codex-workflow-v2 2.0.0-beta.12.9 → 2.0.0-beta.13

package/dist/src/workflow.js

@@ -2,23 +2,26 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
+import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
 import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
+import { deriveCompletedStepCarryover, normalizePlanStepDefinition, } from './domain/completed-step-carryover.js';
 import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
+import { withObservedRouteMetadata } from './observed-routes.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
 import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
 import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
-import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationEvent, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
+import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, prepareRemediationEvent, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
+import { mechanicalCauseBindings, normalizeMechanicalFailures, } from './alpha6/remediation-cause.js';
 import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
-import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneScopeChangeEvents, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
 import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestFailedStepReviewRouting, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, verifiedHistoricalStepReviewBindings, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
@@ -28,7 +31,7 @@ import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
 import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
-import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
+import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, prepareReviewerRuntimePreflight, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
 import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
 import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
@@ -601,6 +604,353 @@ export class WorkflowService {
         const savedDiscovery = this.store.writeDiscovery({ ...discovery, status: 'materialized', materializedEntityId: taskId }, expectedRevision);
         return { discovery: savedDiscovery, task: savedTask, taskRoot };
     }
+    materializeAuditedRemediationTask(repository, milestoneId, expectedMilestoneRevision, blockedTaskId, expectedBlockedTaskRevision, input) {
+        const { identity, locks } = this.#mutationContext(repository);
+        const observation = this.observationSnapshot(repository).observation;
+        if (observation.kind !== 'assessment'
+            || observation.leases.length > 0
+            || observation.coreTaskOperations.length > 0
+            || observation.pendingProjectTransactions.length > 0
+            || observation.pendingMilestoneTransactions.length > 0
+            || observation.pendingTaskTransactions.length > 0
+            || observation.corruptTaskTransactions.length > 0) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation materialization requires a coherent, idle observation boundary.', { observation });
+        }
+        if (!isClean(identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Audited remediation materialization requires a clean Milestone base checkout.', { changedFiles: changedFiles(identity.repositoryRoot) });
+        }
+        const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
+        assertExpectedRevision(milestone, expectedMilestoneRevision);
+        if (milestone.status !== 'active' || currentBranch(identity.repositoryRoot) !== milestone.baseBranch) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation materialization requires the active Milestone base branch.', {
+                milestoneStatus: milestone.status,
+                expectedBranch: milestone.baseBranch,
+                actualBranch: currentBranch(identity.repositoryRoot),
+            });
+        }
+        this.assertMilestoneAuthorizationFresh(milestone);
+        const blockedTask = this.store.readTask(identity.projectId, blockedTaskId);
+        assertExpectedRevision(blockedTask, expectedBlockedTaskRevision);
+        if (blockedTask.milestoneId !== milestone.id
+            || blockedTask.status !== 'awaiting_execution_authorization'
+            || !blockedTask.planHash
+            || blockedTask.workspaceOwner !== null
+            || blockedTask.steps.some((step) => step.status !== 'planned')) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation is available only for an unstarted Milestone Task with a rejected current Plan.', {
+                taskId: blockedTask.id,
+                taskStatus: blockedTask.status,
+                milestoneId: blockedTask.milestoneId,
+                workspaceOwner: blockedTask.workspaceOwner,
+            });
+        }
+        const blockedMembership = milestone.memberships.find((membership) => membership.taskId === blockedTask.id);
+        if (blockedMembership?.disposition !== 'required') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The blocked Task must remain a required Milestone member.', { taskId: blockedTask.id, disposition: blockedMembership?.disposition ?? null });
+        }
+        const audit = readPlanRiskAuditEvents(this.store, blockedTask).at(-1);
+        if (!audit
+            || audit.decision !== 'stop-escalate'
+            || audit.taskRevision !== blockedTask.revision
+            || audit.briefHash !== blockedTask.briefHash
+            || audit.planHash !== blockedTask.planHash) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation requires the current stop-escalate Plan Risk Audit.', {
+                taskId: blockedTask.id,
+                currentTaskRevision: blockedTask.revision,
+                currentBriefHash: blockedTask.briefHash,
+                currentPlanHash: blockedTask.planHash,
+                latestAudit: audit ?? null,
+            });
+        }
+        const duplicate = readMilestoneScopeChangeEvents(this.store, identity.projectId, milestone.id)
+            .find((event) => event.authorizationMode === 'audited-remediation'
+            && event.remediationEvidence?.planRiskAuditEventHash === audit.eventHash);
+        if (duplicate) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'This blocking Plan Risk Audit already has a materialized remediation Task.', {
+                planRiskAuditEventId: audit.eventId,
+                remediationTaskId: duplicate.remediationEvidence?.remediationTaskId ?? null,
+            });
+        }
+        const discovery = this.store.readDiscovery(identity.projectId, input.discoveryId);
+        assertExpectedRevision(discovery, input.expectedDiscoveryRevision);
+        const readiness = assessDiscovery(discovery);
+        if (!readiness.ready || discovery.status !== 'ready_to_materialize') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation Discovery is not ready to materialize.', {
+                discoveryId: discovery.id,
+                missing: readiness.missing,
+            });
+        }
+        const title = input.title.trim();
+        if (!title)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Remediation Task title is required.');
+        const predecessorTaskIds = [...new Set(input.predecessorTaskIds.map((taskId) => taskId.trim()))].sort();
+        if (predecessorTaskIds.length === 0 || predecessorTaskIds.some((taskId) => !taskId)) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Audited remediation requires at least one explicit merged predecessor Task.');
+        }
+        const requiredPredecessorTaskIds = [...(blockedMembership.dependsOnTaskIds ?? [])].sort();
+        if (canonicalJsonStringify(predecessorTaskIds) !== canonicalJsonStringify(requiredPredecessorTaskIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation must inherit the blocked Task exact direct predecessor frontier.', {
+                blockedTaskId: blockedTask.id,
+                requiredPredecessorTaskIds,
+                actualPredecessorTaskIds: predecessorTaskIds,
+            });
+        }
+        const membershipsByTaskId = new Map(milestone.memberships.map((membership) => [membership.taskId, membership]));
+        const ancestorTaskIds = new Set();
+        const visitAncestors = (taskId) => {
+            const membership = membershipsByTaskId.get(taskId);
+            for (const dependencyId of membership?.dependsOnTaskIds ?? []) {
+                if (ancestorTaskIds.has(dependencyId))
+                    continue;
+                ancestorTaskIds.add(dependencyId);
+                visitAncestors(dependencyId);
+            }
+        };
+        visitAncestors(blockedTask.id);
+        for (const predecessorTaskId of predecessorTaskIds) {
+            const predecessorMembership = membershipsByTaskId.get(predecessorTaskId);
+            const predecessor = this.store.readTask(identity.projectId, predecessorTaskId);
+            if (!ancestorTaskIds.has(predecessorTaskId)
+                || predecessorMembership?.disposition !== 'required'
+                || predecessor.status !== 'merged') {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Every remediation predecessor must be a merged required ancestor of the blocked Task.', {
+                    predecessorTaskId,
+                    isAncestor: ancestorTaskIds.has(predecessorTaskId),
+                    disposition: predecessorMembership?.disposition ?? null,
+                    status: predecessor.status,
+                });
+            }
+        }
+        const now = this.now();
+        const timestamp = now.toISOString();
+        const actor = `agent:milestone-remediation:${milestone.id}`;
+        const storedKnowledgeMap = this.store.readKnowledgeMap(identity.projectId);
+        const scannedKnowledgeMap = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, now);
+        const inspectedKnowledgeMap = inspectKnowledgeMap(storedKnowledgeMap, scannedKnowledgeMap);
+        let dependencyKnowledgeRefresh = null;
+        let refreshedKnowledgeMap = null;
+        if (inspectedKnowledgeMap.status !== 'active' || !inspectedKnowledgeMap.approval) {
+            dependencyKnowledgeRefresh = inspectDependencyKnowledgeRefresh(identity.repositoryRoot, milestone.baseBranch, storedKnowledgeMap, inspectedKnowledgeMap);
+            if (!dependencyKnowledgeRefresh.eligible) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation cannot bypass unrelated or unproven Project Knowledge drift.', { dependencyKnowledgeRefresh });
+            }
+            const reconciled = reconcileKnowledgeMap(storedKnowledgeMap, scannedKnowledgeMap);
+            const approved = applyKnowledgeSelections(reconciled, [], actor, now);
+            if (!approved.approval) {
+                throw new WorkflowError('STATE_CORRUPT', 'Dependency-only Knowledge refresh did not produce approval evidence.');
+            }
+            refreshedKnowledgeMap = {
+                ...approved,
+                revision: storedKnowledgeMap.revision + 2,
+                createdAt: storedKnowledgeMap.createdAt,
+                updatedAt: timestamp,
+                approval: {
+                    ...approved.approval,
+                    authorizationMode: 'corrective-derived',
+                },
+            };
+        }
+        const remediationTaskId = createEntityId('TASK', now.getTime());
+        const briefContent = renderBrief(discovery, title);
+        const normalizedBriefContent = briefContent.endsWith('\n') ? briefContent : `${briefContent}\n`;
+        const briefHash = sha256Hex(normalizedBriefContent);
+        const remediationTask = {
+            schemaVersion: STATE_SCHEMA_VERSION,
+            revision: 1,
+            id: remediationTaskId,
+            projectId: identity.projectId,
+            createdAt: timestamp,
+            updatedAt: timestamp,
+            kind: 'task',
+            status: 'planning',
+            title,
+            slug: slugify(title),
+            discoveryId: discovery.id,
+            milestoneId: milestone.id,
+            repositoryRoot: identity.repositoryRoot,
+            baseBranch: milestone.baseBranch,
+            baseCommit: null,
+            taskBranch: null,
+            workspaceOwner: null,
+            briefHash,
+            planHash: null,
+            planObjective: null,
+            resultHash: null,
+            evidenceHash: null,
+            requirements: discovery.acceptance.map((_, index) => `REQ-${String(index + 1).padStart(3, '0')}`),
+            acceptance: discovery.acceptance.map((_, index) => `AC-${String(index + 1).padStart(3, '0')}`),
+            risks: discovery.assumptions,
+            knowledgeImpact: null,
+            knowledgeImpactReason: null,
+            knowledgeTargets: [],
+            knowledgeMapRevision: null,
+            knowledgeMapHash: null,
+            graphUse: null,
+            steps: [],
+            authorizations: [],
+            knowledgeRebinds: [],
+            review: emptyReview(),
+            blockReason: null,
+            mergedCommit: null,
+            systemCommits: [],
+        };
+        const consumedDiscovery = {
+            ...discovery,
+            revision: discovery.revision + 1,
+            updatedAt: timestamp,
+            status: 'materialized',
+            materializedEntityId: remediationTaskId,
+        };
+        const remediationEvidence = {
+            blockedTaskId: blockedTask.id,
+            blockedTaskRevision: blockedTask.revision,
+            blockedBriefHash: blockedTask.briefHash,
+            blockedPlanHash: blockedTask.planHash,
+            planRiskAuditEventId: audit.eventId,
+            planRiskAuditEventHash: audit.eventHash,
+            remediationTaskId,
+            predecessorTaskIds,
+        };
+        const reason = `Audited remediation for ${blockedTask.id} after stop-escalate ${audit.eventId}.`;
+        const plan = {
+            outcome: milestone.outcome,
+            successSignal: milestone.successSignal,
+            acceptance: [...milestone.acceptance],
+            checks: [...milestone.checks],
+            memberships: [
+                ...milestone.memberships.map((membership) => membership.taskId === blockedTask.id
+                    ? {
+                        ...membership,
+                        dependsOnTaskIds: [...new Set([...(membership.dependsOnTaskIds ?? []), remediationTaskId])],
+                    }
+                    : { ...membership, dependsOnTaskIds: [...(membership.dependsOnTaskIds ?? [])] }),
+                {
+                    taskId: remediationTaskId,
+                    disposition: 'required',
+                    reason,
+                    dependsOnTaskIds: predecessorTaskIds,
+                },
+            ],
+        };
+        const readCandidateTask = (taskId) => taskId === remediationTaskId
+            ? remediationTask
+            : this.store.readTask(identity.projectId, taskId);
+        const preparedCandidate = prepareMilestoneScopeChangeCandidate({
+            milestone,
+            plan,
+            readTask: readCandidateTask,
+            actor,
+            auditedRemediationEvidence: remediationEvidence,
+        });
+        const sourceAuthorization = [...milestone.authorizations]
+            .reverse()
+            .find((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved');
+        if (!sourceAuthorization) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Audited remediation has no current Milestone execution authority.');
+        }
+        const derivedAuthorization = {
+            kind: 'execution',
+            decision: 'approved',
+            actor,
+            recordedAt: timestamp,
+            briefHash: null,
+            planHash: preparedCandidate.candidatePlanHash,
+            resultHash: null,
+            evidenceHash: sha256Hex(canonicalJsonStringify({
+                sourcePlanHash: sourceAuthorization.planHash,
+                sourceAuthorizationMode: sourceAuthorization.authorizationMode ?? 'human',
+                planRiskAuditEventHash: audit.eventHash,
+                remediationEvidence,
+            })),
+            headCommit: headCommit(identity.repositoryRoot),
+            reason: 'Derived from the current Milestone execution authority and exact blocking Plan Risk Audit.',
+            authorizationMode: 'corrective-derived',
+        };
+        const prepared = {
+            ...preparedCandidate,
+            authorizations: [...preparedCandidate.authorizations, derivedAuthorization],
+        };
+        const bundle = prepareMilestoneScopeChangeBundle({
+            store: this.store,
+            milestone,
+            prepared,
+            now,
+            readTask: readCandidateTask,
+        });
+        const projectRoot = this.store.projectRoot(identity.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        applyProjectTransaction({
+            projectRoot,
+            projectId: identity.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'audited-remediation-materialization',
+            now,
+            targets: [
+                ...(refreshedKnowledgeMap
+                    ? [{
+                            path: relative(path.join(projectRoot, 'knowledge-map.json')),
+                            content: `${JSON.stringify(refreshedKnowledgeMap, null, 2)}\n`,
+                        }]
+                    : []),
+                {
+                    path: relative(path.join(this.store.discoveryRoot(identity.projectId, discovery.id), 'state.json')),
+                    content: `${JSON.stringify(consumedDiscovery, null, 2)}\n`,
+                },
+                {
+                    path: relative(path.join(this.store.taskRoot(identity.projectId, remediationTaskId), 'brief.md')),
+                    content: normalizedBriefContent,
+                },
+                {
+                    path: relative(path.join(this.store.taskRoot(identity.projectId, remediationTaskId), 'state.json')),
+                    content: `${JSON.stringify(remediationTask, null, 2)}\n`,
+                },
+                {
+                    path: relative(path.join(this.store.milestoneRoot(identity.projectId, milestone.id), 'plan.json')),
+                    content: bundle.planContent,
+                },
+                {
+                    path: relative(path.join(this.store.milestoneRoot(identity.projectId, milestone.id), 'scope-change-events.jsonl')),
+                    content: bundle.sidecarContent,
+                },
+                {
+                    path: relative(path.join(this.store.milestoneRoot(identity.projectId, milestone.id), 'state.json')),
+                    content: bundle.stateContent,
+                },
+            ],
+            validate: () => {
+                const savedDiscovery = this.store.readDiscovery(identity.projectId, discovery.id);
