@ai-dossier/sched 0.18.0 → 0.20.0

package/README.md

@@ -88,7 +88,13 @@ where every mechanical supervision decision is code, not remembered prose:
    runstate milestone is `report done`, or GitHub says the issue is closed — except a
    report-agent slot (`role: 'report'`), whose issue is already closed at merge: the
    closed signal is suppressed and only a `report done` milestone completes it (#500).
-   An unverified exit rides the recovery ladder like a stall.
+   An unverified exit rides the recovery ladder like a stall. A `report done` milestone
+   must also postdate the slot's own `spawned_at` (±60s clock-skew tolerance, #575) — a
+   re-enqueued issue's PREVIOUS run's report milestone is ignored (journaled
+   `stale-milestone-ignored`) rather than instantly completing a freshly-spawned agent on
+   its first reconcile tick; a legacy slot with no `spawned_at` degrades to the old,
+   unfenced check. Batch members get the same fence on their own completion signal
+   (`isMemberComplete`, `phase=review status=done mode=slot`).
 3. **Reconciliation tick (AC3)** — every tick detects externally-advanced state (someone
    finished the work outside sched → complete, kill the leftover agent, reclaim the
    slot), orphaned pids after a restart (dead pid on a running slot → exit rail →
@@ -122,7 +128,7 @@ where every mechanical supervision decision is code, not remembered prose:
    progress, stalled, redispatched, fence-written, fence-failed, unit-failed,
    dependents-blocked, slot-released, suspect-dispatch, dispatch-unhealthy,
    run-log-recorded, run-log-no-usage, run-log-skipped, run-log-failed, engine-stale,
-   engine-auto-upgrade-attempted, engine-auto-upgrade-failed, …) is
+   engine-auto-upgrade-attempted, engine-auto-upgrade-failed, stale-milestone-ignored, …) is
    appended to `events.jsonl`; `sched status` shows the live phase per unit, plus each
    slot's `gen` and `fenced` state (#504).
    `engine-stale`/`engine-auto-upgrade-attempted`/`engine-auto-upgrade-failed`
@@ -207,6 +213,13 @@ Two engine-safety policies were explicit product decisions on #464:
   never kill a healthy agent or fail a unit as "unverified". An agent that exits during
   an outage holds in `verifying` until truth returns. Each pause is journaled as
   `ground-truth-unreachable`.
+- **A completion milestone is fenced to its own dispatch (#575).** `isVerifiedComplete`
+  (issues) and `isMemberComplete` (batch members) both accept the current dispatch's
+  `SlotEntry.spawned_at` and reject a `report done` / `review done mode=slot` milestone
+  that predates it (±60s clock-skew tolerance) — a re-enqueued issue or a member re-added
+  to a fresh batch run must not read as instantly complete against a PREVIOUS run's
+  milestone. The rejection is journaled as `stale-milestone-ignored`; `spawned_at=null`
+  (a legacy slot) degrades to the old, unfenced check.
 
 This applies to `issue:<n>` unit dispatch (`dispatchAssignments`). `batch:<id>` units run
 through a separate pass with its own claim/reconcile logic — see
@@ -442,6 +455,8 @@ ready → executing(member i/N) ⟲ → validating → reviewing → shipping
 failure rails: executing → dissolving (a member self-reports blocked)
                validating → attributing → (fixing | evicting) → validating → dissolving
                validating → blocked (suite report unreadable, #562) → validating
+               executing → blocked (gate-inconclusive:<cap>, #583) → executing
+                 (`sched resume --batch <id>` re-runs the gate; nothing requeued/reverted)
 ```
 
 - **One shared worktree/branch per batch**, claimed once by a deterministic (no LLM)
@@ -460,7 +475,12 @@ failure rails: executing → dissolving (a member self-reports blocked)
   kept on `BatchEntry.ranges` for eviction. An incremental gate (`ai-dossier cap run
   typecheck.run` / `test.focused`, when the repo has a manifest) runs after each member
   before advancing — a second, independent check that the member's self-reported "done"
-  is real.
