# Adversarial Bug Report: State File Enforcement

## Deep Review
The .state file format and transition rules are robust. Approval sub-states create a hard gate that cannot be bypassed via `--transition`. Atomic writes via tmp+rename prevent corruption on crash.

## Potential Issues
1. **Race condition on create**: Two concurrent `--create-task` calls for the same name could both pass the "doesn't exist" check before one creates the directory. The atomic rename pattern mitigates this for .state writes but not for `mkdir`.

2. **Manual .state tampering**: A user or agent could directly edit `.state` to write an invalid phase name. `status.py` handles this ("Unknown phase" error), but the error path could be clearer about what phases are valid.

3. **Stale .state after crash**: If an agent crashes after producing an artifact but before transitioning `.state`, the `.state` lags behind artifacts. The artifact heuristic fallback in `--audit` Category 2 catches this, but it's a recovery scenario not a normal path.

## Verdict: PASS — no security or logic flaws that would compromise enforcement.