@gajae-code/coding-agent 0.11.10 → 0.12.0

package/dist/types/gjc-runtime/deep-interview-ambiguity.d.ts

@@ -9,13 +9,15 @@ export interface AmbiguityClampResult {
     effective: number;
     clamped: boolean;
 }
-/** Compute the deterministic floor from integer units of persisted evidence. */
+/** Compute the deterministic floor from the inner deep-interview `state` object. */
 export declare function computeAmbiguityFloor(inner: unknown): AmbiguityFloorBreakdown;
 /** Clamp an LLM-reported ambiguity to the deterministic floor: `max(reported, floor)`. */
 export declare function clampReportedAmbiguity(reported: number, floor: number): AmbiguityClampResult;
 /**
- * Legacy pure utility for migrations and explicit repair flows. The recorder does
- * not dispute facts when an answer is retracted: scored evidence is immutable.
+ * Mark every established fact recorded in `retractedRound` as disputed. This is the
+ * mechanical contradiction signal for answer retraction: when the user replaces an
+ * already-scored answer (A -> B pivot), the facts that answer established can no
+ * longer be trusted, so they raise the floor until re-confirmed or superseded.
  * Returns new arrays/objects; never mutates the input.
  */
 export declare function disputeFactsFromRetractedRound(facts: readonly unknown[], retractedRound: number): {
@@ -35,12 +37,3 @@ export interface AppliedAmbiguityFloor {
  * (state CLI write/reconcile, recorder) applies this immediately before persisting.
  */
 export declare function applyAmbiguityFloorToEnvelope(value: unknown): AppliedAmbiguityFloor;
-export type DeepInterviewAmbiguityMilestone = "initial" | "progress" | "refined" | "ready";
-export declare function deriveAmbiguityMilestone(effectiveUnits: number, thresholdUnits: number): DeepInterviewAmbiguityMilestone;
-export declare function scoreToUnits(score: number): number;
-export declare function weightedAmbiguityUnits(scores: {
-    goal: number;
-    constraints: number;
-    criteria: number;
-    context?: number;
-}, type: "greenfield" | "brownfield"): number;

