@quantiya/codevibe-claude-plugin 2.0.42 → 2.0.44

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/ImplementorSetupWizard.d.ts

@@ -0,0 +1,10 @@
+import * as React from 'react';
+import type { ImplementorWizardState } from '../types';
+import { type ImplementorPreference } from '../implementor-preference';
+export declare const IMPLEMENTOR_WIZARD_MAX_ROWS = 12;
+export interface ImplementorSetupWizardProps {
+    wizard: ImplementorWizardState;
+    onSubmit: (pref: ImplementorPreference) => void;
+    onCancel: () => void;
+}
+export declare function ImplementorSetupWizard(props: ImplementorSetupWizardProps): React.ReactElement;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/InputBar.d.ts

@@ -84,6 +84,7 @@ export declare function computeInputWindow(display: string, caretCol: number, va
 export type GatePromptMode = {
     kind: 'awaiting-number';
     maxOption: number;
+    taskLabel?: string;
 } | {
     kind: 'awaiting-notes';
     decisionDraft: string;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-decision-submit.d.ts

@@ -89,13 +89,34 @@ type GatePromptEntry = Extract<ConversationEntry, {
     kind: 'gate-prompt';
 }>;
 /**
- * §5.1 + #C8M-11 active-gate-prompt scan. Tail-to-head walk for the first
- * `kind:'gate-prompt'` entry with `final === false`. Pure; safe to call from a
+ * §5.1 + #C8M-11 active-gate-prompt scan: the OLDEST `kind:'gate-prompt'`
+ * entry with `final === false` (head-to-tail). Pure; safe to call from a
  * render path. Returns the entry verbatim so callers can pattern-match the
- * discriminated union directly. (Shared so the TTY component + non-TTY loop use
- * the identical scan.)
+ * discriminated union directly. (Shared so the TTY component, the mobile
+ * reply route and the non-TTY loop use the identical scan.)
+ *
+ * P46a (F-P46a-5): this used to be tail-to-head (the NEWEST open gate). With
+ * several tasks in flight, gates arrive in bursts, and the newest-wins rule
+ * moved the target under the user's fingers — the composer read `Task #2`,
+ * a gate for `#3` arrived, and the `1` that was typed for #2 approved #3
+ * (E2E r3 q1). Oldest-first keeps the active gate — its pinned card, the
+ * composer label `Type a number 1..N · Task #n`, and the gate a digit
+ * resolves — stable until the user answers it; newer gates wait their turn.
+ *
+ * Stage 1 r1 F2(b): an older open gate that is NOT answerable — stuck in
+ * `confirming` / `submitting` (the F-P46a-1 wedge) or `claimed` elsewhere —
+ * must not block every newer gate: the active gate is the oldest open gate in
+ * an ANSWERABLE phase (`awaiting-number` / `awaiting-notes`); when no open gate
+ * is answerable, the oldest open one (so the UI still shows its state).
+ *
+ * Stage 1 r2 F1: that choice is STICKY. Callers holding the store state pass
+ * `state.activeGatePromptId` (reducer-owned, see `normalizeActiveGatePrompt`):
+ * while that entry is open it stays the active gate, so an older gate whose
+ * submit rolled back to `awaiting-number` never takes the digits (or a
+ * half-typed note) back from the gate the user is answering. Without an id the
+ * scan above applies (pure callers and tests).
  */
-export declare function findActiveGatePromptEntry(conversation: ReadonlyArray<ConversationEntry>): GatePromptEntry | null;
+export declare function findActiveGatePromptEntry(conversation: ReadonlyArray<ConversationEntry>, activeGatePromptId?: string | null): GatePromptEntry | null;
 /**
  * Submit a gate decision: dispatch SUBMIT_STARTED, fire the SDK, dispatch
  * RESOLVED on success (and notify `onTerminalDecision`) or SUBMIT_FAILED on

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/implementor-preference.d.ts

@@ -0,0 +1,24 @@
+export type ActiveImplementorAgentKind = 'CLAUDE' | 'CODEX' | 'ANTIGRAVITY';
+export declare const DEFAULT_IMPLEMENTOR_PRIORITY: readonly ActiveImplementorAgentKind[];
+export interface ImplementorPreference {
+    schemaVersion: 1;
+    priorityOrder: ActiveImplementorAgentKind[];
+    confirmBeforeStart: boolean;
+    updatedAt: string;
+}
+export declare function implementorPreferenceFilePath(): string;
+export declare function defaultImplementorPreference(): ImplementorPreference;
+export declare function normalizeImplementorAgent(val: string): ActiveImplementorAgentKind | null;
+/**
+ * Synchronously reads the implementor preference. Fails soft: returns defaults
+ * if the file is absent or corrupt.
