opencode-swarm 7.144.2 → 7.144.4

package/dist/cli/{worktree-isolation-g54kxw6x.js → worktree-isolation-canf3rj8.js}

@@ -20,60 +20,60 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-nretd4qn.js";
-import"./index-g2ajae1z.js";
-import"./index-jb4tchvy.js";
-import"./index-qpt8ahph.js";
+} from "./index-q4ed1jk7.js";
+import"./index-d12jd5mn.js";
+import"./index-h98t1m88.js";
+import"./index-az8etqpp.js";
 import"./index-134d35c1.js";
 import"./index-b6e016tv.js";
-import"./index-4q9vfav6.js";
-import"./index-k92cagmt.js";
+import"./index-1csyxv0f.js";
+import"./index-fqcjragy.js";
 import"./index-y8552snf.js";
-import"./index-m6wv2qdr.js";
+import"./index-nckg4gxb.js";
 import"./index-70ha9e09.js";
 import"./index-c8s9a3zh.js";
 import"./index-9ss2m4rs.js";
-import"./index-d55crzd4.js";
 import"./index-74hpm6sh.js";
-import"./index-7ca3a6gj.js";
-import"./index-av0f6mm0.js";
-import"./index-zr370283.js";
-import"./index-g1c5fgaw.js";
-import"./index-556ja8an.js";
-import"./index-gdd4jt6b.js";
+import"./index-bt9aa01f.js";
+import"./index-zb0xcz9t.js";
+import"./index-x6tp0hfr.js";
+import"./index-yts89pqg.js";
+import"./index-dty5qgk2.js";
+import"./index-rtry5xyf.js";
 import"./index-zsrtt42s.js";
+import"./index-jabkn643.js";
 import"./index-k3cxyk66.js";
-import"./index-4fda8kkw.js";
-import"./index-dhh2j2nd.js";
-import"./index-8fwhhayc.js";
-import"./index-q1exe2b3.js";
+import"./index-cz25e8xp.js";
+import"./index-8j0va7jp.js";
+import"./index-pw83zgny.js";
+import"./index-z6v7kwpa.js";
+import"./index-556ja8an.js";
 import"./index-7sy3aa9m.js";
 import"./index-wx8zdh4a.js";
-import"./index-p3tnmkvc.js";
+import"./index-8fwhhayc.js";
+import"./index-q1exe2b3.js";
+import"./index-03pv47h2.js";
+import"./index-4w5qdbk7.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-dg2w0wr4.js";
+} from "./index-psvxq93b.js";
 import"./index-gprxjmm7.js";
 import"./index-n832052r.js";
-import"./index-y95nwsge.js";
-import"./index-h3z64mhz.js";
 import"./index-rn0eq85g.js";
-import"./index-4rhhvd1a.js";
-import"./index-whezv7vc.js";
 import"./index-z6xqpmqg.js";
+import"./index-9qq7c18c.js";
+import"./index-y8j8ehc8.js";
+import"./index-4rhhvd1a.js";
+import"./index-v3y3qg48.js";
 import"./index-zjygnfay.js";
-import"./index-ne8cfgw5.js";
-import"./index-tq5s07ta.js";
-import"./index-rtry5xyf.js";
-import"./index-ckrasab9.js";
 import"./index-ae75rja9.js";
-import"./index-w7x7qxz2.js";
-import"./index-erfnw81g.js";
-import"./index-bk5tah7q.js";
+import"./index-ywn7vtxp.js";
+import"./index-mazgg5s2.js";
 import"./index-ed5ykebp.js";
-import"./index-k31en0ja.js";
+import"./index-bk5tah7q.js";
+import"./index-f9vvg5xb.js";
+import"./index-1jsmmx7y.js";
 import"./index-7g4c7s5r.js";
-import"./index-s2rcz51a.js";
 import"./index-bpmtbmy9.js";
 import"./index-4nt52yr9.js";
 import"./index-zgwm4ryv.js";

