opencode-swarm 7.99.3 → 7.99.5

package/.opencode/skills/brainstorm/SKILL.md

@@ -86,6 +86,7 @@ Present the eleven gates with their defaults (DEFAULT_QA_GATES), parallel coder
 
 Additionally, present these two sub-items as part of the same exchange:
 - Parallel coders (default: 1, range: 1-6) -- how many coders should run in parallel. Parallel coders each run in an isolated git worktree (separate working dir + branch) and merge back automatically, so they never overwrite each other's files -- safe and faster, but only for tasks whose file scopes do NOT overlap. The per-task file scopes that determine a safe parallel count are not known until the plan is finalized, so default to 1 (serial) here; the precise recommendation is made at plan time once the tasks and their scopes exist.
+  > COMMON MISCONCEPTION: worktree isolation is baseline for standard parallel coders, governed by the parallel execution profile plus top-level `worktree.policy`. It is not provided by Lean Turbo or Epic. Do not recommend Lean Turbo or Epic to obtain worktree isolation; recommend them only for what they add beyond baseline (Lean Turbo: lane planning, file locks, phase reviewer, integrated diff; Epic: co-change awareness and auto-decide). Worktrees also do not make overlapping scopes safe: dependency readiness, file-disjoint scopes, and merge-back ownership are still required.
 - Commit frequency (default: phase-level only) -- optional per-task checkpoint commit after each task completion.
 - auto_proceed (boolean, default: false) -- when true, auto-advance to the next phase without asking "Ready for Phase N+1?"; runtime toggle via /swarm auto-proceed on|off.
 

package/.opencode/skills/codebase-review-swarm/SKILL.md

@@ -70,4 +70,4 @@ When selected-track inventory or candidate generation decomposes into independen
 
 **Incremental collection:** While lanes are running, poll with `collect_lane_results` (without `wait` or `wait: false`) to check progress and process any settled lanes immediately — call `retrieve_lane_output` for full text when `output_ref` is present, extract candidates, update coverage ledger entries, validate output quality — while continuing independent work between polls. Only use `wait: true` if lanes are still pending and no more independent architect work remains.
 
-At every coverage, validation, and synthesis boundary, all lanes in the relevant batch must be settled before proceeding. Missing, stale, cancelled, or failed lanes are coverage gaps that must be closed before proceeding — they map to the existing `BLOCKED` invariant (#2 Coverage Closure) but with stricter resolution: (1) retry max 2 times with materially different parameters; (2) if retries fail, deploy a verified equivalent alternative (same agent type, same prompt, same scope, same isolation — different dispatch mechanism acceptable when equivalence is verified); (3) if no equivalent exists, the coverage unit becomes `BLOCKED` and the run is reported INCOMPLETE to the user. `SKIPPED_WITH_REASON` is not acceptable for dispatch-lane failures — it must be `BLOCKED` with an explicit retry/equivalent/INCOMPLETE trail.
+At every coverage, validation, and synthesis boundary, all lanes in the relevant batch must be settled before proceeding. Missing, stale, cancelled, or failed lanes are coverage gaps that must be closed before proceeding — they map to the existing `BLOCKED` invariant (#2 Coverage Closure) but with stricter resolution: (1) retry max 2 times with materially different parameters; (2) if retries fail, deploy a verified equivalent alternative (same agent type, same prompt, same scope, same isolation — different dispatch mechanism acceptable when equivalence is verified, including Task-tool dispatch as the final fallback when lane tools do not work); (3) if no equivalent exists, the coverage unit becomes `BLOCKED` and the architect must surface the lane failure to the user before producing a report. `SKIPPED_WITH_REASON` is not acceptable for dispatch-lane failures — it must be `BLOCKED` with an explicit retry/equivalent/escalation trail, and no degraded review report is written.

package/.opencode/skills/council/SKILL.md

@@ -115,9 +115,11 @@ Do NOT share other agents' responses at this stage.
    use `wait: true` if lanes are still pending and no more independent work
    remains. All three lanes must be settled before proceeding to synthesis.
    If `dispatch_lanes_async` is unavailable, use blocking `dispatch_lanes`
-   and record that async advisory lanes were unavailable; do not substitute
-   per-agent Task calls for this fallback unless lane tools are unavailable and
-   you explicitly verify equivalent agent type, prompt, scope, and isolation. The
+   as the first fallback and record that async advisory lanes were unavailable.
+   This changes only when the architect waits, not whether all council lanes
+   must settle. Do not substitute Task-tool dispatch unless lane tools are
+   unavailable; when they are unavailable, Task is the final fallback and must be
+   verified as equivalent by agent type, prompt, scope, and isolation. The
    `round1Responses` array will contain entries with `memberId` of
    `council_generalist`, `council_skeptic`, and `council_domain_expert` and
    `role` of `generalist`, `skeptic`, and `domain_expert` respectively. If

package/.opencode/skills/deep-dive/SKILL.md

@@ -85,9 +85,9 @@ Explorer missions are dispatched in parallel waves. Launch the wave promptly —
 
 **Incremental collection pattern:** While lanes are running, use `collect_lane_results` without `wait` (or `wait: false`) to poll progress. Process any settled lanes immediately — extract candidates, check `output_ref`, update the candidate ledger — while continuing independent architect work (scope refinement, local evidence reads, reviewer preparation) between polls. This avoids idle waiting and lets you pipeline candidate normalization with lane completion. Only use `wait: true` at the Step 4 boundary if lanes are still pending and no more independent work remains.
 