package/dist/types/gjc-runtime/deep-interview-recorder.d.ts

@@ -1,4 +1,4 @@
-import { type DeepInterviewEstablishedFact, type DeepInterviewIntentItem, type DeepInterviewIntentSubstitution, type DeepInterviewRoundRecord, type DeepInterviewRoundResultV1, type DeepInterviewStateEnvelope, type DeepInterviewTriggerMetadata } from "./deep-interview-state";
+import { type DeepInterviewEstablishedFact, type DeepInterviewIntentItem, type DeepInterviewIntentSubstitution, type DeepInterviewRoundRecord, type DeepInterviewStateEnvelope, type DeepInterviewTriggerMetadata } from "./deep-interview-state";
 export * from "./deep-interview-ambiguity";
 export * from "./deep-interview-state";
 /**
@@ -40,8 +40,6 @@ export interface DeepInterviewScoringInput {
     scores: Record<string, number>;
     ambiguity: number;
     triggers?: DeepInterviewTriggerMetadata[];
-    /** Complete native round result for typed callers. */
-    roundResult?: DeepInterviewRoundResultV1;
 }
 export type AppendOrMergeAction = "created" | "noop" | "replaced";
 export interface AppendOrMergeResult {
@@ -69,9 +67,11 @@ export interface TransitionValidationResult {
 }
 export declare function buildAnswerShell(input: DeepInterviewAnswerInput, now?: string): DeepInterviewRoundRecord;
 /**
- * Append-or-merge by `round_key`. An answer is a no-op only when its complete
- * canonical shell identity matches; a scored record is immutable evidence and
- * cannot be replaced by a late answer.
+ * Append-or-merge by `round_key`. Exactly one record per key:
+ * - no existing record -> append (`created`);
+ * - identical question_hash + answer_hash -> deterministic no-op (`noop`);
+ * - same key, different hashes -> deterministic replacement of the prior shell
+ *   (`replaced`); the prior answer for that key is superseded and lifecycle resets.
  */
 export declare function appendOrMergeRound(rounds: readonly DeepInterviewRoundRecord[], shell: DeepInterviewRoundRecord): AppendOrMergeResult;
 /**
@@ -94,43 +94,28 @@ export declare function ensureDeepInterviewStateShape(value: unknown): DeepInter
 export declare function projectCompactState(value: unknown, options?: {
     lastN?: number;
 }): DeepInterviewCompactState;
-interface RecorderMutationOptions {
-    sessionId?: string;
-    expectedRevision?: number;
-}
-export interface DeepInterviewPostCommitWarning {
-    code: "DI_POST_COMMIT_AUDIT_FAILED" | "DI_POST_COMMIT_ACTIVITY_FAILED" | "DI_POST_COMMIT_HUD_FAILED";
-    message: string;
-}
-export declare function runDeepInterviewPostCommitEffects(options: {
-    cwd: string;
-    statePath: string;
-    sessionId: string;
-    envelope: Record<string, unknown>;
-    revision: number;
-    writer: string;
-    auditWarnings?: readonly {
-        code: "DI_POST_COMMIT_AUDIT_FAILED";
-        message: string;
-    }[];
-}): Promise<DeepInterviewPostCommitWarning[]>;
 /** Refresh the best-effort HUD cache from persisted deep-interview state. */
 export declare function syncDeepInterviewRecorderHud(cwd: string, statePath: string, sessionId: string | undefined): Promise<void>;
 /**
  * Record an `answered` shell for one round (append-or-merge by durable key).
  *
- * Replacing an already-scored answer is rejected with
- * `DI_ANSWER_LIFECYCLE_CONFLICT`; scored evidence is immutable.
+ * Retraction dynamics: replacing an already-`scored` answer is a mechanical
+ * contradiction signal (the user pivoted). The facts that round established are
+ * marked disputed, which raises the deterministic ambiguity floor immediately —
+ * without waiting for the LLM scorer to self-report a trigger.
