@supacloud/cli 0.101.4 → 0.103.1

package/dist/index.js

@@ -9317,7 +9317,7 @@ var ACTION_POLICY = {
   env: { local: ["list", "check"] },
   app: {
     local: ["init", "generate", "dev", "watch", "verify-plan", "compile", "check", "graph", "explain", "export-tools", "context", "doctor", "fix", "plan", "build"],
-    read: ["status", "logs", "transfer-plan", "promote-plan", "rollback-plan", "history", "deploy-plan", "diff", "promote-status", "preview-plan", "previews", "preview-list", "preview-status"],
+    read: ["status", "evidence", "logs", "transfer-plan", "promote-plan", "rollback-plan", "history", "deploy-plan", "diff", "promote-status", "preview-plan", "previews", "preview-list", "preview-status"],
     write: ["release", "upload", "configure", "transfer", "promote", "promote-reconcile", "deploy", "rollback", "reconcile", "retire", "preview", "preview-create", "preview-reconcile", "preview-cleanup"]
   },
   db: {
@@ -10955,6 +10955,65 @@ function parseDeploymentEvidence(value) {
   }
   return structuredClone(value);
 }
+function formatDeploymentEvidence(evidence) {
+  const report = summarizeDeploymentEvidence(evidence);
+  return [
+    `DEPLOYMENT ${evidence.scope.project_ref}/${evidence.scope.application_id}/${evidence.scope.environment_id}`,
+    `  status:     ${report.status}`,
+    ...report.status !== evidence.status ? [`  recorded status: ${evidence.status} (additional proof missing)`] : [],
+    `  manifest:   ${evidence.source.manifest_sha256.slice(0, 12)}`,
+    `  database:   ${evidence.database.provider} ${evidence.database.version} (${evidence.database.topology})`,
+    `  activation: ${evidence.activation.activation_id}`,
+    `  rollback:   ${evidence.rollback.status}`,
+    `  health:     ${evidence.health.status}; smoke=${evidence.health.authenticated_smoke}`,
+    `  release:    ${evidence.activation.release_id}`,
+    `  recorded:   ${evidence.recorded_at} (snapshot, not a live probe)`,
+    ...report.issues.map((issue) => `  ${issue.status} ${issue.component}: ${issue.nextAction}`),
+    "  recovery:   code rollback does not restore database or object storage",
+    "  retries:    do not replay mutations with unknown outcomes; read back the original identity"
+  ].join(`
+`);
+}
+function summarizeDeploymentEvidence(value) {
+  const evidence = parseDeploymentEvidence(value);
+  const issues = [];
+  const observe = (component, state, complete, nextAction) => {
+    if (state !== "confirmed" || !complete)
+      issues.push({
+        component,
+        status: state === "failed" ? "failed" : state === "unknown" ? "unknown" : "incomplete",
+        nextAction
+      });
+  };
+  for (const component of evidence.components) {
+    observe(component.name, component.status, component.checked_at !== null && component.health_check !== null, "Inspect this component's health and logs for the recorded activation before changing or restarting it.");
+  }
+  observe("database.migration", evidence.database.migration.status, evidence.database.migration.compatibility === "verified" && evidence.database.migration.inventory_sha256 !== null, "Read the migration inventory and compare its digest; do not reapply an unconfirmed migration.");
+  observe("database.backup", evidence.database.backup.status, evidence.database.backup.latest_success_at !== null && evidence.database.backup.freshness_seconds !== null, "Read backup inventory and freshness for this project; a successful deployment is not a backup.");
+  observe("database.recovery", evidence.database.recovery.status, evidence.database.recovery.drill_id !== null && evidence.database.recovery.rpo_seconds !== null && evidence.database.recovery.rto_seconds !== null, "Obtain a separate approved restore drill and verify data, permissions and storage; never restore automatically.");
+  observe("health", evidence.health.status, evidence.health.checked_at !== null, "Read back this activation's readiness; process health alone does not prove a business operation.");
+  observe("authenticated-smoke", evidence.health.authenticated_smoke, true, "Run the selected business smoke with a real authorized session and verify forbidden access remains denied.");
+  observe("code-rollback", evidence.rollback.status === "ready" ? "confirmed" : evidence.rollback.status, evidence.rollback.release_id !== null && evidence.rollback.configuration_id !== null, "Inspect the explicit rollback release and configuration; data recovery requires a separate plan.");
+  if (evidence.rollback.result !== null) {
+    observe("code-rollback.result", evidence.rollback.result, true, "Read back the rollback activation and authenticated smoke before another mutation.");
+  }
+  return {
+    version: 1,
+    status: evidence.status === "confirmed" && issues.length > 0 ? "incomplete" : evidence.status,
+    recordedStatus: evidence.status,
+    scope: evidence.scope,
+    recordedAt: evidence.recorded_at,
+    correlation: {
+      releaseId: evidence.activation.release_id,
+      activationId: evidence.activation.activation_id,
+      manifestSha256: evidence.source.manifest_sha256
+    },
+    issues,
+    automaticMutationRetry: false,
+    codeRollbackRestoresData: false,
+    liveObservationPerformed: false
+  };
+}
 // node_modules/@supacloud/delivery/src/delivery-tuple.ts
 var sha2563 = String2({ pattern: "^[a-f0-9]{64}$" });
 var commit = String2({ pattern: "^(?:[a-f0-9]{40}|[a-f0-9]{64})$" });
@@ -21388,7 +21447,7 @@ var starter_metadata_default = {
   generatedBy: "supacloud/starter-metadata-v1",
   packages: {
     compiler: {
-      version: "0.46.4"
+      version: "0.46.5"
     },
     app: {
       version: "0.27.1",
@@ -21397,16 +21456,16 @@ var starter_metadata_default = {
       }
     },
     elysia: {
-      version: "0.31.1"
+      version: "0.33.1"
     },
     commands: {
       version: "0.9.3"
     },
     contracts: {
-      version: "0.11.0"
+      version: "0.11.1"
     },
     db: {
-      version: "0.17.1",
+      version: "0.18.0",
       peerDependencies: {
         "drizzle-orm": "1.0.0-rc.5-5935859"
       },
@@ -22450,7 +22509,7 @@ export async function createReviewAttachmentAdapters(options: ReviewAttachmentOp
 `;
 
 // src/shared/tools/app-starter-attachment-worker.ts
-var STARTER_ATTACHMENT_WORKER = `import { createWorker, type CompiledModule } from "@supacloud/elysia";
+var STARTER_ATTACHMENT_WORKER = `import { createWorker, type CompiledModule, type ExecutionObserver } from "@supacloud/elysia";
 import {
   createSupaCloudWorkflowTransport,
   type SupaCloudWorkflowClaim,
@@ -22464,6 +22523,7 @@ export interface ReviewAttachmentWorkerOptions extends ReviewAttachmentOptions {
   workerId: string;
   queueOwnership: "exclusive-review-attachments";
   pollIntervalMs?: number;
+  onExecution?: ExecutionObserver;
 }
 
 export async function createReviewAttachmentWorker(options: ReviewAttachmentWorkerOptions) {
@@ -22490,7 +22550,9 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
       throw new Error("Invalid attachment workflow input");
     }
     const bound = await options.database.transaction(tx => tx.query(
-      "SELECT run_id FROM public.starter_attachments WHERE review_id=$1 AND artifact_id=$2 AND run_id=$3",
+      "SELECT a.run_id FROM public.starter_attachments a WHERE a.review_id=$1 AND a.artifact_id=$2 " +
+      "AND COALESCE((SELECT r.run_id FROM public.starter_attachment_retries r " +
+      "WHERE r.review_id=a.review_id ORDER BY r.generation DESC LIMIT 1),a.run_id)=$3",
       [reviewId, artifactId, claim.runId],
     ));
     if (!Array.isArray(bound) || bound.length !== 1) throw new Error("Attachment workflow ownership mismatch");
@@ -22502,6 +22564,7 @@ export async function createReviewAttachmentWorker(options: ReviewAttachmentWork
     modules: options.modules, deps: { dbClient: store }, workerId, concurrency: 1,
     pollIntervalMs: options.pollIntervalMs ?? 1000,
     onError: fatal,
+    ...(options.onExecution === undefined ? {} : { onExecution: options.onExecution }),
     transport: {
       async claim(signal): Promise<SupaCloudWorkflowClaim | null> {
         if (halted || signal.aborted) return null;
@@ -22557,6 +22620,7 @@ import { SupaCloudWorkflowsClient } from "@supacloud/js";
 import { createBunCommandDatabase } from "@supacloud/db/bun";
 import type { CompiledModule } from "@supacloud/elysia";
 import { createReviewAttachmentWorker } from "./host/review-attachment-worker";
+import { createReviewWorkerObserver } from "./host/review-worker-observability";
 
 function required(name: string): string {
   const value = process.env[name];
@@ -22600,6 +22664,7 @@ export async function createDeliveryWorker(modules: CompiledModule[], lifecycle:
       database: createBunCommandDatabase(pool), service, projectId: settings.projectId,
       tenantId: settings.tenantId, modules, workerId: settings.workerId,
       workflows: new SupaCloudWorkflowsClient(service), queueOwnership: "exclusive-review-attachments",
+      onExecution: createReviewWorkerObserver(settings.workerId),
     });
     lifecycle.signal.throwIfAborted();
     return {
@@ -22616,15 +22681,50 @@ export async function createDeliveryWorker(modules: CompiledModule[], lifecycle:
 }
 `;
 
+// src/shared/tools/app-starter-execution-observability.ts
+var STARTER_EXECUTION_OBSERVABILITY = `import type { ExecutionObserver } from "@supacloud/elysia";
+
+function correlationId(value: string | undefined): string | undefined {
+  return typeof value === "string" && /^[A-Za-z0-9._:-]{1,256}$/.test(value) ? value : undefined;
+}
+
+function createObserver(source: "http" | "worker", workerId?: string): ExecutionObserver {
+  return metadata => {
+    // Select fields explicitly: future observer extensions must not leak payloads.
+    console.info(JSON.stringify({
+      event: source === "http" ? "review-http-execution" : "review-worker-execution",
+      component: source === "http" ? "review-http" : "review-attachment-worker",
+      timestamp: new Date().toISOString(),
+      workerId: correlationId(workerId),
+      kind: metadata.kind,
+      operation: metadata.operation,
+      stage: metadata.stage,
+      phase: metadata.phase,
+      requestId: correlationId(metadata.requestId),
+      durationMs: typeof metadata.durationMs === "number" && Number.isFinite(metadata.durationMs)
+        && metadata.durationMs >= 0 ? metadata.durationMs : undefined,
+    }));
+  };
+}
+
+export function createReviewHttpObserver(): ExecutionObserver {
+  return createObserver("http");
+}
+
+export function createReviewWorkerObserver(workerId: string): ExecutionObserver {
+  return createObserver("worker", workerId);
+}
+`;
+var STARTER_WORKER_OBSERVABILITY = `export { createReviewWorkerObserver } from "./review-execution-observability";
+`;
+
 // src/shared/tools/app-starter-upload.ts
 var STARTER_UPLOAD_FEATURE = `import { Effect } from "effect";
 import { Body, Controller, Inject, Injectable, Param, Post, DB_CLIENT, REQUEST_CONTEXT } from "@supacloud/app";
 import { ApplicationError } from "@supacloud/elysia";
-import { UploadBody, UploadLocation, UploadParams, UploadResult } from "./contracts";
-
-export interface ReviewUploadInput { reviewId: string; artifactId: string; expectedVersion: number }
-export interface ReviewUploadLocation { artifactId: string; bucketId: string; objectPath: string }
-export interface ReviewUploadResult { artifactId: string; runId: string; objectPath: string; sha256: string; bytes: number }
+import { UploadBody, UploadLocation, UploadParams, UploadResult,
+  type ReviewUploadBody, type ReviewUploadInput, type ReviewUploadLocation, type ReviewUploadResult } from "./contracts";
+export type { ReviewUploadInput, ReviewUploadLocation, ReviewUploadResult } from "./contracts";
 type PreviewUploadError =
   | { readonly _tag: "AUTHENTICATION_REQUIRED" }
   | { readonly _tag: "UPLOAD_INPUT_INVALID" }
@@ -22639,6 +22739,7 @@ type RegisterUploadError =
 export interface ReviewUploadPort {
   previewUpload(context: unknown, input: ReviewUploadInput): Promise<ReviewUploadLocation>;
   registerUpload(context: unknown, input: ReviewUploadInput): Promise<ReviewUploadResult>;
+  lookupUpload?(context: unknown, input: ReviewUploadInput): Promise<boolean>;
 }
 @Injectable({ scope: "request" })
 export class ReviewUploads {
@@ -22675,7 +22776,7 @@ export class ReviewUploadsController {
       retry: "none",
     },
   })
-  preview(@Param("id") id: string, @Body() body: { artifactId: string; expectedVersion: number }): Effect.Effect<ReviewUploadLocation, PreviewUploadError, never> {
+  preview(@Param("id") id: string, @Body() body: ReviewUploadBody): Effect.Effect<ReviewUploadLocation, PreviewUploadError, never> {
     return Effect.promise(() => this.uploads.preview({ reviewId: id, artifactId: body.artifactId, expectedVersion: body.expectedVersion }));
   }
   @Post("/:id/attachment-registration", {
@@ -22698,7 +22799,7 @@ export class ReviewUploadsController {
       retry: "none",
     },
   })
-  register(@Param("id") id: string, @Body() body: { artifactId: string; expectedVersion: number }): Effect.Effect<ReviewUploadResult, RegisterUploadError, never> {
+  register(@Param("id") id: string, @Body() body: ReviewUploadBody): Effect.Effect<ReviewUploadResult, RegisterUploadError, never> {
     return Effect.promise(() => this.uploads.register({ reviewId: id, artifactId: body.artifactId, expectedVersion: body.expectedVersion }));
   }
 }
@@ -22750,7 +22851,8 @@ import { SupaCloudArtifactsClient } from "@supacloud/js";
 import { createTransactionalCommand, plaintextCommandInput } from "@supacloud/commands";
 import { CommandError } from "@supacloud/contracts";
 import { createPostgresCommandStore, type CommandTransaction } from "@supacloud/db";
-import { ApplicationError, requireTrustedIdentity } from "@supacloud/elysia";
+import { ApplicationError, createSchemaDecoder, requireTrustedIdentity } from "@supacloud/elysia";
+import { UploadInput, UploadResult } from "../review/contracts";
 import type { ReviewAttachmentOptions } from "./review-attachments";
 import type { ReviewUploadInput, ReviewUploadPort, ReviewUploadResult } from "../review/uploads";
 