-At the Step 4 boundary, all lanes must be settled before proceeding. If non-blocking polls show lanes still running and you have exhausted independent work, call `collect_lane_results` with `wait: true` to block on the remaining lanes. **COVERAGE GATE:** Every lane must produce validated candidate output before proceeding. Missing, stale, cancelled, or failed lanes are coverage gaps that must be closed — not documented and skipped. If a lane fails: (1) retry max 2 times with materially different parameters; (2) if retries fail, deploy an equivalent alternative (same agent type, same prompt, same scope, same isolation — different dispatch mechanism acceptable when verified); (3) if no equivalent exists, report INCOMPLETE to the user. Do not proceed past a required lane with unclosed coverage.
+At the Step 4 boundary, all lanes must be settled before proceeding. If non-blocking polls show lanes still running and you have exhausted independent work, call `collect_lane_results` with `wait: true` to block on the remaining lanes. **COVERAGE GATE:** Every lane must produce validated candidate output before proceeding. Missing, stale, cancelled, or failed lanes are coverage gaps that must be closed — not documented and skipped. If a lane fails: (1) retry max 2 times with materially different parameters; (2) if retries fail, deploy an equivalent alternative (same agent type, same prompt, same scope, same isolation — different dispatch mechanism acceptable when verified, including Task-tool dispatch as the final fallback when lane tools do not work); (3) if no equivalent exists, stop and surface the lane failure to the user as BLOCKED. Do not proceed past a required lane with unclosed coverage or produce a degraded review.
 
-When a collected or blocking lane result includes `output_ref`, treat `output` as a preview and call `retrieve_lane_output` before extracting candidate findings or declaring a lane clean. If the result is `output_degraded`, `transcript_incomplete`, truncated without a usable ref, missing, stale, cancelled, or failed — or if the lane reports `status: completed` but `parse_lane_candidates` returns 0 candidates (Mode B: intermediate reasoning only) — apply the COVERAGE GATE: retry, deploy equivalent, or report INCOMPLETE. Do not mark findings/coverage UNVERIFIED to proceed past the gap.
+When a collected or blocking lane result includes `output_ref`, treat `output` as a preview and call `retrieve_lane_output` before extracting candidate findings or declaring a lane clean. If the result is `output_degraded`, `transcript_incomplete`, truncated without a usable ref, missing, stale, cancelled, or failed — or if the lane reports `status: completed` but `parse_lane_candidates` returns 0 candidates (Mode B: intermediate reasoning only) — apply the COVERAGE GATE: retry, deploy equivalent including Task-tool dispatch as the final fallback when lane tools do not work, or stop and surface the lane failure to the user as BLOCKED. Do not mark findings/coverage UNVERIFIED to proceed past the gap.
 
 Explorers generate CANDIDATE FINDINGS only — they do NOT make verdicts. All findings are unverified until Step 5.
 

package/.opencode/skills/deep-research/SKILL.md

@@ -127,10 +127,13 @@ lanes are still pending and no independent work remains. Do not advance to Step
 until every synthesis lane is settled. Collect all completed worker responses into
 a candidate findings set, each finding tagged with its subtopic, evidence refs,
 and the worker's confidence. Treat missing, stale, cancelled, or failed lanes as
-explicit coverage gaps. If `dispatch_lanes_async` is unavailable, use blocking
-`dispatch_lanes` and record that async advisory lanes were unavailable; do not
-substitute per-agent Task calls for this fallback unless lane tools are unavailable
-and you explicitly verify equivalent agent type, prompt, scope, and isolation.
+explicit coverage gaps. If `dispatch_lanes_async` is unavailable, use
+blocking `dispatch_lanes` as the first fallback and record that async advisory lanes were
+unavailable. This changes only when the architect waits, not whether every
+synthesis lane must settle before Step 5. Do not substitute Task-tool dispatch
+unless lane tools are unavailable; when they are unavailable, Task is the final fallback
+and must be verified as equivalent by agent type, prompt, scope, and
+isolation.
 
 ## Step 5 — Dual-Reviewer Claim Verification
 

package/.opencode/skills/plan/SKILL.md

@@ -228,6 +228,7 @@ After `save_plan` succeeds, read `.swarm/context.md`:
   - final_council (default: OFF) - when enabled, after all phases complete the architect dispatches the full 5-member council (critic, reviewer, sme, test_engineer, explorer) -- NOT the General Council -- at project scope, collects `CouncilMemberVerdict` objects, and calls `write_final_council_evidence`. This does not require `council.general.enabled`.
   Additionally, present these two sub-items as part of the same exchange:
   - Parallel coders (default: 1, range: 1-6) - how many coders should run in parallel. Parallel coders each run in an isolated git worktree (separate working dir + branch) and merge back automatically, so they never overwrite each other's files - safe and faster, but only for tasks whose declared file scopes do NOT overlap. Inspect the plan and recommend a count equal to the number of dependency-ready, file-disjoint task groups (clamped 1-6); recommend 1 (serial) when scopes overlap or are unknown. State your recommendation and reasoning when you ask.
+  > COMMON MISCONCEPTION: worktree isolation is baseline for standard parallel coders, governed by the parallel execution profile plus top-level `worktree.policy`. It is not provided by Lean Turbo or Epic. Do not recommend Lean Turbo or Epic to obtain worktree isolation; recommend them only for what they add beyond baseline (Lean Turbo: lane planning, file locks, phase reviewer, integrated diff; Epic: co-change awareness and auto-decide). Worktrees also do not make overlapping scopes safe: dependency readiness, file-disjoint scopes, and merge-back ownership are still required.
   - Commit frequency (default: phase-level only) - optional per-task checkpoint commit after each task completion.
   The user answers all three (gates, parallel coders, commit frequency) in one exchange. Wait for the user's response.
   If the user says parallel coders > 1, write a `## Pending Parallelization Config` section to `.swarm/context.md` alongside the gate selection:

package/.opencode/skills/specify/SKILL.md

@@ -49,6 +49,7 @@ Present the eleven gates with their defaults (DEFAULT_QA_GATES), parallel coder
 
