diff --git a/apps/presentation/dashboard/smoke/assets/todo-lifecycle/after-deferred.png b/apps/presentation/dashboard/smoke/assets/todo-lifecycle/after-deferred.png
new file mode 100644
index 0000000000..acc17e72dd
Binary files /dev/null and b/apps/presentation/dashboard/smoke/assets/todo-lifecycle/after-deferred.png differ
diff --git a/apps/presentation/dashboard/smoke/assets/todo-lifecycle/before-deferred.png b/apps/presentation/dashboard/smoke/assets/todo-lifecycle/before-deferred.png
new file mode 100644
index 0000000000..fec4128e03
Binary files /dev/null and b/apps/presentation/dashboard/smoke/assets/todo-lifecycle/before-deferred.png differ
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/context-drawer.tsx b/apps/presentation/dashboard/src/features/personal-workspace/context-drawer.tsx
index 506cc30ba2..4ced7c7da0 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/context-drawer.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/context-drawer.tsx
@@ -68,7 +68,7 @@ const focusableSelector = [
   "[tabindex]:not([tabindex='-1'])",
 ].join(",");
 
-type TodoOperation = "block" | "complete" | "defer" | "successor_create";
+type TodoOperation = "block" | "resume" | "complete" | "defer" | "successor_create";
 
 type GoalSubagentPreview = {
   codexHostCapacity?: WorkspaceGoalSubagentConfiguration["codexHostCapacity"];
@@ -422,7 +422,8 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
       normalizedParameters: {
         agent_id: todo.claimedBy ?? todoAgentId,
         goal_id: todo.goalId,
-        operation,
+        operation: operation === "resume" ? "edit" : operation,
+        ...(operation === "resume" ? {status: "open"} : {}),
         ...(operation === "block" ? { note: t("drawer.taskSuccessorNote") } : {}),
         ...(operation === "defer" && resumeWhen ? { resume_when: resumeWhen } : {}),
         todo_id: todo.todoId,
@@ -432,6 +433,8 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
     });
   }
 
+  const todoAwaitingResume = selection.kind === "todo" && ["blocked", "deferred"].includes(selection.item.status ?? "");
+  const todoCompleted = selection.kind === "todo" && (selection.item.status === "done" || selection.item.status == null && selection.item.done);
   const currentSubagentConfiguration: WorkspaceGoalSubagentConfiguration = selection.kind === "goal"
     ? verifiedSubagentConfiguration
       ?? selection.item.subagentExecution
@@ -642,14 +645,14 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
           <>
             <section className="personal-task-inspector-summary">
               <div className="personal-task-inspector-status">
-                <span className={selection.item.done ? "is-done" : selection.item.status === "blocked" ? "is-blocked" : "is-open"}>
-                  <i />{selection.item.done ? t("drawer.taskStatusCompleted") : selection.item.retryReadback ? t("drawer.resumePending") : selection.item.status === "deferred" ? t("drawer.taskStatusDeferred") : selection.item.status === "blocked" ? t("drawer.taskStatusBlocked") : t("drawer.taskStatusOpen")}
+                <span className={selection.item.status === "done" ? "is-done" : selection.item.status === "blocked" ? "is-blocked" : "is-open"}>
+                  <i />{selection.item.status === "done" ? t("drawer.taskStatusCompleted") : selection.item.retryReadback ? t("drawer.resumePending") : selection.item.status === "deferred" ? t("drawer.taskStatusDeferred") : selection.item.status === "blocked" ? t("drawer.taskStatusBlocked") : t("drawer.taskStatusOpen")}
                 </span>
                 {selection.item.priority ? <span>{selection.item.priority}</span> : null}
                 <span>{selection.item.taskClass === "advancement_task" ? t("drawer.taskAdvancement") : selection.item.taskClass ?? t("drawer.taskOrdinary")}</span>
               </div>
               <TaskRequest todo={selection.item} local={!readOnly} />
-              {selection.item.status === "blocked" && !selection.item.done ? <section aria-label={t("drawer.blockedReason")} className="personal-task-blocked-reason" data-recorded={selection.item.blockedReason ? "true" : "false"}>
+              {selection.item.status === "blocked" ? <section aria-label={t("drawer.blockedReason")} className="personal-task-blocked-reason" data-recorded={selection.item.blockedReason ? "true" : "false"}>
                 <h4><AlertCircle size={14} />{t("drawer.blockedReason")}</h4>
                 <p>{selection.item.blockedReason ?? t("drawer.blockedReasonMissing")}</p>
               </section> : null}
@@ -659,7 +662,7 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
               <dl>
                 <div><dt>Goal</dt><dd>{selection.item.goalTitle}</dd></div>
                 <div><dt>{t("common.owner")}</dt><dd>{selection.item.claimedBy ? selection.item.ownerLabel ?? selection.item.claimedBy : t("drawer.notAssigned")}</dd></div>
-                <div><dt>{t("common.status")}</dt><dd>{selection.item.done ? t("drawer.taskStatusCompleted") : selection.item.retryReadback ? t("drawer.resumePending") : selection.item.status === "deferred" ? t("drawer.taskStatusDeferred") : selection.item.status === "blocked" ? t("drawer.taskStatusBlocked") : t("drawer.taskStatusOpen")}</dd></div>
+                <div><dt>{t("common.status")}</dt><dd>{selection.item.status === "done" ? t("drawer.taskStatusCompleted") : selection.item.retryReadback ? t("drawer.resumePending") : selection.item.status === "deferred" ? t("drawer.taskStatusDeferred") : selection.item.status === "blocked" ? t("drawer.taskStatusBlocked") : t("drawer.taskStatusOpen")}</dd></div>
                 <div><dt>{t("drawer.priority")}</dt><dd>{selection.item.priority ?? t("drawer.notSet")}</dd></div>
                 {selection.item.completedAt ? <div><dt>{t("drawer.completedAt")}</dt><dd><time dateTime={selection.item.completedAt}>{selection.item.completedAt}</time></dd></div> : null}
                 {selection.item.dependencies ? <div><dt>{t("drawer.dependencies")}</dt><dd>{selection.item.dependencies.join(" · ") || t("common.none")}</dd></div> : null}
@@ -676,10 +679,10 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
                   <div><dt>{t("drawer.validationDigest")}</dt><dd><code>{selection.item.validationDigest}</code></dd></div>
                   {selection.item.validationRevisionActor ? <div><dt>{t("drawer.validationRevisionActor")}</dt><dd>{selection.item.validationRevisionActor}</dd></div> : null}
                 </> : null}
-                <div><dt>{t("drawer.nextTransition")}</dt><dd>{selection.item.nextTransition ?? (selection.item.done ? t("drawer.taskNextCompleted") : selection.item.resumeInvalidReason === "dependency_cycle" ? t("drawer.taskNextCycle") : selection.item.retryReadback ? t("drawer.taskNextDeferred") : selection.item.resumeReady ? t("drawer.taskNextResumeReady") : selection.item.status === "deferred" ? t("drawer.taskNextDeferred") : selection.item.status === "blocked" ? t("drawer.taskNextBlocked") : t("drawer.taskNextOpen"))}</dd></div>
+                <div><dt>{t("drawer.nextTransition")}</dt><dd>{selection.item.nextTransition ?? (selection.item.status === "done" ? t("drawer.taskNextCompleted") : selection.item.resumeInvalidReason === "dependency_cycle" ? t("drawer.taskNextCycle") : selection.item.retryReadback ? t("drawer.taskNextDeferred") : selection.item.resumeReady ? t("drawer.taskNextResumeReady") : selection.item.status === "deferred" ? t("drawer.taskNextDeferred") : selection.item.status === "blocked" ? t("drawer.taskNextBlocked") : t("drawer.taskNextOpen"))}</dd></div>
               </dl>
             </section>
-            {!readOnly && !selection.item.done ? <div className="personal-task-inspector-actions" aria-label={t("drawer.taskActions")}>
+            {!readOnly && selection.item.status !== "done" ? <div className="personal-task-inspector-actions" aria-label={t("drawer.taskActions")}>
               <details className="personal-task-management">
                 <summary><MoreHorizontal size={16} />{t("drawer.taskManage")}</summary>
                 <div>
@@ -706,12 +709,13 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
                       actionKind: "todo.update",
                       context: {goal_id: selection.item.goalId, kind: "todo", todo_id: selection.item.todoId},
                       idempotencyKey: `workspace-todo-${selection.item.todoId}-priority-${todoPriority}-${Date.now().toString(36)}`,
-                      normalizedParameters: {goal_id: selection.item.goalId, todo_id: selection.item.todoId, operation: "edit",
+                      normalizedParameters: {goal_id: selection.item.goalId, todo_id: selection.item.todoId,
+                        agent_id: selection.item.claimedBy ?? todoAgentId, operation: "edit",
                         ...(todoPriority === "clear" ? {clear_priority: true} : {priority: todoPriority})},
                       summary: `${t("drawer.taskPriority")}: ${todoPriority === "clear" ? t("drawer.taskPriorityClear") : todoPriority}`,
                     })} type="button">{t("timeline.review")}</button>
                   </label>
-                  <strong>{t("drawer.taskDeferUntil")}</strong>
+                  {!todoAwaitingResume ? <><strong>{t("drawer.taskDeferUntil")}</strong>
                   <label className="personal-inline-agent-select personal-inline-resume-when">{t("drawer.taskDeferUntil")}
                     <input
                       aria-label={t("drawer.taskDeferCondition")}
@@ -722,21 +726,21 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
                     />
                     <button className="personal-secondary-action" disabled={!normalizedTodoResumeWhen} onClick={() => void previewTodoTransition(selection.item, "defer", t("drawer.taskDefer"), normalizedTodoResumeWhen ?? undefined)} type="button">{t("drawer.taskDeferReview")}</button>
                     <small>{todoResumeWhen.trim() && !normalizedTodoResumeWhen ? t("drawer.taskDeferInvalid") : t("drawer.taskDeferSupported")}</small>
-                  </label>
+                  </label></> : null}
                   <div className="personal-task-management-secondary">
-                    {todoTransitions.map((transition) => (
+                    {todoTransitions.filter(transition => !todoAwaitingResume || transition.operation !== "block").map((transition) => (
                       <button key={transition.operation} onClick={() => void previewTodoTransition(selection.item, transition.operation, t(transition.key))} type="button">{t(transition.key)}</button>
                     ))}
                   </div>
                 </div>
               </details>
-              <button className="personal-primary-action" onClick={() => void previewTodoTransition(selection.item, "complete", t("drawer.taskComplete"))} type="button"><Check size={17} />{t("drawer.taskComplete")}</button>
-              <details className="personal-task-completion-proof">
+              <button className="personal-primary-action" onClick={() => void previewTodoTransition(selection.item, todoAwaitingResume ? "resume" : "complete", t(todoAwaitingResume ? "drawer.taskResume" : "drawer.taskComplete"))} type="button">{!todoAwaitingResume ? <Check size={17} /> : null}{t(todoAwaitingResume ? "drawer.taskResume" : "drawer.taskComplete")}</button>
+              {todoAwaitingResume ? <small>{t("drawer.taskResumeHint")}</small> : <details className="personal-task-completion-proof">
                 <summary>{t("drawer.taskCompletionProof")}</summary>
                 <label><textarea aria-label={t("drawer.taskCompletionProof")} rows={4}
                   value={todoCompletionProof} onChange={(event) => setTodoCompletionProof(event.target.value)} />
                   <small>{t("drawer.taskCompletionProofHint")}</small></label>
-              </details>
+              </details>}
             </div> : null}
             {selection.item.evidence ? <section className="personal-detail-card" aria-label={t("drawer.evidence")}>
               <h4>{t("drawer.evidence")}</h4>
@@ -746,7 +750,7 @@ export function ContextDrawer({ agents, attentionHistory = [], onSelectAttention
               <summary>{t("drawer.notes")}</summary>
               <MarkdownText text={selection.item.note} />
             </details> : null}
-            {selection.item.done ? <div className="personal-task-completed-note"><Check size={16} /><span><strong>{t("drawer.taskCompletedTitle")}</strong><small>{t("drawer.taskCompletedNote")}</small></span></div> : null}
+            {selection.item.status === "done" ? <div className="personal-task-completed-note"><Check size={16} /><span><strong>{t("drawer.taskCompletedTitle")}</strong><small>{t("drawer.taskCompletedNote")}</small></span></div> : null}
           </>
         ) : null}
 
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx b/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx
index e562f0dd4b..9782e58b72 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx
+++ b/apps/presentation/dashboard/src/features/personal-workspace/i18n.tsx
@@ -507,6 +507,8 @@ const en = {
   "drawer.taskActions": "Pending Todo actions",
   "drawer.taskAdvancement": "Advancement task",
   "drawer.taskBlock": "Mark blocked",
+  "drawer.taskResume": "Resume task",
+  "drawer.taskResumeHint": "Makes this task eligible to run again. Existing sessions have their own controls.",
   "drawer.taskComplete": "Mark complete",
   "drawer.taskCompletedNote": "This task is retained as a read-only record.",
   "drawer.taskCompletedTitle": "Task completed",
@@ -2055,6 +2057,8 @@ const zhCN: Record<WorkspaceMessageKey, string> = {
   "drawer.taskActions": "Todo 待确认操作",
   "drawer.taskAdvancement": "推进任务",
   "drawer.taskBlock": "标记阻塞",
+  "drawer.taskResume": "恢复任务",
+  "drawer.taskResumeHint": "恢复后可继续安排执行；正在运行的会话需单独控制。",
   "drawer.taskComplete": "标记完成",
   "drawer.taskCompletedNote": "该任务保留为只读记录。",
   "drawer.taskCompletedTitle": "任务已完成",
diff --git a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs
index 73dc610423..8617b3eee4 100644
--- a/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs
+++ b/apps/presentation/dashboard/src/features/personal-workspace/personal-workspace-contract.test.mjs
@@ -50,7 +50,8 @@ for (const operation of ["reassign", "block"]) {
 assert.match(drawer, /previewTodoTransition\(selection\.item, "defer"/, "Todo defer collects a resume condition before preview");
 assert.match(drawer, /resume_when:\s*resumeWhen/, "Todo defer sends its explicit resume condition");
 assert.doesNotMatch(drawer + page, /owner_resume/, "Personal Workspace never emits the unsupported owner_resume sentinel");
-assert.match(drawer, /previewTodoTransition\(selection\.item, "complete"/, "Todo complete is the primary drawer action");
+assert.match(drawer, /\["blocked", "deferred"\]\.includes\(selection\.item\.status/, "Paused Todos offer resume through the existing primary action");
+assert.match(drawer, /className="personal-primary-action" onClick=\{\(\) => void previewTodoTransition\(selection\.item, todoAwaitingResume \? "resume" : "complete"/, "The primary Todo action resumes paused work and completes open work through typed preview");
 assert.match(drawer, /actionKind: "todo\.create"/, "Todo successor uses the canonical create action");
 
 for (const field of ["evidence", "explanation"]) {
diff --git a/docs/project-agent-todo-contract.md b/docs/project-agent-todo-contract.md
index 4bdfc85aff..f3814f5b5c 100644
--- a/docs/project-agent-todo-contract.md
+++ b/docs/project-agent-todo-contract.md
@@ -1146,38 +1146,41 @@ preserve both claim metadata and unrelated updates.
 The fifth verifies per-todo `required_capabilities`, including multiple P0/P1
 candidate selection, bridge repair, and owner-gated capability misses.
 