package/dist/commands/index.d.ts

@@ -46,6 +46,7 @@ export { handlePlanCommand } from './plan';
 export { handlePreflightCommand } from './preflight';
 export { handlePromoteCommand } from './promote';
 export { handleQaGatesCommand } from './qa-gates';
+export { handleRecoverCommand } from './recover';
 export { handleHelpCommand } from './registry';
 export type { CommandContext, CommandEntry, RegisteredCommand, } from './registry.js';
 export { COMMAND_REGISTRY, resolveCommand, VALID_COMMANDS, } from './registry.js';

package/dist/commands/recover.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Handles the /swarm recover command (issue #2268).
+ *
+ * The user-facing invoker for coder-settlement recovery. The wedge class this
+ * exists for: a DISPATCHED settlement WAL whose completion (toolAfter) never
+ * arrived — every dispatch retry is refused with CODER_SETTLEMENT_IN_PROGRESS
+ * / CODER_DISPATCH_IN_PROGRESS and internal sinks (update_task_status, /swarm
+ * close) are paused too. Safe mode recovers settlements whose owning process
+ * is gone; --force additionally releases ownership keys still held by THIS
+ * process (an operator assertion that no dispatch is genuinely in flight —
+ * a still-running dispatch's late completion will then fail settlement with
+ * CODER_SETTLEMENT_IDEMPOTENCY_CONFLICT, which is safe to ignore).
+ *
+ * Human-only by policy: agents already self-heal dead-owner settlements via
+ * update_task_status, and --force must stay an operator decision.
+ */
+export declare function handleRecoverCommand(directory: string, args: string[]): Promise<string>;

package/dist/commands/registry.d.ts

@@ -619,7 +619,7 @@ export declare const COMMAND_REGISTRY: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear a stuck PR_REVIEW/PR_FEEDBACK mechanical gate and stop the auto-resume loop [mode] [reason]";
         readonly args: "[PR_REVIEW|PR_FEEDBACK] [reason...]";
-        readonly details: "Human-only escape hatch for an unrecoverable PR_REVIEW or PR_FEEDBACK mechanical gate. When the architect cannot reach complete_pr_workflow — for example a compound `git fetch && git checkout` was rejected as read-only shell syntax, the PR head cannot be fetched, or the working tree is on the wrong branch — running this clears the durable gate state for the current session and stops the auto-resume loop without depending on the trapped model. The agent itself cannot run this command; it must call the abort_pr_workflow tool (or ask you to run this command). Both paths funnel into the same fail-closed abortPrWorkflow hook, which refuses while the workflow is armed for publication or while PR workflow lanes are still in flight. When checkout preparation preserved a stash, the result instructs the caller to run prepare_pr_workflow_checkout operation=restore after the clear. An audit event is appended to .swarm/events.jsonl.";
+        readonly details: "Human-only escape hatch for an unrecoverable PR_REVIEW or PR_FEEDBACK mechanical gate. When the architect cannot reach complete_pr_workflow — for example a compound `git fetch && git checkout` was rejected as read-only shell syntax, the PR head cannot be fetched, or the working tree is on the wrong branch — running this clears the durable gate state for the current session and stops the auto-resume loop without depending on the trapped model. The agent itself cannot run this command; it must call the abort_pr_workflow tool (or ask you to run this command). Both paths funnel into the same fail-closed abortPrWorkflow hook, which refuses while the workflow is armed for publication or while PR workflow lanes are still in flight. This human-only force path has exactly one exception to that second refusal (issue #2251): when the ONLY lanes still blocking are ones past the 30-minute staleness horizon that the liveness probe reports as still running — a lane nothing will ever settle on a schedule — it clears the gate anyway, names exactly which lanes it overrode, and finalizes their delegation records so the session can start a new PR workflow. Those sessions are NOT stopped and their output is NOT collected. A lane with a fresh updatedAt still blocks even under force, and any delegation record that still keeps the session blocked is named in the warning. When checkout preparation preserved a stash, the result instructs the caller to run prepare_pr_workflow_checkout operation=restore after the clear. An audit event is appended to .swarm/events.jsonl.";
         readonly category: "utility";
         readonly toolPolicy: "restricted";
     };
@@ -825,11 +825,19 @@ export declare const COMMAND_REGISTRY: {
     readonly 'reset-session': {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear session state while preserving plan, evidence, and knowledge";
-        readonly details: "Deletes only .swarm/session/state.json and any other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge for cross-session continuity. Before deleting, auto-backs up the session files it removes to .swarm/reset-backups/<timestamp>/ (newest 5 kept).";
+        readonly details: "Deletes only .swarm/session/state.json and any other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge for cross-session continuity. Also recovers stale coder settlements, releasing in-flight ownership held by this process, so dispatches cannot stay wedged on CODER_DISPATCH_IN_PROGRESS (issue #2268). Before deleting, auto-backs up the session files it removes to .swarm/reset-backups/<timestamp>/ (newest 5 kept).";
         readonly args: "";
         readonly category: "utility";
         readonly toolPolicy: "restricted";
     };
+    readonly recover: {
+        readonly handler: (ctx: CommandContext) => Promise<string>;
+        readonly description: "Recover wedged coder settlements [task_id] [--force]";
+        readonly details: "Settles stale coder-settlement WALs in .swarm/coder-settlements/ — the CODER_DISPATCH_IN_PROGRESS wedge where a dispatch's completion never fired (issue #2268). Safe mode recovers settlements whose owner process is gone. --force also releases ownership keys held by this process: use only when no dispatch is genuinely running (a late completion then reports CODER_SETTLEMENT_IDEMPOTENCY_CONFLICT, safe to ignore). Never interrupts another live OpenCode process. Human-only.";
+        readonly args: "[task_id] [--force]";
+        readonly category: "utility";
+        readonly toolPolicy: "human-only";
+    };
     readonly rollback: {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Restore swarm state or project files to a checkpoint";

