@cassiomc1/forgeloop 1.2.4 → 1.5.0

package/THREAT_MODEL.md

@@ -17,6 +17,27 @@ remaining trust boundaries and their executable evidence.
 | Malicious work-state | Resumes stale, secret-bearing, or invalid work | `.forgeloop/work-state.json` | Schema/semantic checks, version checks, transition checks, contract/HEAD/artifact freshness, secret scan, size/depth bounds | Freshness cannot prove that an external process did not alter a file immediately afterward | `tests/work-state.test.js`, `tests/checkpoint-freshness.test.js`, `tests/security-limits.test.js` |
 | Forged preparation | Makes an agent's prose claim look like a completed preflight | Contract, route, gate, and preflight artifacts | Canonical SHA-256 fingerprints, guide-declared gate requirements, stale-artifact checks, and `E_*` failures | The CLI cannot stop a separate process from writing project files before preflight | `tests/protocol-artifacts.test.js`, `tests/preflight.test.js` |
 | Chronology rewrite | Hides execution before route, gates, or verification | `.forgeloop/events.ndjson` | Append-only local ledger, sequence numbers, hash chaining, and chronology validation without prompts or hidden reasoning | A privileged process can still replace the ledger after validation | `tests/lifecycle.test.js` |
+| Concurrent protocol mutation | Two writers read the same state or ledger tail and silently overwrite each other | Task state, task event ledger, and transaction journal | Mutations acquire a lease-bearing task lock, stage writes in `.forgeloop/.txn/`, preserve a recovery manifest, and publish only after the callback completes; state mutators use an expected revision, while ledger appends validate a tail checkpoint and stage only a synchronized suffix | The filesystem does not provide a multi-file atomic commit primitive; a process killed during append is recovered by truncating to the journaled pre-append size rather than treated as complete | `tests/state-revision.test.js`, `tests/concurrent-ledger.test.js`, `tests/scale-ledger.test.js`, `tests/transaction.test.js` |
+| Stale lock theft | A live process loses exclusive ownership because another process removes or replaces its lock | `.forgeloop/locks/<taskKey>.lock` | Locks record hostname, owner instance ID, heartbeat, and lease; inspection distinguishes `NONE`, `LIVE`, `STALE`, `UNKNOWN`, and `CORRUPT`; stale-only release quarantines the observed inode and compares lock ID, heartbeat, and owner instance before deletion | A malicious or separately privileged actor can still delete local locks; an expired lease remains a recovery heuristic rather than remote liveness proof | `tests/task-lock.test.js`, `tests/task-recover.test.js` |
+| Forged recovery tombstone | A schema-valid fake `recovery.json` makes historical claims disappear without an official recovery event | Task descriptor, recovery artifact, and complete event ledger | The canonical claim-state resolver releases claims only when every artifact field matches one unresolved recovery history cycle; a tombstone alone is `INCONSISTENT`, retains historical claims, and disables mutation | A privileged actor can replace every linked local artifact; validation proves consistency, not remote attestation | `tests/task-claim-state.test.js`, `tests/task-claim-ownership-integration.test.js`, `tests/task-recovery-invariants.test.js` |
+| Forged completion claim release | An actor changes `work-state.phase` to `COMPLETE` to make write claims disappear without canonical completion | Work state, canonical completion event, and the complete validated event ledger | Claim ownership releases COMPLETE claims only when state and a validated lifecycle ledger prove canonical completion (`COMPLETION_VALIDATED` bound to the task, coherent state/ledger, no contradicting later lifecycle event); otherwise ownership is `INCONSISTENT` with historical claims retained, mutation disabled, and overlapping acquisition blocked (`E_COMPLETION_OWNERSHIP_UNPROVEN`) | A separately privileged actor can rewrite all local artifacts consistently; ForgeLoop provides consistency verification, not external cryptographic attestation | `tests/completion-claim-ownership.test.js`, `tests/task-claim-state.test.js` |
+| Incomplete task-lock identity theft | A structurally incomplete persisted task lock (missing lockId, owner instance, operation, or lease) with plausible timestamps is classified LIVE/STALE and removed as stale | `.forgeloop/locks/<taskKey>.lock` identity validation | Task lock identity requires `taskId`, `lockId`, `ownerInstanceId`, `operation`, heartbeat, and a positive integer lease; incomplete metadata classifies `UNKNOWN` (never stale-releasable), lease values are never defaulted at validation time, and CAS release additionally requires `lock.taskId === requested taskId` plus unchanged observed identity | A privileged writer can still forge a fully identified lock; classification proves structure, not liveness | `tests/task-lock.test.js` |
+| Partial already-repaired relationship | A tampered recovery artifact (claims, classification, revision, fingerprint, or authority edited after migration) is accepted as an idempotent already-repaired no-op | Full canonical relationship validation in `alreadyRepaired` | Idempotency requires the complete validated ownership projection (`RELEASED_BY_RECOVERY` with matching recovery id/seq) and every artifact field agreeing with the canonical migration event; any mismatch fails closed | A separately privileged actor can rewrite all local artifacts consistently; validation proves consistency, not attestation | `tests/task-repair-legacy-recovery.test.js` |
+| Forged legacy-migration authority | A forged `LEGACY_RECOVERY_MIGRATION_RECORDED` claims `HOST_ATTESTED` authority to impersonate a host grant | Migration event authority validation | Legacy migration v1 accepts only `CALLER_ACKNOWLEDGED`; any other authority kind makes the event invalid and the ledger INCONSISTENT | Normal recovery events retain their own host-attestation boundary with trusted grant references | `tests/task-repair-legacy-recovery.test.js` |
+| MCP project-root substitution | A tool call supplies a different project root to read or mutate an unintended target | Immutable server-pinned project context | The ForgeLoop MCP server realpaths the project root once at startup and freezes it; project root is never a tool input | A privileged local process can still target other roots by launching its own server | `integrations/mcp/tests/` |
+| MCP claim-projection fork | An adapter derives claim ownership from raw artifacts (task.json, recovery.json) and disagrees with the canonical resolver | Canonical ownership resource | The `task/ownership` resource is derived exclusively from `resolveTaskClaimState()`; forged COMPLETE stays INCONSISTENT with retained claims through the resource surface | Presentation bugs could still mislabel values; the resolver remains the single authority | `integrations/mcp/tests/ownership.test.js`, `tests/integration-resources.test.js` |
+| MCP capability escalation via tool input | Tool input (e.g. `force: true`, `acknowledgeRecovery: true`) elevates a server started without the matching capability | Launch-level capability gates re-checked per invocation | Risk classification is invocation-level; disabled capabilities refuse with `E_MCP_CAPABILITY_DISABLED`; recovery acknowledgement never upgrades launch policy; legacy repair stays hidden by default; deprecated `operatorAuthorized` is absent from schemas | A separately authorized local actor can restart the server in full mode | `integrations/mcp/tests/policy.test.js`, `integrations/mcp/tests/safety.test.js` |
+| MCP HTTP unauthenticated remote bind | A network-bound MCP endpoint exposes ForgeLoop operations to any reachable client without authentication | Loopback-only bind policy | The HTTP transport refuses every non-loopback bind with `E_MCP_REMOTE_NOT_SUPPORTED`; Host/Origin validation is defense against DNS rebinding, not authentication; remote access stays disabled until a separately designed authenticated boundary exists | A same-host process can still reach the loopback endpoint | `integrations/mcp/tests/http.test.js` |
+| MCP protocol downgrade / legacy fallback | Legacy-era traffic is silently served, weakening the declared 2026 security posture | Strict modern mode | The HTTP handler is constructed with the SDK strict-modern setting (`legacy: "reject"`); legacy handshakes are answered with an unsupported-protocol-version rejection instead of being served | Stdio remains available for clients that only speak older protocol generations | `integrations/mcp/tests/http.test.js` |
+| MCP HTTP resource exhaustion | Slow headers, slow bodies, oversized bodies, or connection floods exhaust server resources | Bounded transport controls | Header/request/keepalive timeouts are set on the HTTP server; request bodies are hard-bounded at 4 MiB (413 on exceed); an in-flight ceiling sheds load with 503 `E_MCP_HTTP_BUSY`; only POST is served | Bounds protect availability, not authorization | `integrations/mcp/tests/http.test.js` |
+| Transport metadata as authority | An MCP session id, HTTP source address, Origin/Host header, or tool-supplied acknowledgement is treated as ForgeLoop authority | Authority-free adapter design | No session identity is issued or consumed; capability policy is fixed at launch and re-checked per invocation; acknowledgement fields satisfy canonical command semantics only after launch-level capability was granted | None within the adapter boundary; host-level network controls remain external | `integrations/mcp/tests/policy.test.js` |
