codex-workflow-v2 2.0.0-beta.2 → 2.0.0-beta.5

package/dist/src/workflow.js

@@ -9,24 +9,32 @@ import { pathAllowed, validatePlan } from './domain/validation.js';
 import { WorkflowError } from './errors.js';
 import { bindGraphEvidence, createGraphRefreshRequest, fallbackGraphBinding, inspectGraphBinding, validateGraphRequestCurrent, } from './graph.js';
 import { inspectLocalDependency, inspectWorkflowVersions } from './diagnostics.js';
-import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
+import { appendTaskClaim, appendTaskHandback, appendTaskHandoff, appendTaskWriterCredentialReplacement, assertTaskClaimAllowed, assertTaskMutationAllowedByC1, defaultTaskWorkerActor, readTaskC1Posture, } from './alpha6/handoff.js';
 import { applyAdoptionPosture, assertAdoptionBaselinePreserved, buildAdoptionPreparation, initializeProjectRegistrationAdoption, readCurrentAdoptionPosture, } from './alpha6/adoption.js';
 import { appendCurrentPlanRiskAudit, appendReboundPlanRiskAudit, readCurrentPlanRiskAudit, validatePlanRiskAuditCandidate, } from './alpha6/plan-risk.js';
 import { appendCorrectiveDecisionEvent, appendRemediationEvent, appendRemediationModeRecovery, assertCorrectiveAuditorIndependence, assertGuardedRemediationAttemptAllowed, defaultCorrectiveAuditorActor, findCurrentGuardedRemediationPosture, findRemediationModeRecoveryCandidate, findFailedGuardedStepRequiringCorrectiveDecision, readGuardedRemediationPostureForStep, readCorrectiveDecisionEvents, readRemediationEvents, } from './alpha6/remediation.js';
-import { assessMilestoneInitialAssembly, applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
+import { assessMilestoneInitialAssembly, applyMilestoneScopeChangeTransaction, assertMilestoneMembershipIntegrity, assertMilestoneScopeChangeStatusAllowed, inspectMilestoneWithIntegrity, normalizeMilestonePlan, prepareMilestoneScopeChangeCandidate, prepareMilestoneScopeChangeBundle, readMilestoneForScopeChange, readMilestoneWithIntegrity, } from './alpha6/milestone.js';
 import { applyProjectTransaction, recoverProjectTransactions, runRollbackProjectTransaction, } from './beta1/project-transaction.js';
-import { buildCurrentStrictStepReviewCycle, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
+import { buildCurrentStrictStepReviewCycle, countUnverifiedStrictStepReviews, ensurePendingStrictStepReview, isStepReviewRequired, recordStrictStepReview, } from './alpha6/review.js';
 import { applyMilestoneAutonomyContract, assertAutonomousPlanEvolution, prepareMilestoneAutonomyContract, readMilestoneAutonomyEvents, requireActiveMilestoneAutonomy, } from './alpha7/autonomy.js';
 import { appendCorrectiveDecisionRecovery, readValidatedCorrectiveDecisionRecoveryForNavigation, requireCorrectiveDecisionRecoveryForRun, } from './alpha7/corrective-recovery.js';
 import { applyKnowledgeSelections, hashKnowledgeMap, inspectKnowledgeMap, normalizeRelativePath, reconcileKnowledgeMap, scanProjectKnowledge, selectKnowledgeSources, } from './memory.js';
 import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
+import { ensureDirectory } from './fs-utils.js';
 import { commitStep, mergeTaskBranch, runChecks, startLocalTaskBranch, syncBaseIntoTask, validateTaskHistory, } from './git.js';
 import { changedFiles, currentBranch, gitIsAncestor, headCommit, isClean, resolveRepositoryIdentity, runGit, } from './repository.js';
-import { launchStrictStepReviewer } from './reviewer.js';
-import { WriterLockManager } from './state/lock.js';
+import { launchStrictStepReviewer, prepareExternalStrictStepReviewPacket, prepareExternalStrictTaskReviewPacket, strictReviewInputHash, validateExternalStrictStepReviewInput, validateExternalStrictTaskReviewInput, } from './reviewer.js';
+import { listCoreTaskOperationMutexes, inspectWriterLease as inspectRawWriterLease, toPublicWriterLease, WriterLockManager, } from './state/lock.js';
 import { FileStateStore } from './state/store.js';
+import { inspectCorrectiveReplanTaskTransactions } from './state/corrective-replan-transaction.js';
+import { inspectCorrectiveYieldTaskTransactions } from './state/corrective-yield-transaction.js';
+import { createCorrectiveYieldExecutor } from './state/corrective-yield-executor.js';
+import { createCorrectiveReplanPublicController, } from './state/corrective-replan-public.js';
+import { inspectWorkflowObservationBoundary, } from './observation.js';
 import { createEntityId } from './ulid.js';
 import { PACKAGE_VERSION } from './version.js';
+import { correctiveReplanBlockedNavigation, correctiveReplanNavigation, evaluateTaskCorrectiveReplanAvailability, evaluateTaskCorrectiveReplanCandidate, identifyCorrectiveReplanPosture, prepareCorrectiveReplanCandidate, TASK_CORRECTIVE_REPLAN_TRANSITION_ID, } from './lifecycle/corrective-replan.js';
+const MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES = 2;
 export class WorkflowService {
     store;
     now;
@@ -34,13 +42,42 @@ export class WorkflowService {
         this.store = store;
         this.now = now;
     }
-    context(repository) {
+    #mutationContext(repository) {
         const identity = resolveRepositoryIdentity(repository);
         const projectRoot = this.store.projectRoot(identity.projectId);
+        const replanTransactions = inspectCorrectiveReplanTaskTransactions(projectRoot, this.store.root);
+        const yieldTransactions = inspectCorrectiveYieldTaskTransactions(projectRoot, this.store.root);
+        const taskTransactions = {
+            corrupt: [...replanTransactions.corrupt, ...yieldTransactions.corrupt],
+            pending: [...replanTransactions.pending, ...yieldTransactions.pending],
+        };
+        if (taskTransactions.corrupt.length > 0) {
+            throw new WorkflowError('STATE_CORRUPT', 'A Task transaction journal failed integrity validation.', {
+                transactions: taskTransactions.corrupt,
+            });
+        }
+        if (taskTransactions.pending.length > 0) {
+            throw new WorkflowError('TASK_RECOVERY_REQUIRED', 'A Task transaction requires explicit recovery.', {
+                taskIds: [...new Set(taskTransactions.pending.map((transaction) => transaction.taskId))].sort(),
+                transactionIds: taskTransactions.pending.map((transaction) => transaction.transactionId).sort(),
+            });
+        }
+        const coreTaskOperations = listCoreTaskOperationMutexes(this.store.lockRoot(identity.projectId), this.store.root);
+        if (coreTaskOperations.length > 0) {
+            throw new WorkflowError('LOCKED', 'A Core Task operation owns the project mutation boundary.', {
+                taskIds: coreTaskOperations.map((operation) => operation.entityId).sort(),
+                operationIds: coreTaskOperations.map((operation) => operation.operationId).sort(),
+            });
+        }
         recoverProjectTransactions(projectRoot, identity.projectId);
         const projectFile = path.join(projectRoot, 'project.json');
         const projectAlreadyRegistered = existsSync(projectFile);
         if (!projectAlreadyRegistered) {
+            // The registration posture is a sidecar under the project root. A completely
+            // fresh CODEX_WORKFLOW_STATE_HOME has no project directory yet, so establish
+            // only that directory before writing the posture; project.json remains the
+            // final registration record written below.
