@gajae-code/coding-agent 0.2.5 → 0.3.1

package/src/gjc-runtime/state-runtime.ts

@@ -1,4 +1,3 @@
-import { randomBytes } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import type { WorkflowHudSummary } from "../skill-state/active-state";
@@ -18,11 +17,42 @@ import {
 	buildUltragoalHudSummary,
 } from "../skill-state/workflow-hud";
 import {
+	type AuditEntry,
 	buildWorkflowStateReceipt,
 	canonicalWorkflowSkill,
 	describeWorkflowStateContract,
+	WORKFLOW_STATE_VERSION,
 	type WorkflowStateReceipt,
 } from "../skill-state/workflow-state-contract";
+import { renderCliWriteReceipt } from "./cli-write-receipt";
+import { renderStateGraph, type StateGraphFormat } from "./state-graph";
+import { migrateAndPersistLegacyState, migrateWorkflowState } from "./state-migrations";
+import {
+	buildStateStatusSummary,
+	compactProjectStateJson,
+	projectStateFields,
+	renderContractMarkdown,
+	renderHistoryMarkdown,
+	renderStateMarkdown,
+	renderStateStatusLine,
+	STATE_FIELD_ALLOWLIST,
+	type StateProjectionField,
+} from "./state-renderer";
+import { validateWorkflowStateEnvelope } from "./state-validation";
+import {
+	appendAuditEntry,
+	beginWorkflowTransactionJournal,
+	completeWorkflowTransactionJournal,
+	detectWorkflowEnvelopeIntegrityMismatch,
+	type GenericHardPruneTarget,
+	hardPrune,
+	readExistingStateForMutation,
+	type StateWriterAuditContext,
+	softDelete,
+	updateWorkflowTransactionJournal,
+	writeWorkflowEnvelopeAtomic,
+} from "./state-writer";
+import { getSkillManifest, isKnownWorkflowState, isValidTransition, typedArgsFor } from "./workflow-manifest";
 
 /**
  * Native implementation of the `gjc state read|write|clear` command surface.
@@ -62,11 +92,104 @@ function hasFlag(args: readonly string[], flag: string): boolean {
 	return args.includes(flag);
 }
 
-const FLAGS_WITH_VALUES = new Set(["--input", "--mode", "--session-id", "--thread-id", "--turn-id", "--to"]);
-const ACTION_NAMES = new Set(["read", "write", "clear", "contract", "handoff"]);
+const GRAPH_FORMATS = new Set(["ascii", "mermaid", "dot"]);
+const FLAGS_WITH_VALUES = new Set([
+	"--input",
+	"--mode",
+	"--session-id",
+	"--thread-id",
+	"--turn-id",
+	"--to",
+	"--skill",
+	"--format",
+	"--older-than",
+	"--status",
+	"--fields",
+	"--since",
+	"--limit",
+]);
+const ACTION_NAMES = new Set([
+	"read",
+	"write",
+	"clear",
+	"contract",
+	"handoff",
+	"graph",
+	"prune",
+	"gc",
+	"migrate",
+	"status",
+	"doctor",
+]);
+const BOOLEAN_FLAGS = new Set([
+	"--json",
+	"--replace",
+	"--hard",
+	"--dry-run",
+	"--migrate",
+	"--compact",
+	"--history",
+	"--force",
+]);
+const VERB_SPECIFIC_FLAGS = new Set([
+	"--skill",
+	"--format",
+	"--older-than",
+	"--status",
+	"--fields",
+	"--since",
+	"--limit",
+	"--history",
+]);
+
+function flagName(arg: string): string | undefined {
+	if (!arg.startsWith("--")) return undefined;
+	const equalsIndex = arg.indexOf("=");
+	return equalsIndex >= 0 ? arg.slice(0, equalsIndex) : arg;
+}
+
+function manifestFlagNames(action: ParsedInvocation["action"], positionalSkill: string | undefined): Set<string> {
+	const names = new Set<string>();
+	const skills =
+		positionalSkill && KNOWN_MODES.includes(positionalSkill)
+			? [positionalSkill as CanonicalGjcWorkflowSkill]
+			: CANONICAL_GJC_WORKFLOW_SKILLS;
+	for (const skill of skills) {
+		for (const arg of typedArgsFor(skill, action)) names.add(`--${arg.name}`);
+	}
+	return names;
+}
+
+function assertKnownFlags(args: readonly string[], parsed: ParsedInvocation): void {
+	const manifestFlags = manifestFlagNames(parsed.action, parsed.positionalSkill);
+	for (const arg of args) {
+		const flag = flagName(arg);
+		if (!flag) continue;
+		if (
+			FLAGS_WITH_VALUES.has(flag) ||
+			BOOLEAN_FLAGS.has(flag) ||
+			VERB_SPECIFIC_FLAGS.has(flag) ||
+			manifestFlags.has(flag)
+		) {
+			continue;
+		}
+		throw new StateCommandError(2, `unknown gjc state flag: ${flag}`);
+	}
+}
 
 interface ParsedInvocation {
-	action: "read" | "write" | "clear" | "contract" | "handoff";
+	action:
+		| "read"
+		| "write"
+		| "clear"
+		| "contract"
+		| "handoff"
+		| "graph"
+		| "prune"
+		| "gc"
+		| "migrate"
+		| "status"
+		| "doctor";
 	positionalSkill?: string;
 }
 
@@ -90,7 +213,7 @@ function parsePositionalArgs(args: readonly string[]): ParsedInvocation {
 	const first = positional[0];
 	const second = positional[1];
 	if (first && ACTION_NAMES.has(first)) {
-		return { action: first as ParsedInvocation["action"] };
+		return { action: first as ParsedInvocation["action"], positionalSkill: second };
 	}
 	if (first && second && ACTION_NAMES.has(second)) {
 		return { action: second as ParsedInvocation["action"], positionalSkill: first };
@@ -236,15 +359,441 @@ async function readJsonFile(filePath: string): Promise<Record<string, unknown> |
 	} catch (error) {
 		const err = error as NodeJS.ErrnoException;
 		if (err.code === "ENOENT") return null;
-		throw new StateCommandError(1, `failed to read ${filePath}: ${err.message}`);
+		process.stderr.write(`WARNING: failed to read ${filePath}; ignoring corrupt state: ${err.message}\n`);
+		return null;
+	}
+}
+
+async function readJsonValue(filePath: string): Promise<unknown | null> {
+	try {
+		return JSON.parse(await fs.readFile(filePath, "utf-8"));
+	} catch (error) {
+		const err = error as NodeJS.ErrnoException;
+		if (err.code === "ENOENT") return null;
+		process.stderr.write(`WARNING: failed to read ${filePath}; ignoring corrupt state: ${err.message}\n`);
+		return null;
+	}
+}
+
+type DoctorProblemType = "orphan_journal" | "checksum_mismatch" | "schema_violation" | "stale_active_state";
+
+interface DoctorProblem {
+	type: DoctorProblemType;
+	skill?: CanonicalGjcWorkflowSkill;
+	path: string;
+	message: string;
+	fixCommand: string;
+}
+
+interface DoctorSummary {
+	ok: boolean;
+	root: string;
+	summary: {
+		skills_scanned: number;
+		files_scanned: number;
+		journals_scanned: number;
+		findings_total: number;
+		by_kind: Record<DoctorProblemType, number>;
+	};
+	problems: DoctorProblem[];
+}
+
+async function readRawJson(filePath: string): Promise<{ exists: boolean; value?: unknown; error?: string }> {
+	try {
+		return { exists: true, value: JSON.parse(await fs.readFile(filePath, "utf-8")) };
+	} catch (error) {
+		const err = error as NodeJS.ErrnoException;
+		if (err.code === "ENOENT") return { exists: false };
+		return { exists: true, error: err.message };
+	}
+}
+
+async function listJsonFiles(dir: string): Promise<string[]> {
+	let entries: string[];
+	try {
+		entries = await fs.readdir(dir);
+	} catch (error) {
+		const err = error as NodeJS.ErrnoException;
+		if (err.code === "ENOENT") return [];
+		throw error;
 	}
+	return entries
+		.filter(entry => entry.endsWith(".json"))
+		.sort()
+		.map(entry => path.join(dir, entry));
 }
 
