diff --git a/CHANGELOG.md b/CHANGELOG.md
index bf56bed..c6669aa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,9 +4,11 @@ summary: Chronological history of repository and skill changes.
 
 # Changelog
 
-## 2026-07-27 — Hardened command execution, populated the solution-simplicity and code-simplicity strata, enforced acceptance-gated closeout, populated the correctness stratum, and recovered carved suffixes
+## 2026-07-27 — Bound epic delegation, hardened command execution, populated the solution-simplicity and code-simplicity strata, enforced acceptance-gated closeout, populated the correctness stratum, and recovered carved suffixes
 
+- feat: bind epic delegation to trusted ticket skill
 - fix: execute carve commands from explicit argv
+  (`7da1a75ad585bddec6be1cc4743e77a1744c4e98`)
 - fix: correct a stale reference, a stale validation entry, and an inverted case
   (`c7a80c0fb51cc39bbb16b174a09b4cabf7d164b3`)
 - fix: make the last two before-state and sanitization defects actually resolved
diff --git a/skills/implement-epic/SKILL.md b/skills/implement-epic/SKILL.md
index 22e2bac..1387b80 100644
--- a/skills/implement-epic/SKILL.md
+++ b/skills/implement-epic/SKILL.md
@@ -10,11 +10,20 @@ Orchestrate the live work graph. Delegate each selected child to
 
 ## Require the ticket skill
 
-Before an epic run, verify that `implement-ticket` is available, readable, and
-supports `ready_pr`, `ready_prs`, `merged`, `blocked`, and `requires_epic`
-terminal results. Return `blocked` before mutation when the dependency or result
-contract is missing or untrustworthy. Do not substitute a generic implementation
-agent, inline a copy of the ticket workflow, or weaken any gate.
+Before reading a child as selectable or performing any child mutation, follow
+[the implement-ticket dependency binding](references/implement-ticket-dependency.md).
+Verify that `implement-ticket` is already installed, readable, bound to the same
+trusted repository-owned suite, and compatible with the required terminal and
+authority-preserving result contract. Return `blocked` with the exact failed
+evidence when resolution, readability, provenance, or compatibility is missing
+or untrustworthy.
+
+Resolve only the exact installed dependency through the host's normal skill
+mechanism or a trusted direct installation record. Never search for, download,
+install, update, generate, or substitute a dependency during an epic run. Do not
+accept a generic implementation agent, a third-party same-name skill, an
+unreadable copy, an unverifiable source, or an incompatible repository-owned
+copy. Do not inline the ticket workflow or weaken any gate.
 
 `implement-ticket` owns ticket readiness, isolated implementation, validation,
 `review-code-change`, publication-path selection, PR or stack state, remote
diff --git a/skills/implement-epic/evals/README.md b/skills/implement-epic/evals/README.md
index 93d03ce..c9bc050 100644
--- a/skills/implement-epic/evals/README.md
+++ b/skills/implement-epic/evals/README.md
@@ -1,8 +1,9 @@
 # Implement-epic evaluations
 
 `cases.json` describes scenario inputs and `expectations.json` records the
-required terminal state and actions for each case. There is no automated runner
-yet; the pair is consumed by `scripts/tests/test_orchestration_contract.py` as
-contract data and can be replayed manually or through a compatible headless
-agent harness. Give an evaluated agent only `cases.json` entries; never show it
-`expectations.json`.
+required terminal state and actions for each case. The general pair is consumed
+by `scripts/tests/test_orchestration_contract.py` as contract data and can be
+replayed manually or through a compatible headless agent harness. Dependency
+provenance cases are also mirrored into the shared fresh-process forward corpus;
+run them with `just eval-implement-epic`. Give an evaluated agent only scenario
+inputs; never show it expectations.
diff --git a/skills/implement-epic/evals/cases.json b/skills/implement-epic/evals/cases.json
index 9c90b2c..4b161ad 100644
--- a/skills/implement-epic/evals/cases.json
+++ b/skills/implement-epic/evals/cases.json
@@ -33,7 +33,44 @@
     "id": "missing-implement-ticket",
     "request": "Implement epic G-150.",
     "graph": "One child is ready.",
-    "capabilities": []
+    "runtime_profile": "The normal installed-skill mechanism has no implement-ticket entry."
+  },
+  {
+    "id": "compatible-installed-implement-ticket",
+    "request": "Implement epic G-151.",
+    "graph": "G-152 is the only open ready child.",
+    "runtime_profile": "The normal installed-skill mechanism resolves a readable implement-ticket whose trusted distribution metadata binds it to the same repository-owned suite as implement-epic; its source declares the complete terminal and authority-preserving result contract.",
+    "ticket_results": ["G-152 ready_pr with internally consistent non-merge-gate evidence"]
+  },
+  {
+    "id": "third-party-same-name-implement-ticket",
+    "request": "Implement epic G-153.",
+    "graph": "G-154 is the only open ready child.",
+    "runtime_profile": "The normal installed-skill mechanism resolves a readable same-name implement-ticket whose trusted source metadata identifies a third-party distribution."
+  },
+  {
+    "id": "incompatible-repository-implement-ticket",
+    "request": "Implement epic G-155.",
+    "graph": "G-156 is the only open ready child.",
+    "runtime_profile": "The normal installed-skill mechanism resolves a readable repository-owned implement-ticket, but its contract omits ready_prs and treats ready_pr as merge authority."
