opencode-swarm 7.133.0 → 7.134.1

package/.opencode/skills/codebase-review-swarm/SKILL.md

@@ -71,8 +71,16 @@ When the review target is a PR branch or commit range, complete this before any
 explorer or candidate-generation dispatch:
 
 1. Verify the working tree is clean with `git status --porcelain`. If
-   uncommitted changes exist, stash them or abort the checkout to prevent data
-   loss.
+   uncommitted changes exist, **you (the orchestrator)** must handle them
+   before any explorer/candidate dispatch — use `prepare_pr_workflow_checkout`
+   (the controller-owned path; it preserves every dirty path — including
+   untracked files when called with no `paths` argument — and returns a recovery
+   command), or a git worktree (see `running-tests` skill precedent). Note:
+   `git branch tmp/save-<topic>` only moves the HEAD ref — it does not record or
+   preserve uncommitted working-tree changes, so do not rely on it to save dirty
+   work. **Never delegate `git stash`, `git reset`, `git checkout -- .`,
+   or `git restore` to subagents** — these are worktree-global operations that
+   destroy sibling agents' in-flight work under parallel execution.
 2. Fetch and check out the PR head branch locally. Explorer agents read the
    working-tree filesystem (`Read`/`Glob`/`Grep`), not git history, so reviewing
    a PR while the base branch is checked out produces invalid candidates.
@@ -80,6 +88,14 @@ explorer or candidate-generation dispatch:
    packet and pass that range in every explorer/candidate-generation delegation
    so agents have revision context for targeted `git show` inspection.
 
+**Subagent prohibition — must reach every subagent prompt:**
+Include this line verbatim in every explorer/candidate-generation lane
+or subagent dispatch prompt:
+"You are a subagent sharing a worktree with sibling agents. You MUST
+NOT run `git stash`, `git reset`, `git checkout -- .`, `git restore`,
+or any other worktree-global destructive git command. These destroy
+sibling agents' in-flight work without error."
+
 ## Async advisory lanes
 
 When selected-track inventory or candidate generation decomposes into independent read-only units, launch those units with `dispatch_lanes_async` when available. Record each returned `batch_id`, then continue architect-owned deterministic work that does not depend on lane output: update the coverage ledger shell, run safe local tools, prepare validation shards, and document unresolved coverage units. Do not mark coverage `REVIEWED`, promote candidates to findings, or write the final report from running lanes.

package/.opencode/skills/codebase-review-swarm/references/review-protocol-v8.2.md

@@ -196,8 +196,16 @@ If the review target is a PR branch or commit range, complete this before Phase
 candidate-generation dispatch:
 
 1. Verify the working tree is clean with `git status --porcelain`. If
-   uncommitted changes exist, stash them or abort the checkout to prevent data
-   loss.
+   uncommitted changes exist, **you (the orchestrator)** must handle them
+   before any explorer/candidate dispatch — use `prepare_pr_workflow_checkout`
+   (the controller-owned path; it preserves every dirty path — including
+   untracked files when called with no `paths` argument — and returns a recovery
+   command), or a git worktree (see `running-tests` skill precedent). Note:
+   `git branch tmp/save-<topic>` only moves the HEAD ref — it does not record or
+   preserve uncommitted working-tree changes, so do not rely on it to save dirty
+   work. **Never delegate `git stash`, `git reset`, `git checkout -- .`,
+   or `git restore` to subagents** — these are worktree-global operations that
+   destroy sibling agents' in-flight work under parallel execution.
 2. Fetch and check out the PR head branch locally. Explorer agents read the
    working-tree filesystem (`Read`/`Glob`/`Grep`), not git history; without the
    checkout, they inspect the base branch and produce invalid candidates.
@@ -205,6 +213,14 @@ candidate-generation dispatch:
    commit range in every explorer/candidate-generation delegation so lanes can
    use `git show` for revision-specific inspection.
 