-async function writeJsonAtomic(filePath: string, value: unknown): Promise<void> {
-	await fs.mkdir(path.dirname(filePath), { recursive: true });
-	const tmp = `${filePath}.tmp-${randomBytes(6).toString("hex")}`;
-	await fs.writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`);
-	await fs.rename(tmp, filePath);
+function doctorProblem(
+	type: DoctorProblemType,
+	pathValue: string,
+	message: string,
+	fixCommand: string,
+	skill?: CanonicalGjcWorkflowSkill,
+): DoctorProblem {
+	return skill
+		? { type, skill, path: pathValue, message, fixCommand }
+		: { type, path: pathValue, message, fixCommand };
+}
+
+function activeEntryDir(cwd: string, sessionId: string | undefined): string {
+	return path.join(stateDirFor(cwd, sessionId), "active");
+}
+
+function skillFromActiveValue(value: unknown): string | undefined {
+	return isPlainObject(value) && typeof value.skill === "string" ? value.skill : undefined;
+}
+
+function activeFlag(value: unknown): boolean {
+	return isPlainObject(value) && value.active !== false;
+}
+
+async function collectDoctorSummary(
+	cwd: string,
+	skill: CanonicalGjcWorkflowSkill | undefined,
+	sessionId: string | undefined,
+): Promise<DoctorSummary> {
+	const root = path.join(cwd, ".gjc", "state");
+	const skills = skill ? [skill] : [...CANONICAL_GJC_WORKFLOW_SKILLS];
+	const problems: DoctorProblem[] = [];
+	let filesScanned = 0;
+	let journalsScanned = 0;
+
+	for (const currentSkill of skills) {
+		const filePath = modeStateFile(cwd, currentSkill, sessionId);
+		const raw = await readRawJson(filePath);
+		if (!raw.exists) continue;
+		filesScanned += 1;
+		if (raw.error) {
+			problems.push(
+				doctorProblem(
+					"schema_violation",
+					filePath,
+					`mode-state JSON is unreadable: ${raw.error}`,
+					`gjc state ${currentSkill} migrate`,
+					currentSkill,
+				),
+			);
+			continue;
+		}
+		const validation = validateWorkflowStateEnvelope(currentSkill, raw.value);
+		if (!validation.valid) {
+			problems.push(
+				doctorProblem(
+					"schema_violation",
+					filePath,
+					validation.error ?? `invalid ${currentSkill} state envelope`,
+					`gjc state ${currentSkill} migrate`,
+					currentSkill,
+				),
+			);
+		}
+		const mismatch = await detectWorkflowEnvelopeIntegrityMismatch(filePath);
+		if (mismatch) {
+			problems.push(
+				doctorProblem(
+					"checksum_mismatch",
+					filePath,
+					`expected sha256 ${mismatch.expected} but found ${mismatch.actual}`,
+					`gjc state ${currentSkill} migrate`,
+					currentSkill,
+				),
+			);
+		}
+	}
+
+	const journalFiles = await listJsonFiles(path.join(root, "transactions"));
+	for (const journalPath of journalFiles) {
+		journalsScanned += 1;
+		const raw = await readRawJson(journalPath);
+		const value = raw.value;
+		const status = isPlainObject(value) && typeof value.status === "string" ? value.status : undefined;
+		const paths =
+			isPlainObject(value) && Array.isArray(value.paths) ? value.paths.filter(p => typeof p === "string") : [];
+		const hasLiveMutation = status === "pending" && paths.some(filePath => path.resolve(filePath).startsWith(root));
+		if (!hasLiveMutation) {
+			problems.push(
+				doctorProblem(
+					"orphan_journal",
+					journalPath,
+					"transaction journal has no matching live mutation",
+					"gjc state prune --hard",
+				),
+			);
+		}
+	}
+
+	const inspectActiveScope = async (scopeSessionId: string | undefined): Promise<void> => {
+		const snapshotPath = activeStateFile(cwd, scopeSessionId);
+		const snapshot = await readRawJson(snapshotPath);
+		if (snapshot.exists) filesScanned += 1;
+		const entryFiles = await listJsonFiles(activeEntryDir(cwd, scopeSessionId));
+		const entrySkills = new Set<string>();
+		for (const entryPath of entryFiles) {
+			filesScanned += 1;
+			const entry = await readRawJson(entryPath);
+			const entrySkill = skillFromActiveValue(entry.value) ?? path.basename(entryPath, ".json");
+			entrySkills.add(entrySkill);
+			const canonical = canonicalWorkflowSkill(entrySkill);
+			if (canonical && !skills.includes(canonical)) continue;
+			const statePath = canonical
+				? modeStateFile(cwd, canonical, scopeSessionId)
+				: path.join(root, `${entrySkill}-state.json`);
+			const state = await readRawJson(statePath);
+			if (activeFlag(entry.value) && (!state.exists || !activeFlag(state.value))) {
+				problems.push(
+					doctorProblem(
+						"stale_active_state",
+						entryPath,
+						`active entry for ${entrySkill} does not match a live active mode-state`,
+						canonical ? `gjc state ${canonical} clear` : "gjc state prune --hard",
+						canonical ?? undefined,
+					),
+				);
+			}
+		}
+		if (isPlainObject(snapshot.value)) {
+			const activeSkills = Array.isArray(snapshot.value.active_skills) ? snapshot.value.active_skills : [];
+			for (const entry of activeSkills) {
+				const entrySkill = skillFromActiveValue(entry);
+				if (!entrySkill) continue;
+				const canonical = canonicalWorkflowSkill(entrySkill);
+				if (canonical && !skills.includes(canonical)) continue;
+				if (activeFlag(entry) && !entrySkills.has(entrySkill)) {
+					problems.push(
+						doctorProblem(
+							"stale_active_state",
+							snapshotPath,
+							`active snapshot lists ${entrySkill} but no raw per-skill active entry exists`,
+							canonical ? `gjc state ${canonical} clear` : "gjc state prune --hard",
+							canonical ?? undefined,
+						),
+					);
+				}
+			}
+		}
+	};
+
+	await inspectActiveScope(sessionId);
+	if (!sessionId) {
+		const sessionsDir = path.join(root, "sessions");
+		let sessions: string[] = [];
+		try {
+			const entries = await fs.readdir(sessionsDir, { withFileTypes: true });
+			sessions = entries
+				.filter(entry => entry.isDirectory())
+				.map(entry => entry.name)
+				.sort();
+		} catch (error) {
+			const err = error as NodeJS.ErrnoException;
+			if (err.code !== "ENOENT") throw error;
+		}
+		for (const rawSession of sessions) await inspectActiveScope(decodeURIComponent(rawSession));
+	}
+
+	problems.sort(
+		(a, b) =>
+			a.type.localeCompare(b.type) || (a.skill ?? "").localeCompare(b.skill ?? "") || a.path.localeCompare(b.path),
+	);
+	const byKind: Record<DoctorProblemType, number> = {
+		orphan_journal: 0,
+		checksum_mismatch: 0,
+		schema_violation: 0,
+		stale_active_state: 0,
+	};
+	for (const problem of problems) byKind[problem.type] += 1;
+	return {
+		ok: problems.length === 0,
+		root,
+		summary: {
+			skills_scanned: skills.length,
+			files_scanned: filesScanned,
+			journals_scanned: journalsScanned,
+			findings_total: problems.length,
+			by_kind: byKind,
+		},
+		problems,
+	};
+}
+
+function renderDoctorText(summary: DoctorSummary): string {
+	const lines = [
+		`ok: ${summary.ok}`,
+		`root: ${summary.root}`,
+		`skills_scanned: ${summary.summary.skills_scanned}`,
+		`files_scanned: ${summary.summary.files_scanned}`,
+		`journals_scanned: ${summary.summary.journals_scanned}`,
+		`findings_total: ${summary.summary.findings_total}`,
+		`counts: ${Object.entries(summary.summary.by_kind)
+			.map(([kind, count]) => `${kind}=${count}`)
+			.join(", ")}`,
+	];
+	for (const problem of summary.problems) {
+		lines.push(
+			`finding: kind=${problem.type} skill=${problem.skill ?? "-"} path=${problem.path} message=${problem.message} fix=${problem.fixCommand}`,
+		);
+	}
+	return `${lines.join("\n")}\n`;
+}
+
+async function handleDoctor(
+	args: readonly string[],
+	cwd: string,
+	positionalSkill: string | undefined,
+): Promise<StateCommandResult> {
+	const rawSkill = flagValue(args, "--skill")?.trim() || flagValue(args, "--mode")?.trim() || positionalSkill?.trim();
+	if (rawSkill) assertKnownMode(rawSkill);
