codex-workflow-v2 2.0.0-alpha.7.2 → 2.0.0-alpha.7.2.1

package/README.md

@@ -36,7 +36,7 @@ cross-machine synchronization are not part of its contract.
 Node.js 22 or newer is required. Consumers pin the exact package version:
 
 ```bash
-npm install --save-dev --save-exact codex-workflow-v2@2.0.0-alpha.7.2
+npm install --save-dev --save-exact codex-workflow-v2@2.0.0-alpha.7.2.1
 npx codex-workflow gateway handshake --repo .
 npx codex-workflow doctor --repo .
 ```
@@ -125,13 +125,23 @@ sidecars:
 - project: `adoption-posture.jsonl`
 - task: `plan-risk-audits.jsonl`, `step-review-events.jsonl`,
   `reviewer-attestations.jsonl`, `remediation-events.jsonl`,
-  `corrective-decisions.jsonl`, `handoffs.jsonl`
+  `corrective-decisions.jsonl`, `corrective-decision-recoveries.jsonl`,
+  `remediation-mode-recoveries.jsonl`, `handoffs.jsonl`
 - milestone: `scope-change-events.jsonl`, `autonomy-contract-events.jsonl`
 
 Milestone scope-change recovery also uses Milestone-local `.transactions/` journal files.
 Broken JSONL, duplicate event ids, broken hash chains, stale revision/hash/commit bindings,
 or mismatched authority fail closed with structured diagnostics.
 
+Alpha.7.2.1 can recover the one exact alpha.7.2 defect where a validated third
+corrective attempt was persisted as `mode=ordinary`. `next` exposes
+`task remediation-mode-recover` only for that fully verified legacy shape. Run the
+returned command with its exact Task revision, actor, and writer token. Recovery
+appends a bound event to `remediation-mode-recoveries.jsonl`; it never edits the
+historical remediation event. An identical retry is idempotent. After recovery,
+the three-attempt hard stop remains in force and `next` permits only
+`split-required` or `stop-escalate`, never a fourth implementation run.
+
 ## Delegated approval
 
 Delegation never makes an agent a human actor. A user first approves an exact grant policy;

package/dist/src/alpha6/remediation.d.ts

@@ -1,8 +1,10 @@
-import type { CorrectiveDecisionEvent, CorrectivePlanAuditInput, GuardedRiskCategory, RemediationEvent, RemediationFailureEvidence, RemediationFailureKind, RemediationMode, TaskState } from '../contracts.js';
+import type { CorrectiveDecisionEvent, CorrectiveDecisionRecoveryEvent, CorrectivePlanAuditInput, GuardedRiskCategory, RemediationEvent, RemediationFailureEvidence, RemediationFailureKind, RemediationMode, RemediationModeRecoveryEvent, TaskState } from '../contracts.js';
 import type { FileStateStore } from '../state/store.js';
 import type { CurrentPlanRiskAudit } from './plan-risk.js';
 export declare const REMEDIATION_EVENTS_SIDECAR = "remediation-events.jsonl";
 export declare const CORRECTIVE_DECISIONS_SIDECAR = "corrective-decisions.jsonl";
+export declare const CORRECTIVE_DECISION_RECOVERIES_SIDECAR = "corrective-decision-recoveries.jsonl";
+export declare const REMEDIATION_MODE_RECOVERIES_SIDECAR = "remediation-mode-recoveries.jsonl";
 export interface GuardedRemediationAttemptGate {
     stepId: string;
     guardedCategory: GuardedRiskCategory;
@@ -12,11 +14,26 @@ export interface GuardedRemediationAttemptGate {
     correctiveDecision: CorrectiveDecisionEvent | null;
     posture: 'ordinary' | 'decision-required' | 'continue-fix' | 'replan-required' | 'replan-ready' | 'split-required' | 'stop-escalate' | 'hard-stop';
 }
+export interface RemediationModeRecoveryAssessment {
+    task: TaskState;
+    remediation: RemediationEvent;
+    decision: CorrectiveDecisionEvent;
+    correctiveRecovery: CorrectiveDecisionRecoveryEvent;
+    existingRecovery: RemediationModeRecoveryEvent | null;
+    actor: string;
+    c1ClaimEventHash: string | null;
+    writerLeaseTokenHash: string | null;
+    evidenceFingerprint: string;
+}
 export declare function readRemediationEvents(store: FileStateStore, task: TaskState): RemediationEvent[];
 export declare function readCorrectiveDecisionEvents(store: FileStateStore, task: TaskState): CorrectiveDecisionEvent[];
 export declare function defaultCorrectiveAuditorActor(taskId: string): string;
 export declare function assertCorrectiveAuditorIndependence(store: FileStateStore, task: TaskState, stepId: string, auditor: string): void;
+export declare function readRemediationModeRecoveryEvents(store: FileStateStore, task: TaskState): RemediationModeRecoveryEvent[];
