codex-workflow-v2 2.0.0-beta.12.1 → 2.0.0-beta.12.10

package/dist/src/workflow.js

@@ -2,7 +2,8 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectDependencyProvenanceRecovery } from './dependency-provenance.js';
+import { inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
+import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
@@ -10,17 +11,18 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
+import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
-import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
+import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
 import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
-import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneScopeChangeEvents, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
-import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestFailedStepReviewRouting, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, } from './alpha6/review.js';
+import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestFailedStepReviewRouting, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, verifiedHistoricalStepReviewBindings, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
-import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
+import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, readValidatedStopOverrideContextRebindIfApplicable, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
 import { ensureDirectory } from './fs-utils.js';
@@ -170,6 +172,202 @@ export class WorkflowService {
             now: this.now,
         }).recover({ taskId, transactionId });
     }
+    recoverDownstreamProof(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.heartbeat(taskId, writerToken);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedTaskRevision);
+        this.assertTaskMutationAllowedByHandoff(task, actor, lease.token);
+        const posture = readTaskC1Posture(this.store, task);
+        if (posture.state === 'none' && lease.owner !== actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream proof recovery actor must own the active writer lease.', {
+                taskId,
+                requiredActor: lease.owner,
+                actualActor: actor.trim(),
+            });
+        }
+        const assessment = assessDownstreamProofRecovery(this.store, context.identity.repositoryRoot, task);
+        if (!assessment.applicable || !assessment.eligible || !assessment.activeStepId) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task is not eligible for bounded downstream proof recovery.', {
+                taskId,
+                assessment,
+            });
+        }
+        const invalidatedIds = new Set(assessment.invalidatedSteps.map((step) => step.stepId));
+        const retainedHistoricalCommits = assessment.invalidatedSteps.map((step) => step.evidenceCommit);
+        const now = this.now();
+        const resultTask = {
+            ...task,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            status: 'needs_fix',
+            steps: task.steps.map((step) => {
+                if (invalidatedIds.has(step.id))
+                    return { ...step, status: 'planned', evidence: null };
+                if (step.id === assessment.activeStepId)
+                    return { ...step, status: 'blocked', evidence: null };
+                return step;
+            }),
+            authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
+                ? { ...authorization, decision: 'superseded' }
+                : authorization),
+            review: emptyReview(),
+            resultHash: null,
+            evidenceHash: null,
+            blockReason: `${assessment.activeStepId} exposed changes required in completed predecessor authority; replace the Step Plan before resuming execution.`,
+            invalidatedStepCommits: [...new Set([
+                    ...(task.invalidatedStepCommits ?? []),
+                    ...retainedHistoricalCommits,
+                ])],
+        };
+        const invalidation = prepareDownstreamProofInvalidation(this.store, resultTask, assessment, {
+            previousTaskRevision: task.revision,
+            actor,
+            reason,
+        }, now);
+        const preparedYield = posture.state === 'claimed'
+            ? prepareTaskCorrectiveYield(this.store, resultTask, {
+                actor,
+                writerToken,
+                reason: `Yield after downstream proof invalidated predecessor completion authority: ${reason}`,
+                eventId: `HOF-${sha256Hex([
+                    'downstream-proof-recovery-v1',
+                    task.id,
+                    String(task.revision),
+                    invalidation.event.eventHash,
+                    actor.trim(),
+                ].join('\0'))}`,
+            }, now)
+            : null;
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'downstream-proof-predecessor-recovery',
+            now,
+            targets: [
+                {
+                    path: relative(path.join(taskRoot, downstreamProofInvalidationSidecar())),
+                    content: invalidation.postimage,
+                },
+                ...(preparedYield
+                    ? [{ path: relative(path.join(taskRoot, 'handoffs.jsonl')), content: preparedYield.postimage.toString('utf8') }]
+                    : []),
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+                { path: relative(path.join(this.store.lockRoot(task.projectId), `${task.id}.json`)), content: null },
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const events = readDownstreamProofInvalidations(this.store, saved);
+                const readbackDirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+                if (saved.revision !== resultTask.revision
+                    || saved.status !== 'needs_fix'
+                    || events.at(-1)?.eventHash !== invalidation.event.eventHash
+                    || headCommit(context.identity.repositoryRoot) !== assessment.preservedHeadCommit
+                    || JSON.stringify(readbackDirtyFiles) !== JSON.stringify(assessment.dirtyFiles)
+                    || context.locks.inspect(task.id) !== null
+                    || (preparedYield && readTaskC1Posture(this.store, saved).state !== 'none')) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Downstream proof recovery transaction readback failed.', {
+                        taskId,
+                    });
+                }
+                validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return {
+            task: this.store.readTask(task.projectId, task.id),
+            invalidation: invalidation.event,
+        };
+    }
+    recoverDownstreamProofReplan(repository, taskId, expectedTaskRevision, actor, reason) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedTaskRevision);
+        // This repair intentionally runs before Project Knowledge refresh: the exact
+        // dependency-only transport can make the current map stale, while the
+        // recovery assessment still binds the stranded Task to its recorded rebind.
+        const observation = this.observationSnapshot(repository).observation;
+        if (observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan recovery requires a coherent observation boundary.', {
+                observation,
+            });
+        }
+        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
+        const assessment = assessDownstreamProofReplanRecovery(this.store, context.identity.repositoryRoot, task, { currentPlanRiskAuditExists });
+        const environmentBlockers = [
+            ...(!assessment.dependencyRecoveryCommit
+                ? ['The exact beta.12.7 dependency compatibility must be registered before Task recovery.']
+                : []),
+            ...(observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+            ...(observation.pendingProjectTransactions.length > 0
+                || observation.pendingMilestoneTransactions.length > 0
+                || observation.pendingTaskTransactions.length > 0
+                ? ['No pending Workflow transaction may exist.'] : []),
+            ...(observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+            ...(observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+        ];
+        if (!assessment.applicable || !assessment.eligible || environmentBlockers.length > 0) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task is not eligible for bounded downstream-proof replan recovery.', {
+                taskId,
+                blockers: [...assessment.blockers, ...environmentBlockers],
+            });
+        }
+        const now = this.now();
+        const resultTask = {
+            ...task,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            status: 'needs_fix',
+            authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
+                ? { ...authorization, decision: 'superseded' }
+                : authorization),
+            review: emptyReview(),
+            resultHash: null,
+            evidenceHash: null,
+            blockReason: `${assessment.invalidation.activeStepId} downstream-proof recovery requires replacement of the full unfinished Step Plan before execution can resume.`,
+        };
+        const recovery = prepareDownstreamProofReplanRecovery(this.store, resultTask, assessment, { previousTaskRevision: task.revision, actor, reason }, now);
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'downstream-proof-replan-recovery',
+            now,
+            targets: [
+                {
+                    path: relative(path.join(taskRoot, downstreamProofReplanRecoverySidecar())),
+                    content: recovery.postimage,
+                },
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const events = readDownstreamProofReplanRecoveries(this.store, saved);
+                if (saved.revision !== resultTask.revision
+                    || saved.status !== 'needs_fix'
+                    || saved.planHash !== task.planHash
+                    || events.at(-1)?.eventHash !== recovery.event.eventHash
+                    || headCommit(context.identity.repositoryRoot) !== recovery.event.preservedHeadCommit
+                    || JSON.stringify(changedFiles(context.identity.repositoryRoot).sort())
+                        !== JSON.stringify(recovery.event.dirtyFiles)) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Downstream-proof replan recovery transaction readback failed.', {
+                        taskId,
+                    });
+                }
+                validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return {
+            task: this.store.readTask(task.projectId, task.id),
+            recovery: recovery.event,
+        };
+    }
     correctiveReplanController(repository) {
         const identity = resolveRepositoryIdentity(repository);
         return createCorrectiveReplanPublicController({
@@ -403,6 +601,316 @@ export class WorkflowService {
         const savedDiscovery = this.store.writeDiscovery({ ...discovery, status: 'materialized', materializedEntityId: taskId }, expectedRevision);
         return { discovery: savedDiscovery, task: savedTask, taskRoot };
     }