+**Subagent prohibition — must reach every subagent prompt:**
+Include this line verbatim in every explorer/candidate-generation
+subagent dispatch prompt:
+"You are a subagent sharing a worktree with sibling agents. You MUST
+NOT run `git stash`, `git reset`, `git checkout -- .`, `git restore`,
+or any other worktree-global destructive git command. These destroy
+sibling agents' in-flight work without error."
+
 ### 0K — User review mode gate
 
 Stop and present the ten review choices unless the user’s original request already selected tracks and explicitly authorized continuing. If the user selects a focused review, do not run unrelated tracks; record omitted tracks in coverage notes.

package/.opencode/skills/swarm-implement/SKILL.md

@@ -75,8 +75,16 @@ When implementation or review-scoping work depends on explorer agents reading a
 PR branch or commit range, complete this before Phase 1 explorer dispatch:
 
 1. Verify the working tree is clean with `git status --porcelain`. If
-   uncommitted changes exist, stash them or abort the checkout to prevent data
-   loss.
+   uncommitted changes exist, **you (the orchestrator)** must handle them
+   before Phase 1 dispatch — use `prepare_pr_workflow_checkout` (the
+   controller-owned path; it preserves every dirty path — including untracked
+   files when called with no `paths` argument — and returns a recovery command),
+   or a git worktree (see `running-tests` skill precedent). Note: `git branch
+   tmp/save-<topic>` only moves the HEAD ref — it does not record or preserve
+   uncommitted working-tree changes, so do not rely on it to save dirty work.
+   **Never delegate `git stash`, `git reset`, `git checkout -- .`,
+   or `git restore` to subagents** — these are worktree-global operations that
+   destroy sibling agents' in-flight work under parallel execution.
 2. Fetch and check out the PR head branch locally. Explorer agents read files
    from the working tree (`Read`/`Glob`/`Grep`), not from git history, so a stale
    checkout makes them inspect the base branch.
@@ -90,6 +98,13 @@ Launch parallel subagents for disjoint investigation tasks such as repository
 mapping, locating existing patterns, finding tests/contracts, side-effect
 analysis, and dependency or migration checks. Keep the main context focused.
 
+**Subagent prohibition — must reach every subagent prompt:**
+Include this line verbatim in every subagent dispatch prompt:
+"You are a subagent sharing a worktree with sibling agents. You MUST
+NOT run `git stash`, `git reset`, `git checkout -- .`, `git restore`,
+or any other worktree-global destructive git command. These destroy
+sibling agents' in-flight work without error."
+
 ### Phase 2 - Plan
 
 Create a concrete implementation plan before editing for any non-trivial task.

package/dist/background/completion-observer.d.ts

@@ -1,22 +1,32 @@
 /**
- * Background subagent completion observer/ingester.
+ * Trusted background-subagent completion observer.
  *
- * Trusted synthetic background completions always settle the durable
- * background-delegation ledger. Correctness-critical Stage B completions then
- * pass through workspace freshness validation before gate evidence, receipts, or
- * task workflow state can advance.
+ * Terminal identity, coder settlement, workflow ingestion, and parent
+ * notification are separate durable transitions. Replaying the same synthetic
+ * event therefore resumes the first incomplete transition without re-running a
+ * completed one.
  */
-import type { ReviewerReceiptValidationOptions } from '../hooks/review-receipt-collector.js';
+import { type BackgroundDelegationRecord, recordDelegationIngestionResult } from './pending-delegations.js';
 interface ObserverConfig {
     enabled: boolean;
 }
+export interface PreparedBackgroundAdvisories {
+    preparationId: string;
+    eventIds: string[];
+    messages: string[];
+}
 export declare function createBackgroundCompletionObserver(opts: {
     config: ObserverConfig;
     directory: string;
-    reviewerReceiptOptions?: ReviewerReceiptValidationOptions;
+    onTerminalClaimed?: (record: BackgroundDelegationRecord) => void;
+    recordIngestionResult?: typeof recordDelegationIngestionResult;
+    reviewerReceiptOptions?: Record<string, unknown>;
 }): {
     event: (input: {
         event: unknown;
     }) => Promise<void>;
+    prepareAdvisories: (parentSessionId: string) => Promise<PreparedBackgroundAdvisories | null>;
+    ackObservedAdvisories: (parentSessionId: string, observedTexts: readonly string[]) => Promise<number>;
+    releaseAdvisories: (parentSessionId: string, prepared: PreparedBackgroundAdvisories) => Promise<boolean>;
 };
 export {};

