@quantiya/codevibe-codex-plugin 2.0.63 → 2.0.65

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/OrchestrationApp.d.ts

@@ -4,6 +4,8 @@ import { ConversationEntry, PostDecisionAction, Tier } from '../types';
 import type { PlannerRuntimeKind } from '../status-format';
 import type { UpdateReviewerPolicyInput, UserReviewerPolicySnapshot } from '../../types/reviewer';
 import { type ApplyUserDecisionClient as SharedApplyUserDecisionClient, type GroupDecisionSubmitDeps } from '../gate-decision-submit';
+import { type CompanionSyncStateSource } from '../../appsync/sync-state';
+import { type CompanionSyncWarningStore } from '../../appsync/sync-usage-warning';
 /** P46b §3.7 — at most this many per-task progress lines render (`+n more` after). */
 export declare const MAX_TASK_PROGRESS_LINES = 3;
 /**
@@ -70,6 +72,10 @@ export interface OrchestrationAppProps {
      * runtime.
      */
     appsyncClient: ApplyUserDecisionClient;
+    /** Display-only cloud status feed; production shell always wires its client. */
+    companionSyncStateSource?: CompanionSyncStateSource;
+    /** Local-only once-per-period advisory; never inserted into conversation sync. */
+    companionSyncWarningStore?: CompanionSyncWarningStore;
     /**
      * Session-key resolver invoked just-in-time when a gate-prompt submit
      * includes notes. Returns the base64 session key for the caller's

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/components/StatusBar.d.ts

@@ -14,6 +14,8 @@ export interface StatusBarProps {
     plannerRuntimeKind: PlannerRuntimeKind;
     /** Display label for the local model (e.g. `gemma4`). */
     plannerLabel: string;
+    /** Closed display label from validated cloud status, never a local gate. */
+    companionSyncBadge?: string | null;
     /** Test seam — overrides the terminal width used for cwd truncation. */
     columns?: number;
 }

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/decision-attempt-recovery.d.ts

@@ -10,6 +10,7 @@ export interface DecisionAttemptRecoveryClient {
     getGateResolution(input: {
         sessionId: string;
         promptId: string;
+        sessionGenerationId?: string;
     }): Promise<unknown>;
     submitGateDecisionV2?(request: Extract<DecisionAttemptReceipt['request'], {
         promptKind: 'GATE';
@@ -63,6 +64,7 @@ export declare function createDurableResolutionAttemptHandoff(args: {
  */
 export declare function recoverDecisionAttemptReceipts(args: {
     sessionId: string;
+    sessionGenerationId?: string;
     client: DecisionAttemptRecoveryClient;
     store?: DecisionAttemptReceiptStore;
     onResolutionEvent: (event: Event) => Promise<DurableGateResolution | null> | DurableGateResolution | null;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/emit-shell-event.d.ts

