codex-workflow-v2 2.0.0-alpha.7.2 → 2.0.0-beta.1

package/dist/src/alpha6/remediation.js

@@ -1,11 +1,15 @@
-import { existsSync } from 'node:fs';
+import { closeSync, existsSync, openSync, readFileSync, unlinkSync } from 'node:fs';
 import path from 'node:path';
 import { WorkflowError } from '../errors.js';
 import { createUlid } from '../ulid.js';
-import { assertHash64 } from './store-sidecars.js';
+import { assertHash64, canonicalJsonStringify, sha256Hex } from './store-sidecars.js';
+import { readTaskC1Posture } from './handoff.js';
 import { buildCurrentStrictStepReviewCycle, readReviewerAttestations, readStepReviewEvents, } from './review.js';
 export const REMEDIATION_EVENTS_SIDECAR = 'remediation-events.jsonl';
 export const CORRECTIVE_DECISIONS_SIDECAR = 'corrective-decisions.jsonl';
+export const CORRECTIVE_DECISION_RECOVERIES_SIDECAR = 'corrective-decision-recoveries.jsonl';
+export const REMEDIATION_MODE_RECOVERIES_SIDECAR = 'remediation-mode-recoveries.jsonl';
+const REMEDIATION_MODE_RECOVERY_LOCK = '.remediation-mode-recovery.lock';
 const COMMIT_SHA_PATTERN = /^[a-f0-9]{40}$/;
 const REMEDIATION_FAILURE_KINDS = new Set([
     'checks-failed',
@@ -65,15 +69,35 @@ export function assertCorrectiveAuditorIndependence(store, task, stepId, auditor
 function validateRemediationHistory(store, task) {
     const remediationEvents = readRawRemediationEvents(store, task);
     const correctiveDecisionEvents = readRawCorrectiveDecisionEvents(store, task);
+    const modeRecoveries = readRemediationModeRecoveryEvents(store, task);
     validateRemediationAttemptOrdinals(remediationEvents, task);
     validateRemediationReviewReferences(store, task, remediationEvents);
     validateCorrectiveDecisionCoverage(task, correctiveDecisionEvents, remediationEvents);
-    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents);
+    const recoveredEventIds = validateRemediationModeRecoveries(store, task, remediationEvents, correctiveDecisionEvents, modeRecoveries);
+    validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisionEvents, recoveredEventIds);
     return {
         remediationEvents,
         correctiveDecisionEvents,
     };
 }
+export function readRemediationModeRecoveryEvents(store, task) {
+    const root = store.taskRoot(task.projectId, task.id);
+    const file = path.join(root, REMEDIATION_MODE_RECOVERIES_SIDECAR);
+    if (!existsSync(file))
+        return [];
+    return store.readSidecarEvents(root, REMEDIATION_MODE_RECOVERIES_SIDECAR, {
+        validateEvent: (event, context) => validateStoredRemediationModeRecovery(event, task, context.file, context.line),
+    });
+}
+function readRawCorrectiveDecisionRecoveries(store, task) {
+    const root = store.taskRoot(task.projectId, task.id);
+    const file = path.join(root, CORRECTIVE_DECISION_RECOVERIES_SIDECAR);
+    if (!existsSync(file))
+        return [];
+    return store.readSidecarEvents(root, CORRECTIVE_DECISION_RECOVERIES_SIDECAR, {
+        validateEvent: (event, context) => validateStoredCorrectiveDecisionRecoveryReference(event, task, context.file, context.line),
+    });
+}
 function readRawRemediationEvents(store, task) {
     const sidecarFile = path.join(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR);
     if (!existsSync(sidecarFile))
@@ -91,6 +115,7 @@ function readRawCorrectiveDecisionEvents(store, task) {
     });
 }
 export function appendRemediationEvent(store, task, stepId, failureKind, failureEvidence, planRiskAudit, now) {
+    const recoveredDecisionEventId = findCorrectiveRecoveryDecisionIdForFailure(store, task, stepId);
     const existing = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
     const matching = existing.filter((event) => remediationEventMatchesFailure(event, failureKind, failureEvidence));
     if (matching.length > 1) {
@@ -104,7 +129,9 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
     if (matching.length === 1) {
         const reused = matching[0];
         const priorEvents = existing.filter((event) => event.attemptOrdinal < reused.attemptOrdinal);
-        const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, priorEvents, readCorrectiveDecisionEvents(store, task));