+            ensureDirectory(projectRoot);
             initializeProjectRegistrationAdoption(this.store, {
                 projectId: identity.projectId,
                 repositoryIdentity: identity,
@@ -54,17 +91,103 @@ export class WorkflowService {
         return {
             identity,
             store: this.store,
-            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now),
+            locks: new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root),
+        };
+    }
+    inspectWriterLease(repository, entityId) {
+        const identity = resolveRepositoryIdentity(repository);
+        const lease = inspectRawWriterLease(this.store.lockRoot(identity.projectId), entityId, this.store.root);
+        return lease ? this.publicWriterLeaseDiagnostic(lease) : null;
+    }
+    repairStaleWriterLease(repository, entityId) {
+        const context = this.#mutationContext(repository);
+        const lease = context.locks.repairStale(entityId);
+        return {
+            ...this.publicWriterLeaseDiagnostic(lease),
+            repaired: true,
+        };
+    }
+    prepareCorrectiveReplan(repository, taskId, candidate) {
+        return this.correctiveReplanController(repository).prepare({ taskId, candidate });
+    }
+    confirmCorrectiveReplan(repository, taskId, candidate, gate, confirmationCode) {
+        return this.correctiveReplanController(repository).confirm({ taskId, candidate, gate, confirmationCode });
+    }
+    executeCorrectiveReplan(repository, taskId, candidate, credential) {
+        return this.correctiveReplanController(repository).execute({ taskId, candidate, credential });
+    }
+    recoverCorrectiveReplan(repository, taskId, transactionId) {
+        return this.correctiveReplanController(repository).recover({ taskId, transactionId });
+    }
+    executeCorrectiveYield(repository, taskId, expectedTaskRevision, actor, writerToken, reason) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).execute({
+            projectId: identity.projectId,
+            taskId,
+            expectedTaskRevision,
+            actor,
+            writerToken,
+            reason,
+        });
+    }
+    recoverCorrectiveYield(repository, taskId, transactionId) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveYieldExecutor({
+            store: this.store,
+            projectId: identity.projectId,
+            now: this.now,
+        }).recover({ taskId, transactionId });
+    }
+    correctiveReplanController(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        return createCorrectiveReplanPublicController({
+            store: this.store,
+            projectId: identity.projectId,
+            repositoryRoot: identity.repositoryRoot,
+            now: this.now,
+        });
+    }
+    observationSnapshot(repository) {
+        const identity = resolveRepositoryIdentity(repository);
+        const boundary = inspectWorkflowObservationBoundary({
+            store: this.store,
+            identity,
+            now: this.now(),
+        });
+        if (boundary.observation.kind !== 'assessment') {
+            return {
+                ...boundary,
+                discoveries: [],
+                tasks: [],
+                milestones: [],
+                delegations: [],
+                adoption: null,
+            };
+        }
+        const tasks = this.store.listTasks(identity.projectId);
+        const rawMilestones = this.store.listMilestones(identity.projectId);
+        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones, boundary.leases, boundary.currentAdoptionPosture);
+        return {
+            ...boundary,
+            discoveries: this.store.listDiscoveries(identity.projectId),
+            tasks,
+            milestones: this.listMilestonesObserved(identity.projectId, rawMilestones, adoption.currentPosture),
+            delegations: this.store.listDelegations(identity.projectId),
+            adoption,
         };
     }
     prepareDelegation(repository, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         return gate;
     }
     grantDelegation(repository, input, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const gate = prepareDelegationGrantGate(identity.projectId, input, this.now());
         this.assertDelegationScopeExists(identity.projectId, gate.policy);
         if (confirmationCode.trim() !== gate.confirmationCode) {
@@ -100,7 +223,7 @@ export class WorkflowService {
         }, null);
     }
     revokeDelegation(repository, grantId, expectedRevision, actor, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const grant = this.store.readDelegation(identity.projectId, grantId);
         assertExpectedRevision(grant, expectedRevision);
         if (grant.status !== 'active') {
@@ -124,7 +247,7 @@ export class WorkflowService {
     startDiscovery(repository, input) {
         if (!input.goal.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Discovery requires a substantive goal.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const timestamp = this.now().toISOString();
         const initial = {
             schemaVersion: STATE_SCHEMA_VERSION,
@@ -152,7 +275,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(initial, null);
     }
     updateDiscovery(repository, discoveryId, expectedRevision, patch) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readDiscovery(identity.projectId, discoveryId);
         if (current.status === 'materialized' || current.status === 'abandoned') {
             throw new WorkflowError('TRANSITION_BLOCKED', `Discovery ${discoveryId} is ${current.status}.`);
@@ -176,7 +299,7 @@ export class WorkflowService {
         return this.store.writeDiscovery(updated, expectedRevision);
     }
     materializeTask(repository, discoveryId, expectedRevision, title, baseBranch = 'main', milestoneId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -253,7 +376,7 @@ export class WorkflowService {
         return { discovery: savedDiscovery, task: savedTask, taskRoot };
     }
     replaceSplitRequiredTask(repository, oldTaskId, expectedOldTaskRevision, discoveryId, expectedDiscoveryRevision, expectedMilestoneRevision, title, actor) {
-        const { identity, locks } = this.context(repository);
+        const { identity, locks } = this.#mutationContext(repository);
         const oldTask = this.store.readTask(identity.projectId, oldTaskId);
         assertExpectedRevision(oldTask, expectedOldTaskRevision);
         if (!oldTask.milestoneId) {
@@ -504,7 +627,7 @@ export class WorkflowService {
         };
     }
     materializeMilestone(repository, discoveryId, expectedRevision, title, baseBranch = 'main') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const discovery = this.store.readDiscovery(identity.projectId, discoveryId);
         assertExpectedRevision(discovery, expectedRevision);
         const readiness = assessDiscovery(discovery);
@@ -552,7 +675,7 @@ export class WorkflowService {
         };
     }
     setMilestonePlan(repository, milestoneId, expectedRevision, plan) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['planning', 'awaiting_execution_authorization', 'active', 'blocked'].includes(milestone.status)) {
@@ -624,7 +747,7 @@ export class WorkflowService {
         return saved;
     }
     prepareMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -641,7 +764,7 @@ export class WorkflowService {
         };
     }
     applyMilestoneScopeChange(repository, milestoneId, expectedRevision, plan, actor, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -664,7 +787,7 @@ export class WorkflowService {
         });
     }
     prepareMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         return prepareMilestoneAutonomyContract({
@@ -677,7 +800,7 @@ export class WorkflowService {
         });
     }
     grantMilestoneAutonomy(repository, milestoneId, expectedRevision, principal, delegate, expiresAt, confirmationCode) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         return applyMilestoneAutonomyContract({
@@ -692,7 +815,7 @@ export class WorkflowService {
         });
     }
     evolveMilestonePlanAutonomously(repository, milestoneId, expectedRevision, plan, actor) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneScopeChangeCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         assertMilestoneScopeChangeStatusAllowed(milestone);
@@ -722,7 +845,7 @@ export class WorkflowService {
         });
     }
     authorizeMilestone(repository, milestoneId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_execution_authorization' || !milestone.planHash) {
@@ -751,7 +874,7 @@ export class WorkflowService {
         return this.store.writeMilestone({ ...milestone, status: 'active', planHash, authorizations: [...milestone.authorizations, event] }, expectedRevision);
     }
     validateMilestone(repository, milestoneId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (!['active', 'awaiting_final_acceptance'].includes(milestone.status)) {
@@ -814,7 +937,7 @@ export class WorkflowService {
         return saved;
     }
     acceptMilestone(repository, milestoneId, expectedRevision, actor, confirmationCode, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (milestone.status !== 'awaiting_final_acceptance' || !milestone.resultHash || !milestone.evidenceHash) {
@@ -853,7 +976,7 @@ export class WorkflowService {
             resultHash,
             evidenceHash,
             headCommit: currentHead,
-            reason: `Confirmed with ${gate.confirmationCode}.`,
+            reason: 'Milestone final acceptance confirmed against the current validated state.',
             authorizationMode: delegation ? 'delegated' : 'human',
             ...(delegation ? { delegation } : {}),
         };
@@ -869,7 +992,7 @@ export class WorkflowService {
     cancelMilestone(repository, milestoneId, expectedRevision, reason) {
         if (!reason.trim())
             throw new WorkflowError('INVALID_ARGUMENT', 'Milestone cancellation requires a reason.');
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestone = this.readMilestoneCurrent(identity.projectId, milestoneId);
         assertExpectedRevision(milestone, expectedRevision);
         if (['accepted', 'cancelled'].includes(milestone.status)) {
@@ -879,21 +1002,54 @@ export class WorkflowService {
     }
     setTaskPlan(repository, taskId, expectedRevision, plan, correctiveAudit = null, planRiskAudit = null) {
         validatePlan(plan);
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const knowledgeMap = this.assertKnowledgeMapBinding(identity.repositoryRoot, identity.projectId, plan.knowledgeMapRevision, plan.knowledgeMapHash);
         this.validateKnowledgeTargets(knowledgeMap, plan);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
-        }
+        const correctiveDecisionEvents = task.planHash ? readCorrectiveDecisionEvents(this.store, task) : [];
         const currentPlanCorrectiveDecisions = task.planHash
-            ? readCorrectiveDecisionEvents(this.store, task).filter((event) => event.planHash === task.planHash)
+            ? correctiveDecisionEvents.filter((event) => event.planHash === task.planHash)
             : [];
         const currentReplanDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'replan-required');
         const currentContinueFixDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'continue-fix');
         const currentHardBlockingDecisions = currentPlanCorrectiveDecisions.filter((event) => event.decision === 'split-required' || event.decision === 'stop-escalate');
-        const currentReplanRequiredStepIds = [...new Set(currentReplanDecisions.map((event) => event.stepId))];
+        const currentPlanRiskAudit = task.status === 'needs_fix' || currentReplanDecisions.length > 0
+            ? readCurrentPlanRiskAudit(this.store, task)
+            : null;
+        const classifiedCorrectivePosture = currentReplanDecisions.length > 0 && currentPlanRiskAudit
+            ? findCurrentGuardedRemediationPosture(this.store, task, currentPlanRiskAudit)
+            : null;
+        const correctiveReplanPosture = classifiedCorrectivePosture?.posture === 'replan-required'
+            ? classifiedCorrectivePosture
+            : currentPlanRiskAudit
+                ? identifyCorrectiveReplanPosture(task, currentPlanRiskAudit.reviewRequiredStepIds, correctiveDecisionEvents, readRemediationEvents(this.store, task))
+                : null;
+        const correctiveReplanAvailability = correctiveReplanPosture?.posture === 'replan-required'
+            ? evaluateTaskCorrectiveReplanAvailability(task, correctiveReplanPosture)
+            : null;
+        if (currentReplanDecisions.length > 0) {
+            if (!correctiveReplanAvailability?.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} is blocked for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    posture: correctiveReplanPosture?.posture ?? null,
+                    evaluationPhase: correctiveReplanAvailability?.phase ?? 'availability',
+                    blockingGuardIds: correctiveReplanAvailability?.blockingGuardIds ?? [],
+                    pendingGuardIds: correctiveReplanAvailability?.pendingGuardIds ?? [],
+                    guardResults: correctiveReplanAvailability?.guardResults ?? [],
+                });
+            }
+            throw new WorkflowError('TRANSITION_BLOCKED', `Legacy task plan-set cannot execute ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID}.`, {
+                taskId: task.id,
+                transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                requiredAction: readTaskC1Posture(this.store, task).state === 'claimed'
+                    ? 'Run task corrective-yield first, then use task corrective-replan-prepare.'