+| MCP stdout corruption / shell injection | Protocol transport polluted by diagnostics, or a generic shell tool enabling arbitrary execution | Transport discipline and exact-argv policy | stdout carries only MCP protocol; logging goes to stderr; no shell/exec tools exist; external execution passes exact argv arrays through canonical provenance | Compromised dependencies remain out of scope of transport discipline | `scripts/mcp-package-smoke.mjs` |
+| Recovery tombstone deletion / claim resurrection | Deleting `recovery.json` lets a recovered task mutate after another task adopts the released scope | Recovery history and all ordinary task mutation entry points | The complete ledger derives unresolved recovery independently; a missing tombstone with unresolved history is `INCONSISTENT`, and the canonical mutation guard rejects it with `E_TASK_CLAIM_OWNERSHIP_INCONSISTENT` | A separately privileged process can still deny service by corrupting local artifacts | `tests/task-claim-state.test.js`, `tests/task-claim-ownership-integration.test.js` |
+| Corrupt task namespace claim disappearance | An unreadable descriptor or recovery artifact is interpreted as claim-free during task creation or scope change | Modern task namespace discovery and project claim acquisition | Readable historical claims are retained conservatively; an unhealthy namespace with unknown ownership blocks claim mutation globally with `E_TASK_CLAIM_OWNERSHIP_INCONSISTENT` | Recovery requires repairing protocol-owned evidence; ForgeLoop does not invent unknown claims | `tests/task-claim-ownership-integration.test.js`, `tests/task-recovery-tamper.test.js` |
+| Recovery event-tail eviction | Later ledger events push recovery history beyond a bounded read window and reactivate old claims | Recovery state versus append-only event history | Claim ownership validates the complete ledger and binds the artifact to its exact recovery event, recovery ID, claims, classification, authority, revision, and repository fingerprint | Full validation is intentionally correctness-first and may be optimized only with verdict-equivalent checkpoints | `tests/task-recover.test.js`, `tests/task-recovery-validation.test.js`, `tests/task-recovery-invariants.test.js` |
+| Project claims lock deadlock or theft | A crashed process blocks every ownership transition, or stale cleanup removes a replacement owner | `.forgeloop/.claims.lock` | Project claim locks classify `NONE`, `LIVE`, `STALE`, `UNKNOWN`, and `CORRUPT`; acquisition may quarantine and remove only an unchanged stale inode after matching lock ID, heartbeat, and owner instance, while unknown/corrupt/CAS-mismatch state fails closed | Lease expiry is a recovery heuristic; separately privileged filesystem writers remain outside the boundary | `tests/project-claims-lock.test.js`, `tests/task-recovery-concurrency.test.js` |
+| Self-asserted recovery authority | An actor labels its own recovery request operator- or host-authorized | Caller input, recovery authority metadata, and host integration boundary | Standalone recovery records only `CALLER_ACKNOWLEDGED`; the deprecated operator flag is only an alias; `HOST_ATTESTED` requires a host-owned grant reference and cannot be minted by the CLI | Host attestation remains only as strong as the host-controlled boundary and grant source | `tests/task-recovery-cli.test.js`, `tests/task-recovery-validation.test.js` |
+| Recovery TOCTOU and reacquisition collision | State changes between inspection and claim release, or two tasks acquire the same released path | Project claims lock, task lock, revision, ledger sequence, and scope checks | Project-claims lock precedes task lock; recovery revalidates validated ownership, classification, revision, phase, and ledger sequence; resume validates the same ownership, CAS-settles stale task locks, and reuses normal conflict and clean-scope enforcement; concurrent tests assert at most one active owner | The filesystem cannot make repository content and multi-file metadata globally atomic against separately privileged writers | `tests/task-recovery-concurrency.test.js`, `tests/project-claims-lock.test.js`, `tests/task-lock.test.js`, `tests/task-resume.test.js` |
 | Lifecycle artifact repair | Direct state or receipt edits fabricate a legal recovery or terminal phase | Work state, receipt, evidence checks, and event ledger | New verification cycles record phase events and fingerprints; validators reject state/ledger divergence and future lifecycle evidence | Local artifacts are detection-oriented, not cryptographically tamper-proof against a privileged process rewriting every linked artifact | `tests/lifecycle-evidence-recovery.test.js`, `tests/completion-ergonomics.test.js` |
 | Unsupported profile fact | Turns an agent decision into a durable user fact | `PROJECT_PROFILE.md` and `.forgeloop/sources.json` | Source IDs, source-kind validation, unknown-reference rejection, and explicit misclassification failures | Arbitrary Markdown semantics still require a human or host-specific parser | `tests/profile-provenance.test.js`, `src/core/profile.js` |
 | Weak verification | Treats a vague or inferred claim as observed evidence | Receipt checks and coverage | Versioned check schema, contradictory-status rejection, observed-evidence requirements, and coverage matrix | Evidence remains local and declarative; it is not a remote attestation service | `tests/evidence-coverage.test.js`, `tests/completion.test.js` |
@@ -53,7 +74,7 @@ remaining trust boundaries and their executable evidence.
 | Lock regeneration or subdigest tampering | An actor modifies rules or baseline, omits subdigests, or regenerates `policy.lock` to hide tampering | Effective policy lock verification (`verifyPolicyLock`) | Lock derives deterministically from effective rules + baseline. Schema-invalid lock artifacts (malformed JSON or missing required fields such as `rulesDigest`/`baselineDigest`) fail closed with `E_POLICY_INVALID`; schema-valid locks whose semantic digest components (`algorithm`, `digest`, `rulesDigest`, `baselineDigest`) no longer match effective policy state fail with `E_POLICY_LOCK_MISMATCH` before any relocking. Changing only `capturedAt` does not change semantic identity | Explicit update commands (`policy-discover --write`, `baseline`) update lock after authorization | `tests/policy-hardening.test.js` |
 | Baseline re-record bypass | An actor uses `baseline --record` during an active task to convert newly introduced violations into tolerated debt | Active task baseline protection in `runBaseline` | `baseline --record` is rejected during active policy-bound tasks with `E_BASELINE_RECORD_DURING_ACTIVE_TASK`; only monotonic `--update` is permitted | Explicit `--policy-reset-authorized` flag required for intentional operator resets | `tests/policy-hardening.test.js` |
 | Legacy snapshot semantic confusion | A legacy task snapshot lacking baseline state is assumed to have empty baseline, creating false `WEAKEN` drift | Semantic baseline snapshotting in `policy-snapshot.json` | Snapshots retain full semantic baseline entries; snapshots lacking baseline state classify drift as `UNKNOWN` rather than inventing state | Modern tasks retain semantic baseline entries for exact diff | `tests/policy-hardening.test.js` |
-| Cross-task state confusion | Concurrent processes or alternative harnesses mutate or read the wrong task's state in a multi-task workspace | Task-scoped isolation in `.forgeloop/task-state/<taskKey>/` | Deterministic SHA-256 task directory namespacing, explicit `--task` / `FORGELOOP_TASK` selectors, file-level mutex locking (`.lock`), and claim overlap detection in `task-create` | Tasks must declare non-overlapping write claims or operate in isolated worktrees | `tests/task-namespace.test.js`, `tests/task-scope.test.js` |
+| Cross-task state confusion | Concurrent processes or alternative harnesses mutate or read the wrong task's state in a multi-task workspace | Task-scoped isolation in `.forgeloop/task-state/<taskKey>/` | Deterministic SHA-256 task directory namespacing, explicit `--task` / `FORGELOOP_TASK` selectors, separate file-level lease locks under `.forgeloop/locks/`, and claim overlap detection in `task-create` | Tasks must declare non-overlapping write claims or operate in isolated worktrees | `tests/task-namespace.test.js`, `tests/task-scope.test.js` |
 | Modern namespace descriptor deletion | Corruption or an attacker removes `task.json` from a modern task namespace (leaving contract/work-state/receipt/events), the resolver ignores the namespace, and stale legacy singleton state becomes authoritative | Descriptor boundary between modern task namespaces and the legacy singleton | Descriptor-less 64-hex directories are classified by contents: directories containing modern task artifacts (or empty directories) fail closed with `E_TASK_DESCRIPTOR_INVALID`; only directories containing exclusively the explicitly recognized legacy-incidental artifact (`policy-snapshot.json`) are ignored; `resolveTaskContext` fails closed when all namespaces are corrupt | A separately privileged process can rewrite task-state directories after validation | `tests/validate-receipt-task.test.js` |
 
