@quantiya/codevibe-core 2.0.91 → 2.0.93

package/dist/orchestration-shell/components/OrchestrationApp.d.ts

@@ -4,7 +4,7 @@ import { OrchestrationStore } from '../store';
 import { ConversationEntry, PostDecisionAction, Tier } from '../types';
 import type { PlannerRuntimeKind } from '../status-format';
 import type { UpdateReviewerPolicyInput, UserReviewerPolicySnapshot } from '../../types/reviewer';
-import { type ApplyUserDecisionClient as SharedApplyUserDecisionClient, type GroupDecisionSubmitDeps } from '../gate-decision-submit';
+import { type ApplyUserDecisionClient as SharedApplyUserDecisionClient, type GateDecisionSubmitDeps, type GroupDecisionSubmitDeps } from '../gate-decision-submit';
 import { type CompanionSyncStateSource } from '../../appsync/sync-state';
 import { type CompanionSyncWarningStore } from '../../appsync/sync-usage-warning';
 /** P46b §3.7 — at most this many per-task progress lines render (`+n more` after). */
@@ -114,6 +114,11 @@ export interface OrchestrationAppProps {
      * (rejected) shadow, not the restart's fresh one. ABSENT → no capture (no-op).
      */
     captureShadow?: (taskId: string) => unknown;
+    /**
+     * Decision delivery after an unknown outcome: the same object the non-TTY path uses, so an ambiguous submit made on
+     * the screen is retried during the session as well (w6jheld: it stayed at "Confirming decision…" for 53 minutes).
+     */
+    decisionDelivery?: Pick<GateDecisionSubmitDeps, 'decisionAttemptReceiptStore' | 'onDecisionDeliveryAmbiguous' | 'acknowledgeDelayedRejection'>;
     /**
      * PHASE-589/469 W3.2 — the two-phase group-escalation decision transport.
      * Present ONLY for a TEAM session (built in `cli.ts`, completed in

package/dist/orchestration-shell/decision-attempt-recovery.d.ts

@@ -70,3 +70,17 @@ export declare function recoverDecisionAttemptReceipts(args: {
     onResolutionEvent: (event: Event) => Promise<DurableGateResolution | null> | DurableGateResolution | null;
     onActionableRejection: (receipt: DecisionAttemptReceipt, rejectionCode: string) => void;
 }): Promise<void>;
+export interface LiveDecisionAttemptRecovery {
+    schedule(): void;
+    stop(): void;
+}
+/**
+ * g3paths4: an ambiguous submit stays fenced "and will recover automatically", but only a shell start ran the recovery
+ * pass, so one backend error left an Approve stuck for the rest of the session. This runs the same pass during a session,
+ * the exact-resubmit it does being safe by design, until no receipt is left.
+ */
+export declare function createLiveDecisionAttemptRecovery(args: {
+    recover: () => Promise<void>;
+    hasPending: () => Promise<boolean>;
+    delaysMs?: readonly number[];
+}): LiveDecisionAttemptRecovery;

package/dist/orchestration-shell/engine-projection.d.ts

@@ -0,0 +1,98 @@
+import { type ShadowChangeKind } from '../local-executor/shadow-protocol';
+export declare const PROJECTION_BUDGET_BYTES: number;
+export declare const PROJECTION_INLINE_MAX_BYTES: number;
+export declare const PROJECTION_EXCERPT_MAX_BYTES: number;
+export declare const PROJECTION_BRIEF_MAX_BYTES: number;
+export declare const PROJECTION_SUMMARY_MAX_BYTES = 1024;
+export declare const PROJECTION_MANIFEST_PATH = "CODEVIBE-MANIFEST";
+/** One changed file as the projection sees it. Content is read lazily, so a large file is never held whole. */
+export interface ProjectionFile {
+    path: string;
+    change_kind: ShadowChangeKind;
+    mode?: number;
+    /** Byte length of the full post-image (0 for a deletion). */
+    size: number;
+    /** SHA-256 (hex) of the full post-image ('' for a deletion). */
+    sha256: string;
+    /** The whole post-image; called only when `size` ≤ {@link PROJECTION_INLINE_MAX_BYTES}. */
+    readWhole(): Promise<string>;
+    /**
+     * The first `maxBytes` (raw, cut at a character boundary) of the excerpt source — the unified diff for a
+     * modification, the file for a creation. The identity line's `<size>` is the full post-image's, the same bytes its
+     * SHA-256 names, so a file listed by its identity line alone is never read or diffed.