  */
-export declare function appendOrMergeDeepInterviewRound(cwd: string, statePath: string, input: DeepInterviewAnswerInput, options?: RecorderMutationOptions): Promise<{
+export declare function appendOrMergeDeepInterviewRound(cwd: string, statePath: string, input: DeepInterviewAnswerInput, options?: {
+    sessionId?: string;
+}): Promise<{
     action: AppendOrMergeAction;
     record: DeepInterviewRoundRecord;
-    warnings: DeepInterviewPostCommitWarning[];
+    disputedFactIds?: string[];
 }>;
 /** Merge scoring output into the same round record, transitioning to `scored`. */
-export declare function enrichDeepInterviewRoundScoring(cwd: string, statePath: string, input: DeepInterviewScoringInput, options?: RecorderMutationOptions): Promise<{
+export declare function enrichDeepInterviewRoundScoring(cwd: string, statePath: string, input: DeepInterviewScoringInput, options?: {
+    sessionId?: string;
+}): Promise<{
     record: DeepInterviewRoundRecord;
-    warnings: DeepInterviewPostCommitWarning[];
 }>;
 /** Compact projection so callers read a slice instead of the full transcript. */
 export declare function readDeepInterviewStateCompact(statePath: string, options?: {

package/dist/types/gjc-runtime/deep-interview-stage.d.ts

@@ -0,0 +1,37 @@
+import { CommandError } from "./workflow-cli-common";
+export declare const DEEP_INTERVIEW_STAGE_TRANSITIONS: readonly ["initialize-context", "record-round", "update-facts", "merge-state"];
+export type DeepInterviewStageTransition = (typeof DEEP_INTERVIEW_STAGE_TRANSITIONS)[number];
+declare const DRAFT_VERSION = 1;
+export type DeepInterviewStageErrorCode = "DI_STAGE_USAGE" | "DI_STAGE_INPUT_INVALID" | "DI_STAGE_SESSION_REQUIRED" | "DI_STAGE_DRAFT_EXISTS" | "DI_STAGE_NO_DRAFT" | "DI_STAGE_DRAFT_CORRUPT" | "DI_STAGE_STATE_MISSING" | "DI_STAGE_STATE_CORRUPT" | "DI_STAGE_REVISION_CONFLICT" | "DI_STAGE_MERGE_REJECTED";
+export declare class DeepInterviewStageError extends CommandError {
+    readonly code: DeepInterviewStageErrorCode;
+    readonly recovery?: string | undefined;
+    constructor(code: DeepInterviewStageErrorCode, message: string, recovery?: string | undefined);
+}
+export interface DeepInterviewStageDraft {
+    version: typeof DRAFT_VERSION;
+    draft_id: string;
+    session_id: string;
+    transition: DeepInterviewStageTransition;
+    /** State revision the draft was staged against; `apply` CAS-checks this. */
+    staged_against_revision: number;
+    /**
+     * Canonical content SHA-256 of the state the draft was staged against. Revision
+     * alone cannot catch sanctioned writers that do not bump `state_revision`
+     * (seed/spec-persistence), so `apply` requires BOTH to match.
+     */
+    staged_against_sha256: string;
+    payload: Record<string, unknown>;
+    created_at: string;
+}
+export interface DeepInterviewStageCommandResult {
+    status: number;
+    stdout?: string;
+    stderr?: string;
+}
+export declare function deepInterviewDraftPath(cwd: string, sessionId: string): string;
+export declare const DEEP_INTERVIEW_STAGE_VERBS: readonly ["stage", "check", "apply", "discard", "read", "write", "clear", "handoff"];
+export type DeepInterviewStageVerb = (typeof DEEP_INTERVIEW_STAGE_VERBS)[number];
+export declare function isDeepInterviewStageVerb(value: string | undefined): value is DeepInterviewStageVerb;
+export declare function runDeepInterviewStageCommand(verb: DeepInterviewStageVerb, args: readonly string[], cwd?: string): Promise<DeepInterviewStageCommandResult>;
+export {};

