actor does not match the fresh Workflow route.', {
+                taskId,
+                stepId,
+                requiredActor,
+                actualActor: actor.trim(),
+            });
+        }
+        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity recovery requires the failed Step to be guarded by the current Plan Risk Audit.', {
+                taskId,
+                stepId,
+            });
+        }
+        const assessment = assessPlanIntegrityRecovery(this.store, context.identity.repositoryRoot, task, stepId);
+        if (!assessment.applicable || !assessment.eligible || !assessment.evidence) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Bounded Plan-integrity recovery is not eligible for the current Task state.', {
+                taskId,
+                stepId,
+                applicable: assessment.applicable,
+                blockers: assessment.blockers,
+            });
+        }
+        const event = appendPlanIntegrityRecoveryDecision(this.store, task, stepId, defaultPlanIntegrityRecoveryActor(task.id), assessment.evidence, this.now());
+        return { assessment, event };
+    }
     recordStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, correctiveAudit, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         if (!['ready', 'needs_fix', 'blocked'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot record a corrective decision while ${task.status}.`);
@@ -2007,7 +2478,7 @@ export class WorkflowService {
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
     setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
@@ -2021,7 +2492,7 @@ export class WorkflowService {
         return saved;
     }
     acceptTask(repository, taskId, expectedRevision, actor, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'awaiting_final_acceptance' || !task.resultHash || !task.evidenceHash) {
@@ -2059,7 +2530,7 @@ export class WorkflowService {
         }, expectedRevision);
     }
     syncTaskBase(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.taskBranch || !task.baseCommit) {
@@ -2111,7 +2582,7 @@ export class WorkflowService {
         return saved;
     }
     mergeTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2133,7 +2604,7 @@ export class WorkflowService {
         return saved;
     }
     confirmExternalMerge(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2150,21 +2621,22 @@ export class WorkflowService {
         return saved;
     }
     status(repository) {
-        const { identity } = this.context(repository);
-        const tasks = this.store.listTasks(identity.projectId);
-        const rawMilestones = this.store.listMilestones(identity.projectId);
-        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones);
+        const snapshot = this.observationSnapshot(repository);
         return {
-            projectId: identity.projectId,
-            discoveries: this.store.listDiscoveries(identity.projectId),
-            tasks,
-            milestones: this.listMilestonesCurrent(identity.projectId, adoption.currentPosture),
-            delegations: this.store.listDelegations(identity.projectId),
-            adoption,
+            projectId: snapshot.identity.projectId,
+            discoveries: snapshot.discoveries,
+            tasks: snapshot.tasks,
+            milestones: snapshot.milestones,
+            milestoneInitialAssembly: snapshot.milestones
+                .map((milestone) => this.describeMilestoneInitialAssembly(snapshot.identity.projectId, milestone, snapshot.tasks))
+                .filter((value) => value !== null),
+            delegations: snapshot.delegations,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
         };
     }
     recoverMilestoneTransactions(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestones = this.listMilestonesCurrent(identity.projectId, readCurrentAdoptionPosture(this.store, identity.projectId));
         return {
             projectId: identity.projectId,
@@ -2172,11 +2644,11 @@ export class WorkflowService {
         };
     }
     prepareAdoption(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.inspectAdoptionPreparation(identity, this.store.listTasks(identity.projectId), this.store.listMilestones(identity.projectId));
     }
     applyAdoption(repository, actor, confirmationCode) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const tasks = context.store.listTasks(context.identity.projectId);
         const milestones = context.store.listMilestones(context.identity.projectId);
         return applyAdoptionPosture(this.store, {
@@ -2193,19 +2665,19 @@ export class WorkflowService {
         }, actor, confirmationCode);
     }
     updatePreflight(repository) {
-        const context = this.context(repository);
-        const tasks = context.store.listTasks(context.identity.projectId);
-        const milestones = context.store.listMilestones(context.identity.projectId);
-        const dirty = changedFiles(context.identity.repositoryRoot);
+        const snapshot = this.observationSnapshot(repository);
+        const tasks = snapshot.tasks;
+        const milestones = snapshot.milestones;
+        const dirty = changedFiles(snapshot.identity.repositoryRoot);
         const runningSteps = tasks.flatMap((task) => task.steps
             .filter((step) => step.status === 'in_progress')
             .map((step) => ({ taskId: task.id, stepId: step.id })));
-        const leases = context.locks.list();
+        const leases = snapshot.leases;
         const now = this.now().getTime();
         const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
         const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
         const activeMilestones = milestones.filter((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
-        const inspectedVersions = inspectWorkflowVersions(context.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
+        const inspectedVersions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
         const milestoneBases = inspectedVersions.milestoneBases.map((base) => ({
             ...base,
             milestoneIds: activeMilestones.filter((milestone) => milestone.baseBranch === base.branch).map((milestone) => milestone.id),
@@ -2232,31 +2704,20 @@ export class WorkflowService {
             ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
             ...(staleLeases.length > 0 ? ['At least one stale writer lease requires explicit repair.'] : []),
             ...versionBlockers,
+            ...observationPreflightBlockers(snapshot.observation),
         ];
-        const adoption = buildAdoptionPreparation({
-            projectId: context.identity.projectId,
-            repositoryIdentity: context.identity,
-            packageVersion: PACKAGE_VERSION,
-            protocolVersion: PROTOCOL_VERSION,
-            stateSchemaVersion: STATE_SCHEMA_VERSION,
-            tasks,
-            milestones,
-            sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
-            blockers,
-            now: this.now(),
-        }, readCurrentAdoptionPosture(this.store, context.identity.projectId));
         return {
             safe: blockers.length === 0,
             packageVersion: PACKAGE_VERSION,
             protocolVersion: PROTOCOL_VERSION,
             stateSchemaVersion: STATE_SCHEMA_VERSION,
-            projectId: context.identity.projectId,
-            repositoryRoot: context.identity.repositoryRoot,
+            projectId: snapshot.identity.projectId,
+            repositoryRoot: snapshot.identity.repositoryRoot,
             clean: dirty.length === 0,
             changedFiles: dirty,
             runningSteps,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             blockers,
             workflowVersions: {
                 runtime: inspectedVersions.runtime,
@@ -2272,11 +2733,134 @@ export class WorkflowService {
                     ? null
                     : 'Land only package.json/package-lock.json dependency changes on every active Milestone base; do not transport unrelated product commits.',
             },
-            adoption,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
+        };
+    }
+    dependencyProvenanceRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Dependency provenance recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        return this.inspectDependencyProvenanceCandidate(snapshot, task);
+    }
+    recoverDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        const normalizedActor = actor.trim();
+        const normalizedReason = reason.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Dependency provenance recovery requires an actor.');
+        if (!normalizedReason)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Dependency provenance recovery requires a reason.');
+        const context = this.#mutationContext(repository);
+        const current = context.store.readTask(context.identity.projectId, taskId);
+        const currentHead = headCommit(context.identity.repositoryRoot);
+        const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead && record.packageVersion === PACKAGE_VERSION);
+        if (prior && current.systemCommits.includes(currentHead))
+            return current;
+        assertExpectedRevision(current, expectedRevision);
+        const snapshot = this.observationSnapshot(repository);
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task);
+        if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
+                taskId,
+                blockers: preflight.blockers,
+            });
+        }
+        return context.store.writeTask({