+	const sessionId = flagValue(args, "--session-id")?.trim() || undefined;
+	if (sessionId) assertSafePathComponent(sessionId, "session-id");
+	const summary = await collectDoctorSummary(cwd, rawSkill as CanonicalGjcWorkflowSkill | undefined, sessionId);
+	return {
+		status: summary.ok ? 0 : 1,
+		stdout: hasFlag(args, "--json") ? `${JSON.stringify(summary, null, 2)}\n` : renderDoctorText(summary),
+	};
+}
+
+async function warnAndAuditOutOfBandIfNeeded(
+	cwd: string,
+	filePath: string,
+	skill: CanonicalGjcWorkflowSkill,
+	options?: { mutationId?: string; forced?: boolean },
+): Promise<string | undefined> {
+	let mismatch: Awaited<ReturnType<typeof detectWorkflowEnvelopeIntegrityMismatch>>;
+	try {
+		mismatch = await detectWorkflowEnvelopeIntegrityMismatch(filePath);
+	} catch {
+		// Unparseable/corrupt state has no recoverable checksum to compare; the strict
+		// mutation reader already gates unforced overwrites, so fail-open here.
+		return undefined;
+	}
+	if (!mismatch) return undefined;
+	const message = `WARNING: workflow mode-state out-of-band edit detected for ${skill}: ${filePath} expected sha256 ${mismatch.expected} but found ${mismatch.actual}`;
+	await appendAuditEntry(cwd, {
+		ts: new Date().toISOString(),
+		skill,
+		category: "state",
+		verb: "out_of_band_detected",
+		owner: "gjc-state-cli",
+		mutation_id: options?.mutationId ?? `${skill}:out-of-band:${new Date().toISOString()}`,
+		forced: options?.forced ?? false,
+		paths: [filePath],
+		expected_sha256: mismatch.expected,
+		actual_sha256: mismatch.actual,
+	} as AuditEntry);
+	return message;
+}
+
+async function writeJsonAtomic(
+	cwd: string,
+	filePath: string,
+	value: unknown,
+	verb: "write" | "clear" | "handoff" = "write",
+	options?: {
+		skill?: CanonicalGjcWorkflowSkill;
+		mutationId?: string;
+		force?: boolean;
+		fromPhase?: string;
+		toPhase?: string;
+	},
+): Promise<{ warning?: string; stamped: Record<string, unknown> }> {
+	const warning = options?.skill
+		? await warnAndAuditOutOfBandIfNeeded(cwd, filePath, options.skill, {
+				mutationId: options.mutationId,
+				forced: options.force ?? false,
+			})
+		: undefined;
+	if (warning && !options?.force) {
+		throw new StateCommandError(2, `${warning}; use --force to overwrite tampered mode-state`);
+	}
+	await writeWorkflowEnvelopeAtomic(filePath, value, {
+		cwd,
+		audit: {
+			category: "state",
+			verb,
+			owner: "gjc-state-cli",
+			skill: options?.skill,
+			mutationId: options?.mutationId,
+			fromPhase: options?.fromPhase,
+			toPhase: options?.toPhase,
+			forced: options?.force ?? false,
+		},
+	});
+	return { warning, stamped: (await readJsonFile(filePath)) ?? {} };
+}
+
+function parseFieldsFlag(args: readonly string[]): StateProjectionField[] | undefined {
+	const raw = flagValue(args, "--fields");
+	if (raw === undefined) return undefined;
+	const allowed = new Set<string>(STATE_FIELD_ALLOWLIST);
+	const fields = raw
+		.split(",")
+		.map(field => field.trim())
+		.filter(Boolean);
+	const unknown = fields.filter(field => !allowed.has(field));
+	if (unknown.length) {
+		throw new StateCommandError(
+			2,
+			`unknown --fields value(s): ${unknown.join(", ")}. Allowed fields: ${STATE_FIELD_ALLOWLIST.join(", ")}`,
+		);
+	}
+	return fields as StateProjectionField[];
+}
+
+function parseLimitFlag(args: readonly string[], defaultLimit = 50): number {
+	const raw = flagValue(args, "--limit");
+	if (raw === undefined) return defaultLimit;
+	const parsed = Number(raw);
+	if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 500) {
+		throw new StateCommandError(2, "gjc state --limit requires an integer from 1 to 500");
+	}
+	return parsed;
+}
+
+function parseSinceFlag(args: readonly string[]): string | undefined {
+	const raw = flagValue(args, "--since")?.trim();
+	if (!raw) return undefined;
+	const duration = raw.match(/^(\d+)(m|h|d)$/);
+	if (duration) {
+		const amount = Number(duration[1]);
+		const unit = duration[2];
+		const multiplier = unit === "m" ? 60_000 : unit === "h" ? 3_600_000 : 86_400_000;
+		return new Date(Date.now() - amount * multiplier).toISOString();
+	}
+	if (Number.isNaN(Date.parse(raw)))
+		throw new StateCommandError(2, "gjc state --since requires an ISO timestamp or duration like 30m, 6h, 7d");
+	return new Date(raw).toISOString();
+}
+
+async function readAuditWindow(
+	cwd: string,
+	args: readonly string[],
+): Promise<{ entries: unknown[]; limit: number; since?: string; truncated: boolean }> {
+	const limit = parseLimitFlag(args);
+	const since = parseSinceFlag(args);
+	const auditPath = path.join(cwd, ".gjc", "state", "audit.jsonl");
+	let raw = "";
+	try {
+		raw = await fs.readFile(auditPath, "utf-8");
+	} catch (error) {
+		const err = error as NodeJS.ErrnoException;
+		if (err.code !== "ENOENT") throw error;
+	}
+	const selected: unknown[] = [];
+	let matched = 0;
+	const lines = raw.split(/\r?\n/).filter(line => line.trim().length > 0);
+	for (let index = lines.length - 1; index >= 0; index -= 1) {
+		const line = lines[index];
+		let entry: unknown;
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (since && isPlainObject(entry) && typeof entry.ts === "string" && Date.parse(entry.ts) < Date.parse(since))
+			break;
+		matched += 1;
+		if (selected.length < limit) selected.push(entry);
+	}
+	return { entries: selected.reverse(), limit, ...(since ? { since } : {}), truncated: matched > limit };
 }
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
@@ -408,6 +957,14 @@ async function syncWorkflowSkillState(options: {
 		// HUD sync is best-effort and must not change command semantics.
 	}
 }
+export async function readWorkflowStateJson(
+	cwd: string,
+	skill: CanonicalGjcWorkflowSkill,
+	sessionId?: string,
+): Promise<Record<string, unknown>> {
+	return (await readJsonFile(modeStateFile(cwd, skill, sessionId))) ?? {};
+}
+
 async function handleRead(
 	args: readonly string[],
 	cwd: string,
@@ -415,19 +972,70 @@ async function handleRead(
 ): Promise<StateCommandResult> {
 	const selectors = await resolveSelectors(args, cwd, positionalSkill);
 	const mode = selectors.mode ?? (await inferModeFromActiveState(cwd, selectors.sessionId));
+	const fields = parseFieldsFlag(args);
 	if (mode) {
 		const filePath = modeStateFile(cwd, mode, selectors.sessionId);
-		const existing = await readJsonFile(filePath);
+		const existing = await readWorkflowStateJson(cwd, mode, selectors.sessionId);
+		const envelope = { skill: mode, state: existing, storage_path: filePath };
+		const manifest = getSkillManifest(mode);
+		if (fields) {
+			const projected = projectStateFields(mode, envelope, manifest, fields);
+			return {
+				status: 0,
+				stdout: hasFlag(args, "--json")
+					? `${JSON.stringify(projected, null, 2)}\n`
+					: renderStateMarkdown(mode, projected, manifest),
+			};
+		}
+		if (hasFlag(args, "--compact")) {
+			const compact = compactProjectStateJson(mode, envelope, manifest);
+			return {
+				status: 0,
+				stdout: hasFlag(args, "--json")
+					? `${JSON.stringify(compact, null, 2)}\n`
+					: renderStateMarkdown(mode, envelope, manifest),
+			};
+		}
 		return {
 			status: 0,
-			stdout: `${JSON.stringify({ skill: mode, state: existing, storage_path: filePath }, null, 2)}\n`,
+			stdout: hasFlag(args, "--json")
+				? `${JSON.stringify(envelope, null, 2)}\n`
+				: renderStateMarkdown(mode, envelope, manifest),
 		};
 	}
 	const filePath = activeStateFile(cwd, selectors.sessionId);
-	const existing = await readJsonFile(filePath);
+	const existingRaw = await readJsonValue(filePath);
+	const existing = isPlainObject(existingRaw) ? existingRaw : null;
 	return { status: 0, stdout: `${JSON.stringify(existing ?? {}, null, 2)}\n` };
 }
 
