codex-workflow-v2 2.0.0-beta.1 → 2.0.0-beta.4

package/dist/src/workflow.js

@@ -9,11 +9,11 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
-import { applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { assessMilestoneInitialAssembly, applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
 import { buildCurrentStrictStepReviewCycle, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
@@ -23,10 +23,16 @@ import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
 import { launchStrictStepReviewer } from './reviewer.js';
-import { WriterLockManager } from './state/lock.js';
+import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
+import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
+import { inspectCorrectiveYieldTaskTransactions } from './state/corrective-yield-transaction.js';
+import { createCorrectiveYieldExecutor } from './state/corrective-yield-executor.js';
+import { createCorrectiveReplanPublicController, } from './state/corrective-replan-public.js';
+import { inspectWorkflowObservationBoundary, } from './observation.js';
 import { createEntityId } from './ulid.js';
 import { PACKAGE_VERSION } from './version.js';
+import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
 export class WorkflowService {
     store;
     now;
@@ -34,9 +40,33 @@ export class WorkflowService {
         this.store = store;
         this.now = now;
     }
-    context(repository) {
+    #mutationContext(repository) {
         const identity = resolveRepositoryIdentity(repository);
         const projectRoot = this.store.projectRoot(identity.projectId);
+        const replanTransactions = inspectCorrectiveReplanTaskTransactions(projectRoot, this.store.root);
+        const yieldTransactions = inspectCorrectiveYieldTaskTransactions(projectRoot, this.store.root);
+        const taskTransactions = {
+            corrupt: [...replanTransactions.corrupt, ...yieldTransactions.corrupt],
+            pending: [...replanTransactions.pending, ...yieldTransactions.pending],
+        };
+        if (taskTransactions.corrupt.length > 0) {
+            throw new WorkflowError('STATE_CORRUPT', 'A Task transaction journal failed integrity validation.', {
+                transactions: taskTransactions.corrupt,
+            });
+        }
+        if (taskTransactions.pending.length > 0) {
+            throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'A Task transaction requires explicit recovery.', {
+                taskIds: [...new Set(taskTransactions.pending.map((transaction) => transaction.taskId))].sort(),
+                transactionIds: taskTransactions.pending.map((transaction) => transaction.transactionId).sort(),
+            });
+        }
+        const coreTaskOperations = listCoreTaskOperationMutexes(this.store.lockRoot(identity.projectId), this.store.root);
+        if (coreTaskOperations.length > 0) {
+            throw new WorkflowError('LOCKED', 'A Core Task operation owns the project mutation boundary.', {
+                taskIds: coreTaskOperations.map((operation) => operation.entityId).sort(),
+                operationIds: coreTaskOperations.map((operation) => operation.operationId).sort(),
+            });
+        }
         recoverProjectTransactions(projectRoot, identity.projectId);
         const projectFile = path.join(projectRoot, 'project.json');
         const projectAlreadyRegistered = existsSync(projectFile);
@@ -54,17 +84,103 @@ export class WorkflowService {
         return {
             identity,
             store: this.store,
-            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now),
+            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root),
+        };
+    }
+    inspectWriterLease(repository, entityId) {
+        const identity = resolveRepositoryIdentity(repository);
+        const lease = inspectRawWriterLease(this.store.lockRoot(identity.projectId), entityId, this.store.root);
+        return lease ? this.publicWriterLeaseDiagnostic(lease) : null;
+    }
+    repairStaleWriterLease(repository, entityId) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.repairStale(entityId);
+        return {
+            ...this.publicWriterLeaseDiagnostic(lease),
+            repaired: true,
+        };
+    }
+    prepareCorrectiveReplan(repository, taskId, candidate) {
+        return this.correctiveReplanController(repository).prepare({ taskId, candidate });
+    }
+    confirmCorrectiveReplan(repository, taskId, candidate, gate, confirmationCode) {
+        return this.correctiveReplanController(repository).confirm({ taskId, candidate, gate, confirmationCode });
+    }
+    executeCorrectiveReplan(repository, taskId, candidate, credential) {
+        return this.correctiveReplanController(repository).execute({ taskId, candidate, credential });
+    }
+    recoverCorrectiveReplan(repository, taskId, transactionId) {
+        return this.correctiveReplanController(repository).recover({ taskId, transactionId });
+    }
+    executeCorrectiveYield(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).execute({
+            projectId: identity.projectId,
+            taskId,
+            expectedTaskRevision,
+            actor,
+            writerToken,
+            reason,
+        });
+    }
+    recoverCorrectiveYield(repository, taskId, transactionId) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).recover({ taskId, transactionId });
+    }
+    correctiveReplanController(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveReplanPublicController({
+            store: this.store,
+            projectId: identity.projectId,
+            repositoryRoot: identity.repositoryRoot,
+            now: this.now,
+        });
+    }
+    observationSnapshot(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        const boundary = inspectWorkflowObservationBoundary({
+            store: this.store,
+            identity,
+            now: this.now(),
+        });
+        if (boundary.observation.kind !== 'assessment') {
+            return {
+                ...boundary,
+                discoveries: [],
+                tasks: [],
+                milestones: [],
+                delegations: [],
+                adoption: null,
+            };
+        }
+        const tasks = this.store.listTasks(identity.projectId);
+        const rawMilestones = this.store.listMilestones(identity.projectId);
+        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones, boundary.leases, boundary.currentAdoptionPosture);
+        return {
+            ...boundary,
+            discoveries: this.store.listDiscoveries(identity.projectId),
+            tasks,
+            milestones: this.listMilestonesObserved(identity.projectId, rawMilestones, adoption.currentPosture),
+            delegations: this.store.listDelegations(identity.projectId),
+            adoption,
         };
     }
     prepareDelegation(repository, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         return gate;
     }
     grantDelegation(repository, input, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         if (confirmationCode.trim() !== gate.confirmationCode) {
@@ -100,7 +216,7 @@ export class WorkflowService {
         }, null);
     }
     revokeDelegation(repository, grantId, expectedRevision, actor, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const grant = this.store.readDelegation(identity.projectId, grantId);
         assertExpectedRevision(grant, expectedRevision);
         if (grant.status !== 'active') {
@@ -124,7 +240,7 @@ export class WorkflowService {