+  is real. Three-way outcome policy (#583): `task-failed` evicts the member (same rail
+  as a self-reported block); `automation-broken`/`capability-unavailable` — the gate
+  itself couldn't reach a verdict — block the batch instead of silently proceeding
+  (`gate-inconclusive:<cap>`, `member_gates`/`blocked_reason` on `BatchEntry`, surfaced
+  in `sched status`); `sched resume --batch <id>` re-runs the gate later to resolve the
+  block once the capability is fixed.
 - **The batch's single slot is claimed FRESH for each live step** (a member, the tail
   agent, the report agent, a bounded fix agent) — never held across a wait. The aggregate
   suite itself runs with NO slot claimed at all (deterministic engine work, not an LLM
@@ -491,10 +511,21 @@ batch-setup had pool integration). Config schema moves to 1.3.0: `dispatch` gain
 `member_prompt`, `batch_tail_prompt` and `batch_report_prompt` (the three new agent
 prompt templates).
 
+Schema 1.11.0 (#583): `BatchEntry` gains `member_gates` (most recent incremental-gate
+result per member, keyed by issue number as a string — `{capability, outcome,
+output_tail, at}`) and `blocked_reason` (why the batch is `blocked` — persisted so
+`sched status` can show it; previously `blockBatch` only journaled/posted the reason,
+never stored it on the entry, so this also retroactively covers the #562 case). 1.10.0
+states migrate on load: no gate has ever produced a non-`ok` verdict, and no batch has
+ever been blocked, under them, so `{}`/`null` is the exact backfill, not a guess.
+
 New journal events: `batch-setup-done`, `batch-setup-failed`, `member-advanced`,
 `batch-warmup-done`, `batch-warmup-failed` (#561 — the cold-path warm step only; a pool
-claim emits neither). Member/tail/report/fix-agent spawn, progress, completion and park
-events reuse the existing unit-generic names (`assigned`/`spawned`/`unit-failed`/
+claim emits neither). `gate-inconclusive` (#583 — the incremental gate came back
+`automation-broken`/`capability-unavailable` rather than a definite `ok`/`task-failed`;
+sits alongside `batch-blocked` as the per-member analogue of the aggregate suite's
+"block, don't dissolve" precedent). Member/tail/report/fix-agent spawn, progress,
+completion and park events reuse the existing unit-generic names (`assigned`/`spawned`/`unit-failed`/
 `external-advance`/`pr-parked`/`merge-accepted`/`report-dispatched`/`teardown-done`/
 `teardown-failed`) with `unit = batch:<id>`.
 
@@ -611,10 +642,12 @@ import {
                          //   the issue pass — loads/saves state itself, holds no lock
                          //   across the call
   type BatchDispatchDeps, // inject store/journal/groundTruth/spawnDeps/exec/runSuite/
-                         //   runCapability(optional)/fsExists(optional)
+                         //   runCapability(optional, returns CapabilityGateResult)/fsExists(optional)
   type BatchTickResult,  // spawned/completed/parked/mergeAccepted/failed (batch:<id> ids)
                          //   + blocked (issue numbers, dissolve-requeued)
   type CapOutcome,       // ok | task-failed | automation-broken | capability-unavailable
+  type CapabilityGateResult, // {outcome: CapOutcome, outputTail?, reason?} — runCapability's return shape (#583)
+  resumeBlockedGate,     // #583: sched resume --batch <id> — re-run the gate that blocked a batch
   buildMemberPrompt, buildBatchTailPrompt, buildBatchReportPrompt, // #523 prompt builders
   DEFAULT_MEMBER_PROMPT_TEMPLATE, DEFAULT_BATCH_TAIL_PROMPT_TEMPLATE,
   DEFAULT_BATCH_REPORT_PROMPT_TEMPLATE,

package/dist/batch-dispatch.d.ts

@@ -67,15 +67,8 @@ import type { SchedStore } from './persist';
 import type { ExecFn } from './project';
 import { type SuiteResult } from './recovery';
 import { type FsExists } from './teardown';
-import type { SchedConfig } from './types';
-/**
- * The four `ai-dossier cap run` outcomes (docs/reference/capabilities.md):
- * `ok` = the capability ran and passed; `task-failed` = it ran and the TASK
- * itself failed (trust the result); `automation-broken` = do not trust the
- * machinery (missing tool, timeout, bad manifest); `capability-unavailable` =
- * no manifest / no such id / `lifecycle: shadow` — no fast path here.