 export declare function appendRemediationEvent(store: FileStateStore, task: TaskState, stepId: string, failureKind: RemediationFailureKind, failureEvidence: RemediationFailureEvidence, planRiskAudit: CurrentPlanRiskAudit, now: Date): RemediationEvent;
+export declare function findRemediationModeRecoveryCandidate(store: FileStateStore, task: TaskState): RemediationModeRecoveryAssessment | null;
+export declare function assessRemediationModeRecovery(store: FileStateStore, task: TaskState, stepId: string, actor: string, writerToken: string | null): RemediationModeRecoveryAssessment;
+export declare function appendRemediationModeRecovery(store: FileStateStore, task: TaskState, stepId: string, expectedRevision: number, actor: string, writerToken: string | null, now: Date): RemediationModeRecoveryEvent;
 export declare function appendCorrectiveDecisionEvent(store: FileStateStore, task: TaskState, stepId: string, correctiveAudit: CorrectivePlanAuditInput, planRiskAudit: CurrentPlanRiskAudit, planHash: string, now: Date): CorrectiveDecisionEvent;
 export declare function assertGuardedRemediationAttemptAllowed(store: FileStateStore, task: TaskState, stepId: string, planRiskAudit: CurrentPlanRiskAudit, recoveredDecisionEventId?: string | null): GuardedRemediationAttemptGate;
 export declare function readGuardedRemediationPostureForStep(store: FileStateStore, task: TaskState, stepId: string, planRiskAudit: CurrentPlanRiskAudit): GuardedRemediationAttemptGate | null;

package/dist/src/alpha6/remediation.js

@@ -1,11 +1,15 @@
-import { existsSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, unlinkSync } from 'node:fs';
 import path from 'node:path';
 import { WorkflowError } from '../errors.js';
 import { createUlid } from '../ulid.js';
-import { assertHash64 } from './store-sidecars.js';
+import { assertHash64, canonicalJsonStringify, sha256Hex } from './store-sidecars.js';
+import { readTaskC1Posture } from './handoff.js';
 import { buildCurrentStrictStepReviewCycle, readReviewerAttestations, readStepReviewEvents, } from './review.js';
 export const REMEDIATION_EVENTS_SIDECAR = 'remediation-events.jsonl';
 export const CORRECTIVE_DECISIONS_SIDECAR = 'corrective-decisions.jsonl';
+export const CORRECTIVE_DECISION_RECOVERIES_SIDECAR = 'corrective-decision-recoveries.jsonl';
+export const REMEDIATION_MODE_RECOVERIES_SIDECAR = 'remediation-mode-recoveries.jsonl';
+const REMEDIATION_MODE_RECOVERY_LOCK = '.remediation-mode-recovery.lock';
 const COMMIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
 const REMEDIATION_FAILURE_KINDS = new Set([
     'checks-failed',
@@ -65,15 +69,35 @@ export function assertCorrectiveAuditorIndependence(store, task, stepId, auditor
 function validateRemediationHistory(store, task) {
     const remediationEvents = readRawRemediationEvents(store, task);
     const correctiveDecisionEvents = readRawCorrectiveDecisionEvents(store, task);
+    const modeRecoveries = readRemediationModeRecoveryEvents(store, task);
     validateRemediationAttemptOrdinals(remediationEvents, task);
     validateRemediationReviewReferences(store, task, remediationEvents);
     validateCorrectiveDecisionCoverage(task, correctiveDecisionEvents, remediationEvents);
-    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents);
+    const recoveredEventIds = validateRemediationModeRecoveries(store, task, remediationEvents, correctiveDecisionEvents, modeRecoveries);
+    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents, recoveredEventIds);
     return {
         remediationEvents,
         correctiveDecisionEvents,
     };
 }
+export function readRemediationModeRecoveryEvents(store, task) {
+    const root = store.taskRoot(task.projectId, task.id);
+    const file = path.join(root, REMEDIATION_MODE_RECOVERIES_SIDECAR);
+    if (!existsSync(file))
+        return [];
+    return store.readSidecarEvents(root, REMEDIATION_MODE_RECOVERIES_SIDECAR, {
+        validateEvent: (event, context) => validateStoredRemediationModeRecovery(event, task, context.file, context.line),
+    });
+}
+function readRawCorrectiveDecisionRecoveries(store, task) {
+    const root = store.taskRoot(task.projectId, task.id);
+    const file = path.join(root, CORRECTIVE_DECISION_RECOVERIES_SIDECAR);
+    if (!existsSync(file))
+        return [];
