// Owner-only reconcile of a wedged task: fork credentials revoked and fork head recorded before its claim is released.
CONTRACT ForgeTaskReconcile {
  ENFORCEMENT_MODE: enforced
  CONTEXT {
    ENTITIES TaskReconcileRequest {
      operation: string
      repository_matches_main: bool
      requester_is_owner: bool
      task_exists: bool
      task_held: bool
      inflight_guard_set: bool
      fork_tokens_revoked: bool
      fork_head_recorded: bool
      idle_seconds: int
      idle_threshold_seconds: int
      effect_hash: string
    }
    CONSTANTS {
      min_idle_threshold_seconds: int == 300 [SOURCE:FORGE-RECONCILE-V1]
    }
  }
  TRIGGER { reconcile_task() }
  PROHIBITION {
    FORBID reconcile_task WHEN TaskReconcileRequest.operation != "reconcile" [SOURCE:reconcile_operation]
    FORBID reconcile_task WHEN TaskReconcileRequest.repository_matches_main == false [SOURCE:reconcile_repository]
    FORBID reconcile_task WHEN TaskReconcileRequest.requester_is_owner == false [SOURCE:reconcile_owner]
    FORBID reconcile_task WHEN TaskReconcileRequest.task_exists == false [SOURCE:reconcile_task_exists]
    FORBID reconcile_task WHEN TaskReconcileRequest.task_held == false [SOURCE:reconcile_task_held]
    FORBID reconcile_task WHEN TaskReconcileRequest.idle_seconds < TaskReconcileRequest.idle_threshold_seconds [SOURCE:reconcile_idle]
    FORBID reconcile_task WHEN TaskReconcileRequest.idle_threshold_seconds < min_idle_threshold_seconds [SOURCE:reconcile_idle_floor]
    FORBID reconcile_task WHEN TaskReconcileRequest.fork_tokens_revoked == false [SOURCE:reconcile_fork_tokens]
    FORBID reconcile_task WHEN TaskReconcileRequest.fork_head_recorded == false [SOURCE:reconcile_fork_head]
  }
  OBSERVABILITY { LOG "ForgeTaskReconcile evaluated" ON decision }
}