- */
-export type CapOutcome = 'ok' | 'task-failed' | 'automation-broken' | 'capability-unavailable';
+import type { CapabilityGateResult, SchedConfig } from './types';
+export type { CapOutcome } from './types';
 /** Everything batch dispatch needs from the outside world. */
 export interface BatchDispatchDeps {
     store: SchedStore;
@@ -100,19 +93,24 @@ export interface BatchDispatchDeps {
     /**
      * Runs one `ai-dossier cap run <capabilityId>` in a batch worktree. Two call
      * sites, different degrade contracts:
-     * - the per-member incremental gate (#523 AC2 — "typecheck + focused tests
-     *   via `cap run test.focused` when available"): degrade-not-crash — without
-     *   this hook, or on `automation-broken`/`capability-unavailable`, the gate
-     *   is skipped (the member's own `slot-cycle` run already attempted this
-     *   fast path before ever posting `review done`, so a repo with no manifest
-     *   loses nothing but the engine's independent re-check).
+     * - the per-member incremental gate (#523 AC2, revised #583): without this
+     *   hook, the gate is skipped entirely (the member's own `slot-cycle` run
+     *   already attempted this fast path before ever posting `review done`, so
+     *   a repo with no manifest loses nothing but the engine's independent
+     *   re-check). With the hook: `ok` advances, `task-failed` evicts,
+     *   `automation-broken`/`capability-unavailable` BLOCK the batch
+     *   (`gate-inconclusive`) rather than silently proceeding — #583 found the
+     *   old "proceed on anything but task-failed" policy let a script's own
+     *   "I could not run this" signal (a non-zero exit reporting it never
+     *   really tested anything) masquerade as either a pass or a real failure.
      * - batch-setup's `worktree.prepare` warm step (#561, `warmColdBatchWorktree`):
-     *   `undefined`/`capability-unavailable`/`automation-broken` fall through to
-     *   package-manager detection, but a declared-and-`task-failed` capability
-     *   hard-fails the whole batch setup — a repo that owns its warm-up should
-     *   never be silently second-guessed by a fallback underneath it.
+     *   unaffected by #583's gate policy change — `undefined`/
+     *   `capability-unavailable`/`automation-broken` still fall through to
+     *   package-manager detection, and a declared-and-`task-failed` capability
+     *   still hard-fails the whole batch setup (a repo that owns its warm-up
+     *   should never be silently second-guessed by a fallback underneath it).
      */
-    runCapability?: (worktree: string, capabilityId: string) => CapOutcome;
+    runCapability?: (worktree: string, capabilityId: string) => CapabilityGateResult;
     fsExists?: FsExists;
     /**
      * Home directory for `~/.dossier/runs.jsonl` (#564) — mirrors `EngineDeps.homeDir`.
@@ -130,6 +128,33 @@ export interface BatchTickResult {
     /** Issue numbers requeued full-cycle by a dissolve — matches `TickResult.blocked`'s shape. */
     blocked: number[];
 }
+/**
+ * `sched resume --batch <id>` (#583 AC4): an operator-triggered, synchronous
+ * one-shot recheck of a batch blocked on `gate-inconclusive:<capabilityId>`
+ * — re-runs exactly that capability against the current member and resolves
+ * the block:
+ *
+ * - still `automation-broken`/`capability-unavailable` → stays `blocked`,
+ *   no state change (the capability still isn't fixed).
