immune-brain 4.4.1 → 4.6.0

package/plugins/immune-brain/runtime/github_issue_tracker.ts

@@ -103,6 +103,19 @@ export interface InitiativeHistoricalChild {
 	binding: InitiativeAmendmentBinding;
 }
 
+/**
+ * How much remote effect the caller may believe, stated explicitly instead of
+ * inferred from the status code.
+ *
+ * `confirmed` means every step settled and was read back. `uncertain` means the
+ * caller may not assume zero writes: the call must re-read exact ownership,
+ * topology and intent-hash state before replaying the same approved manifest.
+ * The layer never claims "zero writes" itself, because a status code cannot
+ * prove the absence of a remote effect; only the transport's own call record
+ * can, and a caller that needs that decides from its own readback.
+ */
+export type PublicationWriteState = "confirmed" | "uncertain";
+
 export interface GithubInitiativePublicationResult {
 	contract: "immune_brain/github_initiative_publication/v1";
 	operation: "publish-initiative";
@@ -116,6 +129,12 @@ export interface GithubInitiativePublicationResult {
 		issue_url?: string;
 		node_id?: string;
 	}>;
+	/** Truthful effect reporting for the whole batch. */
+	write_state: PublicationWriteState;
+	/** Task ids whose step is confirmed written and read back. */
+	confirmed_steps: string[];
+	/** Task ids whose step is not yet confirmed. */
+	pending_steps: string[];
 	execution?: {
 		recommended_first_task_id: string;
 		recommended_first_issue_number: number;
@@ -170,6 +189,8 @@ export type TrackerOperation =
 		risk: "routine" | "material" | "critical";
 		acceptance: Array<{ id: string; summary: string }>;
 		projection?: TaskProjection;
+		/** The canonical TaskIntent content hash this Task was prepared from. */
+		intent_hash?: string;
 	}
 	| {
 		op: "mark-terminal";
@@ -187,7 +208,18 @@ export interface GhExecution {
 }
 
 export interface GhTransport {
-	run(args: string[], options?: { cwd?: string; stdin?: string }): Promise<GhExecution>;
+	run(args: string[], options?: { cwd?: string; stdin?: string; signal?: { readonly aborted: boolean } }): Promise<GhExecution>;
+}
+
+/**
+ * External cancellation for a multi-step operation. There is no cumulative
+ * deadline: one publication call is a finite step sequence that stops at its
+ * first failed call, and each call keeps its own per-call timeout. Only the
+ * caller's abort signal is forwarded to every call.
+ */
+export interface OperationCancellation {
+	/** Optional external cancellation signal (user cancel / host abort). */
+	signal?: { readonly aborted: boolean };
 }
 
 interface RepositoryInfo {
@@ -238,7 +270,7 @@ function countLiteral(value: string, needle: string): number {
 	return count;
 }
 
-function marker(name: "repo-id" | "initiative-id" | "task-id" | "slice-id", value: string | number): string {
+function marker(name: "repo-id" | "initiative-id" | "task-id" | "slice-id" | "intent-hash", value: string | number): string {
 	return `<!-- immune-brain:${name}=${value} -->`;
 }
 
@@ -436,6 +468,10 @@ function ghFailure(
 ): GithubTrackerResult {
 	const retryable = execution.timed_out
 		|| /timeout|timed out|network|connection|temporar|rate limit|502|503|504/i.test(execution.stderr);
+	// A transport failure is the one class where re-reading the approved state and
+	// replaying the same manifest is the correct recovery, so that action is
+	// attached here, at the origin. Any other failure keeps its own message as
+	// the single action; nothing generic is layered on top of it.
 	return result(
 		operation,
 		retryable ? "retryable_failure" : "permanent_failure",
@@ -449,6 +485,18 @@ export function createGhTransport(binary = "gh"): GhTransport {
 			return new Promise((complete) => {
 				let stdout: Buffer = Buffer.alloc(0);
 				let stderr: Buffer = Buffer.alloc(0);
+				// A cancelled operation never starts another remote call.
+				if (options.signal?.aborted) {
+					complete({
+						exit_code: 1,
+						stdout: "",
+						stderr: "operation cancelled by the caller",
+						timed_out: true,
+						output_exceeded: false,
+					});
+					return;
+				}
+				const remaining = GH_TIMEOUT_MS;
 				let timedOut = false;
 				let outputExceeded = false;
 				let timer: ReturnType<typeof setTimeout> | undefined;
@@ -496,7 +544,7 @@ export function createGhTransport(binary = "gh"): GhTransport {
 				timer = setTimeout(() => {
 					timedOut = true;
 					child.kill("SIGKILL");
-				}, GH_TIMEOUT_MS);
+				}, remaining);
 				child.once("close", (code) => { finish(code ?? 1); });
 				try {
 					childIn.end(options.stdin ?? "");
@@ -615,6 +663,73 @@ function initiativeLookup(issues: GithubIssue[], repositoryId: number, initiativ
 	return findIssue(issues, [initiative, KIND_INITIATIVE_MARKER], [marker("repo-id", repositoryId), initiative]);
 }
 
+/**
+ * The published Intent identity marker, when the Child carries one. `null` means
+ * this Child was published before the marker existed: an upgraded tracker still
+ * converges it (the marker is additive), which keeps a previously published
+ * batch idempotently replayable across the upgrade. It is never invented
+ * locally: the value is the canonical hash of the Intent the Child was prepared
+ * from.
+ */
+/** Any published-identity markers on the body, in order. */
+function publishedIntentHashMarkers(body: string): string[] {
+	return [...body.matchAll(/<!-- immune-brain:intent-hash=([A-Za-z0-9][A-Za-z0-9._:-]{0,127}) -->/g)].map((match) => match[1]);
+}
+
+/**
+ * The published Intent identity of a Child, as three distinct states:
+ *
+ * - `absent`: published before the marker existed. It is a pre-upgrade
+ *   publication and still converges, because the marker is additive.
+ * - `bound`: exactly one well-formed marker. It must agree with the Intent
+ *   being published.
+ * - `ambiguous`: two or more markers. The Child states several conflicting
+ *   identities, so nothing can be trusted about which Intent it came from; it
+ *   fails closed rather than being read as `absent`.
+ *
+ * Collapsing `ambiguous` into `absent` would let a Child carry both the correct
+ * and a stale hash and still pass every check, so the three states are kept
+ * separate everywhere the identity is read.
+ */
+type PublishedIntentIdentity =
+	| { kind: "absent" }
+	| { kind: "bound"; hash: string }
+	| { kind: "ambiguous"; hashes: string[] };
+
+function publishedIntentIdentity(body: string): PublishedIntentIdentity {
+	const hashes = publishedIntentHashMarkers(body);
+	if (hashes.length === 0) return { kind: "absent" };
+	if (hashes.length === 1) return { kind: "bound", hash: hashes[0] };
+	return { kind: "ambiguous", hashes };
+}
+
+/** The identity mismatch message for one Child, or null when it is acceptable. */
+function publishedIntentMismatch(body: string, taskId: string, expected: string | undefined): string | null {
+	const identity = publishedIntentIdentity(body);
+	if (identity.kind === "ambiguous")
+		return `published Task ${taskId} carries ${identity.hashes.length} conflicting intent-hash markers; its published Intent identity is ambiguous`;
+	if (identity.kind === "absent" || expected === undefined) return null;
+	if (identity.hash !== expected)
+		return `published Task ${taskId} was published from a different TaskIntent revision; the published identity no longer matches the Intent being published`;
+	return null;
+}
+
+/**
+ * Bodies compared for drift, ignoring the optional published-identity marker.
+ *
+ * The identity marker is additive, so a Child published before it existed has
+ * none and must still compare equal here; the identity itself is checked
+ * separately, and a multiply-marked body is rejected outright rather than
+ * having its markers stripped and ignored.
+ */
+function sameTrackedBody(current: string, expected: string): boolean {
+	return stripPublishedIntentHash(current) === stripPublishedIntentHash(expected);
+}
+
+function stripPublishedIntentHash(body: string): string {
+	return body.replace(/<!-- immune-brain:intent-hash=[A-Za-z0-9][A-Za-z0-9._:-]{0,127} -->\n?/g, "");
+}
+
 function ownershipMarkerValue(body: string, name: "initiative-id" | "slice-id" | "task-id"): string | null {
 	const values = [...body.matchAll(new RegExp(`<!-- immune-brain:${name}=([A-Za-z0-9][A-Za-z0-9._-]{0,127}) -->`, "g"))];
 	return values.length === 1 ? values[0][1] : null;
@@ -858,7 +973,7 @@ function createInitiativeBody(
 		KIND_INITIATIVE_MARKER,
 		marker("repo-id", repository.id),
 		marker("initiative-id", operation.initiative_id),
-	].join("\n")}\n\n${provenance}## How to use this Issue\n\n- Edit planning prose and Slice ordering directly after creation.\n- Keep each Slice marker attached to exactly one stable Slice entry.\n- The tracker never rewrites or closes this Parent after creation; the tracker never changes or closes it automatically.\n\n## Problem\n\n${publicText(projection.problem ?? "The Initiative addresses the bounded delivery described below.", "projection.problem")}\n\n## Result\n\n${publicText(projection.result ?? operation.goal, "projection.result")}\n\n## Initiative design\n\n${publicText(projection.design ?? "Each Child preserves the shared Initiative decisions and boundaries recorded here.", "projection.design")}\n\n## Decisions\n\n${listText(projection.decisions, "- No additional Initiative decisions recorded.")}\n\n## Testing strategy\n\n${publicText(projection.testing_strategy ?? "Each Child closes from its focused acceptance verification.", "projection.testing_strategy")}\n\n## Out of scope\n\n${listText(projection.out_of_scope, "- Unrelated work outside this Initiative.")}\n\n## Slices\n\n${operation.slices.length + historicalSlices.length === 0 ? "No Slices recorded yet." : [...historicalSlices, ...operation.slices.map((slice) => `- [ ] ${marker("slice-id", slice.id)} **${slice.id}**: ${slice.result ?? slice.goal}${slice.blocked_by?.length ? ` (blocked by: ${slice.blocked_by.join(", ")})` : ""}`)].join("\n")}\n\n${ISSUE_FOOTER}\n`;
+	].join("\n")}\n\n${provenance}## How to use this Issue\n\n- Edit planning prose and Slice ordering directly after creation.\n- Keep each Slice marker attached to exactly one stable Slice entry.\n- The tracker never rewrites this Parent after creation; the tracker closes it as completed once every Slice Child is completed, and never closes it otherwise.\n\n## Problem\n\n${publicText(projection.problem ?? "The Initiative addresses the bounded delivery described below.", "projection.problem")}\n\n## Result\n\n${publicText(projection.result ?? operation.goal, "projection.result")}\n\n## Initiative design\n\n${publicText(projection.design ?? "Each Child preserves the shared Initiative decisions and boundaries recorded here.", "projection.design")}\n\n## Decisions\n\n${listText(projection.decisions, "- No additional Initiative decisions recorded.")}\n\n## Testing strategy\n\n${publicText(projection.testing_strategy ?? "Each Child closes from its focused acceptance verification.", "projection.testing_strategy")}\n\n## Out of scope\n\n${listText(projection.out_of_scope, "- Unrelated work outside this Initiative.")}\n\n## Slices\n\n${operation.slices.length + historicalSlices.length === 0 ? "No Slices recorded yet." : [...historicalSlices, ...operation.slices.map((slice) => `- [ ] ${marker("slice-id", slice.id)} **${slice.id}**: ${slice.result ?? slice.goal}${slice.blocked_by?.length ? ` (blocked by: ${slice.blocked_by.join(", ")})` : ""}`)].join("\n")}\n\n${ISSUE_FOOTER}\n`;
 }
 
 async function createInitiative(
@@ -937,6 +1052,10 @@ function childBody(
 		marker("initiative-id", operation.initiative_id),
 		marker("slice-id", operation.slice_id),
 		marker("task-id", operation.task_id),
+		// The approved Intent identity travels with the published Child, so an
+		// idempotent replay can compare against what was actually published
+		// instead of against whatever bytes it happens to read this time.
+		...(operation.intent_hash ? [marker("intent-hash", operation.intent_hash)] : []),
 	].join("\n")}\n\n## Parent\n\n| Initiative | \`${operation.initiative_id}\` |\n| Parent Issue | [#${parent.number}](${parent.url}) |\n| Slice | \`${operation.slice_id}\` |\n| Risk | \`${operation.risk}\` |\n\n## Current behavior\n\n${publicText(projection.current_behavior ?? "The current behavior is defined by the repository's existing contract.", "projection.current_behavior")}\n\n## Desired behavior\n\n${publicText(projection.desired_behavior ?? projection.result ?? operation.goal, "projection.desired_behavior")}\n\n## Key interfaces\n\n${listText(projection.key_interfaces, "- Canonical TaskIntent acceptance and Kernel lifecycle remain authoritative.")}\n\n## Acceptance criteria\n\n${acceptance}\n\n## Verification\n\n${publicText(projection.verification ?? "Run the focused acceptance verification declared by the TaskIntent.", "projection.verification")}\n\n## Blocked by\n\n${projection.blocked_by?.length ? projection.blocked_by.map((id) => `- \`${identifier(id, "blocked_by task_id")}\``).join("\n") : "None"}\n\n## Out of scope\n\n${listText(projection.out_of_scope, "- Scope not declared by the validated TaskIntent.")}\n\n## Agent handoff\n\n${publicText(projection.agent_handoff ?? "Implement only the bounded TaskIntent result and run the focused checks. Do not widen scope or treat GitHub as authorization.", "projection.agent_handoff")}\n\n${ISSUE_FOOTER}\n`;
 }
 