+    return store.readSidecarEvents(root, CORRECTIVE_DECISION_RECOVERIES_SIDECAR, {
+        validateEvent: (event, context) => validateStoredCorrectiveDecisionRecoveryReference(event, task, context.file, context.line),
+    });
+}
 function readRawRemediationEvents(store, task) {
     const sidecarFile = path.join(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR);
     if (!existsSync(sidecarFile))
@@ -91,6 +115,7 @@ function readRawCorrectiveDecisionEvents(store, task) {
     });
 }
 export function appendRemediationEvent(store, task, stepId, failureKind, failureEvidence, planRiskAudit, now) {
+    const recoveredDecisionEventId = findCorrectiveRecoveryDecisionIdForFailure(store, task, stepId);
     const existing = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
     const matching = existing.filter((event) => remediationEventMatchesFailure(event, failureKind, failureEvidence));
     if (matching.length > 1) {
@@ -104,7 +129,9 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
     if (matching.length === 1) {
         const reused = matching[0];
         const priorEvents = existing.filter((event) => event.attemptOrdinal < reused.attemptOrdinal);
-        const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, priorEvents, readCorrectiveDecisionEvents(store, task));
+        const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, priorEvents, readCorrectiveDecisionEvents(store, task), {
+            recoveredDecisionEventId,
+        });
         if (reused.attemptOrdinal !== gate.nextAttemptOrdinal || reused.mode !== gate.mode || reused.guardedCategory !== gate.guardedCategory) {
             throw new WorkflowError('STATE_CORRUPT', 'Existing remediation event conflicts with the current guarded retry binding.', {
                 taskId: task.id,
@@ -118,7 +145,9 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
         }
         return reused;
     }
-    const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, existing, readCorrectiveDecisionEvents(store, task));
+    const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, existing, readCorrectiveDecisionEvents(store, task), {
+        recoveredDecisionEventId,
+    });
     return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR, {
         eventId: `RME-${createUlid(now.getTime())}`,
         recordedAt: now.toISOString(),
@@ -133,6 +162,290 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
         validateEvent: (event, context) => validateStoredRemediationEvent(event, task, context.file, context.line),
     });
 }
+function findCorrectiveRecoveryDecisionIdForFailure(store, task, stepId) {
+    const remediations = readRawRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+    if (remediations.length !== 2)
+        return null;
+    const decisions = readRawCorrectiveDecisionEvents(store, task).filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.decision === 'continue-fix'
+        && event.planHash !== task.planHash);
+    if (decisions.length !== 1)
+        return null;
+    const recoveries = readRawCorrectiveDecisionRecoveries(store, task).filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.correctiveDecisionEventId === decisions[0].eventId
+        && event.correctiveDecisionEventHash === decisions[0].eventHash
+        && event.reboundPlanHash === task.planHash);
+    if (recoveries.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple corrective recoveries match one remediation attempt.', {
+            taskId: task.id,
+            stepId,
+            recoveryEventIds: recoveries.map((event) => event.eventId),
+        });
+    }
+    return recoveries[0]?.correctiveDecisionEventId ?? null;
+}
+export function findRemediationModeRecoveryCandidate(store, task) {
+    const raw = readRawRemediationEvents(store, task);
+    const candidates = raw.filter((event) => event.attemptOrdinal > 2 && event.mode === 'ordinary');
+    if (candidates.length === 0)
+        return null;
+    if (candidates.length !== 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple malformed remediation modes are not recoverable.', {
+            taskId: task.id,
+            eventIds: candidates.map((event) => event.eventId),
+        });
+    }
+    const posture = readTaskC1Posture(store, task);