package/dist/commands/reset-session.d.ts

@@ -1,3 +1,4 @@
+import { recoverStaleCoderSettlements } from '../workflow/coder-settlement.js';
 import { type OrphanCleanupResult } from '../worktree/merge';
 import { type ResetBackupResult } from './reset-backup';
 /**
@@ -9,6 +10,7 @@ import { type ResetBackupResult } from './reset-backup';
 export declare const _internals: {
     cleanupOrphanedBranches: (directory: string, activeSessionIds: string[]) => Promise<OrphanCleanupResult>;
     backupSwarmStateBeforeReset: (directory: string, kind: 'reset' | 'reset-session', relEntries: string[]) => ResetBackupResult;
+    recoverStaleCoderSettlements: typeof recoverStaleCoderSettlements;
 };
 /**
  * Handles the /swarm reset-session command.

package/dist/hooks/context-budget.d.ts

@@ -6,6 +6,7 @@
  * to provide proactive context management guidance to the architect agent.
  */
 import type { PluginConfig } from '../config';
+import { telemetry } from '../telemetry';
 interface MessageInfo {
     role: string;
     agent?: string;
@@ -31,6 +32,9 @@ interface MessageWithParts {
     info: MessageInfo;
     parts: MessagePart[];
 }
+export declare const _internals: {
+    telemetryContextPruned: typeof telemetry.contextPruned;
+};
 /**
  * Creates the experimental.chat.messages.transform hook for context budget tracking.
  * Injects warnings when context usage exceeds configured thresholds.

