opencode-swarm 7.153.0 → 7.153.2

package/dist/commands/registry.d.ts

@@ -845,7 +845,7 @@ export declare const COMMAND_REGISTRY: {
     readonly 'reset-session': {
         readonly handler: (ctx: CommandContext) => Promise<string>;
         readonly description: "Clear session state while preserving plan, evidence, and knowledge";
-        readonly details: "Deletes only .swarm/session/state.json and any other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge for cross-session continuity. Also recovers stale coder settlements, releasing in-flight ownership held by this process, so dispatches cannot stay wedged on CODER_DISPATCH_IN_PROGRESS (issue #2268). Before deleting, auto-backs up the session files it removes to .swarm/reset-backups/<timestamp>/ (newest 5 kept).";
+        readonly details: "Deletes only .swarm/session/state.json and other session files. Clears in-memory agent sessions, delegation chains, and active-agent mappings. Preserves plan, evidence, and knowledge. Also releases this session's pending knowledge-gate obligations (#2398) and recovers stale coder settlements so dispatches cannot wedge on CODER_DISPATCH_IN_PROGRESS (#2268). Auto-backs up removed files to .swarm/reset-backups/ (newest 5 kept).";
         readonly args: "";
         readonly category: "utility";
         readonly toolPolicy: "restricted";

package/dist/commands/reset-session.d.ts

@@ -1,3 +1,4 @@
+import { commitGateReleaseBatch, queryLiveMemberships } from '../hooks/knowledge-receipt-ledger';
 import { recoverStaleCoderSettlements } from '../workflow/coder-settlement.js';
 import { type OrphanCleanupResult } from '../worktree/merge';
 import { type ResetBackupResult } from './reset-backup';
@@ -11,11 +12,16 @@ export declare const _internals: {
     cleanupOrphanedBranches: (directory: string, activeSessionIds: string[]) => Promise<OrphanCleanupResult>;
     backupSwarmStateBeforeReset: (directory: string, kind: 'reset' | 'reset-session', relEntries: string[]) => ResetBackupResult;
     recoverStaleCoderSettlements: typeof recoverStaleCoderSettlements;
+    queryLiveMemberships: typeof queryLiveMemberships;
+    commitGateReleaseBatch: typeof commitGateReleaseBatch;
+    releaseKnowledgeGateObligations: (directory: string, sessionID: string) => Promise<string[]>;
 };
 /**
  * Handles the /swarm reset-session command.
  * Deletes only the session state file (.swarm/session/state.json)
  * and clears in-memory agent sessions. Preserves plan, evidence,
- * and knowledge for continuity across sessions.
+ * and knowledge for continuity across sessions — but DOES release this
+ * session's pending knowledge-application gate obligations (issue #2398) so
+ * the reset is a real escape from an enforce-mode lockout.
  */
-export declare function handleResetSessionCommand(directory: string, _args: string[]): Promise<string>;
+export declare function handleResetSessionCommand(directory: string, _args: string[], sessionID?: string): Promise<string>;

package/dist/consensus/corpus.d.ts

@@ -81,6 +81,7 @@ import { type GateAuditReadSummary } from '../evaluation/store.js';
 import { type LoadEvidenceResult } from '../evidence/manager.js';
 import type { RetrievalOutcome } from '../hooks/knowledge-types.js';
 import { readSkillUsageEntries, type readSkillUsageEntriesWithCoverage } from '../hooks/skill-usage-log.js';
+import { type TrajectoryReadWithCoverage } from '../prm/trajectory-store.js';
 import type { TrajectoryEntry } from '../prm/types.js';
 import type { ConsensusCorpusHash, ConsensusSourceKind } from './contracts.js';
 /**
@@ -129,6 +130,21 @@ export interface CorpusReaders {
     readTaskTrajectory: (directory: string, taskId: string) => Promise<TrajectoryEntry[]>;
     listTrajectorySessions: (directory: string) => Promise<string[]>;
     readTrajectory: (sessionId: string, directory: string) => Promise<TrajectoryEntry[]>;
+    /**
+     * Additive coverage seam (issue #2041 Required 4), mirroring
+     * `readSkillUsageEntriesWithCoverage` above: optional, deliberately NOT
+     * part of `defaultReaders()`, and injecting it overrides BOTH the entries
+     * and the coverage verdict so an injected fixture stays coherent.
+     *
+     * Without it, entries keep coming from `readTrajectory` (injected fixtures
+     * keep working) and the default coverage verdict comes from the session's
+     * persisted checkpoint (`readTrajectoryCheckpoint`) — the same
+     * manifest-only precedent the skill-usage source uses. The default path's
+     * known limit mirrors that precedent too: it discloses compaction eviction
+     * (`droppedEntries`) but not a single read that hit the tail-window byte
+     * cap, which for a within-budget store is unreachable.
+     */
+    readTrajectoryWithCoverage?: (sessionId: string, directory: string) => Promise<TrajectoryReadWithCoverage>;
     readSkillUsageEntries: typeof readSkillUsageEntries;
     /**
      * Additive coverage seam (issue #2038 §7). Optional, and deliberately NOT