+    const lease = readWriterLeaseForModeRecovery(store, task);
+    const actor = posture.state === 'claimed' ? posture.claimant : lease?.owner ?? 'worker';
+    return assessRemediationModeRecovery(store, task, candidates[0].stepId, actor, lease?.token ?? null);
+}
+export function assessRemediationModeRecovery(store, task, stepId, actor, writerToken) {
+    const normalizedActor = actor.trim();
+    if (!normalizedActor)
+        throw new WorkflowError('INVALID_ARGUMENT', 'Remediation mode recovery actor is required.');
+    const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+    if (!step)
+        throw new WorkflowError('NOT_FOUND', `Step not found: ${stepId}`);
+    if (task.status !== 'needs_fix' || step.status !== 'failed') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation mode recovery requires the exact failed Task/Step posture.', {
+            taskId: task.id,
+            taskStatus: task.status,
+            stepId,
+            stepStatus: step.status,
+        });
+    }
+    if (!task.planHash)
+        throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} is missing its Plan hash.`);
+    const remediations = readRawRemediationEvents(store, task);
+    const decisions = readRawCorrectiveDecisionEvents(store, task);
+    validateRemediationAttemptOrdinals(remediations, task);
+    validateRemediationReviewReferences(store, task, remediations);
+    validateCorrectiveDecisionCoverage(task, decisions, remediations);
+    const malformed = remediations.filter((event) => event.attemptOrdinal > 2 && event.mode === 'ordinary');
+    if (malformed.length !== 1 || malformed[0].stepId !== stepId || malformed[0].attemptOrdinal !== 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'State does not contain the one exact alpha.7.2 remediation mode omission.', {
+            taskId: task.id,
+            stepId,
+            malformedEventIds: malformed.map((event) => event.eventId),
+        });
+    }
+    const stepRemediations = remediations.filter((event) => event.stepId === stepId);
+    if (stepRemediations.length !== 3
+        || stepRemediations[0].mode !== 'ordinary'
+        || stepRemediations[1].mode !== 'ordinary'
+        || stepRemediations[2].eventId !== malformed[0].eventId) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery requires exactly two ordinary attempts and one malformed third attempt.', {
+            taskId: task.id,
+            stepId,
+        });
+    }
+    const decisionMatches = decisions.filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.decision === 'continue-fix'
+        && sameStringArray(event.coveredEventIds, stepRemediations.slice(0, 2).map((event) => event.eventId)));
+    if (decisionMatches.length !== 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery requires one exact continue-fix decision.', {
+            taskId: task.id,
+            stepId,
+            decisionEventIds: decisionMatches.map((event) => event.eventId),
+        });
+    }
+    const decision = decisionMatches[0];
+    const correctiveRecoveries = readRawCorrectiveDecisionRecoveries(store, task).filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.correctiveDecisionEventId === decision.eventId
+        && event.correctiveDecisionEventHash === decision.eventHash
+        && event.reboundPlanHash === task.planHash);
+    if (correctiveRecoveries.length !== 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery requires one exact corrective-decision recovery.', {
+            taskId: task.id,
+            stepId,
+            recoveryEventIds: correctiveRecoveries.map((event) => event.eventId),
+        });
+    }
+    const correctiveRecovery = correctiveRecoveries[0];
+    const authority = requireRemediationModeRecoveryAuthority(store, task, normalizedActor, writerToken);
+    const existing = readRemediationModeRecoveryEvents(store, task).filter((event) => event.remediationEventId === malformed[0].eventId);
+    if (existing.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple remediation mode recoveries target one event.', {
+            taskId: task.id,
+            remediationEventId: malformed[0].eventId,
+        });
+    }
+    if (existing[0]) {
+        validateRemediationModeRecoveryBinding(existing[0], malformed[0], decision, correctiveRecovery);
+        const retryMismatches = [