@@ -1,6 +1,9 @@
 import { AppSyncClient } from '../appsync';
 import { CreateEventInput, type Session } from '../types';
 import type { E1ProducerKind } from '../e1';
+import type { PromptPublicationJournal } from '../appsync/sync-prompt-publication';
+import type { ShellSyncSource } from '../appsync/sync-shell-source';
+import type { ToolActivitySyncEncryption } from '../tool-activity/sync-transport';
 /**
  * §3 LOCK lines 173-181. Names + per-type metadata shapes are part of
  * the Stage A contract. CP-1.a ships the union; CP-1.b/c/d add call
@@ -53,6 +56,8 @@ export interface ShellEventEmit {
     promptId?: string;
     producerKind?: E1ProducerKind;
     mobileActionable?: boolean;
+    /** Local-only identity of one durably recorded canonical prompt absence. */
+    syncReRaiseToken?: string;
     resolvedPromptId?: string;
     resolutionAt?: string;
 }
@@ -65,6 +70,13 @@ export interface EmitShellEventDeps {
     appsyncClient: Pick<AppSyncClient, 'createEvent'>;
     getSessionKey: (sessionId: string) => Promise<string | null>;
     session?: Session;
+    /** Cloud-selected source path. Prompt raises use their own durable episode,
+     * not ordinary append semantics; resolution/outcome writers remain separate. */
+    sync?: {
+        source: ShellSyncSource;
+        context: ToolActivitySyncEncryption;
+        promptPublication?: PromptPublicationJournal;
+    };
     /**
      * Persist an exact encrypted/signed input without sending it. Reserved for
      * crash-safe workspace-outcome drafts that must remain undiscoverable until
@@ -73,6 +85,16 @@ export interface EmitShellEventDeps {
     prepareOnly?: (input: CreateEventInput) => Promise<void>;
 }
 export type ShellEventEmitResult = {
+    emitted: true;
+    controlClass: 'PROMPT_OWNERSHIP';
+    promptId: string;
+    state: 'RESOLVED';
+    sessionId: string;
+    type: 'NOTIFICATION';
+    source: 'DESKTOP';
+    eventId?: never;
+    writer?: never;
+} | {
     emitted: true;
     eventId: string;
     sessionId: string;
@@ -86,7 +108,7 @@ export type ShellEventEmitResult = {
     };
 } | {
     emitted: false;
-    reason: 'missing_session_key' | 'auth_required' | 'auth_unavailable' | 'create_failed' | 'definitive_rejection' | 'invalid_response' | 'prepared_only' | 'writer_ineligible';
+    reason: 'missing_session_key' | 'auth_required' | 'auth_unavailable' | 'create_failed' | 'definitive_rejection' | 'invalid_response' | 'prepared_only' | 'sync_quota_exhausted' | 'sync_already_settled' | 'sync_pending' | 'sync_unavailable' | 'writer_ineligible';
     error?: unknown;
 };
 /**
@@ -103,10 +125,11 @@ export type ShellEventEmitResult = {
  * codevibe-core (each plugin instantiates its own `AppSyncClient`).
  */
 export declare function emitShellEvent(args: ShellEventEmit, deps: EmitShellEventDeps): Promise<ShellEventEmitResult>;
-/**
- * Convenience helper for production callers — binds default
- * dependencies (`keychainManager` for session-key lookup) and accepts
- * the AppSync client separately because there's no global default in
- * `codevibe-core`.
- */
-export declare function createShellEventEmitter(appsyncClient: Pick<AppSyncClient, 'createEvent'>, session?: Session): (args: ShellEventEmit) => Promise<ShellEventEmitResult>;
+/** Sync quota/delivery is not authority to disable the local desktop. These
+ * results are explicit, never masquerading as a successful cloud Event. */
+export declare function isNonBlockingShellSyncResult(result: ShellEventEmitResult): boolean;
+/** Join every shell/CLI/team emitter sharing this exact client + session before
+ * terminal source cleanup. Old closures retain their closed owner; other
+ * sessions and clients are untouched. No timer or process is created here. */
+export declare function closeShellEventEmitters(client: object, sessionId: string): Promise<void>;
+export declare function createShellEventEmitter(appsyncClient: Pick<AppSyncClient, 'createEvent' | 'selectCompanionSourceTransport' | 'recoverShellSyncSources' | 'resolveCoreOfferPrompt'>, session?: Session): (args: ShellEventEmit) => Promise<ShellEventEmitResult>;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/gate-prompts.d.ts

@@ -452,6 +452,8 @@ export interface ReviewSummaryTerminalModel {
         }>;
         readonly roundCount: number;
         readonly revisionCount: number;
+        readonly approvalRule?: string;
+        readonly autoRevisionLimit?: number;
     };
     readonly mergeGate: {
         readonly applicable: boolean;
@@ -530,6 +532,8 @@ export interface DecryptedReviewSummaryInput {
         }>;
         readonly roundCount?: number;
         readonly revisionCount?: number;
+        readonly approvalRule?: string;
+        readonly autoRevisionLimit?: number;
     };
     readonly mergeGate?: {
         readonly applicable?: boolean;

