codex-workflow-v2 2.0.0-beta.12.6 → 2.0.0-beta.12.8

package/dist/src/workflow.js

@@ -11,9 +11,9 @@ import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
 import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
-import { assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, prepareDownstreamProofInvalidation, readDownstreamProofInvalidations, } from './alpha6/downstream-proof.js';
+import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
-import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
+import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
 import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
@@ -281,6 +281,92 @@ export class WorkflowService {
             invalidation: invalidation.event,
         };
     }
+    recoverDownstreamProofReplan(repository, taskId, expectedTaskRevision, actor, reason) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedTaskRevision);
+        // This repair intentionally runs before Project Knowledge refresh: the exact
+        // dependency-only transport can make the current map stale, while the
+        // recovery assessment still binds the stranded Task to its recorded rebind.
+        const observation = this.observationSnapshot(repository).observation;
+        if (observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan recovery requires a coherent observation boundary.', {
+                observation,
+            });
+        }
+        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
+        const assessment = assessDownstreamProofReplanRecovery(this.store, context.identity.repositoryRoot, task, { currentPlanRiskAuditExists });
+        const environmentBlockers = [
+            ...(!assessment.dependencyRecoveryCommit
+                ? ['The exact beta.12.7 dependency compatibility must be registered before Task recovery.']
+                : []),
+            ...(observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+            ...(observation.pendingProjectTransactions.length > 0
+                || observation.pendingMilestoneTransactions.length > 0
+                || observation.pendingTaskTransactions.length > 0
+                ? ['No pending Workflow transaction may exist.'] : []),
+            ...(observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+            ...(observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+        ];
+        if (!assessment.applicable || !assessment.eligible || environmentBlockers.length > 0) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task is not eligible for bounded downstream-proof replan recovery.', {
+                taskId,
+                blockers: [...assessment.blockers, ...environmentBlockers],
+            });
+        }
+        const now = this.now();
+        const resultTask = {
+            ...task,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            status: 'needs_fix',
+            authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
+                ? { ...authorization, decision: 'superseded' }
+                : authorization),
+            review: emptyReview(),
+            resultHash: null,
+            evidenceHash: null,
+            blockReason: `${assessment.invalidation.activeStepId} downstream-proof recovery requires replacement of the full unfinished Step Plan before execution can resume.`,
+        };
+        const recovery = prepareDownstreamProofReplanRecovery(this.store, resultTask, assessment, { previousTaskRevision: task.revision, actor, reason }, now);
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'downstream-proof-replan-recovery',
+            now,
+            targets: [
+                {
+                    path: relative(path.join(taskRoot, downstreamProofReplanRecoverySidecar())),
+                    content: recovery.postimage,
+                },
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const events = readDownstreamProofReplanRecoveries(this.store, saved);
+                if (saved.revision !== resultTask.revision
+                    || saved.status !== 'needs_fix'
+                    || saved.planHash !== task.planHash
+                    || events.at(-1)?.eventHash !== recovery.event.eventHash
+                    || headCommit(context.identity.repositoryRoot) !== recovery.event.preservedHeadCommit
+                    || JSON.stringify(changedFiles(context.identity.repositoryRoot).sort())
+                        !== JSON.stringify(recovery.event.dirtyFiles)) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Downstream-proof replan recovery transaction readback failed.', {
+                        taskId,
+                    });
+                }
+                validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return {
+            task: this.store.readTask(task.projectId, task.id),
+            recovery: recovery.event,
+        };
+    }
     correctiveReplanController(repository) {
         const identity = resolveRepositoryIdentity(repository);
         return createCorrectiveReplanPublicController({
@@ -1177,7 +1263,10 @@ export class WorkflowService {
         const overriddenStopDecisionEventIds = stopEscalateOverrideDecisionEventIds(this.store, task);
         const currentHardBlockingDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'split-required'
             || (event.decision === 'stop-escalate' && !overriddenStopDecisionEventIds.has(event.eventId)));
-        const currentPlanRiskAudit = task.status === 'needs_fix' || currentReplanDecisions.length > 0