+                    : 'Use task corrective-replan-prepare, confirm, and execute.',
+            });
+        }
+        else if (!['planning', 'awaiting_execution_authorization', 'needs_fix', 'blocked'].includes(task.status)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Cannot update Plan while Task is ${task.status}.`);
+        }
         if (currentHardBlockingDecisions.length > 0) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${task.id} has current corrective decisions that prohibit normal plan updates.`, {
                 taskId: task.id,
@@ -923,9 +1079,6 @@ export class WorkflowService {
                 })),
             });
         }
-        const currentPlanRiskAudit = task.status === 'needs_fix'
-            ? readCurrentPlanRiskAudit(this.store, task)
-            : null;
         const failedReviewAttempts = countFailedReviewAttempts(this.store.taskRoot(identity.projectId, taskId));
         if (task.status === 'needs_fix' && task.review.status === 'failed' && failedReviewAttempts >= 2) {
             validateCorrectivePlanAudit(task, correctiveAudit, failedReviewAttempts);
@@ -968,7 +1121,7 @@ export class WorkflowService {
             }
         }
         const root = this.store.taskRoot(identity.projectId, taskId);
-        const stagedPlan = this.store.stageArtifact(root, 'plan.md', renderPlan(task, plan));
+        const preparedPlan = prepareCorrectiveReplanCandidate(task, plan);
         const authorizations = task.authorizations.map((authorization) => authorization.kind === 'execution' && authorization.decision === 'approved'
             ? { ...authorization, decision: 'superseded' }
             : authorization);
@@ -985,12 +1138,17 @@ export class WorkflowService {
             plannedSteps.every((step) => step.status === 'completed')) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'A failed review requires at least one new or changed remediation Step.');
         }
-        if (currentReplanRequiredStepIds.some((stepId) => !plannedSteps.some((step) => step.id === stepId))) {
-            throw new WorkflowError('TRANSITION_BLOCKED', `Replacement Plan under replan-required must retain every guarded Step targeted by the current corrective decision; removing or renaming one would reset remediation history.`, {
-                taskId: task.id,
-                requiredStepIds: currentReplanRequiredStepIds,
-                plannedStepIds: plannedSteps.map((step) => step.id),
-            });
+        if (correctiveReplanPosture?.posture === 'replan-required') {
+            const executionEvaluation = evaluateTaskCorrectiveReplanCandidate(task, correctiveReplanPosture, preparedPlan);
+            if (!executionEvaluation.allowed) {
+                throw new WorkflowError('TRANSITION_BLOCKED', `Transition ${TASK_CORRECTIVE_REPLAN_TRANSITION_ID} rejected the candidate Plan for Task ${task.id}.`, {
+                    transitionId: TASK_CORRECTIVE_REPLAN_TRANSITION_ID,
+                    evaluationPhase: executionEvaluation.phase,
+                    blockingGuardIds: executionEvaluation.blockingGuardIds,
+                    pendingGuardIds: executionEvaluation.pendingGuardIds,
+                    guardResults: executionEvaluation.guardResults,
+                });
+            }
         }
         if (guardedRemediationGate && currentReplanDecisions.length === 0 && !plannedSteps.some((step) => step.id === guardedRemediationGate.stepId)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Continue-fix must retain guarded Step ${guardedRemediationGate.stepId}; removing or renaming it would reset the remediation breaker.`, {
@@ -998,14 +1156,10 @@ export class WorkflowService {
                 stepId: guardedRemediationGate.stepId,
             });
         }
-        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
-            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
-            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, stagedPlan.hash, this.now());
-        }
         const candidate = {
             ...task,
             status: 'awaiting_execution_authorization',
-            planHash: stagedPlan.hash,
+            planHash: preparedPlan.planHash,
             planObjective: plan.objective,
             requirements: plan.requirements,
             acceptance: plan.acceptance,
@@ -1025,6 +1179,18 @@ export class WorkflowService {
         };
         if (planRiskAudit)
             validatePlanRiskAuditCandidate(this.store, candidate, planRiskAudit);
+        const stagedPlan = this.store.stageArtifact(root, 'plan.md', preparedPlan.planBytes);
+        if (stagedPlan.hash !== preparedPlan.planHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'Prepared candidate Plan hash changed during staging.', {
+                taskId: task.id,
+                preparedPlanHash: preparedPlan.planHash,
+                stagedPlanHash: stagedPlan.hash,
+            });
+        }
+        if (correctiveAudit && guardedRemediationGate && currentReplanDecisions.length === 0 && currentPlanRiskAudit) {
+            assertCorrectiveAuditorIndependence(this.store, task, guardedRemediationGate.stepId, correctiveAudit.auditor);
+            appendCorrectiveDecisionEvent(this.store, task, guardedRemediationGate.stepId, correctiveAudit, currentPlanRiskAudit, preparedPlan.planHash, this.now());
+        }
         const saved = this.store.writeTask(candidate, expectedRevision);
         this.store.publishArtifact(stagedPlan);
         if (planRiskAudit)
@@ -1035,7 +1201,7 @@ export class WorkflowService {
         return saved;
     }
     rebindTaskKnowledge(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.assertTaskContextChangeAllowed(task);
@@ -1120,7 +1286,7 @@ export class WorkflowService {
         if (!delegationGrantId) {
             throw new WorkflowError('TRANSITION_BLOCKED', 'Task context refresh combines approval transitions and therefore requires an explicit delegated approval grant.');
         }
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const currentMap = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(task, expectedTaskRevision);
@@ -1211,7 +1377,7 @@ export class WorkflowService {
         });
     }
     authorizeTask(repository, taskId, expectedRevision, actor, reason = '', delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1241,7 +1407,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'ready', briefHash, planHash, authorizations: [...task.authorizations, event] }, expectedRevision);
     }
     recordPlanRiskAudit(repository, taskId, expectedRevision, input) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1249,7 +1415,7 @@ export class WorkflowService {
         return appendCurrentPlanRiskAudit(this.store, task, input, this.now());
     }
     showTaskHandoff(repository, taskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         return {
             task,
@@ -1257,8 +1423,8 @@ export class WorkflowService {
             claimTokenAvailable: false,
         };
     }
-    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null) {
-        const context = this.context(repository);
+    handoffTask(repository, taskId, expectedRevision, actor, targetActor, reason, writerToken = null, grantId = null, expiresAt = null, replacePending = false) {
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
@@ -1316,6 +1482,7 @@ export class WorkflowService {
                 expectedNext: String(nextForTask(task).action ?? 'task show'),
                 grantId,
                 expiresAt: expiresAt ?? new Date(this.now().getTime() + 24 * 60 * 60 * 1000).toISOString(),
+                replacePending,
             }, this.now());
             releaseLease();
             return { task, event: prepared.event, bundle: prepared.bundle };
@@ -1327,15 +1494,15 @@ export class WorkflowService {
         }
     }
     claimTask(repository, taskId, expectedRevision, actor, claimToken, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const normalizedActor = actor.trim();
         if (!normalizedActor) {
             throw new WorkflowError('INVALID_ARGUMENT', 'Claim actor is required.');
         }
-        const pendingHandoff = readTaskC1Posture(this.store, task);
-        if (pendingHandoff.state === 'pending' && pendingHandoff.latestEvent.grantId) {
+        const pendingHandoff = assertTaskClaimAllowed(this.store, task, normalizedActor, claimToken, this.now());
+        if (pendingHandoff.latestEvent.grantId) {
             this.assertHandoffGrant(context.identity.projectId, task, normalizedActor, pendingHandoff.latestEvent.grantId);
         }
         const existingLease = context.locks.inspect(taskId);
@@ -1368,7 +1535,14 @@ export class WorkflowService {
         }
         try {
             const event = appendTaskClaim(this.store, task, actor, claimToken, lease.token, this.now());
-            return { task, event, lease };
+            return {
+                task,
+                event,
+                lease: toPublicWriterLease(lease, this.now()),
+                writerCredential: acquiredHere
+                    ? { disposition: 'issued', token: lease.token }
+                    : { disposition: 'renewed' },
+            };
         }
         catch (error) {
             if (acquiredHere)
@@ -1376,8 +1550,45 @@ export class WorkflowService {
             throw error;
         }
     }
+    replaceClaimedWriterCredential(repository, taskId, expectedRevision, actor) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const normalizedActor = actor.trim();
+        if (!normalizedActor)
+            throw new WorkflowError('INVALID_ARGUMENT', 'Writer credential replacement actor is required.');
+        const posture = readTaskC1Posture(this.store, task);
+        const navigation = this.taskGitNavigationOverride(task) ?? nextForTask(task);
+        const action = String(navigation.action);
+        const currentLease = context.locks.inspect(taskId);
+        const writerTokenContract = writerTokenContractForAction(action, posture.state === 'claimed');
+        const requiredActor = writerTokenContract
+            ? this.writerCredentialRecoveryActor(task, action, posture.state === 'claimed' ? posture.claimant : null, currentLease?.owner ?? null)
+            : null;
+        if (!requiredActor || requiredActor !== normalizedActor) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} writer credential replacement requires the exact advertised recovery actor.`, {
+                taskId,
+                posture: posture.state,
+                claimant: posture.state === 'claimed' ? posture.claimant : null,
+                actor: normalizedActor,
+                requiredActor,
+                nextAction: action,
+            });
+        }
+        const lease = currentLease
+            ? context.locks.replaceCredential(taskId, normalizedActor)
+            : context.locks.acquire(taskId, normalizedActor);
+        if (posture.state === 'claimed') {
+            appendTaskWriterCredentialReplacement(this.store, task, normalizedActor, lease.token, this.now());
+        }
+        return {
+            task,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: 'issued', token: lease.token },
+        };
+    }
     handbackTask(repository, taskId, expectedRevision, actor, reason, writerToken = null, limitations = [], recommendedNext = 'Coordinator reviews the terminal Task result and recorded evidence.') {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = task.status === 'merged' || task.status === 'cancelled'
@@ -1389,7 +1600,7 @@ export class WorkflowService {
         return { task, event };
     }
     startTask(repository, taskId, expectedRevision, workspaceOwner) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(identity, taskId);
@@ -1441,7 +1652,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, baseCommit, taskBranch, workspaceOwner, blockReason: null }, expectedRevision);
     }
     runStep(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
@@ -1470,6 +1681,7 @@ export class WorkflowService {
             throw new WorkflowError('TRANSITION_BLOCKED', `${stepId} cannot start from ${step.status}.`);
         }
         const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        let resumesCorrectiveReplan = false;
