Bind execution to the reviewed preview

Context

Changing a task without changing its count must still invalidate approval.

Decision

Open-plan reads, edits and validation refresh the stored preview and material hash; submission and execution compare a new preview against that stored approval boundary.

Alternatives Considered

Approve only related-record counts. Replacing a related record would leave the count unchanged and evade review.

Require only a client-supplied hash. Omitting that hash must not permit an unseen plan to execute.

Consequences

A qualified colleague’s read can update the stored approval boundary. Labels, estimates and carried dismissals do not invalidate approval on their own.