@@ -946,12 +1065,8 @@ interface AmendmentExecutionContext {
 	pendingContent: Map<string, { title: string; body: string }>;
 	/** Approved final Parent title/body. */
 	parent: { title: string; body: string };
-	/** Approved bound Parent issue number. */
-	parentIssueNumber: number;
 	/** Historical Slice lines derived from the approved Parent baseline (exact bytes). */
 	historicalSlices: string[];
-	/** Historical dependency database IDs and terminal state_reason snapshotted before any write. */
-	historicalRelations: Map<string, { blocked_by: number[]; state_reason: string | null }>;
 }
 
 /**
@@ -1024,9 +1139,7 @@ function approvedAmendmentContent(
 			title: initiativeIssueTitle(parent.initiative_id, parent.projection),
 			body: parentBody,
 		},
-		parentIssueNumber: parentIssue.number,
 		historicalSlices,
-		historicalRelations: new Map(),
 	};
 }
 
@@ -1068,66 +1181,12 @@ function baselineHistoricalSlices(parentBaselineBody: string, amendedSliceIds: S
 	return lines;
 }
 
-/** Edit an open Initiative Parent's title/body to the approved amendment content. */
-async function amendInitiativeParent(
-	root: string,
-	gh: GhTransport,
-	operation: Extract<TrackerOperation, { op: "create-initiative" }>,
-	source: RepositorySnapshot,
-	binding: InitiativeAmendmentBinding,
-	context: AmendmentExecutionContext,
-): Promise<GithubTrackerResult> {
-	const lookup = (issues: GithubIssue[]) => initiativeLookup(issues, source.repository.id, operation.initiative_id);
-	const body = context.parent.body;
-	const oversized = bodyLimitFailure(operation.op, body);
-	if (oversized) return oversized;
-	const title = context.parent.title;
-	// Re-read the Parent immediately before writing: earlier topology and
-	// historical-dependency reads may have raced a concurrent user edit.
-	const reread = await snapshot(root, gh, operation.op);
-	if ("contract" in reread) return reread;
-	const found = lookup(reread.issues);
-	if (found.kind !== "found")
-		return result(operation.op, "permanent_failure", "an amendment requires the Initiative Parent to already exist");
-	if (found.issue.state !== "open")
-		return result(operation.op, "ambiguous_remote_state", "an amendment requires the Initiative Parent to remain open", found.issue);
-	if (binding.issue_number !== found.issue.number)
-		return result(operation.op, "ambiguous_remote_state", `amendment Parent is bound to Issue #${binding.issue_number} but observed Issue #${found.issue.number}`, found.issue);
-	if (found.issue.body === body && found.issue.title === title && !labelMutationArgs(found.issue.labels, []).length)
-		return result(operation.op, "already_current", "Initiative Issue already carries the requested amended content", found.issue);
-	// Content that already matches the approved final bytes still converges labels;
-	// anything else must still be the approved amendment baseline.
-	if ((found.issue.body !== body || found.issue.title !== title)
-		&& (found.issue.body !== binding.body || found.issue.title !== binding.title))
-		return result(operation.op, "ambiguous_remote_state", "Initiative Parent changed since the approved amendment baseline", found.issue);
-	// The Parent carries no Task state labels: any managed label observed on it is
-	// drift and is removed by the same edit that writes the amended content.
-	const labelArgs = labelMutationArgs(found.issue.labels, []);
-	const edited = await gh.run([
-		"issue", "edit", String(found.issue.number), "--repo", source.repository.name_with_owner,
-		"--title", title,
-		"--body-file", "-",
-		...labelArgs,
-	], { cwd: root, stdin: body });
-	if (edited.exit_code !== 0 || edited.output_exceeded) return ghFailure(operation.op, edited, "Initiative amendment edit failed");
-	const refreshed = await snapshot(root, gh, operation.op);
-	if ("contract" in refreshed) return refreshed;
-	const confirmed = lookup(refreshed.issues);
-	if (confirmed.kind !== "found") return result(operation.op, "ambiguous_remote_state", "Initiative Parent became ambiguous after amendment", found.issue);
-	if (MANAGED_ISSUE_LABELS.some((label) => confirmed.issue.labels.includes(label)))
-		return result(operation.op, "retryable_failure", "Initiative amendment did not converge to an unlabeled Parent", confirmed.issue);
-	return confirmed.issue.body === body && confirmed.issue.title === title
-		? result(operation.op, "updated", "Initiative Issue updated with approved amendment content", confirmed.issue)
-		: result(operation.op, "retryable_failure", "Initiative amendment did not converge to the requested title and body", confirmed.issue);
-}
 
 async function upsertTask(
 	root: string,
 	gh: GhTransport,
 	operation: Extract<TrackerOperation, { op: "upsert-task" }>,
 	source: RepositorySnapshot,
-	pendingBinding: InitiativeAmendmentBinding | undefined | null = null,
-	amendmentContext: AmendmentExecutionContext | undefined = undefined,
 ): Promise<GithubTrackerResult> {
 	const labelFailure = await labelAvailabilityFailure(root, gh, source.repository, desiredTaskLabels(operation));
 	if (labelFailure) return labelFailure;
@@ -1145,8 +1204,6 @@ async function upsertTask(
 	const lookup = (issues: GithubIssue[]) => taskLookup(issues, source.repository.id, operation.task_id);
 	const found = lookup(source.issues);
 	if (found.kind === "ambiguous") return result(operation.op, "ambiguous_remote_state", found.message);
-	if (found.kind === "missing" && pendingBinding !== null && pendingBinding !== undefined)
-		return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} is bound to Issue #${pendingBinding.issue_number} but that Issue no longer holds its Task marker; amend the binding or restore the marker instead of recreating`, parent.issue);
 	const blockerIds = operation.projection?.blocked_by ?? [];
 	const blockers: GithubIssue[] = [];
 	for (const blockerId of blockerIds) {
@@ -1167,40 +1224,6 @@ async function upsertTask(
 	let createdChild = false;
 	let labelsConverged = false;
 	if (found.kind === "missing") {
-		// Pre-create re-read (amendment path): a concurrent writer may have already
-		// created this unbound Task between the initial snapshot and our create — the
-		// same resumable-creation contract applies before we issue any write, so we
-		// fail closed on divergent content instead of issuing a duplicate create.
-		if (amendmentContext !== undefined) {
-			const reRead = await snapshot(root, gh, operation.op);
-			if ("contract" in reRead) return reRead;
-			// The re-read snapshot must also still hold the amendment's Parent exactly
-			// as approved: a Parent closed or edited after the initial snapshot fails
-			// closed here, before any Child create (avoiding an avoidable remote write
-			// that the post-create attachment guard would otherwise reject).
-			const reReadParent = initiativeLookup(reRead.issues, reRead.repository.id, operation.initiative_id);
-			if (reReadParent.kind !== "found")
-				return result(operation.op, "ambiguous_remote_state", reReadParent.kind === "ambiguous" ? reReadParent.message : "amendment Parent is not observable before creating a new Child", parent.issue);
-			if (reReadParent.issue.number !== amendmentContext.parentIssueNumber)
-				return result(operation.op, "ambiguous_remote_state", `amendment Parent is bound to Issue #${amendmentContext.parentIssueNumber} but observed Issue #${reReadParent.issue.number} before creating a new Child`, reReadParent.issue);
-			if (reReadParent.issue.state !== "open")
-				return result(operation.op, "ambiguous_remote_state", "amendment Parent is no longer open before creating a new Child", reReadParent.issue);
-			if (amendmentContext.parent.title !== reReadParent.issue.title || amendmentContext.parent.body !== reReadParent.issue.body)
-				return result(operation.op, "ambiguous_remote_state", "amendment Parent content changed before creating a new Child", reReadParent.issue);
-			if (sliceCount(reReadParent.issue.body, operation.slice_id) !== 1)
-				return result(operation.op, "ambiguous_remote_state", `Parent Issue #${reReadParent.issue.number} lost its exact Slice marker ${operation.slice_id} before creating a new Child`, reReadParent.issue);
-			const raced = lookup(reRead.issues);
-			if (raced.kind === "ambiguous") return result(operation.op, "ambiguous_remote_state", raced.message);
-			if (raced.kind === "found") {
-				const approved = amendmentContext.pendingContent.get(operation.task_id);
-				const resumable = approved !== undefined
-					&& raced.issue.state === "open"
-					&& carriesApprovedContent(raced.issue.title, raced.issue.body, approved);
-				if (!resumable)
-					return result(operation.op, "ambiguous_remote_state", `new pending Task ${operation.task_id} is unbound but Issue #${raced.issue.number} already exists with divergent content; bind it to amend`, raced.issue);
-				return updatePendingChild(root, gh, reRead, operation, raced.issue, undefined, blockers, approved, amendmentContext);
-			}
-		}
 		const mutation = await gh.run([
 			"issue", "create", "--repo", source.repository.name_with_owner,
 			"--title", title,
@@ -1218,61 +1241,19 @@ async function upsertTask(
 		}
 		if (created.issue.body !== body || created.issue.title !== title)
 			return result(operation.op, "retryable_failure", "Task Issue did not converge to the requested title and body", created.issue);
-		if (amendmentContext !== undefined) {
-			// Amendment unbound new Child: creation converged, but the Child must
-			// still be open — a concurrent close between create and read fails closed
-			// instead of attaching and wiring dependencies onto closed work.
-			if (created.issue.state !== "open")
-				return result(operation.op, "ambiguous_remote_state", `new pending Task ${operation.task_id} (Issue #${created.issue.number}) is not open after creation`, created.issue);
-			// Route through the amendment convergence path so attachment (R4
-			// re-attach) and every dependency write carry the same pre-write
-			// revalidation as bound pending Children.
-			return updatePendingChild(root, gh, source, operation, created.issue, undefined, blockers, amendmentContext.pendingContent.get(operation.task_id), amendmentContext);
-		}
 		child = created.issue;
 		createdChild = true;
 	} else {
 		const owned = ownedTaskLookup(source.issues, source.repository.id, operation.task_id, operation.initiative_id, operation.slice_id);
 		if (owned.kind !== "found") return result(operation.op, "ambiguous_remote_state", owned.kind === "ambiguous" ? owned.message : "Task Issue ownership changed during publication", found.issue);
 		child = owned.issue;
-		if (pendingBinding !== null) {
-			if (child.state !== "open")
-				return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} is closed and cannot be amended as pending work`, found.issue);
-			// The bound pending Child must still be the Issue its binding pins (review-5):
-			// a replacement Issue that took over the markers fails closed instead of
-			// being edited or recreated.
-			if (pendingBinding !== undefined && pendingBinding.issue_number !== child.number)
-				return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} is bound to Issue #${pendingBinding.issue_number} but observed Issue #${child.number}`, found.issue);
-			const approvedFinal = amendmentContext?.pendingContent.get(operation.task_id);
-			// A Child left open with a validated terminal suffix (failed terminal close)
-			// counts as approved-final when its suffix-free bytes match the approved bytes.
-			const isFinal = approvedFinal !== undefined && carriesApprovedContent(found.issue.title, found.issue.body, approvedFinal);
-			if (!isFinal) {
-				// Suffix-aware baseline equality: a Child whose remote bytes carry a validated
-				// terminal suffix over the binding baseline (failed terminal close) still
-				// matches its binding, because the suffix is terminal evidence, not drift.
-				const baselineMatches = pendingBinding !== undefined
-					&& pendingBinding.title === found.issue.title
-					&& carriesApprovedContent(found.issue.title, found.issue.body, pendingBinding);
-				if (!baselineMatches)
-					return result(operation.op, "ambiguous_remote_state", `Task ${operation.task_id} changed since the approved amendment baseline`, found.issue);
-			}
-			return updatePendingChild(root, gh, source, operation, child, pendingBinding?.issue_number, blockers, approvedFinal, amendmentContext);
-		}
-		if (amendmentContext !== undefined) {
-			// Amendment unbound Child observed before any write: it is only valid
-			// as the exact approved-final creation of this same batch (resumable
-			// creation); anything else fails closed.
-			const approvedFinal = amendmentContext.pendingContent.get(operation.task_id);
-			const resumable = approvedFinal !== undefined
-				&& child.state === "open"
-				&& carriesApprovedContent(found.issue.title, found.issue.body, approvedFinal);
-			if (!resumable)
-				return result(operation.op, "ambiguous_remote_state", `new pending Task ${operation.task_id} is unbound but Issue #${child.number} already exists with divergent content; bind it to amend`, found.issue);
-			return updatePendingChild(root, gh, source, operation, child, undefined, blockers, approvedFinal, amendmentContext);
-		}
-		if (found.issue.body !== body || found.issue.title !== title)
+		if (!sameTrackedBody(found.issue.body, body) || found.issue.title !== title)
 			return result(operation.op, "permanent_failure", "Task Issue already exists with a different title or Agent Brief; edit the GitHub source or retry the original projection before changing native relations", found.issue);
+		// The published surface records the approved Intent identity. A Child that
+		// carries it must agree exactly; a Child published before the marker
+		// existed has nothing to compare against and still converges.
+		const intentMismatch = publishedIntentMismatch(found.issue.body, operation.task_id, operation.intent_hash);
+		if (intentMismatch) return result(operation.op, "ambiguous_remote_state", intentMismatch, found.issue);
 		// A repeated complete batch is a convergence pass: managed label drift is
 		// repaired here without rewriting content the tracker never owns.
 		const observedLabelArgs = labelMutationArgs(child.labels, desiredTaskLabels(operation));
@@ -1301,8 +1282,10 @@ async function upsertTask(
 	const finalSource = await snapshot(root, gh, operation.op);
 	if ("contract" in finalSource) return finalSource;
 	const finalChild = ownedTaskLookup(finalSource.issues, finalSource.repository.id, operation.task_id, operation.initiative_id, operation.slice_id);
-	if (finalChild.kind !== "found" || finalChild.issue.id !== child.id || finalChild.issue.title !== title || finalChild.issue.body !== body)
+	if (finalChild.kind !== "found" || finalChild.issue.id !== child.id || finalChild.issue.title !== title || !sameTrackedBody(finalChild.issue.body, body))
 		return result(operation.op, "ambiguous_remote_state", "Task Issue changed identity, title, or body during dependency publication", child);
+	const finalIdentityMismatch = publishedIntentMismatch(finalChild.issue.body, operation.task_id, operation.intent_hash);
+	if (finalIdentityMismatch) return result(operation.op, "ambiguous_remote_state", finalIdentityMismatch, child);
 	const finalChildOwnership = await confirmTerminalOwnership(root, gh, operation.op, finalSource, finalChild.issue);
 	if (!("owned" in finalChildOwnership)) return finalChildOwnership;
 	child = finalChild.issue;
@@ -1376,7 +1359,7 @@ async function closeTerminalIssue(
 		: result(operation.op, "retryable_failure", "terminal Issue closure did not converge", found.issue);
 }
 