+ * - `task-failed` → the member really is broken; evict via the same rail
+ *   the live gate uses.
+ * - `ok` → the member really was fine; complete it via the same rail the
+ *   live gate uses.
+ *
+ * Deliberately NOT a generic engine tick: `runBatchTick`'s own "executing
+ * with no live slot" wedge-recovery path (`spawnMemberContinuation`,
+ * unconditional) exists for a dispatch that never happened — reusing it here
+ * would redispatch a fresh agent for a member whose work is already
+ * committed and reviewed. This function transitions `blocked → executing`
+ * and immediately, synchronously, calls the same completion/eviction
+ * functions the live gate calls — no intervening tick ever sees the batch
+ * `executing` with nothing in flight.
+ */
+export declare function resumeBlockedGate(deps: BatchDispatchDeps, config: SchedConfig, dispatch: ResolvedDispatch, batchId: string, now: Date): {
+    outcome: 'still-blocked' | 'evicted' | 'completed';
+    capability: string;
+    detail?: string;
+};
 /**
  * One batch reconcile+refill pass. Called from `engine.ts`'s `tick()` after
  * the issue-level pass — this pass never claims a slot the issue pass already

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAiBH,OAAO,EASL,KAAK,gBAAgB,EAErB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,WAAW,EAOjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAYpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAKV,WAAW,EAIZ,MAAM,SAAS,CAAC;AAGjB;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,aAAa,GAAG,mBAAmB,GAAG,wBAAwB,CAAC;AAE/F,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,UAAU,CAAC;IACvE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAsiDD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAsFjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAiBH,OAAO,EAUL,KAAK,gBAAgB,EAErB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,WAAW,EAOjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAYpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAGV,oBAAoB,EAIpB,WAAW,EAIZ,MAAM,SAAS,CAAC;AAMjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAywCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IAAE,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA+E7F;AAieD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAsFjB"}

package/dist/batch-dispatch.js

@@ -95,6 +95,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resumeBlockedGate = resumeBlockedGate;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
@@ -140,6 +141,65 @@ function sanitizeUntrustedText(value) {
 function journalEvent(deps, event, unitId, extra = {}) {
     deps.journal.append((0, journal_1.unitEvent)(event, unitId, extra), deps.now());
 }
+/**
+ * Last ~500 bytes of a gate's output tail, falling back to the envelope's
+ * `reason` when no subprocess ran (#583 AC1/AC3 review: `capability-unavailable`
+ * and a failed assumption probe carry no output_tail — `reason` is the only
+ * explanation available for those) — journal details stay compact; the full
+ * tail lives in the per-gate log file. UTF-8-safe (never splits a multi-byte
+ * character) — chars would risk exactly that, hence `Buffer`, matching
+ * `cli/src/capability.ts`'s `truncateTailBytes`.
+ */
+function gateDetailExcerpt(outputTail, reason) {
+    const text = outputTail || reason;
+    if (!text)
+        return undefined;
+    const buf = Buffer.from(text, 'utf-8');
+    return buf.length > 500 ? buf.subarray(buf.length - 500).toString('utf-8') : text;
+}
+/**
+ * Best-effort per-gate diagnostic log (#583 AC1) — mirrors `appendCapLog`'s
+ * never-crash contract: a log-write failure must not interrupt the gate
+ * decision itself.
+ */
+function writeGateLog(deps, batchId, capabilityId, issue, outputTail) {
+    if (!outputTail)
+        return;
+    try {
+        const logPath = (0, dispatch_1.batchGateLogPath)(deps.store.runsDir, batchId, capabilityId, issue);
+        fs.mkdirSync(path.dirname(logPath), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(logPath, outputTail, { mode: 0o600 });
+    }
+    catch {
+        // diagnostic only — never fail the gate decision over a log write
+    }
+}
+/**
+ * Persist the incremental gate's most recent verdict for a member on
+ * `BatchEntry.member_gates` (#583 AC4) — shared by the live gate
+ * (`reconcileMemberSlot`) and `sched resume --batch`'s recheck
+ * (`resumeBlockedGate`), so a resumed batch's status never shows a stale
+ * outcome from before the recheck ran.