+ */
+export declare function readImplementorPreferenceSync(): ImplementorPreference;
+/**
+ * Saves updated implementor preference to ~/.codevibe/implementor-preference.json.
+ */
+export declare function saveImplementorPreference(patch: {
+    priorityOrder?: ActiveImplementorAgentKind[];
+    confirmBeforeStart?: boolean;
+}): Promise<ImplementorPreference>;
+export declare function resetImplementorPreference(): Promise<ImplementorPreference>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -47,7 +47,30 @@ import type { EnsureFreshResult } from './context-store';
 import { contextItemOccurrence, type ContextDurabilityReceipt } from './context-items';
 import { renderRehydratedSessionContext } from './context-compaction';
 import type { AgentKind as LocalExecutorAgentKind } from '../local-executor/types';
+import type { OrchestrationState as OrchestrationStateType } from './types';
 import { type TaskProgressEvent } from './task-progress';
+import { taskLabel } from './task-label';
+/**
+ * Gathers the implementor agents currently active across single-implementor running tasks
+ * and multi-track Agent Teams tracks. Used for multi-track priority allocation.
+ */
+export declare function getInFlightImplementorAgents(state: OrchestrationStateType): LocalExecutorAgentKind[];
+/**
+ * P46a (Stage 1 r1 F2a) — the oldest unresolved continuation-offer gate
+ * prompt, whatever other gates are open. Pure.
+ */
+export declare function findActiveContinuationOfferEntry(conversation: ReadonlyArray<ConversationEntry>): (ConversationEntry & {
+    kind: 'gate-prompt';
+}) | null;
+/**
+ * P46a (Stage 1 r1 F2c) — a typed digit from the phone cannot choose between
+ * several open review gates (the phone shows no task label until P46b): the
+ * advisory to send back instead of answering the oldest gate, or null when the
+ * reply is not a bare digit or at most one gate is answerable. Pure.
+ */
+export declare function mobileGateReplyAmbiguity(state: Parameters<typeof taskLabel>[0] & {
+    conversation: ReadonlyArray<ConversationEntry>;
+}, text: string): string | null;
 export declare class OrchestrationShellStartupError extends Error {
     readonly cause?: unknown;
     constructor(message: string, cause?: unknown);
@@ -686,6 +709,20 @@ export declare function routeTeamDecompose(deps: {
     /** Stage-2 R3 HIGH — the loop's durable store, so the live launch persists the retained spec + attachments. */
     durableStore?: RevertManifestStore;
 }): Promise<void>;
+/**
+ * Shared helper for handling LaunchTeamOutcome for both unconfirmed (auto-launch)
+ * and confirmed ("yes" reply) team launches. Ensures parity across both paths:
+ * - 'accepted' -> clean return (success advisory already dispatched by launchTeamFromWorkItems)
+ * - 'disjointness_rejected' -> dispatch advisory, call fallbackToSingle (if provided)
+ * - 'unknown_create_error' -> retry ONCE with same idempotency key; if second attempt
+ *   is disjointness_rejected -> fallbackToSingle; if second attempt is unknown_create_error ->
+ *   dispatch "Couldn't confirm the team started — check /status or retry. Nothing was launched."
+ */
+export declare function handleTeamLaunchOutcome(deps: {
+    launch: () => Promise<LaunchTeamOutcome>;
+    store: OrchestrationStore;
+    fallbackToSingle?: () => Promise<void>;
+}): Promise<void>;
 /** Test seam — reset the module-level A1e and M7 composers (vitest-gated). */
 export declare function resetDispatchContextComposerForTests(): void;
 /** Test seam — install the M7 decomposer user-context composer (vitest-gated). */

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/non-tty-fallback.d.ts

@@ -38,9 +38,8 @@ export interface RunLineLogFallbackArgs {
 /**
  * Whether the internal planner-classification entry (`[planner] <action>:
  * <rationale>` / the TTY "Planner classified …" node) is shown to the user.
- * OFF by default — it's internal mechanics that duplicate the actual response /
- * clarification the user already sees, and leaks taxonomy jargon ("classify").
- * Opt in with `CODEVIBE_PLANNER_DEBUG=1` when debugging the planner. The entry is
+ * OFF by default — it's internal mechanics that duplicate the actual response.
+ * Standardized to log level `CODEVIBE_LOG_LEVEL=debug`. The entry is
  * ALWAYS kept in conversation state (audit / logic / tests) — only the VIEW is gated.
