@quantiya/codevibe-claude-plugin 2.0.43 → 2.0.45

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/ImplementorSetupWizard.d.ts

@@ -0,0 +1,10 @@
+import * as React from 'react';
+import type { ImplementorWizardState } from '../types';
+import { type ImplementorPreference } from '../implementor-preference';
+export declare const IMPLEMENTOR_WIZARD_MAX_ROWS = 12;
+export interface ImplementorSetupWizardProps {
+    wizard: ImplementorWizardState;
+    onSubmit: (pref: ImplementorPreference) => void;
+    onCancel: () => void;
+}
+export declare function ImplementorSetupWizard(props: ImplementorSetupWizardProps): React.ReactElement;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/LiveProgressLine.d.ts

@@ -2,6 +2,10 @@ import * as React from 'react';
 import { LiveProgress } from '../types';
 export interface LiveProgressLineProps {
     progress: LiveProgress | null;
+    /** P46b §3.7 — the task's label (`#2`) when several task lines render. */
+    label?: string;
+    /** P46b §3.7 — how many more busy tasks are not shown (last line only). */
+    moreCount?: number;
     /** Test seam; otherwise derived from the live terminal width, then 80 (mirrors StatusBar). */
     columns?: number;
 }

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/OrchestrationApp.d.ts

@@ -4,6 +4,19 @@ import { ConversationEntry, PostDecisionAction, Tier } from '../types';
 import type { PlannerRuntimeKind } from '../status-format';
 import type { UpdateReviewerPolicyInput, UserReviewerPolicySnapshot } from '../../types/reviewer';
 import { type ApplyUserDecisionClient as SharedApplyUserDecisionClient, type GroupDecisionSubmitDeps } from '../gate-decision-submit';
+/**
+ * Stable empty list passed to <InputBar> to SUPPRESS slash autocomplete unless
+ * it fits (Stage-1 MEDIUM + Stage-2 — #469): the dropdown lives in the live
+ * region below the input, so an open dropdown while the live region is tall
+ * could push total output over the terminal height and re-trigger Ink's
+ * whole-scrollback reprint. P46b §3.7 — the dropdown is offered while tasks run
+ * (progress lines no longer suppress it); a pinned gate-prompt card or the
+ * reviewer wizard still does, and while it can be open we reserve
+ * DROPDOWN_MAX_ROWS plus every progress line beyond the first in the height cap
+ * (below) so it always fits. Module-scope constant → stable identity.
+ */
+/** P46b §3.7 — at most this many per-task progress lines render (`+n more` after). */
+export declare const MAX_TASK_PROGRESS_LINES = 3;
 /**
  * Minimal SDK contract for the applyUserDecision wire. Structurally
  * compatible with the full `AppSyncClient.applyUserDecision` signature

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/implementor-preference.d.ts

@@ -0,0 +1,24 @@
+export type ActiveImplementorAgentKind = 'CLAUDE' | 'CODEX' | 'ANTIGRAVITY';
+export declare const DEFAULT_IMPLEMENTOR_PRIORITY: readonly ActiveImplementorAgentKind[];
+export interface ImplementorPreference {
+    schemaVersion: 1;
+    priorityOrder: ActiveImplementorAgentKind[];
+    confirmBeforeStart: boolean;
+    updatedAt: string;
+}
+export declare function implementorPreferenceFilePath(): string;
+export declare function defaultImplementorPreference(): ImplementorPreference;
+export declare function normalizeImplementorAgent(val: string): ActiveImplementorAgentKind | null;
+/**
+ * Synchronously reads the implementor preference. Fails soft: returns defaults
+ * if the file is absent or corrupt.
+ */
+export declare function readImplementorPreferenceSync(): ImplementorPreference;
+/**
+ * Saves updated implementor preference to ~/.codevibe/implementor-preference.json.
+ */
+export declare function saveImplementorPreference(patch: {
+    priorityOrder?: ActiveImplementorAgentKind[];
+    confirmBeforeStart?: boolean;
+}): Promise<ImplementorPreference>;
+export declare function resetImplementorPreference(): Promise<ImplementorPreference>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -47,8 +47,14 @@ import type { EnsureFreshResult } from './context-store';
 import { contextItemOccurrence, type ContextDurabilityReceipt } from './context-items';
 import { renderRehydratedSessionContext } from './context-compaction';
 import type { AgentKind as LocalExecutorAgentKind } from '../local-executor/types';
+import type { OrchestrationState as OrchestrationStateType } from './types';
 import { type TaskProgressEvent } from './task-progress';
-import { taskLabel } from './task-label';
+import { type PromptReplyOrigin } from './prompt-reply-router';
+/**
+ * Gathers the implementor agents currently active across single-implementor running tasks
+ * and multi-track Agent Teams tracks. Used for multi-track priority allocation.