+     */
+    readExcerpt(maxBytes: number): Promise<string>;
+}
+export interface ProjectedFile {
+    path: string;
+    change_kind: ShadowChangeKind;
+    content: string;
+    mode?: number;
+}
+export interface ProjectedPayload {
+    kind: 'execute_first_diff';
+    task_brief: string;
+    summary?: string;
+    files: ProjectedFile[];
+}
+export interface ProjectionInput {
+    taskBrief: string;
+    summary: string;
+    files: readonly ProjectionFile[];
+    /** Root hash of the change manifest (§9.4), named by a `CODEVIBE-MANIFEST` entry when the list is cut. */
+    manifestRootHash: string;
+    /** Test seam: the serialized budget. */
+    budgetBytes?: number;
+}
+/** Bytes a string takes inside the serialized payload (its JSON string literal, quotes included). */
+export declare function serializedBytes(text: string): number;
+/**
+ * §9.4 brief/summary rule: a field whose serialized form exceeds `max` is sent as
+ * `[codevibe-<label> v1] first <k> of <n> bytes; sha256 <hex>; review bundle: INDEX.md` followed by its longest
+ * prefix for which identity line and prefix together serialize to at most `max` (`<k>` = that prefix's raw bytes).
+ */
+export declare function cutFieldToSerialized(text: string, max: number, label: 'brief' | 'summary'): string;
+/**
+ * The files the engine receives in a payload this module built — what its #EF-1 empty-artifact rule sees (a large or
+ * excerpted file reaches it as an identity line, not as the raw capture's content). Throws on a payload it did not build.
+ */
+export declare function projectedPayloadFiles(rawOutput: string): ProjectedFile[];
+/**
+ * Build the engine payload: the change projected into at most `budgetBytes` of serialized JSON.
+ *
+ * Sizes are summed per entry, never by re-serializing the payload, and content is read only for files that can be
+ * sent: a change too large for its identity lines (roughly 160 files and more) reads nothing at all.
+ */
+export declare function projectExecuteFirstPayload(input: ProjectionInput): Promise<string>;
+/** Cut `text` to at most `maxBytes` raw bytes at a character boundary. */
+export declare function headBytes(text: string, maxBytes: number): string;
+/**
+ * The first `maxBytes` of a unified diff of `base` → `after`, computed in linear time: common leading and trailing
+ * lines are trimmed and the changed middle is shown as one hunk with 3 lines of context. An excerpt only — the review
+ * bundle holds the full diff (§8.1) — so a 16 MiB file never needs an LCS table.
+ */
+export declare function excerptDiff(path: string, base: string, after: string, maxBytes: number): string;
+/**
+ * A captured file as a projection input. §9.4: the capture holds references only, so a reference entry's size and
+ * SHA-256 come from its blob and its text is read only when the projection needs it — whole for an inline file
+ * (≤ 24 KiB serialized, so small), for the diff of an excerpt (≤ LARGE_TEXT_BYTES), never for a large file (its head).
+ */
+export declare function projectionFileFromCapture(file: {
+    path: string;
+    change_kind: ShadowChangeKind;
+    content: string;
+    mode?: number;
+    blob?: {
+        blob: string;
+        size: number;
+    };
+}, 
+/** The pre-task text when the real file still matches its recorded base hash; null otherwise (S2-5). */
+readBase: () => Promise<string | null>, 
+/**
+ * P63 Slice 2 (§9.4 W3d): the first bytes of a LARGE entry's blob. A large file is always over the inline bound, so
+ * only its excerpt — the head of the file, never a diff — is ever read.
+ */
+readLargeHead?: (maxBytes: number) => Promise<Buffer>, 
+/** §9.4: the text of a reference entry up to LARGE_TEXT_BYTES, read from its blob (required for one). */
+readText?: () => Promise<string>): ProjectionFile;

package/dist/orchestration-shell/exit-guard.d.ts

@@ -0,0 +1,18 @@
+/** How long a clean `process.exit` may take before the watchdog ends it. */
+export declare const EXIT_GUARD_GRACE_MS = 10000;
+/**
+ * N5 (Stage 1 R2): the identity is read the same way here and in the watchdog — the same arguments (`-ww`: never cut
+ * to a terminal width) and the same environment (`LC_ALL=C` for `lstart`'s date format, no inherited `COLUMNS`) — so a
+ * difference in width or locale between this process and the detached watchdog can never make them disagree.
+ */
+export declare const PS_IDENTITY_ARGS: readonly string[];
+export declare const PS_IDENTITY_ENV: Readonly<Record<string, string>>;
+/** `ps -ww -o lstart=,command=` for one pid — the identity the watchdog re-checks before it signals. */
+export declare function processIdentity(pid: number): string | null;
+/** The watchdog program (run by `process.execPath -e`): argv = pid, identity, grace ms. */
+export declare const EXIT_GUARD_SCRIPT: string;
+/**
+ * Arm the watchdog for this process, then `process.exit(code)`. Arming never throws: if it cannot start (no `ps`,
+ * spawn failure) the exit proceeds as before.
