codex-workflow-v2 2.0.0-beta.13.9 → 2.0.0-beta.14.1

package/dist/src/workflow.js

@@ -1,11 +1,21 @@
+import { assessNavigationDirtyCarryover } from './alpha6/navigation-dirty-carryover.js';
+import { navigationUpdateSource, assertNavigationSourceInstalled, inspectNavigationTransport } from './navigation-update.js';
+import { failedCheckpointUpdateSource, assertFailedCheckpointInstalled, inspectFailedCheckpointTransport, readFailedCheckpointDirtyTransport, FAILED_CHECKPOINT_SOURCE, FAILED_CHECKPOINT_TARGET } from './failed-checkpoint-update.js';
+import { verifyNavigationUpdateArtifact } from './navigation-update-artifact.js';
+import { taskSyncChecks, taskSyncChecksHash, assertNoPendingBaseSyncValidation, assessPendingBaseSyncValidation, assertPendingBaseSyncValidationReady } from './checks/task-sync.js';
+import { isVirginRegistrationRoot } from './domain/virgin-registration.js';
+import { currentBaseSyncConflict, recordBaseSyncConflict } from './domain/base-sync-conflict.js';
+import { stepStartPhase } from './domain/step-start-admission.js';
+import { correctiveDecisionCheckoutEligible } from './alpha6/corrective-decision-boundary.js';
+import { prepareCapturedCheckEvidence, assertCapturedCheckEvidence, assertCurrentCapturedCheckEvidence } from './alpha6/captured-check-evidence.js';
 import { readCorrectivePlanningAudit, readFailedStepPlanningRecovery } from './alpha6/failed-step-planning-recovery.js';
 import { explainChange } from './change-explanation.js';
-import { pendingReviewRunnerFingerprint, PENDING_REVIEW_UPDATE_SIDECAR, preparePendingReviewUpdateEvent, PENDING_REVIEW_SOURCE_VERSION, pendingReviewSourceBinding, pendingReviewBindingHash, assertPendingReviewTransport, verifiedPendingReviewTransport } from './pending-review-update.js';
+import { verifiedPendingReviewTransport } from './pending-review-update.js';
 import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, workflowDependencyVersionAt, } from './dependency-provenance.js';
+import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
 import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
@@ -15,22 +25,23 @@ import { deriveCompletedStepCarryover, normalizePlanStepDefinition, } from './do
 import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { withObservedRouteMetadata } from './observed-routes.js';
+import { withWorkflowBlockerRoute } from './workflow-blocker-route.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
-import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
+import { inspectWorkflowVersions } from './diagnostics.js';
 import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, prepareTaskCorrectiveYield, readTaskC1Posture, readTaskHandoffEvents, } from './alpha6/handoff.js';
-import { assessDownstreamProofCarryover, assessDownstreamProofReplanRecovery, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, downstreamProofReplanRecoverySidecar, prepareDownstreamProofInvalidation, prepareDownstreamProofReplanRecovery, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
+import { assessDownstreamProofCarryover, assessDownstreamProofRecovery, downstreamProofInvalidationSidecar, prepareDownstreamProofInvalidation, readDownstreamProofInvalidations, readDownstreamProofReplanRecoveries, hashDirtyWorktree, } from './alpha6/downstream-proof.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, buildCandidatePlanRiskAuditEvent, buildPlanRiskAuditEvent, readCurrentPlanRiskAudit, readCurrentPlanningObstructionAudit, readPlanRiskAuditEvents, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { hashCompletedSteps, hashExecutionAuthorization, preparePreExecutionReplanEvent, preExecutionReplanSidecar, readCurrentPreExecutionReplan, } from './alpha6/preexecution-replan.js';
 import { assessRootCauseReplanDirtyCarryover, matchesTerminalCorrectiveYield, } from './alpha6/root-cause-replan-carryover.js';
-import { appendCorrectiveDecisionEvent, appendPlanIntegrityRecoveryDecision, appendRemediationModeRecovery, appendStopEscalateOverride, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, deriveCurrentCauseDecisionForTask, prepareRemediationEvent, prepareStopEscalateOverride, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
+import { appendCorrectiveDecisionEvent, firstFailurePlanningObstructionEvidence, appendPlanIntegrityRecoveryDecision, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, effectiveStepAllowedWrites, isKnowledgeReboundSupportDecision, findCurrentGuardedRemediationPosture, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, deriveRollingCauseDecision, deriveCurrentCauseDecisionForTask, prepareRemediationEvent, stopEscalateOverrideDecisionEventIds, } from './alpha6/remediation.js';
 import { assessPlanIntegrityRecovery, defaultPlanIntegrityRecoveryActor, } from './alpha6/plan-integrity.js';
 import { mechanicalCauseBindings, normalizeMechanicalFailures, } from './alpha6/remediation-cause.js';
 import { assertMechanicalFeasibilityFresh, evaluateMechanicalFeasibility, hashMechanicalFeasibilityEvidence, } from './alpha6/mechanical-feasibility.js';
-import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneScopeChangeEvents, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { assessMilestoneInitialAssembly, applyInitialMilestonePlanTransaction, applyMilestoneScopeChangeTransaction, assertMilestoneDependenciesDeclared, assertMilestoneTaskRunnable, assessMilestoneTaskDependencies, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneScopeChangeEvents, readMilestoneForScopeChange, assessMilestoneScopeCompletion, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
 import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, latestFailedStepReviewRouting, latestPassedVerifiedStepReviewEvent, recordStrictStepReview, verifiedHistoricalStepReviewCommits, verifiedHistoricalStepReviewBindings, } from './alpha6/review.js';
-import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
+import { applyMilestoneAutonomyContract, bindMilestoneAutonomyToGrant, milestoneSemanticScopeHash, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, readValidatedStopOverrideContextRebindIfApplicable, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, prepareSidecarAppend, sha256Hex } from './alpha6/store-sidecars.js';
@@ -38,7 +49,7 @@ import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
 import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, prepareReviewerRuntimePreflight, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
-import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
+import { CoreTaskOperationLockManager, inspectCoreTaskOperationMutex, listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
 import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
 import { inspectCorrectiveYieldTaskTransactions } from './state/corrective-yield-transaction.js';
@@ -49,14 +60,14 @@ import { createEntityId } from './ulid.js';
 import { PACKAGE_NAME, PACKAGE_VERSION } from './version.js';
 import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
 const MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES = 2;
-// Release-reviewed exact compatibility target; never infer support from PACKAGE_VERSION.
-const CONSUMED_CARRYOVER_TARGET_VERSION = '2.0.0-beta.13.9';
 export class WorkflowService {
     store;
+    checkOptions;
     now;
     transactionHooks;
-    constructor(store = new FileStateStore(), now = () => new Date(), transactionHooks = {}) {
+    constructor(store = new FileStateStore(), now = () => new Date(), transactionHooks = {}, checkOptions = {}) {
         this.store = store;
+        this.checkOptions = checkOptions;
         this.now = now;
         this.transactionHooks = transactionHooks;
     }
@@ -91,6 +102,9 @@ export class WorkflowService {
         const projectFile = path.join(projectRoot, 'project.json');
         const projectAlreadyRegistered = existsSync(projectFile);
         if (!projectAlreadyRegistered) {
+            if (!isVirginRegistrationRoot(projectRoot, this.store.root, identity, PACKAGE_VERSION)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Missing registration with retained or unrecognized state requires explicit recovery.');
+            }
             // The registration posture is a sidecar under the project root. A completely
             // fresh CODEX_WORKFLOW_STATE_HOME has no project directory yet, so establish
             // only that directory before writing the posture; project.json remains the
@@ -118,6 +132,36 @@ export class WorkflowService {
         return lease ? this.publicWriterLeaseDiagnostic(lease) : null;
     }
     repairStaleWriterLease(repository, entityId) {
+        const identity = resolveRepositoryIdentity(repository);
+        const locksRoot = this.store.lockRoot(identity.projectId);
+        const core = inspectCoreTaskOperationMutex(locksRoot, entityId, this.store.root);
+        if (core) {
+            const project = this.store.readProject(identity.projectId);
+            if (!project.repositoryRoots.includes(identity.repositoryRoot)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Repository is not registered for Core orphan repair.');
+            }
+            const taskRoot = this.store.taskRoot(identity.projectId, entityId);
+            this.store.readTask(identity.projectId, entityId);
+            return new CoreTaskOperationLockManager(locksRoot, this.now, this.store.root).repairExpiredOrphan(entityId, (mutex) => {
+                const replan = inspectCorrectiveReplanTaskTransactions(this.store.projectRoot(identity.projectId), this.store.root);
+                const yielded = inspectCorrectiveYieldTaskTransactions(this.store.projectRoot(identity.projectId), this.store.root);
+                if ([...replan.pending, ...replan.corrupt, ...yielded.pending, ...yielded.corrupt].some(item => item.taskId === entityId)) {
+                    throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'Pending or corrupt Task journal state requires transaction recovery.');
+                }
+                for (const name of ['.transactions', '.yield-transactions']) {
+                    const exactTransaction = path.join(taskRoot, name, mutex.operationId);
+                    try {
+                        lstatSync(exactTransaction);
+                    }
+                    catch (error) {
+                        if (error.code === 'ENOENT')
+                            continue;
+                        throw error;
+                    }
+                    throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'The Core operation has retained journal state; use transaction recovery.');
+                }
+            });
+        }
         const context = this.#mutationContext(repository);
         const lease = context.locks.repairStale(entityId);
         return {
@@ -125,30 +169,8 @@ export class WorkflowService {
             repaired: true,
         };
     }
-    prepareTaskStopOverride(repository, taskId, stepId, expectedRevision, actor, reason) {
-        const snapshot = this.observationSnapshot(repository);
-        if (snapshot.observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override requires a coherent observation boundary.', {
-                observation: snapshot.observation,
-            });
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId) ?? null;
-        if (!task)
-            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        this.assertStopOverrideRepositoryBoundary(snapshot.identity, task);
-        return prepareStopEscalateOverride(this.store, task, stepId, expectedRevision, actor, reason, headCommit(snapshot.identity.repositoryRoot));
-    }
-    applyTaskStopOverride(repository, taskId, stepId, expectedRevision, actor, reason, confirmationCode) {
-        const snapshot = this.observationSnapshot(repository);
-        if (snapshot.observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override requires a coherent observation boundary.', {
-                observation: snapshot.observation,
-            });
-        }
-        const context = this.#mutationContext(repository);
-        const task = context.store.readTask(context.identity.projectId, taskId);
-        this.assertStopOverrideRepositoryBoundary(context.identity, task, context.locks.list());
-        return appendStopEscalateOverride(context.store, task, stepId, expectedRevision, actor, reason, headCommit(context.identity.repositoryRoot), confirmationCode, this.now());
+    authorizeDelegatedCorrectiveReplan(repository, taskId, candidate) {
+        return this.correctiveReplanController(repository).authorizeDelegated({ taskId, candidate });
     }
     prepareCorrectiveReplan(repository, taskId, candidate) {
         return this.correctiveReplanController(repository).prepare({ taskId, candidate });
@@ -295,92 +317,6 @@ export class WorkflowService {
             invalidation: invalidation.event,
         };
     }
-    recoverDownstreamProofReplan(repository, taskId, expectedTaskRevision, actor, reason) {
-        const context = this.#mutationContext(repository);
-        const task = this.store.readTask(context.identity.projectId, taskId);
-        assertExpectedRevision(task, expectedTaskRevision);
-        // This repair intentionally runs before Project Knowledge refresh: the exact
-        // dependency-only transport can make the current map stale, while the
-        // recovery assessment still binds the stranded Task to its recorded rebind.
-        const observation = this.observationSnapshot(repository).observation;
-        if (observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan recovery requires a coherent observation boundary.', {
-                observation,
-            });
-        }
-        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
-        const assessment = assessDownstreamProofReplanRecovery(this.store, context.identity.repositoryRoot, task, { currentPlanRiskAuditExists });
-        const environmentBlockers = [
-            ...(!assessment.dependencyRecoveryCommit
-                ? ['The exact beta.12.7 dependency compatibility must be registered before Task recovery.']
-                : []),
-            ...(observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
-            ...(observation.pendingProjectTransactions.length > 0
-                || observation.pendingMilestoneTransactions.length > 0
-                || observation.pendingTaskTransactions.length > 0
-                ? ['No pending Workflow transaction may exist.'] : []),
-            ...(observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
-            ...(observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
-        ];
-        if (!assessment.applicable || !assessment.eligible || environmentBlockers.length > 0) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Task is not eligible for bounded downstream-proof replan recovery.', {
-                taskId,
-                blockers: [...assessment.blockers, ...environmentBlockers],
-            });
-        }
-        const now = this.now();
-        const resultTask = {
-            ...task,
-            revision: task.revision + 1,
-            updatedAt: now.toISOString(),
-            status: 'needs_fix',
-            authorizations: task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
-                ? { ...authorization, decision: 'superseded' }
-                : authorization),
-            review: emptyReview(),
-            resultHash: null,
-            evidenceHash: null,
-            blockReason: `${assessment.invalidation.activeStepId} downstream-proof recovery requires replacement of the full unfinished Step Plan before execution can resume.`,
-        };
-        const recovery = prepareDownstreamProofReplanRecovery(this.store, resultTask, assessment, { previousTaskRevision: task.revision, actor, reason }, now);
-        const projectRoot = this.store.projectRoot(task.projectId);
-        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
-        const taskRoot = this.store.taskRoot(task.projectId, task.id);
-        applyProjectTransaction({
-            projectRoot,
-            projectId: task.projectId,
-            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
-            kind: 'downstream-proof-replan-recovery',
-            now,
-            targets: [
-                {
-                    path: relative(path.join(taskRoot, downstreamProofReplanRecoverySidecar())),
-                    content: recovery.postimage,
-                },
-                { path: relative(path.join(taskRoot, 'state.json')), content: `${JSON.stringify(resultTask, null, 2)}\n` },
-            ],
-            validate: () => {
-                const saved = this.store.readTask(task.projectId, task.id);
-                const events = readDownstreamProofReplanRecoveries(this.store, saved);
-                if (saved.revision !== resultTask.revision
-                    || saved.status !== 'needs_fix'
-                    || saved.planHash !== task.planHash
-                    || events.at(-1)?.eventHash !== recovery.event.eventHash
-                    || headCommit(context.identity.repositoryRoot) !== recovery.event.preservedHeadCommit
-                    || JSON.stringify(changedFiles(context.identity.repositoryRoot).sort())
-                        !== JSON.stringify(recovery.event.dirtyFiles)) {
-                    throw new WorkflowError('STATE_CORRUPT', 'Downstream-proof replan recovery transaction readback failed.', {
-                        taskId,
-                    });
-                }
-                validateTaskHistory(context.identity.repositoryRoot, saved);
-            },
-        });
-        return {
-            task: this.store.readTask(task.projectId, task.id),
-            recovery: recovery.event,
-        };
-    }
     correctiveReplanController(repository) {
         const identity = resolveRepositoryIdentity(repository);
         return createCorrectiveReplanPublicController({
@@ -568,6 +504,7 @@ export class WorkflowService {
             if (milestone.status === 'accepted' || milestone.status === 'cancelled') {
                 throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} is ${milestone.status}.`);
             }
+            assertMilestoneScopeChangeStatusAllowed(milestone);
             if (milestone.baseBranch !== baseBranch) {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'Task and Milestone must use the same base branch.', {
                     taskBaseBranch: baseBranch,
@@ -1009,7 +946,7 @@ export class WorkflowService {
                 milestoneId: milestone.id,
                 oldTaskId: oldTask.id,
                 incidentDependencies,
-                requiredAction: 'Materialize P04-B/P05 before replacing this split-required Task.',
+                requiredAction: 'The owner must decide whether to stop this Task or revise the Milestone scope through supported transitions; structural replacement is unavailable.',
             });
         }
         /* P04-B retains the existing one-for-one transaction below as implementation evidence,
@@ -1449,6 +1386,20 @@ export class WorkflowService {
             locks.release(milestoneId, lease.token);
         }
     }
+    bindMilestoneAutonomy(repository, milestoneId, expectedRevision, actor, grantId) {
+        const { identity, locks } = this.#mutationContext(repository);
+        const lease = locks.acquire(milestoneId, 'workflow-core:autonomy-binding');
+        try {
+            const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
+            assertExpectedRevision(milestone, expectedRevision);
+            this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
+            return bindMilestoneAutonomyToGrant({ store: this.store, projectId: identity.projectId,
+                milestone, actor, grantId, now: this.now() });
+        }
+        finally {
+            locks.release(milestoneId, lease.token);
+        }
+    }
     evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
         const { identity, locks } = this.#mutationContext(repository);
         const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
@@ -1522,34 +1473,37 @@ export class WorkflowService {
             locks.release(milestoneId, authorityLease.token);
         }
     }
+    assertMilestoneValidationReady(repositoryRoot, milestone) {
+        if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestone.id} cannot be validated while ${milestone.status}.`);
+        }
+        this.assertMilestoneAuthorizationFresh(milestone);
+        if (currentBranch(repositoryRoot) !== milestone.baseBranch || !isClean(repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Milestone validation requires a clean base branch checkout.', {
+                expectedBranch: milestone.baseBranch,
+                actualBranch: currentBranch(repositoryRoot),
+                changedFiles: changedFiles(repositoryRoot),
+            });
+        }
+        const incomplete = milestone.memberships.filter((membership) => {
+            if (membership.disposition !== 'required')
+                return false;
+            return this.store.readTask(milestone.projectId, membership.taskId).status !== 'merged';
+        });
+        if (incomplete.length > 0) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Required Milestone Tasks are not merged.', {
+                taskIds: incomplete.map((membership) => membership.taskId),
+            });
+        }
+    }
     validateMilestone(repository, milestoneId, expectedRevision) {
         const { identity, locks } = this.#mutationContext(repository);
         const authorityLease = locks.acquire(milestoneId, 'workflow-core:milestone-authority');
         try {
             const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
             assertExpectedRevision(milestone, expectedRevision);
-            if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
-                throw new WorkflowError('TRANSITION_BLOCKED', `Milestone ${milestoneId} cannot be validated while ${milestone.status}.`);
-            }
-            this.assertMilestoneAuthorizationFresh(milestone);
-            if (currentBranch(identity.repositoryRoot) !== milestone.baseBranch || !isClean(identity.repositoryRoot)) {
-                throw new WorkflowError('GIT_PRECONDITION_FAILED', 'Milestone validation requires a clean base branch checkout.', {
-                    expectedBranch: milestone.baseBranch,
-                    actualBranch: currentBranch(identity.repositoryRoot),
-                    changedFiles: changedFiles(identity.repositoryRoot),
-                });
-            }
-            const incomplete = milestone.memberships.filter((membership) => {
-                if (membership.disposition !== 'required')
-                    return false;
-                return this.store.readTask(identity.projectId, membership.taskId).status !== 'merged';
-            });
-            if (incomplete.length > 0) {
-                throw new WorkflowError('TRANSITION_BLOCKED', 'Required Milestone Tasks are not merged.', {
-                    taskIds: incomplete.map((membership) => membership.taskId),
-                });
-            }
-            const checks = runChecks(identity.repositoryRoot, milestone.checks);
+            this.assertMilestoneValidationReady(identity.repositoryRoot, milestone);
+            const checks = runChecks(identity.repositoryRoot, milestone.checks, this.checkOptions);
             const baseHead = headCommit(identity.repositoryRoot);
             const root = this.store.milestoneRoot(identity.projectId, milestoneId);
             const stagedEvidence = this.store.stageArtifact(root, 'evidence.json', JSON.stringify({
@@ -2097,10 +2051,10 @@ export class WorkflowService {
         const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.assertTaskContextChangeAllowed(task);
-        if (!taskCanRebindKnowledge(task)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot rebind Task Plan knowledge while Task is ${task.status}.`);
-        }
+        const contextBlocker = this.taskContextChangeBlocker(task, 'rebind', identity.repositoryRoot);
+        // Preserve Plan-corruption precedence over the active-Step rejection.
