opencode-swarm 7.199.4 → 7.199.5

package/dist/cli/{worktree-isolation-yj3vfp1h.js → worktree-isolation-z6ytes0j.js}

@@ -25,83 +25,83 @@ import {
   sanitizeWorktreeTaskId,
   standardWorktreeByCallID,
   standardWorktreeSerializationSessions
-} from "./index-5mfahvm2.js";
-import"./index-jhz7qpb4.js";
-import"./index-2wsh6d15.js";
-import"./index-vnmadnbs.js";
-import"./index-j2vv0h13.js";
-import"./index-dyp5807d.js";
-import"./index-7c432abn.js";
+} from "./index-26dmsdx3.js";
+import"./index-my753e0g.js";
+import"./index-3fz5w2wb.js";
+import"./index-6ssraqaa.js";
+import"./index-axqyjreb.js";
+import"./index-0je0mees.js";
+import"./index-hx2f3j9w.js";
 import"./index-txdagbh7.js";
-import"./index-x1j0838n.js";
+import"./index-zdfzrwbk.js";
 import"./index-rdec0y3z.js";
-import"./index-sxh861jr.js";
-import"./index-dradkxhb.js";
-import"./index-ffkd1zwc.js";
-import"./index-h44592hj.js";
-import"./index-hz2609qt.js";
-import"./index-bkscmz4z.js";
-import"./index-cjapb4hy.js";
-import"./index-pxdc0qn1.js";
+import"./index-9n40q82y.js";
+import"./index-6xyt6d5m.js";
+import"./index-85vd6sxy.js";
+import"./index-10wwrgj2.js";
+import"./index-eyq1q1xn.js";
+import"./index-4cyc18bc.js";
+import"./index-x5jwegqw.js";
+import"./index-tsg61z0r.js";
+import"./index-4pbzepgw.js";
+import"./index-8mrentmw.js";
 import"./index-pt7h91zc.js";
 import"./index-q7sjgr1y.js";
-import"./index-h3nns8py.js";
-import"./index-aayv19fb.js";
+import"./index-xtda4xsn.js";
+import"./index-gyz59cbh.js";
 import"./index-6b295cas.js";
 import"./index-9nyqt3kb.js";
-import"./index-t94vcqg6.js";
+import"./index-76skvj8z.js";
 import"./index-v3bmwmqw.js";
-import"./index-k0er6f51.js";
-import"./index-nfpfbce0.js";
-import"./index-eh12k044.js";
-import"./index-g4fs6z4e.js";
-import"./index-hxav7nr0.js";
-import"./index-9gfymmr8.js";
-import"./index-bh6j8qxz.js";
+import"./index-9c0vp5yj.js";
+import"./index-yg5xd4am.js";
+import"./index-0ra0vs2p.js";
+import"./index-spggmr30.js";
+import"./index-6xv2hz0e.js";
+import"./index-d7y3cafq.js";
 import"./index-m9zzj4ee.js";