         if (remediationHistoryForStep.length > 0 && (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds))) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} has remediation history but is no longer marked for guarded review by the current Plan Risk Audit; execution is blocked until the audit and Step posture are reconciled.`, {
                 taskId,
@@ -1484,20 +1696,21 @@ export class WorkflowService {
                 && guardedPosture.correctiveDecision.planHash !== task.planHash
                 ? guardedPosture.correctiveDecision
                 : null;
-            const recovery = staleDecision
+            const recovery = staleDecision?.decision === 'continue-fix'
                 ? requireCorrectiveDecisionRecoveryForRun(this.store, task, stepId, actor, writerToken)
                 : null;
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            const gate = assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit, recovery?.correctiveDecisionEventId ?? null);
+            resumesCorrectiveReplan = gate.posture === 'replan-ready';
         }
         const knowledgeMap = this.assertTaskKnowledgeBinding(context.identity.repositoryRoot, task);
         const dirty = changedFiles(context.identity.repositoryRoot);
-        if (step.status === 'planned' && dirty.length > 0) {
+        if (step.status === 'planned' && dirty.length > 0 && !resumesCorrectiveReplan) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} must start from a clean checkout.`, {
                 changedFiles: dirty,
             });
         }
         const dirtyOutsideStep = dirty.filter((file) => !pathAllowed(file, step.allowedWrites));
-        if (step.status === 'failed' && dirtyOutsideStep.length > 0) {
+        if ((step.status === 'failed' || resumesCorrectiveReplan) && dirtyOutsideStep.length > 0) {
             throw new WorkflowError('GIT_PRECONDITION_FAILED', `${stepId} retry has changes outside allowedWrites.`, {
                 changedFiles: dirtyOutsideStep,
             });
@@ -1555,7 +1768,8 @@ export class WorkflowService {
         }
         return {
             task: saved,
-            lease,
+            lease: toPublicWriterLease(lease, this.now()),
+            writerCredential: { disposition: acquiredHere ? 'issued' : 'renewed' },
             envelope: {
                 protocolVersion: PROTOCOL_VERSION,
                 packageVersion: PACKAGE_VERSION,
@@ -1591,14 +1805,14 @@ export class WorkflowService {
                 taskId,
                 stepId,
                 expectedRevision: saved.revision,
-                writerToken: lease.token,
+                writerToken: acquiredHere ? lease.token : null,
                 knowledgeMap: knowledgeSummary(knowledgeMap),
                 knowledgeSources: selectKnowledgeSources(knowledgeMap, 'worker', task.knowledgeTargets.map((target) => target.path)),
             },
         };
     }
     taskContext(repository, taskId, role) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         const historicalStrictReview = role === 'independent-reviewer'
             && task.steps.some((step) => step.status === 'in_progress' && step.evidence !== null);
@@ -1677,7 +1891,7 @@ export class WorkflowService {
         };
     }
     completeStep(repository, taskId, stepId, expectedRevision, writerToken, notes, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
@@ -1763,7 +1977,7 @@ export class WorkflowService {
         return this.store.writeTask({ ...task, status: 'in_progress', steps, blockReason: null }, expectedRevision);
     }
     reviewStep(repository, taskId, stepId, expectedRevision, runner, actor, writerToken = null) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(context.identity.projectId);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1819,10 +2033,18 @@ export class WorkflowService {
                     resolution: currentCycle.resolution,
                 });
             }
-            assertGuardedRemediationAttemptAllowed(this.store, task, stepId, planRiskAudit);
+            const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+            if (infrastructureFailures >= MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Strict Step Review exhausted its bounded infrastructure retries.', {
+                    taskId: task.id,
+                    stepId,
+                    infrastructureFailures,
+                    requiredAction: 'Use an external sealed reviewer or run doctor; do not start another local reviewer process.',
+                });
+            }
         }
         else if (currentCycle.resolution !== 'pending') {
-            if (currentCycle.resolution === 'failed' || currentCycle.resolution === 'unverified') {
+            if (currentCycle.resolution === 'failed') {
                 if (!currentCycle.reviewRecordedEvent || !currentCycle.reviewerAttestationEvent) {
                     throw new WorkflowError('STATE_CORRUPT', 'Strict Step Review recovery requires exact review and attestation sidecars.', {
                         taskId: task.id,
@@ -1830,7 +2052,7 @@ export class WorkflowService {
                         resolution: currentCycle.resolution,
                     });
                 }
-                appendRemediationEvent(this.store, task, stepId, currentCycle.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+                appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                     completionCommit: currentCycle.reviewRecordedEvent.completionCommit,
                     checksHash: currentCycle.reviewRecordedEvent.checksHash,
                     reviewEventHash: currentCycle.reviewRecordedEvent.eventHash,
@@ -1848,7 +2070,7 @@ export class WorkflowService {
             reviewedCommit: launch.reviewedCommit,
             isolationResult: launch.verifiedIsolation ? 'verified' : 'unverified',
         }, this.now());
-        if (recorded.resolution === 'failed' || recorded.resolution === 'unverified') {
+        if (recorded.resolution === 'failed') {
             const reviewRecordedEvent = recorded.reviewRecordedEvent;
             const reviewerAttestationEvent = recorded.reviewerAttestationEvent;
             if (!reviewRecordedEvent || !reviewerAttestationEvent) {
@@ -1858,7 +2080,7 @@ export class WorkflowService {
                     resolution: recorded.resolution,
                 });
             }
-            appendRemediationEvent(this.store, task, stepId, recorded.resolution === 'failed' ? 'review-failed' : 'review-unverified', {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
                 completionCommit: reviewRecordedEvent.completionCommit,
                 checksHash: reviewRecordedEvent.checksHash,
                 reviewEventHash: reviewRecordedEvent.eventHash,
@@ -1867,8 +2089,132 @@ export class WorkflowService {
         }
         return this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, launch.review.summary), expectedRevision);
     }
+    prepareExternalStepReview(repository, taskId, stepId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        if (task.status !== 'in_progress' && task.status !== 'blocked') {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        const planRiskAudit = readCurrentPlanRiskAudit(this.store, task);
+        if (!planRiskAudit || !isStepReviewRequired(task, stepId, planRiskAudit.reviewRequiredStepIds)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Step ${stepId} is not marked for strict review by the current Plan Risk Audit.`);
+        }
+        const step = requireStep(task, stepId);
+        if (step.status !== 'in_progress' || !step.evidence) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Step Review requires ${stepId} in progress with canonical evidence.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot) || headCommit(identity.repositoryRoot) !== step.evidence.commitSha) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Step Review requires a clean checkout at the completion commit.');
+        }
+        const envelope = this.taskContext(repository, taskId, 'independent-reviewer');
+        return prepareExternalStrictStepReviewPacket(identity.repositoryRoot, task, this.store.taskRoot(task.projectId, task.id), envelope, stepId, step.evidence);
+    }
+    recordExternalStepReview(repository, taskId, stepId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalStepReview(repository, taskId, stepId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictStepReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Step reviewer must differ from the lifecycle mutation actor.');
+        }
+        const currentCycle = buildCurrentStrictStepReviewCycle(this.store, task, stepId);
+        if (task.status === 'blocked' && currentCycle.resolution !== 'unverified') {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue requires an unverified prior review cycle.', {
+                taskId,
+                stepId,
+                resolution: currentCycle.resolution,
+            });
+        }
+        const infrastructureFailures = countUnverifiedStrictStepReviews(this.store, task, stepId);
+        if (infrastructureFailures > MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'External sealed review rescue exceeded its bounded infrastructure history.', {
+                taskId,
+                stepId,
+                infrastructureFailures,
+            });
+        }
+        ensurePendingStrictStepReview(this.store, task, stepId, this.now());
+        const recorded = recordStrictStepReview(this.store, task, stepId, {
+            review,
+            reviewerOutputHash: strictReviewInputHash(review),
+            reviewedCommit: packet.reviewedCommit,
+            isolationResult: 'verified',
+        }, this.now());
+        if (recorded.resolution === 'failed') {
+            appendRemediationEvent(this.store, task, stepId, 'review-failed', {
+                completionCommit: recorded.reviewRecordedEvent.completionCommit,
+                checksHash: recorded.reviewRecordedEvent.checksHash,
+                reviewEventHash: recorded.reviewRecordedEvent.eventHash,
+                reviewerAttestationHash: recorded.reviewerAttestationEvent.eventHash,
+            }, readCurrentPlanRiskAudit(this.store, task), this.now());
+        }
+        const saved = this.store.writeTask(applyStrictStepReviewResolution(task, stepId, recorded.resolution, review.summary), expectedRevision);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
+    prepareExternalTaskReview(repository, taskId, expectedRevision) {
+        const identity = resolveRepositoryIdentity(repository);
+        const task = this.store.readTask(identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
+        if (task.status !== 'validating' && !retryingUnverified) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `External Strict Task Review cannot run while task ${taskId} is ${task.status}.`);
+        }
+        validateTaskHistory(identity.repositoryRoot, task);
+        assertTaskBranch(identity.repositoryRoot, task);
+        if (!isClean(identity.repositoryRoot)) {
+            throw new WorkflowError('GIT_PRECONDITION_FAILED', 'External Strict Task Review requires a clean Task checkout.');
+        }
+        const taskRoot = this.store.taskRoot(task.projectId, task.id);
+        if (!task.evidenceHash || this.store.hashArtifact(taskRoot, 'evidence.json') !== task.evidenceHash) {
+            throw new WorkflowError('STATE_CORRUPT', 'External Strict Task Review requires the exact submitted evidence artifact.');
+        }
+        return prepareExternalStrictTaskReviewPacket(identity.repositoryRoot, task, taskRoot, this.taskContext(repository, taskId, 'independent-reviewer'));
+    }
+    recordExternalTaskReview(repository, taskId, expectedRevision, input, actor, writerToken = null) {
+        const context = this.#mutationContext(repository);
+        const task = this.store.readTask(context.identity.projectId, taskId);
+        assertExpectedRevision(task, expectedRevision);
+        this.proveOptionalWriterLeaseToken(context, taskId, writerToken);
+        this.assertTaskMutationAllowedByHandoff(task, actor, writerToken);
+        const packet = this.prepareExternalTaskReview(repository, taskId, expectedRevision);
+        let review;
+        try {
+            review = validateExternalStrictTaskReviewInput(input, packet);
+        }
+        catch (error) {