+ */
+export declare function getInFlightImplementorAgents(state: OrchestrationStateType): LocalExecutorAgentKind[];
 /**
  * P46a (Stage 1 r1 F2a) — the oldest unresolved continuation-offer gate
  * prompt, whatever other gates are open. Pure.
@@ -57,14 +63,37 @@ export declare function findActiveContinuationOfferEntry(conversation: ReadonlyA
     kind: 'gate-prompt';
 }) | null;
 /**
- * P46a (Stage 1 r1 F2c) — a typed digit from the phone cannot choose between
- * several open review gates (the phone shows no task label until P46b): the
- * advisory to send back instead of answering the oldest gate, or null when the
- * reply is not a bare digit or at most one gate is answerable. Pure.
+ * P46a (Stage 1 r1 F2c) / P46b §3.7 — a bare digit from the phone cannot choose
+ * between several open prompts: every prompt the phone can answer counts (gate
+ * prompts awaiting a number or a note, the retry prompt, a pending planner
+ * offer). Returns the advisory naming them, or null when the reply is not a bare
+ * digit or at most one prompt is open. Pure.
+ */
+export declare function mobileGateReplyAmbiguity(state: Pick<OrchestrationStateType, 'conversation' | 'taskOrdinals' | 'team' | 'pendingApplyConflicts' | 'pendingPlannerOffer'>, text: string): string | null;
+/**
+ * P46b §3.13 item 3 — route a reply that names or must choose among the open
+ * prompts. Returns true when the line was consumed (answered, or refused with
+ * an advisory); false sends it down today's paths (the keyboard's active
+ * prompt, slash commands, the planner).
+ *
+ *   1. While any prompt is open, `#n <rest>` / `#offer <rest>` is always
+ *      consumed, from either origin: naming an open prompt it answers it
+ *      (making a gate the active prompt), otherwise an advisory.
+ *   2. Keyboard lines without `#` → today's paths (never refused).
+ *   3. Phone lines without `#`: a bare digit with several open prompts is
+ *      refused; with one it answers it. With several prompts awaiting a note a
+ *      plain line or bare `/cancel` is refused; with exactly one it is that
+ *      prompt's note (or leaves its notes entry). Anything else → today's paths.
  */
-export declare function mobileGateReplyAmbiguity(state: Parameters<typeof taskLabel>[0] & {
-    conversation: ReadonlyArray<ConversationEntry>;
-}, text: string): string | null;
+export declare function routeOpenPromptReply(deps: {
+    store: OrchestrationStore;
+    args: RunOrchestrationShellArgs;
+    emitShellEventBound: ReturnType<typeof createShellEventEmitter>;
+    generator: StructuralSummaryGenerator;
+    gateDecisionDeps: GateDecisionSubmitDeps | null;
+    origin: PromptReplyOrigin;
+    text: string;
+}): Promise<boolean>;
 export declare class OrchestrationShellStartupError extends Error {
     readonly cause?: unknown;
     constructor(message: string, cause?: unknown);
@@ -374,6 +403,8 @@ export declare function runOrchestrationShell(args: RunOrchestrationShellArgs):
  * simply renders with no review panel (fail-open).
  */
 export declare const TASK_REVIEW_SUMMARY_FETCH_TIMEOUT_MS = 5000;
+/** P46b §3.9 — the engine's phone retry prompt kind (core-rs `apply_retry.rs`). */
+export declare const APPLY_RETRY_PROMPT_KIND = "orchestration_apply_retry";
 /**
  * Plaintext-first dispatcher per #C8M-7 (Stage 1 R1 M6 lock):
  *   1. If `event.metadata` is an object, use it directly. Otherwise try
@@ -502,18 +533,48 @@ export declare function createSubscribedEventDispatcher(deps: {
     onDurableGateResolution?: (resolution: DurableGateResolution) => Promise<void> | void;
     updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>;
 }): (event: Event) => void;
+export declare function registerTeamTrackStarts(taskGroupId: string, initialRunning: number): void;
+export declare function routeTeamShellEventToStore(store: OrchestrationStore, evt: TeamTapEvent, postLine?: (text: string) => void): void;
 /**
- * Route ONE team-mode LE shell event into the store's minimal `team` state.
- * The W2.b `emitTrackProgress` emits a NOTIFICATION carrying
- * `metadata.track_index` + `task_id` (+ `source: 'track_progress'`); the
- * `haltTaskGroup` path emits a NOTIFICATION with `source: 'task_group_halted'`.
- * We discriminate on `metadata.source` so non-team NOTIFICATIONs (planner
- * health, late-arrival audits) are IGNORED — they have no team `source` tag.