package/dist/types/gjc-runtime/deep-interview-state.d.ts

@@ -1,4 +1,3 @@
-import { computeAmbiguityFloor, type DeepInterviewAmbiguityMilestone } from "./deep-interview-ambiguity";
 /**
  * Pure, dependency-free foundation for deep-interview state shape.
  *
@@ -36,6 +35,10 @@ export interface DeepInterviewTriggerMetadata {
     status: DeepInterviewTriggerStatus;
     component: string;
     dimension: string;
+    priorDimensionScore?: number;
+    newDimensionScore?: number;
+    priorAmbiguity?: number;
+    newAmbiguity?: number;
     evidence?: string;
     contradictedFactId?: string;
     /** Required when status is `disputed` or `unresolved` to exempt the invariant. */
@@ -65,11 +68,9 @@ export interface DeepInterviewRoundRecord {
     /** Deterministic floor in effect when this round was scored, when it clamped. */
     ambiguity_floor?: number;
     triggers?: DeepInterviewTriggerMetadata[];
-    round_result_digest?: string;
 }
 export interface DeepInterviewStateEnvelope {
     threshold?: number;
-    threshold_units?: number;
     threshold_source?: string;
     state?: Record<string, unknown>;
     [key: string]: unknown;
@@ -196,135 +197,3 @@ export declare function assertDeepInterviewIntentReview(value: unknown, locked:
     round: unknown;
     answer_hash: unknown;
 }[]): asserts value is DeepInterviewIntentReview;
-export type DeepInterviewDimension = "goal" | "constraints" | "criteria" | "context";
-export type DeepInterviewResolution = "auto_research_accepted" | "auto_answer" | "direct" | "refined" | "cited_confirmation";
-export interface DeepInterviewFactOperation {
-    op: "add" | "dispute" | "supersede";
-    id: string;
-    statement?: string;
-    component?: string;
-    dimension?: DeepInterviewDimension;
-    evidence?: string;
-    target_id?: string;
-}
-export interface DeepInterviewOntologyEntity {
-    id: string;
-    name: string;
-    type: string;
-    fields: string[];
-}
-export interface DeepInterviewOntologyRelationship {
-    id: string;
-    from_entity_id: string;
-    to_entity_id: string;
-    type: string;
-}
-export interface DeepInterviewOntologyReasoning {
-    statement: string;
-    evidence?: string;
-}
-export interface DeepInterviewOntologyInput {
-    entities: DeepInterviewOntologyEntity[];
-    relationships: DeepInterviewOntologyRelationship[];
-    reasoning: DeepInterviewOntologyReasoning[];
-}
-export interface DeepInterviewComponentUpdate {
-    component_id: string;
-    scores: Record<DeepInterviewDimension, number>;
-}
-/**
- * Optional legacy assertions accepted only when they agree with the native
- * target. The persisted target is always derived from component scores.
- */
-export interface DeepInterviewTargetingInput {
-    target_component_id?: string;
-    target_dimension?: DeepInterviewDimension;
-    weakest_component_id?: string;
-    weakest_dimension?: DeepInterviewDimension;
-    last_targeted_component_id?: string | null;
-}
-export interface DeepInterviewRoundBookkeeping {
-    resolution: DeepInterviewResolution;
-    round_ids?: string[];
-    counter_deltas?: Record<string, number>;
-}
-/**
- * Closed evidence submitted for one scoring transaction. All convergence values
- * (ambiguity, floor, milestone, ontology counts, rotation, and streak) are
- * native-derived and intentionally cannot be supplied here.
- */
-export interface DeepInterviewRoundResultV1 {
-    global_scores: Record<DeepInterviewDimension, number>;
-    component_updates?: DeepInterviewComponentUpdate[];
-    targeting?: DeepInterviewTargetingInput;
-    triggers?: DeepInterviewTriggerMetadata[];
-    fact_ops?: DeepInterviewFactOperation[];
-    ontology?: DeepInterviewOntologyInput | DeepInterviewOntologyEntity[];
-    bookkeeping?: DeepInterviewRoundBookkeeping;