-async function markTerminal(
+async function markChildTerminal(
 	root: string,
 	gh: GhTransport,
 	operation: Extract<TrackerOperation, { op: "mark-terminal" }>,
@@ -1422,6 +1405,86 @@ async function markTerminal(
 	return closeTerminalIssue(root, gh, operation, refreshed, reread.issue, lookup);
 }
 
+/**
+ * The Parent decision reads only Issue-scoped endpoints (the Parent and its
+ * Sub-issue list), never a repository listing. A failed read or close is a
+ * tracker observation whose single retry action is the same `mark-terminal`;
+ * the Child's terminal closure is already confirmed and stays unchanged.
+ */
+async function closeParentWhenComplete(
+	root: string,
+	gh: GhTransport,
+	operation: Extract<TrackerOperation, { op: "mark-terminal" }>,
+	source: RepositorySnapshot,
+	childResult: GithubTrackerResult,
+): Promise<GithubTrackerResult> {
+	const child = taskLookup(source.issues, source.repository.id, operation.task_id);
+	if (child.kind !== "found") return childResult;
+	const initiativeId = ownershipMarkerValue(child.issue.body, "initiative-id");
+	if (!initiativeId) return childResult;
+	const parentLookup = initiativeLookup(source.issues, source.repository.id, initiativeId);
+	if (parentLookup.kind !== "found") return childResult;
+	const parentNumber = parentLookup.issue.number;
+	const retry = (message: string, status: TrackerStatus = "retryable_failure") =>
+		result(operation.op, status, `Parent #${parentNumber}: ${message}; the Task closure is unchanged, retry the same mark-terminal`, child.issue);
+	const endpoint = `repos/${source.repository.name_with_owner}/issues/${parentNumber}`;
+	const readParent = async (): Promise<GithubIssue | GithubTrackerResult> => {
+		const read = await gh.run(["api", endpoint], { cwd: root });
+		if (read.exit_code !== 0 || read.output_exceeded) {
+			const failed = ghFailure(operation.op, read, "cannot read the Initiative Parent");
+			return retry(failed.message, failed.status);
+		}
+		try {
+			const [issue] = parseIssues(`[${read.stdout}]`);
+			return issue ?? retry("gh returned a malformed Issue", "permanent_failure");
+		} catch (error) {
+			return retry(error instanceof Error ? error.message : String(error), "permanent_failure");
+		}
+	};
+	const parent = await readParent();
+	if ("contract" in parent) return parent;
+	if (parent.state === "closed") return childResult;
+	const listed = await gh.run(["api", "--paginate", "--slurp", `${endpoint}/sub_issues?per_page=100`], { cwd: root });
+	if (listed.exit_code !== 0 || listed.output_exceeded) {
+		const failed = ghFailure(operation.op, listed, "cannot read the Initiative Sub-issues");
+		return retry(failed.message, failed.status);
+	}
+	let children: GithubIssue[];
+	try {
+		children = parseIssues(listed.stdout);
+	} catch (error) {
+		return retry(error instanceof Error ? error.message : String(error), "permanent_failure");
+	}
+	const sliceChildren = children.filter((candidate) =>
+		candidate.body.includes(marker("initiative-id", initiativeId))
+		&& /<!-- immune-brain:slice-id=[^>]+ -->/.test(candidate.body));
+	if (sliceChildren.length === 0
+		|| !sliceChildren.every((candidate) => candidate.state === "closed" && candidate.state_reason === "completed"))
+		return childResult;
+	const close = await gh.run(["issue", "close", String(parentNumber), "--repo", source.repository.name_with_owner, "--reason", "completed"], { cwd: root });
+	const confirmed = await readParent();
+	if ("contract" in confirmed) return confirmed;
+	if (confirmed.state === "closed" && confirmed.state_reason === "completed")
+		return result(operation.op, "updated", `${childResult.message}; Initiative Parent #${parentNumber} closed as completed`, child.issue);
+	if (close.exit_code !== 0 || close.output_exceeded) {
+		const failed = ghFailure(operation.op, close, "Initiative Parent closure failed");
+		return retry(failed.message, failed.status);
+	}
+	return retry("closure did not converge");
+}
+
+async function markTerminal(
+	root: string,
+	gh: GhTransport,
+	operation: Extract<TrackerOperation, { op: "mark-terminal" }>,
+	source: RepositorySnapshot,
+): Promise<GithubTrackerResult> {
+	const terminal = await markChildTerminal(root, gh, operation, source);
+	if (operation.phase !== "done" || (terminal.status !== "updated" && terminal.status !== "already_current") || !terminal.association_found)
+		return terminal;
+	return closeParentWhenComplete(root, gh, operation, source, terminal);
+}
+
 function normalizedList(value: unknown, name: string, max = 2_000): string[] | undefined {
 	if (value === undefined) return undefined;
 	if (!Array.isArray(value)) throw new Error(`${name} must be an array`);
@@ -1535,19 +1598,6 @@ function validateOperation(operation: TrackerOperation): TrackerOperation {
 	};
 }
 
-/** Run one amendment pending Task: create unbound new Children, amend bound drift. */
-async function runAmendmentTaskOperation(
-	root: string,
-	gh: GhTransport,
-	operation: Extract<TrackerOperation, { op: "upsert-task" }>,
-	pendingBinding: InitiativeAmendmentBinding | undefined | null,
-	context: AmendmentExecutionContext | undefined,
-): Promise<GithubTrackerResult> {
-	const absoluteRoot = resolve(root);
-	const source = await snapshot(absoluteRoot, gh, operation.op);
-	if ("contract" in source) return source;
-	return upsertTask(absoluteRoot, gh, operation, source, pendingBinding, context);
-}
 
 export async function runGithubTrackerOperation(
 	root: string,
@@ -1574,21 +1624,58 @@ export async function runGithubTrackerOperation(
 	}
 }
 
-function publicationResult(
+/**
+ * The publication result builder. `plannedTaskIds` is the operation's complete
+ * step set, known before the first remote write; every Task that is not
+ * confirmed is a pending step, so a Parent failure, an early Child failure, or
+ * a post-plan validation refusal still reports every unfinished Task instead of
+ * an empty list.
+ */
+function publicationResultWithPlan(
+	plannedTaskIds: readonly string[],
 	status: TrackerStatus,
 	message: string,
 	initiative?: GithubTrackerResult,
 	tasks: GithubInitiativePublicationResult["tasks"] = [],
 	execution?: GithubInitiativePublicationResult["execution"],
 ): GithubInitiativePublicationResult {
+	const settledTaskSteps = tasks.filter((task) => isSuccessfulTrackerStatus(task.status));
+	const confirmedIds = new Set(settledTaskSteps.map((task) => task.task_id));
+	const planned = plannedTaskIds.length > 0 ? plannedTaskIds : tasks.map((task) => task.task_id);
+	const pendingSteps = planned.filter((taskId) => !confirmedIds.has(taskId));
+	// Truthful effect reporting: a caller must be able to tell a confirmed, read
+	// back write from an outcome it may not treat as zero writes. A failure says
+	// nothing about how much already landed, so its write state is `uncertain`,
+	// never `confirmed` and never "zero writes".
+	const writeState: PublicationWriteState = status === "created" || status === "updated" || status === "already_current"
+		? "confirmed"
+		: "uncertain";
+	// A failure never proves zero writes, so that fact is always stated. The
+	// replay *action* is offered only when replaying could actually work: a
+	// permanent_failure needs its own specific fix first, so its own message stays
+	// the single action instead of being joined by a replay suggestion.
+	const uncertainty = writeState === "confirmed"
+		? ""
+		: "This failure does not prove zero writes; earlier steps may already have landed. ";
+	// One action for the whole retryable class, so a failure that reaches this
+	// builder without the transport-level attribution still gets exactly one
+	// corrective action instead of none. Permanent failures keep their own.
+	const recovery = status === "retryable_failure"
+		? "Re-read the exact ownership, Sub-issue topology and intent hashes, then replay the same approved manifest. "
+		: "";
+	// A permanent_failure needs its own specific repair, and its own message is
+	// that single action; nothing generic is layered on top of it.
 	return {
 		contract: "immune_brain/github_initiative_publication/v1",
 		operation: "publish-initiative",
 		status,
 		...(initiative ? { initiative } : {}),
 		tasks,
+		write_state: writeState,
+		confirmed_steps: settledTaskSteps.map((task) => task.task_id),
+		pending_steps: pendingSteps,
 		...(execution ? { execution } : {}),
-		message: redactGithubDiagnostic(message),
+		message: `${uncertainty}${recovery}${redactGithubDiagnostic(message)}`,
 	};
 }
 
@@ -1692,6 +1779,46 @@ function preflightPublication(root: string, input: InitiativePublicationInput):
 	return { initiative, ...plan, intent_bindings: intentBindings, foreign_dependers: foreignDependers };
 }
 
+/**
+ * Whole-batch validation before any recovery write.
+ *
+ * A repeated publication is a recovery pass: it may repair managed label drift
+ * and converge pending Children. Before the first such write, every already
+ * published Child of this batch must still be the one this Intent approves --
+ * correct ownership markers, exactly one Slice entry in the Parent, and the
+ * published Intent identity where the Child carries one. Otherwise a later
+ * Child's mismatch could be discovered only after earlier Children had already
+ * been written, which is exactly the partial recovery this pass must not cause.
+ */
+function publicationBatchDrift(
+	source: RepositorySnapshot,
+	initiativeId: string,
+	order: readonly Extract<TrackerOperation, { op: "upsert-task" }>[],
+): string | null {
+	const parent = initiativeLookup(source.issues, source.repository.id, initiativeId);
+	// A missing Parent is not a batch-drift condition: creation is the normal path.
+	if (parent.kind === "missing") return null;
+	if (parent.kind === "ambiguous") return parent.message;
+	// Narrow by construction: this check exists solely because the published
+	// Intent identity is verified inside each Child's own convergence pass, so a
+	// later Child's mismatch would otherwise be discovered only after an earlier
+	// Child had already been repaired. Every other precondition keeps its
+	// existing classification on the existing path.
+	for (const operation of order) {
+		const found = ownedTaskLookup(
+			source.issues,
+			source.repository.id,
+			operation.task_id,
+			initiativeId,
+			operation.slice_id,
+		);
+		if (found.kind !== "found") continue;
+		const mismatch = publishedIntentMismatch(found.issue.body, operation.task_id, operation.intent_hash);
+		if (mismatch) return mismatch;
+	}
+	return null;
+}
+
 function publicationIntentDrift(
 	root: string,
 	bindings: Map<string, Pick<PreparedPublicationTask, "intent_path" | "intent_content_hash">>,
@@ -1711,24 +1838,6 @@ function publicationIntentDrift(
 	return null;
 }
 
-function publicationIssueDrift(expected: {
-	issue_number?: number;
-	issue_url?: string;
-	node_id?: string;
-}, actual: GithubIssue, title: string, body: string, label: string, options?: { allowTerminalSuffix?: boolean }): string | null {
-	if (expected.issue_number !== actual.number || expected.issue_url !== actual.url || expected.node_id !== String(actual.id))
-		return `${label} identity changed during Initiative publication`;
-	if (actual.state !== "open") return `${label} is no longer open`;
-	if (actual.title !== title || actual.body !== body) {
-		// Only a pending amendment Child left open with a validated terminal suffix
-		// (failed terminal close) matches its suffix-free expected content. The
-		// Parent and the strict non-amendment path have no terminal-suffix
-		// lifecycle: byte-exact comparison, any extra suffix is real drift.
-		if (options?.allowTerminalSuffix && carriesApprovedContent(actual.title, actual.body, { title, body })) return null;
-		return `${label} content changed during Initiative publication`;
-	}
-	return null;
-}
 
 /** One bound Issue's expected remote identity and content. */
 function validateAmendmentBinding(binding: unknown, label: string): InitiativeAmendmentBinding {
@@ -1999,258 +2108,645 @@ function carriesApprovedContent(title: string, body: string, approved: { title:
 	return typeof stripped === "string" && stripped.trimEnd() === approved.body.trimEnd();
 }
 