     startDiscovery(repository, input) {
         if (!input.goal.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Discovery requires a substantive goal.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const timestamp = this.now().toISOString();
         const initial = {
             schemaVersion: STATE_SCHEMA_VERSION,
@@ -152,7 +268,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(initial, null);
     }
     updateDiscovery(repository, discoveryId, expectedRevision, patch) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readDiscovery(identity.projectId, discoveryId);
         if (current.status === 'materialized' || current.status === 'abandoned') {
             throw new WorkflowError('TRANSITION_BLOCKED', `Discovery ${discoveryId} is ${current.status}.`);
@@ -176,7 +292,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(updated, expectedRevision);
     }
     materializeTask(repository, discoveryId, expectedRevision, title, baseBranch = 'main', milestoneId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -253,7 +369,7 @@ export class WorkflowService {
         return { discovery: savedDiscovery, task: savedTask, taskRoot };
     }
     replaceSplitRequiredTask(repository, oldTaskId, expectedOldTaskRevision, discoveryId, expectedDiscoveryRevision, expectedMilestoneRevision, title, actor) {
-        const { identity, locks } = this.context(repository);
+        const { identity, locks } = this.#mutationContext(repository);
         const oldTask = this.store.readTask(identity.projectId, oldTaskId);
         assertExpectedRevision(oldTask, expectedOldTaskRevision);
         if (!oldTask.milestoneId) {
@@ -504,7 +620,7 @@ export class WorkflowService {
         };
     }
     materializeMilestone(repository, discoveryId, expectedRevision, title, baseBranch = 'main') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -552,7 +668,7 @@ export class WorkflowService {
         };
     }
     setMilestonePlan(repository, milestoneId, expectedRevision, plan) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['planning', 'awaiting_execution_authorization', 'active', 'blocked'].includes(milestone.status)) {
@@ -624,7 +740,7 @@ export class WorkflowService {
         return saved;
     }
     prepareMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -641,7 +757,7 @@ export class WorkflowService {
         };
     }
     applyMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -664,7 +780,7 @@ export class WorkflowService {
         });
     }
     prepareMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         return prepareMilestoneAutonomyContract({
@@ -677,7 +793,7 @@ export class WorkflowService {
         });
     }
     grantMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         return applyMilestoneAutonomyContract({
@@ -692,7 +808,7 @@ export class WorkflowService {
         });
     }
     evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -722,7 +838,7 @@ export class WorkflowService {
         });
     }
     authorizeMilestone(repository, milestoneId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
@@ -751,7 +867,7 @@ export class WorkflowService {
         return this.store.writeMilestone({ ...milestone, status: 'active', planHash, authorizations: [...milestone.authorizations, event] }, expectedRevision);
     }
     validateMilestone(repository, milestoneId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
@@ -814,7 +930,7 @@ export class WorkflowService {
         return saved;
     }
     acceptMilestone(repository, milestoneId, expectedRevision, actor, confirmationCode, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_final_acceptance' || !milestone.resultHash || !milestone.evidenceHash) {
@@ -869,7 +985,7 @@ export class WorkflowService {
     cancelMilestone(repository, milestoneId, expectedRevision, reason) {
         if (!reason.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone cancellation requires a reason.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (['accepted', 'cancelled'].includes(milestone.status)) {
@@ -879,21 +995,54 @@ export class WorkflowService {
     }
     setTaskPlan(repository, taskId, expectedRevision, plan, correctiveAudit = null, planRiskAudit = null) {
         validatePlan(plan);
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const knowledgeMap = this.assertKnowledgeMapBinding(identity.repositoryRoot, identity.projectId, plan.knowledgeMapRevision, plan.knowledgeMapHash);
         this.validateKnowledgeTargets(knowledgeMap, plan);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
-        }
+        const correctiveDecisionEvents = task.planHash ? readCorrectiveDecisionEvents(this.store, task) : [];
         const currentPlanCorrectiveDecisions = task.planHash
-            ? readCorrectiveDecisionEvents(this.store, task).filter((event) => event.planHash === task.planHash)
+            ? correctiveDecisionEvents.filter((event) => event.planHash === task.planHash)
             : [];
         const currentReplanDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'replan-required');
         const currentContinueFixDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'continue-fix');
         const currentHardBlockingDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'split-required' || event.decision === 'stop-escalate');
-        const currentReplanRequiredStepIds = [...new Set(currentReplanDecisions.map((event) => event.stepId))];
+        const currentPlanRiskAudit = task.status === 'needs_fix' || currentReplanDecisions.length > 0
+            ? readCurrentPlanRiskAudit(this.store, task)
+            : null;
+        const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
+            ? findCurrentGuardedRemediationPosture(this.store, task, currentPlanRiskAudit)
+            : null;
+        const correctiveReplanPosture = classifiedCorrectivePosture?.posture === 'replan-required'
+            ? classifiedCorrectivePosture
+            : currentPlanRiskAudit
+                ? identifyCorrectiveReplanPosture(task, currentPlanRiskAudit.reviewRequiredStepIds, correctiveDecisionEvents, readRemediationEvents(this.store, task))
+                : null;
+        const correctiveReplanAvailability = correctiveReplanPosture?.posture === 'replan-required'
+            ? evaluateTaskCorrectiveReplanAvailability(task, correctiveReplanPosture)
+            : null;
+        if (currentReplanDecisions.length > 0) {
+            if (!correctiveReplanAvailability?.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} is blocked for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    posture: correctiveReplanPosture?.posture ?? null,
+                    evaluationPhase: correctiveReplanAvailability?.phase ?? 'availability',
+                    blockingGuardIds: correctiveReplanAvailability?.blockingGuardIds ?? [],
+                    pendingGuardIds: correctiveReplanAvailability?.pendingGuardIds ?? [],
+                    guardResults: correctiveReplanAvailability?.guardResults ?? [],
+                });
+            }
+            throw new WorkflowError('TRANSITION_BLOCKED', `Legacy task plan-set cannot execute ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID}.`, {
+                taskId: task.id,
+                transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                requiredAction: readTaskC1Posture(this.store, task).state === 'claimed'
+                    ? 'Run task corrective-yield first, then use task corrective-replan-prepare.'