 ## Boundary rules

package/docs/ARTIFACT_REFERENCE.md

@@ -30,6 +30,7 @@ All artifact schemas are defined in `schemas/*.schema.json`. Persisted artifact
 | `policy/baseline.json` | `policy-baseline` | Protocol Generated Or Operator | Monotonic Ratchet Down | Brownfield Baseline |
 | `policy/policy.lock` | `policy-lock` | Protocol Generated | Atomic Digest Compilation | Policy Integrity Lock |
 | `task-state/<task-key>/policy-snapshot.json` | `policy-snapshot` | Protocol Generated | Mutable Before Execution | Task Policy Attestation |
+| `task-state/<task-key>/recovery.json` | `task-recovery` | Protocol Generated | Recovery State Transitions | Task Recovery State |
 
 <!-- END FORGELOOP GENERATED: artifact-registry -->
 
@@ -287,6 +288,7 @@ The canonical, authoritative lifecycle work state. Represents current checkpoint
 - `failures` *(array<object>, required)*
 - `blockers` *(array<object>, required)*
 - `lastUpdated` *(string, required, minLength: 1)*
+- `revision` *(integer, optional, minimum: 0)*
 - `previousPhase` *(string, optional)*
 - `diagnosedHypothesis` *(string, optional, minLength: 1)*
 - `verificationEvidence` *(array<object>, optional)*
@@ -421,6 +423,16 @@ Attested command execution provenance artifact generated by `forgeloop run-check
 - `finishedAt` *(string, required, minLength: 1)*
 - `status` *(string, required, enum: `passed`, `failed`)*
 - `exitCode` *(integer or null, required)*
+- `durationMs` *(integer, optional, minimum: 0)*
+- `termination` *(string, optional, enum: `exit`, `signal`, `timeout`, `spawn-error`)*
+- `signal` *(string or null, optional)*
+- `stdoutSha256` *(string, optional, pattern: `^[a-f0-9]{64}$`)*
+- `stderrSha256` *(string, optional, pattern: `^[a-f0-9]{64}$`)*
+- `stdoutBytes` *(integer, optional, minimum: 0)*
+- `stderrBytes` *(integer, optional, minimum: 0)*
+- `outputTruncated` *(boolean, optional)*
+- `timeoutMs` *(integer, optional, minimum: 1)*
+- `terminationGraceMs` *(integer, optional, minimum: 1)*
 