-### Lease-fenced canonical text/note updates
+### Administrative edits and explicit execution proof
 
-After explicit canonical-authority promotion, the active lease holder can edit
-`text` and `note` using the existing execution key and current lease version:
+On canonical `hard_lease` authority, a registered current owner can update task
+text, note, evidence, reason and priority without acquiring an execution lease:
 
 ```bash
 loopx todo update --goal-id <goal> --todo-id <todo> --agent-id <agent> \
-  --text 'Correct task description' --note 'Correction context' \
-  --task-lease-idempotency-key <execution-key> --task-lease-expected-version <version> \
+  --note 'Reviewed context' --evidence 'evidence:reviewed' \
   --update-operation-id <stable-update-id>
 ```
 
-Reuse the update id, execution proof and edit intent after a lost response.
-The original receipt can be replayed after lease expiry or transfer; it grants no
-current execution authority. Changed proof or edit intent with that id conflicts.
-Omitting the update id preserves a fresh id per CLI invocation. Preview writes
-nothing and does not consume the id. Updates preserve the lease exactly: they
-cannot acquire, renew, release or transfer it. Missing, stale or expired proof
-fails closed. These options do not enable promotion or a legacy Markdown fallback;
-legacy updates without the new options retain their existing behavior.
-An empty or Unicode-whitespace-only `--note` is an omitted note update and keeps
-the persisted note, before and after promotion. It never means clear; clearing a
-note requires a separate explicit contract.
-
-显式切换到 canonical authority 后，当前租约持有者可使用执行 key 和当前租约版本
-修改 `text`／`note`。响应丢失后复用相同 `--update-operation-id`、凭证和修改内容；
-历史回执可在租约过期或转交后回放，但不授予当前执行权。相同 ID 搭配不同凭证或
-内容会冲突；省略 ID 则每次 CLI 调用生成新 ID。Preview 不写入、不消耗 ID。
-更新不获取、续期、释放或转交租约；缺失、陈旧或过期凭证拒绝。此入口不自动
-promotion，也不回退 Markdown；不带新选项的 legacy 更新保持原行为。
-空字符串或仅含 Unicode 空白的 `--note` 视为省略 note 更新，在 promotion 前后都保留
-已持久化 note；它不表示清空。清空 note 需要另行定义显式契约。
+This changes the previous default that required an acquire/edit/release sequence
+for ordinary Agent metadata. The typed owner reads the current head and commits
+under provider CAS. The operation grants no execution, preserves retained lease
+history and cannot borrow another holder. Claims, exclusions, bindings, repository
+identity and reviewed source/revision checks still apply. Work requirements,
+dependencies, ownership, Monitor observations, validation and completion keep their
+own execution or lifecycle admission.
+
+Supplying either `--task-lease-idempotency-key` or `--task-lease-expected-version`
+opts into the existing strict execution fence. Supply both current values; stale,
+partial, expired or foreign proof is rejected, never silently refreshed or dropped.
+After a lost response, retry the same update ID, proof and edit intent. Historical
+receipt replay grants no current execution rights; changing that intent conflicts.
+Omitting the update ID creates a new ID per invocation. Preview writes nothing.
+An empty or Unicode-whitespace-only `--note` remains omission, never an implicit
+clear. Unsupported updates cannot fall back to Markdown or activate a provider.
+
+中文：canonical `hard_lease` 下，本人的普通任务说明、备注、证据、原因和优先级修改
+不再要求先领执行租约再释放；TS 在当前 provider CAS 中执行行政性编辑，保留租约历史，
+不授予执行权。注册、claim、排除、绑定、仓库与已审阅 revision 的约束不变，他人持有者
+不能被借用。工作要求、依赖、ownership、Monitor 观察、验证和完成仍走各自的准入。
+显式传入任一租约 proof 参数时仍严格检查两个参数及当前 generation；陈旧、部分、过期
+或他人 proof 不会被自动替换或忽略。响应丢失后沿用同一操作 ID 和意图恢复原回执；
+省略 ID 表示新的调用。空白 note 仍为省略；无隐式清空、Markdown fallback 或 provider 切换。
 
 ### Reviewed canonical edits and recovery
 
@@ -1284,29 +1287,43 @@ loopx todo list --goal-id <goal>
 Preview with `--dry-run` before the real attempt. A cleared resume condition also
 clears its generation fence; an omitted condition is retained. Empty successor
 arrays and explicit `no_followup=false` in API intent remain meaningful values.
-For a promoted hard-lease Agent Todo that the owner has paused, use a narrow
-nonterminal lifecycle edit after its execution lease has been released or has
-expired:
+For a promoted hard-lease Agent Todo, pause with one intent and optional
+context; the current holder does not need a separate release:
 
 ```bash
-loopx todo update --goal-id <goal> --todo-id <todo> --agent-id <owner-or-granted-controller> \
-  --status blocked --clear-resume-when --reason '<public-safe pause reason>' \
-  --update-operation-id <stable-pause-id> --update-expected-provider-revision <readback-revision>
+loopx todo update --goal-id <goal> --todo-id <todo> --agent-id <owner> \
+  --status blocked --reason 'Owner paused this task' --note 'Preserve original acceptance' \
+  --evidence 'evidence:owner-pause' --update-operation-id <stable-pause-id>
+loopx todo update --goal-id <goal> --todo-id <todo> --agent-id <owner> \
+  --status open --reason 'Owner explicitly resumed' --note 'Resume context' \
+  --update-operation-id <stable-resume-id>
 loopx todo list --goal-id <goal> --todo-id <todo> --role agent
 ```
 
-The same provider CAS blocks the Todo and retires only an inactive retained
-lease. An active lease must be released first. The edit grants no execution,
-does not complete validation or spend quota, and preserves claim and successor
-links. Reopening requires another explicit `--status open --clear-resume-when
---reason ...` operation and a fresh execution lease. Do not combine this
-transition with text, ownership, work requirements or a lease proof.
-
-已晋升的 hard-lease Agent Todo 如被 owner 暂停，应先确认旧执行租约已释放或到期，
-再以稳定操作 ID、读回的 provider revision 和明确原因执行上述窄范围状态更新。
-同一次 CAS 会把 Todo 标为 `blocked` 并退休非活跃租约，同时清除旧等待条件及其派生观察；
-它不会完成验收、扣额或授予新的执行权。活跃租约须先释放；恢复执行要明确改回 `open`
-并重新领取租约，不能把阻塞记录当作交付完成。
+One provider CAS records status, note/evidence and applicable lease retirement.
+Omitting a resume condition on this explicit pause/resume clears the previous wait
+and its derived observations; a typed condition on pause is preserved instead.
+Explicit `clear_resume_when=false` is not silently overridden. Deferral with a
+reason and typed `resume_when` uses the same atomic retirement; resuming it clears
+the wait and grants no execution. Paused/deferred work is not completed acceptance.
+
+The current holder's active lease can retire with its own pause. A different
+active holder, divergent active execution on an already paused Todo, stale explicit
+proof, changed reviewed revision or missing authority refuses before effects.
+A granted controller cannot silently retire another live holder. An explicit proof
+remains a generation constraint; it is never substituted with a current read.
+Text, ownership, work requirements and successor changes are separate operations.
+The existing App/Chat task controls use this same owner; blocked and deferred task
+details offer explicit resume, without requesting lease keys. Pausing changes
+future admission and fences old execution writes; it does not assert process exit.
+
+中文：暂停、暂缓及明确恢复支持备注和证据，与适用租约退休在同一 provider CAS 中提交；
+本人有效租约不再需要手动先释放。暂停/恢复未指定等待条件时，自动清除旧条件及派生观察；
+暂停明确指定合法条件则保留，显式 `clear_resume_when=false` 不会被覆盖。恢复不会启动
+执行；后续须重新准入。不同活跃持有者、已暂停任务上仍活跃的异常执行、陈旧显式 proof、
+已变化 revision 或缺权限均拒绝，不会借用他人凭证或静默接管。修改 text、ownership、
+工作要求和 successor 应单独操作。App/Chat 复用同一 owner，任务详情可明确恢复；
+暂停/暂缓不等于完成验收或已终止进程。
 
 Dependency validation sees the complete canonical inventory, not a hot-path
 summary or a Markdown buffer. A satisfied Monitor wait is not silently re-armed
@@ -1318,10 +1335,10 @@ legacy public planner; a combined raw text/note correction retains its establish
 copy-edit attribution behavior.
 
 Authority is unchanged: registered, non-excluded peers may edit unclaimed work
-without claiming it; another owner's claim is not writable. A lease-bearing edit
-requires current execution proof and preserves the entire lease. **Changing a
-leased Todo's status is unsupported** until status and lease effects can commit
-together. Monitor planning/observations, ownership, routing, capability fields
+without claiming it; another owner's claim is not writable. Ordinary owner copy
+edits and the bounded nonterminal transitions above prepare their state within
+the same CAS; explicit execution proof retains its strict fence. Monitor
+planning/observations, ownership, routing, capability fields
 and terminal operations are outside this update intent. Use the existing
 dedicated lifecycle operations where supported; no unsupported update falls
 back to Markdown. Missing display files do not block a canonical update; normal
@@ -1336,7 +1353,7 @@ inventory，不依赖摘要条数或 Markdown。补 evidence 不会重新设置
 仅包含规划字段的更新保留既有 `last_actor_agent_id`，与 legacy public planner 一致；
 若同时包含 raw text/note 修正，则继续沿用既有文案修正的 actor 归属语义。
 权限不扩大：未 claim 的工作仍可由未被排除的注册 agent 修改，不能改写
-其他 owner 的工作。带租约的编辑须提供当前 proof，保持租约不变；**暂不支持改变
-带租约 Todo 的 status**。Monitor 规划/观察、ownership、routing、capability 与终态
+其他 owner 的工作。普通本人文案编辑与上述非终态变更在同一 CAS 中准备状态；
+显式执行 proof 仍严格校验。Monitor 规划/观察、ownership、routing、capability 与终态
 操作不在此 intent 内。缺失 display 不阻止 canonical 更新；提交后的正常投影恢复
 托管 Todo 展示。不支持的操作不会回退 Markdown，也不自动切换 provider 或 promotion。
diff --git a/docs/reference/canonical-lease-renew.md b/docs/reference/canonical-lease-renew.md
index 7661d13d19..02f3eaddca 100644
--- a/docs/reference/canonical-lease-renew.md
+++ b/docs/reference/canonical-lease-renew.md
@@ -173,6 +173,39 @@ already assigned to the eligible receiver. Without `--transfer-claim`, transfer
 claim. Neither form overrides an exclusion or widens write scopes. Use the actual readback
 versions, not these example numbers.
 
+### Ordinary task operations
+
+Use `todo update` for ordinary owner notes, evidence, priority, pause and resume.
+The canonical typed owner prepares current state and performs the authorized
+operation in one CAS; do not acquire a lease merely to edit a note. A pause can
+retire its current holder's lease atomically with note/evidence. Resume grants no
+execution; a new execution still uses this document's explicit lease lifecycle.
+See [Todo administrative and nonterminal updates](../project-agent-todo-contract.md#canonical-nonterminal-planning-updates).
+
+An explicit key/version remains a strict generation constraint. LoopX never
+silently replaces it, borrows a foreign holder or retries an ambiguous mutation
+as new work. Acquire, renew and transfer change execution authority and remain
+explicit. Every CLI lease refusal includes a routed `inspection.cli_args` command
+to read the actual holder/state/version; JSON and Markdown retain the original
+error. Parameter errors additionally explain missing and unsupported flags.
+Inspection is read-only and does not authorize the displayed lease's use.
+
+中文：普通本人任务的备注、证据、优先级、暂停和恢复直接使用 `todo update`，无需为改
+备注临时领租约。本人暂停可原子退休当前租约，恢复不授予执行。显式 key/version 仍是
+严格 generation 约束；不会自动替换、借用他人或把不确定提交作为新工作重试。
+领取、续期和转交执行权限仍须明确请求。所有 CLI lease 拒绝都提供带原路由的
+`inspection.cli_args`，可直接读取真实持有者、状态和版本；JSON/Markdown 保留原错误，
+参数错误另列缺失和冲突参数。读回不是使用凭证的授权。
+
+The synthetic deferred task below uses the same disposable canonical data in
+both views. The task detail now offers **Resume task** as its primary operation;
+completion proof is kept with completion. These compare source presentations,
+not an installed-App upgrade or a claim that a process stopped.
+
+| Previous task detail | Task detail with explicit resume |
+| --- | --- |
+| ![Deferred task with completion controls](../../apps/presentation/dashboard/smoke/assets/todo-lifecycle/before-deferred.png) | ![Deferred task with resume controls](../../apps/presentation/dashboard/smoke/assets/todo-lifecycle/after-deferred.png) |
+
 ### Action help and argument recovery
 