package/dist/hooks/context-usage.d.ts

@@ -0,0 +1,48 @@
+export interface ContextUsageMessageInfo {
+    role?: string;
+    tokens?: {
+        input?: unknown;
+        cache?: {
+            read?: unknown;
+            write?: unknown;
+        };
+    };
+    [key: string]: unknown;
+}
+export interface ContextUsageMessagePart {
+    type?: string;
+    text?: string;
+    state?: {
+        status?: string;
+        input?: unknown;
+        output?: string;
+        error?: string;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface ContextUsageMessage {
+    info?: ContextUsageMessageInfo;
+    parts?: ContextUsageMessagePart[];
+}
+export type ContextUsageSource = 'provider' | 'estimated';
+export interface ContextUsageResult {
+    tokensUsed: number;
+    source: ContextUsageSource;
+    assistantAnchorIndex: number | null;
+}
+export declare function serializeToolInput(input: unknown): string;
+export declare function estimateToolInputTokens(input: unknown): number;
+export declare function getVisibleToolPartText(part: ContextUsageMessagePart): string;
+export declare function estimateVisibleToolPartTokens(part: ContextUsageMessagePart): number;
+export declare function estimateMessageTokens(message: ContextUsageMessage): number;
+export declare function readProviderPromptTokens(message: ContextUsageMessage | undefined): number | undefined;
+export declare function computeContextUsage(messages: ContextUsageMessage[] | undefined): ContextUsageResult;
+export declare const _test_exports: {
+    computeContextUsage: typeof computeContextUsage;
+    estimateToolInputTokens: typeof estimateToolInputTokens;
+    estimateVisibleToolPartTokens: typeof estimateVisibleToolPartTokens;
+    estimateMessageTokens: typeof estimateMessageTokens;
+    readProviderPromptTokens: typeof readProviderPromptTokens;
+    serializeToolInput: typeof serializeToolInput;
+};