+async function handleStatus(
+	args: readonly string[],
+	cwd: string,
+	positionalSkill: string | undefined,
+): Promise<StateCommandResult> {
+	const selectors = await resolveSelectors(args, cwd, positionalSkill);
+	const mode = selectors.mode ?? (await inferModeFromActiveState(cwd, selectors.sessionId));
+	if (!mode) {
+		throw new StateCommandError(
+			2,
+			"gjc state status requires --mode <skill>, positional <skill>, input.skill, or an active workflow in .gjc/state/skill-active-state.json",
+		);
+	}
+	const filePath = modeStateFile(cwd, mode, selectors.sessionId);
+	const existing = await readWorkflowStateJson(cwd, mode, selectors.sessionId);
+	const summary = buildStateStatusSummary(
+		mode,
+		{ skill: mode, state: existing, storage_path: filePath },
+		getSkillManifest(mode),
+		filePath,
+	);
+	return {
+		status: 0,
+		stdout: hasFlag(args, "--json") ? `${JSON.stringify(summary, null, 2)}\n` : renderStateStatusLine(summary),
+	};
+}
+
 async function handleWrite(
 	args: readonly string[],
 	cwd: string,
@@ -444,8 +1052,17 @@ async function handleWrite(
 		);
 
 	const filePath = modeStateFile(cwd, mode, sessionId);
-	const existing = await readJsonFile(filePath);
+	const forced = hasFlag(args, "--force");
+	const existingRead = await readExistingStateForMutation(filePath);
+	if (existingRead.kind === "corrupt" && !forced) {
+		throw new StateCommandError(
+			2,
+			`existing state for ${mode} is corrupt or tampered (${existingRead.error}); use --force to overwrite`,
+		);
+	}
+	const existingPayload = existingRead.kind === "valid" ? existingRead.value : {};
 	const nowIsoStr = nowIso();
+	const mutationId = `${mode}:${nowIsoStr}`;
 	const receipt = buildWorkflowStateReceipt({
 		cwd,
 		skill: mode,
@@ -453,8 +1070,8 @@ async function handleWrite(
 		command: `gjc state ${mode} write`,
 		sessionId,
 		nowIso: nowIsoStr,
+		mutationId,
 	});
-	const existingPayload = existing ?? {};
 	const innerState = (payload.state as Record<string, unknown> | undefined) ?? {};
 	const incomingPhase =
 		typeof payload.current_phase === "string" && payload.current_phase.trim()
@@ -476,19 +1093,53 @@ async function handleWrite(
 			delete merged.state;
 		}
 	}
+	const preDefaultValidation = validateWorkflowStateEnvelope(mode, merged);
+	if (!preDefaultValidation.valid) {
+		throw new StateCommandError(2, preDefaultValidation.error ?? `invalid ${mode} state envelope`);
+	}
 	merged.skill = mode;
 	if (incomingPhase) {
 		merged.current_phase = incomingPhase;
-	} else if (typeof merged.current_phase !== "string") {
-		merged.current_phase =
-			typeof existingPayload.current_phase === "string" ? existingPayload.current_phase : "active";
+	} else if (typeof merged.current_phase !== "string" || !merged.current_phase.trim()) {
+		const retainedPhase =
+			typeof existingPayload.current_phase === "string" ? existingPayload.current_phase.trim() : "";
+		merged.current_phase = retainedPhase || initialPhaseForSkill(mode);
+	} else {
+		merged.current_phase = merged.current_phase.trim();
 	}
-	if (typeof merged.version !== "number") merged.version = 1;
+	merged.version = WORKFLOW_STATE_VERSION;
 	if (typeof merged.active !== "boolean") merged.active = true;
 	merged.updated_at = nowIsoStr;
 	merged.receipt = receipt;
 	if (sessionId && typeof merged.session_id !== "string") merged.session_id = sessionId;
-	await writeJsonAtomic(filePath, merged);
+
+	const fromPhase =
+		typeof existingPayload.current_phase === "string" ? existingPayload.current_phase.trim() : undefined;
+	const toPhase = merged.current_phase as string;
+	const manifestStates = new Set(getSkillManifest(mode).states.map(state => state.id));
+	if (!manifestStates.has(toPhase) && !forced) {
+		throw new StateCommandError(2, `unknown ${mode} phase "${toPhase}"; use --force to bypass`);
+	}
+	if (fromPhase && toPhase && isKnownWorkflowState(mode, fromPhase) && isKnownWorkflowState(mode, toPhase)) {
+		if (!isValidTransition(mode, fromPhase, toPhase) && !forced) {
+			throw new StateCommandError(
+				2,
+				`invalid ${mode} phase transition from ${fromPhase} to ${toPhase}; use --force to bypass`,
+			);
+		}
+	}
+
+	const validation = validateWorkflowStateEnvelope(mode, merged);
+	if (!validation.valid) throw new StateCommandError(2, validation.error ?? `invalid ${mode} state envelope`);
+
+	const { warning: outOfBandWarning, stamped } = await writeJsonAtomic(cwd, filePath, merged, "write", {
+		skill: mode,
+		mutationId,
+		force: forced,
+		fromPhase,
+		toPhase,
+	});
+	const stampedReceipt = isPlainObject(stamped.receipt) ? stamped.receipt : {};
 