 Additionally, present these three sub-items as part of the same exchange:
 - Parallel coders (default: 1, range: 1-6) -- how many coders should run in parallel. Parallel coders each run in an isolated git worktree (separate working dir + branch) and merge back automatically, so they never overwrite each other's files -- safe and faster, but only for tasks whose file scopes do NOT overlap. The per-task file scopes that determine a safe parallel count are not known until the plan is finalized, so default to 1 (serial) here; the precise recommendation is made at plan time once the tasks and their scopes exist.
+  > COMMON MISCONCEPTION: worktree isolation is baseline for standard parallel coders, governed by the parallel execution profile plus top-level `worktree.policy`. It is not provided by Lean Turbo or Epic. Do not recommend Lean Turbo or Epic to obtain worktree isolation; recommend them only for what they add beyond baseline (Lean Turbo: lane planning, file locks, phase reviewer, integrated diff; Epic: co-change awareness and auto-decide). Worktrees also do not make overlapping scopes safe: dependency readiness, file-disjoint scopes, and merge-back ownership are still required.
 - Commit frequency (default: phase-level only) -- optional per-task checkpoint commit after each task completion.
 - auto_proceed (boolean, default: false) -- when true, auto-advance to the next phase without asking "Ready for Phase N+1?"; runtime toggle via /swarm auto-proceed on|off.
 

package/.opencode/skills/swarm-pr-feedback/SKILL.md

@@ -222,7 +222,9 @@ independent work is exhausted, to confirm every lane is settled.
 Missing, stale, cancelled, or failed lanes are coverage gaps that must be closed
 before marking any item RESOLVED/DISPROVED/PRE_EXISTING. Apply the COVERAGE GATE:
 retry failed lanes (max 2), deploy a verified equivalent alternative (same agent
-type, same prompt, same scope, same isolation), or report INCOMPLETE to the user.
+type, same prompt, same scope, same isolation, with Task-tool dispatch as the
+final fallback when lane tools do not work), or stop and surface the lane failure
+to the user as BLOCKED.
 Do not proceed with "blocking verification and record that async advisory lanes
 were unavailable" — record-and-continue is not coverage closure.
 

package/.opencode/skills/swarm-pr-review/SKILL.md

@@ -146,7 +146,7 @@ Before deeper analysis, verify the PR meets the commit-pr skill's publication co
 - **Title format:** `<type>(<scope>): <description>` — lowercase description, no trailing period, allowed types: `feat`, `fix`, `perf`, `revert`, `docs`, `chore`, `refactor`, `test`, `ci`, `build`.
 - **Body contract:** `Closes #<issue-number>` as the first line (when the PR resolves an issue), followed by `## Summary`, `## Invariant audit` (all 12 invariants), and `## Test plan` sections.
 
-**`Closes #N` claim integrity (apply the COVERAGE GATE):** if the PR body claims `Closes #<issue-number>`, verify (a) the issue is currently open (`gh issue view <N> --json state`), and (b) the diff addresses the issue's acceptance criteria (read the issue, map each criterion to changed files/symbols, and inspect the diff for those areas). If the issue is already closed by another merged PR, do NOT re-close it — the duplicate `Closes #N` reference is misleading and will confuse release-please aggregation. If the issue is open but the diff does not address the acceptance criteria, mark the claim as `UNVERIFIED — claim integrity` in the validation provenance and report INCOMPLETE to the user.
+**`Closes #N` claim integrity (apply the COVERAGE GATE):** if the PR body claims `Closes #<issue-number>`, verify (a) the issue is currently open (`gh issue view <N> --json state`), and (b) the diff addresses the issue's acceptance criteria (read the issue, map each criterion to changed files/symbols, and inspect the diff for those areas). If the issue is already closed by another merged PR, do NOT re-close it — the duplicate `Closes #N` reference is misleading and will confuse release-please aggregation. If the issue is open but the diff does not address the acceptance criteria, mark the claim as `UNVERIFIED — claim integrity` in the validation provenance and surface the unresolved claim-integrity gap to the user before synthesis.
 
 Non-compliance is a ledger item (advisory, not blocking — CI will catch it). If the PR is from an external contributor, note the compliance gap for the maintainer to address before merge.
 
@@ -517,8 +517,8 @@ Before Phase 4 or synthesis, all base lanes must be settled. `dispatch_lanes_asy
 
 For ANY lane that failed (either mode):
 1. **Retry** (max 2 attempts) with materially different parameters — different session, different prompt decomposition, or blocking `dispatch_lanes`.
-2. If retries fail, **deploy an equivalent alternative** and **verify equivalence**: same agent type, same prompt, same scope, same isolation. State the equivalence verification explicitly. Task is not an early-poll or empty-partial-output fallback; use it only as a last-resort equivalent dispatch mechanism after `dispatch_lanes_async` is unavailable or a settled lane result is confirmed failed/empty, and after blocking `dispatch_lanes` is unavailable or inappropriate. Use `retrieve_lane_output` to inspect the full artifact before declaring equivalence or failure.
-3. If no equivalent alternative can be verified, **report to the user as INCOMPLETE**. Present partial findings from successful lanes alongside the INCOMPLETE verdict. The user decides whether to accept reduced coverage. The architect NEVER makes that call.
+2. If retries fail, **deploy an equivalent alternative** and **verify equivalence**: same agent type, same prompt, same scope, same isolation. Fallback order is explicit: retry or re-collect `dispatch_lanes_async` first, use blocking `dispatch_lanes` when async dispatch or collection cannot close coverage, then use the Task tool as the last-resort equivalent dispatch mechanism when lane tools do not work. State the Task fallback equivalence verification explicitly. Task is not an early-poll or empty-partial-output fallback; use `retrieve_lane_output` to inspect the full artifact before declaring equivalence or failure.
+3. If no equivalent alternative can be verified, **STOP and surface the lane failure to the user as BLOCKED** with the lane id, scope, failure mode, retry attempts, and why equivalence could not be proven. Do not present partial findings, do not issue a review verdict, and do not synthesize from successful lanes. A low-quality partial review is worse than no review.
 
 ### Candidate extraction via parser
 
@@ -543,7 +543,7 @@ rather than preview-text extraction:
    lists. Each reviewer lane receives only the candidates from its assigned
    chunk.
 