-import"./index-820pzqd6.js";
-import"./index-2s7dvzff.js";
-import"./index-3gr7a9j8.js";
-import"./index-2mx2gn97.js";
+import"./index-b3ws03kp.js";
+import"./index-xyg7des8.js";
+import"./index-0veqvgny.js";
 import"./index-rtry5xyf.js";
 import {
   resolveWorktreeIsolationConfig
-} from "./index-4f5ejd03.js";
+} from "./index-zte3djpf.js";
 import"./index-g22dps7x.js";
 import"./index-0725jpp7.js";
-import"./index-hfpa3hrz.js";
-import"./index-65syfqe1.js";
-import"./index-h349p91m.js";
-import"./index-p5pgjp7n.js";
-import"./index-nr1pj3hy.js";
-import"./index-w00dj8p5.js";
+import"./index-p5d32v0x.js";
+import"./index-j3rfbs45.js";
+import"./index-ybvnf7rt.js";
+import"./index-9y6yk1n0.js";
+import"./index-snx2vb1x.js";
 import"./index-ry16d01s.js";
 import"./index-rdm3px0g.js";
+import"./index-3mzc5rqc.js";
 import"./index-7pmbnjvj.js";
-import"./index-hc6wa3yg.js";
-import"./index-3chx0ed6.js";
+import"./index-9rwhas09.js";
+import"./index-zbygz217.js";
+import"./index-bgydmx8k.js";
 import"./index-vzm6zre7.js";
 import"./index-ae75rja9.js";
-import"./index-2bc7zfw3.js";
-import"./index-w7d8gcj0.js";
-import"./index-4s6kdsfr.js";
+import"./index-n1ddn12j.js";
+import"./index-jmhn6ab5.js";
+import"./index-dz15f98h.js";
 import"./index-t7hmqgjy.js";
-import"./index-6dtt0brw.js";
-import"./index-fzpt2djt.js";
+import"./index-dtwj4hsk.js";
+import"./index-te9hq2f4.js";
 import"./index-ejhxgyvm.js";
 import"./index-7g4c7s5r.js";
-import"./index-ywb5er8g.js";
+import"./index-270zfq1f.js";
 import"./index-gx2vp8gx.js";
-import"./index-97cpeqb2.js";
-import"./index-zxdawwc7.js";
-import"./index-g1wra8ky.js";
+import"./index-3ckvw3j2.js";
+import"./index-sp2cxpaq.js";
+import"./index-qbxk2rn6.js";
+import"./index-zgwm4ryv.js";
+import"./index-dengtwpp.js";
 import"./index-xfzkq1k4.js";
 import"./index-bk5tah7q.js";
 import"./index-gknz3bv1.js";
 import"./index-zpsr8rpc.js";
-import"./index-8mrentmw.js";
-import"./index-9rwhas09.js";
-import"./index-zgwm4ryv.js";
 import"./index-a76rekgs.js";
 export {
   standardWorktreeSerializationSessions,