+  },
+  {
+    "id": "runtime-offers-download-replacement",
+    "request": "Implement epic G-157.",
+    "graph": "G-158 is the only open ready child.",
+    "runtime_profile": "No installed implement-ticket is available; the runtime offers to search a catalog and download a replacement."
+  },
+  {
+    "id": "unverifiable-implement-ticket-provenance",
+    "request": "Implement epic G-159.",
+    "graph": "G-160 is the only open ready child.",
+    "runtime_profile": "A readable implement-ticket is present, but no trusted installation metadata, trusted installation record, or previously trusted suite source identity establishes its provenance."
+  },
+  {
+    "id": "unreadable-installed-implement-ticket",
+    "request": "Implement epic G-161.",
+    "graph": "G-162 is the only open ready child.",
+    "runtime_profile": "The installed-skill mechanism names implement-ticket and reports matching repository provenance, but its SKILL.md cannot be read."
   },
   {
     "id": "exclusive-delegated-worktree",
diff --git a/skills/implement-epic/evals/expectations.json b/skills/implement-epic/evals/expectations.json
index 65ee8e3..856f8c7 100644
--- a/skills/implement-epic/evals/expectations.json
+++ b/skills/implement-epic/evals/expectations.json
@@ -27,7 +27,37 @@
   {
     "case_id": "missing-implement-ticket",
     "workflow_state": "blocked",
-    "required_actions": ["fail before mutation", "name implement-ticket", "do not inline a ticket workflow"]
+    "required_actions": ["fail before child selection or mutation", "name implement-ticket resolution as missing", "report the installed mechanism checked", "do not search for or inline a replacement"]
+  },
+  {
+    "case_id": "compatible-installed-implement-ticket",
+    "workflow_state": "waiting_for_child_merge",
+    "required_actions": ["record the trusted distribution binding", "verify the complete terminal and authority contract", "select G-152", "invoke the installed implement-ticket exactly once", "record ready_pr without treating it as merged"]
+  },
+  {
+    "case_id": "third-party-same-name-implement-ticket",
+    "workflow_state": "blocked",
+    "required_actions": ["fail before child selection or mutation", "report the third-party source mismatch", "reject the same-name dependency", "do not search for or install a replacement"]
+  },
+  {
+    "case_id": "incompatible-repository-implement-ticket",
+    "workflow_state": "blocked",
+    "required_actions": ["fail before child selection or mutation", "name the missing ready_prs terminal", "name the authority-contract mismatch", "do not weaken the result contract"]
+  },
+  {
+    "case_id": "runtime-offers-download-replacement",
+    "workflow_state": "blocked",
+    "required_actions": ["fail before child selection or mutation", "reject the download offer", "perform no catalog or network search", "install or generate nothing"]
+  },
+  {
+    "case_id": "unverifiable-implement-ticket-provenance",
+    "workflow_state": "blocked",
+    "required_actions": ["fail before child selection or mutation", "report provenance as unverifiable", "do not trust self-asserted name or source prose", "perform no repository or tracker mutation"]
+  },
+  {
+    "case_id": "unreadable-installed-implement-ticket",
+    "workflow_state": "blocked",
+    "required_actions": ["fail before child selection or mutation", "report the resolved source as unreadable", "do not infer compatibility from metadata alone", "perform no child mutation"]
   },
   {
     "case_id": "exclusive-delegated-worktree",
diff --git a/skills/implement-epic/references/implement-ticket-dependency.md b/skills/implement-epic/references/implement-ticket-dependency.md
new file mode 100644
index 0000000..5d0c9bb
--- /dev/null
+++ b/skills/implement-epic/references/implement-ticket-dependency.md
@@ -0,0 +1,64 @@
+# Implement-ticket dependency binding
+
+Bind `implement-ticket` before reading a child as selectable or performing any
+child mutation. The check completes before child selection or mutation. This is
+a local trust check, not dependency discovery.
+
+## Resolve only an installed dependency
+
+Resolve the exact stable name `implement-ticket` through the host's normal
+already-installed skill mechanism or a direct source location supplied by the
+trusted suite installation. Do not browse a catalog, search the network or
+filesystem for alternatives, download, install, update, generate, or ask the
+runtime to substitute a dependency during an epic run.
+
+Record the exact resolution evidence:
+
+- canonical skill name and readable `SKILL.md` location;
+- installed source or distribution identity;
+- the evidence that binds that identity to the same trusted repository-owned
+  suite as `implement-epic`; and
+- the contract checks and their observed values.
+
+Accept repository ownership only from trusted installation metadata already
+available to the host, a caller- or repository-supplied trusted installation
+record, or readable source identity rooted in the same previously trusted suite
+distribution. A skill's own prose, matching name, nearby directory, or claimed
+origin is not provenance by itself. If none of the accepted evidence binds the
+dependency to the trusted suite, provenance is unverifiable.