package/dist/hooks/delegation-gate/worktree-isolation.d.ts

@@ -13,9 +13,12 @@ import { tryAcquireLock } from '../../parallel/file-locks';
 import { bunSpawn } from '../../utils/bun-compat';
 import { resolveGitExecutable } from '../../utils/git-executable.js';
 import type { WorktreeHandle } from '../../worktree';
-import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, pruneStaleWorktreeMetadata, removeWorktree, startupOrphanRecovery } from '../../worktree';
-import type { DirtyMergeOptions, MergeOperationProvenance } from '../../worktree/merge';
+import { attemptMergeBackFromDirty, cleanupOrphanedBranches, postMergeCleanup, provisionWorktree, pruneStaleWorktreeMetadata, recoverMergeBackFromImmutableCoordinates, removeWorktree, startupOrphanRecovery } from '../../worktree';
+import type { DirtyMergeOptions, ImmutableMergeRecoveryCoordinates, MergeOperationProvenance } from '../../worktree/merge';
+import type { WorktreeProvisioningOwnerRemovalIdentity } from './worktree-provisioning-owner';
 import { recordWorktreeProvisioningOwner, removeWorktreeProvisioningOwner } from './worktree-provisioning-owner';
+import type { WorktreeRecoveryImmutableIdentityInput } from './worktree-recovery-authority';
+import { claimWorktreeRecoveryAuthority, finalizeWorktreeRecoveryAuthority, lookupWorktreeRecoveryAuthoritiesByTask, publishWorktreeRecoveryAuthority, releaseWorktreeRecoveryClaim, renewWorktreeRecoveryClaim, replayWorktreeRecoveryClaimJournal } from './worktree-recovery-authority';
 /**
  * FR-201: Per-lane runtime profile injected into spawned child processes.
  *
@@ -59,8 +62,23 @@ export interface StandardWorktreeDispatch {
     parentSessionID: string;
     taskId: string;
     planTaskId?: string;
+    reservationId?: string;
+    generation?: number;
+    provisioningOwner?: WorktreeProvisioningOwnerRemovalIdentity;
+    canonicalBranch?: string;
+    canonicalPath?: string;
     handle: WorktreeHandle;
     mergeStrategy: 'merge' | 'rebase' | 'cherry-pick';
+    recoveryClaim?: {
+        authorityDigest: string;
+        claimRevision: number;
+        rawToken: string;
+        coordinates?: ImmutableMergeRecoveryCoordinates;
+        settlement?: {
+            sourceCommitOrder: string[];
+            rewrittenCommitOrder: string[];
+        };
+    };
     /** FR-201: 0-based lane index for runtime profile derivation. */
     laneIndex: number;
     /** Configured worktree-dir override, so cleanup trusts the same base. */
@@ -102,6 +120,9 @@ export interface AwaitingMergeRecord {
     parentSessionID: string;
     taskId: string;
     planTaskId?: string;
+    /** Exact durable launch identity threaded from the delegation gate. */
+    reservationId?: string;
+    generation?: number;
     branch: string;
     worktreePath: string;
     mergeStrategy: 'merge' | 'rebase' | 'cherry-pick';
@@ -125,6 +146,11 @@ interface SessionSerializationState {
      */
     successfulDispatchesSince: number;
 }
+interface CleanupStandardWorktreeResult {
+    removedWorktree: boolean;
+    cleanedBranch: boolean;
+    preservedRecoveryLane: boolean;
+}
 export declare function getStandardWorktreeDegradationReason(sessionID: string): {
     reason: string;
     at: number;
@@ -187,6 +213,13 @@ declare function inspectStandardWorktreeCollisionOwnership(identity: {
     branchName: string;
     worktreePath: string;
 }): Promise<import("./worktree-collision-ownership").StandardWorktreeCollisionOwnership>;
+declare function buildWorktreeRecoveryPublishIdentity(input: {
+    directory: string;
+    dispatch: StandardWorktreeDispatch;
+    taskId: string;
+    provenance: MergeOperationProvenance;
+    conflictFiles?: string[];
+}): Promise<WorktreeRecoveryImmutableIdentityInput | undefined>;
 export declare function precreateStandardWorktreeSession(args: {
     config: PluginConfig;
     directory: string;
@@ -194,6 +227,9 @@ export declare function precreateStandardWorktreeSession(args: {
     callID: string;
     taskId: string;
     planTaskId?: string;
+    /** Exact durable launch identity threaded from the delegation gate. */
+    reservationId?: string;
+    generation?: number;
     description?: string;
     outputArgs: Record<string, unknown>;
     /** Scope to materialize into the lane for durability across restart (FR-102). */
@@ -264,7 +300,7 @@ export declare function preserveDirtyWorktreeAtPath(worktreePath: string, branch
  * @param directory - The project root (required for git worktree/branch commands).
  * @param worktree_dir - Configured worktree-dir override.
  */
-export declare function cleanupStandardWorktreeForCallId(callID: string, reason: 'success' | 'denied' | 'cancelled', directory: string, worktree_dir?: string): Promise<void>;
+export declare function cleanupStandardWorktreeForCallId(callID: string, reason: 'success' | 'denied' | 'cancelled', directory: string, worktree_dir?: string): Promise<CleanupStandardWorktreeResult>;
 /**
  * FR-001a: Abort an in-flight standard worktree dispatch.
  *
@@ -310,6 +346,7 @@ export declare const _internals: {
     provisionWorktree: typeof provisionWorktree;
     removeWorktree: typeof removeWorktree;
     attemptMergeBackFromDirty: typeof attemptMergeBackFromDirty;
+    recoverMergeBackFromImmutableCoordinates: typeof recoverMergeBackFromImmutableCoordinates;
     postMergeCleanup: typeof postMergeCleanup;
     pruneStaleWorktreeMetadata: typeof pruneStaleWorktreeMetadata;
     /** FR-201: read lane runtime profile from disk for spawn injection. */
@@ -335,8 +372,18 @@ export declare const _internals: {
     tryAcquireWorktreeLifecycleLock: typeof tryAcquireLock;
     recordWorktreeProvisioningOwner: typeof recordWorktreeProvisioningOwner;
     removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
+    lookupWorktreeRecoveryAuthoritiesByTask: typeof lookupWorktreeRecoveryAuthoritiesByTask;
+    claimWorktreeRecoveryAuthority: typeof claimWorktreeRecoveryAuthority;
+    renewWorktreeRecoveryClaim: typeof renewWorktreeRecoveryClaim;
+    releaseWorktreeRecoveryClaim: typeof releaseWorktreeRecoveryClaim;
+    finalizeWorktreeRecoveryAuthority: typeof finalizeWorktreeRecoveryAuthority;
+    publishWorktreeRecoveryAuthority: typeof publishWorktreeRecoveryAuthority;
+    replayWorktreeRecoveryClaimJournal: typeof replayWorktreeRecoveryClaimJournal;
+    buildWorktreeRecoveryPublishIdentity: typeof buildWorktreeRecoveryPublishIdentity;
     /** FR-001b SC-004: path-based dirty worktree preservation for stale-lane fallback. */
     preserveDirtyWorktreeAtPath: typeof preserveDirtyWorktreeAtPath;
+    /** Bounded lane session.create timeout (tests may override). */
+    worktreeSessionCreateTimeoutMs: number;
     /** FR-001a: abort entry point for in-flight dispatches. */
     abortStandardWorktreeDispatch: typeof abortStandardWorktreeDispatch;
     standardWorktreeByCallID: Map<string, StandardWorktreeDispatch>;