+ */
+function recordMemberGate(deps, batchId, memberIssue, gate, now) {
+    deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        return {
+            state: (0, state_1.patchBatch)(s, batchId, {
+                member_gates: {
+                    ...(b?.member_gates ?? {}),
+                    [String(memberIssue)]: {
+                        capability: gate.id,
+                        outcome: gate.outcome,
+                        output_tail: gate.outputTail ?? null,
+                        at: now.toISOString(),
+                    },
+                },
+            }, now),
+            result: undefined,
+        };
+    });
+}
 function slotFor(state, batchId) {
     return state.slots.find((s) => s.unit === unit(batchId));
 }
@@ -288,7 +348,7 @@ poolNote = '') {
         }), now);
         return { ok: true };
     };
-    const capOutcome = deps.runCapability?.(worktree, 'worktree.prepare');
+    const capOutcome = deps.runCapability?.(worktree, 'worktree.prepare')?.outcome;
     if (capOutcome === 'ok')
         return done('cap:worktree.prepare');
     if (capOutcome === 'task-failed')
@@ -932,6 +992,187 @@ function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIs
     }
     advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
 }
+/**
+ * The incremental gate (#523 AC2, revised #583): typecheck + focused tests
+ * via `cap run`, when the repo has a manifest for them — a second,
+ * independent check that the member's own self-reported "done" is real,
+ * matching this codebase's "never trust a claimed completion" ethos
+ * (AC2/#464's `isVerifiedComplete`). Three-way policy: `task-failed` evicts
+ * the member directly, same rail as a self-reported block (RFC F.1) — no
+ * aggregate suite has run yet, so there is nothing to attribute.
+ * `automation-broken`/`capability-unavailable` — the gate itself could not
+ * reach a verdict — BLOCK the batch instead of silently proceeding (#583: a
+ * script that legitimately could not run its suite must not be read as
+ * either a pass or a real failure). Only both `ok` falls through.
+ *
+ * Returns `true` when the gate already decided the member's fate (evicted or
+ * blocked, both of which `return` from the caller); `false` when no hook is
+ * configured or both checks came back `ok`, meaning the caller should treat
+ * the member as genuinely complete.
+ */
+function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result) {
+    if (batch.worktree === null || !deps.runCapability)
+        return false;
+    const worktree = batch.worktree;
+    const runCapability = deps.runCapability;
+    const gateResults = ['typecheck.run', 'test.focused'].map((id) => ({
+        id,
+        ...runCapability(worktree, id),
+    }));
+    const gateFailure = gateResults.find((r) => r.outcome === 'task-failed');
+    const gateInconclusive = gateResults.find((r) => r.outcome === 'automation-broken' || r.outcome === 'capability-unavailable');
+    const worstGate = gateFailure ?? gateInconclusive;
+    if (worstGate) {
+        recordMemberGate(deps, batchId, memberIssue, worstGate, now);
+    }
+    if (gateFailure) {
+        const reason = `incremental-gate-failed:${gateFailure.id}`;
+        writeGateLog(deps, batchId, gateFailure.id, memberIssue, gateFailure.outputTail);
+        const excerpt = gateDetailExcerpt(gateFailure.outputTail, gateFailure.reason);
+        journalEvent(deps, 'unit-failed', unit(batchId), {
+            issue: memberIssue,
+            reason,
+            detail: excerpt
+                ? `cap run ${gateFailure.id} reported task-failed after member review done: ${excerpt}`
+                : `cap run ${gateFailure.id} reported task-failed after member review done`,
+        });
+        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result);
+        return true;
+    }
+    if (gateInconclusive) {
+        const reason = `gate-inconclusive:${gateInconclusive.id}`;
