opencode-swarm 7.164.4 → 7.164.6

package/dist/cli/{index-qkwx4rrc.js → index-935ww10s.js}

@@ -6,7 +6,7 @@ import {
   resolveExecutableFromPath,
   runEvaluation,
   runExternalTool
-} from "./index-x9ayhkkx.js";
+} from "./index-7v3bb0h3.js";
 import {
   finalizeShellAuditForClose,
   isPolicyProtectedPath,
@@ -15,13 +15,13 @@ import {
   protectedRoots,
   redactDecisionLineForArchive,
   stableCanonicalStringify
-} from "./index-pztdbtgw.js";
+} from "./index-12xzj0hm.js";
 import {
   detectStraySwarmDirs,
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-k8vy89vm.js";
+} from "./index-kvb4dwgf.js";
 import {
   MAX_TRANSIENT_RETRIES,
   archiveEvidence,
@@ -65,7 +65,7 @@ import {
   validateProjectRoot,
   validateSymlinkBoundary,
   validateTargetWithinRoot
-} from "./index-vzs3st30.js";
+} from "./index-x76mprg2.js";
 import {
   EvaluationTaskV1Schema,
   GateAuditManifestV1Schema,
@@ -82,7 +82,7 @@ import {
   saveGateAuditResult,
   savePromotionDecision,
   saveTaskSetSnapshot
-} from "./index-jba9jgse.js";
+} from "./index-9qvmsyab.js";
 import {
   canonicalHash,
   canonicalJson,
@@ -124,15 +124,15 @@ import {
   retireSkill,
   selectCandidateEntries,
   syncBundledProjectSkillsIfMissingAsync
-} from "./index-4tgtbptw.js";
+} from "./index-59hvr3f4.js";
 import {
   readRecentEscalations
-} from "./index-xjw7j7et.js";
+} from "./index-zypacgjc.js";
 import {
   alreadyCuratedThisGeneration,
   claimNextScanBatch,
   resolveCohortId
-} from "./index-x63jqvj3.js";
+} from "./index-6f9yvd67.js";
 import {
   CURATOR_INIT_PROMPT,
   CURATOR_PHASE_PROMPT,
@@ -143,7 +143,7 @@ import {
   getGlobalEventBus,
   getGroupCommitWriter,
   importLegacyJsonl
-} from "./index-1f4nandk.js";
+} from "./index-yh8wxegw.js";
 import {
   DURABILITY_CLASSES,
   applySynchronousForClass,
@@ -159,7 +159,7 @@ import {
   resolveSpeckitProjection,
   validateSpeckit,
   writeProjectedSpecSync
-} from "./index-0zbze3n6.js";
+} from "./index-zjg5ajf5.js";
 import {
   loadDatabaseCtor
 } from "./index-zaab1wz9.js";
@@ -169,7 +169,7 @@ import {
   listActive,
   subscribe,
   unsubscribe
-} from "./index-tme2kjvq.js";
+} from "./index-zfwd65c2.js";
 import {
   clearWorktreeMergeStatus,
   getAllWorktreeMergeFailures,
@@ -181,7 +181,7 @@ import {
   listCoderSettlementWalStates,
   recoverCoderSettlement,
   recoverStaleCoderSettlements
-} from "./index-08e6x59x.js";
+} from "./index-4k16cz8r.js";
 import {
   parsePorcelainV2Snapshot,
   resolveCommitCountSince,
@@ -214,7 +214,7 @@ import {
   WORKTREE_LIFECYCLE_LOCK_FILE,
   recordWorktreeProvisioningOwner,
   removeWorktreeProvisioningOwner
-} from "./index-xj4kbtdw.js";
+} from "./index-b0m3efpf.js";
 import {
   appendUnactionable,
   quarantineEntry,
@@ -225,11 +225,11 @@ import {
   validateActionableFields,
   validateLesson,
   validateSkillPath
-} from "./index-t2tqbq62.js";
+} from "./index-jzvrvdmr.js";
 import {
   authorizeCuration,
   buildConfigFingerprintInput
-} from "./index-prammvxb.js";
+} from "./index-x6zyc38w.js";
 import {
   cohortConfigFingerprint
 } from "./index-rtry5xyf.js";
@@ -260,12 +260,12 @@ import {
   transitionTaskWorkflowEvidence,
   withTaskEvidenceTransaction,
   writeWorkflowWalFile
-} from "./index-0m94jsss.js";
+} from "./index-g5714mpv.js";
 import {
   makeWorktreeBranchName,
   provisionWorktree,
   removeWorktree
-} from "./index-8fjx6k2s.js";
+} from "./index-t1nkr7cz.js";
 import {
   DEFAULT_STALE_DELEGATION_TIMEOUT_MS,
   DELEGATION_COMPACTION_HIGH_WATER_BYTES,
@@ -284,6 +284,7 @@ import {
   PrReviewReviewerVerdictFieldsSchema,
   PrReviewRunIdSchema,
   collectDelegationLedgerHealth,
+  decodePrReviewWorkflowBinding,
   findByBatchId,
   generatePrReviewRunId,
   maintainBackgroundDelegations,
@@ -298,7 +299,7 @@ import {
   scanBackgroundCoderReservationsForAdmission,
   scanDelegationsForRecovery,
   sweepStaleDelegations
-} from "./index-cf54ftj1.js";
+} from "./index-qdbgc16x.js";
 import {
   compositeSessionKey,
   sessionKeySuffix
@@ -309,7 +310,7 @@ import {
   clearAllScopes,
   clearScopeBindingFromDisk,
   clearScopeBindings
-} from "./index-q9yz8da4.js";
+} from "./index-j3hsjynw.js";
 import {
   appendLedgerEvent,
   computePlanLedgerHash,
@@ -324,7 +325,7 @@ import {
   readPlanEpochIdentity,
   replayFromLedgerWithStatus,
   takeSnapshotEvent
-} from "./index-yx3xqb0w.js";
+} from "./index-j645xpsm.js";
 import {
   CORE_EVENT_LOCKED,
   appendCoreEventSync,
@@ -334,7 +335,7 @@ import {
   hasSpecDriftAuditEvent,
   hasTaskRepairAuditEvent,
   readCoreEvents
-} from "./index-z408nj03.js";
+} from "./index-pvp5tnn2.js";
 import {
   sanitizeDiagnosticText
 } from "./index-556ja8an.js";
@@ -383,7 +384,7 @@ import {
   transactFile,
   transactKnowledge,
   wordBigrams
-} from "./index-eh2k07pp.js";
+} from "./index-rysxqae0.js";
 import {
   MAX_EVENT_LOG_ENTRIES,
   _internals as _internals2,
@@ -399,10 +400,10 @@ import {
   recordKnowledgeEvent,
   recordPhaseCloseIntent,
   resolveKnowledgeEventsPath
-} from "./index-7zbk1e24.js";
+} from "./index-gwg7a00b.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-v7a8e7rv.js";
+} from "./index-hdapetg1.js";
 import {
   RetrospectiveEvidenceSchema
 } from "./index-zg9d392c.js";
@@ -411,7 +412,7 @@ import {
   readSwarmFileAsync,
   safeHook,
   validateSwarmPath
-} from "./index-rz87mx1c.js";
+} from "./index-2c3np82d.js";
 import {
   bunSpawn,
   bunSpawnSync,
@@ -423,9 +424,10 @@ import {
   PlanSchema,
   exports_loader,
   init_loader,
+  loadGateOverrides,
   loadPluginConfig,
   loadPluginConfigWithMeta
-} from "./index-vx28633q.js";
+} from "./index-ew99d4y6.js";
 import {
   DEFAULT_HARNESS_EVOLUTION_CONFIG,
   DEFAULT_PR_REVIEW_RESILIENCE_CONFIG,
@@ -442,7 +444,7 @@ import {
   resolveAutoReviewConfig,
   resolveGeneratedAgentRole,
   stripKnownSwarmPrefix
-} from "./index-wzmchqry.js";
+} from "./index-5p1tzpwh.js";
 import {
   init_git_executable,
   resolveGitExecutable,
@@ -458,7 +460,7 @@ import {
   observeCuratorCompliance,
   observeStoreHealth,
   readLearningHealth
-} from "./index-stj85yx1.js";
+} from "./index-p56xc59p.js";
 import {
   AGENT_TOOL_MAP,
   ALL_AGENT_NAMES,
@@ -489,10 +491,10 @@ import {
   resolveLinkDir,
   sanitizeLinkId,
   writeLinkPointer
-} from "./index-qfrrcdhj.js";
+} from "./index-tegp2mny.js";
 import {
   atomicWriteFile
-} from "./index-5k226hxp.js";
+} from "./index-ze5zyv28.js";
 import {
   KNOWLEDGE_SCHEMA_VERSION,
   OUTCOME_BLOCK_THRESHOLD,
@@ -506,7 +508,7 @@ import {
   listActiveLocks,
   tryAcquireLock,
   withEvidenceLock
-} from "./index-gt6p21cs.js";
+} from "./index-fxxja498.js";
 import {
   atomicWriteSwarmFile,
   atomicWriteSwarmFileSync,
@@ -514,12 +516,12 @@ import {
   matchTempGrammar,
   parseTargetBasename,
   resetSwarmArtifactCache
-} from "./index-tfa2p4y4.js";
+} from "./index-cyhw0der.js";
 import {
   emit,
   getLastHeartbeat,
   telemetry
-} from "./index-k1m9214q.js";
+} from "./index-1dz8hv7p.js";
 import {
   require_proper_lockfile
 } from "./index-7g4c7s5r.js";
@@ -10130,10 +10132,18 @@ async function writeAuthorizationFile(filePath, file) {
   }
 }
 function pruneAuthorizations(records, nowMs) {
-  const unexpired = records.filter((record) => Date.parse(record.expiresAt) > nowMs).sort((left, right) => right.createdAt.localeCompare(left.createdAt));
-  const unconsumed = unexpired.filter((record) => !record.consumedAt);
-  const consumed = unexpired.filter((record) => record.consumedAt).slice(0, Math.max(0, MAX_PERSISTED_AUTHORIZATIONS - unconsumed.length));
-  return [...unconsumed.slice(0, MAX_PERSISTED_AUTHORIZATIONS), ...consumed];