+ * CP-12 W3 — minimal `/team <json>` arg parse. Accepts a JSON `WorkItemInput[]`
+ * (≥2 items). Shallow structural validation only — the backend
+ * `validate_create_input` (#C12-2 disjointness) is authoritative; we just need
+ * a well-formed array to drive `createTaskGroup`. Polished ergonomics
+ * (file-path-set shorthand, interactive builder) are [DEFERRED → CP-8 #469].
+ */
+/**
+ * Audited-path fix (Fix 4 + Fix 5) — parse a `/task` invocation into an optional
+ * implementor-agent override + the remaining brief. Supports a LEADING `--agent
+ * codex|claude|antigravity|agy` flag (case-insensitive value, space or '=' separated); everything after it (or the
+ * whole arg list when absent) is the brief, re-joined verbatim. The override is
+ * returned even when not detected on this host — `selectImplementorAgent` decides
+ * whether to honor it (fail-closed to the default with a user-facing note).
  *
- * Pure mapping → store dispatch; no rich rendering (that is [DEFERRED → CP-8
- * #469]). Called from the `teamShellEventTap.fn` installed at startup.
+ * Tolerant: an unknown `--agent <value>` is IGNORED (the `--agent` token is dropped,
+ * the unrecognized value becomes part of the brief) rather than erroring — keeps the shortcut
+ * forgiving. When using the composite `--agent=<value>` form, the entire token including
+ * any unrecognized value is dropped so it does not pollute the brief. `--agent` with no
+ * following value is dropped (no brief consumed).
  */
-export declare function routeTeamShellEventToStore(store: OrchestrationStore, evt: TeamTapEvent): void;
+export declare function parseTaskCommand(text: string): {
+    agent: LocalExecutorAgentKind | null;
+    brief: string;
+    /** P46a B1 — `/task focus <n>` (or `#n`): the task number to focus, else null. */
+    focus: number | null;
+    /** P46a C3 (Stage 1 r1 F3) — `/task retry <n>` / `/task discard <n>`: answer the apply-conflict menu of task #n. */
+    conflictChoice: {
+        choice: 1 | 2;
+        ordinal: number;
+    } | null;
+    /**
+     * P46b §3.7 — `/task cancel <n>`: `{ ordinal }`, or `{ ordinal: null }` for a
+     * `/task cancel` without a valid number (usage). Matched before the brief
+     * fallback, so it never starts a task with the brief "cancel …".
+     */
+    cancel: {
+        ordinal: number | null;
+    } | null;
+};
 export declare function readOnlyAgentPrompt(args: {
     agent: LocalExecutorAgentKind;
     intent: AgentMentionIntent;
@@ -650,6 +711,8 @@ export declare function launchTeamFromWorkItems(deps: {
      * rewrite resolves each chip to the right ref. Retained for REJECT_RESTART reissue.
      */
     attachmentPaths?: string[];
+    /** P46b §3.10 — the failed group this launch retries (the new group is `#m retry`). */
+    retryOf?: string;
 }): Promise<LaunchTeamOutcome>;
 /**
  * PHASE-589/469 W3.2 RESIDUAL 1 — re-dispatch the WHOLE team for a
@@ -673,7 +736,9 @@ export declare function reissueTeamFromRetainedSpec(deps: {
     quorumLoop?: QuorumLoop;
     sessionId: string;
     durableStore: RevertManifestStore;
-}, taskGroupId: string): Promise<void>;
+}, taskGroupId: string, options?: {
+    retryOf?: string;
+}): Promise<void>;
 /**
  * PHASE-590 §3.D — the `team_decompose` routing path. Runs the local decomposer,
  * shape-checks (the schema is applied inside the decomposer parse) +
@@ -703,6 +768,20 @@ export declare function routeTeamDecompose(deps: {
     /** Stage-2 R3 HIGH — the loop's durable store, so the live launch persists the retained spec + attachments. */
     durableStore?: RevertManifestStore;
 }): Promise<void>;
+/**
+ * Shared helper for handling LaunchTeamOutcome for both unconfirmed (auto-launch)
+ * and confirmed ("yes" reply) team launches. Ensures parity across both paths:
+ * - 'accepted' -> clean return (success advisory already dispatched by launchTeamFromWorkItems)
+ * - 'disjointness_rejected' -> dispatch advisory, call fallbackToSingle (if provided)
+ * - 'unknown_create_error' -> retry ONCE with same idempotency key; if second attempt
+ *   is disjointness_rejected -> fallbackToSingle; if second attempt is unknown_create_error ->
+ *   dispatch "Couldn't confirm the team started — check /status or retry. Nothing was launched."
+ */
+export declare function handleTeamLaunchOutcome(deps: {
+    launch: () => Promise<LaunchTeamOutcome>;
+    store: OrchestrationStore;
+    fallbackToSingle?: () => Promise<void>;
+}): Promise<void>;
 /** Test seam — reset the module-level A1e and M7 composers (vitest-gated). */
 export declare function resetDispatchContextComposerForTests(): void;
 /** Test seam — install the M7 decomposer user-context composer (vitest-gated). */

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/non-tty-fallback.d.ts

@@ -38,9 +38,8 @@ export interface RunLineLogFallbackArgs {
 /**
  * Whether the internal planner-classification entry (`[planner] <action>:
  * <rationale>` / the TTY "Planner classified …" node) is shown to the user.