-If a lane has `output_degraded: true`, `transcript_incomplete: true`, or no usable `output_ref`, apply the COVERAGE GATE from Phase 3: retry (max 2) with materially different parameters, deploy a verified equivalent alternative, or report INCOMPLETE to the user. Do not mark affected candidates UNVERIFIED to proceed past the gap. Never infer candidate absence from a preview.
+If a lane has `output_degraded: true`, `transcript_incomplete: true`, or no usable `output_ref`, apply the COVERAGE GATE from Phase 3: retry (max 2) with materially different parameters, then use blocking `dispatch_lanes` or the Task tool as verified-equivalent fallbacks when lane tools do not work. If the gap cannot be closed, stop and surface the lane failure to the user as BLOCKED. Do not mark affected candidates UNVERIFIED to proceed past the gap. Never infer candidate absence from a preview.
 
 **Fallback convention:** If the parser is unavailable, the explorer MAY emit
 `[CANDIDATE]` rows in the lane output as a fallback convention (see the
@@ -603,7 +603,7 @@ Explorers must not use `CONFIRMED`, `DISPROVED`, or `PRE_EXISTING`.
 
 After base lanes are settled, inspect the context pack risk triggers. Launch focused micro-lanes for triggered categories only, using `dispatch_lanes_async` again when more than one read-only micro-lane is needed (`dispatch_lanes_async` accepts max 8 lanes per call — micro-lanes are dispatched in a separate batch from base lanes). Use the same incremental collection pattern: poll with `collect_lane_results` (without `wait`) to process settled micro-lanes while continuing independent work, falling back to `wait: true` only when no independent work remains. All micro-lanes must be settled before reviewer classification. Do not launch irrelevant micro-lanes.
 
-Apply the same parser-based extraction to micro-lanes: call `parse_lane_candidates` on each micro-lane `output_ref` (filter the returned `candidates[]` array by `row_format_family === "micro_lane"` after parsing). Apply the COVERAGE GATE from Phase 3 to micro-lanes: degraded, incomplete, or candidate-less lane artifacts are coverage gaps that must be closed by retry, verified equivalent alternative, or reported as INCOMPLETE — not treated as clean negative evidence.
+Apply the same parser-based extraction to micro-lanes: call `parse_lane_candidates` on each micro-lane `output_ref` (filter the returned `candidates[]` array by `row_format_family === "micro_lane"` after parsing). Apply the COVERAGE GATE from Phase 3 to micro-lanes: degraded, incomplete, or candidate-less lane artifacts are coverage gaps that must be closed by retry, blocking `dispatch_lanes`, or Task-tool dispatch as a verified-equivalent fallback when lane tools do not work. If the gap cannot be closed, stop and surface it to the user as BLOCKED before reviewer classification — never treat it as clean negative evidence and never proceed with a degraded review.
 
 Each micro-lane receives:
 
@@ -772,7 +772,7 @@ The `[CRITIC]` row in the format above is **mandatory contract**, not advisory o
 
 **Re-dispatch trigger:** when a critic lane response is missing the verdict row, the orchestrator must automatically re-dispatch that lane with the explicit instruction: "Your final line MUST be exactly the Phase 8 contract row: `[CRITIC] | finding_id | UPHELD/DOWNGRADED/DISPROVED/NEEDS_MORE_EVIDENCE | final_severity | reason | required_report_change`. A response without that exact row will be treated as a planning message and re-dispatched." Do not synthesize findings from the planning preamble; only from the re-dispatched verdict.
 
-**COVERAGE GATE alignment:** Critic lane failures follow the same COVERAGE GATE as explorer lanes: retry (max 2 attempts) with materially different parameters. If retries fail, deploy a verified equivalent alternative (same agent type, same prompt, same scope, same isolation). If no equivalent can be verified, report INCOMPLETE to the user — do NOT mark findings UNVERIFIED to continue past the gap. The orchestrator NEVER fabricates a critic verdict by parsing prose, by tolerating a planning preamble, or by silently accepting reduced coverage.
+**COVERAGE GATE alignment:** Critic lane failures follow the same COVERAGE GATE as explorer lanes: retry (max 2 attempts) with materially different parameters. If retries fail, deploy a verified equivalent alternative (same agent type, same prompt, same scope, same isolation), including Task-tool dispatch as the final fallback when lane tools do not work. If no equivalent can be verified, stop and surface the critic-lane failure to the user as BLOCKED — do NOT mark findings UNVERIFIED or continue past the gap. The orchestrator NEVER fabricates a critic verdict by parsing prose, by tolerating a planning preamble, by presenting partial findings, or by silently accepting reduced coverage.
 
 Refuted findings become `DISPROVED` or `ADVISORY`, depending on critic rationale. Downgrades must be listed in the final validation provenance.
 
@@ -1200,9 +1200,9 @@ Council findings are supplementary, not authoritative overrides. Do not adopt co
 11. Obligation precedence is deterministic. Do not skip higher-precedence sources to fill gaps with LLM synthesis.
 12. Do not leak secrets from logs, evidence bundles, config files, URLs, or scanner output.
 13. Do not recommend destructive git or filesystem actions as fixes unless they are clearly scoped, safe, and necessary.
-14. If subagents fail, timeout, or return malformed output, retry with corrected parameters (max 2 attempts). If retries fail, deploy a provably equivalent alternative (same agent type, same prompt, same scope, same isolation — different dispatch mechanism acceptable) and verify equivalence. If no equivalent alternative exists, the affected coverage dimension is INCOMPLETE and must be reported to the user before synthesis. Do not fabricate validation results, and do not silently mark candidates UNVERIFIED to proceed past the gap.
+14. If subagents fail, timeout, or return malformed output, retry with corrected parameters (max 2 attempts). If retries fail, deploy a provably equivalent alternative (same agent type, same prompt, same scope, same isolation — different dispatch mechanism acceptable), with Task-tool dispatch explicitly allowed as the final fallback when lane tools do not work, and verify equivalence. If no equivalent alternative exists, the affected coverage dimension is BLOCKED and must be surfaced to the user before synthesis. Do not fabricate validation results, do not present partial findings, and do not silently mark candidates UNVERIFIED to proceed past the gap.
 
