opencode-swarm 7.159.1 → 7.159.2

package/dist/cli/{index-86dvzyac.js → index-9ev0bbqh.js}

@@ -6,7 +6,7 @@ import {
   resolveExecutableFromPath,
   runEvaluation,
   runExternalTool
-} from "./index-tvz43tea.js";
+} from "./index-jd7mz4yg.js";
 import {
   finalizeShellAuditForClose,
   isPolicyProtectedPath,
@@ -15,13 +15,13 @@ import {
   protectedRoots,
   redactDecisionLineForArchive,
   stableCanonicalStringify
-} from "./index-9fphcxes.js";
+} from "./index-nmp47dmm.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-60mzwj91.js";
+} from "./index-e1jcdpdg.js";
 import {
   MAX_TRANSIENT_RETRIES,
   archiveEvidence,
@@ -68,7 +68,7 @@ import {
   validateProjectRoot,
   validateSymlinkBoundary,
   validateTargetWithinRoot
-} from "./index-f3yphmk6.js";
+} from "./index-7tjamatf.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -85,7 +85,7 @@ import {
   saveGateAuditResult,
   savePromotionDecision,
   saveTaskSetSnapshot
-} from "./index-zxkv8x5n.js";
+} from "./index-ky2r092m.js";
 import {
   canonicalHash,
   canonicalJson,
@@ -129,15 +129,15 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-29wav1x0.js";
+} from "./index-y55hqgcj.js";
 import {
   readRecentEscalations
-} from "./index-gkw7kq6z.js";
+} from "./index-b2dh37cf.js";
 import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-4nc9npx5.js";
+} from "./index-m0gfzxw1.js";
 import {
   CURATOR_INIT_PROMPT,
   CURATOR_PHASE_PROMPT,
@@ -161,7 +161,7 @@ import {
   listActive,
   subscribe,
   unsubscribe
-} from "./index-1qpagg2t.js";
+} from "./index-6sheh3yp.js";
 import {
   clearWorktreeMergeStatus,
   getAllWorktreeMergeFailures,
@@ -173,7 +173,7 @@ import {
   listCoderSettlementWalStates,
   recoverCoderSettlement,
   recoverStaleCoderSettlements
-} from "./index-9yxyc1gb.js";
+} from "./index-rq461prn.js";
 import {
   parsePorcelainV2Snapshot,
   resolveCommitCountSince,
@@ -206,7 +206,7 @@ import {
   WORKTREE_LIFECYCLE_LOCK_FILE,
   recordWorktreeProvisioningOwner,
   removeWorktreeProvisioningOwner
-} from "./index-6z53bew2.js";
+} from "./index-w1rhyqw2.js";
 import {
   appendUnactionable,
   quarantineEntry,
@@ -217,11 +217,11 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-8819vcke.js";
+} from "./index-8ahjx7vt.js";
 import {
   authorizeCuration,
   buildConfigFingerprintInput
-} from "./index-54pkyasv.js";
+} from "./index-egc8d995.js";
 import {
   cohortConfigFingerprint
 } from "./index-rtry5xyf.js";
@@ -252,12 +252,12 @@ import {
   transitionTaskWorkflowEvidence,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-zmc8mm7v.js";
+} from "./index-eh1gh043.js";
 import {
   makeWorktreeBranchName,
   provisionWorktree,
   removeWorktree
-} from "./index-ve3v09kq.js";
+} from "./index-8gh97gkz.js";
 import {
   DEFAULT_STALE_DELEGATION_TIMEOUT_MS,
   DELEGATION_COMPACTION_HIGH_WATER_BYTES,
@@ -272,7 +272,7 @@ import {
   scanBackgroundCoderReservationsForAdmission,
   scanDelegationsForRecovery,
   sweepStaleDelegations
-} from "./index-4k9pqbxw.js";
+} from "./index-caqjwnak.js";
 import {
   compositeSessionKey,
   sessionKeySuffix
@@ -283,7 +283,7 @@ import {
   clearAllScopes,
   clearScopeBindingFromDisk,
   clearScopeBindings
-} from "./index-bz7ayg01.js";
+} from "./index-b5s1n149.js";
 import {
   appendLedgerEvent,
   computePlanHash,
@@ -298,7 +298,7 @@ import {
   readPlanEpochIdentity,
   replayFromLedgerWithStatus,
   takeSnapshotEvent
-} from "./index-k6y6btb6.js";
+} from "./index-v7wm4mw8.js";
 import {
   CORE_EVENT_LOCKED,
   appendCoreEventSync,
@@ -357,7 +357,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-bea260ta.js";
+} from "./index-bmst1sje.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals as _internals2,
@@ -373,13 +373,13 @@ import {
   recordKnowledgeEvent,
   recordPhaseCloseIntent,
   resolveKnowledgeEventsPath
-} from "./index-yw26j0q7.js";
+} from "./index-qypnqmcj.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-3scbg6n2.js";
+} from "./index-wzc6vzq6.js";
 import {
   RetrospectiveEvidenceSchema
-} from "./index-gprxjmm7.js";
+} from "./index-ebz97mks.js";
 import {
   estimateTokens,