- * OFF by default — it's internal mechanics that duplicate the actual response /
- * clarification the user already sees, and leaks taxonomy jargon ("classify").
- * Opt in with `CODEVIBE_PLANNER_DEBUG=1` when debugging the planner. The entry is
+ * OFF by default — it's internal mechanics that duplicate the actual response.
+ * Standardized to log level `CODEVIBE_LOG_LEVEL=debug`. The entry is
  * ALWAYS kept in conversation state (audit / logic / tests) — only the VIEW is gated.
  */
 export declare function plannerDecisionRenderEnabled(env?: NodeJS.ProcessEnv): boolean;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/prompt-reply-router.d.ts

@@ -0,0 +1,53 @@
+import type { ConversationEntry, OrchestrationState, PendingApplyConflict, PendingPlannerOffer } from './types';
+export type PromptReplyOrigin = 'keyboard' | 'mobile';
+type GatePromptEntry = Extract<ConversationEntry, {
+    kind: 'gate-prompt';
+}>;
+export type OpenPrompt = {
+    kind: 'gate';
+    /** `#3`, `#5.2`, or the short-id fallback of an unnumbered task. */
+    label: string;
+    entry: GatePromptEntry;
+    awaiting: 'number' | 'note';
+    optionCount: number;
+} | {
+    kind: 'apply';
+    label: string;
+    menu: PendingApplyConflict;
+    awaiting: 'number';
+    optionCount: 2;
+} | {
+    kind: 'offer';
+    label: 'offer';
+    offer: PendingPlannerOffer;
+    awaiting: 'number';
+    optionCount: number;
+};
+/** The reference a reply uses for `prompt`: `3`, `5.2` or `offer`. */
+export declare function promptReference(prompt: OpenPrompt): string;
+/** How advisories name `prompt`: `Task #3`, `Task #5.2`, `#offer`. */
+export declare function promptName(prompt: OpenPrompt): string;
+/** Every open prompt in presentation order (gates, then menus, then the offer). */
+export declare function listOpenPrompts(state: Pick<OrchestrationState, 'conversation' | 'taskOrdinals' | 'team' | 'pendingApplyConflicts' | 'pendingPlannerOffer'>, origin: PromptReplyOrigin): OpenPrompt[];
+/**
+ * `#2 1` → `{ reference: '2', rest: '1' }`; `#5.2 note text` → `{ '5.2', 'note text' }`;
+ * `#offer 3` → `{ 'offer', '3' }`; a bare `#2` → rest `''`. Null when the line
+ * does not start with a reference followed by whitespace or the end.
+ */
+export declare function parsePromptReference(text: string): {
+    reference: string;
+    rest: string;
+} | null;
+/** The open prompt a reference names, or null. */
+export declare function findPromptByReference(open: ReadonlyArray<OpenPrompt>, reference: string): OpenPrompt | null;
+/** §3.7 — a bare digit from the phone while several prompts are open. */
+export declare function severalPromptsAdvisory(open: ReadonlyArray<OpenPrompt>): string;
+/** §3.13 item 3.3.2 — a plain phone line while several prompts await a note. */
+export declare function severalNotesAdvisory(notes: ReadonlyArray<OpenPrompt>): string;
+/** §3.13 item 3.1 — a `#n` reply the named prompt cannot take. */
+export declare function expectedReplyAdvisory(prompt: OpenPrompt): string;
+/** §3.13 item 3.1 — a `#n` reply naming no open prompt. */
+export declare function noOpenPromptAdvisory(reference: string): string;
+/** §3.13 item 3 — the phone hint when a numbered answer opens a gate's notes entry. */
+export declare function notesHint(prompt: OpenPrompt): string;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/quorum-loop.d.ts

@@ -1,7 +1,7 @@
 import type { AppSyncClient, TeamTrackRecoveryRow } from '../appsync/appsync-client';
 import type { Session } from '../types';
 import type { LocalExecutor } from '../local-executor';
-import type { ClassBInbound } from '../local-executor/types';
+import type { ClassBInbound, QueuedWorkEndedPayload } from '../local-executor/types';
 import type { ImageAttachment } from './types';
 import { type TaskAuditSummaryModel, type ReviewHistorySnapshot, type UserDecisionRecord } from './audit-summary';
 import type { DecryptedReviewSummaryInput } from './gate-prompts';
@@ -103,17 +103,18 @@ export declare function policyRejectionAdvisoryText(info: {
  *   - An explicit `override` (from `/task --agent claude|codex|antigravity`) wins, BUT only
  *     when that agent was actually detected on this host (else fail-closed to the
  *     default — we never spawn a binary the host doesn't have).