+        if (contextBlocker && !contextBlocker.activeStep)
+            throw contextBlocker.error;
         if (!task.planHash ||
             !task.planObjective ||
             task.knowledgeMapRevision === null ||
@@ -2110,10 +2064,8 @@ export class WorkflowService {
             task.graphUse === null) {
             throw new WorkflowError('STATE_CORRUPT', `Task ${taskId} has no complete Plan binding to rebind.`);
         }
-        const activeStep = task.steps.find((step) => step.status === 'in_progress');
-        if (activeStep) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot rebind Task Plan knowledge while ${activeStep.id} is in progress.`);
-        }
+        if (contextBlocker)
+            throw contextBlocker.error;
         const knowledgeMap = this.requireActiveKnowledgeMap(identity.repositoryRoot, identity.projectId);
         const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
         if (task.knowledgeMapRevision === knowledgeMap.revision &&
@@ -2190,21 +2142,24 @@ export class WorkflowService {
         const currentMap = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(task, expectedTaskRevision);
         assertExpectedRevision(currentMap, expectedKnowledgeMapRevision);
-        this.assertTaskContextChangeAllowed(task);
-        if (!taskCanRebindKnowledge(task)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot refresh Task context while Task is ${task.status}.`);
-        }
-        const activeStep = task.steps.find((step) => step.status === 'in_progress');
-        if (activeStep) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot refresh Task context while ${activeStep.id} is in progress.`);
-        }
+        const contextBlocker = this.taskContextChangeBlocker(task, 'refresh', identity.repositoryRoot);
+        if (contextBlocker)
+            throw contextBlocker.error;
         const inspectedMap = inspectKnowledgeMap(currentMap, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
         const transitions = [];
-        const currentPlanRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        const retainedAudits = JSON.stringify(readPlanRiskAuditEvents(this.store, task));
+        const retainedRemediation = JSON.stringify(readRemediationEvents(this.store, task));
+        const transport = this.registeredPlanningContextTransport(task, identity.repositoryRoot);
+        const planningRecovery = transport ? null : readFailedStepPlanningRecovery(this.store, task);
+        const planningOnly = Boolean(planningRecovery || transport);
+        const currentPlanRiskAudit = transport ? null : planningRecovery?.current ?? readCurrentPlanRiskAudit(this.store, task);
         const currentPlanArtifactHash = task.planHash
             ? this.store.hashArtifact(this.store.taskRoot(identity.projectId, task.id), 'plan.md')
             : null;
         const refreshAssessment = assessDelegatedKnowledgeRefresh(currentMap, inspectedMap, task, currentPlanArtifactHash);
+        if (planningOnly && refreshAssessment.mode !== 'delegated-content-only') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Stopped planning context refresh permits content-only Knowledge drift.');
+        }
         // Validate every delegated transition before the first write so a narrow grant cannot
         // leave the composite operation half-applied.
         this.delegatedAuthorization(identity.projectId, delegationGrantId, 'task.execution_authorize', actor, task);
@@ -2251,11 +2206,15 @@ export class WorkflowService {
                     appendReboundPlanRiskAudit(this.store, task, refreshedTask, currentPlanRiskAudit, this.now());
                 }
                 transitions.push('task knowledge-rebind');
-                refreshedTask = this.authorizeTask(repository, taskId, refreshedTask.revision, actor, refreshAssessment.mode === 'delegated-plan-bounded-supporting-source'
-                    ? 'Delegated Plan-bounded supporting-source context refresh.'
-                    : 'Delegated content-only context refresh.', delegationGrantId);
-                transitions.push('task execution authorize');
+                // A stopped Plan may regain its Knowledge binding, never execution authority.
+                if (!planningOnly)
+                    refreshedTask = this.authorizeTask(repository, taskId, refreshedTask.revision, actor, refreshAssessment.mode === 'delegated-plan-bounded-supporting-source'
+                        ? 'Delegated Plan-bounded supporting-source context refresh.'
+                        : 'Delegated content-only context refresh.', delegationGrantId);
+                if (!planningOnly)
+                    transitions.push('task execution authorize');
                 return {
+                    authority: planningOnly ? 'planning-only' : 'execution',
                     mode: refreshAssessment.mode,
                     transitions,
                     addedSources: refreshAssessment.addedSources,
@@ -2265,8 +2224,27 @@ export class WorkflowService {
             },
             validate: (result) => {
                 const currentTask = this.store.readTask(identity.projectId, task.id);
-                if (currentTask.revision !== result.task.revision || currentTask.status !== 'ready') {
-                    throw new WorkflowError('STATE_CORRUPT', 'Context refresh transaction did not commit an authorized Task.');
+                if (currentTask.revision !== result.task.revision || currentTask.status !== (planningOnly ? 'awaiting_execution_authorization' : 'ready')) {
+                    throw new WorkflowError('STATE_CORRUPT', 'Context refresh transaction did not commit the expected Task posture.');
+                }
+                if (transport) {
+                    if (!readFailedCheckpointDirtyTransport(this.store, identity.repositoryRoot, currentTask, transport.stepId, transport.sourceHead, transport.sourceDirtyHash)) {
+                        throw new WorkflowError('STATE_CORRUPT', 'Transport context proof disappeared.');
+                    }
+                    if (JSON.stringify(currentTask.steps) !== JSON.stringify(task.steps)
+                        || JSON.stringify(currentTask.authorizations) !== JSON.stringify(task.authorizations)
+                        || JSON.stringify(readPlanRiskAuditEvents(this.store, currentTask)) !== retainedAudits
+                        || JSON.stringify(readRemediationEvents(this.store, currentTask)) !== retainedRemediation) {
+                        throw new WorkflowError('STATE_CORRUPT', 'Transport context refresh changed retained evidence.');
+                    }
+                }
+                if (planningRecovery && !transport) {
+                    const rebound = readFailedStepPlanningRecovery(this.store, currentTask);
+                    if (!rebound || rebound.baseline.eventHash !== planningRecovery.baseline.eventHash
+                        || JSON.stringify(currentTask.steps) !== JSON.stringify(task.steps)
+                        || JSON.stringify(currentTask.authorizations) !== JSON.stringify(task.authorizations)) {
+                        throw new WorkflowError('STATE_CORRUPT', 'Planning context refresh changed retained recovery evidence.');
+                    }
                 }
                 const currentKnowledgeMap = this.store.readKnowledgeMap(identity.projectId);
                 if (currentKnowledgeMap.revision !== result.knowledgeMap.revision) {
@@ -2339,6 +2317,7 @@ export class WorkflowService {
         const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
         if (readCurrentPreExecutionReplan(this.store, task)) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Pre-execution replan requires task plan-set; the blocking audit cannot be replaced in place.', { taskId, requiredAction: 'task plan-set' });
@@ -2489,7 +2468,16 @@ export class WorkflowService {
     handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null, replacePending = false) {
         const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
+        if (task.status === 'ready' && changedFiles(context.identity.repositoryRoot).length > 0) {
+            const carryover = this.assessCurrentRootCauseReplanDirtyCarryover(context.identity.repositoryRoot, task);
+            if (carryover.requiredActor && targetActor.trim() !== carryover.requiredActor) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Native carryover handoff must return to its recorded execution actor.', {
+                    taskId, requiredActor: carryover.requiredActor,
+                });
+            }
+        }
         if (readCurrentPreExecutionReplan(this.store, task)) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Task ownership cannot change while a pre-execution replan is pending.', {
                 taskId,
@@ -2793,7 +2781,7 @@ export class WorkflowService {
         const step = requireStep(task, stepId);
         const allowedWrites = effectiveStepAllowedWrites(this.store, task, stepId);
         const remediationHistoryForStep = readRemediationEvents(this.store, task).filter((event) => event.stepId === stepId);
-        if (!['planned', 'failed'].includes(step.status)) {
+        if (stepStartPhase(step.status, false) === 'not-startable') {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} cannot start from ${step.status}.`);
         }
         const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
@@ -2813,6 +2801,7 @@ export class WorkflowService {
                 ? guardedPosture.correctiveDecision
                 : null;
             const recovery = staleDecision?.decision === 'continue-fix'
+                && !isKnowledgeReboundSupportDecision(this.store, task, staleDecision)
                 ? requireCorrectiveDecisionRecoveryForRun(this.store, task, stepId, actor, writerToken)
                 : null;
             const stopOverrideContextRebind = staleDecision?.decision === 'stop-escalate'
@@ -2823,23 +2812,28 @@ export class WorkflowService {
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        const downstreamProofCarryover = step.status === 'planned' && dirty.length > 0
+        const startPhase = stepStartPhase(step.status, dirty.length > 0);
+        const downstreamProofCarryover = startPhase === 'planned-dirty'
             ? assessDownstreamProofCarryover(this.store, context.identity.repositoryRoot, task, stepId)
             : null;
-        const planIntegrityDirtyCarryover = step.status === 'planned' && dirty.length > 0
+        const planIntegrityDirtyCarryover = startPhase === 'planned-dirty'
             ? this.assessPostRebindCheckSupportDirtyCarryover(context.identity.repositoryRoot, task, stepId)
             : null;
-        const rootCauseReplanDirtyCarryover = step.status === 'planned' && dirty.length > 0
+        const navigationDirtyCarryover = startPhase === 'planned-dirty'
+            ? assessNavigationDirtyCarryover(this.store, context.identity.repositoryRoot, task, stepId)
+            : null;
+        const rootCauseReplanDirtyCarryover = startPhase === 'planned-dirty' && !navigationDirtyCarryover?.applicable
             ? this.assessCurrentRootCauseReplanDirtyCarryover(context.identity.repositoryRoot, task, stepId)
             : null;
-        if (step.status === 'planned'
-            && dirty.length > 0
+        if (startPhase === 'planned-dirty'
             && !resumesCorrectiveReplan
             && !downstreamProofCarryover?.eligible
             && !planIntegrityDirtyCarryover?.eligible
+            && !navigationDirtyCarryover?.eligible
             && !rootCauseReplanDirtyCarryover?.eligible) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
+                ...(navigationDirtyCarryover?.applicable ? { navigationDirtyCarryoverBlockers: navigationDirtyCarryover.blockers } : {}),
                 ...(downstreamProofCarryover?.applicable
                     ? { downstreamProofCarryoverBlockers: downstreamProofCarryover.blockers }
                     : {}),
@@ -2852,7 +2846,7 @@ export class WorkflowService {
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, allowedWrites));
-        if ((step.status === 'failed' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
+        if ((startPhase === 'failed-retry' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} retry has changes outside allowedWrites.`, {
                 changedFiles: dirtyOutsideStep,
             });
@@ -3073,7 +3067,7 @@ export class WorkflowService {
             return task;
         }
         validateTaskHistory(context.identity.repositoryRoot, task);
-        const checks = runChecks(context.identity.repositoryRoot, step.checks);
+        const checks = runChecks(context.identity.repositoryRoot, step.checks, this.checkOptions);
         const failed = checks.filter((check) => !check.passed);
         if (failed.length > 0) {
             const now = this.now();
@@ -3081,13 +3075,16 @@ export class WorkflowService {
             // Bind useful uncommitted work to this failure without treating it as
             // completed-Step authority.
             const dirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
+            const capturedEvidence = prepareCapturedCheckEvidence(this.store, task, checks);
             const failurePause = {
                 recordedAt: now.toISOString(),
                 dirtyFiles,
                 dirtyWorktreeHash: hashDirtyWorktree(context.identity.repositoryRoot, dirtyFiles),
                 checksHash: sha256Hex(canonicalJsonStringify(checks)),
                 failedChecks: normalizedFailures,
+                checksEvidence: capturedEvidence.reference,
             };
+            const failureC1Posture = readTaskC1Posture(this.store, task);
             const preparedRemediation = reviewRequired && planRiskAudit
                 ? prepareRemediationEvent(this.store, task, stepId, 'checks-failed', {
                     completionCommit: headCommit(context.identity.repositoryRoot),
@@ -3096,6 +3093,11 @@ export class WorkflowService {
                     reviewerAttestationHash: null,
                     executionTaskRevision: task.revision,
                     dirtyWorktreeHash: failurePause.dirtyWorktreeHash,
+                    ...(failureC1Posture.state === 'none' ? { unclaimedExecutionBoundary: {
+                            kind: 'native-unclaimed-check-failure',
+                            actor: lease.owner,
+                            priorHandoffEventHash: failureC1Posture.latestEvent?.eventHash ?? null,
+                        } } : {}),
                 }, planRiskAudit, now, this.stopOverrideContextRebindDecisionId(task, stepId, context.identity.repositoryRoot), mechanicalCauseBindings(normalizedFailures))
                 : null;
             const steps = task.steps.map((candidate) => candidate.id === stepId
@@ -3143,6 +3145,7 @@ export class WorkflowService {
                     : 'failed-step-continuation',
                 now,
                 targets: [
+                    ...(capturedEvidence.target ? [capturedEvidence.target] : []),
                     ...(preparedRemediation?.postimage
                         ? [{
                                 path: relative(path.join(taskRoot, 'remediation-events.jsonl')),
@@ -3158,6 +3161,7 @@ export class WorkflowService {
                 validate: () => {
                     const saved = this.store.readTask(task.projectId, task.id);
                     const savedStep = requireStep(saved, stepId);
+                    assertCapturedCheckEvidence(this.store, saved, savedStep.failurePause, checks);
                     const readbackDirtyFiles = changedFiles(context.identity.repositoryRoot).sort();
                     const remediationHash = preparedRemediation
                         ? readRemediationEvents(this.store, saved).find((event) => event.eventId === preparedRemediation.event.eventId)?.eventHash ?? null
@@ -3522,6 +3526,7 @@ export class WorkflowService {
     prepareExternalTaskReview(repository, taskId, expectedRevision, reviewMode = 'ordinary') {
         const identity = resolveRepositoryIdentity(repository);
         const task = this.store.readTask(identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
         const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
         if (task.status !== 'validating' && !retryingUnverified) {
@@ -3604,6 +3609,7 @@ export class WorkflowService {
         const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
         this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
@@ -3654,12 +3660,52 @@ export class WorkflowService {
         this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         return appendCorrectiveDecisionRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
-    recoverRemediationMode(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.#mutationContext(repository);
-        const task = this.store.readTask(context.identity.projectId, taskId);
-        assertExpectedRevision(task, expectedRevision);
-        this.requireExecutionAdoptionPosture(context.identity, taskId);
-        return appendRemediationModeRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
+    /** Recording a machine finding may retain its exact failed execution context;
+     * it never approves changed Knowledge or authorizes another task run. */
+    assessPlanIntegrityRecoveryAdmission(repository, task, stepId) {
+        const assessment = assessPlanIntegrityRecovery(this.store, repository, task, stepId);
+        if (!assessment.eligible)
+            return assessment;
+        try {
+            this.assertExecutionAuthorizationFresh(task, repository);
+            const stored = this.store.readKnowledgeMap(task.projectId);
+            const storedHash = hashKnowledgeMap(stored);
+            if (stored.status !== 'active' || !stored.approval || stored.approval.mapHash !== storedHash
+                || task.knowledgeMapRevision !== stored.revision || task.knowledgeMapHash !== storedHash) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Recovery requires the exact approved Task Knowledge binding.');
+            }
+            const inspected = inspectKnowledgeMap(stored, scanProjectKnowledge(repository, task.projectId, this.now()));
+            if (inspected.status === 'active' && inspected.approval?.mapHash === storedHash && hashKnowledgeMap(inspected) === storedHash)
+                return assessment;
+            if (inspected.status !== 'stale' || !isContentOnlyKnowledgeRefresh(stored, inspected)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Recovery permits only content changes within the recorded failed execution.');
+            }
+            const step = requireStep(task, stepId);
+            const pause = step.failurePause;
+            const last = readRemediationEvents(this.store, task).filter(event => event.stepId === stepId).at(-1);
+            const dirty = changedFiles(repository).sort();
+            const changedKnowledge = inspected.entries.filter(entry => stored.entries.find(previous => previous.id === entry.id)?.contentHash !== entry.contentHash);
+            // Only the immediately recorded native failure may defer Knowledge approval;
+            // historical transport or later Task revisions never establish this admission.
+            if (!pause || !last || last.failureKind !== 'checks-failed'
+                || last.failureEvidence.executionTaskRevision !== task.revision - 1
+                || last.failureEvidence.completionCommit !== headCommit(repository)
+                || last.failureEvidence.checksHash !== pause.checksHash
+                || last.failureEvidence.dirtyWorktreeHash !== pause.dirtyWorktreeHash
+                || JSON.stringify(dirty) !== JSON.stringify([...pause.dirtyFiles].sort())
+                || hashDirtyWorktree(repository, dirty) !== pause.dirtyWorktreeHash
+                || changedKnowledge.some(entry => !dirty.includes(entry.path)
+                    || !pathAllowed(entry.path, step.allowedWrites) || pathAllowed(entry.path, step.forbiddenScope))) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Recovery Knowledge drift must match the exact native failed-Step HEAD, checks and dirty bytes.');
+            }
+            assertCurrentCapturedCheckEvidence(this.store, task, stepId);
+            return assessment;
+        }
+        catch (error) {
+            if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
+                throw error;
+            return { ...assessment, eligible: false, blockers: [...assessment.blockers, error.message] };
+        }
     }
     recoverPlanIntegrity(repository, taskId, stepId, expectedRevision, actor, writerToken) {
         const context = this.#mutationContext(repository);
@@ -3688,29 +3734,12 @@ export class WorkflowService {
                 stepId,
             });
         }
-        const assessment = assessPlanIntegrityRecovery(this.store, context.identity.repositoryRoot, task, stepId);
+        const assessment = this.assessPlanIntegrityRecoveryAdmission(context.identity.repositoryRoot, task, stepId);
         if (!assessment.applicable || !assessment.eligible || !assessment.evidence) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Bounded Plan-integrity recovery is not eligible for the current Task state.', {
-                taskId,
-                stepId,
-                applicable: assessment.applicable,
-                blockers: assessment.blockers,
+                taskId, stepId, applicable: assessment.applicable, blockers: assessment.blockers,
             });
         }
-        const remediationEventIds = assessment.evidence.kind === 'missing-npm-script-outside-allowed-writes'
-            ? [assessment.evidence.remediationEventId]
-            : assessment.evidence.remediationEvents.map((event) => event.eventId);
-        const compatibility = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.commitSha === headCommit(context.identity.repositoryRoot)
-            && record.packageVersion === PACKAGE_VERSION
-            && task.systemCommits.includes(record.commitSha)
-            && record.planIntegrity?.stepId === stepId
-            && record.planIntegrity.planHash === task.planHash
-            && canonicalJsonStringify(record.planIntegrity.remediationEventIds) === canonicalJsonStringify(remediationEventIds)
-            && record.planIntegrity.dirtyWorktreeHash === hashDirtyWorktree(context.identity.repositoryRoot, record.planIntegrity.dirtyFiles));
-        if (!compatibility) {
-            this.assertExecutionAuthorizationFresh(task, context.identity.repositoryRoot);
-            this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
-        }
         const event = appendPlanIntegrityRecoveryDecision(this.store, task, stepId, defaultPlanIntegrityRecoveryActor(task.id), assessment.evidence, this.now());
         return { assessment, event };
     }
@@ -3761,6 +3790,9 @@ export class WorkflowService {
                 resolution: currentCycle,
             });
         }
+        if (!correctiveDecisionCheckoutEligible(this.store, identity.repositoryRoot, task, stepId)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Corrective decision requires the Task checkout to be clean or match its exact in-scope failed checkpoint.', { taskId, stepId });
+        }
         assertCorrectiveAuditorIndependence(this.store, task, stepId, correctiveAudit.auditor);
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
@@ -3768,6 +3800,7 @@ export class WorkflowService {
         const context = this.#mutationContext(repository);
         const { identity } = context;
         const task = this.store.readTask(identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Result requires a passing independent review.');
@@ -3788,6 +3821,7 @@ export class WorkflowService {
     acceptTask(repository, taskId, expectedRevision, actor, delegationGrantId = null) {
         const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'awaiting_final_acceptance' || !task.resultHash || !task.evidenceHash) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} is not ready for final acceptance.`);
@@ -3834,59 +3868,70 @@ export class WorkflowService {
     }
     syncTaskBase(repository, taskId, expectedRevision) {
         const { identity } = this.#mutationContext(repository);
-        const task = this.store.readTask(identity.projectId, taskId);
+        let task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.taskBranch || !task.baseCommit) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Base sync is available only for an accepted local Task.');
-        }
-        const currentBase = runGit(identity.repositoryRoot, ['rev-parse', task.baseBranch]);
-        if (currentBase === task.baseCommit) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Base branch has not advanced; synchronization is unnecessary.');
-        }
-        const synced = syncBaseIntoTask(identity.repositoryRoot, task.taskBranch, task.baseBranch);
-        const checks = runChecks(identity.repositoryRoot, [...new Set(task.steps.flatMap((step) => step.checks))]);
-        const failed = checks.filter((check) => !check.passed);
-        if (failed.length > 0) {
-            return this.store.writeTask({
-                ...task,
-                status: 'needs_fix',
-                baseCommit: synced.baseCommit,
-                systemCommits: [...task.systemCommits, synced.syncCommit],
-                review: emptyReview(),
-                resultHash: null,
-                blockReason: 'Checks failed after synchronizing the base branch.',
-            }, expectedRevision);
+        if (task.pendingBaseSyncValidation !== undefined) {
+            assertPendingBaseSyncValidationReady(task);
         }
+        else {
+            if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.taskBranch || !task.baseCommit) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Base sync is available only for an accepted local Task.');
+            }
+            const currentBase = runGit(identity.repositoryRoot, ['rev-parse', task.baseBranch]);
+            if (currentBase === task.baseCommit) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Base branch has not advanced; synchronization is unnecessary.');
+            }
+            const taskHead = headCommit(identity.repositoryRoot);
+            if (currentBaseSyncConflict(this.store, task, taskHead, currentBase)) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Base sync awaits an external decision for this exact conflicting HEAD pair.', {
+                    taskId, taskHead, baseHead: currentBase, waitFor: 'The base owner resolves the conflict on the base branch without changing the reviewed Task head.',
+                });
+            }
+            let synced;
+            try {
+                synced = syncBaseIntoTask(identity.repositoryRoot, task.taskBranch, task.baseBranch);
+            }
+            catch (error) {
+                if (error instanceof WorkflowError && error.code === 'GIT_PRECONDITION_FAILED'
+                    && error.details.cleanAbortVerified === true && headCommit(identity.repositoryRoot) === taskHead
+                    && runGit(identity.repositoryRoot, ['rev-parse', task.baseBranch]) === currentBase) {
+                    recordBaseSyncConflict(this.store, task, taskHead, currentBase);
+                }
+                throw error;
+            }
+            task = this.store.writeTask({
+                ...task, status: 'validating', baseCommit: synced.baseCommit,
+                systemCommits: [...new Set([...task.systemCommits, synced.syncCommit])],
+                evidenceHash: null, resultHash: null, review: emptyReview(),
+                authorizations: task.authorizations.map(item => item.kind === 'final_acceptance' && item.decision === 'approved'
+                    ? { ...item, decision: 'superseded' } : item),
+                pendingBaseSyncValidation: { baseCommit: synced.baseCommit, syncCommit: synced.syncCommit,
+                    headCommit: headCommit(identity.repositoryRoot), checksHash: taskSyncChecksHash(task) },
+                blockReason: 'Base synchronized; checks must complete before review and acceptance.',
+            }, task.revision);
+        }
+        assertPendingBaseSyncValidationReady(task);
+        const checks = runChecks(identity.repositoryRoot, taskSyncChecks(task), this.checkOptions);
+        // A check that changes the repository cannot certify the recorded merge snapshot.