+        const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, priorEvents, readCorrectiveDecisionEvents(store, task), {
+            recoveredDecisionEventId,
+        });
         if (reused.attemptOrdinal !== gate.nextAttemptOrdinal || reused.mode !== gate.mode || reused.guardedCategory !== gate.guardedCategory) {
             throw new WorkflowError('STATE_CORRUPT', 'Existing remediation event conflicts with the current guarded retry binding.', {
                 taskId: task.id,
@@ -118,7 +145,9 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
         }
         return reused;
     }
-    const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, existing, readCorrectiveDecisionEvents(store, task));
+    const gate = deriveAttemptGateFromHistory(task, stepId, planRiskAudit, existing, readCorrectiveDecisionEvents(store, task), {
+        recoveredDecisionEventId,
+    });
     return store.appendSidecarEvent(store.taskRoot(task.projectId, task.id), REMEDIATION_EVENTS_SIDECAR, {
         eventId: `RME-${createUlid(now.getTime())}`,
         recordedAt: now.toISOString(),
@@ -133,6 +162,290 @@ export function appendRemediationEvent(store, task, stepId, failureKind, failure
         validateEvent: (event, context) => validateStoredRemediationEvent(event, task, context.file, context.line),
     });
 }
+function findCorrectiveRecoveryDecisionIdForFailure(store, task, stepId) {
+    const remediations = readRawRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+    if (remediations.length !== 2)
+        return null;
+    const decisions = readRawCorrectiveDecisionEvents(store, task).filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.decision === 'continue-fix'
+        && event.planHash !== task.planHash);
+    if (decisions.length !== 1)
+        return null;
+    const recoveries = readRawCorrectiveDecisionRecoveries(store, task).filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.correctiveDecisionEventId === decisions[0].eventId
+        && event.correctiveDecisionEventHash === decisions[0].eventHash
+        && event.reboundPlanHash === task.planHash);
+    if (recoveries.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple corrective recoveries match one remediation attempt.', {
+            taskId: task.id,
+            stepId,
+            recoveryEventIds: recoveries.map((event) => event.eventId),
+        });
+    }
+    return recoveries[0]?.correctiveDecisionEventId ?? null;
+}
+export function findRemediationModeRecoveryCandidate(store, task) {
+    const raw = readRawRemediationEvents(store, task);
+    const candidates = raw.filter((event) => event.attemptOrdinal > 2 && event.mode === 'ordinary');
+    if (candidates.length === 0)
+        return null;
+    if (candidates.length !== 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple malformed remediation modes are not recoverable.', {
+            taskId: task.id,
+            eventIds: candidates.map((event) => event.eventId),
+        });
+    }
+    const posture = readTaskC1Posture(store, task);
+    const lease = readWriterLeaseForModeRecovery(store, task);
+    const actor = posture.state === 'claimed' ? posture.claimant : lease?.owner ?? 'worker';
+    return assessRemediationModeRecovery(store, task, candidates[0].stepId, actor, lease?.token ?? null);
+}
+export function assessRemediationModeRecovery(store, task, stepId, actor, writerToken) {
+    const normalizedActor = actor.trim();
+    if (!normalizedActor)
+        throw new WorkflowError('INVALID_ARGUMENT', 'Remediation mode recovery actor is required.');
+    const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+    if (!step)
+        throw new WorkflowError('NOT_FOUND', `Step not found: ${stepId}`);
+    if (task.status !== 'needs_fix' || step.status !== 'failed') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation mode recovery requires the exact failed Task/Step posture.', {
+            taskId: task.id,
+            taskStatus: task.status,
+            stepId,
+            stepStatus: step.status,
+        });
+    }
+    if (!task.planHash)
