opencode-swarm 7.178.0 → 7.179.0

package/dist/memory/index.d.ts

@@ -10,6 +10,7 @@ export { createMemoryLifecycleHooks, type MemoryLifecycleHookOptions, type Memor
 export { backupLegacyJsonl, getLegacyJsonlFileStatus, getLegacyOutcomeJsonlSignature, type JsonlBackupResult, type JsonlImportPayload, type JsonlInvalidRow, type JsonlMigrationReport, LEGACY_JSONL_MIGRATION_NAME, LEGACY_JSONL_MIGRATION_VERSION, LEGACY_JSONL_OUTCOME_META_KEY, readLegacyJsonl, readMigrationReport, resolveMemoryStorageDir, resolveSqliteDatabasePath, writeJsonlExport, writeMigrationReport, } from './jsonl-migration';
 export { LocalJsonlMemoryProvider } from './local-jsonl-provider';
 export { buildMemoryMaintenanceReport, type MemoryMaintenanceReport, type MemoryMaintenanceReportOptions, type MemoryRecallUsageByMemory, type MemoryRecallUsageByRole, type MemorySupersededChain, shouldCompactMemory, } from './maintenance';
+export { MemoryMigrationLockError } from './memory-family-migration';
 export { invalidateMemoryStoreDirCache, isMemoryLinked, MEMORY_LINK_POINTER_FILENAME, type MemoryLinkPointer, readMemoryLinkPointer, removeMemoryLinkPointer, resolveMemoryStoreDir, writeMemoryLinkPointer, } from './memory-link';
 export type { MemoryOutcomeEvent } from './outcome-events';
 export { computePiiScore, createPiiDetector, type PiiDetector, type PiiFinding, type PiiType, RegexPiiDetector, summarizePiiFindings, } from './pii';

package/dist/memory/memory-family-migration.d.ts

@@ -18,15 +18,46 @@
  * (`handleMemoryLinkCommand`), so a mid-migration failure leaves the worktree
  * in its prior link state and a retry is idempotent.
  *
- * Lock discipline: `proper-lockfile` on the destination cohort dir with a
- * bumped `stale` (30s) for the migration critical section — reused from the
- * knowledge family so there is one source of truth for the lock config.
+ * Lock discipline: `proper-lockfile` on the destination storage dir (cohort
+ * OR local — both directions) with a bumped `stale` (30s) for the migration
+ * critical section — reused from the knowledge family so there is one source
+ * of truth for the lock config. `realpath: false` keeps the lock identity on
+ * the literal path so it is the SAME lock the local JSONL provider takes on
+ * this directory (PRR-U1): symlinked roots (e.g. macOS /var → /private/var)
+ * must not split the exclusion into two identities.
+ * Admission is fail-closed (#2577): if the destination lock cannot be
+ * acquired (a legitimate concurrent writer holds it, or acquisition fails for
+ * a storage reason), the migration throws a typed
+ * {@link MemoryMigrationLockError} and never runs unlocked.
  *
  * No writes happen here on the plugin-init path (invariant 1). Called only
  * from the `/swarm memory link` / `/swarm memory unlink` command handlers.
  */
 import { type MemoryOutcomeEvent } from './outcome-events.js';
 import type { VettedMemoryRoot } from './storage-root.js';
+/**
+ * Minimal typing for the async `proper-lockfile` API this engine uses,
+ * exposed through {@link _internals} so tests can classify acquisition
+ * failures deterministically (same DI pattern as `src/full-auto/state.ts`).
+ */
+type MigrationLockFile = {
+    lock: typeof import('proper-lockfile')['lock'];
+};
+/** Failure category for destination-lock admission (#2577, #2575 contract). */
+export type MemoryMigrationLockErrorCategory = 'contention' | 'storage';
+/**
+ * Typed failure for acquiring the destination migration lock. Thrown BEFORE
+ * the merge loop opens, so no destination or source write ever happens on a
+ * failed admission. Mirrors `FullAutoStateLockError` in
+ * `src/full-auto/state.ts` (#2575): stable category + code, cause preserved
+ * for diagnostics, and messages that never echo absolute host paths.
+ */
+export declare class MemoryMigrationLockError extends Error {
+    readonly category: MemoryMigrationLockErrorCategory;
+    readonly cause: unknown;
+    readonly code: `MEMORY_MIGRATION_LOCK_${Uppercase<MemoryMigrationLockErrorCategory>}`;
+    constructor(category: MemoryMigrationLockErrorCategory, message: string, cause?: unknown);
+}
 export interface MemoryFamilyMigrationCounts {
     readonly perMember: ReadonlyArray<{
         filename: string;
@@ -102,5 +133,6 @@ export declare const _internals: {
     stageSqliteDb: typeof stageSqliteDb;
     mergeStagedSqlite: typeof mergeStagedSqlite;
     countRowsSafe: typeof countRowsSafe;
+    lockfile: MigrationLockFile;
 };
 export {};