- *   - Otherwise: CLAUDE when it is among the detected agents (the documented
- *     default), else the FIRST detected agent, else CLAUDE as the universal
- *     fail-safe (matches the engine's Claude-only fallback when the host detected
- *     nothing). The implementor argv allowlist already covers all three agents,
- *     so any returned kind is spawnable without widening it.
+ *   - Configurable implementor priority order via ~/.codevibe/implementor-preference.json
+ *     (defaults to CLAUDE > CODEX > ANTIGRAVITY).
+ *   - Multi-track priority allocation: when concurrent tracks run, allocates each track
+ *     to the next idle agent in priority order. For hosts with a single installed agent,
+ *     all tracks allocate to that agent.
+ *   - Explicit override (@mention or --agent flag) always takes precedence if installed.
  *
  * Returns `{ agent, note }` — `note` is a non-null user-facing string ONLY when
  * an explicit override could not be honored (so the shell can surface it); null
  * when the selection was clean. NEVER throws.
  */
-export declare function selectImplementorAgent(detected: readonly AgentKind[], override?: AgentKind | null): {
+export declare function selectImplementorAgent(detected: readonly AgentKind[], override?: AgentKind | null, inFlightAgents?: readonly AgentKind[] | null, priorityOrder?: readonly AgentKind[] | null): {
     agent: AgentKind;
     note: string | null;
 };
@@ -320,9 +321,8 @@ export interface QuorumLoopDeps {
     /**
      * CP-14 Wave A — the team execution model. `worktree_merge` makes each team
      * track commit to a persistent branch (the merge-before-push spine) instead of
-     * the merge-train promote (the only model since the §10 retirement). Omitted keeps the
-     * shipped path byte-identical. Resolved from `CODEVIBE_TEAM_EXECUTION` when
-     * unset (see {@link resolveTeamExecution}).
+     * the merge-train promote (the sole model since the §10 retirement). Omitted keeps the
+     * shipped path byte-identical (see {@link resolveTeamExecution}).
      */
     teamExecution?: TeamExecution;
     /**
@@ -332,11 +332,8 @@ export interface QuorumLoopDeps {
      * agent reviewer runs INSIDE the sandbox with no ambient vendor creds and a
      * broker-routed model call — closing the CP-14 §8/§13 reviewer-sandbox gap.
      * ABSENT (legacy / companion / tests) → reviewers take the legacy unsandboxed
-     * path BYTE-IDENTICAL (§7 non-regression). Reviewer-sandboxing DEFAULTS ON
-     * when this engager is wired (R7 A4), with an operator opt-out env flag
-     * (`CODEVIBE_SANDBOX_REVIEWERS=0`, read in `engageSeatSubstrate` on the
-     * `spawnOneSeat` path — see `reviewerSandboxingEnabled`). The flag is
-     * independent of implementor sandboxing (which has its own engager).
+     * path BYTE-IDENTICAL (§7 non-regression). Reviewer-sandboxing is mandatory
+     * when this engager is wired (see `reviewerSandboxingEnabled`).
      */
     engageReviewerSubstrate?: ReviewerSubstrateEngager;
     /**
@@ -599,6 +596,51 @@ export interface TaskOrdinalSink {
     }): number | undefined;
     label(taskId: string): string;
 }
+/**
+ * P46a D2 / P46b §3.7 — a single task's recorded state for `/status`. `queued`
+ * waits for a running-track slot; `cancelled` ended before it started
+ * (`QUEUED_WORK_ENDED`, or a `cancelled` START replay); `already_finished` is a
+ * START replay of work that already ended.
+ */
+export type SingleTaskOutcome = 'running' | 'queued' | 'applied' | 'discarded' | 'apply_failed' | 'unresolved' | 'rejected' | 'cancelled' | 'already_finished';
+/** P46b §3.3 — what a confirmed START did. */
+export interface StartTaskResultInfo {
+    taskId: string;
+    outcome: 'running' | 'queued' | 'already_finished' | 'cancelled';
+    /** Present when queued: 1-based position in the account's queue. */
+    queuePosition?: number;
+    runningTracks?: number;
+    trackBudget?: number;
+}
+/**
+ * P46b §3.13 item 1 — a single task's lifecycle change the shell turns into a
+ * store update and a phone line: queued at START, started (immediately or when
+ * a slot freed), or cancelled before it started.