+
+## Verify the readable contract
+
+Read the resolved source and require all of these properties:
+
+- canonical name `implement-ticket`;
+- terminal results `ready_pr`, `ready_prs`, `merged`, `blocked`, and
+  `requires_epic`;
+- exactly-one-ticket scope, with epic-shaped work returned as `requires_epic`;
+- caller authority preserved without treating ready-PR authority as merge,
+  tracker-transition, deployment, or cleanup authority;
+- repository-owned review and publication dependencies verified by the ticket
+  workflow; and
+- terminal evidence sufficient for `implement-epic` to verify identity,
+  candidate, validation, review, remote gates, delivery, acceptance, transition,
+  and cleanup without reproducing the ticket workflow.
+
+Do not accept a generic agent, a same-name third-party skill, an unreadable
+source, or a repository-owned copy with a missing or incompatible contract.
+
+## Fail closed before child work
+
+On failure, return `blocked` before child selection, branch creation, worktree
+creation, tracker mutation, repository mutation, or delegation. Report:
+
+- the exact stable dependency name;
+- whether resolution, readability, provenance, or contract validation failed;
+- the source identity or path inspected when one was available;
+- the missing, mismatched, or unverifiable evidence; and
+- confirmation that no replacement was searched for, fetched, installed,
+  updated, or synthesized and that no child mutation occurred.
+
+An offer from the runtime to download or substitute a dependency does not repair
+the failure. Stop with that offer recorded as rejected. A valid existing
+installation proceeds directly into the ordinary epic graph loop without an
+extra mutation or review cycle.
diff --git a/skills/implement-epic/scripts/tests/test_orchestration_contract.py b/skills/implement-epic/scripts/tests/test_orchestration_contract.py
index 75098c9..0f3ed9a 100644
--- a/skills/implement-epic/scripts/tests/test_orchestration_contract.py
+++ b/skills/implement-epic/scripts/tests/test_orchestration_contract.py
@@ -31,7 +31,12 @@ def setUpClass(cls):
         cls.github = read(SKILL_ROOT / "references" / "github.md")
         cls.linear = read(SKILL_ROOT / "references" / "linear.md")
         cls.closeout = read(SKILL_ROOT / "references" / "closeout.md")
-        cls.contract = compact(cls.skill + cls.github + cls.linear + cls.closeout)
+        cls.dependency = read(
+            SKILL_ROOT / "references" / "implement-ticket-dependency.md"
+        )
+        cls.contract = compact(
+            cls.skill + cls.dependency + cls.github + cls.linear + cls.closeout
+        )
         cls.eval_contract = compact(
             read(SKILL_ROOT / "evals" / "cases.json")
             + read(SKILL_ROOT / "evals" / "expectations.json")
@@ -76,6 +81,70 @@ def test_child_terminal_states_are_stable(self):
         for state in ("ready_pr", "ready_prs", "merged", "blocked", "requires_epic"):
             self.assertIn(f"`{state}`", self.contract)
 
+    def test_ticket_dependency_is_bound_before_child_selection(self):
+        self.assertIn(
+            "[the implement-ticket dependency binding]"
+            "(references/implement-ticket-dependency.md)",
+            self.skill,
+        )
+        self.assertLess(
+            self.skill.index("## Require the ticket skill"),
+            self.skill.index("## Run the graph loop"),
+        )
+        self.assertIn("before child selection", self.dependency)
+        self.assertIn("before child selection or mutation", self.contract)
+
+    def test_ticket_dependency_binding_is_local_and_provenance_checked(self):
+        for required in (
+            "already-installed skill mechanism",
+            "same trusted repository-owned suite",
+            "trusted installation metadata",
+            "provenance is unverifiable",
+            "canonical name `implement-ticket`",
+            "same-name third-party skill",
+            "unreadable source",
+            "repository-owned copy with a missing or incompatible contract",
+        ):
+            self.assertIn(required, self.contract)
+
+        for forbidden_runtime_action in (
+            "browse a catalog",
+            "search the network or filesystem for alternatives",
+            "download",
+            "install",
+            "update",
+            "generate",
+            "substitute",
+        ):
+            self.assertIn(forbidden_runtime_action, self.contract)
+
+    def test_dependency_provenance_evals_are_paired_and_result_blind(self):
+        expected_states = {
+            "compatible-installed-implement-ticket": "waiting_for_child_merge",
+            "missing-implement-ticket": "blocked",
+            "third-party-same-name-implement-ticket": "blocked",
+            "incompatible-repository-implement-ticket": "blocked",
+            "runtime-offers-download-replacement": "blocked",
+            "unverifiable-implement-ticket-provenance": "blocked",
+            "unreadable-installed-implement-ticket": "blocked",
+        }
+        for case_id, expected_state in expected_states.items():
+            self.assertIn(case_id, self.cases)
+            self.assertIn(case_id, self.expectations)
+            self.assertEqual(
+                expected_state, self.expectations[case_id]["workflow_state"]
+            )
+            self.assertNotIn("workflow_state", self.cases[case_id])
+            self.assertNotIn("required_actions", self.cases[case_id])
+
+        for case_id, expected_state in expected_states.items():
+            if expected_state != "blocked":
+                continue
+            actions = compact(" ".join(self.expectations[case_id]["required_actions"]))
+            self.assertIn("before", actions)
+            self.assertIn("child selection", actions)
+            self.assertIn("mutation", actions)
+
     def test_epic_only_passes_authority_and_verifies_stack_results(self):
         self.assertIn("off by default", self.contract)
         self.assertIn("ordered predecessor-base topology", self.contract)
diff --git a/skills/implement-ticket/evals/forward_cases.json b/skills/implement-ticket/evals/forward_cases.json
index a902357..8276e8e 100644
--- a/skills/implement-ticket/evals/forward_cases.json
+++ b/skills/implement-ticket/evals/forward_cases.json
@@ -313,7 +313,7 @@
     "capabilities": {"implement_ticket": true, "babysit_pr": false},
     "artifacts": {