+        const downstreamReplanRecovered = readDownstreamProofReplanRecoveries(this.store, task)
+            .some((event) => event.resultTaskRevision === task.revision && event.reboundPlanHash === task.planHash);
+        const currentPlanRiskAudit = (task.status === 'needs_fix' || currentReplanDecisions.length > 0)
+            && !downstreamReplanRecovered
             ? readCurrentPlanRiskAudit(this.store, task)
             : null;
         const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
@@ -1946,9 +2035,18 @@ export class WorkflowService {
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        if (step.status === 'planned' && dirty.length > 0 && !resumesCorrectiveReplan) {
+        const downstreamProofCarryover = step.status === 'planned' && dirty.length > 0
+            ? assessDownstreamProofCarryover(this.store, context.identity.repositoryRoot, task, stepId)
+            : null;
+        if (step.status === 'planned'
+            && dirty.length > 0
+            && !resumesCorrectiveReplan
+            && !downstreamProofCarryover?.eligible) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
+                ...(downstreamProofCarryover?.applicable
+                    ? { downstreamProofCarryoverBlockers: downstreamProofCarryover.blockers }
+                    : {}),
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
@@ -2635,16 +2733,23 @@ export class WorkflowService {
         assertCorrectiveAuditorIndependence(this.store, task, stepId, correctiveAudit.auditor);
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
-    setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.#mutationContext(repository);
+    setTaskResult(repository, taskId, expectedRevision, summary, limitations, writerToken, actor) {
+        const context = this.#mutationContext(repository);
+        const { identity } = context;
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Result requires a passing independent review.');
         }
         this.assertReviewFresh(identity.repositoryRoot, task);
+        const lease = context.locks.heartbeat(taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor ?? null, lease.token);
         const root = this.store.taskRoot(task.projectId, task.id);
         const stagedResult = this.store.stageArtifact(root, 'result.md', renderResult(task, summary, limitations));
+        // Human final acceptance is an intentionally unbounded pause. Release the
+        // execution lease before entering that gate so elapsed human time cannot
+        // turn a successful Task into a repository-wide stale-lock repair route.
+        context.locks.release(taskId, lease.token);
         const saved = this.store.writeTask({ ...task, status: 'awaiting_final_acceptance', resultHash: stagedResult.hash, blockReason: null }, expectedRevision);
         this.store.publishArtifact(stagedResult);
         return saved;
@@ -2944,13 +3049,117 @@ export class WorkflowService {
             invalidatedStepIds: assessment.invalidatedSteps.map((step) => step.stepId),
         });
     }
+    downstreamProofReplanUpdatePreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan update preflight requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
+        const assessment = assessDownstreamProofReplanRecovery(this.store, snapshot.identity.repositoryRoot, task, { currentPlanRiskAuditExists });
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const sourceVersion = '2.0.0-beta.12.6';
+        const versionSurfaces = {
+            declared: versions.declared,
+            locked: versions.locked,
+            installed: versions.installed,
+            currentBranch: versions.currentBranch,
+            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+        };
+        const blockers = [
+            ...assessment.blockers,
+            ...(String(PACKAGE_VERSION) === sourceVersion ? ['Recovery runner must be newer than the beta.12.6 source package.'] : []),
+            ...Object.entries(versionSurfaces)
+                .filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the stranded source ${sourceVersion}.`),
+            ...(snapshot.observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+            ...(snapshot.observation.pendingProjectTransactions.length > 0
+                || snapshot.observation.pendingMilestoneTransactions.length > 0
+                || snapshot.observation.pendingTaskTransactions.length > 0
+                ? ['No pending Workflow transaction may exist.'] : []),
+            ...(snapshot.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+            ...(snapshot.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+        ];
+        return {
+            readOnly: true,
+            eligible: assessment.applicable && assessment.eligible && blockers.length === 0,
+            action: assessment.applicable && assessment.eligible && blockers.length === 0
+                ? 'update downstream-proof-replan-transport'
+                : null,
+            projectId: task.projectId,
+            taskId: task.id,
+            taskRevision: task.revision,
+            sourceVersion,
+            targetVersion: PACKAGE_VERSION,
+            sourceHeadCommit: assessment.invalidation?.preservedHeadCommit ?? null,
+            taskBranch: task.taskBranch,
+            baseBranch: task.baseBranch,
+            dirtyFiles: assessment.compatibility?.dirtyFiles ?? [],
+            dirtyWorktreeHash: assessment.compatibility?.dirtyWorktreeHash ?? null,
+            requiredTransport: [
+                'Commit only package.json and package-lock.json on the active Milestone base.',