package/dist/hooks/pr-workflow-gate.d.ts

@@ -2,7 +2,7 @@ import * as fsp from 'node:fs/promises';
 import { z } from 'zod';
 import { type CandidateSeverity, type RowFormatFamily } from '../background/candidate-contract.js';
 import { type LaneOutputArtifact } from '../background/lane-output-store.js';
-import { type BackgroundDelegationRecord, type BackgroundDelegationResult, findByBatchId } from '../background/pending-delegations.js';
+import { type BackgroundDelegationRecord, type BackgroundDelegationResult, type BackgroundDelegationWorkflowLaneRecovery, findByBatchId, sweepStaleDelegations } from '../background/pending-delegations.js';
 import { type PrReviewInlineTriggerRow } from '../background/pr-review-trigger-contract.js';
 import { type RevisionDigestResult, resolveCommitCountSince, resolveCommitCountSinceAsync, resolveCurrentGitHead, resolveCurrentGitHeadAsync, resolveCurrentUpstreamPushTarget, resolveCurrentUpstreamPushTargetAsync, resolveCurrentUpstreamRemoteRef, resolveExactRemoteBranchHead, resolveExactRemoteBranchHeadAsync, resolveIsExactSingleChildCommit, resolveIsExactSingleChildCommitAsync, resolveIsWorkingTreeClean, resolveIsWorkingTreeCleanAsync, resolvePrReviewDiffStats, resolvePrReviewDiffStatsAsync, resolvePrWorkflowRevisionDigest, resolvePrWorkflowRevisionDigestDetailed, resolveRemoteRefsContainingHead, resolveRemoteRefsContainingHeadAsync } from '../background/workspace-snapshot.js';
 import { classifyPrWorkflowGitState, type PrWorkflowGitState } from '../git/pr-workflow-state.js';
@@ -10,7 +10,7 @@ export declare const PR_REVIEW_BASE_DIMENSION_IDS: readonly ["intent-architectur
 export declare const PR_REVIEW_REQUIRED_MICRO_LANE_IDS: ("auth-identity-secrets" | "untrusted-input-boundaries" | "subprocess-platform" | "concurrency-state" | "dependencies-build-release" | "api-schema-migrations" | "test-infrastructure" | "ui-accessibility-i18n" | "privacy-observability" | "generated-provenance" | "unclassified-risk")[];
 export type PrReviewBaseDimensionId = (typeof PR_REVIEW_BASE_DIMENSION_IDS)[number];
 export type PrWorkflowMode = 'PR_REVIEW' | 'PR_FEEDBACK';
-export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.truncated' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence';
+export type PrReviewLaneValidationPredicate = 'batch.validated_at' | 'batch.expected_lane_unique' | 'record.missing' | 'record.duplicate_lane' | 'record.subagent_session_id' | 'record.duplicate_subagent_session_id' | 'record.forbidden_subagent_session_id' | 'record.created_at' | 'record.workflow_lane' | 'record.owned_workflow_lanes' | 'record.mode' | 'record.pr_head_sha' | 'record.git_head' | 'record.status' | 'result.output_degraded' | 'result.transcript_incomplete' | 'result.chars' | 'result.digest' | 'result.output_ref' | 'artifact.readable' | 'artifact.ref' | 'artifact.batch_id' | 'artifact.lane_id' | 'artifact.mode' | 'artifact.session_id' | 'artifact.parent_session_id' | 'artifact.agent' | 'artifact.role' | 'artifact.source' | 'artifact.workflow_lane_record' | 'artifact.workflow_lane_expected' | 'artifact.pr_head_sha' | 'artifact.git_head' | 'artifact.revision_digest' | 'record.scope' | 'artifact.scope' | 'artifact.digest' | 'artifact.chars' | 'discovery.header' | 'discovery.row' | 'discovery.coverage' | 'discovery.duplicate_evidence';
 export interface PrReviewLaneValidationFailure {
     predicate: PrReviewLaneValidationPredicate;
     expected: string;
@@ -25,6 +25,8 @@ export type PrReviewLaneValidationResult = {
      * distinguishable from a well-formed one.
      */
     salvaged?: readonly string[];
+    /** Typed recovery disclosures persisted to the durable delegation ledger. */
+    recoveries?: readonly BackgroundDelegationWorkflowLaneRecovery[];
 } | {
     ok: false;
     failure: PrReviewLaneValidationFailure;
@@ -44,6 +46,20 @@ export interface PrReviewDiscoveryLaneValidationInput {
         checkWorkflowLane?: boolean;
     };
 }
+export interface PrWorkflowTransportRecoveryValidationInput {
+    directory: string;
+    record: BackgroundDelegationRecord;
+    result: BackgroundDelegationResult;
+    artifact: LaneOutputArtifact | null;
+    revisionDigest: string;
+}
+export type PrWorkflowTransportRecoveryValidationResult = {
+    ok: true;
+    recoveries?: readonly BackgroundDelegationWorkflowLaneRecovery[];
+} | {
+    ok: false;
+    reason: string;
+};
 export interface PrWorkflowCheckoutRecoveryRecord {
     code: 'UNMERGED_INDEX' | 'GIT_OPERATION_IN_PROGRESS' | 'DIRTY_SUBMODULE' | 'SWARM_STATE_TRACKING_ERROR' | 'GIT_STATE_INDETERMINATE';
     retryable: false;
@@ -408,13 +424,99 @@ export declare function withInactivePrWorkflowCheckoutRestoreLock<T>(directory:
 export declare function clearPrWorkflowGateState(directory: string, sessionID: string, expectedRevision?: number, options?: {