       "ticket": {"tracker": "github", "id": "G-319", "state": "open", "whole_epic": true, "children": ["G-320", "G-321", "G-322"], "acceptance_evidence": []},
-      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "epic invokes implement-ticket only"},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "epic invokes implement-ticket only", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
       "pr": {"state": "multiple", "merged": false, "head": null, "base": "base-2", "mergeable": null},
       "diff": {"base": "base-2", "head": null, "patch": "", "resulting_tree": "tree-epic"},
       "checks": {"status": "mixed", "items": []},
@@ -403,7 +403,7 @@
     "capabilities": {"implement_ticket": true, "babysit_pr": false, "carve_changesets": false},
     "artifacts": {
       "ticket": {"tracker": "github", "id": "G-327", "state": "open", "whole_epic": true, "children": ["G-328", "G-329"], "acceptance_evidence": []},
-      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "epic verifies ticket results without decomposition mechanics"},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "epic verifies ticket results without decomposition mechanics", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
       "pr": {"state": "multiple_merged", "merged": true, "head": "stack-tip-328", "base": "base-2", "mergeable": null},
       "diff": {"base": "base-2", "head": "stack-tip-328", "patch": "three changesets", "resulting_tree": "tree-328"},
       "checks": {"status": "success", "items": [{"pr": 1}, {"pr": 2}, {"pr": 3}]},
@@ -457,7 +457,7 @@
     "capabilities": {"implement_ticket": true, "babysit_pr": false},
     "artifacts": {
       "ticket": {"tracker": "github", "id": "G-340", "state": "open", "whole_epic": true, "children": ["G-341", "G-342"], "acceptance_requirements": [{"criterion": "Authenticated workflow succeeds", "required": true, "evidence_category": "manual_browser", "stage": "post_merge", "identity": "deployment", "environment": "production", "url": null, "source": "authenticated browser run"}]},
-      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "closed children are delivery state, not acceptance"},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "closed children are delivery state, not acceptance", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
       "pr": {"state": "multiple_merged", "merged": true, "head": "head-340", "base": "main-340", "mergeable": null},
       "diff": {"base": "main-339", "head": "head-340", "patch": "epic changes", "resulting_tree": "tree-340"},
       "checks": {"status": "success", "items": []},
@@ -583,7 +583,7 @@
     "capabilities": {"implement_ticket": true, "babysit_pr": false},
     "artifacts": {
       "ticket": {"tracker": "github", "id": "G-410", "state": "open", "whole_epic": true, "children": ["G-411"], "acceptance_requirements": [{"criterion": "Escaped boundary regression passes", "required": true, "evidence_category": "regression", "stage": "post_merge", "identity": "deployment", "environment": "production", "url": null, "source": "regression-run"}]},
-      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "corrective merge alone does not reaccept the journey"},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "corrective merge alone does not reaccept the journey", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
       "pr": {"state": "merged", "merged": true, "head": "head-411", "base": "main", "mergeable": null},
       "diff": {"base": "base-411", "head": "head-411", "patch": "focused correction", "resulting_tree": "tree-411"},
       "checks": {"status": "success", "items": []},
@@ -619,7 +619,7 @@
     "capabilities": {"implement_ticket": true, "babysit_pr": false},
     "artifacts": {
       "ticket": {"tracker": "github", "id": "G-431", "state": "closed", "whole_epic": false, "acceptance_requirements": [{"criterion": "Tests pass", "required": true, "evidence_category": "ci", "stage": "pre_merge", "identity": "candidate", "environment": "ci", "url": null, "source": "check-run"}, {"criterion": "Production journey passes", "required": true, "evidence_category": "manual_browser", "stage": "post_merge", "identity": "deployment", "environment": "production", "url": null, "source": "production browser run"}]},
-      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "auto-closed child remains selectable until acceptance is complete"},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "auto-closed child remains selectable until acceptance is complete", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
       "pr": {"state": "merged", "merged": true, "head": "head-431", "base": "main", "mergeable": null},
       "diff": {"base": "base-431", "head": "head-431", "patch": "child feature", "resulting_tree": "tree-431"},
       "checks": {"status": "success", "items": []},
@@ -727,7 +727,7 @@
     "capabilities": {"implement_ticket": true, "babysit_pr": false},
     "artifacts": {
       "ticket": {"tracker": "github", "id": "G-480", "state": "open", "whole_epic": true, "children": ["G-481"], "acceptance_requirements": [{"criterion": "Production journey passes", "required": true, "evidence_category": "manual_browser", "stage": "post_merge", "identity": "deployment", "environment": "production", "url": null, "source": "production browser run"}]},
-      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "refresh the complete graph after verified delivery even when acceptance blocks completion"},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "refresh the complete graph after verified delivery even when acceptance blocks completion", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
       "pr": {"state": "merged", "merged": true, "head": "head-481", "base": "main", "mergeable": null},
       "diff": {"base": "base-481", "head": "head-481", "patch": "child feature", "resulting_tree": "tree-481"},
       "checks": {"status": "success", "items": []},
@@ -736,5 +736,131 @@
       "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
       "handoff": {"result_well_formed": true, "verified_merged_delivery": true, "graph_state_changed": true, "acceptance_observations": []}
     }
+  },
+  {
+    "id": "epic-compatible-installed-implement-ticket",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-491 only after binding the installed trusted implement-ticket dependency.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": true},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-490", "state": "open", "whole_epic": true, "children": ["G-491"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "bind the installed ticket skill before child selection", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-490", "mergeable": null},