   readSwarmFileAsync,
@@ -399,7 +399,7 @@ import {
   init_loader,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-7yg4ypyg.js";
+} from "./index-dgt8z19x.js";
 import {
   DEFAULT_HARNESS_EVOLUTION_CONFIG,
   DEFAULT_PR_REVIEW_RESILIENCE_CONFIG,
@@ -415,7 +415,7 @@ import {
   package_default,
   resolveAutoReviewConfig,
   stripKnownSwarmPrefix
-} from "./index-wae55z9w.js";
+} from "./index-1xcve0gc.js";
 import {
   init_git_executable,
   resolveGitExecutable,
@@ -455,10 +455,10 @@ import {
   resolveLinkDir,
   sanitizeLinkId,
   writeLinkPointer
-} from "./index-g6d8xam2.js";
+} from "./index-vq4d1h7t.js";
 import {
   atomicWriteFile
-} from "./index-v3jy0tc6.js";
+} from "./index-1e9rzhmr.js";
 import {
   KNOWLEDGE_SCHEMA_VERSION,
   OUTCOME_BLOCK_THRESHOLD,
@@ -470,7 +470,7 @@ import {
   atomicWriteSwarmFileSync,
   matchTempGrammar,
   parseTargetBasename
-} from "./index-a5w29k1t.js";
+} from "./index-q8yma345.js";
 import {
   assertProjectRoot,
   hasExplicitProjectBoundary,
@@ -21454,7 +21454,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2z00wqvb.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-mcan50mx.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -22584,7 +22584,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-vwcrfrw3.js");
+        const skillModule = await import("./skill-generator-6tjyffgd.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -23056,7 +23056,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-585m4927.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-rxagfxnk.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -23875,7 +23875,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-kv9scb2v.js");
+      const { getScanStatus } = await import("./scan-cursor-fasdj7kj.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -24047,9 +24047,9 @@ var _internals27 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-a7f88yc3.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-3x28z3rp.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2z00wqvb.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-mcan50mx.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -24057,11 +24057,11 @@ var _internals27 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-mpqpbr0r.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-n81nzdw8.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-zjtgbh4w.js");
+    const { checkHivePromotions } = await import("./hive-promoter-brq9cx7c.js");
     return checkHivePromotions(entries, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -24070,7 +24070,7 @@ var _internals27 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-vwcrfrw3.js");
+    } = await import("./skill-generator-6tjyffgd.js");
     const result = {
       approved: [],
       rejected: [],
@@ -25400,9 +25400,9 @@ function hashContent(content) {
   return createHash13("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-a7f88yc3.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-3x28z3rp.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2z00wqvb.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-mcan50mx.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -37655,7 +37655,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-a7f88yc3.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-3x28z3rp.js");
     const { config: pmLoadedConfig } = _internals41.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -39879,9 +39879,9 @@ var _internals45 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
-      import("./schema-a7f88yc3.js"),
-      import("./curator-mpqpbr0r.js"),
-      import("./curator-llm-factory-m3yw6sn5.js")
+      import("./schema-3x28z3rp.js"),
+      import("./curator-n81nzdw8.js"),
+      import("./curator-llm-factory-24bfn7h1.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -40890,7 +40890,7 @@ async function computeCurationDiagnostics(directory, entries) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-kv9scb2v.js");
+    const { getScanStatus } = await import("./scan-cursor-fasdj7kj.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -40898,19 +40898,19 @@ async function computeCurationDiagnostics(directory, entries) {
