@quantiya/codevibe-core 2.0.7 → 2.0.9

package/dist/orchestration-shell/quorum-loop.d.ts

@@ -1,6 +1,7 @@
 import type { AppSyncClient, TeamTrackRecoveryRow } from '../appsync/appsync-client';
 import type { Session } from '../types';
 import type { LocalExecutor } from '../local-executor';
+import type { ClassBInbound } from '../local-executor/types';
 import type { ImageAttachment } from './types';
 import { type ImplementorMode } from '../local-executor/implementor-argv';
 import { type FallbackLadderDeps } from '../substrate-launch/fallback-ladder';
@@ -9,8 +10,9 @@ import type { ConflictResolverContext } from '../local-executor/merge-conflict-r
 import type { AgentKind } from '../local-executor/types';
 import type { GateDispatchPayload, ReviewerDispatchPayload, ReviseFeedbackPayload } from '../local-executor/types';
 import type { TeamTrackFailureReason } from '../local-executor/task-group-types';
-import { WorkspaceShadow, type ShadowEnv } from '../local-executor/workspace-shadow';
+import { WorkspaceShadow, type RecoveredShadow, type ShadowCleanupResidue, type ShadowEnv } from '../local-executor/workspace-shadow';
 import type { RevertManifestStore } from '../local-executor/durable-store';
+import { captureWorkspaceRootAuthority } from '../local-executor/workspace-authority';
 import { type TeamExecution } from '../local-executor/team-execution-flag';
 import { type RenderedConflict, type TrackIntentDiff } from '../local-executor/wb2-review-bundle';
 import { ReviewerRegistry } from '../reviewer/registry';
@@ -322,12 +324,10 @@ export interface QuorumLoopDeps {
      * agent reviewer runs INSIDE the sandbox with no ambient vendor creds and a
      * broker-routed model call — closing the CP-14 §8/§13 reviewer-sandbox gap.
      * ABSENT (legacy / companion / tests) → reviewers take the legacy unsandboxed
-     * path BYTE-IDENTICAL (§7 non-regression). Reviewer-sandboxing is ALSO gated
-     * behind an opt-in env flag (`CODEVIBE_SANDBOX_REVIEWERS=1`, read in
-     * `engageSeatSubstrate` on the `spawnOneSeat` path) that DEFAULTS OFF — so
-     * even when this engager is wired,
-     * reviewers stay on the legacy path until the broker round-trip is observed
-     * green in a configured env (see `reviewerSandboxingEnabled`). The flag is
+     * path BYTE-IDENTICAL (§7 non-regression). Reviewer-sandboxing DEFAULTS ON
+     * when this engager is wired (R7 A4), with an operator opt-out env flag
+     * (`CODEVIBE_SANDBOX_REVIEWERS=0`, read in `engageSeatSubstrate` on the
+     * `spawnOneSeat` path — see `reviewerSandboxingEnabled`). The flag is
      * independent of implementor sandboxing (which has its own engager).
      */
     engageReviewerSubstrate?: ReviewerSubstrateEngager;
@@ -386,6 +386,22 @@ export interface QuorumLoopDeps {
      * production uses the defaults (`~/.codevibe/shadow-state`, `os.tmpdir()`).
      */
     shadowEnv?: ShadowEnv;
+    /**
+     * Deterministic recovery seams. Production omits this object and uses the
+     * imported filesystem implementations. Tests may park an exact recovery
+     * await to prove the session-disposal admission/drain boundary without
+     * weakening any production timeout or filesystem check.
+     */
+    shadowRecoveryOps?: {
+        listRecoverableShadows?: (env: ShadowEnv) => Promise<RecoveredShadow[]>;
+        listShadowCleanupResidue?: (taskIds: ReadonlySet<string>, env: ShadowEnv) => Promise<ShadowCleanupResidue[]>;
+        captureWorkspaceRootAuthority?: typeof captureWorkspaceRootAuthority;
+        reopenShadow?: (recovered: RecoveredShadow, env: ShadowEnv) => Promise<WorkspaceShadow | null>;
+        reapOrphanShadows?: (keepTaskIds: ReadonlySet<string>, env: ShadowEnv) => Promise<{
+            reaped: string[];
+            retained: string[];
+        }>;
+    };
     /**
      * CP-1.f execute-first (#EF-1 / #SR-2) — surface a user-visible halt /
      * fail-closed message to the orchestration timeline. Wired by the shell to an
@@ -463,8 +479,10 @@ export interface QuorumLoopDeps {
      *
      * SECURITY INVARIANT: events carry ONLY counts/labels/paths/elapsed — never
      * diff content, file contents, reviewer reasoning, prompts, or any decrypted
-     * plaintext (the `TaskProgressEvent` union is the allowlist). The loop wraps
-     * every emit so a throwing listener can NEVER break the loop.