@@ -22765,20 +22867,15 @@ function rows(value: unknown): Record<string, unknown>[] {
   if (!Array.isArray(value)) throw new TypeError("Invalid upload database result");
   return value.map(record);
 }
+const decodeInput = createSchemaDecoder(UploadInput, { normalize: false });
+const result = createSchemaDecoder(UploadResult, { normalize: false });
 function capture(value: unknown): ReviewUploadInput {
-  const item = record(value), uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  if (typeof item["reviewId"] !== "string" || !uuid.test(item["reviewId"])
-    || typeof item["artifactId"] !== "string" || !uuid.test(item["artifactId"])
-    || typeof item["expectedVersion"] !== "number" || !Number.isSafeInteger(item["expectedVersion"]) || item["expectedVersion"] < 1) {
+  try {
+    const input = decodeInput(value);
+    return { ...input, reviewId: input.reviewId.toLowerCase(), artifactId: input.artifactId.toLowerCase() };
+  } catch {
     throw new ApplicationError("Invalid upload input", { status: 400, code: "UPLOAD_INPUT_INVALID" });
   }
-  return { reviewId: item["reviewId"].toLowerCase(), artifactId: item["artifactId"].toLowerCase(), expectedVersion: item["expectedVersion"] };
-}
-function result(value: unknown): ReviewUploadResult {
-  const item = record(value);
-  if (typeof item["artifactId"] !== "string" || typeof item["runId"] !== "string" || typeof item["objectPath"] !== "string"
-    || typeof item["sha256"] !== "string" || typeof item["bytes"] !== "number") throw new TypeError("Invalid upload receipt");
-  return { artifactId: item["artifactId"], runId: item["runId"], objectPath: item["objectPath"], sha256: item["sha256"], bytes: item["bytes"] };
 }
 
 export async function createReviewUploadAdapters(options: ReviewAttachmentOptions): Promise<ReviewUploadPort> {
@@ -22805,7 +22902,7 @@ export async function createReviewUploadAdapters(options: ReviewAttachmentOption
       "SELECT m.storage_subject::text AS storage_subject FROM public.starter_reviews r " +
       "JOIN public.starter_members m ON m.subject=r.owner_id CROSS JOIN public.starter_application p " +
       "WHERE r.id=$1 AND r.owner_id=$2 AND ((r.state='draft' AND r.version=$3) OR " +
-      "($6::boolean AND r.state='approved' AND r.version=$3+1 AND EXISTS (" +
+      "($6::boolean AND r.state='approved' AND r.version=$3::bigint+1 AND EXISTS (" +
       "SELECT 1 FROM public.starter_attachments b WHERE b.review_id=r.id AND b.artifact_id=$7::uuid AND b.owner_id=$2 " +
       "AND b.object_path=m.storage_subject::text || '/' || r.id || '/' || $7::text || '.txt'))) " +
       "AND m.enabled AND m.can_approve AND m.storage_subject IS NOT NULL " +
@@ -22817,7 +22914,24 @@ export async function createReviewUploadAdapters(options: ReviewAttachmentOption
     }
     return allowed[0]["storage_subject"] + "/" + input.reviewId + "/" + input.artifactId + ".txt";
   }
+  const receiptLookup = createTransactionalCommand({
+    name: "review.attach", store: createPostgresCommandStore(database), inputCodec: plaintextCommandInput,
+    input: capture, result,
+    async authorize(who, request, tx) {
+      try { await authorize(tx, who.actorId, request, true); return "allow"; }
+      catch (error) {
+        if (error instanceof ApplicationError && error.code === "UPLOAD_DENIED") return "deny";
+        throw error;
+      }
+    },
+    execute: async () => { throw new Error("Receipt lookup cannot register an upload"); },
+    audit: { event: "review.attachment-bound", details: request => ({ reviewId: request.reviewId, artifactId: request.artifactId }) },
+  });
   return {
+    async lookupUpload(context, value) {
+      const input = capture(value), subject = actor(context);
+      return (await receiptLookup.lookup({ actorId: subject, tenantId }, input.artifactId, input))?.status === "confirmed";
+    },
     async previewUpload(context, value) {
       const input = capture(value), subject = actor(context);
       const objectPath = await database.transaction(tx => authorize(tx, subject, input));
@@ -22825,8 +22939,14 @@ export async function createReviewUploadAdapters(options: ReviewAttachmentOption
     },
     async registerUpload(context, value) {
       const input = capture(value), subject = actor(context);
-      const objectPath = await database.transaction(tx => authorize(tx, subject, input, true));
       try {
+        // Only an authorized, validated receipt can bypass external registration.
+        const saved = await receiptLookup.lookup({ actorId: subject, tenantId }, input.artifactId, input);
+        if (saved !== null) {
+          if (saved.status !== "confirmed") throw new CommandError("COMMAND_RECEIPT_INVALID");
+          return saved.result;
+        }
+        const objectPath = await database.transaction(tx => authorize(tx, subject, input, true));
         const downloaded = await service.storage.from("review-attachments").download(objectPath);
         if (downloaded.error || !downloaded.data) throw new Error("Upload unavailable");
         const blob = downloaded.data;
@@ -22984,21 +23104,24 @@ ALTER TABLE public.starter_application ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.starter_reviews ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.starter_members ENABLE ROW LEVEL SECURITY;
 `;
-var STARTER_REVIEW_POSTGRES = `import { plaintextCommandInput } from "@supacloud/commands";
+var STARTER_REVIEW_POSTGRES = `import { createTransactionalCommand, plaintextCommandInput } from "@supacloud/commands";
 import { CommandError } from "@supacloud/contracts";
 import { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from "@supacloud/db";
 import {
   ApplicationError, createSchemaDecoder, createSupAuthRequestContext, requireTrustedIdentity,
   createTransactionalCommandGovernance,
-  type CommandInvocation, type SupAuthContextOptions,
+  type SupAuthContextOptions,
 } from "@supacloud/elysia";
 import type { AppAdapters } from "../application";
 import type { ReviewStore } from "../review/review";
 import type { ReviewUploadPort } from "../review/uploads";
+import type { ReviewTaskPort } from "../review/tasks";
 import { ApprovalInput, ReviewResult } from "../review/contracts";
+import type { ReviewRow } from "../../db/schema";
 
 const input = createSchemaDecoder(ApprovalInput, { normalize: false });
-const result = createSchemaDecoder(ReviewResult, { normalize: false });
+const result: (value: unknown) => Pick<ReviewRow, "state" | "version"> =
+  createSchemaDecoder(ReviewResult, { normalize: false });
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -23020,6 +23143,7 @@ export interface ReviewPostgresOptions {
   tenantId: string;
   identity: Omit<SupAuthContextOptions, "resolveAccess">;
   uploads?: ReviewUploadPort;
+  tasks?: ReviewTaskPort;
   // Only database effects here: they commit/rollback with the approval and receipt.
   afterApproved?(tx: CommandTransaction, id: string, version: number): Promise<void>;
 }
@@ -23055,6 +23179,38 @@ export async function createReviewPostgresAdapters(options: ReviewPostgresOption
   const transaction = () => commandBinding.transaction();
   const store: ReviewStore = {
     ...options.uploads,
+    ...options.tasks,
+    async lookupOperation(context, operation) {
+      const subject = actor(context);
+      try {
+        let confirmed: boolean = false;
+        if (operation.kind === "upload") {
+          if (!options.uploads?.lookupUpload) {
+            throw new ApplicationError("Upload receipt lookup unavailable", { status: 503, code: "RECEIPTS_UNAVAILABLE" });
+          }
+          confirmed = await options.uploads.lookupUpload(context, {
+            reviewId: operation.reviewId, artifactId: operation.operationId, expectedVersion: operation.expectedVersion,
+          });
+        } else {
+          const command = createTransactionalCommand({
+            name: "review.approve", store: commandStore, inputCodec: plaintextCommandInput, input, result,
+            authorize: authorizeApproval,
+            execute: async () => { throw new Error("Receipt lookup cannot execute a command"); },
+            audit: { event: "review.approved", details: request => ({ reviewId: request.id }) },
+          });
+          const receipt = await command.lookup({ actorId: subject, tenantId }, operation.operationId,
+            { id: operation.reviewId, expectedVersion: operation.expectedVersion });
+          confirmed = receipt?.status === "confirmed";
+        }
+        return { status: confirmed ? "confirmed" : "unknown", operationId: operation.operationId, reviewId: operation.reviewId };
+      } catch (error) {
+        if (error instanceof ApplicationError) throw error;
+        if (error instanceof CommandError && ["COMMAND_REJECTED", "COMMAND_IDEMPOTENCY_CONFLICT"].includes(error.code)) {
+          throw new ApplicationError(error.code, { code: error.code, status: error.code === "COMMAND_REJECTED" ? 403 : 409 });
+        }
+        throw new ApplicationError("Receipt lookup unavailable", { status: 503, code: "RECEIPTS_UNAVAILABLE" });
+      }
+    },
     async get(table, id) {
       if (table !== "reviews") throw new Error("Unsupported review table");
       return rows(await transaction().query(
@@ -23072,35 +23228,37 @@ export async function createReviewPostgresAdapters(options: ReviewPostgresOption
       await afterApproved?.(transaction(), id, review.version);
     },
   };
-  function actor(invocation: CommandInvocation): string {
-    const who = requireTrustedIdentity(invocation.requestContext);
-    const access = record(record(invocation.requestContext)["access"]);
+  function actor(context: unknown): string {
+    const who = requireTrustedIdentity(context);
+    const access = record(record(context)["access"]);
     if (access["projectId"] !== projectId || access["tenantId"] !== tenantId
       || !Array.isArray(access["permissions"]) || !access["permissions"].includes("review.approve")) {
       throw new ApplicationError("Command permission denied", { status: 403, code: "REVIEW_PERMISSION_DENIED" });
     }
     return who.subject;
   }
+  const commandStore = createPostgresCommandStore(database);
+  async function authorizeApproval(who: { actorId: string; tenantId: string }, request: ReturnType<typeof input>, tx: CommandTransaction): Promise<"allow" | "deny"> {
+    const found = rows(await tx.query(
+      "SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id " +
+      "CROSS JOIN public.starter_application a " +
+      "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
+      "AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a",
+      [request.id, who.actorId, projectId, who.tenantId],
+    ));
+    return found.length === 1 ? "allow" : "deny";
+  }
   const commandBinding = createTransactionalCommandGovernance({
     permission: "review.approve",
-    identity: invocation => ({ actorId: actor(invocation), tenantId }),
+    identity: invocation => ({ actorId: actor(invocation.requestContext), tenantId }),
     input: invocation => ({
       ...record(invocation.input.body), id: invocation.input.params["id"],
     }),
     rejection: error => isPublicConflict(error) ? new CommandError("COMMAND_IDEMPOTENCY_CONFLICT") : undefined,
     definition: {
-      name: "review.approve", store: createPostgresCommandStore(database),
+      name: "review.approve", store: commandStore,
       inputCodec: plaintextCommandInput, input, result,
-      async authorize(who, request, tx) {
-        const found = rows(await tx.query(
-          "SELECT r.id FROM public.starter_reviews r JOIN public.starter_members m ON m.subject=r.owner_id " +
-          "CROSS JOIN public.starter_application a " +
-          "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
-          "AND a.singleton AND a.project_id=$3 AND a.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF a",
-          [request.id, who.actorId, projectId, who.tenantId],
-        ));
-        return found.length === 1 ? "allow" : "deny";
-      },
+      authorize: authorizeApproval,
       audit: { event: "review.approved", details: request => ({ reviewId: request.id }) },
     },
   });
@@ -23154,6 +23312,8 @@ import { createApplication, type CompiledModule } from "@supacloud/elysia";
 import { createReviewPostgresAdapters } from "./host/review-postgres";
 import { createReviewAttachmentAdapters } from "./host/review-attachments";
 import { createReviewUploadAdapters } from "./host/review-uploads";
+import { createReviewTaskAdapters } from "./host/review-tasks";
+import { createReviewHttpObserver } from "./host/review-execution-observability";
 
 function required(name: string): string {
   const value = process.env[name];
@@ -23204,15 +23364,17 @@ export async function createDeliveryApplication(modules: CompiledModule[], lifec
     const durable = attachmentOptions ? await createReviewAttachmentAdapters(attachmentOptions) : undefined;
     stage = "uploads";
     const uploads = attachmentOptions ? await createReviewUploadAdapters(attachmentOptions) : undefined;
+    const tasks = attachmentOptions ? await createReviewTaskAdapters(attachmentOptions) : undefined;
     stage = "postgres";
     const adapters = await createReviewPostgresAdapters({
       database, tenantId: settings.tenantId, identity: settings.identity,
       ...(uploads ? { uploads } : {}),
+      ...(tasks ? { tasks } : {}),
       ...(durable ? { afterApproved: durable.enqueue } : {}),
     });
     lifecycle.signal.throwIfAborted();
     stage = "application";
-    const app = createApplication({ name: "review", modules, ...adapters });
+    const app = createApplication({ name: "review", modules, ...adapters, onExecution: createReviewHttpObserver() });
     return { fetch: (request: Request) => app.handle(request), close };
   } catch (error) {
     await close();
@@ -23238,7 +23400,7 @@ var STARTER_DATABASE_CONFIG = {
   role: "starter_review_http"
 };
 var STARTER_DATABASE_SCHEMA = `import { sql } from "drizzle-orm";
-import { boolean, check, integer, jsonb, pgTable, primaryKey, text, uuid } from "drizzle-orm/pg-core";
+import { boolean, check, integer, jsonb, pgTable, primaryKey, text, unique, uuid } from "drizzle-orm/pg-core";
 
 // Structure for the reviewed starter migrations. Grants/policies stay in those migrations.
 export const application = pgTable.withRLS("starter_application", {
@@ -23286,12 +23448,23 @@ export const attachmentResults = pgTable.withRLS("starter_attachment_results", {
   check("starter_attachment_results_version_check", sql\`\${table.version} >= 2\`),
 ]);
 