-15. If context pack, repo graph, deterministic signals, or Swarm artifacts are unavailable, retry with alternative access paths. If unavailable after retry, the affected coverage dimension is INCOMPLETE and must be reported to the user. Do not proceed to synthesis with unclosed coverage gaps under a "best available evidence" rationale — the user decides whether to accept reduced coverage, not the architect.
+15. If context pack, repo graph, deterministic signals, or Swarm artifacts are unavailable, retry with alternative access paths. If unavailable after retry, the affected coverage dimension is BLOCKED and must be surfaced to the user. Do not proceed to synthesis with unclosed coverage gaps under a "best available evidence" rationale — the architect is not authorized to produce a degraded review.
 
 ---
 
@@ -1245,7 +1245,7 @@ Before writing the final output, print this checklist with filled values. Every
 
 If the reviewer returned `REJECTED` or `CONCERNS`, route the issue back to implementation context or mark the candidate invalid with reason. Do not silently downgrade a rejection.
 
-**COVERAGE GATE CONDITION:** If ANY validation dimension shows incomplete coverage (lanes that failed and were not closed by retry or verified equivalent alternative, CI that did not run, tools that were unavailable after retry), the Pre-Synthesis Gate FAILS. Do not proceed to final output. Report the unclosed gaps to the user as INCOMPLETE with the partial findings from successful dimensions. The architect is NEVER authorized to silently accept reduced coverage.
+**COVERAGE GATE CONDITION:** If ANY validation dimension shows incomplete coverage (lanes that failed and were not closed by retry or verified equivalent alternative, CI that did not run, tools that were unavailable after retry), the Pre-Synthesis Gate FAILS. Do not proceed to final output. Surface the unclosed gaps to the user as BLOCKED with exact failing dimensions and retry/equivalence evidence. Do not include partial findings from successful dimensions, do not issue a review verdict, and do not silently accept reduced coverage.
 
 ---
 

package/dist/cli/{config-doctor-9fhfy6p7.js → config-doctor-1j77p1jy.js}

@@ -12,7 +12,7 @@ import {
   shouldRunOnStartup,
   writeBackupArtifact,
   writeDoctorArtifact
-} from "./index-svf2zjxs.js";
+} from "./index-0d3pmjf9.js";
 import"./index-7hnwnw5g.js";
 import"./index-5e4e2hvv.js";
 import"./index-p0arc26j.js";

package/dist/cli/{evidence-summary-service-wxarfgt8.js → evidence-summary-service-5ww1npaa.js}

@@ -6,7 +6,7 @@ import {
   loadPlanJsonOnly,
   mergeDurableGateEntriesFromEvidence,
   readDurableGateEvidence
-} from "./index-6wgwybzj.js";
+} from "./index-9twtnjkv.js";
 import"./index-r8f89sm9.js";
 import"./index-9b7qp18e.js";
 import"./index-94qwbx11.js";

package/dist/cli/{guardrail-explain-5fpwhqk5.js → guardrail-explain-2q5q86jv.js}

@@ -1,15 +1,15 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-nytjghhx.js";
-import"./index-fhve3nj7.js";
+} from "./index-tn5exv94.js";
+import"./index-gjyrjr08.js";
 import"./index-xsswhy6k.js";
 import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
 import"./index-f7nma02k.js";
-import"./index-svf2zjxs.js";
+import"./index-0d3pmjf9.js";
 import"./index-7hnwnw5g.js";
-import"./index-6wgwybzj.js";
+import"./index-9twtnjkv.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";

package/dist/cli/{index-svf2zjxs.js → index-0d3pmjf9.js}

@@ -79,6 +79,21 @@ function emitObjectTypeMismatch(key, value, findings) {
     });
   }
 }
+function emitWorktreeIsolationLayeringAdvisory(config, findings) {
+  const parallelization = config.parallelization;
+  const worktreePolicy = config.worktree?.policy ?? "auto";
+  if (parallelization?.enabled === true && (parallelization.maxConcurrentTasks ?? 1) > 1 && worktreePolicy !== "disabled") {
+    findings.push({
+      id: "worktree-isolation-baseline-active",
+      title: "Worktree isolation is already active for standard parallel coders",
+      description: "Standard parallel coders already use baseline worktree isolation through the parallel execution profile plus top-level worktree.policy. Lean Turbo and Epic are additive strategies, not requirements for obtaining worktree isolation.",
+      severity: "warn",
+      path: "worktree.policy",
+      currentValue: worktreePolicy,
+      autoFixable: false
+    });
+  }
+}
 function getUserConfigDir() {
   return process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
 }
@@ -639,6 +654,14 @@ function validateConfigKey(path2, value) {
       emitObjectTypeMismatch("summaries", value, findings);
       break;
     }
+    case "auto_review": {
+      emitObjectTypeMismatch("auto_review", value, findings);
+      break;
+    }
+    case "repo_graph": {
+      emitObjectTypeMismatch("repo_graph", value, findings);
+      break;
+    }
     case "review_passes": {
       emitObjectTypeMismatch("review_passes", value, findings);
       break;
@@ -715,6 +738,10 @@ function validateConfigKey(path2, value) {
       emitObjectTypeMismatch("skill_improver", value, findings);
       break;
     }
+    case "skills": {
+      emitObjectTypeMismatch("skills", value, findings);
+      break;
+    }
     case "spec_writer": {
       emitObjectTypeMismatch("spec_writer", value, findings);
       break;
@@ -900,6 +927,7 @@ function walkConfigAndValidate(obj, path2, findings, visited = new WeakSet) {
 function runConfigDoctor(config, directory) {
   const findings = [];
   walkConfigAndValidate(config, "", findings);
+  emitWorktreeIsolationLayeringAdvisory(config, findings);
   const summary = {
     info: findings.filter((f) => f.severity === "info").length,
     warn: findings.filter((f) => f.severity === "warn").length,

