codex-workflow-v2 2.0.0-beta.13.1 → 2.0.0-beta.13.10

package/dist/src/workflow.js

@@ -1,23 +1,29 @@
+import { readCorrectivePlanningAudit, readFailedStepPlanningRecovery } from './alpha6/failed-step-planning-recovery.js';
+import { explainChange } from './change-explanation.js';
+import { pendingReviewRunnerFingerprint, PENDING_REVIEW_UPDATE_SIDECAR, preparePendingReviewUpdateEvent, PENDING_REVIEW_SOURCE_VERSION, pendingReviewSourceBinding, pendingReviewBindingHash, assertPendingReviewTransport, verifiedPendingReviewTransport } from './pending-review-update.js';
 import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
+import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, workflowDependencyVersionAt, } from './dependency-provenance.js';
 import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
 import { assessDiscovery, mergeUnique } from './domain/discovery.js';
+import { normalizePlanKnowledgeBinding, readVerifiedPlanArtifact } from './domain/plan-semantics.js';
 import { deriveCompletedStepCarryover, normalizePlanStepDefinition, } from './domain/completed-step-carryover.js';
 import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { withObservedRouteMetadata } from './observed-routes.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, readTaskHandoffEvents, } from './alpha6/handoff.js';
 import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
-import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
-import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, prepareRemediationEvent, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
+import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, buildCandidatePlanRiskAuditEvent, buildPlanRiskAuditEvent, readCurrentPlanRiskAudit, readCurrentPlanningObstructionAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
+import { hashCompletedSteps, hashExecutionAuthorization, preparePreExecutionReplanEvent, preExecutionReplanSidecar, readCurrentPreExecutionReplan, } from './alpha6/preexecution-replan.js';
+import { assessRootCauseReplanDirtyCarryover, matchesTerminalCorrectiveYield, } from './alpha6/root-cause-replan-carryover.js';
+import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, deriveCurrentCauseDecisionForTask, prepareRemediationEvent, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
 import { mechanicalCauseBindings, normalizeMechanicalFailures, } from './alpha6/remediation-cause.js';
 import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
@@ -27,7 +33,7 @@ import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, en
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, readValidatedStopOverrideContextRebindIfApplicable, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
-import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
+import { canonicalJsonStringify, prepareSidecarAppend, sha256Hex } from './alpha6/store-sidecars.js';
 import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
@@ -43,12 +49,16 @@ import { createEntityId } from './ulid.js';
 import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
 import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
 const MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES = 2;
+// Release-reviewed exact compatibility target; never infer support from PACKAGE_VERSION.
+const CONSUMED_CARRYOVER_TARGET_VERSION = '2.0.0-beta.13.10';
 export class WorkflowService {
     store;
     now;
-    constructor(store = new FileStateStore(), now = () => new Date()) {
+    transactionHooks;
+    constructor(store = new FileStateStore(), now = () => new Date(), transactionHooks = {}) {
         this.store = store;
         this.now = now;
+        this.transactionHooks = transactionHooks;
     }
     #mutationContext(repository) {
         const identity = resolveRepositoryIdentity(repository);
@@ -405,7 +415,7 @@ export class WorkflowService {
             discoveries: this.store.listDiscoveries(identity.projectId),
             tasks,
             milestones: this.listMilestonesObserved(identity.projectId, rawMilestones, adoption.currentPosture),
-            delegations: this.store.listDelegations(identity.projectId),
+            delegations: this.listDelegations(identity.projectId),
             adoption,
         };
     }
@@ -422,7 +432,7 @@ export class WorkflowService {
         if (confirmationCode.trim() !== gate.confirmationCode) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Delegation confirmation does not match the exact project and policy.', { projectId: identity.projectId, policyHash: gate.policyHash });
         }
-        const duplicate = this.store.listDelegations(identity.projectId)
+        const duplicate = this.listDelegations(identity.projectId)
             .find((grant) => grant.policyHash === gate.policyHash);
         if (duplicate) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'This exact delegation policy was already issued.', {
@@ -452,26 +462,35 @@ export class WorkflowService {
         }, null);
     }
     revokeDelegation(repository, grantId, expectedRevision, actor, reason) {
-        const { identity } = this.#mutationContext(repository);
-        const grant = this.store.readDelegation(identity.projectId, grantId);
-        assertExpectedRevision(grant, expectedRevision);
-        if (grant.status !== 'active') {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Delegation ${grantId} is already ${grant.status}.`);
-        }
-        if (actor.trim() !== grant.principal) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Only the recorded principal may revoke a delegation.', {
-                principal: grant.principal,
-            });
+        const { identity, locks } = this.#mutationContext(repository);
+        const before = this.store.readDelegation(identity.projectId, grantId);
+        const lease = before.scope.kind === 'milestone'
+            ? locks.acquire(before.scope.id, 'workflow-core:delegation-revocation') : null;
+        try {
+            const grant = this.store.readDelegation(identity.projectId, grantId);
+            assertExpectedRevision(grant, expectedRevision);
+            if (grant.status !== 'active') {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Delegation ${grantId} is already ${grant.status}.`);
+            }
+            if (actor.trim() !== grant.principal) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Only the recorded principal may revoke a delegation.', {
+                    principal: grant.principal,
+                });
+            }
+            if (!reason.trim())
+                throw new WorkflowError('INVALID_ARGUMENT', 'Delegation revocation requires a reason.');
+            return this.store.writeDelegation({
+                ...grant,
+                status: 'revoked',
+                revokedAt: this.now().toISOString(),
+                revokedBy: grant.principal,
+                revokeReason: reason.trim(),
+            }, expectedRevision);
+        }
+        finally {
+            if (lease)
+                locks.release(lease.entityId, lease.token);
         }
-        if (!reason.trim())
-            throw new WorkflowError('INVALID_ARGUMENT', 'Delegation revocation requires a reason.');
-        return this.store.writeDelegation({
-            ...grant,
-            status: 'revoked',
-            revokedAt: this.now().toISOString(),
-            revokedBy: grant.principal,
-            revokeReason: reason.trim(),
-        }, expectedRevision);
     }
     startDiscovery(repository, input) {
         if (!input.goal.trim())
@@ -1353,34 +1372,53 @@ export class WorkflowService {
         };
     }
     applyMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor, confirmationCode) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        assertMilestoneScopeChangeStatusAllowed(milestone);
-        const prepared = this.prepareMilestoneScopeChangeCandidate(identity.projectId, milestone, plan, actor);
-        if (confirmationCode.trim() !== prepared.confirmationCode) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone scope-change confirmation does not match the current Milestone state and requested scope.', {
-                milestoneId,
-                revision: milestone.revision,
-                actor: prepared.actor,
-                confirmationCodeBindingHash: prepared.confirmationCodeBindingHash,
+        const { identity, locks } = this.#mutationContext(repository);
+        const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
+        try {
+            const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            assertMilestoneScopeChangeStatusAllowed(milestone);
+            const prepared = this.prepareMilestoneScopeChangeCandidate(identity.projectId, milestone, plan, actor);
+            if (confirmationCode.trim() !== prepared.confirmationCode) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone scope-change confirmation does not match the current Milestone state and requested scope.', {
+                    milestoneId,
+                    revision: milestone.revision,
+                    actor: prepared.actor,
+                    confirmationCodeBindingHash: prepared.confirmationCodeBindingHash,
+                });
+            }
+            return applyMilestoneScopeChangeTransaction({
+                store: this.store,
+                milestone,
+                expectedRevision,
+                prepared,
+                now: this.now(),
+                readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
             });
         }
-        return applyMilestoneScopeChangeTransaction({
-            store: this.store,
-            milestone,
-            expectedRevision,
-            prepared,
-            now: this.now(),
-            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
-        });
+        finally {
+            locks.release(milestoneId, authorityLease.token);
+        }
+    }
+    listDelegations(projectId) {
+        // Valid append-only issuance events can precede publication of their grant.
+        // Such missing state conveys no authority, even if mkdir already succeeded.
+        const issuedIds = new Set(this.store.listMilestones(projectId).flatMap(milestone => readMilestoneAutonomyEvents(this.store, projectId, milestone.id).map(event => event.delegationGrantId)));
+        return this.store.listDelegations(projectId, issuedIds);
     }
     prepareMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+        const snapshot = this.observationSnapshot(repository);
+        if (snapshot.observation.kind !== 'assessment') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Autonomy preparation requires a coherent observation boundary.', {
+                observation: snapshot.observation,
+            });
+        }
+        const identity = resolveRepositoryIdentity(repository);
+        const milestone = inspectMilestoneWithIntegrity(this.store, identity.projectId, milestoneId, (taskId) => this.store.readTask(identity.projectId, taskId), () => this.store.listTasks(identity.projectId));
         assertExpectedRevision(milestone, expectedRevision);
         this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         return prepareMilestoneAutonomyContract({
+            store: this.store,
             projectId: identity.projectId,
             milestone,
             principal,
@@ -1390,208 +1428,244 @@ export class WorkflowService {
         });
     }
     grantMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt, confirmationCode) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
-        return applyMilestoneAutonomyContract({
-            store: this.store,
-            projectId: identity.projectId,
-            milestone,
-            principal,
-            delegate,
-            expiresAt,
-            confirmationCode,
-            now: this.now(),
-        });
+        const { identity, locks } = this.#mutationContext(repository);
+        const lease = locks.acquire(milestoneId, 'workflow-core:autonomy-issuance');
+        try {
+            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
+            return applyMilestoneAutonomyContract({
+                store: this.store,
+                projectId: identity.projectId,
+                milestone,
+                principal,
+                delegate,
+                expiresAt,
+                confirmationCode,
+                now: this.now(),
+            });
+        }
+        finally {
+            locks.release(milestoneId, lease.token);
+        }
     }
     evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        assertMilestoneScopeChangeStatusAllowed(milestone);
-        const autonomy = requireActiveMilestoneAutonomy({
-            store: this.store,
-            projectId: identity.projectId,
-            milestone,
-            actor,
-            now: this.now(),
-        });
-        validateMilestonePlan(plan);
-        assertAutonomousPlanEvolution(milestone, plan, autonomy.contract);
-        const prepared = prepareMilestoneScopeChangeCandidate({
-            milestone,
-            plan,
-            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
-            actor,
-            autonomyContractEventHash: autonomy.contract.eventHash,
-        });
-        return applyMilestoneScopeChangeTransaction({
-            store: this.store,
-            milestone,
-            expectedRevision,
-            prepared,
-            now: this.now(),
-            readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
-        });
+        const { identity, locks } = this.#mutationContext(repository);
+        const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
+        try {
+            const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            assertMilestoneScopeChangeStatusAllowed(milestone);
+            const autonomy = requireActiveMilestoneAutonomy({
+                store: this.store,
+                projectId: identity.projectId,
+                milestone,
+                actor,
+                now: this.now(),
+            });
+            validateMilestonePlan(plan);
+            assertAutonomousPlanEvolution(milestone, plan, autonomy.contract);
+            const prepared = prepareMilestoneScopeChangeCandidate({
+                milestone,
+                plan,
+                readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
+                actor,
+                autonomyContractEventHash: autonomy.contract.eventHash,
+            });
+            return applyMilestoneScopeChangeTransaction({
+                store: this.store,
+                milestone,
+                expectedRevision,
+                prepared,
+                now: this.now(),
+                readTask: (taskId) => this.store.readTask(identity.projectId, taskId),
+            });
+        }
+        finally {
+            locks.release(milestoneId, authorityLease.token);
+        }
     }
     authorizeMilestone(repository, milestoneId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not awaiting authorization.`);
+        const { identity, locks } = this.#mutationContext(repository);
+        const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
+        try {
+            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not awaiting authorization.`);
+            }
+            assertMilestoneDependenciesDeclared(milestone);
+            this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
+            const root = this.store.milestoneRoot(identity.projectId, milestoneId);
+            const planHash = this.store.hashArtifact(root, 'plan.json');
+            if (planHash !== milestone.planHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone Plan changed after it was recorded.');
+            }
+            const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'milestone.execution_authorize', actor, milestone);
+            const event = {
+                kind: 'execution',
+                decision: 'approved',
+                actor: actor.trim() || 'user',
+                recordedAt: this.now().toISOString(),
+                briefHash: null,
+                planHash,
+                resultHash: null,
+                evidenceHash: null,
+                headCommit: runGit(identity.repositoryRoot, ['rev-parse', milestone.baseBranch]),
+                reason,
+                authorizationMode: delegation ? 'delegated' : 'human',
+                ...(delegation ? { delegation } : {}),
+            };
+            return this.store.writeMilestone({ ...milestone, status: 'active', planHash, authorizations: [...milestone.authorizations, event] }, expectedRevision);
         }
-        assertMilestoneDependenciesDeclared(milestone);
-        this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
-        const root = this.store.milestoneRoot(identity.projectId, milestoneId);
-        const planHash = this.store.hashArtifact(root, 'plan.json');
-        if (planHash !== milestone.planHash) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone Plan changed after it was recorded.');
+        finally {
+            locks.release(milestoneId, authorityLease.token);
         }
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'milestone.execution_authorize', actor, milestone);
-        const event = {
-            kind: 'execution',
-            decision: 'approved',
-            actor: actor.trim() || 'user',
-            recordedAt: this.now().toISOString(),
-            briefHash: null,
-            planHash,
-            resultHash: null,
-            evidenceHash: null,
-            headCommit: runGit(identity.repositoryRoot, ['rev-parse', milestone.baseBranch]),
-            reason,
-            authorizationMode: delegation ? 'delegated' : 'human',
-            ...(delegation ? { delegation } : {}),
-        };
-        return this.store.writeMilestone({ ...milestone, status: 'active', planHash, authorizations: [...milestone.authorizations, event] }, expectedRevision);
     }
     validateMilestone(repository, milestoneId, expectedRevision) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} cannot be validated while ${milestone.status}.`);
-        }
-        this.assertMilestoneAuthorizationFresh(milestone);
-        if (currentBranch(identity.repositoryRoot) !== milestone.baseBranch || !isClean(identity.repositoryRoot)) {
-            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Milestone validation requires a clean base branch checkout.', {
-                expectedBranch: milestone.baseBranch,
-                actualBranch: currentBranch(identity.repositoryRoot),
-                changedFiles: changedFiles(identity.repositoryRoot),