+            ...task,
+            systemCommits: [...task.systemCommits, preflight.commitSha],
+            dependencyProvenanceRecoveries: [
+                ...(task.dependencyProvenanceRecoveries ?? []),
+                {
+                    commitSha: preflight.commitSha,
+                    parentCommitSha: preflight.parentCommitSha,
+                    packageName: PACKAGE_NAME,
+                    packageVersion: PACKAGE_VERSION,
+                    files: ['package-lock.json', 'package.json'],
+                    actor: normalizedActor,
+                    reason: normalizedReason,
+                    recordedAt: this.now().toISOString(),
+                    retainedHistoricalCommits: preflight.retainedHistoricalCommits,
+                },
+            ],
+        }, expectedRevision);
+    }
+    milestoneProgress(repository, milestoneId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone progress requires a coherent read-only observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const milestone = snapshot.milestones.find((candidate) => candidate.id === milestoneId);
+        if (!milestone)
+            throw new WorkflowError('NOT_FOUND', `Milestone ${milestoneId} was not found in this repository.`);
+        const tasksById = new Map(snapshot.tasks.map((task) => [task.id, task]));
+        const tasks = milestone.memberships.map((membership, index) => {
+            const task = tasksById.get(membership.taskId);
+            if (!task)
+                throw new WorkflowError('STATE_CORRUPT', `Milestone member ${membership.taskId} does not exist.`);
+            const stepsCompleted = task.steps.filter((step) => ['completed', 'skipped'].includes(step.status)).length;
+            const dependency = assessMilestoneTaskDependencies(milestone, task.id, (candidateTaskId) => {
+                const candidate = tasksById.get(candidateTaskId);
+                if (!candidate)
+                    throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+                return candidate;
+            });
+            const executionEligible = milestone.status === 'active' && !['merged', 'cancelled'].includes(task.status);
+            return {
+                ordinal: `T${String(index + 1).padStart(2, '0')}`,
+                taskId: task.id,
+                title: task.title,
+                status: task.status,
+                revision: task.revision,
+                disposition: membership.disposition,
+                membershipReason: membership.reason,
+                dependencyState: dependency.dependencyState,
+                dependsOnTaskIds: dependency.dependsOnTaskIds,
+                unsatisfiedPredecessors: dependency.unsatisfiedPredecessors,
+                runnable: executionEligible && dependency.runnable,
+                dependencyBlockReason: !executionEligible
+                    ? milestone.status !== 'active'
+                        ? `Milestone is ${milestone.status}, not active.`
+                        : `Task is terminal (${task.status}).`
+                    : dependency.blockReason,
+                replacementForTaskId: task.replacementForTaskId ?? null,
+                replacedByTaskId: task.replacedByTaskId ?? null,
+                stepsCompleted,
+                stepsTotal: task.steps.length,
+                steps: task.steps.map((step, stepIndex) => ({
+                    ordinal: `S${String(stepIndex + 1).padStart(2, '0')}`,
+                    stepId: step.id,
+                    title: step.title,
+                    status: step.status,
+                })),
+            };
+        });
+        const required = tasks.filter((task) => task.disposition === 'required');
+        return {
+            readOnly: true,
+            projectId: snapshot.identity.projectId,
+            milestoneId: milestone.id,
+            milestoneTitle: milestone.title,
+            milestoneStatus: milestone.status,
+            milestoneRevision: milestone.revision,
+            membershipRevision: milestone.membershipRevision,
+            tasksCompleted: required.filter((task) => task.status === 'merged').length,
+            tasksRequired: required.length,
+            tasks,
         };
     }
     alpha6StrictReviewRescuePreflight(repository) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const dependency = inspectLocalDependency(context.identity.repositoryRoot);
         const tasks = context.store.listTasks(context.identity.projectId);
         const leases = context.locks.list();
@@ -2371,15 +2955,15 @@ export class WorkflowService {
             projectId: context.identity.projectId,
             repositoryRoot: context.identity.repositoryRoot,
             clean: dirty.length === 0,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             candidate,
             blockers,
             requiredActions,
         };
     }
     scanKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         try {
             const current = this.store.readKnowledgeMap(identity.projectId);
@@ -2392,11 +2976,11 @@ export class WorkflowService {
         }
     }
     showKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.store.readKnowledgeMap(identity.projectId);
     }
     knowledgeMapStatus(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         return inspectKnowledgeMap(current, scanned);
@@ -2405,7 +2989,7 @@ export class WorkflowService {
         return this.approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, null);
     }
     approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, autonomyTaskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const inspected = inspectKnowledgeMap(current, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
@@ -2422,43 +3006,35 @@ export class WorkflowService {
         return this.store.writeKnowledgeMap(approved, expectedRevision);
     }
     reconcileKnowledgeMap(repository, expectedRevision, allowAtomicTaskRefresh = false) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         if (!allowAtomicTaskRefresh && current.status === 'active' && current.approval) {
             const milestonesById = new Map(this.listMilestonesCurrent(identity.projectId).map((milestone) => [milestone.id, milestone]));
-            const activeTask = this.store
-                .listTasks(identity.projectId)
-                .find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
-            if (activeTask?.planHash
-                && taskCanRebindKnowledge(activeTask)
-                && !this.taskHasTerminalCorrectiveDecision(activeTask)) {
-                const inspected = inspectKnowledgeMap(current, scanned);
-                const assessment = assessDelegatedKnowledgeRefresh(current, inspected, activeTask, this.store.hashArtifact(this.store.taskRoot(identity.projectId, activeTask.id), 'plan.md'));
-                if (assessment.eligible
-                    && this.delegatedContextRefreshOptions(identity.projectId, activeTask, inspected, assessment.mode).length > 0) {
-                    throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
-                        taskId: activeTask.id,
-                        requiredAction: 'Run the exact task context-refresh action returned by next.',
-                    });
-                }
+            const inspected = inspectKnowledgeMap(current, scanned);
+            const refreshOwner = this.findDelegatedContextRefreshOwner(identity.projectId, this.store.listTasks(identity.projectId), milestonesById, current, inspected);
+            if (refreshOwner) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
+                    taskId: refreshOwner.task.id,
+                    requiredAction: 'Run the exact task context-refresh action returned by next.',
+                });
             }
         }
         return this.store.writeKnowledgeMap(reconcileKnowledgeMap(current, scanned), expectedRevision);
     }
     graphRefreshRequest(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
     }
     graphStatus(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const binding = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return { request, binding: binding ? inspectGraphBinding(binding, request) : null };
     }
     bindGraph(repository, expectedRevision, request, evidence) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const currentRequest = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, request.graphKind, request.mode, this.now());
         validateGraphRequestCurrent(request, currentRequest);
         const existing = this.readGraphBindingOrNull(identity.projectId, request.graphKind);
@@ -2466,13 +3042,78 @@ export class WorkflowService {
         return this.store.writeGraphBinding(binding, expectedRevision);
     }
     recordGraphFallback(repository, graphKind, mode, expectedRevision, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const existing = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
-    next(repository) {
+    next(repository, taskId = null) {
         const status = this.status(repository);
+        if (status.observation.kind === 'blocked') {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
+        if (status.observation.kind === 'repair') {
+            const repair = status.observation.repair;
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'repair-required',
+                action: repair?.command ?? 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: repair ? 'repair' : 'blocked',
+                    transitionId: null,
+                    availableRepairTransitionId: null,
+                    ...(repair ? {