+     * plaintext (the `TaskProgressEvent` union is the allowlist, with its ONE
+     * documented exception: `halt_notice.message`, controlled operational notice
+     * text from `surfaceHalt` — see task-progress.ts's header carve-out). The
+     * loop wraps every emit so a throwing listener can NEVER break the loop.
      */
     onProgress?: OnProgress;
     /**
@@ -516,6 +534,21 @@ declare function reviewerAgentToLeAgent(agent: ReviewerAgentKind): AgentKind;
  * leading token isn't a non-negative integer.
  */
 export declare function numericSeatId(resolvedSeatId: string): number | null;
+interface TeamRunAuthority {
+    taskGroupId: string;
+    trackIndex: number;
+    dispatchGeneration: number;
+}
+/**
+ * Byte-equivalent to the engine's
+ * `round0_gate_id_for_track(task, group, track, generation)`.
+ *
+ * Live GateDispatch packets intentionally carry no mutable "current" pointer.
+ * Their deterministic id is the authenticated correlation between the signed
+ * TrackAssigned generation and the signed GateDispatch. Keeping the formula
+ * here closes packet-order races without extending or weakening the wire.
+ */
+export declare function teamRound0GateId(taskId: string, taskGroupId: string, trackIndex: number, dispatchGeneration: number): string;
 export declare class QuorumLoop {
     private readonly deps;
     private readonly sleep;
@@ -585,6 +618,8 @@ export declare class QuorumLoop {
      * share a `trackIndex` overwrite each other's brief.
      */
     private teamBriefsByKey;
+    /** Recovery-authored briefs keyed by task/group/index/generation authority. */
+    private readonly recoveredBriefsByAuthority;
     private readonly activeBriefByTask;
     /**
      * CP-1.f revise-context fix (dogfood task 2ac68708, 2026-06-11) — the BINDING
@@ -674,6 +709,60 @@ export declare class QuorumLoop {
      * desktop suppression closes the late-LOCAL-submit race. Keyed by taskId.
      */
     private readonly activeImplementorByTask;
+    /** Spawn requests that own a shadow but have not yet returned a killable handle. */
+    private readonly pendingImplementorByTask;
+    /**
+     * Exact lifecycle ownership keyed by gate, including an older generation
+     * displaced from the per-task "current" maps above. Group halt and session
+     * teardown enumerate these registries so every real pending/active process
+     * remains abortable until its own round releases ownership.
+     */
+    private readonly activeImplementorByGate;
+    private readonly pendingImplementorByGate;
+    /**
+     * Full implementor-round coroutines owned by this session. Process handles
+     * cover only the agent subprocess; capture, validation, submission, and
+     * failure cleanup continue after that leader exits. Session teardown must
+     * await this set before deleting any workspace those continuations can use.
+     */
+    private readonly implementorRoundPromises;
+    /** Exact task ownership for group-local cancellation/drain (no unrelated wait). */
+    private readonly implementorRoundPromisesByTask;
+    /**
+     * Team GateDispatch callbacks admitted before their first await. Supersede,
+     * terminal group halt, and session teardown drain this exact registry before
+     * retiring snapshots, closing the pre-round ownership gap.
+     */
+    private readonly teamDispatchAdmissionsByTask;
+    /**
+     * Per-task registration tail. Every caller publishes its immutable gate /
+     * generation intent before joining this queue, so a successor gate received
+     * while an earlier registration drains is still correlated exactly.
+     */
+    private readonly teamTaskRegistrationByTask;
+    /** Exact deterministic gate authority, retained through retirement for stale replay refusal. */
+    private readonly teamGateBindingByRunId;
+    /** All queued/active registration intents, used to publish successor fences synchronously. */
+    private readonly teamRegistrationIntentsByTask;
+    /** Terminal group ids: set synchronously before any halt await or side effect. */
+    private readonly haltedTeamGroups;
+    /** Exact non-terminal generation fences retained after a newer dispatch wins. */
+    private readonly supersededTeamRuns;
+    /**
+     * Task ids whose old generation is being aborted/drained before its newer
+     * brief is installed. GateDispatch buffers behind this synchronous barrier.
+     */
+    private readonly supersedingTeamTaskIds;
+    /**
+     * Child task ids observed for a terminal group. GateDispatch carries only the
+     * child task id, so this closes the post-halt/no-brief replay path: after the
+     * brief is retired, a late dispatch is rejected instead of being buffered as
+     * an apparently early packet. A successful registration for a different,
+     * non-halted group clears the tombstone, which keeps task-id reuse safe.