-async function updatePendingChild(
+/**
+ * The Issue number at the end of a `gh issue create` response URL, or null.
+ * Creation takes its number from the create response: no read-back follows a
+ * write, so a response that cannot be parsed leaves the outcome uncertain
+ * rather than asking the repository what landed.
+ */
+function parseCreatedIssueNumber(stdout: string): number | null {
+	const match = stdout.trim().match(/\/issues\/(\d+)\/?$/);
+	if (!match) return null;
+	const number = Number(match[1]);
+	return Number.isSafeInteger(number) && number > 0 ? number : null;
+}
+
+/**
+ * Resolve one Issue's database id. Assumption A1 fallback: `gh issue create`
+ * returns only the Issue URL, so the id the relation endpoints require is read
+ * once per created Issue immediately after its create. The id is never
+ * re-resolved for an Issue the start listing already carries.
+ */
+async function resolveIssueId(
 	root: string,
 	gh: GhTransport,
-	source: RepositorySnapshot,
-	op: Extract<TrackerOperation, { op: "upsert-task" }>,
-	child: GithubIssue,
-	boundNumber: number | undefined,
-	desiredBlockers: GithubIssue[],
-	approvedFinal: { title: string; body: string } | undefined,
-	amendmentContext: AmendmentExecutionContext | undefined = undefined,
-): Promise<GithubTrackerResult> { // eslint-disable-line @typescript-eslint/no-unused-vars -- boundNumber retained for call-site symmetry
-	const parent = initiativeLookup(source.issues, source.repository.id, op.initiative_id);
-	const body = childBody(source.repository, op, parent.kind === "found" ? parent.issue : child);
-	const oversized = bodyLimitFailure(op.op, body, MAX_TERMINAL_SUFFIX_BYTES);
-	if (oversized) return oversized;
-	const title = taskIssueTitle(op, sliceOrdinalFromChecklist(parent.kind === "found" ? parent.issue.body : child.body, op.slice_id, op.projection?.slice_ordinal ?? 1));
-	// Parent content expectation for pre-write revalidation: on the amendment
-	// path the expectation is always the fixed approved final Parent bytes —
-	// never re-adopt freshly observed content as the baseline, so an edit that
-	// lands between the Parent write and this Child write fails closed. On the
-	// non-amendment path (no amendmentContext) no Parent content expectation is
-	// enforced here.
-	const parentApprovedContent = amendmentContext?.parent;
-	const parentBoundNumber = amendmentContext?.parentIssueNumber;
-	const baseBody = child.body;
-	const suffixEvent = issueTerminalEventId(baseBody);
-	if (suffixEvent === "multiple") return result(op.op, "ambiguous_remote_state", "pending Task has multiple terminal markers", child);
-	if (suffixEvent === "malformed") return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} carries a malformed terminal marker (marker without its exact canonical suffix)`, child);
-	// An open Child left by a failed terminal close retains its validated terminal
-	// suffix; the approved-final bytes keep that suffix so the original-input batch
-	// retry converges instead of failing closed on its own partial write.
-	let finalBody = suffixEvent !== null ? `${body.trimEnd()}${terminalSuffix(suffixEvent)}` : body;
-	// The approved-final bytes are suffix-free by construction; a Child carrying a
-	// validated terminal suffix matches when its suffix-free bytes are exact.
-	const approvedMatches = approvedFinal !== undefined && carriesApprovedContent(title, body, approvedFinal);
-	if (!approvedMatches)
-		return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} carries a terminal suffix that diverges from the approved amendment content`, child);
-	// R4 re-attach: a Child that already carries the exact approved-final content
-	// but lost its native Sub-issue attachment (a detached intermediate state from
-	// a prior partial write) is re-attached instead of failing closed, keeping the
-	// original batch retryable. The Child must be bound to this amendment's
-	// Parent (its marker Initiative) and carry no other parent edge — a foreign
-	// attachment is ambiguous remote state, never re-attached.
-	const approvedNow = approvedFinal !== undefined && carriesApprovedContent(child.title, child.body, approvedFinal);
-	if (approvedNow) {
-		const currentParent = initiativeLookup(source.issues, source.repository.id, op.initiative_id);
-		if (currentParent.kind !== "found")
-			return result(op.op, "ambiguous_remote_state", "pending Task Parent is not observable before attachment convergence", child);
-		// Re-read and revalidate the Child immediately before the attachment
-		// mutation: the earlier snapshot may have raced a concurrent edit or
-		// close. exact identity, open state and approved-final bytes must hold,
-		// or the re-attach fails closed with zero relation writes. The attachment
-		// check is skipped here: the re-attach itself converges it and verifies
-		// the relation after the write.
-		const revalidated = await revalidatePendingChildBeforeWrite(root, gh, child.number, op.task_id, approvedFinal, undefined, true, parentApprovedContent, parentBoundNumber);
-		if ("contract" in revalidated) return revalidated;
-		const targetParentNumber = parentBoundNumber ?? currentParent.issue.number;
-		const attachment = await confirmAttachment(root, gh, op.op, source.repository, targetParentNumber, child.number);
-		if (!("attached" in attachment)) return attachment;
-		if (!attachment.attached) {
-			const attached = await attachSubIssue(root, gh, op.op, source.repository, targetParentNumber, child);
-			if (!("attached" in attached)) return attached;
+	repository: RepositoryInfo,
+	number: number,
+): Promise<GithubTrackerResult | number> {
+	const read = await gh.run(
+		["api", "--jq", ".id", `repos/${repository.name_with_owner}/issues/${number}`],
+		{ cwd: root },
+	);
+	if (read.exit_code !== 0 || read.output_exceeded)
+		return ghFailure("upsert-task", read, `cannot resolve the database id of Issue #${number}`);
+	const id = Number(read.stdout.trim());
+	return Number.isSafeInteger(id) && id > 0
+		? id
+		: result("upsert-task", "retryable_failure", `Issue #${number} identity could not be resolved`);
+}
+
+/**
+ * Direct publication: S1 of docs/specs/tracker-direct-publication.spec.md.
+ *
+ * Mirrors the `to-spec`/`to-tickets` write flow. One start-of-run read of the
+ * repository identity and the Issue listing (plus the label list, resolved by
+ * the caller), then one create per absent Issue in dependency order, one native
+ * Sub-issue attach per Child, and one `blocked_by` write per dependency edge --
+ * every Issue number and id taken from its create response. Nothing is re-read
+ * after a write, so a half-landed batch is recovered by rerunning the same
+ * approved manifest: the next start listing adopts whatever landed and only the
+ * missing relations are written. The reads that are not the start listing -- the
+ * Parent's native Sub-issue list, each adopted Child's `blocked_by` set, and one
+ * id resolution per created Issue -- are targeted at Issues the batch itself
+ * owns and all happen before the relation write they inform.
+ */
+async function publishInitiativeDirect(
+	root: string,
+	gh: GhTransport,
+	prepared: ReturnType<typeof preflightPublication>,
+	initial: RepositorySnapshot,
+): Promise<GithubInitiativePublicationResult> {
+	const plannedTaskIds = prepared.order.map((operation) => operation.task_id);
+	const initiativeId = prepared.initiative.initiative_id;
+	const repository = initial.repository;
+	const desiredParentTitle = initiativeIssueTitle(initiativeId, prepared.initiative.projection);
+	const desiredParentBody = createInitiativeBody(repository, prepared.initiative);
+	let initiativeResult: GithubTrackerResult | undefined;
+	const taskResults: GithubInitiativePublicationResult["tasks"] = [];
+	const failed = (failure: GithubTrackerResult): GithubInitiativePublicationResult =>
+		publicationResultWithPlan(plannedTaskIds, failure.status, failure.message, initiativeResult, taskResults);
+
+	const parentLookup = initiativeLookup(initial.issues, repository.id, initiativeId);
+	if (parentLookup.kind === "ambiguous")
+		return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", parentLookup.message);
+	const existingParent = parentLookup.kind === "found" ? parentLookup.issue : null;
+	// A closed Parent is start-of-run drift: it is state the listing already
+	// reveals, so it fails closed here rather than being adopted as current.
+	if (existingParent && existingParent.state !== "open")
+		return publicationResultWithPlan(
+			plannedTaskIds,
+			"ambiguous_remote_state",
+			"Initiative Parent is no longer open",
+			result("create-initiative", "ambiguous_remote_state", "Initiative Parent is no longer open", existingParent),
+		);
+	// Whole-batch validation before the first write: every already-published
+	// Child of this batch must still be the one this Intent approves, including
+	// its published Intent identity. This runs before the Parent content check
+	// because the Parent body embeds the Child goal prose, so a stale Intent must
+	// be reported as the identity mismatch it is, not as Parent drift.
+	const batchDrift = publicationBatchDrift(
+		initial,
+		initiativeId,
+		prepared.order as Extract<TrackerOperation, { op: "upsert-task" }>[],
+	);
+	if (batchDrift) return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", batchDrift);
+	// The Parent is never rewritten: an existing Parent that no longer carries
+	// the exact approved bytes is a permanent, caller-fixable drift.
+	if (existingParent && (existingParent.title !== desiredParentTitle || existingParent.body !== desiredParentBody))
+		return publicationResultWithPlan(
+			plannedTaskIds,
+			"permanent_failure",
+			"Initiative Issue already exists and the tracker never rewrites it; edit the GitHub source directly for later planning changes",
+			result("create-initiative", "permanent_failure", "Initiative Issue already exists and the tracker never rewrites it", existingParent),
+		);
+
+	const existingChildren = new Map<string, GithubIssue>();
+	for (const operation of prepared.order) {
+		const owned = ownedTaskLookup(initial.issues, repository.id, operation.task_id, initiativeId, operation.slice_id);
+		if (owned.kind === "ambiguous")
+			return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", owned.message);
+		if (owned.kind === "found") existingChildren.set(operation.task_id, owned.issue);
+	}
+	// An owned Child whose Parent is gone cannot be adopted under a new Parent:
+	// the Child still carries the old Parent link, so recreating the Parent would
+	// silently re-home it. This is caller-fixable remote drift, not a create path.
+	if (!existingParent && existingChildren.size > 0)
+		return publicationResultWithPlan(
+			plannedTaskIds,
+			"ambiguous_remote_state",
+			"an owned Child of this Initiative exists but its Parent Issue is missing; the tracker never recreates a Parent over its existing Children",
+		);
+	// A closed Child is start-of-run drift for the same reason as a closed Parent.
+	for (const operation of prepared.order) {
+		const issue = existingChildren.get(operation.task_id);
+		if (issue && issue.state !== "open")
+			return publicationResultWithPlan(
+				plannedTaskIds,
+				"ambiguous_remote_state",
+				`Task ${operation.task_id} is no longer open`,
+				result("upsert-task", "ambiguous_remote_state", `Task ${operation.task_id} is no longer open`, issue),
+			);
+	}
+	if (existingParent) {
+		for (const operation of prepared.order) {
+			const issue = existingChildren.get(operation.task_id);
+			if (!issue) continue;
+			const title = taskIssueTitle(operation, sliceOrdinalFromChecklist(desiredParentBody, operation.slice_id, operation.projection?.slice_ordinal ?? 1));
+			const body = childBody(repository, operation, existingParent);
+			if (issue.title !== title || !sameTrackedBody(issue.body, body))
+				return publicationResultWithPlan(
+					plannedTaskIds,
+					"ambiguous_remote_state",
+					`Task ${operation.task_id} published content no longer matches the approved Intent publication`,
+					result("upsert-task", "ambiguous_remote_state", `Task ${operation.task_id} published content drifted`, issue),
+				);
 		}
 	}
-	// The authoritative remote observation for the write decision is the
-	// revalidated pre-write read, not the earlier snapshot: a terminal suffix
-	// that landed after the snapshot must be preserved exactly, never
-	// overwritten by bytes computed from stale data.
-	let observed = child;
-	const desiredLabels = desiredTaskLabels(op);
-	if (child.title !== title || child.body !== finalBody || labelMutationArgs(child.labels, desiredLabels).length) {
-		// Re-read the Child immediately before writing: earlier blocker ownership
-		// reads may have raced a concurrent user edit. The bound issue_number must
-		// still hold and the remote content must still be baseline-or-approved-final.
-		// revalidatePendingChildBeforeWrite additionally rechecks native Parent
-		// attachment and exact Parent/Slice ownership so a detached or moved Child
-		// never receives a content rewrite.
-		const revalidated = await revalidatePendingChildBeforeWrite(
-			root, gh, child.number, op.task_id, approvedFinal,
-			{ title: child.title, body: child.body },
-			false, parentApprovedContent, parentBoundNumber,
+
+	// The only reads besides the start listing; all before the first write. They
+	// exist to find MISSING relations. A relation that is already present but not
+	// approved by this Intent is drift the listing makes visible, so it fails
+	// closed here instead of being reported as already_current.
+	const attachedNumbers: number[] = [];
+	if (existingParent) {
+		const attached = await readSubIssueNumbers(root, gh, "upsert-task", repository, existingParent.number);
+		if (!Array.isArray(attached))
+			return publicationResultWithPlan(plannedTaskIds, attached.status, attached.message);
+		if (new Set(attached).size !== attached.length)
+			return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", "the Initiative Parent lists the same Sub-issue more than once");
+		const ownedNumbers = new Set([...existingChildren.values()].map((issue) => issue.number));
+		if (attached.some((number) => !ownedNumbers.has(number)))
+			return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", "the Initiative Parent carries Sub-issues this batch does not own");
+		attachedNumbers.push(...attached);
+	}
+	const existingBlockerIds = new Map<string, number[]>();
+	for (const operation of prepared.order) {
+		const issue = existingChildren.get(operation.task_id);
+		if (!issue) continue;
+		const ids = await readBlockedByIds(root, gh, "upsert-task", repository, issue.number);
+		if (!Array.isArray(ids))
+			return publicationResultWithPlan(plannedTaskIds, ids.status, ids.message);
+		const approved = new Set<number>();
+		for (const blockerId of operation.projection?.blocked_by ?? []) {
+			const blocker = taskLookup(initial.issues, repository.id, blockerId);