+                        command: repair.command,
+                        cataloged: repair.cataloged,
+                        ...('available' in repair ? { available: repair.available } : {}),
+                        bindings: repair.command === 'milestone recover'
+                            ? {
+                                projectId: repair.projectId,
+                                milestoneIds: repair.milestoneIds,
+                                transactionIds: repair.transactionIds,
+                            }
+                            : 'taskIds' in repair
+                                ? {
+                                    projectId: repair.projectId,
+                                    taskIds: repair.taskIds,
+                                    transactionIds: repair.transactionIds,
+                                }
+                                : {
+                                    projectId: repair.projectId,
+                                    entityIds: repair.entityIds,
+                                },
+                    } : {}),
+                    reasonCodes: status.observation.reasonCodes,
+                },
+            };
+        }
+        if (!status.adoption) {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
         const adoptionInfo = {
             status: status.adoption.status,
             safe: status.adoption.safe,
@@ -2490,19 +3131,130 @@ export class WorkflowService {
                 status: status.adoption.status,
                 action: status.adoption.safe ? 'state adoption-apply' : 'restore safe boundary, then state adoption-prepare',
                 adoption: adoptionInfo,
+                observation: status.observation,
+                navigation: status.adoption.safe
+                    ? {
+                        kind: 'human-gate',
+                        transitionId: null,
+                        cataloged: false,
+                        command: 'state adoption-apply',
+                        bindings: {
+                            projectId: status.projectId,
+                            confirmationCode: status.adoption.confirmationCode,
+                            confirmationCodeBindingHash: status.adoption.confirmationCodeBindingHash,
+                            actorRequired: true,
+                        },
+                    }
+                    : {
+                        kind: 'blocked',
+                        transitionId: null,
+                        availableRepairTransitionId: null,
+                        reasonCodes: ['ADOPTION_MISSING'],
+                        blockers: status.adoption.blockers,
+                    },
             };
         }
-        const withAdoption = (value) => ({ ...value, adoption: adoptionInfo });
+        const withAdoption = (value) => ({
+            ...value,
+            adoption: adoptionInfo,
+            observation: status.observation,
+        });
         const repositoryRoot = resolveRepositoryIdentity(repository).repositoryRoot;
+        const inspectCurrentKnowledgeMap = () => inspectKnowledgeMap(this.store.readKnowledgeMap(status.projectId), scanProjectKnowledge(repositoryRoot, status.projectId, this.now()));
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
-        const activeTask = status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
+        const tasksById = new Map(status.tasks.map((task) => [task.id, task]));
+        const requestedTask = taskId === null
+            ? null
+            : status.tasks.find((task) => task.id === taskId) ?? null;
+        if (taskId !== null && !requestedTask) {
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        }
+        if (requestedTask && !taskIsActionableFromRepositoryNext(requestedTask, milestonesById, tasksById)) {
+            const requestedMilestone = requestedTask.milestoneId
+                ? milestonesById.get(requestedTask.milestoneId) ?? null
+                : null;
+            const dependency = requestedMilestone
+                ? assessMilestoneTaskDependencies(requestedMilestone, requestedTask.id, (candidateTaskId) => {
+                    const candidate = tasksById.get(candidateTaskId);
+                    if (!candidate)
+                        throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+                    return candidate;
+                })
+                : null;
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} is not actionable from repository next.`, {
+                taskId: requestedTask.id,
+                taskStatus: requestedTask.status,
+                milestoneId: requestedTask.milestoneId,
+                ...(dependency ? { dependency } : {}),
+            });
+        }
+        const activeTask = requestedTask
+            ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
-            const activePlanRiskAudit = activeTask.planHash
-                ? readCurrentPlanRiskAudit(this.store, activeTask)
+            const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (dependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update dependency-provenance-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: dependencyRecovery,
+                });
+            }
+            const activeTaskMilestone = activeTask.milestoneId
+                ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
+            const milestoneCancellationSafe = Boolean(activeTaskMilestone
+                && !activeTask.steps.some((step) => step.status === 'in_progress')
+                && status.observation.leases.length === 0
+                && status.observation.coreTaskOperations.length === 0
+                && status.observation.pendingProjectTransactions.length === 0
+                && status.observation.pendingMilestoneTransactions.length === 0
+                && status.observation.pendingTaskTransactions.length === 0
+                && status.observation.corruptTaskTransactions.length === 0);
+            const withMilestoneCancellation = (value) => (milestoneCancellationSafe
+                ? {
+                    ...value,
+                    milestoneCancellationOption: {
+                        command: 'milestone cancel',
+                        milestoneId: activeTaskMilestone.id,
+                        expectedRevision: activeTaskMilestone.revision,
+                        reasonRequired: true,
+                        taskDisposition: 'retained-historical',
+                    },
+                }
+                : value);
+            let activePlanRiskAudit = null;
+            let planRiskAuditRecovery = null;
+            if (activeTask.planHash) {
+                try {
+                    activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
+                        throw error;
+                    planRiskAuditRecovery = {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'task plan-risk-audit',
+                        revision: activeTask.revision,
+                        planRiskAuditRecovery: {
+                            state: 'required',
+                            reason: error.message,
+                            currentBriefHash: activeTask.briefHash,
+                            currentPlanHash: activeTask.planHash,
+                            knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                            knowledgeMapHash: activeTask.knowledgeMapHash,
+                        },
+                    };
+                }
+            }
             const taskNext = activeTask.status === 'planning'
                 ? null
-                : this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
+                : planRiskAuditRecovery
+                    ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -2511,15 +3263,32 @@ export class WorkflowService {
             if (taskNext?.action === 'task step-complete'
                 || taskNext?.action === 'task step-review'
                 || taskNext?.action === 'task remediation-mode-recover'
+                || taskNext?.action === 'task plan-integrity-recover'
+                || taskNext?.blockedAction === 'task plan-integrity-recover'
                 || hardStop
                 || terminalCorrectiveDecision === 'split-required'
                 || terminalCorrectiveDecision === 'stop-escalate') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
             }
             if (!taskCanRebindKnowledge(activeTask) && activeTask.status !== 'planning') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
+            }
+            let knowledgeMap;
+            try {
+                knowledgeMap = inspectCurrentKnowledgeMap();
+            }
+            catch (error) {
+                if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                    throw error;
+                return withAdoption(withMilestoneCancellation({
+                    scope: 'project-memory',
+                    status: 'missing',
+                    action: 'project-memory scan',
+                    stalenessOriginTaskId: activeTask.id,
+                    authorizesTask: false,
+                    provenanceNotice: 'This Task identifier is diagnostic provenance only; the Project Knowledge action does not authorize or resume it.',
+                }));
             }
-            const knowledgeMap = this.knowledgeMapStatus(repository);
             if (knowledgeMap.status !== 'active' || !knowledgeMap.approval) {
                 const action = knowledgeMap.status === 'stale' ? 'project-memory reconcile' : 'project-memory approve';