+     */
+    private readonly haltedTeamTaskIds;
+    /** Serializes exact group bundle publication against the terminal halt fence. */
+    private readonly teamBundleOpsByGroup;
     /**
      * PHASE-CP-10-MIN (#585) §2.3 / #C10M-16 — offers already resumed (the
      * dedupe set; keyed on `offer_id`, the same axis as the audit slot #C10M-4).
@@ -724,6 +813,8 @@ export declare class QuorumLoop {
      * cardinality is bounded by those same dedup sets).
      */
     private readonly taskByGateId;
+    /** Exact immutable team generation that authored each team gate. */
+    private readonly teamAuthorityByGateId;
     /**
      * GATE_DISPATCH `gateRunId`s already consumed (idempotent re-delivery dedup).
      * A sweeper / WS re-deliver of the SAME round-0 dispatch must NOT double-spawn
@@ -747,18 +838,25 @@ export declare class QuorumLoop {
      */
     private readonly recoveredGateRunIds;
     /**
-     * §4.1 — DURABLE per-track tombstone for a present-but-CORRUPT brief
+     * §4.1 — in-session per-authority tombstone for a present-but-CORRUPT brief
      * ciphertext (decrypt threw during recovery PASS 1). Blocks BOTH recovery
      * relaunch (PASS 2) AND any future LIVE `TrackAssigned`/drain for that track
      * (§4.3) — a corrupt brief must NEVER spawn an empty-brief implementor on
      * EITHER path. The track times out via the engine sweeper (bounded). Distinct
      * from a `null` `encryptedBrief` (a legit empty brief).
      *
-     * CP-12 W4 (#593 Stage-2 r2): keyed by the COMPOSITE `teamBriefKey(taskGroupId,
-     * trackIndex)`, NOT bare `trackIndex` — B.2 aggregates across groups, so a
-     * tombstone on group A's track 0 must not block group B's (valid) track 0.
+     * Round 46: keyed by complete `(taskGroupId, trackIndex, taskId,
+     * dispatchGeneration)` authority, so a corrupt predecessor cannot block a
+     * clean successor that reuses the slot.
      */
     private readonly corruptBriefTracks;
+    /**
+     * The newest fully validated recovery authority seeded for each group/index
+     * slot. It prevents an asynchronously late, older recovery response (or stale
+     * live TrackAssigned) from replacing the brief selected for a newer
+     * generation. The actual tombstone remains keyed by the complete authority.
+     */
+    private readonly recoveryAuthorityBySlot;
     /**
      * #592 PROVENANCE GUARD (2026-06-26) — the task-group ids THIS desktop
      * ORIGINATED (recorded in `armB1Recovery`, right after a successful
@@ -775,11 +873,12 @@ export declare class QuorumLoop {
      */
     private readonly ownedGroupIds;
     /**
-     * CP-12 W4 (#593 Stage-2 r2) — the composite key for `teamBriefsByKey` +
-     * `corruptBriefTracks`. `(taskGroupId, trackIndex)` so two in-flight groups
-     * that share a `trackIndex` (B.2 aggregates session-wide) never collide.
+     * Slot key for parse-time briefs and the selected recovery projection.
+     * Deletion/launch authority never uses this key alone.
      */
     private teamBriefKey;
+    private recoveryAuthorityKey;
+    private isCorruptBriefAuthority;
     /**
      * PHASE-589/469 W3.1 (C1) — the GROUP-WIDE monotonic promote-order counter,
      * keyed by `taskGroupId`. Each team track promote reserves
@@ -864,6 +963,33 @@ export declare class QuorumLoop {
      * This also makes concurrent B.1+B.2 safe (no per-op toggle race).
      */
     private recoverySeedingDepth;
+    /**
+     * Recovery B.1 and B.2 can overlap. A per-call two-row batch is therefore
+     * insufficient: two concurrent calls could each launch two implementors.
+     * These permits are owned by the QuorumLoop/session and cover the complete
+     * `launchRecoveredTrack` operation across every recovery entry path.
+     */
+    private activeRecoveryRelaunches;
+    private readonly recoveryRelaunchWaiters;
+    /**
+     * Every asynchronously delivered session coroutine that can reach a task
+     * workspace: Class-B consumption, shadow recovery, and B.1/B.2 team
+     * recovery. Admission is synchronous and closes when `shuttingDown` flips.
+     * Disposal drains this set before it enumerates task resources, so no
+     * accepted callback can mutate a map or filesystem after the boundary.