 <!-- END FORGELOOP GENERATED: schema:execution -->
 
@@ -590,3 +602,45 @@ comparison explicitly `UNKNOWN` rather than assuming an empty baseline.
 - `capturedAt` *(string, optional)*
 
 <!-- END FORGELOOP GENERATED: schema:policy-snapshot -->
+
+---
+
+### 2.19 `task-state/<taskKey>/recovery.json`
+
+<!-- forgeloop-doc: schema=task-recovery artifact=.forgeloop/task-state/<task-key>/recovery.json -->
+
+Durable current-state input for claim-release recovery. It records the
+classification and exact claims released while leaving lifecycle work state,
+receipts, failures, policy, and continuity unchanged. Structural validity alone
+does not release claims: ForgeLoop must also validate the descriptor, work
+state, full ledger, referenced recovery event, and absence of a later matching
+resume. A mismatch is `INCONSISTENT`, preserves historical claims, and suspends
+ordinary mutation until the protocol-owned evidence is repaired.
+
+`CALLER_ACKNOWLEDGED` is not host attestation. `HOST_ATTESTED` requires a
+host-owned `grantRef`; the standalone CLI does not self-issue that authority.
+
+#### Canonical Fields
+
+<!-- BEGIN FORGELOOP GENERATED: schema:task-recovery -->
+
+- `schemaVersion` *(number, required, const: 1)*
+- `protocolVersion` *(number, required, const: 1)*
+- `taskId` *(string, required, minLength: 1)*
+- `status` *(string, required, const: `RECOVERED`)*
+- `recoveredAt` *(string, required)*
+- `recoveryId` *(string, required, pattern: `^recovery-[A-Za-z0-9-]+$`)*
+- `recoveryEventSeq` *(integer, required, minimum: 1)*
+- `classificationAtRecovery` *(string, required, enum: `STALE`, `ABANDONED`, `LEGACY_BOUNDARY_MIGRATED`)*
+- `reasonCodes` *(array<string>, required)*
+- `releasedClaims` *(array<string>, required)*
+- `previousPhase` *(string, required, minLength: 1)*
+- `previousRevision` *(integer, required, minimum: 0)*
+- `repositoryFingerprint` *(object, required)*
+  - `branch` *(string,null, required)*
+  - `head` *(string,null, required)*
+- `authority` *(object, required)*
+  - `kind` *(string, required, enum: `CALLER_ACKNOWLEDGED`, `HOST_ATTESTED`)*
+  - `grantRef` *(string, optional, minLength: 1)*
+
+<!-- END FORGELOOP GENERATED: schema:task-recovery -->

package/docs/CLI_REFERENCE.md

@@ -39,9 +39,9 @@ ForgeLoop uses a definition-driven command-line parser:
 
 | Category | Commands |
 | --- | --- |
-| **Setup & Maintenance** | [`init`](#init), [`update`](#update), [`task-migrate`](#task-migrate), [`task-unlock`](#task-unlock) |
-| **Inspection & Diagnostics** | [`doctor`](#doctor), [`progress`](#progress), [`profile-interview`](#profile-interview), [`inspect`](#inspect), [`status`](#status), [`validate-state`](#validate-state), [`validate-protocol`](#validate-protocol) |
-| **Lifecycle & State** | [`activate`](#activate), [`route`](#route), [`preflight`](#preflight), [`advance`](#advance), [`next`](#next), [`record-diagnosis`](#record-diagnosis), [`record-decision-criterion`](#record-decision-criterion), [`complete`](#complete), [`clear-state`](#clear-state), [`reconcile-closure`](#reconcile-closure), [`task-create`](#task-create), [`task-list`](#task-list), [`task-show`](#task-show), [`task-scope`](#task-scope) |
+| **Inspection & Diagnostics** | [`protocol-info`](#protocol-info), [`doctor`](#doctor), [`progress`](#progress), [`profile-interview`](#profile-interview), [`inspect`](#inspect), [`status`](#status), [`validate-state`](#validate-state), [`validate-protocol`](#validate-protocol) |
+| **Setup & Maintenance** | [`init`](#init), [`update`](#update), [`task-migrate`](#task-migrate), [`migrate-protocol`](#migrate-protocol), [`task-unlock`](#task-unlock), [`task-recover`](#task-recover), [`task-repair-legacy-recovery`](#task-repair-legacy-recovery), [`task-resume`](#task-resume) |
+| **Lifecycle & State** | [`activate`](#activate), [`route`](#route), [`preflight`](#preflight), [`advance`](#advance), [`next`](#next), [`record-diagnosis`](#record-diagnosis), [`record-decision-criterion`](#record-decision-criterion), [`complete`](#complete), [`clear-state`](#clear-state), [`reconcile-closure`](#reconcile-closure), [`task-create`](#task-create), [`task-list`](#task-list), [`task-show`](#task-show), [`task-lock-status`](#task-lock-status), [`task-scope`](#task-scope) |
 | **Cross-Harness Continuity** | [`continuity`](#continuity), [`record-continuity`](#record-continuity), [`reconcile-continuity`](#reconcile-continuity), [`clear-continuity`](#clear-continuity) |
 | **Verification & Completion** | [`prepare-completion`](#prepare-completion), [`run-check`](#run-check), [`record-check`](#record-check), [`record-terminal-result`](#record-terminal-result), [`audit`](#audit), [`report`](#report), [`validate-receipt`](#validate-receipt) |
 | **Policy & Auditing** | [`policy`](#policy), [`policy-discover`](#policy-discover), [`policy-status`](#policy-status), [`policy-diff`](#policy-diff), [`rule-verify`](#rule-verify), [`baseline`](#baseline), [`bundle`](#bundle) |
@@ -52,6 +52,30 @@ ForgeLoop uses a definition-driven command-line parser:
 