  */
 export declare function plannerDecisionRenderEnabled(env?: NodeJS.ProcessEnv): boolean;
@@ -48,7 +47,7 @@ export declare function plannerDecisionRenderEnabled(env?: NodeJS.ProcessEnv): b
  * Renders a single `ConversationEntry` as a line-prefixed text string.
  * Strict text only — no ANSI escapes, no colors, no `\r` rewrites.
  */
-export declare function renderEntryAsLine(entry: ConversationEntry): string;
+export declare function renderEntryAsLine(entry: ConversationEntry, labelFor?: (taskId: string) => string | undefined): string;
 /**
  * Subscribes to the store and prints new conversation entries as
  * line-prefixed text. Returns a promise that resolves on `EXIT` action

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/quorum-loop.d.ts

@@ -103,17 +103,18 @@ export declare function policyRejectionAdvisoryText(info: {
  *   - An explicit `override` (from `/task --agent claude|codex|antigravity`) wins, BUT only
  *     when that agent was actually detected on this host (else fail-closed to the
  *     default — we never spawn a binary the host doesn't have).
- *   - Otherwise: CLAUDE when it is among the detected agents (the documented
- *     default), else the FIRST detected agent, else CLAUDE as the universal
- *     fail-safe (matches the engine's Claude-only fallback when the host detected
- *     nothing). The implementor argv allowlist already covers all three agents,
- *     so any returned kind is spawnable without widening it.
+ *   - Configurable implementor priority order via ~/.codevibe/implementor-preference.json
+ *     (defaults to CLAUDE > CODEX > ANTIGRAVITY).
+ *   - Multi-track priority allocation: when concurrent tracks run, allocates each track
+ *     to the next idle agent in priority order. For hosts with a single installed agent,
+ *     all tracks allocate to that agent.
+ *   - Explicit override (@mention or --agent flag) always takes precedence if installed.
  *
  * Returns `{ agent, note }` — `note` is a non-null user-facing string ONLY when
  * an explicit override could not be honored (so the shell can surface it); null
  * when the selection was clean. NEVER throws.
  */
-export declare function selectImplementorAgent(detected: readonly AgentKind[], override?: AgentKind | null): {
+export declare function selectImplementorAgent(detected: readonly AgentKind[], override?: AgentKind | null, inFlightAgents?: readonly AgentKind[] | null, priorityOrder?: readonly AgentKind[] | null): {
     agent: AgentKind;
     note: string | null;
 };
@@ -320,24 +321,10 @@ export interface QuorumLoopDeps {
     /**
      * CP-14 Wave A — the team execution model. `worktree_merge` makes each team
      * track commit to a persistent branch (the merge-before-push spine) instead of
-     * the merge-train promote (the only model since the §10 retirement). Omitted keeps the
-     * shipped path byte-identical. Resolved from `CODEVIBE_TEAM_EXECUTION` when
-     * unset (see {@link resolveTeamExecution}).
+     * the merge-train promote (the sole model since the §10 retirement). Omitted keeps the
+     * shipped path byte-identical (see {@link resolveTeamExecution}).
      */
     teamExecution?: TeamExecution;
-    /**
-     * CP-7 Stage-2 r3 (Codex) HIGH — ARM the LE's current/authorized task id so
-     * the round-0 (and revise) implementor spawn engages the CP-7 trusted-execution
-     * substrate instead of the pre-TaskAuthorized reduced-trust path. `startTask`
-     * threads the minted taskId here BEFORE the round-0 spawn drains (and rolls it
-     * back to `null` on a START rejection); production wires it to
-     * `LocalExecutorImpl.setActiveTaskId`. ABSENT (legacy/tests) → the LE's task id
-     * is unchanged (the pre-fix behavior); production MUST wire it so the
-     * implementor never spawns unbadged/unsandboxed. The same state
-     * (`LocalExecutorImpl.taskId`) drives `engageSubstrateForSpawn` (local-executor-
-     * impl.ts:566) to call `substrateEngager` rather than emit a `tier:'none'` badge.
-     */
-    armLeTaskId?: (taskId: string | null) => void;
     /**
      * CP-7 §8 (Stage-1-resolved) — engage the CP-7 trusted-execution substrate +
      * broker for ONE reviewer seat. When wired (production via cli.ts →
@@ -345,11 +332,8 @@ export interface QuorumLoopDeps {
      * agent reviewer runs INSIDE the sandbox with no ambient vendor creds and a
      * broker-routed model call — closing the CP-14 §8/§13 reviewer-sandbox gap.
      * ABSENT (legacy / companion / tests) → reviewers take the legacy unsandboxed
-     * path BYTE-IDENTICAL (§7 non-regression). Reviewer-sandboxing DEFAULTS ON
-     * when this engager is wired (R7 A4), with an operator opt-out env flag
-     * (`CODEVIBE_SANDBOX_REVIEWERS=0`, read in `engageSeatSubstrate` on the
-     * `spawnOneSeat` path — see `reviewerSandboxingEnabled`). The flag is
-     * independent of implementor sandboxing (which has its own engager).