+                'Commit only the same dependency files on the Task branch while preserving all product bytes.',
+                'Install the exact target package, then follow fresh next to dependency registration.',
+            ],
+            blockers,
+        };
+    }
+    downstreamProofReplanDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        let candidateParent = null;
+        try {
+            candidateParent = runGit(snapshot.identity.repositoryRoot, ['rev-parse', 'HEAD^']);
+        }
+        catch {
+            candidateParent = null;
+        }
+        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
+        const assessment = candidateParent
+            ? assessDownstreamProofReplanRecovery(this.store, snapshot.identity.repositoryRoot, task, {
+                historyBoundary: 'HEAD^',
+                preservedHeadCommit: candidateParent,
+                currentPlanRiskAuditExists,
+            })
+            : null;
+        if (!assessment?.applicable || !assessment.eligible || !assessment.compatibility) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                activeDownstreamProof: null,
+                downstreamProofReplan: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...(assessment?.blockers ?? []),
+                        'The Task must preserve the exact beta.12.6 downstream-proof invalidation and accidental knowledge-rebind boundary.',
+                    ])],
+            };
+        }
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, assessment.compatibility);
+    }
     recoverDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, false);
     }
     recoverActiveDownstreamProofDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, true);
     }
-    recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, activeDownstreamProof) {
+    recoverDownstreamProofReplanDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'downstream-replan');
+    }
+    recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, recoveryMode) {
         const normalizedActor = actor.trim();
         const normalizedReason = reason.trim();
         if (!normalizedActor)
@@ -2962,7 +3171,9 @@ export class WorkflowService {
         const currentHead = headCommit(context.identity.repositoryRoot);
         const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead
             && record.packageVersion === PACKAGE_VERSION
-            && Boolean(record.activeDownstreamProof) === activeDownstreamProof);
+            && (recoveryMode === 'downstream-replan'
+                ? Boolean(record.downstreamProofReplan)
+                : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -2970,9 +3181,11 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const preflight = activeDownstreamProof
-            ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
-            : this.inspectDependencyProvenanceCandidate(snapshot, task);
+        const preflight = recoveryMode === 'downstream-replan'
+            ? this.downstreamProofReplanDependencyRecoveryPreflight(repository, taskId)
+            : recoveryMode
+                ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
+                : this.inspectDependencyProvenanceCandidate(snapshot, task);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
@@ -2997,6 +3210,9 @@ export class WorkflowService {
                     ...(preflight.activeDownstreamProof
                         ? { activeDownstreamProof: preflight.activeDownstreamProof }
                         : {}),
+                    ...(preflight.downstreamProofReplan
+                        ? { downstreamProofReplan: preflight.downstreamProofReplan }
+                        : {}),
                 },
             ],
         }, expectedRevision);
@@ -3426,6 +3642,22 @@ export class WorkflowService {
                     },
                 });
             }
+            const downstreamProofReplanDependencyRecovery = this.downstreamProofReplanDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (downstreamProofReplanDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update downstream-proof-replan-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: downstreamProofReplanDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'A newer package preflight approved the exact beta.12.6 stranded replan transport before dependency-only commits were created.',
+                        continuation: 'Register this dependency commit, then run task downstream-proof-replan-recover.',
+                    },
+                });
+            }
             const activeTaskMilestone = activeTask.milestoneId
                 ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
@@ -3449,36 +3681,109 @@ export class WorkflowService {
                     },
                 }
                 : value);
+            const currentPlanRiskAuditExists = activeTask.planHash
+                ? readPlanRiskAuditEvents(this.store, activeTask).some((event) => event.taskRevision === activeTask.revision && event.planHash === activeTask.planHash)
+                : false;
+            const downstreamReplanRecovery = assessDownstreamProofReplanRecovery(this.store, repositoryRoot, activeTask, { currentPlanRiskAuditExists });
+            if (downstreamReplanRecovery.applicable) {
+                const environmentBlockers = [
+                    ...(!downstreamReplanRecovery.dependencyRecoveryCommit
+                        ? ['The exact beta.12.7 dependency compatibility must be registered before Task recovery.']