+  const unexpired = records.filter((record) => Date.parse(record.expiresAt) > nowMs);
+  const newest = (left, right) => {
+    const leftAt = left.consumedAt ?? left.createdAt;
+    const rightAt = right.consumedAt ?? right.createdAt;
+    return leftAt === rightAt ? 0 : leftAt > rightAt ? -1 : 1;
+  };
+  const live = unexpired.filter((record) => !record.consumedAt).sort(newest);
+  const consumed = unexpired.filter((record) => Boolean(record.consumedAt)).sort(newest);
+  return [
+    ...live,
+    ...consumed.slice(0, Math.max(0, MAX_PERSISTED_AUTHORIZATIONS - live.length))
+  ];
 }
 var lf = import_proper_lockfile3.default;
 async function withAuthorizationLock(filePath, write) {
@@ -10156,6 +10166,30 @@ async function withAuthorizationLock(filePath, write) {
 function authorizationMatchesBinding(record, binding) {
   return binding.prHeadSha === record.prHeadSha && binding.revisionDigest === record.revisionDigest && binding.generation === record.generation && binding.workflowInstanceId === record.workflowInstanceId && binding.runId === record.runId;
 }
+async function hasPrReviewReentryAuthorizationAgainstBinding(directory, sessionID, request, binding) {
+  const trimmedSession = sessionID.trim();
+  if (!trimmedSession)
+    return false;
+  const filePath = reentryAuthorizationFilePath(directory, trimmedSession);
+  try {
+    return await withAuthorizationLock(filePath, async () => {
+      const existing = await readAuthorizationFile(filePath);
+      if (!existing)
+        return false;
+      const nowMs = Date.now();
+      const records = pruneAuthorizations(existing.authorizations, nowMs);
+      if (records.length !== existing.authorizations.length) {
+        await writeAuthorizationFile(filePath, {
+          ...existing,
+          authorizations: records
+        });
+      }
+      return records.some((record) => !record.consumedAt && record.role === request.role && record.sessionId === trimmedSession && authorizationMatchesBinding(record, binding));
+    });
+  } catch {
+    return false;
+  }
+}
 async function reservePrReviewReentryAuthorizationAgainstBinding(directory, sessionID, request, binding) {
   const trimmedSession = sessionID.trim();
   if (!trimmedSession)
@@ -10207,6 +10241,7 @@ var _internals17 = {
   reentryAuthorizationFilePath,
   pruneAuthorizations,
   authorizationMatchesBinding,
+  hasPrReviewReentryAuthorizationAgainstBinding,
   renameImpl: (from, to) => fsp3.rename(from, to),
   renameRetryDelaysMs: RENAME_RETRY_DELAYS_MS,
   renameWithRetryAsync,
@@ -10726,7 +10761,7 @@ function hasRevisionIndependentDiscoverySemantics(directory, qualified, state) {
       gitHead: state.prHeadSha ?? "",
       revisionDigest: artifact.revisionDigest,
       workflowInstanceId: state.workflowInstanceId,
-      workflowRevision: state.revision,
+      workflowRevision: qualified.record.workflowGeneration,
       baseSha: state.prReviewBaseSha,
       reviewScope: state.prReviewBaseSha && state.prHeadSha ? `complete PR diff ${state.prReviewBaseSha}...${state.prHeadSha}` : undefined
     }
@@ -10817,7 +10852,7 @@ function latestStructuredReceiptUnresolvedForBaseDimension(directory, state, rev
             gitHead: state.prHeadSha ?? "",
             revisionDigest,
             workflowInstanceId: state.workflowInstanceId,
-            workflowRevision: state.revision,
+            workflowRevision: record.workflowGeneration,
             baseSha: state.prReviewBaseSha,
             reviewScope
           }
@@ -12254,7 +12289,7 @@ async function submitPrReviewResult(directory, childSessionId, input) {
       reason: "invalid child session or result envelope"
     };
   }
-  const preliminary = readDelegations(directory).filter((record) => record.subagentSessionId === child && record.batchId === input.batchId && record.laneId === input.laneId);
+  const preliminary = readDelegations(directory).filter((record2) => record2.subagentSessionId === child && record2.correlationId === child && (record2.mode === "swarm-pr-review:base" || record2.mode === "swarm-pr-review:micro"));
   if (preliminary.length !== 1) {
     return {
       status: "rejected",
@@ -12262,6 +12297,21 @@ async function submitPrReviewResult(directory, childSessionId, input) {
     };
   }
   const parentSessionId = preliminary[0].parentSessionId;
+  const record = preliminary[0];
+  if (!record.batchId || !record.laneId) {
+    return {
+      status: "rejected",
+      reason: "delegation batch/lane provenance is missing"
+    };
+  }
+  if (input.batchId !== undefined && input.batchId !== record.batchId || input.laneId !== undefined && input.laneId !== record.laneId) {
+    return {
+      status: "rejected",
+      reason: "delegation batch/lane identity mismatch"
+    };
+  }
+  const batchId = record.batchId;
+  const laneId = record.laneId;
   return withSessionStateMutation(directory, parentSessionId, async () => {
     const state = await readPrWorkflowGateStateFromDisk3(directory, parentSessionId);
     if (!state || state.mode !== "PR_REVIEW" || !state.workflowInstanceId || !state.prHeadSha || !state.prReviewBaseSha) {
@@ -12274,7 +12324,17 @@ async function submitPrReviewResult(directory, childSessionId, input) {
     if (ctx.revisionDigest !== input.revisionDigest) {
       return { status: "rejected", reason: "stale dispatch revision digest" };
     }
-    const record = preliminary[0];
+    const dispatchWorkflowInstanceId = decodePrReviewWorkflowBinding(record.jobId);
+    const dispatchWorkflowRevision = record.workflowGeneration;
+    if (!dispatchWorkflowInstanceId || dispatchWorkflowRevision === undefined) {
+      return {
+        status: "rejected",
+        reason: "delegation workflow binding provenance is missing"
+      };
+    }
+    if (dispatchWorkflowInstanceId !== state.workflowInstanceId) {
+      return { status: "rejected", reason: "stale workflow instance binding" };
+    }
     if (record.mode !== "swarm-pr-review:base" && record.mode !== "swarm-pr-review:micro" || path15.resolve(record.workspace?.directory ?? "") !== path15.resolve(directory)) {
       return {
         status: "rejected",
@@ -12289,8 +12349,8 @@ async function submitPrReviewResult(directory, childSessionId, input) {
     const existingReceiptDigest = record.result?.prReviewResultReceipt?.semanticEnvelopeDigest;
     const submission = reducePrReviewEvent(state, {
       type: "lane_structured_result_submitted",
-      batchId: input.batchId,
-      laneId: input.laneId,
+      batchId,
+      laneId,
       generation: state.revision,
       semanticEnvelopeDigest,
       outcome: parsedResult.data.outcome,
@@ -12305,18 +12365,18 @@ async function submitPrReviewResult(directory, childSessionId, input) {
     const published = await publishPrReviewResultReceipt(directory, {
       parentSessionId,
       childSessionId: child,
-      batchId: input.batchId,
-      laneId: input.laneId,
+      batchId,
+      laneId,
       expectedWorkflowInstanceId: state.workflowInstanceId,
-      expectedWorkflowRevision: state.revision,
+      expectedWorkflowRevision: dispatchWorkflowRevision,
       expectedBaseSha: state.prReviewBaseSha,
       receipt: {
         schemaVersion: 1,
         mode: record.mode,
-        workflowInstanceId: state.workflowInstanceId,
-        workflowRevision: state.revision,
-        batchId: input.batchId,
-        laneId: input.laneId,
+        workflowInstanceId: dispatchWorkflowInstanceId,
+        workflowRevision: dispatchWorkflowRevision,
+        batchId,
+        laneId,
         workflowLane: record.workflowLane,
         ownedWorkflowLanes,
         baseSha: state.prReviewBaseSha,