+        assertPendingBaseSyncValidationReady(task);
+        const { pendingBaseSyncValidation: _pending, ...validatedTask } = task;
+        const failed = checks.some(check => !check.passed);
         const root = this.store.taskRoot(task.projectId, task.id);
         const stagedEvidence = this.store.stageArtifact(root, 'evidence.json', JSON.stringify({
-            taskId: task.id,
-            headCommit: headCommit(identity.repositoryRoot),
-            generatedAt: this.now().toISOString(),
-            reason: 'base-sync',
-            checks,
-            steps: task.steps.map((step) => ({ id: step.id, evidence: step.evidence })),
-            systemCommits: [...task.systemCommits, synced.syncCommit],
+            taskId: task.id, headCommit: headCommit(identity.repositoryRoot), generatedAt: this.now().toISOString(),
+            reason: 'base-sync', checks, steps: task.steps.map(step => ({ id: step.id, evidence: step.evidence })),
+            systemCommits: task.systemCommits,
         }, null, 2));
-        const authorizations = task.authorizations.map((authorization) => authorization.kind === 'final_acceptance' && authorization.decision === 'approved'
-            ? { ...authorization, decision: 'superseded' }
-            : authorization);
-        const saved = this.store.writeTask({
-            ...task,
-            status: 'validating',
-            baseCommit: synced.baseCommit,
-            systemCommits: [...task.systemCommits, synced.syncCommit],
-            evidenceHash: stagedEvidence.hash,
-            review: emptyReview(),
-            resultHash: null,
-            authorizations,
-            blockReason: 'Base changed; validation, review, and final acceptance must be repeated.',
-        }, expectedRevision);
+        const saved = this.store.writeTask({ ...validatedTask, status: failed ? 'needs_fix' : 'validating', evidenceHash: stagedEvidence.hash,
+            blockReason: failed ? 'Checks failed after synchronizing the base branch.'
+                : 'Base changed; validation, review, and final acceptance must be repeated.' }, task.revision);
         this.store.publishArtifact(stagedEvidence);
         return saved;
     }
     mergeTask(repository, taskId, expectedRevision, writerToken, actor) {
         const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
+        assertNoPendingBaseSyncValidation(task);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, lease.token);
@@ -4019,7 +4064,7 @@ export class WorkflowService {
         const { identity } = this.#mutationContext(repository);
         return this.inspectAdoptionPreparation(identity, this.store.listTasks(identity.projectId), this.store.listMilestones(identity.projectId));
     }
-    applyAdoption(repository, actor, confirmationCode) {
+    applyAdoption(repository, actor, confirmationCode, delegationGrantId = null) {
         const context = this.#mutationContext(repository);
         const tasks = context.store.listTasks(context.identity.projectId);
         const milestones = context.store.listMilestones(context.identity.projectId);
@@ -4034,138 +4079,7 @@ export class WorkflowService {
             sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
             blockers: this.computeAdoptionBoundaryBlockers(context.identity, tasks, context.locks.list()),
             now: this.now(),
-        }, actor, confirmationCode);
-    }
-    pendingReviewUpdatePreflight(repository, taskId) {
-        const snapshot = this.observationSnapshot(repository);
-        const blockers = observationPreflightBlockers(snapshot.observation);
-        try {
-            pendingReviewRunnerFingerprint();
-        }
-        catch (error) {
-            blockers.push(error instanceof Error ? error.message : String(error));
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        let binding = null;
-        if (PACKAGE_VERSION === PENDING_REVIEW_SOURCE_VERSION)
-            blockers.push('The exact target runner must be newer than the supported source.');
-        if (!task)
-            blockers.push('Task not found.');
-        if (task) {
-            try {
-                binding = pendingReviewSourceBinding(snapshot.identity.repositoryRoot, this.store, task);
-            }
-            catch (error) {
-                blockers.push(error instanceof Error ? error.message : String(error));
-            }
-            const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
-            if ([versions.declared, versions.locked, versions.installed, versions.currentBranch,
-                ...versions.milestoneBases.map((base) => base.version)].some((version) => version !== PENDING_REVIEW_SOURCE_VERSION)) {
-                blockers.push('All source version surfaces must equal the exact supported beta.13.1.');
-            }
-        }
-        const otherRunningSteps = snapshot.tasks.flatMap((candidate) => candidate.steps.filter((step) => step.status === 'in_progress' && (candidate.id !== taskId || step.id !== binding?.stepId)));
-        if (otherRunningSteps.length)
-            blockers.push('No other Step may be running.');
-        const stale = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= this.now().getTime());
-        if (snapshot.leases.some((lease) => !stale.includes(lease)))
-            blockers.push('No live writer lease may exist.');
-        if (stale.some((lease) => lease.entityId !== taskId))
-            blockers.push('No unrelated stale writer lease may exist.');
-        const staleLeaseRepair = blockers.length === 0 && binding
-            ? stale.map((lease) => ({ action: 'locks repair', entityId: lease.entityId })) : [];
-        if (stale.length)
-            blockers.push('Repair the exact stale Task lease with the installed source locks repair, then rerun source preflight.');
-        return { readOnly: true, eligible: blockers.length === 0 && binding !== null, binding,
-            bindingHash: binding ? pendingReviewBindingHash(binding) : null, blockers, staleLeaseRepair };
-    }
-    pendingReviewDependencyPreflight(repository, taskId, source) {
-        const snapshot = this.observationSnapshot(repository);
-        const blockers = observationPreflightBlockers(snapshot.observation);
-        try {
-            pendingReviewRunnerFingerprint();
-        }
-        catch (error) {
-            blockers.push(error instanceof Error ? error.message : String(error));
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        const taskHead = headCommit(snapshot.identity.repositoryRoot);
-        let baseTransportCommit = null;
-        if (snapshot.leases.length)
-            blockers.push('No live or stale writer lease may exist.');
-        if (!task)
-            blockers.push('Task not found.');
-        if (task && existsSync(path.join(this.store.taskRoot(task.projectId, task.id), PENDING_REVIEW_UPDATE_SIDECAR)))
-            blockers.push('A pending review update is already recorded.');
-        if (task) {
-            try {
-                // Receipt fields are claims, not authority. Reconstruct every source binding from
-                // canonical Task/sidecars and the exact parents of the candidate Git commits.
-                const parent = runGit(repository, ['rev-parse', 'HEAD^']);
-                baseTransportCommit = runGit(repository, ['rev-parse', task.baseBranch]);
-                const baseParent = runGit(repository, ['rev-parse', `${baseTransportCommit}^`]);
-                const reconstructed = pendingReviewSourceBinding(repository, this.store, task, parent, baseParent);
-                if (canonicalJsonStringify(reconstructed) !== canonicalJsonStringify(source)) {
-                    throw new Error('Source receipt does not match reconstructed Task/revision/Plan/HEAD/pending bindings.');
-                }
-                assertPendingReviewTransport(repository, reconstructed, taskHead, baseTransportCommit);
-                if (snapshot.tasks.some((candidate) => candidate.steps.some((step) => step.status === 'in_progress' && (candidate.id !== taskId || step.id !== source.stepId)))) {
-                    throw new Error('No other Step may be running.');
-                }
-                const versions = inspectWorkflowVersions(repository, [task.baseBranch]);
-                if ([versions.runtime, versions.declared, versions.locked, versions.installed, versions.currentBranch,
-                    ...versions.milestoneBases.map((base) => base.version)].some((version) => version !== PACKAGE_VERSION)) {
-                    throw new Error('All target version surfaces must equal the exact target runner.');
-                }
-            }
-            catch (error) {
-                blockers.push(error instanceof Error ? error.message : String(error));
-            }
-        }
-        return { readOnly: true, eligible: blockers.length === 0, blockers, taskHead, baseTransportCommit };
-    }
-    recoverPendingReviewDependency(repository, taskId, expectedRevision, source, actor, reason) {
-        if (!actor.trim() || !reason.trim())
-            throw new WorkflowError('INVALID_ARGUMENT', 'Actor and reason are required.');
-        const initial = this.pendingReviewDependencyPreflight(repository, taskId, source);
-        if (!initial.eligible)
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Pending review dependency preflight failed.', initial);
-        const context = this.#mutationContext(repository);
-        const task = this.store.readTask(context.identity.projectId, taskId);
-        assertExpectedRevision(task, expectedRevision);
-        const preflight = this.pendingReviewDependencyPreflight(repository, taskId, source);
-        if (!preflight.eligible || !preflight.baseTransportCommit) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Pending review dependency preflight changed.', preflight);
-        }
-        const now = this.now();
-        const nextTask = { ...task, revision: task.revision + 1, updatedAt: now.toISOString(),
-            systemCommits: [...task.systemCommits, preflight.taskHead],
-            dependencyProvenanceRecoveries: [...(task.dependencyProvenanceRecoveries ?? []), {
-                    commitSha: preflight.taskHead, parentCommitSha: source.completionCommit,
-                    packageName: PACKAGE_NAME, packageVersion: PACKAGE_VERSION, files: ['package-lock.json', 'package.json'],
-                    actor: actor.trim(), reason: reason.trim(), recordedAt: now.toISOString(),
-                }] };
-        const projectRoot = this.store.projectRoot(task.projectId);
-        const event = preparePendingReviewUpdateEvent({ source, baseTransportCommit: preflight.baseTransportCommit }, preflight.taskHead, now.toISOString());
-        applyProjectTransaction({ projectRoot, projectId: task.projectId,
-            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
-            kind: 'pending-review-dependency-recovery', now,
-            targets: [{ path: path.relative(projectRoot, path.join(this.store.taskRoot(task.projectId, task.id), 'state.json')).split(path.sep).join('/'),
-                    content: `${JSON.stringify(nextTask, null, 2)}\n` },
-                { path: path.relative(projectRoot, path.join(this.store.taskRoot(task.projectId, task.id), PENDING_REVIEW_UPDATE_SIDECAR)).split(path.sep).join('/'),
-                    content: `${canonicalJsonStringify(event)}\n` }],
-            validate: () => {
-                const saved = this.store.readTask(task.projectId, task.id);
-                if (saved.revision !== nextTask.revision || !verifiedPendingReviewTransport(repository, saved, source.stepId, this.store.taskRoot(task.projectId, task.id))) {
-                    throw new WorkflowError('STATE_CORRUPT', 'Pending review dependency recovery readback failed.');
-                }
-                const cycle = buildCurrentStrictStepReviewCycle(this.store, saved, source.stepId);
-                if (cycle.resolution !== 'pending' || cycle.pendingEvent?.eventHash !== source.pendingEventHash) {
-                    throw new WorkflowError('STATE_CORRUPT', 'Pending review changed during dependency recovery.');
-                }
-            },
-        });
-        return this.store.readTask(task.projectId, task.id);
+        }, actor, confirmationCode, delegationGrantId);
     }
     updatePreflight(repository) {
         const snapshot = this.observationSnapshot(repository);
@@ -4248,6 +4162,110 @@ export class WorkflowService {
             observation: snapshot.observation,
         };
     }
+    navigationUpdateBoundary(repository, taskId) {
+        const snapshot = this.observationSnapshot(repository);
+        const observation = snapshot.observation;
+        const task = snapshot.tasks.find(item => item.id === taskId);
+        if (!task || observation.kind !== 'assessment' || snapshot.leases.length
+            || snapshot.tasks.some(item => item.steps.some(step => step.status === 'in_progress'))
+            || observation.pendingProjectTransactions.length || observation.pendingMilestoneTransactions.length
+            || observation.pendingTaskTransactions.length || observation.corruptTaskTransactions.length
+            || observation.coreTaskOperations.length) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Navigation update requires coherent state and no leases or pending operations.');
+        }
+        const otherBases = snapshot.milestones.filter(item => !['accepted', 'cancelled'].includes(item.status)
+            && item.baseBranch !== task.baseBranch);
+        if (otherBases.length)
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Navigation update supports one active base branch.');
+        return { snapshot, task, root: snapshot.identity.repositoryRoot };
+    }
+    failedCheckpointUpdateSourcePreflight(repository, taskId, tarball) {
+        try {
+            const { task, root } = this.navigationUpdateBoundary(repository, taskId);
+            assertFailedCheckpointInstalled(root, task, FAILED_CHECKPOINT_SOURCE);
+            const receipt = failedCheckpointUpdateSource(root, this.store, task, verifyNavigationUpdateArtifact(tarball));
+            return { eligible: true, blockers: [], receipt };
+        }
+        catch (error) {
+            return { eligible: false, blockers: [error instanceof Error ? error.message : String(error)], receipt: null };
+        }
+    }
+    failedCheckpointUpdateTransportPreflight(repository, taskId, tarball, receipt) {
+        try {
+            const { task, root } = this.navigationUpdateBoundary(repository, taskId);
+            const proof = inspectFailedCheckpointTransport(root, this.store, task, receipt, verifyNavigationUpdateArtifact(tarball, path.join(root, 'node_modules/codex-workflow-v2')));
+            return { eligible: true, blockers: [], proof,
+                action: 'update failed-checkpoint-recover', expectedRevision: task.revision, actor: receipt.actor };
+        }
+        catch (error) {
+            return { eligible: false, blockers: [error instanceof Error ? error.message : String(error)], proof: null };
+        }
+    }
+    recoverFailedCheckpointUpdate(repository, taskId, expectedRevision, tarball, receipt, actor, reason) {
+        this.#mutationContext(repository);
+        const { task, root } = this.navigationUpdateBoundary(repository, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (!actor.trim() || actor !== receipt?.actor || !reason.trim()) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Failed-checkpoint update requires the original claimant and an explicit reason.');
+        }
+        const proof = inspectFailedCheckpointTransport(root, this.store, task, receipt, verifyNavigationUpdateArtifact(tarball, path.join(root, 'node_modules/codex-workflow-v2')));
+        const updated = { ...task, status: 'awaiting_execution_authorization',
+            systemCommits: [...task.systemCommits, proof.target.commitSha],
+            dependencyProvenanceRecoveries: [...(task.dependencyProvenanceRecoveries ?? []), {
+                    ...proof.target, packageName: PACKAGE_NAME, files: ['package-lock.json', 'package.json'], actor,
+                    reason: `${reason.trim()} [failed-checkpoint-update ${receipt.artifact.sha256}]`,
+                    recordedAt: this.now().toISOString(), failedCheckpoint: proof.binding,
+                }],
+        };
+        validateTaskHistory(root, updated);
+        return this.store.writeTask(updated, expectedRevision);
+    }
+    navigationUpdateSourcePreflight(repository, taskId, tarball) {
+        try {
+            const { task, root } = this.navigationUpdateBoundary(repository, taskId);
+            assertNavigationSourceInstalled(root, task);
+            const receipt = navigationUpdateSource(root, this.store, task, verifyNavigationUpdateArtifact(tarball), task.updatedAt);
+            return { eligible: true, blockers: [], receipt };
+        }
+        catch (error) {
+            return { eligible: false, blockers: [error instanceof Error ? error.message : String(error)], receipt: null };
+        }
+    }
+    navigationUpdateTransportPreflight(repository, taskId, tarball, receipt) {
+        try {
+            const { task, root } = this.navigationUpdateBoundary(repository, taskId);
+            const proof = inspectNavigationTransport(root, this.store, task, receipt, verifyNavigationUpdateArtifact(tarball, path.join(root, 'node_modules/codex-workflow-v2')), this.now());
+            return { eligible: true, blockers: [], proof,
+                action: 'update navigation-recover', expectedRevision: task.revision, actor: receipt.actor };
+        }
+        catch (error) {
+            return { eligible: false, blockers: [error instanceof Error ? error.message : String(error)], proof: null };
+        }
+    }
+    recoverNavigationUpdate(repository, taskId, expectedRevision, tarball, receipt, actor, reason) {
+        this.#mutationContext(repository);
+        const { task, root } = this.navigationUpdateBoundary(repository, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (!actor.trim() || actor !== receipt?.actor || !reason.trim()) {
+            throw new WorkflowError('INVALID_ARGUMENT', 'Navigation update requires the source claimant and an explicit reason.');
+        }
+        const preflight = this.navigationUpdateTransportPreflight(repository, taskId, tarball, receipt);
+        if (!preflight.eligible || !preflight.proof) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Navigation transport preflight failed.', { blockers: preflight.blockers });
+        }
+        // Recompute the source/state/Git bindings immediately before the atomic optimistic state write.
+        const boundary = this.navigationUpdateBoundary(repository, taskId);
+        const proof = inspectNavigationTransport(root, this.store, boundary.task, receipt, verifyNavigationUpdateArtifact(tarball, path.join(root, 'node_modules/codex-workflow-v2')), this.now());
+        const saved = this.store.writeTask({ ...boundary.task, status: 'awaiting_execution_authorization',
+            systemCommits: [...boundary.task.systemCommits, ...proof.commits.map(item => item.commitSha)],
+            dependencyProvenanceRecoveries: [...(boundary.task.dependencyProvenanceRecoveries ?? []),
+                ...proof.commits.map(item => ({ ...item, packageName: PACKAGE_NAME,
+                    files: ['package-lock.json', 'package.json'],
+                    actor, reason: `${reason.trim()} [navigation-update ${receipt.artifact.sha256}]`, recordedAt: this.now().toISOString() }))],
+        }, expectedRevision);
+        validateTaskHistory(root, saved);
+        return saved;
+    }
     dependencyProvenanceRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
         if (snapshot.observation.kind !== 'assessment') {
@@ -4258,299 +4276,7 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const candidate = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, headCommit(snapshot.identity.repositoryRoot));
-        const carryover = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task, undefined, candidate?.parentCommitSha);
-        const preflight = this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, null, null, carryover.eligible ? carryover.compatibility : null);
-        if (!preflight.rootCauseReplan)
-            return preflight;
-        let baseTip = null;
-        let baseDependency = null;
-        try {
-            baseTip = runGit(snapshot.identity.repositoryRoot, ['rev-parse', task.baseBranch]);
-            baseDependency = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, baseTip);
-        }
-        catch {
-            // The blocker below keeps a missing or unreadable base reference fail closed.