+    materializeAuditedRemediationTask(repository, milestoneId, expectedMilestoneRevision, blockedTaskId, expectedBlockedTaskRevision, input) {
+        const { identity, locks } = this.#mutationContext(repository);
+        const observation = this.observationSnapshot(repository).observation;
+        if (observation.kind !== 'assessment'
+            || observation.leases.length > 0
+            || observation.coreTaskOperations.length > 0
+            || observation.pendingProjectTransactions.length > 0
+            || observation.pendingMilestoneTransactions.length > 0
+            || observation.pendingTaskTransactions.length > 0
+            || observation.corruptTaskTransactions.length > 0) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation materialization requires a coherent, idle observation boundary.', { observation });
+        }
+        if (!isClean(identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Audited remediation materialization requires a clean Milestone base checkout.', { changedFiles: changedFiles(identity.repositoryRoot) });
+        }
+        const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
+        assertExpectedRevision(milestone, expectedMilestoneRevision);
+        if (milestone.status !== 'active' || currentBranch(identity.repositoryRoot) !== milestone.baseBranch) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation materialization requires the active Milestone base branch.', {
+                milestoneStatus: milestone.status,
+                expectedBranch: milestone.baseBranch,
+                actualBranch: currentBranch(identity.repositoryRoot),
+            });
+        }
+        this.assertMilestoneAuthorizationFresh(milestone);
+        const blockedTask = this.store.readTask(identity.projectId, blockedTaskId);
+        assertExpectedRevision(blockedTask, expectedBlockedTaskRevision);
+        if (blockedTask.milestoneId !== milestone.id
+            || blockedTask.status !== 'awaiting_execution_authorization'
+            || !blockedTask.planHash
+            || blockedTask.workspaceOwner !== null
+            || blockedTask.steps.some((step) => step.status !== 'planned')) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation is available only for an unstarted Milestone Task with a rejected current Plan.', {
+                taskId: blockedTask.id,
+                taskStatus: blockedTask.status,
+                milestoneId: blockedTask.milestoneId,
+                workspaceOwner: blockedTask.workspaceOwner,
+            });
+        }
+        const blockedMembership = milestone.memberships.find((membership) => membership.taskId === blockedTask.id);
+        if (blockedMembership?.disposition !== 'required') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The blocked Task must remain a required Milestone member.', { taskId: blockedTask.id, disposition: blockedMembership?.disposition ?? null });
+        }
+        const audit = readPlanRiskAuditEvents(this.store, blockedTask).at(-1);
+        if (!audit
+            || audit.decision !== 'stop-escalate'
+            || audit.taskRevision !== blockedTask.revision
+            || audit.briefHash !== blockedTask.briefHash
+            || audit.planHash !== blockedTask.planHash) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation requires the current stop-escalate Plan Risk Audit.', {
+                taskId: blockedTask.id,
+                currentTaskRevision: blockedTask.revision,
+                currentBriefHash: blockedTask.briefHash,
+                currentPlanHash: blockedTask.planHash,
+                latestAudit: audit ?? null,
+            });
+        }
+        const duplicate = readMilestoneScopeChangeEvents(this.store, identity.projectId, milestone.id)
+            .find((event) => event.authorizationMode === 'audited-remediation'
+            && event.remediationEvidence?.planRiskAuditEventHash === audit.eventHash);
+        if (duplicate) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'This blocking Plan Risk Audit already has a materialized remediation Task.', {
+                planRiskAuditEventId: audit.eventId,
+                remediationTaskId: duplicate.remediationEvidence?.remediationTaskId ?? null,
+            });
+        }
+        const discovery = this.store.readDiscovery(identity.projectId, input.discoveryId);
+        assertExpectedRevision(discovery, input.expectedDiscoveryRevision);
+        const readiness = assessDiscovery(discovery);
+        if (!readiness.ready || discovery.status !== 'ready_to_materialize') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation Discovery is not ready to materialize.', {
+                discoveryId: discovery.id,
+                missing: readiness.missing,
+            });
+        }
+        const title = input.title.trim();
+        if (!title)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Remediation Task title is required.');
+        const predecessorTaskIds = [...new Set(input.predecessorTaskIds.map((taskId) => taskId.trim()))].sort();
+        if (predecessorTaskIds.length === 0 || predecessorTaskIds.some((taskId) => !taskId)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Audited remediation requires at least one explicit merged predecessor Task.');
+        }
+        const requiredPredecessorTaskIds = [...(blockedMembership.dependsOnTaskIds ?? [])].sort();
+        if (canonicalJsonStringify(predecessorTaskIds) !== canonicalJsonStringify(requiredPredecessorTaskIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation must inherit the blocked Task exact direct predecessor frontier.', {
+                blockedTaskId: blockedTask.id,
+                requiredPredecessorTaskIds,
+                actualPredecessorTaskIds: predecessorTaskIds,
+            });
+        }
+        const membershipsByTaskId = new Map(milestone.memberships.map((membership) => [membership.taskId, membership]));
+        const ancestorTaskIds = new Set();
+        const visitAncestors = (taskId) => {
+            const membership = membershipsByTaskId.get(taskId);
+            for (const dependencyId of membership?.dependsOnTaskIds ?? []) {
+                if (ancestorTaskIds.has(dependencyId))
+                    continue;
+                ancestorTaskIds.add(dependencyId);
+                visitAncestors(dependencyId);
+            }
+        };
+        visitAncestors(blockedTask.id);
+        for (const predecessorTaskId of predecessorTaskIds) {
+            const predecessorMembership = membershipsByTaskId.get(predecessorTaskId);
+            const predecessor = this.store.readTask(identity.projectId, predecessorTaskId);
+            if (!ancestorTaskIds.has(predecessorTaskId)
+                || predecessorMembership?.disposition !== 'required'
+                || predecessor.status !== 'merged') {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Every remediation predecessor must be a merged required ancestor of the blocked Task.', {
+                    predecessorTaskId,
+                    isAncestor: ancestorTaskIds.has(predecessorTaskId),
+                    disposition: predecessorMembership?.disposition ?? null,
+                    status: predecessor.status,
+                });
+            }
+        }
+        const now = this.now();
+        const timestamp = now.toISOString();
+        const remediationTaskId = createEntityId('TASK', now.getTime());
+        const briefContent = renderBrief(discovery, title);
+        const normalizedBriefContent = briefContent.endsWith('\n') ? briefContent : `${briefContent}\n`;
+        const briefHash = sha256Hex(normalizedBriefContent);
+        const remediationTask = {
+            schemaVersion: STATE_SCHEMA_VERSION,
+            revision: 1,
+            id: remediationTaskId,
+            projectId: identity.projectId,
+            createdAt: timestamp,
+            updatedAt: timestamp,
+            kind: 'task',
+            status: 'planning',
+            title,
+            slug: slugify(title),
+            discoveryId: discovery.id,
+            milestoneId: milestone.id,
+            repositoryRoot: identity.repositoryRoot,
+            baseBranch: milestone.baseBranch,
+            baseCommit: null,
+            taskBranch: null,
+            workspaceOwner: null,
+            briefHash,
+            planHash: null,
+            planObjective: null,
+            resultHash: null,
+            evidenceHash: null,
+            requirements: discovery.acceptance.map((_, index) => `REQ-${String(index + 1).padStart(3, '0')}`),
+            acceptance: discovery.acceptance.map((_, index) => `AC-${String(index + 1).padStart(3, '0')}`),
+            risks: discovery.assumptions,
+            knowledgeImpact: null,
+            knowledgeImpactReason: null,
+            knowledgeTargets: [],
+            knowledgeMapRevision: null,
+            knowledgeMapHash: null,
+            graphUse: null,
+            steps: [],
+            authorizations: [],
+            knowledgeRebinds: [],
+            review: emptyReview(),
+            blockReason: null,
+            mergedCommit: null,
+            systemCommits: [],
+        };
+        const consumedDiscovery = {
+            ...discovery,
+            revision: discovery.revision + 1,
+            updatedAt: timestamp,
+            status: 'materialized',
+            materializedEntityId: remediationTaskId,
+        };
+        const remediationEvidence = {
+            blockedTaskId: blockedTask.id,
+            blockedTaskRevision: blockedTask.revision,
+            blockedBriefHash: blockedTask.briefHash,
+            blockedPlanHash: blockedTask.planHash,
+            planRiskAuditEventId: audit.eventId,
+            planRiskAuditEventHash: audit.eventHash,
+            remediationTaskId,
+            predecessorTaskIds,
+        };
+        const reason = `Audited remediation for ${blockedTask.id} after stop-escalate ${audit.eventId}.`;
+        const plan = {
+            outcome: milestone.outcome,
+            successSignal: milestone.successSignal,
+            acceptance: [...milestone.acceptance],
+            checks: [...milestone.checks],
+            memberships: [
+                ...milestone.memberships.map((membership) => membership.taskId === blockedTask.id
+                    ? {
+                        ...membership,
+                        dependsOnTaskIds: [...new Set([...(membership.dependsOnTaskIds ?? []), remediationTaskId])],
+                    }
+                    : { ...membership, dependsOnTaskIds: [...(membership.dependsOnTaskIds ?? [])] }),
+                {
+                    taskId: remediationTaskId,
+                    disposition: 'required',
+                    reason,
+                    dependsOnTaskIds: predecessorTaskIds,
+                },
+            ],
+        };
+        const readCandidateTask = (taskId) => taskId === remediationTaskId
+            ? remediationTask
+            : this.store.readTask(identity.projectId, taskId);
+        const actor = `agent:milestone-remediation:${milestone.id}`;
+        const preparedCandidate = prepareMilestoneScopeChangeCandidate({
+            milestone,
+            plan,
+            readTask: readCandidateTask,
+            actor,
+            auditedRemediationEvidence: remediationEvidence,
+        });