-    /** Compatibility adapter for recorder callers; never persisted as the v1 wire shape. */
-    component_scores?: Record<string, Record<DeepInterviewDimension, number>>;
-    auto_answered?: boolean;
-}
-/**
- * Version 1 native projection returned by `apply-round-result` as
- * `native_projection`. This is the complete renderable convergence surface;
- * callers must not derive or supplement it from candidate scorer input.
- */
-export interface DeepInterviewRoundResultProjection {
-    score_units: Partial<Record<DeepInterviewDimension, number>>;
-    weighted_ambiguity: number;
-    weighted_ambiguity_units: number;
-    floor: number;
-    floor_units: number;
-    floor_cause: ReturnType<typeof computeAmbiguityFloor>;
-    effective_ambiguity: number;
-    effective_ambiguity_units: number;
-    prior_effective_ambiguity: number | null;
-    direction: "increased" | "decreased" | "unchanged" | "initial";
-    ambiguity_milestone: DeepInterviewAmbiguityMilestone;
-    topology: unknown;
-    topology_counts: {
-        active: number;
-        deferred: number;
-        total: number;
-    };
-    ontology: unknown;
-    ontology_counts: {
-        stable: number;
-        changed: number;
-        new: number;
-        basis: string;
-    };
-    targeting: {
-        target_component_id: string | null;
-        target_dimension: DeepInterviewDimension | null;
-        last_targeted_component_id: string | null;
-    };
-    transition: {
-        round_key: string;
-        lifecycle: "scored";
-        auto_answer_streak: number;
-    };
-}
-export type DeepInterviewApplyRoundResult = {
-    kind: "noop";
-    envelope: DeepInterviewStateEnvelope;
-    projection?: DeepInterviewRoundResultProjection;
-} | {
-    kind: "write";
-    envelope: DeepInterviewStateEnvelope;
-    projection: DeepInterviewRoundResultProjection;
-};
-/** Strict UTF-8 JSON serialization used by v1 replay digests. */
-export declare function canonicalDeepInterviewJson(value: unknown): string;
-export declare function deepInterviewRoundResultDigest(input: {
-    round: number;
-    question_id: string;
-    round_id?: string | null;
-    result: unknown;
-}): string;
-/** Complete persisted answer identity; omitted optional values normalize to null. */
-export declare function deepInterviewAnswerIdentityEqual(a: Pick<DeepInterviewRoundRecord, "round" | "round_key" | "round_id" | "question_id" | "component" | "dimension" | "question_text" | "question_hash" | "selected_options" | "custom_input">, b: Pick<DeepInterviewRoundRecord, "round" | "round_key" | "round_id" | "question_id" | "component" | "dimension" | "question_text" | "question_hash" | "selected_options" | "custom_input">): boolean;
-/** Apply one closed v1 scoring round. The input contains evidence only; all convergence state is derived here. */
-export declare function applyDeepInterviewRoundResultV1(envelopeValue: unknown, roundKey: string, result: DeepInterviewRoundResultV1, now: string): DeepInterviewApplyRoundResult;
-export declare function validateDeepInterviewV1Envelope(value: Record<string, unknown>): void;

package/dist/types/gjc-runtime/gc-runtime.d.ts

@@ -12,7 +12,7 @@
  *   error all mean KEEP — a live process is never signalled or killed.
  * - Dry-run by default: nothing is deleted unless `--prune`/`--force`.
  */
-export type GcStore = "harness_leases" | "team_workers" | "file_locks" | "tmux_sessions" | "registry_entries";
+export type GcStore = "harness_leases" | "team_workers" | "file_locks" | "tmux_sessions" | "registry_entries" | "local_roots";
 export declare const GC_STORES: readonly GcStore[];
 /** Why a probed pid is kept instead of treated as dead. */
 export type GcPidKeepReason = "alive" | "eperm" | "unknown";