-        }
-        const bridgeBlockers = [
-            ...(preflight.dependencyCommits.length !== 1
-                ? ['Corrective carryover recovery requires exactly one Task dependency-only commit.'] : []),
-            ...(preflight.parentCommitSha !== preflight.rootCauseReplan.sourceHeadCommit
-                ? ['Corrective carryover dependency parent must equal the bound source HEAD.'] : []),
-            ...(preflight.parentCommitSha
-                && workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha) !== '2.0.0-beta.13.6'
-                ? ['Corrective carryover dependency parent must declare exact source beta.13.6.'] : []),
-            ...(preflight.dependencyCommits.at(-1)?.packageVersion !== PACKAGE_VERSION
-                ? [`Corrective carryover dependency commit must declare exact target ${PACKAGE_VERSION}.`] : []),
-            ...(!baseDependency
-                || baseDependency.commitSha !== baseTip
-                || baseDependency.packageVersion !== PACKAGE_VERSION
-                || workflowDependencyVersionAt(snapshot.identity.repositoryRoot, baseDependency.parentCommitSha)
-                    !== workflowDependencyVersionAt(snapshot.identity.repositoryRoot, preflight.parentCommitSha ?? '')
-                ? ['Corrective carryover Milestone-base tip must be one dependency-only commit with the same exact source and runtime target.'] : []),
-        ];
-        return bridgeBlockers.length === 0
-            ? preflight
-            : {
-                ...preflight,
-                eligible: false,
-                action: null,
-                commitSha: null,
-                parentCommitSha: null,
-                blockers: [...new Set([...preflight.blockers, ...bridgeBlockers])],
-            };
-    }
-    correctiveCarryoverUpdatePreflight(repository, taskId, candidate = null) {
-        const snapshot = this.observationSnapshot(repository);
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        if (!task)
-            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
-        const sourceVersion = '2.0.0-beta.13.6';
-        const targetVersion = CONSUMED_CARRYOVER_TARGET_VERSION;
-        const sourceSurfaces = {
-            declared: versions.declared,
-            locked: versions.locked,
-            installed: versions.installed,
-            currentBranch: versions.currentBranch,
-            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
-        };
-        const c1 = readTaskC1Posture(this.store, task);
-        if (c1.state !== 'claimed') {
-            return this.consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate);
-        }
-        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(snapshot.identity.repositoryRoot, task);
-        const now = this.now().getTime();
-        const activeLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now);
-        const staleLeases = snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
-        const transactionCount = snapshot.observation.pendingProjectTransactions.length
-            + snapshot.observation.pendingMilestoneTransactions.length
-            + snapshot.observation.pendingTaskTransactions.length;
-        const authorizationBlockers = [];
-        if (assessment.eligible) {
-            try {
-                this.assertExecutionAuthorizationFresh(task, snapshot.identity.repositoryRoot);
-            }
-            catch (error) {
-                authorizationBlockers.push(error instanceof Error ? error.message : String(error));
-            }
-        }
-        const baseBlockers = [
-            ...assessment.blockers,
-            ...authorizationBlockers,
-            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
-            ...Object.entries(sourceSurfaces)
-                .filter(([, version]) => version !== sourceVersion)
-                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
-            ...observationPreflightBlockers(snapshot.observation),
-            ...(transactionCount > 0 ? ['No pending Workflow transaction may exist.'] : []),
-            ...(snapshot.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
-            ...(snapshot.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
-            ...(c1.state !== 'claimed' || assessment.compatibility?.claimant !== c1.claimant
-                ? ['The exact original Worker C1 claim must remain current.'] : []),
-            ...(activeLeases.length > 0 ? ['No live writer lease may exist during corrective carryover transport.'] : []),
-            ...(staleLeases.some((lease) => lease.entityId !== task.id
-                || c1.state !== 'claimed' || lease.owner !== c1.claimant
-                || createHash('sha256').update(lease.token).digest('hex') !== c1.writerLeaseTokenHash)
-                ? ['No unrelated or differently owned stale writer lease may exist.'] : []),
-            ...(staleLeases.length > 1 ? ['At most the exact corrective Task stale lease may exist.'] : []),
-        ];
-        const repairableStale = baseBlockers.length === 0 && staleLeases.length === 1
-            ? staleLeases[0]
-            : null;
-        const blockers = [
-            ...baseBlockers,
-            ...(repairableStale
-                ? ['Repair the exact expired claimant lease with source locks repair, then run status, next, and this preflight again.']
-                : []),
-        ];
-        const compatibility = assessment.compatibility;
-        return {
-            readOnly: true,
-            eligible: Boolean(assessment.eligible && compatibility && blockers.length === 0 && staleLeases.length === 0),
-            action: assessment.eligible && compatibility && blockers.length === 0 && staleLeases.length === 0
-                ? 'update corrective-carryover-transport'
-                : null,
-            projectId: task.projectId,
-            taskId: task.id,
-            taskRevision: task.revision,
-            stepId: compatibility?.stepId ?? null,
-            sourceVersion,
-            targetVersion,
-            sourceHeadCommit: compatibility?.sourceHeadCommit ?? null,
-            taskBranch: task.taskBranch,
-            baseBranch: task.baseBranch,
-            dirtyFiles: compatibility?.dirtyFiles ?? [],
-            dirtyWorktreeHash: compatibility?.dirtyWorktreeHash ?? null,
-            compatibilityHash: compatibility?.compatibilityHash ?? null,
-            c1Posture: c1.state === 'claimed' ? {
-                state: 'claimed',
-                claimant: c1.claimant,
-                claimEventId: compatibility?.c1ClaimEventId ?? null,
-                claimEventHash: compatibility?.c1ClaimEventHash ?? null,
-            } : null,
-            staleLeaseRepair: repairableStale ? [{
-                    action: 'locks repair',
-                    entityId: task.id,
-                    owner: repairableStale.owner,
-                    expiresAt: repairableStale.expiresAt,
-                }] : [],
-            requiredTransport: [
-                'Commit only package.json and package-lock.json on the active Milestone base.',
-                'Commit only the same dependency files on the Task branch while preserving the bound dirty bytes.',
-                'Install the exact target package, register dependency provenance, refresh context, replace the same Worker credential, then follow fresh next.',
-            ],
-            blockers,
-        };
-    }
-    consumedCarryoverSourceRecoveryPreflight(snapshot, task, sourceSurfaces, candidate) {
-        const repositoryRoot = snapshot.identity.repositoryRoot;
-        const sourceVersion = '2.0.0-beta.13.6';
-        const targetVersion = CONSUMED_CARRYOVER_TARGET_VERSION;
-        const c1 = readTaskC1Posture(this.store, task);
-        const recorded = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan && task.systemCommits.includes(record.commitSha))?.rootCauseReplan;
-        const currentHead = headCommit(repositoryRoot);
-        const dirtyFiles = changedFiles(repositoryRoot).sort();
-        const dirtyWorktreeHash = hashDirtyWorktree(repositoryRoot, dirtyFiles);
-        const navigation = this.next(repositoryRoot, task.id);
-        const action = String(navigation.action);
-        const stepId = typeof navigation.stepId === 'string' ? navigation.stepId : null;
-        const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
-        const terminal = readRemediationEvents(this.store, task)
-            .filter((event) => event.stepId === stepId && event.failureKind === 'checks-failed').at(-1);
-        const matchingYields = readTaskHandoffEvents(this.store, task).filter((event) => terminal && matchesTerminalCorrectiveYield(event, terminal, task.id));
-        const yielded = matchingYields.length === 1 ? matchingYields[0] : null;
-        const assessment = this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId ?? undefined);
-        const missingClaimOnly = assessment.blockers.length === 1
-            && assessment.blockers[0].startsWith('Corrective carryover requires the retained claimed C1');
-        const rollingWave = navigation.rollingWave;
-        const sourceActionAllowed = (action === 'task plan-set' && step?.status === 'failed'
-            && rollingWave?.state === 'root-cause-replan-required' && !assessment.applicable && c1.state === 'none')
-            || (action === 'task handoff-prepare' && step?.status === 'planned' && missingClaimOnly && c1.state === 'none')
-            || (action === 'task claim' && step?.status === 'planned' && missingClaimOnly
-                && c1.state === 'pending' && c1.targetActor === yielded?.actor);
-        const blockers = [
-            ...(PACKAGE_VERSION !== targetVersion ? [`Runner must be the exact ${targetVersion} compatibility target.`] : []),
-            ...Object.entries(sourceSurfaces).filter(([, version]) => version !== sourceVersion)
-                .map(([surface]) => `${surface} Workflow version must equal the exact ${sourceVersion} source.`),
-            ...observationPreflightBlockers(snapshot.observation),
-            ...(snapshot.leases.length > 0 ? ['No active or stale writer lease may exist before source recovery.'] : []),
-            ...(snapshot.observation.pendingProjectTransactions.length
-                + snapshot.observation.pendingMilestoneTransactions.length
-                + snapshot.observation.pendingTaskTransactions.length
-                + snapshot.observation.corruptTaskTransactions.length
-                + snapshot.observation.coreTaskOperations.length > 0 ? ['No pending or corrupt transaction or Core operation may exist.'] : []),
-            ...(!recorded || recorded.stepId === stepId
-                || task.steps.find((candidate) => candidate.id === recorded.stepId)?.status !== 'completed'
-                ? ['A different, verified completed Step must own the historical carryover binding.'] : []),
-            ...(!sourceActionAllowed ? ['No exact source Plan replacement or original-Worker handoff action is eligible.'] : []),
-            ...(!(task.status === 'ready' || (action === 'task plan-set' && task.status === 'needs_fix'))
-                || task.workspaceOwner !== 'local'
-                || currentBranch(repositoryRoot) !== task.taskBranch
-                || task.steps.some((candidate) => candidate.status === 'in_progress')
-                ? ['The Task must retain its local, no-running-Step source recovery boundary.'] : []),
-            ...(!step || dirtyFiles.length === 0
-                || dirtyFiles.some((file) => !pathAllowed(file, step.allowedWrites) || pathAllowed(file, step.forbiddenScope))
-                ? ['Retained dirty files must remain inside the exact current Step scope.'] : []),
-            ...(!terminal || terminal.failureEvidence.completionCommit !== currentHead
-                || terminal.failureEvidence.dirtyWorktreeHash !== dirtyWorktreeHash
-                ? ['The terminal repeated failure HEAD and dirty-byte binding must remain unchanged.'] : []),
-            ...(!yielded || !terminal || yielded.planHash === null
-                || !Number.isFinite(Date.parse(yielded.recordedAt))
-                || Date.parse(yielded.recordedAt) < Date.parse(terminal.recordedAt)
-                ? ['The terminal failure must retain its exact completed original-Worker corrective yield.'] : []),
-        ];
-        let candidateBinding = null;
-        if (action === 'task plan-set') {
-            if (!candidate) {
-                blockers.push('Source Plan replacement requires candidate Plan and independent Plan Risk Audit inputs.');
-            }
-            else {
-                try {
-                    validatePlan(candidate.plan);
-                    const retained = deriveCompletedStepCarryover(task, candidate.plan.steps);
-                    if (task.steps.some((completed) => completed.status === 'completed' && !retained.has(completed.id))) {
-                        throw new Error('Candidate must preserve every completed Step definition and its execution authority exactly.');
-                    }
-                    const correctiveStep = candidate.plan.steps.find((candidateStep) => candidateStep.id === stepId);
-                    if (!correctiveStep || dirtyFiles.some((file) => !pathAllowed(file, correctiveStep.allowedWrites) || pathAllowed(file, correctiveStep.forbiddenScope))) {
-                        throw new Error('Candidate must retain the exact failed Step and confine every dirty path to its replacement scope.');
-                    }
-                    if (correctiveStep.dependencies.some((dependency) => !retained.has(dependency))) {
-                        throw new Error('Candidate corrective Step dependencies must retain completed execution authority.');
-                    }
-                    if (candidate.plan.objective !== task.planObjective
-                        || canonicalJsonStringify(candidate.plan.requirements) !== canonicalJsonStringify(task.requirements)
-                        || canonicalJsonStringify(candidate.plan.acceptance) !== canonicalJsonStringify(task.acceptance)) {
-                        throw new Error('Candidate cannot change Task objective, requirements or acceptance.');
-                    }
-                    const map = this.assertKnowledgeMapBinding(repositoryRoot, task.projectId, candidate.plan.knowledgeMapRevision, candidate.plan.knowledgeMapHash);
-                    this.validateKnowledgeTargets(map, candidate.plan);
-                    const prepared = prepareCorrectiveReplanCandidate(task, candidate.plan);
-                    if (!task.planHash || normalizePlanKnowledgeBinding(prepared.planBytes, 'source recovery candidate').semanticHash
-                        === normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), task.planHash, task.planHash), 'current failed Plan').semanticHash) {
-                        throw new Error('Candidate must change the failed Plan semantics before source recovery.');
-                    }
-                    if (!['approved', 'approved-with-rationale'].includes(candidate.planRiskAudit.decision)) {
-                        throw new Error('Source recovery candidate requires a positive independent Plan Risk Audit.');
-                    }
-                    const auditTask = {
-                        ...task, status: 'awaiting_execution_authorization', planHash: prepared.planHash,
-                        knowledgeMapRevision: candidate.plan.knowledgeMapRevision,
-                        knowledgeMapHash: candidate.plan.knowledgeMapHash,
-                        steps: candidate.plan.steps.map((candidateStep) => retained.get(candidateStep.id) ?? {
-                            ...candidateStep, status: 'planned', evidence: null, failurePause: null,
-                        }),
-                    };
-                    validatePlanRiskAuditCandidate(this.store, auditTask, candidate.planRiskAudit);
-                    candidateBinding = {
-                        candidatePlanHash: prepared.planHash,
-                        candidateInputHash: sha256Hex(canonicalJsonStringify(candidate.plan)),
-                        riskAuditInputHash: sha256Hex(canonicalJsonStringify(candidate.planRiskAudit)),
-                    };
-                }
-                catch (error) {
-                    blockers.push(error instanceof Error ? error.message : String(error));
-                }
-            }
-        }
-        try {
-            validateTaskHistory(repositoryRoot, task);
-            this.assertTaskKnowledgeBinding(repositoryRoot, task);
-            const sourceAudit = [...readPlanRiskAuditEvents(this.store, task)].reverse().find((event) => event.taskRevision <= (terminal?.failureEvidence.executionTaskRevision ?? -1));
-            if (!sourceAudit || !yielded?.planHash || !task.planHash
-                || normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), sourceAudit.planHash, task.planHash), 'terminal source').semanticHash
-                    !== normalizePlanKnowledgeBinding(readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), yielded.planHash, task.planHash), 'terminal corrective yield').semanticHash) {
-                throw new Error('Terminal failure and exact corrective yield must share a verified source Plan.');
-            }
-        }
-        catch (error) {
-            blockers.push(error instanceof Error ? error.message : String(error));
-        }
-        const binding = {
-            taskId: task.id, taskRevision: task.revision, stepId, briefHash: task.briefHash,
-            planHash: task.planHash, planRiskAuditEventHash: readCurrentPlanRiskAudit(this.store, task)?.audit.eventHash ?? null,
-            sourceHeadCommit: currentHead, dirtyFiles, dirtyWorktreeHash,
-            completedStepsHash: hashCompletedSteps(task), historicalCarryoverHash: recorded?.compatibilityHash ?? null,
-            terminalRemediationEventHash: terminal?.eventHash ?? null,
-            correctiveYieldEventHash: yielded?.eventHash ?? null, originalWorker: yielded?.actor ?? null,
-            c1Posture: c1.state,
-            candidateBinding,
-        };
-        return {
-            readOnly: true, eligible: false, sourceVersion, targetVersion, ...binding,
-            action: null, transportAllowed: false,
-            ...(action === 'task plan-set' ? { taskPlanContract: navigation.taskPlanContract } : {}),
-            compatibilityHash: sha256Hex(canonicalJsonStringify(binding)),
-            sourceRecovery: blockers.length === 0 ? {
-                eligible: true, action,
-                ...(action === 'task plan-set' ? { ...candidateBinding } : {}),
-                ...(action === 'task handoff-prepare' ? { targetActor: yielded.actor } : {}),
-                ...(action === 'task claim' ? { actor: yielded.actor } : {}),
-                instruction: 'Execute only this exact action with the installed source package; run source status then next and repeat this read-only preflight. Ordinary Plan Risk Audit and execution authorization retain their normal gates.',
-            } : null,
-            blockers,
-        };
+        return this.inspectDependencyProvenanceCandidate(snapshot, task);
     }
     historicalStepProvenanceRecoveryPreflight(repository, taskId) {
         const snapshot = this.observationSnapshot(repository);
@@ -4621,7 +4347,7 @@ export class WorkflowService {
                     ])],
             };
         }
-        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, {
+        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, {
             activeStepId: assessment.activeStepId,
             planHash: task.planHash,
             dirtyFiles: assessment.dirtyFiles,
@@ -4720,289 +4446,15 @@ export class WorkflowService {
             invalidatedStepIds: assessment.invalidatedSteps.map((step) => step.stepId),
         });
     }
-    downstreamProofReplanUpdatePreflight(repository, taskId) {
-        const snapshot = this.observationSnapshot(repository);
-        if (snapshot.observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan update preflight requires a coherent observation boundary.', {
-                observation: snapshot.observation,
-            });
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        if (!task)
-            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
-        const assessment = assessDownstreamProofReplanRecovery(this.store, snapshot.identity.repositoryRoot, task, { currentPlanRiskAuditExists });
-        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
-        const sourceVersion = '2.0.0-beta.12.6';
-        const versionSurfaces = {
-            declared: versions.declared,
-            locked: versions.locked,
-            installed: versions.installed,
-            currentBranch: versions.currentBranch,
-            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
-        };
-        const blockers = [
-            ...assessment.blockers,
-            ...(String(PACKAGE_VERSION) === sourceVersion ? ['Recovery runner must be newer than the beta.12.6 source package.'] : []),
-            ...Object.entries(versionSurfaces)
-                .filter(([, version]) => version !== sourceVersion)
-                .map(([surface]) => `${surface} Workflow version must equal the stranded source ${sourceVersion}.`),
-            ...(snapshot.observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
-            ...(snapshot.observation.pendingProjectTransactions.length > 0
-                || snapshot.observation.pendingMilestoneTransactions.length > 0
-                || snapshot.observation.pendingTaskTransactions.length > 0
-                ? ['No pending Workflow transaction may exist.'] : []),
-            ...(snapshot.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
-            ...(snapshot.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
-        ];
-        return {
-            readOnly: true,
-            eligible: assessment.applicable && assessment.eligible && blockers.length === 0,
-            action: assessment.applicable && assessment.eligible && blockers.length === 0
-                ? 'update downstream-proof-replan-transport'
-                : null,
-            projectId: task.projectId,
-            taskId: task.id,
-            taskRevision: task.revision,
-            sourceVersion,
-            targetVersion: PACKAGE_VERSION,
-            sourceHeadCommit: assessment.invalidation?.preservedHeadCommit ?? null,
-            taskBranch: task.taskBranch,
-            baseBranch: task.baseBranch,
-            dirtyFiles: assessment.compatibility?.dirtyFiles ?? [],
-            dirtyWorktreeHash: assessment.compatibility?.dirtyWorktreeHash ?? null,
-            requiredTransport: [
-                'Commit only package.json and package-lock.json on the active Milestone base.',
-                'Commit only the same dependency files on the Task branch while preserving all product bytes.',
-                'Install the exact target package, then follow fresh next to dependency registration.',
-            ],
-            blockers,
-        };
-    }
-    planIntegrityUpdatePreflight(repository, taskId) {
-        const snapshot = this.observationSnapshot(repository);
-        if (snapshot.observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity update preflight requires a coherent observation boundary.', {
-                observation: snapshot.observation,
-            });
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        if (!task)
-            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const assessments = task.steps
-            .filter((step) => step.status === 'failed')
-            .map((step) => assessPlanIntegrityRecovery(this.store, snapshot.identity.repositoryRoot, task, step.id))
-            .filter((assessment) => assessment.applicable);