+                    : 'Use task corrective-replan-prepare, confirm, and execute.',
+            });
+        }
+        else if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
+        }
         if (currentHardBlockingDecisions.length > 0) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has current corrective decisions that prohibit normal plan updates.`, {
                 taskId: task.id,
@@ -923,9 +1072,6 @@ export class WorkflowService {
                 })),
             });
         }
-        const currentPlanRiskAudit = task.status === 'needs_fix'
-            ? readCurrentPlanRiskAudit(this.store, task)
-            : null;
         const failedReviewAttempts = countFailedReviewAttempts(this.store.taskRoot(identity.projectId, taskId));
         if (task.status === 'needs_fix' && task.review.status === 'failed' && failedReviewAttempts >= 2) {
             validateCorrectivePlanAudit(task, correctiveAudit, failedReviewAttempts);
@@ -968,7 +1114,7 @@ export class WorkflowService {
             }
         }
         const root = this.store.taskRoot(identity.projectId, taskId);
-        const stagedPlan = this.store.stageArtifact(root, 'plan.md', renderPlan(task, plan));
+        const preparedPlan = prepareCorrectiveReplanCandidate(task, plan);
         const authorizations = task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
             ? { ...authorization, decision: 'superseded' }
             : authorization);
@@ -985,12 +1131,17 @@ export class WorkflowService {
             plannedSteps.every((step) => step.status === 'completed')) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'A failed review requires at least one new or changed remediation Step.');
         }
-        if (currentReplanRequiredStepIds.some((stepId) => !plannedSteps.some((step) => step.id === stepId))) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Replacement Plan under replan-required must retain every guarded Step targeted by the current corrective decision; removing or renaming one would reset remediation history.`, {
-                taskId: task.id,
-                requiredStepIds: currentReplanRequiredStepIds,
-                plannedStepIds: plannedSteps.map((step) => step.id),
-            });
+        if (correctiveReplanPosture?.posture === 'replan-required') {
+            const executionEvaluation = evaluateTaskCorrectiveReplanCandidate(task, correctiveReplanPosture, preparedPlan);
+            if (!executionEvaluation.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} rejected the candidate Plan for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    evaluationPhase: executionEvaluation.phase,
+                    blockingGuardIds: executionEvaluation.blockingGuardIds,
+                    pendingGuardIds: executionEvaluation.pendingGuardIds,
+                    guardResults: executionEvaluation.guardResults,
+                });
+            }
         }
         if (guardedRemediationGate && currentReplanDecisions.length === 0 && !plannedSteps.some((step) => step.id === guardedRemediationGate.stepId)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Continue-fix must retain guarded Step ${guardedRemediationGate.stepId}; removing or renaming it would reset the remediation breaker.`, {
@@ -998,14 +1149,10 @@ export class WorkflowService {
                 stepId: guardedRemediationGate.stepId,
             });
         }
-        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
-            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
-            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, stagedPlan.hash, this.now());
-        }
         const candidate = {
             ...task,
             status: 'awaiting_execution_authorization',
-            planHash: stagedPlan.hash,
+            planHash: preparedPlan.planHash,
             planObjective: plan.objective,
             requirements: plan.requirements,
             acceptance: plan.acceptance,
@@ -1025,6 +1172,18 @@ export class WorkflowService {
         };
         if (planRiskAudit)
             validatePlanRiskAuditCandidate(this.store, candidate, planRiskAudit);
+        const stagedPlan = this.store.stageArtifact(root, 'plan.md', preparedPlan.planBytes);
+        if (stagedPlan.hash !== preparedPlan.planHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Prepared candidate Plan hash changed during staging.', {
+                taskId: task.id,
+                preparedPlanHash: preparedPlan.planHash,
+                stagedPlanHash: stagedPlan.hash,
+            });
+        }
+        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
+            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
+            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, preparedPlan.planHash, this.now());
+        }
         const saved = this.store.writeTask(candidate, expectedRevision);
         this.store.publishArtifact(stagedPlan);
         if (planRiskAudit)
@@ -1035,7 +1194,7 @@ export class WorkflowService {
         return saved;
     }
     rebindTaskKnowledge(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.assertTaskContextChangeAllowed(task);
@@ -1120,7 +1279,7 @@ export class WorkflowService {
         if (!delegationGrantId) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Task context refresh combines approval transitions and therefore requires an explicit delegated approval grant.');
         }
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const currentMap = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(task, expectedTaskRevision);
@@ -1211,7 +1370,7 @@ export class WorkflowService {
         });
     }
     authorizeTask(repository, taskId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1241,7 +1400,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'ready', briefHash, planHash, authorizations: [...task.authorizations, event] }, expectedRevision);
     }
     recordPlanRiskAudit(repository, taskId, expectedRevision, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1249,7 +1408,7 @@ export class WorkflowService {
         return appendCurrentPlanRiskAudit(this.store, task, input, this.now());
     }
     showTaskHandoff(repository, taskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         return {
             task,
@@ -1258,7 +1417,7 @@ export class WorkflowService {
         };
     }
     handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
@@ -1327,15 +1486,15 @@ export class WorkflowService {
         }
     }
     claimTask(repository, taskId, expectedRevision, actor, claimToken, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
         if (!normalizedActor) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Claim actor is required.');
         }
-        const pendingHandoff = readTaskC1Posture(this.store, task);
-        if (pendingHandoff.state === 'pending' && pendingHandoff.latestEvent.grantId) {
+        const pendingHandoff = assertTaskClaimAllowed(this.store, task, normalizedActor, claimToken, this.now());
+        if (pendingHandoff.latestEvent.grantId) {
             this.assertHandoffGrant(context.identity.projectId, task, normalizedActor, pendingHandoff.latestEvent.grantId);
         }
         const existingLease = context.locks.inspect(taskId);
@@ -1368,7 +1527,14 @@ export class WorkflowService {
         }
         try {
             const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now());
-            return { task, event, lease };
+            return {
+                task,