package/dist/mutation/engine.d.ts

@@ -98,5 +98,11 @@ export declare const _internals: {
 };
 export declare function executeMutation(patch: MutationPatch, testCommand: string[], testFiles: string[], workingDir: string, options?: MutationExecutionOptions): Promise<MutationResult>;
 export declare function computeReport(results: MutationResult[], durationMs: number, budgetMs?: number): MutationReport;
+/**
+ * Apply a unified diff's hunks to the original file text, producing the full
+ * mutated file. Returns null when the diff does not parse or does not apply
+ * cleanly to the original (context mismatch), so callers can fall back.
+ */
+export declare function applyUnifiedDiff(originalCode: string, patchText: string): string | null;
 export declare function executeMutationSuite(patches: MutationPatch[], testCommand: string[], testFiles: string[], workingDir: string, budgetMs?: number, onProgress?: (completed: number, total: number, result: MutationResult) => void, sourceFiles?: Map<string, string>, options?: MutationExecutionOptions): Promise<MutationReport>;
 export {};

package/dist/mutation/equivalence.d.ts

@@ -18,7 +18,17 @@ export type LLMJudgeCallback = (original: string, mutated: string, context: stri
  * Strips comments (single-line // and multi-line /* *\/), console.log/debugger statements,
  * trailing whitespace, and blank lines. Returns true if the stripped versions are identical.
  */
-export declare function isStaticallyEquivalent(originalCode: string, mutatedCode: string): boolean;
+/**
+ * Comment syntax family for a language hint (a file path or language id).
+ * The default family preserves the historical 2-argument behavior exactly:
+ * // line comments plus slash-star block comments (TS/JS/Go/PHP/Java/Kotlin/C/C++/Rust).
+ */
+interface CommentSyntaxFamily {
+    lineTokens: string[];
+    blockComments: boolean;
+}
+export declare function commentFamilyForLanguage(languageHint?: string): CommentSyntaxFamily;
+export declare function isStaticallyEquivalent(originalCode: string, mutatedCode: string, languageHint?: string): boolean;
 export declare const _internals: {
     isStaticallyEquivalent: typeof isStaticallyEquivalent;
     checkEquivalence: typeof checkEquivalence;
@@ -38,3 +48,4 @@ export declare function batchCheckEquivalence(patches: Array<{
     originalCode: string;
     mutatedCode: string;
 }>, llmJudge?: LLMJudgeCallback): Promise<EquivalenceResult[]>;
+export {};

package/dist/plan/ledger.d.ts

@@ -163,6 +163,20 @@ export declare function computePlanLedgerHash(plan: Plan): string;
  * any structural change (description, acceptance, dependencies, files, added
  * or removed tasks/phases) always must.
  *
+ * DELIBERATE exception, recorded with #2532 (PLAN-4): `current_phase` — the
+ * execution cursor — IS included in this hash (and in
+ * {@link computePlanLedgerHash}). Unlike task/phase statuses, a cursor
+ * advance therefore DOES change the baseline hash: bindings and approved
+ * snapshots declared against the pre-advance plan stop matching, exactly as
+ * they already do for any save_plan revision. This is intentional — the
+ * hash bytes are persisted on every live binding (`planStructureHash`,
+ * verified with strict equality) and every critic-approved snapshot
+ * (`payload_hash`), so changing the normalization would silently invalidate
+ * all pre-existing state at upgrade. The bounded safety property: only a
+ * phase-boundary advancement moves the cursor (task-status churn inside a
+ * phase is hash-excluded), so mid-phase parallel siblings keep their
+ * bindings across ordinary task completion.
+ *
  * This mirrors {@link computePlanLedgerHash}'s normalization byte-for-byte
  * EXCEPT it omits the two status fields from the hashed payload. The two
  * functions are deliberately distinct: {@link computePlanLedgerHash} is