+            throw new WorkflowError('INVALID_ARGUMENT', error instanceof Error ? error.message : 'Invalid external strict Task review.');
+        }
+        if (review.reviewer.trim() === actor.trim()) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'The independent Task reviewer must differ from the lifecycle mutation actor.');
+        }
+        const saved = this.recordReview(repository, taskId, expectedRevision, review, actor, writerToken);
+        return {
+            mode: 'external-sealed',
+            packetHash: packet.packetHash,
+            repositorySealHash: packet.repositorySealHash,
+            reviewerThreadId: input.reviewerThreadId,
+            task: saved,
+        };
+    }
     submitTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const lease = context.locks.heartbeat(taskId, writerToken);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
@@ -1900,11 +2246,11 @@ export class WorkflowService {
         return saved;
     }
     recordReview(repository, taskId, expectedRevision, review, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         const retryingUnverified = task.status === 'blocked' && task.review.status === 'unverified';
         if (task.status !== 'validating' && !retryingUnverified) {
@@ -1942,7 +2288,7 @@ export class WorkflowService {
         return saved;
     }
     recoverStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
@@ -1954,18 +2300,18 @@ export class WorkflowService {
         return appendCorrectiveDecisionRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recoverRemediationMode(repository, taskId, stepId, expectedRevision, actor, writerToken) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         this.requireExecutionAdoptionPosture(context.identity, taskId);
         return appendRemediationModeRecovery(this.store, task, stepId, expectedRevision, actor, writerToken, this.now());
     }
     recordStepCorrectiveDecision(repository, taskId, stepId, expectedRevision, correctiveAudit, actor, writerToken = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         this.readCurrentAdoptionPostureStrict(identity.projectId);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
-        this.proveOptionalWriterLeaseToken(this.context(repository), taskId, writerToken);
+        this.proveOptionalWriterLeaseToken(this.#mutationContext(repository), taskId, writerToken);
         this.assertTaskMutationAllowedByHandoff(task, actor ?? null, writerToken);
         if (!['ready', 'needs_fix', 'blocked'].includes(task.status)) {
             throw new WorkflowError('TRANSITION_BLOCKED', `Task ${taskId} cannot record a corrective decision while ${task.status}.`);
@@ -2007,7 +2353,7 @@ export class WorkflowService {
         return appendCorrectiveDecisionEvent(this.store, task, stepId, correctiveAudit, planRiskAudit, task.planHash, this.now());
     }
     setTaskResult(repository, taskId, expectedRevision, summary, limitations) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'validating' || task.review.status !== 'passed') {
@@ -2021,7 +2367,7 @@ export class WorkflowService {
         return saved;
     }
     acceptTask(repository, taskId, expectedRevision, actor, delegationGrantId = null) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'awaiting_final_acceptance' || !task.resultHash || !task.evidenceHash) {
@@ -2059,7 +2405,7 @@ export class WorkflowService {
         }, expectedRevision);
     }
     syncTaskBase(repository, taskId, expectedRevision) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const task = this.store.readTask(identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.taskBranch || !task.baseCommit) {
@@ -2111,7 +2457,7 @@ export class WorkflowService {
         return saved;
     }
     mergeTask(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2133,7 +2479,7 @@ export class WorkflowService {
         return saved;
     }
     confirmExternalMerge(repository, taskId, expectedRevision, writerToken, actor) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const task = this.store.readTask(context.identity.projectId, taskId);
         assertExpectedRevision(task, expectedRevision);
         const lease = context.locks.heartbeat(taskId, writerToken);
@@ -2150,25 +2496,22 @@ export class WorkflowService {
         return saved;
     }
     status(repository) {
-        const { identity } = this.context(repository);
-        const tasks = this.store.listTasks(identity.projectId);
-        const rawMilestones = this.store.listMilestones(identity.projectId);
-        const adoption = this.inspectAdoptionPreparation(identity, tasks, rawMilestones);
-        const milestones = this.listMilestonesCurrent(identity.projectId, adoption.currentPosture);
+        const snapshot = this.observationSnapshot(repository);
         return {
-            projectId: identity.projectId,
-            discoveries: this.store.listDiscoveries(identity.projectId),
-            tasks,
-            milestones,
-            milestoneInitialAssembly: milestones
-                .map((milestone) => this.describeMilestoneInitialAssembly(identity.projectId, milestone, tasks))
+            projectId: snapshot.identity.projectId,
+            discoveries: snapshot.discoveries,
+            tasks: snapshot.tasks,
+            milestones: snapshot.milestones,
+            milestoneInitialAssembly: snapshot.milestones
+                .map((milestone) => this.describeMilestoneInitialAssembly(snapshot.identity.projectId, milestone, snapshot.tasks))
                 .filter((value) => value !== null),
-            delegations: this.store.listDelegations(identity.projectId),
-            adoption,
+            delegations: snapshot.delegations,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
         };
     }
     recoverMilestoneTransactions(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const milestones = this.listMilestonesCurrent(identity.projectId, readCurrentAdoptionPosture(this.store, identity.projectId));
         return {
             projectId: identity.projectId,
@@ -2176,11 +2519,11 @@ export class WorkflowService {
         };
     }
     prepareAdoption(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.inspectAdoptionPreparation(identity, this.store.listTasks(identity.projectId), this.store.listMilestones(identity.projectId));
     }
     applyAdoption(repository, actor, confirmationCode) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const tasks = context.store.listTasks(context.identity.projectId);
         const milestones = context.store.listMilestones(context.identity.projectId);
         return applyAdoptionPosture(this.store, {
@@ -2197,19 +2540,19 @@ export class WorkflowService {
         }, actor, confirmationCode);
     }
     updatePreflight(repository) {
-        const context = this.context(repository);
-        const tasks = context.store.listTasks(context.identity.projectId);
-        const milestones = context.store.listMilestones(context.identity.projectId);
-        const dirty = changedFiles(context.identity.repositoryRoot);
+        const snapshot = this.observationSnapshot(repository);
+        const tasks = snapshot.tasks;
+        const milestones = snapshot.milestones;
+        const dirty = changedFiles(snapshot.identity.repositoryRoot);
         const runningSteps = tasks.flatMap((task) => task.steps
             .filter((step) => step.status === 'in_progress')
             .map((step) => ({ taskId: task.id, stepId: step.id })));
-        const leases = context.locks.list();
+        const leases = snapshot.leases;
         const now = this.now().getTime();
         const activeLeases = leases.filter((lease) => Date.parse(lease.expiresAt) > now);
         const staleLeases = leases.filter((lease) => Date.parse(lease.expiresAt) <= now);
         const activeMilestones = milestones.filter((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
-        const inspectedVersions = inspectWorkflowVersions(context.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
+        const inspectedVersions = inspectWorkflowVersions(snapshot.identity.repositoryRoot, activeMilestones.map((milestone) => milestone.baseBranch));
         const milestoneBases = inspectedVersions.milestoneBases.map((base) => ({
             ...base,
             milestoneIds: activeMilestones.filter((milestone) => milestone.baseBranch === base.branch).map((milestone) => milestone.id),
@@ -2236,31 +2579,20 @@ export class WorkflowService {
             ...(activeLeases.length > 0 ? ['At least one writer lease is active.'] : []),
             ...(staleLeases.length > 0 ? ['At least one stale writer lease requires explicit repair.'] : []),
             ...versionBlockers,
+            ...observationPreflightBlockers(snapshot.observation),
         ];
-        const adoption = buildAdoptionPreparation({
-            projectId: context.identity.projectId,
-            repositoryIdentity: context.identity,
-            packageVersion: PACKAGE_VERSION,
-            protocolVersion: PROTOCOL_VERSION,
-            stateSchemaVersion: STATE_SCHEMA_VERSION,
-            tasks,
-            milestones,
-            sidecarInventory: this.collectAdoptionSidecarInventory(context.identity.projectId, tasks, milestones),
-            blockers,
-            now: this.now(),
-        }, readCurrentAdoptionPosture(this.store, context.identity.projectId));
         return {
             safe: blockers.length === 0,
             packageVersion: PACKAGE_VERSION,
             protocolVersion: PROTOCOL_VERSION,
             stateSchemaVersion: STATE_SCHEMA_VERSION,
-            projectId: context.identity.projectId,
-            repositoryRoot: context.identity.repositoryRoot,
+            projectId: snapshot.identity.projectId,
+            repositoryRoot: snapshot.identity.repositoryRoot,
             clean: dirty.length === 0,
             changedFiles: dirty,
             runningSteps,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             blockers,
             workflowVersions: {
                 runtime: inspectedVersions.runtime,
@@ -2276,11 +2608,12 @@ export class WorkflowService {
                     ? null
                     : 'Land only package.json/package-lock.json dependency changes on every active Milestone base; do not transport unrelated product commits.',
             },
-            adoption,
+            adoption: snapshot.adoption,
+            observation: snapshot.observation,
         };
     }
     alpha6StrictReviewRescuePreflight(repository) {
-        const context = this.context(repository);
+        const context = this.#mutationContext(repository);
         const dependency = inspectLocalDependency(context.identity.repositoryRoot);
         const tasks = context.store.listTasks(context.identity.projectId);
         const leases = context.locks.list();
@@ -2375,15 +2708,15 @@ export class WorkflowService {
             projectId: context.identity.projectId,
             repositoryRoot: context.identity.repositoryRoot,
             clean: dirty.length === 0,
-            activeLeases,
-            staleLeases,
+            activeLeases: activeLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
+            staleLeases: staleLeases.map((lease) => toPublicWriterLease(lease, new Date(now))),
             candidate,
             blockers,
             requiredActions,
         };
     }
     scanKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         try {
             const current = this.store.readKnowledgeMap(identity.projectId);
@@ -2396,11 +2729,11 @@ export class WorkflowService {
         }
     }
     showKnowledgeMap(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return this.store.readKnowledgeMap(identity.projectId);
     }
     knowledgeMapStatus(repository) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         return inspectKnowledgeMap(current, scanned);
@@ -2409,7 +2742,7 @@ export class WorkflowService {
         return this.approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, null);
     }
     approveKnowledgeMapForTaskRefresh(repository, expectedRevision, selections, actor, delegationGrantId, autonomyTaskId) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const inspected = inspectKnowledgeMap(current, scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now()));
@@ -2426,43 +2759,35 @@ export class WorkflowService {