@@ -16499,10 +16559,9 @@ async function enforcePrWorkflowToolBefore(directory, sessionID, toolName, args,
   if (state.mode === "PR_REVIEW") {
     let hasAuthorizedDirectReentry = false;
     if (isDirectAgentTask && requestedAgentFields.length === 1 && requestedAgentFields[0] === "subagent_type" && requestedRoles.length === 1 && (requestedRoles[0] === "reviewer" || requestedRoles[0] === "test_engineer") && callID) {
-      hasAuthorizedDirectReentry = Boolean(await reserveActivePrReviewReentryAuthorization(directory, sessionID, {
-        role: requestedRoles[0],
-        callID
-      }));
+      hasAuthorizedDirectReentry = await hasActivePrReviewReentryAuthorization(directory, sessionID, {
+        role: requestedRoles[0]
+      });
     }
     const isAllowedReviewTool = isInternalWorkflowTool || hasAuthorizedDirectReentry || isNamedReadOnlyTool || isReadOnlyShell && (!isShellCheckout || isCanonicalReviewCheckout);
     if (!isAllowedReviewTool || Boolean(state.prHeadSha) && (isRemoteCheckoutTool || isShellCheckout)) {
@@ -16603,6 +16662,18 @@ async function prReviewReentryBindingFromState(directory, state) {
     } : {}
   };
 }
+async function hasActivePrReviewReentryAuthorization(directory, sessionID, request) {
+  const normalizedSessionID = normalizeSessionID(sessionID);
+  return withSessionStateMutation(directory, normalizedSessionID, async () => {
+    const state = await readPrWorkflowGateStateFromDisk3(directory, normalizedSessionID);
+    if (!state)
+      return false;
+    const binding = await prReviewReentryBindingFromState(directory, state);
+    if (!binding)
+      return false;
+    return hasPrReviewReentryAuthorizationAgainstBinding(directory, normalizedSessionID, request, binding);
+  });
+}
 async function reserveActivePrReviewReentryAuthorization(directory, sessionID, request) {
   const normalizedSessionID = normalizeSessionID(sessionID);
   return withSessionStateMutation(directory, normalizedSessionID, async () => {
@@ -18203,7 +18274,7 @@ function successfulObligationsFromExactBatch2(directory, state, batchId, expecte
         gitHead: state.prHeadSha ?? "",
         revisionDigest: expectedRevisionDigest ?? "",
         workflowInstanceId: state.workflowInstanceId,
-        workflowRevision: state.revision,
+        workflowRevision: qualified.record.workflowGeneration,
         baseSha: state.prReviewBaseSha,
         reviewScope: state.mode === "PR_REVIEW" && state.prReviewBaseSha && state.prHeadSha ? `complete PR diff ${state.prReviewBaseSha}...${state.prHeadSha}` : undefined
       }
@@ -18260,8 +18331,10 @@ function validateExactStructuredReceiptCoverage2(input) {
     };
   }
   const receipt = parsedReceipt2.data;
+  const recordWorkflowInstanceId = decodePrReviewWorkflowBinding(input.record.jobId);
+  const recordWorkflowRevision = input.record.workflowGeneration;
   const ownedWorkflowLanes = input.expected.ownedWorkflowLanes?.length ? [...input.expected.ownedWorkflowLanes] : [input.expected.workflowLane];
-  if (receipt.mode !== input.expected.mode || receipt.workflowInstanceId !== input.expected.workflowInstanceId || receipt.workflowRevision !== input.expected.workflowRevision || receipt.baseSha !== input.expected.baseSha || receipt.batchId !== input.record.batchId || receipt.laneId !== input.record.laneId || receipt.childSessionId !== input.record.subagentSessionId || receipt.workflowLane !== input.expected.workflowLane || !ownedLaneSetsEqual(receipt.ownedWorkflowLanes, ownedWorkflowLanes) || receipt.headSha !== input.expected.prHeadSha || receipt.dispatchRevisionDigest !== input.expected.revisionDigest) {
+  if (!recordWorkflowInstanceId || recordWorkflowRevision === undefined || recordWorkflowInstanceId !== input.expected.workflowInstanceId || recordWorkflowRevision !== input.expected.workflowRevision || receipt.mode !== input.expected.mode || receipt.workflowInstanceId !== recordWorkflowInstanceId || receipt.workflowRevision !== recordWorkflowRevision || receipt.baseSha !== input.expected.baseSha || receipt.batchId !== input.record.batchId || receipt.laneId !== input.record.laneId || receipt.childSessionId !== input.record.subagentSessionId || receipt.workflowLane !== input.expected.workflowLane || !ownedLaneSetsEqual(receipt.ownedWorkflowLanes, ownedWorkflowLanes) || receipt.headSha !== input.expected.prHeadSha || receipt.dispatchRevisionDigest !== input.expected.revisionDigest) {
     return {
       status: "rejected",
       failure: failedLaneValidation("discovery.coverage", "exact child/workflow/revision-bound structured receipt", "mismatched structured receipt").failure
@@ -18397,7 +18470,7 @@ function workflowArtifactHasContractMarker(directory, state, record, expectedMod
         gitHead: state.prHeadSha ?? "",
         revisionDigest: expectedRevisionDigest ?? "",
         workflowInstanceId: state.workflowInstanceId,
-        workflowRevision: state.revision,
+        workflowRevision: record.workflowGeneration,
         baseSha: state.prReviewBaseSha,
         reviewScope
       }
@@ -26104,7 +26177,7 @@ function planMerges(active, threshold, maxComparisons, maxMerges) {
   };
 }
 async function sweepActiveNearDuplicates(directory, options = {}) {
-  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a0jhxx5q.js");
+  const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-ty3vtqe2.js");
   const { config } = loadPluginConfigWithMeta2(directory);
   const sweepConfig = config.learning?.dedup_sweep;
   if (sweepConfig?.enabled === false)
@@ -27241,7 +27314,7 @@ async function runCuratorPhase(directory, phase, agentsDispatched, config, knowl
     }
     if (config.skill_generation_enabled === true && skillCandidates.length > 0) {
       try {
-        const skillModule = await import("./skill-generator-xsxes2w0.js");
+        const skillModule = await import("./skill-generator-7werbwgv.js");
         for (const cand of skillCandidates) {
           if (cand.confidence < (config.min_skill_confidence ?? DEFAULT_SKILL_MIN_CONFIDENCE)) {
             continue;
@@ -27713,7 +27786,7 @@ async function applyCuratorKnowledgeUpdates(directory, recommendations, knowledg
     } catch {}
   }
   if (contradictedEntries.length > 0 && knowledgeConfig.contradiction_threshold_action === "quarantine") {
-    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-hp1ctjpe.js");
+    const { maybeQuarantineOnContradiction } = await import("./knowledge-escalator-aca0nhqg.js");
     for (const { id } of contradictedEntries) {
       try {
         await maybeQuarantineOnContradiction(directory, id, knowledgeConfig.contradiction_quarantine_threshold, knowledgeConfig.contradiction_quarantine_window_days);
@@ -28545,7 +28618,7 @@ async function runCuratorPostMortem(directory, options = {}) {
       warnings.push("Failed to collect knowledge summary.");
     }
     try {
-      const { getScanStatus } = await import("./scan-cursor-gt55f3d6.js");
+      const { getScanStatus } = await import("./scan-cursor-63zx2qd8.js");
       const scanStatus = await getScanStatus(directory);
       if (scanStatus.remaining_estimate > 0) {
         warnings.push(`Fair scan: reviewed ${knowledgeSummary.length} entries this sweep (generation ${scanStatus.generation}); ${scanStatus.remaining_estimate} more eligible entries will be visited in future curation sweeps.`);
@@ -28717,9 +28790,9 @@ var _internals28 = {
   verifyPostMortemKnowledgeActions,
   repairPostMortemActions,
   loadDefaultKnowledgeConfig: async (directory) => {
-    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-rpdz901j.js");
+    const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-t1scx08g.js");