 ## 1. Setup & Maintenance
 
+### `protocol-info`
+
+Reports the public compatibility handshake required by external ForgeLoop harnesses.
+
+- **Purpose**: Publishes protocol/schema versioning, lifecycle metadata, command metadata, guide registry, and the documented error registry.
+- **When to use**: Before a harness creates or resumes a ForgeLoop task, and when verifying compatibility without reading internal source.
+- **Mutation**: Read-only.
+- **Options**:
+
+<!-- BEGIN FORGELOOP GENERATED: cli:protocol-info:options -->
+
+- `--path <directory>`: target project directory (default: current directory)
+- `--json`: emit complete machine-readable protocol metadata
+
+<!-- END FORGELOOP GENERATED: cli:protocol-info:options -->
+
+- **Example**:
+
+  <!-- FORGELOOP EXAMPLE: cli-reference:protocol-info | exit=0 | json.commands.0.name=protocol-info -->
+  ```bash
+  forgeloop protocol-info --json
+  ```
+  <!-- END FORGELOOP EXAMPLE -->
+
 ### `init`
 
 Initializes ForgeLoop in a target repository.
@@ -407,6 +431,7 @@ Executes a verification command with ForgeLoop-attested provenance.
 - `--id <id>`: stable check identifier
 - `--requirement <id>`: completion requirement covered by the check
 - `--details <json>`: additional structured check details
+- `--timeout-ms <number>`: maximum command duration before termination
 - `-- <argv...>`: exact command argv to classify, execute, and attest
 - `--json`: emit structured output as JSON
 
@@ -1139,6 +1164,27 @@ Displays details of a specific task by ID or storage key.
   forgeloop task-show --task task-001 --json
   ```
 
+### `task-lock-status`
+
+Reports the lock owner and lease-based staleness classification for a specific task without mutating it.
+
+- **Mutation**: Read-only.
+- **Options**:
+
+<!-- BEGIN FORGELOOP GENERATED: cli:task-lock-status:options -->
+
+- `--path <directory>`: target project directory (default: current directory)
+- `--task <id>`: task ID to operate on (when omitted, resolved from context or single active task)
+- `--json`: emit structured output as JSON
+
+<!-- END FORGELOOP GENERATED: cli:task-lock-status:options -->
+
+- **Example**:
+
+  ```bash
+  forgeloop task-lock-status --task task-001 --json
+  ```
+
 ### `task-scope`
 
 Updates or inspects write claims for a task.
@@ -1184,11 +1230,42 @@ Migrates a legacy 1.0 single-task `.forgeloop/` layout into a namespaced task di
   forgeloop task-migrate --json
   ```
 
+### `migrate-protocol`
+
+Plans or applies an explicitly supported persisted-state migration to a target
+protocol version.
+
+- **Purpose**: Provides a fail-closed compatibility migration surface. In the
+  current release, target protocol `1` either needs no change or converts a
+  detected legacy singleton layout through the verified `task-migrate` flow.
+- **When to use**: Before upgrading persisted ForgeLoop state when a release
+  documents a new protocol migration. Run the dry-run first and retain the
+  resulting migration receipt after applying a legacy conversion.
+- **Mutation**: Does not write with `--dry-run`. A supported legacy conversion
+  writes the namespaced task state and its `migration-receipt.json` before
+  removing legacy artifacts.
+- **Options**:
+
+<!-- BEGIN FORGELOOP GENERATED: cli:migrate-protocol:options -->
+
+- `--path <directory>`: target project directory (default: current directory)
+- `--to <protocolVersion>`: target supported protocol version
+- `--dry-run`: show migration actions without writing or deleting artifacts
+- `--json`: emit structured migration result as JSON
+
+<!-- END FORGELOOP GENERATED: cli:migrate-protocol:options -->
+
+- **Example**:
+
+  ```bash
+  forgeloop migrate-protocol --to 1 --dry-run --json
+  ```
+
 ### `task-unlock`
 
-Forces the release of a stale task lock.
+Forces the release of a task lock or CAS-safely releases an unchanged stale lease.
 
-- **Purpose**: Removes `.lock` file from the task directory when process crashed.
+- **Purpose**: Removes `.forgeloop/locks/<taskKey>.lock` when its owner is no longer valid. Prefer `--stale-only`; `--force` is an explicit unconditional maintenance action.
 - **Mutation**: Deletes task lock file.
 - **Options**:
 
@@ -1197,6 +1274,7 @@ Forces the release of a stale task lock.
 - `--path <directory>`: target project directory (default: current directory)
 - `--task <id>`: task ID to operate on (when omitted, resolved from context or single active task)
 - `--force`: force release of an orphaned task lock
+- `--stale-only`: release only a lock whose lease is expired
 - `--json`: emit structured output as JSON
 