package/dist/cli/{index-6wgwybzj.js → index-9twtnjkv.js}

@@ -2047,6 +2047,7 @@ class PlanTaskRemovalNotAcknowledgedError extends Error {
   }
 }
 var startupLedgerCheckedWorkspaces = new Set;
+var ledgerStaleWorkspaces = new Set;
 var recoveryMutexes = new Map;
 var PLAN_JSON_CACHE_NAMESPACE = "plan-json:validated:v1";
 var _internals4 = {
@@ -2128,6 +2129,25 @@ async function getLatestLedgerHash(directory) {
     return "";
   }
 }
+async function surfaceLedgerStaleIfPersisted(directory, plan) {
+  const resolvedWorkspace = path6.resolve(directory);
+  if (!ledgerStaleWorkspaces.has(resolvedWorkspace)) {
+    return plan;
+  }
+  try {
+    const planHash = computePlanHash(plan);
+    const ledgerHash = await getLatestLedgerHash(directory);
+    if (ledgerHash !== "" && planHash === ledgerHash) {
+      ledgerStaleWorkspaces.delete(resolvedWorkspace);
+      return plan;
+    }
+  } catch {}
+  plan._ledgerReplayStale = true;
+  if (typeof plan._ledgerReplayStaleReason !== "string" || plan._ledgerReplayStaleReason.length === 0) {
+    plan._ledgerReplayStaleReason = "plan.json still hash-mismatches the ledger after a startup ledger-replay failure (replay could not be applied and no critic-approved snapshot was available). Run /swarm reset-session if this persists.";
+  }
+  return plan;
+}
 async function parsePlanJsonCached(directory) {
   const planJsonPath = path6.resolve(directory, ".swarm", "plan.json");
   return readCachedParsedFile(planJsonPath, PLAN_JSON_CACHE_NAMESPACE, () => readSwarmFileAsync(directory, "plan.json"), (planJsonContent) => {
@@ -2186,7 +2206,7 @@ async function isPlanMdInSync(directory, plan, cache) {
   if (normalizedActual === normalizedExpected) {
     return true;
   }
-  return normalizedActual.includes(normalizedExpected) || normalizedExpected.includes(normalizedActual.replace(/^#.*$/gm, "").trim());
+  return false;
 }
 async function regeneratePlanMarkdown(directory, plan) {
   const swarmDir = path6.resolve(directory, ".swarm");
@@ -2267,6 +2287,12 @@ async function loadPlan(directory, cache) {
                         return approved.plan;
                       }
                     } catch {}
+                    {
+                      const runtimeStale = validated;
+                      runtimeStale._ledgerReplayStale = true;
+                      runtimeStale._ledgerReplayStaleReason = `Ledger replay failed during hash-mismatch rebuild and no approved snapshot was available: ${replayError instanceof Error ? replayError.message : String(replayError)}`;
+                      ledgerStaleWorkspaces.add(resolvedWorkspace);
+                    }
                     warn(`[loadPlan] Ledger replay failed during hash-mismatch rebuild: ${replayError instanceof Error ? replayError.message : String(replayError)}. Returning stale plan.json. To recover: check .swarm/plan-export/SWARM_PLAN.md for a checkpoint, or run /swarm reset-session.`);
                   }
                 }
@@ -2311,7 +2337,7 @@ async function loadPlan(directory, cache) {
               } catch {}
             }
           }
-          return validated;
+          return await surfaceLedgerStaleIfPersisted(directory, validated);
         }
       } catch (error2) {
         warn(`[loadPlan] plan.json validation failed: ${error2 instanceof Error ? error2.message : String(error2)}. Attempting rebuild from ledger. If rebuild fails, check .swarm/plan-export/SWARM_PLAN.md for a checkpoint.`);