         return this.store.writeKnowledgeMap(approved, expectedRevision);
     }
     reconcileKnowledgeMap(repository, expectedRevision, allowAtomicTaskRefresh = false) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const current = this.store.readKnowledgeMap(identity.projectId);
         assertExpectedRevision(current, expectedRevision);
         const scanned = scanProjectKnowledge(identity.repositoryRoot, identity.projectId, this.now());
         if (!allowAtomicTaskRefresh && current.status === 'active' && current.approval) {
             const milestonesById = new Map(this.listMilestonesCurrent(identity.projectId).map((milestone) => [milestone.id, milestone]));
-            const activeTask = this.store
-                .listTasks(identity.projectId)
-                .find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
-            if (activeTask?.planHash
-                && taskCanRebindKnowledge(activeTask)
-                && !this.taskHasTerminalCorrectiveDecision(activeTask)) {
-                const inspected = inspectKnowledgeMap(current, scanned);
-                const assessment = assessDelegatedKnowledgeRefresh(current, inspected, activeTask, this.store.hashArtifact(this.store.taskRoot(identity.projectId, activeTask.id), 'plan.md'));
-                if (assessment.eligible
-                    && this.delegatedContextRefreshOptions(identity.projectId, activeTask, inspected, assessment.mode).length > 0) {
-                    throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
-                        taskId: activeTask.id,
-                        requiredAction: 'Run the exact task context-refresh action returned by next.',
-                    });
-                }
+            const inspected = inspectKnowledgeMap(current, scanned);
+            const refreshOwner = this.findDelegatedContextRefreshOwner(identity.projectId, this.store.listTasks(identity.projectId), milestonesById, current, inspected);
+            if (refreshOwner) {
+                throw new WorkflowError('TRANSITION_BLOCKED', 'Standalone Project Knowledge reconcile would strand an authorized Task context refresh.', {
+                    taskId: refreshOwner.task.id,
+                    requiredAction: 'Run the exact task context-refresh action returned by next.',
+                });
             }
         }
         return this.store.writeKnowledgeMap(reconcileKnowledgeMap(current, scanned), expectedRevision);
     }
     graphRefreshRequest(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         return createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
     }
     graphStatus(repository, graphKind, mode = 'moderate') {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const binding = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return { request, binding: binding ? inspectGraphBinding(binding, request) : null };
     }
     bindGraph(repository, expectedRevision, request, evidence) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const currentRequest = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, request.graphKind, request.mode, this.now());
         validateGraphRequestCurrent(request, currentRequest);
         const existing = this.readGraphBindingOrNull(identity.projectId, request.graphKind);
@@ -2470,13 +2795,78 @@ export class WorkflowService {
         return this.store.writeGraphBinding(binding, expectedRevision);
     }
     recordGraphFallback(repository, graphKind, mode, expectedRevision, reason) {
-        const { identity } = this.context(repository);
+        const { identity } = this.#mutationContext(repository);
         const request = createGraphRefreshRequest(identity.repositoryRoot, identity.projectId, graphKind, mode, this.now());
         const existing = this.readGraphBindingOrNull(identity.projectId, graphKind);
         return this.store.writeGraphBinding(fallbackGraphBinding(identity.projectId, request, reason, existing, this.now()), expectedRevision);
     }
-    next(repository) {
+    next(repository, taskId = null) {
         const status = this.status(repository);
+        if (status.observation.kind === 'blocked') {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
+        if (status.observation.kind === 'repair') {
+            const repair = status.observation.repair;
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'repair-required',
+                action: repair?.command ?? 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: repair ? 'repair' : 'blocked',
+                    transitionId: null,
+                    availableRepairTransitionId: null,
+                    ...(repair ? {
+                        command: repair.command,
+                        cataloged: repair.cataloged,
+                        ...('available' in repair ? { available: repair.available } : {}),
+                        bindings: repair.command === 'milestone recover'
+                            ? {
+                                projectId: repair.projectId,
+                                milestoneIds: repair.milestoneIds,
+                                transactionIds: repair.transactionIds,
+                            }
+                            : 'taskIds' in repair
+                                ? {
+                                    projectId: repair.projectId,
+                                    taskIds: repair.taskIds,
+                                    transactionIds: repair.transactionIds,
+                                }
+                                : {
+                                    projectId: repair.projectId,
+                                    entityIds: repair.entityIds,
+                                },
+                    } : {}),
+                    reasonCodes: status.observation.reasonCodes,
+                },
+            };
+        }
+        if (!status.adoption) {
+            return {
+                scope: 'project',
+                projectId: status.projectId,
+                status: 'observation-blocked',
+                action: 'blocked',
+                observation: status.observation,
+                navigation: {
+                    kind: 'blocked',
+                    reasonCodes: status.observation.reasonCodes,
+                    availableRepairTransitionId: null,
+                },
+            };
+        }
         const adoptionInfo = {
             status: status.adoption.status,
             safe: status.adoption.safe,
@@ -2494,19 +2884,105 @@ export class WorkflowService {
                 status: status.adoption.status,
                 action: status.adoption.safe ? 'state adoption-apply' : 'restore safe boundary, then state adoption-prepare',
                 adoption: adoptionInfo,
+                observation: status.observation,
+                navigation: status.adoption.safe
+                    ? {
+                        kind: 'human-gate',
+                        transitionId: null,
+                        cataloged: false,
+                        command: 'state adoption-apply',
+                        bindings: {
+                            projectId: status.projectId,
+                            confirmationCode: status.adoption.confirmationCode,
+                            confirmationCodeBindingHash: status.adoption.confirmationCodeBindingHash,
+                            actorRequired: true,
+                        },
+                    }
+                    : {
+                        kind: 'blocked',
+                        transitionId: null,
+                        availableRepairTransitionId: null,
+                        reasonCodes: ['ADOPTION_MISSING'],
+                        blockers: status.adoption.blockers,
+                    },
             };
         }
-        const withAdoption = (value) => ({ ...value, adoption: adoptionInfo });
+        const withAdoption = (value) => ({
+            ...value,
+            adoption: adoptionInfo,
+            observation: status.observation,
+        });
         const repositoryRoot = resolveRepositoryIdentity(repository).repositoryRoot;
         const milestonesById = new Map(status.milestones.map((milestone) => [milestone.id, milestone]));
-        const activeTask = status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
+        const requestedTask = taskId === null
+            ? null
+            : status.tasks.find((task) => task.id === taskId) ?? null;
+        if (taskId !== null && !requestedTask) {
+            throw new WorkflowError('NOT_FOUND', `Task ${taskId} was not found in this repository.`);
+        }
+        if (requestedTask && !taskIsActionableFromRepositoryNext(requestedTask, milestonesById)) {
+            throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} is not actionable from repository next.`, {
+                taskId: requestedTask.id,
+                taskStatus: requestedTask.status,
+                milestoneId: requestedTask.milestoneId,
+            });
+        }
+        const activeTask = requestedTask
+            ?? status.tasks.find((task) => taskIsActionableFromRepositoryNext(task, milestonesById));
         if (activeTask) {
-            const activePlanRiskAudit = activeTask.planHash
-                ? readCurrentPlanRiskAudit(this.store, activeTask)
+            const activeTaskMilestone = activeTask.milestoneId
+                ? milestonesById.get(activeTask.milestoneId) ?? null
                 : null;
+            const milestoneCancellationSafe = Boolean(activeTaskMilestone
+                && !activeTask.steps.some((step) => step.status === 'in_progress')
+                && status.observation.leases.length === 0
+                && status.observation.coreTaskOperations.length === 0
+                && status.observation.pendingProjectTransactions.length === 0
+                && status.observation.pendingMilestoneTransactions.length === 0
+                && status.observation.pendingTaskTransactions.length === 0
+                && status.observation.corruptTaskTransactions.length === 0);
+            const withMilestoneCancellation = (value) => (milestoneCancellationSafe
+                ? {
+                    ...value,
+                    milestoneCancellationOption: {
+                        command: 'milestone cancel',
+                        milestoneId: activeTaskMilestone.id,
+                        expectedRevision: activeTaskMilestone.revision,
+                        reasonRequired: true,
+                        taskDisposition: 'retained-historical',
+                    },
+                }
+                : value);
+            let activePlanRiskAudit = null;
+            let planRiskAuditRecovery = null;
+            if (activeTask.planHash) {
+                try {
+                    activePlanRiskAudit = readCurrentPlanRiskAudit(this.store, activeTask);
+                }
+                catch (error) {
+                    if (!(error instanceof WorkflowError) || error.code !== 'TRANSITION_BLOCKED')
+                        throw error;
+                    planRiskAuditRecovery = {
+                        scope: 'task',
+                        id: activeTask.id,
+                        status: activeTask.status,
+                        action: 'task plan-risk-audit',
+                        revision: activeTask.revision,
+                        planRiskAuditRecovery: {
+                            state: 'required',
+                            reason: error.message,
+                            currentBriefHash: activeTask.briefHash,
+                            currentPlanHash: activeTask.planHash,
+                            knowledgeMapRevision: activeTask.knowledgeMapRevision,
+                            knowledgeMapHash: activeTask.knowledgeMapHash,
+                        },
+                    };
+                }
+            }
             const taskNext = activeTask.status === 'planning'
                 ? null
-                : this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
+                : planRiskAuditRecovery
+                    ?? this.nextForTaskWithDelegation(status.projectId, activeTask, activePlanRiskAudit);
             // Active Step work must outrank Project Knowledge refresh/rebind. Both completion and
             // strict review are executable while context refresh correctly remains forbidden.
