diff --git a/gitea_mcp_server.py b/gitea_mcp_server.py
index dd9cfda..8ab9ea3 100644
--- a/gitea_mcp_server.py
+++ b/gitea_mcp_server.py
@@ -519,6 +519,16 @@ def verify_preflight_purity(
                 _preflight_resolved_task, task
             )
         )
+    if (
+        task is not None
+        and _preflight_resolved_task is not None
+        and task != _preflight_resolved_task
+    ):
+        raise RuntimeError(
+            "Pre-flight task mismatch: "
+            f"resolved '{_preflight_resolved_task}' but mutation requires "
+            f"'{task}' (fail closed)"
+        )
 
     ctx = _resolve_author_mutation_context(worktree_path)
     workspace = ctx["workspace_path"]