+                const savedRemediationTask = this.store.readTask(identity.projectId, remediationTaskId);
+                const savedMilestone = this.readMilestoneCurrent(identity.projectId, milestone.id);
+                const savedBlockedMembership = savedMilestone.memberships
+                    .find((membership) => membership.taskId === blockedTask.id);
+                const savedRemediationMembership = savedMilestone.memberships
+                    .find((membership) => membership.taskId === remediationTaskId);
+                const savedAuthorization = [...savedMilestone.authorizations]
+                    .reverse()
+                    .find((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved');
+                const savedKnowledgeMap = this.store.readKnowledgeMap(identity.projectId);
+                if (savedDiscovery.materializedEntityId !== remediationTaskId
+                    || savedRemediationTask.milestoneId !== milestone.id
+                    || !savedBlockedMembership?.dependsOnTaskIds?.includes(remediationTaskId)
+                    || savedRemediationMembership?.disposition !== 'required'
+                    || savedAuthorization?.authorizationMode !== 'corrective-derived'
+                    || savedMilestone.status !== 'active'
+                    || (refreshedKnowledgeMap !== null
+                        && (savedKnowledgeMap.revision !== refreshedKnowledgeMap.revision
+                            || savedKnowledgeMap.status !== 'active'
+                            || savedKnowledgeMap.approval?.authorizationMode !== 'corrective-derived'))
+                    || locks.inspect(blockedTask.id) !== null) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Audited remediation transaction readback failed.');
+                }
+            },
+        });
+        return {
+            discovery: this.store.readDiscovery(identity.projectId, discovery.id),
+            remediationTask: this.store.readTask(identity.projectId, remediationTaskId),
+            blockedTask: this.store.readTask(identity.projectId, blockedTask.id),
+            milestone: this.readMilestoneCurrent(identity.projectId, milestone.id),
+            remediationEvidence,
+        };
+    }
     replaceSplitRequiredTask(repository, oldTaskId, expectedOldTaskRevision, discoveryId, expectedDiscoveryRevision, expectedMilestoneRevision, title, actor) {
         const { identity, locks } = this.#mutationContext(repository);
         const oldTask = this.store.readTask(identity.projectId, oldTaskId);
@@ -1266,11 +1616,14 @@ export class WorkflowService {
             || (event.decision === 'stop-escalate' && !overriddenStopDecisionEventIds.has(event.eventId)));
         const downstreamReplanRecovered = readDownstreamProofReplanRecoveries(this.store, task)
             .some((event) => event.resultTaskRevision === task.revision && event.reboundPlanHash === task.planHash);
-        const currentPlanRiskAudit = (task.status === 'needs_fix' || currentReplanDecisions.length > 0)
+        const currentPlanRiskAuditExists = task.planHash !== null && readPlanRiskAuditEvents(this.store, task).some((event) => event.briefHash === task.briefHash && event.planHash === task.planHash);
+        const currentPlanRiskAudit = (task.status === 'needs_fix'
+            || (task.steps.some((step) => step.status === 'failed') && currentPlanRiskAuditExists)
+            || currentReplanDecisions.length > 0)
             && !downstreamReplanRecovered
             ? readCurrentPlanRiskAudit(this.store, task)
             : null;
-        const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
+        const classifiedCorrectivePosture = currentPlanRiskAudit
             ? findCurrentGuardedRemediationPosture(this.store, task, currentPlanRiskAudit)
             : null;
         const correctiveReplanPosture = classifiedCorrectivePosture?.posture === 'replan-required'
@@ -1300,7 +1653,10 @@ export class WorkflowService {
                     : 'Use task corrective-replan-prepare, confirm, and execute.',
             });
         }
-        else if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
+        else if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)
+            && !(task.status === 'ready'
+                && correctiveReplanPosture?.posture === 'replan-required'
+                && correctiveReplanPosture.correctiveDecision === null)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
         }
         if (currentHardBlockingDecisions.length > 0) {
@@ -1370,7 +1726,8 @@ export class WorkflowService {
                 throw new WorkflowError('TRANSITION_BLOCKED', `Plan omits Task acceptance ${acceptance}.`);
             }
         }
-        if (task.planHash && task.status === 'needs_fix') {
+        if (task.planHash && (task.status === 'needs_fix'
+            || correctiveReplanPosture?.posture === 'replan-required')) {
             if (task.planObjective !== null && plan.objective !== task.planObjective) {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation may change the implementation Plan but not the Task objective.', {
                     taskId: task.id,
@@ -1392,14 +1749,16 @@ export class WorkflowService {
         const authorizations = task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
             ? { ...authorization, decision: 'superseded' }
             : authorization);
-        const completedIds = task.steps
-            .filter((candidate) => candidate.status === 'completed')
-            .map((candidate) => candidate.id);
-        const plannedSteps = plan.steps.map((step) => preserveCompletedStep(task, step) ?? ({
-            ...step,
-            status: dependenciesComplete(step, completedIds) ? 'planned' : 'blocked',
-            evidence: null,
-        }));
+        const retainedCompletedSteps = deriveCompletedStepCarryover(task, plan.steps);
+        const retainedCompletedIds = [...retainedCompletedSteps.keys()];
+        const plannedSteps = plan.steps.map((candidate) => {
+            const step = normalizePlanStep(candidate);
+            return retainedCompletedSteps.get(step.id) ?? ({
+                ...step,
+                status: dependenciesComplete(step, retainedCompletedIds) ? 'planned' : 'blocked',
+                evidence: null,
+            });
+        });
         const invalidatedStepCommits = [...new Set([
                 ...(task.invalidatedStepCommits ?? []),
                 ...omittedStepEvidenceCommits(task, plannedSteps),
@@ -1410,15 +1769,62 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', 'A failed review requires at least one new or changed remediation Step.');
         }
         if (correctiveReplanPosture?.posture === 'replan-required') {
-            const executionEvaluation = evaluateTaskCorrectiveReplanCandidate(task, correctiveReplanPosture, preparedPlan);
-            if (!executionEvaluation.allowed) {
-                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} rejected the candidate Plan for Task ${task.id}.`, {
-                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
-                    evaluationPhase: executionEvaluation.phase,
-                    blockingGuardIds: executionEvaluation.blockingGuardIds,
-                    pendingGuardIds: executionEvaluation.pendingGuardIds,
-                    guardResults: executionEvaluation.guardResults,
-                });
+            if (correctiveReplanPosture.correctiveDecision === null) {
+                const currentStep = task.steps.find((step) => step.id === correctiveReplanPosture.stepId) ?? null;
+                const candidateStep = plan.steps.find((step) => step.id === correctiveReplanPosture.stepId) ?? null;
+                const currentClassification = currentPlanRiskAudit?.audit.stepClassifications
+                    .find((classification) => classification.stepId === correctiveReplanPosture.stepId) ?? null;
+                const candidateClassification = planRiskAudit?.stepClassifications
+                    .find((classification) => classification.stepId === correctiveReplanPosture.stepId) ?? null;
+                const priorProductionEdges = task.productionEdges ?? [];
+                const candidateProductionEdgeKeys = new Set((plan.productionEdges ?? []).map((edge) => `${edge.ownerStepId}\0${edge.consumerStepId}\0${edge.checkRef}`));
+                const c1Posture = readTaskC1Posture(this.store, task);
+                const rawWriterLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+                const blockingGuardIds = [
+                    ...(task.steps.some((step) => step.status === 'in_progress')
+                        ? ['task.rolling-replan.no-step-in-progress']
+                        : []),
+                    ...(rawWriterLease ? ['task.rolling-replan.no-writer-lease'] : []),
+                    ...(c1Posture.state !== 'none' ? ['task.rolling-replan.no-c1-claim'] : []),
+                    ...(preparedPlan.planHash === task.planHash
+                        ? ['task.rolling-replan.semantic-plan-change']
+                        : []),
+                    ...(!preparedPlan.stepIds.includes(correctiveReplanPosture.stepId)
+                        ? ['task.rolling-replan.guarded-step-retained']
+                        : []),
+                    ...(!planRiskAudit || !candidateClassification || !currentClassification
+                        || !candidateClassification.reviewRequired
+                        || currentClassification.categories.some((category) => !candidateClassification.categories.includes(category))
+                        ? ['task.rolling-replan.guarded-review-classification-preserved']
+                        : []),
+                    ...(currentStep && candidateStep
+                        && currentStep.forbiddenScope.some((scope) => !candidateStep.forbiddenScope.includes(scope))
+                        ? ['task.rolling-replan.forbidden-scope-preserved']
+                        : []),
+                    ...((task.requiresProductionEdges === true && plan.requiresProductionEdges !== true)
+                        || priorProductionEdges.some((edge) => !candidateProductionEdgeKeys.has(`${edge.ownerStepId}\0${edge.consumerStepId}\0${edge.checkRef}`))
+                        ? ['task.rolling-replan.production-edge-boundary-preserved']
+                        : []),
+                ];
+                if (blockingGuardIds.length > 0) {
+                    throw new WorkflowError('TRANSITION_BLOCKED', `Rolling-wave root-cause replan rejected the candidate Plan for Task ${task.id}.`, {
+                        transitionId: 'task.plan.rolling-root-cause-replan',
+                        evaluationPhase: 'execution',
+                        blockingGuardIds,
+                    });
+                }
+            }
+            else {
+                const executionEvaluation = evaluateTaskCorrectiveReplanCandidate(task, correctiveReplanPosture, preparedPlan);
+                if (!executionEvaluation.allowed) {
+                    throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} rejected the candidate Plan for Task ${task.id}.`, {
+                        transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                        evaluationPhase: executionEvaluation.phase,
+                        blockingGuardIds: executionEvaluation.blockingGuardIds,
+                        pendingGuardIds: executionEvaluation.pendingGuardIds,
+                        guardResults: executionEvaluation.guardResults,
+                    });
+                }
             }
         }
         if (guardedRemediationGate && currentReplanDecisions.length === 0 && !plannedSteps.some((step) => step.id === guardedRemediationGate.stepId)) {
@@ -1441,6 +1847,8 @@ export class WorkflowService {
             knowledgeMapRevision: plan.knowledgeMapRevision,
             knowledgeMapHash: plan.knowledgeMapHash,
             graphUse: plan.graphUse,
+            productionEdges: structuredClone(plan.productionEdges ?? []),
+            requiresProductionEdges: plan.requiresProductionEdges === true,
             steps: plannedSteps,
             invalidatedStepCommits,
             authorizations,
@@ -1678,7 +2086,12 @@ export class WorkflowService {
                 requiredAction: 'task plan-set',
             });
         }
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
+        const correctiveAuthority = delegationGrantId === null
+            ? this.currentCorrectiveDerivedTaskAuthority(identity.projectId, task, actor)
+            : null;
+        const delegation = correctiveAuthority
+            ? null
+            : this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
         const event = {
             kind: 'execution',
             decision: 'approved',
@@ -1690,7 +2103,11 @@ export class WorkflowService {
             evidenceHash: hashMechanicalFeasibilityEvidence(mechanicalFeasibility),
             headCommit: mechanicalFeasibility.evaluatedHead,
             reason,
-            authorizationMode: delegation ? 'delegated' : 'human',
+            authorizationMode: correctiveAuthority
+                ? 'corrective-derived'
+                : delegation
+                    ? 'delegated'
+                    : 'human',
             ...(delegation ? { delegation } : {}),
             mechanicalFeasibility,
         };
@@ -1875,7 +2292,7 @@ export class WorkflowService {
         const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const action = String(navigation.action);
         const currentLease = context.locks.inspect(taskId);
-        const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed');
+        const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed', currentLease !== null);
         const requiredActor = writerTokenContract
             ? this.writerCredentialRecoveryActor(task, action, posture.state === 'claimed' ? posture.claimant : null, currentLease?.owner ?? null)
             : null;
@@ -1889,9 +2306,7 @@ export class WorkflowService {
                 nextAction: action,
             });
         }
-        const lease = currentLease
-            ? context.locks.replaceCredential(taskId, normalizedActor)
-            : context.locks.acquire(taskId, normalizedActor);
+        const lease = context.locks.replaceOrRecoverCredential(taskId, normalizedActor);
         if (posture.state === 'claimed') {
             appendTaskWriterCredentialReplacement(this.store, task, normalizedActor, lease.token, this.now());
         }
@@ -2010,6 +2425,7 @@ export class WorkflowService {
         }
         assertTaskBranch(context.identity.repositoryRoot, task);
         const step = requireStep(task, stepId);
+        const allowedWrites = effectiveStepAllowedWrites(this.store, task, stepId);
         const remediationHistoryForStep = readRemediationEvents(this.store, task).filter((event) => event.stepId === stepId);
         if (!['planned', 'failed'].includes(step.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} cannot start from ${step.status}.`);
@@ -2044,18 +2460,25 @@ export class WorkflowService {
         const downstreamProofCarryover = step.status === 'planned' && dirty.length > 0
             ? assessDownstreamProofCarryover(this.store, context.identity.repositoryRoot, task, stepId)
             : null;
+        const planIntegrityDirtyCarryover = step.status === 'planned' && dirty.length > 0
+            ? this.assessPostRebindCheckSupportDirtyCarryover(context.identity.repositoryRoot, task, stepId)
+            : null;
         if (step.status === 'planned'
             && dirty.length > 0
             && !resumesCorrectiveReplan
-            && !downstreamProofCarryover?.eligible) {
+            && !downstreamProofCarryover?.eligible
+            && !planIntegrityDirtyCarryover?.eligible) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
                 ...(downstreamProofCarryover?.applicable
                     ? { downstreamProofCarryoverBlockers: downstreamProofCarryover.blockers }
                     : {}),
+                ...(planIntegrityDirtyCarryover?.applicable
+                    ? { planIntegrityDirtyCarryoverBlockers: planIntegrityDirtyCarryover.blockers }
+                    : {}),
             });
         }
-        const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
+        const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, allowedWrites));
         if ((step.status === 'failed' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} retry has changes outside allowedWrites.`, {
                 changedFiles: dirtyOutsideStep,
@@ -2102,7 +2525,9 @@ export class WorkflowService {
                     return context.locks.acquire(taskId, actor.trim() || 'worker');
                 })();
         }
-        const steps = task.steps.map((candidate) => candidate.id === stepId ? { ...candidate, status: 'in_progress' } : candidate);
+        const steps = task.steps.map((candidate) => candidate.id === stepId
+            ? { ...candidate, status: 'in_progress', evidence: null, failurePause: null }
+            : candidate);
         let saved;
         try {
             saved = this.store.writeTask({ ...task, status: 'in_progress', steps, blockReason: null }, expectedRevision);
@@ -2126,7 +2551,7 @@ export class WorkflowService {
                     path.join(this.store.taskRoot(task.projectId, task.id), 'plan.md'),
                 ],
                 allowedReads: [identityRelative(context.identity.repositoryRoot, '.')],
-                allowedWrites: step.allowedWrites,
+                allowedWrites,
                 commands: step.checks,
                 forbiddenScope: [
                     ...step.forbiddenScope,
@@ -2245,6 +2670,7 @@ export class WorkflowService {
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, lease.token);
         assertTaskBranch(context.identity.repositoryRoot, task);
         const step = requireStep(task, stepId);
+        const allowedWrites = effectiveStepAllowedWrites(this.store, task, stepId);
         if (task.status !== 'in_progress' || step.status !== 'in_progress') {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} is not in progress.`);
         }
@@ -2277,18 +2703,114 @@ export class WorkflowService {
         const checks = runChecks(context.identity.repositoryRoot, step.checks);
         const failed = checks.filter((check) => !check.passed);
         if (failed.length > 0) {
-            if (reviewRequired && planRiskAudit) {
-                appendRemediationEvent(this.store, task, stepId, 'checks-failed', {
+            const now = this.now();
+            const normalizedFailures = normalizeMechanicalFailures(failed, context.identity.repositoryRoot);
+            // Bind useful uncommitted work to this failure without treating it as
+            // completed-Step authority.