+                event,
+                lease: toPublicWriterLease(lease, this.now()),
+                writerCredential: acquiredHere
+                    ? { disposition: 'issued', token: lease.token }
+                    : { disposition: 'renewed' },
+            };
         }
         catch (error) {
             if (acquiredHere)
@@ -1377,7 +1543,7 @@ export class WorkflowService {
         }
     }
     handbackTask(repository, taskId, expectedRevision, actor, reason, writerToken = null, limitations = [], recommendedNext = 'Coordinator reviews the terminal Task result and recorded evidence.') {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = task.status === 'merged' || task.status === 'cancelled'
@@ -1389,7 +1555,7 @@ export class WorkflowService {
         return { task, event };
     }
     startTask(repository, taskId, expectedRevision, workspaceOwner) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(identity, taskId);
@@ -1441,7 +1607,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, baseCommit, taskBranch, workspaceOwner, blockReason: null }, expectedRevision);
     }
     runStep(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
@@ -1555,7 +1721,8 @@ export class WorkflowService {
         }
         return {
             task: saved,
-            lease,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: acquiredHere ? 'issued' : 'renewed' },
             envelope: {
                 protocolVersion: PROTOCOL_VERSION,
                 packageVersion: PACKAGE_VERSION,
@@ -1591,14 +1758,14 @@ export class WorkflowService {
                 taskId,
                 stepId,
                 expectedRevision: saved.revision,
-                writerToken: lease.token,
+                writerToken: acquiredHere ? lease.token : null,
                 knowledgeMap: knowledgeSummary(knowledgeMap),
                 knowledgeSources: selectKnowledgeSources(knowledgeMap, 'worker', task.knowledgeTargets.map((target) => target.path)),
             },
         };
     }
     taskContext(repository, taskId, role) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const historicalStrictReview = role === 'independent-reviewer'
             && task.steps.some((step) => step.status === 'in_progress' && step.evidence !== null);
@@ -1677,7 +1844,7 @@ export class WorkflowService {
         };
     }
     completeStep(repository, taskId, stepId, expectedRevision, writerToken, notes, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
@@ -1763,7 +1930,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'in_progress', steps, blockReason: null }, expectedRevision);
     }
     reviewStep(repository, taskId, stepId, expectedRevision, runner, actor, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1868,7 +2035,7 @@ export class WorkflowService {
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
     submitTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1900,11 +2067,11 @@ export class WorkflowService {
         return saved;
     }
     recordReview(repository, taskId, expectedRevision, review, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
         if (task.status !== 'validating' && !retryingUnverified) {
@@ -1942,7 +2109,7 @@ export class WorkflowService {
         return saved;
     }
     recoverStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
@@ -1954,18 +2121,18 @@ export class WorkflowService {
         return appendCorrectiveDecisionRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recoverRemediationMode(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         return appendRemediationModeRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recordStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, correctiveAudit, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         if (!['ready', 'needs_fix', 'blocked'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot record a corrective decision while ${task.status}.`);
@@ -2007,7 +2174,7 @@ export class WorkflowService {
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
     setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
@@ -2021,7 +2188,7 @@ export class WorkflowService {
         return saved;
     }
     acceptTask(repository, taskId, expectedRevision, actor, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'awaiting_final_acceptance' || !task.resultHash || !task.evidenceHash) {
@@ -2059,7 +2226,7 @@ export class WorkflowService {
         }, expectedRevision);
     }
     syncTaskBase(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.taskBranch || !task.baseCommit) {
@@ -2111,7 +2278,7 @@ export class WorkflowService {
         return saved;
     }
     mergeTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2133,7 +2300,7 @@ export class WorkflowService {
         return saved;
     }
     confirmExternalMerge(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2150,21 +2317,22 @@ export class WorkflowService {
         return saved;
     }
     status(repository) {
-        const { identity } = this.context(repository);
-        const tasks = this.store.listTasks(identity.projectId);
-        const rawMilestones = this.store.listMilestones(identity.projectId);
-        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones);
+        const snapshot = this.observationSnapshot(repository);
         return {
-            projectId: identity.projectId,
-            discoveries: this.store.listDiscoveries(identity.projectId),
-            tasks,
-            milestones: this.listMilestonesCurrent(identity.projectId, adoption.currentPosture),
-            delegations: this.store.listDelegations(identity.projectId),
-            adoption,
+            projectId: snapshot.identity.projectId,
+            discoveries: snapshot.discoveries,
+            tasks: snapshot.tasks,
+            milestones: snapshot.milestones,
+            milestoneInitialAssembly: snapshot.milestones
+                .map((milestone) => this.describeMilestoneInitialAssembly(snapshot.identity.projectId, milestone, snapshot.tasks))
+                .filter((value) => value !== null),
+            delegations: snapshot.delegations,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
         };
     }
     recoverMilestoneTransactions(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestones = this.listMilestonesCurrent(identity.projectId, readCurrentAdoptionPosture(this.store, identity.projectId));
         return {
             projectId: identity.projectId,
@@ -2172,11 +2340,11 @@ export class WorkflowService {
         };
     }
     prepareAdoption(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.inspectAdoptionPreparation(identity, this.store.listTasks(identity.projectId), this.store.listMilestones(identity.projectId));
     }
     applyAdoption(repository, actor, confirmationCode) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const tasks = context.store.listTasks(context.identity.projectId);
         const milestones = context.store.listMilestones(context.identity.projectId);
         return applyAdoptionPosture(this.store, {
@@ -2193,19 +2361,19 @@ export class WorkflowService {
         }, actor, confirmationCode);
     }
     updatePreflight(repository) {
-        const context = this.context(repository);
-        const tasks = context.store.listTasks(context.identity.projectId);
-        const milestones = context.store.listMilestones(context.identity.projectId);
-        const dirty = changedFiles(context.identity.repositoryRoot);