package/dist/hooks/delegation-gate/worktree-provisioning-owner.d.ts

@@ -5,15 +5,36 @@
  */
 export declare const WORKTREE_PROVISIONING_OWNER_LEASE_MS: number;
 export declare const WORKTREE_LIFECYCLE_LOCK_FILE = ".swarm/locks/init-orphan-recovery.lock";
+export declare const WORKTREE_PROVISIONING_LIFECYCLE_STATES: readonly ["OWNER_PUBLISHED", "OWNER_REMOVED"];
+export type WorktreeProvisioningLifecycleState = (typeof WORKTREE_PROVISIONING_LIFECYCLE_STATES)[number];
 export interface WorktreeProvisioningOwner {
-    schemaVersion: 1 | 2;
+    schemaVersion: 1 | 2 | 3;
     callID: string;
     parentSessionId: string;
     worktreeSessionId: string;
     /** Added in v2 so restart collision checks can identify the exact lane. */
     taskId?: string;
+    /** Added in v3 so restart recovery can correlate the exact reservation. */
+    reservationId?: string;
+    /** Added in v3 so restart recovery can fence same-task retries. */
+    generation?: number;
+    /** Added in v3 so crash recovery can corroborate the exact lane ref. */
+    branchName?: string;
     createdAt: number;
 }
+export type WorktreeProvisioningOwnerRemovalIdentity = Pick<WorktreeProvisioningOwner, 'reservationId' | 'generation' | 'branchName'>;
+export interface WorktreeProvisioningLifecycleEntry {
+    schemaVersion: 1;
+    state: WorktreeProvisioningLifecycleState;
+    callID: string;
+    parentSessionId: string;
+    worktreeSessionId: string;
+    taskId?: string;
+    reservationId?: string;
+    generation?: number;
+    branchName?: string;
+    recordedAt: number;
+}
 export type WorktreeProvisioningOwnerScan = {
     status: 'ok';
     owners: WorktreeProvisioningOwner[];
@@ -21,6 +42,16 @@ export type WorktreeProvisioningOwnerScan = {
     status: 'uncertain';
     reason: string;
 };
+export type WorktreeProvisioningLifecycleJournalScan = {
+    status: 'ok';
+    entries: WorktreeProvisioningLifecycleEntry[];
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+declare function ownerPath(directory: string, callID: string): string;
+declare function journalPath(directory: string): string;
+declare function readOwner(directory: string, callID: string): WorktreeProvisioningOwner | null;
 /**
  * Publish a provisional owner before a standard worktree can be created.
  * Callers hold the shared orphan-recovery lifecycle lock during this atomic
@@ -28,9 +59,16 @@ export type WorktreeProvisioningOwnerScan = {
  */
 export declare function recordWorktreeProvisioningOwner(directory: string, input: Omit<WorktreeProvisioningOwner, 'schemaVersion' | 'createdAt'>): WorktreeProvisioningOwner;
 /** Remove a provisional owner only after durable ownership or cleanup exists. */
-export declare function removeWorktreeProvisioningOwner(directory: string, callID: string): boolean;
+export declare function removeWorktreeProvisioningOwner(directory: string, callID: string, expected?: WorktreeProvisioningOwnerRemovalIdentity): boolean;
 /**
  * Strict recovery scan. Anything except ENOENT is uncertainty because omitting
  * one marker could allow destructive cleanup to race a live worktree.
  */
 export declare function scanWorktreeProvisioningOwnersForRecovery(directory: string): WorktreeProvisioningOwnerScan;
+export declare function scanWorktreeProvisioningLifecycleJournalForRecovery(directory: string): WorktreeProvisioningLifecycleJournalScan;
+export declare const _internals: {
+    getOwnerPath: typeof ownerPath;
+    getJournalPath: typeof journalPath;
+    readOwner: typeof readOwner;
+};
+export {};