+            const dirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+            const failurePause = {
+                recordedAt: now.toISOString(),
+                dirtyFiles,
+                dirtyWorktreeHash: hashDirtyWorktree(context.identity.repositoryRoot, dirtyFiles),
+                checksHash: sha256Hex(canonicalJsonStringify(checks)),
+                failedChecks: normalizedFailures,
+            };
+            const preparedRemediation = reviewRequired && planRiskAudit
+                ? prepareRemediationEvent(this.store, task, stepId, 'checks-failed', {
                     completionCommit: headCommit(context.identity.repositoryRoot),
                     checksHash: sha256Hex(canonicalJsonStringify(checks)),
                     reviewEventHash: null,
                     reviewerAttestationHash: null,
-                }, planRiskAudit, this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
-            }
-            const steps = task.steps.map((candidate) => candidate.id === stepId ? { ...candidate, status: 'failed' } : candidate);
-            return this.store.writeTask({ ...task, status: 'needs_fix', steps, blockReason: `${stepId} checks failed.` }, expectedRevision);
+                    executionTaskRevision: task.revision,
+                    dirtyWorktreeHash: failurePause.dirtyWorktreeHash,
+                }, planRiskAudit, now, this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot), mechanicalCauseBindings(normalizedFailures))
+                : null;
+            const steps = task.steps.map((candidate) => candidate.id === stepId
+                ? { ...candidate, status: 'failed', evidence: null, failurePause }
+                : candidate);
+            const paused = {
+                ...task,
+                revision: task.revision + 1,
+                updatedAt: now.toISOString(),
+                status: 'needs_fix',
+                steps,
+                blockReason: `${stepId} checks failed.`,
+            };
+            const stepHistory = readRemediationEvents(this.store, task)
+                .filter((event) => event.stepId === stepId);
+            const resultingHistory = !preparedRemediation || preparedRemediation.postimage === null
+                ? stepHistory
+                : [...stepHistory, preparedRemediation.event];
+            const rollingCauseDecision = deriveRollingCauseDecision(resultingHistory);
+            const c1Posture = readTaskC1Posture(this.store, task);
+            const preparedYield = rollingCauseDecision === 'root-cause-replan' && c1Posture.state === 'claimed'
+                ? prepareTaskCorrectiveYield(this.store, paused, {
+                    actor: c1Posture.claimant,
+                    writerToken: lease.token,
+                    reason: `Yield execution authority after repeated mechanical cause ${preparedRemediation.event.eventId}.`,
+                    eventId: `HOF-${sha256Hex([
+                        'checks-failed-root-cause-replan-pause-v1',
+                        task.id,
+                        String(task.revision),
+                        preparedRemediation.event.eventHash,
+                        c1Posture.claimant,
+                    ].join('\0'))}`,
+                }, now)
+                : null;
+            const projectRoot = this.store.projectRoot(task.projectId);
+            const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+            const taskRoot = this.store.taskRoot(task.projectId, task.id);
+            const failureHead = headCommit(context.identity.repositoryRoot);
+            applyProjectTransaction({
+                projectRoot,
+                projectId: task.projectId,
+                transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+                kind: rollingCauseDecision === 'root-cause-replan'
+                    ? 'failed-step-root-cause-replan-pause'
+                    : 'failed-step-continuation',
+                now,
+                targets: [
+                    ...(preparedRemediation?.postimage
+                        ? [{
+                                path: relative(path.join(taskRoot, 'remediation-events.jsonl')),
+                                content: preparedRemediation.postimage,
+                            }]
+                        : []),
+                    ...(preparedYield
+                        ? [{ path: relative(path.join(taskRoot, 'handoffs.jsonl')), content: preparedYield.postimage.toString('utf8') }]
+                        : []),
+                    { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(paused, null, 2)}\n` },
+                    { path: relative(path.join(this.store.lockRoot(task.projectId), `${task.id}.json`)), content: null },
+                ],
+                validate: () => {
+                    const saved = this.store.readTask(task.projectId, task.id);
+                    const savedStep = requireStep(saved, stepId);
+                    const readbackDirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+                    const remediationHash = preparedRemediation
+                        ? readRemediationEvents(this.store, saved).find((event) => event.eventId === preparedRemediation.event.eventId)?.eventHash ?? null
+                        : null;
+                    if (saved.revision !== paused.revision
+                        || saved.status !== 'needs_fix'
+                        || savedStep.status !== 'failed'
+                        || savedStep.failurePause?.dirtyWorktreeHash !== failurePause.dirtyWorktreeHash
+                        || savedStep.failurePause?.checksHash !== failurePause.checksHash
+                        || remediationHash !== (preparedRemediation?.event.eventHash ?? null)
+                        || context.locks.inspect(task.id) !== null
+                        || (preparedYield && readTaskC1Posture(this.store, saved).state !== 'none')
+                        || headCommit(context.identity.repositoryRoot) !== failureHead
+                        || JSON.stringify(readbackDirtyFiles) !== JSON.stringify(dirtyFiles)
+                        || hashDirtyWorktree(context.identity.repositoryRoot, readbackDirtyFiles) !== failurePause.dirtyWorktreeHash) {
+                        throw new WorkflowError('STATE_CORRUPT', 'Failed-Step continuation transaction readback failed.', {
+                            taskId,
+                            stepId,
+                        });
+                    }
+                    validateTaskHistory(context.identity.repositoryRoot, saved);
+                },
+            });
+            return this.store.readTask(task.projectId, task.id);
         }
-        const committed = commitStep(context.identity.repositoryRoot, task.id, step.id, step.title, step.allowedWrites);
+        const committed = commitStep(context.identity.repositoryRoot, task.id, step.id, step.title, allowedWrites);
         const evidence = {
             recordedAt: this.now().toISOString(),
             commitSha: committed.commitSha,
@@ -2327,7 +2849,7 @@ export class WorkflowService {
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        const reviewLease = this.proveWriterLeaseTokenForHandoff(context, taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         if (task.status !== 'in_progress' && task.status !== 'blocked') {
             throw new WorkflowError('TRANSITION_BLOCKED', `Strict Step Review cannot run while task ${taskId} is ${task.status}.`);
@@ -2398,18 +2920,14 @@ export class WorkflowService {
                         resolution: currentCycle.resolution,
                     });
                 }
-                appendRemediationEvent(this.store, task, stepId, 'review-failed', {
-                    completionCommit: currentCycle.reviewRecordedEvent.completionCommit,
-                    checksHash: currentCycle.reviewRecordedEvent.checksHash,
-                    reviewEventHash: currentCycle.reviewRecordedEvent.eventHash,
-                    reviewerAttestationHash: currentCycle.reviewerAttestationEvent.eventHash,
-                }, planRiskAudit, this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
+                return this.finalizeFailedStrictStepReview(context, task, stepId, expectedRevision, currentCycle.reviewRecordedEvent, currentCycle.reviewerAttestationEvent.eventHash, planRiskAudit, undefined, reviewLease);
             }
             return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, currentCycle.resolution), expectedRevision);
         }
         ensurePendingStrictStepReview(this.store, task, stepId, this.now());
         const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
-        const launch = launchStrictStepReviewer(context.identity.repositoryRoot, task, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence, runner);
+        const reviewTask = taskWithEffectiveStepAllowedWrites(this.store, task, stepId);
+        const launch = launchStrictStepReviewer(context.identity.repositoryRoot, reviewTask, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence, runner, reviewScopeAugmentations(this.store, task, stepId));
         const recorded = recordStrictStepReview(this.store, task, stepId, {
             review: launch.review,
             reviewerOutputHash: launch.reviewerOutputHash,
@@ -2426,16 +2944,11 @@ export class WorkflowService {
                     resolution: recorded.resolution,
                 });
             }
-            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
-                completionCommit: reviewRecordedEvent.completionCommit,
-                checksHash: reviewRecordedEvent.checksHash,
-                reviewEventHash: reviewRecordedEvent.eventHash,
-                reviewerAttestationHash: reviewerAttestationEvent.eventHash,
-            }, planRiskAudit, this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
+            return this.finalizeFailedStrictStepReview(context, task, stepId, expectedRevision, reviewRecordedEvent, reviewerAttestationEvent.eventHash, planRiskAudit, launch.review.summary, reviewLease);
         }
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
-    prepareExternalStepReview(repository, taskId, stepId, expectedRevision) {
+    prepareExternalStepReview(repository, taskId, stepId, expectedRevision, reviewMode = 'ordinary') {
         const identity = resolveRepositoryIdentity(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -2455,15 +2968,18 @@ export class WorkflowService {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Step Review requires a clean checkout at the completion commit.');
         }
         const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
-        return prepareExternalStrictStepReviewPacket(identity.repositoryRoot, task, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence);
+        return prepareExternalStrictStepReviewPacket(identity.repositoryRoot, taskWithEffectiveStepAllowedWrites(this.store, task, stepId), this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence, reviewScopeAugmentations(this.store, task, stepId), reviewMode);
     }
     recordExternalStepReview(repository, taskId, stepId, expectedRevision, input, actor, writerToken = null) {
         const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        const reviewLease = this.proveWriterLeaseTokenForHandoff(context, taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
-        const packet = this.prepareExternalStepReview(repository, taskId, stepId, expectedRevision);
+        if (input.reviewMode !== 'ordinary' && input.reviewMode !== 'security') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'External Step Review requires reviewMode ordinary or security.');
+        }
+        const packet = this.prepareExternalStepReview(repository, taskId, stepId, expectedRevision, input.reviewMode);
         let review;
         try {
             review = validateExternalStrictStepReviewInput(input, packet);
@@ -2498,23 +3014,131 @@ export class WorkflowService {
             isolationResult: 'verified',
         }, this.now());
         if (recorded.resolution === 'failed') {
-            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
-                completionCommit: recorded.reviewRecordedEvent.completionCommit,
-                checksHash: recorded.reviewRecordedEvent.checksHash,
-                reviewEventHash: recorded.reviewRecordedEvent.eventHash,
-                reviewerAttestationHash: recorded.reviewerAttestationEvent.eventHash,
-            }, readCurrentPlanRiskAudit(this.store, task), this.now(), this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot));
+            const saved = this.finalizeFailedStrictStepReview(context, task, stepId, expectedRevision, recorded.reviewRecordedEvent, recorded.reviewerAttestationEvent.eventHash, readCurrentPlanRiskAudit(this.store, task), review.summary, reviewLease);
+            return {
+                mode: 'external-sealed',
+                reviewMode: packet.reviewMode,
+                packetHash: packet.packetHash,
+                repositorySealHash: packet.repositorySealHash,
+                reviewerThreadId: input.reviewerThreadId,
+                task: saved,
+            };
         }
         const saved = this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, review.summary), expectedRevision);
         return {
             mode: 'external-sealed',
+            reviewMode: packet.reviewMode,
             packetHash: packet.packetHash,
             repositorySealHash: packet.repositorySealHash,
             reviewerThreadId: input.reviewerThreadId,
             task: saved,
         };
     }
-    prepareExternalTaskReview(repository, taskId, expectedRevision) {
+    finalizeFailedStrictStepReview(context, task, stepId, expectedRevision, reviewEvent, reviewerAttestationHash, planRiskAudit, summary, reviewLease) {
+        const now = this.now();
+        const preparedRemediation = prepareRemediationEvent(this.store, task, stepId, 'review-failed', {
+            completionCommit: reviewEvent.completionCommit,
+            checksHash: reviewEvent.checksHash,
+            reviewEventHash: reviewEvent.eventHash,
+            reviewerAttestationHash,
+        }, planRiskAudit, now, this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot), reviewCauseBindings(reviewEvent));
+        const stepHistory = readRemediationEvents(this.store, task)
+            .filter((event) => event.stepId === stepId);
+        const resultingHistory = preparedRemediation.postimage === null
+            ? stepHistory
+            : [...stepHistory, preparedRemediation.event];
+        const rollingCauseDecision = deriveRollingCauseDecision(resultingHistory);
+        const resolved = applyStrictStepReviewResolution(task, stepId, 'failed', summary);
+        const paused = {
+            ...resolved,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+        };
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        const failureHead = headCommit(context.identity.repositoryRoot);
+        const dirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+        const dirtyWorktreeHash = hashDirtyWorktree(context.identity.repositoryRoot, dirtyFiles);
+        const c1Posture = readTaskC1Posture(this.store, task);
+        if (rollingCauseDecision === 'root-cause-replan' && c1Posture.state === 'claimed' && !reviewLease) {
+            throw new WorkflowError('STATE_CONFLICT', 'Root-cause replan pause requires the claimed writer authority it will release.', {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        const preparedYield = rollingCauseDecision === 'root-cause-replan' && c1Posture.state === 'claimed' && reviewLease
+            ? prepareTaskCorrectiveYield(this.store, paused, {
+                actor: c1Posture.claimant,
+                writerToken: reviewLease.token,
+                reason: `Yield execution authority after repeated authoritative cause ${preparedRemediation.event.eventId}.`,
+                eventId: `HOF-${sha256Hex([
+                    'strict-review-root-cause-replan-pause-v1',