package/dist/cli/{index-fhve3nj7.js → index-gjyrjr08.js}

@@ -57,7 +57,7 @@ import {
   readDoctorArtifact,
   removeStraySwarmDir,
   runConfigDoctor
-} from "./index-svf2zjxs.js";
+} from "./index-0d3pmjf9.js";
 import {
   AGENT_TOOL_MAP,
   ALL_SUBAGENT_NAMES,
@@ -114,7 +114,7 @@ import {
   transientBackoff,
   validateProjectRoot,
   writeProjectedSpecSync
-} from "./index-6wgwybzj.js";
+} from "./index-9twtnjkv.js";
 import {
   _internals as _internals2,
   _internals1 as _internals3,
@@ -909,7 +909,7 @@ var init_executor = __esm(() => {
 // package.json
 var package_default = {
   name: "opencode-swarm",
-  version: "7.99.3",
+  version: "7.99.5",
   description: "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
   main: "dist/index.js",
   types: "dist/index.d.ts",
@@ -5368,6 +5368,7 @@ function resetSwarmState() {
   swarmState.pendingEvents = 0;
   swarmState.lastBudgetPct = 0;
   swarmState.agentSessions.clear();
+  _lastIdleSweepAtMs = 0;
   clearTrajectoryCache();
   clearTrajectoryStepCounters();
   swarmState.pendingRehydrations.clear();
@@ -5409,8 +5410,10 @@ function resetSwarmStatePreservingSingletons() {
   swarmState.specWriterAgentNames = preservedSpecWriterAgentNames;
   swarmState.generatedAgentNames = preservedGeneratedAgentNames;
 }
-function startAgentSession(sessionId, agentName, staleDurationMs = 7200000, directory) {
-  const now = Date.now();
+var STALE_SESSION_TTL_MS = 7200000;
+var IDLE_SWEEP_COOLDOWN_MS = 60000;
+var _lastIdleSweepAtMs = 0;
+function sweepStaleSessions(staleDurationMs = STALE_SESSION_TTL_MS, now = Date.now()) {
   const staleIds = [];
   for (const [id, session] of swarmState.agentSessions) {
     if (now - session.lastToolCallTime > staleDurationMs) {
@@ -5419,7 +5422,20 @@ function startAgentSession(sessionId, agentName, staleDurationMs = 7200000, dire
   }
   for (const id of staleIds) {
     swarmState.agentSessions.delete(id);
+    swarmState.delegationChains.delete(id);
+  }
+  return staleIds;
+}
+function maybeSweepStaleSessions(staleDurationMs = STALE_SESSION_TTL_MS, now = Date.now()) {
+  if (now - _lastIdleSweepAtMs < IDLE_SWEEP_COOLDOWN_MS) {
+    return [];
   }
+  _lastIdleSweepAtMs = now;
+  return sweepStaleSessions(staleDurationMs, now);
+}
+function startAgentSession(sessionId, agentName, staleDurationMs = STALE_SESSION_TTL_MS, directory) {
+  const now = Date.now();
+  sweepStaleSessions(staleDurationMs, now);
   const sessionState = {
     agentName,
     lastToolCallTime: now,
@@ -5670,6 +5686,7 @@ function ensureAgentSession(sessionId, agentName, directory) {
       session.prSubscriptions = new Map;
     }
     session.lastToolCallTime = now;
+    maybeSweepStaleSessions();
     return session;
   }
   _internals12.startAgentSession(sessionId, agentName ?? "unknown", 7200000, directory);
@@ -15869,6 +15886,7 @@ import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as re
 import { homedir as homedir4 } from "os";
 import { join as join27 } from "path";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+var MAX_RESPONSE_BYTES = 256 * 1024;
 function cacheDir() {
   const xdg = process.env.XDG_CACHE_HOME;
   const base = xdg && xdg.length > 0 ? xdg : join27(homedir4(), ".cache");
@@ -17119,7 +17137,7 @@ async function handleDoctorCommand(directory, args) {
   const result = runConfigDoctor(config, directory);
   let output;
   if (enableAutoFix && result.hasAutoFixableIssues) {
-    const { runConfigDoctorWithFixes } = await import("./config-doctor-9fhfy6p7.js");
+    const { runConfigDoctorWithFixes } = await import("./config-doctor-1j77p1jy.js");
     const fixResult = await runConfigDoctorWithFixes(directory, config, true);
     output = formatDoctorMarkdown(fixResult.result);
   } else {
@@ -17932,7 +17950,7 @@ async function handleEvidenceCommand(directory, args) {
   return formatTaskEvidenceMarkdown(evidenceData);
 }
 async function handleEvidenceSummaryCommand(directory) {
-  const { buildEvidenceSummary } = await import("./evidence-summary-service-wxarfgt8.js");
+  const { buildEvidenceSummary } = await import("./evidence-summary-service-5ww1npaa.js");
   const artifact = await buildEvidenceSummary(directory);
   if (!artifact) {
     return "No plan found. Run `/swarm plan` to check plan status.";
@@ -26961,7 +26979,7 @@ function resolveWorkingDirectory(workingDirectory, fallbackDirectory) {
       };
     }
   }
-  const rawPathParts = workingDirectory.split(path53.sep);
+  const rawPathParts = workingDirectory.split(/[\\/]/);
   if (rawPathParts.includes("..")) {
     return {
       success: false,
@@ -32278,7 +32296,7 @@ function buildDetailedHelp(commandName, entry) {
 async function handleHelpCommand(ctx) {
   const targetCommand = ctx.args.join(" ");
   if (!targetCommand) {
-    const { buildHelpText } = await import("./index-y1fgp4xa.js");
+    const { buildHelpText } = await import("./index-s0nsx5v6.js");
     return buildHelpText();
   }
   const tokens = targetCommand.split(/\s+/);
@@ -32287,7 +32305,7 @@ async function handleHelpCommand(ctx) {
     return _internals46.buildDetailedHelp(resolved.key, resolved.entry);
   }
   const similar = _internals46.findSimilarCommands(targetCommand);
-  const { buildHelpText: fullHelp } = await import("./index-y1fgp4xa.js");
+  const { buildHelpText: fullHelp } = await import("./index-s0nsx5v6.js");
   if (similar.length > 0) {
     return `Command '/swarm ${targetCommand}' not found.
 
@@ -32420,7 +32438,7 @@ var COMMAND_REGISTRY = {
   },
   "guardrail explain": {
     handler: async (ctx) => {
-      const { handleGuardrailExplain } = await import("./guardrail-explain-5fpwhqk5.js");
+      const { handleGuardrailExplain } = await import("./guardrail-explain-2q5q86jv.js");
       return handleGuardrailExplain(ctx.directory, ctx.args);
     },
     description: "Dry-run: show what the guardrails would do to a command or write target (executes nothing)",
@@ -32759,7 +32777,7 @@ Subcommands:
     handler: (ctx) => handleModeCommandWithBundledSkills(ctx, handlePrReviewCommand),
     description: "Launch deep PR review with multi-lane analysis [url] [--council]",
     args: "<pr-url|owner/repo#N|N> [--council]",
-    details: "Launches a structured PR review: reconstructs PR intent via obligation extraction cascade, runs 6 parallel explorer lanes through the deterministic dispatch_lanes join barrier (correctness, security, dependencies, docs-intent-vs-actual, tests, performance-architecture), validates findings through independent reviewer confirmation, applies critic challenge to HIGH/CRITICAL findings, synthesizes structured report. --council variant fires adversarial multi-model review. Supports full GitHub URL, owner/repo#N shorthand, or bare PR number (resolves against origin remote).",
+    details: "Launches a structured PR review: reconstructs PR intent via obligation extraction cascade, launches all 6 fixed base explorer lanes through dispatch_lanes_async while the architect keeps doing non-dependent work, polls collect_lane_results incrementally, runs every triggered micro-lane, validates findings through independent reviewer confirmation, applies critic challenge to HIGH/CRITICAL findings, then synthesizes only after coverage is closed. If lane tools cannot close coverage, Task-tool dispatch is the final verified-equivalent fallback; if equivalence cannot be proven, the review is BLOCKED rather than degraded. --council variant fires adversarial multi-model review. Supports full GitHub URL, owner/repo#N shorthand, or bare PR number (resolves against origin remote).",
     category: "agent",
     toolPolicy: "none"
   },