+        writeGateLog(deps, batchId, gateInconclusive.id, memberIssue, gateInconclusive.outputTail);
+        const excerpt = gateDetailExcerpt(gateInconclusive.outputTail, gateInconclusive.reason);
+        journalEvent(deps, 'gate-inconclusive', unit(batchId), {
+            issue: memberIssue,
+            reason,
+            detail: excerpt
+                ? `cap run ${gateInconclusive.id} reported ${gateInconclusive.outcome} after member review done: ${excerpt}`
+                : `cap run ${gateInconclusive.id} reported ${gateInconclusive.outcome} after member review done`,
+        });
+        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        const stateNow = deps.store.load();
+        const rDeps = recoveryDeps(deps, config, batch, now);
+        const blocked = (0, recovery_1.blockBatch)(stateNow, batchId, { reason, milestonePhase: 'batch-review' }, rDeps);
+        deps.store.withLock((s) => ({
+            state: applyBatchAndIssues(s, blocked.state, batchId, []),
+            result: undefined,
+        }));
+        result.failed.push(unit(batchId));
+        return true;
+    }
+    return false;
+}
+/**
+ * The member is verifiably done — self-reported complete AND (when checked)
+ * the incremental gate agrees. Recompute the member's commit range, mark it
+ * validated, and advance the batch. Shared by `reconcileMemberSlot`'s
+ * immediate "both gate checks ok" fallthrough and `resumeBlockedGate` (#583)
+ * — a member confirmed complete via a delayed `sched resume --batch` recheck
+ * gets exactly the same treatment as one confirmed complete on the first try.
+ * `releaseSlot` is idempotent (a no-op once the slot is already idle), so
+ * this is safe to call whether or not the caller already released it.
+ */
+function completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result) {
+    // The commit-range recompute (`git log`) is a blocking subprocess call — it
+    // must run OUTSIDE the lock, like every other exec in this module; the
+    // result then lands as a pure data patch under the lock (Convention review:
+    // `recordRanges` used to run `git log` INSIDE the withLock mutator, which
+    // is exactly what `engine.ts`'s own "a slow git call never holds the lock"
+    // invariant exists to prevent).
+    const ranges = (0, attribution_1.memberRanges)(boundaryCommits(deps, batch));
+    deps.store.withLock((s) => {
+        let n = releaseSlot(s, batchId, now);
+        n = (0, state_1.patchBatch)(n, batchId, { ranges }, now);
+        n = advanceMemberToValidated(n, memberIssue, now);
+        return { state: n, result: undefined };
+    });
+    result.completed.push(unit(batchId));
+    advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
+}
+/**
+ * `sched resume --batch <id>` (#583 AC4): an operator-triggered, synchronous
+ * one-shot recheck of a batch blocked on `gate-inconclusive:<capabilityId>`
+ * — re-runs exactly that capability against the current member and resolves
+ * the block:
+ *
+ * - still `automation-broken`/`capability-unavailable` → stays `blocked`,
+ *   no state change (the capability still isn't fixed).
+ * - `task-failed` → the member really is broken; evict via the same rail
+ *   the live gate uses.
+ * - `ok` → the member really was fine; complete it via the same rail the
+ *   live gate uses.
+ *
+ * Deliberately NOT a generic engine tick: `runBatchTick`'s own "executing
+ * with no live slot" wedge-recovery path (`spawnMemberContinuation`,
+ * unconditional) exists for a dispatch that never happened — reusing it here
+ * would redispatch a fresh agent for a member whose work is already
+ * committed and reviewed. This function transitions `blocked → executing`
+ * and immediately, synchronously, calls the same completion/eviction
+ * functions the live gate calls — no intervening tick ever sees the batch
+ * `executing` with nothing in flight.