package/dist/plan/manager.d.ts

@@ -44,7 +44,6 @@ import { getWorktreeMergeFailure } from '../hooks/delegation-gate/worktree-merge
 import { recordTaskAttempt } from '../services/run-memory.js';
 import { isEpicModeActiveForProject } from '../turbo/epic/state.js';
 import { commitTaskCompletion } from '../turbo/epic/task-commit.js';
-import { readTaskScopes } from '../turbo/lean/conflicts.js';
 import { type LedgerEvent, type LedgerEventInput, ledgerExists, loadLastApprovedPlan, readLedgerEventsWithIntegrity, replayFromLedger, takeSnapshotWithRetry } from './ledger';
 /** Reset the startup ledger check flag. For testing only. */
 export declare function resetStartupLedgerCheck(): void;
@@ -69,7 +68,6 @@ export declare const _internals: {
     regeneratePlanMarkdown: typeof regeneratePlanMarkdown;
     isGitRepo: typeof isGitRepo;
     isEpicModeActiveForProject: typeof isEpicModeActiveForProject;
-    readTaskScopes: typeof readTaskScopes;
     commitTaskCompletion: typeof commitTaskCompletion;
     getWorktreeMergeFailure: typeof getWorktreeMergeFailure;
     recordTaskAttempt: typeof recordTaskAttempt;

package/dist/plan/parallel-verdict.d.ts

@@ -1,7 +1,7 @@
 /**
  * Plan-time parallel-execution verdict helper (#1656 / #1674 v8 flagship).
  *
- * Pure, synchronous, side-effect-free pairwise conflict analysis for N proposed
+ * Pure, side-effect-free pairwise conflict analysis for N proposed
  * parallel task groups. Used by BOTH:
  *   - the `plan_conflict_check` tool (architect-facing advisory — see
  *     `src/tools/plan-conflict-check.ts`), and
@@ -14,23 +14,30 @@
  * means.
  *
  * Design notes:
- *  - Sync by design: it reads only `.swarm/scopes/scope-<taskId>.json` via
- *    the hardened persisted-scope reader (sync + fail-closed). The gate runs in
- *    `toolBefore` on every tool call and must stay bounded; an async/gitten
- *    helper would violate the bounded-gate spirit.
+ *  - Sync by design: it reads only the authoritative v2 scope-binding store
+ *    (the same authority `declare_scope` writes) via the hardened
+ *    fail-closed readers. The gate runs in `toolBefore` on every tool call
+ *    and must stay bounded; an async helper would violate the bounded-gate
+ *    spirit. One binding-set scan is hoisted per verdict, never per task.
+ *  - #2532 (PARALLEL-4): scope resolution deliberately does NOT consult the
+ *    legacy v1 `.swarm/scopes/scope-<taskId>.json` projection — no production
+ *    code writes it in the project root (its one writer targets lane
+ *    worktrees), so v2-declared disjoint scopes used to be reported as
+ *    `unknown_scopes` and parallel-first could never engage.
  *  - The helper itself NEVER calls `getCoChangePairs` (async + `git log`).
  *    Co-change signal is opt-in and supplied by the caller (the tool) via
  *    `options.cochangePairs`. The gate never supplies it, keeping the
  *    enforcement path git-free and fast.
- *  - Fail-closed: a missing/malformed scope → `unknown_scope`, which conflicts
- *    with everything, so `verdict` can never be `all_disjoint` while any task
- *    lacks a declared scope. This is the v8 safety guarantee.
+ *  - Fail-closed: a task with no single live exact-plan v2 binding →
+ *    `unknown`, which conflicts with everything, so `verdict` can never be
+ *    `all_disjoint` while any task lacks a declared scope. This is the v8
+ *    safety guarantee.
  *  - Writes nothing. Honors issue #1656's "read-only (writes nothing)" tool
  *    acceptance criterion.
  */
+import { type Plan } from '../config/plan-schema.js';
 import type { CoChangeEntry } from '../tools/co-change-analyzer.js';
 import { type CoChangeThreshold } from '../turbo/epic/cochange-conflict.js';
-import { normalizePath, pathsConflict, readTaskScopes } from '../turbo/lean/conflicts.js';
 /**
  * Per-pair conflict classification. Mirrors `EpicPairVerdict`'s signal
  * decomposition but flattens `none` into `disjoint` for the plan-level view.
@@ -70,14 +77,22 @@ export interface ComputeParallelVerdictOptions {
     cochangePairs?: CoChangeEntry[];
     /** Override the co-change threshold. Defaults to `DEFAULT_PARALLEL_COCHANGE_THRESHOLD`. */
     cochangeThreshold?: CoChangeThreshold;
+    /**
+     * The plan the verdict is computed against (issue #2532). Bindings must
+     * match its exact identity (`planId` + `planStructureHash`). When omitted,
+     * the helper synchronously reads `<directory>/.swarm/plan.json`; a missing
+     * or unparseable plan resolves every task to `unknown` (fail-closed).
+     */
+    plan?: Plan;
 }
 /**
  * Compute a pairwise conflict verdict for the given task ids.
  *
- * Pure + synchronous. Reads only `.swarm/scopes/`. Writes nothing. Fail-closed
- * on any read/parse error (treats the task as `unknown`).
+ * Pure + synchronous. Reads only the authoritative v2 binding store (plus a
+ * bounded plan.json read when `options.plan` is omitted). Writes nothing.
+ * Fail-closed on any read/parse error (treats the task as `unknown`).
  *
- * @param directory  Project root (for `.swarm/scopes/` reads).
+ * @param directory  Project root (for the binding store and plan.json reads).
  * @param taskIds    Task ids to analyze. Caller is responsible for min-length
  *                   validation (the tool requires ≥2; the gate only calls this
  *                   with ≥2 pending tasks).
@@ -90,5 +105,4 @@ export declare function computeParallelVerdict(directory: string, taskIds: strin
  * Equivalent to `computeParallelVerdict(...).verdict === 'all_disjoint'` but
  * exposed as a named predicate so the gate reads as intent.
  */
-export declare function isProvablyDisjoint(directory: string, taskIds: string[]): boolean;
-export { normalizePath, pathsConflict, readTaskScopes };
+export declare function isProvablyDisjoint(directory: string, taskIds: string[], options?: ComputeParallelVerdictOptions): boolean;