   } catch {}
   let configMatch = null;
   try {
-    const { isLinked: isLinked2 } = await import("./knowledge-link-a9fafeb3.js");
+    const { isLinked: isLinked2 } = await import("./knowledge-link-n1825n09.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-a7f88yc3.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-3x28z3rp.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-2z00wqvb.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-mcan50mx.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
         config = KnowledgeConfigSchema2.parse({});
       }
       const { cohortConfigFingerprint: cohortConfigFingerprint2 } = await import("./config-fingerprint-v22xh5a2.js");
-      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-2gq8307w.js");
+      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-z0a5akng.js");
       const currentFp = cohortConfigFingerprint2(buildConfigFingerprintInput2(config));
       const cohortFp = await readCohortConfigFingerprint(directory);
       configMatch = cohortFp === null ? null : currentFp === cohortFp;
@@ -42223,7 +42223,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-8zawz3qh.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-00ex0s3k.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -43163,7 +43163,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-qaq1eba9.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-nz7y1w2a.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -47930,9 +47930,11 @@ function hasBundledRules(projectRoot) {
 import * as crypto3 from "crypto";
 import * as fs26 from "fs";
 import * as path62 from "path";
-var BASELINE_SCHEMA_VERSION = "1.0.0";
+var BASELINE_SCHEMA_VERSION = "1.1.0";
+var LEGACY_BASELINE_SCHEMA_VERSION = "1.0.0";
 var MAX_BASELINE_FINDINGS = 2000;
 var MAX_BASELINE_BYTES = 2 * 1048576;
+var MAX_BLOCKED_LIST = 20;
 var LOCK_RETRY_DELAYS_MS = [50, 100, 200, 400, 800];
 function normalizeFindingPath(directory, file) {
   const resolved = path62.isAbsolute(file) ? file : path62.resolve(directory, file);
@@ -47991,6 +47993,7 @@ function assignOccurrenceIndices(findings, directory) {
     const relFile = normalizeFindingPath(directory, finding.location.file);
     const lineNum = finding.location.line;
     let baseKey;
+    let reflowKey = "";
     try {
       if (relFile.startsWith(".."))
         throw new Error("escapes workspace");
@@ -48006,6 +48009,8 @@ function assignOccurrenceIndices(findings, directory) {
 `);
       const hash2 = crypto3.createHash("sha256").update(window).digest("hex").slice(0, 16);
       baseKey = `${relFile}|${finding.rule_id}|${hash2}`;
+      const lineHash = crypto3.createHash("sha256").update(getLine(lines, idx)).digest("hex").slice(0, 16);
+      reflowKey = `${relFile}|${finding.rule_id}|${lineHash}`;
     } catch {
       baseKey = `${relFile}|${finding.rule_id}|L${lineNum}|UNSTABLE`;
     }
@@ -48016,10 +48021,38 @@ function assignOccurrenceIndices(findings, directory) {
       finding,
       index: occIdx,
       stable: fp.stable,
-      fingerprint: fp.fingerprint
+      fingerprint: fp.fingerprint,
+      reflowKey
     };
   });
 }
+function partitionAgainstBaseline(indexed, baselineFingerprints, baselineReflowKeys) {
+  const reflowCounts = new Map;
+  for (const key of baselineReflowKeys) {
+    if (!key)
+      continue;
+    reflowCounts.set(key, (reflowCounts.get(key) ?? 0) + 1);
+  }
+  const preExisting = [];
+  const moved = [];
+  const newFindings = [];
+  for (const { finding, stable, fingerprint, reflowKey } of indexed) {
+    if (stable && baselineFingerprints.has(fingerprint)) {
+      preExisting.push(finding);
+      if (reflowKey) {
+        const count = reflowCounts.get(reflowKey) ?? 0;
+        if (count > 0)
+          reflowCounts.set(reflowKey, count - 1);
+      }
+    } else if (stable && reflowKey && (reflowCounts.get(reflowKey) ?? 0) > 0) {
+      reflowCounts.set(reflowKey, (reflowCounts.get(reflowKey) ?? 1) - 1);
+      moved.push(finding);
+    } else {