package/dist/hooks/delegation-gate/worktree-recovery-authority.d.ts

@@ -0,0 +1,201 @@
+export declare const WORKTREE_RECOVERY_MUTATOR_NAMES: readonly ["publish", "claim", "renew", "release", "finalize", "replay"];
+export type WorktreeRecoveryMutatorName = (typeof WORKTREE_RECOVERY_MUTATOR_NAMES)[number];
+export type WorktreeRecoveryStrategy = 'merge' | 'rebase' | 'cherry-pick';
+export type WorktreeRecoveryStatus = 'preserved' | 'claimed' | 'released' | 'finalized';
+export type WorktreeRecoveryJournalState = 'PREPARED' | 'COMMITTED' | 'CLAIM_RENEWED' | 'ABORTED' | 'RELEASED' | 'FINALIZED';
+export interface WorktreeRecoveryImmutableIdentityInput {
+    originalCallID: string;
+    parentSessionId: string;
+    taskId: string;
+    reservationId: string;
+    generation: number;
+    canonicalBranch: string;
+    canonicalPath: string;
+    laneBranch: string;
+    lanePath: string;
+    expectedPrimaryHead: string;
+    sourceBaseOid: string;
+    sourceHeadOid: string;
+    targetHeadOid: string;
+    strategy: WorktreeRecoveryStrategy;
+    declaredConflictFiles?: string[];
+}
+export interface WorktreeRecoveryImmutableIdentity extends WorktreeRecoveryImmutableIdentityInput {
+    createdAt: number;
+}
+export interface WorktreeRecoveryClaimState {
+    claimantCallID: string;
+    claimantSessionId: string;
+    childSessionId: string;
+    claimRevision: number;
+    attempt: number;
+    leaseExpiresAt: number;
+    claimTokenDigest: string;
+    claimedAt: number;
+}
+export interface WorktreeRecoveryAuthorityRecord {
+    schemaVersion: 2;
+    authorityDigest: string;
+    immutable: WorktreeRecoveryImmutableIdentity;
+    status: WorktreeRecoveryStatus;
+    claim?: WorktreeRecoveryClaimState;
+    claimCursor?: {
+        lastClaimRevision: number;
+        lastAttempt: number;
+    };
+    finalizedAt?: number;
+    settlement?: {
+        sourceCommitOrder: string[];
+        rewrittenCommitOrder: string[];
+    };
+}
+interface WorktreeRecoveryStore {
+    schemaVersion: 2;
+    authorities: WorktreeRecoveryAuthorityRecord[];
+    index: {
+        bySessionTask: Record<string, string[]>;
+    };
+}
+export interface WorktreeRecoveryClaimJournalEntry {
+    schemaVersion: 1;
+    authorityDigest: string;
+    state: WorktreeRecoveryJournalState;
+    claimantCallID: string;
+    claimantSessionId: string;
+    childSessionId?: string;
+    claimRevision: number;
+    attempt: number;
+    leaseExpiresAt: number;
+    claimTokenDigest: string;
+    preparedAt: number;
+    credentialInstalledAt?: number;
+    committedAt?: number;
+    abortedAt?: number;
+    reason?: string;
+}
+interface WorktreeRecoveryClaimJournal {
+    schemaVersion: 1;
+    entries: WorktreeRecoveryClaimJournalEntry[];
+}
+interface WorktreeRecoveryCredential {
+    schemaVersion: 1;
+    authorityDigest: string;
+    claimantCallID: string;
+    claimantSessionId: string;
+    childSessionId: string;
+    claimRevision: number;
+    rawToken: string;
+    leaseExpiresAt: number;
+    createdAt: number;
+}
+type ScanStatus = 'ok' | 'unsupported-legacy' | 'uncertain';
+export type WorktreeRecoveryScanResult = {
+    status: 'ok';
+    authorities: WorktreeRecoveryAuthorityRecord[];
+} | {
+    status: 'unsupported-legacy';
+    reason: string;
+} | {
+    status: 'uncertain';
+    reason: string;
+};
+export type WorktreeRecoveryLookupResult = {
+    status: 'ok';
+    authorities: WorktreeRecoveryAuthorityRecord[];
+} | {
+    status: Exclude<ScanStatus, 'ok'>;
+    reason: string;
+};
+type BaseMutationFailureCode = 'not_found' | 'busy' | 'stale_claim' | 'retry_cap_exceeded' | 'revalidation_required' | 'revalidation_failed' | 'unsupported_legacy' | 'uncertain_store' | 'finalized';
+type BaseMutationFailure = {
+    ok: false;
+    code: BaseMutationFailureCode;
+    reason: string;
+};
+export type PublishWorktreeRecoveryAuthorityResult = {
+    ok: true;
+    authority: WorktreeRecoveryAuthorityRecord;
+} | BaseMutationFailure;