+     */
+    private readonly sessionWorkPromises;
+    private readonly sessionWorkAdmissions;
+    /** TaskAuthorized callbacks accepted before shutdown may finish promotion. */
+    private readonly terminalClassBAdmissionsByTask;
+    private trackExistingSessionWork;
+    private startSessionWork;
+    private admittedSessionWorkMayContinue;
+    private trackTeamRecovery;
+    private acquireRecoveryRelaunchPermit;
+    private releaseRecoveryRelaunchPermit;
+    private cancelRecoveryRelaunchWaiters;
+    private withRecoveryRelaunchPermit;
     /**
      * §4.3 — TEAM Class B packets buffered while the recovery seed barrier is up
      * (`recoverySeedingDepth > 0`). Drained through the normal live handlers AFTER
@@ -927,25 +1053,28 @@ export declare class QuorumLoop {
      */
     private readonly shadowsByTask;
     /**
-     * PHASE-598 (Codex impl-r5 / LOCK #598-11) — the REVIEWED diff snapshot per TEAM
-     * task, stored when a round's gate goes live (reviewers dispatched). `promoteShadow`
-     * fails-closed if the live shadow drifts from it before promote — the airtight
-     * backstop for a declared test that spawns a DETACHED writer (the test runner waits
-     * only on the direct child, so such a writer can mutate the shadow AFTER the
-     * post-test re-capture passes but BEFORE promote). Presence ⇔ team task: single-impl
-     * never stores, so its promote path is unchanged. Cleared on promote/discard.
+     * Session-sticky task ids whose snapshots this loop may retire. The set does
+     * not shrink when an in-memory map entry is cleared: normal teardown performs
+     * a fresh durable enumeration and must still recognize an interrupted exact
+     * marker. It also prevents one embedded shell from adopting another shell's
+     * same-workspace snapshot merely because both share a state root.
+     */
+    private readonly workspaceTaskIdsOwned;
+    /**
+     * In-session terminal retirement tombstones. A recovery scan that started
+     * before a terminal discard/promote must not reinstall its stale instance
+     * after that terminal operation wins the task mutex.
+     */
+    private readonly terminallyRetiredWorkspaceTasks;
+    /**
+     * In-memory cache of the crash-durable reviewed artifact for every task. The
+     * authoritative copy lives in the private snapshot marker and is persisted
+     * before submission; promotion always re-reads that copy. Cleared with the
+     * instance on promote/discard.
      */
     private readonly reviewedSnapshotByTask;
     /** Guards concurrent shadow-create for the same task (round-0 + an early re-deliver). */
     private readonly shadowCreateInFlight;
-    /**
-     * CP-14 Wave A — the ONE pinned base SHA per task group (`worktree_merge`),
-     * captured (memoized) at the first track of the group BEFORE any shadow is
-     * created, so EVERY track branches from the same base → a deterministic
-     * merge-train input (Stage-1 plan-review MED-3). Promise-memoized so concurrent
-     * track registrations share a single `git rev-parse HEAD`.
-     */
-    private readonly groupBaseShaInFlight;
     /**
      * Per-task async MUTEX for shadow LIFECYCLE mutations (restart-race fix,
      * 2026-06-11 Stage-2 Codex r2). A promise-chain serializes EVERY map/stateDir-
@@ -962,10 +1091,12 @@ export declare class QuorumLoop {
      * sequencing layer (errors propagate to the OWNING caller, never poison the
      * chain for the next op), and clears the entry once the tail it stored is the
      * one that settled (so an idle task leaks no entry). The serialized region is
-     * fs/git-only with NO nested `runExclusiveShadowOp` call (the wrapped methods
+     * filesystem-only with NO nested `runExclusiveShadowOp` call (the wrapped methods
      * never call each other), so it cannot self-deadlock.
      */
     private readonly shadowOpsByTask;
+    /** Once set, no new implementor workspace may be created for this session. */
+    private shuttingDown;
     /**
      * Serialize one shadow lifecycle op for `taskId` behind any in-flight op for
      * the same task. The op's result/rejection is returned to ITS caller; a
@@ -974,6 +1105,30 @@ export declare class QuorumLoop {
      * appended is still the current tail (no later op queued behind us).
      */
     private runExclusiveShadowOp;
+    private static sameTeamAuthority;
+    private static teamAuthorityKey;
+    private static teamAuthorityForEntry;
+    private static immutableTeamTaskEntry;
+    private static sameTeamTaskEntry;
+    private publishTeamRegistrationIntent;
+    private releaseTeamRegistrationIntent;
+    private refreshTeamSupersedingFence;
+    private hasQueuedNewerTeamRegistration;
+    private retireTeamGateBindings;
+    private teamAuthorityForTask;
+    private teamRunIsHalted;
+    private teamEntryMayContinue;
+    private admitTeamDispatch;
+    private drainTeamDispatchAdmissions;
+    private runTeamBundlePublication;
+    /**
+     * Retire one older team dispatch generation before installing its successor.