     try {
-      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a0jhxx5q.js");
+      const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-ty3vtqe2.js");
       const loaded = loadPluginConfigWithMeta2(directory);
       return KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
     } catch {
@@ -28727,11 +28800,11 @@ var _internals28 = {
     }
   },
   applyCuratorKnowledgeUpdates: async (directory, recommendations, knowledgeConfig, generation) => {
-    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-4s6ekk85.js");
+    const { applyCuratorKnowledgeUpdates: applyCuratorKnowledgeUpdates2 } = await import("./curator-q3qn89wn.js");
     return applyCuratorKnowledgeUpdates2(directory, recommendations, knowledgeConfig, generation);
   },
   checkHivePromotions: async (entries, knowledgeConfig, directory) => {
-    const { checkHivePromotions } = await import("./hive-promoter-nr8dsxhe.js");
+    const { checkHivePromotions } = await import("./hive-promoter-w7g879cm.js");
     return checkHivePromotions(entries, knowledgeConfig, directory);
   },
   applyProposalTriage: async (directory, triage) => {
@@ -28740,7 +28813,7 @@ var _internals28 = {
       activateProposal,
       listSkills: listSkills2,
       sanitizeSlug
-    } = await import("./skill-generator-xsxes2w0.js");
+    } = await import("./skill-generator-7werbwgv.js");
     const result = {
       approved: [],
       rejected: [],
@@ -28782,7 +28855,7 @@ var _internals28 = {
     return result;
   },
   readPriorDriftReports: async (directory) => {
-    const { readPriorDriftReports } = await import("./curator-drift-3s3q4wsy.js");
+    const { readPriorDriftReports } = await import("./curator-drift-0r0scc8r.js");
     return readPriorDriftReports(directory);
   },
   readSwarmKnowledge: (directory) => readKnowledge(resolveSwarmKnowledgePath(directory))
@@ -30069,9 +30142,9 @@ function hashContent(content) {
   return createHash17("sha1").update(content).digest("hex");
 }
 async function loadConfigForPolicyCurator(directory) {
-  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-rpdz901j.js");
+  const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-t1scx08g.js");
   try {
-    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a0jhxx5q.js");
+    const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-ty3vtqe2.js");
     const { config: loadedConfig } = loadPluginConfigWithMeta2(directory);
     return KnowledgeConfigSchema2.parse(loadedConfig.knowledge ?? {});
   } catch {
@@ -42734,7 +42807,7 @@ async function runFinalizeStage(ctx) {
     }
   }
   try {
-    const { CuratorConfigSchema: CCS } = await import("./schema-rpdz901j.js");
+    const { CuratorConfigSchema: CCS } = await import("./schema-t1scx08g.js");
     const { config: pmLoadedConfig } = _internals42.loadPluginConfigWithMeta(ctx.directory);
     const curatorCfg = CCS.parse(pmLoadedConfig.curator ?? {});
     if (curatorCfg.enabled && curatorCfg.postmortem_enabled) {
@@ -43623,7 +43696,7 @@ var _internals42 = {
   closePlanTerminalState: reconcileCloseTerminalStateForPlan,
   endAgentSession,
   flushAndDrainTelemetry: async () => {
-    const { flushAndDrainTelemetry } = await import("./telemetry-9tfts5q2.js");
+    const { flushAndDrainTelemetry } = await import("./telemetry-j14cj552.js");
     return flushAndDrainTelemetry();
   },
   finalizeContextTelemetry: (directory) => {
@@ -44961,9 +45034,9 @@ var _internals46 = {
   loadPluginConfigWithMeta,
   loadCuratorDeps: async () => {
     const [{ CuratorConfigSchema }, curator, { createCuratorLLMDelegate: createCuratorLLMDelegate2 }] = await Promise.all([
-      import("./schema-rpdz901j.js"),
-      import("./curator-4s6ekk85.js"),
-      import("./curator-llm-factory-q3t3r632.js")
+      import("./schema-t1scx08g.js"),
+      import("./curator-q3qn89wn.js"),
+      import("./curator-llm-factory-dw7md4nr.js")
     ]);
     return { CuratorConfigSchema, curator, createCuratorLLMDelegate: createCuratorLLMDelegate2 };
   }
@@ -46006,7 +46079,7 @@ async function computeCurationDiagnostics(directory, entries) {
   let scanCompleted = false;
   let scanRemaining = 0;
   try {
-    const { getScanStatus } = await import("./scan-cursor-gt55f3d6.js");
+    const { getScanStatus } = await import("./scan-cursor-63zx2qd8.js");
     const status = await getScanStatus(directory);
     scanGeneration = status.generation;
     scanCompleted = status.completed;
@@ -46014,19 +46087,19 @@ async function computeCurationDiagnostics(directory, entries) {
   } catch {}
   let configMatch = null;
   try {
-    const { isLinked: isLinked2 } = await import("./knowledge-link-f5g5d171.js");
+    const { isLinked: isLinked2 } = await import("./knowledge-link-8ea4ksda.js");
     if (isLinked2(directory)) {
-      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-rpdz901j.js");
+      const { KnowledgeConfigSchema: KnowledgeConfigSchema2 } = await import("./schema-t1scx08g.js");
       let config;
       try {
-        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-a0jhxx5q.js");
+        const { loadPluginConfigWithMeta: loadPluginConfigWithMeta2 } = await import("./index-ty3vtqe2.js");
         const loaded = loadPluginConfigWithMeta2(directory);
         config = KnowledgeConfigSchema2.parse(loaded.config.knowledge ?? {});
       } catch {
         config = KnowledgeConfigSchema2.parse({});
       }
       const { cohortConfigFingerprint: cohortConfigFingerprint2 } = await import("./config-fingerprint-v22xh5a2.js");
-      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-913dnxqq.js");
+      const { buildConfigFingerprintInput: buildConfigFingerprintInput2, readCohortConfigFingerprint } = await import("./curation-policy-7f8x9yg6.js");
       const currentFp = cohortConfigFingerprint2(buildConfigFingerprintInput2(config));
       const cohortFp = await readCohortConfigFingerprint(directory);
       configMatch = cohortFp === null ? null : currentFp === cohortFp;
@@ -47415,7 +47488,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-62xd5far.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-d1cbh67h.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true, {
       applyLossy: true
     });
@@ -48355,7 +48428,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-gw936xgz.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-3meyb8rc.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -51024,13 +51097,21 @@ var quality_budget = createSwarmTool({
     }).optional().describe("Quality budget thresholds")
   },
   async execute(args, directory, ctx) {
-    const result = await _internals55.qualityBudget(args, directory, ctx?.abort);
+    const typedArgs = args;
+    const fileOverrides = _internals55.loadGateOverrides(directory)?.quality_budget;
+    const mergedConfig = {
+      ...fileOverrides,
+      ...typedArgs.config,
+      ...fileOverrides?.enabled === false ? { enabled: false } : {}
+    };
+    const result = await _internals55.qualityBudget({ changed_files: typedArgs.changed_files, config: mergedConfig }, directory, ctx?.abort);
     return JSON.stringify(result);
   }
 });
 var _internals55 = {
   qualityBudget,
-  computeQualityMetrics
+  computeQualityMetrics,
+  loadGateOverrides
 };
 
 // src/tools/sast-scan.ts
@@ -53745,7 +53826,7 @@ function scanFileWithTierA(filePath, language) {
     return [];
   }
 }
-async function sastScan(input, directory, config) {
+async function sastScan(input, directory, gates) {
   const {
     changed_files,
     severity_threshold = "medium",
@@ -53754,11 +53835,12 @@ async function sastScan(input, directory, config) {