+export type ClaimWorktreeRecoveryAuthorityResult = {
+    ok: true;
+    authority: WorktreeRecoveryAuthorityRecord;
+    rawToken: string;
+    credentialPath: string;
+} | BaseMutationFailure;
+export type MutateWorktreeRecoveryClaimResult = {
+    ok: true;
+    authority: WorktreeRecoveryAuthorityRecord;
+} | BaseMutationFailure;
+export interface ClaimWorktreeRecoveryAuthorityRequest {
+    authorityDigest: string;
+    claimantCallID: string;
+    claimantSessionId: string;
+    now?: number;
+    leaseMs: number;
+    maxAttempts?: number;
+    createChildSession: () => string | Promise<string>;
+    revalidateExpiredClaim?: (args: {
+        authority: WorktreeRecoveryAuthorityRecord;
+        previousClaim: WorktreeRecoveryClaimState;
+    }) => {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    } | Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+}
+interface ExactClaimMutationRequest {
+    authorityDigest: string;
+    claimantCallID: string;
+    claimRevision: number;
+    rawToken: string;
+    now?: number;
+}
+export interface FinalizeWorktreeRecoveryAuthorityRequest extends ExactClaimMutationRequest {
+    settlement?: {
+        sourceCommitOrder: string[];
+        rewrittenCommitOrder: string[];
+    };
+}
+export interface ReplayPreparedClaimOptions {
+    onAbortPreparedClaim?: (entry: WorktreeRecoveryClaimJournalEntry) => void;
+}
+export interface ReplayPreparedClaimOutcome {
+    authorityDigest: string;
+    outcome: 'aborted_prepared_claim' | 'removed_uncommitted_credential' | 'committed_claim_stable' | 'released_orphaned_committed_claim' | 'repaired_terminal_claim' | 'uncertain_committed_without_authority' | 'noop';
+}
+declare function storePath(directory: string): string;
+declare function journalPath(directory: string): string;
+declare function credentialPath(directory: string, authorityDigest: string): string;
+declare function acquireAuthorityLock(directory: string): (() => void) | undefined;
+export declare function publishWorktreeRecoveryAuthority(directory: string, input: WorktreeRecoveryImmutableIdentityInput): PublishWorktreeRecoveryAuthorityResult;
+export declare function scanWorktreeRecoveryAuthoritiesForRecovery(directory: string): WorktreeRecoveryScanResult;
+export declare function lookupWorktreeRecoveryAuthoritiesByTask(directory: string, query: {
+    parentSessionId: string;
+    taskId: string;
+}): WorktreeRecoveryLookupResult;
+export declare function claimWorktreeRecoveryAuthority(directory: string, request: ClaimWorktreeRecoveryAuthorityRequest): Promise<ClaimWorktreeRecoveryAuthorityResult>;
+export declare function renewWorktreeRecoveryClaim(directory: string, request: ExactClaimMutationRequest & {
+    leaseMs: number;
+}): MutateWorktreeRecoveryClaimResult;
+export declare function releaseWorktreeRecoveryClaim(directory: string, request: ExactClaimMutationRequest): MutateWorktreeRecoveryClaimResult;
+export declare function finalizeWorktreeRecoveryAuthority(directory: string, request: FinalizeWorktreeRecoveryAuthorityRequest): MutateWorktreeRecoveryClaimResult;
+export declare function replayWorktreeRecoveryClaimJournal(directory: string, options?: ReplayPreparedClaimOptions): ReplayPreparedClaimOutcome[];
+export declare const _internals: {
+    generateRawToken: () => string;
+    writeRecoveryStore: (targetPath: string, store: WorktreeRecoveryStore, _phase: "publish" | "claim-commit" | "claim-renew" | "claim-release" | "claim-finalize") => void;
+    writeClaimJournal: (targetPath: string, journal: WorktreeRecoveryClaimJournal) => void;
+    writeCredentialFile: (targetPath: string, credential: WorktreeRecoveryCredential) => void;
+    getRecoveryStorePath: typeof storePath;
+    getClaimJournalPath: typeof journalPath;
+    getCredentialPath: typeof credentialPath;
+    acquireAuthorityLock: typeof acquireAuthorityLock;
+    readClaimJournal(directory: string): WorktreeRecoveryClaimJournal;
+    resetForTest(): void;
+};
+export {};