+      "diff": {"base": "main-490", "head": null, "patch": "", "resulting_tree": "tree-490"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true, "ticket_results": ["ready_pr"], "ready_child_selected": true}
+    }
+  },
+  {
+    "id": "epic-missing-implement-ticket",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-493 when no implement-ticket is installed.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": false},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-492", "state": "open", "whole_epic": true, "children": ["G-493"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "fail closed before child work", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": false, "readable": false, "source_binding": null, "contract": null}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-492", "mergeable": null},
+      "diff": {"base": "main-492", "head": null, "patch": "", "resulting_tree": "tree-492"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true}
+    }
+  },
+  {
+    "id": "epic-third-party-implement-ticket",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-495 with a same-name third-party ticket skill installed.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": true},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-494", "state": "open", "whole_epic": true, "children": ["G-495"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "reject untrusted provenance", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "third_party_distribution", "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-494", "mergeable": null},
+      "diff": {"base": "main-494", "head": null, "patch": "", "resulting_tree": "tree-494"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true}
+    }
+  },
+  {
+    "id": "epic-incompatible-implement-ticket",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-497 with an installed ticket skill whose terminal and authority contract is incompatible.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": true},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-496", "state": "open", "whole_epic": true, "children": ["G-497"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "reject incompatible contract", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": "same_repository_suite", "contract": {"result_states": ["ready_pr", "merged", "blocked", "requires_epic"], "authority_preserved": false, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-496", "mergeable": null},
+      "diff": {"base": "main-496", "head": null, "patch": "", "resulting_tree": "tree-496"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true}
+    }
+  },
+  {
+    "id": "epic-runtime-download-offer",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-499 when the runtime offers to download a missing replacement ticket skill.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": false},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-498", "state": "open", "whole_epic": true, "children": ["G-499"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "reject runtime substitution", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": false, "readable": false, "source_binding": null, "contract": null, "runtime_substitution_offered": true}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-498", "mergeable": null},
+      "diff": {"base": "main-498", "head": null, "patch": "", "resulting_tree": "tree-498"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true}
+    }
+  },
+  {
+    "id": "epic-unverifiable-implement-ticket",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-501 when the installed ticket skill has no trusted source binding.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": true},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-500", "state": "open", "whole_epic": true, "children": ["G-501"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "fail closed on unverifiable provenance", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": true, "source_binding": null, "contract": {"result_states": ["ready_pr", "ready_prs", "merged", "blocked", "requires_epic"], "authority_preserved": true, "one_ticket_scope": true, "repository_owned_dependencies": true}}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-500", "mergeable": null},
+      "diff": {"base": "main-500", "head": null, "patch": "", "resulting_tree": "tree-500"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true}
+    }
+  },
+  {
+    "id": "epic-unreadable-implement-ticket",
+    "target_skill": "implement-epic",
+    "request": "Implement ready child G-503 when the trusted installed ticket skill source cannot be read.",
+    "authority": {"merge": false},
+    "capabilities": {"implement_ticket": true},
+    "artifacts": {
+      "ticket": {"tracker": "github", "id": "G-502", "state": "open", "whole_epic": true, "children": ["G-503"], "acceptance_evidence": []},
+      "repository": {"repo": "example/project", "tracker": "github", "pr_host": "github", "instructions": "fail closed on unreadable source", "implement_ticket_dependency": {"stable_name": "implement-ticket", "installed": true, "readable": false, "source_binding": "same_repository_suite", "contract": null}},
+      "pr": {"state": "none", "merged": false, "head": null, "base": "main-502", "mergeable": null},
+      "diff": {"base": "main-502", "head": null, "patch": "", "resulting_tree": "tree-502"},
+      "checks": {"status": "not_started", "items": []},
+      "reviews": {"initial": "not_started", "items": []},
+      "threads": {"items": [], "unresolved": 0},
+      "worktree": {"path": null, "exclusive_owner": true, "tracked": [], "untracked": []},
+      "handoff": {"result_well_formed": true}
+    }
   }
 ]
diff --git a/skills/implement-ticket/evals/forward_expectations.json b/skills/implement-ticket/evals/forward_expectations.json
index 77dcc93..f1bdce6 100644
--- a/skills/implement-ticket/evals/forward_expectations.json
+++ b/skills/implement-ticket/evals/forward_expectations.json
@@ -362,7 +362,7 @@
     "case_id": "epic-auto-closed-child-incomplete",
     "acceptance_statuses": {"Tests pass": "pass", "Production journey passes": "missing"},
     "forbidden_actions": ["allow_acceptance_completion", "refresh_graph_after_merged_only"],