+export const attachmentRetries = pgTable.withRLS("starter_attachment_retries", {
+  runId: uuid("run_id").primaryKey(),
+  reviewId: text("review_id").notNull().references(() => attachments.reviewId),
+  previousRunId: uuid("previous_run_id").notNull().unique(),
+  generation: integer().notNull(),
+}, table => [
+  unique("starter_attachment_retries_review_id_generation_key").on(table.reviewId, table.generation),
+  check("starter_attachment_retries_generation_check", sql\`\${table.generation} > 0\`),
+  check("starter_attachment_retries_check", sql\`\${table.runId} <> \${table.previousRunId}\`),
+]);
+
 export type ReviewRow = typeof reviews.$inferSelect;
 export type NewReview = typeof reviews.$inferInsert;
 `;
 var STARTER_DATABASE_MODULES = `import { defineDatabaseModule } from "@supacloud/db";
 import { getTableConfig } from "drizzle-orm/pg-core";
-import { application, reviews, members, attachments, attachmentResults } from "./schema";
+import { application, reviews, members, attachments, attachmentResults, attachmentRetries } from "./schema";
 
 const backendPolicies = [
   ["starter_backend_binding_read", "public.starter_application", "select", ["starter_review_http", "starter_review_worker"]],
@@ -23314,11 +23487,19 @@ const backendPolicies = [
 // The module is the single live-Catalog ownership contract for starter tables.
 export default defineDatabaseModule({
   name: "starter",
-  tables: [application, reviews, members, attachments, attachmentResults].map(table => {
+  tables: [application, reviews, members, attachments, attachmentResults, attachmentRetries].map(table => {
     const config = getTableConfig(table);
     return (config.schema ?? "public") + "." + config.name;
   }),
   policies: [
+    ...([
+      ["starter_http_retry_read", "select", "starter_review_http"],
+      ["starter_http_retry_insert", "insert", "starter_review_http"],
+      ["starter_worker_retry_read", "select", "starter_review_worker"],
+    ] as const).map(([name, operation, role]) => ({
+      name, table: "public.starter_attachment_retries", operation, roles: [role],
+      source: "migrations/005-review-task-recovery.sql", tests: ["tests/database-governance.sql"],
+    })),
     ...backendPolicies.map(([name, table, operation, roles]) => ({
       name, table, operation, roles: [...roles], source: "migrations/004-review-runtime-roles.sql",
       tests: ["tests/database-governance.sql"],
@@ -23341,15 +23522,15 @@ BEGIN READ ONLY;
 DO $test$
 DECLARE
   owned text[] := ARRAY['starter_application','starter_reviews','starter_members',
-    'starter_attachments','starter_attachment_results'];
+    'starter_attachments','starter_attachment_results','starter_attachment_retries'];
 BEGIN
   IF (SELECT count(*) FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace
-      WHERE n.nspname='public' AND c.relname=ANY(owned) AND c.relrowsecurity) <> 5 THEN
+      WHERE n.nspname='public' AND c.relname=ANY(owned) AND c.relrowsecurity) <> 6 THEN
     RAISE EXCEPTION 'All starter tables must exist with RLS enabled';
   END IF;
   IF (SELECT count(*) FROM pg_policy p JOIN pg_class c ON c.oid=p.polrelid
       JOIN pg_namespace n ON n.oid=c.relnamespace
-      WHERE n.nspname='public' AND c.relname=ANY(owned)) <> 17 THEN
+      WHERE n.nspname='public' AND c.relname=ANY(owned)) <> 20 THEN
     RAISE EXCEPTION 'Starter policy inventory changed; reconcile db/modules.ts';
   END IF;
   IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('starter_review_http','starter_review_worker')
@@ -23429,6 +23610,831 @@ export default defineConfig({
   };
 }
 