+ */
+export type TaskLifecycleEvent = {
+    kind: 'queued';
+    taskId: string;
+    agent: AgentKind;
+    queuePosition?: number;
+    runningTracks?: number;
+    trackBudget?: number;
+} | {
+    kind: 'started';
+    taskId: string;
+    agent: AgentKind;
+    fromQueue: boolean;
+    retryOf?: string;
+} | {
+    kind: 'cancelled';
+    taskId: string;
+    reason: string;
+};
+/** P46b §3.6 — the desktop's slot-lease capability sent on every START. */
+export declare const SLOT_LEASE_PROTOCOL = 1;
+/** P46b §3.6 — one task lease heartbeat per held task every 2 minutes (the engine lease is 600 s). */
+export declare const TASK_LEASE_HEARTBEAT_INTERVAL_MS: number;
+/** P46b §3.3 — map the START answer's state label onto what the START did. */
+export declare function startOutcomeFor(workflowState: string): StartTaskResultInfo['outcome'];
 /** P46a C3 — the desktop-local "could not apply" menu the loop asks the shell to present. */
 export interface ApplyConflictMenu {
     taskId: string;
@@ -609,6 +651,14 @@ export interface ApplyConflictMenu {
         byTaskLabel?: string;
     }>;
     autoRetried: boolean;
+    /** P46b §3.10 — `group` for a team promote (`taskId` is the taskGroupId). */
+    kind?: 'single' | 'group';
+    /** P46b §3.9 — counts only, per cause (the retry prompt's content). */
+    counts?: {
+        sessionTask: number;
+        external: number;
+        writeErrors: number;
+    };
     retryBrief: string;
     /** The ROOT user request (Stage 1 r3 F1) — the menu's retry carries it (web-access decision, `/status`). */
     request: string;
@@ -639,6 +689,19 @@ export declare class QuorumLoop {
     private latestInFlightStart;
     /** Stage 1 r1 F13 — every START still in flight, in issue order; `latestInFlightStart` is its last entry. */
     private readonly startOrderInFlight;
+    /**
+     * P46b §3.7 — a queued task's START answer (position, running tracks, budget)
+     * and, once it ended before starting, the reason. Kept for `/status`.
+     */
+    private readonly queueInfoByTask;
+    /** P46b §3.7 — single tasks whose implementor has been spawned at least once (`starting` ends). */
+    private readonly spawnedSingleTasks;
+    /** P46b §3.13 item 1 — the shell's lifecycle sink (store update + phone line). */
+    private taskLifecycleSink?;
+    /** P46b §3.6 — the one per-session task lease heartbeat timer (null while stopped). */
+    private taskLeaseHeartbeatTimer;
+    /** P46b §3.6 — tasks whose heartbeat request is still in flight (one at a time per task). */
+    private readonly taskLeaseHeartbeatsInFlight;
     /** Tasks whose next automatic revise round must start a fresh review baseline. */
     private readonly reviewScopeResetTasks;
     /** Non-terminal tasks for which `/review-reset` may arm the next revise round. */
@@ -818,8 +881,8 @@ export declare class QuorumLoop {
      *      the stdin, NEVER the task_brief the reviewers see.
      *   2. The agentic class-2 resolver brief (≤ RATIONALE_RESOLVER_MAX_BYTES,
      *      ungated — the resolver is intent-starved by design).
-     *   3. Reviewer packets, ONLY behind the DEFAULT-OFF
-     *      OQ-REVIEWER-RATIONALE flag, as a labeled UNTRUSTED claim.
+     *   3. Reviewer packets NEVER receive implementor rationale (permanent
+     *      diff-only review policy invariant).
      * Lifecycle mirrors `userNotesByTask` (promote / terminal discard / restart
      * clear; PRESERVED across the non-terminal quota-fork/takeover discards).
      */
@@ -1120,8 +1183,22 @@ export declare class QuorumLoop {
      */
     private recoverySeedingDepth;
     /**
-     * Recovery B.1 and B.2 can overlap. A per-call two-row batch is therefore
-     * insufficient: two concurrent calls could each launch two implementors.
+     * P46b (E2E T-3) — how many barrier holders are in their PASS-2 relaunch (each
+     * counted within `recoverySeedingDepth`), and the tracks they relaunch
+     * (refcounted task ids and brief slots). While EVERY holder is relaunching (none
+     * is still querying, seeding briefs or binding a `/team` create), only packets
+     * for a relaunched track keep buffering — the relaunch-before-drain dedup order
+     * is unchanged for them. A packet for any other track (a queued track promoted
+     * meanwhile, whose brief PASS 1 already seeded) is consumed live instead of
+     * waiting for every relaunched implementor round to finish, which can outlast
+     * its 15-minute lease.
+     */
+    private recoveryRelaunchPhaseDepth;
+    private readonly recoveryRelaunchTaskIds;
+    private readonly recoveryRelaunchSlots;
+    /**
+     * Recovery B.1 and B.2 can overlap. A per-call batch is therefore
+     * insufficient: two concurrent calls could each launch a full batch.
      * These permits are owned by the QuorumLoop/session and cover the complete
      * `launchRecoveredTrack` operation across every recovery entry path.