 <!-- END FORGELOOP GENERATED: cli:task-unlock:options -->
@@ -1206,3 +1284,97 @@ Forces the release of a stale task lock.
   ```bash
   forgeloop task-unlock --task task-001 --force --json
   ```
+
+### `task-recover`
+
+Suspends mutation and releases effective claims for a task deterministically classified `STALE` or `ABANDONED`.
+
+- **Purpose**: For a task classified only `STALE` or `ABANDONED`, persists `recovery.json` plus a linked append-only event without changing work state or fabricating completion. The canonical claim-state resolver must validate both before claims become effective-empty. `RECOVERABLE` tasks must use `reconcile-closure`.
+- **Mutation**: Transactionally writes recovery state and appends the recovery event. Historical descriptor claims and all lifecycle evidence remain intact; ordinary mutations return `E_TASK_RECOVERED`.
+- **Options**:
+
+<!-- BEGIN FORGELOOP GENERATED: cli:task-recover:options -->
+
+- `--path <directory>`: target project directory (default: current directory)
+- `--task <id>`: task ID to operate on (when omitted, resolved from context or single active task)
+- `--acknowledge-recovery`: acknowledge release of claims for a STALE or ABANDONED task (required; not host attestation)
+- `--operator-authorized`: deprecated alias for --acknowledge-recovery; does not attest operator authority
+- `--json`: emit structured output as JSON
+
+<!-- END FORGELOOP GENERATED: cli:task-recover:options -->
+
+- **Example**:
+
+  ```bash
+  forgeloop task-recover --task task-001 --acknowledge-recovery --json
+  ```
+
+`--acknowledge-recovery` is caller acknowledgement only. The deprecated
+`--operator-authorized` alias has the same semantics and is not host attestation.
+Fake, missing, corrupt, or mismatched recovery state is
+`E_TASK_CLAIM_OWNERSHIP_INCONSISTENT`/`E_TASK_RECOVERY_INCONSISTENT`; historical
+claims remain reserved.
+
+### `task-resume`
+
+Reacquires a recovered task's write claims and restores ordinary mutation authority.
+
+- **Purpose**: Validates active recovery ownership, CAS-settles only an unchanged stale task lease, reuses normal claim-overlap and clean-checkout enforcement under project/task serialization, then removes `recovery.json` transactionally.
+- **Mutation**: Optionally updates historical claims in `task.json`, appends `TASK_RECOVERY_RESUMED`, and removes `recovery.json` in one transaction.
+- **Options**:
+
+<!-- BEGIN FORGELOOP GENERATED: cli:task-resume:options -->
+
+- `--path <directory>`: target project directory (default: current directory)
+- `--task <id>`: task ID to operate on (when omitted, resolved from context or single active task)
+- `--claim <path>`: write claim to reacquire (defaults to all released claims) (repeatable)
+- `--json`: emit structured output as JSON
+
+<!-- END FORGELOOP GENERATED: cli:task-resume:options -->
+
+- **Example**:
+
+  ```bash
+  forgeloop task-resume --task task-001 --claim src --claim tests --json
+  ```
+
+With no `--claim`, the command attempts to reacquire all claims recorded in the
+active recovery artifact. It returns `E_TASK_SCOPE_CONFLICT` without removing
+recovery state when another active task owns an overlapping path.
+The resume event counts as meaningful task activity. Never create, edit, or
+delete `recovery.json` manually to emulate this command.
+
+### `task-repair-legacy-recovery`
+
+Migrates one recognized legacy recovery boundary event into the modern durable recovery representation.
+
+- **Purpose**: Proves that a historical `OPERATOR_RECOVERY_RECORDED` without `recoveryId` marks the effective task boundary and materializes its modern representation as an append-only `LEGACY_RECOVERY_MIGRATION_RECORDED` event plus a transactional `recovery.json`. The original legacy event is never modified.
+- **Mutation**: Appends the migration event at the ledger tail and writes `recovery.json` in one transaction under project claims locking.
+- **Options**:
+
+<!-- BEGIN FORGELOOP GENERATED: cli:task-repair-legacy-recovery:options -->
+
+- `--path <directory>`: target project directory (default: current directory)
+- `--task <id>`: task ID to operate on (when omitted, resolved from context or single active task)
+- `--acknowledge-recovery`: fresh explicit acknowledgement of the legacy boundary migration (required)
+- `--json`: emit structured output as JSON
+
+<!-- END FORGELOOP GENERATED: cli:task-repair-legacy-recovery:options -->
+
+- **Example**:
+
+  ```bash
+  forgeloop task-repair-legacy-recovery --task task-001 --acknowledge-recovery --json
+  ```
+
+Only the exact known legacy signature is eligible; ambiguous, tampered, or
+post-boundary-active ledgers fail closed with
+`E_LEGACY_RECOVERY_MIGRATION_INVALID` and ownership stays INCONSISTENT. A
+`STALE` task lease is settled only through CAS-safe stale release when the
+observed lock is unchanged; `LIVE` locks refuse with `E_TASK_LOCKED`, and
+`UNKNOWN`/`CORRUPT` locks fail closed with the lock preserved — never delete a
+lock file manually to unblock this command. The repair is idempotent: an
+already repaired task returns `{repaired: 0, alreadyRepaired: true}` only when
+the whole canonical recovery relationship validates; any mismatch fails closed.
+The repair itself never releases claims directly; ownership becomes validated
+recovery state and ordinary mutation remains blocked until `task-resume`.

package/docs/CROSS_HARNESS_CONTINUITY.md

@@ -29,6 +29,15 @@ Switching between execution environments (for example Codex $\rightarrow$ Claude
 
 When a new harness starts in a repository where an active task exists, it must discover the existing task, reconcile continuity when present, inspect the checkout, and proceed from the recorded state rather than overwriting the contract.
 
+Before it touches task state, a harness can verify the public compatibility
+handshake it will use for the handoff:
+
+<!-- FORGELOOP EXAMPLE: cross-harness:handshake | exit=0 | json.lifecycle.phases.0=RECEIVED -->
+```bash
+forgeloop protocol-info --json
+```
+<!-- END FORGELOOP EXAMPLE -->
+
 Key continuity invariants:
 
 - **Continuity is optional**: A missing `continuity.json` file does not invalidate an otherwise resumable task.
@@ -45,6 +54,7 @@ Key continuity invariants:
 | --- | --- | --- | --- |
 | **Task Descriptor** | `.forgeloop/task-state/<taskKey>/task.json` | Task ID, write claims, and task registration | Descriptor authority |
 | **Lifecycle Checkpoint** | `.forgeloop/task-state/<taskKey>/work-state.json` | Current phase, cycle, active guides, preflight binding | Canonical lifecycle truth |
+| **Recovery State** | `.forgeloop/task-state/<taskKey>/recovery.json` | Candidate current suspension bound to ledger history | One input to canonical validated claim ownership; never sufficient alone and never completion evidence |
 | **Operational Continuity** | `.forgeloop/task-state/<taskKey>/continuity.json` | Active focus, remaining items, known issues, inspect-first paths | Operational context only (non-evidence) |
 | **Implementation Truth** | Git checkout / filesystem | Actual source code and files | Ground truth for changes |
 | **Task Intent** | `.forgeloop/task-state/<taskKey>/contract.json` | Objectives, constraints, deliverables, verification requirements | Contract authority |
@@ -133,9 +143,11 @@ forgeloop status --json
 
 Or with explicit flag:
 
+<!-- FORGELOOP EXAMPLE: cross-harness:status | fixture=task:auth-feature | exit=0 | json.taskId=auth-feature -->
 ```bash
 forgeloop status --task auth-feature --json
 ```
+<!-- END FORGELOOP EXAMPLE -->
 
 Verify that the task exists and observe the current lifecycle phase (e.g. `EXECUTING` or `VERIFYING`). If multiple tasks exist and no selector is provided, ForgeLoop returns `E_TASK_AMBIGUOUS`.
 
@@ -171,6 +183,26 @@ forgeloop next --task auth-feature --json
 
 Follow the deterministic action returned by ForgeLoop (e.g. `CONTINUE_IMPLEMENTATION`, `ENTER_VERIFYING`, or `RECORD_CHECK`).
 