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/index.d.ts

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { AppSyncClient } from '../appsync';
+import type { MobileInputStatusUpdater } from '../appsync';
 import { Session } from '../types';
 import { OrchestrationStore } from './store';
 import { type RetainedBrowsePage } from './route-browse';
@@ -33,7 +34,7 @@ import { type RunFlagCommandResult } from './flag-command';
 import { Tier } from './types';
 import type { ConversationEntry, DurableGateResolution, PendingApplyConflict, PendingClarification } from './types';
 import { type GatePromptEnvelope, type DecryptedReviewSummaryInput } from './gate-prompts';
-import type { Event, UpdateEventStatusInput } from '../types/events';
+import type { Event } from '../types/events';
 import { type StructuralSummaryGenerator } from '../structural-summary';
 import type { PlannerAdapter } from '../planner/adapter';
 import type { PlannerCacheLayer } from '../planner/cache';
@@ -491,10 +492,10 @@ export declare function handleSubscribedEvent(event: Event, store: Orchestration
  * The mobile `USER_PROMPT` content is E2E-encrypted (`isEncrypted:true`); decrypt it
  * with the session key (the SAME resolver the non-gate prompt path uses) before
  * submitting. Fail-soft: a missing resolver/key, a decrypt failure, or empty text logs
- * and DROPS (never crashes the shell, never submits ciphertext). Async — the sync
- * subscription callback fires-and-forgets via `void`; every throw is caught here.
+ * and drops (never submits ciphertext). Legacy routing is fire-and-forget.
+ * R2 routing is awaited by the durable inbox; pre-handoff failure stays visible.
  */
-export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver: ((sessionId: string) => Promise<string | null>) | undefined, submit: (text: string, images?: string[], options?: ShellSubmitOptions) => Promise<void>, updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>): Promise<boolean>;
+export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver: ((sessionId: string) => Promise<string | null>) | undefined, submit: (text: string, images?: string[], options?: ShellSubmitOptions) => Promise<void>, updateEventStatus?: MobileInputStatusUpdater): Promise<boolean>;
 /**
  * Route a mobile composer reply through the desktop's canonical gate state
  * machine. Mobile always transports the text as an encrypted `USER_PROMPT`;
@@ -507,7 +508,7 @@ export declare function routeMobileUserPrompt(event: Event, sessionKeyResolver:
  */
 export declare function routeMobileGatePromptInput(deps: GateDecisionSubmitDeps, text: string): Promise<boolean>;
 /**
- * Build the single `(event) => void` callback the AppSync events subscription
+ * Build the single callback the AppSync events subscription
  * invokes. Routes each delivered event to exactly ONE handler:
  *
  *   - MOBILE-source `USER_PROMPT` → `routeMobileUserPrompt` (the mobile→desktop RETURN
@@ -534,8 +535,8 @@ export declare function createSubscribedEventDispatcher(deps: {
     reviewSummaryFetcher?: ReviewSummaryFetcher;
     maybeAutoContinue?: (envelope: GatePromptEnvelope) => boolean;
     onDurableGateResolution?: (resolution: DurableGateResolution) => Promise<void> | void;
-    updateEventStatus?: (input: UpdateEventStatusInput) => Promise<unknown>;
-}): (event: Event) => void;
+    updateEventStatus?: MobileInputStatusUpdater;
+}): (event: Event) => void | Promise<void>;
 export declare function registerTeamTrackStarts(taskGroupId: string, initialRunning: number): void;
 export declare function routeTeamShellEventToStore(store: OrchestrationStore, evt: TeamTapEvent, postLine?: (text: string) => void): void;
 /**

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/planner-offer-e1.d.ts

@@ -1,8 +1,10 @@
+import type { PromptReRaiseDisposition } from '../appsync/sync-prompt-retention';
 import type { ShellEventEmit, ShellEventEmitResult } from './emit-shell-event';
 /** The run-scoped shell emitter (`createShellEventEmitter(...)`). */
 export type ShellEmitter = (args: ShellEventEmit) => Promise<ShellEventEmitResult>;
 /** The run-scoped `openPrompts` TTL co-refresh transport (§3.1). */
 export type OpenPromptTtlRefresher = (promptIds: string[]) => Promise<string[]>;
+export type SessionPromptTtlRefresher = (sessionId: string, promptIds: string[], reRaise: (promptId: string, reRaiseToken?: string) => Promise<PromptReRaiseDisposition>) => Promise<void>;
 /** Everything the ledger needs to (re-)emit an offer raise. */
 export interface PlannerOfferRaiseContext {
     sessionId: string;
@@ -26,9 +28,11 @@ export declare class PlannerOfferE1Ledger {
     private readonly needsReRaise;
     /** promptIds whose resolution emit is un-acked → retry-until-ack (F-C4). */
     private readonly pendingResolutions;
+    private publications;
     private timer;
     private emit;
     private refreshTtl;
+    private refreshSessionTtl;
     private readonly refreshMs;
     private draining;
     constructor(opts?: {
@@ -38,7 +42,7 @@ export declare class PlannerOfferE1Ledger {
      * Install the run-scoped TTL-refresh transport and RESET all per-run state. Call
      * once at shell start; a re-run (tests) gets a clean ledger + no stale timer.
      */
-    beginRun(refreshTtl: OpenPromptTtlRefresher): void;
+    beginRun(refreshTtl: OpenPromptTtlRefresher, refreshSessionTtl?: SessionPromptTtlRefresher): void;
     /**
      * F-C1 — raise (or re-present) a planner offer and INSPECT the emit result. On a
      * transient failure (`{emitted:false}` or a throw) PARK the promptId for