+      newFindings.push(finding);
+    }
+  }
+  return { preExisting, moved, newFindings };
+}
 async function waitForLockRetry(delayMs, abortSignal) {
   if (abortSignal?.aborted)
     return false;
@@ -48110,25 +48143,96 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
     try {
       const raw = fs26.readFileSync(baselinePath, "utf-8");
       const parsed = JSON.parse(raw);
-      if (parsed.schema_version === BASELINE_SCHEMA_VERSION) {
+      if (parsed.schema_version === BASELINE_SCHEMA_VERSION || parsed.schema_version === LEGACY_BASELINE_SCHEMA_VERSION) {
         existing = parsed;
       }
     } catch {}
     const scannedRelFiles = new Set(scannedFiles.map((f) => normalizeFindingPath(directory, f)));
     const indexed = _internals56.assignOccurrenceIndices(findings, directory);
     if (existing && !opts?.force) {
-      const prunedFingerprints = existing.fingerprints.filter((fp) => {
+      const prunedFingerprints = [];
+      const prunedReflowKeys = [];
+      existing.fingerprints.forEach((fp, i) => {
         const relFile = fp.slice(0, fp.indexOf("|"));
-        return !scannedRelFiles.has(relFile);
+        if (scannedRelFiles.has(relFile))
+          return;
+        prunedFingerprints.push(fp);
+        prunedReflowKeys.push(existing.reflow_keys?.[i] ?? "");
       });
       const prunedSnapshot = existing.findings_snapshot.filter((f) => {
         return !scannedRelFiles.has(normalizeFindingPath(directory, f.location.file));
       });
       const prunedFilesIndexed = existing.files_indexed.filter((f) => !scannedRelFiles.has(f));
+      const priorFingerprintSet = new Set;
+      const priorReflowCounts = new Map;
+      existing.fingerprints.forEach((fp, i) => {
+        const relFile = fp.slice(0, fp.indexOf("|"));
+        if (!scannedRelFiles.has(relFile))
+          return;
+        priorFingerprintSet.add(fp);
+        const key = existing.reflow_keys?.[i] ?? "";
+        if (key) {
+          priorReflowCounts.set(key, (priorReflowCounts.get(key) ?? 0) + 1);
+        }
+      });
+      let blockedCount = 0;
+      const blockedList = [];
+      const triageEntries = [];
+      const absorbedAt = new Date().toISOString();
+      const actor = opts?.actor?.trim() ? opts.actor.trim() : "unknown-session";
+      for (const { finding, stable, fingerprint, reflowKey } of indexed) {
+        if (stable && priorFingerprintSet.has(fingerprint)) {
+          if (reflowKey) {
+            const count = priorReflowCounts.get(reflowKey) ?? 0;
+            if (count > 0)
+              priorReflowCounts.set(reflowKey, count - 1);
+          }
+          continue;
+        }
+        if (stable && reflowKey && (priorReflowCounts.get(reflowKey) ?? 0) > 0) {
+          priorReflowCounts.set(reflowKey, (priorReflowCounts.get(reflowKey) ?? 1) - 1);
+          continue;
+        }
+        const relFile = normalizeFindingPath(directory, finding.location.file);
+        if (!opts?.refreshRationale) {
+          blockedCount++;
+          if (blockedList.length < MAX_BLOCKED_LIST) {
+            blockedList.push({
+              fingerprint,
+              rel_file: relFile,
+              rule_id: finding.rule_id
+            });
+          }
+          continue;
+        }
+        triageEntries.push({
+          fingerprint,
+          rel_file: relFile,
+          rule_id: finding.rule_id,
+          rationale: opts.refreshRationale,
+          actor,
+          absorbed_at: absorbedAt
+        });
+      }
+      if (blockedCount > 0) {
+        const sample = blockedList.slice(0, 5);
+        const sampleText = sample.map((b) => `${b.rel_file} (${b.rule_id})`).join(", ");
+        const ellipsis = blockedCount > sample.length ? ", \u2026" : "";
+        return {
+          status: "absorption_blocked",
+          path: baselinePath,
+          blocked: blockedList,
+          message: `capture_baseline would absorb ${blockedCount} finding(s) not present in the prior baseline ` + `(${sampleText}${ellipsis}). ` + `Pass baseline_refresh_rationale to record an audited refresh \u2014 the baseline was left unchanged (fail-closed).`