+     * The exact authority fence is published synchronously, then every pending /
+     * active real handle and the complete round continuation is drained. The old
+     * snapshot is removed only after process ownership is proven empty.
+     */
+    private retireSupersededTeamRun;
+    private rememberWorkspaceLifecycleFailure;
     /**
      * The last terminal workspace outcome (promote / discard) this loop applied,
      * for the `summarize_current_status` shell answer (Fix 2). RELATIVE file paths
@@ -1048,6 +1203,15 @@ export declare class QuorumLoop {
     } | {
         kind: 'discarded';
     } | null;
+    /**
+     * Session-owned Class-B ingress. The subscription calls this wrapper instead
+     * of invoking the LocalExecutor directly, making delivery admission atomic
+     * with the teardown fence. A packet accepted before shutdown is drained;
+     * packets delivered after shutdown are ignored before verification or side
+     * effects. TaskAuthorized gets a narrow terminal admission so its already-
+     * delivered promote can finish before disposal enumerates the task.
+     */
+    consumeClassB(packet: ClassBInbound, envelopeTaskId?: string): Promise<void>;
     /** The DI callbacks the shell wires into its ClassBConsumer. */
     classBConsumerDeps(): {
         classBSignatureVerifier: (packet: import('../local-executor/types').ClassBInbound) => Promise<boolean>;
@@ -1144,14 +1308,15 @@ export declare class QuorumLoop {
      */
     setTeamAttachments(taskGroupId: string, attachments: ImageAttachment[]): void;
     /**
-     * CP-12 W2.b (§3.C.3) — read the brief for `(taskGroupId, trackIndex)`. The
+     * CP-12 W2.b (§3.C.3) — read the brief for a team track. The
      * `registerTeamTask` bridge (wired in the shell) reads this when `TrackAssigned`
      * correlates a track to its child `task_id`; recovery PASS 2 reads it for a
      * relaunched track. Empty string when the user issued no `description` for the
      * track (a track with no brief runs an empty-brief round-0; the engine's #EF-1
-     * born-halt surfaces it). Composite-keyed (#593 Stage-2 r2) — see `teamBriefKey`.
+     * born-halt surfaces it). Recovery callers pass task/generation so the
+     * complete-authority store is consulted; two-argument calls are diagnostic.
      */
-    getTeamBrief(taskGroupId: string, trackIndex: number): string;
+    getTeamBrief(taskGroupId: string, trackIndex: number, taskId?: string, dispatchGeneration?: number): string;
     /**
      * CP-12 W2.b (§3.C.3 / M5) — the brief→task_id bridge. `launchTrack` calls this
      * at `TrackAssigned` (the FIRST surface carrying both `track_index` AND the
@@ -1168,10 +1333,19 @@ export declare class QuorumLoop {
         agent: AgentKind;
         taskGroupId: string;
         trackIndex: number;
+        /** Optional only for direct legacy test/recovery callers. */
+        dispatchGeneration?: number;
+        /**
+         * Recovery/direct-call correlation when the caller already has the
+         * engine gate id. Live TrackAssigned callers omit it and use the exact
+         * deterministic engine formula.
+         */
+        gateRunId?: string;
         writePaths: string[];
         autoModifiedFiles: string[];
         testSurfaces: string[];
-    }): Promise<void>;
+    }): Promise<'accepted' | 'refused'>;
+    private registerTeamTaskBriefOwned;
     /**
      * CP-12 W2.b (§3.C.2) — the TEAM analogue of the single-impl round-0 spawn.
      * Routes by the OUTER envelope's `task_id` (the payload has none): resolves
@@ -1203,19 +1377,11 @@ export declare class QuorumLoop {
     private replaceShadowForRound0Locked;
     /**
      * CP-14 P1 — the team execution model this session SIGNALS on
-     * `createTaskGroup` (`executionModel`). Always `worktree_merge` since the
-     * §10 retirement (2026-07-03): overlapping-track dispatch with the
-     * merge-train + the server contract gate as the authority.
+     * `createTaskGroup` (`executionModel`). `worktree_merge` is retained as the
+     * wire label; locally it means reviewed bundles integrated in a disposable
+     * filesystem snapshot, with no Git requirement.
      */
     teamExecutionModel(): TeamExecution;
-    /**
-     * CP-14 Wave A — the ONE pinned group base SHA (memoized): `git rev-parse HEAD`
-     * in the workspace, captured at the FIRST track of the group, BEFORE any track
-     * shadow/branch is created, so every track roots at the same base (Stage-1
-     * MED-3). Concurrent callers share one rev-parse via the in-flight promise.