     offline_only = false,
     abort_signal
   } = input;
-  if (config?.gates?.sast_scan?.enabled === false) {
+  if (gates?.sast_scan?.enabled === false) {
     return {
       verdict: "pass",
       findings: [],
       summary: {
+        disabled_reason: "sast_scan disabled by configuration",
         engine: "tier_a",
         files_scanned: 0,
         findings_count: 0,
@@ -54193,7 +54275,7 @@ var sast_scan = createSwarmTool({
       session_id: ctx?.sessionID,
       abort_signal: ctx?.abort
     };
-    const result = await _internals58.sastScan(input, directory);
+    const result = await _internals58.sastScan(input, directory, _internals58.loadGateOverrides(directory));
     return JSON.stringify(result, null, 2);
   }
 });
@@ -54202,7 +54284,8 @@ var _internals58 = {
   sast_scan,
   checkSemgrepAvailable: (directory, abortSignal) => checkSemgrepAvailable(directory, abortSignal),
   isSemgrepAvailable: () => isSemgrepAvailable(),
-  runSemgrep: (options) => runSemgrep(options)
+  runSemgrep: (options) => runSemgrep(options),
+  loadGateOverrides
 };
 
 // src/evaluation/gate-audit.ts
@@ -83734,7 +83817,7 @@ async function runValidationWithTransientRetry(input, candidateContent, baseline
       if (!input.dispatcher) {
         throw new Error("no evaluation dispatcher available (cannot run validation)");
       }
-      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-nkh65pcm.js");
+      const { createModelEvaluationExecutor: createModelEvaluationExecutor2 } = await import("./runner-fh7t0mn9.js");
       const executor = createModelEvaluationExecutor2(input.dispatcher, input.sessionId);
       const result = await withProtectedSetIntegrity([evalInputRoot, ...protectedRoots(input.directory)], () => _internals99.evaluateCandidateV1({
         projectRoot: input.directory,
@@ -85869,7 +85952,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-et9y4ga8.js");
+    const { buildHelpText } = await import("./index-y4z0rhsa.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -85878,7 +85961,7 @@ async function handleHelpCommand(ctx) {
     return _internals102.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals102.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-et9y4ga8.js");
+  const { buildHelpText: fullHelp } = await import("./index-y4z0rhsa.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -86209,7 +86292,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-jjbnrcqn.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-6cbszhw1.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -86219,7 +86302,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-1hpd6bkj.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-mzeyd6jh.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -86228,7 +86311,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-jjbnrcqn.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-6cbszhw1.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -86238,7 +86321,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-reset": {
     handler: async (ctx) => {
-      const { handleGuardrailReset } = await import("./guardrail-reset-1hpd6bkj.js");
+      const { handleGuardrailReset } = await import("./guardrail-reset-mzeyd6jh.js");
       return handleGuardrailReset(ctx.args, ctx.sessionID);
     },
     description: "Reset one exact active invocation/action circuit after repair",
@@ -86248,7 +86331,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail-log": {
     handler: async (ctx) => {
-      const { handleGuardrailLog } = await import("./guardrail-log-9d4f09qt.js");
+      const { handleGuardrailLog } = await import("./guardrail-log-0nd1eqvz.js");
       return handleGuardrailLog(ctx.directory, ctx.args);
     },
     description: "Read the guardrail decision log (use --blocks-only for blocks)",
@@ -88196,13 +88279,13 @@ HARD CONSTRAINTS (apply regardless of skill load success):
 - Treat the controller Git-state result as final for the attempt: \`clean\` proceeds; \`stashable\` permits one preparation call; \`recovery-required\` or \`indeterminate\` means report the typed \`required_action\`, abort/clear any already-active gate, and STOP unless \`retryable: true\`. Never loop on stash against an unmerged index or in-progress Git operation.
 - RUN ALL BASE LANES: the default PR_REVIEW path covers all six repository-agnostic base dimensions from the skill on every PR. Use \`mode: "swarm-pr-review:base"\`, the exact \`workflow_lane\` identifiers, and the exact bound \`pr_head_sha\`. \`pr_review_resilience\` is DISABLED by default, so the legacy one-wave base dispatch is the default path at every depth tier \u2014 do not emit \`pr_review_wave_stage\` or \`pr_review_wave_attempt\` unless a project has explicitly enabled it. Only when a project explicitly sets \`pr_review_resilience.enabled: true\` must depth tier M/L stage attempt 0 as one singleton \`pr_review_wave_stage: "canary"\` batch followed by a \`"fanout"\` batch whose combined canary+fanout ownership partitions all six dimensions exactly once; tier L still requires six singleton combined lanes, and tier S keeps the legacy one-wave path regardless. The runtime rejects omitted stage metadata, partial, duplicate, mislabelled, or structurally invalid waves.
 - SETTLE DISCOVERY LANES STRUCTURED-FIRST: for Profile A base and micro discovery lanes, require exactly one \`submit_pr_review_result\` call and then stop. Deprecated transcript \`[CANDIDATE]\` / \`[CLEAN]\` rows are legacy-only compatibility for lanes whose snapped \`pr_review_legacy_transcript_compatibility\` contract explicitly enables them; they are OFF by default for new config and must never be duplicated after the structured submission.
-- RETRY STRUCTURALLY: retry only unresolved failed base obligations in later \`swarm-pr-review:base\` async batches with the same exact \`pr_head_sha\`. Under staged resilience, attempts are numbered by \`pr_review_wave_attempt\`: attempt 0 plus at most two retry attempts (1 and 2), each with one singleton canary batch and then its matching fanout batch when obligations remain. Blocking \`dispatch_lanes\` and direct Task explorer/reviewer/critic dispatch are not provenance-equivalent and are rejected. If the runtime returns typed \`retry_exhausted\` or \`circuit_open\`, or if the second retry still cannot close coverage, collect every lane to settlement, do not probe downstream writers or micro lanes, call \`abort_pr_workflow\` with \`mode: "PR_REVIEW"\`, \`kind: "recovery"\`, and a non-empty one-line \`reason\` naming the failed lane or correlated failure and exhausted retries, then call \`prepare_pr_workflow_checkout\` with \`operation: "restore"\` before reporting the blocker.
+- RETRY STRUCTURALLY: retry only unresolved failed base obligations in later \`swarm-pr-review:base\` async batches with the same exact \`pr_head_sha\`. Under staged resilience, attempts are numbered by \`pr_review_wave_attempt\`: attempt 0 plus at most two retry attempts (1 and 2), each with one singleton canary batch and then its matching fanout batch when obligations remain. Blocking \`dispatch_lanes\` and direct Task explorer/reviewer/critic dispatch are not provenance-equivalent and are rejected. If the runtime returns typed \`retry_exhausted\` or \`circuit_open\`, or if the second retry still cannot close coverage, collect every lane to settlement, do not probe downstream writers or micro lanes, and settle N-of-6 truthfully with \`partial_base_coverage\` when coverage remains incomplete. Call \`prepare_pr_workflow_checkout\` with \`operation: "restore"\` only when the settlement reports checkout restoration is required.