package/dist/types/gjc-runtime/linux-proc.d.ts

@@ -1,29 +1,37 @@
 /**
- * Shared helpers for reading Linux `/proc/<pid>/stat` process start time.
+ * Shared helpers for reading Linux `/proc/<pid>/stat` process identity fields.
  *
  * The `comm` field (field 2, wrapped in parentheses) may itself contain spaces
  * and parentheses, so the only robust anchor is the *last* `)` in the stat
  * string. Field 22 (the process start time in clock ticks since boot) is the
- * 20th whitespace-separated token after that closing paren (index 19).
- *
- * Every caller previously parsed this format independently, with subtly
- * different failure handling. This module fails closed: any malformed input
- * (missing `)`, non-numeric field 22, unreadable `/proc` file, non-Linux
- * platform) yields `null` rather than an inconsistent sentinel.
- */
-/**
- * Parse field 22 (process start time, in clock ticks since boot) from one
- * `/proc/<pid>/stat` record. Returns the raw numeric token, or `null` when the
- * record shape is malformed or field 22 is absent/non-numeric.
+ * 20th whitespace-separated token after that closing paren (index 19). Field 7
+ * (`tty_nr`) is the 5th token after the closing paren (index 4).
  */
+export interface LinuxProcStatIdentity {
+    startTime: string;
+    ttyDevice: string;
+}
+export type LinuxProcPidProbeResult = ({
+    kind: "live";
+} & LinuxProcStatIdentity) | {
+    kind: "absent";
+} | {
+    kind: "unverifiable";
+    reason: "unsupported_platform" | "invalid_pid" | "permission_denied" | "read_error" | "malformed_stat";
+};
+/** Parse field 22 (start time) from a `/proc/<pid>/stat` record. */
 export declare function parseLinuxProcStartTime(stat: string | null | undefined): string | null;
+/** Parse field 7 (`tty_nr`) from a `/proc/<pid>/stat` record. */
+export declare function parseLinuxProcTtyDevice(stat: string | null | undefined): string | null;
+export declare function probeLinuxProcPidSync(pid: number): LinuxProcPidProbeResult;
+export declare function probeLinuxProcPid(pid: number): Promise<LinuxProcPidProbeResult>;
 /**
  * Read `/proc/<pid>/stat` synchronously and return the parsed start time.
- * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
+ * Returns `null` when the probe is absent or unverifiable.
  */
 export declare function readLinuxProcStartTimeSync(pid: number): string | null;
 /**
  * Read `/proc/<pid>/stat` asynchronously and return the parsed start time.
- * Returns `null` on non-Linux platforms, unreadable files, or malformed input.
+ * Returns `null` when the probe is absent or unverifiable.
  */
 export declare function readLinuxProcStartTime(pid: number): Promise<string | null>;

package/dist/types/gjc-runtime/memory-guard-owner-claims.d.ts

@@ -0,0 +1,47 @@
+import { type LinuxProcPidProbeResult } from "./linux-proc";
+declare const MEMORY_GUARD_CLAIM_RESOURCES: readonly ["writer", "tty"];
+type MemoryGuardClaimResource = (typeof MEMORY_GUARD_CLAIM_RESOURCES)[number];
+export interface MemoryGuardClaimOwner {
+    sessionId: string;
+    generation: string;
+    runId: string;
+    childToken: string;
+    pid: number;
+    processStartTime: string;
+    ttyDevice: string;
+}
+export interface MemoryGuardClaimsLease {
+    writerEpoch: number;
+    ttyEpoch: number;
+    owner: MemoryGuardClaimOwner;
+    claimStorePath: string;
+}
+export declare function isMemoryGuardClaimsLease(value: unknown): value is MemoryGuardClaimsLease;
+export declare function isMemoryGuardClaimsLeaseForStateDir(value: unknown, stateDir: string): value is MemoryGuardClaimsLease;
+export type MemoryGuardClaimsReleasedProof = MemoryGuardClaimsLease;
+interface PersistedMemoryGuardClaimRow {
+    resource: MemoryGuardClaimResource;
+    epoch: number;
+    session_id: string;
+    generation: string;
+    run_id: string;
+    child_token: string;
+    pid: number;
+    process_start_time: string;
+    tty_device: string;
+    acquired_at: string;
+}
+export interface MemoryGuardOwnerClaimsDeps {
+    probePid(pid: number): Promise<LinuxProcPidProbeResult>;
+    now(): string;
+}
+export declare function memoryGuardClaimsDatabaseFile(stateDir: string, sessionId: string): string;
+export declare function acquireMemoryGuardClaims(stateDir: string, owner: MemoryGuardClaimOwner, deps?: MemoryGuardOwnerClaimsDeps): Promise<MemoryGuardClaimsLease>;
+export declare function releaseMemoryGuardClaims(stateDir: string, claim: MemoryGuardClaimsLease): Promise<void>;
+export declare function probeMemoryGuardClaimsReleased(stateDir: string, owner: MemoryGuardClaimOwner, deps?: MemoryGuardOwnerClaimsDeps): Promise<MemoryGuardClaimsReleasedProof>;
+export interface PersistedMemoryGuardClaimsSnapshot {
+    epoch: number;
+    claims: PersistedMemoryGuardClaimRow[];
+}
+export declare function readMemoryGuardClaimsForTest(stateDir: string, sessionId: string): Promise<PersistedMemoryGuardClaimsSnapshot>;
+export {};