-     * Throws if HEAD can't be resolved (a non-git workspace is ineligible upstream).
-     */
-    private ensureGroupBaseSha;
     /**
      * CP-1.f execute-first (§4) — ensure the per-task SHADOW exists, creating it
      * BEFORE the round-0 spawn. Idempotent: round-0 + an early GATE_DISPATCH
@@ -1245,6 +1411,8 @@ export declare class QuorumLoop {
         agent: AgentKind;
         sessionKey: string;
         mode?: ImplementorMode;
+        /** Immutable team-generation authority captured at packet admission. */
+        teamAuthority?: TeamRunAuthority;
         /**
          * CP-12 W2.b (§3.C.2b option a / H3) — TEAM only. After `captureDiff` and
          * BEFORE submit, validate every changed file against the track's declared
@@ -1273,6 +1441,7 @@ export declare class QuorumLoop {
             text: string;
         };
     }): Promise<void>;
+    private runImplementorRoundOwned;
     /**
      * Extract the agent's informational stdout summary (audit-only; reviewers
      * never see it — they review the captured diff). Best-effort: a failure to
@@ -1290,7 +1459,7 @@ export declare class QuorumLoop {
      * Gemini/Antigravity are out of scope (undefined). NEVER throws — a read/parse
      * failure yields `undefined` (segment simply omitted), never breaks the round.
      */
-    private extractImplementorTokens;
+    private extractImplementorUsage;
     /**
      * PHASE-589/469 W1+W2 (LOCK #589-E/F/H) — on a TEAM track local hard-fail (any
      * of the 4 closed reasons: `verification_failure` / `out_of_scope_write` /
@@ -1372,6 +1541,50 @@ export declare class QuorumLoop {
      * `TaskGroupHalted` convergence is the authoritative group resolution).
      */
     reportTeamTrackUserResolved(taskId: string, postAction: PostDecisionAction): void;
+    /**
+     * H3 / Option B (#657) — emit the POSITIVE cancel-confirmation milestone on the
+     * final-approval CANCEL path. Final-approval "Do not apply. Leave the task in its
+     * current state" RETAINS the shadow and mutates nothing, so it triggers NEITHER
+     * the promote (`promoted`) NOR the discard (`discarded`) milestone — the decision
+     * was previously SILENT in non-TTY (a canceling user got no confirmation, and the
+     * E2E harness had no positive signal to assert, so an unwired/hung Cancel was
+     * indistinguishable from a correct one). This emits `not_applied` ("Not applied —
+     * your tree is unchanged") so the user AND the harness get a positive terminal
+     * that the Cancel actually resolved.
+     *
+     * SELF-GUARDING single source of truth: fires ONLY for a `final_approval_resolved`
+     * postAction whose `decision` is NOT `approve` (Approve promotes via the
+     * TaskAuthorized edge → `promoted`; Abort/Reject-restart discard → `discarded`; an
+     * `open_new_round`/`continuation_switch_*` postAction keeps working, no terminal).
+     * Reuses the SAME `approve`-vs-else discriminator the engine's
+     * `handle_final_approval` + `postActionTeamTrackState` use
+     * (`decision.trim().toLowerCase()`), so it can never diverge from the
+     * Passed/Failed track classification.
+     *
+     * Fires for BOTH single-impl and team tracks (unlike the team-only
+     * `reportTeamTrackUserResolved`) — every Cancel deserves the confirmation. Called
+     * by the shell's `onTerminalDecision` (the shared TTY + non-TTY gate-resolution
+     * chokepoint) after a successful `applyUserDecision`. `emitProgress` already wraps
+     * the listener so a throwing consumer can NEVER break the decision path. NO
+     * wire/schema change (progress is desktop-LOCAL) — `not_applied` carries ONLY the
+     * taskId (SECURITY INVARIANT: no user content, mirrors `discarded`).
+     */
+    reportFinalApprovalCancelled(taskId: string, postAction: PostDecisionAction): void;
+    /**
+     * Authoritative TaskGroupHalted bridge from LocalExecutor. Calling this async
+     * method publishes the terminal group fence synchronously (before its first
+     * await), then stops the actual QuorumLoop-owned pending/active implementors,
+     * drains their complete round coroutines and bundle publications, and retires
+     * every exact snapshot for the halted generation.
+     */
+    haltTeamTaskGroup(input: {
+        taskGroupId: string;
+        members: readonly {
+            taskId: string;
+            trackIndex: number;
+            dispatchGeneration: number;
+        }[];
+    }): Promise<void>;
     /**
      * CP-1.f execute-first — discard the task's shadow (a non-TaskAuthorized
      * terminal). Best-effort: a teardown failure is logged + leaves the durable
@@ -1420,6 +1633,18 @@ export declare class QuorumLoop {
          * process end — an accepted, documented residual.