-            });
-        }
-        const incomplete = milestone.memberships.filter((membership) => {
-            if (membership.disposition !== 'required')
-                return false;
-            return this.store.readTask(identity.projectId, membership.taskId).status !== 'merged';
-        });
-        if (incomplete.length > 0) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Required Milestone Tasks are not merged.', {
-                taskIds: incomplete.map((membership) => membership.taskId),
+        const { identity, locks } = this.#mutationContext(repository);
+        const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
+        try {
+            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} cannot be validated while ${milestone.status}.`);
+            }
+            this.assertMilestoneAuthorizationFresh(milestone);
+            if (currentBranch(identity.repositoryRoot) !== milestone.baseBranch || !isClean(identity.repositoryRoot)) {
+                throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Milestone validation requires a clean base branch checkout.', {
+                    expectedBranch: milestone.baseBranch,
+                    actualBranch: currentBranch(identity.repositoryRoot),
+                    changedFiles: changedFiles(identity.repositoryRoot),
+                });
+            }
+            const incomplete = milestone.memberships.filter((membership) => {
+                if (membership.disposition !== 'required')
+                    return false;
+                return this.store.readTask(identity.projectId, membership.taskId).status !== 'merged';
             });
-        }
-        const checks = runChecks(identity.repositoryRoot, milestone.checks);
-        const baseHead = headCommit(identity.repositoryRoot);
-        const root = this.store.milestoneRoot(identity.projectId, milestoneId);
-        const stagedEvidence = this.store.stageArtifact(root, 'evidence.json', JSON.stringify({
-            milestoneId,
-            baseBranch: milestone.baseBranch,
-            headCommit: baseHead,
-            generatedAt: this.now().toISOString(),
-            membershipRevision: milestone.membershipRevision,
-            memberships: milestone.memberships,
-            checks,
-        }, null, 2));
-        if (checks.some((check) => !check.passed)) {
-            const saved = this.store.writeMilestone({ ...milestone, status: 'blocked', evidenceHash: stagedEvidence.hash }, expectedRevision);
+            if (incomplete.length > 0) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Required Milestone Tasks are not merged.', {
+                    taskIds: incomplete.map((membership) => membership.taskId),
+                });
+            }
+            const checks = runChecks(identity.repositoryRoot, milestone.checks);
+            const baseHead = headCommit(identity.repositoryRoot);
+            const root = this.store.milestoneRoot(identity.projectId, milestoneId);
+            const stagedEvidence = this.store.stageArtifact(root, 'evidence.json', JSON.stringify({
+                milestoneId,
+                baseBranch: milestone.baseBranch,
+                headCommit: baseHead,
+                generatedAt: this.now().toISOString(),
+                membershipRevision: milestone.membershipRevision,
+                memberships: milestone.memberships,
+                checks,
+            }, null, 2));
+            if (checks.some((check) => !check.passed)) {
+                const saved = this.store.writeMilestone({ ...milestone, status: 'blocked', evidenceHash: stagedEvidence.hash }, expectedRevision);
+                this.store.publishArtifact(stagedEvidence);
+                return saved;
+            }
+            const result = [
+                `# Milestone result: ${milestone.title}`,
+                '',
+                `Outcome: ${milestone.outcome}`,
+                '',
+                `Validated base: ${milestone.baseBranch}@${baseHead}`,
+                '',
+                'All required memberships are merged and all Milestone checks passed.',
+                '',
+            ].join('\n');
+            const stagedResult = this.store.stageArtifact(root, 'result.md', result);
+            const saved = this.store.writeMilestone({
+                ...milestone,
+                status: 'awaiting_final_acceptance',
+                evidenceHash: stagedEvidence.hash,
+                resultHash: stagedResult.hash,
+            }, expectedRevision);
             this.store.publishArtifact(stagedEvidence);
+            this.store.publishArtifact(stagedResult);
             return saved;
         }
-        const result = [
-            `# Milestone result: ${milestone.title}`,
-            '',
-            `Outcome: ${milestone.outcome}`,
-            '',
-            `Validated base: ${milestone.baseBranch}@${baseHead}`,
-            '',
-            'All required memberships are merged and all Milestone checks passed.',
-            '',
-        ].join('\n');
-        const stagedResult = this.store.stageArtifact(root, 'result.md', result);
-        const saved = this.store.writeMilestone({
-            ...milestone,
-            status: 'awaiting_final_acceptance',
-            evidenceHash: stagedEvidence.hash,
-            resultHash: stagedResult.hash,
-        }, expectedRevision);
-        this.store.publishArtifact(stagedEvidence);
-        this.store.publishArtifact(stagedResult);
-        return saved;
+        finally {
+            locks.release(milestoneId, authorityLease.token);
+        }
     }
     acceptMilestone(repository, milestoneId, expectedRevision, actor, confirmationCode, delegationGrantId = null) {
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        if (milestone.status !== 'awaiting_final_acceptance' || !milestone.resultHash || !milestone.evidenceHash) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not ready for acceptance.`);
-        }
-        if (currentBranch(identity.repositoryRoot) !== milestone.baseBranch || !isClean(identity.repositoryRoot)) {
-            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Milestone acceptance requires a clean base branch checkout.');
-        }
-        const root = this.store.milestoneRoot(identity.projectId, milestoneId);
-        const evidence = JSON.parse(readFileSync(path.join(root, 'evidence.json'), 'utf8'));
-        const currentHead = headCommit(identity.repositoryRoot);
-        const resultHash = this.store.hashArtifact(root, 'result.md');
-        const evidenceHash = this.store.hashArtifact(root, 'evidence.json');
-        if (evidence.headCommit !== currentHead || resultHash !== milestone.resultHash || evidenceHash !== milestone.evidenceHash) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone validation evidence is stale.');
-        }
-        const normalizedActor = actor.trim();
-        if (!normalizedActor) {
-            throw new WorkflowError('INVALID_ARGUMENT', 'Milestone final acceptance requires an explicit actor.');
+        const { identity, locks } = this.#mutationContext(repository);
+        const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
+        try {
+            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            if (milestone.status !== 'awaiting_final_acceptance' || !milestone.resultHash || !milestone.evidenceHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is not ready for acceptance.`);
+            }
+            if (currentBranch(identity.repositoryRoot) !== milestone.baseBranch || !isClean(identity.repositoryRoot)) {
+                throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Milestone acceptance requires a clean base branch checkout.');
+            }
+            const root = this.store.milestoneRoot(identity.projectId, milestoneId);
+            const evidence = JSON.parse(readFileSync(path.join(root, 'evidence.json'), 'utf8'));
+            const currentHead = headCommit(identity.repositoryRoot);
+            const resultHash = this.store.hashArtifact(root, 'result.md');
+            const evidenceHash = this.store.hashArtifact(root, 'evidence.json');
+            if (evidence.headCommit !== currentHead || resultHash !== milestone.resultHash || evidenceHash !== milestone.evidenceHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone validation evidence is stale.');
+            }
+            const normalizedActor = actor.trim();
+            if (!normalizedActor) {
+                throw new WorkflowError('INVALID_ARGUMENT', 'Milestone final acceptance requires an explicit actor.');
+            }
+            const gate = milestoneFinalAcceptanceGate(milestone, currentHead);
+            if (confirmationCode.trim() !== gate.confirmationCode) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone final acceptance confirmation does not match the current validated state.', {
+                    milestoneId,
+                    revision: milestone.revision,
+                });
+            }
+            const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'milestone.final_accept', normalizedActor, milestone);
+            const event = {
+                kind: 'final_acceptance',
+                decision: 'approved',
+                actor: normalizedActor,
+                recordedAt: this.now().toISOString(),
+                briefHash: null,
+                planHash: milestone.planHash,
+                resultHash,
+                evidenceHash,
+                headCommit: currentHead,
+                reason: 'Milestone final acceptance confirmed against the current validated state.',
+                authorizationMode: delegation ? 'delegated' : 'human',
+                ...(delegation ? { delegation } : {}),
+            };
+            return this.store.writeMilestone({
+                ...milestone,
+                status: 'accepted',
+                resultHash,
+                evidenceHash,
+                acceptedHead: currentHead,
+                authorizations: [...milestone.authorizations, event],
+            }, expectedRevision);
         }
-        const gate = milestoneFinalAcceptanceGate(milestone, currentHead);
-        if (confirmationCode.trim() !== gate.confirmationCode) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Milestone final acceptance confirmation does not match the current validated state.', {
-                milestoneId,
-                revision: milestone.revision,
-            });
+        finally {
+            locks.release(milestoneId, authorityLease.token);
         }
-        const delegation = this.delegatedAuthorization(identity.projectId, delegationGrantId, 'milestone.final_accept', normalizedActor, milestone);
-        const event = {
-            kind: 'final_acceptance',
-            decision: 'approved',
-            actor: normalizedActor,
-            recordedAt: this.now().toISOString(),
-            briefHash: null,
-            planHash: milestone.planHash,
-            resultHash,
-            evidenceHash,
-            headCommit: currentHead,
-            reason: 'Milestone final acceptance confirmed against the current validated state.',
-            authorizationMode: delegation ? 'delegated' : 'human',
-            ...(delegation ? { delegation } : {}),
-        };
-        return this.store.writeMilestone({
-            ...milestone,
-            status: 'accepted',
-            resultHash,
-            evidenceHash,
-            acceptedHead: currentHead,
-            authorizations: [...milestone.authorizations, event],
-        }, expectedRevision);
     }
     cancelMilestone(repository, milestoneId, expectedRevision, reason) {
         if (!reason.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone cancellation requires a reason.');
-        const { identity } = this.#mutationContext(repository);
-        const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
-        assertExpectedRevision(milestone, expectedRevision);
-        if (['accepted', 'cancelled'].includes(milestone.status)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is ${milestone.status}.`);
+        const { identity, locks } = this.#mutationContext(repository);
+        const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
+        try {
+            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            if (['accepted', 'cancelled'].includes(milestone.status)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is ${milestone.status}.`);
+            }
+            return this.store.writeMilestone({ ...milestone, status: 'cancelled', cancellationReason: reason.trim() }, expectedRevision);
+        }
+        finally {
+            locks.release(milestoneId, authorityLease.token);
         }
-        return this.store.writeMilestone({ ...milestone, status: 'cancelled', cancellationReason: reason.trim() }, expectedRevision);
     }
     setTaskPlan(repository, taskId, expectedRevision, plan, correctiveAudit = null, planRiskAudit = null) {
         validatePlan(plan);
@@ -1600,6 +1674,10 @@ export class WorkflowService {
         this.validateKnowledgeTargets(knowledgeMap, plan);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
+        const preExecutionReplan = readCurrentPreExecutionReplan(this.store, task);
+        const preExecutionReplanAudits = preExecutionReplan
+            ? resolvePreExecutionReplanAudits(this.store, task, preExecutionReplan)
+            : null;
         const correctiveDecisionEvents = task.planHash ? readCorrectiveDecisionEvents(this.store, task) : [];
         const currentPlanCorrectiveDecisions = task.planHash
             ? correctiveDecisionEvents.filter((event) => event.planHash === task.planHash)
@@ -1746,6 +1824,9 @@ export class WorkflowService {
         }
         const root = this.store.taskRoot(identity.projectId, taskId);
         const preparedPlan = prepareCorrectiveReplanCandidate(task, plan);
+        const changesPlanSemantics = !task.planHash
+            || normalizePlanKnowledgeBinding(preparedPlan.planBytes, 'candidate').semanticHash
+                !== normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(root, task.planHash, task.planHash), 'current').semanticHash;
         const authorizations = task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
             ? { ...authorization, decision: 'superseded' }
             : authorization);
@@ -1763,6 +1844,83 @@ export class WorkflowService {
                 ...(task.invalidatedStepCommits ?? []),
                 ...omittedStepEvidenceCommits(task, plannedSteps),
             ])];
+        if (preExecutionReplan && preExecutionReplanAudits) {
+            const replanC1Posture = readTaskC1Posture(this.store, task);
+            const replanWriterLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+            if (replanC1Posture.state !== 'none' || replanWriterLease) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replacement Plan requires no C1 posture or writer lease.', {
+                    taskId: task.id,
+                    c1Posture: replanC1Posture.state,
+                    writerLeasePresent: replanWriterLease !== null,
+                });
+            }
+            if (!planRiskAudit) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires an atomic replacement Plan Risk Audit.');
+            }
+            if (task.planObjective !== plan.objective
+                || canonicalJsonStringify(task.requirements) !== canonicalJsonStringify(plan.requirements)
+                || canonicalJsonStringify(task.acceptance) !== canonicalJsonStringify(plan.acceptance)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan cannot change Task objective, requirements, or acceptance.', {
+                    taskId: task.id,
+                });
+            }
+            if (!changesPlanSemantics) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires a semantic Plan change.', { taskId: task.id });
+            }
+            const candidateSteps = new Map(plan.steps.map((step) => [step.id, step]));
+            const missingStepIds = task.steps.filter((step) => !candidateSteps.has(step.id)).map((step) => step.id);
+            if (missingStepIds.length > 0) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan must retain every existing Step identifier.', {
+                    taskId: task.id,
+                    missingStepIds,
+                });
+            }
+            const completedStepIds = task.steps.filter((step) => step.status === 'completed').map((step) => step.id);
+            const lostCompletedStepIds = completedStepIds.filter((stepId) => !retainedCompletedSteps.has(stepId));
+            if (lostCompletedStepIds.length > 0) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan must preserve the exact completed Step subgraph and evidence.', {
+                    taskId: task.id,
+                    lostCompletedStepIds,
+                });
+            }
+            const weakenedForbiddenScope = task.steps.flatMap((step) => {
+                const candidate = candidateSteps.get(step.id);
+                const missing = step.forbiddenScope.filter((scope) => !candidate.forbiddenScope.includes(scope));
+                return missing.length > 0 ? [{ stepId: step.id, missing }] : [];
+            });
+            if (weakenedForbiddenScope.length > 0) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan cannot weaken existing forbiddenScope boundaries.', {
+                    taskId: task.id,
+                    weakenedForbiddenScope,
+                });
+            }
+            const missingRisks = task.risks.filter((risk) => !plan.risks.includes(risk));
+            if (missingRisks.length > 0) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan cannot suppress existing Plan risks.', {
+                    taskId: task.id,
+                    missingRisks,
+                });
+            }
+            assertPlanRiskSafetyPreserved(preExecutionReplanAudits.obstructionAudit, planRiskAudit, 'Replacement Plan Risk Audit');
+            const candidateEdgeKeys = new Set((plan.productionEdges ?? []).map((edge) => canonicalJsonStringify(edge)));
+            const missingProductionEdges = (task.productionEdges ?? [])
+                .filter((edge) => !candidateEdgeKeys.has(canonicalJsonStringify(edge)));
+            if ((task.requiresProductionEdges === true && plan.requiresProductionEdges !== true)
+                || missingProductionEdges.length > 0) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan cannot weaken production-edge authority.', {
+                    taskId: task.id,
+                    missingProductionEdges,
+                });
+            }