+                        : []),
+                    ...(status.observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+                    ...(status.observation.pendingProjectTransactions.length > 0
+                        || status.observation.pendingMilestoneTransactions.length > 0
+                        || status.observation.pendingTaskTransactions.length > 0
+                        ? ['No pending Workflow transaction may exist.'] : []),
+                    ...(status.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+                    ...(status.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+                ];
+                return withAdoption(withMilestoneCancellation(downstreamReplanRecovery.eligible && environmentBlockers.length === 0
+                    ? {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'task downstream-proof-replan-recover',
+                        revision: activeTask.revision,
+                        downstreamProofReplanRecovery: {
+                            state: 'eligible',
+                            invalidationEventId: downstreamReplanRecovery.invalidation.eventId,
+                            sourcePlanHash: downstreamReplanRecovery.invalidation.planHash,
+                            reboundPlanHash: activeTask.planHash,
+                            dirtyFiles: downstreamReplanRecovery.compatibility.dirtyFiles,
+                            dirtyWorktreeHash: downstreamReplanRecovery.compatibility.dirtyWorktreeHash,
+                            dependencyRecoveryCommit: downstreamReplanRecovery.dependencyRecoveryCommit,
+                            boundedEffect: 'restore-needs-fix-and-return-same-task-to-plan-set',
+                        },
+                    }
+                    : {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'doctor',
+                        blockedAction: 'task downstream-proof-replan-recover',
+                        revision: activeTask.revision,
+                        downstreamProofReplanRecovery: {
+                            state: 'blocked',
+                            blockers: [...downstreamReplanRecovery.blockers, ...environmentBlockers],
+                        },
+                    }));
+            }
             let activePlanRiskAudit = null;
             let planRiskAuditRecovery = null;
-            if (activeTask.planHash) {
+            const requiresReplacementPlan = activeTask.status === 'needs_fix'
+                && !activeTask.steps.some((step) => step.status === 'failed');
+            if (activeTask.planHash && !requiresReplacementPlan) {
                 try {
                     activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
                 }
                 catch (error) {
                     if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
                         throw error;
-                    planRiskAuditRecovery = {
-                        scope: 'task',
-                        id: activeTask.id,
-                        status: activeTask.status,
-                        action: 'task plan-risk-audit',
-                        revision: activeTask.revision,
-                        planRiskAuditRecovery: {
-                            state: 'required',
-                            reason: error.message,
-                            currentBriefHash: activeTask.briefHash,
-                            currentPlanHash: activeTask.planHash,
-                            knowledgeMapRevision: activeTask.knowledgeMapRevision,
-                            knowledgeMapHash: activeTask.knowledgeMapHash,
-                        },
-                    };
+                    const blockingDecision = error.details.decision;
+                    planRiskAuditRecovery = blockingDecision === 'stop-escalate' || blockingDecision === 'split-required'
+                        ? {
+                            scope: 'task',
+                            id: activeTask.id,
+                            status: activeTask.status,
+                            action: blockingDecision === 'stop-escalate' ? 'task plan-set' : 'doctor',
+                            blockedAction: 'task authorize',
+                            revision: activeTask.revision,
+                            planRiskAuditDecision: {
+                                state: 'recorded-blocking',
+                                decision: blockingDecision,
+                                reason: error.message,
+                                requiredAction: blockingDecision === 'stop-escalate'
+                                    ? 'Replace the rejected Step Plan before requesting fresh authorization.'