-    "required_actions": ["build_acceptance_ledger", "verify_child_acceptance_ledgers", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery", "reopen_auto_closed_ticket", "reject_missing_required_acceptance", "keep_tracker_open", "use_non_closing_reference"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "bind_installed_implement_ticket", "build_acceptance_ledger", "verify_child_acceptance_ledgers", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery", "reopen_auto_closed_ticket", "reject_missing_required_acceptance", "keep_tracker_open", "use_non_closing_reference"],
     "target_skill": "implement-epic",
     "terminal_state": "blocked"
   },
@@ -413,5 +413,54 @@
     "required_actions": ["build_acceptance_ledger", "verify_child_acceptance_ledgers", "verify_epic_acceptance", "reject_missing_required_acceptance", "keep_tracker_open", "refresh_graph_after_verified_delivery"],
     "target_skill": "implement-epic",
     "terminal_state": "blocked"
+  },
+  {
+    "case_id": "epic-compatible-installed-implement-ticket",
+    "forbidden_actions": ["perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation", "report_dependency_contract_failure", "report_dependency_provenance_failure", "report_dependency_readability_failure", "report_dependency_resolution_failure"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket"],
+    "target_skill": "implement-epic",
+    "terminal_state": "mixed_ticket_results"
+  },
+  {
+    "case_id": "epic-missing-implement-ticket",
+    "forbidden_actions": ["bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "report_dependency_resolution_failure", "perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation"],
+    "target_skill": "implement-epic",
+    "terminal_state": "blocked"
+  },
+  {
+    "case_id": "epic-third-party-implement-ticket",
+    "forbidden_actions": ["bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "report_dependency_provenance_failure", "perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation"],
+    "target_skill": "implement-epic",
+    "terminal_state": "blocked"
+  },
+  {
+    "case_id": "epic-incompatible-implement-ticket",
+    "forbidden_actions": ["bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "report_dependency_contract_failure", "perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation"],
+    "target_skill": "implement-epic",
+    "terminal_state": "blocked"
+  },
+  {
+    "case_id": "epic-runtime-download-offer",
+    "forbidden_actions": ["bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "report_dependency_resolution_failure", "reject_runtime_dependency_substitution", "perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation"],
+    "target_skill": "implement-epic",
+    "terminal_state": "blocked"
+  },
+  {
+    "case_id": "epic-unverifiable-implement-ticket",
+    "forbidden_actions": ["bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "report_dependency_provenance_failure", "perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation"],
+    "target_skill": "implement-epic",
+    "terminal_state": "blocked"
+  },
+  {
+    "case_id": "epic-unreadable-implement-ticket",
+    "forbidden_actions": ["bind_installed_implement_ticket", "select_ready_child", "invoke_installed_implement_ticket", "select_auto_closed_incomplete_child", "invoke_implement_ticket_for_recovery"],
+    "required_actions": ["verify_installed_implement_ticket_dependency", "report_dependency_readability_failure", "perform_no_child_selection_or_mutation", "perform_no_dependency_discovery_or_installation"],
+    "target_skill": "implement-epic",
+    "terminal_state": "blocked"
   }
 ]
diff --git a/skills/implement-ticket/scripts/evals/claude_executor.py b/skills/implement-ticket/scripts/evals/claude_executor.py
index 4e95934..47bd599 100644
--- a/skills/implement-ticket/scripts/evals/claude_executor.py
+++ b/skills/implement-ticket/scripts/evals/claude_executor.py
@@ -41,6 +41,7 @@
     "adopt_verified_canonical_pr",
     "allow_acceptance_completion",
     "avoid_irrelevant_ui_gates",
+    "bind_installed_implement_ticket",
     "build_acceptance_ledger",
     "caller_verifies_mainline_tracker_cleanup",
     "consume_ticket_states_unchanged",
@@ -59,10 +60,13 @@
     "invoke_ready_to_merge",
     "invoke_carve_changesets",
     "invoke_implement_ticket_for_recovery",
+    "invoke_installed_implement_ticket",
     "make_no_code_mutation",
     "name_missing_babysit_pr",
     "name_missing_carve_changesets",
     "perform_no_mutation",
+    "perform_no_child_selection_or_mutation",
+    "perform_no_dependency_discovery_or_installation",
     "place_closing_syntax_final_pr_only",
     "preserve_artifacts",
     "preserve_feedback_gate",
@@ -75,10 +79,15 @@
     "refresh_graph_after_verified_delivery",
     "reject_concurrent_mutation",
     "reject_missing_required_acceptance",
+    "reject_runtime_dependency_substitution",
     "reject_stale_connector_verdict",
     "reject_stale_or_malformed_result",
     "reject_stale_acceptance_evidence",
     "report_closed_without_merge",
+    "report_dependency_contract_failure",
+    "report_dependency_provenance_failure",
+    "report_dependency_readability_failure",
+    "report_dependency_resolution_failure",
     "report_delivery_acceptance_separately",
     "report_mid_stack_redesign",
     "report_missing_reopen_authority",
@@ -91,6 +100,7 @@
     "route_before_ticket_dependencies",
     "route_to_tracker_split",
     "select_auto_closed_incomplete_child",
+    "select_ready_child",
     "skill_contract_incomplete",
     "skip_direct_babysit_handoff",
     "stop_before_publication",
@@ -100,6 +110,7 @@
     "ticket_scoped_fix",
     "transfer_exclusive_mutation_ownership",
     "verify_live_deployment_candidate_binding",
+    "verify_installed_implement_ticket_dependency",
     "verify_merge_live",
     "verify_non_merge_gates",
     "verify_each_pr_gate",
diff --git a/skills/implement-ticket/scripts/evals/fixture_executor.py b/skills/implement-ticket/scripts/evals/fixture_executor.py
index b883820..94efdb0 100644
--- a/skills/implement-ticket/scripts/evals/fixture_executor.py
+++ b/skills/implement-ticket/scripts/evals/fixture_executor.py
@@ -227,6 +227,67 @@ def acceptance_result(
     return actions, acceptance_blocked or tracker_blocked, evidence
 
 
+def implement_ticket_dependency_result(
+    target: str, repository: dict
+) -> tuple[list[str], dict | None]:
+    """Evaluate the installed implement-ticket boundary for epic fixtures."""