+            if (!isClean(identity.repositoryRoot) || headCommit(identity.repositoryRoot) !== preExecutionReplan.sourceHeadCommit) {
+                throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Pre-execution replacement Plan requires the exact clean recorded HEAD.', {
+                    taskId: task.id,
+                    expectedHead: preExecutionReplan.sourceHeadCommit,
+                    actualHead: headCommit(identity.repositoryRoot),
+                    changedFiles: changedFiles(identity.repositoryRoot),
+                });
+            }
+        }
         if (task.status === 'needs_fix' &&
             task.review.status === 'failed' &&
             plannedSteps.every((step) => step.status === 'completed')) {
@@ -1786,7 +1944,7 @@ export class WorkflowService {
                         : []),
                     ...(rawWriterLease ? ['task.rolling-replan.no-writer-lease'] : []),
                     ...(c1Posture.state !== 'none' ? ['task.rolling-replan.no-c1-claim'] : []),
-                    ...(preparedPlan.planHash === task.planHash
+                    ...(!changesPlanSemantics
                         ? ['task.rolling-replan.semantic-plan-change']
                         : []),
                     ...(!preparedPlan.stepIds.includes(correctiveReplanPosture.stepId)
@@ -1859,6 +2017,61 @@ export class WorkflowService {
         };
         if (planRiskAudit)
             validatePlanRiskAuditCandidate(this.store, candidate, planRiskAudit);
+        if (preExecutionReplan && preExecutionReplanAudits && planRiskAudit) {
+            const now = this.now();
+            const resultTask = {
+                ...candidate,
+                revision: task.revision + 1,
+                updatedAt: now.toISOString(),
+            };
+            const preparedAuditBase = buildCandidatePlanRiskAuditEvent(this.store, resultTask, planRiskAudit, now.toISOString(), now.getTime());
+            const preparedAudit = prepareSidecarAppend(readPlanRiskAuditEvents(this.store, task), preparedAuditBase.event);
+            const projectRoot = this.store.projectRoot(task.projectId);
+            const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+            const versionFile = path.join(root, '.versions', `plan.md.${preparedPlan.planHash}`);
+            if (existsSync(versionFile) && sha256Hex(readFileSync(versionFile)) !== preparedPlan.planHash) {
+                throw new WorkflowError('STATE_CORRUPT', 'Immutable replacement Plan version is corrupt.', {
+                    taskId: task.id,
+                    planHash: preparedPlan.planHash,
+                });
+            }
+            applyProjectTransaction({
+                projectRoot,
+                projectId: task.projectId,
+                transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+                kind: 'preexecution-replacement-plan-set',
+                now,
+                targets: [
+                    { path: relative(path.join(root, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+                    { path: relative(path.join(root, 'plan.md')), content: preparedPlan.planBytes },
+                    { path: relative(versionFile), content: preparedPlan.planBytes },
+                    { path: relative(path.join(root, 'plan-risk-audits.jsonl')), content: preparedAudit.content },
+                ],
+                ...(this.transactionHooks.afterPreExecutionReplanTargetWrite
+                    ? { afterTargetWrite: this.transactionHooks.afterPreExecutionReplanTargetWrite }
+                    : {}),
+                validate: () => {
+                    const saved = this.store.readTask(task.projectId, task.id);
+                    const currentAudit = readCurrentPlanRiskAudit(this.store, saved, { requireCurrentTaskRevision: true });
+                    if (saved.revision !== resultTask.revision
+                        || saved.status !== 'awaiting_execution_authorization'
+                        || saved.planHash !== preparedPlan.planHash
+                        || this.store.hashArtifact(root, 'plan.md') !== preparedPlan.planHash
+                        || sha256Hex(readFileSync(versionFile)) !== preparedPlan.planHash
+                        || currentAudit?.audit.eventHash !== preparedAudit.event.eventHash
+                        || hashCompletedSteps(saved) !== preExecutionReplan.completedStepsHash
+                        || readCurrentPreExecutionReplan(this.store, saved) !== null
+                        || saved.authorizations.some((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved')) {
+                        throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replacement Plan transaction readback failed.', {
+                            taskId: task.id,
+                        });
+                    }
+                    if (saved.baseCommit)
+                        validateTaskHistory(identity.repositoryRoot, saved);
+                },
+            });
+            return this.store.readTask(task.projectId, task.id);
+        }
         const stagedPlan = this.store.stageArtifact(root, 'plan.md', preparedPlan.planBytes);
         if (stagedPlan.hash !== preparedPlan.planHash) {
             throw new WorkflowError('STATE_CORRUPT', 'Prepared candidate Plan hash changed during staging.', {
@@ -1987,11 +2200,15 @@ export class WorkflowService {
         }
         const inspectedMap = inspectKnowledgeMap(currentMap, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
         const transitions = [];
-        const currentPlanRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        const planningRecovery = readFailedStepPlanningRecovery(this.store, task);
+        const currentPlanRiskAudit = planningRecovery?.current ?? readCurrentPlanRiskAudit(this.store, task);
         const currentPlanArtifactHash = task.planHash
             ? this.store.hashArtifact(this.store.taskRoot(identity.projectId, task.id), 'plan.md')
             : null;
         const refreshAssessment = assessDelegatedKnowledgeRefresh(currentMap, inspectedMap, task, currentPlanArtifactHash);
+        if (planningRecovery && refreshAssessment.mode !== 'delegated-content-only') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Stopped planning context refresh permits content-only Knowledge drift.');
+        }
         // Validate every delegated transition before the first write so a narrow grant cannot
         // leave the composite operation half-applied.
         this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
@@ -2038,11 +2255,15 @@ export class WorkflowService {
                     appendReboundPlanRiskAudit(this.store, task, refreshedTask, currentPlanRiskAudit, this.now());
                 }
                 transitions.push('task knowledge-rebind');
-                refreshedTask = this.authorizeTask(repository, taskId, refreshedTask.revision, actor, refreshAssessment.mode === 'delegated-plan-bounded-supporting-source'
-                    ? 'Delegated Plan-bounded supporting-source context refresh.'
-                    : 'Delegated content-only context refresh.', delegationGrantId);
-                transitions.push('task execution authorize');
+                // A stopped Plan may regain its Knowledge binding, never execution authority.
+                if (!planningRecovery)
+                    refreshedTask = this.authorizeTask(repository, taskId, refreshedTask.revision, actor, refreshAssessment.mode === 'delegated-plan-bounded-supporting-source'
+                        ? 'Delegated Plan-bounded supporting-source context refresh.'
+                        : 'Delegated content-only context refresh.', delegationGrantId);
+                if (!planningRecovery)
+                    transitions.push('task execution authorize');
                 return {
+                    authority: planningRecovery ? 'planning-only' : 'execution',
                     mode: refreshAssessment.mode,
                     transitions,
                     addedSources: refreshAssessment.addedSources,
@@ -2052,8 +2273,16 @@ export class WorkflowService {
             },
             validate: (result) => {
                 const currentTask = this.store.readTask(identity.projectId, task.id);
-                if (currentTask.revision !== result.task.revision || currentTask.status !== 'ready') {
-                    throw new WorkflowError('STATE_CORRUPT', 'Context refresh transaction did not commit an authorized Task.');
+                if (currentTask.revision !== result.task.revision || currentTask.status !== (planningRecovery ? 'awaiting_execution_authorization' : 'ready')) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Context refresh transaction did not commit the expected Task posture.');
+                }
+                if (planningRecovery) {
+                    const rebound = readFailedStepPlanningRecovery(this.store, currentTask);
+                    if (!rebound || rebound.baseline.eventHash !== planningRecovery.baseline.eventHash
+                        || JSON.stringify(currentTask.steps) !== JSON.stringify(task.steps)
+                        || JSON.stringify(currentTask.authorizations) !== JSON.stringify(task.authorizations)) {
+                        throw new WorkflowError('STATE_CORRUPT', 'Planning context refresh changed retained recovery evidence.');
+                    }
                 }
                 const currentKnowledgeMap = this.store.readKnowledgeMap(identity.projectId);
                 if (currentKnowledgeMap.revision !== result.knowledgeMap.revision) {
@@ -2067,6 +2296,9 @@ export class WorkflowService {
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
+        if (readCurrentPreExecutionReplan(this.store, task)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires a semantic replacement Plan before execution authorization.', { taskId, requiredAction: 'task plan-set' });
+        }
         if (task.status !== 'awaiting_execution_authorization' || !task.planHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} is not awaiting execution authorization.`);
         }
@@ -2124,9 +2356,143 @@ export class WorkflowService {
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
+        if (readCurrentPreExecutionReplan(this.store, task)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires task plan-set; the blocking audit cannot be replaced in place.', { taskId, requiredAction: 'task plan-set' });
+        }
         this.assertTaskKnowledgeBinding(identity.repositoryRoot, task);
         return appendCurrentPlanRiskAudit(this.store, task, input, this.now());
     }
+    recordPreExecutionReplan(repository, taskId, expectedRevision, actor, reason, binding, input) {
+        const context = this.#mutationContext(repository);
+        this.readCurrentAdoptionPostureStrict(context.identity.projectId);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (readCurrentPreExecutionReplan(this.store, task)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task already has a pending pre-execution replan.', {
+                taskId,
+                requiredAction: 'task plan-set',
+            });
+        }
+        if (task.status !== 'ready' || task.steps.some((step) => ['in_progress', 'failed'].includes(step.status))) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires a ready Task with no Step in progress or failed.', {
+                taskId,
+                status: task.status,
+            });
+        }
+        if (!isClean(context.identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Pre-execution replan requires a clean checkout.', {
+                changedFiles: changedFiles(context.identity.repositoryRoot),
+            });
+        }
+        const c1Posture = readTaskC1Posture(this.store, task);
+        const writerLease = context.locks.inspect(task.id);
+        if (c1Posture.state !== 'none' || writerLease) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires a clean authority boundary without C1 or writer lease.', {
+                taskId,
+                c1Posture: c1Posture.state,
+                writerLeasePresent: writerLease !== null,
+            });
+        }
+        this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
+        if (task.baseCommit) {
+            validateTaskHistory(context.identity.repositoryRoot, task);
+        }
+        else if (task.workspaceOwner !== null || task.taskBranch !== null
+            || task.steps.some((step) => step.status === 'completed')) {
+            throw new WorkflowError('STATE_CORRUPT', 'Unstarted pre-execution replan Task has inconsistent execution history.', {
+                taskId,
+            });
+        }
+        const authorization = this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
+        const sourceAudit = readCurrentPlanRiskAudit(this.store, task, { requireCurrentTaskRevision: false });
+        if (!sourceAudit || !['approved', 'approved-with-rationale'].includes(sourceAudit.audit.decision)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires the current positive Plan Risk Audit.');
+        }
+        const currentHead = headCommit(context.identity.repositoryRoot);
+        const actualBinding = {
+            expectedBriefHash: task.briefHash,
+            expectedPlanHash: task.planHash,
+            expectedPlanRiskAuditEventHash: sourceAudit.audit.eventHash,
+            expectedHeadCommit: currentHead,
+        };
+        if (canonicalJsonStringify(binding) !== canonicalJsonStringify(actualBinding)) {
+            throw new WorkflowError('STATE_CONFLICT', 'Pre-execution replan source binding is stale.', {
+                expected: binding,
+                actual: actualBinding,
+            });
+        }
+        if (input.decision !== 'stop-escalate') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Pre-execution replan requires a stop-escalate Plan Risk Audit.');
+        }
+        if (actor.trim() !== input.auditor.trim() || input.planner.trim() !== sourceAudit.audit.planner) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan must be recorded by the independent auditor against the original planner.', {
+                actor: actor.trim(),
+                auditor: input.auditor.trim(),
+                expectedPlanner: sourceAudit.audit.planner,
+                actualPlanner: input.planner.trim(),
+            });
+        }
+        assertPlanRiskSafetyPreserved(sourceAudit.audit, input, 'Pre-execution replan audit');
+        const now = this.now();
+        const preparedAuditBase = buildPlanRiskAuditEvent(this.store, task, input, now.toISOString(), now.getTime());
+        const preparedAudit = prepareSidecarAppend(readPlanRiskAuditEvents(this.store, task), preparedAuditBase.event);
+        const preparedMarker = preparePreExecutionReplanEvent(this.store, task, {
+            sourceAudit: sourceAudit.audit,
+            obstructionAudit: preparedAudit.event,
+            authorization,
+            sourceHeadCommit: currentHead,
+            actor,
+            reason,
+        }, now);
+        const resultTask = {
+            ...task,
+            revision: task.revision + 1,
+            updatedAt: now.toISOString(),
+            status: 'awaiting_execution_authorization',
+            authorizations: task.authorizations.map((candidate) => candidate.kind === 'execution' && candidate.decision === 'approved'
+                ? { ...candidate, decision: 'superseded' }
+                : candidate),
+            blockReason: reason.trim(),
+        };
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
+        applyProjectTransaction({
+            projectRoot,
+            projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'preexecution-plan-authority-withdrawal',
+            now,
+            targets: [
+                { path: relative(path.join(taskRoot, 'plan-risk-audits.jsonl')), content: preparedAudit.content },
+                { path: relative(path.join(taskRoot, preExecutionReplanSidecar())), content: preparedMarker.postimage },
+                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
+            ],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                const latestAudit = readPlanRiskAuditEvents(this.store, saved).at(-1) ?? null;
+                const marker = readCurrentPreExecutionReplan(this.store, saved);
+                if (saved.revision !== resultTask.revision
+                    || saved.status !== 'awaiting_execution_authorization'
+                    || saved.planHash !== task.planHash
+                    || latestAudit?.eventHash !== preparedAudit.event.eventHash
+                    || marker?.eventHash !== preparedMarker.event.eventHash
+                    || saved.authorizations.some((candidate) => candidate.kind === 'execution' && candidate.decision === 'approved')
+                    || hashCompletedSteps(saved) !== preparedMarker.event.completedStepsHash
+                    || headCommit(context.identity.repositoryRoot) !== currentHead
+                    || !isClean(context.identity.repositoryRoot)) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan transaction readback failed.', { taskId });
+                }
+                if (saved.baseCommit)
+                    validateTaskHistory(context.identity.repositoryRoot, saved);
+            },
+        });
+        return {
+            task: this.store.readTask(task.projectId, task.id),
+            audit: preparedAudit.event,
+            event: preparedMarker.event,
+        };
+    }
     showTaskHandoff(repository, taskId) {
         const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
@@ -2140,6 +2506,12 @@ export class WorkflowService {
         const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
+        if (readCurrentPreExecutionReplan(this.store, task)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Task ownership cannot change while a pre-execution replan is pending.', {
+                taskId,
+                requiredAction: 'task plan-set',
+            });
+        }
         const normalizedActor = actor.trim();
         if (!normalizedActor) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Handoff actor is required.');
@@ -2295,8 +2667,12 @@ export class WorkflowService {
                 });
             }
         }
-        const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
-        const action = String(navigation.action);
+        const planningRecovery = readFailedStepPlanningRecovery(this.store, task);
+        const navigation = planningRecovery
+            ? this.nextForTaskWithDelegation(task.projectId, context.identity.repositoryRoot, task, planningRecovery.current)