package/dist/background/pending-delegations.d.ts

@@ -23,9 +23,24 @@
  * `.swarm/` (Invariant 4).
  */
 export declare const BACKGROUND_DELEGATIONS_FILE = "background-delegations.jsonl";
-export type BackgroundDelegationStatus = 'pending' | 'running' | 'ingestion_error' | 'completed' | 'ingesting' | 'error' | 'cancelled' | 'stale' | 'consumed';
+export declare const BACKGROUND_DELEGATION_FALLBACK_DIR = "background-delegation-fallback";
+export declare const BACKGROUND_CODER_RESERVATIONS_FILE = "background-coder-reservations.json";
+export declare const MAX_LIVE_BACKGROUND_FALLBACKS = 256;
+export declare const MAX_LIVE_BACKGROUND_CODER_RESERVATIONS = 256;
+export declare const MAX_BACKGROUND_OBSERVED_FILES = 5000;
+export declare const MAX_BACKGROUND_ADVISORY_CHARS = 4000;
+export type RecoveryOwnershipScanResult<T> = {
+    status: 'ok';
+    owners: T[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+/** An abandoned ingestion lease may be reclaimed after this bounded interval. */
+export declare const BACKGROUND_INGESTION_LEASE_MS = 30000;
+export type BackgroundDelegationStatus = 'pending' | 'running' | 'ingesting' | 'ingestion_error' | 'completed' | 'error' | 'cancelled' | 'stale' | 'consumed';
 export interface BackgroundDelegationRecord {
-    schemaVersion: 1 | 2;
+    schemaVersion: 1 | 2 | 3;
     /** Subagent session id from the dispatch envelope — the correlation key. */
     correlationId: string;
     /** Structured jobId from dispatch metadata when available, else null. */
@@ -66,16 +81,22 @@ export interface BackgroundDelegationRecord {
     workspace?: BackgroundWorkspaceSnapshot;
     /** Immutable pre-coder provenance for doc-only gate classification. */
     taskChangeContext?: BackgroundTaskChangeContext;
+    /** Complete isolated-worktree recovery coordinates captured before handoff. */
+    worktree?: BackgroundWorktreeDescriptor;
+    /** Stable pre-launch background-coder capacity reservation. */
+    coderReservationId?: string;
     prompt?: BackgroundPromptSnapshot;
     generation?: number;
+    /** Immutable trusted terminal event. Established exactly once. */
+    terminalResult?: BackgroundTerminalResult;
+    /** Durable coder settlement state. Settled outcomes are never recomputed. */
+    coderSettlement?: BackgroundCoderSettlement;
+    /** Durable parent advisory keyed by terminalResult.eventId. */
+    advisoryInbox?: BackgroundAdvisoryInboxEntry;
+    /** CAS marker for exactly one active ingestion attempt. */
+    ingestion?: BackgroundDelegationIngestion;
     result?: BackgroundDelegationResult;
     completedAt?: number;
-    /** Unique lease token for the process currently applying Stage-B side effects. */
-    ingestionId?: string;
-    /** Start time for bounded crash-recovery of an abandoned ingestion lease. */
-    ingestionStartedAt?: number;
-    /** Terminal result digest claimed by the ingester. */
-    ingestionDigest?: string;
 }
 export interface BackgroundWorkspaceSnapshot {
     directory: string;
@@ -89,6 +110,19 @@ export interface BackgroundTaskChangeContext {
     declaredFiles: string[] | null;
     baseline: BackgroundWorkspaceSnapshot;
 }
+export interface BackgroundWorktreeDescriptor {
+    callID: string;
+    parentSessionId: string;
+    taskId: string;
+    planTaskId: string | null;
+    worktreePath: string;
+    branchName: string;
+    worktreeId: string;
+    worktreeSessionId: string;
+    mergeStrategy: 'merge' | 'rebase' | 'cherry-pick';
+    laneIndex: number;
+    worktreeDir: string | null;
+}
 export interface BackgroundPromptSnapshot {
     text: string;
     chars: number;
@@ -108,6 +142,71 @@ export interface BackgroundDelegationResult {
     transcriptIncomplete?: boolean;
     messageCount?: number;
 }
+export interface BackgroundTerminalResult {
+    /** Stable identity derived from trusted correlation + immutable result metadata. */