                 const delegatedApprovalOptions = action === 'project-memory approve'
@@ -2535,7 +3304,17 @@ export class WorkflowService {
                 const contextRefreshOptions = action === 'project-memory reconcile' && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
-                return withAdoption({
+                if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
+                    const refreshOwner = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, storedKnowledgeMap, knowledgeMap);
+                    if (refreshOwner && refreshOwner.task.id !== requestedTask.id) {
+                        throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} cannot be selected while Task ${refreshOwner.task.id} requires an atomic context refresh.`, {
+                            taskId: requestedTask.id,
+                            blockingTaskId: refreshOwner.task.id,
+                            requiredAction: 'Run repository next and its exact task context-refresh action first.',
+                        });
+                    }
+                }
+                return withAdoption(withMilestoneCancellation({
                     scope: contextRefreshOptions.length > 0 ? 'task' : 'project-memory',
                     status: knowledgeMap.status,
                     action: contextRefreshOptions.length > 0 ? 'task context-refresh' : action,
@@ -2567,14 +3346,14 @@ export class WorkflowService {
                             },
                         }
                         : {}),
-                });
+                }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
             if (taskCanRebindKnowledge(activeTask) &&
                 activeTask.planHash &&
                 (activeTask.knowledgeMapRevision !== knowledgeMap.revision ||
                     activeTask.knowledgeMapHash !== knowledgeMapHash)) {
-                return withAdoption({
+                return withAdoption(withMilestoneCancellation({
                     scope: 'task',
                     id: activeTask.id,
                     status: activeTask.status,
@@ -2582,12 +3361,69 @@ export class WorkflowService {
                     revision: activeTask.revision,
                     knowledgeMapRevision: knowledgeMap.revision,
                     knowledgeMapHash,
-                });
+                }));
             }
-            return withAdoption(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null));
+            return withAdoption(withMilestoneCancellation(taskNext ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, null)));
+        }
+        let repositoryKnowledgeMap;
+        try {
+            repositoryKnowledgeMap = inspectCurrentKnowledgeMap();
+        }
+        catch (error) {
+            if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                throw error;
+            return withAdoption({
+                scope: 'project-memory',
+                status: 'missing',
+                action: 'project-memory scan',
+                authorizesMilestone: false,
+                provenanceNotice: 'Project Knowledge must be current before Discovery or Milestone authorization.',
+            });
+        }
+        if (repositoryKnowledgeMap.status !== 'active' || !repositoryKnowledgeMap.approval) {
+            const action = repositoryKnowledgeMap.status === 'stale'
+                ? 'project-memory reconcile'
+                : 'project-memory approve';
+            const delegatedApprovalOptions = action === 'project-memory approve'
+                ? this.delegatedApprovalOptions(status.projectId, 'project_memory.approve', repositoryKnowledgeMap)
+                : [];
+            return withAdoption({
+                scope: 'project-memory',
+                status: repositoryKnowledgeMap.status,
+                action,
+                revision: repositoryKnowledgeMap.revision,
+                authorizesMilestone: false,
+                provenanceNotice: 'Project Knowledge must be reconciled and approved before Discovery or Milestone authorization.',
+                ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
+            });
         }
         const activeMilestone = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         if (activeMilestone) {
+            const initialAssembly = status.milestoneInitialAssembly
+                .find((candidate) => candidate.milestoneId === activeMilestone.id) ?? null;
+            if (initialAssembly) {
+                const activeDiscovery = status.discoveries.find((discovery) => !['materialized', 'abandoned'].includes(discovery.status));
+                if (activeDiscovery) {
+                    return withAdoption({
+                        scope: 'discovery',
+                        id: activeDiscovery.id,
+                        status: activeDiscovery.status,
+                        action: activeDiscovery.status === 'ready_to_materialize' ? 'discovery materialize' : 'discovery update',
+                        readiness: assessDiscovery(activeDiscovery),
+                        milestoneInitialAssembly: initialAssembly,
+                    });
+                }
+                return withAdoption({
+                    scope: 'milestone',
+                    id: activeMilestone.id,
+                    status: activeMilestone.status,
+                    action: 'milestone initial-assembly',
+                    revision: activeMilestone.revision,
+                    linkedTaskIds: initialAssembly.linkedTaskIds,
+                    executionAvailable: initialAssembly.executionAvailable,
+                    milestoneInitialAssembly: initialAssembly,
+                });
+            }
             if (activeMilestone.status === 'awaiting_final_acceptance') {
                 const root = this.store.milestoneRoot(activeMilestone.projectId, activeMilestone.id);
                 const evidence = JSON.parse(readFileSync(path.join(root, 'evidence.json'), 'utf8'));
@@ -2638,6 +3474,19 @@ export class WorkflowService {
                 status: activeMilestone.status,
                 action: nextForMilestone(activeMilestone),
                 revision: activeMilestone.revision,
+                ...(activeMilestone.status === 'awaiting_execution_authorization' && activeMilestone.planHash
+                    ? {
+                        milestoneAuthorizationOptions: [
+                            { action: 'milestone authorize', mode: 'direct-human' },
+                            {
+                                action: 'milestone autonomy-prepare',
+                                mode: 'delegated',
+                                requiresExactHumanConfirmation: true,
+                                maximumDurationHours: 72,
+                            },
+                        ],
+                    }
+                    : {}),
                 ...(activeMilestone.status === 'active'
                     ? {
                         completionPolicy: {
@@ -2649,7 +3498,21 @@ export class WorkflowService {
                                 .filter((membership) => membership.disposition === 'required')
                                 .map((membership) => {
                                 const task = status.tasks.find((candidate) => candidate.id === membership.taskId);
-                                return { taskId: membership.taskId, status: task?.status ?? 'missing' };
+                                const dependency = assessMilestoneTaskDependencies(activeMilestone, membership.taskId, (candidateTaskId) => {
+                                    const candidate = status.tasks.find((taskCandidate) => taskCandidate.id === candidateTaskId);
+                                    if (!candidate)
+                                        throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+                                    return candidate;
+                                });
+                                return {
+                                    taskId: membership.taskId,
+                                    status: task?.status ?? 'missing',
+                                    dependencyState: dependency.dependencyState,
+                                    dependsOnTaskIds: dependency.dependsOnTaskIds,
+                                    unsatisfiedPredecessors: dependency.unsatisfiedPredecessors,
+                                    runnable: Boolean(task && !['merged', 'cancelled'].includes(task.status) && dependency.runnable),
+                                    dependencyBlockReason: dependency.blockReason,
+                                };
                             }),
                         },
                     }
@@ -2772,7 +3635,21 @@ export class WorkflowService {
             }
         }
     }
-    nextForTaskWithDelegation(projectId, task, planRiskAudit = null) {
+    currentMilestoneDependencyBinding(milestone, taskId) {
+        assertMilestoneTaskRunnable(milestone, taskId, (candidateTaskId) => this.store.readTask(milestone.projectId, candidateTaskId));
+        if (!milestone.planHash) {
+            throw new WorkflowError('STATE_CORRUPT', `Active Milestone ${milestone.id} has no Plan hash.`, {
+                milestoneId: milestone.id,
+                taskId,
+            });
+        }
+        return {
+            milestoneRevision: milestone.revision,
+            membershipRevision: milestone.membershipRevision,
+            milestonePlanHash: milestone.planHash,
+        };
+    }
+    nextForTaskWithDelegation(projectId, repositoryRoot, task, planRiskAudit = null) {