-        const assessment = assessments.length === 1 ? assessments[0] : null;
-        const adoptedCompatibility = assessment
-            ? null
-            : this.postRebindCheckSupportCompatibility(snapshot, task);
-        const dirtyCarryoverAssessment = assessment || adoptedCompatibility
-            ? null
-            : this.assessPostRebindCheckSupportDirtyCarryover(snapshot.identity.repositoryRoot, task);
-        const dirtyCarryoverCompatibility = dirtyCarryoverAssessment?.eligible
-            && dirtyCarryoverAssessment.compatibility
-            ? {
-                ...dirtyCarryoverAssessment.compatibility,
-                planHash: task.planHash,
-                mode: 'post-rebind-dirty-carryover',
-            }
-            : null;
-        const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
-        const versionSurfaces = {
-            declared: versions.declared,
-            locked: versions.locked,
-            installed: versions.installed,
-            currentBranch: versions.currentBranch,
-            baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
-        };
-        const sourceVersion = versionSurfaces.declared;
-        const sourceBetaVersion = parseWorkflowBetaVersion(sourceVersion);
-        const targetBetaVersion = parseWorkflowBetaVersion(PACKAGE_VERSION);
-        const sourceIsEligibleBeta12 = sourceBetaVersion?.train === 12
-            && sourceBetaVersion.patch !== null
-            && sourceBetaVersion.patch >= 11;
-        const targetIsNewer = sourceBetaVersion !== null
-            && targetBetaVersion !== null
-            && (targetBetaVersion.train > sourceBetaVersion.train
-                || (targetBetaVersion.train === sourceBetaVersion.train
-                    && targetBetaVersion.patch !== null
-                    && sourceBetaVersion.patch !== null
-                    && targetBetaVersion.patch > sourceBetaVersion.patch));
-        const blockers = [
-            ...(assessments.length > 1 ? ['Exactly one failed Step may expose a Plan-integrity conflict.'] : []),
-            ...(assessment?.blockers ?? (adoptedCompatibility || dirtyCarryoverCompatibility
-                ? []
-                : (dirtyCarryoverAssessment?.blockers.length
-                    ? dirtyCarryoverAssessment.blockers
-                    : ['No eligible Plan-integrity conflict, post-rebind scope adoption, or dirty carryover was found.']))),
-            ...(!sourceIsEligibleBeta12 || !targetIsNewer
-                ? [`Declared Workflow source ${sourceVersion ?? 'missing'} must be an exact beta.12 patch at or after beta.12.11 and older than runner ${PACKAGE_VERSION}.`]
-                : []),
-            ...Object.entries(versionSurfaces)
-                .filter(([, version]) => version !== sourceVersion)
-                .map(([surface, version]) => `${surface} Workflow version ${version ?? 'missing'} must equal the declared source ${sourceVersion ?? 'missing'}.`),
-            ...(snapshot.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
-            ...observationPreflightBlockers(snapshot.observation),
-        ];
-        return {
-            readOnly: true,
-            eligible: Boolean(assessment?.eligible || adoptedCompatibility || dirtyCarryoverCompatibility) && blockers.length === 0,
-            action: (assessment?.eligible || adoptedCompatibility || dirtyCarryoverCompatibility) && blockers.length === 0
-                ? 'update plan-integrity-transport'
-                : null,
-            projectId: task.projectId,
-            taskId: task.id,
-            taskRevision: task.revision,
-            stepId: assessment?.stepId ?? adoptedCompatibility?.stepId ?? dirtyCarryoverCompatibility?.stepId ?? null,
-            sourceVersion,
-            targetVersion: PACKAGE_VERSION,
-            taskBranch: task.taskBranch,
-            baseBranch: task.baseBranch,
-            dirtyFiles: assessment?.evidence?.changedFiles
-                ?? adoptedCompatibility?.dirtyFiles
-                ?? dirtyCarryoverCompatibility?.dirtyFiles
-                ?? [],
-            conflictHash: assessment?.evidence?.conflictHash
-                ?? adoptedCompatibility?.conflictHash
-                ?? dirtyCarryoverCompatibility?.conflictHash
-                ?? null,
-            compatibilityMode: adoptedCompatibility?.mode
-                ?? dirtyCarryoverCompatibility?.mode
-                ?? 'failed-step-conflict',
-            requiredTransport: [
-                'Commit only package.json and package-lock.json on the active Milestone base.',
-                'Fast-forward or apply only that dependency commit to the Task branch while preserving all product bytes.',
-                'Install the exact target package, then follow fresh next to Plan-integrity dependency registration.',
-            ],
-            blockers,
-        };
-    }
-    planIntegrityDependencyRecoveryPreflight(repository, taskId) {
-        const snapshot = this.observationSnapshot(repository);
-        if (snapshot.observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity dependency recovery requires a coherent observation boundary.', {
-                observation: snapshot.observation,
-            });
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        if (!task)
-            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const assessmentBlockers = [];
-        const assessments = task.steps
-            .filter((step) => step.status === 'failed')
-            .flatMap((step) => {
-            try {
-                return [assessPlanIntegrityRecovery(this.store, snapshot.identity.repositoryRoot, task, step.id)];
-            }
-            catch (error) {
-                if (error instanceof WorkflowError && error.code === 'STATE_CORRUPT') {
-                    assessmentBlockers.push(`Plan-integrity compatibility cannot be assessed until the existing remediation history is repaired: ${error.message}`);
-                    return [];
-                }
-                throw error;
-            }
-        })
-            .filter((assessment) => assessment.applicable && assessment.eligible && assessment.evidence);
-        const assessment = assessments.length === 1 ? assessments[0] : null;
-        const adoptedCompatibility = assessment?.evidence
-            ? null
-            : this.postRebindCheckSupportCompatibility(snapshot, task);
-        const dirtyCarryoverCompatibility = assessment?.evidence || adoptedCompatibility
-            ? null
-            : this.carriedPostRebindCheckSupportDirtyCarryover(snapshot, task);
-        const carriedCompatibility = !assessment?.evidence && task.planHash
-            ? this.carriedPlanIntegrityUpdateCompatibility(snapshot, task)
-            : null;
-        if ((!assessment?.evidence
-            && !carriedCompatibility
-            && !adoptedCompatibility
-            && !dirtyCarryoverCompatibility) || !task.planHash) {
-            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
-            return {
-                ...ordinary,
-                eligible: false,
-                action: null,
-                planIntegrity: null,
-                blockers: [...new Set([
-                        ...ordinary.blockers,
-                        ...assessmentBlockers,
-                        'The dependency candidate must preserve one exact eligible Plan-integrity conflict.',
-                    ])],
-            };
-        }
-        const compatibility = carriedCompatibility
-            ?? adoptedCompatibility
-            ?? dirtyCarryoverCompatibility
-            ?? {
-                stepId: assessment.stepId,
-                planHash: task.planHash,
-                conflictHash: assessment.evidence.conflictHash,
-                dirtyFiles: [...assessment.evidence.changedFiles],
-                dirtyWorktreeHash: hashDirtyWorktree(snapshot.identity.repositoryRoot, assessment.evidence.changedFiles),
-                remediationEventIds: assessment.evidence.kind === 'missing-npm-script-outside-allowed-writes'
-                    ? [assessment.evidence.remediationEventId]
-                    : assessment.evidence.remediationEvents.map((event) => event.eventId),
-            };
-        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, null, null, compatibility);
-    }
-    downstreamProofReplanDependencyRecoveryPreflight(repository, taskId) {
-        const snapshot = this.observationSnapshot(repository);
-        if (snapshot.observation.kind !== 'assessment') {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Downstream-proof replan dependency recovery requires a coherent observation boundary.', {
-                observation: snapshot.observation,
-            });
-        }
-        const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
-        if (!task)
-            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        let candidateParent = null;
-        try {
-            candidateParent = runGit(snapshot.identity.repositoryRoot, ['rev-parse', 'HEAD^']);
-        }
-        catch {
-            candidateParent = null;
-        }
-        const currentPlanRiskAuditExists = readPlanRiskAuditEvents(this.store, task).some((event) => event.taskRevision === task.revision && event.planHash === task.planHash);
-        const assessment = candidateParent
-            ? assessDownstreamProofReplanRecovery(this.store, snapshot.identity.repositoryRoot, task, {
-                historyBoundary: 'HEAD^',
-                preservedHeadCommit: candidateParent,
-                currentPlanRiskAuditExists,
-            })
-            : null;
-        if (!assessment?.applicable || !assessment.eligible || !assessment.compatibility) {
-            const ordinary = this.inspectDependencyProvenanceCandidate(snapshot, task);
-            return {
-                ...ordinary,
-                eligible: false,
-                action: null,
-                activeDownstreamProof: null,
-                downstreamProofReplan: null,
-                blockers: [...new Set([
-                        ...ordinary.blockers,
-                        ...(assessment?.blockers ?? []),
-                        'The Task must preserve the exact beta.12.6 downstream-proof invalidation and accidental knowledge-rebind boundary.',
-                    ])],
-            };
-        }
-        return this.inspectDependencyProvenanceCandidate(snapshot, task, null, assessment.compatibility);
-    }
     recoverDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, false);
     }
     recoverActiveDownstreamProofDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, true);
     }
-    recoverDownstreamProofReplanDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
-        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'downstream-replan');
-    }
     recoverHistoricalStepDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
         return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'historical-step');
     }
-    recoverPlanIntegrityDependencyProvenance(repository, taskId, expectedRevision, actor, reason) {
-        return this.recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, 'plan-integrity');
-    }
     recoverDependencyProvenanceCandidate(repository, taskId, expectedRevision, actor, reason, recoveryMode) {
         const normalizedActor = actor.trim();
         const normalizedReason = reason.trim();
@@ -5015,15 +4467,9 @@ export class WorkflowService {
         const currentHead = headCommit(context.identity.repositoryRoot);
         const prior = current.dependencyProvenanceRecoveries?.find((record) => record.commitSha === currentHead
             && record.packageVersion === PACKAGE_VERSION
-            && (recoveryMode === 'downstream-replan'
-                ? Boolean(record.downstreamProofReplan)
-                : recoveryMode === 'historical-step'
-                    ? Boolean(record.historicalStepProvenance)
-                    : recoveryMode === 'plan-integrity'
-                        ? Boolean(record.planIntegrity)
-                        : recoveryMode === false && record.rootCauseReplan
-                            ? true
-                            : Boolean(record.activeDownstreamProof) === recoveryMode));
+            && (recoveryMode === 'historical-step'
+                ? Boolean(record.historicalStepProvenance)
+                : Boolean(record.activeDownstreamProof) === recoveryMode));
         if (prior && current.systemCommits.includes(currentHead))
             return current;
         assertExpectedRevision(current, expectedRevision);
@@ -5031,34 +4477,17 @@ export class WorkflowService {
         const task = snapshot.tasks.find((candidate) => candidate.id === taskId);
         if (!task)
             throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
-        const preflight = recoveryMode === 'downstream-replan'
-            ? this.downstreamProofReplanDependencyRecoveryPreflight(repository, taskId)
-            : recoveryMode === 'historical-step'
-                ? this.historicalStepDependencyRecoveryPreflight(repository, taskId)
-                : recoveryMode === 'plan-integrity'
-                    ? this.planIntegrityDependencyRecoveryPreflight(repository, taskId)
-                    : recoveryMode
-                        ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
-                        : this.dependencyProvenanceRecoveryPreflight(repository, taskId);
+        const preflight = recoveryMode === 'historical-step'
+            ? this.historicalStepDependencyRecoveryPreflight(repository, taskId)
+            : recoveryMode
+                ? this.activeDownstreamProofDependencyRecoveryPreflight(repository, taskId)
+                : this.dependencyProvenanceRecoveryPreflight(repository, taskId);
         if (!preflight.eligible || !preflight.commitSha || !preflight.parentCommitSha) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', 'The bounded dependency provenance recovery preflight failed.', {
                 taskId,
                 blockers: preflight.blockers,
             });
         }
-        if (preflight.rootCauseReplan) {
-            const posture = readTaskC1Posture(this.store, task);
-            if (posture.state !== 'claimed'
-                || posture.claimant !== preflight.rootCauseReplan.claimant
-                || normalizedActor !== posture.claimant) {
-                throw new WorkflowError('TRANSITION_BLOCKED', 'Corrective carryover dependency recovery requires the exact retained C1 claimant actor.', {
-                    taskId,
-                    actor: normalizedActor,
-                    requiredActor: preflight.rootCauseReplan.claimant,
-                    posture: posture.state,
-                });
-            }
-        }
         const now = this.now();
         const recoveredRecords = preflight.dependencyCommits.map((dependencyCommit, index) => {
             const isTerminalCommit = index === preflight.dependencyCommits.length - 1;
@@ -5075,18 +4504,9 @@ export class WorkflowService {
                 ...(isTerminalCommit && preflight.activeDownstreamProof
                     ? { activeDownstreamProof: preflight.activeDownstreamProof }
                     : {}),
-                ...(isTerminalCommit && preflight.downstreamProofReplan
-                    ? { downstreamProofReplan: preflight.downstreamProofReplan }
-                    : {}),
                 ...(isTerminalCommit && preflight.historicalStepProvenance
                     ? { historicalStepProvenance: preflight.historicalStepProvenance }
                     : {}),
-                ...(isTerminalCommit && preflight.planIntegrity
-                    ? { planIntegrity: preflight.planIntegrity }
-                    : {}),
-                ...(isTerminalCommit && preflight.rootCauseReplan
-                    ? { rootCauseReplan: preflight.rootCauseReplan }
-                    : {}),
             };
         });
         const nextTask = {
@@ -5102,62 +4522,7 @@ export class WorkflowService {
                 ...recoveredRecords,
             ],
         };
-        if (recoveryMode !== 'plan-integrity' || !preflight.planIntegrity) {
-            return context.store.writeTask({ ...nextTask, revision: task.revision }, expectedRevision);
-        }
-        const currentKnowledgeMap = this.store.readKnowledgeMap(task.projectId);
-        const scannedKnowledgeMap = scanProjectKnowledge(context.identity.repositoryRoot, task.projectId, now);
-        const inspectedKnowledgeMap = inspectKnowledgeMap(currentKnowledgeMap, scannedKnowledgeMap);
-        let refreshedKnowledgeMap = null;
-        if (inspectedKnowledgeMap.status !== 'active' || !inspectedKnowledgeMap.approval) {
-            const knowledgeRefresh = inspectDependencyKnowledgeRefresh(context.identity.repositoryRoot, task.baseBranch, currentKnowledgeMap, inspectedKnowledgeMap, preflight.planIntegrity.dirtyFiles);
-            if (!knowledgeRefresh.eligible) {
-                throw new WorkflowError('TRANSITION_BLOCKED', 'Plan-integrity dependency recovery cannot bypass unrelated Project Knowledge drift.', {
-                    taskId,
-                    dependencyKnowledgeRefresh: knowledgeRefresh,
-                });
-            }
-            const reconciled = reconcileKnowledgeMap(currentKnowledgeMap, scannedKnowledgeMap);
-            const approved = applyKnowledgeSelections(reconciled, [], normalizedActor, now);
-            if (!approved.approval) {
-                throw new WorkflowError('STATE_CORRUPT', 'Plan-integrity dependency Knowledge refresh produced no approval evidence.');
-            }
-            refreshedKnowledgeMap = {
-                ...approved,
-                revision: currentKnowledgeMap.revision + 2,
-                createdAt: currentKnowledgeMap.createdAt,
-                updatedAt: now.toISOString(),
-                approval: { ...approved.approval, authorizationMode: 'corrective-derived' },
-            };
-        }
-        const projectRoot = this.store.projectRoot(task.projectId);
-        const relative = (absolute) => path.relative(projectRoot, absolute).split(path.sep).join('/');
-        applyProjectTransaction({
-            projectRoot,
-            projectId: task.projectId,
-            transactionId: `tx-${createEntityId('TASK', now.getTime()).toLowerCase()}`,
-            kind: 'plan-integrity-dependency-recovery',
-            now,
-            targets: [
-                ...(refreshedKnowledgeMap
-                    ? [{ path: relative(path.join(projectRoot, 'knowledge-map.json')), content: `${JSON.stringify(refreshedKnowledgeMap, null, 2)}\n` }]
-                    : []),
-                {
-                    path: relative(path.join(this.store.taskRoot(task.projectId, task.id), 'state.json')),
-                    content: `${JSON.stringify(nextTask, null, 2)}\n`,
-                },
-            ],
-            validate: () => {
-                const saved = this.store.readTask(task.projectId, task.id);
-                if (saved.revision !== nextTask.revision || saved.systemCommits.at(-1) !== preflight.commitSha) {
-                    throw new WorkflowError('STATE_CORRUPT', 'Plan-integrity dependency recovery Task readback failed.', { taskId });
-                }
-                if (refreshedKnowledgeMap && this.store.readKnowledgeMap(task.projectId).revision !== refreshedKnowledgeMap.revision) {
-                    throw new WorkflowError('STATE_CORRUPT', 'Plan-integrity dependency Knowledge refresh readback failed.', { taskId });
-                }
-            },
-        });
-        return this.store.readTask(task.projectId, task.id);
+        return context.store.writeTask({ ...nextTask, revision: task.revision }, expectedRevision);
     }
     milestoneProgress(repository, milestoneId) {
         const snapshot = this.observationSnapshot(repository);
@@ -5225,109 +4590,6 @@ export class WorkflowService {
             tasks,
         };
     }
-    alpha6StrictReviewRescuePreflight(repository) {
-        const context = this.#mutationContext(repository);
-        const dependency = inspectLocalDependency(context.identity.repositoryRoot);
-        const tasks = context.store.listTasks(context.identity.projectId);
-        const leases = context.locks.list();
-        const now = this.now().getTime();
-        const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
-        const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
-        const dirty = changedFiles(context.identity.repositoryRoot);
-        const currentHead = headCommit(context.identity.repositoryRoot);
-        const pendingCandidates = [];
-        const malformedCandidates = [];
-        for (const task of tasks) {
-            if (task.status !== 'in_progress')
-                continue;
-            const planRiskAudit = task.planHash ? readCurrentPlanRiskAudit(this.store, task) : null;
-            if (!planRiskAudit)
-                continue;
-            for (const step of task.steps) {
-                if (step.status !== 'in_progress' || !step.evidence)
-                    continue;
-                if (!isStepReviewRequired(task, step.id, planRiskAudit.reviewRequiredStepIds))
-                    continue;
-                try {
-                    const cycle = buildCurrentStrictStepReviewCycle(this.store, task, step.id);
-                    if (cycle.resolution !== 'pending')
-                        continue;
-                    validateTaskHistory(context.identity.repositoryRoot, task);
-                    let knowledgeBindingStale = false;
-                    try {
-                        const storedKnowledgeMap = this.store.readKnowledgeMap(context.identity.projectId);
-                        const knowledgeMap = inspectKnowledgeMap(storedKnowledgeMap, scanProjectKnowledge(context.identity.repositoryRoot, context.identity.projectId, this.now()));
-                        knowledgeBindingStale = knowledgeMap.status !== 'active'
-                            || task.knowledgeMapRevision !== knowledgeMap.revision
-                            || task.knowledgeMapHash !== hashKnowledgeMap(knowledgeMap);
-                    }
-                    catch {
-                        knowledgeBindingStale = true;
-                    }
-                    pendingCandidates.push({
-                        taskId: task.id,
-                        taskRevision: task.revision,
-                        stepId: step.id,
-                        completionCommit: step.evidence.commitSha,
-                        currentHead,
-                        knowledgeBindingStale,
-                    });
-                }
-                catch (error) {
-                    malformedCandidates.push(error instanceof Error ? error.message : String(error));
-                }
-            }
-        }
-        const candidate = pendingCandidates.length === 1 ? pendingCandidates[0] : null;
-        const candidateLeaseIds = new Set(candidate ? [candidate.taskId] : []);
-        const blockers = [
-            ...(dependency.declared !== '2.0.0-alpha.6'
-                ? ['Project package.json must declare codex-workflow-v2 exactly at 2.0.0-alpha.6.']
-                : []),
-            ...(dirty.length > 0 ? ['Repository checkout is not clean.'] : []),
-            ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
-            ...(pendingCandidates.length !== 1
-                ? [`Expected exactly one pending alpha.6 strict review; found ${pendingCandidates.length}.`]
-                : []),
-            ...(candidate && candidate.currentHead !== candidate.completionCommit
-                ? ['HEAD does not match the pending strict review completion commit.']
-                : []),
-            ...(staleLeases.some((lease) => !candidateLeaseIds.has(lease.entityId))
-                ? ['A stale writer lease exists outside the rescue Task.']