+     * path BYTE-IDENTICAL (§7 non-regression). Reviewer-sandboxing is mandatory
+     * when this engager is wired (see `reviewerSandboxingEnabled`).
      */
     engageReviewerSubstrate?: ReviewerSubstrateEngager;
     /**
@@ -599,12 +583,59 @@ interface TeamRunAuthority {
  * here closes packet-order races without extending or weakening the wire.
  */
 export declare function teamRound0GateId(taskId: string, taskGroupId: string, trackIndex: number, dispatchGeneration: number): string;
+/**
+ * P46a D1 — the reducer-owned in-session task numbering, reachable from the
+ * loop through this sink (installed by the shell after the store exists).
+ * `assign` returns the number the store assigned (undefined when unwired);
+ * `label` renders `#n` / `#n retry` / the short-id fallback for any task id.
+ */
+export interface TaskOrdinalSink {
+    assign(taskId: string, opts: {
+        kind: 'single' | 'group';
+        retryOf?: string;
+    }): number | undefined;
+    label(taskId: string): string;
+}
+/** P46a C3 — the desktop-local "could not apply" menu the loop asks the shell to present. */
+export interface ApplyConflictMenu {
+    taskId: string;
+    taskLabel: string;
+    conflicts: Array<{
+        path: string;
+        cause: 'session-task' | 'external' | 'write-error';
+        byTaskLabel?: string;
+    }>;
+    autoRetried: boolean;
+    retryBrief: string;
+    /** The ROOT user request (Stage 1 r3 F1) — the menu's retry carries it (web-access decision, `/status`). */
+    request: string;
+    agent: AgentKind;
+}
 export declare class QuorumLoop {
     private readonly deps;
     private readonly sleep;
     private workspaceOutcomeSink?;
-    /** The active task this desktop is driving (set at start_task). */
-    private activeTaskId;
+    /**
+     * P46a B1 — the FOCUSED single task: the task the UI means when a command
+     * names none (`/continue`, `/review-reset`, the status "starting" row).
+     * Default = the most recently CONFIRMED START; `/task focus <n>` sets it
+     * explicitly; it advances to the newest remaining single task when the
+     * focused task ends; a rejected START never moves it. It replaces the three
+     * P45 singletons (`activeTaskId` / `activeBrief` / `activeImplementorAgent`):
+     * every reader now resolves through the task's OWN record
+     * (`singleTaskContextByTask`), never through "the latest task".
+     */
+    private focusedTaskId;
+    /** P46a B1 — confirmed single tasks in START-confirmation order (focus fallback). */
+    private readonly confirmedSingleOrder;
+    /**
+     * P46a B1 — the most recent START still in flight (or null). A legacy
+     * GATE_DISPATCH with an EMPTY envelope task id can only belong to it (the P45
+     * rule); with no START in flight such a packet is a no-op left to recovery.
+     */
+    private latestInFlightStart;
+    /** Stage 1 r1 F13 — every START still in flight, in issue order; `latestInFlightStart` is its last entry. */
+    private readonly startOrderInFlight;
     /** Tasks whose next automatic revise round must start a fresh review baseline. */
     private readonly reviewScopeResetTasks;
     /** Non-terminal tasks for which `/review-reset` may arm the next revise round. */
@@ -613,16 +644,9 @@ export declare class QuorumLoop {
     private readonly epochByTaskId;
     private readonly tokensByTaskId;
     private readonly tokensCountedGates;
-    /**
-     * The implementor brief for the active task (set at start_task). The
-     * GATE_DISPATCH consumer reads this to drive the round-0 implementor spawn —
-     * the brief is no longer threaded inline through the spawn call (the spawn
-     * moved out of `startTask` into the GATE_DISPATCH consumer, §3.C.20 FIX).