 Use `loopx task-lease renew --help` to inspect only that action's options;
@@ -390,9 +423,12 @@ read the same task again: `resume_ready=true` allows acquisition under the usual
 owner/key/version checks. If the wait itself needs correction, use the existing
 authorized `todo update --resume-when ...` or `--clear-resume-when` operation;
 neither inspecting nor editing the wait grants execution authority.
-In hard-lease mode, ordinary edits still need an active execution proof. After
-release or expiry, use the existing narrow owner pause/reopen lifecycle, with a
-stable operation id, current provider revision and explicit reason:
+In hard-lease mode, execution-sensitive updates retain their active-proof or
+dedicated lifecycle admission. Ordinary owner text, note, evidence, reason and
+priority edits use the administrative provider-CAS path without acquiring a
+lease; see [administrative edits and explicit execution proof](../project-agent-todo-contract.md#administrative-edits-and-explicit-execution-proof).
+Correct an obsolete execution wait through the bounded owner pause/reopen
+lifecycle, with a stable operation id, current provider revision and explicit reason:
 
 ```bash
 loopx todo update --goal-id example-goal --todo-id todo_work --agent-id owner \
@@ -405,6 +441,7 @@ loopx todo update --goal-id example-goal --todo-id todo_work --agent-id owner \
 
 Read back between operations and acquire a fresh lease before executing. Do not
 attach an old lease proof or bundle ownership, text or work-requirement edits.
+Optional note/evidence may accompany each lifecycle step in its atomic update.
 
 在 canonical File、SQLite 和 PostgreSQL Goal 中，`todo_done` 和 `resume_at` 等待同时约束
 实际执行入口，而不只是候选任务展示。必须由真实前置 Todo 的 `done` 状态满足条件，
@@ -416,10 +453,12 @@ attach an old lease proof or bundle ownership, text or work-requirement edits.
 但有效 `active=false`。释放、历史完成读回、授权 supersede、普通分配和等待修复
 沿用原规则。前置任务正常完成或到达指定恢复时刻后，重新读回并按原 owner、key、
 version 规则继续执行。其他恢复条件及 governed amendment 的边界保持独立。
-hard-lease 普通编辑仍须提供有效执行 proof。租约释放或到期后，可按上面的既有窄范围
-流程，以明确理由、稳定操作 ID 和当前 provider revision 暂停并清除等待；读回后再用
-新 revision 明确重新打开，最后领取新租约。不能附带旧 proof、文案、归属或工作要求修改，
-也不能把暂停或重新打开当作执行授权。
+hard-lease 的执行敏感更新仍须有效执行 proof 或专属 lifecycle 准入；本人的普通说明、
+备注、证据、原因和优先级编辑走行政性 provider CAS，无需获取执行租约。
+修正过时等待时，可按上面的既有窄范围流程，以明确理由、稳定操作 ID 和当前
+provider revision 暂停并清除等待；读回后再用
+新 revision 明确重新打开，最后领取新租约。不能附带旧 proof、任务正文、归属或工作要求修改，
+也不能把暂停或重新打开当作执行授权；每步可原子附带备注和证据。
 
 A successful readback is still a point-in-time proof, not a lock over subsequent
 external effects. Execution must retain its existing mutation fences; this
diff --git a/loopx/chat_todo_actions.py b/loopx/chat_todo_actions.py
index 243ffef5ca..42efe19416 100644
--- a/loopx/chat_todo_actions.py
+++ b/loopx/chat_todo_actions.py
@@ -68,16 +68,17 @@ def _run_todo_update(
             status=status,
             **({"role": "user", "no_followup": bool(parameters.get("no_followup", True))}
                if operation == "complete" else {}),
-            # A reviewed block is a lifecycle transition, not a copy edit.
-            # Its UI/Lark note supplies the public reason; a combined note
-            # patch would cross the hard-lease execution fence.
+            # The established block control uses note as its pause reason;
+            # preserve the task's existing notes. Explicit ordinary note edits
+            # and lifecycle effects still share the canonical transaction.
             note=(parameters.get("note") if operation != "block" or basis is None else None),
-            reason=(parameters.get("note") if operation == "block" and basis is not None else None),
+            reason=(parameters.get("note") or "Owner requested deferral") if operation in {"block", "defer"} else (
+                parameters.get("note") or "Owner explicitly requested task resumption" if status == "open" else None),
             claimed_by=(
                 parameters.get("agent_id") if operation == "reassign" else None
             ),
             resume_when=parameters.get("resume_when"),
-            clear_resume_when=operation == "block" and basis is not None,
+            clear_resume_when=(operation == "block" or status == "open") and basis is not None,
             successor_todo_ids=parameters.get("successor_todo_ids"),
             agent_id=parameters.get("agent_id"),
             authority_reason="owner-confirmed typed Chat action",
diff --git a/loopx/cli_commands/task_lease.py b/loopx/cli_commands/task_lease.py
index a05658202e..bf4b9cb843 100644
--- a/loopx/cli_commands/task_lease.py
+++ b/loopx/cli_commands/task_lease.py
@@ -38,6 +38,11 @@ def render_task_lease_markdown(payload: dict[str, object]) -> str:
         lines.append(f"- error: {payload.get('error')}")
     if payload.get("error_code"):
         lines.append(f"- error_code: `{payload.get('error_code')}`")
+    inspection = payload.get("inspection")
+    if isinstance(inspection, dict):
+        import shlex
+        lines.append(f"- inspect current state: `{shlex.join(['loopx', *inspection['cli_args']])}`")
+        lines.append(f"- {inspection['reason']}")
     recovery = payload.get("recovery")
     if isinstance(recovery, dict) and payload.get("error_code") == "canonical_authority_required":
         lines.append(f"- recovery: `{recovery['action']}`")
@@ -247,5 +252,16 @@ def handle_task_lease_command(
             "error": str(exc),
             "error_code": getattr(exc, "code", exc.__class__.__name__),
         }
+    if payload.get("ok") is not True:
+        # Presentation only: retain every native refusal and explicit proof.
+        # An exact read is useful for both grammar and semantic failures; it
+        # neither chooses another owner nor retries a mutation with new proof.
+        inspection_args = [f"--registry={registry_path}", "--format", "json"]
+        if runtime_root_arg is not None:
+            inspection_args.append(f"--runtime-root={runtime_root_arg}")
+        inspection_args.extend(["task-lease", "inspect", f"--goal-id={args.goal_id}", f"--todo-id={args.todo_id}"])
+        payload["inspection"] = {"cli_args": inspection_args,
+            "reason": "Read the current holder, state and version. Keep the original execution identity on retries; another holder requires an explicit handover, not borrowed proof.",
+            "execution_authority_granted": False}
     print_payload(payload, output_format(args), render_task_lease_markdown)
     return 0 if payload.get("ok") else 1
diff --git a/loopx/cli_commands/todo_registration.py b/loopx/cli_commands/todo_registration.py
index ef02ecc0db..56c07da27b 100644
--- a/loopx/cli_commands/todo_registration.py
+++ b/loopx/cli_commands/todo_registration.py
@@ -65,7 +65,8 @@ def register_todo_command(
         "--update-operation-id",
         help=("For promoted text/note, planning, validator revision or User completion update, reuse this operation id after a lost response; "
               "changed intent is rejected. Planning supports status, evidence, reason, resume conditions and successor links; "
-              "User status=done uses terminal validation and lease release; other leased status changes remain unsupported."),
+              "Owner pause/deferral and explicit resume commit applicable lease retirement atomically; "
+              "User status=done uses terminal validation and lease release."),
     )
     todo_parser.add_argument(
         "--update-expected-provider-revision",
@@ -106,7 +107,7 @@ def register_todo_command(
             "becomes the semantic receipt; no follow-up ACK command is required."
         ),
     )
-    todo_parser.add_argument("--status", choices=["open", "done", "blocked", "deferred"], help="For todo add/update, set the lifecycle status.")
+    todo_parser.add_argument("--status", choices=["open", "done", "blocked", "deferred"], help="For add/update, set lifecycle status. Owner pause/resume with --reason and optional --note/--evidence atomically retires the applicable lease; no manual release is needed.")
     todo_parser.add_argument("--note", help="Public-safe note to attach to a lifecycle transition.")
     todo_parser.add_argument("--evidence", help="Public-safe evidence pointer or short result for complete/update.")
     todo_parser.add_argument("--result-file", help="For todo complete with bound Goal acceptance criteria, bind a bounded local .json, .md or .txt result. A Todo validator alone is insufficient; use --evidence for a local artifact pointer.")
@@ -295,8 +296,9 @@ def register_todo_command(
         "--task-lease-idempotency-key",
         help=(
             "For todo claim on promoted hard-lease authority, atomically acquire "
-            "the canonical lease and claim; for promoted text/note or planning update, complete and supersede, prove the "
-            "execution instance that owns the active lease."
+            "the canonical lease and claim. Optional for administrative edits and bounded owner pause/resume; "
+            "when supplied, this proof and the current version are strictly checked. "
+            "Complete, supersede and other execution-fenced updates require the active execution proof."
         ),
     )
     todo_parser.add_argument(
@@ -304,8 +306,9 @@ def register_todo_command(
         type=int,
         help=(
             "For promoted todo claim, optionally compare-and-set the canonical "
-            "lease version; for promoted text/note or planning update, complete and supersede, supply the active lease "
-            "version when it is effective."
+            "lease version. For updates with an explicit lease key, supply its current version; "
+            "partial or stale proof is rejected. Complete, supersede and other execution-fenced "
+            "updates require the active lease version when it is effective."
         ),
     )
     todo_parser.add_argument(
diff --git a/loopx/control_plane/coordination/task_lease_proof.ts b/loopx/control_plane/coordination/task_lease_proof.ts
index 8b4605f64c..b52003fda3 100644
--- a/loopx/control_plane/coordination/task_lease_proof.ts
+++ b/loopx/control_plane/coordination/task_lease_proof.ts
@@ -52,6 +52,21 @@ export function isSoftClaimReleasedCopyUpdate(todo: JsonObject, lease: JsonObjec
   return leaseRepositoryRejection(todo, lease) === null;
 }
 
+/** Current-owner planning copy is administrative state, not task execution.
+ * Keep this bounded: work requirements, ownership, dependencies, validators,
+ * Monitor observations and terminal effects retain their separate fences. */
+export function isOwnerAdministrativeCopyUpdate(todo: JsonObject, input: CoordinationTodoUpdateInput): boolean {
+  return todo.role === "agent" && ["open", "blocked", "deferred"].includes(String(todo.status)) &&
+    input.actor_agent_id !== null && (todo.claimed_by == null || todo.claimed_by === input.actor_agent_id) &&
+    input.completion === undefined && input.completion_validation_revision === undefined &&
+    input.monitor_observation === undefined &&
+    Object.keys(input.patch).every(field => field === "text" || field === "note") &&
+    input.clear_fields.every(field => field === "note") &&
+    Object.entries(input.planning_intent ?? {}).every(([field, value]) =>
+      ["evidence", "reason", "priority", "clear_priority"].includes(field) ||
+      (field === "status" && value === todo.status));
+}
+
 export function decodeTaskLeaseProof(value: unknown): TaskLeaseProof | null {
   if (value == null) return null;
   const proof = requireJsonObject(value, "lease_proof");
@@ -135,15 +150,35 @@ export function todoUpdateLeaseRecovery(head: JsonObject, input: CoordinationTod
   const sameOwner = lease !== null && lease.owner === input.actor_agent_id;
   const ownerRelation: TodoUpdateLeaseRecovery["owner_relation"] =
     lease === null ? "none" : sameOwner ? "same_owner" : "foreign_owner";
+  const todo = index.todos.get(input.todo_id)!;
   const base = {
     lease_state: leaseState,
     owner_relation: ownerRelation,
     observed_version: lease?.version ?? 0,
-    inspect: {command: "loopx task-lease inspect", goal_id: input.goal_id, todo_id: input.todo_id},
+    observed_owner: lease?.owner ?? null,
+    todo_status: todo.status,
+    claimed_by: todo.claimed_by ?? null,
+    inspect: {command: "loopx task-lease inspect", goal_id: input.goal_id, todo_id: input.todo_id,
+      cli_args: ["task-lease", "inspect", "--goal-id", input.goal_id, "--todo-id", input.todo_id]},
     execution_authority_granted: false,
   };
-  const todo = index.todos.get(input.todo_id)!;
   const intent = input.planning_intent ?? {};
+  if ((intent.status === "blocked" || intent.status === "deferred") &&
+      (input.lease_idempotency_key != null || input.lease_expected_version != null)) {
+    return {...base, action: "inspect_current_proof", reason: "This lifecycle request supplied execution proof that did not qualify. Inspect the current lease and review the intended operation; do not silently replace its key or version. A proof-free administrative pause is a new, explicit request, not a retry of the stale execution."};
+  }
+  if (lease?.active && !sameOwner) {
+    return {...base, action: "reconcile_lease_owner", reason: "Another active holder owns this execution. Its owner must release or explicitly hand it over through the lease lifecycle; this request cannot borrow its proof or take over. Inspect the current holder before retrying."};
+  }
+  if (intent.status === "blocked" || intent.status === "deferred") {
+    return {...base, action: "resolve_lifecycle_edit",
+      reason: "Pause with a reason and optional note/evidence in one Todo update. The current holder's lease is retired atomically; no acquire or separate release is needed. Work requirements, text, ownership and successor changes are separate operations. A foreign active holder cannot be retired by this request; explicit stale proof is never replaced.",
+      retry: {command: "loopx todo update", cli_args: ["todo", "update", "--goal-id", input.goal_id,
+        "--todo-id", input.todo_id, ...(input.actor_agent_id ? ["--agent-id", input.actor_agent_id] : []), "--status", intent.status],
+        requires_flags: ["--reason", ...(intent.status === "deferred" ? ["--resume-when"] : [])],
+        remove_flags: ["--text", "--claimed-by", "--required-write-scope", "--successor-todo-id"],
+        proof_source: "fresh_lifecycle_admission"}};
+  }
   if (leaseExecutionTargetRejection(todo) !== null) {
     if (!isBoundUserActionMetadataUpdate(todo, input)) {
       return {...base, action: "resolve_lifecycle_edit", reason_code: "todo_not_executable",
@@ -190,12 +225,15 @@ export function todoUpdateLeaseRecovery(head: JsonObject, input: CoordinationTod
