@ai-dossier/sched 0.22.1 → 0.23.0

package/README.md

@@ -99,7 +99,8 @@ where every mechanical supervision decision is code, not remembered prose:
    An unverified exit rides the recovery ladder like a stall. A `report done` milestone
    must also postdate the slot's own `spawned_at` (±60s clock-skew tolerance, #575) — a
    re-enqueued issue's PREVIOUS run's report milestone is ignored (journaled
-   `stale-milestone-ignored`) rather than instantly completing a freshly-spawned agent on
+   `stale-milestone-ignored`, at most once per dispatch since #610) rather than instantly
+   completing a freshly-spawned agent on
    its first reconcile tick; a legacy slot with no `spawned_at` degrades to the old,
    unfenced check. Batch members get the same fence on their own completion signal
    (`isMemberComplete`, `phase=review status=done mode=slot`).
@@ -115,7 +116,18 @@ where every mechanical supervision decision is code, not remembered prose:
    pre-resolves every tier once per tick, so a mixed-CLI ladder rescues on a different
    agent CLI, not just a different `--model` flag on the same one. Cap 2
    escalations — or a stall at the strongest tier — fails the unit and blocks its
-   TRANSITIVE dependents (`dep-failed:<issue>`). The timeout is **phase-aware** (#495):
+   TRANSITIVE dependents (`dep-failed:<issue>`). One exception (#596): before failing
+   terminally for an UNVERIFIED EXIT (never a stall — a hung agent never had the chance
+   to open anything), the engine asks ground truth whether the slot's branch already
+   carries an open PR the milestone trail never recorded
+   (`GroundTruth.openPrForBranch` → `gh pr list --head <branch> --state open`). A
+   confirmed number parks the unit instead and the watcher owns it from there. It fails
+   closed: a report slot (no branch of its own), an unknown branch, an unusable payload
+   or an unreachable lookup all take the terminal path — only a confirmed PR the fleet
+   itself opened parks. Which of those it was is recorded on the `unit-failed` entry as
+   `pr_check=none|unreachable|no-branch`, so "we checked, there was nothing" is
+   distinguishable from "`gh` was down and we wrote off a unit whose PR may have been
+   mergeable" — the ambiguity that stranded imboard-monorepo#3999. The timeout is **phase-aware** (#495):
    the `implement` phase alone can run 1-3h on a large monorepo with zero intermediate
    milestone or pushed commit, so it gets a longer built-in default (90 min,
    `DEFAULT_PHASE_STALL_TIMEOUT_MS`) than every other phase's 30-min default — selected by
@@ -229,6 +241,17 @@ Two engine-safety policies were explicit product decisions on #464:
   milestone. The rejection is journaled as `stale-milestone-ignored`; `spawned_at=null`
   (a legacy slot) degrades to the old, unfenced check.
 