+                    task.id,
+                    String(task.revision),
+                    preparedRemediation.event.eventHash,
+                    c1Posture.claimant,
+                ].join('\0'))}`,
+            }, now)
+            : null;
+        if (reviewLease) {
+            const currentLease = context.locks.inspect(task.id);
+            if (!currentLease || currentLease.token !== reviewLease.token || currentLease.owner !== reviewLease.owner) {
+                throw new WorkflowError('STATE_CONFLICT', 'Strict Step Review writer authority changed before the failure pause could be recorded.', {
+                    taskId: task.id,
+                    stepId,
+                });
+            }
+        }
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: rollingCauseDecision === 'root-cause-replan'
+                ? 'strict-review-root-cause-replan-pause'
+                : 'strict-review-failed-step-pause',
+            now,
+            targets: [
+                ...(preparedRemediation.postimage
+                    ? [{
+                            path: relative(path.join(taskRoot, 'remediation-events.jsonl')),
+                            content: preparedRemediation.postimage,
+                        }]
+                    : []),
+                ...(preparedYield
+                    ? [{ path: relative(path.join(taskRoot, 'handoffs.jsonl')), content: preparedYield.postimage.toString('utf8') }]
+                    : []),
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(paused, null, 2)}\n` },
+                ...(reviewLease
+                    ? [{ path: relative(path.join(this.store.lockRoot(task.projectId), `${task.id}.json`)), content: null }]
+                    : []),
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const savedStep = requireStep(saved, stepId);
+                const savedRemediation = readRemediationEvents(this.store, saved)
+                    .find((event) => event.eventId === preparedRemediation.event.eventId) ?? null;
+                const readbackDirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+                if (saved.revision !== paused.revision
+                    || saved.status !== 'needs_fix'
+                    || savedStep.status !== 'failed'
+                    || savedRemediation?.eventHash !== preparedRemediation.event.eventHash
+                    || context.locks.inspect(task.id) !== null
+                    || (preparedYield && readTaskC1Posture(this.store, saved).state !== 'none')
+                    || headCommit(context.identity.repositoryRoot) !== failureHead
+                    || JSON.stringify(readbackDirtyFiles) !== JSON.stringify(dirtyFiles)
+                    || hashDirtyWorktree(context.identity.repositoryRoot, readbackDirtyFiles) !== dirtyWorktreeHash) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review failure-pause transaction readback failed.', {
+                        taskId: task.id,
+                        stepId,
+                    });
+                }
+                validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return this.store.readTask(task.projectId, task.id);
+    }
+    prepareExternalTaskReview(repository, taskId, expectedRevision, reviewMode = 'ordinary') {
         const identity = resolveRepositoryIdentity(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -2531,7 +3155,7 @@ export class WorkflowService {
         if (!task.evidenceHash || this.store.hashArtifact(taskRoot, 'evidence.json') !== task.evidenceHash) {
             throw new WorkflowError('STATE_CORRUPT', 'External Strict Task Review requires the exact submitted evidence artifact.');
         }
-        return prepareExternalStrictTaskReviewPacket(identity.repositoryRoot, task, taskRoot, this.taskContext(repository, taskId, 'independent-reviewer'));
+        return prepareExternalStrictTaskReviewPacket(identity.repositoryRoot, task, taskRoot, this.taskContext(repository, taskId, 'independent-reviewer'), task.steps.flatMap((step) => reviewScopeAugmentations(this.store, task, step.id)), reviewMode);
     }
     recordExternalTaskReview(repository, taskId, expectedRevision, input, actor, writerToken = null) {
         const context = this.#mutationContext(repository);
@@ -2539,7 +3163,10 @@ export class WorkflowService {
         assertExpectedRevision(task, expectedRevision);
         this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
-        const packet = this.prepareExternalTaskReview(repository, taskId, expectedRevision);
+        if (input.reviewMode !== 'ordinary' && input.reviewMode !== 'security') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'External Task Review requires reviewMode ordinary or security.');
+        }
+        const packet = this.prepareExternalTaskReview(repository, taskId, expectedRevision, input.reviewMode);
         let review;
         try {
             review = validateExternalStrictTaskReviewInput(input, packet);
@@ -2553,6 +3180,7 @@ export class WorkflowService {
         const saved = this.recordReview(repository, taskId, expectedRevision, review, actor, writerToken);
         return {
             mode: 'external-sealed',
+            reviewMode: packet.reviewMode,
             packetHash: packet.packetHash,
             repositorySealHash: packet.repositorySealHash,
             reviewerThreadId: input.reviewerThreadId,
@@ -2657,8 +3285,6 @@ export class WorkflowService {
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
-        this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
-        this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         assertTaskBranch(context.identity.repositoryRoot, task);
         this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
@@ -2690,6 +3316,20 @@ export class WorkflowService {
                 blockers: assessment.blockers,
             });
         }
+        const remediationEventIds = assessment.evidence.kind === 'missing-npm-script-outside-allowed-writes'
+            ? [assessment.evidence.remediationEventId]
+            : assessment.evidence.remediationEvents.map((event) => event.eventId);
+        const compatibility = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.commitSha === headCommit(context.identity.repositoryRoot)
+            && record.packageVersion === PACKAGE_VERSION
+            && task.systemCommits.includes(record.commitSha)
+            && record.planIntegrity?.stepId === stepId
+            && record.planIntegrity.planHash === task.planHash
+            && canonicalJsonStringify(record.planIntegrity.remediationEventIds) === canonicalJsonStringify(remediationEventIds)
+            && record.planIntegrity.dirtyWorktreeHash === hashDirtyWorktree(context.identity.repositoryRoot, record.planIntegrity.dirtyFiles));
+        if (!compatibility) {
+            this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
+            this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
+        }
         const event = appendPlanIntegrityRecoveryDecision(this.store, task, stepId, defaultPlanIntegrityRecoveryActor(task.id), assessment.evidence, this.now());
         return { assessment, event };
     }
@@ -2775,7 +3415,12 @@ export class WorkflowService {
         this.assertReviewFresh(identity.repositoryRoot, task);
         const resultHash = this.store.hashArtifact(root, 'result.md');
         const evidenceHash = this.store.hashArtifact(root, 'evidence.json');
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.final_accept', actor, task);
+        const correctiveAuthority = delegationGrantId === null
+            ? this.currentCorrectiveDerivedTaskAuthority(identity.projectId, task, actor)
+            : null;
+        const delegation = correctiveAuthority
+            ? null
+            : this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.final_accept', actor, task);
         const event = {
             kind: 'final_acceptance',
             decision: 'approved',
@@ -2787,7 +3432,11 @@ export class WorkflowService {
             evidenceHash,
             headCommit: headCommit(identity.repositoryRoot),
             reason: '',
-            authorizationMode: delegation ? 'delegated' : 'human',
+            authorizationMode: correctiveAuthority
+                ? 'corrective-derived'
+                : delegation
+                    ? 'delegated'
+                    : 'human',
             ...(delegation ? { delegation } : {}),
         };
         return this.store.writeTask({
@@ -2890,7 +3539,9 @@ export class WorkflowService {
         return saved;
     }
     status(repository) {
-        const snapshot = this.observationSnapshot(repository);
+        return this.statusFromSnapshot(this.observationSnapshot(repository));
+    }
+    statusFromSnapshot(snapshot) {
         return {
             projectId: snapshot.identity.projectId,
             discoveries: snapshot.discoveries,
@@ -2904,6 +3555,73 @@ export class WorkflowService {
             observation: snapshot.observation,
         };
     }
+    compactStatus(repository) {
+        const snapshot = this.observationSnapshot(repository);
+        const status = this.statusFromSnapshot(snapshot);
+        const next = this.nextFromStatus(repository, null, status);
+        const routedId = typeof next.id === 'string'
+            ? next.id
+            : typeof next.taskId === 'string'
+                ? next.taskId
+                : null;
+        const activeTask = routedId === null
+            ? null
+            : snapshot.tasks.find((task) => task.id === routedId) ?? null;
+        const routedStepId = typeof next.stepId === 'string' ? next.stepId : null;
+        const activeStep = activeTask === null
+            ? null
+            : routedStepId === null
+                ? activeTask.steps.find((step) => step.status === 'in_progress')
+                    ?? activeTask.steps.find((step) => step.status === 'failed')
+                    ?? null
+                : activeTask.steps.find((step) => step.id === routedStepId) ?? null;
+        const action = typeof next.action === 'string' ? next.action : 'blocked';
+        const blockedAction = typeof next.blockedAction === 'string' ? next.blockedAction : null;
+        const navigation = next.navigation && typeof next.navigation === 'object' && !Array.isArray(next.navigation)
+            ? next.navigation
+            : null;
+        const route = {
+            scope: typeof next.scope === 'string' ? next.scope : null,
+            status: typeof next.status === 'string' ? next.status : null,
+            entityId: routedId,
+            navigationKind: navigation && typeof navigation.kind === 'string' ? navigation.kind : null,
+            transitionId: navigation && typeof navigation.transitionId === 'string' ? navigation.transitionId : null,
+        };
+        const routeFingerprint = sha256Hex(canonicalJsonStringify({
+            projectId: snapshot.identity.projectId,
+            taskId: activeTask?.id ?? null,
+            taskRevision: activeTask?.revision ?? null,
+            stepId: activeStep?.id ?? routedStepId,
+            action,
+            blockedAction,
+            route,
+            observationKind: snapshot.observation.kind,
+            observationReasonCodes: snapshot.observation.reasonCodes,
+        }));
+        return {
+            projection: 'codex-workflow-compact-status-v1',
+            bounded: true,
+            projectId: snapshot.identity.projectId,
+            counts: {
+                discoveries: snapshot.discoveries.length,
+                tasks: snapshot.tasks.length,
+                milestones: snapshot.milestones.length,
+                delegations: snapshot.delegations.length,
+            },
+            activeTask: activeTask
+                ? { id: activeTask.id, revision: activeTask.revision, status: activeTask.status }
+                : null,
+            activeStep: activeStep ? { id: activeStep.id, status: activeStep.status } : null,
+            action,
+            blockedAction,
+            routeFingerprint,
+            route,
+            observation: {
+                kind: snapshot.observation.kind,
+                reasonCodes: [...snapshot.observation.reasonCodes],
+            },
+        };
+    }
     recoverMilestoneTransactions(repository) {
         const { identity } = this.#mutationContext(repository);
         const milestones = this.listMilestonesCurrent(identity.projectId, readCurrentAdoptionPosture(this.store, identity.projectId));
@@ -3239,12 +3957,179 @@ export class WorkflowService {
             dirtyWorktreeHash: assessment.compatibility?.dirtyWorktreeHash ?? null,
             requiredTransport: [
                 'Commit only package.json and package-lock.json on the active Milestone base.',
-                'Commit only the same dependency files on the Task branch while preserving all product bytes.',
-                'Install the exact target package, then follow fresh next to dependency registration.',
+                'Commit only the same dependency files on the Task branch while preserving all product bytes.',
+                'Install the exact target package, then follow fresh next to dependency registration.',
+            ],
+            blockers,
+        };
+    }
+    planIntegrityUpdatePreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity update preflight requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const assessments = task.steps
+            .filter((step) => step.status === 'failed')
+            .map((step) => assessPlanIntegrityRecovery(this.store, snapshot.identity.repositoryRoot, task, step.id))
+            .filter((assessment) => assessment.applicable);
+        const assessment = assessments.length === 1 ? assessments[0] : null;
+        const adoptedCompatibility = assessment
+            ? null
+            : this.postRebindCheckSupportCompatibility(snapshot, task);
+        const dirtyCarryoverAssessment = assessment || adoptedCompatibility
+            ? null
+            : this.assessPostRebindCheckSupportDirtyCarryover(snapshot.identity.repositoryRoot, task);
+        const dirtyCarryoverCompatibility = dirtyCarryoverAssessment?.eligible
+            && dirtyCarryoverAssessment.compatibility
+            ? {
+                ...dirtyCarryoverAssessment.compatibility,
+                planHash: task.planHash,
+                mode: 'post-rebind-dirty-carryover',
+            }
+            : null;
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const versionSurfaces = {
+            declared: versions.declared,
+            locked: versions.locked,
+            installed: versions.installed,
+            currentBranch: versions.currentBranch,
+            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+        };
+        const sourceVersion = versionSurfaces.declared;
+        const sourceBetaVersion = parseWorkflowBetaVersion(sourceVersion);
+        const targetBetaVersion = parseWorkflowBetaVersion(PACKAGE_VERSION);
+        const sourceIsEligibleBeta12 = sourceBetaVersion?.train === 12
+            && sourceBetaVersion.patch !== null
+            && sourceBetaVersion.patch >= 11;
+        const targetIsNewer = sourceBetaVersion !== null
+            && targetBetaVersion !== null
+            && (targetBetaVersion.train > sourceBetaVersion.train
+                || (targetBetaVersion.train === sourceBetaVersion.train
+                    && targetBetaVersion.patch !== null
+                    && sourceBetaVersion.patch !== null
+                    && targetBetaVersion.patch > sourceBetaVersion.patch));
+        const blockers = [
+            ...(assessments.length > 1 ? ['Exactly one failed Step may expose a Plan-integrity conflict.'] : []),
+            ...(assessment?.blockers ?? (adoptedCompatibility || dirtyCarryoverCompatibility
+                ? []
+                : (dirtyCarryoverAssessment?.blockers.length
+                    ? dirtyCarryoverAssessment.blockers
+                    : ['No eligible Plan-integrity conflict, post-rebind scope adoption, or dirty carryover was found.']))),