+        throw new WorkflowError('STATE_CORRUPT', `Task ${task.id} is missing its Plan hash.`);
+    const remediations = readRawRemediationEvents(store, task);
+    const decisions = readRawCorrectiveDecisionEvents(store, task);
+    validateRemediationAttemptOrdinals(remediations, task);
+    validateRemediationReviewReferences(store, task, remediations);
+    validateCorrectiveDecisionCoverage(task, decisions, remediations);
+    const malformed = remediations.filter((event) => event.attemptOrdinal > 2 && event.mode === 'ordinary');
+    if (malformed.length !== 1 || malformed[0].stepId !== stepId || malformed[0].attemptOrdinal !== 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'State does not contain the one exact alpha.7.2 remediation mode omission.', {
+            taskId: task.id,
+            stepId,
+            malformedEventIds: malformed.map((event) => event.eventId),
+        });
+    }
+    const stepRemediations = remediations.filter((event) => event.stepId === stepId);
+    if (stepRemediations.length !== 3
+        || stepRemediations[0].mode !== 'ordinary'
+        || stepRemediations[1].mode !== 'ordinary'
+        || stepRemediations[2].eventId !== malformed[0].eventId) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery requires exactly two ordinary attempts and one malformed third attempt.', {
+            taskId: task.id,
+            stepId,
+        });
+    }
+    const decisionMatches = decisions.filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.decision === 'continue-fix'
+        && sameStringArray(event.coveredEventIds, stepRemediations.slice(0, 2).map((event) => event.eventId)));
+    if (decisionMatches.length !== 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery requires one exact continue-fix decision.', {
+            taskId: task.id,
+            stepId,
+            decisionEventIds: decisionMatches.map((event) => event.eventId),
+        });
+    }
+    const decision = decisionMatches[0];
+    const correctiveRecoveries = readRawCorrectiveDecisionRecoveries(store, task).filter((event) => event.stepId === stepId
+        && event.triggeringAttemptCount === 3
+        && event.correctiveDecisionEventId === decision.eventId
+        && event.correctiveDecisionEventHash === decision.eventHash
+        && event.reboundPlanHash === task.planHash);
+    if (correctiveRecoveries.length !== 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery requires one exact corrective-decision recovery.', {
+            taskId: task.id,
+            stepId,
+            recoveryEventIds: correctiveRecoveries.map((event) => event.eventId),
+        });
+    }
+    const correctiveRecovery = correctiveRecoveries[0];
+    const authority = requireRemediationModeRecoveryAuthority(store, task, normalizedActor, writerToken);
+    const existing = readRemediationModeRecoveryEvents(store, task).filter((event) => event.remediationEventId === malformed[0].eventId);
+    if (existing.length > 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Multiple remediation mode recoveries target one event.', {
+            taskId: task.id,
+            remediationEventId: malformed[0].eventId,
+        });
+    }
+    if (existing[0]) {
+        validateRemediationModeRecoveryBinding(existing[0], malformed[0], decision, correctiveRecovery);
+        const retryMismatches = [
+            existing[0].taskRevision !== task.revision ? 'taskRevision' : null,
+            existing[0].planHash !== task.planHash ? 'planHash' : null,
+            existing[0].actor !== normalizedActor ? 'actor' : null,
+            existing[0].c1ClaimEventHash !== authority.c1ClaimEventHash ? 'c1ClaimEventHash' : null,
+            existing[0].writerLeaseTokenHash !== authority.writerLeaseTokenHash ? 'writerLeaseTokenHash' : null,
+        ].filter((value) => value !== null);
+        if (retryMismatches.length > 0) {
+            throw new WorkflowError('STATE_CONFLICT', 'Existing remediation mode recovery conflicts with the requested retry binding.', {
+                taskId: task.id,
+                stepId,
+                recoveryEventId: existing[0].eventId,
+                mismatches: retryMismatches,
+            });