+        const sourceAuthorization = [...milestone.authorizations]
+            .reverse()
+            .find((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved');
+        if (!sourceAuthorization) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation has no current Milestone execution authority.');
+        }
+        const derivedAuthorization = {
+            kind: 'execution',
+            decision: 'approved',
+            actor,
+            recordedAt: timestamp,
+            briefHash: null,
+            planHash: preparedCandidate.candidatePlanHash,
+            resultHash: null,
+            evidenceHash: sha256Hex(canonicalJsonStringify({
+                sourcePlanHash: sourceAuthorization.planHash,
+                sourceAuthorizationMode: sourceAuthorization.authorizationMode ?? 'human',
+                planRiskAuditEventHash: audit.eventHash,
+                remediationEvidence,
+            })),
+            headCommit: headCommit(identity.repositoryRoot),
+            reason: 'Derived from the current Milestone execution authority and exact blocking Plan Risk Audit.',
+            authorizationMode: 'corrective-derived',
+        };
+        const prepared = {
+            ...preparedCandidate,
+            authorizations: [...preparedCandidate.authorizations, derivedAuthorization],
+        };
+        const bundle = prepareMilestoneScopeChangeBundle({
+            store: this.store,
+            milestone,
+            prepared,
+            now,
+            readTask: readCandidateTask,
+        });
+        const projectRoot = this.store.projectRoot(identity.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        applyProjectTransaction({
+            projectRoot,
+            projectId: identity.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'audited-remediation-materialization',
+            now,
+            targets: [
+                {
+                    path: relative(path.join(this.store.discoveryRoot(identity.projectId, discovery.id), 'state.json')),
+                    content: `${JSON.stringify(consumedDiscovery, null, 2)}\n`,
+                },
+                {
+                    path: relative(path.join(this.store.taskRoot(identity.projectId, remediationTaskId), 'brief.md')),
+                    content: normalizedBriefContent,
+                },
+                {
+                    path: relative(path.join(this.store.taskRoot(identity.projectId, remediationTaskId), 'state.json')),
+                    content: `${JSON.stringify(remediationTask, null, 2)}\n`,
+                },
+                {
+                    path: relative(path.join(this.store.milestoneRoot(identity.projectId, milestone.id), 'plan.json')),
+                    content: bundle.planContent,
+                },
+                {
+                    path: relative(path.join(this.store.milestoneRoot(identity.projectId, milestone.id), 'scope-change-events.jsonl')),
+                    content: bundle.sidecarContent,
+                },
+                {
+                    path: relative(path.join(this.store.milestoneRoot(identity.projectId, milestone.id), 'state.json')),
+                    content: bundle.stateContent,
+                },
+            ],
+            validate: () => {
+                const savedDiscovery = this.store.readDiscovery(identity.projectId, discovery.id);
+                const savedRemediationTask = this.store.readTask(identity.projectId, remediationTaskId);
+                const savedMilestone = this.readMilestoneCurrent(identity.projectId, milestone.id);
+                const savedBlockedMembership = savedMilestone.memberships
+                    .find((membership) => membership.taskId === blockedTask.id);
+                const savedRemediationMembership = savedMilestone.memberships
+                    .find((membership) => membership.taskId === remediationTaskId);
+                const savedAuthorization = [...savedMilestone.authorizations]
+                    .reverse()
+                    .find((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved');
+                if (savedDiscovery.materializedEntityId !== remediationTaskId
+                    || savedRemediationTask.milestoneId !== milestone.id
+                    || !savedBlockedMembership?.dependsOnTaskIds?.includes(remediationTaskId)
+                    || savedRemediationMembership?.disposition !== 'required'
+                    || savedAuthorization?.authorizationMode !== 'corrective-derived'
+                    || savedMilestone.status !== 'active'
+                    || locks.inspect(blockedTask.id) !== null) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Audited remediation transaction readback failed.');
+                }
+            },
+        });
+        return {
+            discovery: this.store.readDiscovery(identity.projectId, discovery.id),
+            remediationTask: this.store.readTask(identity.projectId, remediationTaskId),
+            blockedTask: this.store.readTask(identity.projectId, blockedTask.id),
+            milestone: this.readMilestoneCurrent(identity.projectId, milestone.id),
+            remediationEvidence,
+        };
+    }
     replaceSplitRequiredTask(repository, oldTaskId, expectedOldTaskRevision, discoveryId, expectedDiscoveryRevision, expectedMilestoneRevision, title, actor) {
         const { identity, locks } = this.#mutationContext(repository);
         const oldTask = this.store.readTask(identity.projectId, oldTaskId);
@@ -1066,7 +1574,10 @@ export class WorkflowService {
         const overriddenStopDecisionEventIds = stopEscalateOverrideDecisionEventIds(this.store, task);
         const currentHardBlockingDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'split-required'
             || (event.decision === 'stop-escalate' && !overriddenStopDecisionEventIds.has(event.eventId)));
-        const currentPlanRiskAudit = task.status === 'needs_fix' || currentReplanDecisions.length > 0
+        const downstreamReplanRecovered = readDownstreamProofReplanRecoveries(this.store, task)
+            .some((event) => event.resultTaskRevision === task.revision && event.reboundPlanHash === task.planHash);
+        const currentPlanRiskAudit = (task.status === 'needs_fix' || currentReplanDecisions.length > 0)
+            && !downstreamReplanRecovered
             ? readCurrentPlanRiskAudit(this.store, task)
             : null;
         const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
@@ -1199,6 +1710,10 @@ export class WorkflowService {
             status: dependenciesComplete(step, completedIds) ? 'planned' : 'blocked',
             evidence: null,
         }));
+        const invalidatedStepCommits = [...new Set([
+                ...(task.invalidatedStepCommits ?? []),
+                ...omittedStepEvidenceCommits(task, plannedSteps),
+            ])];
         if (task.status === 'needs_fix' &&
             task.review.status === 'failed' &&
             plannedSteps.every((step) => step.status === 'completed')) {
@@ -1237,6 +1752,7 @@ export class WorkflowService {
             knowledgeMapHash: plan.knowledgeMapHash,
             graphUse: plan.graphUse,
             steps: plannedSteps,
+            invalidatedStepCommits,
             authorizations,
             review: emptyReview(),
             resultHash: null,
@@ -1472,7 +1988,12 @@ export class WorkflowService {
                 requiredAction: 'task plan-set',
             });
         }
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
+        const correctiveAuthority = delegationGrantId === null
+            ? this.currentCorrectiveDerivedTaskAuthority(identity.projectId, task, actor)
+            : null;
+        const delegation = correctiveAuthority
+            ? null
+            : this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
         const event = {
             kind: 'execution',
             decision: 'approved',
@@ -1484,7 +2005,11 @@ export class WorkflowService {
             evidenceHash: hashMechanicalFeasibilityEvidence(mechanicalFeasibility),
             headCommit: mechanicalFeasibility.evaluatedHead,
             reason,
-            authorizationMode: delegation ? 'delegated' : 'human',
+            authorizationMode: correctiveAuthority
+                ? 'corrective-derived'
+                : delegation
+                    ? 'delegated'
+                    : 'human',
             ...(delegation ? { delegation } : {}),
             mechanicalFeasibility,
         };
@@ -1827,14 +2352,26 @@ export class WorkflowService {
             const recovery = staleDecision?.decision === 'continue-fix'
                 ? requireCorrectiveDecisionRecoveryForRun(this.store, task, stepId, actor, writerToken)
                 : null;
-            const gate = assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            const stopOverrideContextRebind = staleDecision?.decision === 'stop-escalate'
+                ? readValidatedStopOverrideContextRebindIfApplicable(this.store, task, stepId, context.identity.repositoryRoot)
+                : null;
+            const gate = assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null, stopOverrideContextRebind?.stopDecision.eventId ?? null);
             resumesCorrectiveReplan = gate.posture === 'replan-ready';
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        if (step.status === 'planned' && dirty.length > 0 && !resumesCorrectiveReplan) {
+        const downstreamProofCarryover = step.status === 'planned' && dirty.length > 0
+            ? assessDownstreamProofCarryover(this.store, context.identity.repositoryRoot, task, stepId)
+            : null;
+        if (step.status === 'planned'
+            && dirty.length > 0
+            && !resumesCorrectiveReplan
+            && !downstreamProofCarryover?.eligible) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
+                ...(downstreamProofCarryover?.applicable
+                    ? { downstreamProofCarryoverBlockers: downstreamProofCarryover.blockers }
+                    : {}),
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
@@ -2065,7 +2602,7 @@ export class WorkflowService {
                     checksHash: sha256Hex(canonicalJsonStringify(checks)),
                     reviewEventHash: null,
                     reviewerAttestationHash: null,
-                }, planRiskAudit, this.now());
+                }, planRiskAudit, this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
             }
             const steps = task.steps.map((candidate) => candidate.id === stepId ? { ...candidate, status: 'failed' } : candidate);
             return this.store.writeTask({ ...task, status: 'needs_fix', steps, blockReason: `${stepId} checks failed.` }, expectedRevision);
@@ -2185,7 +2722,7 @@ export class WorkflowService {
                     checksHash: currentCycle.reviewRecordedEvent.checksHash,
                     reviewEventHash: currentCycle.reviewRecordedEvent.eventHash,
                     reviewerAttestationHash: currentCycle.reviewerAttestationEvent.eventHash,
-                }, planRiskAudit, this.now());
+                }, planRiskAudit, this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
             }
             return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, currentCycle.resolution), expectedRevision);