+    eventId: string;
+    status: 'completed' | 'error' | 'cancelled';
+    recordedAt: number;
+    result: BackgroundDelegationResult;
+}
+export type BackgroundCoderSettlementState = 'pending' | 'settling' | 'settled' | 'preserved';
+export interface BackgroundCoderSettlementProvenance {
+    correlationId: string;
+    parentSessionId: string;
+    callID: string;
+    planTaskId: string | null;
+    baseline: BackgroundWorkspaceSnapshot;
+    worktree: BackgroundWorktreeDescriptor | null;
+}
+export interface BackgroundCoderSettlementOutcome {
+    kind: 'shared-root' | 'standard-worktree';
+    result: 'ready' | 'merged' | 'unchanged' | 'partial' | 'failed';
+    reason?: string;
+    sourceHeadAfterCommit?: string | null;
+    targetHeadBeforeMerge?: string | null;
+    targetHeadAfterMerge?: string | null;
+}
+export interface BackgroundCoderSettlement {
+    state: BackgroundCoderSettlementState;
+    provenance: BackgroundCoderSettlementProvenance;
+    operationId?: string;
+    sourceHeadAfterCommit?: string | null;
+    targetHeadBeforeMerge?: string | null;
+    observedFiles: string[] | null;
+    outcome?: BackgroundCoderSettlementOutcome;
+    updatedAt: number;
+}
+export interface BackgroundAdvisoryPreparation {
+    id: string;
+    preparedAt: number;
+    leaseExpiresAt: number;
+}
+export interface BackgroundAdvisoryInboxEntry {
+    eventId: string;
+    parentSessionId: string;
+    state: 'pending' | 'delivered';
+    message: string;
+    createdAt: number;
+    preparation?: BackgroundAdvisoryPreparation;
+    deliveredAt?: number;
+}
+export interface BackgroundDelegationIngestion {
+    state: 'claimed' | 'retryable' | 'consumed';
+    attempt: number;
+    updatedAt: number;
+    claimToken: string;
+    leaseExpiresAt?: number;
+}
+export interface BackgroundCoderReservation {
+    reservationId: string;
+    parentSessionId: string;
+    planTaskId: string | null;
+    callID: string;
+    state: 'reserved' | 'bound';
+    correlationId: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
 /**
  * Read and fold the store to the latest snapshot per correlationId. Lock-free and
  * defensive: a missing file yields an empty list, and malformed/partial lines are skipped
@@ -118,6 +217,12 @@ export interface BackgroundDelegationResult {
  * concurrent background delegations, and the on-disk log is small).
  */
 export declare function readDelegations(directory: string): BackgroundDelegationRecord[];
+/**
+ * Strict startup-recovery view of the primary ledger. Unlike the ordinary
+ * advisory reader, this never treats unreadable, oversized, or malformed owner
+ * data as absence: destructive orphan cleanup must fail closed on uncertainty.
+ */
+export declare function scanDelegationsForRecovery(directory: string): RecoveryOwnershipScanResult<BackgroundDelegationRecord>;
 /** Returns the folded record for a correlationId, or null. Lock-free read. */
 export declare function findByCorrelationId(directory: string, correlationId: string): BackgroundDelegationRecord | null;
 export interface RecordPendingInput {
@@ -138,6 +243,8 @@ export interface RecordPendingInput {
     promptHash?: string;
     workspace?: BackgroundWorkspaceSnapshot;
     taskChangeContext?: BackgroundTaskChangeContext;
+    worktree?: BackgroundWorktreeDescriptor;
+    coderReservationId?: string;
     prompt?: BackgroundPromptSnapshot;
     generation?: number;
 }
@@ -157,38 +264,101 @@ export declare function appendDelegationTransition(directory: string, correlatio
     result?: BackgroundDelegationResult;
     completedAt?: number;
 }): Promise<BackgroundDelegationRecord | null>;
-/** An abandoned ingestion lease may be reclaimed after this bounded interval. */
-export declare const BACKGROUND_INGESTION_LEASE_MS = 30000;
-export type BackgroundIngestionClaim = {
-    outcome: 'claimed';
