Why: Real project messages and retrieved material need a scoped observer and preflight decision contract before they can become governed project candidates.
Evidence: Registration denial test was RED before the implementation; go test ./... passed on Backend origin/main 2716b9e.
Impact: Add public X3 types and trusted single-provider registration; the production observer slot is deliberately not wired yet, so no project observation behavior is claimed.
Refs: TT-N03, TT-R01; approved work observation stage-five plan r1