1 files changed, 24 insertions, 2 deletions

diff --git a/internal/store/native_tasks.go b/internal/store/native_tasks.go
index 6f8ba7a..11a9197 100644
--- a/internal/store/native_tasks.go
+++ b/internal/store/native_tasks.go
@@ -161,15 +161,27 @@ func (s *Store) UpdateNativeTaskDescription(id, description string) error {
 	return err
 }
 
+// ErrChainTaskLocked is returned by CompleteNativeTask when the task
+// belongs to a chain but isn't the currently-unlocked position -- without
+// this guard, completing a locked task directly by id (bypassing the UI,
+// which never renders a checkbox for locked chain tasks) would still run
+// advanceChain against the wrong position, breaking the chain's WIP-1
+// invariant.
+var ErrChainTaskLocked = errors.New("task is locked in its chain")
+
 // CompleteNativeTask marks a task as completed. If it's the latest
 // occurrence of a recurring series (no newer row exists yet), it also
 // creates the next iteration. Returns ErrNativeTaskNotFound if id doesn't
-// match any row.
+// match any row, or ErrChainTaskLocked if it's a locked (not yet
+// actionable) chain task.
 func (s *Store) CompleteNativeTask(id string) error {
 	task, err := s.GetNativeTaskByID(id)
 	if err != nil {
 		return err
 	}
+	if task.ChainID != "" && !task.ChainUnlocked {
+		return ErrChainTaskLocked
+	}
 
 	result, err := s.db.Exec(`
 		UPDATE native_tasks SET completed = 1, updated_at = CURRENT_TIMESTAMP WHERE id = ?
@@ -182,9 +194,19 @@ func (s *Store) CompleteNativeTask(id string) error {
 	}
 
 	if task.ChainID != "" {
-		if err := s.advanceChain(task.ChainID, task.ChainPosition); err != nil {
+		chain, err := s.GetChain(task.ChainID)
+		if err != nil {
 			return err
 		}
+		// A paused chain does not auto-advance -- completing its unlocked
+		// task is still allowed (it's the one actionable step), but the
+		// successor stays locked until the chain is explicitly resumed
+		// (see SetChainStatus's resume catch-up).
+		if chain.Status != "paused" {
+			if err := s.advanceChain(task.ChainID, task.ChainPosition); err != nil {
+				return err
+			}
+		}
 	}
 
 	if task.BucketID != "" {