+        const snapshot = this.observationSnapshot(repository);
+        const tasks = snapshot.tasks;
+        const milestones = snapshot.milestones;
+        const dirty = changedFiles(snapshot.identity.repositoryRoot);
         const runningSteps = tasks.flatMap((task) => task.steps
             .filter((step) => step.status === 'in_progress')
             .map((step) => ({ taskId: task.id, stepId: step.id })));
-        const leases = context.locks.list();
+        const leases = snapshot.leases;
         const now = this.now().getTime();
         const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
         const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
         const activeMilestones = milestones.filter((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
-        const inspectedVersions = inspectWorkflowVersions(context.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
+        const inspectedVersions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
         const milestoneBases = inspectedVersions.milestoneBases.map((base) => ({
             ...base,
             milestoneIds: activeMilestones.filter((milestone) => milestone.baseBranch === base.branch).map((milestone) => milestone.id),
@@ -2232,31 +2400,20 @@ export class WorkflowService {
             ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
             ...(staleLeases.length > 0 ? ['At least one stale writer lease requires explicit repair.'] : []),
             ...versionBlockers,
+            ...observationPreflightBlockers(snapshot.observation),
         ];
-        const adoption = buildAdoptionPreparation({
-            projectId: context.identity.projectId,
-            repositoryIdentity: context.identity,
-            packageVersion: PACKAGE_VERSION,
-            protocolVersion: PROTOCOL_VERSION,
-            stateSchemaVersion: STATE_SCHEMA_VERSION,
-            tasks,
-            milestones,
-            sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
-            blockers,
-            now: this.now(),
-        }, readCurrentAdoptionPosture(this.store, context.identity.projectId));
         return {
             safe: blockers.length === 0,
             packageVersion: PACKAGE_VERSION,
             protocolVersion: PROTOCOL_VERSION,
             stateSchemaVersion: STATE_SCHEMA_VERSION,
-            projectId: context.identity.projectId,
-            repositoryRoot: context.identity.repositoryRoot,
+            projectId: snapshot.identity.projectId,
+            repositoryRoot: snapshot.identity.repositoryRoot,
             clean: dirty.length === 0,
             changedFiles: dirty,
             runningSteps,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             blockers,
             workflowVersions: {
                 runtime: inspectedVersions.runtime,
@@ -2272,11 +2429,12 @@ export class WorkflowService {
                     ? null
                     : 'Land only package.json/package-lock.json dependency changes on every active Milestone base; do not transport unrelated product commits.',
             },
-            adoption,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
         };
     }
     alpha6StrictReviewRescuePreflight(repository) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const dependency = inspectLocalDependency(context.identity.repositoryRoot);
         const tasks = context.store.listTasks(context.identity.projectId);
         const leases = context.locks.list();
@@ -2371,15 +2529,15 @@ export class WorkflowService {
             projectId: context.identity.projectId,
             repositoryRoot: context.identity.repositoryRoot,
             clean: dirty.length === 0,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             candidate,
             blockers,
             requiredActions,
         };
     }
     scanKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         try {
             const current = this.store.readKnowledgeMap(identity.projectId);
@@ -2392,11 +2550,11 @@ export class WorkflowService {
         }
     }
     showKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.store.readKnowledgeMap(identity.projectId);
     }
     knowledgeMapStatus(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         return inspectKnowledgeMap(current, scanned);
@@ -2405,7 +2563,7 @@ export class WorkflowService {
         return this.approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, null);
     }
     approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, autonomyTaskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const inspected = inspectKnowledgeMap(current, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
@@ -2422,7 +2580,7 @@ export class WorkflowService {
         return this.store.writeKnowledgeMap(approved, expectedRevision);
     }
     reconcileKnowledgeMap(repository, expectedRevision, allowAtomicTaskRefresh = false) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
@@ -2448,17 +2606,17 @@ export class WorkflowService {
         return this.store.writeKnowledgeMap(reconcileKnowledgeMap(current, scanned), expectedRevision);
     }
     graphRefreshRequest(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
     }
     graphStatus(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const binding = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return { request, binding: binding ? inspectGraphBinding(binding, request) : null };
     }
     bindGraph(repository, expectedRevision, request, evidence) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const currentRequest = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, request.graphKind, request.mode, this.now());
         validateGraphRequestCurrent(request, currentRequest);
         const existing = this.readGraphBindingOrNull(identity.projectId, request.graphKind);
@@ -2466,13 +2624,78 @@ export class WorkflowService {
         return this.store.writeGraphBinding(binding, expectedRevision);
     }
     recordGraphFallback(repository, graphKind, mode, expectedRevision, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const existing = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
     next(repository) {
         const status = this.status(repository);
+        if (status.observation.kind === 'blocked') {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
+        if (status.observation.kind === 'repair') {
+            const repair = status.observation.repair;
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'repair-required',
+                action: repair?.command ?? 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: repair ? 'repair' : 'blocked',
+                    transitionId: null,
+                    availableRepairTransitionId: null,
+                    ...(repair ? {
+                        command: repair.command,
+                        cataloged: repair.cataloged,
+                        ...('available' in repair ? { available: repair.available } : {}),
+                        bindings: repair.command === 'milestone recover'
+                            ? {
+                                projectId: repair.projectId,
+                                milestoneIds: repair.milestoneIds,
+                                transactionIds: repair.transactionIds,
+                            }
+                            : 'taskIds' in repair
+                                ? {
+                                    projectId: repair.projectId,
+                                    taskIds: repair.taskIds,