+ */
+function resumeBlockedGate(deps, config, dispatch, batchId, now) {
+    const state = deps.store.load();
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch)
+        throw new types_1.SchedNotFoundError(`Batch not found: ${batchId}`);
+    if (batch.status !== 'blocked' || !batch.blocked_reason?.startsWith('gate-inconclusive:')) {
+        throw new types_1.IllegalTransitionError('batch', batch.status, 'executing');
+    }
+    const capabilityId = batch.blocked_reason.slice('gate-inconclusive:'.length);
+    const memberIssue = batch.members[batch.executing_member - 1];
+    if (batch.worktree === null || !deps.runCapability || memberIssue === undefined) {
+        throw new types_1.SchedNotFoundError(`Batch ${batchId} has no worktree/current member/gate hook to recheck`);
+    }
+    const recheck = deps.runCapability(batch.worktree, capabilityId);
+    const result = emptyResult();
+    const excerpt = gateDetailExcerpt(recheck.outputTail, recheck.reason);
+    recordMemberGate(deps, batchId, memberIssue, { id: capabilityId, ...recheck }, now);
+    if (recheck.outcome === 'automation-broken' || recheck.outcome === 'capability-unavailable') {
+        // Still inconclusive: leave an audit trail (log + journal) exactly like
+        // the live gate does, even though the batch stays `blocked` — otherwise
+        // a repeated `sched resume --batch` leaves no record of when it was last
+        // checked or what it said (#583 review).
+        writeGateLog(deps, batchId, capabilityId, memberIssue, recheck.outputTail);
+        journalEvent(deps, 'gate-inconclusive', unit(batchId), {
+            issue: memberIssue,
+            reason: `gate-inconclusive:${capabilityId}`,
+            detail: excerpt
+                ? `sched resume --batch: cap run ${capabilityId} still reports ${recheck.outcome} on recheck: ${excerpt}`
+                : `sched resume --batch: cap run ${capabilityId} still reports ${recheck.outcome} on recheck`,
+        });
+        return {
+            outcome: 'still-blocked',
+            capability: capabilityId,
+            detail: excerpt,
+        };
+    }
+    deps.store.withLock((s) => ({
+        state: (0, state_1.patchBatch)((0, state_1.transitionBatch)(s, batchId, 'executing', {}, now), batchId, { blocked_reason: null }, now),
+        result: undefined,
+    }));
+    if (recheck.outcome === 'task-failed') {
+        const reason = `incremental-gate-failed:${capabilityId}`;
+        writeGateLog(deps, batchId, capabilityId, memberIssue, recheck.outputTail);
+        journalEvent(deps, 'unit-failed', unit(batchId), {
+            issue: memberIssue,
+            reason,
+            detail: excerpt
+                ? `sched resume --batch: cap run ${capabilityId} reported task-failed on recheck: ${excerpt}`
+                : `sched resume --batch: cap run ${capabilityId} reported task-failed on recheck`,
+        });
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result);
+        return { outcome: 'evicted', capability: capabilityId, detail: excerpt };
+    }
+    journalEvent(deps, 'external-advance', unit(batchId), {
+        issue: memberIssue,
+        detail: `sched resume --batch: cap run ${capabilityId} reported ok on recheck`,
+    });
+    completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
+    return { outcome: 'completed', capability: capabilityId };
+}
 /**
  * Record one member dispatch's tokens/cost to `runs.jsonl` (#564) — the
  * `batch-dispatch.ts` analogue of `engine.ts`'s `recordDispatchRunLog`.
@@ -989,7 +1230,25 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     const milestone = deps.groundTruth.latestMilestone(memberIssue);
     if (milestone === undefined)
         return; // unreachable — pause this batch's decisions
-    if ((0, groundtruth_1.isMemberComplete)(milestone)) {
+    // #575: fence to THIS member dispatch's `spawned_at` — a member re-added to
+    // a fresh batch run after a PREVIOUS batch already posted its
+    // `review done mode=slot` milestone (pilot re-run, requeue-with-context)
+    // must not read as instantly complete against that stale milestone. Mirrors
+    // the per-issue fence in `engine.ts`'s `reconcileRunning`/
+    // `completeUnitOrRecover` — same bug class, same fix, different completion
+    // predicate (`isMemberComplete` vs `isVerifiedComplete`).