          */
         preserveReviseContext?: boolean;
+        /**
+         * P10 E3 r4 (Stage-1 r4 M-1) — set by `onTerminalDecision` for the
+         * `restart_proposal` discard ONLY: the restart reuses the SAME taskId
+         * and runs a fresh round-0, so the `discarded` closer must NOT carry
+         * the taskId (a stamped closer would flip the session-listing record
+         * to 'cancelled' and the M3 no-resurrect guard would lock it there —
+         * even after the restarted task promotes). Deliberately does NOT touch
+         * the revise-context clear or `terminallyRetiredWorkspaceTasks` — a
+         * restart is a fresh round-0 (context cleared as before); ONLY the
+         * listing stamp is suppressed.
+         */
+        taskContinues?: boolean;
     }): Promise<void>;
     private discardShadowLocked;
     /**
@@ -1561,9 +1786,8 @@ export declare class QuorumLoop {
      *     path (that defeats the moat).
      *
      * TRI-STATE (decided here, mirroring the implementor LE):
-     *   1. No engager wired OR `CODEVIBE_SANDBOX_REVIEWERS` not opted in (DEFAULT
-     *      OFF; opt in with `=1`/`=true`) → LEGACY (byte-identical non-regression).
-     *      No badge.
+     *   1. No engager wired OR `CODEVIBE_SANDBOX_REVIEWERS=0` opted out (the gate
+     *      DEFAULTS ON — R7 A4) → LEGACY (byte-identical non-regression). No badge.
      *   1b. No resolvable taskId (cannot scope a per-task broker) → LEGACY + a
      *      reduced-trust badge (Stage-2 r1 Codex LOW — a trust-downgrade must be
      *      VISIBLE, never a silent ambient-cred fallback; see
@@ -1596,8 +1820,8 @@ export declare class QuorumLoop {
     private surfaceReviewerReducedTrust;
     /**
      * Wave B §2.1 confinement TRI-STATE for a merge-gate model/reviewer invocation
-     * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (opted in + a Trusted agent
-     * + engage succeeds → a handle; no ambient vendor cred in the child). Path B: a
+     * (LOCK #C14-MOAT). Path A: the CP-7 substrate/broker (not opted out + a Trusted
+     * agent + engage succeeds → a handle; no ambient vendor cred in the child). Path B: a
      * trusted-container boundary (legacy spawn confined by the OUTER container — the
      * dogfood/E2E path). Path C: neither → NOT confined. A path-A engage that
      * throws/reduced-trusts falls through to B/C (both safe: B confined, C refuses),
@@ -1641,8 +1865,9 @@ export declare class QuorumLoop {
      *     converting it into a per-slot spawn-time fail-close.
      *
      * Deliberately DECOUPLED from `engageWaveBConfinement` and its
-     * `CODEVIBE_SANDBOX_REVIEWERS` opt-in: that flag gates REVIEWER sandboxing
-     * (per-seat, `makeConflictModelCaller`, Tier-2) exactly as before — riding
+     * `CODEVIBE_SANDBOX_REVIEWERS` gate (default-ON, `=0` opts out — R7 A4):
+     * that flag gates REVIEWER sandboxing (per-seat, `makeConflictModelCaller`,
+     * Tier-2) exactly as before — riding
      * it here made the A1d resolver row unreachable on the default bare host.
      * The ladder select is side-effect-free (no launch, no broker); test seams
      * via `deps.resolverProbeDeps`.
@@ -1660,7 +1885,8 @@ export declare class QuorumLoop {
      *      DISPATCH-time engage could establish a confining substrate on this
      *      host (a real §6 Q2 ladder tier, or the preserved trusted-container
      *      posture). Deliberately DECOUPLED from `engageWaveBConfinement`'s
-     *      `CODEVIBE_SANDBOX_REVIEWERS` opt-in — that flag gates REVIEWER
+     *      `CODEVIBE_SANDBOX_REVIEWERS` gate (default-ON post-R7-A4) — that flag
+     *      gates REVIEWER
      *      sandboxing (seat/`makeConflictModelCaller`/Tier-2, unchanged), and
      *      riding it here made the A1d write-confined resolver row unreachable
      *      on the default bare-host path. Unwired → return `null` →
@@ -1760,6 +1986,26 @@ export declare class QuorumLoop {
      * re-delivered packet (or the next live edge) promotes it.