+// src/shared/tools/app-starter-client.ts
+var STARTER_REVIEW_CLIENT = String.raw`import type { ReviewOperation, ReviewReceipt } from "../review/contracts";
+import { REVIEW_VERSION_MAX } from "../review/limits";
+export type { ReviewOperation } from "../review/contracts";
+
+export interface ReviewRow { id: string; state: "draft" | "approved"; version: number }
+export type ReviewWriteResult =
+  | (ReviewReceipt & { status: "confirmed" })
+  | { status: "denied" | "conflict" | "unknown" };
+export interface ReviewTransport {
+  list(): Promise<ReviewRow[]>;
+  approve(operation: ReviewOperation): Promise<ReviewWriteResult>;
+  upload(operation: ReviewOperation, file: Blob): Promise<ReviewWriteResult>;
+  // Read-only receipt lookup, bound to current identity. A current row alone is not a receipt.
+  lookup?(operation: ReviewOperation): Promise<ReviewWriteResult>;
+}
+export interface ReviewClientState {
+  list: { status: "idle" | "loading" | "ready" | "empty" | "error" | "denied"; rows: ReviewRow[] };
+  mutation: {
+    status: "idle" | "submitting" | "confirmed" | "denied" | "conflict" | "unknown";
+    operation: ReviewOperation | null;
+  };
+}
+
+export interface ReviewPendingStore {
+  load(): ReviewOperation | null;
+  save(operation: ReviewOperation): void;
+  clear(operation: ReviewOperation): void;
+}
+
+/** Keep operation identity, not tokens, file bytes or row data. Storage is not authorization. */
+export function createReviewPendingStore(storage: Pick<Storage, "getItem" | "setItem" | "removeItem">,
+  scope: { projectId: string; tenantId: string; applicationId: string; subject: string }): ReviewPendingStore {
+  const identity = [scope.projectId, scope.tenantId, scope.applicationId, scope.subject];
+  if (identity.some(value => !value.trim())) throw new Error("Explicit recovery scope required");
+  const key = "supacloud.review.pending.v1:" + JSON.stringify(identity);
+  function isRecord(value: unknown): value is Record<string, unknown> {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+  }
+  function decode(value: unknown): ReviewOperation {
+    if (!isRecord(value)) throw new Error("Invalid pending operation");
+    const item = value;
+    if ((item["kind"] !== "approve" && item["kind"] !== "upload")
+      || typeof item["reviewId"] !== "string" || !item["reviewId"].trim()
+      || typeof item["operationId"] !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(item["operationId"])
+      || typeof item["expectedVersion"] !== "number" || !Number.isSafeInteger(item["expectedVersion"])
+      || item["expectedVersion"] < 1 || item["expectedVersion"] > REVIEW_VERSION_MAX) {
+      throw new Error("Invalid pending operation");
+    }
+    return { kind: item["kind"], reviewId: item["reviewId"], operationId: item["operationId"], expectedVersion: item["expectedVersion"] };
+  }
+  const load = () => {
+    const value = storage.getItem(key);
+    if (value === null) return null;
+    const parsed: unknown = JSON.parse(value);
+    return decode(parsed);
+  };
+  return {
+    load,
+    save(operation) {
+      const previous = load();
+      if (previous && JSON.stringify(previous) !== JSON.stringify(decode(operation))) {
+        throw new Error("Another unresolved operation exists");
+      }
+      storage.setItem(key, JSON.stringify(decode(operation)));
+    },
+    clear(operation) {
+      const previous = load();
+      if (previous && JSON.stringify(previous) !== JSON.stringify(decode(operation))) {
+        throw new Error("Pending operation identity changed");
+      }
+      storage.removeItem(key);
+    },
+  };
+}
+
+export function createReviewClient(transport: ReviewTransport, pending?: ReviewPendingStore) {
+  let state: ReviewClientState = { list: { status: "idle", rows: [] }, mutation: { status: "idle", operation: null } };
+  try {
+    const operation = pending?.load();
+    if (operation) state.mutation = { status: "unknown", operation };
+  } catch { state.mutation = { status: "unknown", operation: null }; }
+  let generation: number = 0, closed: boolean = false, recovering: boolean = false;
+  const listeners = new Set<() => void>();
+  const snapshot = (): ReviewClientState => structuredClone(state);
+  const notify = () => {
+    for (const listener of listeners) {
+      // A view subscriber cannot interrupt persistence or change a write outcome.
+      try { listener(); } catch {}
+    }
+  };
+  function finish(operation: ReviewOperation, result: ReviewWriteResult) {
+    if (closed) return;
+    let status = result.status === "confirmed"
+      && (result.operationId !== operation.operationId || result.reviewId !== operation.reviewId)
+      ? "unknown" : result.status;
+    if (status !== "unknown") {
+      try {
+        if (pending) {
+          pending.clear(structuredClone(operation));
+          if (pending.load() !== null) throw new Error("Pending operation was not cleared");
+        }
+      } catch { status = "unknown"; }
+    }
+    state = { ...state, mutation: { status, operation } };
+    notify();
+  }
+  async function load() {
+    if (closed) return;
+    const request = ++generation;
+    state = { ...state, list: { status: "loading", rows: [] } };
+    notify();
+    try {
+      const rows = await transport.list();
+      if (closed || request !== generation) return;
+      state = { ...state, list: { status: rows.length ? "ready" : "empty", rows: structuredClone(rows) } };
+    } catch (error) {
+      if (closed || request !== generation) return;
+      state = { ...state, list: { status: error instanceof ReviewAccessDenied ? "denied" : "error", rows: [] } };
+    }
+    notify();
+  }
+  async function submit(kind: ReviewOperation["kind"], row: ReviewRow, file?: Blob) {
+    if (closed || recovering || state.mutation.status === "submitting" || state.mutation.status === "unknown") return;
+    if (row.state !== "draft" || !Number.isSafeInteger(row.version) || row.version < 1 || !row.id.trim()) return;
+    if (row.version > REVIEW_VERSION_MAX || (kind === "approve" && row.version === REVIEW_VERSION_MAX)) return;
+    // Upload contracts are narrower than approval/list IDs and PostgreSQL-safe versions.
+    // Reject locally before creating an unresolved operation for an impossible request.
+    if (kind === "upload" && (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(row.id)
+      || !file || file.size < 1 || file.size > 1048576
+      || file.type.split(";")[0]?.trim().toLowerCase() !== "text/plain")) return;
+    const operation: ReviewOperation = {
+      kind, reviewId: row.id, expectedVersion: row.version, operationId: crypto.randomUUID(),
+    };
+    try {
+      if (pending) {
+        pending.save(structuredClone(operation));
+        const stored = pending.load();
+        if (!stored || stored.kind !== operation.kind || stored.reviewId !== operation.reviewId
+          || stored.expectedVersion !== operation.expectedVersion || stored.operationId !== operation.operationId) {
+          throw new Error("Pending operation was not persisted");
+        }
+      }
+    } catch {
+      let original: ReviewOperation | null = null;
+      try { original = pending?.load() ?? null; } catch {}
+      state = { ...state, mutation: { status: "unknown", operation: original } };
+      notify();
+      return;
+    }
+    state = { ...state, mutation: { status: "submitting", operation } };
+    notify();
+    if (closed) return;
+    let result: ReviewWriteResult;
+    try {
+      result = kind === "approve" ? await transport.approve(structuredClone(operation))
+        : file ? await transport.upload(structuredClone(operation), file) : { status: "unknown" };
+    } catch {
+      result = { status: "unknown" };
+    }
+    finish(operation, result);
+    if (state.mutation.status === "confirmed" || state.mutation.status === "conflict") await load();
+  }
+  return {
+    snapshot,
+    subscribe(listener: () => void) { listeners.add(listener); return () => { listeners.delete(listener); }; },
+    load,
+    approve: (row: ReviewRow) => submit("approve", row),
+    upload: (row: ReviewRow, file: Blob) => submit("upload", row, file),
+    async reconcile() {
+      const operation = state.mutation.operation;
+      if (closed || recovering || state.mutation.status !== "unknown" || !operation || !transport.lookup) return;
+      recovering = true;
+      try {
+        const result = await transport.lookup(structuredClone(operation));
+        // Denial or conflict during lookup does not prove the original write did not commit.
+        finish(operation, result.status === "confirmed" ? result : { status: "unknown" });
+        if (snapshot().mutation.status === "confirmed") await load();
+      } catch {
+        finish(operation, { status: "unknown" });
+      } finally { recovering = false; }
+    },
+    // Dispose on logout/identity change; do not reuse rows or results across sessions.
+    dispose() { closed = true; generation++; listeners.clear(); },
+  };
+}
+
+export class ReviewAccessDenied extends Error {}
+`;
+var STARTER_REVIEW_TRANSPORT = String.raw`import type { SingleAttemptFetch } from "@supacloud/js/contracts";
+import { ReviewAccessDenied, type ReviewOperation, type ReviewRow, type ReviewTransport, type ReviewWriteResult } from "./reviews";
+
+/** Structural SDK boundary: application data is decoded, never propagated as SDK generics. */
+export interface ReviewSupabaseClient {
+  from(table: "starter_reviews"): {
+    select(columns: "id,state,version"): {
+      order(column: "id"): { limit(count: number): PromiseLike<{ data: unknown; error: unknown; status: number }> };
+    };
+  };
+  storage: {
+    from(bucket: string): {
+      upload(path: string, file: Blob, options: { upsert: boolean; contentType: string }): Promise<{ error: unknown }>;
+    };
+  };
+}
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function record(value: unknown): Record<string, unknown> {
+  if (!isRecord(value)) throw new Error("Invalid response");
+  return value;
+}
+function isList(value: unknown): value is unknown[] { return Array.isArray(value); }
+function row(value: unknown): ReviewRow {
+  const item = record(value);
+  if (typeof item["id"] !== "string" || (item["state"] !== "draft" && item["state"] !== "approved")
+    || typeof item["version"] !== "number" || !Number.isSafeInteger(item["version"]) || item["version"] < 1) throw new Error("Invalid row");
+  return { id: item["id"], state: item["state"], version: item["version"] };
+}
+function rejected(status: number, body: unknown): ReviewWriteResult {
+  const code = record(body)["code"];
+  if ((status === 401 || status === 403) && [
+    "AUTHENTICATION_REQUIRED", "REVIEW_PERMISSION_DENIED", "COMMAND_REJECTED", "UPLOAD_DENIED",
+  ].includes(String(code))) return { status: "denied" };
+  if (status === 409 && ["REVIEW_CONFLICT", "FEATURE_TRANSITION_CONFLICT", "COMMAND_IDEMPOTENCY_CONFLICT"]
+    .includes(String(code))) return { status: "conflict" };
+  return { status: "unknown" };
+}
+
+/** Use the same user-scoped Supabase client and createAuthenticatedFetch session supplier. */
+export function createReviewTransport(options: {
+  supabase: ReviewSupabaseClient;
+  authenticatedFetch: SingleAttemptFetch;
+  apiOrigin: string;
+  lookup?: ReviewTransport["lookup"];
+}): ReviewTransport {
+  const origin = new URL(options.apiOrigin);
+  if (origin.protocol !== "https:" || origin.username || origin.password || origin.search || origin.hash
+    || origin.pathname !== "/") throw new Error("A fixed trusted HTTPS origin is required");
+  async function request(path: string, body: unknown, operationId: string): Promise<{ response: Response; body: unknown }> {
+    const response = await options.authenticatedFetch(new URL(path, origin), {
+      method: "POST", redirect: "error", signal: AbortSignal.timeout(15000),
+      headers: { "content-type": "application/json", "idempotency-key": operationId, "x-request-id": operationId },
+      body: JSON.stringify(body),
+    });
+    const result: unknown = await response.json();
+    return { response, body: result };
+  }
+  return {
+    lookup: options.lookup ?? (async operation => {
+      const url = new URL("/reviews/" + encodeURIComponent(operation.reviewId)
+        + "/operations/" + encodeURIComponent(operation.operationId), origin);
+      url.searchParams.set("kind", operation.kind);
+      url.searchParams.set("expectedVersion", String(operation.expectedVersion));
+      const response = await options.authenticatedFetch(url, {
+        method: "GET", redirect: "error", cache: "no-store", signal: AbortSignal.timeout(15000),
+        headers: { "x-request-id": operation.operationId },
+      });
+      if (!response.ok) return { status: "unknown" };
+      const body: unknown = await response.json();
+      const receipt = record(body);
+      if (receipt["status"] !== "confirmed" || receipt["operationId"] !== operation.operationId
+        || receipt["reviewId"] !== operation.reviewId) return { status: "unknown" };
+      return { status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId };
+    }),
+    async list() {
+      const { data, error, status } = await options.supabase.from("starter_reviews")
+        .select("id,state,version").order("id").limit(100);
+      if (error) {
+        if (status === 401 || status === 403) throw new ReviewAccessDenied();
+        throw new Error("Review read failed");
+      }
+      if (!isList(data)) throw new Error("Invalid list");
+      return data.map(row);
+    },
+    async approve(operation: ReviewOperation) {
+      const result = await request("/reviews/" + encodeURIComponent(operation.reviewId) + "/approve",
+        { expectedVersion: operation.expectedVersion }, operation.operationId);
+      if (!result.response.ok) return rejected(result.response.status, result.body);
+      const value = record(result.body);
+      if (value["state"] !== "approved" || value["version"] !== operation.expectedVersion + 1) return { status: "unknown" };
+      return { status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId };
+    },
+    async upload(operation: ReviewOperation, file: Blob) {
+      const input = { artifactId: operation.operationId, expectedVersion: operation.expectedVersion };
+      const base = "/reviews/" + encodeURIComponent(operation.reviewId);
+      const preview = await request(base + "/attachment-upload", input, operation.operationId);
+      if (!preview.response.ok) {
+        // These explicit preview rejections happen before any object or registration write.
+        const code = record(preview.body)["code"];
+        if ((preview.response.status === 501 && code === "UPLOADS_UNAVAILABLE")
+          || (preview.response.status === 400 && code === "UPLOAD_INPUT_INVALID")) return { status: "denied" };
+        return rejected(preview.response.status, preview.body);
+      }
+      const location = record(preview.body);
+      if (location["artifactId"] !== operation.operationId || location["bucketId"] !== "review-attachments"
+        || typeof location["objectPath"] !== "string"
+        || !location["objectPath"].endsWith("/" + operation.reviewId + "/" + operation.operationId + ".txt")) {
+        return { status: "unknown" };
+      }
+      // Never overwrite an object or repeat this upload after a network failure.
+      const stored = await options.supabase.storage.from("review-attachments")
+        .upload(location["objectPath"], file, { upsert: false, contentType: "text/plain" });
+      if (stored.error) return { status: "unknown" };
+      const registered = await request(base + "/attachment-registration", input, operation.operationId);
+      // The object is already stored. A rejection cannot roll back that side effect.
+      if (!registered.response.ok) return { status: "unknown" };
+      const value = record(registered.body);
+      const sha256 = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", await file.arrayBuffer())),
+        byte => byte.toString(16).padStart(2, "0")).join("");
+      if (value["artifactId"] !== operation.operationId || value["objectPath"] !== location["objectPath"]
+        || typeof value["runId"] !== "string" || value["sha256"] !== sha256
+        || value["bytes"] !== file.size) return { status: "unknown" };
+      return { status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId };
+    },
+  };
+}
+`;
+var STARTER_REVIEW_CLIENT_TEST = String.raw`import { expect, test } from "bun:test";
+import { createReviewClient, createReviewPendingStore, ReviewAccessDenied, type ReviewOperation, type ReviewTransport, type ReviewRow, type ReviewWriteResult } from "../src/client/reviews";
+import { createReviewTransport } from "../src/client/review-transport";
+
+const draft: ReviewRow = { id: "review-one", state: "draft", version: 1 };
+const uploadDraft: ReviewRow = { ...draft, id: "11111111-1111-4111-8111-111111111111" };
+function transport(overrides: Partial<ReviewTransport> = {}): ReviewTransport {
+  return {
+    list: async () => [draft],
+    approve: async op => ({ status: "confirmed", operationId: op.operationId, reviewId: op.reviewId }),
+    upload: async op => ({ status: "confirmed", operationId: op.operationId, reviewId: op.reviewId }),
+    ...overrides,
+  };
+}
+test("list has loading, empty, permission and failure states; old results cannot replace new reads", async () => {
+  let resolve: (rows: ReviewRow[]) => void = () => {};
+  let calls = 0;
+  const client = createReviewClient(transport({ list: () => ++calls === 1
+    ? new Promise(done => { resolve = done; }) : Promise.resolve([]) }));
+  const loading = client.load();
+  expect(client.snapshot().list.status).toBe("loading");
+  await client.load();
+  resolve([draft]); await loading;
+  expect(client.snapshot().list.status).toBe("empty");
+  for (const [error, status] of [[new ReviewAccessDenied(), "denied"], [new Error("private"), "error"]] as const) {
+    const failed = createReviewClient(transport({ list: async () => { throw error; } }));
+    await failed.load();
+    expect(failed.snapshot().list).toEqual({ status, rows: [] });
+    expect(JSON.stringify(failed.snapshot())).not.toContain("private");
+  }
+});
+test("double submit sends one write; unknown retains its identity and only a lookup can confirm it", async () => {
+  let sends = 0, lookups = 0, resolve: (result: ReviewWriteResult) => void = () => {};
+  const client = createReviewClient(transport({
+    approve: () => { sends++; return new Promise(done => { resolve = done; }); },
+    lookup: async op => { lookups++; return { status: "confirmed", operationId: op.operationId, reviewId: op.reviewId }; },
+  }));
+  const pending = client.approve(draft);
+  const operation = client.snapshot().mutation.operation;
+  await client.approve(draft);
+  resolve({ status: "unknown" }); await pending;
+  await client.approve(draft);
+  expect(sends).toBe(1);
+  expect(client.snapshot().mutation).toEqual({ status: "unknown", operation });
+  await client.reconcile();
+  expect(sends).toBe(1); expect(lookups).toBe(1);
+  expect(client.snapshot().mutation.status).toBe("confirmed");
+});
+test("conflict refreshes but does not retry the write; wrong receipt remains unknown", async () => {
+  let writes = 0, reads = 0;
+  const client = createReviewClient(transport({
+    list: async () => { reads++; return []; },
+    approve: async () => { writes++; return { status: "conflict" }; },
+  }));
+  await client.approve(draft);
+  expect(writes).toBe(1); expect(reads).toBe(1);
+  expect(client.snapshot().mutation.status).toBe("conflict");
+  const wrong = createReviewClient(transport({
+    approve: async () => ({ status: "confirmed", operationId: "foreign", reviewId: draft.id }),
+  }));
+  await wrong.approve(draft);
+  expect(wrong.snapshot().mutation.status).toBe("unknown");
+});
+test("upload validates size/type, retains failure identity, and disposal drops late results", async () => {
+  let uploads = 0;
+  const client = createReviewClient(transport({ upload: async () => { uploads++; throw new Error("private"); } }));
+  await client.upload(uploadDraft, new Blob(["bad"], { type: "application/pdf" }));
+  expect(uploads).toBe(0);
+  await client.upload(uploadDraft, new Blob(["ok"], { type: "text/plain" }));
+  expect(uploads).toBe(1);
+  expect(client.snapshot().mutation.status).toBe("unknown");
+  await client.reconcile();
+  expect(uploads).toBe(1);
+  client.dispose();
+  await client.upload(uploadDraft, new Blob(["ok"], { type: "text/plain" }));
+  expect(uploads).toBe(1);
+});
+
+test("upload-only input constraints never persist or dispatch an impossible request or block approval", async () => {
+  let saves = 0, uploads = 0, approvals = 0, saved: ReviewOperation | null = null;
+  const client = createReviewClient(transport({
+    upload: async () => { uploads++; return { status: "unknown" }; },
+    approve: async op => { approvals++; return { status: "confirmed", operationId: op.operationId, reviewId: op.reviewId }; },
+  }), {
+    load: () => saved, save: op => { saves++; saved = op; }, clear: () => { saved = null; },
+  });
+  await client.load();
+  expect(client.snapshot().list.rows).toEqual([draft]);
+  const file = new Blob(["hello"], { type: "text/plain" });
+  await client.upload(draft, file);
+  await client.upload({ ...uploadDraft, version: 2147483648 }, file);