-     */
-    private activeBrief;
     /**
      * IMAGE-ATTACHMENT-DESIGN.md §5 — TASK-SCOPED image attachments (parallel to
-     * `activeBrief`/`activeBriefByTask`). The single-impl path uses `activeAttachments`;
+     * `singleTaskContextByTask`/`activeBriefByTask`). The single-impl path uses `activeAttachments`;
      * the team path keys by the child `taskId` in `activeAttachmentsByTask` (armed at
      * `registerTeamTaskBrief`, before its buffered GATE_DISPATCH drains). Re-copied
      * into EACH round's shadow at `runImplementorRound` (round-0, revise, continuation,
@@ -677,20 +701,50 @@ export declare class QuorumLoop {
     private readonly recoveredBriefsByAuthority;
     private readonly activeBriefByTask;
     /**
-     * P45 D1 (M7 E2E step 8, 2026-09-14) — the brief + agent of EVERY single-
-     * implementor task this loop started, keyed by task id. `activeTaskId` /
-     * `activeBrief` / `activeImplementorAgent` are the LATEST task only: when a
-     * second single task started while the first still ran (the planner routed a
-     * mid-task turn as a task), the first task's revise round was composed from
-     * the second task's request (`buildReviseBrief` fell back to `activeBrief`)
-     * and its round-0 dispatch — whose envelope names the FIRST task — would have
-     * been mis-read as a team dispatch. Round-0 spawns, revise rounds and the
-     * continuation context resolve through this map first; the singletons stay
-     * as the legacy fallback (an empty envelope task id, the test seam). Entries
-     * are removed with the task's other per-task state at its terminal cleanup.
+     * P45 D1 (M7 E2E step 8, 2026-09-14) / P46a B1 — the brief + agent of EVERY
+     * LIVE single-implementor task this loop started, keyed by task id. P45 added
+     * it beside the three "latest task" singletons (a second single task's
+     * request had replaced the first task's in its revise round); P46a deletes
+     * the singletons — round-0 spawns, revise rounds, the continuation context and
+     * every other reader resolve ONLY through this map. An entry exists from the
+     * START call (in flight) until the task's terminal cleanup; `retryOf` links a
+     * `#n retry` task to its `apply_failed` original (P46a C2/C3).
      */
     private readonly singleTaskContextByTask;
+    /** Agent web browsing (upstream 2.0.37) — whether a task's ORIGINAL request needs web access; ends with the task (`forgetSingleTask`, team cleanup). */
     private readonly webAccessByTask;
+    /**
+     * P46a D2 — append-only per-loop-life record of every single task this loop
+     * started (confirmed or in flight) with its terminal outcome once known, for
+     * `/status` (`describeTasks`). Never deleted (bounded by the session's tasks).
+     */
+    private readonly singleTaskHistory;
+    /**
+     * P46a C1 — every single-task promote THIS session landed, by workspace-
+     * relative path: the promoting task + the post-image hash/mode the promote
+     * compare-and-set reads (`readRealMetadata`; `null` hash = a deletion). Used
+     * to attribute a later collision to a `session-task` (the path's current
+     * metadata equals a recorded post-image) or `external` (anything else —
+     * including a session-promoted file the user edited afterwards, and every
+     * promote by another session). In-memory, fail-safe: empty after a desktop
+     * restart, so every collision then classifies as `external`.
+     */
+    private readonly promotedByPath;
+    /** P46a C2 — originals whose ONE automatic retry has been issued (never a second). */
+    private readonly autoRetryIssuedFor;
+    /**
+     * P46a C2 — retry STARTs planned inside the promote critical section and
+     * issued only after it (and the durable `apply_failed` record) completed:
+     * `startTask` runs the round-0 spawn before returning, so it must never run
+     * inside `promoteShadowLocked`.
+     */
+    private readonly pendingPromoteRetries;
+    /** P46a D1 — the store-owned ordinal sink (installed by the shell after construction). */
+    private taskOrdinalSink?;
+    /** P46a C3 — the desktop-local apply-conflict menu sink (installed by the shell). */
+    private applyConflictSink?;
+    /** P46a C2 — notified when an automatic retry task started (the shell records its lifecycle row). */
+    private retryStartedSink?;
     /**
      * CP-1.f revise-context fix (dogfood task 2ac68708, 2026-06-11) — the BINDING
      * user-requested changes for a task, accumulated across ALL revise rounds.
@@ -761,8 +815,8 @@ export declare class QuorumLoop {
      *      the stdin, NEVER the task_brief the reviewers see.
      *   2. The agentic class-2 resolver brief (≤ RATIONALE_RESOLVER_MAX_BYTES,
      *      ungated — the resolver is intent-starved by design).
-     *   3. Reviewer packets, ONLY behind the DEFAULT-OFF
-     *      OQ-REVIEWER-RATIONALE flag, as a labeled UNTRUSTED claim.
+     *   3. Reviewer packets NEVER receive implementor rationale (permanent
+     *      diff-only review policy invariant).
      * Lifecycle mirrors `userNotesByTask` (promote / terminal discard / restart
      * clear; PRESERVED across the non-terminal quota-fork/takeover discards).