 - RECOVER CONTRACT FAILURES EXPLICITLY: when collection reports \`workflow_lane_failure_class: "contract"\`, retry that one singleton base dimension once with \`pr_review_contract_retry: true\`; this retry is outside staged \`pr_review_wave_attempt\` accounting and cannot be combined with stage metadata. When fewer than six base dimensions settle but every launched lane is terminal or explicitly cancelled, the \`post_explorer\` findings write may explicitly submit \`partial_base_coverage: { unresolved_dimensions: [<exactly the uncovered dimensions>] }\` (issue #2383 N-of-6 settlement). Never infer or omit dimensions from this disclosure: the runtime derives each dimension's terminal state from lane evidence, persists an immutable coverage receipt, and rejects any declaration that does not exactly match the derived settlement.
 - USE ASYNC DISPATCH WITHOUT IDLING: each admissible base wave uses one \`dispatch_lanes_async\` call. With enabled tier-M/L staged resilience, this means one singleton canary call followed by one unresolved-only fanout call after canary admission; it never means one legacy call carrying the whole initial base wave. Record each \`batch_id\`, then keep doing non-dependent architect work while its lanes run. Poll with \`collect_lane_results\` without \`wait\` (or \`wait: false\`) to process settled lanes and continue independent work between polls; use \`wait: true\` only as the final join when no independent work remains.
 - EVALUATE ALL RISK FAMILIES: after the base explorer lanes settle, evaluate every repository-agnostic trigger row against the exact diff/context pack. Record applicable families as \`MATCHED\` and inapplicable families as provenance-free \`NOT_TRIGGERED\` with concrete absence evidence; \`unclassified-risk\` always remains \`MATCHED\`. Launch \`swarm-pr-review:micro\` lanes only for the \`MATCHED\` IDs. The first micro dispatch MUST pass the complete exact eleven-row \`trigger_evaluation\`, which freezes it for this session; any subsequent same-session micro batch may omit it and reuse the frozen ledger, while an explicitly supplied copy must remain exactly identical. Use each dispatched trigger ID as \`workflow_lane\`. Missing an evaluation row or a matched-family attestation is BLOCKED; a \`NOT_TRIGGERED\` family must not create a micro artifact.
 - RUN HEAD-BOUND VALIDATION: dispatch independent reviewers with \`mode: "swarm-pr-review:reviewer"\` and critics with \`mode: "swarm-pr-review:critic"\`, unique \`workflow_lane\` obligations, role-correct agents, and the same exact \`pr_head_sha\`. Critic dispatch is blocked until all declared reviewer obligations have successful artifacts.
 - COMPLETE EXPLICITLY: after final artifacts and synthesis, call \`complete_pr_workflow\` with \`mode: "PR_REVIEW"\`, the bound \`pr_head_sha\`, and the terminal \`report_verdict\` the coverage kind allows (issue #2383): COMPLETE may APPROVE, REQUEST_CHANGES, or INCOMPLETE; PARTIAL only REQUEST_CHANGES or INCOMPLETE; NO_COVERAGE must be INCOMPLETE and skips the findings ladder entirely. Never leave the session trapped in a stale workflow gate. When completion reports checkout restoration is required, call \`prepare_pr_workflow_checkout\` with \`operation: "restore"\` before returning to the user. For a publication-armed workflow whose exact publication cannot proceed, \`abort_pr_workflow\` with \`kind: "armed_recovery"\` plus the armed-recovery identity fields is the audited escape that preserves validated work.
-- ABORT IF UNRECOVERABLE: if the PR head cannot be fetched/checked out (the working tree stays on the wrong branch), a compound \`git fetch && git checkout\` keeps being rejected as read-only shell syntax (run them as TWO separate standalone commands first), the merge-base bind is unreachable, or the bounded lane retries above are exhausted, call \`abort_pr_workflow\` with \`mode: "PR_REVIEW"\`, \`kind: "recovery"\`, and a one-line \`reason\` instead of looping. The tool accepts unbound and bound workflows but refuses while PR workflow lanes are in flight (collect their results first). Aborting clears the durable gate and stops the auto-resume loop; the user can force-clear via \`/swarm abort-pr-workflow\`. Do NOT abort while useful bounded recovery work remains.
+- ABORT IF UNRECOVERABLE: if the PR head cannot be fetched/checked out (the working tree stays on the wrong branch), a compound \`git fetch && git checkout\` keeps being rejected as read-only shell syntax (run them as TWO separate standalone commands first), or the merge-base bind is unreachable, call \`abort_pr_workflow\` with \`mode: "PR_REVIEW"\`, \`kind: "recovery"\`, and a one-line \`reason\` instead of looping. The tool accepts unbound and bound workflows but refuses while PR workflow lanes are in flight (collect their results first). Aborting clears the durable gate and stops the auto-resume loop; the user can force-clear via \`/swarm abort-pr-workflow\`. Do NOT abort while useful bounded recovery or N-of-6 settlement work remains.
 - Honor any free-text instructions that follow the closing bracket of the signal as additional reviewer focus, without weakening the validation ladder above.
 
 ### MODE: PR_FEEDBACK
@@ -92247,7 +92330,7 @@ function getDisplayFinalPromptPressure() {
 async function rehydratePrSubscriptions(sessionID, directory) {
   const map = new Map;
   try {
-    const { listActive: listActive2 } = await import("./pr-subscriptions-s2b2yvbd.js");
+    const { listActive: listActive2 } = await import("./pr-subscriptions-05dzvavk.js");
     const records = await listActive2(directory);
     for (const record of records) {
       if (record.sessionID !== sessionID)
@@ -92693,7 +92776,7 @@ function isLaneOwnedByCurrentSession(branchName, expectedSessionId) {
   return extracted === expectedSessionId;
 }
 async function inspectStandardWorktreeCollisionOwnership(identity) {
-  const collisionOwnership = await import("./worktree-collision-ownership-54ca6mb8.js");
+  const collisionOwnership = await import("./worktree-collision-ownership-wzdzky33.js");
   return collisionOwnership.inspectStandardWorktreeCollisionOwnership(identity);
 }
 async function runRecoveryGit(directory, args, timeoutMs = 15000) {
@@ -93102,7 +93185,7 @@ async function precreateStandardWorktreeSession(args) {
   const laneProfile = computeLaneRuntimeProfile(worktreeConfig.runtime_isolation, laneIndex, handle.worktreePath);
   if (laneProfile) {
     try {
-      const { writeLaneProfileToDiskReal } = await import("./core-7kdmc7h9.js");
+      const { writeLaneProfileToDiskReal } = await import("./core-g0cvvj3b.js");
       await writeLaneProfileToDiskReal(handle.worktreePath, laneProfile.laneIndex, laneProfile.envOverrides);
     } catch {}
   }
@@ -94027,7 +94110,7 @@ async function finishStandardWorktreeDispatch(directory, dispatch, config, callI
       }
       clearWorktreeMergeStatus(statusKey);