         const transition = task.status === 'awaiting_execution_authorization'
             ? 'task.execution_authorize'
             : task.status === 'awaiting_final_acceptance'
@@ -2794,8 +3671,73 @@ export class WorkflowService {
                     throw error;
             }
         }
-        const next = nextForTask(task);
+        let catalogCorrectiveReplanPosture = guardedCorrectivePosture?.posture === 'replan-required'
+            ? guardedCorrectivePosture
+            : null;
+        if (!remediationModeRecovery && planRiskAudit && guardedCorrectivePosture === null) {
+            try {
+                catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
+            }
+            catch (error) {
+                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task);
+                if (!remediationModeRecovery)
+                    throw error;
+            }
+        }
+        const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        let mechanicalFeasibilityOverlay = {};
+        if (task.status === 'awaiting_execution_authorization' && task.planHash) {
+            try {
+                const taskRoot = this.store.taskRoot(projectId, task.id);
+                const briefHash = this.store.hashArtifact(taskRoot, 'brief.md');
+                const planHash = this.store.hashArtifact(taskRoot, 'plan.md');
+                if (task.briefHash !== briefHash || task.planHash !== planHash) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Task Plan authority does not match its stored artifacts.', {
+                        taskId: task.id,
+                        stateBriefHash: task.briefHash,
+                        artifactBriefHash: briefHash,
+                        statePlanHash: task.planHash,
+                        artifactPlanHash: planHash,
+                    });
+                }
+                const mechanicalFeasibility = evaluateMechanicalFeasibility(repositoryRoot, task, briefHash, planHash);
+                mechanicalFeasibilityOverlay = mechanicalFeasibility.decision === 'blocked'
+                    ? {
+                        action: 'task plan-set',
+                        blockedAction: 'task authorize',
+                        mechanicalFeasibility,
+                        mechanicalFeasibilityGate: {
+                            state: 'blocked',
+                            diagnosticCode: 'MECHANICAL_PLAN_INFEASIBILITY',
+                            requiredAction: 'Replace the current Plan through task plan-set, then request fresh execution authorization.',
+                        },
+                    }
+                    : {
+                        mechanicalFeasibility,
+                        mechanicalFeasibilityGate: {
+                            state: 'clear',
+                            meaning: 'No supported analyzer proved infeasibility; semantic sufficiency is not asserted.',
+                        },
+                    };
+            }
+            catch (error) {
+                mechanicalFeasibilityOverlay = {
+                    action: 'doctor',
+                    blockedAction: 'task authorize',
+                    mechanicalFeasibilityGate: {
+                        state: 'unavailable',
+                        diagnosticCode: error instanceof WorkflowError ? error.code : 'UNKNOWN_ERROR',
+                        reason: error instanceof Error ? error.message : String(error),
+                        requiredAction: 'Restore the exact Plan/source authority before execution authorization.',
+                    },
+                };
+            }
+        }
         const handoffPosture = readTaskC1Posture(this.store, task);
+        const failedStep = task.steps.find((step) => step.status === 'failed') ?? null;
+        const planIntegrityAssessment = !remediationModeRecovery && planRiskAudit && failedStep
+            ? assessPlanIntegrityRecovery(this.store, repositoryRoot, task, failedStep.id)
+            : null;
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
                 if (step.status !== 'in_progress' || !step.evidence || !planRiskAudit.reviewRequiredStepIds.includes(step.id)) {
@@ -2806,6 +3748,11 @@ export class WorkflowService {
                 return buildCurrentStrictStepReviewCycle(this.store, task, step.id).resolution === 'unverified';
             }) ?? null
             : null;
+        const strictReviewInfrastructureFailures = strictStepReviewStep
+            ? countUnverifiedStrictStepReviews(this.store, task, strictStepReviewStep.id)
+            : 0;
+        const strictTaskReviewRequired = (task.status === 'validating' && task.review.status === 'pending')
+            || (task.status === 'blocked' && task.review.status === 'unverified');
         const handoffOverlay = handoffPosture.state === 'pending'
             ? {
                 action: 'task claim',
@@ -2814,6 +3761,15 @@ export class WorkflowService {
                     state: 'pending',
                     targetActor: handoffPosture.targetActor,
                     eventId: handoffPosture.latestEvent.eventId,
+                    credentialRecovery: {
+                        action: 'task handoff-replace',
+                        when: 'claim credential is unavailable',
+                        requiredActor: handoffPosture.latestEvent.actor,
+                        targetActor: handoffPosture.targetActor,
+                        grantId: handoffPosture.latestEvent.grantId,
+                        expectedRevision: task.revision,
+                        invalidatesPriorCredential: true,
+                    },
                 },
             }
             : handoffPosture.state === 'claimed'
@@ -2836,7 +3792,97 @@ export class WorkflowService {
                         },
                     }
                     : {};
+        const correctiveReplanOverlay = (posture) => {
+            const evaluation = evaluateTaskCorrectiveReplanAvailability(task, posture);
+            const writerLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+            const command = handoffPosture.state === 'claimed'
+                ? 'task corrective-yield'
+                : writerLease
+                    ? 'doctor'
+                    : 'task corrective-replan-prepare';
+            if (evaluation.allowed && handoffPosture.state === 'none' && writerLease) {
+                const navigation = correctiveReplanNavigation(evaluation);
+                return {
+                    action: command,
+                    blockedAction: 'task corrective-replan-prepare',
+                    stepId: posture.stepId,
+                    navigation: {
+                        kind: 'blocked',
+                        transitionId: navigation.transitionId,
+                        semanticFingerprint: navigation.semanticFingerprint,
+                        command: navigation.command,
+                        blockingGuardIds: ['task.corrective-replan.no-writer-lease'],
+                        pendingInputGuardIds: navigation.pendingInputGuardIds,
+                        reasonCode: 'ACTIVE_WRITER_LEASE',
+                    },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: 'The active non-C1 writer lease must expire and be explicitly repaired before corrective replan preparation.',
+                        writerLease: {
+                            owner: writerLease.owner,
+                            expiresAt: writerLease.expiresAt,
+                        },
+                    },
+                };
+            }
+            return evaluation.allowed
+                ? {
+                    action: command,
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: { ...correctiveReplanNavigation(evaluation), command },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: handoffPosture.state === 'claimed'
+                            ? 'Yield the exact C1 claim and writer lease before preparing replacement authority.'
+                            : 'Prepare a state-bound candidate, confirm the Human gate, then execute its exact receipt.',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: correctiveReplanBlockedNavigation(evaluation),
+                };
+        };
         let guardedCorrectiveOverlay = {};
+        if (planIntegrityAssessment?.applicable) {
+            const requiredActor = handoffPosture.state === 'claimed'
+                ? handoffPosture.claimant
+                : defaultPlanIntegrityRecoveryActor(task.id);
+            guardedCorrectiveOverlay = planIntegrityAssessment.eligible
+                ? {
+                    action: 'task plan-integrity-recover',
+                    blockedAction: 'task run',
+                    stepId: planIntegrityAssessment.stepId,
+                    planIntegrityRecovery: {
+                        state: 'eligible',
+                        reasonCode: 'MISSING_NPM_SCRIPT_OUTSIDE_ALLOWED_WRITES',
+                        expectedRevision: task.revision,
+                        requiredActor,
+                        evidence: planIntegrityAssessment.evidence,
+                        boundedEffect: 'record-replan-required-decision',
+                        preservesWorktree: true,
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task plan-integrity-recover',
+                    stepId: planIntegrityAssessment.stepId,
+                    planIntegrityRecovery: {
+                        state: 'blocked',
+                        reasonCode: 'PLAN_INTEGRITY_RECOVERY_BLOCKED',
+                        expectedRevision: task.revision,
+                        requiredActor,