package/dist/cli/{index-y1fgp4xa.js → index-s0nsx5v6.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   handleGuardrailExplain
-} from "./index-nytjghhx.js";
+} from "./index-tn5exv94.js";
 import {
   handleGuardrailLog
 } from "./index-h9ptj4b1.js";
@@ -79,18 +79,18 @@ import {
   handleWriteRetroCommand,
   normalizeSwarmCommandInput,
   resolveCommand
-} from "./index-fhve3nj7.js";
+} from "./index-gjyrjr08.js";
 import"./index-xsswhy6k.js";
 import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
 import"./index-f7nma02k.js";
-import"./index-svf2zjxs.js";
+import"./index-0d3pmjf9.js";
 import {
   AGENT_TOOL_MAP,
   ORCHESTRATOR_NAME,
   stripKnownSwarmPrefix
 } from "./index-7hnwnw5g.js";
-import"./index-6wgwybzj.js";
+import"./index-9twtnjkv.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";

package/dist/cli/{index-nytjghhx.js → index-tn5exv94.js}

@@ -12,7 +12,7 @@ import {
   detectPosixWrites,
   detectWindowsWrites,
   resolveWriteTargets
-} from "./index-fhve3nj7.js";
+} from "./index-gjyrjr08.js";
 import {
   checkFileAuthority,
   classifyFile,

package/dist/cli/index.js

@@ -7,16 +7,16 @@ import {
   getPluginLockFilePaths,
   package_default,
   resolveCommand
-} from "./index-fhve3nj7.js";
+} from "./index-gjyrjr08.js";
 import"./index-xsswhy6k.js";
 import"./index-ydgy7vg5.js";
 import"./index-vwyjkzgs.js";
 import"./index-f7nma02k.js";
-import"./index-svf2zjxs.js";
+import"./index-0d3pmjf9.js";
 import {
   DEFAULT_AGENT_CONFIGS
 } from "./index-7hnwnw5g.js";
-import"./index-6wgwybzj.js";
+import"./index-9twtnjkv.js";
 import"./index-adz3nk9b.js";
 import"./index-v4fcn4tr.js";
 import"./index-r8f89sm9.js";

package/dist/commands/registry.d.ts

@@ -485,7 +485,7 @@ export declare const COMMAND_REGISTRY: {
         readonly handler: (ctx: CommandContext) => CommandResult;
         readonly description: "Launch deep PR review with multi-lane analysis [url] [--council]";
         readonly args: "<pr-url|owner/repo#N|N> [--council]";
-        readonly details: "Launches a structured PR review: reconstructs PR intent via obligation extraction cascade, runs 6 parallel explorer lanes through the deterministic dispatch_lanes join barrier (correctness, security, dependencies, docs-intent-vs-actual, tests, performance-architecture), validates findings through independent reviewer confirmation, applies critic challenge to HIGH/CRITICAL findings, synthesizes structured report. --council variant fires adversarial multi-model review. Supports full GitHub URL, owner/repo#N shorthand, or bare PR number (resolves against origin remote).";
+        readonly details: "Launches a structured PR review: reconstructs PR intent via obligation extraction cascade, launches all 6 fixed base explorer lanes through dispatch_lanes_async while the architect keeps doing non-dependent work, polls collect_lane_results incrementally, runs every triggered micro-lane, validates findings through independent reviewer confirmation, applies critic challenge to HIGH/CRITICAL findings, then synthesizes only after coverage is closed. If lane tools cannot close coverage, Task-tool dispatch is the final verified-equivalent fallback; if equivalence cannot be proven, the review is BLOCKED rather than degraded. --council variant fires adversarial multi-model review. Supports full GitHub URL, owner/repo#N shorthand, or bare PR number (resolves against origin remote).";
         readonly category: "agent";
         readonly toolPolicy: "none";
     };

package/dist/config/plan-schema.d.ts

@@ -178,6 +178,25 @@ export type Plan = z.infer<typeof PlanSchema>;
  * `_midLoadRemovals` is attached by loadPlan-recovery paths that auto-
  * acknowledged task removals (issue #853) so the system-enhancer Layer A
  * can disclose the count to the model without re-reading the ledger.
+ *
+ * `_ledgerReplayStale` / `_ledgerReplayStaleReason` are attached by loadPlan
+ * when it returns a STALE plan.json: the plan.json hash mismatched the ledger,
+ * ledger replay failed (threw), AND no critic-approved snapshot was available,
+ * so the loader fell back to the (stale) plan.json (#1269 finding 2). Consumers
+ * in phase-complete.ts and update-task-status.ts read these to surface a
+ * structured staleness signal instead of silently trusting plan.json.
+ *
+ * RUNTIME-ONLY CONTRACT (mirrors `_specStale`): every field on RuntimePlan is a
+ * TypeScript-only overlay on the persisted `Plan`. It is NOT part of the durable
+ * `PlanSchema` (see this file ~line 95 — a plain `z.object`, no `.passthrough()`,
+ * so Zod strips unknown keys), so `savePlan`'s `JSON.stringify(PlanSchema.parse(...))`
+ * can never write these to .swarm/plan.json. It is also excluded from plan hashing:
+ * both `computePlanHash` (src/plan/ledger.ts) and `computePlanContentHash`
+ * (src/plan/manager.ts) hash an explicit allow-list of fields, never the whole
+ * object. Because of this, AGENTS.md invariant-5's "six places" (ledger replay,
+ * projection, checkpoint import/export, get_approved_plan, tests, docs) do NOT
+ * all apply — these are not durable schema fields. Do NOT move these into
+ * `PlanSchema`.
  */
 export type RuntimePlan = Plan & {
     _specStale?: boolean;
@@ -186,6 +205,8 @@ export type RuntimePlan = Plan & {
         count: number;
         source: string;
     };
+    _ledgerReplayStale?: boolean;
+    _ledgerReplayStaleReason?: string;
 };
 /**
  * Find the first phase that is in progress.