             const hardStop = taskNext?.action === 'task corrective-decision'
@@ -2518,12 +2994,27 @@ export class WorkflowService {
                 || hardStop
                 || terminalCorrectiveDecision === 'split-required'
                 || terminalCorrectiveDecision === 'stop-escalate') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
             }
             if (!taskCanRebindKnowledge(activeTask) && activeTask.status !== 'planning') {
-                return withAdoption(taskNext);
+                return withAdoption(withMilestoneCancellation(taskNext));
+            }
+            let knowledgeMap;
+            try {
+                knowledgeMap = this.knowledgeMapStatus(repository);
+            }
+            catch (error) {
+                if (!(error instanceof WorkflowError) || error.code !== 'NOT_FOUND')
+                    throw error;
+                return withAdoption(withMilestoneCancellation({
+                    scope: 'project-memory',
+                    status: 'missing',
+                    action: 'project-memory scan',
+                    stalenessOriginTaskId: activeTask.id,
+                    authorizesTask: false,
+                    provenanceNotice: 'This Task identifier is diagnostic provenance only; the Project Knowledge action does not authorize or resume it.',
+                }));
             }
-            const knowledgeMap = this.knowledgeMapStatus(repository);
             if (knowledgeMap.status !== 'active' || !knowledgeMap.approval) {
                 const action = knowledgeMap.status === 'stale' ? 'project-memory reconcile' : 'project-memory approve';
                 const delegatedApprovalOptions = action === 'project-memory approve'
@@ -2539,7 +3030,17 @@ export class WorkflowService {
                 const contextRefreshOptions = action === 'project-memory reconcile' && refreshAssessment?.eligible
                     ? this.delegatedContextRefreshOptions(status.projectId, activeTask, knowledgeMap, refreshAssessment.mode)
                     : [];
-                return withAdoption({
+                if (requestedTask && action === 'project-memory reconcile' && contextRefreshOptions.length === 0) {
+                    const refreshOwner = this.findDelegatedContextRefreshOwner(status.projectId, status.tasks, milestonesById, storedKnowledgeMap, knowledgeMap);
+                    if (refreshOwner && refreshOwner.task.id !== requestedTask.id) {
+                        throw new WorkflowError('TRANSITION_BLOCKED', `Task ${requestedTask.id} cannot be selected while Task ${refreshOwner.task.id} requires an atomic context refresh.`, {
+                            taskId: requestedTask.id,
+                            blockingTaskId: refreshOwner.task.id,
+                            requiredAction: 'Run repository next and its exact task context-refresh action first.',
+                        });
+                    }
+                }
+                return withAdoption(withMilestoneCancellation({
                     scope: contextRefreshOptions.length > 0 ? 'task' : 'project-memory',
                     status: knowledgeMap.status,
                     action: contextRefreshOptions.length > 0 ? 'task context-refresh' : action,
@@ -2571,14 +3072,14 @@ export class WorkflowService {
                             },
                         }
                         : {}),
-                });
+                }));
             }
             const knowledgeMapHash = hashKnowledgeMap(knowledgeMap);
             if (taskCanRebindKnowledge(activeTask) &&
                 activeTask.planHash &&
                 (activeTask.knowledgeMapRevision !== knowledgeMap.revision ||
                     activeTask.knowledgeMapHash !== knowledgeMapHash)) {
-                return withAdoption({
+                return withAdoption(withMilestoneCancellation({
                     scope: 'task',
                     id: activeTask.id,
                     status: activeTask.status,
@@ -2586,9 +3087,9 @@ export class WorkflowService {
                     revision: activeTask.revision,
                     knowledgeMapRevision: knowledgeMap.revision,
                     knowledgeMapHash,
-                });
+                }));
             }
-            return withAdoption(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null));
+            return withAdoption(withMilestoneCancellation(taskNext ?? this.nextForTaskWithDelegation(status.projectId, activeTask, null)));
         }
         const activeMilestone = status.milestones.find((milestone) => !['accepted', 'cancelled'].includes(milestone.status));
         if (activeMilestone) {
@@ -2667,6 +3168,19 @@ export class WorkflowService {
                 status: activeMilestone.status,
                 action: nextForMilestone(activeMilestone),
                 revision: activeMilestone.revision,
+                ...(activeMilestone.status === 'awaiting_execution_authorization' && activeMilestone.planHash
+                    ? {
+                        milestoneAuthorizationOptions: [
+                            { action: 'milestone authorize', mode: 'direct-human' },
+                            {
+                                action: 'milestone autonomy-prepare',
+                                mode: 'delegated',
+                                requiresExactHumanConfirmation: true,
+                                maximumDurationHours: 72,
+                            },
+                        ],
+                    }
+                    : {}),
                 ...(activeMilestone.status === 'active'
                     ? {
                         completionPolicy: {
@@ -2823,6 +3337,19 @@ export class WorkflowService {
                     throw error;
             }
         }
+        let catalogCorrectiveReplanPosture = guardedCorrectivePosture?.posture === 'replan-required'
+            ? guardedCorrectivePosture
+            : null;
+        if (!remediationModeRecovery && planRiskAudit && guardedCorrectivePosture === null) {
+            try {
+                catalogCorrectiveReplanPosture = identifyCorrectiveReplanPosture(task, planRiskAudit.reviewRequiredStepIds, readCorrectiveDecisionEvents(this.store, task), readRemediationEvents(this.store, task));
+            }
+            catch (error) {
+                remediationModeRecovery = findRemediationModeRecoveryCandidate(this.store, task);
+                if (!remediationModeRecovery)
+                    throw error;
+            }
+        }
         const next = this.taskGitNavigationOverride(task) ?? nextForTask(task);
         const handoffPosture = readTaskC1Posture(this.store, task);
         const strictStepReviewStep = planRiskAudit
@@ -2835,6 +3362,11 @@ export class WorkflowService {
                 return buildCurrentStrictStepReviewCycle(this.store, task, step.id).resolution === 'unverified';
             }) ?? null
             : null;
+        const strictReviewInfrastructureFailures = strictStepReviewStep
+            ? countUnverifiedStrictStepReviews(this.store, task, strictStepReviewStep.id)
+            : 0;
+        const strictTaskReviewRequired = (task.status === 'validating' && task.review.status === 'pending')
+            || (task.status === 'blocked' && task.review.status === 'unverified');
         const handoffOverlay = handoffPosture.state === 'pending'
             ? {
                 action: 'task claim',
@@ -2843,6 +3375,15 @@ export class WorkflowService {
                     state: 'pending',
                     targetActor: handoffPosture.targetActor,
                     eventId: handoffPosture.latestEvent.eventId,
+                    credentialRecovery: {
+                        action: 'task handoff-replace',
+                        when: 'claim credential is unavailable',
+                        requiredActor: handoffPosture.latestEvent.actor,
+                        targetActor: handoffPosture.targetActor,
+                        grantId: handoffPosture.latestEvent.grantId,
+                        expectedRevision: task.revision,
+                        invalidatesPriorCredential: true,
+                    },
                 },
             }
             : handoffPosture.state === 'claimed'
@@ -2865,6 +3406,63 @@ export class WorkflowService {
                         },
                     }
                     : {};
+        const correctiveReplanOverlay = (posture) => {
+            const evaluation = evaluateTaskCorrectiveReplanAvailability(task, posture);
+            const writerLease = inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root);
+            const command = handoffPosture.state === 'claimed'
+                ? 'task corrective-yield'
+                : writerLease
+                    ? 'doctor'
+                    : 'task corrective-replan-prepare';
+            if (evaluation.allowed && handoffPosture.state === 'none' && writerLease) {
+                const navigation = correctiveReplanNavigation(evaluation);
+                return {
+                    action: command,
+                    blockedAction: 'task corrective-replan-prepare',
+                    stepId: posture.stepId,
+                    navigation: {
+                        kind: 'blocked',
+                        transitionId: navigation.transitionId,
+                        semanticFingerprint: navigation.semanticFingerprint,
+                        command: navigation.command,
+                        blockingGuardIds: ['task.corrective-replan.no-writer-lease'],
+                        pendingInputGuardIds: navigation.pendingInputGuardIds,
+                        reasonCode: 'ACTIVE_WRITER_LEASE',
+                    },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: 'The active non-C1 writer lease must expire and be explicitly repaired before corrective replan preparation.',
+                        writerLease: {
+                            owner: writerLease.owner,
+                            expiresAt: writerLease.expiresAt,
+                        },
+                    },
+                };
+            }
+            return evaluation.allowed
+                ? {
+                    action: command,
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: { ...correctiveReplanNavigation(evaluation), command },
+                    correctiveDecisionGate: {
+                        attemptCount: posture.attemptCount,
+                        decision: posture.correctiveDecision?.decision ?? null,
+                        decisionEventId: posture.correctiveDecision?.eventId ?? null,
+                        requiredAction: handoffPosture.state === 'claimed'
+                            ? 'Yield the exact C1 claim and writer lease before preparing replacement authority.'