+            : this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const action = String(navigation.action === 'task writer-credential-replace'
+            ? navigation.blockedAction : navigation.action);
         const currentLease = context.locks.inspect(taskId);
         const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed', currentLease !== null);
         const requiredActor = writerTokenContract
@@ -2469,11 +2845,15 @@ export class WorkflowService {
         const planIntegrityDirtyCarryover = step.status === 'planned' && dirty.length > 0
             ? this.assessPostRebindCheckSupportDirtyCarryover(context.identity.repositoryRoot, task, stepId)
             : null;
+        const rootCauseReplanDirtyCarryover = step.status === 'planned' && dirty.length > 0
+            ? this.assessCurrentRootCauseReplanDirtyCarryover(context.identity.repositoryRoot, task, stepId)
+            : null;
         if (step.status === 'planned'
             && dirty.length > 0
             && !resumesCorrectiveReplan
             && !downstreamProofCarryover?.eligible
-            && !planIntegrityDirtyCarryover?.eligible) {
+            && !planIntegrityDirtyCarryover?.eligible
+            && !rootCauseReplanDirtyCarryover?.eligible) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
                 ...(downstreamProofCarryover?.applicable
@@ -2482,6 +2862,9 @@ export class WorkflowService {
                 ...(planIntegrityDirtyCarryover?.applicable
                     ? { planIntegrityDirtyCarryoverBlockers: planIntegrityDirtyCarryover.blockers }
                     : {}),
+                ...(rootCauseReplanDirtyCarryover?.applicable
+                    ? { rootCauseReplanDirtyCarryoverBlockers: rootCauseReplanDirtyCarryover.blockers }
+                    : {}),
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, allowedWrites));
@@ -2747,7 +3130,7 @@ export class WorkflowService {
             const resultingHistory = !preparedRemediation || preparedRemediation.postimage === null
                 ? stepHistory
                 : [...stepHistory, preparedRemediation.event];
-            const rollingCauseDecision = deriveRollingCauseDecision(resultingHistory);
+            const rollingCauseDecision = deriveCurrentCauseDecisionForTask(this.store, task, stepId, resultingHistory);
             const c1Posture = readTaskC1Posture(this.store, task);
             const preparedYield = rollingCauseDecision === 'root-cause-replan' && c1Posture.state === 'claimed'
                 ? prepareTaskCorrectiveYield(this.store, paused, {
@@ -2970,7 +3353,15 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review requires ${stepId} in progress with canonical evidence.`);
         }
         validateTaskHistory(identity.repositoryRoot, task);
-        if (!isClean(identity.repositoryRoot) || headCommit(identity.repositoryRoot) !== step.evidence.commitSha) {
+        const transport = verifiedPendingReviewTransport(identity.repositoryRoot, task, stepId, this.store.taskRoot(task.projectId, task.id));
+        if (transport) {
+            const cycle = buildCurrentStrictStepReviewCycle(this.store, task, stepId);
+            if (cycle.resolution !== 'pending' || cycle.pendingEvent?.eventHash !== transport.source.pendingEventHash
+                || cycle.binding.evidenceHash !== transport.source.evidenceHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'The transported strict review must retain its exact pending chain.');
+            }
+        }
+        if (!isClean(identity.repositoryRoot) || (headCommit(identity.repositoryRoot) !== step.evidence.commitSha && !transport)) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Step Review requires a clean checkout at the completion commit.');
         }
         const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
@@ -3053,7 +3444,7 @@ export class WorkflowService {
         const resultingHistory = preparedRemediation.postimage === null
             ? stepHistory
             : [...stepHistory, preparedRemediation.event];
-        const rollingCauseDecision = deriveRollingCauseDecision(resultingHistory);
+        const rollingCauseDecision = deriveCurrentCauseDecisionForTask(this.store, task, stepId, resultingHistory);
         const resolved = applyStrictStepReviewResolution(task, stepId, 'failed', summary);
         const paused = {
             ...resolved,
@@ -3077,7 +3468,7 @@ export class WorkflowService {
             ? prepareTaskCorrectiveYield(this.store, paused, {
                 actor: c1Posture.claimant,
                 writerToken: reviewLease.token,
-                reason: `Yield execution authority after repeated authoritative cause ${preparedRemediation.event.eventId}.`,
+                reason: `Yield execution authority after authoritative replan cause ${preparedRemediation.event.eventId}.`,
                 eventId: `HOF-${sha256Hex([
                     'strict-review-root-cause-replan-pause-v1',
                     task.id,
@@ -3346,10 +3737,14 @@ export class WorkflowService {
         assertExpectedRevision(task, expectedRevision);
         this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
-        if (!['ready', 'needs_fix', 'blocked'].includes(task.status)) {
+        const planningRecovery = readFailedStepPlanningRecovery(this.store, task);
+        if (!['ready', 'needs_fix', 'blocked'].includes(task.status) && !planningRecovery) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot record a corrective decision while ${task.status}.`);
         }
-        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (planningRecovery && correctiveAudit.decision === 'continue-fix') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'A stopped rebound Plan requires replan, split, or escalation; continue-fix cannot restore execution authority.', { taskId, stepId });
+        }
+        const planRiskAudit = readCorrectivePlanningAudit(this.store, task);
         if (!planRiskAudit) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} has no current Plan Risk Audit for corrective decision recording.`, {
                 taskId,
@@ -3640,22 +4035,153 @@ export class WorkflowService {
         const { identity } = this.#mutationContext(repository);
         return this.inspectAdoptionPreparation(identity, this.store.listTasks(identity.projectId), this.store.listMilestones(identity.projectId));
     }
-    applyAdoption(repository, actor, confirmationCode) {
+    applyAdoption(repository, actor, confirmationCode) {
+        const context = this.#mutationContext(repository);
+        const tasks = context.store.listTasks(context.identity.projectId);
+        const milestones = context.store.listMilestones(context.identity.projectId);
+        return applyAdoptionPosture(this.store, {
+            projectId: context.identity.projectId,
+            repositoryIdentity: context.identity,
+            packageVersion: PACKAGE_VERSION,
+            protocolVersion: PROTOCOL_VERSION,
+            stateSchemaVersion: STATE_SCHEMA_VERSION,
+            tasks,
+            milestones,
+            sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
+            blockers: this.computeAdoptionBoundaryBlockers(context.identity, tasks, context.locks.list()),
+            now: this.now(),
+        }, actor, confirmationCode);
+    }
+    pendingReviewUpdatePreflight(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        const blockers = observationPreflightBlockers(snapshot.observation);
+        try {
+            pendingReviewRunnerFingerprint();
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        let binding = null;
+        if (PACKAGE_VERSION === PENDING_REVIEW_SOURCE_VERSION)
+            blockers.push('The exact target runner must be newer than the supported source.');
+        if (!task)
+            blockers.push('Task not found.');
+        if (task) {
+            try {
+                binding = pendingReviewSourceBinding(snapshot.identity.repositoryRoot, this.store, task);
+            }
+            catch (error) {
+                blockers.push(error instanceof Error ? error.message : String(error));
+            }
+            const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+            if ([versions.declared, versions.locked, versions.installed, versions.currentBranch,
+                ...versions.milestoneBases.map((base) => base.version)].some((version) => version !== PENDING_REVIEW_SOURCE_VERSION)) {
+                blockers.push('All source version surfaces must equal the exact supported beta.13.1.');
+            }
+        }
+        const otherRunningSteps = snapshot.tasks.flatMap((candidate) => candidate.steps.filter((step) => step.status === 'in_progress' && (candidate.id !== taskId || step.id !== binding?.stepId)));
+        if (otherRunningSteps.length)
+            blockers.push('No other Step may be running.');
+        const stale = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= this.now().getTime());
+        if (snapshot.leases.some((lease) => !stale.includes(lease)))
+            blockers.push('No live writer lease may exist.');
+        if (stale.some((lease) => lease.entityId !== taskId))
+            blockers.push('No unrelated stale writer lease may exist.');
+        const staleLeaseRepair = blockers.length === 0 && binding
+            ? stale.map((lease) => ({ action: 'locks repair', entityId: lease.entityId })) : [];
+        if (stale.length)
+            blockers.push('Repair the exact stale Task lease with the installed source locks repair, then rerun source preflight.');
+        return { readOnly: true, eligible: blockers.length === 0 && binding !== null, binding,
+            bindingHash: binding ? pendingReviewBindingHash(binding) : null, blockers, staleLeaseRepair };
+    }
+    pendingReviewDependencyPreflight(repository, taskId, source) {
+        const snapshot = this.observationSnapshot(repository);
+        const blockers = observationPreflightBlockers(snapshot.observation);
+        try {
+            pendingReviewRunnerFingerprint();
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        const taskHead = headCommit(snapshot.identity.repositoryRoot);
+        let baseTransportCommit = null;
+        if (snapshot.leases.length)
+            blockers.push('No live or stale writer lease may exist.');
+        if (!task)
+            blockers.push('Task not found.');
+        if (task && existsSync(path.join(this.store.taskRoot(task.projectId, task.id), PENDING_REVIEW_UPDATE_SIDECAR)))
+            blockers.push('A pending review update is already recorded.');
+        if (task) {
+            try {
+                // Receipt fields are claims, not authority. Reconstruct every source binding from
+                // canonical Task/sidecars and the exact parents of the candidate Git commits.
+                const parent = runGit(repository, ['rev-parse', 'HEAD^']);
+                baseTransportCommit = runGit(repository, ['rev-parse', task.baseBranch]);
+                const baseParent = runGit(repository, ['rev-parse', `${baseTransportCommit}^`]);
+                const reconstructed = pendingReviewSourceBinding(repository, this.store, task, parent, baseParent);
+                if (canonicalJsonStringify(reconstructed) !== canonicalJsonStringify(source)) {
+                    throw new Error('Source receipt does not match reconstructed Task/revision/Plan/HEAD/pending bindings.');
+                }
+                assertPendingReviewTransport(repository, reconstructed, taskHead, baseTransportCommit);
+                if (snapshot.tasks.some((candidate) => candidate.steps.some((step) => step.status === 'in_progress' && (candidate.id !== taskId || step.id !== source.stepId)))) {
+                    throw new Error('No other Step may be running.');
+                }
+                const versions = inspectWorkflowVersions(repository, [task.baseBranch]);
+                if ([versions.runtime, versions.declared, versions.locked, versions.installed, versions.currentBranch,
+                    ...versions.milestoneBases.map((base) => base.version)].some((version) => version !== PACKAGE_VERSION)) {
+                    throw new Error('All target version surfaces must equal the exact target runner.');
+                }
+            }
+            catch (error) {
+                blockers.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        return { readOnly: true, eligible: blockers.length === 0, blockers, taskHead, baseTransportCommit };
+    }
+    recoverPendingReviewDependency(repository, taskId, expectedRevision, source, actor, reason) {
+        if (!actor.trim() || !reason.trim())
+            throw new WorkflowError('INVALID_ARGUMENT', 'Actor and reason are required.');
+        const initial = this.pendingReviewDependencyPreflight(repository, taskId, source);
+        if (!initial.eligible)
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pending review dependency preflight failed.', initial);
         const context = this.#mutationContext(repository);
-        const tasks = context.store.listTasks(context.identity.projectId);
-        const milestones = context.store.listMilestones(context.identity.projectId);
-        return applyAdoptionPosture(this.store, {
-            projectId: context.identity.projectId,
-            repositoryIdentity: context.identity,
-            packageVersion: PACKAGE_VERSION,
-            protocolVersion: PROTOCOL_VERSION,
-            stateSchemaVersion: STATE_SCHEMA_VERSION,
-            tasks,
-            milestones,
-            sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
-            blockers: this.computeAdoptionBoundaryBlockers(context.identity, tasks, context.locks.list()),
-            now: this.now(),
-        }, actor, confirmationCode);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const preflight = this.pendingReviewDependencyPreflight(repository, taskId, source);
+        if (!preflight.eligible || !preflight.baseTransportCommit) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Pending review dependency preflight changed.', preflight);
+        }
+        const now = this.now();
+        const nextTask = { ...task, revision: task.revision + 1, updatedAt: now.toISOString(),
+            systemCommits: [...task.systemCommits, preflight.taskHead],
+            dependencyProvenanceRecoveries: [...(task.dependencyProvenanceRecoveries ?? []), {
+                    commitSha: preflight.taskHead, parentCommitSha: source.completionCommit,
+                    packageName: PACKAGE_NAME, packageVersion: PACKAGE_VERSION, files: ['package-lock.json', 'package.json'],
+                    actor: actor.trim(), reason: reason.trim(), recordedAt: now.toISOString(),
+                }] };
+        const projectRoot = this.store.projectRoot(task.projectId);
+        const event = preparePendingReviewUpdateEvent({ source, baseTransportCommit: preflight.baseTransportCommit }, preflight.taskHead, now.toISOString());
+        applyProjectTransaction({ projectRoot, projectId: task.projectId,
+            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
+            kind: 'pending-review-dependency-recovery', now,
+            targets: [{ path: path.relative(projectRoot, path.join(this.store.taskRoot(task.projectId, task.id), 'state.json')).split(path.sep).join('/'),
+                    content: `${JSON.stringify(nextTask, null, 2)}\n` },
+                { path: path.relative(projectRoot, path.join(this.store.taskRoot(task.projectId, task.id), PENDING_REVIEW_UPDATE_SIDECAR)).split(path.sep).join('/'),
+                    content: `${canonicalJsonStringify(event)}\n` }],
+            validate: () => {
+                const saved = this.store.readTask(task.projectId, task.id);
+                if (saved.revision !== nextTask.revision || !verifiedPendingReviewTransport(repository, saved, source.stepId, this.store.taskRoot(task.projectId, task.id))) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Pending review dependency recovery readback failed.');
+                }
+                const cycle = buildCurrentStrictStepReviewCycle(this.store, saved, source.stepId);
+                if (cycle.resolution !== 'pending' || cycle.pendingEvent?.eventHash !== source.pendingEventHash) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Pending review changed during dependency recovery.');
+                }
+            },
+        });
+        return this.store.readTask(task.projectId, task.id);
     }
     updatePreflight(repository) {
         const snapshot = this.observationSnapshot(repository);
@@ -3669,6 +4195,9 @@ export class WorkflowService {
         const now = this.now().getTime();
         const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
         const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
+        const pendingPreExecutionReplanTaskIds = tasks
+            .filter((task) => readCurrentPreExecutionReplan(this.store, task) !== null)
+            .map((task) => task.id);
         const activeMilestones = milestones.filter((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         const inspectedVersions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
         const milestoneBases = inspectedVersions.milestoneBases.map((base) => ({
@@ -3696,6 +4225,9 @@ export class WorkflowService {
             ...(runningSteps.length > 0 ? ['At least one Worker Step is in progress.'] : []),
             ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
             ...(staleLeases.length > 0 ? ['At least one stale writer lease requires explicit repair.'] : []),
+            ...(pendingPreExecutionReplanTaskIds.length > 0
+                ? [`Complete the pending pre-execution Plan replacement and reauthorization first: ${pendingPreExecutionReplanTaskIds.join(', ')}.`]
+                : []),
             ...versionBlockers,
             ...observationPreflightBlockers(snapshot.observation),
         ];
@@ -3721,10 +4253,12 @@ export class WorkflowService {
                 milestoneBases,
             },
             dependencyTransport: {
-                safe: versionBlockers.length === 0,
-                requiredAction: versionBlockers.length === 0
-                    ? null
-                    : 'Land only package.json/package-lock.json dependency changes on every active Milestone base; do not transport unrelated product commits.',
+                safe: versionBlockers.length === 0 && pendingPreExecutionReplanTaskIds.length === 0,
+                requiredAction: pendingPreExecutionReplanTaskIds.length > 0
+                    ? 'Complete each pending pre-execution task plan-set and reauthorization before changing Workflow dependency HEAD.'