+        };
+      }
       const mergedFingerprints = [
         ...prunedFingerprints,
         ...indexed.map((i) => i.fingerprint)
       ];
+      const mergedReflowKeys = [
+        ...prunedReflowKeys,
+        ...indexed.map((i) => i.reflowKey)
+      ];
       const mergedSnapshot = [
         ...prunedSnapshot,
         ...indexed.map((i) => i.finding)
@@ -48140,6 +48244,7 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
       const truncated2 = mergedSnapshot.length > MAX_BASELINE_FINDINGS;
       const cappedSnapshot2 = truncated2 ? mergedSnapshot.slice(-MAX_BASELINE_FINDINGS) : mergedSnapshot;
       const cappedFingerprints2 = truncated2 ? mergedFingerprints.slice(-MAX_BASELINE_FINDINGS) : mergedFingerprints;
+      const cappedReflowKeys2 = truncated2 ? mergedReflowKeys.slice(-MAX_BASELINE_FINDINGS) : mergedReflowKeys;
       let cappedFilesIndexed = mergedFilesIndexed;
       if (truncated2) {
         const survivingFiles = new Set;
@@ -48149,6 +48254,9 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
         }
         cappedFilesIndexed = Array.from(survivingFiles);
       }
+      const cappedFingerprintSet = new Set(cappedFingerprints2);
+      const retainedTriage = (existing.triage_log ?? []).filter((e) => cappedFingerprintSet.has(e.fingerprint));
+      const mergedTriageLog = [...retainedTriage, ...triageEntries].slice(-MAX_BASELINE_FINDINGS);
       const now3 = new Date().toISOString();
       const bundle2 = {
         schema_version: BASELINE_SCHEMA_VERSION,
@@ -48158,14 +48266,16 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
         engine,
         files_indexed: cappedFilesIndexed,
         fingerprints: cappedFingerprints2,
+        reflow_keys: cappedReflowKeys2,
         findings_snapshot: cappedSnapshot2,
+        triage_log: mergedTriageLog,
         truncated: truncated2
       };
       const json2 = JSON.stringify(bundle2, null, 2);
       if (json2.length > MAX_BASELINE_BYTES) {
         return {
           status: "error",
-          message: `Baseline would exceed size cap (${json2.length} bytes > ${MAX_BASELINE_BYTES})`
+          message: `Baseline would exceed size cap (${json2.length} bytes > ${MAX_BASELINE_BYTES} bytes)`
         };
       }
       if (opts?.abortSignal?.aborted) {
@@ -48181,14 +48291,17 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
       return {
         status: "merged",
         path: baselinePath,
-        fingerprint_count: cappedFingerprints2.length
+        fingerprint_count: cappedFingerprints2.length,
+        absorbed_finding_count: triageEntries.length
       };
     }
     const newFingerprints = indexed.map((i) => i.fingerprint);
+    const newReflowKeys = indexed.map((i) => i.reflowKey);
     const newSnapshot = indexed.map((i) => i.finding);
     const truncated = newSnapshot.length > MAX_BASELINE_FINDINGS;
     const cappedSnapshot = truncated ? newSnapshot.slice(0, MAX_BASELINE_FINDINGS) : newSnapshot;
     const cappedFingerprints = truncated ? newFingerprints.slice(0, MAX_BASELINE_FINDINGS) : newFingerprints;
+    const cappedReflowKeys = truncated ? newReflowKeys.slice(0, MAX_BASELINE_FINDINGS) : newReflowKeys;
     const now2 = new Date().toISOString();
     const bundle = {
       schema_version: BASELINE_SCHEMA_VERSION,
@@ -48198,7 +48311,9 @@ async function captureOrMergeBaseline(directory, phase, findings, engine, scanne
       engine,
       files_indexed: Array.from(scannedRelFiles),
       fingerprints: cappedFingerprints,
+      reflow_keys: cappedReflowKeys,
       findings_snapshot: cappedSnapshot,
+      triage_log: [],
       truncated
     };
     const json = JSON.stringify(bundle, null, 2);
@@ -48244,7 +48359,7 @@ function loadBaseline(directory, phase) {
   try {
     const raw = fs26.readFileSync(baselinePath, "utf-8");
     const parsed = JSON.parse(raw);
-    if (parsed.schema_version !== BASELINE_SCHEMA_VERSION) {
+    if (parsed.schema_version !== BASELINE_SCHEMA_VERSION && parsed.schema_version !== LEGACY_BASELINE_SCHEMA_VERSION) {
       return {
         status: "invalid_schema",