+  expect(uploads).toBe(0); expect(saves).toBe(0); expect(saved).toBeNull();
+  expect(client.snapshot().mutation).toEqual({ status: "idle", operation: null });
+  await client.approve(draft);
+  expect(approvals).toBe(1); expect(saves).toBe(1);
+  expect(client.snapshot().mutation.status).toBe("confirmed");
+});
+
+test("explicit upload preview rejection clears pending before side effects, without retrying", async () => {
+  for (const [status, code] of [[501, "UPLOADS_UNAVAILABLE"], [400, "UPLOAD_INPUT_INVALID"]] as const) {
+    let requests = 0, uploads = 0, saved: ReviewOperation | null = null;
+    const adapter = createReviewTransport({
+      supabase: {
+        storage: { from: () => ({ upload: async () => { uploads++; return { error: null }; } }) },
+      } as unknown as Parameters<typeof createReviewTransport>[0]["supabase"],
+      apiOrigin: "https://reviews.example.test",
+      authenticatedFetch: async url => {
+        requests++;
+        return String(url).endsWith("/attachment-upload")
+          ? Response.json({ code }, { status }) : Response.json({ state: "approved", version: 2 });
+      },
+    });
+    const client = createReviewClient({ ...adapter, list: async () => [uploadDraft] }, {
+      load: () => saved, save: op => { saved = op; }, clear: () => { saved = null; },
+    });
+    await client.upload(uploadDraft, new Blob(["hello"], { type: "text/plain" }));
+    expect(client.snapshot().mutation.status).toBe("denied");
+    expect(saved).toBeNull(); expect(uploads).toBe(0); expect(requests).toBe(1);
+    await client.reconcile();
+    expect(requests).toBe(1);
+    await client.approve(uploadDraft);
+    expect(client.snapshot().mutation.status).toBe("confirmed");
+    expect(requests).toBe(2);
+  }
+});
+
+test("HTTP approval makes one authenticated request and preserves denied, conflict and unknown results", async () => {
+  const operation = { kind: "approve" as const, reviewId: draft.id, expectedVersion: 1, operationId: crypto.randomUUID() };
+  for (const [httpStatus, body, expected] of [
+    [200, { state: "approved", version: 2 }, "confirmed"],
+    [403, { code: "REVIEW_PERMISSION_DENIED" }, "denied"],
+    [409, { code: "COMMAND_IDEMPOTENCY_CONFLICT" }, "conflict"],
+    [500, { code: "INTERNAL_ERROR" }, "unknown"],
+    [200, { state: "approved", version: 99 }, "unknown"],
+  ] as const) {
+    let calls = 0;
+    const adapter = createReviewTransport({
+      supabase: {} as Parameters<typeof createReviewTransport>[0]["supabase"],
+      apiOrigin: "https://reviews.example.test",
+      authenticatedFetch: async (url, init) => {
+        calls++;
+        expect(String(url)).toBe("https://reviews.example.test/reviews/review-one/approve");
+        expect(new Headers(init?.headers).get("idempotency-key")).toBe(operation.operationId);
+        expect(init?.redirect).toBe("error");
+        expect(JSON.parse(String(init?.body))).toEqual({ expectedVersion: 1 });
+        return Response.json(body, { status: httpStatus });
+      },
+    });
+    expect((await adapter.approve(operation)).status).toBe(expected);
+    expect(calls).toBe(1);
+  }
+});
+
+test("private upload verifies its binding and checksum; a lost registration response is never replayed", async () => {
+  const operationId = crypto.randomUUID();
+  const file = new Blob(["hello"], { type: "text/plain" });
+  const path = "owner/" + uploadDraft.id + "/" + operationId + ".txt";
+  let uploads = 0, requests = 0;
+  const supabase = {
+    storage: { from(bucket: string) {
+      expect(bucket).toBe("review-attachments");
+      return { async upload(objectPath: string, body: Blob, options: { upsert: boolean }) {
+        uploads++;
+        expect(objectPath).toBe(path); expect(body).toBe(file); expect(options.upsert).toBe(false);
+        return { error: null };
+      } };
+    } },
+  } as unknown as Parameters<typeof createReviewTransport>[0]["supabase"];
+  const adapter = createReviewTransport({
+    supabase, apiOrigin: "https://reviews.example.test",
+    authenticatedFetch: async url => {
+      requests++;
+      if (String(url).endsWith("/attachment-upload")) {
+        return Response.json({ artifactId: operationId, bucketId: "review-attachments", objectPath: path });
+      }
+      throw new Error("Registration response lost");
+    },
+  });
+  const operation = { kind: "upload" as const, reviewId: uploadDraft.id, expectedVersion: 1, operationId };
+  await expect(adapter.upload(operation, file)).rejects.toThrow("Registration response lost");
+  expect(uploads).toBe(1); expect(requests).toBe(2);
+  const confirmed = createReviewTransport({
+    supabase, apiOrigin: "https://reviews.example.test",
+    authenticatedFetch: async url => String(url).endsWith("/attachment-upload")
+      ? Response.json({ artifactId: operationId, bucketId: "review-attachments", objectPath: path })
+      : Response.json({ artifactId: operationId, objectPath: path, runId: "run-one", bytes: 5,
+        sha256: "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824" }),
+  });
+  expect((await confirmed.upload(operation, file)).status).toBe("confirmed");
+});
+
+test("reload restores pending identity, denies replay and resolves only a matching durable receipt", async () => {
+  const values = new Map<string, string>();
+  const storage = {
+    getItem: (key: string) => values.get(key) ?? null,
+    setItem: (key: string, value: string) => { values.set(key, value); },
+    removeItem: (key: string) => { values.delete(key); },
+  };
+  const scope = { projectId: "p", tenantId: "t", applicationId: "reviews", subject: "owner" };
+  const pending = createReviewPendingStore(storage, scope);
+  let writes = 0;
+  const first = createReviewClient(transport({ approve: async () => { writes++; return { status: "unknown" }; } }), pending);
+  await first.approve(draft);
+  const operation = first.snapshot().mutation.operation!;
+  first.dispose();
+  const reloaded = createReviewClient(transport({
+    approve: async () => { writes++; return { status: "unknown" }; },
+    lookup: async op => ({ status: "confirmed", operationId: op.operationId, reviewId: op.reviewId }),
+  }), createReviewPendingStore(storage, scope));
+  expect(reloaded.snapshot().mutation).toEqual({ status: "unknown", operation });
+  await reloaded.approve(draft);
+  expect(writes).toBe(1);
+  expect(createReviewPendingStore(storage, { ...scope, subject: "other" }).load()).toBeNull();
+  expect(createReviewPendingStore(storage, { ...scope, projectId: "other" }).load()).toBeNull();
+  await reloaded.reconcile();
+  expect(reloaded.snapshot().mutation.status).toBe("confirmed");
+  expect(pending.load()).toBeNull();
+});
+
+test("denied or conflicting recovery never unlocks an unknown operation", async () => {
+  for (const status of ["denied", "conflict"] as const) {
+    let writes = 0;
+    const client = createReviewClient(transport({
+      approve: async () => { writes++; return { status: "unknown" }; },
+      lookup: async () => ({ status }),
+    }));
+    await client.approve(draft);
+    const original = client.snapshot().mutation.operation;
+    await client.reconcile(); await client.approve(draft);
+    expect(writes).toBe(1);
+    expect(client.snapshot().mutation).toEqual({ status: "unknown", operation: original });
+  }
+});
+
+test("unavailable recovery storage prevents dispatch, and disposal leaves pending evidence", async () => {
+  let writes = 0;
+  const client = createReviewClient(transport({ approve: async () => { writes++; return { status: "unknown" }; } }), {
+    load: () => null, save: () => { throw new Error("Storage unavailable"); }, clear: () => {},
+  });
+  await client.approve(draft);
+  expect(writes).toBe(0);
+  expect(client.snapshot().mutation.status).toBe("unknown");
+  let saved: ReviewOperation | null = null, cleared = 0, resolve: (result: ReviewWriteResult) => void = () => {};
+  const closed = createReviewClient(transport({ approve: () => new Promise(done => { resolve = done; }) }), {
+    load: () => saved, save: op => { saved = op; }, clear: () => { cleared++; },
+  });
+  const request = closed.approve(draft);
+  const op = closed.snapshot().mutation.operation!;
+  closed.dispose();
+  resolve({ status: "confirmed", operationId: op.operationId, reviewId: op.reviewId }); await request;
+  expect<ReviewOperation | null>(saved).toEqual(op); expect(cleared).toBe(0);
+});
+
+test("default recovery transport performs one read without body or mutation retry", async () => {
+  let calls = 0;
+  const operation = { kind: "approve" as const, reviewId: draft.id, expectedVersion: 1, operationId: crypto.randomUUID() };
+  const adapter = createReviewTransport({
+    supabase: {} as Parameters<typeof createReviewTransport>[0]["supabase"],
+    apiOrigin: "https://reviews.example.test",
+    authenticatedFetch: async (input, init) => {
+      calls++;
+      const url = new URL(String(input));
+      expect(url.pathname).toBe("/reviews/" + draft.id + "/operations/" + operation.operationId);
+      expect(url.searchParams.get("expectedVersion")).toBe("1");
+      expect(init?.method).toBe("GET"); expect(init?.body).toBeUndefined();
+      expect(init?.cache).toBe("no-store");
+      return Response.json({ status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId });
+    },
+  });
+  expect((await adapter.lookup!(operation)).status).toBe("confirmed");
+  expect(calls).toBe(1);
+});
+
+test("corrupt pending records fail closed and cannot be overwritten by another operation", async () => {
+  let value: string | null = "{broken", writes = 0;
+  const pending = createReviewPendingStore({
+    getItem: () => value, setItem: (_key, next) => { value = next; }, removeItem: () => { value = null; },
+  }, { projectId: "p", tenantId: "t", applicationId: "a", subject: "s" });
+  const blocked = createReviewClient(transport({ approve: async () => { writes++; return { status: "unknown" }; } }), pending);
+  await blocked.approve(draft);
+  expect(writes).toBe(0);
+  expect(blocked.snapshot().mutation).toEqual({ status: "unknown", operation: null });
+  expect(value).toBe("{broken");
+  value = null;
+  const original = { kind: "approve" as const, reviewId: draft.id, expectedVersion: 1, operationId: crypto.randomUUID() };
+  pending.save(original);
+  const other = { ...original, operationId: crypto.randomUUID() };
+  expect(() => pending.save(other)).toThrow("Another unresolved operation");
+  expect(() => pending.clear(other)).toThrow("identity changed");
+  expect(pending.load()).toEqual(original);
+});
+
+test("a competing pending operation is recovered instead of the undispatched attempt", async () => {
+  let value: string | null = null, writes = 0, lookedUp: unknown;
+  const pending = createReviewPendingStore({
+    getItem: () => value, setItem: (_key, next) => { value = next; }, removeItem: () => { value = null; },
+  }, { projectId: "p", tenantId: "t", applicationId: "a", subject: "s" });
+  const client = createReviewClient(transport({
+    approve: async () => { writes++; return { status: "unknown" }; },
+    lookup: async op => {
+      lookedUp = op;
+      return { status: "confirmed", operationId: op.operationId, reviewId: op.reviewId };
+    },
+  }), pending);
+  const original = { kind: "upload" as const, reviewId: uploadDraft.id, expectedVersion: 1, operationId: crypto.randomUUID() };
+  pending.save(original);
+  await client.approve(draft);
+  expect(writes).toBe(0);
+  expect(client.snapshot().mutation).toEqual({ status: "unknown", operation: original });
+  await client.reconcile();
+  expect(lookedUp).toEqual(original);
+  expect(pending.load()).toBeNull();
+});
+
+test("disposal during submitting notification prevents dispatch and preserves pending identity", async () => {
+  let writes = 0, saved: ReviewOperation | null = null;
+  const client = createReviewClient(transport({
+    approve: async () => { writes++; return { status: "unknown" }; },
+  }), { load: () => saved, save: op => { saved = op; }, clear: () => { saved = null; } });
+  client.subscribe(() => { if (client.snapshot().mutation.status === "submitting") client.dispose(); });
+  await client.approve(draft);
+  expect(writes).toBe(0);
+  expect(client.snapshot().mutation.operation).toEqual(saved);
+  expect(saved).not.toBeNull();
+});
+
+test("registration rejection after object upload retains pending identity and never submits a replacement", async () => {
+  for (const [status, code] of [[403, "UPLOAD_DENIED"], [409, "COMMAND_IDEMPOTENCY_CONFLICT"]] as const) {
+    let uploads = 0, requests = 0, saved: ReviewOperation | null = null;
+    const adapter = createReviewTransport({
+      supabase: {
+        storage: { from: () => ({ upload: async () => { uploads++; return { error: null }; } }) },
+      } as unknown as Parameters<typeof createReviewTransport>[0]["supabase"],
+      apiOrigin: "https://reviews.example.test",
+      authenticatedFetch: async (input, init) => {
+        requests++;
+        if (String(input).endsWith("/attachment-upload")) {
+          const operationId = new Headers(init?.headers).get("idempotency-key")!;
+          return Response.json({ artifactId: operationId, bucketId: "review-attachments",
+            objectPath: "owner/" + uploadDraft.id + "/" + operationId + ".txt" });
+        }
+        return Response.json({ code }, { status });
+      },
+    });
+    const client = createReviewClient(adapter, {
+      load: () => saved, save: op => { saved = op; }, clear: () => { saved = null; },
+    });
+    const file = new Blob(["hello"], { type: "text/plain" });
+    await client.upload(uploadDraft, file);
+    expect(client.snapshot().mutation.status).toBe("unknown");
+    expect(client.snapshot().mutation.operation).toEqual(saved);
+    expect(saved).not.toBeNull();
+    await client.upload(uploadDraft, file);
+    expect(uploads).toBe(1);
+    expect(requests).toBe(2);
+  }
+});
+
+
+for (const kind of ["approve", "upload"] as const) {
+  const submit = (client: ReturnType<typeof createReviewClient>) => kind === "approve"
+    ? client.approve(draft) : client.upload(uploadDraft, new Blob(["hello"], { type: "text/plain" }));
+  for (const failure of ["silent", "read-error", "operation", "version", "kind"] as const) {
+    test(kind + " verifies pending readback before any transport: " + failure, async () => {
+      let saved: ReviewOperation | null = null, attempted = false, sends = 0;
+      const client = createReviewClient(transport({
+        approve: async () => { sends++; return { status: "unknown" }; },
+        upload: async () => { sends++; return { status: "unknown" }; },
+      }), {
+        load() {
+          if (attempted && failure === "read-error") throw new Error("private storage failure");
+          return saved;
+        },
+        save(operation) {
+          attempted = true;
+          if (failure === "silent") return;
+          saved = { ...operation };
+          if (failure === "operation") saved.operationId = crypto.randomUUID();
+          if (failure === "version") saved.expectedVersion++;
+          if (failure === "kind") saved.kind = kind === "approve" ? "upload" : "approve";
+        },
+        clear() { throw new Error("Must not clear an unconfirmed operation"); },
+      });
+      await submit(client);
+      await submit(client);
+      expect(sends).toBe(0);
+      expect(client.snapshot().mutation.status).toBe("unknown");
+      expect(JSON.stringify(client.snapshot())).not.toContain("private storage failure");
+      expect(client.snapshot().mutation.operation).toEqual(failure === "read-error" ? null : saved);
+    });
+  }
+  for (const resultStatus of ["confirmed", "denied", "conflict"] as const) {
+    test(kind + " retains pending after silent cleanup: " + resultStatus, async () => {
+      let saved: ReviewOperation | null = null, sends = 0, clears = 0;
+      const send = async (operation: ReviewOperation): Promise<ReviewWriteResult> => {
+        sends++;
+        return resultStatus === "confirmed"
+          ? { status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId }
+          : { status: resultStatus };
+      };
+      const client = createReviewClient(transport({ approve: send, upload: send }), {
+        load: () => saved, save: operation => { saved = operation; }, clear: () => { clears++; },
+      });
+      await submit(client);
+      expect(client.snapshot().mutation).toEqual({ status: "unknown", operation: saved });
+      await submit(client);
+      expect(sends).toBe(1);
+      expect(clears).toBe(1);
+      expect(saved).not.toBeNull();
+    });
+  }
+  test(kind + " accepts exact JSON readback and recovers once without another write", async () => {
+    const values = new Map<string, string>();
+    const pending = createReviewPendingStore({
+      getItem: key => values.get(key) ?? null,
+      setItem: (key, value) => { values.set(key, value); },
+      removeItem: key => { values.delete(key); },
+    }, { projectId: "project", tenantId: "tenant", applicationId: "reviews", subject: "owner" });
+    let sends = 0, reads = 0;
+    const send = async (operation: ReviewOperation): Promise<ReviewWriteResult> => {
+      sends++;
+      // Stored field ordering differs from the newly created operation.
+      expect(pending.load()).toEqual(operation);
+      return { status: "unknown" };
+    };
+    const client = createReviewClient(transport({
+      approve: send, upload: send,
+      lookup: async operation => {
+        reads++;
+        return { status: "confirmed", operationId: operation.operationId, reviewId: operation.reviewId };
+      },
+    }), pending);
+    await submit(client);
+    await submit(client);
+    expect(sends).toBe(1);
+    await client.reconcile();
+    expect(client.snapshot().mutation.status).toBe("confirmed");
+    expect(pending.load()).toBeNull();
+    expect(sends).toBe(1);
+    expect(reads).toBe(1);
+  });
+}
+`;
+
+// src/shared/tools/app-starter-receipts.ts
+var STARTER_REVIEW_RECEIPTS = `import { Effect } from "effect";
+import { Controller, DB_CLIENT, Get, Inject, Injectable, Param, Query, REQUEST_CONTEXT } from "@supacloud/app";
+import { ApplicationError, createSchemaDecoder } from "@supacloud/elysia";
+import { ReceiptOperation, ReceiptParams, ReceiptQuery, ReceiptResult,
+  type ReviewOperation, type ReviewReceipt } from "./contracts";
+export type { ReviewOperation, ReviewReceipt } from "./contracts";
+
+const decodeOperation = createSchemaDecoder(ReceiptOperation, { normalize: false });
+export interface ReviewReceiptPort {
+  lookupOperation(context: unknown, operation: ReviewOperation): Promise<ReviewReceipt>;
+}
+type ReceiptError =
+  | { readonly _tag: "AUTHENTICATION_REQUIRED" }
+  | { readonly _tag: "REVIEW_PERMISSION_DENIED" }
+  | { readonly _tag: "UPLOAD_DENIED" }
+  | { readonly _tag: "COMMAND_REJECTED" }
+  | { readonly _tag: "COMMAND_IDEMPOTENCY_CONFLICT" }
+  | { readonly _tag: "RECEIPT_INPUT_INVALID" }
+  | { readonly _tag: "RECEIPTS_UNAVAILABLE" };
+
+@Injectable({ scope: "request" })
+export class ReviewReceipts {
+  constructor(@Inject(DB_CLIENT) private readonly store: Partial<ReviewReceiptPort>,
+    @Inject(REQUEST_CONTEXT) private readonly context: unknown) {}
+  lookup(operation: ReviewOperation): Promise<ReviewReceipt> {
+    let input: ReviewOperation;
+    try { input = decodeOperation(operation); }
+    catch {
+      throw new ApplicationError("Invalid receipt input", { status: 400, code: "RECEIPT_INPUT_INVALID" });
+    }
+    if (!this.store.lookupOperation) {
+      throw new ApplicationError("Receipt lookup is unavailable", { status: 503, code: "RECEIPTS_UNAVAILABLE" });
+    }
+    return this.store.lookupOperation(this.context, input);
+  }
+}
+
+@Controller("/reviews")
+export class ReviewReceiptsController {
+  constructor(@Inject(ReviewReceipts) private readonly receipts: ReviewReceipts) {}
+  @Get("/:id/operations/:operationId", {
+    params: ReceiptParams, query: ReceiptQuery, responses: { 200: ReceiptResult },
+    effect: {
+      required: true, dependencies: [], retry: "none",
+      errors: [
+        { tag: "AUTHENTICATION_REQUIRED", status: 401, code: "AUTHENTICATION_REQUIRED" },
+        { tag: "REVIEW_PERMISSION_DENIED", status: 403, code: "REVIEW_PERMISSION_DENIED" },
+        { tag: "UPLOAD_DENIED", status: 403, code: "UPLOAD_DENIED" },
+        { tag: "COMMAND_REJECTED", status: 403, code: "COMMAND_REJECTED" },
+        { tag: "COMMAND_IDEMPOTENCY_CONFLICT", status: 409, code: "COMMAND_IDEMPOTENCY_CONFLICT" },
+        { tag: "RECEIPT_INPUT_INVALID", status: 400, code: "RECEIPT_INPUT_INVALID" },
+        { tag: "RECEIPTS_UNAVAILABLE", status: 503, code: "RECEIPTS_UNAVAILABLE" },
+      ],
+    },
+  })
+  lookup(@Param("id") reviewId: string, @Param("operationId") operationId: string,
+    @Query("kind") kind: ReviewOperation["kind"], @Query("expectedVersion") expectedVersion: string): Effect.Effect<ReviewReceipt, ReceiptError, never> {
+    return Effect.promise(() => this.receipts.lookup({ reviewId, operationId, kind, expectedVersion: Number(expectedVersion) }));
+  }
+}
+`;
+
 // src/shared/tools/app-starter-query.ts
 var STARTER_REVIEW_QUERY = `import type { SupabaseClient } from "@supabase/supabase-js";
 import type { ReviewRow } from "../../db/schema";
@@ -23481,6 +24487,330 @@ export async function listReviews(
 }
 `;
 