+            existing[0].taskRevision !== task.revision ? 'taskRevision' : null,
+            existing[0].planHash !== task.planHash ? 'planHash' : null,
+            existing[0].actor !== normalizedActor ? 'actor' : null,
+            existing[0].c1ClaimEventHash !== authority.c1ClaimEventHash ? 'c1ClaimEventHash' : null,
+            existing[0].writerLeaseTokenHash !== authority.writerLeaseTokenHash ? 'writerLeaseTokenHash' : null,
+        ].filter((value) => value !== null);
+        if (retryMismatches.length > 0) {
+            throw new WorkflowError('STATE_CONFLICT', 'Existing remediation mode recovery conflicts with the requested retry binding.', {
+                taskId: task.id,
+                stepId,
+                recoveryEventId: existing[0].eventId,
+                mismatches: retryMismatches,
+            });
+        }
+    }
+    const evidenceFingerprint = sha256Hex(canonicalJsonStringify({
+        taskId: task.id,
+        taskRevision: task.revision,
+        stepId,
+        planHash: task.planHash,
+        remediationEventHash: malformed[0].eventHash,
+        correctiveDecisionEventHash: decision.eventHash,
+        correctiveDecisionRecoveryEventHash: correctiveRecovery.eventHash,
+        actor: normalizedActor,
+        c1ClaimEventHash: authority.c1ClaimEventHash,
+        writerLeaseTokenHash: authority.writerLeaseTokenHash,
+    }));
+    return {
+        task,
+        remediation: malformed[0],
+        decision,
+        correctiveRecovery,
+        existingRecovery: existing[0] ?? null,
+        actor: normalizedActor,
+        c1ClaimEventHash: authority.c1ClaimEventHash,
+        writerLeaseTokenHash: authority.writerLeaseTokenHash,
+        evidenceFingerprint,
+    };
+}
+export function appendRemediationModeRecovery(store, task, stepId, expectedRevision, actor, writerToken, now) {
+    if (task.revision !== expectedRevision) {
+        throw new WorkflowError('STATE_CONFLICT', `State revision conflict for ${task.id}`, {
+            expectedRevision,
+            actualRevision: task.revision,
+        });
+    }
+    const preflight = assessRemediationModeRecovery(store, task, stepId, actor, writerToken);
+    const root = store.taskRoot(task.projectId, task.id);
+    const lockFile = path.join(root, REMEDIATION_MODE_RECOVERY_LOCK);
+    let descriptor;
+    try {
+        descriptor = openSync(lockFile, 'wx', 0o600);
+        closeSync(descriptor);
+    }
+    catch (error) {
+        if (existsSync(lockFile)) {
+            throw new WorkflowError('LOCKED', `Remediation mode recovery for ${task.id} is already being serialized.`, {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        throw error;
+    }
+    try {
+        const currentTask = store.readTask(task.projectId, task.id);
+        if (currentTask.revision !== expectedRevision) {
+            throw new WorkflowError('STATE_CONFLICT', `State revision conflict for ${task.id}`, {
+                expectedRevision,
+                actualRevision: currentTask.revision,
+            });
+        }
+        let underLock;
+        try {
+            underLock = assessRemediationModeRecovery(store, currentTask, stepId, actor, writerToken);
+        }
+        catch (error) {
+            throw new WorkflowError('STATE_CONFLICT', 'Remediation mode recovery evidence changed after preflight.', {
+                taskId: task.id,
+                stepId,
+                cause: error instanceof Error ? error.message : String(error),
+            });
+        }
+        if (underLock.existingRecovery)
+            return underLock.existingRecovery;
+        if (underLock.evidenceFingerprint !== preflight.evidenceFingerprint) {
+            throw new WorkflowError('STATE_CONFLICT', 'Remediation mode recovery evidence changed after preflight.', {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        return store.appendSidecarEvent(root, REMEDIATION_MODE_RECOVERIES_SIDECAR, {
+            eventId: `RMR-${createUlid(now.getTime())}`,
+            recordedAt: now.toISOString(),
+            taskId: task.id,
+            stepId,
+            taskRevision: expectedRevision,
+            remediationEventId: underLock.remediation.eventId,
+            remediationEventHash: underLock.remediation.eventHash,