   if (intent.status === "open" && (canReopen || canResume)) {
     const nextEdit = mode === "soft_claim"
       ? "Then retry only a permitted owner copy edit without either lease proof flag. Planning, ownership and terminal edits keep their own admission; do not acquire a lease in soft_claim."
-      : "Then claim/acquire a fresh execution lease before retrying the remaining edit.";
+      : "Ordinary owner metadata then needs no execution lease; other work still uses its execution or lifecycle admission.";
     return {...base, action: "resolve_lifecycle_edit",
-      reason: `Reopen this ${todo.status} Todo separately with only status, clear-resume-when and a reviewed reason. Do not bundle notes, evidence, work requirements or ownership. Use a fresh update operation and current provider revision after reviewing the wait. ${nextEdit} Reopening alone grants no execution authority.`,
-      retry: {command: "loopx todo update --status open --clear-resume-when --reason '<reviewed reason>'",
+      reason: `Reopen this ${todo.status} Todo with status=open and a reviewed reason; optional note/evidence can commit with it. Keep text, work requirements, ownership and successors separate. Use a fresh update operation and current provider revision after reviewing the wait. An omitted wait is cleared by this explicit resume. ${nextEdit} Reopening alone grants no execution authority.`,
+      retry: {command: "loopx todo update --status open --reason '<reviewed reason>'",
+        cli_args: ["todo", "update", "--goal-id", input.goal_id, "--todo-id", input.todo_id,
+          ...(input.actor_agent_id ? ["--agent-id", input.actor_agent_id] : []), "--status", "open"],
         goal_id: input.goal_id, todo_id: input.todo_id, agent_id: input.actor_agent_id,
-        requires_flags: ["--status", "--clear-resume-when", "--reason"],
+        requires_flags: ["--reason"],
+        remove_flags: ["--text", "--claimed-by", "--required-write-scope", "--successor-todo-id"],
         proof_source: "fresh_lifecycle_admission"}};
   }
   const editRejection = lease === null || isOwnerDeferral(input, todo) ? null : leasedTodoEditRejection(todo, intent);
@@ -222,7 +260,7 @@ export function todoUpdateLeaseRecovery(head: JsonObject, input: CoordinationTod
         lease: index.leases.get(input.todo_id), lease_idempotency_key: null,
         lease_expected_version: null, now: input.now}) === null) {
     return {...base, action: "resolve_lifecycle_edit", reason_code: dependency.code,
-      reason: "Keep waiting if the dependency remains valid. For an evidence-backed owner replan, first block the unchanged Todo and clear its obsolete wait through the existing lifecycle, then reopen it. Each step requires fresh provider CAS and its own operation identity; neither consumes an old lease or grants execution. Do not bundle copy, evidence, requirements or ownership edits. Acquire a fresh execution lease afterwards.",
+      reason: "Keep waiting if the dependency remains valid. For an evidence-backed owner replan, first block the unchanged Todo and clear its obsolete wait through the existing lifecycle, then reopen it. Each step requires fresh provider CAS and its own operation identity; neither consumes an old lease or grants execution. Optional note/evidence may accompany the transition; text, requirements and ownership edits remain separate. Actual execution still needs a fresh lease afterwards.",
       lifecycle_replan: {condition: "owner_reviewed_obsolete_dependency", steps: [
         {command: "loopx todo update --status blocked --clear-resume-when --reason '<reviewed obsolete dependency>'"},
         {command: "loopx todo update --status open --clear-resume-when --reason '<reviewed new route>'"},
diff --git a/loopx/control_plane/coordination/todo_blocked_lifecycle.ts b/loopx/control_plane/coordination/todo_blocked_lifecycle.ts
index fb0f426583..a8bc08b598 100644
--- a/loopx/control_plane/coordination/todo_blocked_lifecycle.ts
+++ b/loopx/control_plane/coordination/todo_blocked_lifecycle.ts
@@ -1,6 +1,6 @@
 /** A bounded pause is a Todo lifecycle change, not a completed delivery.
- * Retire only an inactive execution generation in the same provider CAS; a
- * live holder must release its lease before another actor can pause the work. */
+ * Retire the current holder's generation in the same provider CAS. A foreign
+ * live holder still has to release; administrative authority is not takeover. */
 import type {JsonObject} from "../effect_program.ts";
 import type {CoordinationProjectionMutation} from "./coordination_projection.ts";
 import type {CoordinationTodoUpdateInput} from "./todo_update_intent.ts";
@@ -9,14 +9,16 @@ import {leaseEpoch, leaseIsActive, leaseVersion} from "../work_items/task_lease_
 import {releasedTaskLeaseRecord} from "../work_items/task_lease_lifecycle_decision.ts";
 import {normalizeTodoResumeWhen, TODO_RESUME_NORMALIZE_REQUEST_SCHEMA_VERSION} from "../todos/resume_condition.ts";
 
-const LIFECYCLE_FIELDS = new Set(["status", "reason", "clear_resume_when", "resume_when"]);
+const LIFECYCLE_FIELDS = new Set(["status", "reason", "clear_resume_when", "resume_when", "evidence"]);
 
 export function isBlockedLifecycleTransition(
   input: CoordinationTodoUpdateInput, todo: JsonObject,
 ): boolean {
   const intent = input.planning_intent ?? {};
   const pause = todo.status === "open" && intent.status === "blocked";
-  const clearWait = intent.clear_resume_when === true && intent.resume_when == null;
+  // Explicit pause/resume clears an omitted wait in materialization. Callers
+  // need not discover an otherwise hidden --clear-resume-when incantation.
+  const clearWait = intent.resume_when == null && intent.clear_resume_when !== false;
   const typedWait = pause && intent.clear_resume_when !== true && typeof intent.resume_when === "string"
     && normalizeTodoResumeWhen({schema_version: TODO_RESUME_NORMALIZE_REQUEST_SCHEMA_VERSION,
       resume_when: intent.resume_when}) === intent.resume_when;
@@ -25,7 +27,7 @@ export function isBlockedLifecycleTransition(
       (todo.status === "blocked" && intent.status === "open")) &&
     (clearWait || typedWait) &&
     typeof intent.reason === "string" && Boolean(intent.reason.trim()) &&
-    Object.keys(input.patch).length === 0 && input.clear_fields.length === 0 &&
+    Object.keys(input.patch).every(field => field === "note") && input.clear_fields.length === 0 &&
     Object.keys(intent).every(field => LIFECYCLE_FIELDS.has(field));
 }
 
@@ -33,20 +35,21 @@ export function blockedLifecycleRejection(input: {
   goal_id: string; todo_id: string; actor_agent_id: string | null;
   registered_agents: readonly string[]; lease: JsonObject | undefined;
   lease_idempotency_key: string | null; lease_expected_version: number | null;
-  now: Date;
+  now: Date; allow_current_holder?: boolean; proof_validated?: boolean;
 }): {code: string; reason: string} | null {
   if (input.actor_agent_id === null || !input.registered_agents.includes(input.actor_agent_id)) {
     return {code: "actor_not_registered", reason: "Blocked lifecycle transition requires a registered actor"};
   }
-  if (input.lease_idempotency_key !== null || input.lease_expected_version !== null) {
+  if (!input.proof_validated && (input.lease_idempotency_key !== null || input.lease_expected_version !== null)) {
     return {code: "blocked_lifecycle_execution_proof_not_allowed",
       reason: "Blocked lifecycle transition does not consume an old execution lease"};
   }
   if (input.lease === undefined) return null;
   const lease = canonicalTaskLease(input.lease, input.goal_id, input.todo_id);
-  if (leaseIsActive(lease, input.now)) {
+  if (leaseIsActive(lease, input.now) &&
+      !(input.allow_current_holder && lease.owner === input.actor_agent_id)) {
     return {code: "blocked_lifecycle_active_lease",
-      reason: "Release the active execution lease before changing the Todo lifecycle"};
+      reason: "A different or divergent execution still holds this Todo; its holder must release before this lifecycle change"};
   }
   return null;
 }
diff --git a/loopx/control_plane/coordination/todo_continuation.ts b/loopx/control_plane/coordination/todo_continuation.ts
index b321a5467f..058423062c 100644
--- a/loopx/control_plane/coordination/todo_continuation.ts
+++ b/loopx/control_plane/coordination/todo_continuation.ts
@@ -153,6 +153,10 @@ export async function executeTodoContinuation(store: AuthorityStore, value: unkn
     actor_agent_id: agentId, registered_agents: registered, dry_run: false, now: new Date()};
   if (input.action === "prepare") {
     if (todo.claimed_by !== agentId) return reject("continuation_owner_required", "Only the current Todo owner can prepare a continuation note");
+    // A leased handoff requires execution authority. Ordinary note-edit admission
+    // cannot replace this check; the update below pins the same source CAS.
+    if (leased && !execution.allowed) return reject(execution.reason_code,
+      "Preparation requires the current execution lease and admission; inspect the reported authority gap");
     const context = buildContextFromInput(input);
     const todoFacts = computeContinuationTodoFacts(todo);
     const noteObj = buildContinuationNote(context, sessionId, todoFacts);
diff --git a/loopx/control_plane/coordination/todo_deferred_lifecycle.ts b/loopx/control_plane/coordination/todo_deferred_lifecycle.ts
index 774496cd63..8ca358120e 100644
--- a/loopx/control_plane/coordination/todo_deferred_lifecycle.ts
+++ b/loopx/control_plane/coordination/todo_deferred_lifecycle.ts
@@ -7,14 +7,14 @@ import {canonicalTaskLease} from "./task_lease_state.ts";
 import {leaseIsActive, leaseVersion, leaseEpoch} from "../work_items/task_lease_acquire.ts";
 import {releasedTaskLeaseRecord} from "../work_items/task_lease_lifecycle_decision.ts";
 
-const REOPEN_FIELDS = new Set(["status", "clear_resume_when", "reason"]);
+const REOPEN_FIELDS = new Set(["status", "clear_resume_when", "reason", "evidence"]);
 
 export function isDeferredReopen(input: CoordinationTodoUpdateInput, todo: JsonObject): boolean {
   const intent = input.planning_intent ?? {};
   return todo.role === "agent" && todo.status === "deferred" &&
-    intent.status === "open" && intent.clear_resume_when === true &&
+    intent.status === "open" && intent.resume_when == null && intent.clear_resume_when !== false &&
     typeof todo.resume_when === "string" && Boolean(todo.resume_when) &&
-    Object.keys(input.patch).length === 0 && input.clear_fields.length === 0 &&
+    Object.keys(input.patch).every(field => field === "note") && input.clear_fields.length === 0 &&
     Object.keys(intent).every(field => REOPEN_FIELDS.has(field));
 }
 
@@ -25,8 +25,8 @@ export function isOwnerDeferral(input: CoordinationTodoUpdateInput, todo: JsonOb
   return todo.role === "agent" && todo.status === "open" && intent.status === "deferred" &&
     typeof intent.resume_when === "string" && Boolean(intent.resume_when.trim()) &&
     typeof intent.reason === "string" && Boolean(intent.reason.trim()) &&
-    Object.keys(input.patch).length === 0 && input.clear_fields.length === 0 &&
-    Object.keys(intent).every(field => ["status", "resume_when", "reason"].includes(field));
+    Object.keys(input.patch).every(field => field === "note") && input.clear_fields.length === 0 &&
+    Object.keys(intent).every(field => ["status", "resume_when", "reason", "evidence"].includes(field));
 }
 
 /** Actor, claim, exclusion and binding admission happens before this check.
diff --git a/loopx/control_plane/coordination/todo_update_admission.ts b/loopx/control_plane/coordination/todo_update_admission.ts
index a133a4881d..712b66695c 100644
--- a/loopx/control_plane/coordination/todo_update_admission.ts
+++ b/loopx/control_plane/coordination/todo_update_admission.ts
@@ -12,11 +12,12 @@ import {TODO_WORK_REQUIREMENT_FIELDS} from "../todos/work_requirements.ts";
 import {TODO_OWNERSHIP_INTENT_FIELDS} from "../todos/authoring_scope.ts";
 import {evaluateCoordinationTodoMutationDecision,
   COORDINATION_TODO_MUTATION_DECISION_REQUEST_SCHEMA} from "./todo_lifecycle_decision.ts";
-import {decodeTaskLeaseProof, evaluateCanonicalTaskLeaseProof, todoUpdateLeaseRecovery, leasedTodoEditRejection, isBoundUserActionMetadataUpdate, isSoftClaimReleasedCopyUpdate} from "./task_lease_proof.ts";
+import {decodeTaskLeaseProof, evaluateCanonicalTaskLeaseProof, todoUpdateLeaseRecovery, leasedTodoEditRejection, isBoundUserActionMetadataUpdate, isSoftClaimReleasedCopyUpdate, isOwnerAdministrativeCopyUpdate} from "./task_lease_proof.ts";
 import {deferredReopenRejection, isDeferredReopen, isOwnerDeferral} from "./todo_deferred_lifecycle.ts";
 import {blockedLifecycleRejection, isBlockedLifecycleTransition} from "./todo_blocked_lifecycle.ts";
 import {indexCoordinationProjection} from "./coordination_projection.ts";
 import {canonicalTaskLease} from "./task_lease_state.ts";
+import {leaseIsActive} from "../work_items/task_lease_acquire.ts";
 
 interface TodoUpdateRejection {code: string; reason: string; handoff_mode?: string; recovery?: JsonObject}
 const reject = (code: string, reason: string): TodoUpdateRejection => ({code, reason});
@@ -54,6 +55,9 @@ export function todoUpdateAdmissionRejection(
   const retired = retiredHandoffModeRejection(mode);
   if (retired !== null) return {...reject(retired, HANDOFF_MODE_RETIRED_REASON), handoff_mode: mode};
   const intent = input.planning_intent ?? {};
+  const hasProof = input.lease_idempotency_key != null || input.lease_expected_version != null;
+  const withRecovery = (refusal: {code: string; reason: string} | null): TodoUpdateRejection | null =>
+    refusal === null ? null : {...refusal, handoff_mode: mode, recovery: todoUpdateLeaseRecovery(head, input, mode)};
   const ownershipMutation = ["claimed_by", "clear_claim", "excluded_agents", "bound_agent",
     "goal_bound", "blocks_agent", "clear_blocks_agent", "global_gate", "clear_global_gate"]
     .some(field => Object.hasOwn(intent, field));
@@ -89,7 +93,11 @@ export function todoUpdateAdmissionRejection(
     const reason = code === "update_owner_mismatch"
       ? "Todo update cannot edit another claim owner's work"
       : "Todo update is outside the actor's registered owner/binding scope";
-    return reject(code, reason);
+    return {...reject(code, reason), handoff_mode: mode,
+      recovery: {action: "reconcile_lease_owner", reason,
+        todo_status: todo.status, claimed_by: todo.claimed_by ?? null,
+        execution_authority_granted: false,
+        inspect: {command: "loopx todo list", cli_args: ["todo", "list", "--goal-id", input.goal_id, "--todo-id", input.todo_id]}}};
   }
   // Promotion deliberately preserves legacy claims without inventing leases.