package/dist/pr-review/circuit.d.ts

@@ -22,9 +22,9 @@
  * Issue #2385 additionally makes this module the ONLY authority that may
  * construct or transition circuit records: policy snapshot resolution, the
  * re-enable reset, and the rolled-back-probe transition live here (previously
- * inline record constructions in the gate). The parallel-rule guardrail
- * (`src/pr-review/guardrails.ts`) enforces that no circuit record is built
- * outside `src/pr-review/`.
+ * inline record constructions in the gate). The source-tree regression tests
+ * enforce that no circuit record is built outside `src/pr-review/`; this pure
+ * state-machine module remains the production construction authority.
  */
 import { z } from 'zod';
 import type { BackgroundDelegationRecord } from '../background/pending-delegations.js';

package/dist/pr-review/legacy-transcript-adapter.d.ts

@@ -4,12 +4,10 @@
  *
  * This is the ONLY module allowed to convert raw transcript / artifact text
  * into canonical PR-review data (verdict rows, per-item verdicts, feedback
- * classifications). The locality contract is enforced mechanically by
- * `scanTranscriptParsingOutsideAdapter` in `src/pr-review/guardrails.ts`:
- * every identifier in `TRANSCRIPT_CONVERSION_SYMBOLS` may appear only in this
- * file across `src/`. The gate therefore consumes this boundary through the
- * `legacy*`-prefixed aliases and the test surface exported below — never
- * through the conversion identifiers themselves.
+ * classifications). This module is the sole owner of the transcript
+ * conversion identifiers across `src/`; the gate therefore consumes this
+ * boundary through the `legacy*`-prefixed aliases and the test surface
+ * exported below — never through the conversion identifiers themselves.
  *
  * Compat gating: the settlement path that accepts legacy (pre-structured-
  * receipt) transcript text is governed by the delegation record's
@@ -252,10 +250,9 @@ export declare function feedbackArtifactTextCoversItems(text: string, itemIds: r
  */
 export declare function readSettledFeedbackClassifications(directory: string, state: PrReviewTranscriptState): Map<string, string>;
 /**
- * Issue #2385 guardrail aliases: the transcript-conversion identifiers may
- * appear only in this module (`scanTranscriptParsingOutsideAdapter` in
- * `src/pr-review/guardrails.ts`), so the owning gate imports these aliases
- * instead of the canonical names.
+ * Issue #2385 guardrail aliases: transcript-conversion identifiers are owned
+ * only by this module, so the owning gate imports these aliases instead of
+ * the canonical names.
  */
 export declare const analyzeLegacyVerdictRowContract: typeof analyzePrReviewVerdictRowContract;
 export declare const legacyArtifactHasExactPositiveVerdictRow: typeof artifactHasExactPositiveVerdictRow;