package/dist/hooks/init-orphan-recovery.d.ts

@@ -21,7 +21,8 @@ import { isLocked, listActiveLocks, tryAcquireLock } from '../parallel/file-lock
 import { removeWorktree } from '../worktree/core';
 import { scanRegisteredWorktreeLiveness } from '../worktree/merge';
 import { scanWorktreeMergeFailuresForRecovery } from './delegation-gate/worktree-merge-status';
-import { removeWorktreeProvisioningOwner, scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
+import { removeWorktreeProvisioningOwner, scanWorktreeProvisioningLifecycleJournalForRecovery, scanWorktreeProvisioningOwnersForRecovery } from './delegation-gate/worktree-provisioning-owner';
+import { replayWorktreeRecoveryClaimJournal, scanWorktreeRecoveryAuthoritiesForRecovery } from './delegation-gate/worktree-recovery-authority';
 type OwnershipTagSessionScan = {
     status: 'ok';
     sessionIds: string[];
@@ -51,7 +52,10 @@ export declare const _internals: {
     recordDelegationRecoveryObservation: typeof recordDelegationRecoveryObservation;
     scanDelegationFallbacksForRecovery: typeof scanDelegationFallbacksForRecovery;
     scanWorktreeMergeFailuresForRecovery: typeof scanWorktreeMergeFailuresForRecovery;
+    scanWorktreeRecoveryAuthoritiesForRecovery: typeof scanWorktreeRecoveryAuthoritiesForRecovery;
+    replayWorktreeRecoveryClaimJournal: typeof replayWorktreeRecoveryClaimJournal;
     scanWorktreeProvisioningOwnersForRecovery: typeof scanWorktreeProvisioningOwnersForRecovery;
+    scanWorktreeProvisioningLifecycleJournalForRecovery: typeof scanWorktreeProvisioningLifecycleJournalForRecovery;
     scanRegisteredWorktreeLiveness: typeof scanRegisteredWorktreeLiveness;
     removeWorktreeProvisioningOwner: typeof removeWorktreeProvisioningOwner;
 };