+// src/shared/tools/app-starter-tasks.ts
+var STARTER_TASK_CONTRACTS = `import { t, type UnwrapSchema } from "elysia";
+import { AttachmentResult } from "./attachment";
+import { REVIEW_VERSION_MAX } from "./limits";
+import { ReviewVersion } from "./contracts";
+
+export const TaskParams = t.Object({ id: t.String({ minLength: 1, maxLength: 100 }) }, { additionalProperties: false });
+export const RetryBody = t.Object({
+  expectedVersion: t.Integer({ minimum: 2, maximum: REVIEW_VERSION_MAX }),
+  expectedRunId: t.String({ format: "uuid" }),
+  recoveryId: t.String({ format: "uuid" }),
+}, { additionalProperties: false });
+export const RetryInput = t.Object({
+  reviewId: TaskParams.properties.id, ...RetryBody.properties,
+}, { additionalProperties: false });
+export const TaskStatus = t.Object({
+  reviewId: TaskParams.properties.id,
+  version: ReviewVersion,
+  artifactId: t.Nullable(t.String({ format: "uuid" })),
+  runId: t.Nullable(t.String({ format: "uuid" })),
+  state: t.Union([t.Literal("not_submitted"), t.Literal("queued"), t.Literal("running"),
+    t.Literal("completed"), t.Literal("failed"), t.Literal("cancelled")]),
+  attempts: t.Integer({ minimum: 0 }),
+  maxAttempts: t.Literal(3),
+  canRetry: t.Boolean(),
+  result: t.Nullable(AttachmentResult),
+}, { additionalProperties: false });
+export const RetryResult = t.Object({
+  reviewId: TaskParams.properties.id,
+  previousRunId: t.String({ format: "uuid" }),
+  runId: t.String({ format: "uuid" }),
+  state: t.Literal("queued"),
+}, { additionalProperties: false });
+export type ReviewTaskStatus = UnwrapSchema<typeof TaskStatus>;
+export type ReviewRetryBody = UnwrapSchema<typeof RetryBody>;
+export type ReviewRetryInput = UnwrapSchema<typeof RetryInput>;
+export type ReviewRetryResult = UnwrapSchema<typeof RetryResult>;
+`;
+var STARTER_TASK_FEATURE = `import { Effect } from "effect";
+import { Body, Controller, DB_CLIENT, Get, Inject, Injectable, Param, Post, REQUEST_CONTEXT } from "@supacloud/app";
+import { ApplicationError } from "@supacloud/elysia";
+import { RetryBody, RetryResult, TaskParams, TaskStatus,
+  type ReviewRetryBody, type ReviewRetryInput, type ReviewRetryResult, type ReviewTaskStatus } from "./task-contracts";
+
+export interface ReviewTaskPort {
+  attachmentTask(context: unknown, reviewId: string): Promise<ReviewTaskStatus>;
+  retryAttachmentTask(context: unknown, input: ReviewRetryInput): Promise<ReviewRetryResult>;
+}
+type TaskError =
+  | { readonly _tag: "AUTHENTICATION_REQUIRED" }
+  | { readonly _tag: "TASK_INPUT_INVALID" }
+  | { readonly _tag: "TASK_DENIED" }
+  | { readonly _tag: "TASK_CONFLICT" }
+  | { readonly _tag: "TASK_UNAVAILABLE" }
+  | { readonly _tag: "TASK_OUTCOME_UNKNOWN" };
+
+@Injectable({ scope: "request" })
+export class ReviewTasks {
+  constructor(@Inject(DB_CLIENT) private readonly store: Partial<ReviewTaskPort>,
+    @Inject(REQUEST_CONTEXT) private readonly context: unknown) {}
+
+  status(id: string): Promise<ReviewTaskStatus> {
+    if (!this.store.attachmentTask) throw new ApplicationError("Attachment tasks are not configured", { status: 501, code: "TASK_UNAVAILABLE" });
+    return this.store.attachmentTask(this.context, id);
+  }
+  retry(input: ReviewRetryInput): Promise<ReviewRetryResult> {
+    if (!this.store.retryAttachmentTask) throw new ApplicationError("Attachment tasks are not configured", { status: 501, code: "TASK_UNAVAILABLE" });
+    return this.store.retryAttachmentTask(this.context, input);
+  }
+}
+
+@Controller("/reviews")
+export class ReviewTasksController {
+  constructor(@Inject(ReviewTasks) private readonly tasks: ReviewTasks) {}
+
+  @Get("/:id/attachment-task", {
+    params: TaskParams, responses: { 200: TaskStatus },
+    effect: { required: true, dependencies: [], retry: "none", errors: [
+      { tag: "AUTHENTICATION_REQUIRED", status: 401, code: "AUTHENTICATION_REQUIRED" },
+      { tag: "TASK_INPUT_INVALID", status: 400, code: "TASK_INPUT_INVALID" },
+      { tag: "TASK_DENIED", status: 403, code: "TASK_DENIED" },
+      { tag: "TASK_CONFLICT", status: 409, code: "TASK_CONFLICT" },
+      { tag: "TASK_UNAVAILABLE", status: 501, code: "TASK_UNAVAILABLE" },
+      { tag: "TASK_OUTCOME_UNKNOWN", status: 503, code: "TASK_OUTCOME_UNKNOWN" },
+    ] },
+  })
+  status(@Param("id") id: string): Effect.Effect<ReviewTaskStatus, TaskError, never> {
+    return Effect.promise(() => this.tasks.status(id));
+  }
+
+  @Post("/:id/attachment-task/retry", {
+    params: TaskParams, body: RetryBody, responses: { 200: RetryResult },
+    effect: { required: true, dependencies: [], retry: "none", errors: [
+      { tag: "AUTHENTICATION_REQUIRED", status: 401, code: "AUTHENTICATION_REQUIRED" },
+      { tag: "TASK_INPUT_INVALID", status: 400, code: "TASK_INPUT_INVALID" },
+      { tag: "TASK_DENIED", status: 403, code: "TASK_DENIED" },
+      { tag: "TASK_CONFLICT", status: 409, code: "TASK_CONFLICT" },
+      { tag: "TASK_UNAVAILABLE", status: 501, code: "TASK_UNAVAILABLE" },
+      { tag: "TASK_OUTCOME_UNKNOWN", status: 503, code: "TASK_OUTCOME_UNKNOWN" },
+    ] },
+  })
+  retry(@Param("id") id: string, @Body() body: ReviewRetryBody): Effect.Effect<ReviewRetryResult, TaskError, never> {
+    return Effect.promise(() => this.tasks.retry({ ...body, reviewId: id }));
+  }
+}
+`;
+var STARTER_TASK_SCHEMA = `-- Forward-only operator provisioning after 004 and the platform Workflow runtime.
+CREATE TABLE public.starter_attachment_retries (
+  run_id uuid PRIMARY KEY,
+  review_id text NOT NULL REFERENCES public.starter_attachments(review_id),
+  previous_run_id uuid NOT NULL UNIQUE,
+  generation integer NOT NULL CHECK (generation > 0),
+  UNIQUE(review_id,generation),
+  CHECK (run_id <> previous_run_id)
+);
+ALTER TABLE public.starter_attachment_retries ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON public.starter_attachment_retries FROM PUBLIC, anon, authenticated;
+GRANT SELECT,INSERT ON public.starter_attachment_retries TO starter_review_http;
+GRANT SELECT ON public.starter_attachment_retries TO starter_review_worker;
+DROP POLICY IF EXISTS starter_http_retry_read ON public.starter_attachment_retries;
+CREATE POLICY starter_http_retry_read ON public.starter_attachment_retries
+  FOR SELECT TO starter_review_http USING (true);
+DROP POLICY IF EXISTS starter_http_retry_insert ON public.starter_attachment_retries;
+CREATE POLICY starter_http_retry_insert ON public.starter_attachment_retries
+  FOR INSERT TO starter_review_http WITH CHECK (true);
+DROP POLICY IF EXISTS starter_worker_retry_read ON public.starter_attachment_retries;
+CREATE POLICY starter_worker_retry_read ON public.starter_attachment_retries
+  FOR SELECT TO starter_review_worker USING (true);
+-- Trusted HTTP adapters authorize the review before inspecting its bound run.
+GRANT EXECUTE ON FUNCTION supacloud_workflows.snapshot(uuid,boolean) TO starter_review_http;
+`;
+var STARTER_TASK_HOST = `import { t } from "elysia";
+import { createTransactionalCommand, plaintextCommandInput } from "@supacloud/commands";
+import { CommandError } from "@supacloud/contracts";
+import { createPostgresCommandStore, type CommandDatabase, type CommandTransaction } from "@supacloud/db";
+import { ApplicationError, createSchemaDecoder, requireTrustedIdentity } from "@supacloud/elysia";
+import { AttachmentInput, AttachmentResult } from "../review/attachment";
+import { ReviewResult } from "../review/contracts";
+import { RetryInput, RetryResult, TaskParams, TaskStatus, type ReviewRetryInput } from "../review/task-contracts";
+import type { ReviewTaskPort } from "../review/tasks";
+import type { attachments, attachmentRetries, ReviewRow } from "../../db/schema";
+
+export interface ReviewTaskOptions { database: CommandDatabase; projectId: string; tenantId: string }
+type Binding = Pick<typeof attachments.$inferSelect, "artifactId" | "runId">
+  & Pick<typeof attachmentRetries.$inferSelect, "generation" | "runId">;
+const decodeInput = createSchemaDecoder(RetryInput, { normalize: false });
+const decodeRetry = createSchemaDecoder(RetryResult, { normalize: false });
+const decodeStatus = createSchemaDecoder(TaskStatus, { normalize: false });
+const decodeParams = createSchemaDecoder(TaskParams, { normalize: false });
+const decodeReview: (value: unknown) => Pick<ReviewRow, "state" | "version"> =
+  createSchemaDecoder(ReviewResult, { normalize: false });
+const decodeResult = createSchemaDecoder(AttachmentResult, { normalize: false });
+const decodeBinding: (value: unknown) => Binding = createSchemaDecoder(t.Object({
+  artifactId: t.String({ format: "uuid" }), runId: t.String({ format: "uuid" }),
+  generation: t.Integer({ minimum: 0 }),
+}), { normalize: false });
+const decodeRun = createSchemaDecoder(t.Object({
+  runId: t.String({ format: "uuid" }), workflowName: t.Literal("review.verify-attachment"),
+  workflowVersion: t.Literal("1"),
+  status: t.Union([t.Literal("queued"), t.Literal("running"), t.Literal("completed"), t.Literal("failed"), t.Literal("cancelled")]),
+  input: AttachmentInput, output: t.Unknown(), idempotent: t.Boolean(),
+  steps: t.Array(t.Object({
+    stepKey: t.Literal("verify"), attempts: t.Integer({ minimum: 0 }),
+    maxAttempts: t.Literal(3),
+    status: t.Union([t.Literal("queued"), t.Literal("running"), t.Literal("completed"), t.Literal("failed"), t.Literal("dead_lettered"), t.Literal("cancelled")]),
+  }, { additionalProperties: true }), { minItems: 1, maxItems: 1 }),
+}, { additionalProperties: true }), { normalize: false });
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function record(value: unknown): Record<string, unknown> {
+  if (!isRecord(value)) throw new Error("Invalid task record");
+  return value;
+}
+function rows(value: unknown): Record<string, unknown>[] {
+  if (!Array.isArray(value)) throw new Error("Invalid task rows");
+  return value.map(record);
+}
+function capture(value: unknown): ReviewRetryInput {
+  try {
+    const input = decodeInput(value);
+    return { ...input, recoveryId: input.recoveryId.toLowerCase(), expectedRunId: input.expectedRunId.toLowerCase() };
+  } catch { throw new ApplicationError("Invalid task request", { status: 400, code: "TASK_INPUT_INVALID" }); }
+}
+function failure(error: unknown): never {
+  if (error instanceof ApplicationError) throw error;
+  if (error instanceof CommandError && error.code === "COMMAND_REJECTED") {
+    throw new ApplicationError("Task access denied", { status: 403, code: "TASK_DENIED" });
+  }
+  if (error instanceof CommandError && error.code === "COMMAND_IDEMPOTENCY_CONFLICT") {
+    throw new ApplicationError("Task changed or is not retryable", { status: 409, code: "TASK_CONFLICT" });
+  }
+  throw new ApplicationError("Task outcome could not be confirmed", { status: 503, code: "TASK_OUTCOME_UNKNOWN" });
+}
+const conflict = () => { throw new CommandError("COMMAND_IDEMPOTENCY_CONFLICT"); };
+
+export async function createReviewTaskAdapters(options: ReviewTaskOptions): Promise<ReviewTaskPort> {
+  const { database, projectId, tenantId } = options;
+  const configured = rows(await database.transaction(tx => tx.query(
+    "SELECT project_id,tenant_id FROM public.starter_application WHERE singleton",
+  )));
+  if (!projectId.trim() || !tenantId.trim() || configured.length !== 1
+    || configured[0]?.["project_id"] !== projectId || configured[0]?.["tenant_id"] !== tenantId) {
+    throw new Error("Task database project/tenant binding mismatch");
+  }
+  function actor(context: unknown): string {
+    const who = requireTrustedIdentity(context);
+    const access = record(record(context)["access"]);
+    if (access["projectId"] !== projectId || access["tenantId"] !== tenantId
+      || !Array.isArray(access["permissions"]) || !access["permissions"].includes("review.approve")) {
+      throw new ApplicationError("Task access denied", { status: 403, code: "TASK_DENIED" });
+    }
+    return who.subject;
+  }
+  async function authorize(tx: CommandTransaction, subject: string, reviewId: string) {
+    const found = rows(await tx.query(
+      "SELECT r.state,r.version FROM public.starter_reviews r " +
+      "JOIN public.starter_members m ON m.subject=r.owner_id CROSS JOIN public.starter_application p " +
+      "WHERE r.id=$1 AND r.owner_id=$2 AND m.enabled AND m.can_approve " +
+      "AND p.singleton AND p.project_id=$3 AND p.tenant_id=$4 FOR UPDATE OF r,m FOR SHARE OF p",
+      [reviewId, subject, projectId, tenantId],
+    ));
+    if (found.length !== 1) throw new ApplicationError("Task access denied", { status: 403, code: "TASK_DENIED" });
+    return decodeReview(found[0]);
+  }
+  async function binding(tx: CommandTransaction, reviewId: string) {
+    const found = rows(await tx.query(
+      'SELECT a.artifact_id AS "artifactId",COALESCE(retry.run_id,a.run_id) AS "runId",COALESCE(retry.generation,0) AS generation ' +
+      "FROM public.starter_attachments a LEFT JOIN LATERAL (" +
+      "SELECT run_id,generation FROM public.starter_attachment_retries WHERE review_id=a.review_id ORDER BY generation DESC LIMIT 1" +
+      ") retry ON true WHERE a.review_id=$1", [reviewId],
+    ));
+    return found.length === 0 ? null : decodeBinding(found[0]);
+  }
+  async function snapshot(tx: CommandTransaction, runId: string) {
+    return rows(await tx.query("SELECT supacloud_workflows.snapshot($1::uuid,false) AS run", [runId]))[0]?.["run"];
+  }
+  function boundRun(value: unknown, reviewId: string, version: number, bound: NonNullable<Awaited<ReturnType<typeof binding>>>) {
+    const run = decodeRun(value);
+    if (run.runId !== bound.runId || run.input.reviewId !== reviewId
+      || run.input.version !== version || run.input.artifactId !== bound.artifactId) {
+      throw new Error("Task Workflow binding mismatch");
+    }
+    const step = run.steps[0];
+    if (!step || (run.status === "queued" && step.status !== "queued")
+      || (run.status === "running" && step.status !== "queued" && step.status !== "running")
+      || (run.status === "completed" && step.status !== "completed")
+      || (run.status === "failed" && step.status !== "failed" && step.status !== "dead_lettered")
+      || (run.status === "cancelled" && step.status !== "cancelled")) {
+      throw new Error("Task Workflow state mismatch");
+    }
+    return run;
+  }
+  const retry = createTransactionalCommand({
+    name: "review.retry-attachment", store: createPostgresCommandStore(database),
+    inputCodec: plaintextCommandInput, input: capture, result: decodeRetry,
+    async authorize(who, input, tx) {
+      try {
+        const review = await authorize(tx, who.actorId, input.reviewId);
+        return review.state === "approved" && review.version === input.expectedVersion ? "allow" : "deny";
+      } catch (error) {
+        if (error instanceof ApplicationError && error.code === "TASK_DENIED") return "deny";
+        throw error;
+      }
+    },
+    async execute(tx, input) {
+      const bound = await binding(tx, input.reviewId);
+      if (!bound || bound.runId !== input.expectedRunId || input.recoveryId === bound.runId) return conflict();
+      const previous = boundRun(await snapshot(tx, bound.runId), input.reviewId, input.expectedVersion, bound);
+      if (previous.status !== "failed") return conflict();
+      if (await snapshot(tx, input.recoveryId) !== null) return conflict();
+      const started = rows(await tx.query(
+        "SELECT supacloud_workflows.start_run($1::uuid,'review.verify-attachment','1','verify',$2::text::jsonb,3) AS run",
+        [input.recoveryId, JSON.stringify(previous.input)],
+      ))[0]?.["run"];
+      const next = boundRun(started, input.reviewId, input.expectedVersion, { ...bound, runId: input.recoveryId });
+      if (next.idempotent || next.status !== "queued") return conflict();
+      await tx.query("INSERT INTO public.starter_attachment_retries(run_id,review_id,previous_run_id,generation) VALUES($1,$2,$3,$4)",
+        [input.recoveryId, input.reviewId, bound.runId, bound.generation + 1]);
+      return { reviewId: input.reviewId, previousRunId: bound.runId, runId: input.recoveryId, state: "queued" as const };
+    },
+    audit: { event: "review.attachment-retried", details: input => ({
+      reviewId: input.reviewId, previousRunId: input.expectedRunId, runId: input.recoveryId,
+    }) },
+  });
+  return {
+    async attachmentTask(context, reviewId) {
+      try {
+        const subject = actor(context);
+        try { decodeParams({ id: reviewId }); }
+        catch { throw new ApplicationError("Invalid task request", { status: 400, code: "TASK_INPUT_INVALID" }); }
+        return await database.transaction(async tx => {
+          const review = await authorize(tx, subject, reviewId);
+          const bound = await binding(tx, reviewId);
+          const empty = { reviewId, version: review.version, artifactId: bound?.artifactId ?? null,
+            runId: null, state: "not_submitted", attempts: 0, maxAttempts: 3, canRetry: false, result: null } as const;
+          if (!bound) return decodeStatus(empty);
+          const value = await snapshot(tx, bound.runId);
+          if (value === null && review.state === "draft" && bound.generation === 0) return decodeStatus(empty);
+          const run = boundRun(value, reviewId, review.version, bound);
+          const step = run.steps[0];
+          if (!step) throw new Error("Missing task step");
+          const result = run.status === "completed" ? decodeResult(run.output) : null;
+          if (result && (result.reviewId !== reviewId || result.version !== review.version || result.artifactId !== bound.artifactId)) {
+            throw new Error("Task result binding mismatch");
+          }
+          return decodeStatus({ ...empty, runId: run.runId,
+            state: run.status === "running" && step.status === "queued" ? "queued" : run.status,
+            attempts: step.attempts, canRetry: run.status === "failed", result });
+        });
+      } catch (error) { return failure(error); }
+    },
+    async retryAttachmentTask(context, value) {
+      try {
+        const subject = actor(context), input = capture(value);
+        const receipt = await retry.execute({ actorId: subject, tenantId }, input.recoveryId, input);
+        if (receipt.status !== "confirmed") throw new CommandError("COMMAND_OUTCOME_UNKNOWN");
+        return receipt.result;
+      } catch (error) { return failure(error); }
+    },
+  };
+}
+`;
+
 // src/shared/tools/app-starter.ts
 var { compiler: compilerMetadata2, app: appMetadata2, elysia: elysiaMetadata2, commands: commandsMetadata, contracts: contractsMetadata, db: dbMetadata, sdk: sdkMetadata } = starter_metadata_default.packages;
 var json2 = (value) => `${JSON.stringify(value, null, 2)}
@@ -23489,6 +24819,10 @@ function appStarterFiles(name) {
   return {
     ...starterDatabaseFiles(),
     "src/review/list-reviews.ts": STARTER_REVIEW_QUERY,
+    "src/review/task-contracts.ts": STARTER_TASK_CONTRACTS,
+    "src/review/tasks.ts": STARTER_TASK_FEATURE,
+    "src/host/review-tasks.ts": STARTER_TASK_HOST,
+    "migrations/005-review-task-recovery.sql": STARTER_TASK_SCHEMA,
     "package.json": json2({
       name,
       version: "0.0.0",
@@ -23609,6 +24943,7 @@ export default defineSupacloudConfig({
         { source: "migrations/002-review-attachments.sql", version: "2", name: "review_attachments", executor: "project-migration" },
         { source: "migrations/003-review-uploads.sql", version: "3", name: "review_uploads", executor: "operator-provisioning" },
         { source: "migrations/004-review-runtime-roles.sql", version: "4", name: "review_runtime_roles", executor: "operator-provisioning" },
+        { source: "migrations/005-review-task-recovery.sql", version: "5", name: "review_task_recovery", executor: "operator-provisioning" },
       ],
     },
   },
@@ -23780,8 +25115,11 @@ import {
 } from "@supacloud/app";
 import { ApplicationError, assertFeatureTransition, createSchemaDecoder } from "@supacloud/elysia";
 import { ApproveBody, HealthResult, Params, ReviewResult, type ApprovalBody, type Review } from "./contracts";
+import { REVIEW_VERSION_MAX } from "./limits";
 import { VerifyReviewAttachment } from "./attachment";
 import { ReviewUploads, ReviewUploadsController, type ReviewUploadPort } from "./uploads";
+import { ReviewReceipts, ReviewReceiptsController, type ReviewReceiptPort } from "./receipts";
+import { ReviewTasks, ReviewTasksController, type ReviewTaskPort } from "./tasks";
 