package/dist/pr-review/persistence.d.ts

@@ -55,6 +55,10 @@ export interface PrReviewPersistenceHooks {
     beforeSafeDirectoryCreate?: (parentPath: string, nextPath: string) => Promise<void>;
     beforeAtomicTempWrite?: () => Promise<void>;
     beforeAtomicRename?: () => Promise<void>;
+    /** Test-only interleave point immediately before terminal CAS deletion. */
+    beforeTerminalizationDelete?: () => Promise<void>;
+    /** Test-only unlink seam for partial-shadow cleanup recovery tests. */
+    removeShadowProjection?: (filePath: string) => Promise<void>;
 }
 export declare const defaultPersistenceHooks: PrReviewPersistenceHooks;
 /**
@@ -94,6 +98,28 @@ export declare function readPrWorkflowGateStateFromDisk<S extends PrWorkflowPers
 export declare function readPrWorkflowGateStateFileRawFromDisk<S extends PrWorkflowPersistedStateBase>(filePath: string, stateLabel: string): Promise<S | null>;
 export declare function readPrWorkflowGateStateFileFromDisk<S extends PrWorkflowPersistedStateBase>(filePath: string, stateLabel: string): Promise<S | null>;
 export declare function readPrWorkflowGateStateFromCoordination<S extends PrWorkflowPersistedStateBase>(directory: string, sessionID: string): Promise<S | null>;
+export type PrWorkflowGateCoordinationRecovery<S extends PrWorkflowPersistedStateBase> = {
+    kind: 'absent';
+} | {
+    kind: 'valid';
+    rowRevision: number;
+    generation: number;
+    state: S;
+} | {
+    kind: 'corrupt';
+    rowRevision: number;
+    generation: number;
+    reason: string;
+} | {
+    kind: 'invalid';
+    reason: string;
+};
+/**
+ * Inspect one workflow coordination row for recovery without trusting payload
+ * bytes. Only payload JSON/codec/generation failures are recoverable with a
+ * matching shadow projection. Database open/query errors intentionally escape.
+ */
+export declare function readPrWorkflowGateStateCoordinationForRecovery<S extends PrWorkflowPersistedStateBase>(directory: string, sessionID: string): PrWorkflowGateCoordinationRecovery<S>;
 /** Persist one CAS-checked state replacement while the session lock is held. */
 export declare function writeStateWhileLocked<S extends PrWorkflowPersistedStateBase>(directory: string, state: S, options?: {
     replaceWorkflowInstanceId?: string;
@@ -103,6 +129,16 @@ export declare function deleteStateWhileLocked(directory: string, sessionID: str
     expectedStateRevision?: number;
     allowSalvagedRead?: boolean;
 }): Promise<void>;
+/**
+ * Terminalize one session's gate on exact owner lifecycle deletion.
+ *
+ * This is deliberately independent of abort policy: it serializes the exact
+ * normalized session, removes that session's shadow projection before its
+ * CAS-delete, then forgets the cache entry. A missing row/projection is an
+ * idempotent successful terminal; retaining the row across partial cleanup
+ * prevents a legacy shadow from being imported as resurrected state.
+ */
+export declare function terminalizePrWorkflowGateForSession(directory: string, sessionID: string): Promise<void>;
 /** A bounded checkout-mutation refusal that never permits unsafe late overlap. */
 export declare class PrWorkflowCheckoutMutationTimeoutError extends Error {
     readonly phase: 'queue' | 'action';

package/dist/retention/sweep.d.ts

@@ -23,6 +23,10 @@
  *  - authoritative streams (plan ledger, knowledge store, council, evidence,
  *    scopes, swarm.db, telemetry) are NOT in any family and are never
  *    touched (negative test).
+ *  - checkout-preparation receipts remain recovery material: the checkout
+ *    family only removes old, strictly validated applied+verified receipts
+ *    (and abandoned atomic-write temporary files), never a pending receipt or
+ *    its stash.
  */
 /** Default age horizon for keyspace families (30 days). */
 export declare const DEFAULT_FAMILY_AGE_DAYS = 30;