package/dist/hooks/knowledge-application-gate.d.ts

@@ -30,13 +30,22 @@
  *   - update_task_status
  *   - phase_complete
  *   - Task (delegations to coder/reviewer/test_engineer/sme/docs/designer)
+ *   - skill_regenerate
+ *   - skill_retire
  *
  * Non-architect agents are never gated.
  */
 import { type KnowledgeApplicationConfig } from './knowledge-application.js';
 import { type ReceiptMembership } from './knowledge-receipt-ledger.js';
 import type { MessageWithParts } from './knowledge-types.js';
-/** Tools that require knowledge-directive acknowledgment before execution. */
+/**
+ * Fallback set used only when `config.high_risk_tools` is absent. The parsed
+ * config schema (`KnowledgeApplicationConfigSchema`) defaults
+ * `high_risk_tools` to a 5-tool list (save_plan, update_task_status,
+ * phase_complete, task, Task) that is always populated post-parse, so this
+ * constant is shadowed in practice and `skill_regenerate` / `skill_retire`
+ * are NOT gated unless the operator's config lists them explicitly.
+ */
 export declare const HIGH_RISK_TOOLS: Set<string>;
 export interface GateInput {
     tool: unknown;

package/dist/hooks/knowledge-receipt-ledger.d.ts

@@ -27,7 +27,7 @@ export declare const RECEIPT_TERMINAL_OUTCOMES: ReadonlySet<ReceiptOutcome>;
  * preserved as `'unknown'` and is never coerced to delegate, ignored, or any
  * other class. New producers must stamp one of the closed values below.
  */
-export type ReceiptSourceCode = 'delegate' | 'reviewer' | 'architect' | 'architect_marker' | 'test_engineer' | 'phase_override' | 'application_gate_staleness_release' | 'application_gate_denial_limit_release' | 'manual' | 'migration' | 'unknown';
+export type ReceiptSourceCode = 'delegate' | 'reviewer' | 'architect' | 'architect_marker' | 'test_engineer' | 'phase_override' | 'application_gate_staleness_release' | 'application_gate_denial_limit_release' | 'application_gate_session_reset_release' | 'manual' | 'migration' | 'unknown';
 /** Closed set form of {@link ReceiptSourceCode}. */
 export declare const CANONICAL_RECEIPT_SOURCES: ReadonlySet<string>;
 /**

package/dist/hooks/trajectory-logger.d.ts

@@ -9,6 +9,13 @@
  */
 export interface TrajectoryConfig {
     enabled: boolean;
+    /**
+     * Line budget for BOTH the session store's in-memory cache trim AND its
+     * on-disk compaction (issue #2041): over budget, the newest
+     * floor(max_lines/2) entries are retained on disk and in cache, and the
+     * derived byte ceiling is sovereign. The task-evidence copy below uses the
+     * same value for its own write-side truncation.
+     */
     max_lines: number;
 }
 export interface TrajectoryEntry {
@@ -64,8 +71,8 @@ declare function extractTarget(tool: string, args?: Record<string, unknown>): st
 /**
  * Creates the trajectory logger hook pair.
  *
- * @param config - TrajectoryConfig { enabled: boolean (default true), max_lines: number (default 500) }
- * @param _directory - Reserved for future use (evidence path derived from session taskId)
+ * @param config - TrajectoryConfig { enabled: boolean (default true), max_lines: number (default 500) — bounds the session store's cache AND disk compaction plus the task-evidence truncation }
+ * @param _directory - Workspace root (session store + evidence paths derive from it)
  * @returns Object with toolAfter handler
  */
 export declare function createTrajectoryLoggerHook(config: Partial<TrajectoryConfig>, _directory: string): {
@@ -90,8 +97,9 @@ export declare function createTrajectoryLoggerHook(config: Partial<TrajectoryCon
  * the record of it.
  *
  * Contract:
- *   - The step is minted with the SHARED `nextTrajectoryStep(sessionId)`. Any
- *     private counter would desynchronise the `prmTrajectoryStep` window and
+ *   - The step is minted with the SHARED `nextTrajectoryStep(sessionId, directory)`
+ *     (seeded from the persisted high-water mark — see ensureSessionStepSeeded).
+ *     Any private counter would desynchronise the `prmTrajectoryStep` window and
  *     silently break PRM's step-range filtering.
  *   - `session.delegationActive` gates recording at all (the architect session
  *     is deliberately out of scope); the task-evidence copy additionally
@@ -117,13 +125,18 @@ export declare function recordDeniedToolCall(sessionID: string, input: {
 export declare function clearDeniedCallMarkers(): void;
 /**
  * Resets the step counter for a session. Called when a new session starts
- * or when trajectory tracking should restart from step 1.
+ * or when trajectory tracking should restart from step 1. The restart-seed
+ * gate is invalidated so the next mint re-seeds from the persisted
+ * high-water mark (issue #2041 monotonicity).
  *
  * @param sessionId - Session identifier
+ * @param directory - Workspace root owning the session's trajectory store
  */
-export declare function resetTrajectoryStep(sessionId: string): void;
+export declare function resetTrajectoryStep(sessionId: string, directory?: string): void;
 /**
  * Clears trajectory step counters for one session, or all sessions when omitted.
+ * The restart-seed gate is invalidated alongside so a cleared session re-seeds
+ * from disk on its next mint (issue #2041 monotonicity).
  *
  * @param sessionId - Optional session identifier
  */
@@ -140,6 +153,7 @@ export declare function recordToolCallStart(sessionId: string, callID: string, s
 /**
  * Tier-0 pure-function test seam (writing-tests skill). These helpers take no
  * external dependencies, so testing them directly needs no mocks at all.
+ * The seed-gate accessors cover the restart-seeding state machine (issue #2041).
  */
 export declare const _test_exports: {
     readonly deriveAction: typeof deriveAction;
@@ -147,5 +161,7 @@ export declare const _test_exports: {
     readonly MAX_DENIED_CALL_MARKERS: 500;
     readonly DENIED_CALL_TTL_MS: number;
     readonly deniedCallMarkerCount: () => number;
+    readonly stepSeedGateSize: () => number;
+    readonly clearStepSeedGate: () => void;
 };
 export {};