+            correctiveDecisionEventId: underLock.decision.eventId,
+            correctiveDecisionEventHash: underLock.decision.eventHash,
+            correctiveDecisionRecoveryEventId: underLock.correctiveRecovery.eventId,
+            correctiveDecisionRecoveryEventHash: underLock.correctiveRecovery.eventHash,
+            attemptOrdinal: 3,
+            planHash: currentTask.planHash,
+            actor: underLock.actor,
+            c1ClaimEventHash: underLock.c1ClaimEventHash,
+            writerLeaseTokenHash: underLock.writerLeaseTokenHash,
+            fromMode: 'ordinary',
+            toMode: 'corrective',
+            reason: 'alpha7.2-recovered-continue-fix-mode-omission',
+        }, {
+            validateEvent: (event, context) => validateStoredRemediationModeRecovery(event, currentTask, context.file, context.line),
+        });
+    }
+    finally {
+        if (existsSync(lockFile))
+            unlinkSync(lockFile);
+    }
+}
+function requireRemediationModeRecoveryAuthority(store, task, actor, writerToken) {
+    const posture = readTaskC1Posture(store, task);
+    const lease = readWriterLeaseForModeRecovery(store, task);
+    if (posture.state === 'pending') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Pending C1 handoff must be claimed before remediation mode recovery.');
+    }
+    if (posture.state === 'claimed') {
+        const tokenHash = writerToken ? sha256Hex(writerToken) : null;
+        if (!lease
+            || actor !== posture.claimant
+            || lease.owner !== posture.claimant
+            || !writerToken
+            || lease.token !== writerToken
+            || tokenHash !== posture.writerLeaseTokenHash) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation mode recovery requires the claimed C1 actor and exact writer token.', {
+                taskId: task.id,
+                claimant: posture.claimant,
+                leaseOwner: lease?.owner ?? null,
+            });
+        }
+        return { c1ClaimEventHash: posture.latestEvent.eventHash, writerLeaseTokenHash: tokenHash };
+    }
+    if (lease && (lease.owner !== actor || !writerToken || lease.token !== writerToken)) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Existing writer lease is not owned by the remediation recovery actor/token.');
+    }
+    if (!lease && writerToken) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'A writer token was provided without an existing writer lease.');
+    }
+    return {
+        c1ClaimEventHash: posture.latestEvent?.eventHash ?? null,
+        writerLeaseTokenHash: lease ? sha256Hex(lease.token) : null,
+    };
+}
+function readWriterLeaseForModeRecovery(store, task) {
+    const file = path.join(store.lockRoot(task.projectId), `${task.id}.json`);
+    if (!existsSync(file))
+        return null;
+    let lease;
+    try {
+        lease = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        throw new WorkflowError('STATE_CORRUPT', `Writer lease is unreadable: ${file}`);
+    }
+    if (lease.entityId !== task.id || typeof lease.owner !== 'string' || typeof lease.token !== 'string') {
+        throw new WorkflowError('STATE_CORRUPT', `Writer lease does not match Task ${task.id}.`);
+    }
+    return lease;
+}
 export function appendCorrectiveDecisionEvent(store, task, stepId, correctiveAudit, planRiskAudit, planHash, now) {
     validateCorrectiveDecisionAudit(correctiveAudit);
     const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
@@ -553,6 +866,142 @@ function validateStoredCorrectiveDecisionEvent(event, task, file, line) {
     normalizeStringList(event.coveredEventIds, 'Corrective decision coveredEventIds');
     assertHash64(event.planHash, `Corrective decision planHash at ${file}:${line}`);
 }
+function validateStoredCorrectiveDecisionRecoveryReference(event, task, file, line) {
+    if (!/^CDR-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.eventId)
+        || event.taskId !== task.id
+        || event.triggeringAttemptCount !== 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective recovery reference does not match the Task/ordinal.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+            triggeringAttemptCount: event.triggeringAttemptCount,
+        });
+    }