   // An explicitly granted controller must be able to repair planning state on
@@ -127,10 +135,24 @@ export function todoUpdateAdmissionRejection(
   }
   if (mode === "hard_lease" && isBlockedLifecycleTransition(input, todo)) {
     try {
-      return blockedLifecycleRejection({goal_id: input.goal_id, todo_id: input.todo_id,
+      // Proof, if supplied, is an explicit generation constraint. Never replace
+      // a stale/partial proof with a convenient current holder read.
+      if (hasProof) {
+        const fence = evaluateCanonicalTaskLeaseProof({todo, lease, handoff_mode: mode,
+          registered_agents: input.registered_agents, actor_agent_id: input.actor_agent_id,
+          lease_idempotency_key: input.lease_idempotency_key ?? null,
+          lease_expected_version: input.lease_expected_version ?? null, now: input.now});
+        if (fence.outcome !== "apply") return withRecovery(reject(String(fence.code), "Explicit execution proof is stale or unavailable; inspect this Todo before retrying"));
+      }
+      if (lease !== undefined) {
+        const repository = leaseRepositoryRejection(todo, canonicalTaskLease(lease, input.goal_id, input.todo_id));
+        if (repository !== null) return withRecovery(reject(repository, "Lifecycle change must preserve the execution repository"));
+      }
+      return withRecovery(blockedLifecycleRejection({goal_id: input.goal_id, todo_id: input.todo_id,
         actor_agent_id: input.actor_agent_id, registered_agents: input.registered_agents,
         lease, lease_idempotency_key: input.lease_idempotency_key ?? null,
-        lease_expected_version: input.lease_expected_version ?? null, now: input.now});
+        lease_expected_version: input.lease_expected_version ?? null, now: input.now,
+        allow_current_holder: todo.status === "open", proof_validated: hasProof}));
     } catch (error) {
       return reject("invalid_coordination_projection",
         error instanceof Error ? error.message : "invalid retained lease facts");
@@ -138,15 +160,34 @@ export function todoUpdateAdmissionRejection(
   }
   if ((mode === "hard_lease" || lease !== undefined) && isDeferredReopen(input, todo)) {
     try {
-      return deferredReopenRejection({goal_id: input.goal_id, todo_id: input.todo_id,
+      return withRecovery(deferredReopenRejection({goal_id: input.goal_id, todo_id: input.todo_id,
         actor_agent_id: input.actor_agent_id, registered_agents: input.registered_agents,
         lease, lease_idempotency_key: input.lease_idempotency_key ?? null,
-        lease_expected_version: input.lease_expected_version ?? null, now: input.now});
+        lease_expected_version: input.lease_expected_version ?? null, now: input.now}));
     } catch (error) {
       return reject("invalid_coordination_projection",
         error instanceof Error ? error.message : "invalid retained lease facts");
     }
   }
+  // Current-head preparation and provider CAS replace the artificial acquire /
+  // edit / release dance for administrative work. No execution grant is made.
+  // Existing explicit-proof callers keep their strict generation semantics.
+  if (mode === "hard_lease" && !hasProof &&
+      (isOwnerAdministrativeCopyUpdate(todo, input) || isOwnerDeferral(input, todo))) {
+    try {
+      if (lease !== undefined) {
+        const current = canonicalTaskLease(lease, input.goal_id, input.todo_id);
+        leaseIsActive(current, input.now); // Validate the retained clock as well.
+        const repository = leaseRepositoryRejection(todo, current);
+        if (repository !== null) return withRecovery(reject(repository, "Administrative edit must preserve the execution repository"));
+        if (current.owner !== input.actor_agent_id) return withRecovery(reject("lease_owner_mismatch",
+          "This Todo retains another holder's execution; reconcile that holder before editing"));
+      }
+      return null;
+    } catch (error) {
+      return reject("invalid_coordination_projection", error instanceof Error ? error.message : "invalid retained lease");
+    }
+  }
   // A completed owner's evidence association is metadata, not renewed work.
   // Keep the retained execution key/version under the provider transaction CAS;
   // no active, expired, foreign or missing lease receives this exception.
@@ -207,7 +248,7 @@ export function todoUpdateAdmissionRejection(
         return reject("update_owner_mismatch", "Leased Todo update requires the current claim owner");
       }
       if (lease !== undefined) {
-        return isOwnerDeferral(input, todo) ? null : leasedTodoEditRejection(todo, input.planning_intent ?? {});
+        return isOwnerDeferral(input, todo) ? null : withRecovery(leasedTodoEditRejection(todo, input.planning_intent ?? {}));
       }
     } catch (error) {
       return reject("invalid_coordination_projection",
diff --git a/loopx/control_plane/coordination/todo_update_intent.ts b/loopx/control_plane/coordination/todo_update_intent.ts
index 7774c75c44..a822c07fab 100644
--- a/loopx/control_plane/coordination/todo_update_intent.ts
+++ b/loopx/control_plane/coordination/todo_update_intent.ts
@@ -1,6 +1,8 @@
 /** Canonical edit decoding and materialization shared by ordinary updates and
  * User completion. Admission, validation effects and commits stay with callers. */
 import {decodeTaskLeaseProof} from "./task_lease_proof.ts";
+import {isBlockedLifecycleTransition} from "./todo_blocked_lifecycle.ts";
+import {isDeferredReopen} from "./todo_deferred_lifecycle.ts";
 import {planTodoPriority} from "../todos/priority.ts";
 import type {JsonObject} from "../effect_program.ts";
 import {AuthorityStoreProtocolError, canonicalAuthorityObject, canonicalAuthorityBytes,
@@ -203,7 +205,11 @@ export function prepareUpdatedTodo(
   }
   let monitorTransition: JsonObject | undefined;
   if (Object.keys(input.planning_intent ?? {}).length || input.monitor_observation !== undefined) {
-    const plan = planNativeTodoUpdate(todo, input.planning_intent ?? {}, head,
+    const clearLifecycleWait = input.planning_intent?.resume_when == null &&
+      (isBlockedLifecycleTransition(input, todo) || isDeferredReopen(input, todo));
+    const intent = clearLifecycleWait ? {...input.planning_intent, clear_resume_when: true}
+      : input.planning_intent ?? {};
+    const plan = planNativeTodoUpdate(todo, intent, head,
       input.actor_agent_id, input.registered_agents, String(next.updated_at), kind, input.monitor_observation);
     const updates = plan.updates;
     monitorTransition = plan.monitorTransition;
@@ -214,7 +220,7 @@ export function prepareUpdatedTodo(
       if (value === null || value === "") { delete next[field]; clearFields.add(field); }
       else next[field] = value;
     }
-    if (input.planning_intent?.clear_resume_when === true) {
+    if (intent.clear_resume_when === true) {
       // These are observations of the old condition, not independent resume
       // authority. Keeping either after an explicit clear resurrects a stale
       // wait in canonical readback even though resume_when is absent.
diff --git a/loopx/control_plane/todos/markdown.py b/loopx/control_plane/todos/markdown.py
index 2a417b1d51..e54c6ecff7 100644
--- a/loopx/control_plane/todos/markdown.py
+++ b/loopx/control_plane/todos/markdown.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+import shlex
 from typing import Any
 
 from .contract import TODO_STATUS_OPEN, todo_marker_for_status
@@ -15,8 +16,13 @@ def _render_lease_recovery(payload: dict[str, Any]) -> list[str]:
     for step in ("inspect", "acquire", "retry", "release"):
         instruction = recovery.get(step)
         if isinstance(instruction, dict) and instruction.get("command"):
-            lines.append(f"- {step}: `{instruction['command']}`")
-    lines.append("- Use `--format json` for the recovery arguments and current-version requirements.")
+            arguments = instruction.get("cli_args")
+            command = shlex.join(["loopx", *arguments]) if isinstance(arguments, list) else instruction["command"]
+            lines.append(f"- {step}: `{command}`")
+            if instruction.get("requires_flags"):
+                lines.append(f"  - supply: `{', '.join(instruction['requires_flags'])}`")
+            if instruction.get("remove_flags"):
+                lines.append(f"  - remove if supplied: `{', '.join(instruction['remove_flags'])}`")
     return lines
 
 
diff --git a/loopx/control_plane/todos/provider_update.py b/loopx/control_plane/todos/provider_update.py
index fa81931e38..04e121e04a 100644
--- a/loopx/control_plane/todos/provider_update.py
+++ b/loopx/control_plane/todos/provider_update.py
@@ -322,6 +322,16 @@ def update_canonical_todo_if_promoted(
         request["observed_at"] = now_local()
         result = _dispatch_canonical_todo_update(request, registry_path=registry_path)
     if isinstance(result, dict):
+        # Preserve native recovery decisions and arguments, adding only the
+        # caller's exact transport route. A default-registry command could read
+        # an unrelated Goal when this call used an explicit registry/runtime.
+        recovery = result.get("recovery")
+        if isinstance(recovery, dict):
+            for step in ("inspect", "retry", "acquire", "release"):
+                descriptor = recovery.get(step)
+                if isinstance(descriptor, dict) and isinstance(descriptor.get("cli_args"), list):
+                    descriptor["cli_args"] = [f"--registry={registry_path}",
+                        f"--runtime-root={runtime_root}", "--format", "json", *descriptor["cli_args"]]
         raise_canonical_write_failure(
             result,
             goal_id=goal_id,
diff --git a/tests/control_plane/test_deferred_resume_generated_command.py b/tests/control_plane/test_deferred_resume_generated_command.py
index 0ecc9b34b6..300b576746 100644
--- a/tests/control_plane/test_deferred_resume_generated_command.py
+++ b/tests/control_plane/test_deferred_resume_generated_command.py
@@ -1,4 +1,4 @@
-"""Quota's deferred-resume command must consume the existing narrow lifecycle."""
+"""Generated resume accepts planning copy while preserving execution proof fences."""
 
 from __future__ import annotations
 
@@ -33,7 +33,7 @@
 
 @pytest.mark.parametrize("provider", ["file", "sqlite"])
 @pytest.mark.parametrize("fallback", [False, True])
-def test_generated_deferred_resume_preserves_execution_lease_boundary(
+def test_generated_deferred_resume_keeps_proof_fences_with_planning_note(
     tmp_path: Path,
     monkeypatch: pytest.MonkeyPatch,
     capsys: pytest.CaptureFixture[str],
@@ -153,7 +153,6 @@ def cli(*args: str) -> tuple[int, dict]:
     )
     assert rc == 1 and premature["error_code"] == "todo_not_open", premature
     for extra, actor in (
-        (["--note", "This is an execution edit."], AGENT_ID),
         ([], peer),
         (
             [
@@ -185,13 +184,17 @@ def cli(*args: str) -> tuple[int, dict]:
         assert rc == 1 and rejected["ok"] is False, rejected
         assert state.read_bytes() == before
 
-    # Execute the actual quota output; the old --note template fails here.
-    rc, resumed = cli(*resume)
+    # A caller may retain planning context alongside the generated transition;
+    # neither the note nor resume can substitute for the next execution grant.
+    note = "Retain the planning context while resuming unchanged work."
+    rc, resumed = cli(*resume, "--note", note)
     assert rc == 0 and resumed["status"] == "applied", json.dumps(resumed, indent=2)
     assert "--reason" in resume and "--note" not in resume
     transition = resumed["deferred_resume_transition"]
     assert transition["execution_authority_granted"] is False
     assert transition["next_execution"] == "acquire_fresh_lease"
+    rc, current = cli("todo", "list", "--goal-id", GOAL_ID, "--todo-id", TODO_ID)
+    assert rc == 0 and current["todo"]["note"] == note, current
     rc, absent = cli(
         "task-lease", "inspect", "--goal-id", GOAL_ID, "--todo-id", TODO_ID
     )
diff --git a/tests/control_plane/test_native_todo_planning_update.py b/tests/control_plane/test_native_todo_planning_update.py
index c9ece39345..26f4c4ceb4 100644
--- a/tests/control_plane/test_native_todo_planning_update.py
+++ b/tests/control_plane/test_native_todo_planning_update.py
@@ -484,7 +484,7 @@ def lease(action: str, *args: str) -> tuple[int, dict]:
     code, rejected = lease("acquire", "--owner", "agent-a", "--idempotency-key", "paused-execution")
     assert code == 1 and rejected["error_code"] == "todo_not_open"
     update(registry, "--status", "open", "--clear-resume-when", "--reason", "Reviewed new route",
-           "--evidence", "Bundled evidence is a separate leased edit", ok=False)
+           "--text", "Changing acceptance is a separate edit", ok=False)
     assert records(registry) == blocked
     reopen = shlex.split(guide["steps"][1]["command"])[3:]
     update(registry, *reopen, "--update-operation-id", "stale-reopen",
diff --git a/tests/control_plane/test_task_lease_argument_recovery.py b/tests/control_plane/test_task_lease_argument_recovery.py
index ebc103118a..2231e765e9 100644
--- a/tests/control_plane/test_task_lease_argument_recovery.py
+++ b/tests/control_plane/test_task_lease_argument_recovery.py
@@ -100,6 +100,9 @@ def test_missing_inputs_are_combined_and_wrong_owner_is_not_repaired(lease_cli):
     assert repaired[repaired.index("--expected-version") + 1] == "0"
     denied = run(repaired, code=1)
     assert denied["ok"] is False and "recovery" not in denied
+    observed = run(denied["inspection"]["cli_args"])
+    assert observed["lease"] == before
+    assert denied["inspection"]["execution_authority_granted"] is False
     assert run(action("inspect"))["lease"] == before
 
 
diff --git a/tests/control_plane/test_todo_administrative_journey.py b/tests/control_plane/test_todo_administrative_journey.py
new file mode 100644
index 0000000000..e0e2428a32
--- /dev/null
+++ b/tests/control_plane/test_todo_administrative_journey.py
@@ -0,0 +1,108 @@
+"""Ordinary task intent uses the real canonical CLI and Chat action owner."""
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+
+import pytest
+
+from canonical_authority_fixture import isolate_sqlite_runtime, promoted_create_fixture
+from loopx.chat_action_store import ChatActionStore
+from loopx.chat_actions import ChatActionService
+from loopx.control_plane.todos.mutation_api import add_goal_todo
+
+
+@pytest.fixture(params=["file", "sqlite"])
+def journey(tmp_path, monkeypatch, request):
+    isolate_sqlite_runtime(tmp_path, monkeypatch)
+    registry, runtime, state = promoted_create_fixture(
+        tmp_path, provider=request.param, handoff_mode="hard_lease", registered_agents=["agent-a", "agent-b"])