         }
@@ -2213,7 +2750,7 @@ export class WorkflowService {
                 checksHash: reviewRecordedEvent.checksHash,
                 reviewEventHash: reviewRecordedEvent.eventHash,
                 reviewerAttestationHash: reviewerAttestationEvent.eventHash,
-            }, planRiskAudit, this.now());
+            }, planRiskAudit, this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
         }
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
@@ -2285,7 +2822,7 @@ export class WorkflowService {
                 checksHash: recorded.reviewRecordedEvent.checksHash,
                 reviewEventHash: recorded.reviewRecordedEvent.eventHash,
                 reviewerAttestationHash: recorded.reviewerAttestationEvent.eventHash,
-            }, readCurrentPlanRiskAudit(this.store, task), this.now());
+            }, readCurrentPlanRiskAudit(this.store, task), this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
         }
         const saved = this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, review.summary), expectedRevision);
         return {
@@ -2521,16 +3058,23 @@ export class WorkflowService {
         assertCorrectiveAuditorIndependence(this.store, task, stepId, correctiveAudit.auditor);
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
-    setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.#mutationContext(repository);
+    setTaskResult(repository, taskId, expectedRevision, summary, limitations, writerToken, actor) {
+        const context = this.#mutationContext(repository);
+        const { identity } = context;
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Result requires a passing independent review.');
         }
         this.assertReviewFresh(identity.repositoryRoot, task);
+        const lease = context.locks.heartbeat(taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor ?? null, lease.token);
         const root = this.store.taskRoot(task.projectId, task.id);
         const stagedResult = this.store.stageArtifact(root, 'result.md', renderResult(task, summary, limitations));
+        // Human final acceptance is an intentionally unbounded pause. Release the
+        // execution lease before entering that gate so elapsed human time cannot
+        // turn a successful Task into a repository-wide stale-lock repair route.
+        context.locks.release(taskId, lease.token);
         const saved = this.store.writeTask({ ...task, status: 'awaiting_final_acceptance', resultHash: stagedResult.hash, blockReason: null }, expectedRevision);
         this.store.publishArtifact(stagedResult);
         return saved;
@@ -2550,7 +3094,12 @@ export class WorkflowService {
         this.assertReviewFresh(identity.repositoryRoot, task);
         const resultHash = this.store.hashArtifact(root, 'result.md');
         const evidenceHash = this.store.hashArtifact(root, 'evidence.json');
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.final_accept', actor, task);
+        const correctiveAuthority = delegationGrantId === null
+            ? this.currentCorrectiveDerivedTaskAuthority(identity.projectId, task, actor)
+            : null;
+        const delegation = correctiveAuthority
+            ? null
+            : this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.final_accept', actor, task);
         const event = {
             kind: 'final_acceptance',
             decision: 'approved',
@@ -2562,7 +3111,11 @@ export class WorkflowService {
             evidenceHash,
             headCommit: headCommit(identity.repositoryRoot),
             reason: '',
-            authorizationMode: delegation ? 'delegated' : 'human',
+            authorizationMode: correctiveAuthority
+                ? 'corrective-derived'
+                : delegation
+                    ? 'delegated'
+                    : 'human',
             ...(delegation ? { delegation } : {}),
         };
         return this.store.writeTask({
@@ -2793,7 +3346,288 @@ export class WorkflowService {
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
         return this.inspectDependencyProvenanceCandidate(snapshot, task);
     }
+    historicalStepProvenanceRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Historical Step provenance recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        return this.inspectHistoricalStepProvenanceCandidate(snapshot, task);
+    }
+    historicalStepDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Historical Step dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        let candidateParent = null;
+        try {
+            candidateParent = runGit(snapshot.identity.repositoryRoot, ['rev-parse', 'HEAD^']);
+        }
+        catch {
+            candidateParent = null;
+        }
+        const assessment = candidateParent
+            ? this.inspectHistoricalStepProvenanceCandidate(snapshot, task, {
+                historyBoundary: 'HEAD^',
+                preservedHeadCommit: candidateParent,
+            })
+            : null;
+        if (!assessment?.eligible
+            || !assessment.activeStepId
+            || !assessment.commitSha
+            || !task.planHash) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                historicalStepProvenance: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...(assessment?.blockers ?? []),
+                        'The dependency candidate parent must contain exactly one accepted and strictly reviewed historical Step commit omitted by the current corrective Plan.',
+                    ])],
+            };
+        }
+        let dirtyWorktreeHash;
+        try {
+            dirtyWorktreeHash = hashDirtyWorktree(snapshot.identity.repositoryRoot, assessment.dirtyFiles);
+        }
+        catch (error) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                historicalStepProvenance: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        error instanceof Error ? error.message : String(error),
+                    ])],
+            };
+        }
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, {
+            activeStepId: assessment.activeStepId,
+            planHash: task.planHash,
+            dirtyFiles: assessment.dirtyFiles,
+            dirtyWorktreeHash,
+            retainedCommitSha: assessment.commitSha,
+        });
+    }
+    recoverHistoricalStepProvenance(repository, taskId, expectedRevision, commitSha, actor, reason) {
+        const normalizedActor = actor.trim();
+        const normalizedReason = reason.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Historical Step provenance recovery requires an actor.');
+        if (!normalizedReason)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Historical Step provenance recovery requires a reason.');
+        const context = this.#mutationContext(repository);
+        const current = context.store.readTask(context.identity.projectId, taskId);
+        const prior = current.historicalStepProvenanceRecoveries?.find((record) => record.commitSha === commitSha);
+        if (prior && (current.invalidatedStepCommits ?? []).includes(commitSha)) {
+            validateTaskHistory(context.identity.repositoryRoot, current);
+            return current;
+        }
+        assertExpectedRevision(current, expectedRevision);
+        const preflight = this.historicalStepProvenanceRecoveryPreflight(repository, taskId);
+        if (!preflight.eligible || preflight.commitSha !== commitSha || !preflight.sourceFinalAcceptanceRecordedAt) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded historical Step provenance recovery preflight failed.', {
+                taskId,
+                requestedCommit: commitSha,
+                candidateCommit: preflight.commitSha,
+                blockers: preflight.blockers,
+            });
+        }
+        const sourceAcceptance = current.authorizations.find((authorization) => authorization.kind === 'final_acceptance'
+            && ['approved', 'superseded'].includes(authorization.decision)
+            && authorization.headCommit === commitSha
+            && authorization.recordedAt === preflight.sourceFinalAcceptanceRecordedAt
+            && authorization.planHash
+            && authorization.resultHash
+            && authorization.evidenceHash);
+        if (!sourceAcceptance?.planHash || !sourceAcceptance.resultHash || !sourceAcceptance.evidenceHash) {
+            throw new WorkflowError('STATE_CONFLICT', 'The source final acceptance changed after historical provenance preflight.');
+        }
+        const saved = context.store.writeTask({
+            ...current,
+            invalidatedStepCommits: [...new Set([...(current.invalidatedStepCommits ?? []), commitSha])],
+            historicalStepProvenanceRecoveries: [
+                ...(current.historicalStepProvenanceRecoveries ?? []),
+                {
+                    commitSha,
+                    actor: normalizedActor,
+                    reason: normalizedReason,
+                    recordedAt: this.now().toISOString(),
+                    sourceFinalAcceptanceRecordedAt: sourceAcceptance.recordedAt,
+                    sourcePlanHash: sourceAcceptance.planHash,
+                    sourceResultHash: sourceAcceptance.resultHash,
+                    sourceEvidenceHash: sourceAcceptance.evidenceHash,
+                },
+            ],
+        }, expectedRevision);
+        validateTaskHistory(context.identity.repositoryRoot, saved);
+        return saved;
+    }
+    activeDownstreamProofDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Active downstream-proof dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const assessment = assessDownstreamProofRecovery(this.store, snapshot.identity.repositoryRoot, task, { historyBoundary: 'HEAD^', preservedHeadCommit: headCommit(snapshot.identity.repositoryRoot) });
+        if (!assessment.applicable
+            || !assessment.eligible
+            || !assessment.activeStepId
+            || !assessment.dirtyWorktreeHash
+            || !task.planHash) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                activeDownstreamProof: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...assessment.blockers,
+                        'The Task must have one eligible active downstream-proof predecessor invalidation at the candidate parent boundary.',
+                    ])],
+            };
+        }
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, {
+            activeStepId: assessment.activeStepId,
+            planHash: task.planHash,
+            dirtyFiles: assessment.dirtyFiles,
+            dirtyWorktreeHash: assessment.dirtyWorktreeHash,
+            invalidatedStepIds: assessment.invalidatedSteps.map((step) => step.stepId),
+        });
+    }
+    downstreamProofReplanUpdatePreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan update preflight requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
+        const assessment = assessDownstreamProofReplanRecovery(this.store, snapshot.identity.repositoryRoot, task, { currentPlanRiskAuditExists });
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const sourceVersion = '2.0.0-beta.12.6';
+        const versionSurfaces = {
+            declared: versions.declared,
+            locked: versions.locked,
+            installed: versions.installed,