+        }
+    }
+    const evidenceFingerprint = sha256Hex(canonicalJsonStringify({
+        taskId: task.id,
+        taskRevision: task.revision,
+        stepId,
+        planHash: task.planHash,
+        remediationEventHash: malformed[0].eventHash,
+        correctiveDecisionEventHash: decision.eventHash,
+        correctiveDecisionRecoveryEventHash: correctiveRecovery.eventHash,
+        actor: normalizedActor,
+        c1ClaimEventHash: authority.c1ClaimEventHash,
+        writerLeaseTokenHash: authority.writerLeaseTokenHash,
+    }));
+    return {
+        task,
+        remediation: malformed[0],
+        decision,
+        correctiveRecovery,
+        existingRecovery: existing[0] ?? null,
+        actor: normalizedActor,
+        c1ClaimEventHash: authority.c1ClaimEventHash,
+        writerLeaseTokenHash: authority.writerLeaseTokenHash,
+        evidenceFingerprint,
+    };
+}
+export function appendRemediationModeRecovery(store, task, stepId, expectedRevision, actor, writerToken, now) {
+    if (task.revision !== expectedRevision) {
+        throw new WorkflowError('STATE_CONFLICT', `State revision conflict for ${task.id}`, {
+            expectedRevision,
+            actualRevision: task.revision,
+        });
+    }
+    const preflight = assessRemediationModeRecovery(store, task, stepId, actor, writerToken);
+    const root = store.taskRoot(task.projectId, task.id);
+    const lockFile = path.join(root, REMEDIATION_MODE_RECOVERY_LOCK);
+    let descriptor;
+    try {
+        descriptor = openSync(lockFile, 'wx', 0o600);
+        closeSync(descriptor);
+    }
+    catch (error) {
+        if (existsSync(lockFile)) {
+            throw new WorkflowError('LOCKED', `Remediation mode recovery for ${task.id} is already being serialized.`, {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        throw error;
+    }
+    try {
+        const currentTask = store.readTask(task.projectId, task.id);
+        if (currentTask.revision !== expectedRevision) {
+            throw new WorkflowError('STATE_CONFLICT', `State revision conflict for ${task.id}`, {
+                expectedRevision,
+                actualRevision: currentTask.revision,
+            });
+        }
+        let underLock;
+        try {
+            underLock = assessRemediationModeRecovery(store, currentTask, stepId, actor, writerToken);
+        }
+        catch (error) {
+            throw new WorkflowError('STATE_CONFLICT', 'Remediation mode recovery evidence changed after preflight.', {
+                taskId: task.id,
+                stepId,
+                cause: error instanceof Error ? error.message : String(error),
+            });
+        }
+        if (underLock.existingRecovery)
+            return underLock.existingRecovery;
+        if (underLock.evidenceFingerprint !== preflight.evidenceFingerprint) {
+            throw new WorkflowError('STATE_CONFLICT', 'Remediation mode recovery evidence changed after preflight.', {
+                taskId: task.id,
+                stepId,
+            });
+        }
+        return store.appendSidecarEvent(root, REMEDIATION_MODE_RECOVERIES_SIDECAR, {
+            eventId: `RMR-${createUlid(now.getTime())}`,
+            recordedAt: now.toISOString(),
+            taskId: task.id,
+            stepId,
+            taskRevision: expectedRevision,
+            remediationEventId: underLock.remediation.eventId,
+            remediationEventHash: underLock.remediation.eventHash,
+            correctiveDecisionEventId: underLock.decision.eventId,
+            correctiveDecisionEventHash: underLock.decision.eventHash,
+            correctiveDecisionRecoveryEventId: underLock.correctiveRecovery.eventId,
+            correctiveDecisionRecoveryEventHash: underLock.correctiveRecovery.eventHash,
+            attemptOrdinal: 3,
+            planHash: currentTask.planHash,
+            actor: underLock.actor,
+            c1ClaimEventHash: underLock.c1ClaimEventHash,
+            writerLeaseTokenHash: underLock.writerLeaseTokenHash,
+            fromMode: 'ordinary',
+            toMode: 'corrective',
+            reason: 'alpha7.2-recovered-continue-fix-mode-omission',