package/dist/commands/close/dry-run.d.ts

@@ -3,7 +3,8 @@ import type { PlanData } from './context.js';
  * Builds the `/swarm finalize --dry-run` report. Purely READ-ONLY: inspects the
  * plan and the filesystem and describes what a real finalize WOULD do, without
  * acquiring the finalize lock, creating an archive bundle, deleting any file,
- * running git, or tearing down session state. (#1692)
+ * running any mutating git command (the repository probe below is a read-only
+ * `git rev-parse`), or tearing down session state. (#1692)
  *
  * The archive-first guard means the clean stage only removes files it first
  * archived successfully; this report approximates that by listing existing

package/dist/commands/close/orchestrator.d.ts

@@ -1,4 +1,5 @@
 import { type PurgeCandidate } from '../destructive-purge.js';
+import { type GitStatusReadResult } from '../git-status-read.js';
 import type { CloseCommandOptions, CloseStageContext } from './context.js';
 /**
  * #2508 two-step destructive close: what the destructive portion of close
@@ -25,13 +26,24 @@ export interface ClosePurgeGate {
      * not trip this signal.
      */
     gitStatusFailed: boolean;
+    /**
+     * #3317: WHY the read failed, when the async reader could tell — error
+     * code, exit status, and a bounded stderr tail, interpolated into the
+     * abort text with a remedy that matches the cause.
+     */
+    statusFailure?: {
+        code: string | null;
+        status: number | null;
+        stderrTail: string;
+    };
 }
-declare function runCloseGateGit(args: string[], cwd: string): string | null;
-/** Test seam for the #2508 gate (simulate git-status read failures). */
+/** Test seam for the #2508 gate (simulate git-status read failures). The
+ * default routes through the #3317 async reader; legacy sync stubs returning
+ * `string | null` keep their original meaning (await-tolerant). */
 export declare const _closeGateInternals: {
-    runGit: typeof runCloseGateGit;
+    runGit: (args: string[], cwd: string) => string | null | GitStatusReadResult | Promise<string | null | GitStatusReadResult>;
 };
-export declare function evaluateClosePurgeGate(directory: string, swarmDir: string): ClosePurgeGate;
+export declare function evaluateClosePurgeGate(directory: string, swarmDir: string): Promise<ClosePurgeGate>;
 export declare function archiveCloseSummary(ctx: Pick<CloseStageContext, 'archiveStageFailed' | 'archiveDir' | 'warnings'>, closeSummaryPath: string, summaryWritten: boolean): Promise<void>;
 /**
  * Handles /swarm close command - performs full terminal session finalization:
@@ -63,4 +75,3 @@ export declare function acquireFinalizeLock(directory: string): Promise<{
  * scans all sessions).
  */
 export declare function detectFullAuto(directory: string, sessionID: string): boolean;
-export {};