 	const phase = typeof merged.current_phase === "string" ? merged.current_phase : undefined;
 	const active = merged.active !== false;
@@ -496,7 +1147,17 @@ async function handleWrite(
 
 	return {
 		status: 0,
-		stdout: `${JSON.stringify({ skill: mode, state: merged, receipt }, null, 2)}\n`,
+		stdout: renderCliWriteReceipt({
+			ok: true,
+			skill: mode,
+			state_path: filePath,
+			current_phase: phase,
+			active,
+			mutation_id: typeof stampedReceipt.mutation_id === "string" ? stampedReceipt.mutation_id : mutationId,
+			status: typeof stampedReceipt.status === "string" ? stampedReceipt.status : undefined,
+			content_sha256: stampedReceipt.content_sha256,
+		}),
+		...(outOfBandWarning ? { stderr: `${outOfBandWarning}\n` } : {}),
 	};
 }
 
@@ -515,14 +1176,44 @@ async function handleClear(
 		);
 
 	const filePath = modeStateFile(cwd, mode, sessionId);
-	const existing = (await readJsonFile(filePath)) ?? {};
+	const forced = hasFlag(args, "--force");
+	const existingRead = await readExistingStateForMutation(filePath);
+	if (existingRead.kind === "corrupt" && !forced) {
+		throw new StateCommandError(
+			2,
+			`existing state for ${mode} is corrupt or tampered (${existingRead.error}); use --force to overwrite`,
+		);
+	}
+	const existing = existingRead.kind === "valid" ? existingRead.value : {};
+	const clearedAt = nowIso();
 	const cleared: Record<string, unknown> = {
+		skill: mode,
 		...existing,
 		active: false,
 		current_phase: "complete",
-		updated_at: nowIso(),
+		updated_at: clearedAt,
+		version: WORKFLOW_STATE_VERSION,
 	};
-	await writeJsonAtomic(filePath, cleared);
+	cleared.skill = mode;
+	const mutationId = `${mode}:clear:${clearedAt}`;
+	const receipt = buildWorkflowStateReceipt({
+		cwd,
+		skill: mode,
+		owner: "gjc-state-cli",
+		command: `gjc state ${mode} clear`,
+		sessionId,
+		nowIso: clearedAt,
+		mutationId,
+	});
+	cleared.receipt = receipt;
+	const { warning: outOfBandWarning, stamped } = await writeJsonAtomic(cwd, filePath, cleared, "clear", {
+		skill: mode,
+		mutationId,
+		force: forced,
+		fromPhase: typeof existing.current_phase === "string" ? existing.current_phase : undefined,
+		toPhase: "complete",
+	});
+	const stampedReceipt = isPlainObject(stamped.receipt) ? stamped.receipt : {};
 
 	await syncWorkflowSkillState({
 		cwd,
@@ -534,8 +1225,20 @@ async function handleClear(
 		phase: "complete",
 		payload: cleared,
 	});
-
-	return { status: 0, stdout: `${JSON.stringify(cleared, null, 2)}\n` };
+	return {
+		status: 0,
+		stdout: renderCliWriteReceipt({
+			ok: true,
+			skill: mode,
+			state_path: filePath,
+			active: false,
+			current_phase: typeof cleared.current_phase === "string" ? cleared.current_phase : undefined,
+			mutation_id: typeof stampedReceipt.mutation_id === "string" ? stampedReceipt.mutation_id : mutationId,
+			status: typeof stampedReceipt.status === "string" ? stampedReceipt.status : undefined,
+			content_sha256: stampedReceipt.content_sha256,
+		}),
+		...(outOfBandWarning ? { stderr: `${outOfBandWarning}\n` } : {}),
+	};
 }
 
 /**
@@ -583,16 +1286,32 @@ async function handleHandoff(
 
 	const callerPath = modeStateFile(cwd, caller, sessionId);
 	const calleePath = modeStateFile(cwd, callee, sessionId);
-	const existingCaller = await readJsonFile(callerPath);
-	if (!existingCaller) {
+	const forced = hasFlag(args, "--force");
+	const callerRead = await readExistingStateForMutation(callerPath);
+	if (callerRead.kind === "corrupt" && !forced) {
+		throw new StateCommandError(
+			2,
+			`existing state for ${caller} is corrupt or tampered (${callerRead.error}); use --force to overwrite`,
+		);
+	}
+	if (callerRead.kind === "absent") {
 		throw new StateCommandError(
 			2,
 			`gjc state ${caller} handoff: caller is not active (no mode-state file at ${callerPath})`,
 		);
 	}
-	const existingCallee = (await readJsonFile(calleePath)) ?? {};
+	const calleeRead = await readExistingStateForMutation(calleePath);
+	if (calleeRead.kind === "corrupt" && !forced) {
+		throw new StateCommandError(
+			2,
+			`existing state for ${callee} is corrupt or tampered (${calleeRead.error}); use --force to overwrite`,
+		);
+	}
+	const existingCaller = callerRead.kind === "valid" ? callerRead.value : {};
+	const existingCallee = calleeRead.kind === "valid" ? calleeRead.value : {};
 