-                : []),
-            ...malformedCandidates.map((message) => `Pending strict review state is invalid: ${message}`),
-        ];
-        const eligible = blockers.length === 0 && candidate !== null;
-        const requiredActions = eligible
-            ? [
-                ...staleLeases.map((lease) => ({
-                    action: 'locks repair',
-                    entityId: lease.entityId,
-                })),
-                {
-                    action: 'task step-review',
-                    taskId: candidate.taskId,
-                    stepId: candidate.stepId,
-                    expectedRevision: candidate.taskRevision,
-                },
-            ]
-            : [];
-        return {
-            eligible,
-            mutationFree: true,
-            runnerPackageVersion: PACKAGE_VERSION,
-            requiredProjectPackageVersion: '2.0.0-alpha.6',
-            declaredProjectPackageVersion: dependency.declared,
-            projectId: context.identity.projectId,
-            repositoryRoot: context.identity.repositoryRoot,
-            clean: dirty.length === 0,
-            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
-            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
-            candidate,
-            blockers,
-            requiredActions,
-        };
-    }
     scanKnowledgeMap(repository) {
         const { identity } = this.#mutationContext(repository);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
@@ -5379,7 +4641,7 @@ export class WorkflowService {
         if (!allowAtomicTaskRefresh && current.status === 'active' && current.approval) {
             const milestonesById = new Map(this.listMilestonesCurrent(identity.projectId).map((milestone) => [milestone.id, milestone]));
             const inspected = inspectKnowledgeMap(current, scanned);
-            const refreshOwner = this.findDelegatedContextRefreshOwner(identity.projectId, this.store.listTasks(identity.projectId), milestonesById, current, inspected);
+            const refreshOwner = this.findDelegatedContextRefreshOwner(identity.projectId, this.store.listTasks(identity.projectId), milestonesById, current, inspected, identity.repositoryRoot);
             if (refreshOwner) {
                 throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
                     taskId: refreshOwner.task.id,
@@ -5394,10 +4656,13 @@ export class WorkflowService {
         return createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
     }
     graphStatus(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.#mutationContext(repository);
+        // Graph diagnostics must not register a virgin project or implicitly recover journals.
+        // Surface the same structural boundary as status/next without loading or mutating Tasks.
+        const identity = resolveRepositoryIdentity(repository);
+        const { observation } = inspectWorkflowObservationBoundary({ store: this.store, identity, now: this.now() });
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const binding = this.readGraphBindingOrNull(identity.projectId, graphKind);
-        return { request, binding: binding ? inspectGraphBinding(binding, request) : null };
+        return { request, binding: binding ? inspectGraphBinding(binding, request) : null, observation };
     }
     bindGraph(repository, expectedRevision, request, evidence) {
         const { identity } = this.#mutationContext(repository);
@@ -5426,10 +4691,25 @@ export class WorkflowService {
         return explainChange(input, repository, effectiveTask, navigation);
     }
     next(repository, taskId = null) {
-        return withObservedRouteMetadata(this.nextFromStatus(repository, taskId, this.statusFromSnapshot(this.observationSnapshot(repository))));
+        return withWorkflowBlockerRoute(withObservedRouteMetadata(this.nextFromStatus(repository, taskId, this.statusFromSnapshot(this.observationSnapshot(repository)))), PACKAGE_VERSION);
     }
     nextFromStatus(repository, taskId, status) {
         if (status.observation.kind === 'blocked') {
+            // Observation stays write-free. Only an absent or proven virgin registration
+            // may resume initialization; retained or unknown state remains blocked.
+            if (taskId === null && status.observation.missingRegistration
+                && isVirginRegistrationRoot(this.store.projectRoot(status.projectId), this.store.root, resolveRepositoryIdentity(repository), PACKAGE_VERSION)
+                && status.observation.reasonCodes.every(code => code === 'PROJECT_REGISTRATION_MISSING' || code === 'ADOPTION_MISSING')) {
+                return {
+                    scope: 'project', projectId: status.projectId,
+                    status: 'initialization-required', action: 'project-memory scan',
+                    observation: status.observation,
+                    navigation: {
+                        kind: 'executable', command: 'project-memory scan', cataloged: false,
+                        bindings: { projectId: status.projectId },
+                    },
+                };
+            }
             return {
                 scope: 'project',
                 projectId: status.projectId,
@@ -5437,7 +4717,16 @@ export class WorkflowService {
                 action: 'blocked',
                 observation: status.observation,
                 navigation: {
-                    kind: 'blocked',
+                    kind: status.observation.pendingProjectTransactions.some(transaction => transaction.ownerActive)
+                        || status.observation.reasonCodes.includes('TASK_OPERATION_IN_PROGRESS') ? 'wait' : 'blocked',
+                    ...(status.observation.pendingProjectTransactions.some(transaction => transaction.ownerActive) ? {
+                        reason: 'project-transaction-in-progress',
+                        waitFor: 'The current transaction owner must finish or exit before recovery; obtain fresh status and next afterward.',
+                    } : status.observation.reasonCodes.includes('TASK_OPERATION_IN_PROGRESS') ? {
+                        reason: 'core-operation-in-progress',
+                        waitFor: 'The active Core operation must finish or its lease expire; obtain fresh status and next afterward.',
+                        operations: status.observation.coreTaskOperations,
+                    } : {}),
                     reasonCodes: status.observation.reasonCodes,
                     availableRepairTransitionId: null,
                 },
@@ -5505,7 +4794,18 @@ export class WorkflowService {
             currentEventType: status.adoption.currentPosture?.eventType ?? null,
         };
         if (status.adoption.status !== 'applied') {
+            const adoptionApprovals = this.listDelegations(status.projectId).flatMap(grant => {
+                try {
+                    return [assertDelegationCanAuthorize(grant, 'project.adopt', grant.delegate, { kind: 'project', id: status.projectId }, this.now())];
+                }
+                catch (error) {
+                    if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                        return [];
+                    throw error;
+                }
+            });
             return {
+                ...(adoptionApprovals.length ? { delegatedApprovalOptions: adoptionApprovals } : {}),
                 scope: 'project',
                 projectId: status.projectId,
                 status: status.adoption.status,
@@ -5514,7 +4814,7 @@ export class WorkflowService {
                 observation: status.observation,
                 navigation: status.adoption.safe
                     ? {
-                        kind: 'human-gate',
+                        kind: adoptionApprovals.length ? 'delegated' : 'human-gate',
                         transitionId: null,
                         cataloged: false,
                         command: 'state adoption-apply',
@@ -5536,6 +4836,49 @@ export class WorkflowService {
         }
         const withAdoption = (value) => ({
             ...value,
+            delegatedMilestoneAutonomyOptions: status.milestones.flatMap(milestone => {
+                if (!['active', 'awaiting_execution_authorization'].includes(milestone.status) || !milestone.planHash)
+                    return [];
+                const previousContract = readMilestoneAutonomyEvents(this.store, status.projectId, milestone.id).at(-1);
+                if (previousContract) {
+                    if (previousContract.semanticScopeHash !== milestoneSemanticScopeHash(milestone))
+                        return [];
+                    try {
+                        const previousGrant = this.store.readDelegation(status.projectId, previousContract.delegationGrantId);
+                        if (previousGrant.status === 'active' && Date.parse(previousGrant.expiresAt) > this.now().getTime())
+                            return [];
+                    }
+                    catch (error) {
+                        if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                            throw error;
+                    }
+                }
+                try {
+                    this.requireActiveKnowledgeMap(repository, status.projectId);
+                }
+                catch (error) {
+                    if (error instanceof WorkflowError)
+                        return [];
+                    throw error;
+                }
+                return this.listDelegations(status.projectId).flatMap(grant => {
+                    if (grant.scope.kind !== 'milestone' || grant.scope.id !== milestone.id
+                        || !['task.execution_authorize', 'task.final_accept', 'milestone.execution_authorize', 'milestone.final_accept']
+                            .every(transition => grant.transitions.some(value => value === transition)))
+                        return [];
+                    try {
+                        assertDelegationCanAuthorize(grant, 'milestone.execution_authorize', grant.delegate, milestone, this.now());
+                        return [{ action: 'milestone autonomy-bind', milestoneId: milestone.id,
+                                expectedRevision: milestone.revision, actor: grant.delegate, delegationGrantId: grant.id,
+                                issuesGrant: false, requiresExactHumanConfirmation: false }];
+                    }
+                    catch (error) {
+                        if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                            return [];
+                        throw error;
+                    }
+                });
+            }),
             ...(status.milestones.some((milestone) => milestone.status === 'active' && milestone.planHash)
                 ? { activeMilestoneAutonomyOptions: status.milestones
                         .filter((milestone) => milestone.status === 'active' && milestone.planHash)
@@ -5574,6 +4917,46 @@ export class WorkflowService {
         const inspectCurrentKnowledgeMap = () => inspectKnowledgeMap(this.store.readKnowledgeMap(status.projectId), scanProjectKnowledge(repositoryRoot, status.projectId, this.now()));
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
         const tasksById = new Map(status.tasks.map((task) => [task.id, task]));
+        const incompleteScope = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status)
+            && (taskId === null || tasksById.get(taskId)?.milestoneId === milestone.id)
+            && !assessMilestoneInitialAssembly({ store: this.store, projectId: status.projectId, milestone,
+                listTasks: () => status.tasks }).eligible
+            && assessMilestoneScopeCompletion(milestone, status.tasks).length > 0);
+        if (incompleteScope) {
+            const lease = this.inspectWriterLease(repositoryRoot, incompleteScope.id);
+            if (lease)
+                return withAdoption({ scope: 'milestone', id: incompleteScope.id, entityId: incompleteScope.id,
+                    revision: incompleteScope.revision, action: lease.stale ? 'locks repair' : 'blocked', lease,
+                    navigation: { kind: lease.stale ? 'repair' : 'wait', reason: 'milestone-authority-lease' } });
+            if (incompleteScope.status === 'awaiting_final_acceptance')
+                return withAdoption({
+                    scope: 'milestone', id: incompleteScope.id, revision: incompleteScope.revision, action: 'blocked',
+                    navigation: { kind: 'blocked', reason: 'retained-final-scope-gap' },
+                    reason: 'Retained final acceptance state contains unclassified linked Tasks; no safe scope transition is available.',
+                    scopeCompletion: { orphanTaskIds: assessMilestoneScopeCompletion(incompleteScope, status.tasks), executionAvailable: false },
+                });
+            const event = readMilestoneAutonomyEvents(this.store, status.projectId, incompleteScope.id).at(-1);
+            let autonomous = null;
+            if (event) {
+                try {
+                    const authority = requireActiveMilestoneAutonomy({ store: this.store, projectId: status.projectId,
+                        milestone: incompleteScope, actor: event.delegate, now: this.now() });
+                    autonomous = { actor: event.delegate, grantId: authority.grant.id };
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError) || !['TRANSITION_BLOCKED', 'NOT_FOUND'].includes(error.code))
+                        throw error;
+                }
+            }
+            return withAdoption({ scope: 'milestone', id: incompleteScope.id, status: incompleteScope.status,
+                revision: incompleteScope.revision, action: autonomous ? 'milestone autonomy-evolve' : 'milestone scope-change-prepare',
+                scopeCompletion: { orphanTaskIds: assessMilestoneScopeCompletion(incompleteScope, status.tasks),
+                    requiresCandidatePlan: true, executionAvailable: false, preservesExistingScopeAndDependencies: true },
+                ...(autonomous ? { autonomy: autonomous } : { scopeChangeBoundary: { state: 'human-decision-required',
+                        requiresCandidatePlan: true, prepareAction: 'milestone scope-change-prepare', applyAction: 'milestone scope-change-apply',
+                        requiresExplicitHumanConfirmation: true, confirmationCodeSource: 'scope-change-prepare-result',
+                        afterPreparation: 'await-human-confirmation-before-apply', applyRequiresSamePlanAndActor: true } }) });
+        }
         const requestedTask = taskId === null
             ? null
             : status.tasks.find((task) => task.id === taskId) ?? null;
@@ -5615,23 +4998,27 @@ export class WorkflowService {
                 ? [task]
                 : [];
         }).at(0) ?? null;
+        let prioritizedRefreshTask = null;
+        if (!requestedTask) {
+            let approved = null;
+            try {
+                approved = this.store.readKnowledgeMap(status.projectId);
+            }
+            catch (error) {
+                if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                    throw error;
+            }
+            if (approved?.status === 'active' && approved.approval) {
+                const inspected = inspectCurrentKnowledgeMap();
+                if (inspected.status === 'stale')
+                    prioritizedRefreshTask = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, approved, inspected, repositoryRoot)?.task ?? null;
+            }
+        }
         const activeTask = requestedTask
+            ?? prioritizedRefreshTask
             ?? prioritizedRemediationTask
             ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById, tasksById));
         if (activeTask) {
-            let pendingReviewDependencyRecovery = null;
-            try {
-                const reconstructed = pendingReviewSourceBinding(repositoryRoot, this.store, activeTask, runGit(repositoryRoot, ['rev-parse', 'HEAD^']), runGit(repositoryRoot, ['rev-parse', `${activeTask.baseBranch}^`]));
-                pendingReviewDependencyRecovery = this.pendingReviewDependencyPreflight(repositoryRoot, activeTask.id, reconstructed);
-            }
-            catch { /* A nonmatching shape follows ordinary navigation without a compatibility bypass. */ }
-            if (pendingReviewDependencyRecovery?.eligible) {
-                return withAdoption({ scope: 'task', id: activeTask.id, status: activeTask.status,
-                    action: 'update pending-review-dependency-recover', revision: activeTask.revision,
-                    pendingReviewDependencyRecovery,
-                    sourceReceiptRequired: true,
-                });
-            }
             const historicalStepProvenanceRecovery = this.historicalStepProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (historicalStepProvenanceRecovery.eligible) {
                 return withAdoption({
@@ -5659,22 +5046,6 @@ export class WorkflowService {
                     },
                 });
             }
-            const planIntegrityDependencyRecovery = this.planIntegrityDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
-            if (planIntegrityDependencyRecovery.eligible) {
-                return withAdoption({
-                    scope: 'task',
-                    id: activeTask.id,
-                    status: activeTask.status,
-                    action: 'update plan-integrity-dependency-recover',
-                    revision: activeTask.revision,
-                    dependencyProvenanceRecovery: planIntegrityDependencyRecovery,
-                    compatibilityBoundary: {
-                        preservesWorktree: true,
-                        prerequisite: 'A newer package preflight approved the exact failed Step, remediation history, and dirty allowlist before dependency-only transport.',
-                        continuation: 'Register this dependency commit, then follow fresh next to Plan-integrity recovery and corrective replan.',
-                    },
-                });
-            }
             const dependencyRecovery = this.dependencyProvenanceRecoveryPreflight(repositoryRoot, activeTask.id);
             if (dependencyRecovery.eligible) {
                 return withAdoption({
@@ -5686,6 +5057,29 @@ export class WorkflowService {
                     dependencyProvenanceRecovery: dependencyRecovery,
                 });
             }
+            if (PACKAGE_VERSION === FAILED_CHECKPOINT_TARGET && activeTask.status === 'awaiting_execution_authorization'
+                && activeTask.workspaceOwner === 'external' && activeTask.steps.some(step => step.status === 'failed')) {
+                const transport = inspectBoundedWorkflowDependencyCommit(repositoryRoot, headCommit(repositoryRoot));
+                if (transport?.packageVersion === FAILED_CHECKPOINT_TARGET && !activeTask.systemCommits.includes(transport.commitSha)) {
+                    return withAdoption({ scope: 'task', id: activeTask.id, revision: activeTask.revision,
+                        action: 'update failed-checkpoint-transport-preflight',
+                        requiredInputs: ['--tarball <exact target artifact>', '--file <source receipt>'],
+                        reason: 'Verify the original failed-checkpoint receipt, native failure and retained product bytes before registering the dependency transport.',
+                    });
+                }
+            }
+            const navigationSourceHead = activeTask.authorizations.filter(item => item.kind === 'execution' && item.decision === 'approved').at(-1)?.headCommit;
+            if (activeTask.status === 'ready' && navigationSourceHead
+                && activeTask.dependencyProvenanceRecoveries?.some(item => item.planIntegrity?.mode === 'navigation-fix-dirty-carryover')) {
+                const transport = inspectBoundedWorkflowDependencyCommit(repositoryRoot, headCommit(repositoryRoot));
+                if (transport?.packageVersion === PACKAGE_VERSION && transport.parentCommitSha === navigationSourceHead) {
+                    return withAdoption({ scope: 'task', id: activeTask.id, revision: activeTask.revision,
+                        action: 'update navigation-transport-preflight',
+                        requiredInputs: ['--tarball <exact target artifact>', '--file <source receipt>'],
+                        reason: 'Verify the preserved source receipt before registering navigation dependency transport. Missing evidence blocks recovery.',
+                    });
+                }
+            }
             const activeDownstreamProofDependencyRecovery = this.activeDownstreamProofDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
             if (activeDownstreamProofDependencyRecovery.eligible) {
                 return withAdoption({
@@ -5702,22 +5096,6 @@ export class WorkflowService {
                     },
                 });
             }
-            const downstreamProofReplanDependencyRecovery = this.downstreamProofReplanDependencyRecoveryPreflight(repositoryRoot, activeTask.id);
-            if (downstreamProofReplanDependencyRecovery.eligible) {
-                return withAdoption({
-                    scope: 'task',
-                    id: activeTask.id,
-                    status: activeTask.status,
-                    action: 'update downstream-proof-replan-dependency-recover',
-                    revision: activeTask.revision,
-                    dependencyProvenanceRecovery: downstreamProofReplanDependencyRecovery,
-                    compatibilityBoundary: {
-                        preservesWorktree: true,
-                        prerequisite: 'A newer package preflight approved the exact beta.12.6 stranded replan transport before dependency-only commits were created.',
-                        continuation: 'Register this dependency commit, then run task downstream-proof-replan-recover.',
-                    },
-                });
-            }
             const activeTaskMilestone = activeTask.milestoneId
                 ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
@@ -5741,54 +5119,6 @@ export class WorkflowService {
                     },
                 }
                 : value);
-            const currentPlanRiskAuditExists = activeTask.planHash
-                ? readPlanRiskAuditEvents(this.store, activeTask).some((event) => event.taskRevision === activeTask.revision && event.planHash === activeTask.planHash)
-                : false;
-            const downstreamReplanRecovery = assessDownstreamProofReplanRecovery(this.store, repositoryRoot, activeTask, { currentPlanRiskAuditExists });
-            if (downstreamReplanRecovery.applicable) {
-                const environmentBlockers = [
-                    ...(!downstreamReplanRecovery.dependencyRecoveryCommit
-                        ? ['The exact beta.12.7 dependency compatibility must be registered before Task recovery.']
-                        : []),
-                    ...(status.observation.leases.length > 0 ? ['No active or stale Task writer lease may exist.'] : []),
-                    ...(status.observation.pendingProjectTransactions.length > 0
-                        || status.observation.pendingMilestoneTransactions.length > 0
-                        || status.observation.pendingTaskTransactions.length > 0
-                        ? ['No pending Workflow transaction may exist.'] : []),
-                    ...(status.observation.corruptTaskTransactions.length > 0 ? ['No corrupt Task transaction may exist.'] : []),
-                    ...(status.observation.coreTaskOperations.length > 0 ? ['No Core Task operation may exist.'] : []),
-                ];
-                return withAdoption(withMilestoneCancellation(downstreamReplanRecovery.eligible && environmentBlockers.length === 0
-                    ? {
-                        scope: 'task',
-                        id: activeTask.id,
-                        status: activeTask.status,
-                        action: 'task downstream-proof-replan-recover',
-                        revision: activeTask.revision,
-                        downstreamProofReplanRecovery: {
-                            state: 'eligible',
-                            invalidationEventId: downstreamReplanRecovery.invalidation.eventId,
-                            sourcePlanHash: downstreamReplanRecovery.invalidation.planHash,
-                            reboundPlanHash: activeTask.planHash,
-                            dirtyFiles: downstreamReplanRecovery.compatibility.dirtyFiles,
-                            dirtyWorktreeHash: downstreamReplanRecovery.compatibility.dirtyWorktreeHash,
-                            dependencyRecoveryCommit: downstreamReplanRecovery.dependencyRecoveryCommit,
-                            boundedEffect: 'restore-needs-fix-and-return-same-task-to-plan-set',
-                        },
-                    }
-                    : {
-                        scope: 'task',
-                        id: activeTask.id,
-                        status: activeTask.status,
-                        action: 'doctor',
-                        blockedAction: 'task downstream-proof-replan-recover',
-                        revision: activeTask.revision,
-                        downstreamProofReplanRecovery: {
-                            state: 'blocked',
-                            blockers: [...downstreamReplanRecovery.blockers, ...environmentBlockers],
-                        },
-                    }));
-            }
             let activePlanRiskAudit = null;
             let planRiskAuditRecovery = null;
             const requiresReplacementPlan = activeTask.status === 'needs_fix'
@@ -6004,9 +5334,8 @@ export class WorkflowService {
             if (taskNext?.action === 'task step-complete'
                 || taskNext?.action === 'task step-review'
                 || taskNext?.action === 'task downstream-proof-recover'
-                || taskNext?.action === 'task remediation-mode-recover'
                 || (taskNext?.action === 'task writer-credential-replace'
-                    && ['task step-complete', 'task step-review', 'task remediation-mode-recover'].includes(String(taskNext?.blockedAction)))
+                    && ['task step-complete', 'task step-review'].includes(String(taskNext?.blockedAction)))
                 || taskNext?.action === 'task plan-integrity-recover'
                 || taskNext?.blockedAction === 'task plan-integrity-recover'
                 || taskNext?.action === 'task corrective-yield'
@@ -6052,10 +5381,10 @@ export class WorkflowService {
                 const contextRefreshOptions = action === 'project-memory reconcile'
                     && (taskNext?.action !== 'task plan-set' || rollingRootCausePlanSet)
                     && refreshAssessment?.eligible
-                    ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
+                    ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode, repositoryRoot)
                     : [];
                 if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
-                    const refreshOwner = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, storedKnowledgeMap, knowledgeMap);
+                    const refreshOwner = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, storedKnowledgeMap, knowledgeMap, repositoryRoot);
                     if (refreshOwner && refreshOwner.task.id !== requestedTask.id) {
                         throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} cannot be selected while Task ${refreshOwner.task.id} requires an atomic context refresh.`, {
                             taskId: requestedTask.id,
@@ -6082,6 +5411,7 @@ export class WorkflowService {
                             contextRefresh: {
                                 action: 'task context-refresh',
                                 mode: refreshAssessment.mode,
+                                authority: (this.registeredPlanningContextTransport(activeTask, repositoryRoot) || readFailedStepPlanningRecovery(this.store, activeTask)) ? 'planning-only' : 'execution',
                                 addedSources: refreshAssessment.addedSources,
                                 options: contextRefreshOptions,
                             },
@@ -6186,6 +5516,24 @@ export class WorkflowService {
                     milestoneInitialAssembly: initialAssembly,
                 });
             }
+            // Only this Milestone's authority lease gates its own transitions.