      */
     recoverShadows(): Promise<void>;
+    private recoverShadowsOwned;
+    /**
+     * Session-exit ownership boundary. Stop future creates, wait behind every
+     * in-flight per-task lifecycle operation, then synchronously reclaim each
+     * live snapshot. Startup TTL cleanup remains only the SIGKILL/power-loss
+     * fallback, not normal lifecycle management.
+     */
+    private reconcileUnresolvedBundleRetention;
+    private retireExactShadow;
+    /**
+     * Strict, exhaustive cleanup for task ids this loop owns. It first attempts
+     * every mapped exact instance, then performs a fresh authenticated marker
+     * enumeration and reopens/retire any same-task instance absent from memory.
+     * A final fresh enumeration is the convergence proof. Live foreign owners and
+     * unresolved authority are preserved, but returned as explicit failures.
+     */
+    private cleanupOwnedTaskSnapshots;
+    disposeWorkspaces(opts?: {
+        strict?: boolean;
+    }): Promise<void>;
     /**
      * §4.3 — true while a team recovery is seeding briefs (the startup barrier is
      * down). The Class B consume path checks this to BUFFER a live TEAM packet
@@ -1769,17 +2015,18 @@ export declare class QuorumLoop {
      */
     isRecoverySeeding(): boolean;
     /**
-     * §4.3 (Stage-2 r1 Codex MED) — true if `(taskGroupId, trackIndex)` carries a
-     * corrupt-brief TOMBSTONE. The LE consults this at the TOP of `launchTrack`
+     * §4.3 (Stage-2 r1 Codex MED) — true if the complete team generation carries
+     * a corrupt tombstone or is stale relative to recovered authority. The LE
+     * consults this at the TOP of `launchTrack`
      * (before any register / spawn / lease-renewing progress emit) so a tombstoned
      * track is refused on the LIVE path as early as on the recovery path — never
      * spawning an empty-brief implementor or mutating registry state for it. The
      * engine sweeper times the un-launched track out (bounded).
      *
-     * CP-12 W4 (#593 Stage-2 r2): keyed by `(taskGroupId, trackIndex)` so a corrupt
-     * brief in group A never blocks a different group B's track with the same index.
+     * Production supplies taskId + dispatchGeneration. The optional form remains
+     * only for backward-compatible diagnostics/tests.
      */
-    isTrackTombstoned(taskGroupId: string, trackIndex: number): boolean;
+    isTrackTombstoned(taskGroupId: string, trackIndex: number, taskId?: string, dispatchGeneration?: number): boolean;
     /**
      * #592 PROVENANCE GUARD (live path) — true if `taskGroupId` is a team group this
      * desktop did NOT originate AND this desktop owns ≥1 group. Wired to the LE's
@@ -1883,6 +2130,8 @@ export declare class QuorumLoop {
      * so this method just seeds + relaunches (it is always invoked under a barrier
      * that is already down, and may run multiple times within one barrier window).
      */
+    private normalizeTeamRecoveryRow;
+    private normalizeTeamRecoveryRows;
     recoverTeamTracks(rows: TeamTrackRecoveryRow[]): Promise<void>;
     /**
      * §4.1 PASS 2 (one row) — validate → recoverLaunchTrack → repair-on-duplicate →
@@ -2047,6 +2296,7 @@ export declare class QuorumLoop {
         decision: string;
         action: PostDecisionAction;
     }): Promise<void>;
+    private onApplyUserDecisionEchoOwned;
     /**
      * #585 §3.5 / #C10M-11/13 — resume the task with the user's chosen agent.
      * The SERVER has ALREADY minted the `nextGateId` row + advanced to
@@ -2063,6 +2313,7 @@ export declare class QuorumLoop {
     resumeFromContinuation(input: {
         taskId: string;
         targetAgent: AgentKind;
+        sourceGateId?: string;
         nextGateId: string;
         nextRound: number;
     }): Promise<boolean>;

package/dist/orchestration-shell/reducer.d.ts

@@ -6,3 +6,12 @@ export declare const CONVERSATION_BUFFER_MAX = 500;
  * mutates `state` in place. Map fields are cloned via `new Map(state.x)`.
  */
 export declare function reducer(state: OrchestrationState, action: OrchestrationAction): OrchestrationState;
+/**
+ * P10 E3 r6/r8 — "is a single-implementor task actually running?" from the
+ * TRUTHFUL `sessionTasks` lifecycle (the task-end closers terminalize it;
+ * `runningTasks` never terminalizes in production and is kept ONLY for the
+ * decision-spawned-a-task size heuristic). Shared by the `/status` running
+ * line, `deriveCurrentTaskState` (the planner packet), and the reviewer-line
+ * SET guard below.
+ */
+export declare function hasRunningSingleTask(state: OrchestrationState): boolean;