package/dist/commands/destructive-purge.d.ts

@@ -1,6 +1,34 @@
+/**
+ * Issue #2527 / #2508: the shared two-step destructive-purge confirmation
+ * primitive (preview + confirm_token → exact-token execution).
+ *
+ * Contract (frozen by check C8 and the destructive-purge-2527 unit suite):
+ *  - `previewDestructivePurge` is a side-effect-free preview (counts, exact
+ *    option label, the confirmation the operator must echo);
+ *  - `issueConfirmToken` records a single-slot pending purge keyed by a
+ *    digest over the candidate SET (sorted absolute paths + kind) and
+ *    returns the confirm token (15-minute TTL);
+ *  - `executeDestructivePurge` re-derives the CURRENT scope digest and
+ *    passes only on exact token match AND digest match AND fresh TTL — so
+ *    replay after the candidate set changes (a lane added, removed, or the
+ *    scope re-derived differently) is rejected by construction, and the
+ *    token is single-use (the pending record is consumed on execution; a
+ *    second execution is rejected with "no pending purge").
+ *  - TTL expiry: an expired pending record is treated as absent on read
+ *    (silent); every new issuance overwrites the single slot — the
+ *    overwritten token can never execute (it is rejected with "confirm
+ *    token mismatch"; a single-slot store cannot distinguish generations,
+ *    but rejection is guaranteed either way).
+ *  - Scope-of-execution: the executor deletes ONLY the recorded candidate
+ *    paths. The primitive confirms operator intent; CALLERS own scoping —
+ *    `/swarm reset-session` (and #2508's `/swarm close` when it adopts
+ *    this) must only construct candidate sets from ownership-gated,
+ *    base-scoped directories.
+ */
 import { randomBytes } from 'node:crypto';
 import * as fs from 'node:fs';
 import { atomicWriteSwarmFileSync } from '../utils/atomic-write';
+import { type GitStatusReadResult } from './git-status-read.js';
 export interface PurgeCandidate {
     path: string;
     reason: string;
@@ -27,19 +55,24 @@ export declare const _internals: {
     now: () => number;
     randomBytes: typeof randomBytes;
     scopeDigest: typeof scopeDigest;
-    runGitStatus: typeof runGitStatusSync;
+    /**
+     * #3317: the tracked-dirty status read is async, bounded, and killable
+     * through the shared reader. Legacy sync stubs returning `string | null`
+     * keep their original meaning (#2953's await-tolerant seam contract).
+     */
+    runGitStatus: (args: readonly string[], cwd: string) => string | null | GitStatusReadResult | Promise<string | null | GitStatusReadResult>;
 };
 /**
  * Shared argv for every tracked-dirty measurement (issue #2953): the close
  * gate and the pre-destruction re-check run the identical status command and
- * feed the same parser, so the two measurements parse identically. (The two
- * reads still go through separate spawn wrappers; equivalence is by
- * convention + review, not a single shared call site.)
+ * feed the same parser, so the two measurements parse identically. (Both now
+ * route through the shared #3317 reader via their own test seam; equivalence
+ * is by convention + review, not a single shared call site.)
+ * #3317: `--no-optional-locks` leads the argv — a read-only status must not
+ * contend on the index write lock. It is a top-level git option and therefore
+ * sits BEFORE the subcommand.
  */
-export declare const GIT_STATUS_ARGS: readonly ["status", "--porcelain"];
-/** Default bounded status read (invariant 3: array form, cwd, timeout, ignore
- * stdin, bounded stdout, windowsHide). Exposed via `_internals` for tests. */
-declare function runGitStatusSync(args: readonly string[], cwd: string): string | null;
+export declare const GIT_STATUS_ARGS: readonly ["--no-optional-locks", "status", "--porcelain"];
 /**
  * Parse `git status --porcelain` (newline) output into repo-relative
  * tracked-dirty paths: untracked (`??`) entries are skipped (they survive the
@@ -59,13 +92,21 @@ export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
  * The close gate composes the same argv + parser directly through its own
  * long-standing `_closeGateInternals.runGit` seam rather than calling this
  * helper, so its existing #2508 fail-closed tests keep their injection point.
+ * #3317: async — the read is bounded and killable, and legacy sync stubs
+ * keep working (awaiting a plain value is a no-op).
  */
-export declare function readTrackedDirtyPaths(directory: string): {
+export declare function readTrackedDirtyPaths(directory: string): Promise<{
     ok: true;
     dirtyPaths: string[];
 } | {
     ok: false;
-};
+    /** Structured cause when the reader could tell (absent for legacy `null` stubs). */
+    failure?: {
+        code: string | null;
+        status: number | null;
+        stderrTail: string;
+    };
+}>;
 /**
  * Issue #2953 TOCTOU re-check: re-measure the tracked-dirty set immediately
  * before a destructive reset and compare it to the set the operator actually
@@ -75,14 +116,14 @@ export declare function readTrackedDirtyPaths(directory: string): {
  * "unchanged"). A file that got cleaner passes — strictly less destruction
  * than confirmed.
  */
-export declare function recheckBeforeDestructive(directory: string, expectedDirtyPaths: readonly string[]): {
+export declare function recheckBeforeDestructive(directory: string, expectedDirtyPaths: readonly string[]): Promise<{
     ok: true;
     dirtyPaths: string[];
 } | {
     ok: false;
     reason: string;
     newDirtyPaths: string[];
-};
+}>;
 declare function scopeDigest(kind: string, candidates: PurgeCandidate[]): string;
 /**
  * Side-effect-free preview: what would be purged, the counts, the exact