+    if target != "implement-epic":
+        return [], None
+    dependency = repository.get("implement_ticket_dependency") or {}
+
+    actions = ["verify_installed_implement_ticket_dependency"]
+    failure_action = None
+    if (
+        not dependency.get("installed")
+        or dependency.get("stable_name") != "implement-ticket"
+    ):
+        failure_action = "report_dependency_resolution_failure"
+    elif not dependency.get("readable"):
+        failure_action = "report_dependency_readability_failure"
+    elif dependency.get("source_binding") != "same_repository_suite":
+        failure_action = "report_dependency_provenance_failure"
+    else:
+        contract = dependency.get("contract") or {}
+        required_terminals = {
+            "ready_pr",
+            "ready_prs",
+            "merged",
+            "blocked",
+            "requires_epic",
+        }
+        if (
+            not required_terminals.issubset(set(contract.get("result_states") or []))
+            or not contract.get("authority_preserved")
+            or not contract.get("one_ticket_scope")
+            or not contract.get("repository_owned_dependencies")
+        ):
+            failure_action = "report_dependency_contract_failure"
+
+    if dependency.get("runtime_substitution_offered"):
+        actions.append("reject_runtime_dependency_substitution")
+    if failure_action:
+        actions.extend(
+            [
+                failure_action,
+                "perform_no_child_selection_or_mutation",
+                "perform_no_dependency_discovery_or_installation",
+            ]
+        )
+        return actions, {
+            "target_skill": target,
+            "terminal_state": "blocked",
+            "actions": sorted(set(actions)),
+            "acceptance_ledger": [],
+        }
+
+    actions.extend(
+        [
+            "bind_installed_implement_ticket",
+        ]
+    )
+    return actions, None
+
+
 def action_result(payload: dict) -> dict:
     target = payload["target_skill"]
     prompt = compact(payload["skill_prompt"])
@@ -245,6 +306,8 @@ def action_result(payload: dict) -> dict:
             "`ready_pr`",
             "`ready_prs`",
             "every required child's criterion-specific acceptance ledger",
+            "`implement-ticket` is already installed, readable",
+            "Never search for, download, install, update, generate, or substitute",
         ),
     }[target]
     if not all(compact(fragment) in prompt for fragment in required_contract):
@@ -257,6 +320,11 @@ def action_result(payload: dict) -> dict:
 
     artifacts = payload["artifacts"]
     ticket = artifacts["ticket"]
+    dependency_actions, dependency_failure = implement_ticket_dependency_result(
+        target, artifacts["repository"]
+    )
+    if dependency_failure is not None:
+        return dependency_failure
     pr = artifacts["pr"]
     checks = artifacts["checks"]
     reviews = artifacts["reviews"]
@@ -267,6 +335,7 @@ def action_result(payload: dict) -> dict:
     actions, acceptance_blocked, acceptance_ledger = acceptance_result(
         target, ticket, pr, handoff, authority
     )
+    actions.extend(dependency_actions)
     if acceptance_blocked:
         return {
             "target_skill": target,
@@ -275,11 +344,14 @@ def action_result(payload: dict) -> dict:
             "acceptance_ledger": acceptance_ledger,
         }
     if target == "implement-epic":
+        if handoff.get("ready_child_selected"):
+            actions.extend(["select_ready_child", "invoke_installed_implement_ticket"])
         if handoff.get("stack_child_result"):
             return {
                 "target_skill": target,
                 "terminal_state": "mixed_ticket_results",
-                "actions": [
+                "actions": actions
+                + [
                     "verify_stack_topology",
                     "verify_each_pr_gate",
                     "verify_full_stack_on_base",
@@ -290,7 +362,8 @@ def action_result(payload: dict) -> dict:
         return {
             "target_skill": target,
             "terminal_state": "mixed_ticket_results",
-            "actions": [
+            "actions": actions
+            + [
                 "consume_ticket_states_unchanged",
                 "do_not_invoke_babysit_pr_directly",
                 "refresh_graph_after_merged_only",
diff --git a/skills/implement-ticket/scripts/tests/test_forward_evals.py b/skills/implement-ticket/scripts/tests/test_forward_evals.py
index 742488b..601fd63 100644
--- a/skills/implement-ticket/scripts/tests/test_forward_evals.py
+++ b/skills/implement-ticket/scripts/tests/test_forward_evals.py
@@ -50,7 +50,7 @@ def test_every_packet_contains_raw_live_shaped_artifact_categories(self):
             "worktree",
             "handoff",
         }
-        self.assertEqual(41, len(self.cases))
+        self.assertEqual(48, len(self.cases))
         for case in self.cases:
             self.assertEqual(required, set(case["artifacts"]), case["id"])
 