+                            : 'Prepare a state-bound candidate, confirm the Human gate, then execute its exact receipt.',
+                    },
+                }
+                : {
+                    action: 'doctor',
+                    blockedAction: 'task plan-set',
+                    stepId: posture.stepId,
+                    navigation: correctiveReplanBlockedNavigation(evaluation),
+                };
+        };
         let guardedCorrectiveOverlay = {};
         if (remediationModeRecovery) {
             guardedCorrectiveOverlay = {
@@ -2883,7 +3481,12 @@ export class WorkflowService {
                 },
             };
         }
-        if (!remediationModeRecovery && !strictStepReviewStep && guardedCorrectivePosture) {
+        if (!remediationModeRecovery && guardedCorrectivePosture === null && catalogCorrectiveReplanPosture) {
+            guardedCorrectiveOverlay = correctiveReplanOverlay(catalogCorrectiveReplanPosture);
+        }
+        if (!remediationModeRecovery
+            && guardedCorrectivePosture
+            && (!strictStepReviewStep || guardedCorrectivePosture.posture === 'replan-required')) {
             switch (guardedCorrectivePosture.posture) {
                 case 'decision-required':
                     if (guardedCorrectivePosture.correctiveDecision
@@ -2958,16 +3561,7 @@ export class WorkflowService {
                     };
                     break;
                 case 'replan-required':
-                    guardedCorrectiveOverlay = {
-                        action: 'task plan-set',
-                        stepId: guardedCorrectivePosture.stepId,
-                        correctiveDecisionGate: {
-                            attemptCount: guardedCorrectivePosture.attemptCount,
-                            decision: guardedCorrectivePosture.correctiveDecision?.decision ?? null,
-                            decisionEventId: guardedCorrectivePosture.correctiveDecision?.eventId ?? null,
-                            requiredAction: 'Record an actual new Plan posture before another remediation run.',
-                        },
-                    };
+                    guardedCorrectiveOverlay = correctiveReplanOverlay(guardedCorrectivePosture);
                     break;
                 case 'split-required':
                     {
@@ -3051,6 +3645,30 @@ export class WorkflowService {
                     strictStepReview: {
                         reviewRequired: true,
                         completionCommit: strictStepReviewStep.evidence.commitSha,
+                        infrastructureFailures: strictReviewInfrastructureFailures,
+                        maxLocalInfrastructureFailures: MAX_STRICT_REVIEW_INFRASTRUCTURE_FAILURES,
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task step-review-packet',
+                            recordCommand: 'task step-review-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
+                    },
+                }
+                : {}),
+            ...(strictTaskReviewRequired
+                ? {
+                    strictTaskReview: {
+                        reviewRequired: true,
+                        localInfrastructureFailureObserved: task.review.status === 'unverified',
+                        recommendedMode: 'external-sealed',
+                        externalSealedReview: {
+                            packetCommand: 'task review-packet',
+                            recordCommand: 'task review-sealed-record',
+                            reviewerMustUseSeparateChat: true,
+                            repositorySealRequired: true,
+                        },
                     },
                 }
                 : {}),
@@ -3104,6 +3722,12 @@ export class WorkflowService {
             exactInclusionRequired: true,
             briefHash: task.briefHash,
             knowledgeMap: knowledgeSummary(map),
+            planRiskAuditContract: {
+                required: true,
+                option: '--risk-audit-file',
+                atomicWithPlanSet: true,
+                plannerAuditorSeparationRequired: true,
+            },
         };
     }
     assertTaskContextChangeAllowed(task) {
@@ -3183,6 +3807,22 @@ export class WorkflowService {
             policyHash: grant.policyHash,
         }));
     }
+    findDelegatedContextRefreshOwner(projectId, tasks, milestonesById, approved, inspected) {
+        for (const task of tasks) {
+            if (!taskIsActionableFromRepositoryNext(task, milestonesById)
+                || !task.planHash
+                || !taskCanRebindKnowledge(task)
+                || this.taskHasTerminalCorrectiveDecision(task))
+                continue;
+            const assessment = assessDelegatedKnowledgeRefresh(approved, inspected, task, this.store.hashArtifact(this.store.taskRoot(projectId, task.id), 'plan.md'));
+            if (!assessment.eligible)
+                continue;
+            const options = this.delegatedContextRefreshOptions(projectId, task, inspected, assessment.mode);
+            if (options.length > 0)
+                return { task, assessment, options };
+        }
+        return null;
+    }
     assertPlanBoundedSupportingSourceGrant(projectId, grantId, actor, task) {
         const grant = this.store.readDelegation(projectId, grantId);
         if (!task.milestoneId || grant.scope.kind !== 'milestone' || grant.scope.id !== task.milestoneId) {
@@ -3252,6 +3892,14 @@ export class WorkflowService {
             ? milestone
             : readMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
     }
+    listMilestonesObserved(projectId, milestones, posture) {
+        if (!posture)
+            return milestones;
+        const grandfatheredMilestones = new Set(posture.terminalMilestones.map((milestone) => `${milestone.milestoneId}:${milestone.revision}:${milestone.status}`));
+        return milestones.map((milestone) => (grandfatheredMilestones.has(`${milestone.id}:${milestone.revision}:${milestone.status}`)
+            ? milestone
+            : inspectMilestoneWithIntegrity(this.store, projectId, milestone.id, (taskId) => this.store.readTask(projectId, taskId), () => this.store.listTasks(projectId))));
+    }
     taskGitNavigationOverride(task) {
         if (task.status !== 'merging' || task.workspaceOwner !== 'local' || !task.baseCommit || !task.taskBranch) {
             return null;
@@ -3277,14 +3925,44 @@ export class WorkflowService {
         if (!action)
             return next;
         const policy = gitMutationPolicyForAction(task, action);
-        const claimedC1Posture = readTaskC1Posture(this.store, task).state === 'claimed';
+        const c1Posture = readTaskC1Posture(this.store, task);
+        const claimedC1Posture = c1Posture.state === 'claimed';
         const writerTokenContract = writerTokenContractForAction(action, claimedC1Posture);
+        const activeLease = writerTokenContract
+            ? inspectRawWriterLease(this.store.lockRoot(task.projectId), task.id, this.store.root)
+            : null;
+        const writerCredentialRecoveryActor = this.writerCredentialRecoveryActor(task, action, claimedC1Posture ? c1Posture.claimant : null, activeLease?.owner ?? null);
+        const writerCredentialRecovery = writerTokenContract && writerCredentialRecoveryActor
+            ? {
+                action: 'task writer-credential-replace',
+                when: 'the active writer credential is unavailable',
+                requiredActor: writerCredentialRecoveryActor,
+                expectedRevision: task.revision,
+                invalidatesPriorCredential: true,
+                acquiresLeaseWhenAbsent: true,
+            }
+            : null;
         return {
             ...next,
             ...(policy ? { gitMutationPolicy: policy } : {}),
             ...(writerTokenContract ? { writerTokenContract } : {}),
+            ...(writerCredentialRecovery ? { writerCredentialRecovery } : {}),
         };
     }
+    writerCredentialRecoveryActor(task, action, claimedActor, activeLeaseOwner) {
+        if (claimedActor)
+            return claimedActor;
+        if (activeLeaseOwner)
+            return activeLeaseOwner;
+        const authorizationKind = ['task merge', 'task merge-confirm'].includes(action)
+            ? 'final_acceptance'
+            : ['task step-complete', 'task submit'].includes(action)
+                ? 'execution'
+                : null;
+        if (!authorizationKind)
+            return null;
+        return [...task.authorizations].reverse().find((authorization) => authorization.kind === authorizationKind && authorization.decision === 'approved')?.actor ?? null;
+    }
     describeMilestoneInitialAssembly(projectId, milestone, tasks) {
         const assessment = assessMilestoneInitialAssembly({
             store: this.store,
@@ -3325,6 +4003,12 @@ export class WorkflowService {
             actor,
         });
     }
+    publicWriterLeaseDiagnostic(lease) {
+        return {
+            ...toPublicWriterLease(lease, this.now()),
+            tokenFingerprint: createHash('sha256').update(lease.token).digest('hex').slice(0, 16),
+        };
+    }
     proveWriterLeaseTokenForHandoff(context, taskId, writerToken) {
         const currentLease = context.locks.inspect(taskId);
         if (!currentLease) {
@@ -3414,9 +4098,12 @@ export class WorkflowService {
             storedKnowledgeMapHash: storedHash,
         });
     }
-    inspectAdoptionPreparation(identity, tasks, milestones) {
-        const locks = new WriterLockManager(this.store.lockRoot(identity.projectId), this.now);
-        const currentPosture = readCurrentAdoptionPosture(this.store, identity.projectId);
+    inspectAdoptionPreparation(identity, tasks, milestones, observedLeases, observedPosture) {
+        const leases = observedLeases
+            ?? new WriterLockManager(this.store.lockRoot(identity.projectId), this.now, this.store.root).list();
+        const currentPosture = observedPosture === undefined
+            ? readCurrentAdoptionPosture(this.store, identity.projectId)
+            : observedPosture;
         if (currentPosture) {
             assertAdoptionBaselinePreserved(currentPosture, tasks, milestones);
         }
@@ -3429,7 +4116,7 @@ export class WorkflowService {
             tasks,
             milestones,
             sidecarInventory: this.collectAdoptionSidecarInventory(identity.projectId, tasks, milestones),
-            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, locks.list()),
+            blockers: this.computeAdoptionBoundaryBlockers(identity, tasks, leases),
             now: this.now(),
         }, currentPosture);
     }
@@ -4046,11 +4733,14 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
     const claimedC1LeaseBound = [
         'task run',
         'task step-review',
+        'task step-review-record',
         'task review-record',
         'task review-launch',
+        'task review-sealed-record',
         'task corrective-decision-recover',
         'task remediation-mode-recover',
         'task corrective-decision',
+        'task corrective-yield',
         'task handoff',
         'task handoff-prepare',
         'task handback',
@@ -4064,7 +4754,26 @@ function writerTokenContractForAction(action, claimedC1Posture = false) {
         option: '--writer-token',
         source: 'active-writer-lease',
         sensitive: true,
+        renewalDisposition: 'reuse-presented-token',
+        tokenReissuedOnRenewal: false,
+    };
+}
+function observationPreflightBlockers(observation) {
+    const messages = {
+        PROJECT_REGISTRATION_MISSING: 'Workflow project registration is missing.',
+        PROJECT_REPOSITORY_ROOT_UNBOUND: 'The current repository root is not bound to the Workflow project.',
+        PROJECT_RECOVERY_REQUIRED: 'A project transaction requires explicit recovery.',
+        MILESTONE_RECOVERY_REQUIRED: 'A Milestone transaction requires explicit recovery.',
+        TASK_RECOVERY_REQUIRED: 'A Task corrective-replan transaction requires explicit recovery.',
+        TASK_TRANSACTION_INTEGRITY_FAILED: 'A Task transaction journal failed integrity validation.',
+        TASK_OPERATION_IN_PROGRESS: 'A Core Task operation is in progress.',
+        STALE_TASK_OPERATION: 'A stale Core Task operation requires bounded repair.',
+        ADOPTION_MISSING: 'Workflow lifecycle adoption is missing.',
     };
+    return observation.reasonCodes.flatMap((reasonCode) => {
+        const message = messages[reasonCode];
+        return message ? [message] : [];
+    });
 }
 function knowledgeSummary(map) {
     return {