+                                    transactionIds: repair.transactionIds,
+                                }
+                                : {
+                                    projectId: repair.projectId,
+                                    entityIds: repair.entityIds,
+                                },
+                    } : {}),
+                    reasonCodes: status.observation.reasonCodes,
+                },
+            };
+        }
+        if (!status.adoption) {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
         const adoptionInfo = {
             status: status.adoption.status,
             safe: status.adoption.safe,
@@ -2490,9 +2713,34 @@ export class WorkflowService {
                 status: status.adoption.status,
                 action: status.adoption.safe ? 'state adoption-apply' : 'restore safe boundary, then state adoption-prepare',
                 adoption: adoptionInfo,
+                observation: status.observation,
+                navigation: status.adoption.safe
+                    ? {
+                        kind: 'human-gate',
+                        transitionId: null,
+                        cataloged: false,
+                        command: 'state adoption-apply',
+                        bindings: {
+                            projectId: status.projectId,
+                            confirmationCode: status.adoption.confirmationCode,
+                            confirmationCodeBindingHash: status.adoption.confirmationCodeBindingHash,
+                            actorRequired: true,
+                        },
+                    }
+                    : {
+                        kind: 'blocked',
+                        transitionId: null,
+                        availableRepairTransitionId: null,
+                        reasonCodes: ['ADOPTION_MISSING'],
+                        blockers: status.adoption.blockers,
+                    },
             };
         }
-        const withAdoption = (value) => ({ ...value, adoption: adoptionInfo });
+        const withAdoption = (value) => ({
+            ...value,
+            adoption: adoptionInfo,
+            observation: status.observation,
+        });
         const repositoryRoot = resolveRepositoryIdentity(repository).repositoryRoot;
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
         const activeTask = status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
@@ -2588,6 +2836,31 @@ export class WorkflowService {
         }
         const activeMilestone = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         if (activeMilestone) {
+            const initialAssembly = status.milestoneInitialAssembly
+                .find((candidate) => candidate.milestoneId === activeMilestone.id) ?? null;
+            if (initialAssembly) {
+                const activeDiscovery = status.discoveries.find((discovery) => !['materialized', 'abandoned'].includes(discovery.status));
+                if (activeDiscovery) {
+                    return withAdoption({
+                        scope: 'discovery',
+                        id: activeDiscovery.id,
+                        status: activeDiscovery.status,
+                        action: activeDiscovery.status === 'ready_to_materialize' ? 'discovery materialize' : 'discovery update',
+                        readiness: assessDiscovery(activeDiscovery),
+                        milestoneInitialAssembly: initialAssembly,
+                    });
+                }
+                return withAdoption({
+                    scope: 'milestone',
+                    id: activeMilestone.id,
+                    status: activeMilestone.status,
+                    action: 'milestone initial-assembly',
+                    revision: activeMilestone.revision,
+                    linkedTaskIds: initialAssembly.linkedTaskIds,
+                    executionAvailable: initialAssembly.executionAvailable,
+                    milestoneInitialAssembly: initialAssembly,
+                });
+            }
             if (activeMilestone.status === 'awaiting_final_acceptance') {
                 const root = this.store.milestoneRoot(activeMilestone.projectId, activeMilestone.id);
                 const evidence = JSON.parse(readFileSync(path.join(root, 'evidence.json'), 'utf8'));
@@ -2794,7 +3067,20 @@ export class WorkflowService {
                     throw error;
             }
         }
-        const next = nextForTask(task);
+        let catalogCorrectiveReplanPosture = guardedCorrectivePosture?.posture === 'replan-required'
+            ? guardedCorrectivePosture
+            : null;
+        if (!remediationModeRecovery && planRiskAudit && guardedCorrectivePosture === null) {
+            try {
+                catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
+            }
+            catch (error) {
+                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task);
+                if (!remediationModeRecovery)
+                    throw error;
+            }
+        }
+        const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const handoffPosture = readTaskC1Posture(this.store, task);
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
@@ -2836,6 +3122,63 @@ export class WorkflowService {
                         },
                     }
                     : {};
+        const correctiveReplanOverlay = (posture) => {
+            const evaluation = evaluateTaskCorrectiveReplanAvailability(task, posture);
+            const writerLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+            const command = handoffPosture.state === 'claimed'
+                ? 'task corrective-yield'
+                : writerLease
+                    ? 'doctor'
+                    : 'task corrective-replan-prepare';
+            if (evaluation.allowed && handoffPosture.state === 'none' && writerLease) {
+                const navigation = correctiveReplanNavigation(evaluation);
+                return {
+                    action: command,
+                    blockedAction: 'task corrective-replan-prepare',
+                    stepId: posture.stepId,
+                    navigation: {
+                        kind: 'blocked',
+                        transitionId: navigation.transitionId,
+                        semanticFingerprint: navigation.semanticFingerprint,
+                        command: navigation.command,
+                        blockingGuardIds: ['task.corrective-replan.no-writer-lease'],
+                        pendingInputGuardIds: navigation.pendingInputGuardIds,
+                        reasonCode: 'ACTIVE_WRITER_LEASE',
+                    },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: 'The active non-C1 writer lease must expire and be explicitly repaired before corrective replan preparation.',
+                        writerLease: {
+                            owner: writerLease.owner,
+                            expiresAt: writerLease.expiresAt,
+                        },
+                    },
+                };
+            }
+            return evaluation.allowed
+                ? {
+                    action: command,
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: { ...correctiveReplanNavigation(evaluation), command },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: handoffPosture.state === 'claimed'
+                            ? 'Yield the exact C1 claim and writer lease before preparing replacement authority.'