+                        blockers: planIntegrityAssessment.blockers,
+                        evidence: planIntegrityAssessment.evidence,
+                    },
+                };
+        }
         if (remediationModeRecovery) {
             guardedCorrectiveOverlay = {
                 action: 'task remediation-mode-recover',
@@ -2854,7 +3900,12 @@ export class WorkflowService {
                 },
             };
         }
-        if (!remediationModeRecovery && !strictStepReviewStep && guardedCorrectivePosture) {
+        if (!remediationModeRecovery && guardedCorrectivePosture === null && catalogCorrectiveReplanPosture) {
+            guardedCorrectiveOverlay = correctiveReplanOverlay(catalogCorrectiveReplanPosture);
+        }
+        if (!remediationModeRecovery
+            && guardedCorrectivePosture
+            && (!strictStepReviewStep || guardedCorrectivePosture.posture === 'replan-required')) {
             switch (guardedCorrectivePosture.posture) {
                 case 'decision-required':
                     if (guardedCorrectivePosture.correctiveDecision
@@ -2929,28 +3980,35 @@ export class WorkflowService {
                     };
                     break;
                 case 'replan-required':
-                    guardedCorrectiveOverlay = {
-                        action: 'task plan-set',
-                        stepId: guardedCorrectivePosture.stepId,
-                        correctiveDecisionGate: {
-                            attemptCount: guardedCorrectivePosture.attemptCount,
-                            decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
-                            decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
-                            requiredAction: 'Record an actual new Plan posture before another remediation run.',
-                        },
-                    };
+                    guardedCorrectiveOverlay = correctiveReplanOverlay(guardedCorrectivePosture);
                     break;
                 case 'split-required':
                     {
                         const replacementDiscoveries = this.store.listDiscoveries(projectId)
                             .filter((discovery) => discovery.status === 'ready_to_materialize');
-                        const replacementDiscovery = replacementDiscoveries.length === 1 ? replacementDiscoveries[0] : null;
                         const replacementMilestone = task.milestoneId
                             ? this.store.readMilestone(projectId, task.milestoneId)
                             : null;
+                        const incidentDependencies = replacementMilestone
+                            ? replacementMilestone.memberships.flatMap((membership) => {
+                                if (!Array.isArray(membership.dependsOnTaskIds))
+                                    return [];
+                                return [
+                                    ...(membership.taskId === task.id
+                                        ? membership.dependsOnTaskIds.map((predecessorTaskId) => ({
+                                            predecessorTaskId,
+                                            consumerTaskId: membership.taskId,
+                                        }))
+                                        : []),
+                                    ...(membership.dependsOnTaskIds.includes(task.id)
+                                        ? [{ predecessorTaskId: task.id, consumerTaskId: membership.taskId }]
+                                        : []),
+                                ];
+                            })
+                            : [];
                         guardedCorrectiveOverlay = {
-                            action: replacementDiscovery ? 'task replacement-materialize' : 'discovery start',
-                            ...(replacementDiscovery ? {} : { blockedAction: 'task replacement-materialize' }),
+                            action: 'doctor',
+                            blockedAction: 'task replacement-materialize',
                             stepId: guardedCorrectivePosture.stepId,
                             correctiveDecisionGate: {
                                 attemptCount: guardedCorrectivePosture.attemptCount,
@@ -2964,29 +4022,17 @@ export class WorkflowService {
                                 requiredDiscoveryStatus: 'ready_to_materialize',
                                 oldMembershipDisposition: 'cancelled',
                                 replacementMembershipDisposition: 'required',
-                                transaction: 'journal-recoverable',
+                                transaction: 'disabled',
+                                retainedImplementation: 'journal-recoverable-1-to-1',
+                                diagnosticCode: 'STRUCTURAL_REPLACEMENT_REQUIRED',
+                                structuralReplacementAvailable: false,
+                                incidentDependencies,
                                 discoveryCandidates: replacementDiscoveries.map((discovery) => ({
                                     id: discovery.id,
                                     revision: discovery.revision,
                                     goal: discovery.goal,
                                 })),
-                                ...(replacementDiscovery && replacementMilestone
-                                    ? {
-                                        exactTransition: {
-                                            command: 'task replacement-materialize',
-                                            taskId: task.id,
-                                            expectedTaskRevision: task.revision,
-                                            discoveryId: replacementDiscovery.id,
-                                            expectedDiscoveryRevision: replacementDiscovery.revision,
-                                            milestoneId: replacementMilestone.id,
-                                            expectedMilestoneRevision: replacementMilestone.revision,
-                                        },
-                                    }
-                                    : {
-                                        requiredAction: replacementDiscoveries.length === 0
-                                            ? 'Create and complete one thin replacement Discovery, then run next again.'
-                                            : 'Select exactly one ready replacement Discovery explicitly; next will not guess between candidates.',
-                                    }),
+                                requiredAction: 'Materialize P04-B/P05 before replacing this split-required Task.',
                             },
                         };
                     }
@@ -3022,6 +4068,30 @@ export class WorkflowService {
                     strictStepReview: {
                         reviewRequired: true,
                         completionCommit: strictStepReviewStep.evidence.commitSha,
+                        infrastructureFailures: strictReviewInfrastructureFailures,
+                        maxLocalInfrastructureFailures: MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES,
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task step-review-packet',
+                            recordCommand: 'task step-review-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
+                    },
+                }
+                : {}),
+            ...(strictTaskReviewRequired
+                ? {
+                    strictTaskReview: {
+                        reviewRequired: true,
+                        localInfrastructureFailureObserved: task.review.status === 'unverified',
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task review-packet',
+                            recordCommand: 'task review-sealed-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
                     },
                 }
                 : {}),
@@ -3048,16 +4118,41 @@ export class WorkflowService {
                 }
                 : {}),
             ...guardedCorrectiveOverlay,
+            ...mechanicalFeasibilityOverlay,
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
         };
         if (handoffPosture.state === 'pending') {
-            return {
+            return this.withTaskNavigationContracts(task, {
                 ...result,
                 action: 'task claim',
                 blockedAction: next.action,
-            };
+            });
         }
-        return result;
+        const navigableResult = ['task plan-set', 'task plan-set with independent corrective audit']
+            .includes(String(result.action))
+            ? {
+                ...result,
+                taskPlanContract: this.taskPlanContract(projectId, task),
+            }
+            : result;
+        return this.withTaskNavigationContracts(task, navigableResult);
+    }
+    taskPlanContract(projectId, task) {
+        const map = this.store.readKnowledgeMap(projectId);
+        return {
+            requiredRequirementIds: [...task.requirements],
+            requiredAcceptanceIds: [...task.acceptance],
+            currentRisks: [...task.risks],
+            exactInclusionRequired: true,
+            briefHash: task.briefHash,
+            knowledgeMap: knowledgeSummary(map),
+            planRiskAuditContract: {
+                required: true,
+                option: '--risk-audit-file',
+                atomicWithPlanSet: true,
+                plannerAuditorSeparationRequired: true,
+            },
+        };
     }
