swarm

# Swarm Swarm exposes one optional factory port: ```text dispatch_once(explicit_disjoint_packets, executor) -> per-packet candidate | evidence | error ``` The caller supplies every complete packet, proves their write scopes disjoint, and chooses the executor. Swarm dispatches each packet once, preserves packet and context identities, collects results, and stops. Write scopes must be **workspace-relative and canonical** — symlink-resolved and already normalized. The disjointness check is lexical: it case-folds prefixes so scopes differing only by case are treated as a collision (safe on case-insensitive filesystems), but it cannot see a symlink that aliases two scopes onto one target. Supplying non-canonical or symlinked scopes forfeits the disjointness guarantee; a non-empty `write_scope.exclude` is rejected, not silently ignored, because the proof cannot honor it. Exactly-once dispatch over proven-disjoint scopes is why parallel failures stay independent: no packet can observe, block, or corrupt another, so N packets yield N factual results about N experiments rather than one tangle. Those results are not semantic verdicts. Named failure mode — **partial-batch launch**: dispatching valid packets before discovering an invalid one, leaving the batch half-run; validate the entire batch before the first call. Anti-pattern: re-dispatching a packet whose executor returned an error. Corrective: return the error as that packet's factual result; retry is the caller's decisio...