      */
@@ -1245,10 +1299,67 @@ export declare class QuorumLoop {
     setWorkspaceOutcomeSink(sink: WorkspaceOutcomeSink | undefined): void;
     isWorkspaceTaskTerminallyRetired(taskId: string): boolean;
     isTaskTerminallyRetired(taskId: string): boolean;
-    /** The current active task id (for the recovery poll). */
+    /**
+     * P46a B1 — the FOCUSED single task (null when no single task is live). The
+     * P45 `activeTask` name is kept for the shell's readers; it now means the
+     * focused task, never "the latest task".
+     */
     get activeTask(): string | null;
-    /** Arm an explicit, one-shot comprehensive baseline for the active task. */
-    requestReviewScopeReset(): boolean;
+    /** P46a B1 — every LIVE single task this loop started (in flight or confirmed). */
+    knownSingleTasks(): string[];
+    /**
+     * P46a B1 — `/task focus <n>`: make `taskId` the focused task. Refused (false)
+     * for a task this loop does not know as a live single task.
+     */
+    setFocusedTask(taskId: string): boolean;
+    /** P46a D1 — install the store-owned ordinal sink (the shell, after construction). */
+    setTaskOrdinalSink(sink: TaskOrdinalSink | undefined): void;
+    /** P46a C3 — install the desktop-local apply-conflict menu sink. */
+    setApplyConflictSink(sink: ((menu: ApplyConflictMenu) => void) | undefined): void;
+    /** P46a C2 — install the retry-started notifier (the shell records the lifecycle row). */
+    setRetryStartedSink(sink: ((info: {
+        taskId: string;
+        retryOf: string;
+        agent: AgentKind;
+    }) => void) | undefined): void;
+    /** P46a D1 — `#n` / `#n retry` / short id for any task id (never throws). */
+    labelFor(taskId: string): string;
+    /**
+     * P46a D2 — every single task this loop started, for `/status`: its label,
+     * agent, request (desktop-local plaintext — the user's own words), link to an
+     * `apply_failed` original, loop state and whether it is the focused task.
+     */
+    describeTasks(): Array<{
+        taskId: string;
+        label: string;
+        agent: AgentKind;
+        brief: string;
+        retryOf?: string;
+        outcome: 'running' | 'applied' | 'discarded' | 'apply_failed' | 'unresolved' | 'rejected';
+        implementorActive: boolean;
+        focused: boolean;
+    }>;
+    /** Stage 1 r1 F13 — a START confirmed or rejected: the newest START still in flight (if any) becomes the empty-envelope target. */
+    private dropInFlightStart;
+    /**
+     * P46a B1 — a single task ended (promote, terminal discard, rejected START):
+     * drop its live record and, when it was the focused task, advance the focus
+     * to the newest remaining confirmed single task (or none).
+     */
+    private forgetSingleTask;
+    /**
+     * Arm an explicit, one-shot comprehensive baseline for the FOCUSED task
+     * (P46a B1). Refused with the candidate list when the focused task has no
+     * eligible gate (or no single task is focused) — the shell renders the
+     * `#n` candidates so the user can `/task focus <n>` first.
+     */
+    requestReviewScopeReset(): {
+        armed: true;
+        taskId: string;
+    } | {
+        armed: false;
+        candidates: string[];
+    };
     /**
      * Audited-path fix (Fix 5) — the host's detected implementor agents
      * (UPPERCASE `AgentKind`), as threaded into the loop at construction. Used by
@@ -1369,6 +1480,16 @@ export declare class QuorumLoop {
         agent: AgentKind;
         /** IMAGE-ATTACHMENT-DESIGN.md §5 — task-scoped image attachments, armed before the drain. */
         attachments?: ImageAttachment[];
+        /** P46a C2/C3 — the `apply_failed` original this task retries (renders `#n retry`). */
+        retryOf?: string;
+        /**
+         * P46a C2/C3 (Stage 1 r3 F1) — the ROOT user request a retry carries. A
+         * retry's `brief` is the COMPOSED retry brief (diffs + reviewed contents that
+         * can hold any text — URLs included); decisions that must follow the user's
+         * own words (the agent-web access decision, the next retry brief, `/status`)
+         * read this instead. Omitted for an ordinary task (its brief IS the request).
+         */
+        request?: string;
     }): Promise<{
         taskId: string;
     } | null>;
@@ -1551,8 +1672,8 @@ export declare class QuorumLoop {
          * `handleReviseFeedback` so the revise implementor does not re-derive its
          * own reasoning. Appended to the STDIN payload ONLY (self-visibility) —
          * NEVER to `args.brief`, which becomes the execute-first `task_brief`
-         * rendered into the reviewer prompts (OQ-REVIEWER-RATIONALE: GA reviewers
-         * see NO rationale; the flag-gated reviewer path is separate).