package/dist/commands/git-status-read.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Async, bounded, killable git-read runner for the user-facing gate paths
+ * (issue #3317): /swarm close's destructive-purge gate, the pre-destruction
+ * re-check, /swarm rollback's destruction measurement, /swarm diagnose's
+ * repository check, and /swarm finalize --dry-run's repository probe.
+ *
+ * Replaces the private blocking `spawnSync` wrappers that collapsed every
+ * failure class (timeout, missing binary, nonzero exit) into `null`, leaving
+ * the abort text no cause to name. The gate stays fail-closed — a read that
+ * cannot complete is reported as a structured failure, never as a clean tree.
+ *
+ * Deadline convention (the repo's discriminated-timeout rule, mirroring
+ * `runGitAsyncDetailed` in src/background/workspace-snapshot.ts): the
+ * caller-side `Promise.race` owns the deadline; `bunSpawn` with
+ * `killProcessTree: true` deletes the native timeout so exactly one timer is
+ * armed, and the `finally` block tree-kills a child that is still running.
+ * The deadline covers the WHOLE attempt — executable resolution is timed
+ * against it too, so the advertised timeoutMs is an end-to-end bound. The
+ * losing racer carries a no-op catch so a late completion can never surface
+ * an unhandled rejection.
+ */
+import { bunSpawn } from '../utils/bun-compat';
+export type GitStatusReadResult = {
+    ok: true;
+    stdout: string;
+} | {
+    ok: false;
+    /**
+     * Failure class: `ETIMEDOUT` (deadline), `ENOENT` (missing binary,
+     * both runtimes), `ESIGNAL` (signal-terminated — see the arm's
+     * reachability note; Windows external termination lands in the
+     * nonzero path), `EOUTPUT` (output exceeded the read safety
+     * bound), or another spawn-error code (`EPERM`, `EBUSY`, …).
+     * Null only when the child ran and exited nonzero on its own.
+     */
+    code: string | null;
+    /** Child exit status when it ran and exited; null otherwise. */
+    status: number | null;
+    /** Bounded excerpt of the child's stderr (at most 200 characters, sanitized). */
+    stderrTail: string;
+};
+/** Parity with the gates this module replaces (10 s bounded read). */
+export declare const GIT_READ_DEFAULT_TIMEOUT_MS = 10000;
+/** Parity with the replaced wrappers' `maxBuffer: 1024 * 1024`. */
+export declare const GIT_READ_DEFAULT_MAX_BUFFER_BYTES: number;
+/** Bound for the `stderrTail` carried in failure results and abort text. */
+export declare const GIT_READ_STDERR_TAIL_MAX_CHARS = 200;
+/**
+ * Test seam (repo convention): `resolveExecutable` defaults to the async git
+ * resolver, `spawn` defaults to `bunSpawn`, and `readOnce` is the
+ * single-attempt runner `readGitStatusAsync` wraps. All three are late-bound
+ * through this object so sibling test files can stub them without
+ * `mock.module`.
+ */
+export declare const gitStatusReadInternals: {
+    readOnce: (args: readonly string[], cwd: string, timeoutMs: number, maxBufferBytes?: number, ignoreOutput?: boolean) => Promise<GitStatusReadResult>;
+    resolveExecutable: () => Promise<string>;
+    spawn: typeof bunSpawn;
+};
+/**
+ * Bounded git read with exactly one retry for transient spawn errors
+ * (`ETIMEDOUT`, `EBUSY`, `EPERM`). Definite failures — `ENOENT`, `EOUTPUT`,
+ * `ESIGNAL`, nonzero exits — are permanent: one attempt only. A second
+ * transient failure is final (two attempts total).
+ */
+export declare function readGitStatusAsync(args: readonly string[], cwd: string, opts?: {
+    timeoutMs?: number;
+    maxBufferBytes?: number;
+}): Promise<GitStatusReadResult>;
+/**
+ * Single-attempt repository probe for `/swarm finalize --dry-run`
+ * (issue #3317): `rev-parse --git-dir` through the shared reader, mapped to a
+ * boolean. Single attempt by design — the dry-run report must stay a fast,
+ * non-blocking preview, with no transient-retry chain.
+ */
+export declare function readGitRepositoryStatusAsync(cwd: string): Promise<boolean>;

