- add one inline deterministic MCP task and sealed planning assets - reseal S2_00/S2_10 release hashes for the S2_20 handoff - keep live and legal admission explicitly pending