package/dist/scope/scope-persistence.d.ts

@@ -117,6 +117,47 @@ export declare function readScopeBindingFromDisk(input: {
     requireDispatchCorrelation?: boolean;
     requireDeclaration?: boolean;
 }): ScopeBinding | null;
+/**
+ * Resolve the currently-declared scope FILES for a task from the authoritative
+ * v2 binding store (issue #2532 / PARALLEL-4).
+ *
+ * Scheduling/conflict consumers (the v8 parallel verdict, Rule-2 auto-commit)
+ * must resolve task scopes from the same authority `declare_scope` writes —
+ * never from the legacy v1 `scope-<taskId>.json` projection, which no
+ * production code writes in the project root. This is a scheduling read, NOT
+ * write authorization: it deliberately does not require owner-session or
+ * dispatch correlation, but it DOES require an exact `planStructureHash`
+ * match so a declaration made against an older plan revision cannot certify
+ * disjointness for the current one.
+ *
+ * Fail-closed: zero live candidates (undeclared or store failure), live
+ * candidates that DISAGREE on the file set, or an empty file list all return
+ * `null`, which callers treat as "unknown scope" → serial. Multiple live
+ * candidates that AGREE on the exact same file set are NOT ambiguous: the
+ * delegation gate mints a dispatch-correlated binding (activation 'active',
+ * child owner) alongside the architect's declaration binding for the same
+ * task with the same files, and the scheduling question — "what is this
+ * task's currently-declared scope?" — has one answer whenever they agree.
+ *
+ * `bindingSet` lets a multi-task caller hoist ONE
+ * `readAllAuthoritativeScopeBindings` scan for the whole verdict (pass the
+ * result of {@link readAuthoritativeScopeBindingSet}); omit it for a
+ * single-task read.
+ */
+export declare function readDeclaredScopeFilesFromBindings(input: {
+    directory: string;
+    taskId: string;
+    plan: Plan;
+    bindingSet?: ScopeBinding[] | null;
+}): string[] | null;
+/**
+ * Hoisted single read of the authoritative v2 binding set for multi-task
+ * scheduling consumers (issue #2532): one bounded scan shared by every
+ * per-task {@link readDeclaredScopeFilesFromBindings} call in a verdict.
+ * Returns `null` when the store is unreadable/overloaded so callers fail
+ * closed to "unknown scope" per task.
+ */
+export declare function readAuthoritativeScopeBindingSet(directory: string): ScopeBinding[] | null;
 export declare function resolveScopeBindingFromDisk(input: {
     directory: string;
     taskId: string;

package/dist/tools/mutation-test.d.ts

@@ -1,2 +1,8 @@
+import { analyzeImpact } from '../test-impact/analyzer.js';
 import { createSwarmTool } from './create-tool';
 export declare const mutation_test: ReturnType<typeof createSwarmTool>;
+export declare const _internals: {
+    mutationInternals: {
+        analyzeImpact: typeof analyzeImpact;
+    };
+};

package/dist/tools/plan-conflict-check.d.ts

@@ -7,10 +7,10 @@
  *
  * READ-ONLY CONTRACT (issue #1656 acceptance): this tool writes NOTHING — not
  * to `.swarm/`, not to the source tree. It calls no other tools. The only I/O
- * is reading `.swarm/plan.json` (via `loadPlanJsonOnly`) and
- * `.swarm/scopes/scope-<taskId>.json` (via `readTaskScopes` inside
- * `computeParallelVerdict`), plus an optional `git log` (only when the caller
- * opts in via `use_cochange: true`).
+ * is reading `.swarm/plan.json` (via `loadPlanJsonOnly`) and the
+ * authoritative v2 scope-binding store (via `readDeclaredScopeFilesFromBindings`
+ * inside `computeParallelVerdict`, #2532), plus an optional `git log` (only
+ * when the caller opts in via `use_cochange: true`).
  *
  * Why this tool exists alongside the gate: the gate (`delegation-gate.ts`)
  * independently recomputes the verdict INLINE at coder-dispatch time via the
@@ -50,8 +50,9 @@ export interface PlanConflictCheckResult {
 /**
  * Pure executor (no createSwarmTool wrapper) so it is directly unit-testable.
  *
- * Reads `.swarm/plan.json` (to confirm the task ids exist) and
- * `.swarm/scopes/scope-*.json` (via `computeParallelVerdict`). Writes nothing.
+ * Reads `.swarm/plan.json` (to confirm the task ids exist) and the
+ * authoritative v2 scope-binding store (via `computeParallelVerdict`,
+ * #2532). Writes nothing.
  */
 export declare function executePlanConflictCheck(args: {
     task_ids: string[];