+                    : versionBlockers.length === 0
+                        ? null
+                        : 'Land only package.json/package-lock.json dependency changes on every active Milestone base; do not transport unrelated product commits.',
             },
             adoption: snapshot.adoption,
             observation: snapshot.observation,
@@ -3740,7 +4274,299 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        return this.inspectDependencyProvenanceCandidate(snapshot, task);
+        const candidate = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, headCommit(snapshot.identity.repositoryRoot));
+        const carryover = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task, undefined, candidate?.parentCommitSha);
+        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, null, null, carryover.eligible ? carryover.compatibility : null);
+        if (!preflight.rootCauseReplan)
+            return preflight;
+        let baseTip = null;
+        let baseDependency = null;
+        try {
+            baseTip = runGit(snapshot.identity.repositoryRoot, ['rev-parse', task.baseBranch]);
+            baseDependency = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, baseTip);
+        }
+        catch {
+            // The blocker below keeps a missing or unreadable base reference fail closed.
+        }
+        const bridgeBlockers = [
+            ...(preflight.dependencyCommits.length !== 1
+                ? ['Corrective carryover recovery requires exactly one Task dependency-only commit.'] : []),
+            ...(preflight.parentCommitSha !== preflight.rootCauseReplan.sourceHeadCommit
+                ? ['Corrective carryover dependency parent must equal the bound source HEAD.'] : []),
+            ...(preflight.parentCommitSha
+                && workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha) !== '2.0.0-beta.13.6'
+                ? ['Corrective carryover dependency parent must declare exact source beta.13.6.'] : []),
+            ...(preflight.dependencyCommits.at(-1)?.packageVersion !== PACKAGE_VERSION
+                ? [`Corrective carryover dependency commit must declare exact target ${PACKAGE_VERSION}.`] : []),
+            ...(!baseDependency
+                || baseDependency.commitSha !== baseTip
+                || baseDependency.packageVersion !== PACKAGE_VERSION
+                || workflowDependencyVersionAt(snapshot.identity.repositoryRoot, baseDependency.parentCommitSha)
+                    !== workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha ?? '')
+                ? ['Corrective carryover Milestone-base tip must be one dependency-only commit with the same exact source and runtime target.'] : []),
+        ];
+        return bridgeBlockers.length === 0
+            ? preflight
+            : {
+                ...preflight,
+                eligible: false,
+                action: null,
+                commitSha: null,
+                parentCommitSha: null,
+                blockers: [...new Set([...preflight.blockers, ...bridgeBlockers])],
+            };
+    }
+    correctiveCarryoverUpdatePreflight(repository, taskId, candidate = null) {
+        const snapshot = this.observationSnapshot(repository);
+        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
+        if (!task)
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
+        const sourceVersion = '2.0.0-beta.13.6';
+        const targetVersion = CONSUMED_CARRYOVER_TARGET_VERSION;
+        const sourceSurfaces = {
+            declared: versions.declared,
+            locked: versions.locked,
+            installed: versions.installed,
+            currentBranch: versions.currentBranch,
+            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
+        };
+        const c1 = readTaskC1Posture(this.store, task);
+        if (c1.state !== 'claimed') {
+            return this.consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate);
+        }
+        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task);
+        const now = this.now().getTime();
+        const activeLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now);
+        const staleLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
+        const transactionCount = snapshot.observation.pendingProjectTransactions.length
+            + snapshot.observation.pendingMilestoneTransactions.length
+            + snapshot.observation.pendingTaskTransactions.length;
+        const authorizationBlockers = [];
+        if (assessment.eligible) {
+            try {
+                this.assertExecutionAuthorizationFresh(task, snapshot.identity.repositoryRoot);
+            }
+            catch (error) {
+                authorizationBlockers.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+        const baseBlockers = [
+            ...assessment.blockers,
+            ...authorizationBlockers,
+            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
+            ...Object.entries(sourceSurfaces)
+                .filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
+            ...observationPreflightBlockers(snapshot.observation),
+            ...(transactionCount > 0 ? ['No pending Workflow transaction may exist.'] : []),
+            ...(snapshot.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
+            ...(snapshot.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
+            ...(c1.state !== 'claimed' || assessment.compatibility?.claimant !== c1.claimant
+                ? ['The exact original Worker C1 claim must remain current.'] : []),
+            ...(activeLeases.length > 0 ? ['No live writer lease may exist during corrective carryover transport.'] : []),
+            ...(staleLeases.some((lease) => lease.entityId !== task.id
+                || c1.state !== 'claimed' || lease.owner !== c1.claimant
+                || createHash('sha256').update(lease.token).digest('hex') !== c1.writerLeaseTokenHash)
+                ? ['No unrelated or differently owned stale writer lease may exist.'] : []),
+            ...(staleLeases.length > 1 ? ['At most the exact corrective Task stale lease may exist.'] : []),
+        ];
+        const repairableStale = baseBlockers.length === 0 && staleLeases.length === 1
+            ? staleLeases[0]
+            : null;
+        const blockers = [
+            ...baseBlockers,
+            ...(repairableStale
+                ? ['Repair the exact expired claimant lease with source locks repair, then run status, next, and this preflight again.']
+                : []),
+        ];
+        const compatibility = assessment.compatibility;
+        return {
+            readOnly: true,
+            eligible: Boolean(assessment.eligible && compatibility && blockers.length === 0 && staleLeases.length === 0),
+            action: assessment.eligible && compatibility && blockers.length === 0 && staleLeases.length === 0
+                ? 'update corrective-carryover-transport'
+                : null,
+            projectId: task.projectId,
+            taskId: task.id,
+            taskRevision: task.revision,
+            stepId: compatibility?.stepId ?? null,
+            sourceVersion,
+            targetVersion,
+            sourceHeadCommit: compatibility?.sourceHeadCommit ?? null,
+            taskBranch: task.taskBranch,
+            baseBranch: task.baseBranch,
+            dirtyFiles: compatibility?.dirtyFiles ?? [],
+            dirtyWorktreeHash: compatibility?.dirtyWorktreeHash ?? null,
+            compatibilityHash: compatibility?.compatibilityHash ?? null,
+            c1Posture: c1.state === 'claimed' ? {
+                state: 'claimed',
+                claimant: c1.claimant,
+                claimEventId: compatibility?.c1ClaimEventId ?? null,
+                claimEventHash: compatibility?.c1ClaimEventHash ?? null,
+            } : null,
+            staleLeaseRepair: repairableStale ? [{
+                    action: 'locks repair',
+                    entityId: task.id,
+                    owner: repairableStale.owner,
+                    expiresAt: repairableStale.expiresAt,
+                }] : [],
+            requiredTransport: [
+                'Commit only package.json and package-lock.json on the active Milestone base.',
+                'Commit only the same dependency files on the Task branch while preserving the bound dirty bytes.',
+                'Install the exact target package, register dependency provenance, refresh context, replace the same Worker credential, then follow fresh next.',
+            ],
+            blockers,
+        };
+    }
+    consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate) {
+        const repositoryRoot = snapshot.identity.repositoryRoot;
+        const sourceVersion = '2.0.0-beta.13.6';
+        const targetVersion = CONSUMED_CARRYOVER_TARGET_VERSION;
+        const c1 = readTaskC1Posture(this.store, task);
+        const recorded = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan && task.systemCommits.includes(record.commitSha))?.rootCauseReplan;
+        const currentHead = headCommit(repositoryRoot);
+        const dirtyFiles = changedFiles(repositoryRoot).sort();
+        const dirtyWorktreeHash = hashDirtyWorktree(repositoryRoot, dirtyFiles);
+        const navigation = this.next(repositoryRoot, task.id);
+        const action = String(navigation.action);
+        const stepId = typeof navigation.stepId === 'string' ? navigation.stepId : null;
+        const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+        const terminal = readRemediationEvents(this.store, task)
+            .filter((event) => event.stepId === stepId && event.failureKind === 'checks-failed').at(-1);
+        const matchingYields = readTaskHandoffEvents(this.store, task).filter((event) => terminal && matchesTerminalCorrectiveYield(event, terminal, task.id));
+        const yielded = matchingYields.length === 1 ? matchingYields[0] : null;
+        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId ?? undefined);
+        const missingClaimOnly = assessment.blockers.length === 1
+            && assessment.blockers[0].startsWith('Corrective carryover requires the retained claimed C1');
+        const rollingWave = navigation.rollingWave;
+        const sourceActionAllowed = (action === 'task plan-set' && step?.status === 'failed'
+            && rollingWave?.state === 'root-cause-replan-required' && !assessment.applicable && c1.state === 'none')
+            || (action === 'task handoff-prepare' && step?.status === 'planned' && missingClaimOnly && c1.state === 'none')
+            || (action === 'task claim' && step?.status === 'planned' && missingClaimOnly
+                && c1.state === 'pending' && c1.targetActor === yielded?.actor);
+        const blockers = [
+            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
+            ...Object.entries(sourceSurfaces).filter(([, version]) => version !== sourceVersion)
+                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
+            ...observationPreflightBlockers(snapshot.observation),
+            ...(snapshot.leases.length > 0 ? ['No active or stale writer lease may exist before source recovery.'] : []),
+            ...(snapshot.observation.pendingProjectTransactions.length
+                + snapshot.observation.pendingMilestoneTransactions.length
+                + snapshot.observation.pendingTaskTransactions.length
+                + snapshot.observation.corruptTaskTransactions.length
+                + snapshot.observation.coreTaskOperations.length > 0 ? ['No pending or corrupt transaction or Core operation may exist.'] : []),
+            ...(!recorded || recorded.stepId === stepId
+                || task.steps.find((candidate) => candidate.id === recorded.stepId)?.status !== 'completed'
+                ? ['A different, verified completed Step must own the historical carryover binding.'] : []),
+            ...(!sourceActionAllowed ? ['No exact source Plan replacement or original-Worker handoff action is eligible.'] : []),
+            ...(!(task.status === 'ready' || (action === 'task plan-set' && task.status === 'needs_fix'))
+                || task.workspaceOwner !== 'local'
+                || currentBranch(repositoryRoot) !== task.taskBranch
+                || task.steps.some((candidate) => candidate.status === 'in_progress')
+                ? ['The Task must retain its local, no-running-Step source recovery boundary.'] : []),
+            ...(!step || dirtyFiles.length === 0
+                || dirtyFiles.some((file) => !pathAllowed(file, step.allowedWrites) || pathAllowed(file, step.forbiddenScope))
+                ? ['Retained dirty files must remain inside the exact current Step scope.'] : []),
+            ...(!terminal || terminal.failureEvidence.completionCommit !== currentHead
+                || terminal.failureEvidence.dirtyWorktreeHash !== dirtyWorktreeHash
+                ? ['The terminal repeated failure HEAD and dirty-byte binding must remain unchanged.'] : []),
+            ...(!yielded || !terminal || yielded.planHash === null
+                || !Number.isFinite(Date.parse(yielded.recordedAt))
+                || Date.parse(yielded.recordedAt) < Date.parse(terminal.recordedAt)
+                ? ['The terminal failure must retain its exact completed original-Worker corrective yield.'] : []),
+        ];
+        let candidateBinding = null;
+        if (action === 'task plan-set') {
+            if (!candidate) {
+                blockers.push('Source Plan replacement requires candidate Plan and independent Plan Risk Audit inputs.');
+            }
+            else {
+                try {
+                    validatePlan(candidate.plan);
+                    const retained = deriveCompletedStepCarryover(task, candidate.plan.steps);
+                    if (task.steps.some((completed) => completed.status === 'completed' && !retained.has(completed.id))) {
+                        throw new Error('Candidate must preserve every completed Step definition and its execution authority exactly.');
+                    }
+                    const correctiveStep = candidate.plan.steps.find((candidateStep) => candidateStep.id === stepId);
+                    if (!correctiveStep || dirtyFiles.some((file) => !pathAllowed(file, correctiveStep.allowedWrites) || pathAllowed(file, correctiveStep.forbiddenScope))) {
+                        throw new Error('Candidate must retain the exact failed Step and confine every dirty path to its replacement scope.');
+                    }
+                    if (correctiveStep.dependencies.some((dependency) => !retained.has(dependency))) {
+                        throw new Error('Candidate corrective Step dependencies must retain completed execution authority.');
+                    }
+                    if (candidate.plan.objective !== task.planObjective
+                        || canonicalJsonStringify(candidate.plan.requirements) !== canonicalJsonStringify(task.requirements)
+                        || canonicalJsonStringify(candidate.plan.acceptance) !== canonicalJsonStringify(task.acceptance)) {
+                        throw new Error('Candidate cannot change Task objective, requirements or acceptance.');
+                    }
+                    const map = this.assertKnowledgeMapBinding(repositoryRoot, task.projectId, candidate.plan.knowledgeMapRevision, candidate.plan.knowledgeMapHash);
+                    this.validateKnowledgeTargets(map, candidate.plan);
+                    const prepared = prepareCorrectiveReplanCandidate(task, candidate.plan);
+                    if (!task.planHash || normalizePlanKnowledgeBinding(prepared.planBytes, 'source recovery candidate').semanticHash
+                        === normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), task.planHash, task.planHash), 'current failed Plan').semanticHash) {
+                        throw new Error('Candidate must change the failed Plan semantics before source recovery.');
+                    }
+                    if (!['approved', 'approved-with-rationale'].includes(candidate.planRiskAudit.decision)) {
+                        throw new Error('Source recovery candidate requires a positive independent Plan Risk Audit.');
+                    }
+                    const auditTask = {
+                        ...task, status: 'awaiting_execution_authorization', planHash: prepared.planHash,
+                        knowledgeMapRevision: candidate.plan.knowledgeMapRevision,
+                        knowledgeMapHash: candidate.plan.knowledgeMapHash,
+                        steps: candidate.plan.steps.map((candidateStep) => retained.get(candidateStep.id) ?? {
+                            ...candidateStep, status: 'planned', evidence: null, failurePause: null,
+                        }),
+                    };
+                    validatePlanRiskAuditCandidate(this.store, auditTask, candidate.planRiskAudit);
+                    candidateBinding = {
+                        candidatePlanHash: prepared.planHash,
+                        candidateInputHash: sha256Hex(canonicalJsonStringify(candidate.plan)),
+                        riskAuditInputHash: sha256Hex(canonicalJsonStringify(candidate.planRiskAudit)),
+                    };
+                }
+                catch (error) {
+                    blockers.push(error instanceof Error ? error.message : String(error));
+                }
+            }
+        }
+        try {
+            validateTaskHistory(repositoryRoot, task);
+            this.assertTaskKnowledgeBinding(repositoryRoot, task);
+            const sourceAudit = [...readPlanRiskAuditEvents(this.store, task)].reverse().find((event) => event.taskRevision <= (terminal?.failureEvidence.executionTaskRevision ?? -1));
+            if (!sourceAudit || !yielded?.planHash || !task.planHash
+                || normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), sourceAudit.planHash, task.planHash), 'terminal source').semanticHash