+    task = add_goal_todo(registry_path=registry, goal_id="goal-a", role="agent",
+        text="Validate the original task", claimed_by="agent-a", agent_id="agent-a",
+        task_class="advancement_task", action_kind="implement")
+    todo_id = task["todo_id"]
+
+    def cli(*args, ok=True):
+        child = subprocess.run([sys.executable, "-m", "loopx.cli", "--format", "json",
+            "--registry", str(registry), "--runtime-root", str(runtime), *args,
+            "--goal-id", "goal-a", "--todo-id", todo_id], capture_output=True, text=True, timeout=60)
+        payload = json.loads(child.stdout)
+        assert (child.returncode == 0) is ok, (payload, child.stderr)
+        return payload
+
+    return cli, todo_id, registry, runtime
+
+
+def test_cli_copy_pause_resume_defer_without_lease_bookkeeping(journey):
+    cli, _, registry, runtime = journey
+    lease = cli("task-lease", "acquire", "--owner", "agent-a", "--idempotency-key", "original")["lease"]
+    original = cli("todo", "list")["todo"]
+    assert cli("todo", "update", "--agent-id", "agent-a", "--note", "Administrative note")["ok"]
+    assert cli("task-lease", "inspect")["lease"] == lease
+    pause = ("todo", "update", "--agent-id", "agent-a", "--status", "blocked", "--reason", "Owner paused",
+        "--note", "Keep the original acceptance", "--evidence", "evidence:owner-pause", "--update-operation-id", "pause-once")
+    assert cli(*pause, "--dry-run")["status"] == "planned"
+    assert cli("task-lease", "inspect")["lease"] == lease
+    applied = cli(*pause)
+    assert applied["blocked_lifecycle_transition"]["lease_retirement"] == "released"
+    assert cli(*pause)["status"] == "replayed"
+    paused = cli("todo", "list")["todo"]
+    assert paused["status"] == "blocked" and paused["done"] is False
+    assert paused["note"] == "Keep the original acceptance"
+    assert paused["evidence"] == "evidence:owner-pause"
+    assert paused["text"] == original["text"] and paused["claimed_by"] == "agent-a"
+    stale = cli("todo", "update", "--agent-id", "agent-a", "--note", "Stale execution",
+        "--task-lease-idempotency-key", "original", "--task-lease-expected-version", str(lease["version"]), ok=False)
+    assert stale["ok"] is False
+    inspect = stale["recovery"]["inspect"]["cli_args"]
+    assert f"--registry={registry}" in inspect and f"--runtime-root={runtime}" in inspect
+    inspected = subprocess.run([sys.executable, "-m", "loopx.cli", *inspect], capture_output=True, text=True, timeout=60)
+    assert inspected.returncode == 0, inspected.stderr
+    assert json.loads(inspected.stdout)["lease"]["status"] == "released"
+    resumed = cli("todo", "update", "--agent-id", "agent-a", "--status", "open", "--reason", "Owner resumed", "--note", "Resume context")
+    assert resumed["blocked_lifecycle_transition"]["execution_authority_granted"] is False
+    assert cli("task-lease", "inspect")["lease"]["status"] == "released"
+    deferred = cli("todo", "update", "--agent-id", "agent-a", "--status", "deferred", "--reason", "Wait for owner",
+        "--resume-when", "resume_at:2099-01-01T00:00:00Z", "--note", "Deferral context", "--evidence", "evidence:wait")
+    assert deferred["deferred_transition"]["execution_authority_granted"] is False
+    assert cli("todo", "list")["todo"]["status"] == "deferred"
+    resumed = cli("todo", "update", "--agent-id", "agent-a", "--status", "open", "--note", "Explicit resume", "--reason", "Owner resumed")
+    assert resumed["deferred_resume_transition"]["execution_authority_granted"] is False
+    readback = cli("todo", "list")["todo"]
+    assert readback["status"] == "open" and readback.get("resume_when") is None
+    refused = cli("todo", "update", "--agent-id", "agent-a", "--status", "blocked", "--reason", "Pause",
+        "--text", "Replace the acceptance while pausing", ok=False)
+    assert refused["recovery"]["action"] == "resolve_lifecycle_edit"
+    assert "--text" in refused["recovery"]["retry"]["remove_flags"]
+    assert cli("todo", "list")["todo"] == readback
+
+
+def test_chat_uses_same_atomic_owner_and_refuses_changed_review_basis(journey, tmp_path):
+    cli, todo_id, registry, runtime = journey
+    cli("task-lease", "acquire", "--owner", "agent-a", "--idempotency-key", "chat-execution")
+    cli("todo", "update", "--agent-id", "agent-a", "--note", "Original task context")
+    service = ChatActionService(store=ChatActionStore(tmp_path / "actions"), registry_path=registry,
+        runtime_root_override=str(runtime))
+
+    def preview(key, **parameters):
+        return service.preview({"action_kind": "todo.update", "summary": "Owner task operation", "idempotency_key": key,
+            "context": {"kind": "todo", "goal_id": "goal-a", "todo_id": todo_id},
+            "normalized_parameters": {"goal_id": "goal-a", "todo_id": todo_id, "agent_id": "agent-a", **parameters}})
+
+    before = cli("task-lease", "inspect")["lease"]
+    paused = preview("chat-pause", operation="block", note="Pause with context")
+    assert cli("task-lease", "inspect")["lease"] == before
+    result = service.apply(paused["proposal_id"])
+    assert result["proposal"]["status"] == "applied"
+    assert cli("task-lease", "inspect")["lease"]["status"] == "released"
+    paused_todo = cli("todo", "list")["todo"]
+    assert paused_todo["note"] == "Original task context" and paused_todo["reason"] == "Pause with context"
+    resume = preview("chat-resume", operation="edit", status="open")
+    assert service.apply(resume["proposal_id"])["proposal"]["status"] == "applied"
+    resumed_todo = cli("todo", "list")["todo"]
+    assert resumed_todo["status"] == "open" and resumed_todo["note"] == "Original task context"
+    priority = preview("chat-priority", operation="edit", priority="P2")
+    cli("todo", "update", "--agent-id", "agent-a", "--note", "Intervening task change")
+    assert service.apply(priority["proposal_id"])["proposal"]["status"] == "stale"
+    assert cli("todo", "list")["todo"].get("priority") != "P2"
diff --git a/tests/control_plane/test_todo_update_lease_recovery.py b/tests/control_plane/test_todo_update_lease_recovery.py
index 2bdbf29d14..5441877da0 100644
--- a/tests/control_plane/test_todo_update_lease_recovery.py
+++ b/tests/control_plane/test_todo_update_lease_recovery.py
@@ -16,7 +16,7 @@
 
 
 @pytest.mark.parametrize("provider", ["file", "sqlite"])
-def test_hard_lease_recovery_through_public_cli(tmp_path: Path, monkeypatch, provider: str) -> None:
+def test_execution_scoped_planning_recovery_through_public_cli(tmp_path: Path, monkeypatch, provider: str) -> None:
     mode = "hard_lease"
     isolate_sqlite_runtime(tmp_path, monkeypatch)
     runtime = tmp_path / "runtime"
@@ -55,7 +55,7 @@ def snapshot() -> dict:
         "--expected-version", str(first["lease"]["version"]))
     before = snapshot()
     display_before = state.read_bytes() if state.exists() else None
-    edit = ("todo", "update", "--agent-id", "agent-a", "--text", "Recovered edit")
+    edit = ("todo", "update", "--agent-id", "agent-a", "--text", "Recovered edit", "--unblocks-todo-id", "todo_recovery")
     for dry in [("--dry-run",), ()]:
         rejected = cli(*edit, *dry, ok=False)
         assert rejected["error_code"] == "handoff_mode_requires_lease"
@@ -214,14 +214,16 @@ def snapshot() -> dict:
         if lease_state == "active":
             assert "retry" not in recovery
         else:
-            assert "--clear-resume-when" in recovery["retry"]["command"]
+            assert "--status open" in recovery["retry"]["command"]
             assert "--reason" in render_todo_markdown(rejected)
         assert "acquire" not in recovery
         assert snapshot() == before
     if claimed:
         foreign = cli("todo", "update", "--agent-id", "agent-b", "--status", "open", "--note", "Foreign edit", ok=False)
         assert foreign["error_code"] == "update_owner_mismatch"
-        assert "recovery" not in foreign
+        assert foreign["recovery"]["execution_authority_granted"] is False
+        assert "retry" not in foreign["recovery"] and "acquire" not in foreign["recovery"]
+        assert foreign["recovery"]["claimed_by"] == "agent-a"
         assert snapshot() == before
     unknown = cli("todo", "update", "--agent-id", "agent-unknown", "--status", "open", "--note", "Foreign edit", ok=False)
     assert unknown["error_code"] == "actor_not_registered"
diff --git a/tests/control_plane_ts/authority_store_conformance.ts b/tests/control_plane_ts/authority_store_conformance.ts
index d3a0c64a1a..19985054d0 100644
--- a/tests/control_plane_ts/authority_store_conformance.ts
+++ b/tests/control_plane_ts/authority_store_conformance.ts
@@ -1656,7 +1656,7 @@ export function registerAuthorityStoreConformance(
       assert.equal(rejected.reason_code, "claim_owner_mismatch");
       assert.deepEqual(await store.loadAuthority(), loaded);
     });
-    test(`${providerName} conformance: lease-fenced text/note update (${native ? "native" : "v0"})`, async (t) => {
+    test(`${providerName} conformance: explicit-proof text/note update with administrative preview (${native ? "native" : "v0"})`, async (t) => {
       const {store, contender} = await factory(t);
       const goalId = "goal-claim";
       const projection = {...todoClaimProjection(goalId, native), handoff_mode: "hard_lease"};
@@ -1685,14 +1685,15 @@ export function registerAuthorityStoreConformance(
         {...request, actor_agent_id: "agent-b"},
         {...request, lease_idempotency_key: "old-execution"},
         {...request, lease_expected_version: 3},
-        {...request, lease_idempotency_key: null, lease_expected_version: null},
+        {...request, lease_idempotency_key: null, lease_expected_version: 4},
         {...request, now: new Date("2026-09-05T06:00:00Z")},
       ]) {
         assert.equal((await executeCoordinationTodoUpdate(store, invalid)).status, "failed");
         assert.deepEqual(await store.loadAuthority(), before);
         assert.equal((await store.readReceipt(request.operation_id)).status, "missing");
       }
-      assert.equal((await executeCoordinationTodoUpdate(store, {...request, dry_run: true})).status, "planned");
+      assert.equal((await executeCoordinationTodoUpdate(store, {...request, dry_run: true,
+        lease_idempotency_key: null, lease_expected_version: null})).status, "planned");
       assert.deepEqual(await store.loadAuthority(), before);
       assert.equal((await executeCoordinationTodoUpdate(store, request)).status, "applied");
       const after = await store.loadAuthority();
diff --git a/tests/control_plane_ts/blocked_hard_lease_lifecycle.test.ts b/tests/control_plane_ts/blocked_hard_lease_lifecycle.test.ts
index 4244b47134..8d9e93027c 100644
--- a/tests/control_plane_ts/blocked_hard_lease_lifecycle.test.ts
+++ b/tests/control_plane_ts/blocked_hard_lease_lifecycle.test.ts
@@ -140,7 +140,7 @@ for (const provider of ["file", "sqlite"] as const) {
     assert.equal((await executeCoordinationTodoUpdate(active, input)).reason_code, "blocked_lifecycle_active_lease");
     assert.equal((await executeCoordinationTodoUpdate(active, {...input,
       lease_idempotency_key: "old-execution", lease_expected_version: 29})).reason_code,
-      "blocked_lifecycle_execution_proof_not_allowed");
+      "lease_cas_mismatch");
     assert.deepEqual(await read(active), before);
   });
 
@@ -151,8 +151,9 @@ for (const provider of ["file", "sqlite"] as const) {
       [{}, "blocked_lifecycle_active_lease"],
       [{lifecycle_grants: []}, "update_owner_mismatch"],
       [{lease_idempotency_key: "old-execution", lease_expected_version: 29},
-        "blocked_lifecycle_execution_proof_not_allowed"],
-      [{patch: {note: "Bundled work"}}, "lease_fence_required"],
+        "lease_cas_mismatch"],
+      [{patch: {note: "Bundled note"}}, "blocked_lifecycle_active_lease"],
+      [{patch: {text: "Changed work"}}, "lease_fence_required"],
     ];
     for (const [change, code] of cases) {
       const result = await executeCoordinationTodoUpdate(active, {...pause("reject-pause"), ...change});
diff --git a/tests/control_plane_ts/deferred_hard_lease_lifecycle.test.ts b/tests/control_plane_ts/deferred_hard_lease_lifecycle.test.ts
index 0af34ead17..5b7c4371e4 100644
--- a/tests/control_plane_ts/deferred_hard_lease_lifecycle.test.ts
+++ b/tests/control_plane_ts/deferred_hard_lease_lifecycle.test.ts
@@ -122,7 +122,7 @@ for (const provider of ["file", "sqlite"] as const) {
       [{actor_agent_id: "agent-b"}, "update_owner_mismatch"],
       [{lease_idempotency_key: "old-execution", lease_expected_version: 3},
         "deferred_resume_execution_proof_not_allowed"],
-      [{patch: {note: "Bundled work"}}, "handoff_mode_lease_claim_divergence"],
+      [{patch: {note: "Bundled work"}}, "deferred_resume_active_lease"],
     ] as const) {
       const result = await executeCoordinationTodoUpdate(active, {...resume("rejected"), ...change});
       assert.equal(result.reason_code, code, JSON.stringify(result));
@@ -163,33 +163,36 @@ for (const provider of ["file", "sqlite"] as const) {
 
 for (const provider of ["file", "sqlite"] as const) {
   for (const mode of ["legacy", "hard_lease"] as const) {
-    test(`${provider}/${mode}: ${mode === "legacy" ? "retired policy rejects deferral with retained proof" : "owner deferral releases its grant atomically and can resume"}`,
+    test(`${provider}/${mode}: ${mode === "legacy" ? "retired policy rejects deferral with retained proof" : "owner deferral automatically retires its grant; explicit constraints remain fenced"}`,
       {skip: provider === "sqlite" && sqliteSkip}, async () => {
       const store = await seeded(provider, {status: "open", done: false},
         oldLease("active", "2026-09-06T00:00:00Z"));
       const seededHead = await read(store);
       await store.commitAuthority({operation_id: "set-mode", expected_provider_revision: seededHead.provider_revision,
         next_projection: {...seededHead.head, handoff_mode: mode}, events: [], receipts: []});
-      const input = {...resume("defer-owner"), lease_idempotency_key: "old-execution", lease_expected_version: 3,
+      const proof = {lease_idempotency_key: "old-execution", lease_expected_version: 3};
+      const input = {...resume("defer-owner"),
         planning_intent: {status: "deferred", resume_when: "todo_done:todo_dependency", reason: "Dependency is pending"}};
       const before = await read(store);
       if (mode === "legacy") {
         for (const dry_run of [true, false]) {
-          const rejected = await executeCoordinationTodoUpdate(store, {...input, dry_run});
+          const rejected = await executeCoordinationTodoUpdate(store, {...input, ...proof, dry_run});