+ */
+export declare function exitWithGuard(code: number, graceMs?: number): never;

package/dist/orchestration-shell/gate-decision-submit.d.ts

@@ -35,6 +35,8 @@ export interface GateDecisionSubmitDeps {
     getSessionKey: (sessionId: string) => Promise<string | null>;
     /** Optional override for isolated tests; production uses the durable 0600 store. */
     decisionAttemptReceiptStore?: DecisionAttemptReceiptStoreSurface;
+    /** A submit's outcome is unknown and its receipt is fenced: production keeps retrying it during the session. */
+    onDecisionDeliveryAmbiguous?: () => void;
     /**
      * Production effect-completion barrier for a response that loses after the
      * winner Event was already classified. It returns false when no matching

package/dist/orchestration-shell/index.d.ts

@@ -124,6 +124,7 @@ export interface RunOrchestrationShellArgs {
      * (the resume entry point then releases P's resume lock).
      */
     resume?: {
+        predecessorSessionId: string;
         restoredItems: import('./context-items').ContextItem[];
         markerSeq: string;
         header: {
@@ -721,6 +722,11 @@ export declare function composeTeamTrackBrief(trackDescription: string, sourceBr
 export type LaunchTeamOutcome = {
     kind: 'accepted';
     taskGroupId: string;
+}
+/** P63 §6.4 — a track's agent cannot be confined here; the opt-in question was asked, nothing was created. */
+ | {
+    kind: 'confinement_refused';
+    reason: string;
 } | {
     kind: 'disjointness_rejected';
     rejection: DisjointnessRejection;
@@ -776,6 +782,8 @@ export declare function launchTeamFromWorkItems(deps: {
     attachmentPaths?: string[];
     /** P46b §3.10 — the failed group this launch retries (the new group is `#m retry`). */
     retryOf?: string;
+    /** P63 §6.4 — the user opted in to running this group's tracks unconfined (re-issued launch after the question). */
+    allowUnconfined?: boolean;
 }): Promise<LaunchTeamOutcome>;
 /**
  * PHASE-589/469 W3.2 RESIDUAL 1 — re-dispatch the WHOLE team for a
@@ -808,6 +816,16 @@ export declare function reissueTeamFromRetainedSpec(deps: {
  * from the backend rather than an opaque generic failure.
  * Sanitizes terminal escapes, redacts absolute paths, and caps display length.
  */
+/** The confirm-before-start reply matcher: only these replies start a task (§6.4 reuses it for the opt-in). */
+export declare function isAffirmativeStartReply(text: string): boolean;
+/**
+ * P63 §6.4 — a START the loop refused because its implementor cannot be confined on this machine does not start: the
+ * desktop (and, through the planner question, the phone) says why and how to fix it, and offers to run it unconfined
+ * THIS ONCE. Any other refusal keeps today's advisory.
+ */
+export declare function surfaceStartRefusal(store: OrchestrationStore, quorumLoop: QuorumLoop | undefined): void;
+/** P63 §6.4 — asks the opt-in question when the loop's last START was a confinement refusal; true when it asked. */
+export declare function askConfinementOptIn(store: OrchestrationStore, quorumLoop: QuorumLoop | undefined): boolean;
 export declare function formatStartTaskRejection(errorOrLoop: unknown): string;
 /**
  * PHASE-590 §3.D — the `team_decompose` routing path. Runs the local decomposer,

package/dist/orchestration-shell/quorum-loop.d.ts

@@ -2,6 +2,7 @@ import * as fsSync from 'node:fs';
 import type { AppSyncClient, TeamTrackRecoveryRow } from '../appsync/appsync-client';
 import type { SyncSecurityPosture } from '../appsync/sync-security-posture';
 import type { Session } from '../types';
+import { type ReviewerSeatSelfTestConfig } from './reviewer-seat-self-test';
 import type { LocalExecutor } from '../local-executor';
 import type { ClassBInbound, QueuedWorkEndedPayload } from '../local-executor/types';
 import type { ImageAttachment } from './types';
@@ -327,28 +328,9 @@ export interface ResolverIntentContext {
  * not import (they only help it converge).