+If `next` returns `RESUME_RECOVERED_TASK`, the handoff is still the same task,
+but ordinary mutation is suspended. Inspect the recovery metadata and current
+claim owners, then reacquire claims explicitly:
+
+```bash
+forgeloop task-show --task auth-feature --json
+forgeloop task-resume --task auth-feature --json
+```
+
+Do not create, edit, or delete `recovery.json` manually. Every harness must use
+the canonical validated descriptor + work-state + recovery + ledger projection;
+a tombstone alone never releases claims. If another task owns an
+overlapping path, `task-resume` fails with `E_TASK_SCOPE_CONFLICT` and leaves
+the recovery state intact.
+
+A project containing active task recovery state requires ForgeLoop 1.4.0 or
+newer and `features.taskClaimRecovery.validatedClaimProjection=true` in
+`protocol-info`. An unaware reader must fail closed rather than continue from
+descriptor-only ownership.
+
 ---
 
 ## 6. Stale, Inconsistent, or Missing Handoffs
@@ -186,6 +218,8 @@ ForgeLoop handles edge cases deterministically:
 | **Multiple Active Tasks** | No `--task` or `FORGELOOP_TASK` supplied | `E_TASK_AMBIGUOUS` | List tasks with `task-list` and supply `--task` |
 | **Different Task ID** | Contract / state ID mismatch | `TASK_MISMATCH` | Do not merge contexts; complete or clear previous state |
 | **Malformed State** | Corrupted JSON or invalid hash chain | `INVALID` | Fails closed; inspect errors via `forgeloop doctor --json` |
+| **Recovered Task** | `recovery.json` and its complete ledger history validate as one active recovery cycle | `RESUME_RECOVERED_TASK` | Inspect ownership, then use `task-resume`; recovery is not completion |
+| **Recovery Inconsistency** | Artifact/history, descriptor claims, lock, or ledger evidence is missing, corrupt, or mismatched | `RESOLVE_RECOVERY_INCONSISTENCY` | Historical claims remain reserved; run `validate-protocol` and repair the named artifact instead of forcing recovery |
 
 ---
 

package/docs/DOCUMENTATION_GUIDE.md

@@ -31,10 +31,24 @@ Reason-code truth       -> exported protocol constants (src/core/error-codes.js,
 Guide registry truth    -> canonical guide registry (src/config/guides.json)
 Package contents truth  -> package.json + package tests (tests/package.test.js)
 Documentation routing   -> DOCS_INDEX.md
+Integration API truth   -> src/integration.js (exports, envelope, limits, risk classes, resources)
+MCP behavior truth      -> integrations/mcp/src/* and integrations/mcp/package.json
+MCP package boundary    -> MCP package tests + scripts/mcp-package-smoke.mjs
 ```
 
 Operational documentation must explain canonical behavior, not redefine it.
 
+Documentation-impact questions for integration/MCP changes:
+
+- Did a server mode or capability gate change?
+- Did an MCP transport change?
+- Did an adapter error code change?
+- Did an integration limit or resource list change?
+
+Anti-drift invariant: every `documentation-manifest.json` entry marked
+`packaged: true` is mechanically checked against the core npm tarball
+contents (`tests/package.test.js`).
+
 Canonical phase and transition inventories must be derived from `WORK_PHASES`
 and `WORK_TRANSITIONS`; do not maintain independent hand-written transition
 enums when a generated or mechanically validated representation is available.
@@ -123,6 +137,21 @@ When writing documentation, use precise terms:
 
 Avoid ambiguous phrases like *"should generally"* or *"usually"* for behaviors that are strictly enforced by the validator.
 
+### Stable requirement IDs
+
+Every protocol-level `MUST` or `MUST NOT` has a stable `FL-<AREA>-<NNN>`
+anchor and an entry in [`protocol-requirements.json`](./protocol-requirements.json).
+Each map entry names its normative source, implementation validator, and at
+least one executable test. `npm run docs:check` rejects an unmapped normative
+requirement, an unused mapping, or a missing implementation/test target.
+
+### Documentation impact classification
+
+Classify each documentation-impacting change as one or more of: `NONE`,
+`REFERENCE_ONLY`, `OPERATIONAL`, `NORMATIVE`, `SCHEMA_COMPATIBILITY`,
+`MIGRATION`, or `SECURITY`. Changes that are normative, compatibility,
+migration, or security-sensitive require `npm run docs:check` before merge.
+
 ### Multi-Task Layout Rules
 
 - Canonical task-scoped paths are defined in `src/core/task-paths.js` under `.forgeloop/task-state/<taskKey>/`.
@@ -196,3 +225,5 @@ For documentation-impacting changes, verify each item before merging:
 - [ ] Did package-shipped documentation change?
 - [ ] Were generated reference docs updated (`npm run docs:generate`)?
 - [ ] Did documentation conformance CI pass (`npm run docs:check`)?
+- [ ] If normative language changed, are stable IDs and mappings current?
+- [ ] Is the documentation impact classification recorded in the PR?

package/docs/GETTING_STARTED.md

@@ -39,6 +39,15 @@ Core mental model:
 
 In your project repository:
 
+Confirm the installed CLI exposes the compatible protocol before creating
+state. This is read-only and safe to run in a fresh project directory.
+
+<!-- FORGELOOP EXAMPLE: getting-started:compatibility | exit=0 | json.compatibility.schemaVersion=1 -->
+```bash
+forgeloop protocol-info --json
+```
+<!-- END FORGELOOP EXAMPLE -->
+
 ```bash
 # Initialize ForgeLoop kit and discovery shims
 npx @cassiomc1/forgeloop init
@@ -373,6 +382,7 @@ forgeloop task-migrate --json
 ## 8. Next Steps
 