+			if (blocker.kind === "found") approved.add(blocker.issue.id);
+		}
+		if (ids.some((id) => !approved.has(id)))
+			return publicationResultWithPlan(
+				plannedTaskIds,
+				"ambiguous_remote_state",
+				`Task ${operation.task_id} carries native blocked_by relations this Intent does not approve`,
+			);
+		existingBlockerIds.set(operation.task_id, ids);
+	}
+	const beforeParentWrite = publicationIntentDrift(root, prepared.intent_bindings);
+	if (beforeParentWrite)
+		return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", beforeParentWrite);
+
+	let parentNumber: number;
+	if (existingParent) {
+		parentNumber = existingParent.number;
+		const labelArgs = labelMutationArgs(existingParent.labels, []);
+		if (labelArgs.length === 0) {
+			initiativeResult = result("create-initiative", "already_current", "Initiative Issue already carries the requested initial source", existingParent);
+		} else {
+			const edited = await gh.run(
+				["issue", "edit", String(parentNumber), "--repo", repository.name_with_owner, ...labelArgs],
+				{ cwd: root },
+			);
+			if (edited.exit_code !== 0 || edited.output_exceeded)
+				return failed(ghFailure("create-initiative", edited, "Initiative Parent label convergence failed"));
+			initiativeResult = result(
+				"create-initiative",
+				"updated",
+				"Initiative Issue managed labels converged",
+				{ ...existingParent, labels: [] },
+			);
+		}
+	} else {
+		const created = await gh.run(
+			["issue", "create", "--repo", repository.name_with_owner, "--title", desiredParentTitle, "--body-file", "-"],
+			{ cwd: root, stdin: desiredParentBody },
 		);
-		if ("contract" in revalidated) return revalidated;
-		observed = revalidated;
-		// A newly observed terminal suffix on the remote (approved-final content
-		// plus evidence appended after the snapshot) must survive this write: the
-		// written body keeps the observed suffix instead of the snapshot-derived one.
-		const observedEvent = issueTerminalEventId(observed.body);
-		if (observedEvent === "malformed") return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} carries a malformed terminal marker (marker without its exact canonical suffix)`, child);
-		const writeBody = typeof observedEvent === "string"
-			? `${body.trimEnd()}${terminalSuffix(observedEvent)}`
-			: finalBody;
-		const labelArgs = labelMutationArgs(observed.labels, desiredLabels);
-		if (observed.title !== title || observed.body !== writeBody || labelArgs.length) {
-			const edited = await gh.run([
-				"issue", "edit", String(child.number), "--repo", source.repository.name_with_owner,
+		if (created.exit_code !== 0 || created.output_exceeded)
+			return failed(ghFailure("create-initiative", created, "Initiative Issue creation failed"));
+		const number = parseCreatedIssueNumber(created.stdout);
+		if (number === null)
+			return publicationResultWithPlan(plannedTaskIds, "retryable_failure", "Initiative creation could not be confirmed", initiativeResult, taskResults);
+		parentNumber = number;
+		initiativeResult = {
+			contract: CONTRACT,
+			operation: "create-initiative",
+			status: "created",
+			association_found: true,
+			issue_number: number,
+			issue_url: created.stdout.trim(),
+			message: "Initiative Issue created as the single GitHub source",
+		};
+	}
+	const parentReference: GithubIssue = existingParent ?? {
+		id: 0,
+		number: parentNumber,
+		url: initiativeResult.issue_url ?? `https://github.com/${repository.name_with_owner}/issues/${parentNumber}`,
+		title: desiredParentTitle,
+		body: desiredParentBody,
+		state: "open",
+		state_reason: null,
+		labels: [],
+	};
+	const numberByTask = new Map<string, number>();
+	const numberByTaskId = new Map<string, number>();
+	const blockerNumber = (blockerId: string): number | undefined =>
+		numberByTask.get(blockerId) ?? existingChildren.get(blockerId)?.number;
+
+	for (const operation of prepared.order) {
+		const intentDrift = publicationIntentDrift(root, prepared.intent_bindings, [operation.task_id]);
+		if (intentDrift) return failed(result("upsert-task", "ambiguous_remote_state", intentDrift));
+		const blockers: Array<{ taskId: string; number: number; id: number | undefined }> = [];
+		for (const blockerId of operation.projection?.blocked_by ?? []) {
+			if (blockerId === operation.task_id)
+				return failed(result("upsert-task", "ambiguous_remote_state", "a Task cannot block itself"));
+			const number = blockerNumber(blockerId);
+			if (number === undefined)
+				return failed(result("upsert-task", "permanent_failure", `blocking Task ${blockerId} has not been published`));
+			blockers.push({ taskId: blockerId, number, id: numberByTaskId.get(blockerId) ?? existingChildren.get(blockerId)?.id });
+		}
+		const existing = existingChildren.get(operation.task_id);
+		if (existing) {
+			let mutated = false;
+			const labelArgs = labelMutationArgs(existing.labels, desiredTaskLabels(operation));
+			if (labelArgs.length) {
+				const edited = await gh.run(
+					["issue", "edit", String(existing.number), "--repo", repository.name_with_owner, ...labelArgs],
+					{ cwd: root },
+				);
+				if (edited.exit_code !== 0 || edited.output_exceeded)
+					return failed(ghFailure("upsert-task", edited, `Task Issue #${existing.number} label convergence failed`));
+				mutated = true;
+			}
+			if (!attachedNumbers.includes(existing.number)) {
+				const attach = await attachChildDirect(root, gh, repository, parentNumber, existing.id, existing.number);
+				if ("contract" in attach) return failed(attach);
+				attachedNumbers.push(existing.number);
+				mutated = true;
+			}
+			const currentIds = existingBlockerIds.get(operation.task_id) ?? [];
+			for (const blocker of blockers) {
+				if (blocker.id !== undefined && currentIds.includes(blocker.id)) continue;
+				const added = await addBlockedByDirect(root, gh, repository, existing.number, blocker.id, blocker.number);
+				if ("contract" in added) return failed(added);
+				mutated = true;
+			}
+			taskResults.push({
+				task_id: operation.task_id,
+				slice_id: operation.slice_id,
+				status: mutated ? "updated" : "already_current",
+				issue_number: existing.number,
+				issue_url: existing.url,
+				node_id: String(existing.id),
+			});
+			continue;
+		}
+		const title = taskIssueTitle(operation, sliceOrdinalFromChecklist(desiredParentBody, operation.slice_id, operation.projection?.slice_ordinal ?? 1));
+		const body = childBody(repository, operation, parentReference);
+		const created = await gh.run(
+			[
+				"issue", "create", "--repo", repository.name_with_owner,
 				"--title", title,
 				"--body-file", "-",
-				...labelArgs,
-			], { cwd: root, stdin: writeBody });
-			if (edited.exit_code !== 0 || edited.output_exceeded) return ghFailure(op.op, edited, `pending Task Issue #${child.number} update failed`);
-			finalBody = writeBody;
+				...desiredTaskLabels(operation).flatMap((label) => ["--label", label]),
+			],
+			{ cwd: root, stdin: body },
+		);
+		if (created.exit_code !== 0 || created.output_exceeded)
+			return failed(ghFailure("upsert-task", created, "Task Issue creation failed"));
+		const number = parseCreatedIssueNumber(created.stdout);
+		if (number === null)
+			return publicationResultWithPlan(plannedTaskIds, "retryable_failure", "Task creation could not be confirmed", initiativeResult, taskResults);
+		const id = await resolveIssueId(root, gh, repository, number);
+		if (typeof id !== "number") return failed(id);
+		const attach = await attachChildDirect(root, gh, repository, parentNumber, id, number);
+		if ("contract" in attach) return failed(attach);
+		for (const blocker of blockers) {
+			const added = await addBlockedByDirect(root, gh, repository, number, blocker.id, blocker.number);
+			if ("contract" in added) return failed(added);
 		}
+		numberByTask.set(operation.task_id, number);
+		numberByTaskId.set(operation.task_id, id);
+		taskResults.push({
+			task_id: operation.task_id,
+			slice_id: operation.slice_id,
+			status: "created",
+			issue_number: number,
+			issue_url: created.stdout.trim(),
+		});
 	}
-	const dependencies = await convergePendingDependencies(root, gh, source, child.number, op.task_id, desiredBlockers, approvedFinal, parentApprovedContent, parentBoundNumber);
-	if (!("complete" in dependencies)) return dependencies;
-	const refreshed = await snapshot(root, gh, op.op);
-	if ("contract" in refreshed) return refreshed;
-	const reread = ownedTaskLookup(refreshed.issues, refreshed.repository.id, op.task_id, op.initiative_id, op.slice_id);
-	if (reread.kind !== "found" || reread.issue.number !== child.number)
-		return result(op.op, "ambiguous_remote_state", `pending Task ${op.task_id} changed identity during amendment`, child);
-	if (reread.issue.title !== title || reread.issue.body !== finalBody)
-		return result(op.op, "retryable_failure", `pending Task ${op.task_id} update did not converge`, reread.issue);
-	const labelsCurrent = !desiredLabels.some((label) => !reread.issue.labels.includes(label));
-	if (!labelsCurrent)
-		return result(op.op, "retryable_failure", `pending Task ${op.task_id} labels did not converge`, reread.issue);
-	const currentDependencies = await confirmBlockedBy(root, gh, op.op, refreshed.repository, reread.issue.number, desiredBlockers);
-	if (!("complete" in currentDependencies)) return currentDependencies;
-	if (!currentDependencies.complete)
-		return result(op.op, "retryable_failure", `pending Task ${op.task_id} dependencies did not converge`, reread.issue);
-	const contentCurrent = child.title === title && child.body === finalBody
-		&& labelMutationArgs(child.labels, desiredLabels).length === 0;
-	return contentCurrent
-		? result(op.op, "already_current", `pending Task ${op.task_id} already carries the approved amendment content`, reread.issue)
-		: result(op.op, "updated", `pending Task ${op.task_id} Agent Brief updated with approved amendment content`, reread.issue);
-}
-
-/** Converge the exact approved dependency set on a pending Child (amendment only). */
-async function convergePendingDependencies(
+
+	const finalIntentDrift = publicationIntentDrift(root, prepared.intent_bindings);
+	if (finalIntentDrift) return failed(result("upsert-task", "ambiguous_remote_state", finalIntentDrift));
+	const statuses = [initiativeResult.status, ...taskResults.map((task) => task.status)];
+	const status: TrackerStatus = statuses.every((item) => item === "created")
+		? "created"
+		: statuses.every((item) => item === "already_current") ? "already_current" : "updated";
+	const issueNumber = (taskId: string): number => numberByTask.get(taskId) ?? existingChildren.get(taskId)!.number;
+	const firstTaskId = prepared.order[0].task_id;
+	return publicationResultWithPlan(plannedTaskIds, status, "complete Initiative Parent, Children, and dependency graph published", initiativeResult, taskResults, {
+		recommended_first_task_id: firstTaskId,
+		recommended_first_issue_number: issueNumber(firstTaskId),
+		order: prepared.order.map((operation) => operation.task_id),
+		issue_order: prepared.order.map((operation) => issueNumber(operation.task_id)),
+		parallel_groups: prepared.parallel_groups,
+		parallel_issue_groups: prepared.parallel_groups.map((group) => group.map(issueNumber)),
+	});
+}
+
+/** Attach one Child as a native Sub-issue of the Parent. */
+async function attachChildDirect(
 	root: string,
 	gh: GhTransport,
-	source: RepositorySnapshot,
+	repository: RepositoryInfo,
+	parentNumber: number,
+	childId: number,
+	childNumber: number,
+): Promise<GithubTrackerResult | { attached: true }> {
+	const mutation = await gh.run(
+		["api", "-F", `sub_issue_id=${childId}`, `repos/${repository.name_with_owner}/issues/${parentNumber}/sub_issues`],
+		{ cwd: root },
+	);
+	if (mutation.exit_code !== 0 || mutation.output_exceeded)
+		return ghFailure("upsert-task", mutation, `native Sub-issue attachment failed for Issue #${childNumber}`);
+	return { attached: true };
+}
+
+/** Create one native `blocked_by` edge; the blocker id is already known. */
+async function addBlockedByDirect(
+	root: string,
+	gh: GhTransport,
+	repository: RepositoryInfo,
 	childNumber: number,
-	childTaskId: string,
-	requestedBlockers: GithubIssue[],
-	approvedFinal: { title: string; body: string } | undefined,
-	parentApprovedContent: { title: string; body: string } | undefined = undefined,
-	parentBoundNumber: number | undefined = undefined,
+	blockerId: number | undefined,
+	blockerNumber: number,
 ): Promise<GithubTrackerResult | { complete: true }> {
-	const expected = requestedBlockers.map((blocker) => blocker.id);
-	const existing = await readBlockedByIds(root, gh, "upsert-task", source.repository, childNumber);
-	if (!Array.isArray(existing)) return existing;
-	const removed = existing.filter((id) => !expected.includes(id));
-	for (const id of removed) {
-		const revalidated = await revalidatePendingChildBeforeWrite(root, gh, childNumber, childTaskId, approvedFinal, undefined, false, parentApprovedContent, parentBoundNumber);
-		if ("contract" in revalidated) return revalidated;
-		const mutation = await gh.run([
-			"api", "--method", "DELETE",
-			`repos/${source.repository.name_with_owner}/issues/${childNumber}/dependencies/blocked_by/${id}`,
-		], { cwd: root });
-		if (mutation.exit_code !== 0 || mutation.output_exceeded)
-			return ghFailure("upsert-task", mutation, `native blocked_by removal failed for Issue #${childNumber}`);
-	}
-	const additions = requestedBlockers.filter((blocker) => !existing.includes(blocker.id));
-	for (const blocker of additions) {
-		const revalidated = await revalidatePendingChildBeforeWrite(root, gh, childNumber, childTaskId, approvedFinal, undefined, false, parentApprovedContent, parentBoundNumber);
-		if ("contract" in revalidated) return revalidated;
-		const mutation = await gh.run([
-			"api", "-F", `issue_id=${blocker.id}`,
-			`repos/${source.repository.name_with_owner}/issues/${childNumber}/dependencies/blocked_by`,
-		], { cwd: root });
-		if (mutation.exit_code !== 0 || mutation.output_exceeded)
-			return ghFailure("upsert-task", mutation, `native blocked_by attachment failed for Issue #${blocker.number}`);
-	}
-	const confirm = await confirmBlockedBy(root, gh, "upsert-task", source.repository, childNumber, requestedBlockers);
-	if (!("complete" in confirm)) return confirm;
-	return confirm.complete ? { complete: true } : { complete: true };
+	const resolved = blockerId ?? await resolveIssueId(root, gh, repository, blockerNumber);
+	if (typeof resolved !== "number") return resolved;
+	const mutation = await gh.run(
+		["api", "-F", `issue_id=${resolved}`, `repos/${repository.name_with_owner}/issues/${childNumber}/dependencies/blocked_by`],
+		{ cwd: root },
+	);
+	if (mutation.exit_code !== 0 || mutation.output_exceeded)
+		return ghFailure("upsert-task", mutation, `native blocked_by attachment failed for Issue #${childNumber}`);
+	return { complete: true };
 }
 