+                            : 'Prepare a state-bound candidate, confirm the Human gate, then execute its exact receipt.',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: correctiveReplanBlockedNavigation(evaluation),
+                };
+        };
         let guardedCorrectiveOverlay = {};
         if (remediationModeRecovery) {
             guardedCorrectiveOverlay = {
@@ -2854,7 +3197,12 @@ export class WorkflowService {
                 },
             };
         }
-        if (!remediationModeRecovery && !strictStepReviewStep && guardedCorrectivePosture) {
+        if (!remediationModeRecovery && guardedCorrectivePosture === null && catalogCorrectiveReplanPosture) {
+            guardedCorrectiveOverlay = correctiveReplanOverlay(catalogCorrectiveReplanPosture);
+        }
+        if (!remediationModeRecovery
+            && guardedCorrectivePosture
+            && (!strictStepReviewStep || guardedCorrectivePosture.posture === 'replan-required')) {
             switch (guardedCorrectivePosture.posture) {
                 case 'decision-required':
                     if (guardedCorrectivePosture.correctiveDecision
@@ -2929,16 +3277,7 @@ export class WorkflowService {
                     };
                     break;
                 case 'replan-required':
-                    guardedCorrectiveOverlay = {
-                        action: 'task plan-set',
-                        stepId: guardedCorrectivePosture.stepId,
-                        correctiveDecisionGate: {
-                            attemptCount: guardedCorrectivePosture.attemptCount,
-                            decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
-                            decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
-                            requiredAction: 'Record an actual new Plan posture before another remediation run.',
-                        },
-                    };
+                    guardedCorrectiveOverlay = correctiveReplanOverlay(guardedCorrectivePosture);
                     break;
                 case 'split-required':
                     {
@@ -3051,13 +3390,31 @@ export class WorkflowService {
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
         };
         if (handoffPosture.state === 'pending') {
-            return {
+            return this.withTaskNavigationContracts(task, {
                 ...result,
                 action: 'task claim',
                 blockedAction: next.action,
-            };
+            });
         }
-        return result;
+        const navigableResult = ['task plan-set', 'task plan-set with independent corrective audit']
+            .includes(String(result.action))
+            ? {
+                ...result,
+                taskPlanContract: this.taskPlanContract(projectId, task),
+            }
+            : result;
+        return this.withTaskNavigationContracts(task, navigableResult);
+    }
+    taskPlanContract(projectId, task) {
+        const map = this.store.readKnowledgeMap(projectId);
+        return {
+            requiredRequirementIds: [...task.requirements],
+            requiredAcceptanceIds: [...task.acceptance],
+            currentRisks: [...task.risks],
+            exactInclusionRequired: true,
+            briefHash: task.briefHash,
+            knowledgeMap: knowledgeSummary(map),
+        };
     }
     assertTaskContextChangeAllowed(task) {
         const posture = this.taskTerminalCorrectivePosture(task);
@@ -3205,6 +3562,78 @@ export class WorkflowService {
             ? milestone
             : readMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
     }
+    listMilestonesObserved(projectId, milestones, posture) {
+        if (!posture)
+            return milestones;
+        const grandfatheredMilestones = new Set(posture.terminalMilestones.map((milestone) => `${milestone.milestoneId}:${milestone.revision}:${milestone.status}`));
+        return milestones.map((milestone) => (grandfatheredMilestones.has(`${milestone.id}:${milestone.revision}:${milestone.status}`)
+            ? milestone
+            : inspectMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
+    }
+    taskGitNavigationOverride(task) {
+        if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.baseCommit || !task.taskBranch) {
+            return null;
+        }
+        const currentBase = runGit(task.repositoryRoot, ['rev-parse', task.baseBranch]);
+        if (currentBase === task.baseCommit)
+            return null;
+        return {
+            scope: 'task',
+            id: task.id,
+            status: task.status,
+            action: 'task sync-base',
+            revision: task.revision,
+            baseSyncRequired: {
+                baseBranch: task.baseBranch,
+                recordedBaseCommit: task.baseCommit,
+                currentBaseCommit: currentBase,
+            },
+        };
+    }
+    withTaskNavigationContracts(task, next) {
+        const action = typeof next.action === 'string' ? next.action : null;
+        if (!action)
+            return next;
+        const policy = gitMutationPolicyForAction(task, action);
+        const claimedC1Posture = readTaskC1Posture(this.store, task).state === 'claimed';
+        const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture);
+        return {
+            ...next,
+            ...(policy ? { gitMutationPolicy: policy } : {}),
+            ...(writerTokenContract ? { writerTokenContract } : {}),
+        };
+    }
+    describeMilestoneInitialAssembly(projectId, milestone, tasks) {
+        const assessment = assessMilestoneInitialAssembly({
+            store: this.store,
+            projectId,
+            milestone,
+            listTasks: () => tasks,
+        });
+        if (!assessment.eligible)
+            return null;
+        const options = [
+            {
+                action: 'linked-task-assembly',
+                commands: ['discovery start', 'discovery materialize'],
+                description: 'Start or materialize the next linked Task Discovery for this Milestone before closing the initial membership Plan.',
+            },
+        ];
+        if (assessment.orphanTaskIds.length > 0) {
+            options.push({
+                action: 'milestone plan-set',
+                commands: ['milestone plan-set'],
+                description: 'Record one complete initial Milestone Plan that classifies every currently linked Task.',
+            });
+        }