 export const reviewSpec = defineFeatureSpec({
   name: "review",
@@ -23797,7 +25135,7 @@ export const reviewSpec = defineFeatureSpec({
 });
 
 // Production implementations must bind both operations to the current transaction.
-export interface ReviewStore extends Partial<ReviewUploadPort> {
+export interface ReviewStore extends Partial<ReviewUploadPort>, Partial<ReviewReceiptPort>, Partial<ReviewTaskPort> {
   get(table: string, key: string): unknown;
   set(table: string, key: string, value: Review): void | Promise<void>;
 }
@@ -23828,6 +25166,9 @@ export class ApproveReview {
     if (current.version !== expectedVersion) {
       throw new ApplicationError("Review state or version changed", { status: 409, code: "REVIEW_CONFLICT" });
     }
+    if (current.version === REVIEW_VERSION_MAX) {
+      throw new ApplicationError("Review version is exhausted", { status: 409, code: "REVIEW_CONFLICT" });
+    }
     const next = {
       state: assertFeatureTransition(reviewSpec, current.state, "approve"),
       version: current.version + 1,
@@ -23887,25 +25228,34 @@ export class ReviewController {
 
 export const ReviewFeature = defineFeatureSlice({
   name: "review", tags: ["type:feature"], spec: reviewSpec,
-  providers: [ApproveReview, VerifyReviewAttachment, ReviewUploads], controllers: [ReviewController, ReviewUploadsController],
+  providers: [ApproveReview, VerifyReviewAttachment, ReviewUploads, ReviewReceipts, ReviewTasks],
+  controllers: [ReviewController, ReviewUploadsController, ReviewReceiptsController, ReviewTasksController],
   jobs: [VerifyReviewAttachment],
 });
 `,
     "src/review/attachment.ts": STARTER_REVIEW_JOB,
+    "src/review/limits.ts": `// Matches the existing PostgreSQL integer version columns; widening requires a migration.
+export const REVIEW_VERSION_MAX = 2147483647;
+`,
     "src/review/contracts.ts": `import { t, type UnwrapSchema } from "elysia";
+import { REVIEW_VERSION_MAX } from "./limits";
 export const Params = t.Object({ id: t.String({ minLength: 1 }) });
-export const ApproveBody = t.Object({ expectedVersion: t.Integer({ minimum: 1, maximum: 9007199254740991 }) });
+export const ReviewVersion = t.Integer({ minimum: 1, maximum: REVIEW_VERSION_MAX });
+export const ApproveBody = t.Object({ expectedVersion: ReviewVersion });
 export const ApprovalInput = t.Object({ ...Params.properties, ...ApproveBody.properties }, { additionalProperties: false });
 export type ApprovalBody = UnwrapSchema<typeof ApproveBody>;
 export const ReviewResult = t.Object({
   state: t.Union([t.Literal("draft"), t.Literal("approved")]),
-  version: t.Integer({ minimum: 1, maximum: 9007199254740991 }),
+  version: ReviewVersion,
 });
 export type Review = UnwrapSchema<typeof ReviewResult>;
 export const HealthResult = t.Object({ ok: t.Boolean() });
 export const UploadParams = t.Object({ id: t.String({ format: "uuid" }) });
 export const UploadBody = t.Object({
-  artifactId: t.String({ format: "uuid" }), expectedVersion: t.Integer({ minimum: 1 }),
+  artifactId: t.String({ format: "uuid" }), expectedVersion: ReviewVersion,
+}, { additionalProperties: false });
+export const UploadInput = t.Object({
+  reviewId: UploadParams.properties.id, ...UploadBody.properties,
 }, { additionalProperties: false });
 export const UploadLocation = t.Object({
   artifactId: t.String({ format: "uuid" }), bucketId: t.String(), objectPath: t.String(),
@@ -23914,12 +25264,41 @@ export const UploadResult = t.Object({
   artifactId: t.String({ format: "uuid" }), runId: t.String({ format: "uuid" }),
   objectPath: t.String(), sha256: t.String({ pattern: "^[a-f0-9]{64}$" }), bytes: t.Integer({ minimum: 1, maximum: 1048576 }),
 });
+export const ReceiptParams = t.Object({
+  id: t.String({ minLength: 1 }), operationId: t.String({ format: "uuid" }),
+});
+export const ReceiptQuery = t.Object({
+  kind: t.Union([t.Literal("approve"), t.Literal("upload")]),
+  expectedVersion: t.String({ pattern: "^[1-9][0-9]*$", maxLength: 16 }),
+}, { additionalProperties: false });
+export const ReceiptResult = t.Object({
+  status: t.Union([t.Literal("confirmed"), t.Literal("unknown")]),
+  operationId: t.String({ format: "uuid" }), reviewId: t.String({ minLength: 1 }),
+});
+export const ReceiptOperation = t.Object({
+  kind: ReceiptQuery.properties.kind,
+  reviewId: ReceiptParams.properties.id,
+  operationId: ReceiptParams.properties.operationId,
+  expectedVersion: ApprovalInput.properties.expectedVersion,
+}, { additionalProperties: false });
+export type ReviewOperation = UnwrapSchema<typeof ReceiptOperation>;
+export type ReviewReceipt = UnwrapSchema<typeof ReceiptResult>;
+export type ReviewUploadBody = UnwrapSchema<typeof UploadBody>;
+export type ReviewUploadInput = UnwrapSchema<typeof UploadInput>;
+export type ReviewUploadLocation = UnwrapSchema<typeof UploadLocation>;
+export type ReviewUploadResult = UnwrapSchema<typeof UploadResult>;
 `,
+    "src/review/receipts.ts": STARTER_REVIEW_RECEIPTS,
     "src/review/uploads.ts": STARTER_UPLOAD_FEATURE,
+    "src/client/reviews.ts": STARTER_REVIEW_CLIENT,
+    "src/client/review-transport.ts": STARTER_REVIEW_TRANSPORT,
+    "tests/review-client.test.ts": STARTER_REVIEW_CLIENT_TEST,
     "src/host/review-uploads.ts": STARTER_UPLOAD_ADAPTER,
     "src/host/review-postgres.ts": STARTER_REVIEW_POSTGRES,
     "src/host/review-attachments.ts": STARTER_ATTACHMENT_POSTGRES,
     "src/host/review-attachment-worker.ts": STARTER_ATTACHMENT_WORKER,
+    "src/host/review-worker-observability.ts": STARTER_WORKER_OBSERVABILITY,
+    "src/host/review-execution-observability.ts": STARTER_EXECUTION_OBSERVABILITY,
     "src/delivery-worker.ts": STARTER_ATTACHMENT_DELIVERY_WORKER,
     "src/delivery-host.ts": STARTER_REVIEW_DELIVERY_HOST,
     "migrations/001-review.sql": STARTER_REVIEW_SCHEMA,
@@ -24017,6 +25396,25 @@ It is not a complete Maker-Checker workflow or a production authorization policy
 
 ## Frontend SDK Boundary
 
+src/client/reviews.ts supplies framework-neutral loading/empty/denied/error and
+submission/conflict/unknown states. src/client/review-transport.ts binds ordinary
+reads and private uploads to the existing user-scoped Supabase client, and
+approval/registration to createAuthenticatedFetch. It never uses a service key.
+Bind snapshot/subscribe to the view or SVAdmin store; dispose on identity change.
+The example lists at most 100 rows. Loading and permission failures clear rows.
+Unknown writes keep their operation ID and block resubmission. The default
+lookup calls GET /reviews/:id/operations/:operationId with kind and
+expectedVersion. It rechecks current authorization and reads the original
+durable receipt; current row state alone cannot confirm the operation.
+Construct createReviewPendingStore(localStorage, { projectId, tenantId,
+applicationId, subject }) and pass it as createReviewClient's second argument.
+The scope must come from the current authenticated session and application
+binding. It stores no token or file bytes. Reload restores unknown, then
+reconcile() performs only a receipt read; denied/conflicting lookup stays
+unknown. Storage failures block writes. Dispose never deletes pending evidence.
+Use one active mutation owner per identity/application: localStorage is not a
+cross-tab atomic lock. Do not clear unresolved records to enable another write.
+
 Use @supacloud/js as the platform SDK around your existing user-scoped
 @supabase/supabase-js client. Pass that same client to existing UI providers;
 supacloud.supabase exposes it unchanged. Keep UI routing, forms and query
@@ -24126,11 +25524,12 @@ This is not production-role acceptance. Ordinary API clients cannot edit members
 or the database binding. No migration, binding, member or review is auto-created
 by the HTTP host. This SQL file is not a migration runner or a recovery receipt.
 
-The starter's delivery.build.migrations explicitly declares these four files.
+The starter's delivery.build.migrations explicitly declares these five files.
 Immutable targets archive their exact bytes and a migrations.json inventory;
 project migrations and operator provisioning use separate directories.
 001-002 declare project migration handling. 003 changes Storage policies and
-004 creates cluster-wide roles, so both declare operator provisioning; ordinary
+004 creates cluster-wide roles and 005 adds the task recovery ledger and scoped
+backend grants, so these declare operator provisioning; ordinary
 project-role permission to perform those changes has not been established.
 These raw SQL hashes are not the platform ledger's normalized-statement
 checksums. Building or copying an archive never applies SQL, proves compatibility
@@ -24157,6 +25556,16 @@ authenticated upload requests return 501. With that setting, SUPACLOUD_URL and
 SUPACLOUD_SERVICE_ROLE_KEY are required; shipped adapters register/bind uploads
 and enqueue attachment verification through afterApproved in the approval
 transaction. A separately delivered worker consumes it.
+With attachments enabled, GET /reviews/:id/attachment-task returns the current
+authorized task state. POST /reviews/:id/attachment-task/retry takes expectedVersion,
+expectedRunId and a new recoveryId UUID. Reuse that same body/recoveryId after an
+uncertain response; do not generate another key until the outcome is reconciled.
+Only failed runs can be retried. A retry creates a linked new run, receipt and audit
+in one transaction, preserving the old run and its attempts. Concurrent distinct
+recovery requests cannot both replace the same failed run. Read status after the
+receipt: its queued state describes submission, not necessarily the current state.
+Apply migration 005 before updating either HTTP or Worker code; it extends only
+backend capabilities. Do not grant Workflow access to browser roles.
 An HTTP listener or immutable build does not prove full-platform identity,
 migration compatibility, activation, application rollback or data recovery.
 