+            ...(!sourceIsEligibleBeta12 || !targetIsNewer
+                ? [`Declared Workflow source ${sourceVersion ?? 'missing'} must be an exact beta.12 patch at or after beta.12.11 and older than runner ${PACKAGE_VERSION}.`]
+                : []),
+            ...Object.entries(versionSurfaces)
+                .filter(([, version]) => version !== sourceVersion)
+                .map(([surface, version]) => `${surface} Workflow version ${version ?? 'missing'} must equal the declared source ${sourceVersion ?? 'missing'}.`),
+            ...(snapshot.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
+            ...observationPreflightBlockers(snapshot.observation),
+        ];
+        return {
+            readOnly: true,
+            eligible: Boolean(assessment?.eligible || adoptedCompatibility || dirtyCarryoverCompatibility) && blockers.length === 0,
+            action: (assessment?.eligible || adoptedCompatibility || dirtyCarryoverCompatibility) && blockers.length === 0
+                ? 'update plan-integrity-transport'
+                : null,
+            projectId: task.projectId,
+            taskId: task.id,
+            taskRevision: task.revision,
+            stepId: assessment?.stepId ?? adoptedCompatibility?.stepId ?? dirtyCarryoverCompatibility?.stepId ?? null,
+            sourceVersion,
+            targetVersion: PACKAGE_VERSION,
+            taskBranch: task.taskBranch,
+            baseBranch: task.baseBranch,
+            dirtyFiles: assessment?.evidence?.changedFiles
+                ?? adoptedCompatibility?.dirtyFiles
+                ?? dirtyCarryoverCompatibility?.dirtyFiles
+                ?? [],
+            conflictHash: assessment?.evidence?.conflictHash
+                ?? adoptedCompatibility?.conflictHash
+                ?? dirtyCarryoverCompatibility?.conflictHash
+                ?? null,
+            compatibilityMode: adoptedCompatibility?.mode
+                ?? dirtyCarryoverCompatibility?.mode
+                ?? 'failed-step-conflict',
+            requiredTransport: [
+                'Commit only package.json and package-lock.json on the active Milestone base.',
+                'Fast-forward or apply only that dependency commit to the Task branch while preserving all product bytes.',
+                'Install the exact target package, then follow fresh next to Plan-integrity dependency registration.',
             ],
             blockers,
         };
     }
+    planIntegrityDependencyRecoveryPreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity dependency recovery requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const assessmentBlockers = [];
+        const assessments = task.steps
+            .filter((step) => step.status === 'failed')
+            .flatMap((step) => {
+            try {
+                return [assessPlanIntegrityRecovery(this.store, snapshot.identity.repositoryRoot, task, step.id)];
+            }
+            catch (error) {
+                if (error instanceof WorkflowError && error.code === 'STATE_CORRUPT') {
+                    assessmentBlockers.push(`Plan-integrity compatibility cannot be assessed until the existing remediation history is repaired: ${error.message}`);
+                    return [];
+                }
+                throw error;
+            }
+        })
+            .filter((assessment) => assessment.applicable && assessment.eligible && assessment.evidence);
+        const assessment = assessments.length === 1 ? assessments[0] : null;
+        const adoptedCompatibility = assessment?.evidence
+            ? null
+            : this.postRebindCheckSupportCompatibility(snapshot, task);
+        const dirtyCarryoverCompatibility = assessment?.evidence || adoptedCompatibility
+            ? null
+            : this.carriedPostRebindCheckSupportDirtyCarryover(snapshot, task);
+        const carriedCompatibility = !assessment?.evidence && task.planHash
+            ? this.carriedPlanIntegrityUpdateCompatibility(snapshot, task)
+            : null;
+        if ((!assessment?.evidence
+            && !carriedCompatibility
+            && !adoptedCompatibility
+            && !dirtyCarryoverCompatibility) || !task.planHash) {
+            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
+            return {
+                ...ordinary,
+                eligible: false,
+                action: null,
+                planIntegrity: null,
+                blockers: [...new Set([
+                        ...ordinary.blockers,
+                        ...assessmentBlockers,
+                        'The dependency candidate must preserve one exact eligible Plan-integrity conflict.',
+                    ])],
+            };
+        }
+        const compatibility = carriedCompatibility
+            ?? adoptedCompatibility
+            ?? dirtyCarryoverCompatibility
+            ?? {
+                stepId: assessment.stepId,
+                planHash: task.planHash,
+                conflictHash: assessment.evidence.conflictHash,
+                dirtyFiles: [...assessment.evidence.changedFiles],
+                dirtyWorktreeHash: hashDirtyWorktree(snapshot.identity.repositoryRoot, assessment.evidence.changedFiles),
+                remediationEventIds: assessment.evidence.kind === 'missing-npm-script-outside-allowed-writes'
+                    ? [assessment.evidence.remediationEventId]
+                    : assessment.evidence.remediationEvents.map((event) => event.eventId),
+            };
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, null, compatibility);
+    }
     downstreamProofReplanDependencyRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
         if (snapshot.observation.kind !== 'assessment') {
@@ -3299,6 +4184,9 @@ export class WorkflowService {
     recoverHistoricalStepDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'historical-step');
     }
+    recoverPlanIntegrityDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
+        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'plan-integrity');
+    }
     recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, recoveryMode) {
         const normalizedActor = actor.trim();
         const normalizedReason = reason.trim();
@@ -3315,7 +4203,9 @@ export class WorkflowService {
                 ? Boolean(record.downstreamProofReplan)
                 : recoveryMode === 'historical-step'
                     ? Boolean(record.historicalStepProvenance)
-                    : Boolean(record.activeDownstreamProof) === recoveryMode));
+                    : recoveryMode === 'plan-integrity'
+                        ? Boolean(record.planIntegrity)
+                        : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -3327,42 +4217,113 @@ export class WorkflowService {
             ? this.downstreamProofReplanDependencyRecoveryPreflight(repository, taskId)
             : recoveryMode === 'historical-step'
                 ? this.historicalStepDependencyRecoveryPreflight(repository, taskId)
-                : recoveryMode
-                    ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
-                    : this.inspectDependencyProvenanceCandidate(snapshot, task);
+                : recoveryMode === 'plan-integrity'
+                    ? this.planIntegrityDependencyRecoveryPreflight(repository, taskId)
+                    : recoveryMode
+                        ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
+                        : this.inspectDependencyProvenanceCandidate(snapshot, task);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
                 blockers: preflight.blockers,
             });
         }
-        return context.store.writeTask({
+        const now = this.now();
+        const recoveredRecords = preflight.dependencyCommits.map((dependencyCommit, index) => {
+            const isTerminalCommit = index === preflight.dependencyCommits.length - 1;
+            return {
+                commitSha: dependencyCommit.commitSha,
+                parentCommitSha: dependencyCommit.parentCommitSha,
+                packageName: PACKAGE_NAME,
+                packageVersion: dependencyCommit.packageVersion,
+                files: ['package-lock.json', 'package.json'],
+                actor: normalizedActor,
+                reason: normalizedReason,
+                recordedAt: now.toISOString(),
+                retainedHistoricalCommits: isTerminalCommit ? preflight.retainedHistoricalCommits : [],
+                ...(isTerminalCommit && preflight.activeDownstreamProof
+                    ? { activeDownstreamProof: preflight.activeDownstreamProof }
+                    : {}),
+                ...(isTerminalCommit && preflight.downstreamProofReplan
+                    ? { downstreamProofReplan: preflight.downstreamProofReplan }
+                    : {}),
+                ...(isTerminalCommit && preflight.historicalStepProvenance
+                    ? { historicalStepProvenance: preflight.historicalStepProvenance }
+                    : {}),
+                ...(isTerminalCommit && preflight.planIntegrity
+                    ? { planIntegrity: preflight.planIntegrity }
+                    : {}),
+            };
+        });
+        const nextTask = {
             ...task,
-            systemCommits: [...task.systemCommits, preflight.commitSha],
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            systemCommits: [
+                ...task.systemCommits,
+                ...preflight.dependencyCommits.map((dependencyCommit) => dependencyCommit.commitSha),
+            ],
             dependencyProvenanceRecoveries: [
                 ...(task.dependencyProvenanceRecoveries ?? []),
+                ...recoveredRecords,
+            ],
+        };
+        if (recoveryMode !== 'plan-integrity' || !preflight.planIntegrity) {
+            return context.store.writeTask({ ...nextTask, revision: task.revision }, expectedRevision);
+        }
+        const currentKnowledgeMap = this.store.readKnowledgeMap(task.projectId);
+        const scannedKnowledgeMap = scanProjectKnowledge(context.identity.repositoryRoot, task.projectId, now);
+        const inspectedKnowledgeMap = inspectKnowledgeMap(currentKnowledgeMap, scannedKnowledgeMap);
+        let refreshedKnowledgeMap = null;
+        if (inspectedKnowledgeMap.status !== 'active' || !inspectedKnowledgeMap.approval) {
+            const knowledgeRefresh = inspectDependencyKnowledgeRefresh(context.identity.repositoryRoot, task.baseBranch, currentKnowledgeMap, inspectedKnowledgeMap, preflight.planIntegrity.dirtyFiles);
+            if (!knowledgeRefresh.eligible) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity dependency recovery cannot bypass unrelated Project Knowledge drift.', {
+                    taskId,
+                    dependencyKnowledgeRefresh: knowledgeRefresh,
+                });
+            }
+            const reconciled = reconcileKnowledgeMap(currentKnowledgeMap, scannedKnowledgeMap);
+            const approved = applyKnowledgeSelections(reconciled, [], normalizedActor, now);
+            if (!approved.approval) {
+                throw new WorkflowError('STATE_CORRUPT', 'Plan-integrity dependency Knowledge refresh produced no approval evidence.');
+            }
+            refreshedKnowledgeMap = {
+                ...approved,
+                revision: currentKnowledgeMap.revision + 2,
+                createdAt: currentKnowledgeMap.createdAt,
+                updatedAt: now.toISOString(),
+                approval: { ...approved.approval, authorizationMode: 'corrective-derived' },
+            };
+        }
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'plan-integrity-dependency-recovery',
+            now,
+            targets: [
+                ...(refreshedKnowledgeMap
+                    ? [{ path: relative(path.join(projectRoot, 'knowledge-map.json')), content: `${JSON.stringify(refreshedKnowledgeMap, null, 2)}\n` }]
+                    : []),
                 {
-                    commitSha: preflight.commitSha,
-                    parentCommitSha: preflight.parentCommitSha,
-                    packageName: PACKAGE_NAME,
-                    packageVersion: PACKAGE_VERSION,
-                    files: ['package-lock.json', 'package.json'],
-                    actor: normalizedActor,
-                    reason: normalizedReason,
-                    recordedAt: this.now().toISOString(),
-                    retainedHistoricalCommits: preflight.retainedHistoricalCommits,
-                    ...(preflight.activeDownstreamProof
-                        ? { activeDownstreamProof: preflight.activeDownstreamProof }
-                        : {}),
-                    ...(preflight.downstreamProofReplan
-                        ? { downstreamProofReplan: preflight.downstreamProofReplan }
-                        : {}),
-                    ...(preflight.historicalStepProvenance
-                        ? { historicalStepProvenance: preflight.historicalStepProvenance }
-                        : {}),
+                    path: relative(path.join(this.store.taskRoot(task.projectId, task.id), 'state.json')),
+                    content: `${JSON.stringify(nextTask, null, 2)}\n`,
                 },
             ],
-        }, expectedRevision);
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                if (saved.revision !== nextTask.revision || saved.systemCommits.at(-1) !== preflight.commitSha) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Plan-integrity dependency recovery Task readback failed.', { taskId });
+                }
+                if (refreshedKnowledgeMap && this.store.readKnowledgeMap(task.projectId).revision !== refreshedKnowledgeMap.revision) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Plan-integrity dependency Knowledge refresh readback failed.', { taskId });
+                }
+            },
+        });
+        return this.store.readTask(task.projectId, task.id);
     }
     milestoneProgress(repository, milestoneId) {
         const snapshot = this.observationSnapshot(repository);
@@ -3619,7 +4580,9 @@ export class WorkflowService {
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
     next(repository, taskId = null) {
-        const status = this.status(repository);
+        return withObservedRouteMetadata(this.nextFromStatus(repository, taskId, this.statusFromSnapshot(this.observationSnapshot(repository))));
+    }
+    nextFromStatus(repository, taskId, status) {
         if (status.observation.kind === 'blocked') {
             return {
                 scope: 'project',
@@ -3759,7 +4722,24 @@ export class WorkflowService {
                 ...(dependency ? { dependency } : {}),
             });
         }
+        const prioritizedRemediationTask = status.milestones.flatMap((milestone) => {
+            if (milestone.status !== 'active')
+                return [];
+            const event = [...readMilestoneScopeChangeEvents(this.store, status.projectId, milestone.id)]
+                .reverse()
+                .find((candidate) => candidate.authorizationMode === 'audited-remediation'
+                && candidate.candidatePlanHash === milestone.planHash
+                && candidate.remediationEvidence?.remediationTaskId);
+            if (!event?.remediationEvidence)
+                return [];
+            const task = tasksById.get(event.remediationEvidence.remediationTaskId);
+            return task
+                && taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
+                ? [task]
+                : [];
+        }).at(0) ?? null;
         const activeTask = requestedTask
+            ?? prioritizedRemediationTask
             ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
             const historicalStepProvenanceRecovery = this.historicalStepProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
@@ -3789,6 +4769,22 @@ export class WorkflowService {
                     },
                 });
             }