  */
 declare function renderAgenticResolveBrief(conflictedPaths: readonly string[], implementorRationale?: string | null, intent?: ResolverIntentContext): string;
-/**
- * CP-7 §8 (Stage-1-resolved) — the narrow result the QuorumLoop consumes from
- * the reviewer substrate engager. Mirrors `SubstrateLaunch.EngageResult` /
- * `LocalExecutorImpl.SubstrateEngageResult` but is declared STRUCTURALLY here
- * (not importing the concrete `engageSubstrate`) so the loop module stays
- * decoupled and tests inject a stub. Two variants:
- *  - `substrate` (the moat is ON for this seat — the loop threads
- *    `substrateHandle` into `evaluate` + calls `teardown()` when the seat
- *    completes, on EVERY path).
- *  - `reduced_trust` (the moat is OFF for this seat — A5 coarse host with no
- *    runtime / Gemini non-Trusted: the loop runs the reviewer on the LEGACY
- *    unsandboxed path + surfaces the reduced-trust badge).
- *
- * THROW semantics (fail-closed): the engager THROWS for a Trusted agent when
- * the broker cannot start (or any non-`reduced_trust` engage failure). The
- * loop treats a throw as FAIL-CLOSED — it does NOT silently fall back to the
- * ambient-cred legacy path (that would defeat the moat); it synthesizes a
- * clean ESCALATE so the gate resolves rather than hangs.
- */
 export type ReviewerSubstrateEngageResult = {
     mode: 'substrate';
-    tier: 'docker' | 'sandbox_exec';
+    tier: 'docker' | 'sandbox_exec' | 'bubblewrap';
     reducedTrust: boolean;
     reducedTrustReason?: string;
     substrateHandle: SubstrateHandle;
@@ -376,8 +358,24 @@ export type ReviewerSubstrateEngager = (input: {
     taskId: string;
     /** The reviewer's lowercase agent (the loop maps it to UPPERCASE inside the wiring). */
     agent: ReviewerAgentKind;
-    /** Canonical host workdir the sandbox mounts (the loop's working dir). */
+    /** Canonical host workdir the sandbox mounts — P63 Slice 2 (§8.2): the seat's private scratch. */
     workdir: string;
+    /** P63 Slice 2 (§8.2) — the seat's read-only grants (review bundle; macOS: masked original). */
+    reviewGrants?: {
+        bundleDir: string;
+        maskedOriginal?: {
+            dir: string;
+            changedWithheld: readonly string[];
+        };
+    };
+    /**
+     * P63 Slice 2 (§8.2) — an Antigravity review seat engages the agy write-confined row (private home, writes = its
+     * scratch + that home, reads = the review grants) instead of the unconfined legacy path. Set only for agy seats with a
+     * review round; the wiring maps it to `engageSubstrate({ requireConfined: true })`.
+     */
+    requireConfined?: boolean;
+    /** P63 §6.1 / §6.2 — the user's real project folder (the grant rule hides it and never grants a root containing it). */
+    projectRoot?: string;
 }) => Promise<ReviewerSubstrateEngageResult>;
 export type ReviewerSafetyNoticeSink = (message: string, posture: SyncSecurityPosture) => Promise<void>;
 export interface QuorumLoopDeps {
@@ -434,6 +432,29 @@ export interface QuorumLoopDeps {
      * when this engager is wired (see `reviewerSandboxingEnabled`).
      */
     engageReviewerSubstrate?: ReviewerSubstrateEngager;
+    /** P63 §6.4 — the read-only tier self-test before a reviewer's first confined seat. Absent → none (tests, embedders). */
+    reviewerSeatSelfTest?: ReviewerSeatSelfTestConfig;
+    /**
+     * P63 Slice 2 (§8.1–§8.2) — the per-task folder that holds a task's review rounds (`review/<gate>/{bundle,seat-<n>}`).
+     * Production wires `taskFolderFor` (Stream A's folder). Absent → no review round: seats keep today's working
+     * directory (the pre-Slice-2 path, byte-identical — and no test ever writes into the user's real cache).
+     */
+    reviewTaskFolder?: (taskId: string) => string;
+    /**
+     * P63 §6.4 — can an implementor of this agent be confined on this machine? Asked by `startTask` before a task
+     * starts (production wires `SubstrateLaunch.confinementPreflight`). A task whose agent cannot be confined does not
+     * start; the shell asks the user whether to run it unconfined this once (`takeConfinementRefusal`). Absent → no
+     * preflight (tests); the LE still refuses any unconfined spawn the user did not opt into.