+    if (milestone !== null &&
+        !(0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at) &&
+        (0, groundtruth_1.isMemberComplete)(milestone)) {
+        journalEvent(deps, 'stale-milestone-ignored', unit(batchId), {
+            issue: memberIssue,
+            slot: slot.id,
+            run: milestone.run,
+            at: milestone.at,
+            detail: `predates dispatch spawned_at=${slot.spawned_at}`,
+        });
+    }
+    if ((0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at)) {
         deps.journal.append((0, journal_1.unitEvent)('external-advance', unit(batchId), {
             issue: memberIssue,
             detail: 'member review done',
@@ -998,46 +1257,15 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // incremental gate below decides — record its telemetry once here (#564)
         // rather than at each of this branch's two later exit points.
         recordMemberRunLog(deps, dispatch, state0, batchId, batch, memberIssue, slot, now);
-        // Incremental gate (#523 AC2): typecheck + focused tests via `cap run`,
-        // when the repo has a manifest for them — a second, independent check
-        // that the member's own self-reported "done" is real, matching this
-        // codebase's "never trust a claimed completion" ethos (AC2/#464's
-        // `isVerifiedComplete`). `task-failed` evicts the member directly, same
-        // rail as a self-reported block (RFC F.1) — no aggregate suite has run
-        // yet, so there is nothing to attribute.
-        if (batch.worktree !== null && deps.runCapability) {
-            const gateFailure = ['typecheck.run', 'test.focused']
-                .map((id) => ({ id, outcome: deps.runCapability?.(batch.worktree, id) }))
-                .find((r) => r.outcome === 'task-failed');
-            if (gateFailure) {
-                const reason = `incremental-gate-failed:${gateFailure.id}`;
-                journalEvent(deps, 'unit-failed', unit(batchId), {
-                    issue: memberIssue,
-                    reason,
-                    detail: `cap run ${gateFailure.id} reported task-failed after member review done`,
-                });
-                deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-                evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result);
-                return;
-            }
-            // `ok` / `automation-broken` / `capability-unavailable` all proceed —
-            // only a definite task failure blocks a member here.
+        // Incremental gate (#523 AC2, revised #583) — see `runIncrementalGate`'s
+        // own doc comment for the three-way policy. A `true` return means the
+        // gate already decided the member's fate (evicted or blocked) and
+        // returned early; `false` means both checks were `ok` and the member is
+        // genuinely done.
+        if (runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue, now, result)) {
+            return;
         }
-        // The commit-range recompute (`git log`) is a blocking subprocess call —
-        // it must run OUTSIDE the lock, like every other exec in this module;
-        // the result then lands as a pure data patch under the lock (Convention
-        // review: `recordRanges` used to run `git log` INSIDE the withLock
-        // mutator, which is exactly what `engine.ts`'s own "a slow git call never
-        // holds the lock" invariant exists to prevent).
-        const ranges = (0, attribution_1.memberRanges)(boundaryCommits(deps, batch));
-        deps.store.withLock((s) => {
-            let n = releaseSlot(s, batchId, now);
-            n = (0, state_1.patchBatch)(n, batchId, { ranges }, now);
-            n = advanceMemberToValidated(n, memberIssue, now);
-            return { state: n, result: undefined };
-        });
-        result.completed.push(unit(batchId));
-        advanceMemberOrValidate(deps, config, dispatch, batchId, batch.members.length, batch.executing_member, memberIssue, now, result);
+        completeMemberGate(deps, config, dispatch, batchId, batch, memberIssue, now, result);
         return;
     }
     if ((0, groundtruth_1.isMemberBlocked)(milestone) || dead) {