+  #610: the event is emitted at most ONCE PER DISPATCH, on both rails. The decision is
+  stamped on `SlotEntry.stale_milestone_ignored_for` and compared against `spawned_at`
+  itself, so a redispatch's new `spawned_at` re-arms it for free — no reset at any spawn
+  site. Previously it re-fired every reconcile tick for as long as the stale milestone
+  stayed latest (~20 identical lines for a 40-minute unit, each forwarded to Telegram by
+  `tick.sh`, burying the events an operator is actually watching for). The entry's `at`
+  is the time the ENGINE made the decision and `milestone_at` is the ignored milestone's
+  own timestamp — one vocabulary for both emitters (`journalStaleMilestoneIfIgnored` in
+  `engine.ts`, `reconcileMemberSlot` in `batch-dispatch.ts`), so nothing reading
+  `events.jsonl` has to know which rail produced a line to know what `at` means.
+
 This applies to `issue:<n>` unit dispatch (`dispatchAssignments`). `batch:<id>` units run
 through a separate pass with its own claim/reconcile logic — see
 [Batch dispatch (#523)](#batch-dispatch-523) below.
@@ -337,7 +360,12 @@ awaiting-merge (CONFLICTING | auto-merge-blocked)
    [Batch dispatch (#523)](#batch-dispatch-523) — appends to `evictions[]`) is a no-op
    for a repeat issue and journals `eviction-duplicate` instead; the repeat requeue is
    skipped with it, so a second call cannot overwrite the first eviction's
-   `failure_evidence` or kill a live re-dispatch of that member. **Read
+   `failure_evidence` or kill a live re-dispatch of that member. Since #613 the duplicate
+   is a no-op for the CALLER too, not just for the append: `evictMemberDirectly` returns
+   `{ dissolved, duplicate }` and, on `duplicate: true`, `evictMemberAndContinue` journals
+   no `unit-failed` and does not advance the batch — record and journal share one
+   lock-protected claim, so they can never disagree about which member the batch advanced
+   past. **Read
    `docs/agent-traps.md` before "fixing" the dissolve rule:** the dissolve trigger has
    counted DISTINCT member ids since #572 (`evictedMemberIds`) and was never inflatable
    by a duplicate. What a duplicate did inflate is the raw `evictions[]` array itself —
@@ -371,8 +399,9 @@ awaiting-merge (CONFLICTING | auto-merge-blocked)
 
 Thirteen journal events carry the detail: `suite-failed`, `attributed`, `fix-dispatched`,
 `fix-resolved`, `member-evicted`, `eviction-duplicate` (#595 — a second eviction call
-named a member already in `evictions[]`; the append and the requeue are both no-ops and
-the attempt is journaled rather than dropped), `revert-conflict`, `batch-rebased`,
+named a member already in `evictions[]`; the append, the requeue, the caller's own
+`unit-failed` and the batch advance are ALL no-ops — since #613 the duplicate claim is the
+single gate on all four — and the attempt is journaled rather than dropped), `revert-conflict`, `batch-rebased`,
 `batch-dissolved`,
 `batch-preserved` (#563 — the dissolve threshold was crossed but the survivors' re-run
 suite came back green, so the batch ships them instead of dissolving), `batch-blocked`
@@ -549,6 +578,15 @@ never stored it on the entry, so this also retroactively covers the #562 case).
 states migrate on load: no gate has ever produced a non-`ok` verdict, and no batch has
 ever been blocked, under them, so `{}`/`null` is the exact backfill, not a guess.
 