         errors: [`Unknown schema version: ${String(parsed.schema_version)}`]
@@ -48256,9 +48371,25 @@ function loadBaseline(directory, phase) {
         errors: ["Missing or invalid fingerprints array"]
       };
     }
+    let reflowKeys = [];
+    if (parsed.schema_version === BASELINE_SCHEMA_VERSION) {
+      if (parsed.reflow_keys === undefined) {
+        reflowKeys = [];
+      } else if (!Array.isArray(parsed.reflow_keys) || parsed.reflow_keys.some((k) => typeof k !== "string") || parsed.reflow_keys.length !== parsed.fingerprints.length) {
+        return {
+          status: "invalid_schema",
+          errors: [
+            "reflow_keys must be a string array aligned 1:1 with fingerprints"
+          ]
+        };
+      } else {
+        reflowKeys = parsed.reflow_keys;
+      }
+    }
     return {
       status: "found",
       fingerprints: new Set(parsed.fingerprints),
+      reflowKeys,
       bundle: parsed
     };
   } catch (e) {
@@ -48274,6 +48405,7 @@ function loadBaseline(directory, phase) {
 var _internals56 = {
   fingerprintFinding,
   assignOccurrenceIndices,
+  partitionAgainstBaseline,
   captureOrMergeBaseline,
   loadBaseline
 };
@@ -48614,10 +48746,18 @@ async function sastScan(input, directory, config) {
     if (abort_signal?.aborted) {
       return cancelledScanResult(allFindings, filesScanned);
     }
-    const captureResult = await captureOrMergeBaseline(directory, phase, captureFindings, engine, scannedFilePaths, { abortSignal: abort_signal });
-    const captureStatus = captureResult.status === "written" ? "baseline_captured" : captureResult.status === "merged" ? "baseline_merged" : undefined;
+    const captureResult = await captureOrMergeBaseline(directory, phase, captureFindings, engine, scannedFilePaths, {
+      abortSignal: abort_signal,
+      refreshRationale: input.baseline_refresh_rationale,
+      actor: input.session_id
+    });
+    const captureStatus = captureResult.status === "written" ? "baseline_captured" : captureResult.status === "merged" ? "baseline_merged" : captureResult.status === "absorption_blocked" ? "baseline_absorption_blocked" : undefined;
     if (captureResult.status === "error") {
       warn(`SAST Baseline: capture failed \u2014 ${captureResult.message}`);
+    } else if (captureResult.status === "absorption_blocked") {
+      warn(`SAST Baseline: ${captureResult.message}`);
+    } else if (captureResult.status === "merged" && captureResult.absorbed_finding_count > 0) {
+      warn(`SAST Baseline: merged and absorbed ${captureResult.absorbed_finding_count} novel finding(s) ` + "under the supplied refresh rationale. If this capture ran after a gate failure, " + "those findings may be coder-introduced \u2014 verify before proceeding.");
     }
     const finalFindings2 = allFindings.slice(0, MAX_FINDINGS);
     const summary2 = {
@@ -48645,33 +48785,31 @@ async function sastScan(input, directory, config) {
       findings: finalFindings2,
       summary: summary2,
       status: captureStatus,
-      finding_count: captureResult.status !== "error" ? captureResult.fingerprint_count : undefined,
+      finding_count: captureResult.status === "written" || captureResult.status === "merged" ? captureResult.fingerprint_count : undefined,
+      ...captureResult.status === "merged" && captureResult.absorbed_finding_count > 0 ? { absorbed_finding_count: captureResult.absorbed_finding_count } : {},
       baseline_used: false
     };
   }
   let newFindings;
   let preExistingFindings;
+  let movedFindings;
   let baselineUsed = false;
   let truncatedPreExisting = false;
+  let truncatedMoved = false;
   if (phase !== undefined && Number.isInteger(phase) && phase >= 1) {
     const baselineResult = loadBaseline(directory, phase);
     if (baselineResult.status === "found") {
       baselineUsed = true;
       const baselineSet = baselineResult.fingerprints;
       const indexed = assignOccurrenceIndices(allFindings, directory);
-      const rawNew = [];
-      const rawPreExisting = [];
-      for (const { finding, stable, fingerprint } of indexed) {
-        if (!stable || !baselineSet.has(fingerprint)) {