 /**
- * Re-snapshot and re-validate a pending Child's bound identity, open state,
- * ownership, and baseline-or-approved-final content immediately before each
- * dependency write. Any drift stops the remaining mutations and fails closed
- * as ambiguous remote state. On success returns the validated Child
- * observation so callers can write the bytes actually present on the remote
- * (preserving a terminal suffix that landed after their earlier snapshot).
- * The return is discriminated by `contract`: a GithubTrackerResult failure
- * short-circuits the caller, a GithubIssue is the validated observation.
+ * Direct amendment: S2 of docs/specs/tracker-direct-publication.spec.md.
+ *
+ * The approved baseline is verified once at the start, against the start listing
+ * plus Issue-scoped reads (the Parent's Sub-issue list and each adopted Child's
+ * `blocked_by` set). Then the Parent is edited at most once, each pending brief is
+ * edited at most once, absent pending Children are created as in S1, and each
+ * pending Child's `blocked_by` set is converged to the approved set from the
+ * start read. Nothing is re-read after a write and no closing recheck runs, so a
+ * baseline drift that appears after the start listing is not detected in this
+ * run; it surfaces at the start of the next run.
  */
-async function revalidatePendingChildBeforeWrite(
+async function publishAmendmentDirect(
 	root: string,
 	gh: GhTransport,
-	childNumber: number,
-	childTaskId: string,
-	approvedFinal: { title: string; body: string } | undefined,
-	/** Additional byte-exact content this Child is allowed to carry (e.g. its pre-update baseline). */
-	allowedBaseline: { title: string; body: string } | undefined = undefined,
-	/** When true the native Sub-issue attachment check is skipped (re-attach phase: the attachment write itself is about to run). */
-	skipAttachmentCheck = false,
-	/** Expected exact Parent bytes (approved final after the Parent write, baseline before it); undefined skips the Parent content check. */
-	parentApproved: { title: string; body: string } | undefined = undefined,
-	/** Expected exact bound Parent issue number; undefined skips the Parent issue_number check. */
-	parentExpectedNumber: number | undefined = undefined,
-): Promise<GithubTrackerResult | GithubIssue> {
-	const refreshed = await snapshot(root, gh, "upsert-task");
-	if ("contract" in refreshed) return refreshed;
-	// Repository-wide identity resolution: a duplicate Task Issue introduced after
-	// the caller's snapshot must fail closed here, not at a later lookup — the
-	// immediate pre-write observation is the authoritative one.
-	const resolved = taskLookup(refreshed.issues, refreshed.repository.id, childTaskId);
-	if (resolved.kind !== "found")
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} is not uniquely owned before a write: ${resolved.kind}`);
-	const child = resolved.issue;
-	if (child.number !== childNumber)
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} resolves to Issue #${child.number}, not the bound Issue #${childNumber}`, child);
-	if (child.state !== "open")
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) is no longer open before a dependency write`, child);
-	const contentFinal = approvedFinal !== undefined && carriesApprovedContent(child.title, child.body, approvedFinal);
-	const contentBaseline = allowedBaseline !== undefined && child.title === allowedBaseline.title && child.body === allowedBaseline.body;
-	if (!contentFinal && !contentBaseline)
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) content is no longer the approved final bytes before a dependency write`, child);
-	const initiativeId = [...child.body.matchAll(/<!-- immune-brain:initiative-id=([A-Za-z0-9._:-]+) -->/g)].map((match) => match[1])[0];
-	if (!initiativeId)
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) lost its Initiative marker before a dependency write`, child);
-	const parent = initiativeLookup(refreshed.issues, refreshed.repository.id, initiativeId);
-	if (parent.kind !== "found" || parent.issue.state !== "open")
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) lost its open Parent before a dependency write`, child);
-	if (parentExpectedNumber !== undefined && parent.issue.number !== parentExpectedNumber)
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) Parent resolves to Issue #${parent.issue.number}, not the bound Parent Issue #${parentExpectedNumber} before a dependency write`, child);
-	// The Parent must still carry exactly the expected amendment bytes before any
-	// Child write: after the Parent write it is the approved final content; before
-	// the Parent write (non-amendment or pre-write paths) the earlier caller
-	// snapshot bytes apply. A concurrent edit that keeps ownership markers intact
-	// must fail closed here, not after the dependency mutations in final verification.
-	if (parentApproved !== undefined
-		&& (parent.issue.title !== parentApproved.title || parent.issue.body !== parentApproved.body))
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) Parent changed since the approved amendment content before a dependency write`, child);
-	// Native Sub-issue attachment must still hold immediately before each
-	// dependency write: a detached Child no longer belongs to the amendment.
-	if (!skipAttachmentCheck) {
-		const attachedNow = await readSubIssueNumbers(root, gh, "upsert-task", refreshed.repository, parent.issue.number);
-		if (!Array.isArray(attachedNow)) return attachedNow;
-		if (!attachedNow.includes(childNumber))
-			return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) is no longer attached to the Parent before a dependency write`, child);
+	prepared: ReturnType<typeof preflightPublication>,
+	initial: RepositorySnapshot,
+	amendment: ReturnType<typeof validateAmendment>,
+	context: AmendmentExecutionContext,
+): Promise<GithubInitiativePublicationResult> {
+	const plannedTaskIds = prepared.order.map((operation) => operation.task_id);
+	const initiativeId = prepared.initiative.initiative_id;
+	const repository = initial.repository;
+	const taskResults: GithubInitiativePublicationResult["tasks"] = [];
+	// The confirmed Parent result, when it exists, must survive a later Child or
+	// relation failure: a step whose response was already received is not lost just
+	// because a later step failed. Set once the Parent write has been confirmed.
+	let confirmedParent: GithubTrackerResult | undefined;
+	const failed = (failure: GithubTrackerResult): GithubInitiativePublicationResult =>
+		publicationResultWithPlan(plannedTaskIds, failure.status, failure.message, confirmedParent, taskResults);
+
+	const parentLookup = initiativeLookup(initial.issues, repository.id, initiativeId);
+	if (parentLookup.kind !== "found")
+		return publicationResultWithPlan(plannedTaskIds, "permanent_failure", "an amendment requires the Initiative Parent to already exist");
+	const parentIssue = parentLookup.issue;
+
+	// Baseline verification, once, before any write: membership, bound identity,
+	// baseline-or-approved-final content, native attachment and terminal ownership.
+	const topology = await validateAmendmentTopology(
+		root, gh, initial, initiativeId, parentIssue,
+		amendment.tasks, amendment.historical,
+		prepared.foreign_dependers,
+		{ pendingContent: context.pendingContent, parent: context.parent, historicalSlices: context.historicalSlices },
+		prepared.order,
+	);
+	if (!("get" in topology)) return failed(topology);
+	const bound = topology;
+
+	// The only reads besides the start listing; all before the first write. They
+	// exist to find MISSING relations, so an unapproved relation already present
+	// fails closed here instead of being reported as already_current.
+	const attached = await readSubIssueNumbers(root, gh, "upsert-task", repository, parentIssue.number);
+	if (!Array.isArray(attached)) return failed(attached);
+	if (new Set(attached).size !== attached.length)
+		return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", "the Initiative Parent lists the same Sub-issue more than once");
+	const attachedNumbers = new Set(attached);
+	const blockerIdsByTask = new Map<string, number[]>();
+	for (const operation of prepared.order) {
+		const issue = bound.get(operation.task_id);
+		if (!issue) continue;
+		const ids = await readBlockedByIds(root, gh, "upsert-task", repository, issue.number);
+		if (!Array.isArray(ids)) return failed(ids);
+		// The approved set is the convergence target, so an unapproved edge present at
+		// start is simply removed by the same run; it is state this run owns, not drift.
+		blockerIdsByTask.set(operation.task_id, ids);
 	}
-	const sliceId = ownershipMarkerValue(child.body, "slice-id");
-	if (sliceId && sliceCount(parent.issue.body, sliceId) !== 1)
-		return result("upsert-task", "ambiguous_remote_state", `pending Task ${childTaskId} (Issue #${childNumber}) lost its exact Slice in the Parent before a dependency write`, child);
-	return child;
+	const beforeWrite = publicationIntentDrift(root, prepared.intent_bindings);
+	if (beforeWrite) return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", beforeWrite);
+
+	// One Parent edit at most, and only when the approved bytes or labels differ.
+	const parentNeedsEdit = parentIssue.title !== context.parent.title
+		|| parentIssue.body !== context.parent.body
+		|| labelMutationArgs(parentIssue.labels, []).length > 0;
+	let parentResult: GithubTrackerResult;
+	if (!parentNeedsEdit) {
+		parentResult = result("create-initiative", "already_current", "Initiative Issue already carries the requested amended content", parentIssue);
+	} else {
+		const edited = await gh.run(
+			[
+				"issue", "edit", String(parentIssue.number), "--repo", repository.name_with_owner,
+				"--title", context.parent.title,
+				"--body-file", "-",
+				...labelMutationArgs(parentIssue.labels, []),
+			],
+			{ cwd: root, stdin: context.parent.body },
+		);
+		if (edited.exit_code !== 0 || edited.output_exceeded)
+			return failed(ghFailure("create-initiative", edited, "Initiative amendment edit failed"));
+		parentResult = result("create-initiative", "updated", "Initiative Issue updated with approved amendment content", {
+			...parentIssue,
+			title: context.parent.title,
+			body: context.parent.body,
+			labels: [],
+		});
+	}
+	confirmedParent = parentResult;
+
+	const numberByTask = new Map<string, number>();
+	const idByTask = new Map<string, number>();
+	const blockerRef = (blockerId: string): { number: number; id: number } | undefined => {
+		const number = numberByTask.get(blockerId) ?? bound.get(blockerId)?.number;
+		if (number === undefined) return undefined;
+		const observedBlocker = taskLookup(initial.issues, repository.id, blockerId);
+		const id = idByTask.get(blockerId) ?? bound.get(blockerId)?.id
+			?? (observedBlocker.kind === "found" ? observedBlocker.issue.id : undefined);
+		if (id === undefined || !Number.isSafeInteger(id)) return undefined;
+		return { number, id };
+	};
+
+	for (const operation of prepared.order) {
+		const intentDrift = publicationIntentDrift(root, prepared.intent_bindings, [operation.task_id]);
+		if (intentDrift) return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", intentDrift, parentResult, taskResults);
+		const approved = context.pendingContent.get(operation.task_id);
+		if (!approved) return failed(result("upsert-task", "permanent_failure", `pending Task ${operation.task_id} has no approved amendment content`));
+		const desiredBlockers: Array<{ number: number; id: number }> = [];
+		for (const blockerId of operation.projection?.blocked_by ?? []) {
+			if (blockerId === operation.task_id)
+				return failed(result("upsert-task", "ambiguous_remote_state", "a Task cannot block itself"));
+			const resolved = blockerRef(blockerId);
+			if (!resolved)
+				return failed(result("upsert-task", "permanent_failure", `blocking Task ${blockerId} has not been published`));
+			desiredBlockers.push(resolved);
+		}
+
+		const observed = bound.get(operation.task_id);
+		let number: number;
+		let id: number;
+		// Content/label mutation decides the reported status; relation convergence
+		// alone leaves an already-current pending brief as already_current.
+		let contentMutated = false;
+		if (observed) {
+			number = observed.number;
+			id = observed.id;
+		} else {
+			// Absent pending Child: one create, number from the create response and id
+			// resolved once for the relation endpoints (Assumption A1).
+			const created = await gh.run(
+				[
+					"issue", "create", "--repo", repository.name_with_owner,
+					"--title", approved.title,
+					"--body-file", "-",
+					...desiredTaskLabels(operation).flatMap((label) => ["--label", label]),
+				],
+				{ cwd: root, stdin: approved.body },
+			);
+			if (created.exit_code !== 0 || created.output_exceeded)
+				return failed(ghFailure("upsert-task", created, `Task Issue creation failed for ${operation.task_id}`));
+			const parsed = parseCreatedIssueNumber(created.stdout);
+			if (parsed === null)
+				return publicationResultWithPlan(plannedTaskIds, "retryable_failure", `Task ${operation.task_id} creation could not be confirmed`, parentResult, taskResults);
+			number = parsed;
+			const resolvedId = await resolveIssueId(root, gh, repository, number);
+			if (typeof resolvedId !== "number") return failed(resolvedId);
+			id = resolvedId;
+		}
+
+		if (!attachedNumbers.has(number)) {
+			const attach = await attachChildDirect(root, gh, repository, parentIssue.number, id, number);
+			if ("contract" in attach) return failed(attach);
+			attachedNumbers.add(number);
+		}
+
+		if (observed) {
+			// One edit at most, and only when the approved content or labels differ. A
+			// validated terminal suffix observed in the start listing is terminal
+			// evidence, so it is preserved by the rewrite instead of being dropped.
+			const suffixEvent = issueTerminalEventId(observed.body);
+			if (suffixEvent === "multiple")
+				return failed(result("upsert-task", "ambiguous_remote_state", `pending Task ${operation.task_id} has multiple terminal markers`, observed));
+			if (suffixEvent === "malformed")
+				return failed(result("upsert-task", "ambiguous_remote_state", `pending Task ${operation.task_id} carries a malformed terminal marker (marker without its exact canonical suffix)`, observed));
+			const writeBody = suffixEvent !== null ? `${approved.body.trimEnd()}${terminalSuffix(suffixEvent)}` : approved.body;
+			const labelArgs = labelMutationArgs(observed.labels, desiredTaskLabels(operation));
+			if (!carriesApprovedContent(observed.title, observed.body, approved) || labelArgs.length) {
+				const edited = await gh.run(
+					[
+						"issue", "edit", String(number), "--repo", repository.name_with_owner,
+						"--title", approved.title,
+						"--body-file", "-",
+						...labelArgs,
+					],
+					{ cwd: root, stdin: writeBody },
+				);
+				if (edited.exit_code !== 0 || edited.output_exceeded)
+					return failed(ghFailure("upsert-task", edited, `pending Task Issue #${number} update failed`));
+				contentMutated = true;
+			}
+		}
+
+		// Converge the approved dependency set from the start read: no read follows
+		// the relation writes, and only the missing or unapproved edges are touched.
+		const current = blockerIdsByTask.get(operation.task_id) ?? [];
+		const expected = desiredBlockers.map((blocker) => blocker.id);
+		for (const removedId of current.filter((currentId) => !expected.includes(currentId))) {
+			const mutation = await gh.run(
+				["api", "--method", "DELETE", `repos/${repository.name_with_owner}/issues/${number}/dependencies/blocked_by/${removedId}`],
+				{ cwd: root },
+			);
+			if (mutation.exit_code !== 0 || mutation.output_exceeded)
+				return failed(ghFailure("upsert-task", mutation, `native blocked_by removal failed for Issue #${number}`));
+		}
+		for (const blocker of desiredBlockers.filter((candidate) => !current.includes(candidate.id))) {
+			const added = await addBlockedByDirect(root, gh, repository, number, blocker.id, blocker.number);
+			if ("contract" in added) return failed(added);
+		}
+
+		numberByTask.set(operation.task_id, number);
+		idByTask.set(operation.task_id, id);
+		taskResults.push({
+			task_id: operation.task_id,
+			slice_id: operation.slice_id,
+			status: !observed ? "created" : contentMutated ? "updated" : "already_current",
+			issue_number: number,
+			issue_url: observed?.url ?? `https://github.com/${repository.name_with_owner}/issues/${number}`,
+		});
+	}
+
+	const finalIntentDrift = publicationIntentDrift(root, prepared.intent_bindings);
+	if (finalIntentDrift) return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", finalIntentDrift, parentResult, taskResults);
+	const statuses = [parentResult.status, ...taskResults.map((task) => task.status)];
+	const status: TrackerStatus = statuses.every((item) => item === "created")
+		? "created"
+		: statuses.every((item) => item === "already_current") ? "already_current" : "updated";
+	const issueNumber = (taskId: string): number => numberByTask.get(taskId) ?? bound.get(taskId)!.number;
+	const firstTaskId = prepared.order[0].task_id;
+	return publicationResultWithPlan(plannedTaskIds, status, "complete Initiative Parent, Children, and dependency graph published", parentResult, taskResults, {
+		recommended_first_task_id: firstTaskId,
+		recommended_first_issue_number: issueNumber(firstTaskId),
+		order: prepared.order.map((operation) => operation.task_id),
+		issue_order: prepared.order.map((operation) => issueNumber(operation.task_id)),
+		parallel_groups: prepared.parallel_groups,
+		parallel_issue_groups: prepared.parallel_groups.map((group) => group.map(issueNumber)),
+	});
 }
 