package/dist/tools/prepare-pr-workflow-checkout.d.ts

@@ -1,9 +1,26 @@
+import { appendCoreEventSync } from '../events/core-events.js';
 import { classifyPrWorkflowGitState } from '../git/pr-workflow-state.js';
 import { createSwarmTool } from './create-tool.js';
 export interface PrWorkflowCheckoutRestoreInventoryItem {
     stash_oid: string;
     stash_present: boolean | null;
 }
+export interface PrWorkflowCheckoutReconciliationSummary {
+    /** The exact owner session whose receipt directory was inspected. */
+    sessionID: string;
+    /** Number of validated receipt files considered in this bounded pass. */
+    inspectedReceiptCount: number;
+    /** Verified receipt OIDs whose marked stash was collected and verified absent. */
+    collectedStashOids: string[];
+    /** Missing-stash receipt OIDs with bounded core-event evidence and receipt retirement. */
+    retiredMissingStashOids: string[];
+    /** Receipt/stash OIDs deliberately preserved (pending, unknown, or failed cleanup). */
+    preservedStashOids: string[];
+    /** Cleanup failures; no corresponding receipt is retired when this is non-empty. */
+    failures: string[];
+    /** True when all inspected inventory stayed within the hard bounds. */
+    bounded: boolean;
+}
 /**
  * Preserve explicit dirty tracked files before the unbound PR checkout.
  *
@@ -27,6 +44,7 @@ declare function runGit(directory: string, args: string[], options?: {
 declare function readBoundedGitStdout(stream: {
     getReader(): ReadableStreamDefaultReader<Uint8Array>;
 }, onOverflow: () => void): Promise<string>;
+export declare function reconcilePrWorkflowCheckoutReceipts(directory: string, rawSessionID: string): Promise<PrWorkflowCheckoutReconciliationSummary>;
 declare function removeCheckoutRestoreReceipt(receiptPath: string): Promise<void>;
 export declare function listPendingPrWorkflowCheckoutRestores(directory: string, sessionID: string): Promise<PrWorkflowCheckoutRestoreInventoryItem[]>;
 /**
@@ -40,6 +58,7 @@ export declare const _internals: {
     readBoundedGitStdout: typeof readBoundedGitStdout;
     classifyGitState: typeof classifyPrWorkflowGitState;
     removeCheckoutRestoreReceipt: typeof removeCheckoutRestoreReceipt;
+    appendCoreEventSync: typeof appendCoreEventSync;
 };
 export declare const prepare_pr_workflow_checkout: ReturnType<typeof createSwarmTool>;
 export {};

package/dist/tools/repo-map-action-dispositions.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Disposition registry for repo_map actions audited as unreferenced (issue #2540).
+ *
+ * Every entry in VALID_ACTIONS must be reachable from a real workflow surface
+ * (agent prompt, skill, or command) or be deliberately retired. This registry
+ * records the per-action disposition for the six audit actions from
+ * REPOGRAPH-11 (docs/audits/swarm-plugin-review-2026-09.md): each is retained
+ * and wired to the listed consumers. The controls wired by #2516
+ * (route_trace, test_pack) and the two additional contextually-unreferenced
+ * entries the ratchet surfaced (callers, retrieve) are intentionally NOT
+ * subjects here — they already had, or gained independently, their own
+ * consumers and are enforced by the VALID_ACTIONS↔consumer ratchet test
+ * (tests/unit/config/repo-map-action-consumer-ratchet.test.ts).
+ */
+export interface RepoMapActionDisposition {
+    /** retained = wired to real consumers; retired = removed from the advertised surface */
+    disposition: 'retained' | 'retired';
+    /** repo-relative workflow-surface files containing a repo_map-contextual reference (required when retained) */
+    consumers?: string[];
+    /** surfaces scrubbed of the action (required when retired: schema, help, prompts, inventory) */
+    removedFrom?: string[];
+}
+export declare const REPO_MAP_ACTION_DISPOSITIONS: Record<string, RepoMapActionDisposition>;

