A production emergency, major-version migration, architecture-wide refactor, external-account permission failure, large untested legacy rescue, cloud or infrastructure repair, production database migration, or penetration test requires a separate engagement. A patch also requires a runnable repository or minimal reproducer.