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/quorum-loop.d.ts

@@ -1,5 +1,6 @@
 import * as fsSync from 'node:fs';
 import type { AppSyncClient, TeamTrackRecoveryRow } from '../appsync/appsync-client';
+import type { SyncSecurityPosture } from '../appsync/sync-security-posture';
 import type { Session } from '../types';
 import type { LocalExecutor } from '../local-executor';
 import type { ClassBInbound, QueuedWorkEndedPayload } from '../local-executor/types';
@@ -376,6 +377,7 @@ export type ReviewerSubstrateEngager = (input: {
     /** Canonical host workdir the sandbox mounts (the loop's working dir). */
     workdir: string;
 }) => Promise<ReviewerSubstrateEngageResult>;
+export type ReviewerSafetyNoticeSink = (message: string, posture: SyncSecurityPosture) => Promise<void>;
 export interface QuorumLoopDeps {
     appsyncClient: AppSyncClient;
     session: Session;
@@ -527,6 +529,10 @@ export interface QuorumLoopDeps {
      * `emitShellEvent` NOTIFICATION. ABSENT (tests) → logged only.
      */
     surfaceHalt?: (message: string) => void;
+    /** Closed posture from the engage result, never inferred from warning text.
+     * Production provides local echo plus canonical V2/legacy routing. Advisory
+     * failure cannot prevent reviewer execution or sandbox teardown. */
+    surfaceReviewerSafetyNotice?: ReviewerSafetyNoticeSink;
     /**
      * PHASE-589/469 W1 (LOCK #589-E) — flip the desktop's OWN team track to
      * `Failed` + render the group-terminal from LOCAL state. Wired by the TEAM
@@ -2356,8 +2362,9 @@ export declare class QuorumLoop {
      * CP-7 §8 (Stage-1-resolved) — surface the PROMINENT reduced-trust badge for a
      * reviewer seat (mirrors the implementor's badge, scoped to the loop's
      * available NOTIFICATION channel). The moat being OFF/coarse for a reviewer is
-     * VISIBLE + auditable, never silent: a user-visible NOTIFICATION (via
-     * `surfaceHalt`, the loop's NOTIFICATION surface) + a WARN log. Best-effort —
+     * locally visible + auditable: a desktop notice and WARN log. Production
+     * additionally reports a canonical V2 notice, or the legacy NOTIFICATION.
+     * Persistence/transport acceptance is not a phone acknowledgment. Best-effort —
      * unlike the implementor's `tier:'none'` path this is NOT delivery-gated,
      * because a reviewer reduced-trust badge does not change whether the seat
      * RUNS (it always runs; the badge only informs the user).

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/shell-sync-recovery.d.ts

@@ -0,0 +1,23 @@
+/** One retry owner per mounted orchestration shell, not per emitter closure.
+ * Recovery reads only the bounded local source inventory when it is empty;
+ * cloud I/O is for previously prepared operations, never new encryption.
+ */
+export declare class ShellSyncRecovery {
+    private readonly deps;
+    private state;
+    private timer?;
+    private active?;
+    private retryDelayMs;
+    private stopPromise?;
+    constructor(deps: {
+        recover(signal: AbortSignal): Promise<number>;
+        onFailure(error: unknown): void;
+    });
+    start(): void;
+    /** Synchronous cancellation fence; joins that exact attempt, never launches
+     * a final uncancellable cloud sweep or deletes a pending source on exit.
+     */
+    stop(): Promise<void>;
+    private schedule;
+    private run;
+}

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/slash-routes/reviewers.d.ts

@@ -1,5 +1,5 @@
 import type { AppSyncClient } from '../../appsync';
-import type { ReviewerAgentSpec, UserReviewerPolicySnapshot } from '../../types/reviewer';
+import type { ReviewerAgentSpec, ReviewerQuorumSettings, UserReviewerPolicySnapshot } from '../../types/reviewer';
 import { detectInstalledAgents } from '../../orchestration';
 /**
  * Human-readable, ANSI-free rendering of a reviewer-policy snapshot. Renders ONLY
@@ -10,6 +10,7 @@ import { detectInstalledAgents } from '../../orchestration';
  * (it would always render a misleading default).
  */
 export declare function formatReviewerPolicy(snapshot: UserReviewerPolicySnapshot): string;
+export declare function formatPassRule(settings: ReviewerQuorumSettings): string;
 /**
  * Fetches + formats the user's reviewer panel. Re-pushes the locally detected
  * agents (idempotent) and renders the returned snapshot. Never throws — returns
@@ -24,6 +25,7 @@ export declare function runReviewersCli(client: AppSyncClient): Promise<string>;
 export interface ReviewerWizardData {
     installedAgents: ReturnType<typeof detectInstalledAgents>;
     currentSeats: ReviewerAgentSpec[] | null;
+    currentQuorum?: ReviewerQuorumSettings | null;
 }
 /**
  * Gathers everything the interactive wizard needs to render synchronously:

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/types.d.ts

@@ -2,7 +2,7 @@ import { Session } from '../types/session';
 import type { StructuralSummary } from '../structural-summary/types';
 import type { GatePromptEnvelope, ReviewSummaryPanelModel } from './gate-prompts';
 import type { TaskProgressEvent } from './task-progress';
-import type { ReviewerAgentSpec } from '../types/reviewer';
+import type { ReviewerAgentSpec, ReviewerQuorumSettings } from '../types/reviewer';
 import type { ImplementorPreference } from './implementor-preference';
 import type { AgentKind as LocalExecutorAgentKind } from '../local-executor/types';
 import type { WorkItemInput } from '../local-executor/task-group-types';
@@ -208,10 +208,9 @@ export interface ReviewerSeatState {
     verdictDigest?: string;
 }
 /**
- * §5.1 LOCK (lines 558-569). Per-gate aggregate over reviewer-quorum +
- * auto-revise round count. `autoReviseCap: 2 | 6` literal-union prevents
- * accidental drift in implementor code per CP-0 §6 line 155 (Pro = 2,
- * Max = 6).
+ * Per-gate aggregate over reviewer-quorum and the cloud-admitted auto-revise
+ * limit. R2 uses Pro=0, Max=2. Six is retained only for historical display;
+ * this presentation type never grants a revision or derives a local cap.
  */
 export interface GateState {
     gateId: string;
@@ -220,7 +219,7 @@ export interface GateState {
     quorumRequired: number;
     quorumAchieved: number;
     autoReviseRound: number;
-    autoReviseCap: 2 | 6;
+    autoReviseCap: 0 | 2 | 6;
     status: 'pending' | 'in_review' | 'PASS' | 'REVISE' | 'BLOCK' | 'merge_gate_pending';
     finalizedAt?: string;
 }
@@ -926,7 +925,7 @@ export interface AuditFlagIndex {
  * opens. The entrypoint (`handleShellUserInput`) gathers these BEFORE
  * dispatching `REVIEWER_WIZARD_OPEN` so the wizard renders synchronously from
  * props with no in-component network I/O:
- *   - `tier` decides the seat budget (Pro = 2 seats, Max = 3).
+ *   - `tier` bounds the panel (Pro = 1 seat, Max = 1–2; default 2).
  *   - `installedAgents` is the host-detected agent set — the wizard offers ONLY
  *     these as reviewer choices (mirrors the `/reviewer-setup`
  *     CLI), so a user can never pick an uninstalled agent.
@@ -936,12 +935,13 @@ export interface AuditFlagIndex {
  *
  * NB: there is no enable/disable state — the legacy `orchestrationEnabledDefault`
  * opt-in was removed in CP-1 (2.0 orchestration is shell-driven, not a stored
- * flag), so the wizard configures the reviewer PANEL only.
+ * flag). The wizard configures the panel, approval rule and revision depth.
  */
 export interface ReviewerWizardState {
     tier: Tier;
     installedAgents: Array<'CLAUDE' | 'GEMINI' | 'CODEX' | 'ANTIGRAVITY'>;
     currentSeats: ReviewerAgentSpec[] | null;
+    currentQuorum?: ReviewerQuorumSettings | null;
 }
 /**
  * `/implementor-setup` interactive wizard state.

package/node_modules/@quantiya/codevibe-core/dist/orchestration-shell/workspace-terminal-coordinator.d.ts