+            currentBranch: versions.currentBranch,
+            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+        };
+        const blockers = [
+            ...assessment.blockers,
+            ...(String(PACKAGE_VERSION) === sourceVersion ? ['Recovery runner must be newer than the beta.12.6 source package.'] : []),
+            ...Object.entries(versionSurfaces)
+                .filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the stranded source ${sourceVersion}.`),
+            ...(snapshot.observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+            ...(snapshot.observation.pendingProjectTransactions.length > 0
+                || snapshot.observation.pendingMilestoneTransactions.length > 0
+                || snapshot.observation.pendingTaskTransactions.length > 0
+                ? ['No pending Workflow transaction may exist.'] : []),
+            ...(snapshot.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+            ...(snapshot.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+        ];
+        return {
+            readOnly: true,
+            eligible: assessment.applicable && assessment.eligible && blockers.length === 0,
+            action: assessment.applicable && assessment.eligible && blockers.length === 0
+                ? 'update downstream-proof-replan-transport'
+                : null,
+            projectId: task.projectId,
+            taskId: task.id,
+            taskRevision: task.revision,
+            sourceVersion,
+            targetVersion: PACKAGE_VERSION,
+            sourceHeadCommit: assessment.invalidation?.preservedHeadCommit ?? null,
+            taskBranch: task.taskBranch,
+            baseBranch: task.baseBranch,
+            dirtyFiles: assessment.compatibility?.dirtyFiles ?? [],
+            dirtyWorktreeHash: assessment.compatibility?.dirtyWorktreeHash ?? null,
+            requiredTransport: [
+                'Commit only package.json and package-lock.json on the active Milestone base.',
+                'Commit only the same dependency files on the Task branch while preserving all product bytes.',
+                'Install the exact target package, then follow fresh next to dependency registration.',
+            ],
+            blockers,
+        };
+    }
+    downstreamProofReplanDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        let candidateParent = null;
+        try {
+            candidateParent = runGit(snapshot.identity.repositoryRoot, ['rev-parse', 'HEAD^']);
+        }
+        catch {
+            candidateParent = null;
+        }
+        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
+        const assessment = candidateParent
+            ? assessDownstreamProofReplanRecovery(this.store, snapshot.identity.repositoryRoot, task, {
+                historyBoundary: 'HEAD^',
+                preservedHeadCommit: candidateParent,
+                currentPlanRiskAuditExists,
+            })
+            : null;
+        if (!assessment?.applicable || !assessment.eligible || !assessment.compatibility) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                activeDownstreamProof: null,
+                downstreamProofReplan: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...(assessment?.blockers ?? []),
+                        'The Task must preserve the exact beta.12.6 downstream-proof invalidation and accidental knowledge-rebind boundary.',
+                    ])],
+            };
+        }
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, assessment.compatibility);
+    }
     recoverDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, false);
+    }
+    recoverActiveDownstreamProofDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, true);
+    }
+    recoverDownstreamProofReplanDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'downstream-replan');
+    }
+    recoverHistoricalStepDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'historical-step');
+    }
+    recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, recoveryMode) {
         const normalizedActor = actor.trim();
         const normalizedReason = reason.trim();
         if (!normalizedActor)
@@ -2803,7 +3637,13 @@ export class WorkflowService {
         const context = this.#mutationContext(repository);
         const current = context.store.readTask(context.identity.projectId, taskId);
         const currentHead = headCommit(context.identity.repositoryRoot);
-        const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead && record.packageVersion === PACKAGE_VERSION);
+        const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead
+            && record.packageVersion === PACKAGE_VERSION
+            && (recoveryMode === 'downstream-replan'
+                ? Boolean(record.downstreamProofReplan)
+                : recoveryMode === 'historical-step'
+                    ? Boolean(record.historicalStepProvenance)
+                    : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -2811,7 +3651,13 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task);
+        const preflight = recoveryMode === 'downstream-replan'
+            ? this.downstreamProofReplanDependencyRecoveryPreflight(repository, taskId)
+            : recoveryMode === 'historical-step'
+                ? this.historicalStepDependencyRecoveryPreflight(repository, taskId)
+                : recoveryMode
+                    ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
+                    : this.inspectDependencyProvenanceCandidate(snapshot, task);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
@@ -2833,6 +3679,15 @@ export class WorkflowService {
                     reason: normalizedReason,
                     recordedAt: this.now().toISOString(),
                     retainedHistoricalCommits: preflight.retainedHistoricalCommits,
+                    ...(preflight.activeDownstreamProof
+                        ? { activeDownstreamProof: preflight.activeDownstreamProof }
+                        : {}),
+                    ...(preflight.downstreamProofReplan
+                        ? { downstreamProofReplan: preflight.downstreamProofReplan }
+                        : {}),
+                    ...(preflight.historicalStepProvenance
+                        ? { historicalStepProvenance: preflight.historicalStepProvenance }
+                        : {}),
                 },
             ],
         }, expectedRevision);
@@ -3232,9 +4087,53 @@ export class WorkflowService {
                 ...(dependency ? { dependency } : {}),
             });
         }
+        const prioritizedRemediationTask = status.milestones.flatMap((milestone) => {
+            if (milestone.status !== 'active')
+                return [];
+            const event = [...readMilestoneScopeChangeEvents(this.store, status.projectId, milestone.id)]
+                .reverse()
+                .find((candidate) => candidate.authorizationMode === 'audited-remediation'
+                && candidate.candidatePlanHash === milestone.planHash
+                && candidate.remediationEvidence?.remediationTaskId);
+            if (!event?.remediationEvidence)
+                return [];
+            const task = tasksById.get(event.remediationEvidence.remediationTaskId);
+            return task
+                && taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
+                ? [task]
+                : [];
+        }).at(0) ?? null;
         const activeTask = requestedTask
+            ?? prioritizedRemediationTask
             ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
+            const historicalStepProvenanceRecovery = this.historicalStepProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (historicalStepProvenanceRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'task historical-step-provenance-recover',
+                    revision: activeTask.revision,
+                    historicalStepProvenanceRecovery,
+                });
+            }
+            const historicalStepDependencyRecovery = this.historicalStepDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (historicalStepDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update historical-step-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: historicalStepDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'The active Milestone base and Task branch contain only the exact target dependency commits; the candidate parent still binds the reviewed historical Step commit.',
+                        continuation: 'Register the dependency commit and historical provenance atomically, then follow fresh next.',
+                    },
+                });
+            }
             const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (dependencyRecovery.eligible) {
                 return withAdoption({
@@ -3246,6 +4145,38 @@ export class WorkflowService {
                     dependencyProvenanceRecovery: dependencyRecovery,
                 });
             }
+            const activeDownstreamProofDependencyRecovery = this.activeDownstreamProofDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (activeDownstreamProofDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update downstream-proof-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: activeDownstreamProofDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'The active Milestone base and Task branch already contain only the exact dependency update commits.',
+                        continuation: 'Run task downstream-proof-recover after this provenance registration.',
+                    },
+                });
+            }
+            const downstreamProofReplanDependencyRecovery = this.downstreamProofReplanDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (downstreamProofReplanDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update downstream-proof-replan-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: downstreamProofReplanDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'A newer package preflight approved the exact beta.12.6 stranded replan transport before dependency-only commits were created.',
+                        continuation: 'Register this dependency commit, then run task downstream-proof-replan-recover.',
+                    },
+                });
+            }
             const activeTaskMilestone = activeTask.milestoneId
                 ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
@@ -3269,36 +4200,200 @@ export class WorkflowService {
                     },
                 }
                 : value);
+            const currentPlanRiskAuditExists = activeTask.planHash
+                ? readPlanRiskAuditEvents(this.store, activeTask).some((event) => event.taskRevision === activeTask.revision && event.planHash === activeTask.planHash)
+                : false;
+            const downstreamReplanRecovery = assessDownstreamProofReplanRecovery(this.store, repositoryRoot, activeTask, { currentPlanRiskAuditExists });
+            if (downstreamReplanRecovery.applicable) {
+                const environmentBlockers = [
+                    ...(!downstreamReplanRecovery.dependencyRecoveryCommit
+                        ? ['The exact beta.12.7 dependency compatibility must be registered before Task recovery.']