+        return {
+            milestoneId: milestone.id,
+            revision: milestone.revision,
+            linkedTaskIds: assessment.orphanTaskIds,
+            executionAvailable: false,
+            options,
+        };
+    }
     prepareMilestoneScopeChangeCandidate(projectId, milestone, plan, actor) {
         validateMilestonePlan(plan);
         return prepareMilestoneScopeChangeCandidate({
@@ -3214,6 +3643,12 @@ export class WorkflowService {
             actor,
         });
     }
+    publicWriterLeaseDiagnostic(lease) {
+        return {
+            ...toPublicWriterLease(lease, this.now()),
+            tokenFingerprint: createHash('sha256').update(lease.token).digest('hex').slice(0, 16),
+        };
+    }
     proveWriterLeaseTokenForHandoff(context, taskId, writerToken) {
         const currentLease = context.locks.inspect(taskId);
         if (!currentLease) {
@@ -3303,9 +3738,12 @@ export class WorkflowService {
             storedKnowledgeMapHash: storedHash,
         });
     }
-    inspectAdoptionPreparation(identity, tasks, milestones) {
-        const locks = new WriterLockManager(this.store.lockRoot(identity.projectId), this.now);
-        const currentPosture = readCurrentAdoptionPosture(this.store, identity.projectId);
+    inspectAdoptionPreparation(identity, tasks, milestones, observedLeases, observedPosture) {
+        const leases = observedLeases
+            ?? new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root).list();
+        const currentPosture = observedPosture === undefined
+            ? readCurrentAdoptionPosture(this.store, identity.projectId)
+            : observedPosture;
         if (currentPosture) {
             assertAdoptionBaselinePreserved(currentPosture, tasks, milestones);
         }
@@ -3318,7 +3756,7 @@ export class WorkflowService {
             tasks,
             milestones,
             sidecarInventory: this.collectAdoptionSidecarInventory(identity.projectId, tasks, milestones),
-            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, locks.list()),
+            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, leases),
             now: this.now(),
         }, currentPosture);
     }
@@ -3860,13 +4298,13 @@ function nextForTask(task) {
         awaiting_execution_authorization: 'task authorize',
         ready: task.workspaceOwner ? (stepsComplete ? 'task submit' : 'task run') : 'task start',
         in_progress: activeStep ? 'task step-complete' : stepsComplete ? 'task submit' : 'task run',
-        validating: task.review.status === 'passed' ? 'task result-set' : 'task review-record',
+        validating: task.review.status === 'passed' ? 'task result-set' : 'task review-launch',
         needs_fix: task.steps.some((step) => step.status === 'failed') ? 'task run' : 'task plan-set',
         awaiting_final_acceptance: 'task accept',
         merging: 'task merge',
         ready_to_merge: 'task merge-confirm',
         merged: 'none',
-        blocked: task.review.status === 'unverified' ? 'task review-record' : 'doctor',
+        blocked: task.review.status === 'unverified' ? 'task review-launch' : 'doctor',
         cancelled: 'none',
     };
     const selectedStep = activeStep ?? failedStep ?? runnableStep;
@@ -3888,6 +4326,91 @@ function nextForTask(task) {
             : {}),
     };
 }
+function gitMutationPolicyForAction(task, action) {
+    const metadataWrites = ['.git/index', '.git/index.lock', '.git/HEAD', '.git/refs', '.git/logs'];
+    switch (action) {
+        case 'task start':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task start',
+                appliesWhen: { workspaceOwner: 'local' },
+                metadataWrites,
+            };
+        case 'task step-complete':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task step-complete',
+                metadataWrites,
+            };
+        case 'task merge':
+            if (task.workspaceOwner !== 'local')
+                return null;
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task merge',
+                metadataWrites,
+            };
+        case 'task sync-base':
+            return {
+                permission: 'git-metadata-write',
+                requiredBeforeFirstCall: true,
+                boundedToTransition: true,
+                transition: 'task sync-base',
+                metadataWrites,
+            };
+        default:
+            return null;
+    }
+}
+function writerTokenContractForAction(action, claimedC1Posture = false) {
+    const alwaysLeaseBound = ['task step-complete', 'task submit', 'task merge', 'task merge-confirm'];
+    const claimedC1LeaseBound = [
+        'task run',
+        'task step-review',
+        'task review-record',
+        'task review-launch',
+        'task corrective-decision-recover',
+        'task remediation-mode-recover',
+        'task corrective-decision',
+        'task corrective-yield',
+        'task handoff',
+        'task handoff-prepare',
+        'task handback',
+        'task handback-create',
+    ];
+    if (!alwaysLeaseBound.includes(action) && !(claimedC1Posture && claimedC1LeaseBound.includes(action))) {
+        return null;
+    }
+    return {
+        required: true,
+        option: '--writer-token',
+        source: 'active-writer-lease',
+        sensitive: true,
+    };
+}
+function observationPreflightBlockers(observation) {
+    const messages = {
+        PROJECT_REGISTRATION_MISSING: 'Workflow project registration is missing.',
+        PROJECT_REPOSITORY_ROOT_UNBOUND: 'The current repository root is not bound to the Workflow project.',
+        PROJECT_RECOVERY_REQUIRED: 'A project transaction requires explicit recovery.',
+        MILESTONE_RECOVERY_REQUIRED: 'A Milestone transaction requires explicit recovery.',
+        TASK_RECOVERY_REQUIRED: 'A Task corrective-replan transaction requires explicit recovery.',
+        TASK_TRANSACTION_INTEGRITY_FAILED: 'A Task transaction journal failed integrity validation.',
+        TASK_OPERATION_IN_PROGRESS: 'A Core Task operation is in progress.',
+        STALE_TASK_OPERATION: 'A stale Core Task operation requires bounded repair.',
+        ADOPTION_MISSING: 'Workflow lifecycle adoption is missing.',
+    };
+    return observation.reasonCodes.flatMap((reasonCode) => {
+        const message = messages[reasonCode];
+        return message ? [message] : [];
+    });
+}
 function knowledgeSummary(map) {
     return {
         revision: map.revision,