 	const handoffAt = nowIso();
+	const mutationId = `${caller}:handoff:${callee}:${handoffAt}`;
 	const callerReceipt = buildWorkflowStateReceipt({
 		cwd,
 		skill: caller,
@@ -600,6 +1319,7 @@ async function handleHandoff(
 		command: `gjc state ${caller} handoff --to ${callee}`,
 		sessionId,
 		nowIso: handoffAt,
+		mutationId,
 	});
 	const calleeReceipt = buildWorkflowStateReceipt({
 		cwd,
@@ -608,13 +1328,16 @@ async function handleHandoff(
 		command: `gjc state ${caller} handoff --to ${callee}`,
 		sessionId,
 		nowIso: handoffAt,
+		mutationId,
 	});
 
 	const calleeInitial = initialPhaseForSkill(callee);
+	const normalizedCaller = migrateWorkflowState(existingCaller, caller).state;
+	const normalizedCallee = migrateWorkflowState(existingCallee, callee).state;
 	const mergedCalleeState: Record<string, unknown> = {
-		...existingCallee,
+		...normalizedCallee,
 		skill: callee,
-		version: typeof existingCallee.version === "number" ? existingCallee.version : 1,
+		version: WORKFLOW_STATE_VERSION,
 		active: true,
 		current_phase: calleeInitial,
 		handoff_from: caller,
@@ -626,8 +1349,9 @@ async function handleHandoff(
 		mergedCalleeState.session_id = sessionId;
 	}
 	const mergedCallerState: Record<string, unknown> = {
-		...existingCaller,
+		...normalizedCaller,
 		skill: caller,
+		version: WORKFLOW_STATE_VERSION,
 		active: false,
 		current_phase: "handoff",
 		handoff_to: callee,
@@ -636,6 +1360,14 @@ async function handleHandoff(
 		receipt: callerReceipt,
 	};
 
+	await beginWorkflowTransactionJournal({
+		cwd,
+		mutationId,
+		caller,
+		callee,
+		paths: [calleePath, callerPath, activeStateFile(cwd, sessionId)],
+	});
+
 	// Atomic write order (architecture blocker AR-3): mode-state files first,
 	// then a single atomic active-state mutation per file (session before root)
 	// via applyHandoffToActiveState. The single-write transaction prevents the
@@ -643,8 +1375,34 @@ async function handleHandoff(
 	// and write order keeps the session-scoped source of truth ahead of the
 	// root aggregate. strict:true on the active-state read tolerates ENOENT
 	// only; corrupt JSON / IO failures propagate as non-zero CLI status.
-	await writeJsonAtomic(calleePath, mergedCalleeState);
-	await writeJsonAtomic(callerPath, mergedCallerState);
+	const force = hasFlag(args, "--force");
+	const calleeWrite = await writeJsonAtomic(cwd, calleePath, mergedCalleeState, "handoff", {
+		skill: callee,
+		mutationId,
+		force,
+		fromPhase: typeof existingCallee.current_phase === "string" ? existingCallee.current_phase : undefined,
+		toPhase: calleeInitial,
+	});
+	await updateWorkflowTransactionJournal(cwd, mutationId, { steps: ["callee-mode-state"] });
+	const callerWrite = await writeJsonAtomic(cwd, callerPath, mergedCallerState, "handoff", {
+		skill: caller,
+		mutationId,
+		force,
+		fromPhase: typeof existingCaller.current_phase === "string" ? existingCaller.current_phase : undefined,
+		toPhase: "handoff",
+	});
+	await updateWorkflowTransactionJournal(cwd, mutationId, {
+		steps: ["callee-mode-state", "caller-mode-state"],
+	});
+	const warnings = [calleeWrite.warning, callerWrite.warning].filter(
+		(warning): warning is string => typeof warning === "string",
+	);
+	const stampedCallerReceipt = isPlainObject(callerWrite.stamped.receipt) ? callerWrite.stamped.receipt : {};
+	const stampedCalleeReceipt = isPlainObject(calleeWrite.stamped.receipt) ? calleeWrite.stamped.receipt : {};
+	for (const warning of warnings) process.stderr.write(`${warning}\n`);
+	if (process.env.GJC_STATE_HANDOFF_FAIL_AFTER_CALLER === mutationId) {
+		throw new StateCommandError(1, `injected handoff failure after caller write for ${mutationId}`);
+	}
 	await applyHandoffToActiveState({
 		cwd,
 		nowIso: handoffAt,
@@ -678,20 +1436,40 @@ async function handleHandoff(
 			receipt: calleeReceipt,
 		},
 	});
+	await updateWorkflowTransactionJournal(cwd, mutationId, {
+		steps: ["callee-mode-state", "caller-mode-state", "active-state"],
+	});
+	await completeWorkflowTransactionJournal(cwd, mutationId);
 
 	return {
 		status: 0,
-		stdout: `${JSON.stringify(
-			{
-				from: caller,
-				to: callee,
-				handoff_at: handoffAt,
-				caller_state: mergedCallerState,
-				callee_state: mergedCalleeState,
+		stdout: renderCliWriteReceipt({
+			ok: true,
+			from: caller,
+			to: callee,
+			handoff_at: handoffAt,
+			phases: {
+				from: mergedCallerState.current_phase,
+				to: mergedCalleeState.current_phase,
 			},
-			null,
-			2,
-		)}\n`,
+			receipts: {
+				from: {
+					mutation_id: stampedCallerReceipt.mutation_id,
+					status: stampedCallerReceipt.status,
+					content_sha256: stampedCallerReceipt.content_sha256,
+				},
+				to: {
+					mutation_id: stampedCalleeReceipt.mutation_id,
+					status: stampedCalleeReceipt.status,
+					content_sha256: stampedCalleeReceipt.content_sha256,
+				},
+			},
+			paths: {
+				from: callerPath,
+				to: calleePath,
+				active_state: activeStateFile(cwd, sessionId),
+			},
+		}),
 	};
 }
 