+                        : []),
+                    ...(status.observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+                    ...(status.observation.pendingProjectTransactions.length > 0
+                        || status.observation.pendingMilestoneTransactions.length > 0
+                        || status.observation.pendingTaskTransactions.length > 0
+                        ? ['No pending Workflow transaction may exist.'] : []),
+                    ...(status.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+                    ...(status.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+                ];
+                return withAdoption(withMilestoneCancellation(downstreamReplanRecovery.eligible && environmentBlockers.length === 0
+                    ? {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'task downstream-proof-replan-recover',
+                        revision: activeTask.revision,
+                        downstreamProofReplanRecovery: {
+                            state: 'eligible',
+                            invalidationEventId: downstreamReplanRecovery.invalidation.eventId,
+                            sourcePlanHash: downstreamReplanRecovery.invalidation.planHash,
+                            reboundPlanHash: activeTask.planHash,
+                            dirtyFiles: downstreamReplanRecovery.compatibility.dirtyFiles,
+                            dirtyWorktreeHash: downstreamReplanRecovery.compatibility.dirtyWorktreeHash,
+                            dependencyRecoveryCommit: downstreamReplanRecovery.dependencyRecoveryCommit,
+                            boundedEffect: 'restore-needs-fix-and-return-same-task-to-plan-set',
+                        },
+                    }
+                    : {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'doctor',
+                        blockedAction: 'task downstream-proof-replan-recover',
+                        revision: activeTask.revision,
+                        downstreamProofReplanRecovery: {
+                            state: 'blocked',
+                            blockers: [...downstreamReplanRecovery.blockers, ...environmentBlockers],
+                        },
+                    }));
+            }
             let activePlanRiskAudit = null;
             let planRiskAuditRecovery = null;
-            if (activeTask.planHash) {
+            const requiresReplacementPlan = activeTask.status === 'needs_fix'
+                && !activeTask.steps.some((step) => step.status === 'failed');
+            if (activeTask.planHash && !requiresReplacementPlan) {
                 try {
                     activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
                 }
                 catch (error) {
                     if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
                         throw error;
-                    planRiskAuditRecovery = {
-                        scope: 'task',
-                        id: activeTask.id,
-                        status: activeTask.status,
-                        action: 'task plan-risk-audit',
-                        revision: activeTask.revision,
-                        planRiskAuditRecovery: {
-                            state: 'required',
-                            reason: error.message,
-                            currentBriefHash: activeTask.briefHash,
-                            currentPlanHash: activeTask.planHash,
-                            knowledgeMapRevision: activeTask.knowledgeMapRevision,
-                            knowledgeMapHash: activeTask.knowledgeMapHash,
-                        },
+                    const blockingDecision = error.details.decision;
+                    const blockingAudit = readPlanRiskAuditEvents(this.store, activeTask).at(-1) ?? null;
+                    const existingRemediationEvent = blockingAudit && activeTask.milestoneId
+                        ? [...readMilestoneScopeChangeEvents(this.store, status.projectId, activeTask.milestoneId)]
+                            .reverse()
+                            .find((event) => event.authorizationMode === 'audited-remediation'
+                            && event.remediationEvidence?.planRiskAuditEventHash === blockingAudit.eventHash) ?? null
+                        : null;
+                    const existingRemediationTask = existingRemediationEvent?.remediationEvidence
+                        ? tasksById.get(existingRemediationEvent.remediationEvidence.remediationTaskId) ?? null
+                        : null;
+                    const remediationDiscovery = status.discoveries.find((discovery) => !['materialized', 'abandoned'].includes(discovery.status)) ?? null;
+                    const remediationMilestone = activeTask.milestoneId
+                        ? milestonesById.get(activeTask.milestoneId) ?? null
+                        : null;
+                    const remediationMemberships = remediationMilestone
+                        ? new Map(remediationMilestone.memberships.map((membership) => [membership.taskId, membership]))
+                        : new Map();
+                    const remediationMembership = remediationMemberships.get(activeTask.id) ?? null;
+                    const auditedRemediationEligible = activeTask.status === 'awaiting_execution_authorization'
+                        && remediationMilestone?.status === 'active'
+                        && remediationMembership?.disposition === 'required';
+                    const remediationAncestorIds = new Set();
+                    const visitRemediationAncestors = (candidateTaskId) => {
+                        for (const predecessorTaskId of remediationMemberships.get(candidateTaskId)?.dependsOnTaskIds ?? []) {
+                            if (remediationAncestorIds.has(predecessorTaskId))
+                                continue;
+                            remediationAncestorIds.add(predecessorTaskId);
+                            visitRemediationAncestors(predecessorTaskId);
+                        }
                     };
+                    visitRemediationAncestors(activeTask.id);
+                    const eligibleRemediationPredecessorTaskIds = [...remediationAncestorIds]
+                        .filter((candidateTaskId) => tasksById.get(candidateTaskId)?.status === 'merged')
+                        .sort();
+                    planRiskAuditRecovery = blockingDecision === 'stop-escalate' && auditedRemediationEligible
+                        ? {
+                            scope: 'task',
+                            id: activeTask.id,
+                            status: activeTask.status,
+                            action: existingRemediationTask?.status === 'merged'
+                                ? 'task plan-set'
+                                : existingRemediationTask
+                                    ? 'doctor'
+                                    : remediationDiscovery?.status === 'ready_to_materialize'
+                                        ? 'milestone remediation-materialize'
+                                        : remediationDiscovery
+                                            ? 'discovery update'
+                                            : 'discovery start',
+                            blockedAction: 'task authorize',
+                            revision: activeTask.revision,
+                            planRiskAuditDecision: {
+                                state: 'recorded-blocking',
+                                decision: blockingDecision,
+                                reason: error.message,
+                                requiredAction: 'Materialize one audited additive remediation Task, merge it, then replace the rejected Plan.',
+                            },
+                            auditedRemediation: {
+                                state: existingRemediationTask?.status === 'merged'
+                                    ? 'merged-replan-required'
+                                    : existingRemediationTask
+                                        ? 'materialized-not-merged'
+                                        : remediationDiscovery?.status === 'ready_to_materialize'
+                                            ? 'ready-to-materialize'
+                                            : 'discovery-required',
+                                humanApprovalRequired: false,
+                                blockedTaskId: activeTask.id,
+                                blockedTaskRevision: activeTask.revision,
+                                milestoneId: remediationMilestone.id,
+                                milestoneRevision: remediationMilestone.revision,
+                                planRiskAuditEventId: blockingAudit?.eventId ?? null,
+                                planRiskAuditEventHash: blockingAudit?.eventHash ?? null,
+                                discoveryId: remediationDiscovery?.id ?? null,
+                                discoveryRevision: remediationDiscovery?.revision ?? null,
+                                remediationTaskId: existingRemediationTask?.id ?? null,
+                                remediationTaskStatus: existingRemediationTask?.status ?? null,
+                                requiredPredecessorTaskIds: [...(remediationMembership.dependsOnTaskIds ?? [])],
+                                eligibleMergedAncestorTaskIds: eligibleRemediationPredecessorTaskIds,
+                                command: existingRemediationTask?.status === 'merged'
+                                    ? 'task plan-set'
+                                    : existingRemediationTask
+                                        ? 'doctor'
+                                        : remediationDiscovery?.status === 'ready_to_materialize'
+                                            ? 'milestone remediation-materialize'
+                                            : remediationDiscovery
+                                                ? 'discovery update'
+                                                : 'discovery start',
+                                boundedEffect: 'append-one-required-remediation-task-and-add-one-blocked-task-dependency',
+                                preservesMilestoneSemantics: true,
+                            },
+                            taskPlanContract: this.taskPlanContract(status.projectId, activeTask),
+                        }
+                        : blockingDecision === 'stop-escalate' || blockingDecision === 'split-required'
+                            ? {
+                                scope: 'task',
+                                id: activeTask.id,
+                                status: activeTask.status,
+                                action: blockingDecision === 'stop-escalate' ? 'task plan-set' : 'doctor',
+                                blockedAction: 'task authorize',
+                                revision: activeTask.revision,
+                                planRiskAuditDecision: {
+                                    state: 'recorded-blocking',
+                                    decision: blockingDecision,
+                                    reason: error.message,
+                                    requiredAction: blockingDecision === 'stop-escalate'
+                                        ? 'Replace the rejected Step Plan before requesting fresh authorization.'