+            // Keep this outside validation admission: the executor already owns its lease there.
+            const milestoneLease = this.inspectWriterLease(repositoryRoot, activeMilestone.id);
+            if (milestoneLease) {
+                return withAdoption({
+                    scope: 'milestone',
+                    id: activeMilestone.id,
+                    entityId: activeMilestone.id,
+                    status: activeMilestone.status,
+                    action: milestoneLease.stale ? 'locks repair' : 'blocked',
+                    ...(!milestoneLease.stale ? { navigation: { kind: 'wait', reason: 'active-milestone-writer-lease' } } : {}),
+                    revision: activeMilestone.revision,
+                    lease: milestoneLease,
+                    reason: milestoneLease.stale
+                        ? 'The expired Milestone authority lease requires explicit repair before another transition.'
+                        : 'Another writer owns this Milestone; wait for that operation to release its lease.',
+                });
+            }
             if (activeMilestone.status === 'awaiting_final_acceptance') {
                 const root = this.store.milestoneRoot(activeMilestone.projectId, activeMilestone.id);
                 const evidence = JSON.parse(readFileSync(path.join(root, 'evidence.json'), 'utf8'));
@@ -6227,6 +5575,33 @@ export class WorkflowService {
                     ...(delegatedApprovalOptions.length > 0 ? { delegatedApprovalOptions } : {}),
                 });
             }
+            let milestoneAction = nextForMilestone(activeMilestone);
+            let validationBlock = null;
+            if (activeMilestone.status === 'active') {
+                try {
+                    this.assertMilestoneValidationReady(repositoryRoot, activeMilestone);
+                    milestoneAction = 'milestone validate';
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError))
+                        throw error;
+                    if (error.code === 'GIT_PRECONDITION_FAILED') {
+                        milestoneAction = 'restore clean base, then milestone validate';
+                        validationBlock = { blockedAction: 'milestone validate', reason: error.message };
+                    }
+                    else if (error.code === 'TRANSITION_BLOCKED' && Array.isArray(error.details.taskIds)) {
+                        validationBlock = { blockedAction: 'milestone validate', incompleteTaskIds: error.details.taskIds };
+                    }
+                    else if (error.code === 'TRANSITION_BLOCKED') {
+                        milestoneAction = 'doctor';
+                        validationBlock = { blockedAction: 'milestone validate', reason: error.message };
+                    }
+                    else
+                        throw error;
+                }
+            }
+            if (activeMilestone.status === 'blocked')
+                milestoneAction = 'milestone scope-change-prepare';
             const delegatedApprovalOptions = activeMilestone.status === 'awaiting_execution_authorization'
                 ? this.delegatedApprovalOptions(status.projectId, 'milestone.execution_authorize', activeMilestone)
                 : [];
@@ -6234,7 +5609,24 @@ export class WorkflowService {
                 scope: 'milestone',
                 id: activeMilestone.id,
                 status: activeMilestone.status,
-                action: nextForMilestone(activeMilestone),
+                action: milestoneAction,
+                ...(validationBlock ?? {}),
+                ...(activeMilestone.status === 'blocked' ? {
+                    options: [
+                        { action: 'milestone scope-change-prepare', eligible: true, requiresCandidatePlan: true },
+                        { action: 'milestone cancel', eligible: true, requiresExplicitCancellationIntent: true },
+                    ],
+                    scopeChangeBoundary: {
+                        state: 'human-decision-required',
+                        requiresCandidatePlan: true,
+                        prepareAction: 'milestone scope-change-prepare',
+                        applyAction: 'milestone scope-change-apply',
+                        requiresExplicitHumanConfirmation: true,
+                        confirmationCodeSource: 'scope-change-prepare-result',
+                        afterPreparation: 'await-human-confirmation-before-apply',
+                        applyRequiresSamePlanAndActor: true,
+                    },
+                } : {}),
                 revision: activeMilestone.revision,
                 ...(activeMilestone.status === 'awaiting_execution_authorization' && activeMilestone.planHash
                     ? {
@@ -6438,6 +5830,8 @@ export class WorkflowService {
         return { milestone, authorization, scopeChange };
     }
     nextForTaskWithDelegation(projectId, repositoryRoot, task, planRiskAudit = null) {
+        if (task.pendingBaseSyncValidation !== undefined)
+            return this.taskGitNavigationOverride(task);
         const planningRecovery = readFailedStepPlanningRecovery(this.store, task);
         // A stopped rebound Plan can expose planning recovery, never an approval route.
         const transition = planningRecovery ? null : task.status === 'awaiting_execution_authorization'
@@ -6454,49 +5848,44 @@ export class WorkflowService {
         const correctiveDerivedAuthority = transition && correctiveDerivedActor
             ? this.currentCorrectiveDerivedTaskAuthority(projectId, task, correctiveDerivedActor)
             : null;
-        let remediationModeRecovery = null;
-        let guardedCorrectivePosture = null;
-        if (planRiskAudit) {
-            try {
-                guardedCorrectivePosture = findCurrentGuardedRemediationPosture(this.store, task, planRiskAudit);
-            }
-            catch (error) {
-                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task, { authorityMode: 'observe' });
-                if (!remediationModeRecovery)
-                    throw error;
-            }
-        }
-        let catalogCorrectiveReplanPosture = guardedCorrectivePosture?.posture === 'replan-required'
-            ? guardedCorrectivePosture
+        const guardedCorrectivePosture = planRiskAudit
+            ? findCurrentGuardedRemediationPosture(this.store, task, planRiskAudit)
             : null;
-        if (!remediationModeRecovery && planRiskAudit && guardedCorrectivePosture === null) {
-            try {
-                catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
-            }
-            catch (error) {
-                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task, { authorityMode: 'observe' });
-                if (!remediationModeRecovery)
-                    throw error;
-            }
+        let catalogCorrectiveReplanPosture = guardedCorrectivePosture?.posture === 'replan-required'
+            ? guardedCorrectivePosture : null;
+        if (planRiskAudit && guardedCorrectivePosture === null) {
+            catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
         }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const nextStepId = typeof next.stepId === 'string' ? next.stepId : null;
         const rootCauseStepId = nextStepId
             ?? task.steps.find((candidate) => candidate.status === 'planned')?.id
             ?? null;
+        const hasDirtyFiles = changedFiles(repositoryRoot).length > 0;
+        const nextStartPhase = stepStartPhase(task.steps.find(step => step.id === nextStepId)?.status, hasDirtyFiles);
+        const rootCauseStartPhase = stepStartPhase(task.steps.find(step => step.id === rootCauseStepId)?.status, hasDirtyFiles);
         const downstreamProofCarryover = next.action === 'task run'
             && nextStepId
-            && changedFiles(repositoryRoot).length > 0
+            && nextStartPhase === 'planned-dirty'
             ? assessDownstreamProofCarryover(this.store, repositoryRoot, task, nextStepId)
             : null;
         const planIntegrityDirtyCarryover = next.action === 'task run'
             && nextStepId
-            && changedFiles(repositoryRoot).length > 0
+            && nextStartPhase === 'planned-dirty'
             ? this.assessPostRebindCheckSupportDirtyCarryover(repositoryRoot, task, nextStepId)
             : null;
-        let rootCauseReplanDirtyCarryover = ['task run', 'task handoff-prepare', 'task claim'].includes(String(next.action))
+        const navigationDirtyCarryover = next.action === 'task run' && rootCauseStartPhase === 'planned-dirty' && rootCauseStepId
+            ? assessNavigationDirtyCarryover(this.store, repositoryRoot, task, rootCauseStepId)
+            : null;
+        const navigationDirtyOverlay = navigationDirtyCarryover?.applicable
+            ? navigationDirtyCarryover.eligible
+                ? { navigationDirtyCarryover: { state: 'validated', stepId: rootCauseStepId, dirtyFiles: navigationDirtyCarryover.compatibility?.dirtyFiles, dirtyWorktreeHash: navigationDirtyCarryover.compatibility?.dirtyWorktreeHash } }
+                : { action: 'doctor', blockedAction: 'task run', navigationDirtyCarryover: { state: 'blocked', stepId: rootCauseStepId, blockers: navigationDirtyCarryover.blockers } }
+            : {};
+        let rootCauseReplanDirtyCarryover = !navigationDirtyCarryover?.applicable && ['task run', 'task handoff-prepare', 'task claim'].includes(String(next.action))
             && rootCauseStepId
-            && changedFiles(repositoryRoot).length > 0
+            // Match runStep: historical carryover admits a replacement start, never a failed retry.
+            && rootCauseStartPhase === 'planned-dirty'
             ? this.assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, rootCauseStepId)
             : null;
         if (rootCauseReplanDirtyCarryover?.eligible) {
@@ -6562,14 +5951,14 @@ export class WorkflowService {
         }
         const handoffPosture = readTaskC1Posture(this.store, task);
         const failedStep = task.steps.find((step) => step.status === 'failed') ?? null;
-        const failedStepRemediations = failedStep && !remediationModeRecovery
+        const failedStepRemediations = failedStep
             ? readRemediationEvents(this.store, task).filter((event) => event.stepId === failedStep.id)
             : [];
         const failedStepReviewRouting = failedStep
             ? latestFailedStepReviewRouting(this.store, task, failedStep.id)
             : null;
-        const planIntegrityAssessment = !remediationModeRecovery && planRiskAudit && failedStep
-            ? assessPlanIntegrityRecovery(this.store, repositoryRoot, task, failedStep.id)
+        const planIntegrityAssessment = planRiskAudit && failedStep
+            ? this.assessPlanIntegrityRecoveryAdmission(repositoryRoot, task, failedStep.id)
             : null;
         const downstreamProofAssessment = assessDownstreamProofRecovery(this.store, repositoryRoot, task);
         const strictStepReviewStep = planRiskAudit
@@ -6628,12 +6017,13 @@ export class WorkflowService {
                     : {};
         const correctiveReplanOverlay = (posture) => {
             const evaluation = evaluateTaskCorrectiveReplanAvailability(task, posture);
+            const replanDelegations = this.delegatedApprovalOptions(task.projectId, 'task.execution_authorize', task);
             const writerLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
             const command = handoffPosture.state === 'claimed'
                 ? 'task corrective-yield'
                 : writerLease
                     ? 'doctor'
-                    : 'task corrective-replan-prepare';
+                    : replanDelegations.length ? 'task corrective-replan-authorize' : 'task corrective-replan-prepare';
             if (evaluation.allowed && handoffPosture.state === 'none' && writerLease) {
                 const navigation = correctiveReplanNavigation(evaluation);
                 return {
@@ -6664,16 +6054,19 @@ export class WorkflowService {
             return evaluation.allowed
                 ? {
                     action: command,
+                    ...(replanDelegations.length ? { delegatedApprovalOptions: replanDelegations, correctiveReplanAuthority: { mode: 'delegated', candidateField: 'delegation', actorHash: 'sha256-utf8-grant-delegate', principalHash: 'sha256-utf8-grant-principal', grantTransition: 'task.execution_authorize' } } : {}),
                     blockedAction: 'task plan-set',
                     stepId: posture.stepId,
-                    navigation: { ...correctiveReplanNavigation(evaluation), command },
+                    navigation: { ...correctiveReplanNavigation(evaluation), kind: replanDelegations.length ? 'executable' : 'human-gate', command },
                     correctiveDecisionGate: {
                         attemptCount: posture.attemptCount,
                         decision: posture.correctiveDecision?.decision ?? null,
                         decisionEventId: posture.correctiveDecision?.eventId ?? null,
                         requiredAction: handoffPosture.state === 'claimed'
                             ? 'Yield the exact C1 claim and writer lease before preparing replacement authority.'
-                            : 'Prepare a state-bound candidate, confirm the Human gate, then execute its exact receipt.',
+                            : replanDelegations.length
+                                ? 'Prepare an independently validated same-scope candidate with the eligible grant and actor; authorize it without Human confirmation, then execute its exact delegated receipt.'
+                                : 'No eligible execution grant: request issuance/expansion of grant for delegate mode; the explicit Human preparation route remains available outside delegate mode.',
                     },
                 }
                 : {
@@ -6727,28 +6120,10 @@ export class WorkflowService {
                     },
                 };
         }
-        if (remediationModeRecovery) {
-            guardedCorrectiveOverlay = {
-                action: 'task remediation-mode-recover',
-                stepId: remediationModeRecovery.remediation.stepId,
-                remediationModeRecovery: {
-                    state: 'required',
-                    remediationEventId: remediationModeRecovery.remediation.eventId,
-                    remediationEventHash: remediationModeRecovery.remediation.eventHash,
-                    correctiveDecisionEventId: remediationModeRecovery.decision.eventId,
-                    correctiveDecisionRecoveryEventId: remediationModeRecovery.correctiveRecovery.eventId,
-                    attemptOrdinal: remediationModeRecovery.remediation.attemptOrdinal,
-                    fromMode: 'ordinary',
-                    toMode: 'corrective',
-                    requiredActor: remediationModeRecovery.actor,
-                },
-            };
-        }
-        if (!remediationModeRecovery && guardedCorrectivePosture === null && catalogCorrectiveReplanPosture) {
+        if (guardedCorrectivePosture === null && catalogCorrectiveReplanPosture) {
             guardedCorrectiveOverlay = correctiveReplanOverlay(catalogCorrectiveReplanPosture);
         }
-        if (!remediationModeRecovery
-            && guardedCorrectivePosture
+        if (guardedCorrectivePosture
             && (!strictStepReviewStep || guardedCorrectivePosture.posture === 'replan-required')) {
             switch (guardedCorrectivePosture.posture) {
                 case 'decision-required':
@@ -6929,62 +6304,42 @@ export class WorkflowService {
                                 retainedImplementation: 'journal-recoverable-1-to-1',
                                 diagnosticCode: 'STRUCTURAL_REPLACEMENT_REQUIRED',
                                 structuralReplacementAvailable: false,
+                                productDecisionRequired: true,
+                                executionAvailable: false,
+                                decisionEffect: 'No decision authorizes structural replacement in this package.',
+                                productDecisionOptions: replacementMilestone && !['accepted', 'cancelled'].includes(replacementMilestone.status)
+                                    ? [{
+                                            command: 'milestone cancel',
+                                            milestoneId: replacementMilestone.id,
+                                            expectedRevision: replacementMilestone.revision,
+                                            reasonRequired: true,
+                                            effect: 'Cancels the whole Milestone; does not create or authorize a replacement Task.',
+                                        }]
+                                    : [],
                                 incidentDependencies,
                                 discoveryCandidates: replacementDiscoveries.map((discovery) => ({
                                     id: discovery.id,
                                     revision: discovery.revision,
                                     goal: discovery.goal,
                                 })),
-                                requiredAction: 'Materialize P04-B/P05 before replacing this split-required Task.',
+                                requiredAction: 'The owner must decide whether to stop this Task or revise the Milestone scope through supported transitions; structural replacement is unavailable.',
                             },
                         };
                     }
                     break;
                 case 'stop-escalate':
-                    try {
-                        this.assertStopOverrideRepositoryBoundary(resolveRepositoryIdentity(repositoryRoot), task);
-                        prepareStopEscalateOverride(this.store, task, guardedCorrectivePosture.stepId, task.revision, 'user', 'navigation eligibility probe', headCommit(repositoryRoot));
-                        guardedCorrectiveOverlay = {
-                            action: 'task stop-override-prepare',
-                            blockedAction: 'task run',
-                            stepId: guardedCorrectivePosture.stepId,
-                            correctiveDecisionGate: {
-                                attemptCount: guardedCorrectivePosture.attemptCount,
-                                decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
-                                decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
-                                humanApprovalRequired: true,
-                                delegatedApprovalAllowed: false,
-                            },
-                            stopOverride: {
-                                state: 'eligible',
-                                policy: 'beta11-attempt4-stop-compatibility-v1',
-                                prepareCommand: 'task stop-override-prepare',
-                                applyCommand: 'task stop-override-apply',
-                                expectedRevision: task.revision,
-                                appendOnly: true,
-                                preservesOriginalDecision: true,
-                                requiredAction: 'Prepare with an explicit human actor and reason, then apply the exact confirmation code in a later user turn.',
-                            },
-                        };
-                    }
-                    catch (error) {
-                        guardedCorrectiveOverlay = {
-                            action: 'doctor',
-                            blockedAction: 'task stop-override-prepare',
-                            stepId: guardedCorrectivePosture.stepId,
-                            correctiveDecisionGate: {
-                                attemptCount: guardedCorrectivePosture.attemptCount,
-                                decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
-                                decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
-                                humanApprovalRequired: true,
-                            },
-                            stopOverride: {
-                                state: 'blocked',
-                                policy: 'beta11-attempt4-stop-compatibility-v1',
-                                reason: error instanceof Error ? error.message : String(error),
-                            },
-                        };
-                    }
+                    guardedCorrectiveOverlay = {
+                        action: 'doctor',
+                        blockedAction: 'task run',
+                        stepId: guardedCorrectivePosture.stepId,
+                        correctiveDecisionGate: {
+                            attemptCount: guardedCorrectivePosture.attemptCount,
+                            decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
+                            decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
+                            humanApprovalRequired: true,
+                        },
+                        reason: 'The recorded stop decision blocks execution; legacy stop-override creation is no longer supported.',
+                    };
                     break;
                 default:
                     break;
@@ -7135,6 +6490,7 @@ export class WorkflowService {
                 }
                 : {}),
             ...mechanicalFeasibilityOverlay,
+            ...navigationDirtyOverlay,
             ...(downstreamProofCarryover?.applicable
                 ? downstreamProofCarryover.eligible
                     ? {
@@ -7203,10 +6559,11 @@ export class WorkflowService {
                                 rootCauseReplanDirtyCarryover: {
                                     state: 'awaiting-c1',
                                     stepId: rootCauseStepId,
-                                    requiredActor: defaultTaskWorkerActor(task.id),
+                                    requiredActor: rootCauseReplanDirtyCarryover.requiredActor ?? defaultTaskWorkerActor(task.id),
                                 },
                             }
                             : handoffPosture.state === 'pending'
+                                && (!rootCauseReplanDirtyCarryover.requiredActor || handoffPosture.targetActor === rootCauseReplanDirtyCarryover.requiredActor)
                                 ? {}
                                 : {
                                     action: 'doctor',
@@ -7247,15 +6604,17 @@ export class WorkflowService {
         // fix review. Advertise the existing append-only decision route without turning
         // every ordinary repair into a mandatory replan or rewriting that review.