-          rawNew.push(finding);
-        } else {
-          rawPreExisting.push(finding);
-        }
-      }
-      newFindings = rawNew.slice(0, MAX_FINDINGS);
+      const partition = partitionAgainstBaseline(indexed, baselineSet, baselineResult.reflowKeys ?? []);
+      newFindings = partition.newFindings.slice(0, MAX_FINDINGS);
       const preExistingBudget = Math.max(0, MAX_FINDINGS - newFindings.length);
-      preExistingFindings = rawPreExisting.slice(0, preExistingBudget);
-      truncatedPreExisting = rawPreExisting.length > preExistingBudget;
+      preExistingFindings = partition.preExisting.slice(0, preExistingBudget);
+      truncatedPreExisting = partition.preExisting.length > preExistingBudget;
+      const movedBudget = Math.max(0, preExistingBudget - preExistingFindings.length);
+      movedFindings = partition.moved.slice(0, movedBudget);
+      truncatedMoved = partition.moved.length > movedBudget;
     } else if (baselineResult.status === "invalid_schema") {
       warn(`SAST Baseline: could not load baseline for phase ${phase} \u2014 ${baselineResult.errors.join(", ")}. Falling back to legacy behavior.`);
     }
@@ -48686,7 +48824,8 @@ async function sastScan(input, directory, config) {
   } else {
     finalFindings = [
       ...newFindings ?? [],
-      ...preExistingFindings ?? []
+      ...preExistingFindings ?? [],
+      ...movedFindings ?? []
     ].slice(0, MAX_FINDINGS);
   }
   const findingsBySeverity = countBySeverity(finalFindings);
@@ -48730,6 +48869,7 @@ async function sastScan(input, directory, config) {
     ...baselineUsed && {
       new_findings: newFindings,
       pre_existing_findings: preExistingFindings,
+      moved_findings: movedFindings,
       baseline_used: true
     }
   }, abort_signal);
@@ -48743,9 +48883,12 @@ async function sastScan(input, directory, config) {
   if (baselineUsed) {
     result.new_findings = newFindings;
     result.pre_existing_findings = preExistingFindings;
+    result.moved_findings = movedFindings;
     result.baseline_used = true;
     if (truncatedPreExisting)
       result.truncated_pre_existing = true;
+    if (truncatedMoved)
+      result.truncated_moved_findings = true;
   }
   return result;
 }
@@ -48756,8 +48899,9 @@ var sast_scan = createSwarmTool({
     directory: exports_external.string().describe("Directory to scan for security vulnerabilities"),
     changed_files: exports_external.array(exports_external.string()).optional().describe("List of files to scan (leave empty to scan none)"),
     severity_threshold: exports_external.enum(["low", "medium", "high", "critical"]).optional().default("medium").describe("Minimum severity that causes failure"),
-    capture_baseline: exports_external.boolean().optional().describe("When true, capture/merge a phase-scoped baseline of pre-existing findings. Requires phase. Subsequent scans with phase only fail on NEW findings."),
-    phase: exports_external.number().int().min(1).optional().describe("Current phase number (positive integer >= 1). Required with capture_baseline. Enables baseline diff when provided on non-capture scans.")
+    capture_baseline: exports_external.boolean().optional().describe("When true, capture/merge a phase-scoped baseline of pre-existing findings. Requires phase. Subsequent scans with phase only fail on NEW findings. Merging findings not previously in the baseline (any file) is BLOCKED unless baseline_refresh_rationale is provided."),
+    phase: exports_external.number().int().min(1).optional().describe("Current phase number (positive integer >= 1). Required with capture_baseline. Enables baseline diff when provided on non-capture scans."),
+    baseline_refresh_rationale: exports_external.string().trim().min(1).max(500).optional().describe('Audited rationale required when capture_baseline would absorb findings not previously in the baseline \u2014 for already-indexed AND first-time files (e.g. "pre-delegation capture for task 2.1; findings verified pre-existing"). Recorded per finding in the baseline triage log. Only meaningful with capture_baseline: true.')
