Replan only remaining drift and test injected partial failures #27

Goal

Replan only the remaining desired drift after a partial apply, with no old-hash reuse, no duplicate create, and no replay of uncertain mutations.

Observations

• Replanning from stale hashes can cause duplicate creates.
• Recovery must preserve foreign edits and require fresh approval.

Decision gate

Approve the replan diff rules and the preservation boundary before implementing.

Acceptance criteria

• Replan computes only the remaining desired drift.
• No old hash is reused; no duplicate create occurs.
• Uncertain mutations are not replayed.
• Foreign edits are preserved and a new approval is required.

Verification

• Injected GH timeout, permission, local-file, and project-view failures after a partial -> replan covers only remaining drift.
• Foreign-edit fixture -> an external change survives recovery.

Release checkpoint

Remaining risk: recovery correctness depends on prior classification accuracy. No auto-cleanup deletes, rollback, or governance weakening.

Tracking

Roadmap item: B05-03. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Add an owner-restricted audit ledger with no secret or environment data #26 (B05-02).