@@ -24269,6 +25678,28 @@ committed idempotent result. The host's failure promise makes the executable exi
 nonzero with bounded cleanup. Restart only after investigating an ownership or
 receipt failure; repeated automatic restart can exhaust an unknown run's attempts.
 
+The delivery worker emits review-worker-execution JSON lines to stdout using
+src/host/review-worker-observability.ts, which re-exports the shared observer
+from src/host/review-execution-observability.ts. Events contain timestamp, workerId,
+kind, operation, stage, phase and optional requestId/durationMs. For attachment
+jobs, requestId is the Workflow run ID; join it to starter_attachments.run_id
+or the current starter_attachment_retries lineage, not to an HTTP request ID.
+Only selected execution metadata is serialized, never input, output, errors,
+credentials or database parameters. Correlation identifiers must be opaque,
+non-secret identifiers; malformed identifiers and invalid durations are omitted.
+Logging is best effort and cannot alter a job outcome. A succeeded stage is not
+proof of queue settlement: confirm the Workflow receipt and durable attachment
+result separately. Configure stdout collection in the deployment environment;
+the starter does not install a collector or prove gateway trace propagation.
+
+The HTTP delivery host uses the same serializer for review-http-execution events
+with component review-http. Route and command events preserve their requestId
+from the existing request context and do not contain a workerId. Do not equate
+that request ID with a Workflow run ID or an idempotency key. Identity resolution
+and failures before an execution observer is reached are not covered by these
+events; use the platform's existing request/identity logs for those failures.
+Both hosts emit only execution metadata, not access logs or audit receipts.
+
 The memory demo does not start this worker. The included unit tests exercise the
 handler contract, not production Storage, queue delivery or external identity.
 
@@ -24286,6 +25717,14 @@ Context packs include directional dependencies, relevant aspect files, diagnosti
 and static execution plans, without provider values or source expressions.
 The optional --events example expects a trusted host
 to capture approved onExecution metadata in { "version": 1, "events": [...] }.
+It also accepts a bounded JSON-lines export containing only the generated
+review-http-execution and review-worker-execution records. Pass that file
+directly as --events execution.ndjson; use the HTTP request ID or Workflow run
+ID appropriate to the selected operation. Unknown log records, extra fields,
+malformed lines and oversized files fail the entire read rather than being
+silently skipped. Wrapper timestamps, component names and worker IDs are
+validated then excluded from the context metadata. Review the export before
+sharing; context correlation still does not authenticate the log source.
 It selects one opaque request ID, omits payloads and source expressions, and applies
 input/output size limits. It does not read arbitrary logs, prove deployment versions,
 identify a root cause or apply repairs. Never put credentials or business data in
@@ -25013,26 +26452,47 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
   const sources = [
     owner.file,
     ...owner.providers.map((item) => item.file),
-    ...owner.controllers.map((item) => item.file)
+    ...owner.controllers.map((item) => item.file),
+    ...graph.moduleHandlerFiles?.[owner.name] ?? [],
+    ...(owner.aspects ?? []).flatMap((item) => item.file ? [item.file] : []),
+    ...owner.commands.flatMap((item) => (item.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])),
+    ...(owner.jobs ?? []).flatMap((item) => (item.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])),
+    ...owner.controllers.flatMap((item) => item.routes.flatMap((route) => (route.aspects ?? []).flatMap((aspect) => aspect.file ? [aspect.file] : [])))
   ].filter((file) => typeof file === "string");
   const directories = [...new Set(sources.map((file) => dirname6(resolve15(sourceRoot, file))))].sort();
   const tests = new Set;
   const manual = [];
+  const coverage = [];
   for (const directory of directories) {
     if (!inside2(requestedRoot, directory)) {
       manual.push("A source directory is outside the project; select its owning project explicitly");
       continue;
     }
-    const actual = await realpath3(directory);
+    const actual = await realpath3(directory).catch((error) => {
+      if (error instanceof Error && "code" in error && error.code === "ENOENT")
+        return null;
+      throw error;
+    });
+    if (actual === null) {
+      manual.push(`Source directory is missing: ${relative5(requestedRoot, directory).replaceAll("\\", "/")}`);
+      continue;
+    }
     if (!inside2(project, actual)) {
       manual.push("A source directory is outside the project; select its owning project explicitly");
       continue;
     }
+    const local = [];
     for (const entry of await readdir4(actual, { withFileTypes: true })) {
       if (entry.isFile() && /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name)) {
-        tests.add(relative5(project, resolve15(actual, entry.name)).replaceAll("\\", "/"));
+        const file = relative5(project, resolve15(actual, entry.name)).replaceAll("\\", "/");
+        tests.add(file);
+        local.push(file);
       }
     }
+    const path = relative5(project, actual).replaceAll("\\", "/") || ".";
+    coverage.push({ directory: path, tests: local.sort(), basis: "colocated-not-proven" });
+    if (!local.length)
+      manual.push(`No colocated tests for source directory: ${path}`);
   }
   const selected = [...tests].sort();
   if (!selected.length)
@@ -25051,6 +26511,12 @@ async function createVerificationPlan(root, graph, target, sourceRoot = root) {
       ["git", "diff", "--check"]
     ] : [],
     manual,
+    coverage,
+    limitations: [
+      "Colocation selects candidates; it does not prove behavioral coverage",
+      "Dependent modules and database behavior require explicit integration acceptance",
+      "No recursive scan, test execution or generated-file repair is performed"
+    ],
     releaseOnly: ["generated artifact drift", "consumer types", "database/RLS and authenticated integration", "delivery read-back"],
     executed: false
   };
@@ -25259,6 +26725,7 @@ var REMOTE_APP_ACTIONS = {
   "deploy-plan": "get_deploy_plan",
   diff: "get_deploy_plan",
   status: "get_runtime",
+  evidence: "get_deployment_evidence",
   rollback: "rollback_release",
   "rollback-plan": "get_rollback_snapshot",
   history: "get_history",
@@ -25603,11 +27070,49 @@ function formatModuleContextPack(pack) {
 `);
 }
 async function runContext(args) {
-  const { root, configFile, outDir, result } = await projectCompileConfig(args);
+  const { root, sourceDir, configFile, outDir, result } = await projectCompileConfig(args);
   const subject = args.target?.trim();
   if (subject) {
     const pack = createContextPack({ ...result.graph, diagnostics: result.diagnostics }, subject);
-    return textResult(args.format === "json" ? JSON.stringify(pack, null, 2) : formatModuleContextPack(pack));
+    const verification = await createVerificationPlan(root, result.graph, pack.subject, sourceDir);
+    const repairs = createDiagnosticRepairPlan(pack.diagnostics);
+    const workflow = {
+      root,
+      sourceRoot: sourceDir,
+      generatedDir: outDir,
+      allowedDependencies: await readAllowedDependencies(root),
+      editFiles: verification.files,
+      referenceFiles: pack.files,
+      verification,
+      repairs,
+      rules: {
+        generatedFiles: "do-not-edit",
+        permissions: "explicit-business-input-required",
+        writeRetry: "disabled",
+        fixDefault: "preview"
+      },
+      daily: [
+        ["supacloud", "app", "doctor", "--target", pack.subject, "--format", "json"],
+        ["supacloud", "app", "fix", "--fix", "<reviewed-fix.json>"],
+        ["supacloud", "app", "compile"],
+        ...verification.commands
+      ],
+      release: {
+        first: ["supacloud", "app", "check", "--format", "json"],
+        rule: "Check committed artifacts before any regeneration; never repair drift to make this gate pass",
+        additionalEvidence: verification.releaseOnly
+      },
+      executed: false
+    };
+    return textResult(args.format === "json" ? JSON.stringify({ ...pack, workflow }, null, 2) : [
+      formatModuleContextPack(pack),
+      `  edit files (project-relative): ${workflow.editFiles.join(", ") || "-"}`,
+      `  focused tests: ${verification.tests.join(", ") || "-"}`,
+      ...verification.manual.map((item) => `  manual: ${item}`),
+      "  fixes: preview first; business policy requires explicit input",
+      "  release: app check before regeneration; local tests do not prove deployment"
+    ].join(`
+`));
   }
   const project = {
     version: 1,
@@ -25694,8 +27199,10 @@ async function findUnwiredContracts(rootDir) {
 }
 async function runDoctor(args) {
   const { root, outDir, result } = await projectCompileConfig(args);
-  const doctor = doctorProject(root, outDir, result.graph, result.upToDate, result.diagnostics);
-  const database = checkAppDatabaseSources(root);
+  const target = args.target?.trim();
+  const context = target ? createContextPack({ ...result.graph, diagnostics: result.diagnostics }, target) : undefined;
+  const doctor = doctorProject(root, outDir, { ...result.graph, ...context ? { modules: context.modules } : {}, diagnostics: [] }, result.upToDate, context?.diagnostics ?? result.diagnostics);
+  const database = context ? null : checkAppDatabaseSources(root);
   if (database) {
     doctor.checks.push(database);
     if (!database.ok)
@@ -25705,11 +27212,29 @@ async function runDoctor(args) {
   const autoFixable = fixPlan.filter((repair) => repair.readiness === "preview").length;
   const inputRequired = fixPlan.filter((repair) => repair.readiness === "input-required").length;
   const manualFixes = fixPlan.filter((repair) => repair.readiness === "manual").length;
-  const unwiredContracts = await findUnwiredContracts(root);
+  const unwiredContracts = context ? [] : await findUnwiredContracts(root);
+  const scope = context ? {
+    target: context.subject,
+    files: context.files,
+    omittedProjectDiagnostics: result.diagnostics.length - context.diagnostics.length,
+    notChecked: ["unwired contracts outside graph", "additional database source CLI check"],
+    generatedArtifactCheck: "project-wide"
+  } : undefined;
   if (args.format === "json") {
-    return textResult(JSON.stringify({ ok: doctor.errors === 0, autoFixable, inputRequired, manualFixes, fixPlan, unwiredContracts, ...doctor }, null, 2), doctor.errors > 0);
+    return textResult(JSON.stringify({
+      ok: doctor.errors === 0,
+      autoFixable,
+      inputRequired,
+      manualFixes,
+      fixPlan,
+      unwiredContracts,
+      ...scope ? { scope } : {},
+      ...doctor
+    }, null, 2), doctor.errors > 0);
   }
   const lines = doctor.checks.map((check) => `${check.ok ? "OK" : "FAIL"} ${check.name}: ${check.detail}`);
+  if (scope)
+    lines.unshift(`TARGET ${scope.target}; omitted project diagnostics=${scope.omittedProjectDiagnostics}; generated drift remains project-wide`);
   for (const diagnostic of doctor.diagnostics ?? []) {
     lines.push(formatDiagnostic(diagnostic));
   }
@@ -26700,6 +28225,21 @@ async function runAppTool(request, options = {}) {
     };
     validateToolArguments2(APPLICATION_TOOL_SCHEMA2, args);
     const result = await delegate(args);
+    if (request.action === "evidence" && format !== "json" && json !== true && !result.isError) {
+      try {
+        const payload = JSON.parse(result.content[0].text);
+        if (payload === null || typeof payload !== "object" || !("project_ref" in payload) || payload.project_ref !== args.ref || !("application_id" in payload) || payload.application_id !== request.id || !("environment_id" in payload) || payload.environment_id !== request.environment_id || !("evidence" in payload))
+          throw new Error;
+        if (payload.evidence === null)
+          return textResult("DEPLOYMENT incomplete: no recorded evidence. Read runtime status and obtain authenticated smoke and recovery evidence.");
+        const evidence = parseDeploymentEvidence(payload.evidence);
+        if (evidence.scope.project_ref !== args.ref || evidence.scope.application_id !== request.id || evidence.scope.environment_id !== request.environment_id)
+          throw new Error;
+        return textResult(formatDeploymentEvidence(evidence));
+      } catch {
+        return textResult("DEPLOYMENT unknown: invalid or mismatched evidence; no mutation was attempted.", true);
+      }
+    }
     if (request.action === "history" && format !== "json" && json !== true) {
       return historyText(result, request, args.ref);
     }
@@ -26792,6 +28332,7 @@ function registerAppTools(server, options = {}) {
       "deploy-plan",
       "diff",
       "status",
+      "evidence",
       "rollback",
       "rollback-plan",
       "history",
@@ -30562,7 +32103,7 @@ async function runProjectDeployment(http, args) {
 // package.json
 var package_default = {
   name: "@supacloud/cli",
-  version: "0.101.4",
+  version: "0.103.1",
   description: "Project-scoped CLI for SupaCloud users",
   type: "module",
   main: "./dist/index.js",
@@ -30614,18 +32155,19 @@ var package_default = {
     directory: "packages/cli"
   },
   dependencies: {
-    "@supacloud/compiler": "^0.46.4",
-    "@supacloud/delivery": "0.18.1",
-    "@supacloud/db": "0.17.1",
+    "@supacloud/compiler": "^0.46.5",
+    "@supacloud/delivery": "0.19.0",
+    "@supacloud/db": "0.18.0",
     typebox: "1.3.37"
   },
   overrides: {
-    "@supacloud/contracts": "0.11.0",
-    "@supacloud/delivery": "0.18.1",
+    "@supacloud/contracts": "0.11.1",
+    "@supacloud/delivery": "0.19.0",
     "@graphql-tools/utils": "^12.0.4"
   },
   devDependencies: {
-    "@supacloud/elysia": "0.31.1",
+    "@supabase/supabase-js": "2.117.3",
+    "@supacloud/elysia": "0.33.1",
     "@types/bun": "^1.4.3",
     effect: "4.0.5",
     elysia: "2.0.0-beta.32",
@@ -30891,6 +32433,7 @@ EXAMPLES
   ${preferredCommand} app diff --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid>
   ${preferredCommand} app deploy --ref abc123 --id orders --environment_id test --release_id <sha256> --configuration_id <uuid>
   ${preferredCommand} app status --ref abc123 --id orders --environment_id test
+  ${preferredCommand} app evidence --ref abc123 --id orders --environment_id test
   ${preferredCommand} app diff --ref abc123 --id orders --environment_id production --source_ref staging --source_environment_id staging --source_release_id <sha256>
   ${preferredCommand} --env production app promote-plan --id orders --environment_id production --source_ref staging --source_environment_id staging --source_release_id <sha256>
   ${preferredCommand} app preview-plan --ref abc123 --id orders --environment_id test --release_id <sha256> --branch_ref preview-orders