diff --git a/.github/workflows/temp-residual-safety-refactor.yml b/.github/workflows/temp-residual-safety-refactor.yml
new file mode 100644
index 0000000..907e14a
--- /dev/null
+++ b/.github/workflows/temp-residual-safety-refactor.yml
@@ -0,0 +1,33 @@
+name: Temporary residual safety refactor
+
+on:
+  push:
+    paths:
+      - tools/apply_residual_safety_and_outputs_refactor.py
+      - .github/workflows/temp-residual-safety-refactor.yml
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install focused test dependency
+        run: python -m pip install filelock
+      - name: Apply residual fixes and safe extraction
+        run: python tools/apply_residual_safety_and_outputs_refactor.py
+      - name: Verify syntax
+        run: python -m compileall -q grok_register_ttk.py registration_flow.py account_outputs.py cpa_xai tests
+      - name: Run focused regression tests
+        run: python -m unittest tests.test_registration_flow tests.test_pending_recovery tests.test_grok2api_remote_pool
+      - name: Commit source changes and cleanup
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git rm -f tools/apply_residual_safety_and_outputs_refactor.py .github/workflows/temp-residual-safety-refactor.yml
+          git add -A
+          git commit -m "fix: harden residual flow boundaries and pending recovery"
+          git push