   },
   execute: async (args, directory, ctx) => {
     let safeArgs;
@@ -48765,12 +48909,14 @@ var sast_scan = createSwarmTool({
       if (args && typeof args === "object") {
         const rawPhase = args.phase;
         const rawCapture = args.capture_baseline;
+        const rawRationale = args.baseline_refresh_rationale;
         safeArgs = {
           directory: args.directory,
           changed_files: args.changed_files,
           severity_threshold: args.severity_threshold,
           phase: typeof rawPhase === "number" && Number.isInteger(rawPhase) && rawPhase >= 1 ? rawPhase : undefined,
-          capture_baseline: typeof rawCapture === "boolean" ? rawCapture : undefined
+          capture_baseline: typeof rawCapture === "boolean" ? rawCapture : undefined,
+          baseline_refresh_rationale: typeof rawRationale === "string" && rawRationale.trim().length >= 1 && rawRationale.trim().length <= 500 ? rawRationale.trim() : undefined
         };
       } else {
         safeArgs = {
@@ -48778,7 +48924,8 @@ var sast_scan = createSwarmTool({
           changed_files: undefined,
           severity_threshold: undefined,
           capture_baseline: undefined,
-          phase: undefined
+          phase: undefined,
+          baseline_refresh_rationale: undefined
         };
       }
     } catch {
@@ -48787,7 +48934,8 @@ var sast_scan = createSwarmTool({
         changed_files: undefined,
         severity_threshold: undefined,
         capture_baseline: undefined,
-        phase: undefined
+        phase: undefined,
+        baseline_refresh_rationale: undefined
       };
     }
     if (safeArgs.directory === undefined) {
@@ -48813,6 +48961,8 @@ var sast_scan = createSwarmTool({
       severity_threshold: safeArgs.severity_threshold ?? "medium",
       capture_baseline: safeArgs.capture_baseline,
       phase: safeArgs.phase,
+      baseline_refresh_rationale: safeArgs.baseline_refresh_rationale,
+      session_id: ctx?.sessionID,
       abort_signal: ctx?.abort
     };
     const result = await _internals57.sastScan(input, directory);
@@ -78241,7 +78391,7 @@ async function runValidationWithTransientRetry(input, candidateContent, baseline
       if (!input.dispatcher) {
         throw new Error("no evaluation dispatcher available (cannot run validation)");
       }
-      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-atbehryj.js");
+      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-fzgkhx6a.js");
       const executor = createModelEvaluationExecutor2(input.dispatcher, input.sessionId);
       const result = await withProtectedSetIntegrity([evalInputRoot, ...protectedRoots(input.directory)], () => _internals98.evaluateCandidateV1({
         projectRoot: input.directory,
@@ -80336,7 +80486,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-36sgq7n9.js");
+    const { buildHelpText } = await import("./index-k7kvrwbj.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -80345,7 +80495,7 @@ async function handleHelpCommand(ctx) {
     return _internals101.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals101.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-36sgq7n9.js");
+  const { buildHelpText: fullHelp } = await import("./index-k7kvrwbj.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -80676,7 +80826,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-5z64w3ah.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-b3k9xrx9.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -80686,7 +80836,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-yjwk20rb.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-0ft2gf03.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -80695,7 +80845,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-5z64w3ah.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-b3k9xrx9.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -80705,7 +80855,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-yjwk20rb.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-0ft2gf03.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -80715,7 +80865,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-f9nf687y.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-t8c7acxg.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",
@@ -86708,7 +86858,7 @@ function getDisplayFinalPromptPressure() {
 async function rehydratePrSubscriptions(sessionID, directory) {
   const map = new Map;
   try {
-    const { listActive: listActive2 } = await import("./pr-subscriptions-fvmey1x6.js");
+    const { listActive: listActive2 } = await import("./pr-subscriptions-pxv24d5k.js");
     const records = await listActive2(directory);
     for (const record of records) {
       if (record.sessionID !== sessionID)
@@ -87154,7 +87304,7 @@ function isLaneOwnedByCurrentSession(branchName, expectedSessionId) {
   return extracted === expectedSessionId;
 }
 async function inspectStandardWorktreeCollisionOwnership(identity) {
-  const collisionOwnership = await import("./worktree-collision-ownership-7kf9mm5z.js");
+  const collisionOwnership = await import("./worktree-collision-ownership-3bbn1n2r.js");
   return collisionOwnership.inspectStandardWorktreeCollisionOwnership(identity);
 }
 async function runRecoveryGit(directory, args, timeoutMs = 15000) {
@@ -87563,7 +87713,7 @@ async function precreateStandardWorktreeSession(args) {
   const laneProfile = computeLaneRuntimeProfile(worktreeConfig.runtime_isolation, laneIndex, handle.worktreePath);
   if (laneProfile) {
     try {
-      const { writeLaneProfileToDiskReal } = await import("./core-pp64ys5v.js");
+      const { writeLaneProfileToDiskReal } = await import("./core-03tedwzg.js");
       await writeLaneProfileToDiskReal(handle.worktreePath, laneProfile.laneIndex, laneProfile.envOverrides);
     } catch {}
   }
@@ -88488,7 +88638,7 @@ async function finishStandardWorktreeDispatch(directory, dispatch, config, callI
       }
       clearWorktreeMergeStatus(statusKey);
       try {
-        const { removeLaneProfileFromDiskReal } = await import("./core-pp64ys5v.js");
+        const { removeLaneProfileFromDiskReal } = await import("./core-03tedwzg.js");
         await removeLaneProfileFromDiskReal(dispatch.handle.worktreePath, dispatch.laneIndex);
       } catch {}
       const state = serializationStateBySessionID.get(dispatch.parentSessionID);