package/dist/types/gjc-runtime/ralplan-runtime.d.ts

@@ -1,3 +1,4 @@
+import { type RalplanIndexRow } from "./ledger-event-renderer";
 /**
  * Native implementation of `gjc ralplan`.
  *
@@ -12,7 +13,7 @@
  *
  * 2. **Artifact write**: `gjc ralplan --write --stage <type> --stage_n <N>
  *    (--artifact <path-or-string> | --artifact-env GJC_RALPLAN_ARTIFACT)
- *    [--run-id <id>] [--session-id <id>] [--json]` persists Planner / Architect
+ *    [--run-id <id>] [--session-id <id>] [--lane-verdict <token>] [--json]` persists Planner / Architect
  *    / Critic / revision / post-interview / ADR / final markdown under `.gjc/plans/ralplan/<run-id>/`, maintains
  *    an `index.jsonl` audit log, copies `final` stages to `pending-approval.md`, and advances
  *    the HUD chip to reflect the latest persisted stage.
@@ -22,5 +23,115 @@ export interface RalplanCommandResult {
     stdout?: string;
     stderr?: string;
 }
+/** Default consensus iterations (planner + revision openers) per run. Matches SKILL.md re-review cap. */
+export declare const RALPLAN_DEFAULT_MAX_ITERATIONS = 5;
+/** Inclusive upper bound for `gjc.ralplan.maxIterations` settings overrides. */
+export declare const RALPLAN_MAX_ITERATIONS_LIMIT = 20;
+/** Operator-visible stuck signal for headless/CI orchestration (#3165). */
+export declare const PLANNING_STUCK_MARKER = "PLANNING-STUCK";
+/** Default architect/critic review passes per consensus iteration. */
+export declare const RALPLAN_DEFAULT_MAX_REVIEW_PASSES_PER_LANE = 1;
+/** Inclusive upper bound for `gjc.ralplan.maxReviewPassesPerLane` settings overrides. */
+export declare const RALPLAN_MAX_REVIEW_PASSES_PER_LANE_LIMIT = 10;
+export type RalplanIterationCapDecision = {
+    allowed: true;
+    currentIterations: number;
+    projectedIterations: number;
+    maxIterations: number;
+} | {
+    allowed: false;
+    currentIterations: number;
+    projectedIterations: number;
+    maxIterations: number;
+    reason: string;
+};
+/**
+ * Pure consensus-iteration budget gate (#3165).
+ *
+ * A `planner` or `revision` write opens a new iteration (same definition as
+ * `summarizeRalplanIndex`). Other stages never open iterations and are always
+ * allowed by this gate — including `final` after the cap is already reached.
+ *
+ * `iterationFloor` raises the observed opener count when on-disk evidence or a
+ * recovered ledger is higher than the parsed index (fail-closed vs wipe/truncate).
+ */
+export declare function evaluateRalplanIterationCap(input: {
+    rows: readonly RalplanIndexRow[];
+    stage: string;
+    maxIterations?: number;
+    /** Minimum opener count (e.g. on-disk stage-*-{planner,revision}.md). */
+    iterationFloor?: number;
+}): RalplanIterationCapDecision;
+export type RalplanReviewLane = "architect" | "critic";
+export type RalplanReviewLaneBudgetDecision = {
+    allowed: true;
+    lane?: RalplanReviewLane;
+    currentPasses: number;
+    projectedPasses: number;
+    maxReviewPassesPerLane: number;
+    finalSlot: boolean;
+    ledgerNote?: string;
+} | {
+    allowed: false;
+    lane: RalplanReviewLane;
+    currentPasses: number;
+    projectedPasses: number;
+    maxReviewPassesPerLane: number;
+    finalSlot: false;
+    ledgerNote?: string;
+    reason: string;
+};
+/**
+ * Pure per-lane review-pass budget gate. Architect and critic passes are limited
+ * within the current consensus iteration; all other stages remain unconditionally
+ * available as escalation paths.
+ */
+export declare function evaluateRalplanReviewLaneBudget(input: {
+    rows: readonly RalplanIndexRow[];
+    stage: string;
+    maxReviewPassesPerLane?: unknown;
+    onDiskLaneCounts?: {
+        architect: number;
+        critic: number;
+    };
+}): RalplanReviewLaneBudgetDecision;
+/**
+ * Count on-disk planner/revision stage artifacts for a run. Used as a floor when
+ * `index.jsonl` is missing, empty, truncated, or otherwise under-counts openers.
+ */
+export declare function countRalplanOnDiskOpeners(cwd: string, sessionId: string, runId: string): Promise<number>;
+/**
+ * Count on-disk Architect/Critic stage artifacts for a run. This is the
+ * fail-closed floor for a missing, truncated, or malformed `index.jsonl`.
+ */
+export declare function countRalplanOnDiskLaneArtifacts(cwd: string, sessionId: string, runId: string): Promise<{
+    architect: number;
+    critic: number;
+}>;
+/**
+ * Load index rows for cap enforcement. Unlike HUD reads, returns structural
+ * signals so callers can fail closed when the ledger is empty/malformed while
+ * opener artifacts already exist on disk.
+ */
+export declare function loadRalplanIndexForCap(cwd: string, sessionId: string, runId: string): Promise<{
+    rows: RalplanIndexRow[];
+    indexPresent: boolean;
+    parseableLines: number;
+    rawLineCount: number;
+    rawText?: string;
+}>;
+/**
+ * Resolve ralplan consensus iteration cap. Project `./.gjc/settings.json` overrides
+ * user settings, else default 5.
+ */
+export declare function resolveRalplanMaxIterations(cwd: string): Promise<{
+    maxIterations: number;
+    source: string;
+}>;
+/** Resolve the per-lane review-pass budget with project-over-user precedence. */
+export declare function resolveRalplanMaxReviewPassesPerLane(cwd: string): Promise<{
+    maxReviewPassesPerLane: number;
+    source: string;
+}>;
 export declare function isRalplanArtifactWriteInvocation(args: readonly string[]): boolean;
 export declare function runNativeRalplanCommand(args: string[], cwd?: string): Promise<RalplanCommandResult>;