+     */
+    confinementPreflight?: (input: {
+        agentKind: AgentKind;
+        webTurn: boolean;
+    }) => Promise<{
+        confinable: true;
+    } | {
+        confinable: false;
+        reason: string;
+    }>;
     /**
      * A1e (P3 slice-wiring REMAP) — compose the bounded repository-context
      * block for a task dispatch: the resolved `context_ref` structural slice
@@ -527,6 +548,8 @@ export interface QuorumLoopDeps {
         reapOrphanShadows?: (keepTaskIds: ReadonlySet<string>, env: ShadowEnv) => Promise<{
             reaped: string[];
             retained: string[];
+            spawnBlockedTaskIds?: ReadonlySet<string>;
+            spawnSweepFailed?: boolean;
         }>;
     };
     /**
@@ -771,6 +794,8 @@ export interface ApplyConflictMenu {
     agent: AgentKind;
 }
 export declare class QuorumLoop {
+    /** P63 §6.4 — one reviewer-seat self-test per key at a time. */
+    private readonly seatSelfTestsInFlight;
     private readonly deps;
     private readonly sleep;
     private workspaceOutcomeSink?;
@@ -814,6 +839,41 @@ export declare class QuorumLoop {
     private lastStartError;
     /** Retrieve the last error message from a rejected or failed startTask call. */
     getLastStartError(): string | null;
+    /**
+     * P63 §6.4 — the last START refused because its agent cannot be confined here: the reason, and the exact start
+     * arguments, so the user's "yes, run it unconfined this once" re-issues that same start with `allowUnconfined`.
+     * Taking it clears it.
+     */
+    private lastConfinementRefusal;
+    takeConfinementRefusal(): {
+        reason: string;
+        startArgs: Parameters<QuorumLoop['startTask']>[0];
+    } | null;
+    /** P63 §6.4 — tasks the user opted into running unconfined (their implementor spawns carry `allowUnconfined`). */
+    private readonly unconfinedOptInTasks;
+    isUnconfinedOptIn(taskId: string): boolean;
+    /**
+     * S2-C3 (Stage 2 R1) — tasks reopened after a crash whose earlier run was opted in to run unconfined (their task
+     * intent says so). History only: it keeps the after-run folder check and the summary's disclosure; it never lets a
+     * spawn run unconfined (`unconfinedOptInTasks` alone does that).
+     */
+    private readonly ranUnconfinedBeforeReopen;
+    /** §6.4 — this task's work was done by an agent running unconfined (opted in now, or before a crash reopened it). */
+    private ranUnconfined;
+    /** P63 §6.4 — Agent Teams groups the user opted into running unconfined (every track spawn carries the opt-in). */
+    private readonly unconfinedOptInGroups;
+    markTeamGroupUnconfined(taskGroupId: string): void;
+    /**
+     * P63 §6.4 — can this agent's implementor be confined here for this request? The same web decision the spawn makes
+     * (`isWebAccessNeeded` over the user's own request, Claude/agy only). No preflight wired → confinable (the LE still
+     * refuses any unconfined spawn without the opt-in).
+     */
+    preflightConfinement(agent: AgentKind, request: string): Promise<{
+        confinable: true;
+    } | {
+        confinable: false;
+        reason: string;
+    }>;
     /** Non-terminal tasks for which `/review-reset` may arm the next revise round. */
     private readonly reviewScopeResetEligibleTasks;
     private taskEpoch;
@@ -886,6 +946,16 @@ export declare class QuorumLoop {
      * START call (in flight) until the task's terminal cleanup; `retryOf` links a
      * `#n retry` task to its `apply_failed` original (P46a C2/C3).
      */
+    /** F-RESTART-NOT-RESUMED (§17) — the session this one resumes; its stopped tasks are reopened at startup. */
+    private resumedFromSessionId;
+    /** The planner decision behind each single task, kept for its durable intent record. */
+    private readonly startDecisionByTask;
+    /** A reopened task's first round: no agent runs, the copy it inherited is captured as this round's work. */
+    private readonly reopenedRoundTasks;
+    /** Instances reopened under a new task id; a later recovery pass keeps them and never registers them twice. */
+    private readonly reopenedStateFiles;
+    private readonly reopenedFromTaskIds;
+    private readonly reopenedTaskIds;
     private readonly singleTaskContextByTask;
     /** Agent web browsing (upstream 2.0.37) — whether a task's ORIGINAL request needs web access; ends with the task (`forgetSingleTask`, team cleanup). */
     private readonly webAccessByTask;
@@ -1448,6 +1518,39 @@ export declare class QuorumLoop {
      * instance on promote/discard.
      */
     private readonly reviewedSnapshotByTask;
+    /**
+     * P63 Slice 2 (§8.1–§8.2) — one review round per gate: the read-only bundle every seat reads (built once, before the
+     * first seat) and its hash record for the return check. Null for a gate with no reviewed snapshot (e.g. a merge
+     * gate) — those seats keep today's working directory.