package/dist/commands/rollback-gate.d.ts

@@ -1,4 +1,5 @@
 import type { PurgeCandidate } from './destructive-purge';
+import { type GitStatusReadResult } from './git-status-read';
 /** Destructive-surface kind for the git checkpoint restore path. */
 export declare const ROLLBACK_GIT_KIND = "swarm-rollback-git";
 /** Destructive-surface kind for the legacy phase-overwrite restore path. */
@@ -6,10 +7,14 @@ export declare const ROLLBACK_PHASE_KIND = "swarm-rollback-phase";
 /**
  * Test seam for the rollback gate (simulate git-status read failures without
  * spawning real git). Mirrors `_closeGateInternals.runGit`.
+ * #3317: the defaults are the async shared reader — bounded, killable, and
+ * detail-carrying. Legacy sync stubs returning `string | null` keep their
+ * original meaning (await-tolerant); the status argv leads with
+ * `--no-optional-locks` and the listing reads keep the 32 MB bound.
  */
 export declare const _rollbackGateInternals: {
-    runGit: (args: string[], cwd: string) => string | null;
-    runGitBuffered: (args: string[], cwd: string) => string | null;
+    runGit: (args: string[], cwd: string) => string | null | GitStatusReadResult | Promise<string | null | GitStatusReadResult>;
+    runGitBuffered: (args: string[], cwd: string) => string | null | GitStatusReadResult | Promise<string | null | GitStatusReadResult>;
 };
 /**
  * A real git repository root: `.git` is a linked-worktree/submodule pointer
@@ -42,7 +47,7 @@ export declare function parseTrackedDirtyPaths(statusOutput: string): string[];
  * listing cannot be read — the tracked-dirty gate above still applies, and
  * the caller's unreadable-status refusal covers real-repo failures.
  */
-export declare function untrackedPathsInTargetTree(directory: string, targetSha: string): string[];
+export declare function untrackedPathsInTargetTree(directory: string, targetSha: string): Promise<string[]>;
 /**
  * The git-kind candidate set: the absolute paths of tracked-dirty files that
  * `git reset --hard` would destroy. This is the ONLY derivation for
@@ -55,6 +60,16 @@ export declare function trackedDirtyCandidates(directory: string, dirtyRelPaths:
  * entries the checkpoint copy loop would overwrite.
  */
 export declare function swarmOverwriteCandidates(directory: string, overwriteRelPaths: string[]): PurgeCandidate[];
+/**
+ * #3317: cause-matched wording for an unreadable destruction measurement —
+ * single source shared by the /swarm rollback command and the checkpoint
+ * tool sink so the two refusal texts cannot drift.
+ */
+export declare function describeUnreadableCause(measurement: {
+    code?: string | null;
+    status?: number | null;
+    stderrTail?: string;
+}): string;
 /**
  * Measure the destruction scope for a git checkpoint restore. When
  * `targetSha` is provided, files that are untracked (or since-ignored) on
@@ -65,9 +80,13 @@ export declare function swarmOverwriteCandidates(directory: string, overwriteRel
  * it as a clean tree). A non-git or bare-marker root returns an empty
  * dirty set: nothing tracked to destroy.
  */
-export declare function measureGitDestruction(directory: string, targetSha?: string): {
+export declare function measureGitDestruction(directory: string, targetSha?: string): Promise<{
     kind: 'ok';
     dirtyRelPaths: string[];
 } | {
     kind: 'unreadable';
-};
+    /** #3317: why the read failed, when the async reader could tell. */
+    code?: string | null;
+    status?: number | null;
+    stderrTail?: string;
+}>;

package/dist/config/schema.d.ts

@@ -2152,8 +2152,10 @@ export declare const ReviewRoutingConfigSchema: z.ZodObject<{
 export type ReviewRoutingConfig = z.infer<typeof ReviewRoutingConfigSchema>;
 export declare const DEFAULT_REVIEW_ROUTING_CONFIG: ReviewRoutingConfig;
 /**
- * Issue #2506 (G2): the lane-liveness watchdog. Default OFF; each numeric knob
- * disables its own feature at 0. When enabled, `timeout_ms` becomes the ONE
+ * Issue #2506 (G2): the lane-liveness watchdog. Default ON (#3313 AC14
+ * supersedes the #2506 AC1 default-off contract): an omitted section or an
+ * empty section resolves the enabled watchdog, and `enabled: false` (or a 0
+ * knob) is a full opt-out. When enabled, `timeout_ms` becomes the ONE
  * effective PR-lane settlement horizon (the 30-minute reachability floor
  * remains the fallback when the watchdog is off or `timeout_ms` is 0), and
  * stall detection escalates low-output lanes BEFORE that horizon. Parameter
@@ -2314,7 +2316,7 @@ export declare const PluginConfigSchema: z.ZodObject<{
     review_routing: z.ZodOptional<z.ZodObject<{
         enforce_receipts: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strict>>;
-    lane_liveness_watchdog: z.ZodOptional<z.ZodObject<{
+    lane_liveness_watchdog: z.ZodPrefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         timeout_ms: z.ZodDefault<z.ZodNumber>;
         stall_threshold_ms: z.ZodDefault<z.ZodNumber>;