@@ -705,14 +1483,333 @@ async function handleContract(
 		throw new StateCommandError(2, "gjc state contract requires --mode <skill>, positional <skill>, or input.skill");
 	}
 	const payload = { skill: mode, contract: describeWorkflowStateContract(mode) };
-	return { status: 0, stdout: `${JSON.stringify(payload, null, 2)}\n` };
+	return {
+		status: 0,
+		stdout: hasFlag(args, "--json")
+			? `${JSON.stringify(payload, null, 2)}\n`
+			: renderContractMarkdown(mode, payload.contract),
+	};
+}
+
+function parseNonNegativeIntegerFlag(args: readonly string[], flag: string): number | undefined {
+	const value = flagValue(args, flag);
+	if (value === undefined) return undefined;
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed) || parsed < 0) {
+		throw new StateCommandError(2, `gjc state ${flag} requires a non-negative integer value`);
+	}
+	return parsed;
+}
+
+function statusFromFile(value: unknown): string | undefined {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+	const record = value as Record<string, unknown>;
+	if (typeof record.status === "string") return record.status;
+	if (record.receipt && typeof record.receipt === "object" && !Array.isArray(record.receipt)) {
+		const receiptStatus = (record.receipt as Record<string, unknown>).status;
+		if (typeof receiptStatus === "string") return receiptStatus;
+	}
+	return undefined;
+}
+
+interface RetentionCandidate {
+	path: string;
+	relativePath: string;
+	category: string;
+	mtimeMs: number;
+	policy: { keep?: number; maxAgeDays?: number };
+}
+
+interface GcSummary {
+	skill: CanonicalGjcWorkflowSkill | "all";
+	dry_run: boolean;
+	eligible: string[];
+	pruned: string[];
+	counts: Record<string, number>;
+}
+
+function categoryForStateRelativePath(relativePath: string): string | undefined {
+	const normalized = relativePath.split(path.sep).join("/");
+	if (normalized === "audit.jsonl") return undefined;
+	if (normalized === SKILL_ACTIVE_STATE_FILE || normalized.endsWith(`/${SKILL_ACTIVE_STATE_FILE}`)) return undefined;
+	if (normalized.startsWith("active/") || normalized.includes("/active/")) return undefined;
+	if (
+		/^[^/]+-state\.json$/.test(normalized) ||
+		(normalized.includes("/sessions/") && /\/[^/]+-state\.json$/.test(normalized))
+	)
+		return undefined;
+	if (normalized.startsWith("artifacts/") || normalized.includes("/artifacts/")) return "artifact";
+	if (
+		normalized.startsWith("logs/") ||
+		normalized.includes("/logs/") ||
+		normalized.endsWith(".log") ||
+		normalized.endsWith(".jsonl")
+	)
+		return "log";
+	if (normalized.startsWith("reports/") || normalized.includes("/reports/")) return "report";
+	if (normalized.startsWith("ledgers/") || normalized.includes("/ledgers/")) return "ledger";
+	if (normalized.startsWith("agents/") || normalized.includes("/agents/")) return "agents";
+	if (normalized.startsWith("force/") || normalized.includes("/force/")) return "force";
+	if (
+		normalized.startsWith("prune/") ||
+		normalized.includes("/prune/") ||
+		normalized.startsWith("delete/") ||
+		normalized.includes("/delete/")
+	)
+		return "prune/delete";
+	if (normalized.startsWith("transactions/") || normalized.includes("/transactions/")) return "prune/delete";
+	return undefined;
+}
+
+async function collectRetentionCandidates(
+	cwd: string,
+	skills: readonly CanonicalGjcWorkflowSkill[],
+): Promise<RetentionCandidate[]> {
+	const stateRoot = path.join(cwd, ".gjc", "state");
+	const policies = new Map<string, { keep?: number; maxAgeDays?: number }>();
+	for (const skill of skills) {
+		for (const policy of getSkillManifest(skill).retention) {
+			const existing = policies.get(policy.category);
+			policies.set(policy.category, {
+				keep: Math.max(existing?.keep ?? 0, policy.keep ?? 0) || undefined,
+				maxAgeDays:
+					existing?.maxAgeDays === undefined
+						? policy.maxAgeDays
+						: policy.maxAgeDays === undefined
+							? existing.maxAgeDays
+							: Math.max(existing.maxAgeDays, policy.maxAgeDays),
+			});
+		}
+	}
+	const candidates: RetentionCandidate[] = [];
+	async function visit(dir: string): Promise<void> {
+		let entries: string[];
+		try {
+			entries = await fs.readdir(dir);
+		} catch (error) {
+			const err = error as NodeJS.ErrnoException;
+			if (err.code === "ENOENT") return;
+			throw error;
+		}
+		for (const entry of entries) {
+			const filePath = path.join(dir, entry);
+			const stat = await fs.stat(filePath);
+			if (stat.isDirectory()) {
+				await visit(filePath);
+				continue;
+			}
+			if (!stat.isFile()) continue;
+			const relativePath = path.relative(stateRoot, filePath);
+			const category = categoryForStateRelativePath(relativePath);
+			if (!category) continue;
+			const policy = policies.get(category);
+			if (!policy) continue;
+			candidates.push({ path: filePath, relativePath, category, mtimeMs: stat.mtimeMs, policy });
+		}
+	}
+	await visit(stateRoot);
+	return candidates;
+}
+
+function selectRetentionEligible(candidates: readonly RetentionCandidate[]): RetentionCandidate[] {
+	const now = Date.now();
+	const byCategory = new Map<string, RetentionCandidate[]>();
+	for (const candidate of candidates) {
+		const list = byCategory.get(candidate.category) ?? [];
+		list.push(candidate);
+		byCategory.set(candidate.category, list);
+	}
+	const eligible = new Set<RetentionCandidate>();
+	for (const list of byCategory.values()) {
+		list.sort((a, b) => b.mtimeMs - a.mtimeMs || a.relativePath.localeCompare(b.relativePath));
+		for (let index = 0; index < list.length; index += 1) {
+			const candidate = list[index];
+			const keep = candidate.policy.keep ?? 0;
+			if (keep > 0 && index < keep) continue;
+			if (candidate.policy.maxAgeDays !== undefined) {
+				const maxAgeMs = candidate.policy.maxAgeDays * 24 * 60 * 60 * 1000;
+				if (now - candidate.mtimeMs < maxAgeMs) continue;
+			}
+			if (candidate.policy.keep !== undefined || candidate.policy.maxAgeDays !== undefined) eligible.add(candidate);
+		}
+	}
+	return [...eligible].sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+}
+
+async function buildGcSummary(
+	args: readonly string[],
+	cwd: string,
+	positionalSkill: string | undefined,
+	dryRun: boolean,
+): Promise<GcSummary> {
+	const rawSkill =
+		flagValue(args, "--skill")?.trim() || flagValue(args, "--mode")?.trim() || positionalSkill?.trim() || "all";
+	if (rawSkill !== "all") assertKnownMode(rawSkill);
+	const skills = rawSkill === "all" ? CANONICAL_GJC_WORKFLOW_SKILLS : [rawSkill as CanonicalGjcWorkflowSkill];
+	const eligible = selectRetentionEligible(await collectRetentionCandidates(cwd, skills));
+	const counts: Record<string, number> = {};
+	for (const candidate of eligible) counts[candidate.category] = (counts[candidate.category] ?? 0) + 1;
+	const targets: GenericHardPruneTarget[] = eligible.map(candidate => ({
+		path: candidate.path,
+		category: candidate.category,
+	}));
+	let pruned: string[] = [];
+	if (!dryRun && targets.length > 0) {
+		const eligiblePaths = new Set(eligible.map(candidate => path.resolve(candidate.path)));
+		pruned = await hardPrune(targets, context => eligiblePaths.has(path.resolve(context.path)), {
+			cwd,
+			audit: {
+				cwd,
+				skill: rawSkill,
+				category: "prune",
+				verb: "gc",
+				owner: "gjc-state-cli",
+			},
+		});
+	}
+	return {
+		skill: rawSkill as CanonicalGjcWorkflowSkill | "all",
+		dry_run: dryRun,
+		eligible: eligible.map(candidate => candidate.relativePath),
+		pruned: pruned.map(filePath => path.relative(path.join(cwd, ".gjc", "state"), filePath)),
+		counts,
+	};
+}
+
+async function handleGraph(
+	args: readonly string[],
+	_cwd: string,
+	positionalSkill: string | undefined,
+): Promise<StateCommandResult> {
+	if (hasFlag(args, "--history")) {
+		const history = await readAuditWindow(_cwd, args);
+		return {
+			status: 0,
+			stdout: hasFlag(args, "--json") ? `${JSON.stringify(history, null, 2)}\n` : renderHistoryMarkdown(history),
+		};
+	}
+	const rawSkill = flagValue(args, "--skill")?.trim() || positionalSkill?.trim() || "all";
+	if (rawSkill !== "all") assertKnownMode(rawSkill);
+	const format = flagValue(args, "--format")?.trim() || "ascii";
+	if (!GRAPH_FORMATS.has(format)) {
+		throw new StateCommandError(2, `Invalid graph format: ${format}. Expected one of: ascii, mermaid, dot.`);
+	}
+	return {
+		status: 0,
+		stdout: renderStateGraph(rawSkill as CanonicalGjcWorkflowSkill | "all", format as StateGraphFormat),
+	};
+}
+
+async function handlePrune(
+	args: readonly string[],
+	cwd: string,
+	positionalSkill: string | undefined,
+): Promise<StateCommandResult> {
+	const selectors = await resolveSelectors(args, cwd, positionalSkill);
+	const mode = selectors.mode ?? (await inferModeFromActiveState(cwd, selectors.sessionId));
+	if (!mode) {
+		throw new StateCommandError(
+			2,
+			"gjc state prune requires --mode <skill>, positional <skill>, input.skill, or an active workflow in .gjc/state/skill-active-state.json",
+		);
+	}
+	const filePath = modeStateFile(cwd, mode, selectors.sessionId);
+	const olderThanDays = parseNonNegativeIntegerFlag(args, "--older-than");
+	const status = flagValue(args, "--status")?.trim();
+	const targets: GenericHardPruneTarget[] = [{ path: filePath, category: "prune" }];
+	const audit: StateWriterAuditContext = {
+		cwd,
+		skill: mode,
+		category: "prune",
+		verb: hasFlag(args, "--hard") ? "hard-prune" : "soft-delete",
+		owner: "gjc-state-cli",
+	};
+	const olderThanMs = olderThanDays === undefined ? undefined : olderThanDays * 24 * 60 * 60 * 1000;
+	const matchesSelector = async (
+		stat: { mtimeMs: number | bigint },
+		readJson: () => Promise<unknown>,
+	): Promise<boolean> => {
+		const mtimeMs = typeof stat.mtimeMs === "bigint" ? Number(stat.mtimeMs) : stat.mtimeMs;
+		if (olderThanMs !== undefined && Date.now() - mtimeMs < olderThanMs) return false;
+		if (status) return statusFromFile(await readJson()) === status;
+		return true;
+	};
+	if (hasFlag(args, "--hard")) {
+		const pruned = await hardPrune(
+			targets,
+			context => (context.stat ? matchesSelector(context.stat, context.readJson) : false),
+			{ cwd, audit },
+		);
+		return { status: 0, stdout: `${JSON.stringify({ skill: mode, hard: true, pruned }, null, 2)}\n` };
+	}
+	let deleted: string[] = [];
+	try {
+		const stat = await fs.stat(filePath);
+		if (await matchesSelector(stat, async () => JSON.parse(await fs.readFile(filePath, "utf-8")))) {
+			const archivedPath = await softDelete(
+				filePath,
+				{ skill: mode, reason: "gjc state prune", status: status ?? null, older_than_days: olderThanDays ?? null },
+				{ cwd, audit },
+			);
+			deleted = [archivedPath];
+		}
+	} catch (error) {
+		const err = error as NodeJS.ErrnoException;
+		if (err.code !== "ENOENT") throw error;
+	}
+	return { status: 0, stdout: `${JSON.stringify({ skill: mode, hard: false, soft_deleted: deleted }, null, 2)}\n` };
+}
+
+async function handleGc(
+	args: readonly string[],
+	cwd: string,
+	positionalSkill: string | undefined,
+): Promise<StateCommandResult> {
+	const summary = await buildGcSummary(args, cwd, positionalSkill, hasFlag(args, "--dry-run"));
+	return { status: 0, stdout: `${JSON.stringify(summary, null, 2)}\n` };
+}
+
+async function handleMigrate(
+	args: readonly string[],
+	cwd: string,
+	positionalSkill: string | undefined,
+): Promise<StateCommandResult> {
+	const selectors = await resolveSelectors(args, cwd, positionalSkill);
+	const mode = selectors.mode ?? (await inferModeFromActiveState(cwd, selectors.sessionId));
+	if (!mode) {
+		throw new StateCommandError(
+			2,
+			"gjc state migrate requires --mode <skill>, positional <skill>, input.skill, or an active workflow in .gjc/state/skill-active-state.json",
+		);
+	}
+	const filePath = modeStateFile(cwd, mode, selectors.sessionId);
+	const forced = hasFlag(args, "--force");
+	const mismatchWarning = await warnAndAuditOutOfBandIfNeeded(cwd, filePath, mode, {
+		forced,
+	});
+	if (mismatchWarning && !forced) {
+		throw new StateCommandError(2, `${mismatchWarning}; use --force to migrate tampered mode-state`);
+	}
+	const result = await migrateAndPersistLegacyState({
+		cwd,
+		skill: mode,
+		statePath: filePath,
+		sessionId: selectors.sessionId,
+	});
+	return {
+		status: 0,
+		stdout: `${JSON.stringify({ skill: mode, ...result, integrity_mismatch: Boolean(mismatchWarning) }, null, 2)}\n`,
+		...(mismatchWarning ? { stderr: `${mismatchWarning}\n` } : {}),
+	};
 }
 