+        }, {
+            validateEvent: (event, context) => validateStoredRemediationModeRecovery(event, currentTask, context.file, context.line),
+        });
+    }
+    finally {
+        if (existsSync(lockFile))
+            unlinkSync(lockFile);
+    }
+}
+function requireRemediationModeRecoveryAuthority(store, task, actor, writerToken) {
+    const posture = readTaskC1Posture(store, task);
+    const lease = readWriterLeaseForModeRecovery(store, task);
+    if (posture.state === 'pending') {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Pending C1 handoff must be claimed before remediation mode recovery.');
+    }
+    if (posture.state === 'claimed') {
+        const tokenHash = writerToken ? sha256Hex(writerToken) : null;
+        if (!lease
+            || actor !== posture.claimant
+            || lease.owner !== posture.claimant
+            || !writerToken
+            || lease.token !== writerToken
+            || tokenHash !== posture.writerLeaseTokenHash) {
+            throw new WorkflowError('TRANSITION_BLOCKED', 'Remediation mode recovery requires the claimed C1 actor and exact writer token.', {
+                taskId: task.id,
+                claimant: posture.claimant,
+                leaseOwner: lease?.owner ?? null,
+            });
+        }
+        return { c1ClaimEventHash: posture.latestEvent.eventHash, writerLeaseTokenHash: tokenHash };
+    }
+    if (lease && (lease.owner !== actor || !writerToken || lease.token !== writerToken)) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'Existing writer lease is not owned by the remediation recovery actor/token.');
+    }
+    if (!lease && writerToken) {
+        throw new WorkflowError('TRANSITION_BLOCKED', 'A writer token was provided without an existing writer lease.');
+    }
+    return {
+        c1ClaimEventHash: posture.latestEvent?.eventHash ?? null,
+        writerLeaseTokenHash: lease ? sha256Hex(lease.token) : null,
+    };
+}
+function readWriterLeaseForModeRecovery(store, task) {
+    const file = path.join(store.lockRoot(task.projectId), `${task.id}.json`);
+    if (!existsSync(file))
+        return null;
+    let lease;
+    try {
+        lease = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        throw new WorkflowError('STATE_CORRUPT', `Writer lease is unreadable: ${file}`);
+    }
+    if (lease.entityId !== task.id || typeof lease.owner !== 'string' || typeof lease.token !== 'string') {
+        throw new WorkflowError('STATE_CORRUPT', `Writer lease does not match Task ${task.id}.`);
+    }
+    return lease;
+}
 export function appendCorrectiveDecisionEvent(store, task, stepId, correctiveAudit, planRiskAudit, planHash, now) {
     validateCorrectiveDecisionAudit(correctiveAudit);
     const remediationEvents = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
@@ -553,6 +866,142 @@ function validateStoredCorrectiveDecisionEvent(event, task, file, line) {
     normalizeStringList(event.coveredEventIds, 'Corrective decision coveredEventIds');
     assertHash64(event.planHash, `Corrective decision planHash at ${file}:${line}`);
 }
+function validateStoredCorrectiveDecisionRecoveryReference(event, task, file, line) {
+    if (!/^CDR-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.eventId)
+        || event.taskId !== task.id
+        || event.triggeringAttemptCount !== 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective recovery reference does not match the Task/ordinal.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+            triggeringAttemptCount: event.triggeringAttemptCount,
+        });
+    }
+    if (typeof event.stepId !== 'string' || !event.stepId.trim() || typeof event.actor !== 'string' || !event.actor.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective recovery reference is missing Step or actor.', { file, line });
+    }
+    for (const hash of [
+        event.correctiveDecisionEventHash,
+        event.decisionPlanHash,
+        event.reboundPlanHash,
+        event.semanticPlanHash,
+        event.fromKnowledgeMapHash,
+        event.toKnowledgeMapHash,
+        event.sourcePlanRiskAuditEventHash,
+        event.reboundPlanRiskAuditEventHash,
