fix: stop C-23 promoting proposed and C-15 overwriting files

ADR-007 / RMGR-WP-0005-T06: proposed stays a human gate. Task status
follows the file (ADR-001); wait is not "ahead" of progress or todo.

tests/test_consistency_check.py

@@ -993,10 +993,10 @@ class TestLifecycleRenormalization:
         assert "C-23" in check_ids
         assert "C-04" not in check_ids
         issue = next(issue for issue in report.issues if issue.check_id == "C-23")
-        assert issue.fixable is True
+        assert issue.fixable is False
         assert issue.file_value == "proposed"
 
-    def test_fix_repo_repairs_planning_workplan_with_active_task(self, tmp_path, monkeypatch):
+    def test_fix_repo_does_not_promote_proposed(self, tmp_path, monkeypatch):
         repo = self._make_repo(tmp_path)
         wp = repo / "workplans" / "STATE-WP-0001-demo.md"
         patches = []
@@ -1015,6 +1015,29 @@ class TestLifecycleRenormalization:
 
         report = fix_repo("http://unused", "state-hub")
 
+        assert ("/workplans/ws-1", {"status": "active"}) not in patches
+        assert "status: proposed" in wp.read_text(encoding="utf-8")
+        assert not any("C-23 fixed" in fix for fix in report.fixes_applied)
+
+    def test_fix_repo_repairs_planning_workplan_with_active_task(self, tmp_path, monkeypatch):
+        repo = self._make_repo(tmp_path, status="ready")
+        wp = repo / "workplans" / "STATE-WP-0001-demo.md"
+        patches = []
+
+        def fake_patch(_api_base, path, body):
+            patches.append((path, body))
+            return {"ok": True}
+
+        monkeypatch.setattr("consistency_check._api_get", self._api_get_for_repo(repo))
+        monkeypatch.setattr("consistency_check._api_patch", fake_patch)
+        monkeypatch.setattr("consistency_check._detect_behind_remote", lambda _repo_path: False)
+        monkeypatch.setattr("consistency_check._detect_ahead_of_remote", lambda _repo_path: 0)
+        monkeypatch.setattr("consistency_check._git_commit_writeback", lambda *args, **kwargs: True)
+        monkeypatch.setattr("consistency_check._write_custodian_brief", lambda *args, **kwargs: False)
+        monkeypatch.setattr("consistency_check._git_push", lambda _repo_path: (True, "pushed"))
+
+        report = fix_repo("http://unused", "state-hub")
+
         assert ("/workplans/ws-1", {"status": "active"}) in patches
         assert "status: active" in wp.read_text(encoding="utf-8")
         assert any("C-23 fixed" in fix for fix in report.fixes_applied)