+            const planIntegrityDependencyRecovery = this.planIntegrityDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
+            if (planIntegrityDependencyRecovery.eligible) {
+                return withAdoption({
+                    scope: 'task',
+                    id: activeTask.id,
+                    status: activeTask.status,
+                    action: 'update plan-integrity-dependency-recover',
+                    revision: activeTask.revision,
+                    dependencyProvenanceRecovery: planIntegrityDependencyRecovery,
+                    compatibilityBoundary: {
+                        preservesWorktree: true,
+                        prerequisite: 'A newer package preflight approved the exact failed Step, remediation history, and dirty allowlist before dependency-only transport.',
+                        continuation: 'Register this dependency commit, then follow fresh next to Plan-integrity recovery and corrective replan.',
+                    },
+                });
+            }
             const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (dependencyRecovery.eligible) {
                 return withAdoption({
@@ -3915,41 +4911,132 @@ export class WorkflowService {
                     if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
                         throw error;
                     const blockingDecision = error.details.decision;
-                    planRiskAuditRecovery = blockingDecision === 'stop-escalate' || blockingDecision === 'split-required'
+                    const blockingAudit = readPlanRiskAuditEvents(this.store, activeTask).at(-1) ?? null;
+                    const existingRemediationEvent = blockingAudit && activeTask.milestoneId
+                        ? [...readMilestoneScopeChangeEvents(this.store, status.projectId, activeTask.milestoneId)]
+                            .reverse()
+                            .find((event) => event.authorizationMode === 'audited-remediation'
+                            && event.remediationEvidence?.planRiskAuditEventHash === blockingAudit.eventHash) ?? null
+                        : null;
+                    const existingRemediationTask = existingRemediationEvent?.remediationEvidence
+                        ? tasksById.get(existingRemediationEvent.remediationEvidence.remediationTaskId) ?? null
+                        : null;
+                    const remediationDiscovery = status.discoveries.find((discovery) => !['materialized', 'abandoned'].includes(discovery.status)) ?? null;
+                    const remediationMilestone = activeTask.milestoneId
+                        ? milestonesById.get(activeTask.milestoneId) ?? null
+                        : null;
+                    const remediationMemberships = remediationMilestone
+                        ? new Map(remediationMilestone.memberships.map((membership) => [membership.taskId, membership]))
+                        : new Map();
+                    const remediationMembership = remediationMemberships.get(activeTask.id) ?? null;
+                    const auditedRemediationEligible = activeTask.status === 'awaiting_execution_authorization'
+                        && remediationMilestone?.status === 'active'
+                        && remediationMembership?.disposition === 'required';
+                    const remediationAncestorIds = new Set();
+                    const visitRemediationAncestors = (candidateTaskId) => {
+                        for (const predecessorTaskId of remediationMemberships.get(candidateTaskId)?.dependsOnTaskIds ?? []) {
+                            if (remediationAncestorIds.has(predecessorTaskId))
+                                continue;
+                            remediationAncestorIds.add(predecessorTaskId);
+                            visitRemediationAncestors(predecessorTaskId);
+                        }
+                    };
+                    visitRemediationAncestors(activeTask.id);
+                    const eligibleRemediationPredecessorTaskIds = [...remediationAncestorIds]
+                        .filter((candidateTaskId) => tasksById.get(candidateTaskId)?.status === 'merged')
+                        .sort();
+                    planRiskAuditRecovery = blockingDecision === 'stop-escalate' && auditedRemediationEligible
                         ? {
                             scope: 'task',
                             id: activeTask.id,
                             status: activeTask.status,
-                            action: blockingDecision === 'stop-escalate' ? 'task plan-set' : 'doctor',
+                            action: existingRemediationTask?.status === 'merged'
+                                ? 'task plan-set'
+                                : existingRemediationTask
+                                    ? 'doctor'
+                                    : remediationDiscovery?.status === 'ready_to_materialize'
+                                        ? 'milestone remediation-materialize'
+                                        : remediationDiscovery
+                                            ? 'discovery update'
+                                            : 'discovery start',
                             blockedAction: 'task authorize',
                             revision: activeTask.revision,
                             planRiskAuditDecision: {
                                 state: 'recorded-blocking',
                                 decision: blockingDecision,
                                 reason: error.message,
-                                requiredAction: blockingDecision === 'stop-escalate'
-                                    ? 'Replace the rejected Step Plan before requesting fresh authorization.'
-                                    : 'Resolve the required cross-Task split through an explicit Milestone topology decision.',
+                                requiredAction: 'Materialize one audited additive remediation Task, merge it, then replace the rejected Plan.',
                             },
-                            ...(blockingDecision === 'stop-escalate'
-                                ? { taskPlanContract: this.taskPlanContract(status.projectId, activeTask) }
-                                : {}),
-                        }
-                        : {
-                            scope: 'task',
-                            id: activeTask.id,
-                            status: activeTask.status,
-                            action: 'task plan-risk-audit',
-                            revision: activeTask.revision,
-                            planRiskAuditRecovery: {
-                                state: 'required',
-                                reason: error.message,
-                                currentBriefHash: activeTask.briefHash,
-                                currentPlanHash: activeTask.planHash,
-                                knowledgeMapRevision: activeTask.knowledgeMapRevision,
-                                knowledgeMapHash: activeTask.knowledgeMapHash,
+                            auditedRemediation: {
+                                state: existingRemediationTask?.status === 'merged'
+                                    ? 'merged-replan-required'
+                                    : existingRemediationTask
+                                        ? 'materialized-not-merged'
+                                        : remediationDiscovery?.status === 'ready_to_materialize'
+                                            ? 'ready-to-materialize'
+                                            : 'discovery-required',
+                                humanApprovalRequired: false,
+                                blockedTaskId: activeTask.id,
+                                blockedTaskRevision: activeTask.revision,
+                                milestoneId: remediationMilestone.id,
+                                milestoneRevision: remediationMilestone.revision,
+                                planRiskAuditEventId: blockingAudit?.eventId ?? null,
+                                planRiskAuditEventHash: blockingAudit?.eventHash ?? null,
+                                discoveryId: remediationDiscovery?.id ?? null,
+                                discoveryRevision: remediationDiscovery?.revision ?? null,
+                                remediationTaskId: existingRemediationTask?.id ?? null,
+                                remediationTaskStatus: existingRemediationTask?.status ?? null,
+                                requiredPredecessorTaskIds: [...(remediationMembership.dependsOnTaskIds ?? [])],
+                                eligibleMergedAncestorTaskIds: eligibleRemediationPredecessorTaskIds,
+                                command: existingRemediationTask?.status === 'merged'
+                                    ? 'task plan-set'
+                                    : existingRemediationTask
+                                        ? 'doctor'
+                                        : remediationDiscovery?.status === 'ready_to_materialize'
+                                            ? 'milestone remediation-materialize'
+                                            : remediationDiscovery
+                                                ? 'discovery update'
+                                                : 'discovery start',
+                                boundedEffect: 'append-one-required-remediation-task-and-add-one-blocked-task-dependency',
+                                preservesMilestoneSemantics: true,
                             },
-                        };
+                            taskPlanContract: this.taskPlanContract(status.projectId, activeTask),
+                        }
+                        : blockingDecision === 'stop-escalate' || blockingDecision === 'split-required'
+                            ? {
+                                scope: 'task',
+                                id: activeTask.id,
+                                status: activeTask.status,
+                                action: blockingDecision === 'stop-escalate' ? 'task plan-set' : 'doctor',
+                                blockedAction: 'task authorize',
+                                revision: activeTask.revision,
+                                planRiskAuditDecision: {
+                                    state: 'recorded-blocking',
+                                    decision: blockingDecision,
+                                    reason: error.message,
+                                    requiredAction: blockingDecision === 'stop-escalate'
+                                        ? 'Replace the rejected Step Plan before requesting fresh authorization.'
+                                        : 'Resolve the required cross-Task split through an explicit Milestone topology decision.',
+                                },
+                                ...(blockingDecision === 'stop-escalate'
+                                    ? { taskPlanContract: this.taskPlanContract(status.projectId, activeTask) }
+                                    : {}),
+                            }
+                            : {
+                                scope: 'task',
+                                id: activeTask.id,
+                                status: activeTask.status,
+                                action: 'task plan-risk-audit',
+                                revision: activeTask.revision,
+                                planRiskAuditRecovery: {
+                                    state: 'required',
+                                    reason: error.message,
+                                    currentBriefHash: activeTask.briefHash,
+                                    currentPlanHash: activeTask.planHash,
+                                    knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                                    knowledgeMapHash: activeTask.knowledgeMapHash,
+                                },
+                            };
                 }
             }
             const taskNext = activeTask.status === 'planning'
@@ -3958,6 +5045,37 @@ export class WorkflowService {
                     ? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, null)
                     : planRiskAuditRecovery
                         ?? this.nextForTaskWithDelegation(status.projectId, repositoryRoot, activeTask, activePlanRiskAudit);
+            const auditedRemediationNavigation = taskNext?.auditedRemediation;
+            let auditedDependencyKnowledgeRefreshBlocked = null;
+            if (auditedRemediationNavigation
+                && activeTaskMilestone
+                && ['discovery start', 'discovery update', 'milestone remediation-materialize'].includes(String(taskNext?.action))) {
+                try {
+                    const storedKnowledgeMap = this.store.readKnowledgeMap(status.projectId);
+                    const inspectedKnowledgeMap = inspectCurrentKnowledgeMap();
+                    if (inspectedKnowledgeMap.status !== 'active' || !inspectedKnowledgeMap.approval) {
+                        const dependencyKnowledgeRefresh = inspectDependencyKnowledgeRefresh(repositoryRoot, activeTaskMilestone.baseBranch, storedKnowledgeMap, inspectedKnowledgeMap);
+                        if (dependencyKnowledgeRefresh.eligible) {
+                            return withAdoption(withMilestoneCancellation({
+                                ...taskNext,
+                                auditedRemediation: {
+                                    ...auditedRemediationNavigation,
+                                    dependencyKnowledgeRefresh: {
+                                        ...dependencyKnowledgeRefresh,
+                                        humanApprovalRequired: false,
+                                        application: 'atomic-with-remediation-materialization',
+                                    },
+                                },
+                            }));
+                        }
+                        auditedDependencyKnowledgeRefreshBlocked = dependencyKnowledgeRefresh;
+                    }
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                        throw error;
+                }
+            }
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -3967,8 +5085,12 @@ export class WorkflowService {
                 || taskNext?.action === 'task step-review'
                 || taskNext?.action === 'task downstream-proof-recover'
                 || taskNext?.action === 'task remediation-mode-recover'
+                || (taskNext?.action === 'task writer-credential-replace'
+                    && taskNext?.blockedAction === 'task remediation-mode-recover')
                 || taskNext?.action === 'task plan-integrity-recover'
                 || taskNext?.blockedAction === 'task plan-integrity-recover'
+                || taskNext?.action === 'task corrective-yield'
+                || String(taskNext?.action ?? '').startsWith('task corrective-replan')
                 || hardStop
                 || terminalCorrectiveDecision === 'split-required'
                 || terminalCorrectiveDecision === 'stop-escalate') {
@@ -4005,8 +5127,10 @@ export class WorkflowService {
                         ? this.store.hashArtifact(this.store.taskRoot(status.projectId, activeTask.id), 'plan.md')
                         : null)
                     : null;
+                const rollingRootCausePlanSet = taskNext?.action === 'task plan-set'
+                    && taskNext.rollingWave?.state === 'root-cause-replan-required';
                 const contextRefreshOptions = action === 'project-memory reconcile'
-                    && taskNext?.action !== 'task plan-set'
+                    && (taskNext?.action !== 'task plan-set' || rollingRootCausePlanSet)
                     && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
@@ -4052,6 +5176,15 @@ export class WorkflowService {
                             },
                         }
                         : {}),