 export async function runNativeStateCommand(args: string[], cwd = process.cwd()): Promise<StateCommandResult> {
 	try {
 		const parsed = parsePositionalArgs(args);
+		assertKnownFlags(args, parsed);
 		switch (parsed.action) {
 			case "read":
+				if (hasFlag(args, "--migrate")) return await handleMigrate(args, cwd, parsed.positionalSkill);
 				return await handleRead(args, cwd, parsed.positionalSkill);
 			case "write":
 				return await handleWrite(args, cwd, parsed.positionalSkill);
@@ -720,8 +1817,20 @@ export async function runNativeStateCommand(args: string[], cwd = process.cwd())
 				return await handleClear(args, cwd, parsed.positionalSkill);
 			case "contract":
 				return await handleContract(args, cwd, parsed.positionalSkill);
+			case "status":
+				return await handleStatus(args, cwd, parsed.positionalSkill);
+			case "doctor":
+				return await handleDoctor(args, cwd, parsed.positionalSkill);
 			case "handoff":
 				return await handleHandoff(args, cwd, parsed.positionalSkill);
+			case "graph":
+				return await handleGraph(args, cwd, parsed.positionalSkill);
+			case "prune":
+				return await handlePrune(args, cwd, parsed.positionalSkill);
+			case "gc":
+				return await handleGc(args, cwd, parsed.positionalSkill);
+			case "migrate":
+				return await handleMigrate(args, cwd, parsed.positionalSkill);
 			default:
 				return { status: 2, stderr: `Unknown gjc state command: ${parsed.action}\n` };
 		}