+Schema 1.12.0 (#610): `SlotEntry` gains `stale_milestone_ignored_for` (ISO string or
+null — the `spawned_at` already covered by a `stale-milestone-ignored` journal entry, so
+the event fires once per dispatch rather than once per reconcile tick). Held as the
+timestamp rather than a boolean: a fresh dispatch stamps a NEW `spawned_at`, so the
+marker goes stale automatically and needs no explicit reset at any spawn site. 1.11.0
+states migrate on load, backfilling `null` — nothing was ever recorded per-dispatch
+under the old once-per-tick behavior, so null is exact, not a guess. Resets with the
+slot on release (`CLEARED_SLOT_FIELDS`).
+
 New journal events: `batch-setup-done`, `batch-setup-failed`, `member-advanced`,
 `batch-warmup-done`, `batch-warmup-failed` (#561 — the cold-path warm step only; a pool
 claim emits neither). `gate-inconclusive` (#583 — the incremental gate came back
@@ -556,7 +594,12 @@ claim emits neither). `gate-inconclusive` (#583 — the incremental gate came ba
 sits alongside `batch-blocked` as the per-member analogue of the aggregate suite's
 "block, don't dissolve" precedent; #594 routes an unevidenced `task-failed` here too).
 `eviction-duplicate` (#595 — `evictMemberDirectly` and `evictMembers` both emit it when
-asked to evict a member already in `evictions[]`). Member/tail/report/fix-agent spawn, progress,
+asked to evict a member already in `evictions[]`; since #613 it also suppresses the caller's
+`unit-failed`/`member-advanced` pair and the member advance, so the pair is emitted exactly
+once per member and names the member the batch is advancing FROM) and
+`member-advance-skipped` (#613 — a resolution that lost the one-shot claim on
+`executing_member` and so advanced nothing; journaled rather than dropped, so a batch that
+stops advancing never does so silently). Member/tail/report/fix-agent spawn, progress,
 completion and park events reuse the existing unit-generic names (`assigned`/`spawned`/`unit-failed`/
 `external-advance`/`pr-parked`/`merge-accepted`/`report-dispatched`/`teardown-done`/
 `teardown-failed`) with `unit = batch:<id>`.
@@ -617,6 +660,7 @@ import {
   isParkedMilestone,     // ship-phase awaiting-merge + pr= → the park signal
   prOfMilestone,         // a milestone's pr= key as a positive integer
   parsePrViewJson,       // gh pr view --json → PR truth (mergedAt/mergeable/blocked label)
+  parseOpenPrListJson,   // gh pr list --head <b> --state open → the open PR we opened (#596)
   parseSetupInfo,        // gh issue view --json comments → teardown inputs
   runTeardown,           // #468 script teardown for a merged unit (pool return / worktree remove)
   isSafeWorktree,        // worktree-path containment check (CWE-22)
@@ -657,9 +701,13 @@ import {
   Journal,               // append-only events.jsonl
   appendJsonl,           // the shared mkdir+append+swallow JSONL write
   transitionIssue, transitionBatch, transitionSlot,  // typed §D transitions
+  patchSlot, patchBatch, // §D.3 METADATA patches without a status change — `id`/`status`
+                         //   excluded (and stripped at runtime): status goes through the
+                         //   typed rails above. patchSlot moved out of engine.ts in #610
+                         //   so batch-dispatch.ts can share it.
   TRANSITIONS,           // the transition tables themselves (for previews)
   buildStatusReport,     // machine-readable status incl. blocked/failed sets
-  validateState,         // strict persisted-state validation (1.0.0-1.9.0 files migrate)
+  validateState,         // strict persisted-state validation (1.0.0-1.11.0 files migrate)
   DEFAULT_ISSUE_PRIORITY, DEFAULT_BATCH_PRIORITY, // priority defaults (0 / 10, #565)
   IllegalTransitionError, EnqueueError, CorruptStateError, LockTimeoutError,
   SchedNotFoundError,
@@ -744,8 +792,16 @@ attributes to a concrete cause (e.g. `Monitor`) without opening the transcript.
 non-terminal `verify-incomplete` event on every unverified exit and, once the escalation
 ladder is exhausted, the terminal `unit-failed` (`agent-exited-unverified` /
 `unverified-exit-at-strongest-tier`) as `last_tool`; a stall-timeout kill carries it too. Only
-the dead-pid detection rail and the stall kill record a fresh log slice in the same tick —
-a slot already `exited`/`verifying` when reconciled again has none to attribute.
+the dead-pid detection rail and the stall kill RECORD a fresh log slice (a `runs.jsonl`
+entry) in the same tick — `recordDispatchRunLog` is once-per-dispatch and refuses to
+append a second entry over the same slice. Since #620 a slot already `exited`/`verifying`
+when reconciled again still ATTRIBUTES one: `readLastToolForSlot` re-parses the same
+static slice for the tool name alone, writing nothing, so it carries no exactly-once
+constraint. That matters because the verify decision lands on a LATER tick than the
+dead-pid detection whenever ground truth was unreachable in between — previously the
+tool name was simply lost on exactly the runs hardest to diagnose. The read is deferred
+behind a thunk so only the tick that reaches the unverified-exit decision pays for it,
+never the ticks that return early on an outage.
 