package/dist/types/gjc-runtime/state-runtime.d.ts

@@ -11,6 +11,7 @@ export interface StateCommandResult {
     stdout?: string;
     stderr?: string;
 }
+type StateWarningSink = (warning: string) => void;
 /**
  * Reconcile a workflow skill's mode-state + active-state/HUD from a caller-derived
  * payload. Unlike `gjc state write`, this is a derived repair: callers reconcile from
@@ -34,5 +35,6 @@ export declare function reconcileWorkflowSkillState(options: {
 }): Promise<{
     stateFile: string;
 }>;
-export declare function readWorkflowStateJson(cwd: string, skill: CanonicalGjcWorkflowSkill, sessionId?: string): Promise<Record<string, unknown>>;
+export declare function readWorkflowStateJson(cwd: string, skill: CanonicalGjcWorkflowSkill, sessionId?: string, onWarning?: StateWarningSink): Promise<Record<string, unknown>>;
 export declare function runNativeStateCommand(args: string[], cwd?: string): Promise<StateCommandResult>;
+export {};

package/dist/types/gjc-runtime/state-writer.d.ts

@@ -46,47 +46,6 @@ export interface WorkflowEnvelopeIntegrityMismatch {
     expected: string;
     actual: string;
 }
-export type WorkflowReceiptVerification = "legacy" | "native-valid" | "receipt-malformed" | "receipt-missing" | "checksum-mismatch";
-export interface GuardedWorkflowEnvelopeTransformOptions extends StateWriterOptions {
-    expectedRevision: number;
-    /** Additional native schema validation applied to both current and candidate envelopes. */
-    validate?: (value: Record<string, unknown>, legacy: boolean) => void;
-    transform: (current: Record<string, unknown>, context: {
-        revision: number;
-        legacy: boolean;
-    }) => {
-        kind: "noop";
-    } | {
-        kind: "write";
-        value: Record<string, unknown>;
-    } | Promise<{
-        kind: "noop";
-    } | {
-        kind: "write";
-        value: Record<string, unknown>;
-    }>;
-}
-export interface GuardedWorkflowEnvelopeWarning {
-    code: "DI_POST_COMMIT_AUDIT_FAILED";
-    message: string;
-}
-export type GuardedWorkflowEnvelopeTransformResult = {
-    path: string;
-    written: false;
-    reason: "noop";
-    revision: number;
-    warnings: [];
-} | {
-    path: string;
-    written: true;
-    revision: number;
-    stamped: Record<string, unknown>;
-    warnings: GuardedWorkflowEnvelopeWarning[];
-};
-export declare class GuardedWorkflowEnvelopeError extends Error {
-    readonly code: string;
-    constructor(code: string);
-}
 export interface WorkflowTransactionJournal {
     version: 1;
     mutation_id: string;
@@ -103,7 +62,6 @@ export interface GuardedStateWriterOptions extends StateWriterOptions {
     policy: StateWritePolicy;
     expectedRevision?: number;
     sourceRevision?: number;
-    lockHeld?: boolean;
 }
 export type GuardedWriteResult = {
     path: string;
@@ -121,13 +79,17 @@ export interface StateWriterOptions {
     receipt?: StateWriterReceiptContext;
     audit?: StateWriterAuditContext;
     sourceRevision?: number;
-    orderingRevision?: number;
     /**
      * Cross-process lock tuning for read-modify-write paths that route through
      * `withWorkflowStateLock` / `updateJsonAtomic`. Omit for the hardened
      * `withFileLock` defaults.
      */
     lock?: FileLockOptions;
+    /**
+     * Caller already holds the workflow state lock for this target path (via
+     * `withWorkflowStateLock`). Skip re-acquisition to avoid self-deadlock.
+     */
+    lockHeld?: boolean;
 }
 export declare class StateWriteConflictError extends Error {
     readonly path: string;
@@ -183,8 +145,6 @@ export type StrictMutationReadResult = {
 };
 export declare function readExistingStateForMutation(filePath: string): Promise<StrictMutationReadResult>;
 export declare function workflowEnvelopeContentSha256(value: unknown): string;
-export declare function isNativeDeepInterviewV1(value: Record<string, unknown>): boolean;
-export declare function verifyWorkflowEnvelopeReceiptValue(value: unknown, filePath: string): WorkflowReceiptVerification;
 export declare function stampWorkflowEnvelopeChecksum<T>(value: T, filePath: string, computedAt?: string): T;
 export declare function detectWorkflowEnvelopeIntegrityMismatch(filePath: string): Promise<WorkflowEnvelopeIntegrityMismatch | undefined>;
 type ActiveStateCacheInvalidator = (cwd?: string, sessionId?: string) => void;
@@ -192,7 +152,6 @@ export declare function setActiveStateCacheInvalidator(invalidator: ActiveStateC
 export declare function persistedStateRevision(value: unknown): number;
 export declare function writeGuardedJsonAtomic(targetPath: string, value: unknown, options: GuardedStateWriterOptions): Promise<GuardedWriteResult>;
 export declare function writeGuardedWorkflowEnvelopeAtomic(targetPath: string, value: unknown, options: GuardedStateWriterOptions): Promise<GuardedWriteResult>;
-export declare function transformGuardedWorkflowEnvelopeAtomic(targetPath: string, options: GuardedWorkflowEnvelopeTransformOptions): Promise<GuardedWorkflowEnvelopeTransformResult>;
 export declare function writeJsonAtomic(targetPath: string, value: unknown, options?: StateWriterOptions): Promise<string>;
 export declare function writeWorkflowEnvelopeAtomic(targetPath: string, value: unknown, options?: StateWriterOptions): Promise<string>;
 export declare function writeTextAtomic(targetPath: string, text: string, options?: StateWriterOptions): Promise<string>;