+                                    : 'Resolve the required cross-Task split through an explicit Milestone topology decision.',
+                            },
+                            ...(blockingDecision === 'stop-escalate'
+                                ? { taskPlanContract: this.taskPlanContract(status.projectId, activeTask) }
+                                : {}),
+                        }
+                        : {
+                            scope: 'task',
+                            id: activeTask.id,
+                            status: activeTask.status,
+                            action: 'task plan-risk-audit',
+                            revision: activeTask.revision,
+                            planRiskAuditRecovery: {
+                                state: 'required',
+                                reason: error.message,
+                                currentBriefHash: activeTask.briefHash,
+                                currentPlanHash: activeTask.planHash,
+                                knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                                knowledgeMapHash: activeTask.knowledgeMapHash,
+                            },
+                        };
                 }
             }
             const taskNext = activeTask.status === 'planning'
                 ? null
-                : planRiskAuditRecovery
-                    ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
+                : requiresReplacementPlan
+                    ? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, null)
+                    : planRiskAuditRecovery
+                        ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -3526,7 +3831,9 @@ export class WorkflowService {
                         ? this.store.hashArtifact(this.store.taskRoot(status.projectId, activeTask.id), 'plan.md')
                         : null)
                     : null;
-                const contextRefreshOptions = action === 'project-memory reconcile' && refreshAssessment?.eligible
+                const contextRefreshOptions = action === 'project-memory reconcile'
+                    && taskNext?.action !== 'task plan-set'
+                    && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
                 if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
@@ -3574,6 +3881,9 @@ export class WorkflowService {
                 }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
+            if (taskNext?.action === 'task plan-set') {
+                return withAdoption(withMilestoneCancellation(taskNext));
+            }
             if (taskCanRebindKnowledge(activeTask) &&
                 activeTask.planHash &&
                 (activeTask.knowledgeMapRevision !== knowledgeMap.revision ||
@@ -3909,6 +4219,12 @@ export class WorkflowService {
             }
         }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const nextStepId = typeof next.stepId === 'string' ? next.stepId : null;
+        const downstreamProofCarryover = next.action === 'task run'
+            && nextStepId
+            && changedFiles(repositoryRoot).length > 0
+            ? assessDownstreamProofCarryover(this.store, repositoryRoot, task, nextStepId)
+            : null;
         let mechanicalFeasibilityOverlay = {};
         if (task.status === 'awaiting_execution_authorization' && task.planHash) {
             try {
@@ -4431,6 +4747,29 @@ export class WorkflowService {
                 }
                 : {}),
             ...mechanicalFeasibilityOverlay,
+            ...(downstreamProofCarryover?.applicable
+                ? downstreamProofCarryover.eligible
+                    ? {
+                        downstreamProofCarryover: {
+                            state: 'validated',
+                            invalidationEventId: downstreamProofCarryover.invalidationEventId,
+                            stepId: nextStepId,
+                            dirtyFiles: downstreamProofCarryover.dirtyFiles,
+                            dirtyWorktreeHash: downstreamProofCarryover.dirtyWorktreeHash,
+                            meaning: 'The replacement Step may adopt exactly these preserved uncommitted bytes on task run.',
+                        },
+                    }
+                    : {
+                        action: 'doctor',
+                        blockedAction: 'task run',
+                        downstreamProofCarryover: {
+                            state: 'blocked',
+                            invalidationEventId: downstreamProofCarryover.invalidationEventId,
+                            stepId: nextStepId,
+                            blockers: downstreamProofCarryover.blockers,
+                        },
+                    }
+                : {}),
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
         };
         if (handoffPosture.state === 'pending') {
@@ -4467,6 +4806,12 @@ export class WorkflowService {
         };
     }
     assertTaskContextChangeAllowed(task) {
+        if (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed')) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} requires a replacement Step Plan; Project Knowledge cannot rebind or refresh the stale Plan.`, {
+                taskId: task.id,
+                requiredAction: 'Run task plan-set with the full unfinished remainder before requesting authorization.',
+            });
+        }
         const posture = this.taskTerminalCorrectivePosture(task);
         if (!posture)
             return;
@@ -4588,6 +4933,7 @@ export class WorkflowService {
             if (!taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
                 || !task.planHash
                 || !taskCanRebindKnowledge(task)
+                || (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed'))
                 || this.taskHasTerminalCorrectiveDecision(task))
                 continue;
             const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
@@ -4717,7 +5063,7 @@ export class WorkflowService {
             },
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -4737,7 +5083,7 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        }, activeDownstreamProof);
+        }, activeDownstreamProof, downstreamProofReplan);
     }
     withTaskNavigationContracts(task, next) {
         const action = typeof next.action === 'string' ? next.action : null;
@@ -4775,7 +5121,7 @@ export class WorkflowService {
             return activeLeaseOwner;
         const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
             ? 'final_acceptance'
-            : ['task step-complete', 'task downstream-proof-recover', 'task submit'].includes(action)
+            : ['task step-complete', 'task downstream-proof-recover', 'task submit', 'task result-set'].includes(action)
                 ? 'execution'
                 : null;
         if (!authorizationKind)
@@ -5563,6 +5909,7 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
         'task step-complete',
         'task downstream-proof-recover',
         'task submit',
+        'task result-set',
         'task merge',
         'task merge-confirm',
     ];