package/dist/evaluation/contracts.d.ts

@@ -7,8 +7,8 @@ export { Sha256Schema as EvaluationSha256Schema };
 export { RelativePathSchema as EvaluationRelativePathSchema };
 export declare const EvaluationSplitSchema: z.ZodEnum<{
     test: "test";
-    train: "train";
     validation: "validation";
+    train: "train";
 }>;
 export type EvaluationSplit = z.infer<typeof EvaluationSplitSchema>;
 export declare const CostRecordSchema: z.ZodObject<{
@@ -40,8 +40,8 @@ export declare const EvaluationTaskV1Schema: z.ZodObject<{
     }>;
     split: z.ZodEnum<{
         test: "test";
-        train: "train";
         validation: "validation";
+        train: "train";
     }>;
     category: z.ZodString;
     protected: z.ZodDefault<z.ZodBoolean>;
@@ -196,8 +196,8 @@ export declare const EvaluationRunV1Schema: z.ZodObject<{
     }, z.core.$strict>;
     split: z.ZodEnum<{
         test: "test";
-        train: "train";
         validation: "validation";
+        train: "train";
     }>;
     seed: z.ZodString;
     models: z.ZodArray<z.ZodString>;
@@ -493,8 +493,8 @@ export declare const TaskSetSnapshotV1Schema: z.ZodObject<{
     id: z.ZodString;
     split: z.ZodEnum<{
         test: "test";
-        train: "train";
         validation: "validation";
+        train: "train";
     }>;
     tasks: z.ZodArray<z.ZodObject<{
         v: z.ZodLiteral<1>;
@@ -506,8 +506,8 @@ export declare const TaskSetSnapshotV1Schema: z.ZodObject<{
         }>;
         split: z.ZodEnum<{
             test: "test";
-            train: "train";
             validation: "validation";
+            train: "train";
         }>;
         category: z.ZodString;
         protected: z.ZodDefault<z.ZodBoolean>;

package/dist/hooks/lane-liveness-watchdog.d.ts

@@ -1,5 +1,10 @@
 import type { LaneLivenessWatchdogConfig } from '../config/schema.js';
-/** The five frozen defaults from the #2506 contract (0 disables a feature). */
+/**
+ * The five frozen defaults from the #2506 contract (0 disables a feature).
+ * #3313 AC14 supersedes the #2506 AC1 default-off contract: `enabled` resolves
+ * `true` here because this constant parses `{}` through the schema whose field
+ * default flipped — no literal is pinned in this file, so it cannot drift.
+ */
 export declare const LANE_LIVENESS_WATCHDOG_DEFAULTS: LaneLivenessWatchdogConfig;
 /**
  * Upper bound on lane ids named in one `pr_workflow_lane_watchdog` event or