 The dispatch log (`runs/<unit>.log`) is per-UNIT and opened in append mode
 (`createSpawnDeps`), so a redispatched unit's second agent writes its output AFTER the
@@ -815,14 +871,16 @@ after-the-fact recovery, not a missing-data bug.
   queue data.
 - **Schema**: state/config files from #460 (schema 1.0.0), #464 (1.1.0), #468 (1.2.0),
   #472 (1.3.0), #500 (1.4.0), #505 (1.5.0), #504 (1.6.0), #523 (1.7.0) and #524 (1.8.0)
-  load and migrate to 1.9.0 automatically (slot `branch`/`last_head`/`pid_start`, slot `role` (inferred from the
+  load and migrate to 1.12.0 automatically (slot `branch`/`last_head`/`pid_start`, slot `role` (inferred from the
   unit's queue entry, with the persisted `phase` as a fallback — #500), entry
   `pr`/`cleanup`/`failure_evidence`, batch `anchor`/`branch`/`run_id`/`eviction_groups`/
   `evictions`/`fix_attempts`/`rebase_attempts`, state-level `last_pr_poll_at` backfill to
   null, state-level `consecutive_suspect_dispatches`/`last_suspect_dispatch_unit`
   backfill to `0`/`null` — #505, slot `gen`/`fenced_at` backfill to `0`/`null` — #504, and
-  slot `spawned_at`/`log_offset_at_spawn` backfill to `null`/`null` — #524, and
-  state-level `last_label_poll_at` backfill to `null` — #544).
+  slot `spawned_at`/`log_offset_at_spawn` backfill to `null`/`null` — #524,
+  state-level `last_label_poll_at` backfill to `null` — #544, entry `priority` and batch
+  `member_gates`/`blocked_reason` — #565/#583, and slot
+  `stale_milestone_ignored_for` backfill to `null` — #610).
 - **`max_slots`** bounds live units (`assigned | running | recovering`); dependency
   edges gate readiness — an issue with an unmerged dependency, and a batch behind an
   unmerged batch, are never runnable.
@@ -891,6 +949,14 @@ prompt instructs it) and exit. The engine owns everything after the park:
    phase's `awaiting-merge` (with `pr=`) is a VERIFIED park, not an unverified
    exit: the entry moves to `parked`, the slot is released (a waiting unit
    consumes zero slots), and the watcher takes over.
+1b. **Recovery-adopted park (#596)** — a unit about to fail TERMINALLY for an
+   unverified exit, whose branch ground truth reports an open PR, parks on
+   that PR instead of dying as `unverified-exit-at-strongest-tier`. The
+   `pr-parked` event carries `detail: "unverified-exit-recovered-open-pr"`
+   and the `branch` the PR was found on, so a milestone-verified park (no
+   `detail`) and a recovery-adopted one are distinguishable in
+   `events.jsonl` without cross-referencing the ladder. Report slots are
+   excluded — a report agent has no branch of its own.
 2. **PR watching (AC1)** — parked PRs are polled every `pr_poll_interval_ms`
    (default 150 s — "every 2–3 min", persisted `last_pr_poll_at` so a restart
    honors the cadence; checked on each reconcile tick when due, so a
@@ -947,7 +1013,8 @@ prompt instructs it) and exit. The engine owns everything after the park:
 
 `sched status` shows parked PRs (zero slots, with the last poll's age), a
 `pr` column and a `cleanup` column on the queue; every watcher decision lands
-in `events.jsonl` (`pr-parked`, `merge-accepted`, `pr-watch-failed`,
+in `events.jsonl` (`pr-parked` — two paths, see 1 and 1b above,
+`merge-accepted`, `pr-watch-failed`,
 `pr-watch-waiting`, `teardown-done`/`teardown-failed`, `report-dispatched`,
 `report-failed`, `ground-truth-unreachable`, `stale-failure-reconciled`).
 