+         * rendered into the reviewer prompts (OQ-REVIEWER-RATIONALE: reviewers
+         * see NO rationale — permanent diff-only review policy invariant).
          */
         priorRationale?: {
             round: number;
@@ -1821,6 +1942,27 @@ export declare class QuorumLoop {
      * half-applied tree.
      */
     promoteShadow(taskId: string): Promise<void>;
+    /** P46a C2 — start every planned automatic retry as a new linked task. */
+    private drainPromoteRetries;
+    /** P46a D2 — correct a task's recorded outcome after its terminal cleanup ran. */
+    private markTaskOutcome;
+    /**
+     * P46a C1 — classify each conflicting path: `session-task` when its current
+     * real-tree metadata equals a post-image a single-task promote of THIS
+     * session recorded (`promotedByPath`), else `external`.
+     */
+    private attributeConflicts;
+    /**
+     * P46a C2 — the retry brief: the original request, a "Files changed since
+     * your first attempt" section (a unified diff from the failed task's REVIEWED
+     * contents to the CURRENT real contents, per conflicting path, naming the
+     * session task that changed it), and the reviewed contents themselves. Every
+     * section is capped (`RETRY_BRIEF_SECTION_CAP` per path,
+     * `RETRY_BRIEF_TOTAL_CAP` overall — the brief becomes the retry task's
+     * durable `task_spec`, whose write is fire-and-forget) and secret-scrubbed
+     * (`redactSecretShapesInText`) before insertion.
+     */
+    private buildRetryBrief;
     /**
      * CP-12 W2.b (§3.C.2b (d) / H3-4) — promote-quiescence BARRIER for `taskId`.
      * Enqueues an EMPTY critical section behind any in-flight shadow lifecycle op
@@ -1951,8 +2093,7 @@ export declare class QuorumLoop {
      *     path (that defeats the moat).
      *
      * TRI-STATE (decided here, mirroring the implementor LE):
-     *   1. No engager wired OR `CODEVIBE_SANDBOX_REVIEWERS=0` opted out (the gate
-     *      DEFAULTS ON — R7 A4) → LEGACY (byte-identical non-regression). No badge.
+     *   1. No engager wired → LEGACY (byte-identical non-regression). No badge.
      *   1b. No resolvable taskId (cannot scope a per-task broker) → LEGACY + a
      *      reduced-trust badge (Stage-2 r1 Codex LOW — a trust-downgrade must be
      *      VISIBLE, never a silent ambient-cred fallback; see
@@ -1999,7 +2140,7 @@ export declare class QuorumLoop {
     private describeReviewShapeForDiagnostics;
     /**
      * Wave B §2.1 confinement TRI-STATE for a merge-gate model/reviewer invocation
-     * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (not opted out + a Trusted
+     * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (a Trusted
      * agent + engage succeeds → a handle; no ambient vendor cred in the child). Path B: a
      * trusted-container boundary (legacy spawn confined by the OUTER container — the
      * dogfood/E2E path). Path C: neither → NOT confined. A path-A engage that
@@ -2043,13 +2184,11 @@ export declare class QuorumLoop {
      *     unwired, keeping today's IMMEDIATE legacy human-gate instead of
      *     converting it into a per-slot spawn-time fail-close.
      *
-     * Deliberately DECOUPLED from `engageWaveBConfinement` and its
-     * `CODEVIBE_SANDBOX_REVIEWERS` gate (default-ON, `=0` opts out — R7 A4):
-     * that flag gates REVIEWER sandboxing (per-seat, `makeConflictModelCaller`,
-     * Tier-2) exactly as before — riding
-     * it here made the A1d resolver row unreachable on the default bare host.
-     * The ladder select is side-effect-free (no launch, no broker); test seams
-     * via `deps.resolverProbeDeps`.
+     * Deliberately DECOUPLED from `engageWaveBConfinement` reviewer sandboxing:
+     * that mechanism gates REVIEWER sandboxing (per-seat, `makeConflictModelCaller`,
+     * Tier-2) — coupling it here made the A1d resolver row unreachable on the
+     * default bare host. The ladder select is side-effect-free (no launch, no broker);
+     * test seams via `deps.resolverProbeDeps`.