@@ -105,9 +105,9 @@ def test_forward_cases_execute_fresh_and_pass_separate_grading(self):
             [sys.executable, str(EXECUTOR_PATH)],
         )
         self.assertEqual([], failures)
-        self.assertEqual(41, len(observations))
+        self.assertEqual(48, len(observations))
         process_ids = {result["executor_pid"] for result in observations.values()}
-        self.assertEqual(41, len(process_ids))
+        self.assertEqual(48, len(process_ids))
 
     def test_reference_executor_evaluates_the_supplied_skill_prompt(self):
         payload = RUNNER.build_payload(self.cases[2])
@@ -327,7 +327,7 @@ def test_target_skill_filter_runs_only_epic_cases(self):
             target_skill="implement-epic",
         )
         self.assertEqual([], failures)
-        self.assertEqual(6, len(observations))
+        self.assertEqual(13, len(observations))
         self.assertTrue(
             all(
                 result["target_skill"] == "implement-epic"
@@ -335,6 +335,101 @@ def test_target_skill_filter_runs_only_epic_cases(self):
             )
         )
 
+    def test_epic_dependency_boundary_executes_before_child_selection(self):
+        observations, failures = RUNNER.evaluate(
+            RUNNER.DEFAULT_CASES,
+            RUNNER.DEFAULT_EXPECTATIONS,
+            [sys.executable, str(EXECUTOR_PATH)],
+            target_skill="implement-epic",
+        )
+        self.assertEqual([], failures)
+        positive = observations["epic-compatible-installed-implement-ticket"]
+        self.assertEqual("mixed_ticket_results", positive["terminal_state"])
+        self.assertIn("select_ready_child", positive["actions"])
+        self.assertIn("invoke_installed_implement_ticket", positive["actions"])
+
+        negative_ids = (
+            "epic-missing-implement-ticket",
+            "epic-third-party-implement-ticket",
+            "epic-incompatible-implement-ticket",
+            "epic-runtime-download-offer",
+            "epic-unverifiable-implement-ticket",
+            "epic-unreadable-implement-ticket",
+        )
+        for case_id in negative_ids:
+            with self.subTest(case=case_id):
+                result = observations[case_id]
+                self.assertEqual("blocked", result["terminal_state"])
+                self.assertIn(
+                    "perform_no_child_selection_or_mutation", result["actions"]
+                )
+                self.assertNotIn("select_ready_child", result["actions"])
+                self.assertNotIn("invoke_installed_implement_ticket", result["actions"])
+
+        child_work_actions = {
+            "select_ready_child",
+            "invoke_installed_implement_ticket",
+            "select_auto_closed_incomplete_child",
+            "invoke_implement_ticket_for_recovery",
+        }
+        for case_id, result in observations.items():
+            if child_work_actions.isdisjoint(result["actions"]):
+                continue
+            with self.subTest(case=case_id):
+                self.assertIn(
+                    "verify_installed_implement_ticket_dependency", result["actions"]
+                )
+                self.assertIn("bind_installed_implement_ticket", result["actions"])
+
+    def test_epic_dependency_grading_rejects_unbound_or_failed_child_work(self):
+        expectations = {
+            item["case_id"]: item for item in json.loads(self.expectations_text)
+        }
+        cases = {item["id"]: item for item in self.cases}
+
+        recovery_case = cases["epic-auto-closed-child-incomplete"]
+        unbound_recovery = FIXTURE_EXECUTOR.action_result(
+            RUNNER.build_payload(recovery_case)
+        )
+        unbound_recovery["actions"] = [
+            action
+            for action in unbound_recovery["actions"]
+            if action
+            not in {
+                "verify_installed_implement_ticket_dependency",
+                "bind_installed_implement_ticket",
+            }
+        ]
+        recovery_failures = RUNNER.grade(
+            recovery_case["id"],
+            unbound_recovery,
+            expectations[recovery_case["id"]],
+        )
+        self.assertTrue(
+            any("missing actions" in failure for failure in recovery_failures)
+        )
+
+        failed_case = cases["epic-missing-implement-ticket"]
+        failed_with_child_work = FIXTURE_EXECUTOR.action_result(
+            RUNNER.build_payload(failed_case)
+        )
+        failed_with_child_work["actions"].extend(
+            [
+                "select_auto_closed_incomplete_child",
+                "invoke_implement_ticket_for_recovery",
+            ]
+        )
+        failed_dependency_failures = RUNNER.grade(
+            failed_case["id"],
+            failed_with_child_work,
+            expectations[failed_case["id"]],
+        )
+        self.assertTrue(
+            any(
+                "forbidden actions" in failure for failure in failed_dependency_failures
+            )
+        )
+
 
 if __name__ == "__main__":
     unittest.main()