+                                        : 'Resolve the required cross-Task split through an explicit Milestone topology decision.',
+                                },
+                                ...(blockingDecision === 'stop-escalate'
+                                    ? { taskPlanContract: this.taskPlanContract(status.projectId, activeTask) }
+                                    : {}),
+                            }
+                            : {
+                                scope: 'task',
+                                id: activeTask.id,
+                                status: activeTask.status,
+                                action: 'task plan-risk-audit',
+                                revision: activeTask.revision,
+                                planRiskAuditRecovery: {
+                                    state: 'required',
+                                    reason: error.message,
+                                    currentBriefHash: activeTask.briefHash,
+                                    currentPlanHash: activeTask.planHash,
+                                    knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                                    knowledgeMapHash: activeTask.knowledgeMapHash,
+                                },
+                            };
                 }
             }
             const taskNext = activeTask.status === 'planning'
                 ? null
-                : planRiskAuditRecovery
-                    ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
+                : requiresReplacementPlan
+                    ? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, null)
+                    : planRiskAuditRecovery
+                        ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -3306,6 +4401,7 @@ export class WorkflowService {
             const terminalCorrectiveDecision = taskNext?.correctiveDecisionGate?.decision;
             if (taskNext?.action === 'task step-complete'
                 || taskNext?.action === 'task step-review'
+                || taskNext?.action === 'task downstream-proof-recover'
                 || taskNext?.action === 'task remediation-mode-recover'
                 || taskNext?.action === 'task plan-integrity-recover'
                 || taskNext?.blockedAction === 'task plan-integrity-recover'
@@ -3345,7 +4441,9 @@ export class WorkflowService {
                         ? this.store.hashArtifact(this.store.taskRoot(status.projectId, activeTask.id), 'plan.md')
                         : null)
                     : null;
-                const contextRefreshOptions = action === 'project-memory reconcile' && refreshAssessment?.eligible
+                const contextRefreshOptions = action === 'project-memory reconcile'
+                    && taskNext?.action !== 'task plan-set'
+                    && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
                 if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
@@ -3393,6 +4491,9 @@ export class WorkflowService {
                 }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
+            if (taskNext?.action === 'task plan-set') {
+                return withAdoption(withMilestoneCancellation(taskNext));
+            }
             if (taskCanRebindKnowledge(activeTask) &&
                 activeTask.planHash &&
                 (activeTask.knowledgeMapRevision !== knowledgeMap.revision ||
@@ -3693,6 +4794,32 @@ export class WorkflowService {
             milestonePlanHash: milestone.planHash,
         };
     }
+    currentCorrectiveDerivedTaskAuthority(projectId, task, actor) {
+        if (!task.milestoneId || actor.trim() !== `agent:milestone-remediation:${task.milestoneId}`)
+            return null;
+        const milestone = this.readMilestoneCurrent(projectId, task.milestoneId);
+        if (milestone.status !== 'active' || !milestone.planHash)
+            return null;
+        const membership = milestone.memberships.find((candidate) => candidate.taskId === task.id);
+        if (membership?.disposition !== 'required')
+            return null;
+        const authorization = [...milestone.authorizations]
+            .reverse()
+            .find((candidate) => candidate.kind === 'execution' && candidate.decision === 'approved');
+        if (authorization?.authorizationMode !== 'corrective-derived'
+            || authorization.planHash !== milestone.planHash
+            || authorization.actor !== actor.trim())
+            return null;
+        const scopeChange = [...readMilestoneScopeChangeEvents(this.store, projectId, milestone.id)]
+            .reverse()
+            .find((candidate) => candidate.authorizationMode === 'audited-remediation'
+            && candidate.candidatePlanHash === milestone.planHash
+            && candidate.remediationEvidence !== null
+            && candidate.remediationEvidence !== undefined);
+        if (!scopeChange)
+            return null;
+        return { milestone, authorization, scopeChange };
+    }
     nextForTaskWithDelegation(projectId, repositoryRoot, task, planRiskAudit = null) {
         const transition = task.status === 'awaiting_execution_authorization'
             ? 'task.execution_authorize'
@@ -3702,6 +4829,12 @@ export class WorkflowService {
         const delegatedApprovalOptions = transition
             ? this.delegatedApprovalOptions(projectId, transition, task)
             : [];
+        const correctiveDerivedActor = task.milestoneId
+            ? `agent:milestone-remediation:${task.milestoneId}`
+            : null;
+        const correctiveDerivedAuthority = transition && correctiveDerivedActor
+            ? this.currentCorrectiveDerivedTaskAuthority(projectId, task, correctiveDerivedActor)
+            : null;
         let remediationModeRecovery = null;
         let guardedCorrectivePosture = null;
         if (planRiskAudit) {
@@ -3728,6 +4861,12 @@ export class WorkflowService {
             }
         }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const nextStepId = typeof next.stepId === 'string' ? next.stepId : null;
+        const downstreamProofCarryover = next.action === 'task run'
+            && nextStepId
+            && changedFiles(repositoryRoot).length > 0
+            ? assessDownstreamProofCarryover(this.store, repositoryRoot, task, nextStepId)
+            : null;
         let mechanicalFeasibilityOverlay = {};
         if (task.status === 'awaiting_execution_authorization' && task.planHash) {
             try {
@@ -3784,6 +4923,7 @@ export class WorkflowService {
         const planIntegrityAssessment = !remediationModeRecovery && planRiskAudit && failedStep
             ? assessPlanIntegrityRecovery(this.store, repositoryRoot, task, failedStep.id)
             : null;
+        const downstreamProofAssessment = assessDownstreamProofRecovery(this.store, repositoryRoot, task);
         const strictStepReviewStep = planRiskAudit
             ? task.steps.find((step) => {
                 if (step.status !== 'in_progress' || !step.evidence || !planRiskAudit.reviewRequiredStepIds.includes(step.id)) {
@@ -3956,6 +5096,39 @@ export class WorkflowService {
                 case 'decision-required':
                     if (guardedCorrectivePosture.correctiveDecision
                         && guardedCorrectivePosture.correctiveDecision.planHash !== task.planHash) {
+                        if (guardedCorrectivePosture.correctiveDecision.decision === 'stop-escalate') {
+                            try {
+                                const assessment = readValidatedStopOverrideContextRebindIfApplicable(this.store, task, guardedCorrectivePosture.stepId, repositoryRoot);
+                                if (!assessment) {
+                                    throw new WorkflowError('TRANSITION_BLOCKED', 'Stale stop decision has no validated stop-override context-rebind continuation.');
+                                }
+                                guardedCorrectiveOverlay = {
+                                    action: 'task run',
+                                    stepId: guardedCorrectivePosture.stepId,
+                                    stopOverrideContextRebind: {
+                                        state: 'validated',
+                                        overrideEventId: assessment.override.eventId,
+                                        stopDecisionEventId: assessment.stopDecision.eventId,
+                                        sourcePlanHash: assessment.override.planHash,
+                                        reboundPlanHash: task.planHash,
+                                        semanticPlanHash: assessment.semanticPlanHash,
+                                        appendOnly: true,
+                                    },
+                                };
+                            }
+                            catch (error) {
+                                guardedCorrectiveOverlay = {
+                                    action: 'doctor',
+                                    stepId: guardedCorrectivePosture.stepId,
+                                    blockedAction: 'task run',
+                                    stopOverrideContextRebind: {
+                                        state: 'blocked',
+                                        reason: error instanceof Error ? error.message : String(error),
+                                    },
+                                };