+     */
+    private readonly reviewStateRemovalByTask;
+    private readonly reviewRounds;
+    /**
+     * S2-C1 — per gate, each running seat's current attempt: the round generation it reviews, and a promise settled when
+     * its return check is over (or the seat ends). A seat whose check passed waits for the others of its generation, so a
+     * changed bundle found by any of them discards every verdict of that generation, not only the finder's.
+     */
+    private readonly seatChecksByGate;
+    /**
+     * R2-F1 / R3-F1 (Stage 2 R3) — per gate, the seats whose terminal verdict the engine has CONFIRMED (the submission
+     * returned). Only these count as finished at the gate barrier: a seat whose run ended without a confirmed submission
+     * (a failed submit, a dropped spawn) can still be re-spawned by recovery, so it stays pending.
+     */
+    private readonly confirmedSeatsByGate;
+    /**
+     * R4-F1 / R5-F1 (Stage 2 R4/R5, Hendry's rules 2/3) — a seat whose verdict could not be CONFIRMED after its retries:
+     * the verdict it owes is its OWN original verdict and generation, never a substitute. A lost acknowledgement may mean
+     * the engine already holds it (the first verdict per seat wins), so any resend must be the same verdict. A recovery
+     * re-spawn and the timed resend (R5-F2) send it again; the seat is never reviewed again.
+     */
+    private readonly pendingVerdictBySeat;
+    /** R5-F2 — the timed resend of each owed verdict (task-owned; cleared on confirmation, an abandoned gate or shutdown). */
+    private readonly owedVerdictResendTimers;
+    /** R5-F2 — the wait between timed resends of an owed verdict, and how many are tried (test-overridable). */
+    private owedVerdictResendIntervalMs;
+    private owedVerdictResendTries;
+    /** R4-F1 — the waits between a failed verdict send and its retries (test-overridable). */
+    private verdictSendRetryDelaysMs;
     /** Guards concurrent shadow-create for the same task (round-0 + an early re-deliver). */
     private readonly shadowCreateInFlight;
     /**
@@ -1474,6 +1577,10 @@ export declare class QuorumLoop {
     private readonly backgroundRecoveryAbortControllers;
     /** Once set, no new implementor workspace may be created for this session. */
     private shuttingDown;
+    /** §9.3: the next 10-second retry of each task with a no-link step left pending. */
+    private readonly noLinkRestoreRetries;
+    /** What the attempt that left a step pending knew and cleared; the retry's promotion is the same approved task. */
+    private readonly noLinkRetryContexts;
     private awaitBackgroundRecoveryStep;
     /**
      * Serialize one shadow lifecycle op for `taskId` behind any in-flight op for
@@ -1555,6 +1662,16 @@ export declare class QuorumLoop {
         conflicts: readonly string[];
         writeErrors: readonly string[];
     }): void;
+    /** The team's changes could not be merged: nothing was applied, so there is no menu — the notice names the files. */
+    reportTeamMergeConflict(info: {
+        taskGroupId: string;
+        paths: readonly string[];
+        workLimit: boolean;
+    }): void;
+    /** The merge could not be finished: without this the team only shows pending, with nothing to say why. */
+    reportTeamMergeUnresolved(info: {
+        taskGroupId: string;
+    }): void;
     /** P46b §3.13 item 1 — install the task lifecycle sink (the shell). */
     setTaskLifecycleSink(sink: ((event: TaskLifecycleEvent) => void) | undefined): void;
     /** P46b — notify the lifecycle sink; a throwing sink never breaks the loop. */
@@ -1758,6 +1875,17 @@ export declare class QuorumLoop {
          * read this instead. Omitted for an ordinary task (its brief IS the request).
          */
         request?: string;
+        /**
+         * P63 §6.4 — the user answered yes to running this task unconfined because its agent cannot be confined here.
+         * Skips the preflight and marks the task so its implementor spawns may run without a confining tier.
+         */
+        allowUnconfined?: boolean;
+        /** F-RESTART-NOT-RESUMED — this task continues a stopped one in the copy it left; no agent runs in round 0. */
+        reopen?: {
+            fromTaskId: string;
+            shadow: WorkspaceShadow;
+            ranUnconfined?: boolean;
+        };
     }): Promise<StartTaskResultInfo | null>;
     /**
      * CP-1.f Wave 3 FIX — consume a GATE_DISPATCH packet. The engine emits this
@@ -2011,6 +2139,19 @@ export declare class QuorumLoop {
      * server-side is the one lossy edge (the engine may revise while the desktop
      * cleared) — that degrades to the pre-A1b contextless brief, never worse.
      */
+    /**
+     * P63 Slice 2 (§9.4) — the execute-first payload for a captured change. A modified file's excerpt is its diff
+     * against the pre-task text, read from the real folder only while that file still has its recorded base hash
+     * (ledger S2-5); otherwise the excerpt is the head of the new content.