+    if (typeof event.stepId !== 'string' || !event.stepId.trim() || typeof event.actor !== 'string' || !event.actor.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective recovery reference is missing Step or actor.', { file, line });
+    }
+    for (const hash of [
+        event.correctiveDecisionEventHash,
+        event.decisionPlanHash,
+        event.reboundPlanHash,
+        event.semanticPlanHash,
+        event.fromKnowledgeMapHash,
+        event.toKnowledgeMapHash,
+        event.sourcePlanRiskAuditEventHash,
+        event.reboundPlanRiskAuditEventHash,
+        event.knowledgeMapApprovalFingerprint,
+        event.taskAuthorizationFingerprint,
+        event.delegationGrantFingerprint,
+        event.c1EvidenceFingerprint,
+        event.evidenceFingerprint,
+    ]) {
+        assertHash64(hash, `Corrective recovery hash at ${file}:${line}`);
+    }
+    if (!Number.isInteger(event.fromKnowledgeMapRevision)
+        || event.fromKnowledgeMapRevision < 1
+        || !Number.isInteger(event.toKnowledgeMapRevision)
+        || event.toKnowledgeMapRevision < 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective recovery Knowledge Map revisions are malformed.', { file, line });
+    }
+}
+function validateStoredRemediationModeRecovery(event, task, file, line) {
+    if (!/^RMR-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.eventId)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery eventId is malformed.', { file, line });
+    }
+    if (event.taskId !== task.id || typeof event.stepId !== 'string' || !event.stepId.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery does not match the current Task.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+        });
+    }
+    if (!Number.isInteger(event.taskRevision) || event.taskRevision < 1 || event.attemptOrdinal !== 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery has an invalid revision or ordinal.', { file, line });
+    }
+    if (event.fromMode !== 'ordinary'
+        || event.toMode !== 'corrective'
+        || event.reason !== 'alpha7.2-recovered-continue-fix-mode-omission') {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery has an unsupported correction.', { file, line });
+    }
+    if (!/^RME-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.remediationEventId)
+        || !/^CRD-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.correctiveDecisionEventId)
+        || !/^CDR-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.correctiveDecisionRecoveryEventId)
+        || typeof event.actor !== 'string'
+        || !event.actor.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery identifiers are malformed.', { file, line });
+    }
+    for (const [label, value] of [
+        ['remediationEventHash', event.remediationEventHash],
+        ['correctiveDecisionEventHash', event.correctiveDecisionEventHash],
+        ['correctiveDecisionRecoveryEventHash', event.correctiveDecisionRecoveryEventHash],
+        ['planHash', event.planHash],
+    ]) {
+        assertHash64(value, `Remediation mode recovery ${label} at ${file}:${line}`);
+    }
+    if (event.c1ClaimEventHash !== null)
+        assertHash64(event.c1ClaimEventHash, `Remediation mode recovery C1 hash at ${file}:${line}`);
+    if (event.writerLeaseTokenHash !== null)
+        assertHash64(event.writerLeaseTokenHash, `Remediation mode recovery token hash at ${file}:${line}`);
+}
+function validateRemediationModeRecoveryBinding(recovery, remediation, decision, correctiveRecovery) {
+    const mismatches = [
+        recovery.taskId !== remediation.taskId ? 'taskId' : null,
+        recovery.stepId !== remediation.stepId ? 'stepId' : null,
+        recovery.remediationEventId !== remediation.eventId ? 'remediationEventId' : null,
+        recovery.remediationEventHash !== remediation.eventHash ? 'remediationEventHash' : null,
+        recovery.correctiveDecisionEventId !== decision.eventId ? 'correctiveDecisionEventId' : null,
+        recovery.correctiveDecisionEventHash !== decision.eventHash ? 'correctiveDecisionEventHash' : null,
+        recovery.correctiveDecisionRecoveryEventId !== correctiveRecovery.eventId ? 'correctiveDecisionRecoveryEventId' : null,
+        recovery.correctiveDecisionRecoveryEventHash !== correctiveRecovery.eventHash ? 'correctiveDecisionRecoveryEventHash' : null,