+                            }
+                            break;
+                        }
                         try {
                             const navigation = readValidatedCorrectiveDecisionRecoveryForNavigation(this.store, task, guardedCorrectivePosture.stepId);
                             guardedCorrectiveOverlay = navigation.recovery
@@ -4118,6 +5291,36 @@ export class WorkflowService {
                     break;
             }
         }
+        const downstreamProofOverlay = downstreamProofAssessment.applicable
+            ? downstreamProofAssessment.eligible
+                ? {
+                    action: 'task downstream-proof-recover',
+                    blockedAction: 'task step-complete',
+                    stepId: downstreamProofAssessment.activeStepId,
+                    downstreamProofRecovery: {
+                        state: 'eligible',
+                        expectedRevision: task.revision,
+                        preservesWorktree: true,
+                        preservedHeadCommit: downstreamProofAssessment.preservedHeadCommit,
+                        dirtyFiles: downstreamProofAssessment.dirtyFiles,
+                        outsideActiveStepFiles: downstreamProofAssessment.outsideActiveStepFiles,
+                        invalidatedSteps: downstreamProofAssessment.invalidatedSteps,
+                        boundedEffect: 'invalidate-predecessor-completion-and-return-to-plan-set',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task downstream-proof-recover',
+                    stepId: downstreamProofAssessment.activeStepId,
+                    downstreamProofRecovery: {
+                        state: 'blocked',
+                        expectedRevision: task.revision,
+                        blockers: downstreamProofAssessment.blockers,
+                        dirtyFiles: downstreamProofAssessment.dirtyFiles,
+                        outsideActiveStepFiles: downstreamProofAssessment.outsideActiveStepFiles,
+                    },
+                }
+            : {};
         const result = {
             ...next,
             ...handoffOverlay,
@@ -4171,6 +5374,7 @@ export class WorkflowService {
                 }
                 : {}),
             ...guardedCorrectiveOverlay,
+            ...downstreamProofOverlay,
             ...(failedStepReviewRouting?.route === 'replan' && next.action === 'task run'
                 ? {
                     action: 'task plan-set',
@@ -4185,7 +5389,44 @@ export class WorkflowService {
                 }
                 : {}),
             ...mechanicalFeasibilityOverlay,
+            ...(downstreamProofCarryover?.applicable
+                ? downstreamProofCarryover.eligible
+                    ? {
+                        downstreamProofCarryover: {
+                            state: 'validated',
+                            invalidationEventId: downstreamProofCarryover.invalidationEventId,
+                            stepId: nextStepId,
+                            dirtyFiles: downstreamProofCarryover.dirtyFiles,
+                            dirtyWorktreeHash: downstreamProofCarryover.dirtyWorktreeHash,
+                            meaning: 'The replacement Step may adopt exactly these preserved uncommitted bytes on task run.',
+                        },
+                    }
+                    : {
+                        action: 'doctor',
+                        blockedAction: 'task run',
+                        downstreamProofCarryover: {
+                            state: 'blocked',
+                            invalidationEventId: downstreamProofCarryover.invalidationEventId,
+                            stepId: nextStepId,
+                            blockers: downstreamProofCarryover.blockers,
+                        },
+                    }
+                : {}),
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
+            ...(correctiveDerivedAuthority && correctiveDerivedActor
+                ? {
+                    correctiveDerivedApproval: {
+                        action: transition === 'task.execution_authorize' ? 'task authorize' : 'task accept',
+                        actor: correctiveDerivedActor,
+                        humanApprovalRequired: false,
+                        milestoneId: correctiveDerivedAuthority.milestone.id,
+                        milestoneRevision: correctiveDerivedAuthority.milestone.revision,
+                        milestonePlanHash: correctiveDerivedAuthority.milestone.planHash,
+                        planRiskAuditEventId: correctiveDerivedAuthority.scopeChange.remediationEvidence?.planRiskAuditEventId ?? null,
+                        authority: 'current-corrective-derived-milestone-execution-authorization',
+                    },
+                }
+                : {}),
         };
         if (handoffPosture.state === 'pending') {
             return this.withTaskNavigationContracts(task, {
@@ -4221,6 +5462,12 @@ export class WorkflowService {
         };
     }
     assertTaskContextChangeAllowed(task) {
+        if (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed')) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} requires a replacement Step Plan; Project Knowledge cannot rebind or refresh the stale Plan.`, {
+                taskId: task.id,
+                requiredAction: 'Run task plan-set with the full unfinished remainder before requesting authorization.',
+            });
+        }
         const posture = this.taskTerminalCorrectivePosture(task);
         if (!posture)
             return;
@@ -4234,6 +5481,9 @@ export class WorkflowService {
                 : 'Escalate outside this Task; stop-escalate cannot be resumed or rebound.',
         });
     }
+    stopOverrideContextRebindDecisionId(task, stepId, repositoryRoot) {
+        return readValidatedStopOverrideContextRebindIfApplicable(this.store, task, stepId, repositoryRoot)?.stopDecision.eventId ?? null;
+    }
     taskHasTerminalCorrectiveDecision(task) {
         return this.taskTerminalCorrectivePosture(task) !== null;
     }
@@ -4339,6 +5589,7 @@ export class WorkflowService {
             if (!taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
                 || !task.planHash
                 || !taskCanRebindKnowledge(task)
+                || (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed'))
                 || this.taskHasTerminalCorrectiveDecision(task))
                 continue;
             const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
@@ -4397,6 +5648,10 @@ export class WorkflowService {
                 statePlanHash: task.planHash,
             });
         }
+        if (authorization.authorizationMode === 'corrective-derived'
+            && !this.currentCorrectiveDerivedTaskAuthority(task.projectId, task, authorization.actor)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Corrective-derived Task authorization is no longer backed by the current Milestone authority.', { taskId: task.id, milestoneId: task.milestoneId, actor: authorization.actor });
+        }
         const mechanicalFeasibility = authorization.mechanicalFeasibility;
         if (!mechanicalFeasibility)
             return authorization;
@@ -4468,7 +5723,7 @@ export class WorkflowService {
             },
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -4488,7 +5743,20 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        });
+        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance);
+    }
+    inspectHistoricalStepProvenanceCandidate(snapshot, task, options = {}) {
+        const now = this.now().getTime();
+        return inspectHistoricalStepProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
+            activeLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now).length,
+            staleLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now).length,
+            pendingTransactionCount: snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length,
+            corruptTransactionCount: snapshot.observation.corruptTaskTransactions.length,
+            coreOperationCount: snapshot.observation.coreTaskOperations.length,
+            verifiedHistoricalStepBindings: verifiedHistoricalStepReviewBindings(this.store, task),
+        }, options);
     }
     withTaskNavigationContracts(task, next) {
         const action = typeof next.action === 'string' ? next.action : null;
@@ -4526,7 +5794,7 @@ export class WorkflowService {
             return activeLeaseOwner;
         const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
             ? 'final_acceptance'
-            : ['task step-complete', 'task submit'].includes(action)
+            : ['task step-complete', 'task downstream-proof-recover', 'task submit', 'task result-set'].includes(action)
                 ? 'execution'
                 : null;
         if (!authorizationKind)
@@ -5310,7 +6578,14 @@ function gitMutationPolicyForAction(task, action) {
     }
 }
 function writerTokenContractForAction(action, claimedC1Posture = false) {
-    const alwaysLeaseBound = ['task step-complete', 'task submit', 'task merge', 'task merge-confirm'];
+    const alwaysLeaseBound = [
+        'task step-complete',
+        'task downstream-proof-recover',
+        'task submit',
+        'task result-set',
+        'task merge',
+        'task merge-confirm',
+    ];
     const claimedC1LeaseBound = [
         'task run',
         'task step-review',