+                    ...(auditedDependencyKnowledgeRefreshBlocked
+                        ? {
+                            auditedDependencyKnowledgeRefreshBlocked: {
+                                ...auditedDependencyKnowledgeRefreshBlocked,
+                                humanApprovalRequired: true,
+                                requiredAction: 'Resolve or explicitly approve the non-dependency Project Knowledge drift.',
+                            },
+                        }
+                        : {}),
                 }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
@@ -4358,6 +5491,32 @@ export class WorkflowService {
             milestonePlanHash: milestone.planHash,
         };
     }
+    currentCorrectiveDerivedTaskAuthority(projectId, task, actor) {
+        if (!task.milestoneId || actor.trim() !== `agent:milestone-remediation:${task.milestoneId}`)
+            return null;
+        const milestone = this.readMilestoneCurrent(projectId, task.milestoneId);
+        if (milestone.status !== 'active' || !milestone.planHash)
+            return null;
+        const membership = milestone.memberships.find((candidate) => candidate.taskId === task.id);
+        if (membership?.disposition !== 'required')
+            return null;
+        const authorization = [...milestone.authorizations]
+            .reverse()
+            .find((candidate) => candidate.kind === 'execution' && candidate.decision === 'approved');
+        if (authorization?.authorizationMode !== 'corrective-derived'
+            || authorization.planHash !== milestone.planHash
+            || authorization.actor !== actor.trim())
+            return null;
+        const scopeChange = [...readMilestoneScopeChangeEvents(this.store, projectId, milestone.id)]
+            .reverse()
+            .find((candidate) => candidate.authorizationMode === 'audited-remediation'
+            && candidate.candidatePlanHash === milestone.planHash
+            && candidate.remediationEvidence !== null
+            && candidate.remediationEvidence !== undefined);
+        if (!scopeChange)
+            return null;
+        return { milestone, authorization, scopeChange };
+    }
     nextForTaskWithDelegation(projectId, repositoryRoot, task, planRiskAudit = null) {
         const transition = task.status === 'awaiting_execution_authorization'
             ? 'task.execution_authorize'
@@ -4367,6 +5526,12 @@ export class WorkflowService {
         const delegatedApprovalOptions = transition
             ? this.delegatedApprovalOptions(projectId, transition, task)
             : [];
+        const correctiveDerivedActor = task.milestoneId
+            ? `agent:milestone-remediation:${task.milestoneId}`
+            : null;
+        const correctiveDerivedAuthority = transition && correctiveDerivedActor
+            ? this.currentCorrectiveDerivedTaskAuthority(projectId, task, correctiveDerivedActor)
+            : null;
         let remediationModeRecovery = null;
         let guardedCorrectivePosture = null;
         if (planRiskAudit) {
@@ -4374,7 +5539,7 @@ export class WorkflowService {
                 guardedCorrectivePosture = findCurrentGuardedRemediationPosture(this.store, task, planRiskAudit);
             }
             catch (error) {
-                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task);
+                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task, { authorityMode: 'observe' });
                 if (!remediationModeRecovery)
                     throw error;
             }
@@ -4387,7 +5552,7 @@ export class WorkflowService {
                 catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
             }
             catch (error) {
-                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task);
+                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task, { authorityMode: 'observe' });
                 if (!remediationModeRecovery)
                     throw error;
             }
@@ -4399,6 +5564,11 @@ export class WorkflowService {
             && changedFiles(repositoryRoot).length > 0
             ? assessDownstreamProofCarryover(this.store, repositoryRoot, task, nextStepId)
             : null;
+        const planIntegrityDirtyCarryover = next.action === 'task run'
+            && nextStepId
+            && changedFiles(repositoryRoot).length > 0
+            ? this.assessPostRebindCheckSupportDirtyCarryover(repositoryRoot, task, nextStepId)
+            : null;
         let mechanicalFeasibilityOverlay = {};
         if (task.status === 'awaiting_execution_authorization' && task.planHash) {
             try {
@@ -4449,6 +5619,9 @@ export class WorkflowService {
         }
         const handoffPosture = readTaskC1Posture(this.store, task);
         const failedStep = task.steps.find((step) => step.status === 'failed') ?? null;
+        const failedStepRemediations = failedStep && !remediationModeRecovery
+            ? readRemediationEvents(this.store, task).filter((event) => event.stepId === failedStep.id)
+            : [];
         const failedStepReviewRouting = failedStep
             ? latestFailedStepReviewRouting(this.store, task, failedStep.id)
             : null;
@@ -4579,11 +5752,21 @@ export class WorkflowService {
                     stepId: planIntegrityAssessment.stepId,
                     planIntegrityRecovery: {
                         state: 'eligible',
-                        reasonCode: 'MISSING_NPM_SCRIPT_OUTSIDE_ALLOWED_WRITES',
+                        reasonCode: planIntegrityAssessment.evidence?.kind === 'missing-npm-script-outside-allowed-writes'
+                            ? 'MISSING_NPM_SCRIPT_OUTSIDE_ALLOWED_WRITES'
+                            : planIntegrityAssessment.evidence?.kind === 'check-support-anchor-outside-allowed-writes'
+                                ? 'CHECK_SUPPORT_ANCHOR_OUTSIDE_ALLOWED_WRITES'
+                                : planIntegrityAssessment.evidence?.kind === 'failed-check-component-owner-outside-allowed-writes'
+                                    ? 'FAILED_CHECK_COMPONENT_OWNER_OUTSIDE_ALLOWED_WRITES'
+                                    : 'NON_EXECUTABLE_NPM_CHECK_OUTSIDE_ALLOWED_WRITES',
                         expectedRevision: task.revision,
                         requiredActor,
                         evidence: planIntegrityAssessment.evidence,
-                        boundedEffect: 'record-replan-required-decision',
+                        boundedEffect: planIntegrityAssessment.evidence?.kind === 'check-support-anchor-outside-allowed-writes'
+                            ? 'record-machine-derived-check-support-scope'
+                            : planIntegrityAssessment.evidence?.kind === 'failed-check-component-owner-outside-allowed-writes'
+                                ? 'record-machine-derived-component-owner-scope'
+                                : 'record-replan-required-decision',
                         preservesWorktree: true,
                     },
                 }
@@ -4716,7 +5899,48 @@ export class WorkflowService {
                     };
                     break;
                 case 'replan-required':
-                    guardedCorrectiveOverlay = correctiveReplanOverlay(guardedCorrectivePosture);
+                    guardedCorrectiveOverlay = guardedCorrectivePosture.correctiveDecision
+                        ? correctiveReplanOverlay(guardedCorrectivePosture)
+                        : (() => {
+                            const writerLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+                            const rollingC1Posture = readTaskC1Posture(this.store, task);
+                            const blockers = [
+                                ...(!['needs_fix', 'ready'].includes(task.status)
+                                    ? [`Task must be needs_fix or context-refreshed ready, not ${task.status}.`]
+                                    : []),
+                                ...(task.steps.some((step) => step.status === 'in_progress') ? ['No Step may remain in progress.'] : []),
+                                ...(task.steps.find((step) => step.id === guardedCorrectivePosture.stepId)?.status !== 'failed'
+                                    ? [`${guardedCorrectivePosture.stepId} must remain failed.`]
+                                    : []),
+                                ...(writerLease ? ['No active or stale writer lease may remain after the failure pause.'] : []),
+                                ...(rollingC1Posture.state !== 'none'
+                                    ? ['No C1 claim may remain after the root-cause failure pause.']
+                                    : []),
+                            ];
+                            return blockers.length > 0
+                                ? {
+                                    action: 'doctor',
+                                    blockedAction: 'task plan-set',
+                                    stepId: guardedCorrectivePosture.stepId,
+                                    rollingWave: {
+                                        state: 'root-cause-replan-blocked',
+                                        attemptCount: guardedCorrectivePosture.attemptCount,
+                                        humanApprovalRequired: false,
+                                        blockers,
+                                    },
+                                }
+                                : {
+                                    action: 'task plan-set',
+                                    blockedAction: 'task run',
+                                    stepId: guardedCorrectivePosture.stepId,
+                                    rollingWave: {
+                                        state: 'root-cause-replan-required',
+                                        attemptCount: guardedCorrectivePosture.attemptCount,
+                                        humanApprovalRequired: false,
+                                        boundary: 'Task objective, requirements, acceptance, and security semantics remain unchanged.',
+                                    },
+                                };
+                        })();
                     break;
                 case 'split-required':
                     {
@@ -4874,6 +6098,11 @@ export class WorkflowService {
                         externalSealedReview: {
                             packetCommand: 'task step-review-packet',
                             recordCommand: 'task step-review-record',
+                            reviewMode: 'ordinary',
+                            allowedReviewModes: ['ordinary', 'security'],
+                            packetReviewModeOption: '--review-mode',
+                            implicitSecurityScan: false,
+                            reviewerRuntime: prepareReviewerRuntimePreflight(repositoryRoot, `${task.id}:${strictStepReviewStep.id}:${strictStepReviewStep.evidence.commitSha}:ordinary`),
                             reviewerMustUseSeparateChat: true,
                             repositorySealRequired: true,
                         },
@@ -4889,6 +6118,11 @@ export class WorkflowService {
                         externalSealedReview: {
                             packetCommand: 'task review-packet',
                             recordCommand: 'task review-sealed-record',
+                            reviewMode: 'ordinary',
+                            allowedReviewModes: ['ordinary', 'security'],
+                            packetReviewModeOption: '--review-mode',
+                            implicitSecurityScan: false,
+                            reviewerRuntime: prepareReviewerRuntimePreflight(repositoryRoot, `${task.id}:task:${headCommit(repositoryRoot)}:ordinary`),
                             reviewerMustUseSeparateChat: true,
                             repositorySealRequired: true,
                         },
@@ -4907,7 +6141,11 @@ export class WorkflowService {
                 : {}),
             ...guardedCorrectiveOverlay,
             ...downstreamProofOverlay,
-            ...(failedStepReviewRouting?.route === 'replan' && next.action === 'task run'
+            ...(failedStepReviewRouting?.route === 'replan'
+                && next.action === 'task run'
+                && (!failedStep
+                    || deriveRollingCauseDecision(failedStepRemediations) === null
+                    || failedStepRemediations.at(-1)?.causeBindings?.length === 0)
                 ? {
                     action: 'task plan-set',
                     blockedAction: 'task run',
@@ -4944,7 +6182,44 @@ export class WorkflowService {
                         },
                     }
                 : {}),
+            ...(planIntegrityDirtyCarryover?.applicable
+                ? planIntegrityDirtyCarryover.eligible
+                    ? {
+                        planIntegrityDirtyCarryover: {
+                            state: 'validated',
+                            stepId: nextStepId,
+                            dependencyRecoveryCommit: planIntegrityDirtyCarryover.dependencyRecoveryCommit,
+                            dirtyFiles: planIntegrityDirtyCarryover.compatibility?.dirtyFiles ?? [],
+                            dirtyWorktreeHash: planIntegrityDirtyCarryover.compatibility?.dirtyWorktreeHash ?? null,
+                            scopeExtensions: planIntegrityDirtyCarryover.compatibility?.scopeExtensions ?? [],
+                            meaning: 'The current Step may adopt exactly these hash-bound check-support bytes on task run.',
+                        },
+                    }
+                    : {
+                        action: 'doctor',
+                        blockedAction: 'task run',
+                        planIntegrityDirtyCarryover: {
+                            state: 'blocked',
+                            stepId: nextStepId,
+                            blockers: planIntegrityDirtyCarryover.blockers,
+                        },
+                    }
+                : {}),
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
+            ...(correctiveDerivedAuthority && correctiveDerivedActor
+                ? {
+                    correctiveDerivedApproval: {
+                        action: transition === 'task.execution_authorize' ? 'task authorize' : 'task accept',
+                        actor: correctiveDerivedActor,
+                        humanApprovalRequired: false,
+                        milestoneId: correctiveDerivedAuthority.milestone.id,
+                        milestoneRevision: correctiveDerivedAuthority.milestone.revision,
+                        milestonePlanHash: correctiveDerivedAuthority.milestone.planHash,
+                        planRiskAuditEventId: correctiveDerivedAuthority.scopeChange.remediationEvidence?.planRiskAuditEventId ?? null,
+                        authority: 'current-corrective-derived-milestone-execution-authorization',
+                    },
+                }
+                : {}),
         };
         if (handoffPosture.state === 'pending') {
             return this.withTaskNavigationContracts(task, {
@@ -5003,7 +6278,20 @@ export class WorkflowService {
         return readValidatedStopOverrideContextRebindIfApplicable(this.store, task, stepId, repositoryRoot)?.stopDecision.eventId ?? null;
     }
     taskHasTerminalCorrectiveDecision(task) {
-        return this.taskTerminalCorrectivePosture(task) !== null;
+        try {
+            return this.taskTerminalCorrectivePosture(task) !== null;
+        }
+        catch (error) {
+            if (error instanceof WorkflowError
+                && error.code === 'TRANSITION_BLOCKED'
+                && (error.details.decision === 'stop-escalate' || error.details.decision === 'split-required')) {
+                // A blocking Plan Risk Audit is not a guarded-Step terminal decision, but it
+                // equally cannot own an atomic delegated context refresh. Treat it as
+                // ineligible here so standalone Knowledge reconciliation remains executable.