 export async function runGithubInitiativePublication(
 	root: string,
 	input: InitiativePublicationInput,
-	gh: GhTransport = createGhTransport(),
+	rawGh: GhTransport = createGhTransport(),
+	budget?: OperationCancellation,
 ): Promise<GithubInitiativePublicationResult> {
 	const absoluteRoot = resolve(root);
+	// One publication call is a finite remote step sequence with no cumulative
+	// deadline: the caller may still supply a cancellation signal, which is
+	// forwarded to every call, and each call keeps its own per-call timeout.
+	const gh: GhTransport = budget?.signal === undefined
+		? rawGh
+		: { run: (args, options = {}) => rawGh.run(args, { ...options, signal: budget.signal }) };
+	// The complete planned step set, known before the first remote write. Every
+	// unconfirmed Task from this set is a pending step, so a Parent failure or an
+	// early Child failure still names each unfinished Task.
 	let prepared: ReturnType<typeof preflightPublication>;
 	let amendment: ReturnType<typeof validateAmendment> | undefined;
-	let amendmentContext: AmendmentExecutionContext | undefined;
+	// Assigned the moment the plan exists. Every result built after that point
+	// reports the same planned Task set, including the error paths.
+	let plannedTaskIds: string[] = [];
 	try {
 		prepared = preflightPublication(absoluteRoot, input);
+		plannedTaskIds = prepared.order.map((operation) => operation.task_id);
 		if (input.amendment !== undefined) {
 			if (prepared.order.length < 1)
 				throw new Error("an amendment requires at least one pending Task");
@@ -2280,22 +2776,22 @@ export async function runGithubInitiativePublication(
 			amendment = validated;
 		}
 	} catch (error) {
-		return publicationResult("permanent_failure", error instanceof Error ? error.message : String(error));
+		return publicationResultWithPlan(plannedTaskIds, "permanent_failure", error instanceof Error ? error.message : String(error));
 	}
 	const conflict = carrierConflict(absoluteRoot, "create-initiative", prepared.initiative.initiative_id);
-	if (conflict) return publicationResult(conflict.status, conflict.message, conflict);
+	if (conflict) return publicationResultWithPlan(plannedTaskIds, conflict.status, conflict.message, conflict);
 	const initial = await snapshot(absoluteRoot, gh, "create-initiative");
-	if ("contract" in initial) return publicationResult(initial.status, initial.message, initial);
+	if ("contract" in initial) return publicationResultWithPlan(plannedTaskIds, initial.status, initial.message, initial);
 	const initialParent = initiativeLookup(initial.issues, initial.repository.id, prepared.initiative.initiative_id);
-	if (initialParent.kind === "ambiguous") return publicationResult("ambiguous_remote_state", initialParent.message);
+	if (initialParent.kind === "ambiguous") return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", initialParent.message);
 	if (amendment && initialParent.kind === "missing")
-		return publicationResult("permanent_failure", "an amendment requires the Initiative Parent to already exist");
+		return publicationResultWithPlan(plannedTaskIds, "permanent_failure", "an amendment requires the Initiative Parent to already exist");
 	// Label availability is validated before any remote mutation: the tracker
 	// never creates labels, so a missing label fails the whole batch closed
 	// instead of half-publishing an Initiative.
 	const requiredLabels = [...new Set(prepared.order.flatMap((operation) => desiredTaskLabels(operation)))];
 	const labelFailure = await labelAvailabilityFailure(absoluteRoot, gh, initial.repository, requiredLabels);
-	if (labelFailure) return publicationResult(labelFailure.status, labelFailure.message, labelFailure);
+	if (labelFailure) return publicationResultWithPlan(plannedTaskIds, labelFailure.status, labelFailure.message, labelFailure);
 	const parentForPreflight = initialParent.kind === "found" ? initialParent.issue : {
 		id: Number.MAX_SAFE_INTEGER,
 		number: Number.MAX_SAFE_INTEGER,
@@ -2307,241 +2803,66 @@ export async function runGithubInitiativePublication(
 		labels: [],
 	};
 	const parentBodyFailure = bodyLimitFailure("create-initiative", createInitiativeBody(initial.repository, prepared.initiative));
-	if (parentBodyFailure) return publicationResult(parentBodyFailure.status, parentBodyFailure.message, parentBodyFailure);
+	if (parentBodyFailure) return publicationResultWithPlan(plannedTaskIds, parentBodyFailure.status, parentBodyFailure.message, parentBodyFailure);
 	for (const operation of prepared.order) {
 		const childFailure = bodyLimitFailure("upsert-task", childBody(initial.repository, operation, parentForPreflight), MAX_TERMINAL_SUFFIX_BYTES);
-		if (childFailure) return publicationResult(childFailure.status, childFailure.message, childFailure);
+		if (childFailure) return publicationResultWithPlan(plannedTaskIds, childFailure.status, childFailure.message, childFailure);
 	}
-
-	if (amendment) {
-		if (initialParent.kind !== "found")
-			return publicationResult("permanent_failure", "an amendment requires the Initiative Parent to already exist");
-		// Caller-controlled binding constraints (missing or duplicate historical
-		// Slice markers) must surface as structured fail-closed publication results,
-		// never as thrown exceptions escaping the guarded validation boundary.
-		let approvedFinalParent: ReturnType<typeof approvedAmendmentContent>;
-		try {
-			approvedFinalParent = approvedAmendmentContent(absoluteRoot, initial.repository, initialParent.issue, prepared, amendment);
-		} catch (error) {
-			return publicationResult("permanent_failure", error instanceof Error ? error.message : String(error));
-		}
-		// Slice identity collisions are deterministic input contract violations (the
-		// batch itself declares two Children with one Slice id), not remote drift.
-		if (typeof approvedFinalParent === "string" && approvedFinalParent.includes("collides with a historical Task Slice"))
-			return publicationResult("permanent_failure", approvedFinalParent);
-		if (typeof approvedFinalParent === "string") return publicationResult("ambiguous_remote_state", approvedFinalParent);
-		const { parent, pendingContent, historicalSlices } = approvedFinalParent;
-		// Deterministic prerequisite completion is validated before any write: a
-		// historical prerequisite already closed without state_reason "completed"
-		// (e.g. not_planned) makes the batch permanently unfulfillable, so it must
-		// fail closed in preflight with zero mutations instead of after the Parent
-		// and Child writes (the final check still guards concurrent races).
-		for (const operation of prepared.order) {
-			for (const blockerId of operation.projection?.blocked_by ?? []) {
-				if (!amendment.historical.has(blockerId)) continue;
-				const blocker = taskLookup(initial.issues, initial.repository.id, blockerId);
-				if (blocker.kind === "found" && (blocker.issue.state !== "closed" || blocker.issue.state_reason !== "completed"))
-					return publicationResult("ambiguous_remote_state", `Task ${operation.task_id} depends on stopped historical prerequisite ${blockerId}`);
-			}
-		}
-		const parentBaseline = amendment.parent.body !== initialParent.issue.body || amendment.parent.title !== initialParent.issue.title;
-		const parentApproved = initialParent.issue.title === parent.title && initialParent.issue.body === parent.body;
-		if (parentBaseline && !parentApproved) return publicationResult("ambiguous_remote_state", `amendment Parent changed since the approved amendment baseline`);
-		if (amendment.parent.issue_number !== initialParent.issue.number)
-			return publicationResult("ambiguous_remote_state", `amendment Parent is bound to Issue #${amendment.parent.issue_number} but observed Issue #${initialParent.issue.number}`);
-		if (initialParent.issue.state !== "open")
-			return publicationResult("ambiguous_remote_state", "an amendment requires the Initiative Parent to remain open");
-		const topology = await validateAmendmentTopology(
-			absoluteRoot, gh, initial, prepared.initiative.initiative_id, initialParent.issue,
-			amendment.tasks, amendment.historical,
-			prepared.foreign_dependers,
-			{ pendingContent, parent, historicalSlices },
-			prepared.order,
+	// Ordinary publication and amendment share the direct write flow: neither
+	// re-reads after a write.
+	if (!amendment) return publishInitiativeDirect(absoluteRoot, gh, prepared, initial);
+
+	if (initialParent.kind !== "found")
+		return publicationResultWithPlan(plannedTaskIds, "permanent_failure", "an amendment requires the Initiative Parent to already exist");
+	// Caller-controlled binding constraints (missing or duplicate historical
+	// Slice markers) must surface as structured fail-closed publication results,
+	// never as thrown exceptions escaping the guarded validation boundary.
+	let approvedFinalParent: ReturnType<typeof approvedAmendmentContent>;
+	try {
+		approvedFinalParent = approvedAmendmentContent(absoluteRoot, initial.repository, initialParent.issue, prepared, amendment);
+	} catch (error) {
+		return publicationResultWithPlan(
+			plannedTaskIds,
+			"permanent_failure",
+			error instanceof Error ? error.message : String(error),
 		);
-		if (!("get" in topology)) return publicationResult(topology.status, topology.message, topology);
-		const historicalRelations = new Map<string, { blocked_by: number[]; state_reason: string | null }>();
-		for (const [taskId] of amendment.historical) {
-			const issue = topology.get(taskId)!;
-			const observed = await readBlockedByIds(absoluteRoot, gh, "upsert-task", initial.repository, issue.number);
-			if (!Array.isArray(observed)) return publicationResult(observed.status, observed.message, observed);
-			historicalRelations.set(taskId, { blocked_by: observed, state_reason: issue.state_reason });
-		}
-		amendmentContext = {
-			pendingContent,
-			parent,
-			parentIssueNumber: amendment.parent.issue_number,
-			historicalSlices,
-			historicalRelations,
-		};
-	}
-
-	const beforeParentWrite = publicationIntentDrift(absoluteRoot, prepared.intent_bindings);
-	if (beforeParentWrite) return publicationResult("ambiguous_remote_state", beforeParentWrite);
-	let parentResult: GithubTrackerResult;
-	if (amendment && amendmentContext) {
-		parentResult = await amendInitiativeParent(absoluteRoot, gh, prepared.initiative, initial, amendment.parent, amendmentContext);
-	} else {
-		parentResult = await runGithubTrackerOperation(absoluteRoot, prepared.initiative, gh);
-	}
-	if (!isSuccessfulTrackerStatus(parentResult.status))
-		return publicationResult(parentResult.status, parentResult.message, parentResult);
-	const taskResults: GithubInitiativePublicationResult["tasks"] = [];
-	for (const operation of prepared.order) {
-		const intentDrift = publicationIntentDrift(absoluteRoot, prepared.intent_bindings, [operation.task_id]);
-		if (intentDrift) return publicationResult("ambiguous_remote_state", intentDrift, parentResult, taskResults);
-		const taskResult = amendment
-			? await runAmendmentTaskOperation(absoluteRoot, gh, operation, amendment.tasks.get(operation.task_id), amendmentContext)
-			: await runGithubTrackerOperation(absoluteRoot, operation, gh);
-		taskResults.push({
-			task_id: operation.task_id,
-			slice_id: operation.slice_id,
-			status: taskResult.status,
-			...(taskResult.issue_number === undefined ? {} : { issue_number: taskResult.issue_number }),
-			...(taskResult.issue_url === undefined ? {} : { issue_url: taskResult.issue_url }),
-			...(taskResult.node_id === undefined ? {} : { node_id: taskResult.node_id }),
-		});
-		if (!isSuccessfulTrackerStatus(taskResult.status))
-			return publicationResult(taskResult.status, taskResult.message, parentResult, taskResults);
-	}
-
-	const finalIntentDrift = publicationIntentDrift(absoluteRoot, prepared.intent_bindings);
-	if (finalIntentDrift) return publicationResult("ambiguous_remote_state", finalIntentDrift, parentResult, taskResults);
-	const finalSource = await snapshot(absoluteRoot, gh, "upsert-task");
-	if ("contract" in finalSource) return publicationResult(finalSource.status, finalSource.message, parentResult, taskResults);
-	if (amendment) {
-		// Repeat complete observed-membership classification on the final snapshot:
-		// an undeclared closed Task carrying this Initiative's markers that becomes
-		// observable only after preflight (detached, so the Sub-issue parity check
-		// cannot see it) must still fail the publication, not report success.
-		const finalClassified = classifyObservedChildren(finalSource, prepared.initiative.initiative_id, amendment.tasks, amendment.historical);
-		if (typeof finalClassified === "string") return publicationResult("ambiguous_remote_state", finalClassified, parentResult, taskResults);