         const correctiveDecisionOrdinal = failedStepRemediations.length + 1;
+        const firstFailurePlanningObstruction = planningRecovery && failedStep
+            ? firstFailurePlanningObstructionEvidence(this.store, task, failedStep.id) : null;
         const optionalCorrectiveDecision = (result.action === 'task run' || planningRecovery !== null)
             && (['needs_fix', 'ready'].includes(task.status) || planningRecovery !== null)
             && failedStep && task.planHash && planRiskAudit
             && planRiskAudit.reviewRequiredStepIds.includes(failedStep.id)
             && !task.steps.some(step => step.status === 'in_progress')
-            && failedStepRemediations.length >= 2
+            && (failedStepRemediations.length >= 2 || firstFailurePlanningObstruction !== null)
             && handoffPosture.state !== 'pending'
             && !readCorrectiveDecisionEvents(this.store, task).some(event => event.stepId === failedStep.id && event.triggeringAttemptCount === correctiveDecisionOrdinal)
-            && currentBranch(repositoryRoot) === task.taskBranch && isClean(repositoryRoot)
+            && correctiveDecisionCheckoutEligible(this.store, repositoryRoot, task, failedStep.id)
             ? {
                 command: 'task corrective-decision',
                 state: 'eligible',
@@ -7271,12 +6630,13 @@ export class WorkflowService {
                 recommendedAuditor: defaultCorrectiveAuditorActor(task.id),
                 auditorMustDifferFromLatestStrictReviewer: true,
                 requiredActor: handoffPosture.state === 'claimed' ? handoffPosture.claimant : null,
-                decisions: planningRecovery ? ['replan-required', 'split-required', 'stop-escalate']
-                    : ['continue-fix', 'replan-required', 'split-required', 'stop-escalate'],
+                decisions: firstFailurePlanningObstruction ? ['replan-required']
+                    : planningRecovery ? ['replan-required', 'split-required', 'stop-escalate']
+                        : ['continue-fix', 'replan-required', 'split-required', 'stop-escalate'],
                 authority: 'none',
                 preservesOriginalReview: true,
                 humanApprovalRequiredForDecision: false,
-                replanRequiresExistingHumanGate: true,
+                replanRequiresBoundAuthorization: true,
                 requiredAction: 'Only for newly assessed evidence: obtain an independent corrective audit, refresh next and existing writer authority, then record the decision. This option does not authorize Plan replacement or extra writes.',
             }
             : null;
@@ -7290,7 +6650,8 @@ export class WorkflowService {
         const rootCauseAllowsPendingClaim = !rootCauseReplanDirtyCarryover?.applicable
             || (rootCauseReplanDirtyCarryover.blockers.length === 1
                 && rootCauseReplanDirtyCarryover.blockers[0]?.startsWith('Corrective carryover requires the retained claimed C1'));
-        if (handoffPosture.state === 'pending' && rootCauseAllowsPendingClaim) {
+        if (handoffPosture.state === 'pending' && rootCauseAllowsPendingClaim
+            && (!rootCauseReplanDirtyCarryover?.requiredActor || handoffPosture.targetActor === rootCauseReplanDirtyCarryover.requiredActor)) {
             return this.withTaskNavigationContracts(task, {
                 ...resultWithCorrectiveOption,
                 action: 'task claim',
@@ -7323,28 +6684,66 @@ export class WorkflowService {
             },
         };
     }
-    assertTaskContextChangeAllowed(task) {
+    registeredPlanningContextTransport(task, repositoryRoot) {
+        const failedTransport = repositoryRoot
+            && task.status === 'awaiting_execution_authorization'
+            && !task.steps.some(step => step.status === 'in_progress')
+            && !readPlanRiskAuditEvents(this.store, task).some(event => event.planHash === task.planHash && event.decision !== 'stop-escalate')
+            && readCorrectiveDecisionEvents(this.store, task).length === 0
+            ? task.dependencyProvenanceRecoveries?.find(record => record.failedCheckpoint
+                && task.steps.some(step => step.id === record.failedCheckpoint.stepId && step.status === 'failed'))
+            : null;
+        if (failedTransport?.failedCheckpoint && repositoryRoot) {
+            const binding = failedTransport.failedCheckpoint;
+            // Historical transports remain readable after later legitimate progress. Validate
+            // their artifact first, but require current dirty bytes only for this exact checkpoint.
+            readVerifiedPlanArtifact(this.store.taskRoot(task.projectId, task.id), binding.sourcePlanHash, task.planHash);
+            if (binding.sourcePlanHash !== task.planHash)
+                return null;
+            if (readFailedCheckpointDirtyTransport(this.store, repositoryRoot, task, binding.stepId, binding.sourceHead, binding.sourceDirtyHash))
+                return binding;
+        }
+        return null;
+    }
+    taskContextChangeBlocker(task, operation, repositoryRoot) {
+        const blocked = (error) => ({ error, activeStep: false });
         if (readCurrentPreExecutionReplan(this.store, task)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has a pending pre-execution replan; replace the implementation Plan before changing context.`, { taskId: task.id, requiredAction: 'task plan-set' });
+            return blocked(new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has a pending pre-execution replan; replace the implementation Plan before changing context.`, { taskId: task.id, requiredAction: 'task plan-set' }));
         }
         if (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed')) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} requires a replacement Step Plan; Project Knowledge cannot rebind or refresh the stale Plan.`, {
+            return blocked(new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} requires a replacement Step Plan; Project Knowledge cannot rebind or refresh the stale Plan.`, {
                 taskId: task.id,
                 requiredAction: 'Run task plan-set with the full unfinished remainder before requesting authorization.',
-            });
+            }));
         }
+        if (repositoryRoot && this.registeredPlanningContextTransport(task, repositoryRoot))
+            return null;
         const posture = this.taskTerminalCorrectivePosture(task);
-        if (!posture)
-            return;
-        throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has terminal corrective decision ${posture.posture}; Project Knowledge cannot rebind or refresh this Task.`, {
-            taskId: task.id,
-            stepId: posture.stepId,
-            decision: posture.posture,
-            decisionEventId: posture.correctiveDecision?.eventId ?? null,
-            requiredAction: posture.posture === 'split-required'
-                ? 'Materialize an atomic replacement Task through the exact replacement route.'
-                : 'Escalate outside this Task; stop-escalate cannot be resumed or rebound.',
-        });
+        if (posture) {
+            return blocked(new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has terminal corrective decision ${posture.posture}; Project Knowledge cannot rebind or refresh this Task.`, {
+                taskId: task.id,
+                stepId: posture.stepId,
+                decision: posture.posture,
+                decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                requiredAction: posture.posture === 'split-required'
+                    ? 'This Task cannot resume after split-required; no executable replacement route is available. Request a human decision without changing retained state.'
+                    : 'Escalate outside this Task; stop-escalate cannot be resumed or rebound.',
+            }));
+        }
+        if (!taskCanRebindKnowledge(task)) {
+            return blocked(new WorkflowError('TRANSITION_BLOCKED', operation === 'rebind'
+                ? `Cannot rebind Task Plan knowledge while Task is ${task.status}.`
+                : `Cannot refresh Task context while Task is ${task.status}.`));
+        }
+        const activeStep = task.steps.find(step => step.status === 'in_progress');
+        if (activeStep)
+            return {
+                activeStep: true,
+                error: new WorkflowError('TRANSITION_BLOCKED', operation === 'rebind'
+                    ? `Cannot rebind Task Plan knowledge while ${activeStep.id} is in progress.`
+                    : `Cannot refresh Task context while ${activeStep.id} is in progress.`),
+            };
+        return null;
     }
     stopOverrideContextRebindDecisionId(task, stepId, repositoryRoot) {
         return readValidatedStopOverrideContextRebindIfApplicable(this.store, task, stepId, repositoryRoot)?.stopDecision.eventId ?? null;
@@ -7368,6 +6767,14 @@ export class WorkflowService {
     taskTerminalCorrectivePosture(task) {
         if (!task.planHash)
             return null;
+        if (task.status === 'awaiting_execution_authorization' && task.authorizations.length === 0
+            && task.baseCommit === null && task.taskBranch === null && task.workspaceOwner === null
+            && task.mergedCommit === null && task.systemCommits.length === 0
+            && task.resultHash === null && task.evidenceHash === null && task.review.status === 'pending'
+            && task.steps.every((step) => (step.status === 'planned' || (step.status === 'blocked' && step.dependencies.length > 0))
+                && step.evidence === null && !step.failurePause)
+            && readPlanRiskAuditEvents(this.store, task).length === 0)
+            return null;
         const planRiskAudit = readCurrentPlanningObstructionAudit(this.store, task);
         if (!planRiskAudit)
             return null;
@@ -7376,42 +6783,6 @@ export class WorkflowService {
             ? posture
             : null;
     }
-    assertStopOverrideRepositoryBoundary(identity, task, observedLeases) {
-        const blockers = [];
-        const dirty = changedFiles(identity.repositoryRoot);
-        if (dirty.length > 0)
-            blockers.push('Repository checkout must be clean.');
-        if (task.workspaceOwner !== 'local')
-            blockers.push('Stop override is limited to a local Task workspace.');
-        if (!task.taskBranch || currentBranch(identity.repositoryRoot) !== task.taskBranch) {
-            blockers.push('The current branch must be the recorded Task branch.');
-        }
-        if (task.steps.some((step) => step.status === 'in_progress'))
-            blockers.push('No Step may be in progress.');
-        const leases = observedLeases
-            ?? new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root).list();
-        if (leases.some((lease) => lease.entityId === task.id))
-            blockers.push('No active or stale Task writer lease may exist.');
-        const projectRoot = this.store.projectRoot(identity.projectId);
-        const replanTransactions = inspectCorrectiveReplanTaskTransactions(projectRoot, this.store.root);
-        const yieldTransactions = inspectCorrectiveYieldTaskTransactions(projectRoot, this.store.root);
-        if (replanTransactions.pending.some((transaction) => transaction.taskId === task.id)
-            || replanTransactions.corrupt.some((transaction) => transaction.taskId === task.id)
-            || yieldTransactions.pending.some((transaction) => transaction.taskId === task.id)
-            || yieldTransactions.corrupt.some((transaction) => transaction.taskId === task.id)) {
-            blockers.push('No pending or corrupt Task transaction may exist.');
-        }
-        if (listCoreTaskOperationMutexes(this.store.lockRoot(identity.projectId), this.store.root)
-            .some((operation) => operation.entityId === task.id)) {
-            blockers.push('No Core Task operation may exist.');
-        }
-        if (blockers.length > 0) {
-            throw new WorkflowError('TRANSITION_BLOCKED', 'Stop override repository preconditions are not satisfied.', {
-                taskId: task.id,
-                blockers,
-            });
-        }
-    }
     delegatedApprovalOptions(projectId, transition, target) {
         return this.listDelegations(projectId)
             .filter((grant) => {
@@ -7434,7 +6805,21 @@ export class WorkflowService {
             policyHash: grant.policyHash,
         }));
     }
-    delegatedContextRefreshOptions(projectId, task, knowledgeMap, mode) {
+    delegatedContextRefreshOptions(projectId, task, knowledgeMap, mode, repositoryRoot) {
+        let planningRecovery;
+        try {
+            planningRecovery = this.registeredPlanningContextTransport(task, repositoryRoot)
+                ?? readFailedStepPlanningRecovery(this.store, task);
+            if (!planningRecovery)
+                readCurrentPlanRiskAudit(this.store, task);
+        }
+        catch (error) {
+            if (error instanceof WorkflowError && error.code === 'TRANSITION_BLOCKED')
+                return [];
+            throw error;
+        }
+        if (planningRecovery && mode !== 'delegated-content-only')
+            return [];
         return this.listDelegations(projectId)
             .filter((grant) => {
             try {
@@ -7454,27 +6839,24 @@ export class WorkflowService {
             grantId: grant.id,
             principal: grant.principal,
             delegate: grant.delegate,
-            transition: 'task.execution_authorize',
-            transitions: ['project_memory.approve', 'task.execution_authorize'],
+            transition: planningRecovery ? 'project_memory.approve' : 'task.execution_authorize',
+            transitions: planningRecovery ? ['project_memory.approve'] : ['project_memory.approve', 'task.execution_authorize'],
             scope: grant.scope,
             expiresAt: grant.expiresAt,
             policyHash: grant.policyHash,
         }));
     }
-    findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected) {
+    findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected, repositoryRoot) {
         const tasksById = new Map(tasks.map((task) => [task.id, task]));
         for (const task of tasks) {
             if (!taskIsActionableFromRepositoryNext(task, milestonesById, tasksById)
-                || !task.planHash
-                || !taskCanRebindKnowledge(task)
-                || (task.status === 'needs_fix' && !task.steps.some((step) => step.status === 'failed'))
-                || this.taskHasTerminalCorrectiveDecision(task))
+                || !task.planHash)
                 continue;
             const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
             if (!assessment.eligible)
                 continue;
-            const options = this.delegatedContextRefreshOptions(projectId, task, inspected, assessment.mode);
-            if (options.length > 0)
+            const options = this.delegatedContextRefreshOptions(projectId, task, inspected, assessment.mode, repositoryRoot);
+            if (options.length > 0 && this.taskContextChangeBlocker(task, 'refresh', repositoryRoot) === null)
                 return { task, assessment, options };
         }
         return null;
@@ -7582,12 +6964,31 @@ export class WorkflowService {
             : inspectMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
     }
     taskGitNavigationOverride(task) {
+        if (task.pendingBaseSyncValidation !== undefined) {
+            const assessment = assessPendingBaseSyncValidation(task);
+            return { scope: 'task', id: task.id, status: task.status, revision: task.revision,
+                action: assessment.reason ? 'blocked' : 'task sync-base',
+                pendingBaseSyncValidation: task.pendingBaseSyncValidation,
+                ...(assessment.reason ? { dirtyFiles: assessment.dirtyFiles,
+                    navigation: { kind: 'wait', reason: 'base-sync-validation-snapshot', waitFor: assessment.reason } } : {}),
+            };
+        }
         if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.baseCommit || !task.taskBranch) {
             return null;
         }
         const currentBase = runGit(task.repositoryRoot, ['rev-parse', task.baseBranch]);
         if (currentBase === task.baseCommit)
             return null;
+        const taskHead = runGit(task.repositoryRoot, ['rev-parse', task.taskBranch]);
+        const conflict = currentBaseSyncConflict(this.store, task, taskHead, currentBase);
+        if (conflict)
+            return {
+                scope: 'task', id: task.id, status: task.status, revision: task.revision, action: 'blocked',
+                baseSyncConflict: conflict,
+                navigation: { kind: 'wait', reason: 'base-sync-conflict', externalDecisionRequired: true,
+                    waitFor: 'The base owner resolves the conflict on the base branch without changing the reviewed Task head.',
+                    resume: 'After the base HEAD changes, obtain fresh status and next; synchronization still requires review and acceptance.' },
+            };
         return {
             scope: 'task',
             id: task.id,
@@ -7601,43 +7002,6 @@ export class WorkflowService {
             },
         };
     }
-    carriedPlanIntegrityUpdateCompatibility(snapshot, task) {
-        let boundaryCommit = headCommit(snapshot.identity.repositoryRoot);
-        let dependencyCommitCount = 0;
-        while (!task.systemCommits.includes(boundaryCommit)) {
-            const dependencyCommit = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, boundaryCommit);
-            if (!dependencyCommit)
-                return null;
-            boundaryCommit = dependencyCommit.parentCommitSha;
-            dependencyCommitCount += 1;
-        }
-        if (dependencyCommitCount === 0)
-            return null;
-        const dirtyFiles = changedFiles(snapshot.identity.repositoryRoot).sort();
-        const candidates = (task.dependencyProvenanceRecoveries ?? []).filter((record) => {
-            const compatibility = record.planIntegrity;
-            if (!compatibility
-                || record.commitSha !== boundaryCommit
-                || !task.systemCommits.includes(record.commitSha)
-                || compatibility.planHash !== task.planHash
-                || canonicalJsonStringify([...compatibility.dirtyFiles].sort()) !== canonicalJsonStringify(dirtyFiles)
-                || compatibility.dirtyWorktreeHash !== hashDirtyWorktree(snapshot.identity.repositoryRoot, compatibility.dirtyFiles))
-                return false;
-            const step = task.steps.find((candidate) => candidate.id === compatibility.stepId);
-            if (!step || step.status !== 'failed')
-                return false;
-            const remediationEventIds = readRemediationEvents(this.store, task)
-                .filter((event) => event.stepId === compatibility.stepId)
-                .map((event) => event.eventId);
-            if (canonicalJsonStringify(compatibility.remediationEventIds) !== canonicalJsonStringify(remediationEventIds))
-                return false;
-            return readCorrectiveDecisionEvents(this.store, task).some((event) => event.planHash === task.planHash
-                && event.stepId === compatibility.stepId
-                && event.decision === 'replan-required')
-                && readTaskC1Posture(this.store, task).state === 'none';
-        });
-        return candidates.length === 1 ? structuredClone(candidates[0].planIntegrity) : null;
-    }
     postRebindCheckSupportCompatibility(snapshot, task) {
         if (task.status !== 'awaiting_execution_authorization'
             || !task.planHash
@@ -7812,9 +7176,12 @@ export class WorkflowService {
             blockers,
         };
     }
-    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, downstreamProofReplan = null, historicalStepProvenance = null, planIntegrity = null, rootCauseReplan = null) {
+    inspectDependencyProvenanceCandidate(snapshot, task, activeDownstreamProof = null, historicalStepProvenance = null) {
         const versions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, [task.baseBranch]);
         const now = this.now().getTime();
+        const navigationCarryover = !activeDownstreamProof && !historicalStepProvenance && changedFiles(snapshot.identity.repositoryRoot).length > 0
+            ? assessNavigationDirtyCarryover(this.store, snapshot.identity.repositoryRoot, task, undefined, 'HEAD^')
+            : null;
         return inspectDependencyProvenanceRecovery(snapshot.identity.repositoryRoot, task, {
             activeLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) > now).length,
             staleLeaseCount: snapshot.leases.filter((lease) => Date.parse(lease.expiresAt) <= now).length,
@@ -7832,7 +7199,7 @@ export class WorkflowService {
                 currentBranch: versions.currentBranch,
                 baseBranch: versions.milestoneBases.find((base) => base.branch === task.baseBranch)?.version ?? null,
             },
-        }, activeDownstreamProof, downstreamProofReplan, historicalStepProvenance, planIntegrity, rootCauseReplan);
+        }, activeDownstreamProof, historicalStepProvenance, navigationCarryover?.eligible ? navigationCarryover.compatibility : null);
     }
     assessCurrentRootCauseReplanDirtyCarryover(repositoryRoot, task, stepId, historyHead) {
         const recordedRecovery = [...(task.dependencyProvenanceRecoveries ?? [])].reverse().find((record) => record.rootCauseReplan
@@ -7898,10 +7265,19 @@ export class WorkflowService {
         }
         const candidates = task.steps
             .filter((step) => step.status === 'planned' && (!stepId || step.id === stepId))
-            .flatMap((step) => [...new Set(readRemediationEvents(this.store, task)
-                .filter((event) => event.stepId === step.id && event.failureKind === 'checks-failed')
-                .map((event) => event.failureEvidence.completionCommit))]
-            .map((historyHead) => assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, step.id, { historyHead })))
+            .flatMap((step) => {
+            const failures = readRemediationEvents(this.store, task)
+                .filter((event) => event.stepId === step.id && event.failureKind === 'checks-failed');
+            const terminal = failures.at(-1);
+            if (!terminal)
+                return [];
+            const yields = readTaskHandoffEvents(this.store, task)
+                .filter((event) => matchesTerminalCorrectiveYield(event, terminal, task.id));
+            // Missing native boundary must remain visibly blocked, never fall through to task run.
+            if (yields.length > 1)
+                return [];
+            return [assessRootCauseReplanDirtyCarryover(this.store, repositoryRoot, task, step.id, { historyHead: terminal.failureEvidence.completionCommit })];
+        })
             .filter((assessment) => assessment.applicable);
         const eligible = candidates.filter((assessment) => assessment.eligible && assessment.compatibility);
         if (eligible.length === 1)
@@ -7910,6 +7286,7 @@ export class WorkflowService {
             applicable: candidates.length > 0,
             eligible: false,
             compatibility: null,
+            ...(candidates.length === 1 && candidates[0].requiredActor ? { requiredActor: candidates[0].requiredActor } : {}),
             blockers: [...new Set([
                     ...candidates.flatMap((assessment) => assessment.blockers),
                     ...(eligible.length > 1 ? ['Corrective carryover history resolved to more than one eligible boundary.'] : []),
@@ -8885,7 +8262,6 @@ function writerTokenContractForAction(action, claimedC1Posture = false, existing
         'task review-launch',
         'task review-sealed-record',
         'task corrective-decision-recover',
-        'task remediation-mode-recover',
         'task plan-integrity-recover',
         'task corrective-decision',
         'task corrective-yield',