           assert.equal(rejected.reason_code, "handoff_mode_retired");
           assert.deepEqual(await read(store), before);
           assert.equal((await store.readReceipt(input.operation_id)).status, "missing");
         }
         return;
       }
-      for (const change of [{lease_expected_version: 2}, {lease_idempotency_key: "foreign"},
-        {actor_agent_id: "agent-b"}, {lease_idempotency_key: null, lease_expected_version: null},
+      for (const change of [{...proof, lease_expected_version: 2}, {...proof, lease_idempotency_key: "foreign"},
+        {actor_agent_id: "agent-b"}, {lease_idempotency_key: "old-execution"},
         {patch: {text: "Changed work"}}, {planning_intent: {...input.planning_intent, completion_criteria: "New contract"}}]) {
         assert.equal((await executeCoordinationTodoUpdate(store, {...input, ...change})).status, "failed");
         assert.deepEqual(await read(store), before);
       }
       assert.equal((await executeCoordinationTodoUpdate(store, {...input, dry_run: true})).status, "planned");
       assert.deepEqual(await read(store), before);
+      assert.equal((await executeCoordinationTodoUpdate(store, {...input, ...proof, dry_run: true})).status, "planned");
+      assert.deepEqual(await read(store), before);
       const applied = await executeCoordinationTodoUpdate(store, input);
       assert.equal(applied.status, "applied", JSON.stringify(applied));
       assert.equal((applied.deferred_transition as JsonObject).kind, "todo_deferred");
@@ -205,9 +208,11 @@ for (const provider of ["file", "sqlite"] as const) {
         planning_intent: {...input.planning_intent, reason: "Changed intent"}})).reason_code,
         "coordination_operation_identity_mismatch");
       assert.equal((await executeCoordinationTodoUpdate(store, resume("resume-after-wait"))).status, "applied");
-      const retry = await executeCoordinationTodoUpdate(store, {...input, operation_id: "defer-again"});
+      const retry = await executeCoordinationTodoUpdate(store, {...input, ...proof, operation_id: "defer-again"});
       assert.equal(retry.status, "failed");
-      assert.equal((retry.recovery as JsonObject).action, "acquire_fresh_lease");
+      assert.equal((retry.recovery as JsonObject).action, "inspect_current_proof");
+      assert.equal((retry.recovery as JsonObject).lease_state, "released");
+      assert.equal((retry.recovery as JsonObject).execution_authority_granted, false);
       assert.equal((await executeCoordinationTodoUpdate(store, {...resume("old-proof"),
         patch: {note: "Unauthorized execution"}, planning_intent: {},
         lease_idempotency_key: "old-execution", lease_expected_version: 3})).status, "failed");
diff --git a/tests/control_plane_ts/leased_continuation.test.ts b/tests/control_plane_ts/leased_continuation.test.ts
index 9e0b08c24e..1592915407 100644
--- a/tests/control_plane_ts/leased_continuation.test.ts
+++ b/tests/control_plane_ts/leased_continuation.test.ts
@@ -125,15 +125,28 @@ for (const provider of ["file", "sqlite", "postgresql"]) {
   });
 }
 
-test("leased preparation requires exact proof; context cannot inject operational proof", async t => {
-  const f = await fixture(t, "file");
+for (const provider of ["file", "sqlite", "postgresql"]) test(`${provider}: leased preparation requires exact proof; context cannot inject operational proof`,
+  {skip: provider === "postgresql" && !process.env.LOOPX_TEST_POSTGRES_URL ? "isolated PostgreSQL URL required" : false}, async t => {
+  const f = await fixture(t, provider);
+  const before = await loaded(f.store);
   for (const proof of [null, {...f.sourceProof, expected_version: 999}, {...f.sourceProof, idempotency_key: "wrong"}]) {
     assert.equal((await executeTodoContinuation(f.store, {...f.prepare, lease_proof: proof})).ok, false);
+    assert.deepEqual(await loaded(f.store), before);
+    assert.equal((await f.store.readReceipt("prepare")).status, "missing");
   }
   await assert.rejects(executeTodoContinuation(f.store, {...f.prepare, lease_proof: {idempotency_key: "partial"}}), /lease_proof/);
   await assert.rejects(executeTodoContinuation(f.store, {...f.prepare,
     context: {...f.prepare.context, lease_proof: f.sourceProof}}), /unknown context field/);
   assert.equal((await f.store.readReceipt("prepare")).status, "missing");
+  const released = await executeCanonicalTaskLeaseLifecycle(f.store, {operation: "release", goal_id: f.base.goal_id,
+    todo_id: f.base.todo_id, owner: f.base.agent_id, idempotency_key: f.sourceProof.idempotency_key,
+    expected_version: f.sourceProof.expected_version, registered_agents: f.base.registered_agents, now: new Date()});
+  assert.equal(released.status, "applied", JSON.stringify(released));
+  const inactive = await loaded(f.store);
+  assert.equal((await executeTodoContinuation(f.store, {...f.prepare,
+    expected_provider_revision: inactive.provider_revision})).ok, false);
+  assert.deepEqual(await loaded(f.store), inactive);
+  assert.equal((await f.store.readReceipt("prepare")).status, "missing");
 });
 
 test("claim transfer never refreshes previously stale context", async t => {
@@ -211,6 +224,15 @@ for (const provider of ["file", "sqlite"]) test(`${provider}: public CLI deliver
     "--task-lease-expected-version", String(f.sourceProof.expected_version)];
   const prepareArgs = [...sourceArgs, "--operation-id", "cli-prepare",
     "--expected-revision", String(f.prepare.expected_provider_revision), "--rationale", "Continue with the preserved decision"];
+  const beforePrepare = await loaded(f.store);
+  await assert.rejects(handoff("prepare", "agent-a", "source", prepareArgs.slice(sourceArgs.length)), error => {
+    const failure = error as Error & {code: number; stdout: string};
+    assert.equal(failure.code, 1);
+    assert.equal(JSON.parse(failure.stdout).ok, false);
+    return true;
+  });
+  assert.deepEqual(await loaded(f.store), beforePrepare);
+  assert.equal((await f.store.readReceipt("cli-prepare")).status, "missing");
   const pending = await handoff("prepare", "agent-a", "source", prepareArgs);
   assert.equal(pending.ok, true); // Missing local display declaration cannot erase the canonical write.
   assert.equal(pending.projection_delivery, "pending");
diff --git a/tests/control_plane_ts/native_planning_update_conformance.ts b/tests/control_plane_ts/native_planning_update_conformance.ts
index 6861b0d67b..548788a187 100644
--- a/tests/control_plane_ts/native_planning_update_conformance.ts
+++ b/tests/control_plane_ts/native_planning_update_conformance.ts
@@ -216,7 +216,7 @@ export function registerNativePlanningUpdateConformance(provider: string, factor
       original.find(t => t.todo_id === request.todo_id)?.last_actor_agent_id,
       "planning-only updates preserve legacy actor attribution");
     for (const [operation_id, change] of [
-      ["no-proof", {lease_idempotency_key: null, lease_expected_version: null}],
+      ["partial-proof", {lease_idempotency_key: null}],
       ["status-change", {planning_intent: {status: "deferred", resume_when: "pr_merged:#123"}}],
       ["requirements-change", {planning_intent: {required_write_scopes: ["new/**"]}}],
       ["wrong-owner", {actor_agent_id: "agent-b"}],
diff --git a/tests/control_plane_ts/todo_administrative_edits.test.ts b/tests/control_plane_ts/todo_administrative_edits.test.ts
new file mode 100644
index 0000000000..52a90949e9
--- /dev/null
+++ b/tests/control_plane_ts/todo_administrative_edits.test.ts
@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import {randomUUID} from "node:crypto";
+import {mkdtemp, rm} from "node:fs/promises";
+import {tmpdir} from "node:os";
+import {join} from "node:path";
+import test from "node:test";
+import {Pool} from "pg";
+import type {AuthorityStore} from "../../loopx/control_plane/coordination/authority_store.ts";
+import type {JsonObject} from "../../loopx/control_plane/effect_program.ts";
+import {FileAuthorityStore} from "../../loopx/control_plane/coordination/file_authority_store.ts";
+import {SqliteAuthorityStore} from "../../loopx/control_plane/coordination/sqlite_authority_store.ts";
+import {PostgreSqlAuthorityStore, installPostgreSqlAuthorityStoreSchema} from "../../loopx/control_plane/coordination/postgresql_authority_store.ts";
+import {coordinationTodoReadModel} from "../../loopx/control_plane/coordination/coordination_projection.ts";
+import {TODO_DOMAIN_READ_RECORD_SCHEMA} from "../../loopx/control_plane/coordination/coordination_state_contract.ts";
+import {executeCoordinationTodoUpdate, type CoordinationTodoUpdateInput} from "../../loopx/control_plane/coordination/todo_update.ts";
+
+const GOAL = "administrative-edits";
+const NOW = new Date("2026-09-25T06:00:00Z");
+const pool = process.env.LOOPX_TEST_POSTGRES_URL ? new Pool({connectionString: process.env.LOOPX_TEST_POSTGRES_URL}) : null;
+const database = pool && {connect: async () => {
+  const client = await pool.connect();
+  return {query: async (sql: string, values?: readonly unknown[]) => client.query(sql, values ? [...values] : undefined),
+    release: (error?: Error) => client.release(error)};
+}};
+const installed = database && installPostgreSqlAuthorityStoreSchema(database, `postgresql:${"b".repeat(32)}`);
+test.after(async () => { await pool?.end(); });
+
+async function fixture(t: test.TestContext, provider: "file" | "sqlite" | "postgresql", leaseState: string | null = "active") {
+  const root = await mkdtemp(join(tmpdir(), "loopx-administrative-"));
+  t.after(() => rm(root, {recursive: true, force: true}));
+  await installed;
+  const store: AuthorityStore = provider === "postgresql"
+    ? new PostgreSqlAuthorityStore(database!, {tenant_id: `test-${randomUUID()}`, goal_id: GOAL})
+    : provider === "file" ? new FileAuthorityStore(root, GOAL) : new SqliteAuthorityStore(root, GOAL);
+  const todo = {schema_version: "todo_item_v0", todo_id: "todo_work", source_section: "Agent Todo", role: "agent", status: "open",
+    done: false, archive_state: "active", claimed_by: "agent-a", text: "Original task",
+    task_class: "advancement_task", task_repository: "git:github.com/example/project", required_write_scopes: ["src/**"], completion_validation_required: true};
+  const lease = {schema_version: "task_lease_v0", goal_id: GOAL, todo_id: "todo_work", owner: "agent-a",
+    idempotency_key: "execution", version: 7, lease_epoch: 3, write_scopes: ["src/**"],
+    status: leaseState === "released" ? "released" : "active",
+    expires_at: leaseState === "active" ? "2026-09-25T07:00:00Z" : "2026-09-25T05:00:00Z"};
+  const seeded = await store.commitAuthority({operation_id: "seed", expected_provider_revision: null,
+    events: [], receipts: [], next_projection: {goal_id: GOAL, handoff_mode: "hard_lease", todos: [todo],
+      leases: leaseState === null ? [] : [lease], todo_read_model: coordinationTodoReadModel([todo], TODO_DOMAIN_READ_RECORD_SCHEMA)}});
+  assert.equal(seeded.status, "applied", JSON.stringify(seeded));
+  const input: CoordinationTodoUpdateInput = {goal_id: GOAL, todo_id: "todo_work", expected_role: "agent",
+    actor_agent_id: "agent-a", registered_agents: ["agent-a", "agent-b"], operation_id: "edit",
+    patch: {note: "Reviewed note"}, clear_fields: [], planning_intent: {evidence: "evidence:reviewed"},
+    dry_run: false, now: NOW};
+  return {store, input, lease, todo};
+}
+
+async function head(store: AuthorityStore) {
+  const read = await store.loadAuthority();
+  assert.equal(read.status, "loaded");
+  if (read.status !== "loaded") throw new Error("missing synthetic authority");
+  return read;
+}
+
+for (const provider of ["file", "sqlite", "postgresql"] as const) {
+  const options = {skip: provider === "postgresql" && !pool ? "requires isolated real PostgreSQL" : false};
+  for (const state of [null, "active", "expired", "released"]) test(`${provider}: owner metadata needs no execution grant (${state})`, options, async t => {
+    const {store, input} = await fixture(t, provider, state);
+    const before = await head(store);
+    const planned = await executeCoordinationTodoUpdate(store, {...input, dry_run: true});
+    assert.equal(planned.status, "planned", JSON.stringify(planned));
+    assert.deepEqual(await head(store), before);
+    assert.equal((await executeCoordinationTodoUpdate(store, input)).status, "applied");
+    const after = await head(store);
+    assert.deepEqual(after.head.leases, before.head.leases);
+    const todo = (after.head.todos as JsonObject[])[0]!;
+    assert.equal(todo.note, "Reviewed note");
+    assert.equal(todo.status, "open");
+    assert.equal(todo.completion_validation_required, true);
+    assert.equal((await executeCoordinationTodoUpdate(store, input)).status, "replayed");
+    assert.deepEqual(await head(store), after);
+  });
+  test(`${provider}: pause, note and evidence retire own active lease atomically; resume grants no execution`, options, async t => {
+    const {store, input} = await fixture(t, provider);
+    const pause = {...input, planning_intent: {...input.planning_intent, status: "blocked", reason: "Owner paused"}};
+    const applied = await executeCoordinationTodoUpdate(store, pause);
+    assert.equal(applied.status, "applied", JSON.stringify(applied));
+    const paused = await head(store);
+    const todo = (paused.head.todos as JsonObject[])[0]!;
+    assert.equal(todo.status, "blocked");
+    assert.equal(todo.done, false);
+    assert.equal(todo.note, input.patch.note);
+    assert.equal(todo.evidence, input.planning_intent!.evidence);
+    assert.equal((paused.head.leases as JsonObject[])[0]!.status, "released");
+    assert.equal((await executeCoordinationTodoUpdate(store, pause)).status, "replayed");
+    assert.deepEqual(await head(store), paused);
+    const resumed = await executeCoordinationTodoUpdate(store, {...input, operation_id: "resume",
+      planning_intent: {status: "open", reason: "Owner resumed"}});
+    assert.equal(resumed.status, "applied");
+    assert.equal((resumed.blocked_lifecycle_transition as JsonObject).execution_authority_granted, false);
+    assert.deepEqual((await head(store)).head.leases, paused.head.leases);
+  });
+  test(`${provider}: explicit stale proof, foreign holder and changed provider revision never auto-heal`, options, async t => {
+    const {store, input} = await fixture(t, provider);
+    const before = await head(store);
+    for (const request of [
+      {...input, lease_idempotency_key: "stale", lease_expected_version: 6},
+      {...input, lease_idempotency_key: "execution"},
+      {...input, expected_provider_revision: "stale:revision"},
+      {...input, actor_agent_id: "agent-b"},
+      {...input, actor_agent_id: "unknown"},