+                    !== normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), yielded.planHash, task.planHash), 'terminal corrective yield').semanticHash) {
+                throw new Error('Terminal failure and exact corrective yield must share a verified source Plan.');
+            }
+        }
+        catch (error) {
+            blockers.push(error instanceof Error ? error.message : String(error));
+        }
+        const binding = {
+            taskId: task.id, taskRevision: task.revision, stepId, briefHash: task.briefHash,
+            planHash: task.planHash, planRiskAuditEventHash: readCurrentPlanRiskAudit(this.store, task)?.audit.eventHash ?? null,
+            sourceHeadCommit: currentHead, dirtyFiles, dirtyWorktreeHash,
+            completedStepsHash: hashCompletedSteps(task), historicalCarryoverHash: recorded?.compatibilityHash ?? null,
+            terminalRemediationEventHash: terminal?.eventHash ?? null,
+            correctiveYieldEventHash: yielded?.eventHash ?? null, originalWorker: yielded?.actor ?? null,
+            c1Posture: c1.state,
+            candidateBinding,
+        };
+        return {
+            readOnly: true, eligible: false, sourceVersion, targetVersion, ...binding,
+            action: null, transportAllowed: false,
+            ...(action === 'task plan-set' ? { taskPlanContract: navigation.taskPlanContract } : {}),
+            compatibilityHash: sha256Hex(canonicalJsonStringify(binding)),
+            sourceRecovery: blockers.length === 0 ? {
+                eligible: true, action,
+                ...(action === 'task plan-set' ? { ...candidateBinding } : {}),
+                ...(action === 'task handoff-prepare' ? { targetActor: yielded.actor } : {}),
+                ...(action === 'task claim' ? { actor: yielded.actor } : {}),
+                instruction: 'Execute only this exact action with the installed source package; run source status then next and repeat this read-only preflight. Ordinary Plan Risk Audit and execution authorization retain their normal gates.',
+            } : null,
+            blockers,
+        };
     }
     historicalStepProvenanceRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
@@ -4211,7 +5037,9 @@ export class WorkflowService {
                     ? Boolean(record.historicalStepProvenance)
                     : recoveryMode === 'plan-integrity'
                         ? Boolean(record.planIntegrity)
-                        : Boolean(record.activeDownstreamProof) === recoveryMode));
+                        : recoveryMode === false && record.rootCauseReplan
+                            ? true
+                            : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -4227,13 +5055,26 @@ export class WorkflowService {
                     ? this.planIntegrityDependencyRecoveryPreflight(repository, taskId)
                     : recoveryMode
                         ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
-                        : this.inspectDependencyProvenanceCandidate(snapshot, task);
+                        : this.dependencyProvenanceRecoveryPreflight(repository, taskId);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
                 blockers: preflight.blockers,
             });
         }
+        if (preflight.rootCauseReplan) {
+            const posture = readTaskC1Posture(this.store, task);
+            if (posture.state !== 'claimed'
+                || posture.claimant !== preflight.rootCauseReplan.claimant
+                || normalizedActor !== posture.claimant) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Corrective carryover dependency recovery requires the exact retained C1 claimant actor.', {
+                    taskId,
+                    actor: normalizedActor,
+                    requiredActor: preflight.rootCauseReplan.claimant,
+                    posture: posture.state,
+                });
+            }
+        }
         const now = this.now();
         const recoveredRecords = preflight.dependencyCommits.map((dependencyCommit, index) => {
             const isTerminalCommit = index === preflight.dependencyCommits.length - 1;
@@ -4259,6 +5100,9 @@ export class WorkflowService {
                 ...(isTerminalCommit && preflight.planIntegrity
                     ? { planIntegrity: preflight.planIntegrity }
                     : {}),
+                ...(isTerminalCommit && preflight.rootCauseReplan
+                    ? { rootCauseReplan: preflight.rootCauseReplan }
+                    : {}),
             };
         });
         const nextTask = {
@@ -4585,6 +5429,18 @@ export class WorkflowService {
         const existing = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
+    explainChange(repository, taskId, input) {
+        const status = this.statusFromSnapshot(this.observationSnapshot(repository));
+        const task = status.tasks.find(candidate => candidate.id === taskId);
+        if (!task && status.observation.kind === 'assessment') {
+            throw new WorkflowError('INVALID_ARGUMENT', 'The requested Task is not present in the current observation.');
+        }
+        const navigation = this.nextFromStatus(repository, taskId, status);
+        const step = task?.steps.find(candidate => candidate.id === navigation.stepId)
+            ?? task?.steps.find(candidate => candidate.status === 'in_progress' || candidate.status === 'failed');
+        const effectiveTask = task && step ? taskWithEffectiveStepAllowedWrites(this.store, task, step.id) : task;
+        return explainChange(input, repository, effectiveTask, navigation);
+    }
     next(repository, taskId = null) {
         return withObservedRouteMetadata(this.nextFromStatus(repository, taskId, this.statusFromSnapshot(this.observationSnapshot(repository))));
     }
@@ -4696,6 +5552,37 @@ export class WorkflowService {
         }
         const withAdoption = (value) => ({
             ...value,
+            ...(status.milestones.some((milestone) => milestone.status === 'active' && milestone.planHash)
+                ? { activeMilestoneAutonomyOptions: status.milestones
+                        .filter((milestone) => milestone.status === 'active' && milestone.planHash)
+                        .filter((milestone) => {
+                        const event = readMilestoneAutonomyEvents(this.store, status.projectId, milestone.id).at(-1);
+                        if (!event)
+                            return true;
+                        try {
+                            requireActiveMilestoneAutonomy({
+                                store: this.store, projectId: status.projectId, milestone,
+                                actor: event.delegate, now: this.now(),
+                            });
+                            return false;
+                        }
+                        catch (error) {
+                            if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                                return true;
+                            if (error instanceof WorkflowError && error.code === 'NOT_FOUND')
+                                return true;
+                            throw error;
+                        }
+                    })
+                        .map((milestone) => ({
+                        action: 'milestone autonomy-prepare',
+                        milestoneId: milestone.id,
+                        expectedRevision: milestone.revision,
+                        requiresExactHumanConfirmation: true,
+                        maximumDurationHours: 72,
+                        preparationRequired: true,
+                        meaning: 'Optional human-requested preparation; existing valid contracts cannot be replaced. Knowledge must be active.',
+                    })) } : {}),
             adoption: adoptionInfo,
             observation: status.observation,
         });
@@ -4748,6 +5635,19 @@ export class WorkflowService {
             ?? prioritizedRemediationTask
             ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
+            let pendingReviewDependencyRecovery = null;
+            try {
+                const reconstructed = pendingReviewSourceBinding(repositoryRoot, this.store, activeTask, runGit(repositoryRoot, ['rev-parse', 'HEAD^']), runGit(repositoryRoot, ['rev-parse', `${activeTask.baseBranch}^`]));
+                pendingReviewDependencyRecovery = this.pendingReviewDependencyPreflight(repositoryRoot, activeTask.id, reconstructed);
+            }
+            catch { /* A nonmatching shape follows ordinary navigation without a compatibility bypass. */ }
+            if (pendingReviewDependencyRecovery?.eligible) {
+                return withAdoption({ scope: 'task', id: activeTask.id, status: activeTask.status,
+                    action: 'update pending-review-dependency-recover', revision: activeTask.revision,
+                    pendingReviewDependencyRecovery,
+                    sourceReceiptRequired: true,
+                });
+            }
             const historicalStepProvenanceRecovery = this.historicalStepProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (historicalStepProvenanceRecovery.eligible) {
                 return withAdoption({
@@ -4911,13 +5811,18 @@ export class WorkflowService {
                 && !activeTask.steps.some((step) => step.status === 'failed');
             if (activeTask.planHash && !requiresReplacementPlan) {
                 try {
-                    activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
+                    activePlanRiskAudit = readCorrectivePlanningAudit(this.store, activeTask);
                 }
                 catch (error) {
                     if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
                         throw error;
                     const blockingDecision = error.details.decision;
                     const blockingAudit = readPlanRiskAuditEvents(this.store, activeTask).at(-1) ?? null;
+                    const preExecutionReplan = readCurrentPreExecutionReplan(this.store, activeTask);
+                    const verifiedPreExecutionReplan = preExecutionReplan
+                        && blockingAudit?.eventHash === preExecutionReplan.obstructionPlanRiskAuditEventHash
+                        ? resolvePreExecutionReplanAudits(this.store, activeTask, preExecutionReplan)
+                        : null;
                     const existingRemediationEvent = blockingAudit && activeTask.milestoneId
                         ? [...readMilestoneScopeChangeEvents(this.store, status.projectId, activeTask.milestoneId)]
                             .reverse()
@@ -4936,6 +5841,9 @@ export class WorkflowService {
                         : new Map();
                     const remediationMembership = remediationMemberships.get(activeTask.id) ?? null;
                     const auditedRemediationEligible = activeTask.status === 'awaiting_execution_authorization'
+                        && activeTask.planHash !== null
+                        && activeTask.workspaceOwner === null
+                        && activeTask.steps.every(step => step.status === 'planned')
                         && remediationMilestone?.status === 'active'
                         && remediationMembership?.disposition === 'required';
                     const remediationAncestorIds = new Set();
@@ -4951,50 +5859,34 @@ export class WorkflowService {
                     const eligibleRemediationPredecessorTaskIds = [...remediationAncestorIds]
                         .filter((candidateTaskId) => tasksById.get(candidateTaskId)?.status === 'merged')
                         .sort();
-                    planRiskAuditRecovery = blockingDecision === 'stop-escalate' && auditedRemediationEligible
+                    planRiskAuditRecovery = verifiedPreExecutionReplan && preExecutionReplan
                         ? {
                             scope: 'task',
                             id: activeTask.id,
                             status: activeTask.status,
-                            action: existingRemediationTask?.status === 'merged'
-                                ? 'task plan-set'
-                                : existingRemediationTask
-                                    ? 'doctor'
-                                    : remediationDiscovery?.status === 'ready_to_materialize'
-                                        ? 'milestone remediation-materialize'
-                                        : remediationDiscovery
-                                            ? 'discovery update'
-                                            : 'discovery start',
+                            action: 'task plan-set',
                             blockedAction: 'task authorize',
                             revision: activeTask.revision,
-                            planRiskAuditDecision: {
-                                state: 'recorded-blocking',
-                                decision: blockingDecision,
-                                reason: error.message,
-                                requiredAction: 'Materialize one audited additive remediation Task, merge it, then replace the rejected Plan.',
+                            preExecutionReplan: {
+                                state: 'recorded',
+                                eventId: preExecutionReplan.eventId,
+                                eventHash: preExecutionReplan.eventHash,
+                                sourcePlanHash: preExecutionReplan.sourcePlanHash,
+                                sourceHeadCommit: preExecutionReplan.sourceHeadCommit,
+                                obstructionPlanRiskAuditEventId: preExecutionReplan.obstructionPlanRiskAuditEventId,
+                                obstructionPlanRiskAuditEventHash: preExecutionReplan.obstructionPlanRiskAuditEventHash,
+                                preservesTaskScope: true,
+                                preservesCompletedStepAuthority: true,
+                                requiredAction: 'Replace the obstructed implementation Plan through ordinary task plan-set.',
                             },
-                            auditedRemediation: {
-                                state: existingRemediationTask?.status === 'merged'
-                                    ? 'merged-replan-required'
-                                    : existingRemediationTask
-                                        ? 'materialized-not-merged'
-                                        : remediationDiscovery?.status === 'ready_to_materialize'
-                                            ? 'ready-to-materialize'
-                                            : 'discovery-required',
-                                humanApprovalRequired: false,
-                                blockedTaskId: activeTask.id,
-                                blockedTaskRevision: activeTask.revision,
-                                milestoneId: remediationMilestone.id,
-                                milestoneRevision: remediationMilestone.revision,
-                                planRiskAuditEventId: blockingAudit?.eventId ?? null,
-                                planRiskAuditEventHash: blockingAudit?.eventHash ?? null,
-                                discoveryId: remediationDiscovery?.id ?? null,
-                                discoveryRevision: remediationDiscovery?.revision ?? null,
-                                remediationTaskId: existingRemediationTask?.id ?? null,
-                                remediationTaskStatus: existingRemediationTask?.status ?? null,
-                                requiredPredecessorTaskIds: [...(remediationMembership.dependsOnTaskIds ?? [])],
-                                eligibleMergedAncestorTaskIds: eligibleRemediationPredecessorTaskIds,
-                                command: existingRemediationTask?.status === 'merged'
+                            taskPlanContract: this.taskPlanContract(status.projectId, activeTask),
+                        }
+                        : blockingDecision === 'stop-escalate' && auditedRemediationEligible
+                            ? {
+                                scope: 'task',
+                                id: activeTask.id,
+                                status: activeTask.status,
+                                action: existingRemediationTask?.status === 'merged'
                                     ? 'task plan-set'
                                     : existingRemediationTask
                                         ? 'doctor'
@@ -5003,46 +5895,84 @@ export class WorkflowService {
                                             : remediationDiscovery
                                                 ? 'discovery update'
                                                 : 'discovery start',
-                                boundedEffect: 'append-one-required-remediation-task-and-add-one-blocked-task-dependency',
-                                preservesMilestoneSemantics: true,
-                            },
-                            taskPlanContract: this.taskPlanContract(status.projectId, activeTask),
-                        }
-                        : blockingDecision === 'stop-escalate' || blockingDecision === 'split-required'
-                            ? {
-                                scope: 'task',
-                                id: activeTask.id,
-                                status: activeTask.status,
-                                action: blockingDecision === 'stop-escalate' ? 'task plan-set' : 'doctor',
                                 blockedAction: 'task authorize',
                                 revision: activeTask.revision,
                                 planRiskAuditDecision: {
                                     state: 'recorded-blocking',
                                     decision: blockingDecision,
                                     reason: error.message,
-                                    requiredAction: blockingDecision === 'stop-escalate'
-                                        ? 'Replace the rejected Step Plan before requesting fresh authorization.'