+export interface BuildBackgroundCompletionEventIdInput {
+    correlationId: string;
+    jobId: string | null;
+    status: BackgroundTerminalResult['status'];
+    resultDigest: string;
+}
+/** Build the stable inbox/terminal identity without timestamps or process state. */
+export declare function buildBackgroundCompletionEventId(input: BuildBackgroundCompletionEventIdInput): string;
+export type TerminalClaimDisposition = 'claimed' | 'resume_settlement' | 'retry_ingestion' | 'preserved' | 'consumed' | 'duplicate';
+export interface TerminalClaim {
+    disposition: TerminalClaimDisposition;
     record: BackgroundDelegationRecord;
-    ingestionId: string;
-} | {
-    outcome: 'busy' | 'settled' | 'rejected' | 'missing';
-    record: BackgroundDelegationRecord | null;
-};
+}
 /**
- * Acquire the single durable right to apply Stage-B side effects.
+ * Establish an immutable trusted terminal event exactly once.
  *
- * The completed/ingestion_error -> ingesting transition is a compare-and-set
- * performed under the pending-delegation store lock. A stale ingesting lease
- * may be reclaimed after a crash; live duplicates observe `busy` and do no
- * work. Result digest equality keeps replay bound to the immutable completion.
+ * A different event for an already-claimed correlation is rejected. Replays of the
+ * same event receive an explicit resume/retry disposition from durable state.
  */
-export declare function claimDelegationIngestion(directory: string, correlationId: string, resultDigest: string, options?: {
+export declare function claimTerminalResult(directory: string, correlationId: string, terminalResult: BackgroundTerminalResult): Promise<TerminalClaim | null>;
+export interface ClaimCoderSettlementInput {
+    sourceHeadAfterCommit?: string | null;
+    targetHeadBeforeMerge?: string | null;
+}
+export interface CoderSettlementClaim {
+    disposition: 'claimed' | 'resume' | 'settled' | 'preserved';
+    record: BackgroundDelegationRecord;
+}
+/**
+ * Claim coder settlement under the ledger lock. A `settling` operation may resume only
+ * with its original operationId; completed or preserved outcomes are returned unchanged.
+ */
+export declare function claimCoderSettlement(directory: string, correlationId: string, operationId: string, input?: ClaimCoderSettlementInput): Promise<CoderSettlementClaim | null>;
+export declare function normalizeBackgroundObservedFiles(files: readonly string[]): string[] | null;
+export interface UpdateCoderSettlementInput {
+    operationId: string;
+    state: 'settling' | 'settled' | 'preserved';
+    sourceHeadAfterCommit?: string | null;
+    targetHeadBeforeMerge?: string | null;
+    observedFiles?: string[] | null;
+    outcome?: BackgroundCoderSettlementOutcome;
+}
+/**
+ * Persist settlement progress or its terminal outcome. Once settled/preserved, every
+ * replay returns the original snapshot and ignores recomputation attempts.
+ */
+export declare function updateCoderSettlement(directory: string, correlationId: string, input: UpdateCoderSettlementInput): Promise<BackgroundDelegationRecord | null>;
+export type DelegationIngestionDisposition = 'claimed' | 'retry' | 'busy' | 'not_ready' | 'preserved' | 'consumed';
+export interface DelegationIngestionClaim {
+    disposition: DelegationIngestionDisposition;
+    record: BackgroundDelegationRecord;
+}
+export interface ClaimDelegationIngestionOptions {
+    claimantId: string;
     now?: number;
     leaseMs?: number;
-}): Promise<BackgroundIngestionClaim>;
+}
 /**
- * Settle only the ingestion lease held by `ingestionId`.
+ * Lease-backed CAS claim for ingestion.
  *
- * A consumed record is forward-only and returned idempotently; no late error
- * path can regress it to ingestion_error.
+ * An interrupted claimant cannot strand the record permanently: after the
+ * bounded lease expires, a replay may reclaim and retry the immutable settled