package/dist/tools/test-runner.d.ts

@@ -12,7 +12,6 @@ export declare const MAX_COMMAND_LENGTH = 500;
 export declare const DEFAULT_TIMEOUT_MS = 60000;
 export declare const MAX_TIMEOUT_MS = 300000;
 export declare const MAX_SAFE_TEST_FILES = 50;
-export declare const MAX_SAFE_SOURCE_FILES = 1;
 /**
  * Estimate the fan-out (number of unique test files) for given source files
  * by reading the cached impact map without spawning a subprocess.
@@ -35,7 +34,14 @@ export interface TestRunnerArgs {
     timeout_ms?: number;
     bail?: boolean;
 }
-export type RegressionOutcome = 'pass' | 'skip' | 'regression' | 'scope_exceeded' | 'error';
+export type RegressionOutcome = 'pass' | 'skip' | 'no_impacted_tests' | 'regression' | 'scope_exceeded' | 'error';
+/** Binding cap decision reported on every discovery-scope test_runner response. */
+export interface CapDecision {
+    decision: 'within_cap' | 'cap_exceeded';
+    resolved_test_count: number;
+    limit: number;
+    source_file_count?: number;
+}
 export interface TestTotals {
     passed: number;
     failed: number;
@@ -64,6 +70,12 @@ export interface TestSuccessResult {
     testCases?: ParsedTestCaseResult[];
     message?: string;
     outcome?: RegressionOutcome;
+    /** Post-resolution deduplicated test-file set (discovery scopes only). */
+    resolved_test_files?: string[];
+    /** Binding cap decision — the post-resolution count, never an estimate. */
+    cap_decision?: CapDecision;
+    /** Non-empty exactly when resolution fell back to a narrower discovery scope. */
+    fallback_reason?: string;
 }
 export interface TestErrorResult {
     success: false;
@@ -80,6 +92,9 @@ export interface TestErrorResult {
     message?: string;
     outcome?: RegressionOutcome;
     attempted_scope?: 'graph';
+    resolved_test_files?: string[];
+    cap_decision?: CapDecision;
+    fallback_reason?: string;
 }
 export type TestResult = TestSuccessResult | TestErrorResult;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.178.0",
+	"version": "7.179.0",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

package/dist/cli/curator-llm-factory-qhhxev17.js

@@ -1,72 +0,0 @@
-// @bun
-import {
-  createCuratorLLMDelegate
-} from "./index-heg4em8j.js";
-import"./index-hnvmj9wx.js";
-import"./index-q9vb5e7n.js";
-import"./index-qs8eth8h.js";
-import"./index-bfz1jvcn.js";
-import"./index-vfc7d22n.js";
-import"./index-jzxeymr0.js";
-import"./index-mpcp6rmj.js";
-import"./index-txdagbh7.js";
-import"./index-n1tcj1q7.js";
-import"./index-6b295cas.js";
-import"./index-zsm8h8y1.js";
-import"./index-at0ygwwp.js";
-import"./index-zex7644g.js";
-import"./index-fyfbpz4f.js";
-import"./index-y74n1sy8.js";
-import"./index-549wxbe1.js";
-import"./index-zsrtt42s.js";
-import"./index-wkde35ej.js";
-import"./index-pm7c6f66.js";
-import"./index-2b1whj28.js";
-import"./index-pt7h91zc.js";
-import"./index-q7sjgr1y.js";
-import"./index-kfk403mc.js";
-import"./index-p27az2hc.js";
-import"./index-rp0jk48x.js";
-import"./index-29begjkp.js";
-import"./index-zmb8fjp5.js";
-import"./index-2s7dvzff.js";
-import"./index-d5dexrv1.js";
-import"./index-ffqy30e5.js";
-import"./index-rtry5xyf.js";
-import"./index-2vhkwy6v.js";
-import"./index-frcemc0b.js";
-import"./index-wrt875kh.js";
-import"./index-gg44hytk.js";
-import"./index-ke3m026z.js";
-import"./index-j1v54ahd.js";
-import"./index-y6a2bkp1.js";
-import"./index-w4yjy3vp.js";
-import"./index-tnjmn0dn.js";
-import"./index-rdm3px0g.js";
-import"./index-ry16d01s.js";
-import"./index-yeh78c1g.js";
-import"./index-2mdk6nt9.js";
-import"./index-vzm6zre7.js";
-import"./index-ae75rja9.js";
-import"./index-yj1kr0ft.js";
-import"./index-j3rkh9mp.js";
-import"./index-7g4c7s5r.js";
-import"./index-wfbh1bx8.js";
-import"./index-zsp9de3k.js";
-import"./index-1xnse449.js";
-import"./index-c1ggtmpm.js";
-import"./index-18hjycr1.js";
-import"./index-zz7gzw57.js";
-import"./index-4ddpvd5c.js";
-import"./index-wbkxbgk8.js";
-import"./index-m2n1rhgv.js";
-import"./index-bk5tah7q.js";
-import"./index-gknz3bv1.js";
-import"./index-zpsr8rpc.js";
-import"./index-wvghb3x6.js";
-import"./index-9rwhas09.js";
-import"./index-zgwm4ryv.js";
-import"./index-a76rekgs.js";
-export {
-  createCuratorLLMDelegate
-};