+                return true;
+            }
+            throw error;
+        }
     }
     taskTerminalCorrectivePosture(task) {
         if (!task.planHash)
@@ -5166,6 +6454,10 @@ export class WorkflowService {
                 statePlanHash: task.planHash,
             });
         }
+        if (authorization.authorizationMode === 'corrective-derived'
+            && !this.currentCorrectiveDerivedTaskAuthority(task.projectId, task, authorization.actor)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Corrective-derived Task authorization is no longer backed by the current Milestone authority.', { taskId: task.id, milestoneId: task.milestoneId, actor: authorization.actor });
+        }
         const mechanicalFeasibility = authorization.mechanicalFeasibility;
         if (!mechanicalFeasibility)
             return authorization;
@@ -5237,7 +6529,218 @@ export class WorkflowService {
             },
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null) {
+    carriedPlanIntegrityUpdateCompatibility(snapshot, task) {
+        let boundaryCommit = headCommit(snapshot.identity.repositoryRoot);
+        let dependencyCommitCount = 0;
+        while (!task.systemCommits.includes(boundaryCommit)) {
+            const dependencyCommit = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, boundaryCommit);
+            if (!dependencyCommit)
+                return null;
+            boundaryCommit = dependencyCommit.parentCommitSha;
+            dependencyCommitCount += 1;
+        }
+        if (dependencyCommitCount === 0)
+            return null;
+        const dirtyFiles = changedFiles(snapshot.identity.repositoryRoot).sort();
+        const candidates = (task.dependencyProvenanceRecoveries ?? []).filter((record) => {
+            const compatibility = record.planIntegrity;
+            if (!compatibility
+                || record.commitSha !== boundaryCommit
+                || !task.systemCommits.includes(record.commitSha)
+                || compatibility.planHash !== task.planHash
+                || canonicalJsonStringify([...compatibility.dirtyFiles].sort()) !== canonicalJsonStringify(dirtyFiles)
+                || compatibility.dirtyWorktreeHash !== hashDirtyWorktree(snapshot.identity.repositoryRoot, compatibility.dirtyFiles))
+                return false;
+            const step = task.steps.find((candidate) => candidate.id === compatibility.stepId);
+            if (!step || step.status !== 'failed')
+                return false;
+            const remediationEventIds = readRemediationEvents(this.store, task)
+                .filter((event) => event.stepId === compatibility.stepId)
+                .map((event) => event.eventId);
+            if (canonicalJsonStringify(compatibility.remediationEventIds) !== canonicalJsonStringify(remediationEventIds))
+                return false;
+            return readCorrectiveDecisionEvents(this.store, task).some((event) => event.planHash === task.planHash
+                && event.stepId === compatibility.stepId
+                && event.decision === 'replan-required')
+                && readTaskC1Posture(this.store, task).state === 'none';
+        });
+        return candidates.length === 1 ? structuredClone(candidates[0].planIntegrity) : null;
+    }
+    postRebindCheckSupportCompatibility(snapshot, task) {
+        if (task.status !== 'awaiting_execution_authorization'
+            || !task.planHash
+            || task.steps.some((step) => step.status === 'in_progress')
+            || readTaskC1Posture(this.store, task).state !== 'none')
+            return null;
+        const dirtyFiles = changedFiles(snapshot.identity.repositoryRoot).sort();
+        const candidates = readCorrectiveDecisionEvents(this.store, task).flatMap((event) => {
+            const evidence = event.planIntegrityEvidence;
+            if (event.planHash === task.planHash
+                || event.decision !== 'continue-fix'
+                || event.recoveryBasis !== 'plan-integrity'
+                || evidence?.kind !== 'check-support-anchor-outside-allowed-writes'
+                || !task.systemCommits.includes(evidence.gitHead)
+                || canonicalJsonStringify([...evidence.changedFiles].sort()) !== canonicalJsonStringify(dirtyFiles)) {
+                return [];
+            }
+            const step = task.steps.find((candidate) => candidate.id === event.stepId) ?? null;
+            if (!step
+                || step.status !== 'planned'
+                || evidence.scopeExtensions.some((scopePath) => !pathAllowed(scopePath, step.allowedWrites)
+                    || !step.expectedOutputs.some((declared) => (declared.startsWith('path:') ? declared.slice(5) : declared) === scopePath)))
+                return [];
+            return [{
+                    stepId: step.id,
+                    planHash: task.planHash,
+                    conflictHash: evidence.conflictHash,
+                    dirtyFiles: [...dirtyFiles],
+                    dirtyWorktreeHash: hashDirtyWorktree(snapshot.identity.repositoryRoot, dirtyFiles),
+                    remediationEventIds: evidence.remediationEvents.map((binding) => binding.eventId),
+                    mode: 'post-rebind-scope-adoption',
+                    scopeExtensions: [...evidence.scopeExtensions],
+                }];
+        });
+        return candidates.length === 1 ? candidates[0] : null;
+    }
+    carriedPostRebindCheckSupportDirtyCarryover(snapshot, task) {
+        let boundaryCommit = headCommit(snapshot.identity.repositoryRoot);
+        let dependencyCommitCount = 0;
+        while (!task.systemCommits.includes(boundaryCommit)) {
+            const dependencyCommit = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, boundaryCommit);
+            if (!dependencyCommit)
+                return null;
+            boundaryCommit = dependencyCommit.parentCommitSha;
+            dependencyCommitCount += 1;
+        }
+        if (dependencyCommitCount === 0)
+            return null;
+        const assessment = this.assessPostRebindCheckSupportDirtyCarryover(snapshot.identity.repositoryRoot, task, undefined, boundaryCommit);
+        if (!assessment.eligible || !assessment.compatibility || !task.planHash)
+            return null;
+        return {
+            ...assessment.compatibility,
+            planHash: task.planHash,
+            mode: 'post-rebind-dirty-carryover',
+        };
+    }
+    assessPostRebindCheckSupportDirtyCarryover(repositoryRoot, task, stepId, historyBoundary = headCommit(repositoryRoot)) {
+        const relevantRecords = [...(task.dependencyProvenanceRecoveries ?? [])]
+            .reverse()
+            .filter((record) => {
+            const compatibility = record.planIntegrity;
+            return compatibility
+                && ['post-rebind-scope-adoption', 'post-rebind-dirty-carryover'].includes(compatibility.mode ?? '')
+                && (!stepId || compatibility.stepId === stepId);
+        });
+        if (relevantRecords.length === 0) {
+            return {
+                applicable: false,
+                eligible: false,
+                compatibility: null,
+                dependencyRecoveryCommit: null,
+                blockers: [],
+            };
+        }
+        const blockers = [];
+        const record = relevantRecords[0];
+        const compatibility = record.planIntegrity;
+        const step = task.steps.find((candidate) => candidate.id === compatibility.stepId) ?? null;
+        const dirtyFiles = changedFiles(repositoryRoot).sort();
+        let dirtyWorktreeHash = null;
+        try {
+            dirtyWorktreeHash = hashDirtyWorktree(repositoryRoot, dirtyFiles);
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        if (record.commitSha !== historyBoundary || !task.systemCommits.includes(record.commitSha)) {
+            blockers.push('The latest check-support compatibility record must bind the exact registered history boundary.');
+        }
+        if (task.workspaceOwner !== 'local') {
+            blockers.push('Check-support dirty carryover requires the recorded local Task workspace.');
+        }
+        if (!task.taskBranch || currentBranch(repositoryRoot) !== task.taskBranch) {
+            blockers.push('Current branch must equal the recorded Task branch.');
+        }
+        if (!['ready', 'in_progress'].includes(task.status)) {
+            blockers.push('The Task must retain an execution-authorized posture before dirty carryover.');
+        }
+        if (!task.planHash) {
+            blockers.push('The Task must retain a current Plan hash.');
+        }
+        if (!step || step.status !== 'planned' || step.evidence !== null) {
+            blockers.push(`The bound Step ${compatibility.stepId} must remain planned with no evidence.`);
+        }
+        if (task.steps.some((candidate) => candidate.status === 'in_progress')) {
+            blockers.push('No Step may already be in progress before dirty carryover.');
+        }
+        if (canonicalJsonStringify(dirtyFiles)
+            !== canonicalJsonStringify([...compatibility.dirtyFiles].sort())) {
+            blockers.push('Dirty files changed after the registered check-support compatibility boundary.');
+        }
+        if (dirtyWorktreeHash !== compatibility.dirtyWorktreeHash) {
+            blockers.push('Dirty file content changed after the registered check-support compatibility boundary.');
+        }
+        if (!compatibility.scopeExtensions?.length) {
+            blockers.push('The compatibility record must retain at least one machine-derived scope extension.');
+        }
+        if (step) {
+            if (dirtyFiles.some((dirtyPath) => !pathAllowed(dirtyPath, step.allowedWrites))) {
+                blockers.push('The current Step must explicitly own every preserved dirty file.');
+            }
+            if ((compatibility.scopeExtensions ?? []).some((scopePath) => !pathAllowed(scopePath, step.allowedWrites)
+                || !step.expectedOutputs.some((declared) => (declared.startsWith('path:') ? declared.slice(5) : declared) === scopePath))) {
+                blockers.push('The current Step must explicitly own every check-support scope extension as allowedWrites and expectedOutputs.');
+            }
+        }
+        let reboundPlanHash = compatibility.planHash;
+        for (const rebind of task.knowledgeRebinds) {
+            if (rebind.previousPlanHash === reboundPlanHash)
+                reboundPlanHash = rebind.reboundPlanHash;
+        }
+        if (!task.planHash || reboundPlanHash !== task.planHash) {
+            blockers.push('The current Plan must equal the compatibility Plan or its exact Knowledge-rebind descendant.');
+        }
+        const matchingDecisions = readCorrectiveDecisionEvents(this.store, task).filter((event) => {
+            const evidence = event.planIntegrityEvidence;
+            return event.stepId === compatibility.stepId
+                && event.decision === 'continue-fix'
+                && event.recoveryBasis === 'plan-integrity'
+                && evidence?.kind === 'check-support-anchor-outside-allowed-writes'
+                && evidence.conflictHash === compatibility.conflictHash
+                && canonicalJsonStringify([...evidence.changedFiles].sort())
+                    === canonicalJsonStringify([...compatibility.dirtyFiles].sort())
+                && canonicalJsonStringify(evidence.remediationEvents.map((binding) => binding.eventId))
+                    === canonicalJsonStringify(compatibility.remediationEventIds)
+                && canonicalJsonStringify([...evidence.scopeExtensions].sort())
+                    === canonicalJsonStringify([...(compatibility.scopeExtensions ?? [])].sort());
+        });
+        if (matchingDecisions.length !== 1) {
+            blockers.push('Exactly one validated historical check-support decision must bind the preserved dirty set and scope.');
+        }
+        try {
+            validateTaskHistory(repositoryRoot, task, historyBoundary);
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        return {
+            applicable: true,
+            eligible: blockers.length === 0,
+            compatibility: blockers.length === 0
+                ? {
+                    ...structuredClone(compatibility),
+                    planHash: task.planHash,
+                    dirtyFiles,
+                    dirtyWorktreeHash: dirtyWorktreeHash,
+                    mode: 'post-rebind-dirty-carryover',
+                }
+                : null,
+            dependencyRecoveryCommit: record.commitSha,
+            blockers,
+        };
+    }
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null, planIntegrity = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -5257,7 +6760,7 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance);
+        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity);
     }
     inspectHistoricalStepProvenanceCandidate(snapshot, task, options = {}) {
         const now = this.now().getTime();
@@ -5279,10 +6782,9 @@ export class WorkflowService {
         const policy = gitMutationPolicyForAction(task, action);
         const c1Posture = readTaskC1Posture(this.store, task);
         const claimedC1Posture = c1Posture.state === 'claimed';
-        const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture);
-        const activeLease = writerTokenContract
-            ? inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root)
-            : null;
+        const activeLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+        const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture, activeLease !== null);
+        const activeLeaseUsable = activeLease ? !toPublicWriterLease(activeLease, this.now()).stale : false;
         const writerCredentialRecoveryActor = this.writerCredentialRecoveryActor(task, action, claimedC1Posture ? c1Posture.claimant : null, activeLease?.owner ?? null);
         const writerCredentialRecovery = writerTokenContract && writerCredentialRecoveryActor
             ? {
@@ -5294,9 +6796,24 @@ export class WorkflowService {
                 acquiresLeaseWhenAbsent: true,
             }
             : null;
+        const credentialBlocksAction = Boolean(writerCredentialRecovery
+            && writerTokenContract
+            && (activeLease === null || !activeLeaseUsable));
         return {
             ...next,
             ...(policy ? { gitMutationPolicy: policy } : {}),
+            ...(credentialBlocksAction
+                ? {
+                    action: 'task writer-credential-replace',
+                    blockedAction: action,
+                    continuation: {
+                        kind: 'failed-step-pause',
+                        preservesTask: true,
+                        preservesWorktree: true,
+                        resumesWithFreshNext: true,
+                    },
+                }
+                : {}),
             ...(writerTokenContract ? { writerTokenContract } : {}),
             ...(writerCredentialRecovery ? { writerCredentialRecovery } : {}),
         };
@@ -5708,16 +7225,20 @@ function assertTaskBranch(repositoryRoot, task) {
         throw new WorkflowError('GIT_PRECONDITION_FAILED', `Expected Task branch ${task.taskBranch}, found ${branch ?? 'detached HEAD'}.`);
     }
 }
-function preserveCompletedStep(task, next) {
-    const previous = task.steps.find((candidate) => candidate.id === next.id && candidate.status === 'completed');
-    if (!previous)
-        return null;
-    const comparable = ({ status: _status, evidence: _evidence, ...definition }) => definition;
-    return JSON.stringify(comparable(previous)) === JSON.stringify(next) ? previous : null;
-}
 function stripStepRuntime(step) {
-    const { status: _status, evidence: _evidence, ...definition } = step;
-    return definition;
+    return normalizePlanStep(step);
+}
+function normalizePlanStep(step) {
+    return normalizePlanStepDefinition(step);
+}
+function parseWorkflowBetaVersion(value) {
+    const match = value?.match(/^2[.]0[.]0-beta[.]([0-9]+)(?:[.]([0-9]+))?$/);
+    if (!match)
+        return null;
+    return {
+        train: Number(match[1]),
+        patch: match[2] === undefined ? null : Number(match[2]),
+    };
 }
 function validateReviewInput(review) {
     if (!review.reviewer.trim())
@@ -6091,7 +7612,32 @@ function gitMutationPolicyForAction(task, action) {
             return null;
     }
 }
-function writerTokenContractForAction(action, claimedC1Posture = false) {
+function taskWithEffectiveStepAllowedWrites(store, task, stepId) {
+    const allowedWrites = effectiveStepAllowedWrites(store, task, stepId);
+    return {
+        ...task,
+        steps: task.steps.map((step) => step.id === stepId ? { ...step, allowedWrites } : step),
+    };
+}
+function reviewScopeAugmentations(store, task, stepId) {
+    const step = requireStep(task, stepId);
+    const paths = effectiveStepAllowedWrites(store, task, stepId)
+        .filter((candidate) => !pathAllowed(candidate, step.allowedWrites));
+    return paths.length === 0 ? [] : [{
+            stepId,
+            paths,
+            authority: 'machine-derived-check-support',
+        }];
+}
+function reviewCauseBindings(event) {
+    return (event.remediationCauses ?? []).map((cause) => ({
+        authority: 'external-reviewer',
+        causeId: cause.causeId,
+        causeFingerprint: cause.causeFingerprint,
+        planConflict: cause.planConflict,
+    }));
+}
+function writerTokenContractForAction(action, claimedC1Posture = false, existingLease = false) {
     const alwaysLeaseBound = [
         'task step-complete',
         'task downstream-proof-recover',
@@ -6117,16 +7663,19 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
         'task handback',
         'task handback-create',
     ];
-    if (!alwaysLeaseBound.includes(action) && !(claimedC1Posture && claimedC1LeaseBound.includes(action))) {
+    if (!alwaysLeaseBound.includes(action)
+        && !(claimedC1Posture && claimedC1LeaseBound.includes(action))
+        && !(existingLease && ['task run', 'task step-review', 'task step-review-record'].includes(action))) {
         return null;
     }
     return {
         required: true,
-        option: '--writer-token',
-        source: 'active-writer-lease',
-        sensitive: true,
-        renewalDisposition: 'reuse-presented-token',
-        tokenReissuedOnRenewal: false,
+        option: '--writer-credential-ref',
+        source: 'local-credential-vault',
+        transport: 'local-vault-v1',
+        secretInArgv: false,
+        secretInOutput: false,
+        renewalDisposition: 'reuse-reference',
     };
 }
 function observationPreflightBlockers(observation) {