+        event.knowledgeMapApprovalFingerprint,
+        event.taskAuthorizationFingerprint,
+        event.delegationGrantFingerprint,
+        event.c1EvidenceFingerprint,
+        event.evidenceFingerprint,
+    ]) {
+        assertHash64(hash, `Corrective recovery hash at ${file}:${line}`);
+    }
+    if (!Number.isInteger(event.fromKnowledgeMapRevision)
+        || event.fromKnowledgeMapRevision < 1
+        || !Number.isInteger(event.toKnowledgeMapRevision)
+        || event.toKnowledgeMapRevision < 1) {
+        throw new WorkflowError('STATE_CORRUPT', 'Corrective recovery Knowledge Map revisions are malformed.', { file, line });
+    }
+}
+function validateStoredRemediationModeRecovery(event, task, file, line) {
+    if (!/^RMR-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.eventId)) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery eventId is malformed.', { file, line });
+    }
+    if (event.taskId !== task.id || typeof event.stepId !== 'string' || !event.stepId.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery does not match the current Task.', {
+            file,
+            line,
+            taskId: task.id,
+            eventTaskId: event.taskId,
+        });
+    }
+    if (!Number.isInteger(event.taskRevision) || event.taskRevision < 1 || event.attemptOrdinal !== 3) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery has an invalid revision or ordinal.', { file, line });
+    }
+    if (event.fromMode !== 'ordinary'
+        || event.toMode !== 'corrective'
+        || event.reason !== 'alpha7.2-recovered-continue-fix-mode-omission') {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery has an unsupported correction.', { file, line });
+    }
+    if (!/^RME-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.remediationEventId)
+        || !/^CRD-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.correctiveDecisionEventId)
+        || !/^CDR-[0-9A-HJKMNP-TV-Z]{26}$/.test(event.correctiveDecisionRecoveryEventId)
+        || typeof event.actor !== 'string'
+        || !event.actor.trim()) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery identifiers are malformed.', { file, line });
+    }
+    for (const [label, value] of [
+        ['remediationEventHash', event.remediationEventHash],
+        ['correctiveDecisionEventHash', event.correctiveDecisionEventHash],
+        ['correctiveDecisionRecoveryEventHash', event.correctiveDecisionRecoveryEventHash],
+        ['planHash', event.planHash],
+    ]) {
+        assertHash64(value, `Remediation mode recovery ${label} at ${file}:${line}`);
+    }
+    if (event.c1ClaimEventHash !== null)
+        assertHash64(event.c1ClaimEventHash, `Remediation mode recovery C1 hash at ${file}:${line}`);
+    if (event.writerLeaseTokenHash !== null)
+        assertHash64(event.writerLeaseTokenHash, `Remediation mode recovery token hash at ${file}:${line}`);
+}
+function validateRemediationModeRecoveryBinding(recovery, remediation, decision, correctiveRecovery) {
+    const mismatches = [
+        recovery.taskId !== remediation.taskId ? 'taskId' : null,
+        recovery.stepId !== remediation.stepId ? 'stepId' : null,
+        recovery.remediationEventId !== remediation.eventId ? 'remediationEventId' : null,
+        recovery.remediationEventHash !== remediation.eventHash ? 'remediationEventHash' : null,
+        recovery.correctiveDecisionEventId !== decision.eventId ? 'correctiveDecisionEventId' : null,
+        recovery.correctiveDecisionEventHash !== decision.eventHash ? 'correctiveDecisionEventHash' : null,
+        recovery.correctiveDecisionRecoveryEventId !== correctiveRecovery.eventId ? 'correctiveDecisionRecoveryEventId' : null,
+        recovery.correctiveDecisionRecoveryEventHash !== correctiveRecovery.eventHash ? 'correctiveDecisionRecoveryEventHash' : null,
+        recovery.attemptOrdinal !== remediation.attemptOrdinal ? 'attemptOrdinal' : null,
+        recovery.planHash !== correctiveRecovery.reboundPlanHash ? 'planHash' : null,
+        recovery.actor !== correctiveRecovery.actor ? 'actor' : null,
+    ].filter((value) => value !== null);
+    if (mismatches.length > 0) {