+        recovery.attemptOrdinal !== remediation.attemptOrdinal ? 'attemptOrdinal' : null,
+        recovery.planHash !== correctiveRecovery.reboundPlanHash ? 'planHash' : null,
+        recovery.actor !== correctiveRecovery.actor ? 'actor' : null,
+    ].filter((value) => value !== null);
+    if (mismatches.length > 0) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery does not match its append-only evidence.', {
+            recoveryEventId: recovery.eventId,
+            mismatches,
+        });
+    }
+}
+function validateRemediationModeRecoveries(store, task, remediations, decisions, recoveries) {
+    const correctiveRecoveries = readRawCorrectiveDecisionRecoveries(store, task);
+    const recoveredEventIds = new Set();
+    for (const recovery of recoveries) {
+        if (recoveredEventIds.has(recovery.remediationEventId)) {
+            throw new WorkflowError('STATE_CORRUPT', 'Duplicate remediation mode recoveries target one event.', {
+                taskId: task.id,
+                remediationEventId: recovery.remediationEventId,
+            });
+        }
+        const remediation = remediations.find((event) => event.eventId === recovery.remediationEventId) ?? null;
+        const decision = decisions.find((event) => event.eventId === recovery.correctiveDecisionEventId) ?? null;
+        const correctiveRecovery = correctiveRecoveries.find((event) => event.eventId === recovery.correctiveDecisionRecoveryEventId) ?? null;
+        if (!remediation || !decision || !correctiveRecovery) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery references missing evidence.', {
+                taskId: task.id,
+                recoveryEventId: recovery.eventId,
+            });
+        }
+        if (recovery.taskRevision !== task.revision
+            || recovery.planHash !== task.planHash
+            || remediation.mode !== 'ordinary'
+            || remediation.attemptOrdinal !== 3
+            || decision.decision !== 'continue-fix'
+            || decision.triggeringAttemptCount !== 3
+            || correctiveRecovery.correctiveDecisionEventId !== decision.eventId) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery references an ineligible lifecycle shape.', {
+                taskId: task.id,
+                recoveryEventId: recovery.eventId,
+            });
+        }
+        validateRemediationModeRecoveryBinding(recovery, remediation, decision, correctiveRecovery);
+        recoveredEventIds.add(remediation.eventId);
+    }
+    return recoveredEventIds;
+}
 function validateRemediationAttemptOrdinals(events, task) {
     const attemptsByStep = new Map();
     for (const event of events) {
@@ -712,7 +1161,7 @@ function validateCorrectiveDecisionCoverage(task, decisions, remediationEvents)
         }
     }
 }
-function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions) {
+function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions, recoveredEventIds) {
     for (const event of remediationEvents) {
         if (event.attemptOrdinal <= 2) {
             if (event.mode !== 'ordinary') {
@@ -726,7 +1175,7 @@ function validateHistoricalRemediationModes(task, stepId, remediationEvents, cor
             }
             continue;
         }
-        if (event.mode === 'ordinary') {
+        if (event.mode === 'ordinary' && !recoveredEventIds.has(event.eventId)) {
             throw new WorkflowError('STATE_CORRUPT', 'Guarded remediation attempt ordinals above 2 must not remain ordinary.', {
                 taskId: task.id,
                 stepId,
@@ -753,13 +1202,13 @@ function validateHistoricalRemediationModes(task, stepId, remediationEvents, cor
         }
     }
 }
-function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions) {
+function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions, recoveredEventIds) {
     const stepIds = new Set(remediationEvents.map((event) => event.stepId));
     for (const stepId of stepIds) {
         const stepEvents = remediationEvents
             .filter((event) => event.stepId === stepId)
             .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
-        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions);
+        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions, recoveredEventIds);
     }
 }
 function validateCorrectiveDecisionAudit(audit) {