       try {
-        const { removeLaneProfileFromDiskReal } = await import("./core-7kdmc7h9.js");
+        const { removeLaneProfileFromDiskReal } = await import("./core-g0cvvj3b.js");
         await removeLaneProfileFromDiskReal(dispatch.handle.worktreePath, dispatch.laneIndex);
       } catch {}
       const state = serializationStateBySessionID.get(dispatch.parentSessionID);
@@ -94230,4 +94313,4 @@ var _internals104 = {
   resolveGitExecutable
 };
 
-export { resetActionCircuitExternally, getBlockingActionCircuit, dcNormalizeCommand, dcUnwrapWrappers, dcSplitSegments, dcExtractRecursiveRmTargets, dcEvaluateRecursiveDeleteTargets, dcCheckJunctionCreation, dcExtractWindowsCmdTargets, dcExtractPowerShellTargets, getSharedClassifierGuardrailBlock, classifyCommand, normalizeSwarmCommandInput, canonicalCommandKey, formatCommandNotFound, executeSwarmCommand, SWARM_COMMAND_TOOL_COMMANDS, SWARM_COMMAND_TOOL_ALLOWLIST, HUMAN_ONLY_SWARM_COMMANDS, classifySwarmCommandToolUse, classifySwarmCommandChatFallbackUse, detectPosixWrites, detectWindowsWrites, resolveWriteTargets, getAgentSession, parseLeanLaneIndex, computeLaneRuntimeProfile, MAX_TRACKED_STANDARD_WORKTREE_CALLS, awaitingMergeByCallID, standardWorktreeByCallID, standardWorktreeSerializationSessions, getStandardWorktreeDegradationReason, resetStandardWorktreeIsolationState, checkStandardWorktreeSerializationRelease, sanitizeWorktreeTaskId, preProvisionCollisionCheck, isLaneOwnedByCurrentSession, precreateStandardWorktreeSession, preserveBackgroundWorktreeOwnershipForCallId, preserveDirtyWorktreeForCallId, preserveDirtyWorktreeAtPath, cleanupStandardWorktreeForCallId, abortStandardWorktreeDispatch, finishStandardWorktreeDispatch, readLaneEnvFileFromDisk, _internals104 as _internals, prWorkflowSessionFileStem, ensurePrWorkflowSafeParentDirectory, writePrWorkflowAtomicJson, PrWorkflowCheckoutMutationTimeoutError, withPrWorkflowCheckoutMutationLock, PR_REVIEW_REPORT_VERDICTS, allowedPrReviewReportVerdicts, normalizePrReviewPartialBaseCoverageRecord, rollbackPrReviewPartialBaseCoverageAdmission, readPrReviewTerminalCoverageForReport, PR_REVIEW_REQUIRED_MICRO_LANE_IDS, PR_REVIEW_DEPTH_TIER_THRESHOLDS, PR_REVIEW_BASE_LANE_FLOORS, PR_REVIEW_TIER_L_CONSOLIDATED_LANE_FLOOR, PR_REVIEW_MICRO_LANE_FLOORS, computePrReviewDepthTier, MAX_PR_FEEDBACK_INVENTORY_AMENDMENTS, activatePrWorkflow, readPrWorkflowGateState, submitPrReviewResult, withPrWorkflowCheckoutPreparationLock, withInactivePrWorkflowCheckoutRestoreLock, clearPrWorkflowGateState, collectPrWorkflowPendingLaneLiveness, settlePresumedStalePrWorkflowLanes, abortPrWorkflow, recoverArmedPrWorkflow, bindPrWorkflowHead, rebindPrFeedbackHead, bindPrReviewBase, assertCurrentCheckoutHead, assertPrReviewCleanCheckout, enforcePrWorkflowDispatchLanesAsync, PrReviewResilienceCircuitOpenError, PrReviewResilienceRetryExhaustedError, enforcePrReviewBaseDimensions, rollbackPrReviewBaseAdmissionIfUnlaunched, admitPrReviewPartialBaseCoverage2 as admitPrReviewPartialBaseCoverage, assertPrReviewBaseCoverageSettled2 as assertPrReviewBaseCoverageSettled, recordPrReviewValidationBatch, assertPrReviewValidationSettled, declarePrFeedbackInventory, enforcePrFeedbackVerificationOwnership, assertPrFeedbackVerificationSettled, recordPrFeedbackStageA, recordPrFeedbackGateBatch, assertPrFeedbackGatePhaseSettled, assertPrFeedbackReadyToPublish, invalidatePrFeedbackPublication, describePrWorkflowPublicationSection, findDanglingLivePublicationGeneration, recordPrFeedbackPushAttemptResult, resolvePrReviewWriterRunId, markPrReviewTriggerEvaluationComplete, bindPrReviewTriggerLedger, assertPrReviewArtifactBoundary, assertPrReviewArtifactRecordsMatchAuthoritativeVerdicts, markPrReviewArtifactBoundary, markPrReviewHandoffComplete, transitionPrReviewToFeedback, declarePrFeedbackScope, resolvePrFeedbackScopeDeclaration, consumePrFeedbackScopeDeclaration, validatePrFeedbackScopeBinding, enforcePrWorkflowToolBefore, readPrReviewReentryBindingContext, reserveActivePrReviewReentryAuthorization, completePrWorkflow, _test_exports2 as _test_exports, normalizePrWorkflowShellCommand, describePrWorkflowRevisionDigestFailure, formatPrReviewLaneValidationFailure, validatePrReviewDiscoveryLaneCompletion2 as validatePrReviewDiscoveryLaneCompletion, validatePrWorkflowTransportRecovery, prReviewDiscoveryArtifactCoversLane, MAX_SALVAGED_SCHEMA_ERROR_CHARS, readPrWorkflowGateStateForRecovery, handleAcknowledgeSpecDriftCommand, handleAgentsCommand, handleAnalyzeCommand, handleApproveWriteCommand, handleArchiveCommand, handleAutoProceedCommand, handleBenchmarkCommand, handleBrainstormCommand, handleCheckpointCommand, handleCiSimulateCommand, handleClarifyCommand, createCuratorLLMDelegate, _internals27 as _internals1, normalizeRecommendationEntryIdToken, parseKnowledgeRecommendations, parseKnowledgeRecommendationsWithDiagnostics, parseStructuredCuratorBlocks, readCuratorSummary, writeCuratorSummary, appendCuratorRecommendation, mergeCuratorPhaseSummary, filterPhaseEvents, checkPhaseCompliance, runCuratorInit, runCuratorPhase, applyCuratorKnowledgeUpdates, isHiveEligible, countDistinctProjects, checkHivePromotions, _internals31 as _internals2, createHivePromoterHook, promoteToHive, promoteFromSwarm, safeRealpathSync, handleCloseCommand, handleCodebaseReviewCommand, handleConcurrencyCommand, handleConfigCommand, handleConsolidateCommand, handleCostsCommand, handleCouncilCommand, handleCurateCommand, handleDarkMatterCommand, handleDeepDiveCommand, handleDeepResearchCommand, getPluginConfigDir, getPluginCachePaths, getPluginLockFilePaths, VERSION_PINNED_LEAF, discoverVersionPinnedCachePaths, readCachePackageVersion, handleDiagnoseCommand, handleDoctorCommand, handleEvidenceCommand, handleEvidenceSummaryCommand, handleExportCommand, handleFullAutoCommand, handleGateAuditCommand, handleGateStatsCommand, handleHandoffCommand, handleBlueprintValidateCommand, handleBlueprintCurrentCommand, handleBlueprintHistoryCommand, handleBlueprintDiffCommand, handleBlueprintExportCommand, handleHarnessCandidateValidateCommand, handleHarnessCandidateShowCommand, handleHarnessCandidateDiffCommand, handleHistoryCommand, handleKnowledgeQuarantineCommand, handleKnowledgeRestoreCommand, handleKnowledgeMigrateCommand, handleKnowledgeListCommand, handleKnowledgeUnactionableCommand, handleKnowledgeRetryHardeningCommand, handleLearningCommand, handleLinkCommand, handleMemoryCommand, handleMemoryStatusCommand, handleMemoryValueLogCommand, handleMemoryMigrateCommand, handleMemoryImportCommand, handleMemoryExportCommand, handlePlanCommand, handlePreflightCommand, handlePromoteCommand, handleQaGatesCommand, handleRecoverCommand, handleResetCommand, handleResetSessionCommand, handleRetrieveCommand, handleReviewCommand, handleRollbackCommand, handleSddStatusCommand, handleSddValidateCommand, handleSddProjectCommand, handleSddCommand, handleSimulateCommand, handleSpecifyCommand, handleStatusCommand, handleSyncPlanCommand, handleTurboCommand, handleUnlinkCommand, handleWriteRetroCommand, handleHelpCommand, COMMAND_REGISTRY, VALID_COMMANDS, _internals102 as _internals3, resolveCommand };