 	}
-	const parent = initiativeLookup(finalSource.issues, finalSource.repository.id, prepared.initiative.initiative_id);
-	if (parent.kind !== "found") return publicationResult("ambiguous_remote_state", parent.kind === "ambiguous" ? parent.message : "published Initiative Parent disappeared", parentResult, taskResults);
-	const amendedFinalSliceIds = new Set(prepared.initiative.slices.map((slice) => slice.id));
-	const parentDrift = publicationIssueDrift(
-		parentResult,
-		parent.issue,
-		amendmentContext ? amendmentContext.parent.title : initiativeIssueTitle(prepared.initiative.initiative_id, prepared.initiative.projection),
-		amendmentContext
-			? amendmentContext.parent.body
-			: createInitiativeBody(finalSource.repository, prepared.initiative),
-		"Initiative Parent",
-	);
-	if (parentDrift) return publicationResult("ambiguous_remote_state", parentDrift, parentResult, taskResults);
-	if (amendmentContext) {
-		// The rewritten Parent must carry each declared historical Slice marker
-		// exactly once: generation drops or duplicates would break terminal
-		// ownership without failing any other final check.
-		for (const line of amendmentContext.historicalSlices) {
-			const sliceId = ownershipMarkerValue(line, "slice-id");
-			if (!sliceId || countLiteral(parent.issue.body, marker("slice-id", sliceId)) !== 1)
-				return publicationResult("ambiguous_remote_state", `regenerated Parent does not carry historical Slice ${sliceId ?? "?"} exactly once`, parentResult, taskResults);
-		}
-	}
-	const resultByTask = new Map(taskResults.map((task) => [task.task_id, task]));
-	const expectedNumbers: number[] = [];
+	// Slice identity collisions are deterministic input contract violations (the
+	// batch itself declares two Children with one Slice id), not remote drift.
+	if (typeof approvedFinalParent === "string" && approvedFinalParent.includes("collides with a historical Task Slice"))
+		return publicationResultWithPlan(plannedTaskIds, "permanent_failure", approvedFinalParent);
+	if (typeof approvedFinalParent === "string") return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", approvedFinalParent);
+	const { parent, pendingContent, historicalSlices } = approvedFinalParent;
+	// Deterministic prerequisite completion is validated before any write: a
+	// historical prerequisite already closed without state_reason "completed"
+	// (e.g. not_planned) makes the batch permanently unfulfillable.
 	for (const operation of prepared.order) {
-		const child = ownedTaskLookup(finalSource.issues, finalSource.repository.id, operation.task_id, operation.initiative_id, operation.slice_id);
-		if (child.kind !== "found") return publicationResult("ambiguous_remote_state", child.kind === "ambiguous" ? child.message : `published Task ${operation.task_id} disappeared`, parentResult, taskResults);
-		const childResult = resultByTask.get(operation.task_id);
-		if (!childResult) return publicationResult("ambiguous_remote_state", `published Task ${operation.task_id} has no batch result`, parentResult, taskResults);
-		const childDrift = publicationIssueDrift(
-			childResult,
-			child.issue,
-			taskIssueTitle(operation, sliceOrdinalFromChecklist(parent.issue.body, operation.slice_id, operation.projection?.slice_ordinal ?? 1)),
-			childBody(finalSource.repository, operation, parent.issue),
-			`Task ${operation.task_id}`,
-			{ allowTerminalSuffix: amendmentContext !== undefined },
-		);
-		if (childDrift) return publicationResult("ambiguous_remote_state", childDrift, parentResult, taskResults);
-		const expectedLabels = desiredTaskLabels(operation);
-		if (childResult.status !== "already_current" && expectedLabels.some((label) => !child.issue.labels.includes(label)))
-			return publicationResult("ambiguous_remote_state", `Task ${operation.task_id} is missing publication labels after publication`, parentResult, taskResults);
-		expectedNumbers.push(child.issue.number);
-		const ownership = await confirmTerminalOwnership(absoluteRoot, gh, "upsert-task", finalSource, child.issue);
-		if (!("owned" in ownership)) return publicationResult(ownership.status, ownership.message, parentResult, taskResults);
-		const blockers: GithubIssue[] = [];
 		for (const blockerId of operation.projection?.blocked_by ?? []) {
-			const blocker = taskLookup(finalSource.issues, finalSource.repository.id, blockerId);
-			if (blocker.kind !== "found") return publicationResult("ambiguous_remote_state", `published blocker ${blockerId} disappeared`, parentResult, taskResults);
-			blockers.push(blocker.issue);
+			if (!amendment.historical.has(blockerId)) continue;
+			const blocker = taskLookup(initial.issues, initial.repository.id, blockerId);
+			if (blocker.kind === "found" && (blocker.issue.state !== "closed" || blocker.issue.state_reason !== "completed"))
+				return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", `Task ${operation.task_id} depends on stopped historical prerequisite ${blockerId}`);
 		}
-		const dependencies = await confirmBlockedBy(absoluteRoot, gh, "upsert-task", finalSource.repository, child.issue.number, blockers);
-		if (!("complete" in dependencies)) return publicationResult(dependencies.status, dependencies.message, parentResult, taskResults);
-		if (!dependencies.complete) return publicationResult("ambiguous_remote_state", `Task ${operation.task_id} has incomplete blocking relations`, parentResult, taskResults);
 	}
-	const attached = await readSubIssueNumbers(absoluteRoot, gh, "upsert-task", finalSource.repository, parent.issue.number);
-	if (!Array.isArray(attached)) return publicationResult(attached.status, attached.message, parentResult, taskResults);
-	if (amendment) {
-		for (const [taskId, binding] of amendment.historical) {
-			// Full ownership lookup: repository, protocol, marker uniqueness, and
-			// repo-wide Task identity must resolve the exact bound Issue.
-			const owned = taskLookup(finalSource.issues, finalSource.repository.id, taskId);
-			if (owned.kind !== "found" || owned.issue.number !== binding.issue_number)
-				return publicationResult("ambiguous_remote_state", `historical Task ${taskId} ownership failed after publication`, parentResult, taskResults);
-			const historical = owned.issue;
-			const drift = amendmentBindingDrift(binding, historical, `historical Task ${taskId}`);
-			if (drift) return publicationResult("ambiguous_remote_state", drift, parentResult, taskResults);
-			if (!attached.includes(historical.number))
-				return publicationResult("ambiguous_remote_state", `historical Task ${taskId} lost its native Sub-issue attachment`, parentResult, taskResults);
-			// R1 final check: historical Slice identities must not collide with any
-			// pending Slice published by this batch — two Children must never share
-			// one Slice identity, including historical Children whose Parent lines are
-			// carried over rather than re-rendered.
-			const historicalSliceId = ownershipMarkerValue(historical.body, "slice-id");
-			if (historicalSliceId && amendedFinalSliceIds.has(historicalSliceId))
-				return publicationResult("ambiguous_remote_state", `historical Task ${taskId} Slice ${historicalSliceId} collides with a pending Task Slice of the same id`, parentResult, taskResults);
-			const snapshotRelations = amendmentContext?.historicalRelations.get(taskId);
-			if (snapshotRelations) {
-				if (historical.state_reason !== snapshotRelations.state_reason)
-					return publicationResult("ambiguous_remote_state", `historical Task ${taskId} terminal state_reason changed during amendment`, parentResult, taskResults);
-				const finalBlockedBy = await readBlockedByIds(absoluteRoot, gh, "upsert-task", finalSource.repository, historical.number);
-				if (!Array.isArray(finalBlockedBy)) return publicationResult(finalBlockedBy.status, finalBlockedBy.message, parentResult, taskResults);
-				if (finalBlockedBy.length !== snapshotRelations.blocked_by.length || finalBlockedBy.some((id, index) => id !== snapshotRelations.blocked_by[index]))
-					return publicationResult("ambiguous_remote_state", `historical Task ${taskId} native blocked_by relations changed during amendment`, parentResult, taskResults);
-			}
-		}
-		const attachedNumbers = new Set(attached);
-		for (const number of attachedNumbers) {
-			const issue = finalSource.issues.find((candidate) => candidate.number === number);
-			const taskId = issue ? ownershipMarkerValue(issue.body, "task-id") : null;
-		if (!taskId || (!amendment.tasks.has(taskId) && !amendment.historical.has(taskId)))
-				return publicationResult("ambiguous_remote_state", `Parent Sub-issue #${number} is not part of the declared amendment membership`, parentResult, taskResults);
-		}
-		for (const operation of prepared.order) {
-			for (const blockerId of operation.projection?.blocked_by ?? []) {
-				if (amendment.historical.has(blockerId)) {
-					const blocker = taskLookup(finalSource.issues, finalSource.repository.id, blockerId);
-					if (blocker.kind !== "found" || blocker.issue.state_reason !== "completed")
-						return publicationResult("ambiguous_remote_state", `Task ${operation.task_id} depends on stopped historical prerequisite ${blockerId}`, parentResult, taskResults);
-				}
-			}
-		}
-	}
-	const sortedAttached = [...attached].sort((left, right) => left - right);
-	const sortedExpected = [...expectedNumbers, ...(amendment ? [...amendment.historical.values()].map((binding) => binding.issue_number) : [])].sort((left, right) => left - right);
-	if (sortedAttached.length !== sortedExpected.length || sortedAttached.some((number, index) => number !== sortedExpected[index]))
-		return publicationResult("ambiguous_remote_state", "Initiative Parent Sub-issues do not match the complete publication batch", parentResult, taskResults);
-	const statuses = [parentResult.status, ...taskResults.map((task) => task.status)];
-	const status: TrackerStatus = statuses.every((item) => item === "created")
-		? "created"
-		: statuses.every((item) => item === "already_current") ? "already_current" : "updated";
-	const issueByTask = new Map(taskResults.map((task) => [task.task_id, task.issue_number]));
-	if ([...issueByTask.values()].some((number) => number === undefined))
-		return publicationResult("ambiguous_remote_state", "published Task result is missing an Issue number", parentResult, taskResults);
-	const issueNumber = (taskId: string): number => issueByTask.get(taskId)!;
-	const firstTaskId = prepared.order[0].task_id;
-	return publicationResult(status, "complete Initiative Parent, Children, and dependency graph published", parentResult, taskResults, {
-		recommended_first_task_id: firstTaskId,
-		recommended_first_issue_number: issueNumber(firstTaskId),
-		order: prepared.order.map((operation) => operation.task_id),
-		issue_order: prepared.order.map((operation) => issueNumber(operation.task_id)),
-		parallel_groups: prepared.parallel_groups,
-		parallel_issue_groups: prepared.parallel_groups.map((group) => group.map(issueNumber)),
-	});
+	// The approved baseline is the only accepted starting point. Every fact here
+	// comes from the start listing, before any write.
+	const parentBaseline = amendment.parent.body !== initialParent.issue.body || amendment.parent.title !== initialParent.issue.title;
+	const parentApproved = initialParent.issue.title === parent.title && initialParent.issue.body === parent.body;
+	if (parentBaseline && !parentApproved)
+		return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", "amendment Parent changed since the approved amendment baseline");
+	if (amendment.parent.issue_number !== initialParent.issue.number)
+		return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", `amendment Parent is bound to Issue #${amendment.parent.issue_number} but observed Issue #${initialParent.issue.number}`);
+	if (initialParent.issue.state !== "open")
+		return publicationResultWithPlan(plannedTaskIds, "ambiguous_remote_state", "an amendment requires the Initiative Parent to remain open");
+	const amendmentContextValue: AmendmentExecutionContext = {
+		pendingContent,
+		parent,
+		historicalSlices,
+	};
+	return publishAmendmentDirect(absoluteRoot, gh, prepared, initial, amendment, amendmentContextValue);
 }
 
+
 function isSuccessfulTrackerStatus(status: TrackerStatus): boolean {
 	return status === "created" || status === "updated" || status === "already_current";
 }
@@ -2602,6 +2923,7 @@ function taskPublication(
 			risk: intent.risk,
 			acceptance: intent.acceptance.map((item) => publicById.get(item.id)!),
 			projection: stampedProjection,
+			intent_hash: read.content_hash,
 		}) as Extract<TrackerOperation, { op: "upsert-task" }>,
 		intent_path: read.intent_ref.path,
 		intent_content_hash: read.content_hash,