+        throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery does not match its append-only evidence.', {
+            recoveryEventId: recovery.eventId,
+            mismatches,
+        });
+    }
+}
+function validateRemediationModeRecoveries(store, task, remediations, decisions, recoveries) {
+    const correctiveRecoveries = readRawCorrectiveDecisionRecoveries(store, task);
+    const recoveredEventIds = new Set();
+    for (const recovery of recoveries) {
+        if (recoveredEventIds.has(recovery.remediationEventId)) {
+            throw new WorkflowError('STATE_CORRUPT', 'Duplicate remediation mode recoveries target one event.', {
+                taskId: task.id,
+                remediationEventId: recovery.remediationEventId,
+            });
+        }
+        const remediation = remediations.find((event) => event.eventId === recovery.remediationEventId) ?? null;
+        const decision = decisions.find((event) => event.eventId === recovery.correctiveDecisionEventId) ?? null;
+        const correctiveRecovery = correctiveRecoveries.find((event) => event.eventId === recovery.correctiveDecisionRecoveryEventId) ?? null;
+        if (!remediation || !decision || !correctiveRecovery) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery references missing evidence.', {
+                taskId: task.id,
+                recoveryEventId: recovery.eventId,
+            });
+        }
+        if (recovery.taskRevision !== task.revision
+            || recovery.planHash !== task.planHash
+            || remediation.mode !== 'ordinary'
+            || remediation.attemptOrdinal !== 3
+            || decision.decision !== 'continue-fix'
+            || decision.triggeringAttemptCount !== 3
+            || correctiveRecovery.correctiveDecisionEventId !== decision.eventId) {
+            throw new WorkflowError('STATE_CORRUPT', 'Remediation mode recovery references an ineligible lifecycle shape.', {
+                taskId: task.id,
+                recoveryEventId: recovery.eventId,
+            });
+        }
+        validateRemediationModeRecoveryBinding(recovery, remediation, decision, correctiveRecovery);
+        recoveredEventIds.add(remediation.eventId);
+    }
+    return recoveredEventIds;
+}
 function validateRemediationAttemptOrdinals(events, task) {
     const attemptsByStep = new Map();
     for (const event of events) {
@@ -712,7 +1161,7 @@ function validateCorrectiveDecisionCoverage(task, decisions, remediationEvents)
         }
     }
 }
-function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions) {
+function validateHistoricalRemediationModes(task, stepId, remediationEvents, correctiveDecisions, recoveredEventIds) {
     for (const event of remediationEvents) {
         if (event.attemptOrdinal <= 2) {
             if (event.mode !== 'ordinary') {
@@ -726,7 +1175,7 @@ function validateHistoricalRemediationModes(task, stepId, remediationEvents, cor
             }
             continue;
         }
-        if (event.mode === 'ordinary') {
+        if (event.mode === 'ordinary' && !recoveredEventIds.has(event.eventId)) {
             throw new WorkflowError('STATE_CORRUPT', 'Guarded remediation attempt ordinals above 2 must not remain ordinary.', {
                 taskId: task.id,
                 stepId,
@@ -753,13 +1202,13 @@ function validateHistoricalRemediationModes(task, stepId, remediationEvents, cor
         }
     }
 }
-function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions) {
+function validateHistoricalRemediationModesForAllSteps(task, remediationEvents, correctiveDecisions, recoveredEventIds) {
     const stepIds = new Set(remediationEvents.map((event) => event.stepId));
     for (const stepId of stepIds) {
         const stepEvents = remediationEvents
             .filter((event) => event.stepId === stepId)
             .sort((left, right) => left.attemptOrdinal - right.attemptOrdinal);
-        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions);
+        validateHistoricalRemediationModes(task, stepId, stepEvents, correctiveDecisions, recoveredEventIds);
     }
 }
 function validateCorrectiveDecisionAudit(audit) {