+export { resetActionCircuitExternally, getBlockingActionCircuit, dcNormalizeCommand, dcUnwrapWrappers, dcSplitSegments, dcExtractRecursiveRmTargets, dcEvaluateRecursiveDeleteTargets, dcCheckJunctionCreation, dcExtractWindowsCmdTargets, dcExtractPowerShellTargets, getSharedClassifierGuardrailBlock, classifyCommand, normalizeSwarmCommandInput, canonicalCommandKey, formatCommandNotFound, executeSwarmCommand, SWARM_COMMAND_TOOL_COMMANDS, SWARM_COMMAND_TOOL_ALLOWLIST, HUMAN_ONLY_SWARM_COMMANDS, classifySwarmCommandToolUse, classifySwarmCommandChatFallbackUse, detectPosixWrites, detectWindowsWrites, resolveWriteTargets, getAgentSession, parseLeanLaneIndex, computeLaneRuntimeProfile, MAX_TRACKED_STANDARD_WORKTREE_CALLS, awaitingMergeByCallID, standardWorktreeByCallID, standardWorktreeSerializationSessions, getStandardWorktreeDegradationReason, resetStandardWorktreeIsolationState, checkStandardWorktreeSerializationRelease, sanitizeWorktreeTaskId, preProvisionCollisionCheck, isLaneOwnedByCurrentSession, precreateStandardWorktreeSession, preserveBackgroundWorktreeOwnershipForCallId, preserveDirtyWorktreeForCallId, preserveDirtyWorktreeAtPath, cleanupStandardWorktreeForCallId, abortStandardWorktreeDispatch, finishStandardWorktreeDispatch, readLaneEnvFileFromDisk, _internals104 as _internals, prWorkflowSessionFileStem, ensurePrWorkflowSafeParentDirectory, writePrWorkflowAtomicJson, PrWorkflowCheckoutMutationTimeoutError, withPrWorkflowCheckoutMutationLock, PR_REVIEW_REPORT_VERDICTS, allowedPrReviewReportVerdicts, normalizePrReviewPartialBaseCoverageRecord, rollbackPrReviewPartialBaseCoverageAdmission, readPrReviewTerminalCoverageForReport, PR_REVIEW_REQUIRED_MICRO_LANE_IDS, PR_REVIEW_DEPTH_TIER_THRESHOLDS, PR_REVIEW_BASE_LANE_FLOORS, PR_REVIEW_TIER_L_CONSOLIDATED_LANE_FLOOR, PR_REVIEW_MICRO_LANE_FLOORS, computePrReviewDepthTier, MAX_PR_FEEDBACK_INVENTORY_AMENDMENTS, activatePrWorkflow, readPrWorkflowGateState, submitPrReviewResult, withPrWorkflowCheckoutPreparationLock, withInactivePrWorkflowCheckoutRestoreLock, clearPrWorkflowGateState, collectPrWorkflowPendingLaneLiveness, settlePresumedStalePrWorkflowLanes, abortPrWorkflow, recoverArmedPrWorkflow, bindPrWorkflowHead, rebindPrFeedbackHead, bindPrReviewBase, assertCurrentCheckoutHead, assertPrReviewCleanCheckout, enforcePrWorkflowDispatchLanesAsync, PrReviewResilienceCircuitOpenError, PrReviewResilienceRetryExhaustedError, enforcePrReviewBaseDimensions, rollbackPrReviewBaseAdmissionIfUnlaunched, admitPrReviewPartialBaseCoverage2 as admitPrReviewPartialBaseCoverage, assertPrReviewBaseCoverageSettled2 as assertPrReviewBaseCoverageSettled, recordPrReviewValidationBatch, assertPrReviewValidationSettled, declarePrFeedbackInventory, enforcePrFeedbackVerificationOwnership, assertPrFeedbackVerificationSettled, recordPrFeedbackStageA, recordPrFeedbackGateBatch, assertPrFeedbackGatePhaseSettled, assertPrFeedbackReadyToPublish, invalidatePrFeedbackPublication, describePrWorkflowPublicationSection, findDanglingLivePublicationGeneration, recordPrFeedbackPushAttemptResult, resolvePrReviewWriterRunId, markPrReviewTriggerEvaluationComplete, bindPrReviewTriggerLedger, assertPrReviewArtifactBoundary, assertPrReviewArtifactRecordsMatchAuthoritativeVerdicts, markPrReviewArtifactBoundary, markPrReviewHandoffComplete, transitionPrReviewToFeedback, declarePrFeedbackScope, resolvePrFeedbackScopeDeclaration, consumePrFeedbackScopeDeclaration, validatePrFeedbackScopeBinding, enforcePrWorkflowToolBefore, readPrReviewReentryBindingContext, hasActivePrReviewReentryAuthorization, reserveActivePrReviewReentryAuthorization, completePrWorkflow, _test_exports2 as _test_exports, normalizePrWorkflowShellCommand, describePrWorkflowRevisionDigestFailure, formatPrReviewLaneValidationFailure, validatePrReviewDiscoveryLaneCompletion2 as validatePrReviewDiscoveryLaneCompletion, validatePrWorkflowTransportRecovery, prReviewDiscoveryArtifactCoversLane, MAX_SALVAGED_SCHEMA_ERROR_CHARS, readPrWorkflowGateStateForRecovery, handleAcknowledgeSpecDriftCommand, handleAgentsCommand, handleAnalyzeCommand, handleApproveWriteCommand, handleArchiveCommand, handleAutoProceedCommand, handleBenchmarkCommand, handleBrainstormCommand, handleCheckpointCommand, handleCiSimulateCommand, handleClarifyCommand, createCuratorLLMDelegate, _internals27 as _internals1, normalizeRecommendationEntryIdToken, parseKnowledgeRecommendations, parseKnowledgeRecommendationsWithDiagnostics, parseStructuredCuratorBlocks, readCuratorSummary, writeCuratorSummary, appendCuratorRecommendation, mergeCuratorPhaseSummary, filterPhaseEvents, checkPhaseCompliance, runCuratorInit, runCuratorPhase, applyCuratorKnowledgeUpdates, isHiveEligible, countDistinctProjects, checkHivePromotions, _internals31 as _internals2, createHivePromoterHook, promoteToHive, promoteFromSwarm, safeRealpathSync, handleCloseCommand, handleCodebaseReviewCommand, handleConcurrencyCommand, handleConfigCommand, handleConsolidateCommand, handleCostsCommand, handleCouncilCommand, handleCurateCommand, handleDarkMatterCommand, handleDeepDiveCommand, handleDeepResearchCommand, getPluginConfigDir, getPluginCachePaths, getPluginLockFilePaths, VERSION_PINNED_LEAF, discoverVersionPinnedCachePaths, readCachePackageVersion, handleDiagnoseCommand, handleDoctorCommand, handleEvidenceCommand, handleEvidenceSummaryCommand, handleExportCommand, handleFullAutoCommand, handleGateAuditCommand, handleGateStatsCommand, handleHandoffCommand, handleBlueprintValidateCommand, handleBlueprintCurrentCommand, handleBlueprintHistoryCommand, handleBlueprintDiffCommand, handleBlueprintExportCommand, handleHarnessCandidateValidateCommand, handleHarnessCandidateShowCommand, handleHarnessCandidateDiffCommand, handleHistoryCommand, handleKnowledgeQuarantineCommand, handleKnowledgeRestoreCommand, handleKnowledgeMigrateCommand, handleKnowledgeListCommand, handleKnowledgeUnactionableCommand, handleKnowledgeRetryHardeningCommand, handleLearningCommand, handleLinkCommand, handleMemoryCommand, handleMemoryStatusCommand, handleMemoryValueLogCommand, handleMemoryMigrateCommand, handleMemoryImportCommand, handleMemoryExportCommand, handlePlanCommand, handlePreflightCommand, handlePromoteCommand, handleQaGatesCommand, handleRecoverCommand, handleResetCommand, handleResetSessionCommand, handleRetrieveCommand, handleReviewCommand, handleRollbackCommand, handleSddStatusCommand, handleSddValidateCommand, handleSddProjectCommand, handleSddCommand, handleSimulateCommand, handleSpecifyCommand, handleStatusCommand, handleSyncPlanCommand, handleTurboCommand, handleUnlinkCommand, handleWriteRetroCommand, handleHelpCommand, COMMAND_REGISTRY, VALID_COMMANDS, _internals102 as _internals3, resolveCommand };