      */
@@ -1325,6 +1402,43 @@ export declare class QuorumLoop {
         retryOf: string;
         agent: AgentKind;
     }) => void) | undefined): void;
+    /**
+     * P46b §3.10 — a team promote could not be applied (the team promote has no
+     * per-path session attribution, so every changed path is `external`). A team
+     * gets no automatic retry: it always offers the menu (retry reissues the
+     * whole team from its retained launch spec).
+     */
+    reportTeamApplyConflict(info: {
+        taskGroupId: string;
+        conflicts: readonly string[];
+        writeErrors: readonly string[];
+    }): void;
+    /** P46b §3.13 item 1 — install the task lifecycle sink (the shell). */
+    setTaskLifecycleSink(sink: ((event: TaskLifecycleEvent) => void) | undefined): void;
+    /** P46b — notify the lifecycle sink; a throwing sink never breaks the loop. */
+    private emitTaskLifecycle;
+    /**
+     * P46b §3.6 — the first change of a queued task to `cancelled (reason)`. Shared
+     * by the `QUEUED_WORK_ENDED` packet, the `/status` catch-up and a `cancelled`
+     * answer to `/task cancel`, so whichever arrives first acts and the others do
+     * nothing. Returns true only on that first change.
+     */
+    markQueuedTaskCancelled(taskId: string, reason: string): boolean;
+    /** P46b §3.6 — the `QUEUED_WORK_ENDED` Class-B packet. */
+    private handleQueuedWorkEnded;
+    /** P46b §3.6 — start the per-session task lease heartbeat (idempotent). */
+    private ensureTaskLeaseHeartbeat;
+    /** P46b §3.6 — stop the task lease heartbeat (terminal: shutdown or no task left). */
+    private stopTaskLeaseHeartbeat;
+    /**
+     * P46b §3.6 — one heartbeat for every single task this desktop holds in the
+     * implement–review loop (queued, starting, implementing, in review, awaiting
+     * you): `recordExecutionEvent(PROGRESS_EVENT, {kind: TASK_LEASE_HEARTBEAT,
+     * taskId})`, which RENEWs the task's slot lease. A START still in flight is
+     * skipped (its holder may not exist yet); a beat still in flight is not
+     * doubled. Work this desktop no longer knows stops renewing and lapses.
+     */
+    sendTaskLeaseHeartbeats(): Promise<void>;
     /** P46a D1 — `#n` / `#n retry` / short id for any task id (never throws). */
     labelFor(taskId: string): string;
     /**
@@ -1338,9 +1452,15 @@ export declare class QuorumLoop {
         agent: AgentKind;
         brief: string;
         retryOf?: string;
-        outcome: 'running' | 'applied' | 'discarded' | 'apply_failed' | 'unresolved' | 'rejected';
+        outcome: SingleTaskOutcome;
         implementorActive: boolean;
         focused: boolean;
+        /** P46b §3.7 — START confirmed or dispatched, implementor not spawned yet. */
+        starting?: boolean;
+        /** P46b §3.7 — queue position from the START answer (queued tasks). */
+        queuePosition?: number;
+        /** P46b §3.6 — why a queued task ended before it started. */
+        cancelReason?: string;
     }>;
     /** Stage 1 r1 F13 — a START confirmed or rejected: the newest START still in flight (if any) becomes the empty-envelope target. */
     private dropInFlightStart;
@@ -1444,6 +1564,7 @@ export declare class QuorumLoop {
         gateDispatch: (payload: GateDispatchPayload, envelopeTaskId?: string) => Promise<void>;
         spawnReviewers: (payload: ReviewerDispatchPayload) => Promise<void>;
         runReviseRound: (payload: ReviseFeedbackPayload) => Promise<void>;
+        queuedWorkEnded: (payload: QueuedWorkEndedPayload) => Promise<void>;
     };
     private cachedSigningKey;
     private verifySignature;
@@ -1493,9 +1614,7 @@ export declare class QuorumLoop {
          * read this instead. Omitted for an ordinary task (its brief IS the request).
          */
         request?: string;
-    }): Promise<{
-        taskId: string;
-    } | null>;
+    }): Promise<StartTaskResultInfo | null>;
     /**
      * CP-1.f Wave 3 FIX — consume a GATE_DISPATCH packet. The engine emits this
      * after `startTask` creates the round-0 `reviewer_quorum` gate; its
@@ -1675,8 +1794,8 @@ export declare class QuorumLoop {
          * `handleReviseFeedback` so the revise implementor does not re-derive its
          * own reasoning. Appended to the STDIN payload ONLY (self-visibility) —
          * NEVER to `args.brief`, which becomes the execute-first `task_brief`
-         * rendered into the reviewer prompts (OQ-REVIEWER-RATIONALE: GA reviewers
-         * see NO rationale; the flag-gated reviewer path is separate).
