enforce lifecycle contracts and scratch transport

internal/continuity/continuity_test.go

@@ -55,6 +55,31 @@ func TestDecodeRejectsUnknownKnowledgeFields(t *testing.T) {
 	}
 }
 
+func TestScratchCommitProtectsTask(t *testing.T) {
+	root := t.TempDir()
+	run := func(a ...string) {
+		c := exec.Command("git", append([]string{"-C", root}, a...)...)
+		c.Env = append(os.Environ(), "GIT_AUTHOR_NAME=test", "GIT_AUTHOR_EMAIL=test@example", "GIT_COMMITTER_NAME=test", "GIT_COMMITTER_EMAIL=test@example")
+		if b, e := c.CombinedOutput(); e != nil {
+			t.Fatalf("git: %s %v", b, e)
+		}
+	}
+	os.WriteFile(filepath.Join(root, "TASK.md"), []byte("fixed"), 0644)
+	run("init")
+	run("add", ".")
+	run("commit", "-m", "init")
+	os.WriteFile(filepath.Join(root, "wip.txt"), []byte("wip"), 0644)
+	if err := ScratchCommit(root, "scratch/task", "wip"); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "TASK.md"), []byte("changed"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := ScratchCommit(root, "scratch/other", "bad"); err == nil {
+		t.Fatal("expected immutable TASK.md rejection")
+	}
+}
+
 func TestVerifyTaskFileRejectsMutation(t *testing.T) {
 	root := t.TempDir()
 	if err := os.WriteFile(filepath.Join(root, "TASK.md"), []byte("task"), 0644); err != nil {