+ * input. A still-live claim remains busy and must never be reported as success.
  */
-export declare function settleDelegationIngestion(directory: string, correlationId: string, ingestionId: string, transition: {
-    status: 'consumed' | 'ingestion_error';
-    result?: BackgroundDelegationResult;
+export declare function claimDelegationIngestion(directory: string, correlationId: string, options: ClaimDelegationIngestionOptions): Promise<DelegationIngestionClaim | null>;
+/** Commit an ingestion claim to consumed or retryable ingestion_error. */
+export declare function recordDelegationIngestionResult(directory: string, correlationId: string, claimToken: string, success: boolean, options?: {
+    now?: number;
 }): Promise<BackgroundDelegationRecord | null>;
+export interface PutPendingBackgroundAdvisoryInput {
+    eventId: string;
+    parentSessionId: string;
+    message: string;
+    createdAt?: number;
+}
+/** Establish one immutable durable advisory for the terminal event. */
+export declare function putPendingBackgroundAdvisory(directory: string, correlationId: string, input: PutPendingBackgroundAdvisoryInput): Promise<BackgroundAdvisoryInboxEntry | null>;
+export interface PreparePendingBackgroundAdvisoriesOptions {
+    preparationId: string;
+    now?: number;
+    leaseMs?: number;
+}
+/**
+ * Lease pending entries for one synchronous message transform. Expired leases are
+ * reclaimable after restart; delivery is committed only when a later host
+ * transform reflects the injected text back as conversation history.
+ */
+export declare function preparePendingBackgroundAdvisories(directory: string, parentSessionId: string, options: PreparePendingBackgroundAdvisoriesOptions): Promise<BackgroundAdvisoryInboxEntry[]>;
+/**
+ * Commit delivery only after a later host transform reflects the exact advisory
+ * text back in conversation history. This is the first boundary at which the
+ * plugin can prove that a prior transform result escaped the process.
+ */
+export declare function acknowledgeObservedBackgroundAdvisories(directory: string, parentSessionId: string, observedTexts: readonly string[]): Promise<number>;
+export declare function releasePreparedBackgroundAdvisories(directory: string, parentSessionId: string, preparationId: string, eventIds: readonly string[]): Promise<boolean>;
 export declare function findByBatchId(directory: string, batchId: string, opts?: {
     parentSessionId?: string;
 }): BackgroundDelegationRecord[];
@@ -198,3 +368,108 @@ export declare function findOpenAsyncLaneBatches(directory: string): BackgroundD
  * Best-effort; returns the number swept (0 on lock timeout / error).
  */
 export declare function sweepStaleDelegations(directory: string, timeoutMs: number): Promise<number>;
+export interface BackgroundDelegationFallbackArtifact {
+    schemaVersion: 1;
+    correlationId: string;
+    createdAt: number;
+    record: BackgroundDelegationRecord;
+}
+/** Read one exact fallback artifact with bounded post-rename visibility retries. */
+export declare function readDelegationFallback(directory: string, correlationId: string): Promise<BackgroundDelegationFallbackArtifact | null>;
+/**
+ * Enumerate valid live fallback owners for startup orphan recovery. Malformed files are
+ * ignored as data but still count toward the fail-closed capacity bound.
+ */
+export declare function listDelegationFallbacks(directory: string): Promise<BackgroundDelegationFallbackArtifact[]>;
+/**
+ * Strict startup-recovery view of fallback owners. Every candidate must be
+ * readable and schema-valid, and overflow is uncertainty rather than
+ * truncation, because omitted ownership could make cleanup destructive.
+ */
+export declare function scanDelegationFallbacksForRecovery(directory: string): Promise<RecoveryOwnershipScanResult<BackgroundDelegationFallbackArtifact>>;