-                                        : 'Resolve the required cross-Task split through an explicit Milestone topology decision.',
+                                    requiredAction: 'Materialize one audited additive remediation Task, merge it, then replace the rejected Plan.',
                                 },
-                                ...(blockingDecision === 'stop-escalate'
-                                    ? { taskPlanContract: this.taskPlanContract(status.projectId, activeTask) }
-                                    : {}),
-                            }
-                            : {
-                                scope: 'task',
-                                id: activeTask.id,
-                                status: activeTask.status,
-                                action: 'task plan-risk-audit',
-                                revision: activeTask.revision,
-                                planRiskAuditRecovery: {
-                                    state: 'required',
-                                    reason: error.message,
-                                    currentBriefHash: activeTask.briefHash,
-                                    currentPlanHash: activeTask.planHash,
-                                    knowledgeMapRevision: activeTask.knowledgeMapRevision,
-                                    knowledgeMapHash: activeTask.knowledgeMapHash,
+                                auditedRemediation: {
+                                    state: existingRemediationTask?.status === 'merged'
+                                        ? 'merged-replan-required'
+                                        : existingRemediationTask
+                                            ? 'materialized-not-merged'
+                                            : remediationDiscovery?.status === 'ready_to_materialize'
+                                                ? 'ready-to-materialize'
+                                                : 'discovery-required',
+                                    humanApprovalRequired: false,
+                                    blockedTaskId: activeTask.id,
+                                    blockedTaskRevision: activeTask.revision,
+                                    milestoneId: remediationMilestone.id,
+                                    milestoneRevision: remediationMilestone.revision,
+                                    planRiskAuditEventId: blockingAudit?.eventId ?? null,
+                                    planRiskAuditEventHash: blockingAudit?.eventHash ?? null,
+                                    discoveryId: remediationDiscovery?.id ?? null,
+                                    discoveryRevision: remediationDiscovery?.revision ?? null,
+                                    remediationTaskId: existingRemediationTask?.id ?? null,
+                                    remediationTaskStatus: existingRemediationTask?.status ?? null,
+                                    requiredPredecessorTaskIds: [...(remediationMembership.dependsOnTaskIds ?? [])],
+                                    eligibleMergedAncestorTaskIds: eligibleRemediationPredecessorTaskIds,
+                                    command: existingRemediationTask?.status === 'merged'
+                                        ? 'task plan-set'
+                                        : existingRemediationTask
+                                            ? 'doctor'
+                                            : remediationDiscovery?.status === 'ready_to_materialize'
+                                                ? 'milestone remediation-materialize'
+                                                : remediationDiscovery
+                                                    ? 'discovery update'
+                                                    : 'discovery start',
+                                    boundedEffect: 'append-one-required-remediation-task-and-add-one-blocked-task-dependency',
+                                    preservesMilestoneSemantics: true,
                                 },
-                            };
+                                taskPlanContract: this.taskPlanContract(status.projectId, activeTask),
+                            }
+                            : blockingDecision === 'stop-escalate' || blockingDecision === 'split-required'
+                                ? {
+                                    scope: 'task',
+                                    id: activeTask.id,
+                                    status: activeTask.status,
+                                    action: blockingDecision === 'stop-escalate' ? 'task plan-set' : 'doctor',
+                                    blockedAction: 'task authorize',
+                                    revision: activeTask.revision,
+                                    planRiskAuditDecision: {
+                                        state: 'recorded-blocking',
+                                        decision: blockingDecision,
+                                        reason: error.message,
+                                        requiredAction: blockingDecision === 'stop-escalate'
+                                            ? 'Replace the rejected Step Plan before requesting fresh authorization.'
+                                            : 'Resolve the required cross-Task split through an explicit Milestone topology decision.',
+                                    },
+                                    ...(blockingDecision === 'stop-escalate'
+                                        ? { taskPlanContract: this.taskPlanContract(status.projectId, activeTask) }
+                                        : {}),
+                                }
+                                : {
+                                    scope: 'task',
+                                    id: activeTask.id,
+                                    status: activeTask.status,
+                                    action: 'task plan-risk-audit',
+                                    revision: activeTask.revision,
+                                    planRiskAuditRecovery: {
+                                        state: 'required',
+                                        reason: error.message,
+                                        currentBriefHash: activeTask.briefHash,
+                                        currentPlanHash: activeTask.planHash,
+                                        knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                                        knowledgeMapHash: activeTask.knowledgeMapHash,
+                                    },
+                                };
                 }
             }
             const taskNext = activeTask.status === 'planning'
@@ -5092,7 +6022,7 @@ export class WorkflowService {
                 || taskNext?.action === 'task downstream-proof-recover'
                 || taskNext?.action === 'task remediation-mode-recover'
                 || (taskNext?.action === 'task writer-credential-replace'
-                    && taskNext?.blockedAction === 'task remediation-mode-recover')
+                    && ['task step-complete', 'task step-review', 'task remediation-mode-recover'].includes(String(taskNext?.blockedAction)))
                 || taskNext?.action === 'task plan-integrity-recover'
                 || taskNext?.blockedAction === 'task plan-integrity-recover'
                 || taskNext?.action === 'task corrective-yield'
@@ -5168,6 +6098,7 @@ export class WorkflowService {
                             contextRefresh: {
                                 action: 'task context-refresh',
                                 mode: refreshAssessment.mode,
+                                authority: readFailedStepPlanningRecovery(this.store, activeTask) ? 'planning-only' : 'execution',
                                 addedSources: refreshAssessment.addedSources,
                                 options: contextRefreshOptions,
                             },
@@ -5524,7 +6455,9 @@ export class WorkflowService {
         return { milestone, authorization, scopeChange };
     }
     nextForTaskWithDelegation(projectId, repositoryRoot, task, planRiskAudit = null) {
-        const transition = task.status === 'awaiting_execution_authorization'
+        const planningRecovery = readFailedStepPlanningRecovery(this.store, task);
+        // A stopped rebound Plan can expose planning recovery, never an approval route.
+        const transition = planningRecovery ? null : task.status === 'awaiting_execution_authorization'
             ? 'task.execution_authorize'
             : task.status === 'awaiting_final_acceptance'
                 ? 'task.final_accept'
@@ -5565,6 +6498,9 @@ export class WorkflowService {
         }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const nextStepId = typeof next.stepId === 'string' ? next.stepId : null;
+        const rootCauseStepId = nextStepId
+            ?? task.steps.find((candidate) => candidate.status === 'planned')?.id
+            ?? null;
         const downstreamProofCarryover = next.action === 'task run'
             && nextStepId
             && changedFiles(repositoryRoot).length > 0
@@ -5575,6 +6511,24 @@ export class WorkflowService {
             && changedFiles(repositoryRoot).length > 0
             ? this.assessPostRebindCheckSupportDirtyCarryover(repositoryRoot, task, nextStepId)
             : null;
+        let rootCauseReplanDirtyCarryover = ['task run', 'task handoff-prepare', 'task claim'].includes(String(next.action))
+            && rootCauseStepId
+            && changedFiles(repositoryRoot).length > 0
+            ? this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, rootCauseStepId)
+            : null;
+        if (rootCauseReplanDirtyCarryover?.eligible) {
+            try {
+                this.assertExecutionAuthorizationFresh(task, repositoryRoot);
+            }
+            catch (error) {
+                rootCauseReplanDirtyCarryover = {
+                    applicable: true,
+                    eligible: false,
+                    compatibility: null,
+                    blockers: [error instanceof Error ? error.message : String(error)],
+                };
+            }
+        }
         let mechanicalFeasibilityOverlay = {};
         if (task.status === 'awaiting_execution_authorization' && task.planHash) {
             try {
@@ -5918,8 +6872,8 @@ export class WorkflowService {
                                 ...(task.steps.find((step) => step.id === guardedCorrectivePosture.stepId)?.status !== 'failed'
                                     ? [`${guardedCorrectivePosture.stepId} must remain failed.`]
                                     : []),
-                                ...(writerLease ? ['No active or stale writer lease may remain after the failure pause.'] : []),
-                                ...(rollingC1Posture.state !== 'none'
+                                ...(writerLease && rollingC1Posture.state !== 'claimed' ? ['No active or stale writer lease may remain after the failure pause.'] : []),
+                                ...(rollingC1Posture.state !== 'none' && rollingC1Posture.state !== 'claimed'
                                     ? ['No C1 claim may remain after the root-cause failure pause.']
                                     : []),
                             ];
@@ -5936,7 +6890,7 @@ export class WorkflowService {
                                     },
                                 }
                                 : {
-                                    action: 'task plan-set',
+                                    action: rollingC1Posture.state === 'claimed' ? 'task corrective-yield' : 'task plan-set',
                                     blockedAction: 'task run',
                                     stepId: guardedCorrectivePosture.stepId,
                                     rollingWave: {
@@ -6083,9 +7037,42 @@ export class WorkflowService {
                     },
                 }
             : {};
+        const preExecutionReplanBlockers = task.status === 'ready'
+            ? [
+                ...(task.steps.some((step) => step.status === 'in_progress') ? ['No Step may be in progress.'] : []),
+                ...(task.steps.some((step) => step.status === 'failed') ? ['No failed Step may require corrective recovery.'] : []),
+                ...(handoffPosture.state !== 'none' ? ['No C1 claim or pending handoff may exist.'] : []),
+                ...(inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root)
+                    ? ['No active or stale writer lease may exist.']
+                    : []),
+                ...(!isClean(repositoryRoot) ? ['Repository checkout must be clean.'] : []),
+                ...(!planRiskAudit || !['approved', 'approved-with-rationale'].includes(planRiskAudit.audit.decision)
+                    ? ['A current positive Plan Risk Audit is required.']
+                    : []),
+            ]
+            : [];
+        const preExecutionReplanOption = task.status === 'ready' && task.planHash && planRiskAudit
+            ? {
+                command: 'task preexecution-replan',
+                state: preExecutionReplanBlockers.length === 0 ? 'eligible' : 'blocked',
+                expectedRevision: task.revision,
+                expectedBriefHash: task.briefHash,
+                expectedPlanHash: task.planHash,
+                expectedPlanRiskAuditEventHash: planRiskAudit.audit.eventHash,
+                expectedHeadCommit: headCommit(repositoryRoot),
+                auditDecision: 'stop-escalate',
+                actorMustEqualAuditAuditor: true,
+                humanApprovalRequired: false,
+                boundedEffect: 'record-current-plan-obstruction-and-withdraw-execution-authorization',
+                preservesTaskScope: true,
+                preservesCompletedStepAuthority: true,
+                blockers: preExecutionReplanBlockers,
+            }
+            : null;
         const result = {
             ...next,
             ...handoffOverlay,
+            ...(preExecutionReplanOption ? { preExecutionReplanOption } : {}),
             ...(strictStepReviewStep
                 ? {
                     action: 'task step-review',
@@ -6171,7 +7158,7 @@ export class WorkflowService {
                         downstreamProofCarryover: {
                             state: 'validated',
                             invalidationEventId: downstreamProofCarryover.invalidationEventId,
-                            stepId: nextStepId,
+                            stepId: rootCauseStepId,
                             dirtyFiles: downstreamProofCarryover.dirtyFiles,
                             dirtyWorktreeHash: downstreamProofCarryover.dirtyWorktreeHash,
                             meaning: 'The replacement Step may adopt exactly these preserved uncommitted bytes on task run.',
@@ -6211,6 +7198,52 @@ export class WorkflowService {
                         },
                     }
                 : {}),
+            ...(rootCauseReplanDirtyCarryover?.applicable
+                ? rootCauseReplanDirtyCarryover.eligible && rootCauseReplanDirtyCarryover.compatibility
+                    ? {
+                        action: 'task run',
+                        rootCauseReplanDirtyCarryover: {
+                            state: 'validated',
+                            stepId: nextStepId,
+                            compatibilityHash: rootCauseReplanDirtyCarryover.compatibility.compatibilityHash,
+                            dirtyFiles: rootCauseReplanDirtyCarryover.compatibility.dirtyFiles,
+                            dirtyWorktreeHash: rootCauseReplanDirtyCarryover.compatibility.dirtyWorktreeHash,
+                            meaning: 'The replacement Step may adopt the exact retained root-cause failure bytes.',
+                        },
+                    }
+                    : rootCauseReplanDirtyCarryover.blockers.length === 1
+                        && rootCauseReplanDirtyCarryover.blockers[0]?.startsWith('Corrective carryover requires the retained claimed C1')
+                        ? handoffPosture.state === 'none'
+                            ? {
+                                action: 'task handoff-prepare',
+                                blockedAction: 'task run',
+                                rootCauseReplanDirtyCarryover: {
+                                    state: 'awaiting-c1',
+                                    stepId: rootCauseStepId,
+                                    requiredActor: defaultTaskWorkerActor(task.id),
+                                },
+                            }
+                            : handoffPosture.state === 'pending'
+                                ? {}
+                                : {
+                                    action: 'doctor',
+                                    blockedAction: 'task run',
+                                    rootCauseReplanDirtyCarryover: {
+                                        state: 'blocked',
+                                        stepId: rootCauseStepId,
+                                        blockers: rootCauseReplanDirtyCarryover.blockers,
+                                    },
+                                }
+                        : {
+                            action: 'doctor',
+                            blockedAction: 'task run',
+                            rootCauseReplanDirtyCarryover: {
+                                state: 'blocked',
+                                stepId: rootCauseStepId,
+                                blockers: rootCauseReplanDirtyCarryover.blockers,
+                            },
+                        }
+                : {}),
             ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
             ...(correctiveDerivedAuthority && correctiveDerivedActor
                 ? {
@@ -6227,9 +7260,56 @@ export class WorkflowService {
                 }
                 : {}),
         };
-        if (handoffPosture.state === 'pending') {
+        // A later independent audit may discover an obstruction absent from the sealed
+        // fix review. Advertise the existing append-only decision route without turning
+        // every ordinary repair into a mandatory replan or rewriting that review.