+      {...input, planning_intent: {required_write_scopes: ["other/**"]}},
+    ]) {
+      assert.equal((await executeCoordinationTodoUpdate(store, request)).status, "failed");
+      assert.deepEqual(await head(store), before);
+    }
+    const competing = {...input, patch: {note: "Foreign execution"}, operation_id: "competing",
+      actor_agent_id: "agent-b", lifecycle_grants: [{agent_id: "agent-b", actions: ["update"], requires_reason: true}],
+      authority_reason: "Administrative grant is not a holder grant"};
+    const refused = await executeCoordinationTodoUpdate(store, competing);
+    assert.equal(refused.status, "failed");
+    assert.equal((refused.recovery as JsonObject)?.owner_relation, "foreign_owner", JSON.stringify(refused));
+    assert.deepEqual(await head(store), before);
+    // Two authorized edits pinning one head cannot silently overwrite each other.
+    const outcomes = await Promise.all(["one", "two"].map(operation_id => executeCoordinationTodoUpdate(store,
+      {...input, operation_id, patch: {note: operation_id}, expected_provider_revision: before.provider_revision})));
+    assert.equal(outcomes.filter(result => result.status === "applied").length, 1);
+  });
+}
diff --git a/tests/control_plane_ts/todo_update.test.ts b/tests/control_plane_ts/todo_update.test.ts
index e7aaea1e1c..29f82123e4 100644
--- a/tests/control_plane_ts/todo_update.test.ts
+++ b/tests/control_plane_ts/todo_update.test.ts
@@ -405,8 +405,6 @@ test("user-action metadata exception retains actor, binding, class, lifecycle an
     {facts: {excluded_agents: ["agent-a"]}, input: {}, code: "actor_excluded"},
     {facts: {bound_agent: null}, input: {}, code: "todo_not_executable"},
     {facts: {task_class: "user_gate"}, input: {}, code: "handoff_mode_requires_lease"},
-    {facts: {role: "agent", task_class: "advancement_task", claimed_by: "agent-a"},
-      input: {expected_role: "agent"}, code: "handoff_mode_requires_lease"},
     {facts: {status: "blocked"}, input: {}, code: "todo_not_executable"},
     {facts: {}, input: {planning_intent: {status: "blocked"}}, code: "todo_not_executable"},
     {facts: {}, input: {planning_intent: {required_capabilities: ["shell"]}}, code: "todo_not_executable"},
@@ -855,7 +853,7 @@ test("provider-first update rejects authority and lifecycle escalation", async (
 });
 
 for (const claimed_by of ["agent-a", null]) {
-test(`provider-first update fails closed without a hard-lease execution proof (${claimed_by ?? "unclaimed"})`, async () => {
+test(`provider-first administrative copy preserves a hard lease without consuming proof (${claimed_by ?? "unclaimed"})`, async () => {
   const {store, request} = await seeded({claimed_by});
   const head = await store.loadAuthority();
   assert.equal(head.status, "loaded");
@@ -868,8 +866,11 @@ test(`provider-first update fails closed without a hard-lease execution proof ($
       idempotency_key: "execution-a", version: 1, lease_epoch: 1,
     }]}});
   const result = await executeCoordinationTodoUpdate(store, request);
-  assert.equal(result.reason_code, "lease_fence_required");
-  assert.equal((await store.readReceipt(request.operation_id)).status, "missing");
+  assert.equal(result.status, "applied", JSON.stringify(result));
+  const after = await store.loadAuthority();
+  if (after.status !== "loaded") assert.fail("missing authority");
+  assert.deepEqual(after.head.leases, [{todo_id: "todo_a", owner: "agent-a", status: "active",
+    expires_at: "2026-09-06T00:00:00Z", idempotency_key: "execution-a", version: 1, lease_epoch: 1}]);
 });
 }
 
@@ -938,7 +939,7 @@ test("schema-less historical canonical leases retain active execution semantics
 });
 
 
-test("retained execution fences distinguish recovery; soft released owner copy needs no proof", async () => {
+test("administrative copy retains lease history; explicit execution recovery stays distinct", async () => {
   for (const mode of ["legacy", "soft_claim", "hard_lease"]) {
     for (const state of ["released", "expired", "active"]) {
       for (const owner of ["agent-a", "agent-b"]) {
@@ -962,7 +963,7 @@ test("retained execution fences distinguish recovery; soft released owner copy n
           assert.equal((await store.readReceipt(request.operation_id)).status, "missing");
           continue;
         }
-        if (mode === "soft_claim" && state === "released" && owner === "agent-a") {
+        if (owner === "agent-a" && (mode === "hard_lease" || mode === "soft_claim" && state === "released")) {
           assert.equal(result.status, "planned");
           assert.deepEqual(await store.loadAuthority(), before);
           continue;
@@ -1083,8 +1084,8 @@ test("recovery preserves stale-proof rejection and never offers foreign proof",
 
 test("inactive history does not invent an executable lease acquisition", async () => {
   for (const [overrides, intent, mode, expected] of [
-    [{status: "blocked"}, {}, "hard_lease", "resolve_acquire_rejection"],
-    [{claimed_by: null}, {}, "hard_lease", "reconcile_lease_owner"],
+    [{status: "blocked"}, {unblocks_todo_id: "todo_other"}, "hard_lease", "resolve_acquire_rejection"],
+    [{claimed_by: null}, {unblocks_todo_id: "todo_other"}, "hard_lease", "reconcile_lease_owner"],
     [{}, {required_capabilities: ["code_review"]}, "hard_lease", "resolve_lifecycle_edit"],
     [{}, {status: "blocked"}, "hard_lease", "resolve_lifecycle_edit"],
     [{status: "blocked"}, {}, "soft_claim", "resolve_acquire_rejection"],
@@ -1132,7 +1133,7 @@ for (const blocker of ["scope", "acceptance"]) test(`recovery respects ${blocker
     assert.equal(configured.status, "applied");
   }
   const before = await store.loadAuthority();
-  const result = await executeCoordinationTodoUpdate(store, request);
+  const result = await executeCoordinationTodoUpdate(store, {...request, planning_intent: {unblocks_todo_id: "todo_other"}});
   const recovery = result.recovery as Record<string, unknown>;
   assert.equal(recovery.action, "resolve_acquire_rejection");
   assert.equal(recovery.reason_code, blocker === "scope" ? "write_scope_conflict" : "goal_acceptance_unbound");
diff --git a/tests/test_todo_deferred_lease_recovery.py b/tests/test_todo_deferred_lease_recovery.py
index 70d23462ae..ca539fc14b 100644
--- a/tests/test_todo_deferred_lease_recovery.py
+++ b/tests/test_todo_deferred_lease_recovery.py
@@ -66,7 +66,7 @@ def snapshot():
     ("hard_lease", "active"), ("legacy", "released"),
     ("soft_claim", "released"), ("soft_claim", "expired"),
 ])
-def test_deferred_bundled_edit_names_executable_lifecycle_recovery(tmp_path, monkeypatch, provider, mode, lease_state):
+def test_deferred_owner_resume_commits_context_without_execution_grant(tmp_path, monkeypatch, provider, mode, lease_state):
     cli, snapshot = fixture(tmp_path, monkeypatch, provider, lease_state, mode=mode)
     before = snapshot()
     # A fresh lease cannot be acquired while this Todo remains deferred.
@@ -76,31 +76,40 @@ def test_deferred_bundled_edit_names_executable_lifecycle_recovery(tmp_path, mon
         assert snapshot() == before
     bundled = ("todo", "update", "--agent-id", "agent-a", "--status", "open",
         "--clear-resume-when", "--note", "Reviewed note", "--evidence", "artifact:reviewed")
-    for dry in [("--dry-run",), ()]:
-        rejected = cli(*bundled, *dry, ok=False)
-        recovery = rejected["recovery"]
-        assert recovery["action"] == "resolve_lifecycle_edit"
-        assert recovery["execution_authority_granted"] is False
-        assert "acquire" not in recovery
-        if lease_state == "active":
-            assert "retry" not in recovery
-        else:
-            assert "--clear-resume-when" in recovery["retry"]["command"]
-            assert "deferred" in render_todo_markdown(rejected)
-            assert "Do not bundle notes, evidence" in recovery["reason"]
-        assert snapshot() == before
+    if mode == "legacy":
+        # Retirement permits historical inspection/release, not administrative
+        # resume. This also pins the inherited legacy diagnostic case.
+        for dry in [("--dry-run",), ()]:
+            rejected = cli(*bundled, *dry, ok=False)
+            assert rejected["error_code"] == "handoff_mode_retired"
+            assert "retry" not in rejected.get("recovery", {})
+            assert "acquire" not in rejected.get("recovery", {})
+            assert snapshot() == before
+        inspected = cli("task-lease", "inspect")
+        assert inspected["active"] is False
+        assert inspected["lease"] == before["leases"][0]
+        for proof in [("--task-lease-idempotency-key", "old-execution"),
+            ("--task-lease-idempotency-key", "old-execution", "--task-lease-expected-version", "5")]:
+            assert cli(*bundled, *proof, ok=False)["error_code"] == "handoff_mode_retired"
+            assert snapshot() == before
+        return
     # A stale or partial execution proof cannot become administrative authority.
     for proof in [("--task-lease-idempotency-key", "old-execution"),
         ("--task-lease-idempotency-key", "old-execution", "--task-lease-expected-version", "5")]:
         stale = cli(*bundled, *proof, ok=False)
+        assert stale["error_code"] == "deferred_resume_execution_proof_not_allowed"
         assert "retry" not in stale.get("recovery", {})
         assert snapshot() == before
-    reopen = ("todo", "update", "--agent-id", "agent-a", "--status", "open", "--clear-resume-when",
-        "--reason", "Reviewed wait; original acceptance remains", "--update-operation-id", "resume-once",
+    reopen = (*bundled, "--reason", "Reviewed wait; original acceptance remains", "--update-operation-id", "resume-once",
         "--update-expected-provider-revision", before["provider_revision"])
     if lease_state == "active":
-        assert cli(*reopen, ok=False)["error_code"] == "deferred_resume_active_lease"
-        assert snapshot() == before
+        for dry in [("--dry-run",), ()]:
+            rejected = cli(*reopen, *dry, ok=False)
+            assert rejected["error_code"] == "deferred_resume_active_lease"
+            recovery = rejected["recovery"]
+            assert recovery["execution_authority_granted"] is False
+            assert "retry" not in recovery and "acquire" not in recovery
+            assert snapshot() == before
         return
     assert cli(*reopen, "--dry-run")["status"] == "planned"
     assert snapshot() == before
@@ -109,6 +118,7 @@ def test_deferred_bundled_edit_names_executable_lifecycle_recovery(tmp_path, mon
     opened = snapshot()
     task = opened["todos"][0]
     assert task["status"] == "open" and not task["done"] and "resume_when" not in task
+    assert task["note"] == "Reviewed note" and task["evidence"] == "artifact:reviewed"
     for field in ("text", "claimed_by", "priority", "task_class", "completion_validation_required"):
         assert task[field] == before["todos"][0][field]
     if lease_state is not None:
@@ -116,20 +126,32 @@ def test_deferred_bundled_edit_names_executable_lifecycle_recovery(tmp_path, mon
         assert opened["leases"][0]["version"] == 5
         assert opened["leases"][0]["lease_epoch"] == 3
         assert opened["leases"][0]["idempotency_key"] == "old-execution"
+    else:
+        assert opened["leases"] == []
+    assert cli("task-lease", "inspect")["active"] is False
     assert cli(*reopen)["status"] == "replayed"
     assert snapshot() == opened
+    stale_revision = cli("todo", "update", "--agent-id", "agent-a", "--note", "Unreviewed overwrite",
+        "--update-operation-id", "stale-copy", "--update-expected-provider-revision", before["provider_revision"], ok=False)
+    assert stale_revision["reason_code"] == "provider_revision_mismatch"
+    assert snapshot() == opened
     if mode == "soft_claim":
-        assert "do not acquire a lease in soft_claim" in recovery["reason"]
-        assert cli("todo", "update", "--agent-id", "agent-a", "--note", "Reviewed note")["ok"]
+        assert cli("todo", "update", "--agent-id", "agent-a", "--note", "Updated copy")["ok"]
         edited = snapshot()
-        assert edited["todos"][0]["note"] == "Reviewed note"
+        assert edited["todos"][0]["note"] == "Updated copy"
         assert edited["leases"] == opened["leases"]
         cli("todo", "update", "--agent-id", "agent-a", "--evidence", "artifact:reviewed", ok=False)
         assert snapshot() == edited
         return
-    # Reopening alone still cannot authorize the pending copy/evidence edit.
-    cli("todo", "update", "--agent-id", "agent-a", "--note", "Reviewed note", ok=False)
-    assert snapshot() == opened
+    # Ordinary owner copy is administrative; it cannot mint a lease or epoch.
+    assert cli("todo", "update", "--agent-id", "agent-a", "--note", "Updated copy",
+        "--evidence", "artifact:updated")["ok"]
+    edited = snapshot()
+    assert edited["todos"][0]["note"] == "Updated copy"
+    assert edited["todos"][0]["evidence"] == "artifact:updated"
+    assert edited["leases"] == opened["leases"]
+    assert cli("task-lease", "inspect")["active"] is False
+    # Actual execution still obtains a new generation through its own owner.
     lease = cli("task-lease", "acquire", "--owner", "agent-a", "--idempotency-key", "fresh-execution",
         "--expected-version", "0" if lease_state is None else "5")["lease"]
     assert lease["lease_epoch"] == (1 if lease_state is None else 4)
@@ -154,5 +176,19 @@ def test_deferred_recovery_does_not_relax_actor_admission(tmp_path, monkeypatch,
         rejected = cli("todo", "update", "--agent-id", actor, "--status", "open", "--clear-resume-when",
             "--reason", "Reviewed wait", *extra, ok=False)
         assert rejected["error_code"] == code
-        assert "recovery" not in rejected
+        if code == "actor_not_registered":
+            assert "recovery" not in rejected
+        else:
+            recovery = rejected["recovery"]
+            assert recovery["action"] == "reconcile_lease_owner"
+            assert recovery["todo_status"] == "deferred" and recovery["claimed_by"] == "agent-a"
+            assert recovery["execution_authority_granted"] is False
+            assert "retry" not in recovery and "acquire" not in recovery
+            inspect = recovery["inspect"]["cli_args"]
+            assert f"--registry={tmp_path / 'registry.json'}" in inspect
+            assert f"--runtime-root={tmp_path / 'runtime'}" in inspect
+            assert inspect[-6:] == ["todo", "list", "--goal-id", "goal-recovery",
+                "--todo-id", "todo_recovery"]
+            assert "todo list" in render_todo_markdown(rejected)
+            assert cli(*inspect)["todo"]["status"] == "deferred"
         assert snapshot() == before