     allowSalvagedRead?: boolean;
 }): Promise<void>;
+/**
+ * The single session operation the liveness probe needs.
+ *
+ * Deliberately a narrow LOCAL structural type rather than a type-only import of
+ * `SessionOps` from `src/tools/dispatch-lanes.ts`: that module's
+ * `isLaneReadyForCollection` is the fail-CLOSED counterpart of this probe, and
+ * keeping the two textually independent removes any invitation to "share" the
+ * predicate. A type-only import would be erased either way; this is about
+ * preventing the wrong reuse, not about module graph cost.
+ */
+interface PrWorkflowLaneLivenessSessionOps {
+    status?: (args: {
+        query?: {
+            directory?: string;
+        };
+    }) => Promise<{
+        data?: Record<string, {
+            type?: string;
+        }> | null;
+        error?: unknown;
+    }>;
+}
+/** Why a probe produced no evidence of life. Absent means the probe ran. */
+export type PrWorkflowLaneProbeDegradedReason = 'probe-unavailable' | 'probe-error' | 'probe-timeout' | 'probe-no-data';
+/**
+ * Probe which of `records` have a session the host affirmatively reports as
+ * still running (issue #2251).
+ *
+ * **FAIL-OPEN, by design.** For its ERROR and NO-DATA cases this is the exact
+ * inverse of `isLaneReadyForCollection` (`src/tools/dispatch-lanes.ts`), which
+ * returns `false` on a truthy `error`, on missing `data`, and on a throw —
+ * because a lane it cannot verify must not be collected. The two agree, rather
+ * than invert, on ONE case: a host that exposes no `status` function at all.
+ * There the collector returns `true` (`dispatch-lanes.ts`, the `typeof
+ * session.status !== 'function'` guard) and this probe reports
+ * `probe-unavailable`, so both fall through to proceeding — an unprobeable host
+ * must not wedge either side.
+ *
+ * Here the default outcome must be "settle": an unavailable, erroring,
+ * timing-out or empty probe returns the empty set, so age alone decides and the
+ * reachability floor this whole subsystem exists to preserve is untouched. Only
+ * a probe that RAN and affirmatively named a live session may contradict
+ * staleness.
+ *
+ * The returned set is built only from a fully-read response — a mid-iteration
+ * throw yields the empty set rather than a partial spare list, so a malformed
+ * response can never spare an arbitrary subset of lanes.
+ *
+ * Keys are `subagentSessionId`s. A record without one is unprobeable and is
+ * simply never added (it settles), which is the fail-open direction.
+ */
+declare function probeAlivePrWorkflowLaneSessions(directory: string, records: BackgroundDelegationRecord[]): Promise<{
+    alive: Set<string>;
+    degradedReason?: PrWorkflowLaneProbeDegradedReason;
+}>;
 export interface PrWorkflowStaleLaneSettlement {
-    /** Lanes still genuinely in flight (fresh `updatedAt`). These still block. */
+    /**
+     * Every lane that still blocks: lanes with a fresh `updatedAt` PLUS lanes
+     * past the horizon whose session the liveness probe reported still running.
+     */
     openLaneIds: string[];
     openLanes: number;
+    /**
+     * Open lanes that block on FRESHNESS alone (age below the horizon).
+     *
+     * Separated from `openLanes` because the human-only `force` abort override
+     * (issue #2251 S3) must distinguish "blocked only by probe retention", which
+     * an operator may override, from "blocked by a lane that is genuinely young",
+     * which stays fail-closed. Deriving it by subtraction or by comparing lane
+     * LABELS would be wrong: `prWorkflowLaneLabel` falls back to `'unknown'`, so
+     * labels are not unique.
+     */
+    freshOpenLanes: number;
     /** Lanes stale past the horizon, treated as settled with disclosure. */
     presumedStaleLaneIds: string[];
-    /** Operator-facing disclosure; `undefined` when nothing was presumed stale. */
+    /**
+     * Lanes past the horizon that the probe spared. Present only when non-empty.
+     */
+    probedAliveLaneIds?: string[];
+    /**
+     * The SAME records as {@link probedAliveLaneIds}, in the same order, keyed by
+     * `correlationId` instead of by display label.
+     *
+     * Both are needed and neither substitutes for the other: `prWorkflowLaneLabel`
+     * falls back to `'unknown'` and is not unique, so it cannot address a durable
+     * record — while `correlationId` is the ledger's primary key and is what the
+     * human-only `force` override must name to finalize exactly these records and
+     * nothing else. Present only when non-empty.
+     */
+    probeRetainedCorrelationIds?: string[];
+    /** Set when the probe could not produce evidence; absent when it ran. */
+    probeDegradedReason?: PrWorkflowLaneProbeDegradedReason;
+    /** Operator-facing disclosure; `undefined` when nothing was settled or retained. */