@@ -46,7 +46,7 @@ export interface WorkspaceOutcomeSinkTap {
 }
 export interface WorkspaceTerminalCoordinatorOptions {
     session: Session;
-    appsyncClient: Pick<AppSyncClient, 'createEvent'>;
+    appsyncClient: Pick<AppSyncClient, 'createEvent' | 'submitWorkspaceOutcome'>;
     getSessionKey: EmitShellEventDeps['getSessionKey'];
     rootDir?: string;
     now?: () => Date;

package/node_modules/@quantiya/codevibe-core/dist/planner/types.d.ts

@@ -17,15 +17,15 @@ export declare const SessionContextSchema: z.ZodObject<{
     recentEventCount: z.ZodNumber;
 }, "strip", z.ZodTypeAny, {
     sessionId: string;
-    userId: string;
     tier: "FREE" | "PRO" | "MAX";
+    userId: string;
     currentTaskState: "none" | "in_progress" | "awaiting_user" | "awaiting_review" | "merge_gate_pending";
     structuralSummaryDigest: string;
     recentEventCount: number;
 }, {
     sessionId: string;
-    userId: string;
     tier: "FREE" | "PRO" | "MAX";
+    userId: string;
     currentTaskState: "none" | "in_progress" | "awaiting_user" | "awaiting_review" | "merge_gate_pending";
     structuralSummaryDigest: string;
     recentEventCount: number;

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/atomic-file.d.ts

@@ -1,6 +1,12 @@
 import type { z } from 'zod';
 /** Marker infix used by every temp file so restart sweeps can find them. */
 export declare const TEMP_INFIX = ".tmp.";
+/** Strict bounded snapshot for terminal cleanup; never follows a file symlink. */
+export declare function readBoundedToolFile(filePath: string, maximumBytes: number): Promise<{
+    bytes: Buffer;
+    dev: number;
+    ino: number;
+}>;
 /**
  * fsync a directory so a preceding `rename` into it is durable across a crash.
  * Best-effort (skipped on Windows / filesystems that reject a dir fsync).
@@ -14,9 +20,13 @@ export declare function fsyncDir(dir: string): Promise<void>;
  * the rename is intra-filesystem, and carries the `.tmp.` infix + pid + random
  * suffix so a restart sweep recognizes an interrupted write.
  */
-export declare function atomicWriteFileSync(finalPath: string, bytes: string): Promise<void>;
+export declare function atomicWriteFileSync(finalPath: string, bytes: string, options?: {
+    requireDirectorySync?: boolean;
+}): Promise<void>;
 /** Crash-atomic write of a JSON value (schema-validated before writing). */
-export declare function atomicWriteJson<T>(finalPath: string, schema: z.ZodType<T>, value: T): Promise<void>;
+export declare function atomicWriteJson<T>(finalPath: string, schema: z.ZodType<T>, value: T, options?: {
+    requireDirectorySync?: boolean;
+}): Promise<void>;
 /**
  * Read + schema-validate a crash-atomic JSON state file. Returns `null` when the
  * file is ABSENT, unreadable, non-JSON, or fails the schema — the caller then
@@ -24,4 +34,4 @@ export declare function atomicWriteJson<T>(finalPath: string, schema: z.ZodType<
  * uniqueness authority; §4.5). `onInvalid` fires (for a CRITICAL log) only when a
  * PRESENT file failed to parse/validate, distinguishing corruption from absence.
  */
-export declare function readValidatedJson<T>(filePath: string, schema: z.ZodType<T>, onInvalid?: (reason: string) => void): Promise<T | null>;
+export declare function readValidatedJson<T>(filePath: string, schema: z.ZodType<T>, onInvalid?: (reason: string) => void, maximumBytes?: number): Promise<T | null>;

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/consolidator.d.ts

@@ -2,6 +2,7 @@ import type { Logger } from '../logger';
 import type { ToolActivityOutbox } from './outbox';
 import type { ToolActivityLedger } from './ledger';
 import type { ToolActivityOutboxEnvelope } from './types';
+import type { DurableSyncResult } from '../appsync/sync-operation-journal';
 /** An observed tool occurrence handed to {@link ToolActivityConsolidator.observe}. */
 /**
  * The ATOMIC (under-lock) outcome of {@link ToolActivityConsolidator.observe}, so the
@@ -32,9 +33,15 @@ export interface ObservedOccurrence {
     /** `digestOf(toolInput)` (§0) — becomes the group's `detail[].digest`. Omit if no input. */
     digest?: string;
 }
-/** Encrypt-at-send transport — throws on a retryable failure; returns on ack. */
+/** Legacy return-on-ack or R2's durable receipt/omission + post-ledger acknowledgment. */
 export interface ToolActivityTransport {
-    send(sessionId: string, envelope: ToolActivityOutboxEnvelope): Promise<void>;
+    protocol?: 'LEGACY' | 'SYNC_V2';
+    /** Required for SYNC_V2; captured in each source window before any send. */
+    sessionGenerationId?: string;
+    /** SYNC_V2 must persist the exact request/terminal outcome before returning. */
+    send(sessionId: string, envelope: ToolActivityOutboxEnvelope): Promise<void | DurableSyncResult>;
+    /** Required for SYNC_V2: idempotent cleanup after durable source settlement. */
+    settled?(sessionId: string, envelope: ToolActivityOutboxEnvelope): Promise<void>;
 }
 /**
  * True when a failed TOOL_ACTIVITY `createEvent` is the backend's TYPED
@@ -254,6 +261,7 @@ export declare class ToolActivityConsolidator {
     private enqueue;
     /** Start as many sends as back-pressure allows. */
     private pump;
+    private requireSourceProtocol;
     private deliver;
     /** Test/diagnostic: windows still awaiting delivery (queued + in flight + backoff-limbo). */
     pendingCount(): number;

