certify: TASKPLAN #844/#850/#851 bounded-repair contract + Safe Start pin

Certification of foreign (uncommitted) work found in the OneDrive working copy,
per the ecosystem rule that foreign changes are reviewed and committed
separately rather than left lying around or silently folded into own work.

Reviewed and found sound:
- tests.yml now pins safe-start-for-codex to the same immutable commit
  (dcb369a) that pyproject.toml already used, replacing a floating @main.
  CI and release build are reproducible against one revision.
- repair_workflow.py: module docstring only. The old text promised the engine
  runs "alle Stufen automatisch, auch die aggressiven (reset_package,
  remove_staged_version, reinstall_package)" - that was STALE: the in-function
  contract at the S1-S3 entrypoint already states S4/S6 are never started
  automatically. The change makes the module docstring match actual behaviour,
  i.e. it removes a false promise rather than adding an uncovered one.
- test_taskplan_contracts.py: static guard for the pin, the bounded-repair
  wording and the 0.8.0 metadata. Note it asserts documentation text, not
  runtime behaviour - it prevents doc drift, it does not prove the bound.
- CHANGELOG entry matches the above.

Verified: full suite 326 passed in this working copy; no overlap with the
maintenance.py / build_exe.bat changes on origin/main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lukisch

.github/workflows/tests.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Install package
         run: |
           python -m pip install --upgrade pip
-          python -m pip install "git+https://github.com/dev-bricks/safe-start-for-codex.git@main"
+          python -m pip install "safe-start-for-codex @ git+https://github.com/dev-bricks/safe-start-for-codex.git@dcb369a64f403f6551bcb3bac16565c56ec79474"
           python -m pip install -e ".[dev]"
 
       - name: Compile sources

CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+- TASKPLAN #844/#850/#851: Status- und Bounded-Reparaturvertrag aktualisiert;
+  Safe Start ist in CI und Release-Build auf denselben Commit gepinnt.
+
 - Updated Last-checked timestamp in `llms.txt` to 2026-07-22 and verified full test suite (323/323 passed).
 - Added an opt-in `store-materials --live-pages` gate that checks the configured
   privacy and support URLs over HTTPS. GitHub Pages is now enabled for the

src/codex_logdatenbank_wartung/repair_workflow.py

@@ -1,16 +1,11 @@
-"""Voll ausschoepfende, aber hang-sichere Codex-Start-Reparatur-Engine.
-
-Bewusst getrennt von der konservativen DB-Wartung (`maintenance.py`/`orchestrator.py`)
-und der gezielten Startblockaden-Reparatur (`health.py`). Dieses Modul adressiert den
-Fall "Codex (Store/Electron) startet nicht" als **automatische Eskalation durch alle
-Stufen**, bis ein Renderer-Fenster erscheint.
-
-Philosophie (siehe CODEX-AUTO-DEBUG-DESIGN.md, justiert 2026-05-29):
-Die Gefahr ist NICHT das Reparieren an sich, sondern das **Haengen/Stapeln** von
-AppX-Deployment-Operationen. Wird die Reparatur ausgeloest, wird sie **voll
-ausgeschoepft** -- alle Stufen automatisch, auch die aggressiven (reset_package,
-remove_staged_version, reinstall_package). Diese stehen aber bewusst SPAET in der
-Reihenfolge (billig+sicher zuerst) und laufen timeboxed.
+"""Bounded, hang-safe Codex start-repair engine.
+
+This is deliberately separate from conservative DB maintenance and targeted
+``health.py`` start-blocker repair. The binding automatic contract is **S1, S2,
+S3, then at most one ``reset_package`` fallback**. S4 removal and S6 reinstall
+are never started automatically; they require a separate, reviewed operator
+decision. The engine aborts on a deployment timeout, missing admin rights, or a
+confirmed absent package and never promises live AppX/PUI observation.
 
 EINZIGE HARTE REGEL: HAENGEN VERMEIDEN.
 * Jede Deploy-Op (complete_staged_update, remove_staged_version, reset_package,

tests/test_taskplan_contracts.py

@@ -0,0 +1,31 @@
+"""Static contracts for TASKPLAN status, Safe Start pinning and bounded repair."""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_ci_and_build_extra_use_the_same_immutable_safe_start_revision():
+    pyproject = (ROOT / "pyproject.toml").read_text(encoding="utf-8")
+    workflow = (ROOT / ".github" / "workflows" / "tests.yml").read_text(encoding="utf-8")
+    pin = "dcb369a64f403f6551bcb3bac16565c56ec79474"
+
+    assert pin in pyproject
+    assert pin in workflow
+    assert "@main" not in workflow
+
+
+def test_repair_entrypoint_states_the_bounded_automatic_contract():
+    source = (ROOT / "src" / "codex_logdatenbank_wartung" / "repair_workflow.py").read_text(encoding="utf-8")
+
+    assert "S1, S2,\nS3" in source
+    assert "S4 removal and S6 reinstall\nare never started automatically" in source
+
+
+def test_current_metadata_marks_old_handoff_as_historical_via_current_state():
+    state = (ROOT / "STATE.md").read_text(encoding="utf-8")
+    claude = (ROOT / "CLAUDE.md").read_text(encoding="utf-8")
+
+    assert "Stand: 2026-07-22 · Version 0.8.0" in state
+    assert "version: 0.8.0" in claude