 - Continue a task across different AI harnesses: [`docs/CROSS_HARNESS_CONTINUITY.md`](./CROSS_HARNESS_CONTINUITY.md)
+- Optional: use ForgeLoop through MCP or the Integration API — [`docs/MCP.md`](./MCP.md) and [`docs/UNIVERSAL_INTEGRATION.md`](./UNIVERSAL_INTEGRATION.md). MCP is not required; CLI and MCP share the same canonical project/task state.
 - Complete command reference: [`docs/CLI_REFERENCE.md`](./CLI_REFERENCE.md)
 - Artifact and schema reference: [`docs/ARTIFACT_REFERENCE.md`](./ARTIFACT_REFERENCE.md)
 - Common symptoms and recovery: [`docs/TROUBLESHOOTING.md`](./TROUBLESHOOTING.md)

package/docs/MCP.md

@@ -0,0 +1,126 @@
+# ForgeLoop MCP
+
+The `@cassiomc1/forgeloop-mcp` package is a **local-first MCP adapter** over
+the canonical ForgeLoop integration API (`@cassiomc1/forgeloop/integration`).
+It is an **adapter, never a second implementation**: every tool call executes
+a canonical ForgeLoop command and every ownership value comes from the
+canonical claim resolver.
+
+Two transports ship in one package:
+
+- `forgeloop-mcp` — **stdio**, the default/recommended transport;
+- `forgeloop-mcp-http` — **optional** strict-modern MCP 2026 HTTP,
+  loopback-only (remote access is unsupported).
+
+## Core principles
+
+- **No duplicated protocol logic.** The server contains no lifecycle,
+  ownership, recovery, lock, or transaction code.
+- **No direct protocol-state access.** The adapter never reads or writes
+  `.forgeloop` files; all mutation flows through ForgeLoop's own guards
+  (locks, transactions, revision checks, ledger append serialization).
+- **`COMPLETE` is not enough.** Claim release is presented exactly as the
+  canonical resolver reports it; forged COMPLETE stays INCONSISTENT with
+  historical claims retained.
+- **Recovery acknowledgement is not authorization.** `acknowledgeRecovery`
+  in tool input only satisfies ForgeLoop's caller acknowledgement after the
+  server was started with recovery capability.
+
+## Modes
+
+| Mode | Read | Loop mutations | task-resume | External | Maintenance | Recovery | Legacy repair | Force |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| `readonly` | yes | no | no | no | no | no | no | no |
+| `safe` (default) | yes | yes | yes | no | no | no | no | no |
+| `full` | yes | yes | yes | opt-in | opt-in | opt-in | opt-in | opt-in |
+
+Capability flags (process-scoped, immutable after launch):
+`--allow-external-execution`, `--allow-maintenance`, `--allow-recovery`,
+`--allow-legacy-repair`, `--allow-force-recovery`.
+
+## Resources
+
+- `forgeloop://protocol/info`
+- `forgeloop://project/tasks`
+- `forgeloop://task/{taskId}/status`
+- `forgeloop://task/{taskId}/ownership` — canonical validated ownership
+- `forgeloop://task/{taskId}/contract`
+- `forgeloop://task/{taskId}/continuity`
+
+Raw recovery artifacts, transaction journals, lock files, and unbounded event
+ledgers are intentionally not exposed.
+
+## Optional stateless HTTP transport
+
+`forgeloop-mcp-http` serves the same deterministic catalog over the **strict
+modern** stateless MCP 2026 model (legacy-era traffic rejected):
+
+```bash
+forgeloop-mcp-http --project /repo --mode safe          # 127.0.0.1:3333
+```
+
+- **Loopback only**: non-loopback binds fail closed with
+  `E_MCP_REMOTE_NOT_SUPPORTED`. Authenticated remote access is not designed
+  yet; Host validation is DNS-rebinding defense, not authentication.
+- Strict modern: legacy-era handshakes are rejected, never silently served.
+- Stateless: no session identity is issued, so transport metadata is never
+  ForgeLoop authority.
+- Resource bounds: 4 MiB body cap, POST-only, header/request/keepalive
+  timeouts, in-flight ceiling (503 `E_MCP_HTTP_BUSY`).
+
+## Version matrix
+
+| Component | Current contract |
+| --- | --- |
+| ForgeLoop core package | `1.5.x` repository generation |
+| ForgeLoop protocol | `1` |
+| Integration API | `1` |
+| MCP package | `0.1.x` initial package |
+| MCP protocol target | `2026-07-28` |
+
+Repository implementation is separate from npm publication; nothing here
+claims a published release.
+
+## Risk classes and gating examples
+
+Invocations are classified at the adapter boundary:
+
+```text
+READ_ONLY · LOOP_MUTATION · CLAIM_REACQUISITION · EXTERNAL_EXECUTION
+MAINTENANCE · CLAIM_RELEASE_RECOVERY · LEGACY_MIGRATION · FORCE_DESTRUCTIVE
+```
+
+Examples: `bundle` → MAINTENANCE (hidden in readonly/safe);
+`task-resume` → CLAIM_REACQUISITION (available in safe — canonical claim
+reacquisition); `task-recover` → CLAIM_RELEASE_RECOVERY (full +
+`--allow-recovery`, plus the canonical acknowledgement); legacy repair →
+separately gated/hidden; force unlock → separately gated. Tool input can
+never elevate launch policy.
+
+## Bounds and timeouts
+
+- Structured MCP input is byte-bounded (`E_MCP_INPUT_TOO_LARGE`).
+- External execution cannot exceed the server launch timeout maximum:
+  omitted/null timeout receives the maximum; `0`, negative, non-integer, or
+  above-maximum values are refused.
+- Tool, capabilities and resource output is bounded using the exact UTF-8
+  serialization actually transmitted. Oversized output fails closed with
+  `E_MCP_RESULT_TOO_LARGE` and is never silently truncated.
+
+## Adapter errors
+
+Adapter-level errors are separate from the generated ForgeLoop core error
+list in [TROUBLESHOOTING](./TROUBLESHOOTING.md):
+
+| Code | Meaning |
+| --- | --- |
+| `E_MCP_INPUT_TOO_LARGE` | structured tool input exceeds the byte bound |
+| `E_MCP_RESULT_TOO_LARGE` | serialized output exceeds the output bound |
+| `E_MCP_HTTP_BUSY` | in-flight HTTP ceiling reached (503, Retry-After) |
+| `E_MCP_REMOTE_NOT_SUPPORTED` | non-loopback bind attempted |
+| `E_MCP_EXECUTION_TIMEOUT_INVALID` | timeout not a positive integer |
+| `E_MCP_EXECUTION_TIMEOUT_EXCEEDS_LIMIT` | timeout above server maximum |
+| `E_MCP_FORGELOOP_INTEGRATION_UNSUPPORTED` | installed core integration API mismatch |
+
+Canonical ForgeLoop errors (e.g. `E_TASK_SCOPE_CONFLICT`,
+`E_TASK_CLAIM_OWNERSHIP_INCONSISTENT`) are always preserved verbatim.