     assertTaskContextChangeAllowed(task) {
         const posture = this.taskTerminalCorrectivePosture(task);
@@ -3136,6 +4231,23 @@ export class WorkflowService {
             policyHash: grant.policyHash,
         }));
     }
+    findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected) {
+        const tasksById = new Map(tasks.map((task) => [task.id, task]));
+        for (const task of tasks) {
+            if (!taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
+                || !task.planHash
+                || !taskCanRebindKnowledge(task)
+                || this.taskHasTerminalCorrectiveDecision(task))
+                continue;
+            const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
+            if (!assessment.eligible)
+                continue;
+            const options = this.delegatedContextRefreshOptions(projectId, task, inspected, assessment.mode);
+            if (options.length > 0)
+                return { task, assessment, options };
+        }
+        return null;
+    }
     assertPlanBoundedSupportingSourceGrant(projectId, grantId, actor, task) {
         const grant = this.store.readDelegation(projectId, grantId);
         if (!task.milestoneId || grant.scope.kind !== 'milestone' || grant.scope.id !== task.milestoneId) {
@@ -3161,7 +4273,7 @@ export class WorkflowService {
         if (policy.scope.kind === 'milestone')
             this.store.readMilestone(projectId, policy.scope.id);
     }
-    assertExecutionAuthorizationFresh(task) {
+    assertExecutionAuthorizationFresh(task, repositoryRoot) {
         const root = this.store.taskRoot(task.projectId, task.id);
         const authorization = [...task.authorizations]
             .reverse()
@@ -3170,14 +4282,35 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Execution authorization is missing.');
         const briefHash = this.store.hashArtifact(root, 'brief.md');
         const planHash = this.store.hashArtifact(root, 'plan.md');
-        if (authorization.briefHash !== briefHash || authorization.planHash !== planHash) {
+        if (authorization.briefHash !== briefHash
+            || authorization.planHash !== planHash
+            || task.briefHash !== briefHash
+            || task.planHash !== planHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Execution authorization is stale.', {
                 authorizedBriefHash: authorization.briefHash,
                 currentBriefHash: briefHash,
                 authorizedPlanHash: authorization.planHash,
                 currentPlanHash: planHash,
+                stateBriefHash: task.briefHash,
+                statePlanHash: task.planHash,
             });
         }
+        const mechanicalFeasibility = authorization.mechanicalFeasibility;
+        if (!mechanicalFeasibility)
+            return authorization;
+        const evidenceHash = hashMechanicalFeasibilityEvidence(mechanicalFeasibility);
+        if (authorization.evidenceHash !== evidenceHash
+            || authorization.headCommit !== mechanicalFeasibility.evaluatedHead) {
+            throw new WorkflowError('STATE_CORRUPT', 'Mechanical-feasibility evidence does not match its authorization event.', {
+                taskId: task.id,
+                authorizedEvidenceHash: authorization.evidenceHash,
+                currentEvidenceHash: evidenceHash,
+                authorizedHeadCommit: authorization.headCommit,
+                evaluatedHead: mechanicalFeasibility.evaluatedHead,
+            });
+        }
+        assertMechanicalFeasibilityFresh(repositoryRoot, task, mechanicalFeasibility, briefHash, planHash);
+        return authorization;
     }
     assertMilestoneAuthorizationFresh(milestone) {
         const authorization = [...milestone.authorizations]
@@ -3205,6 +4338,130 @@ export class WorkflowService {
             ? milestone
             : readMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
     }
+    listMilestonesObserved(projectId, milestones, posture) {
+        if (!posture)
+            return milestones;
+        const grandfatheredMilestones = new Set(posture.terminalMilestones.map((milestone) => `${milestone.milestoneId}:${milestone.revision}:${milestone.status}`));
+        return milestones.map((milestone) => (grandfatheredMilestones.has(`${milestone.id}:${milestone.revision}:${milestone.status}`)
+            ? milestone
+            : inspectMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
+    }
+    taskGitNavigationOverride(task) {
+        if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.baseCommit || !task.taskBranch) {
+            return null;
+        }
+        const currentBase = runGit(task.repositoryRoot, ['rev-parse', task.baseBranch]);
+        if (currentBase === task.baseCommit)
+            return null;
+        return {
+            scope: 'task',
+            id: task.id,
+            status: task.status,
+            action: 'task sync-base',
+            revision: task.revision,
+            baseSyncRequired: {
+                baseBranch: task.baseBranch,
+                recordedBaseCommit: task.baseCommit,
+                currentBaseCommit: currentBase,
+            },
+        };
+    }
+    inspectDependencyProvenanceCandidate(snapshot, task) {
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const now = this.now().getTime();
+        return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
+            activeLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now).length,
+            staleLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now).length,
+            pendingTransactionCount: snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length,
+            corruptTransactionCount: snapshot.observation.corruptTaskTransactions.length,
+            coreOperationCount: snapshot.observation.coreTaskOperations.length,
+            verifiedHistoricalStepCommits: verifiedHistoricalStepReviewCommits(this.store, task),
+            versions: {
+                runtime: versions.runtime,
+                declared: versions.declared,
+                locked: versions.locked,
+                installed: versions.installed,
+                currentBranch: versions.currentBranch,
+                baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+            },
+        });
+    }
+    withTaskNavigationContracts(task, next) {
+        const action = typeof next.action === 'string' ? next.action : null;
+        if (!action)
+            return next;
+        const policy = gitMutationPolicyForAction(task, action);
+        const c1Posture = readTaskC1Posture(this.store, task);
+        const claimedC1Posture = c1Posture.state === 'claimed';
+        const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture);
+        const activeLease = writerTokenContract
+            ? inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root)
+            : null;
+        const writerCredentialRecoveryActor = this.writerCredentialRecoveryActor(task, action, claimedC1Posture ? c1Posture.claimant : null, activeLease?.owner ?? null);
+        const writerCredentialRecovery = writerTokenContract && writerCredentialRecoveryActor
+            ? {
+                action: 'task writer-credential-replace',
+                when: 'the active writer credential is unavailable',
+                requiredActor: writerCredentialRecoveryActor,
+                expectedRevision: task.revision,
+                invalidatesPriorCredential: true,
+                acquiresLeaseWhenAbsent: true,
+            }
+            : null;
+        return {
+            ...next,
+            ...(policy ? { gitMutationPolicy: policy } : {}),
+            ...(writerTokenContract ? { writerTokenContract } : {}),
+            ...(writerCredentialRecovery ? { writerCredentialRecovery } : {}),
+        };
+    }
+    writerCredentialRecoveryActor(task, action, claimedActor, activeLeaseOwner) {
+        if (claimedActor)
+            return claimedActor;
+        if (activeLeaseOwner)
+            return activeLeaseOwner;
+        const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
+            ? 'final_acceptance'
+            : ['task step-complete', 'task submit'].includes(action)
+                ? 'execution'
+                : null;
+        if (!authorizationKind)
+            return null;
+        return [...task.authorizations].reverse().find((authorization) => authorization.kind === authorizationKind && authorization.decision === 'approved')?.actor ?? null;
+    }
+    describeMilestoneInitialAssembly(projectId, milestone, tasks) {
+        const assessment = assessMilestoneInitialAssembly({
+            store: this.store,
+            projectId,
+            milestone,
+            listTasks: () => tasks,
+        });
+        if (!assessment.eligible)
+            return null;
+        const options = [
+            {
+                action: 'linked-task-assembly',
+                commands: ['discovery start', 'discovery materialize'],
+                description: 'Start or materialize the next linked Task Discovery for this Milestone before closing the initial membership Plan.',
+            },
+        ];
+        if (assessment.orphanTaskIds.length > 0) {
+            options.push({
+                action: 'milestone plan-set',
+                commands: ['milestone plan-set'],
+                description: 'Record one complete initial Milestone Plan that classifies every currently linked Task.',
+            });
+        }
+        return {
+            milestoneId: milestone.id,
+            revision: milestone.revision,
+            linkedTaskIds: assessment.orphanTaskIds,