package/dist/hooks/trajectory-step-state.d.ts

@@ -1,11 +1,52 @@
 /**
  * Module-level trajectory step counters shared by runtime reset code and the
  * trajectory logger without creating a state <-> hook import cycle.
+ *
+ * Keys are canonical-root + session id (issue #2041 Required 6): the counters
+ * are process-global module state, so a host that loads one plugin module
+ * instance for several project roots must not let two roots' sessions with
+ * the same host session id share a counter — nor let two aliases of one root
+ * diverge. The shared `src/utils/canonical-root.ts` helper owns the keying so
+ * the trajectory store, these counters, and the logger's restart-seed gate
+ * cannot drift. `directory` is required on the minting/seed path; the clear
+ * paths may omit it and suffix-scan every root, because the reset entry
+ * points legitimately lack a directory.
+ */
+/** Current step-counter generation (changes on every clear/reset). */
+export declare function trajectoryStepGeneration(): number;
+/**
+ * Mints the next sequential step for a session. Restart continuity is the
+ * logger's job (`ensureSessionStepSeeded` in trajectory-logger.ts seeds the
+ * counter from the bounded store before the first mint), not this counter's.
+ */
+export declare function nextTrajectoryStep(sessionId: string, directory: string): number;
+/**
+ * Raises a session's counter to `step` when it is higher than the current
+ * value. Used by the restart-seed path so a resumed session continues minting
+ * monotonically after the on-disk high-water mark instead of restarting at 1
+ * (which would duplicate step numbers against the persisted trajectory).
+ * A lower value never lowers the counter (issue #2041 monotonicity).
+ */
+export declare function seedTrajectoryStepCounter(sessionId: string, directory: string, step: number): void;
+/**
+ * Resets the step counter for a session to zero (module-level semantics —
+ * "restart at step one"). The production reset entry points go through
+ * trajectory-logger.ts, which also invalidates the per-process restart-seed
+ * gate so the next mint re-seeds from disk and steps stay monotonic against
+ * the persisted trajectory.
+ */
+export declare function resetTrajectoryStepCounter(sessionId: string, directory: string): void;
+/**
+ * Clears trajectory step counters for one session (every canonical root — the
+ * reset entry points legitimately lack a directory), or all sessions when
+ * omitted.
  */
-export declare function nextTrajectoryStep(sessionId: string): number;
-export declare function resetTrajectoryStepCounter(sessionId: string): void;
 export declare function clearTrajectoryStepCounters(sessionId?: string): void;
 export declare const _test_exports: {
     MAX_TRACKED_STEP_SESSIONS: number;
     getTrackedStepSessionCount: () => number;
+    /** Whether a counter exists for this session+root in this process. */
+    hasTrajectoryStepCounter: (sessionId: string, directory: string) => boolean;
+    /** Current generation (test seam: gate-invalidation assertions). */
+    getStepCounterGeneration: () => number;
 };