hold

Stop-and-recover gate that triggers ONLY on failures not anticipated in preflight's residual risk list. When triggered, stops all agent action, classifies the failure (new class, materialised risk, or invalidated plan), produces a structured report with evidence, offers exactly three options (fix...