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/index.d.ts

@@ -7,3 +7,4 @@ export * from './session-map';
 export * from './socket-rollout-lock';
 export * from './flock-rollout-lock';
 export * from './consolidator';
+export * from './sync-transport';

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/ledger.d.ts

@@ -14,12 +14,12 @@ export declare const LedgerEntrySchema: z.ZodObject<{
     byteOffset: z.ZodNumber;
     state: z.ZodEnum<["durably-outboxed", "acked", "terminal"]>;
 }, "strip", z.ZodTypeAny, {
-    state: "terminal" | "durably-outboxed" | "acked";
     byteOffset: number;
+    state: "terminal" | "durably-outboxed" | "acked";
     clientEventId: string;
 }, {
-    state: "terminal" | "durably-outboxed" | "acked";
     byteOffset: number;
+    state: "terminal" | "durably-outboxed" | "acked";
     clientEventId: string;
 }>;
 export type LedgerEntry = z.infer<typeof LedgerEntrySchema>;
@@ -38,12 +38,12 @@ export declare const LedgerFileSchema: z.ZodObject<{
         byteOffset: z.ZodNumber;
         state: z.ZodEnum<["durably-outboxed", "acked", "terminal"]>;
     }, "strip", z.ZodTypeAny, {
-        state: "terminal" | "durably-outboxed" | "acked";
         byteOffset: number;
+        state: "terminal" | "durably-outboxed" | "acked";
         clientEventId: string;
     }, {
-        state: "terminal" | "durably-outboxed" | "acked";
         byteOffset: number;
+        state: "terminal" | "durably-outboxed" | "acked";
         clientEventId: string;
     }>>;
     /**
@@ -53,16 +53,16 @@ export declare const LedgerFileSchema: z.ZodObject<{
     terminalClientEventIds: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     entries: Record<string, {
-        state: "terminal" | "durably-outboxed" | "acked";
         byteOffset: number;
+        state: "terminal" | "durably-outboxed" | "acked";
         clientEventId: string;
     }>;
     version: 1;
     terminalClientEventIds: string[];
 }, {
     entries: Record<string, {
-        state: "terminal" | "durably-outboxed" | "acked";
         byteOffset: number;
+        state: "terminal" | "durably-outboxed" | "acked";
         clientEventId: string;
     }>;
     version: 1;
@@ -136,7 +136,9 @@ export declare class ToolActivityLedger {
      * EMPTY ledger (the caller then rebuilds from the outbox via
      * {@link rebuildFromOutbox}); losing it never skips an occurrence.
      */
-    load(): Promise<void>;
+    load(options?: {
+        failClosed?: boolean;
+    }): Promise<void>;
     /**
      * Seed `durably-outboxed` mappings from the surviving outbox entries (§4.5
      * rebuildability) — used after a ledger loss so a still-pending window is not
@@ -178,7 +180,7 @@ export declare class ToolActivityLedger {
      */
     isLegacyInFlight(id: string): boolean;
     getState(id: string): 'durably-outboxed' | 'acked' | 'terminal' | undefined;
-    /** True when a window has been durably settled as permanently undeliverable. */
+    /** True when a window is durably terminal: rejected, quota-omitted, or R2-accepted. */
     isTerminalWindow(clientEventId: string): boolean;
     /**
      * Unique `clientEventId`s still in the `durably-outboxed` state (sealed, not yet
@@ -208,6 +210,10 @@ export declare class ToolActivityLedger {
      * persisted before its outbox file is pruned so restart cannot resend it.
      */
     markTerminal(clientEventId: string, invocationIds?: string[]): Promise<void>;
+    /** Retirement is permanent replay suppression, not delivery/quota settlement. */
+    markRetired(clientEventId: string, invocationIds: string[]): Promise<void>;
+    /** R2 keeps a window settlement independently of occurrence remapping/pruning. */
+    markSettled(clientEventId: string, invocationIds: string[], disposition: 'acked' | 'terminal', requireDirectorySync?: boolean): Promise<void>;
     /**
      * Crash-ordered repair step (2) (§4.5 V3/W2): DEMOTE/remove every mapping
      * referencing a quarantined or missing `clientEventId` so its occurrences are
@@ -275,7 +281,9 @@ export declare class ToolActivityLedger {
      * seen before the backstop re-derives it (§4.8). An absent/invalid file is a
      * no-op (nothing to suppress yet).
      */
-    reloadLegacyOwned(): Promise<void>;
+    reloadLegacyOwned(options?: {
+        failClosed?: boolean;
+    }): Promise<void>;
     /** Test/diagnostic: a snapshot of the in-memory durable legacy-owned id set. */
     legacyOwnedSnapshot(): string[];
     /** Test/diagnostic: a snapshot of the in-memory legacy IN-FLIGHT id set. */

