Source rules: no new dependencies. Validate bad inputs where the task requires it. Treat cancellation as terminal and preserve the original error identity.