+export interface WriteDelegationFallbackOptions {
+    /** Testable lower cap; callers cannot raise the production maximum. */
+    maxLive?: number;
+}
+/**
+ * Atomically persist a launched-but-unledgered delegation in an independent,
+ * per-correlation artifact. Capacity failure never removes another live artifact.
+ */
+export declare function writeDelegationFallback(directory: string, input: RecordPendingInput, options?: WriteDelegationFallbackOptions): Promise<BackgroundDelegationFallbackArtifact | null>;
+/** Idempotently remove one exact fallback after durable primary promotion. */
+export declare function removeDelegationFallback(directory: string, correlationId: string): Promise<boolean>;
+export interface CompletionDelegationLookup {
+    source: 'primary' | 'fallback';
+    record: BackgroundDelegationRecord;
+    fallback?: BackgroundDelegationFallbackArtifact;
+}
+/** Lookup used by terminal handling: primary ledger first, exact fallback second. */
+export declare function findDelegationForCompletion(directory: string, correlationId: string): Promise<CompletionDelegationLookup | null>;
+/**
+ * Promote one exact fallback into the append-only primary ledger, then remove it.
+ * A conflicting primary identity fails closed and leaves the fallback untouched.
+ */
+export declare function promoteDelegationFallback(directory: string, correlationId: string): Promise<CompletionDelegationLookup | null>;
+export declare function buildBackgroundCoderReservationId(input: {
+    parentSessionId: string;
+    planTaskId: string | null;
+    callID: string;
+}): string;
+export type BackgroundCoderReservationScanResult = {
+    status: 'ok';
+    reservations: BackgroundCoderReservation[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+/**
+ * Strict reservation read for admission. Corruption is uncertainty, never absence.
+ */
+export declare function scanBackgroundCoderReservationsForAdmission(directory: string): BackgroundCoderReservationScanResult;
+export interface ReserveBackgroundCoderSlotInput {
+    parentSessionId: string;
+    planTaskId: string | null;
+    callID: string;
+    maxConcurrent: number;
+    occupiedTaskIds?: readonly string[];
+    now?: number;
+}
+export type ReserveBackgroundCoderSlotResult = {
+    ok: true;
+    reservation: BackgroundCoderReservation;
+    activeCount: number;
+} | {
+    ok: false;
+    reason: 'invalid' | 'duplicate_task' | 'duplicate_call' | 'capacity' | 'uncertain';
+    activeCount?: number;
+    detail?: string;
+    existing?: BackgroundCoderReservation;
+};
+/**
+ * Atomically reserve one parent-scoped background coder slot before launch.
+ * This has no workflow-state side effect.
+ */
+export declare function reserveBackgroundCoderSlot(directory: string, input: ReserveBackgroundCoderSlotInput): Promise<ReserveBackgroundCoderSlotResult>;
+export interface BindBackgroundCoderReservationInput {
+    reservationId: string;
+    parentSessionId: string;
+    planTaskId: string | null;
+    callID: string;
+    correlationId: string;
+    now?: number;
+}
+/** Bind the pre-launch owner to the exact trusted completion correlation. */
+export declare function bindBackgroundCoderReservation(directory: string, input: BindBackgroundCoderReservationInput): Promise<BackgroundCoderReservation | null>;
+export interface ReleaseBackgroundCoderReservationInput {
+    reservationId: string;
+    parentSessionId: string;
+    planTaskId: string | null;
+    callID: string;
+    correlationId: string | null;
+    reason: 'consumed' | 'recovered';
+}
+/**
+ * Release only an exact owner. `consumed` is independently proven from the strict
+ * primary ledger; `recovered` is reserved for a caller that completed recovery.
+ */
+export declare function releaseBackgroundCoderReservation(directory: string, input: ReleaseBackgroundCoderReservationInput): Promise<boolean>;