+            executionAvailable: false,
+            options,
+        };
+    }
     prepareMilestoneScopeChangeCandidate(projectId, milestone, plan, actor) {
         validateMilestonePlan(plan);
         return prepareMilestoneScopeChangeCandidate({
@@ -3214,6 +4471,12 @@ export class WorkflowService {
             actor,
         });
     }
+    publicWriterLeaseDiagnostic(lease) {
+        return {
+            ...toPublicWriterLease(lease, this.now()),
+            tokenFingerprint: createHash('sha256').update(lease.token).digest('hex').slice(0, 16),
+        };
+    }
     proveWriterLeaseTokenForHandoff(context, taskId, writerToken) {
         const currentLease = context.locks.inspect(taskId);
         if (!currentLease) {
@@ -3303,9 +4566,12 @@ export class WorkflowService {
             storedKnowledgeMapHash: storedHash,
         });
     }
-    inspectAdoptionPreparation(identity, tasks, milestones) {
-        const locks = new WriterLockManager(this.store.lockRoot(identity.projectId), this.now);
-        const currentPosture = readCurrentAdoptionPosture(this.store, identity.projectId);
+    inspectAdoptionPreparation(identity, tasks, milestones, observedLeases, observedPosture) {
+        const leases = observedLeases
+            ?? new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root).list();
+        const currentPosture = observedPosture === undefined
+            ? readCurrentAdoptionPosture(this.store, identity.projectId)
+            : observedPosture;
         if (currentPosture) {
             assertAdoptionBaselinePreserved(currentPosture, tasks, milestones);
         }
@@ -3318,7 +4584,7 @@ export class WorkflowService {
             tasks,
             milestones,
             sidecarInventory: this.collectAdoptionSidecarInventory(identity.projectId, tasks, milestones),
-            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, locks.list()),
+            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, leases),
             now: this.now(),
         }, currentPosture);
     }
@@ -3765,12 +5031,25 @@ function validateMilestonePlan(plan) {
     if (plan.acceptance.length === 0 || plan.acceptance.some((value) => !value.trim())) {
         throw new WorkflowError('INVALID_ARGUMENT', 'Milestone acceptance must contain substantive entries.');
     }
-    if (plan.memberships.length === 0) {
+    if (!Array.isArray(plan.memberships) || plan.memberships.length === 0) {
         throw new WorkflowError('INVALID_ARGUMENT', 'Milestone requires at least one Task membership.');
     }
     for (const membership of plan.memberships) {
-        if (!membership.taskId.trim())
+        if (!membership || typeof membership !== 'object' || Array.isArray(membership)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone membership must be an object.');
+        }
+        if (typeof membership.taskId !== 'string' || !membership.taskId.trim()) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone membership requires Task ID.');
+        }
+        if (typeof membership.reason !== 'string') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone membership reason must be a string.');
+        }
+        if (!Array.isArray(membership.dependsOnTaskIds)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Every Milestone membership must declare dependsOnTaskIds explicitly.');
+        }
+        if (membership.dependsOnTaskIds.some((taskId) => typeof taskId !== 'string' || !taskId.trim())) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone dependency IDs must be non-empty strings.');
+        }
         if (membership.disposition !== 'required' && !membership.reason.trim()) {
             throw new WorkflowError('INVALID_ARGUMENT', `Milestone ${membership.disposition} membership requires a reason.`);
         }
@@ -3800,7 +5079,7 @@ function taskCanRebindKnowledge(task) {
         'awaiting_final_acceptance',
     ].includes(task.status);
 }
-function taskIsActionableFromRepositoryNext(task, milestonesById) {
+function taskIsActionableFromRepositoryNext(task, milestonesById, tasksById) {
     if (task.status === 'merged' || task.status === 'cancelled')
         return false;
     if (!task.milestoneId)
@@ -3808,10 +5087,18 @@ function taskIsActionableFromRepositoryNext(task, milestonesById) {
     const milestone = milestonesById.get(task.milestoneId);
     if (!milestone)
         return false;
-    if (taskHasStarted(task))
-        return !['accepted', 'cancelled'].includes(milestone.status);
-    const membership = milestone.memberships.find((candidate) => candidate.taskId === task.id);
-    return milestone.status === 'active' && membership?.disposition === 'required';
+    if (milestone.status !== 'active')
+        return false;
+    const assessment = assessMilestoneTaskDependencies(milestone, task.id, (candidateTaskId) => {
+        const candidate = tasksById.get(candidateTaskId);
+        if (!candidate)
+            throw new WorkflowError('NOT_FOUND', `Task ${candidateTaskId} was not found.`);
+        return candidate;
+    });
+    return assessment.runnable;
+}
+function structuralReplacementIsDisabled() {
+    return true;
 }
 function milestoneFinalAcceptanceGate(milestone, headCommit) {
     if (!milestone.resultHash || !milestone.evidenceHash) {
@@ -3860,13 +5147,13 @@ function nextForTask(task) {
         awaiting_execution_authorization: 'task authorize',
         ready: task.workspaceOwner ? (stepsComplete ? 'task submit' : 'task run') : 'task start',
         in_progress: activeStep ? 'task step-complete' : stepsComplete ? 'task submit' : 'task run',
-        validating: task.review.status === 'passed' ? 'task result-set' : 'task review-record',
+        validating: task.review.status === 'passed' ? 'task result-set' : 'task review-launch',
         needs_fix: task.steps.some((step) => step.status === 'failed') ? 'task run' : 'task plan-set',
         awaiting_final_acceptance: 'task accept',
         merging: 'task merge',
         ready_to_merge: 'task merge-confirm',
         merged: 'none',
-        blocked: task.review.status === 'unverified' ? 'task review-record' : 'doctor',
+        blocked: task.review.status === 'unverified' ? 'task review-launch' : 'doctor',
         cancelled: 'none',
     };
     const selectedStep = activeStep ?? failedStep ?? runnableStep;
@@ -3888,6 +5175,96 @@ function nextForTask(task) {
             : {}),
     };
 }
+function gitMutationPolicyForAction(task, action) {
+    const metadataWrites = ['.git/index', '.git/index.lock', '.git/HEAD', '.git/refs', '.git/logs'];
+    switch (action) {
+        case 'task start':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task start',
+                appliesWhen: { workspaceOwner: 'local' },
+                metadataWrites,
+            };
+        case 'task step-complete':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task step-complete',
+                metadataWrites,
+            };
+        case 'task merge':
+            if (task.workspaceOwner !== 'local')
+                return null;
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task merge',
+                metadataWrites,
+            };
+        case 'task sync-base':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task sync-base',
+                metadataWrites,
+            };
+        default:
+            return null;
+    }
+}
+function writerTokenContractForAction(action, claimedC1Posture = false) {
+    const alwaysLeaseBound = ['task step-complete', 'task submit', 'task merge', 'task merge-confirm'];
+    const claimedC1LeaseBound = [
+        'task run',
+        'task step-review',
+        'task step-review-record',
+        'task review-record',
+        'task review-launch',
+        'task review-sealed-record',
+        'task corrective-decision-recover',
+        'task remediation-mode-recover',
+        'task plan-integrity-recover',
+        'task corrective-decision',
+        'task corrective-yield',
+        'task handoff',
+        'task handoff-prepare',
+        'task handback',
+        'task handback-create',
+    ];
+    if (!alwaysLeaseBound.includes(action) && !(claimedC1Posture && claimedC1LeaseBound.includes(action))) {
+        return null;
+    }
+    return {
+        required: true,
+        option: '--writer-token',
+        source: 'active-writer-lease',
+        sensitive: true,
+        renewalDisposition: 'reuse-presented-token',
+        tokenReissuedOnRenewal: false,
+    };
+}
+function observationPreflightBlockers(observation) {
+    const messages = {
+        PROJECT_REGISTRATION_MISSING: 'Workflow project registration is missing.',
+        PROJECT_REPOSITORY_ROOT_UNBOUND: 'The current repository root is not bound to the Workflow project.',
+        PROJECT_RECOVERY_REQUIRED: 'A project transaction requires explicit recovery.',
+        MILESTONE_RECOVERY_REQUIRED: 'A Milestone transaction requires explicit recovery.',
+        TASK_RECOVERY_REQUIRED: 'A Task corrective-replan transaction requires explicit recovery.',
+        TASK_TRANSACTION_INTEGRITY_FAILED: 'A Task transaction journal failed integrity validation.',
+        TASK_OPERATION_IN_PROGRESS: 'A Core Task operation is in progress.',
+        STALE_TASK_OPERATION: 'A stale Core Task operation requires bounded repair.',
+        ADOPTION_MISSING: 'Workflow lifecycle adoption is missing.',
+    };
+    return observation.reasonCodes.flatMap((reasonCode) => {
+        const message = messages[reasonCode];
+        return message ? [message] : [];
+    });
+}
 function knowledgeSummary(map) {
     return {
         revision: map.revision,