+        const correctiveDecisionOrdinal = failedStepRemediations.length + 1;
+        const optionalCorrectiveDecision = (result.action === 'task run' || planningRecovery !== null)
+            && (['needs_fix', 'ready'].includes(task.status) || planningRecovery !== null)
+            && failedStep && task.planHash && planRiskAudit
+            && planRiskAudit.reviewRequiredStepIds.includes(failedStep.id)
+            && !task.steps.some(step => step.status === 'in_progress')
+            && failedStepRemediations.length >= 2
+            && handoffPosture.state !== 'pending'
+            && !readCorrectiveDecisionEvents(this.store, task).some(event => event.stepId === failedStep.id && event.triggeringAttemptCount === correctiveDecisionOrdinal)
+            && currentBranch(repositoryRoot) === task.taskBranch && isClean(repositoryRoot)
+            ? {
+                command: 'task corrective-decision',
+                state: 'eligible',
+                optional: true,
+                taskId: task.id,
+                stepId: failedStep.id,
+                expectedRevision: task.revision,
+                expectedBriefHash: task.briefHash,
+                expectedPlanHash: task.planHash,
+                expectedHeadCommit: headCommit(repositoryRoot),
+                triggeringAttemptCount: correctiveDecisionOrdinal,
+                coveredRemediationEvents: failedStepRemediations.map(event => ({ eventId: event.eventId, eventHash: event.eventHash })),
+                recommendedAuditor: defaultCorrectiveAuditorActor(task.id),
+                auditorMustDifferFromLatestStrictReviewer: true,
+                requiredActor: handoffPosture.state === 'claimed' ? handoffPosture.claimant : null,
+                decisions: planningRecovery ? ['replan-required', 'split-required', 'stop-escalate']
+                    : ['continue-fix', 'replan-required', 'split-required', 'stop-escalate'],
+                authority: 'none',
+                preservesOriginalReview: true,
+                humanApprovalRequiredForDecision: false,
+                replanRequiresExistingHumanGate: true,
+                requiredAction: 'Only for newly assessed evidence: obtain an independent corrective audit, refresh next and existing writer authority, then record the decision. This option does not authorize Plan replacement or extra writes.',
+            }
+            : null;
+        const resultWithCorrectiveOption = optionalCorrectiveDecision
+            ? { ...result, correctiveDecisionOption: optionalCorrectiveDecision,
+                ...(planningRecovery ? { action: 'task corrective-decision', blockedAction: 'task authorize',
+                    planningRecovery: { authority: 'planning-only', obstructionAuditHash: planningRecovery.current.audit.eventHash,
+                        baselineAuditHash: planningRecovery.baseline.eventHash } } : {}) }
+            : planningRecovery && result.action === 'task authorize'
+                ? { ...result, action: 'doctor', blockedAction: 'task authorize' } : result;
+        const rootCauseAllowsPendingClaim = !rootCauseReplanDirtyCarryover?.applicable
+            || (rootCauseReplanDirtyCarryover.blockers.length === 1
+                && rootCauseReplanDirtyCarryover.blockers[0]?.startsWith('Corrective carryover requires the retained claimed C1'));
+        if (handoffPosture.state === 'pending' && rootCauseAllowsPendingClaim) {
             return this.withTaskNavigationContracts(task, {
-                ...result,
+                ...resultWithCorrectiveOption,
                 action: 'task claim',
                 blockedAction: next.action,
             });
@@ -6237,10 +7317,10 @@ export class WorkflowService {
         const navigableResult = ['task plan-set']
             .includes(String(result.action))
             ? {
-                ...result,
+                ...resultWithCorrectiveOption,
                 taskPlanContract: this.taskPlanContract(projectId, task),
             }
-            : result;
+            : resultWithCorrectiveOption;
         return this.withTaskNavigationContracts(task, navigableResult);
     }
     taskPlanContract(projectId, task) {
@@ -6261,6 +7341,9 @@ export class WorkflowService {
         };
     }
     assertTaskContextChangeAllowed(task) {
+        if (readCurrentPreExecutionReplan(this.store, task)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has a pending pre-execution replan; replace the implementation Plan before changing context.`, { taskId: task.id, requiredAction: 'task plan-set' });
+        }
         if (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed')) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} requires a replacement Step Plan; Project Knowledge cannot rebind or refresh the stale Plan.`, {
                 taskId: task.id,
@@ -6302,7 +7385,7 @@ export class WorkflowService {
     taskTerminalCorrectivePosture(task) {
         if (!task.planHash)
             return null;
-        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        const planRiskAudit = readCurrentPlanningObstructionAudit(this.store, task);
         if (!planRiskAudit)
             return null;
         const posture = findCurrentGuardedRemediationPosture(this.store, task, planRiskAudit);
@@ -6347,7 +7430,7 @@ export class WorkflowService {
         }
     }
     delegatedApprovalOptions(projectId, transition, target) {
-        return this.store.listDelegations(projectId)
+        return this.listDelegations(projectId)
             .filter((grant) => {
             try {
                 return Boolean(this.delegatedAuthorization(projectId, grant.id, transition, grant.delegate, target));
@@ -6369,7 +7452,20 @@ export class WorkflowService {
         }));
     }
     delegatedContextRefreshOptions(projectId, task, knowledgeMap, mode) {
-        return this.store.listDelegations(projectId)
+        let planningRecovery;
+        try {
+            planningRecovery = readFailedStepPlanningRecovery(this.store, task);
+            if (!planningRecovery)
+                readCurrentPlanRiskAudit(this.store, task);
+        }
+        catch (error) {
+            if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                return [];
+            throw error;
+        }
+        if (planningRecovery && mode !== 'delegated-content-only')
+            return [];
+        return this.listDelegations(projectId)
             .filter((grant) => {
             try {
                 if (mode === 'delegated-plan-bounded-supporting-source') {
@@ -6388,8 +7484,8 @@ export class WorkflowService {
             grantId: grant.id,
             principal: grant.principal,
             delegate: grant.delegate,
-            transition: 'task.execution_authorize',
-            transitions: ['project_memory.approve', 'task.execution_authorize'],
+            transition: planningRecovery ? 'project_memory.approve' : 'task.execution_authorize',
+            transitions: planningRecovery ? ['project_memory.approve'] : ['project_memory.approve', 'task.execution_authorize'],
             scope: grant.scope,
             expiresAt: grant.expiresAt,
             policyHash: grant.policyHash,
@@ -6746,7 +7842,7 @@ export class WorkflowService {
             blockers,
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null, planIntegrity = null) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null, planIntegrity = null, rootCauseReplan = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
@@ -6766,7 +7862,89 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity);
+        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity, rootCauseReplan);
+    }
+    assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId, historyHead) {
+        const recordedRecovery = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan
+            && task.systemCommits.includes(record.commitSha)) ?? null;
+        const recorded = recordedRecovery?.rootCauseReplan ?? null;
+        if (recorded) {
+            const recordedStep = task.steps.find((candidate) => candidate.id === recorded.stepId) ?? null;
+            if (!recordedStep) {
+                return {
+                    applicable: true,
+                    eligible: false,
+                    compatibility: null,
+                    blockers: [`Recorded corrective carryover Step ${recorded.stepId} is missing from the current Plan.`],
+                };
+            }
+            if (recordedStep.status === 'completed') {
+                const blockers = [];
+                if (!recordedStep.evidence) {
+                    blockers.push(`Completed corrective carryover Step ${recorded.stepId} has no execution evidence.`);
+                }
+                try {
+                    validateTaskHistory(repositoryRoot, task, historyHead);
+                    const sourceAudit = readPlanRiskAuditEvents(this.store, task).find((event) => event.eventId === recorded.replacementPlanRiskAuditEventId
+                        && event.eventHash === recorded.replacementPlanRiskAuditEventHash) ?? null;
+                    const classification = sourceAudit?.stepClassifications.find((candidate) => candidate.stepId === recorded.stepId) ?? null;
+                    if (!sourceAudit || !classification) {
+                        blockers.push('Completed corrective carryover Step lost its exact replacement Plan Risk Audit binding.');
+                    }
+                    else if (classification.reviewRequired
+                        && recordedStep.evidence
+                        && !verifiedHistoricalStepReviewBindings(this.store, task).some((binding) => binding.stepId === recorded.stepId
+                            && binding.commitSha === recordedStep.evidence.commitSha)) {
+                        blockers.push(`Completed corrective carryover Step ${recorded.stepId} lacks verified strict-review proof.`);
+                    }
+                }
+                catch (error) {
+                    blockers.push(error instanceof Error ? error.message : String(error));
+                }
+                if (blockers.length > 0) {
+                    return {
+                        applicable: true,
+                        eligible: false,
+                        compatibility: null,
+                        blockers: [...new Set(blockers)],
+                    };
+                }
+                // A reviewed, history-valid completed Step consumed this carryover. Keep its
+                // immutable recovery record, but let later Steps use their own lifecycle route.
+            }
+            else {
+                if (stepId && stepId !== recorded.stepId) {
+                    return {
+                        applicable: true,
+                        eligible: false,
+                        compatibility: null,
+                        blockers: [`Recorded corrective carryover is bound to ${recorded.stepId}, not requested ${stepId}.`],
+                    };
+                }
+                return assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, recorded.stepId, {
+                    binding: recorded,
+                });
+            }
+        }
+        const candidates = task.steps
+            .filter((step) => step.status === 'planned' && (!stepId || step.id === stepId))
+            .flatMap((step) => [...new Set(readRemediationEvents(this.store, task)
+                .filter((event) => event.stepId === step.id && event.failureKind === 'checks-failed')
+                .map((event) => event.failureEvidence.completionCommit))]
+            .map((historyHead) => assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, step.id, { historyHead })))
+            .filter((assessment) => assessment.applicable);
+        const eligible = candidates.filter((assessment) => assessment.eligible && assessment.compatibility);
+        if (eligible.length === 1)
+            return eligible[0];
+        return {
+            applicable: candidates.length > 0,
+            eligible: false,
+            compatibility: null,
+            blockers: [...new Set([
+                    ...candidates.flatMap((assessment) => assessment.blockers),
+                    ...(eligible.length > 1 ? ['Corrective carryover history resolved to more than one eligible boundary.'] : []),
+                ])],
+        };
     }
     inspectHistoricalStepProvenanceCandidate(snapshot, task, options = {}) {
         const now = this.now().getTime();
@@ -7470,6 +8648,83 @@ function taskHasStarted(task) {
         'merged',
     ].includes(task.status);
 }
+function resolvePreExecutionReplanAudits(store, task, marker) {
+    const audits = readPlanRiskAuditEvents(store, task);
+    const sourceAudit = audits.find((audit) => audit.eventId === marker.sourcePlanRiskAuditEventId
+        && audit.eventHash === marker.sourcePlanRiskAuditEventHash) ?? null;
+    const obstructionAudit = audits.find((audit) => audit.eventId === marker.obstructionPlanRiskAuditEventId
+        && audit.eventHash === marker.obstructionPlanRiskAuditEventHash) ?? null;
+    const sourceAuthorization = task.authorizations.find((authorization) => authorization.kind === 'execution'
+        && authorization.decision === 'superseded'
+        && hashExecutionAuthorization({ ...authorization, decision: 'approved' }) === marker.sourceExecutionAuthorizationHash);
+    if (!sourceAudit || !obstructionAudit || audits.at(-1)?.eventHash !== obstructionAudit.eventHash
+        || !['approved', 'approved-with-rationale'].includes(sourceAudit.decision)
+        || obstructionAudit.decision !== 'stop-escalate'
+        || sourceAudit.planHash !== task.planHash || obstructionAudit.planHash !== task.planHash
+        || !sourceAuthorization) {
+        throw new WorkflowError('STATE_CORRUPT', 'Pre-execution replan provenance chain is incomplete or inconsistent.', {
+            taskId: task.id,
+            eventId: marker.eventId,
+        });
+    }
+    return { sourceAudit, obstructionAudit };
+}
+function assertPlanRiskSafetyPreserved(source, candidate, label) {
+    const candidateByStep = new Map(candidate.stepClassifications.map((classification) => [classification.stepId, classification]));
+    const missing = [];
+    for (const sourceClassification of source.stepClassifications) {
+        const candidateClassification = candidateByStep.get(sourceClassification.stepId);
+        if (!candidateClassification) {
+            missing.push({ stepId: sourceClassification.stepId, field: 'classification', values: [] });
+            continue;
+        }
+        const preserveStrings = (field, sourceValues, candidateValues) => {
+            const absent = sourceValues.filter((value) => !candidateValues.includes(value));
+            if (absent.length > 0)
+                missing.push({ stepId: sourceClassification.stepId, field, values: absent });
+        };
+        preserveStrings('categories', sourceClassification.categories, candidateClassification.categories);
+        preserveStrings('failureModes', sourceClassification.failureModes, candidateClassification.failureModes);
+        preserveStrings('requiredEvidence', sourceClassification.requiredEvidence, candidateClassification.requiredEvidence);
+        if (sourceClassification.reviewRequired && !candidateClassification.reviewRequired) {
+            missing.push({ stepId: sourceClassification.stepId, field: 'reviewRequired', values: [true] });
+        }
+        const proofBinding = (proof) => canonicalJsonStringify({ failureMode: proof.failureMode, evidence: proof.evidence });
+        const candidateProofs = new Set((candidateClassification.proofObligations ?? []).map(proofBinding));
+        const absentProofs = (sourceClassification.proofObligations ?? [])
+            .filter((proof) => !candidateProofs.has(proofBinding(proof)));
+        if (absentProofs.length > 0) {
+            missing.push({ stepId: sourceClassification.stepId, field: 'proofObligations', values: absentProofs });
+        }
+    }
+    if (missing.length > 0) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `${label} cannot suppress existing guarded risk or proof authority.`, {
+            missing,
+        });
+    }
+    const sourceProofText = new Map(source.stepClassifications.flatMap((classification) => (classification.proofObligations ?? []).map((proof) => [
+        canonicalJsonStringify({ stepId: classification.stepId, failureMode: proof.failureMode, evidence: proof.evidence }),
+        canonicalJsonStringify({ counterexample: proof.counterexample, expectedResult: proof.expectedResult }),
+    ])));
+    const revisedProofText = candidate.stepClassifications.some((classification) => (classification.proofObligations ?? []).some((proof) => {
+        const binding = canonicalJsonStringify({
+            stepId: classification.stepId,
+            failureMode: proof.failureMode,
+            evidence: proof.evidence,
+        });
+        const previous = sourceProofText.get(binding);
+        return previous !== undefined
+            && previous !== canonicalJsonStringify({ counterexample: proof.counterexample, expectedResult: proof.expectedResult });
+    }));
+    if (revisedProofText && (candidate.decision !== 'approved-with-rationale'
+        || candidate.summary.trim() === source.summary.trim())) {
+        throw new WorkflowError('TRANSITION_BLOCKED', `${label} may revise proof prose only with approved-with-rationale and a new audit summary.`, {
+            sourceSummary: source.summary,
+            candidateSummary: candidate.summary,
+            candidateDecision: candidate.decision,
+        });
+    }
+}
 function taskCanRebindKnowledge(task) {
     return [
         'awaiting_execution_authorization',