package/dist/background/pr-event-subscribers.d.ts

@@ -97,7 +97,7 @@ declare function scheduleClearUnaddressed(directory: string, correlationId: stri
 /**
  * Format a structured advisory message for the given PR event type.
  * Returns null for unknown event types. The first token is always the
- * dedup token `[pr-monitor:<type>:<repo>#<n>]`.
+ * dedup token from buildPrEventToken.
  */
 declare function formatAdvisory(type: string, payload: PrEventPayload): string | null;
 export {};

package/dist/cli/{config-doctor-8nbdwnn6.js → config-doctor-4avzz3rh.js}

@@ -12,13 +12,13 @@ import {
   shouldRunOnStartup,
   writeBackupArtifact,
   writeDoctorArtifact
-} from "./index-tj2mkfb3.js";
-import"./index-wzb4dv5s.js";
+} from "./index-bq2848a3.js";
+import"./index-y2esw64s.js";
 import"./index-bk5tah7q.js";
+import"./index-bpmtbmy9.js";
 import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";
 import"./index-zgwm4ryv.js";
-import"./index-bpmtbmy9.js";
 import"./index-a76rekgs.js";
 export {
   writeDoctorArtifact,

package/dist/cli/{core-egwpry19.js → core-d6yd2jzv.js}

@@ -14,12 +14,12 @@ import {
   resolveWorktreeBaseDir,
   shortenWorktreePath,
   writeLaneProfileToDiskReal
-} from "./index-17zjp67y.js";
-import"./index-z6xqpmqg.js";
+} from "./index-2t1n9k7b.js";
 import"./index-4rhhvd1a.js";
+import"./index-z6xqpmqg.js";
 import"./index-zjygnfay.js";
-import"./index-zgwm4ryv.js";
 import"./index-qe3v54nb.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   writeLaneProfileToDiskReal,

package/dist/cli/{curation-policy-gae3xm5d.js → curation-policy-8vkzjtwb.js}

@@ -4,18 +4,18 @@ import {
   authorizeCuration,
   buildConfigFingerprintInput,
   readCohortConfigFingerprint
-} from "./index-wz36r0fk.js";
+} from "./index-zjw32rv9.js";
 import"./index-rtry5xyf.js";
-import"./index-bz08438z.js";
+import"./index-8t9xpn1a.js";
 import"./index-ae75rja9.js";
-import"./index-q27bajqb.js";
-import"./index-zgwm4ryv.js";
-import"./index-7mkpsw6g.js";
+import"./index-cfkvc5q9.js";
+import"./index-dd7ttx8x.js";
 import"./index-fsrp8wp3.js";
-import"./index-76kvm9z5.js";
-import"./index-q2rrv0cy.js";
+import"./index-5nybajn9.js";
 import"./index-7g4c7s5r.js";
+import"./index-q2rrv0cy.js";
 import"./index-qe3v54nb.js";
+import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   readCohortConfigFingerprint,