+         * rendered into the reviewer prompts (OQ-REVIEWER-RATIONALE: reviewers
+         * see NO rationale — permanent diff-only review policy invariant).
          */
         priorRationale?: {
             round: number;
@@ -2096,8 +2215,7 @@ export declare class QuorumLoop {
      *     path (that defeats the moat).
      *
      * TRI-STATE (decided here, mirroring the implementor LE):
-     *   1. No engager wired OR `CODEVIBE_SANDBOX_REVIEWERS=0` opted out (the gate
-     *      DEFAULTS ON — R7 A4) → LEGACY (byte-identical non-regression). No badge.
+     *   1. No engager wired → LEGACY (byte-identical non-regression). No badge.
      *   1b. No resolvable taskId (cannot scope a per-task broker) → LEGACY + a
      *      reduced-trust badge (Stage-2 r1 Codex LOW — a trust-downgrade must be
      *      VISIBLE, never a silent ambient-cred fallback; see
@@ -2144,7 +2262,7 @@ export declare class QuorumLoop {
     private describeReviewShapeForDiagnostics;
     /**
      * Wave B §2.1 confinement TRI-STATE for a merge-gate model/reviewer invocation
-     * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (not opted out + a Trusted
+     * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (a Trusted
      * agent + engage succeeds → a handle; no ambient vendor cred in the child). Path B: a
      * trusted-container boundary (legacy spawn confined by the OUTER container — the
      * dogfood/E2E path). Path C: neither → NOT confined. A path-A engage that
@@ -2188,13 +2306,11 @@ export declare class QuorumLoop {
      *     unwired, keeping today's IMMEDIATE legacy human-gate instead of
      *     converting it into a per-slot spawn-time fail-close.
      *
-     * Deliberately DECOUPLED from `engageWaveBConfinement` and its
-     * `CODEVIBE_SANDBOX_REVIEWERS` gate (default-ON, `=0` opts out — R7 A4):
-     * that flag gates REVIEWER sandboxing (per-seat, `makeConflictModelCaller`,
-     * Tier-2) exactly as before — riding
-     * it here made the A1d resolver row unreachable on the default bare host.
-     * The ladder select is side-effect-free (no launch, no broker); test seams
-     * via `deps.resolverProbeDeps`.
+     * Deliberately DECOUPLED from `engageWaveBConfinement` reviewer sandboxing:
+     * that mechanism gates REVIEWER sandboxing (per-seat, `makeConflictModelCaller`,
+     * Tier-2) — coupling it here made the A1d resolver row unreachable on the
+     * default bare host. The ladder select is side-effect-free (no launch, no broker);
+     * test seams via `deps.resolverProbeDeps`.
      */
     private probeResolverDispatchConfinement;
     /**
@@ -2208,11 +2324,9 @@ export declare class QuorumLoop {
      *      MED): `probeResolverDispatchConfinement` wires the closure iff the
      *      DISPATCH-time engage could establish a confining substrate on this
      *      host (a real §6 Q2 ladder tier, or the preserved trusted-container
-     *      posture). Deliberately DECOUPLED from `engageWaveBConfinement`'s
-     *      `CODEVIBE_SANDBOX_REVIEWERS` gate (default-ON post-R7-A4) — that flag
-     *      gates REVIEWER
-     *      sandboxing (seat/`makeConflictModelCaller`/Tier-2, unchanged), and
-     *      riding it here made the A1d write-confined resolver row unreachable
+     *      posture). Deliberately DECOUPLED from `engageWaveBConfinement` — that
+     *      mechanism gates REVIEWER sandboxing (seat/`makeConflictModelCaller`/Tier-2),
+     *      and coupling it here made the A1d write-confined resolver row unreachable
      *      on the default bare-host path. Unwired → return `null` →
      *      `resolveAgentic` is NOT set on the context → a fresh class-2 conflict
      *      takes the legacy `caller` path (which on path C is the
@@ -2374,6 +2488,15 @@ export declare class QuorumLoop {
      * here; single-impl / non-team packets bypass this entirely.
      */
     bufferTeamPacketDuringSeeding(kind: 'trackAssigned' | 'gateDispatch', payload: unknown, envelopeTaskId?: string): boolean;
+    /**
+     * P46b (E2E T-3) — whether a live team packet belongs to a track a recovery is
+     * relaunching right now. A packet that names no track this can match (no
+     * envelope task id and no TrackAssigned ids) counts as one, so it keeps
+     * buffering exactly as before.
+     */
+    private isRecoveryRelaunchPacket;
+    private enterRecoveryRelaunchPhase;
+    private leaveRecoveryRelaunchPhase;
     /**
      * §4.3 — drain the buffered live TEAM packets through the normal live handlers
      * AFTER the recovery seed barrier lifts (`recoverySeedingDepth === 0`). Each