     disclosure?: string;
 }
 /**
@@ -439,6 +541,13 @@ export interface PrWorkflowStaleLaneSettlement {
  *
  * A lane with a RECENT `updatedAt` still blocks: a re-verification that CAN run
  * and reports "still progressing" contradicts settlement and fails closed.
+ *
+ * Issue #2251 adds the second, stronger contradiction: a lane PAST the horizon
+ * whose session the host affirmatively reports as `busy`/`retry` is genuinely
+ * running (nothing heartbeats `updatedAt`, so age alone cannot see this) and is
+ * retained instead of discarded. The probe is fail-open — see
+ * {@link probeAlivePrWorkflowLaneSessions} — so an unavailable, erroring or
+ * empty probe leaves the age-only behaviour exactly as it was.
  */
 export declare function settlePresumedStalePrWorkflowLanes(directory: string, sessionID: string): Promise<PrWorkflowStaleLaneSettlement>;
 /**
@@ -480,6 +589,16 @@ export declare function abortPrWorkflow(directory: string, sessionID: string, op
     openLanes: number;
     presumedStaleLanes?: string[];
     presumedStaleDisclosure?: string;
+    /** Lanes past the horizon the liveness probe reported as still running. */
+    probeRetainedLanes?: string[];
+    /**
+     * Present ONLY when a human `force` abort cleared the gate while those
+     * probe-retained lanes were the sole remaining reason it was blocked
+     * (issue #2251 S3).
+     */
+    probeRetentionOverrideDisclosure?: string;
+    /** Why the liveness probe produced no evidence, when it could not run. */
+    probeDegradedReason?: PrWorkflowLaneProbeDegradedReason;
     stateSalvaged?: boolean;
     stateSalvageDisclosure?: string;
     casEscapeDisclosure?: string;
@@ -652,6 +771,32 @@ export declare const _test_exports: {
     removeCheckoutLock: typeof removeCheckoutLockFile;
     checkoutMutationActionTimeoutMs: number;
     classifyPrWorkflowGitStateAsync: typeof classifyPrWorkflowGitState;
+    /**
+     * The durability sweep, reached through a seam so a test can prove that a
+     * failing sweep cannot un-settle the decision `settlePresumedStalePrWorkflow-
+     * Lanes` already made in memory. It cannot throw today (it catches internally
+     * and returns 0) — the seam is what makes that guarantee testable rather than
+     * merely asserted.
+     */
+    sweepStaleDelegationsAsync: typeof sweepStaleDelegations;
+    /** The fail-open liveness probe (issue #2251). */
+    probeLaneLivenessAsync: typeof probeAlivePrWorkflowLaneSessions;
+    /**
+     * Session handle for the liveness probe.
+     *
+     * A seam rather than a direct `swarmState.opencodeClient` read at the call
+     * site because 20+ test files mutate that field; without this, this suite and
+     * the stale-lane suite would be order-dependent in bun's shared process.
+     * Mirrors `_internals.getSessionOps` in `src/tools/dispatch-lanes.ts`.
+     */
+    getSessionOps: () => PrWorkflowLaneLivenessSessionOps | null;
+    /**
+     * Probe deadline, read through the seam at CALL time. `freezeClock` patches
+     * `Date.now()`, not `setTimeout`, so a test that must reach the timeout branch
+     * has to shorten the real deadline. Same precedent as
+     * `checkoutMutationActionTimeoutMs` above.
+     */
+    laneLivenessProbeTimeoutMs: number;
     resolveCurrentGitHead: typeof resolveCurrentGitHead;
     resolveCurrentGitHeadAsync: typeof resolveCurrentGitHeadAsync;
     resolveCurrentUpstreamPushTarget: typeof resolveCurrentUpstreamPushTarget;
@@ -918,6 +1063,17 @@ declare function analyzePrReviewBatchRecordIntegrity(args: {
  * accidentally accept stale terminal state or a different output reference.
  */
 export declare function validatePrReviewDiscoveryLaneCompletion(input: PrReviewDiscoveryLaneValidationInput): PrReviewLaneValidationResult;
+/**
+ * Collection-time proof for transport-recovered structured workflow lanes.
+ *
+ * Reviewer/critic/PR-feedback lanes normally settle later through the workflow
+ * gate, not in `collect_lane_results`, so a truncated inline preview used to
+ * pass through collection with no durable typed provenance. This helper proves
+ * the durable artifact still carries the exact rows the already-declared batch
+ * owns, allowing collection to persist the transport recovery immediately. Any
+ * unsupported or unprovable structured mode fails closed.
+ */
+export declare function validatePrWorkflowTransportRecovery(input: PrWorkflowTransportRecoveryValidationInput): Promise<PrWorkflowTransportRecoveryValidationResult>;
 /** Require at least one semantically valid discovery row or CLEAN attestation. */
 export declare function prReviewDiscoveryArtifactCoversLane(text: string, expectedWorkflowLane: string, ownedWorkflowLanes?: readonly string[], mode?: string): boolean;
 /**