+     */
+    private projectSubmission;
+    /**
+     * P63 §6.4 — an implementor spawn the LE refused because it cannot be confined and the user did not opt in. The
+     * task stops visibly: a team track is reported failed; a single task's round submits the empty artifact, which the
+     * engine born-halts (so the hosted task does not wait for the sweeper). The copy is discarded either way; the real
+     * folder was never touched.
+     */
+    private haltRefusedImplementorSpawn;
     private reportTeamTrackFailure;
     /**
      * No-op UX (#1) — report the BENIGN no-change terminal for a TEAM track that
@@ -2255,6 +2396,9 @@ export declare class QuorumLoop {
      */
     private promoteApplyLocked;
     /** #SR-2 — surface a halt/fail-closed message to the user (or log if unwired). */
+    private scheduleNoLinkRestoreRetry;
+    /** §9.3: silent while the step stays pending. Once none is, the ordinary promotion finishes the task and reports it. */
+    private retryNoLinkRestore;
     private surfaceHalt;
     /**
      * PHASE-598 — the thin wiring that supplies the real fs/shell deps to the pure
@@ -2378,7 +2522,64 @@ export declare class QuorumLoop {
      * `teardown()` is ALWAYS safe to call (a no-op on the legacy path); the caller
      * invokes it in a `finally` so a sandbox never leaks.
      */
+    /**
+     * P63 Slice 2 (§8.1) — build (once per gate) the read-only review bundle in the task folder from the reviewed
+     * snapshot's verified blobs; null when the gate has no reviewed snapshot or no shadow (merge gates, legacy paths).
+     * The round folder is task-owned scratch: a previous attempt's bundle for the same gate is replaced, never reused.
+     */
+    /**
+     * P63 Slice 2 (§8.1–§8.2, W5 step 5) — drop a task's shadow-map entry AND schedule removal of its review rounds and
+     * capture dirs (`<task folder>/review/`, `<task folder>/capture/`): every path that ends a task's workspace (promote,
+     * discard, halt, restart-replace) goes through here, so full-copy bundles never outlive their task.
+     */
+    private forgetTaskShadow;
+    /** Serialized per task; a new round for the task waits for it (`ensureReviewRound`). Never rejects. */
+    private scheduleTaskReviewStateRemoval;
+    /** @internal — await any scheduled review-state removal for a task (tests). */
+    _awaitReviewStateRemovalForTests(taskId: string): Promise<void>;
+    private ensureReviewRound;
+    /**
+     * §8.1 / §8.5 — a seat's return check: the bundle still matches the hashes recorded when it was built (nothing
+     * else in it), then every receipt request is answered correctly. null = accepted.
+     */
+    private checkSeatReturn;
+    /**
+     * §8.1 — a bundle found changed is rebuilt IN PLACE from the same verified blobs (only `bundle/`: the round folder
+     * also holds the other seats' live scratch), and the gate moves to a new generation (S2-C1): every seat that reviewed
+     * the old one is re-dispatched. Serialized on the gate's round promise; a seat that saw an older generation than the
+     * current one reuses the rebuild another seat already did. The rebuild is byte-identical.
+     */
+    private rebuildReviewBundle;
+    /** S2-C1 — record this seat's attempt on the gate's generation (replacing its previous attempt). */
+    private beginSeatCheck;
+    /** S2-C1 — this seat's return check is over (idempotent). With `remove`, the seat has ended. */
+    private settleSeatCheck;
+    /**
+     * S2-C1 / R2-F1 (Stage 2 R2) — §8.1 "any difference discards the gate's verdicts and re-dispatches the seats", for
+     * the WHOLE gate. After this seat's own check passed it is accepted only when:
+     *   1. the engine's own list of the seats assigned to this gate (`getInReviewAssignments`, the dropped-packet recovery
+     *      primitive) can be read and contains this seat;
+     *   2. every OTHER assigned seat has either a CONFIRMED terminal verdict (R3-F1) or settled a return check at this
+     *      same generation — a seat not yet
+     *      registered (its dispatch or prompt fetch is slow), or still on an older generation, is waited for; one on a
+     *      newer generation means the gate already moved on;
+     *   3. the gate's round still exists and is still at this generation.
+     * Anything else — the list unreadable, this seat missing from it, the round missing or its rebuild failed, or the wait
+     * passing one seat timeout — is NOT a hold: the verdict is discarded (re-dispatch, or ESCALATE on the second attempt).