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/outbox.d.ts

@@ -1,4 +1,6 @@
 import type { Logger } from '../logger';
+import type { DesktopSyncSessionScope } from '../appsync/sync-operation-journal';
+import type { ToolSyncRetirementLocation } from '../appsync/sync-session-retirement';
 import { ToolActivityOutboxEnvelope } from './types';
 export interface ToolActivityOutboxOptions {
     /** Plugin agent slug — `claude` | `codex` (the on-disk namespace). */
@@ -27,6 +29,8 @@ export declare class ToolActivityOutbox {
     constructor(opts: ToolActivityOutboxOptions);
     /** The per-session directory holding one file per sealed window. */
     sessionDir(sessionId: string): string;
+    /** Trusted local namespace persisted inside the encrypted cleanup intent. */
+    retirementLocation(): ToolSyncRetirementLocation;
     private entryPath;
     /**
      * Durably persist a sealed window `pending`, BEFORE any send (§4.5 lifecycle
@@ -40,11 +44,25 @@ export declare class ToolActivityOutbox {
      * `<id>.json`, and QUARANTINES (renames aside, logged) any file that is
      * unreadable, schema-invalid, or whose filename does not match its own
      * `clientEventId`. Quarantined occurrences are recovered by the caller's
-     * transcript rescan — NEVER dead-lettered.
+     * transcript rescan — NEVER dead-lettered on the legacy path. R2 callers
+     * set failClosed: invalid or previously quarantined sources remain untouched
+     * and stop recovery rather than creating a new operation from a rescan.
      */
-    listPending(sessionId: string): Promise<ListPendingResult>;
+    listPending(sessionId: string, options?: {
+        failClosed?: boolean;
+    }): Promise<ListPendingResult>;
     /** Prune a delivered entry on ack — a single idempotent `unlink` (§4.5). */
     prune(sessionId: string, clientEventId: string): Promise<void>;
+    /** Serialize R2 recovery/retirement, not legacy admission. The provider must
+     * still stop and join its normal consolidator before terminal retirement. */
+    withSyncRecovery<T>(sessionId: string, action: (fence: () => Promise<void>) => Promise<T>): Promise<T | null>;
+    /** Exact generation retirement plan, bounded independently of legacy scans.
+     * No temp sweep, quarantine, generation rewrite or legacy window deletion. */
+    withRetirementSources<T>(scope: DesktopSyncSessionScope, action: (sources: {
+        windows: ToolActivityOutboxEnvelope[];
+        markRetired(): Promise<void>;
+        prune(): Promise<void>;
+    }) => Promise<T>): Promise<T | null>;
     /**
      * Enumerate the session ids with a durable outbox directory (§4.5 startup
      * drain — resume EACH session's send-drain independent of which session's

package/node_modules/@quantiya/codevibe-core/dist/tool-activity/replay-cursor.d.ts

@@ -36,9 +36,9 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     /** Partial trailing line as of the last checkpoint (diagnostic; re-derived on read). */
     carryover: z.ZodString;
 }, "strip", z.ZodTypeAny, {
+    byteOffset: number;
     version: 1;
     canonicalPath: string;
-    byteOffset: number;
     fileIdentity: {
         dev: number;
         ino: number;
@@ -46,9 +46,9 @@ export declare const ReplayCursorStateSchema: z.ZodObject<{
     lastKnownSize: number;
     carryover: string;
 }, {
+    byteOffset: number;
     version: 1;
     canonicalPath: string;
-    byteOffset: number;
     fileIdentity: {
         dev: number;
         ino: number;