      */
     private probeResolverDispatchConfinement;
     /**
@@ -2063,11 +2202,9 @@ export declare class QuorumLoop {
      *      MED): `probeResolverDispatchConfinement` wires the closure iff the
      *      DISPATCH-time engage could establish a confining substrate on this
      *      host (a real §6 Q2 ladder tier, or the preserved trusted-container
-     *      posture). Deliberately DECOUPLED from `engageWaveBConfinement`'s
-     *      `CODEVIBE_SANDBOX_REVIEWERS` gate (default-ON post-R7-A4) — that flag
-     *      gates REVIEWER
-     *      sandboxing (seat/`makeConflictModelCaller`/Tier-2, unchanged), and
-     *      riding it here made the A1d write-confined resolver row unreachable
+     *      posture). Deliberately DECOUPLED from `engageWaveBConfinement` — that
+     *      mechanism gates REVIEWER sandboxing (seat/`makeConflictModelCaller`/Tier-2),
+     *      and coupling it here made the A1d write-confined resolver row unreachable
      *      on the default bare-host path. Unwired → return `null` →
      *      `resolveAgentic` is NOT set on the context → a fresh class-2 conflict
      *      takes the legacy `caller` path (which on path C is the
@@ -2143,9 +2280,12 @@ export declare class QuorumLoop {
     private submitVerdict;
     /**
      * On WS (re)connect/startup, poll for the seats assigned to this desktop for
-     * any in_review gate of the active task and spawn any seat NEITHER already
-     * running-in-memory NOR already verdict-submitted (double-guard). Without
-     * this, a REVIEWER_DISPATCH dropped during a WS gap hangs the gate forever.
+     * any in_review gate of EVERY in-flight task (P46a B3: the live single tasks,
+     * the tasks with an active implementor, and the registered team tracks — one
+     * query each) and spawn any seat NEITHER already running-in-memory NOR already
+     * verdict-submitted (double-guard). Without this, a REVIEWER_DISPATCH dropped
+     * during a WS gap hangs the gate forever. Residual (unchanged): after a full
+     * desktop restart the in-memory maps are empty.
      */
     recoverInReviewAssignments(): Promise<void>;
     /**
@@ -2333,17 +2473,37 @@ export declare class QuorumLoop {
      */
     private reconstructRound0GateDispatch;
     private handleReviseFeedback;
-    /** The implementor agent the loop spawns (set at start_task). */
-    private activeImplementorAgent;
-    setActiveImplementorAgent(agent: AgentKind): void;
     /**
-     * #585 #C10M-9 — resolve the active task's request context for `/continue
-     * request` (the entrypoint wires this to the slash route's
-     * `getActiveRequestContext`). Returns `null` when no implementor round is
-     * active (no gate to hand off from). The `gateId`/`roundNumber` come from the
-     * ACTIVE implementor registry (the round currently running); the brief +
-     * source agent come from the loop's active state.
+     * P46a B1 — set a single task's implementor agent on ITS record (the only
+     * caller is `resumeFromContinuation`, after the user chose a target agent).
+     * Replaces the session-wide `setActiveImplementorAgent` singleton.
+     */
+    private setTaskImplementorAgent;
+    /**
+     * #585 #C10M-9 / P46a B1 (OQ-1, decided) — resolve WHICH single task a
+     * `/continue request` means: the FOCUSED task if it has an active implementor
+     * round; else the single task that has one; else refuse — `ambiguous` lists
+     * the candidates (the shell renders their `#n` so the user can
+     * `/task focus <n>` first), `none` means no task is running a round. The
+     * `gateId`/`roundNumber` come from the ACTIVE implementor registry (the round
+     * currently running); the brief + source agent from the task's own record.
      */
+    resolveContinuationRequest(): {
+        kind: 'ok';
+        ctx: {
+            taskId: string;
+            gateId: string;
+            roundNumber: number;
+            brief: string;
+            sourceAgent: AgentKind;
+        };
+    } | {
+        kind: 'ambiguous';
+        candidates: string[];
+    } | {
+        kind: 'none';
+    };
+    /** The `ok` projection of {@link resolveContinuationRequest} (null otherwise). */
     getActiveContinuationRequestContext(): {
         taskId: string;
         gateId: string;
@@ -2605,8 +2765,12 @@ export declare class QuorumLoop {
     get _runningSeatsForTests(): ReadonlySet<string>;
     /** @internal — test introspection. */
     get _submittedSeatsForTests(): ReadonlySet<string>;
-    /** @internal — test seam to set the active task without start_task. */
-    _setActiveTaskForTests(taskId: string, brief?: string): void;
+    /**
+     * @internal — test seam to register a single task (its record + focus)
+     * without start_task. P46a B1: the record is what every reader resolves, so
+     * the seam always creates one (an empty brief when none is given).
+     */
+    _setActiveTaskForTests(taskId: string, brief?: string, agent?: AgentKind, gateIds?: string[]): void;
     /** @internal — read a task's accumulated binding user notes. */
     _userNotesForTests(taskId: string): readonly string[];
     /** @internal — A1b: read a task's accumulated structured findings history. */