package/dist/hooks/pr-workflow-gate.d.ts

@@ -613,6 +613,18 @@ export interface PrWorkflowGateState {
     prReviewPartialBaseCoverage?: PrReviewPartialBaseCoverageRecord;
     prReviewCoverageDisclosurePath?: string;
     prReviewCoverageDisclosureDigest?: string;
+    /**
+     * Issue #3312: durable validation-phase skip disclosure persisted by the
+     * INCOMPLETE bypass arm in `completePrWorkflow` (a controller-derived
+     * projection of derived state — never a lane/model assertion). Mirrors the
+     * `PrReviewCompletionState` fields in `src/pr-review/completion.ts`; read by
+     * the completion report projection's disclosed-degradation leg only.
+     */
+    prReviewValidationSkipDisclosure?: PrReviewValidationSkipDisclosureRecord;
+    /** Issue #3312: durable path of the validation-skip-disclosure artifact. */
+    prReviewValidationSkipDisclosurePath?: string;
+    /** Issue #3312: sha256 of the validation-skip-disclosure artifact bytes. */
+    prReviewValidationSkipDisclosureDigest?: string;
     /**
      * Explicit per-dimension cancellations (issue #2383), written only by the
      * audited armed-recovery operation. A cancelled dimension is terminal for
@@ -1087,7 +1099,8 @@ export interface PrWorkflowStaleLaneSettlement {
 /**
  * Issue #2506 (G2): optional lane-liveness watchdog options for the on-demand
  * settlement entry points. The two-argument call shape every existing caller
- * uses means "watchdog disabled" (the default-off config contract).
+ * uses means no policy is threaded — the config contract threaded by the tool
+ * wrappers applies (default-on since #3313 AC14).
  */
 export interface PrWorkflowLaneLivenessOptions {
     laneLivenessWatchdog?: LaneLivenessWatchdogConfig;
@@ -1667,6 +1680,36 @@ export declare function reserveActivePrReviewReentryAuthorization(directory: str
     role: PrReviewReentryRole;
     callID: string;
 }): Promise<PrReviewReentryAuthorizationRecord | null>;
+/**
+ * Issue #3312 (U1): one skipped-phase entry in the INCOMPLETE bypass's durable
+ * validation-skip disclosure. `unsettledItemIds` is bounded by
+ * {@link MAX_SKIP_DISCLOSURE_UNSETTLED_ITEM_IDS} with a final `+N more`
+ * marker when truncated.
+ */
+interface PrReviewValidationSkipPhaseEntry {
+    phase: 'reviewer' | 'critic' | 'council';
+    reason: string;
+    unsettledItemIds: string[];
+}
+/**
+ * Issue #3312 (U1): the durable shape of
+ * `.swarm/pr-review/<runId>/validation-skip-disclosure.json` and of the
+ * `prReviewValidationSkipDisclosure` gate-state mirror. Structurally identical
+ * to the `PrReviewCompletionState` mirror fields in `src/pr-review/completion.ts`
+ * (the state schema is `.passthrough()`, so the fields survive persistence).
+ */
+interface PrReviewValidationSkipDisclosureRecord {
+    schemaVersion: number;
+    runId: string;
+    prHeadSha: string;
+    revisionDigest: string;
+    createdAt: string;
+    coverageKind: 'COMPLETE' | 'PARTIAL';
+    reportVerdict: 'INCOMPLETE';
+    /** Feedback F6: set when the byte-degrade loop cut any phase's id list. */
+    truncated?: boolean;
+    skippedPhases: PrReviewValidationSkipPhaseEntry[];
+}
 export declare function completePrWorkflow(directory: string, sessionID: string, expectedMode: PrWorkflowMode, prHeadSha: string, options?: {
     reportVerdict?: PrReviewReportVerdict;
     /** Issue #2506: lane-liveness watchdog config for this settlement. */
@@ -1835,6 +1878,23 @@ export declare const _test_exports: {
         } | undefined;
         prReviewCoverageDisclosurePath?: string | undefined;
         prReviewCoverageDisclosureDigest?: string | undefined;
+        prReviewValidationSkipDisclosurePath?: string | undefined;
+        prReviewValidationSkipDisclosureDigest?: string | undefined;
+        prReviewValidationSkipDisclosure?: {
+            schemaVersion: 1;
+            runId: string;
+            prHeadSha: string;
+            revisionDigest: string;
+            createdAt: string;
+            coverageKind: "COMPLETE" | "PARTIAL";
+            reportVerdict: "INCOMPLETE";
+            skippedPhases: {
+                phase: "reviewer" | "critic" | "council";
+                reason: string;
+                unsettledItemIds: string[];
+            }[];
+            truncated?: boolean | undefined;
+        } | undefined;
         prReviewDimensionCancellations?: Record<"intent-architecture" | "correctness-state" | "tests-falsifiability" | "security-trust" | "reliability-performance" | "compatibility-delivery", {
             reason: string;
             cancelledAt: string;