+     */
+    private gateGenerationHolds;
     private engageSeatSubstrate;
+    /** P63 §6.4 — why this confined seat may not run (its read-only tier self-test failed), or null. */
+    private seatSelfTestFailure;
+    /**
+     * P63 Slice 2 (§8.2) — engage an Antigravity review seat in the agy write-confined row (macOS Seatbelt with a
+     * private home per spawn): writes = the seat's scratch + that home; reads = the bundle (+ the masked original on
+     * macOS). Where the row cannot be established (no sandbox tier on this host, or the container tier) the seat runs
+     * on the legacy path with the reduced-trust badge — the same posture a Claude or Codex seat gets on such a host —
+     * and its provider still points agy at the bundle, not the user's folder. An engage FAILURE fails closed (the
+     * caller turns the throw into a clean ESCALATE).
+     */
+    private engageConfinedAgySeat;
     /**
      * CP-7 §8 (Stage-1-resolved) — surface the PROMINENT reduced-trust badge for a
      * reviewer seat (mirrors the implementor's badge, scoped to the loop's
@@ -2544,6 +2745,37 @@ export declare class QuorumLoop {
      * @param reasoning the final clean wire `reasoning` (already a fixed template).
      */
     private synthesizeEscalate;
+    /**
+     * R4-F1 / R5-F1 (Hendry's rules 2/3): send a seat's verdict. When it cannot be CONFIRMED even after its retries, the
+     * seat owes that same verdict: the user is told the gate is waiting for it (not that it escalated: the engine may already
+     * hold it), and it is sent again by a timed, task-owned resend (R5-F2) and by any recovery re-spawn.
+     */
+    private deliverVerdict;
+    /** R5-F2 — resend an owed verdict on a timer, independent of any reconnect; bounded, stops when it no longer applies. */
+    private scheduleOwedVerdictResend;
+    /**
+     * R4-F1 / R5-F1/F2 — send a seat's owed verdict again (the same verdict and generation). True once confirmed, or when it
+     * no longer applies (the gate was abandoned, or nothing is owed); false to try again later.
+     */
+    private resendOwedVerdict;
+    /** @internal test seam (R5-F2): the timed resend's interval and number of tries. */
+    _setOwedVerdictResendForTests(intervalMs: number, tries: number): void;
+    /**
+     * R4-F1 (Hendry's rule 1): another seat of this gate already has a CONFIRMED verdict about an older generation than
+     * `newest`. The engine keeps the first verdict per seat, so that verdict cannot be replaced by one about the changed
+     * files; the gate must not be decided by it, and the seat that found the change ESCALATEs.
+     */
+    private olderVerdictRecorded;
+    /** @internal test seam (R4-F1): record that the engine confirmed a seat's verdict about `generation`. */
+    _recordConfirmedVerdictForTests(gateId: string, seatId: number, generation: number): void;
+    /** @internal test seam (R4-F1): the waits between verdict send retries. */
+    _setVerdictSendRetryDelaysForTests(delays: readonly number[]): void;
+    /**
+     * Returns true once the engine has confirmed this seat's verdict (now or earlier). R4-F1 (Hendry's rule 2): a failed
+     * send is retried with the SAME verdict after each of `verdictSendRetryDelaysMs`; only when every try failed does it
+     * return false (the caller then escalates). `generation` is the review round generation the verdict is about (null
+     * for a seat without a review round).
+     */
     private submitVerdict;
     /**
      * On WS (re)connect/startup, poll for the seats assigned to this desktop for
@@ -2574,6 +2806,16 @@ export declare class QuorumLoop {
     recoverShadows(opts?: {
         drainOnShutdown?: boolean;
     }): Promise<void>;
+    setResumedFromSession(sessionId: string): void;
+    /** The copy stays on disk for a later resume, and this session's exit cleanup no longer owns it. */
+    private detachStoppedTask;
+    /**
+     * F-RESTART-NOT-RESUMED (§17 Restart, §16 C3/C4; Hendry 2026-11-02, option 1): the engine binds a task to its session,
+     * so a stopped task continues as a new task of this session, on the copy it left. Round 0 runs no agent: the copy is
+     * captured as usual and goes through the normal review and gate. The intent is rewritten first, so a second crash
+     * here is resumed from this session.
+     */
+    private reopenStoppedTask;
     private recoverShadowsOwned;
     /**
      * Session-exit ownership boundary. Stop future creates, wait behind every
@@ -2591,6 +2833,8 @@ export declare class QuorumLoop {
      * unresolved authority are preserved, but returned as explicit failures.
      */
     private cleanupOwnedTaskSnapshots;
+    /** F-EXIT-WAITS-CAPTURE (tick): the copies with a progress-count scan in flight (one at a time per copy). */
+    private readonly tickScansInFlight;
     disposeWorkspaces(opts?: {
         strict?: boolean;
     }): Promise<void>;