package/dist/batch-dispatch.d.ts

@@ -67,7 +67,7 @@ import type { SchedStore } from './persist';
 import type { ExecFn } from './project';
 import { type SuiteResult } from './recovery';
 import { type FsExists } from './teardown';
-import type { CapabilityGateResult, SchedConfig } from './types';
+import type { BatchEntry, CapabilityGateResult, SchedConfig } from './types';
 export type { CapOutcome } from './types';
 /** Everything batch dispatch needs from the outside world. */
 export interface BatchDispatchDeps {
@@ -128,6 +128,44 @@ export interface BatchTickResult {
     /** Issue numbers requeued full-cycle by a dissolve — matches `TickResult.blocked`'s shape. */
     blocked: number[];
 }
+/**
+ * Why a member is being evicted: the `reason` recorded in `evictions[]` and the operator-
+ * facing `detail`/`extraKv` journaled alongside it. One object rather than three adjacent
+ * positional arguments — `reason` and `detail` are both strings, and transposing them
+ * compiles cleanly while writing a prose sentence into the eviction record's `reason`,
+ * corrupting exactly the field #613 exists to keep trustworthy.
+ */
+export interface MemberFailure {
+    reason: string;
+    detail: string;
+    extraKv?: Record<string, string>;
+}
+/**
+ * Evict the current member and either dissolve, or continue the batch via
+ * `advanceMemberOrValidate` — the shared tail of both member-failure rails
+ * (self-reported blocked, and the incremental gate below).
+ *
+ * #613: `evictMemberDirectly`'s duplicate check (#595) is the one atomic,
+ * lock-protected claim on "did THIS member's eviction already happen" — so
+ * the `unit-failed` journal is emitted inside `evictMemberDirectly`, the
+ * moment that claim succeeds and BEFORE the dissolve that claim may trigger,
+ * rather than by each caller before it ever calls this function. A caller
+ * that journaled `unit-failed` unconditionally, before the claim, could fire
+ * it twice for one member (and once for the next member never at all) under
+ * a duplicate/re-entrant resolve — the record and the journal must share the
+ * same gate or they can disagree about which member the batch is advancing
+ * past. Emitting it inside also keeps cause before effect in the journal and
+ * survives a kill during the dissolve's shell-outs, which would otherwise
+ * leave the eviction record on disk with no line saying why.
+ *
+ * Exported (not part of the package's `index.ts` public surface — imported
+ * directly by `batch-integration.test.ts`) so #613's regression test can
+ * call it twice with one stale `BatchEntry` snapshot: the exact "another
+ * resolution already claimed this member" condition, which the public
+ * `runBatchTick`/`resumeBlockedGate` entry points cannot reproduce since
+ * both always read state fresh.
+ */
+export declare function evictMemberAndContinue(deps: BatchDispatchDeps, config: SchedConfig, dispatch: ResolvedDispatch, batchId: string, batch: BatchEntry, memberIssue: number, failure: MemberFailure, now: Date, result: BatchTickResult): void;
 /**
  * `sched resume --batch <id>` (#583 AC4): an operator-triggered, synchronous
  * one-shot recheck of a batch blocked on `gate-inconclusive:<capabilityId>`

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAmBH,OAAO,EAUL,KAAK,gBAAgB,EAErB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,WAAW,EAOjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAgBpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAGV,oBAAoB,EAIpB,WAAW,EAIZ,MAAM,SAAS,CAAC;AAWjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAgyCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2GA;AAqhBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CA2GjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAmBH,OAAO,EAUL,KAAK,gBAAgB,EAErB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,WAAW,EAOjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAiBpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EAKpB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAWjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AA6oCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CAyBN;AA0KD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAyGA;AA8kBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CA2GjB"}

package/dist/batch-dispatch.js

@@ -95,6 +95,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.evictMemberAndContinue = evictMemberAndContinue;
 exports.resumeBlockedGate = resumeBlockedGate;
 exports.runBatchTick = runBatchTick;
 const fs = __importStar(require("node:fs"));
@@ -942,34 +943,67 @@ function evictOffender(deps, config, batchId, offender, attribution, now, result
         });
     }
 }
-// --- Reconcile a batch currently holding a live/exited slot ---
 /**
- * After a member leaves `executing` (green, gate-failed, or self-blocked):
- * advance to the next member, or — on the last member — transition to
- * `validating` and run the aggregate suite. Shared by every exit from
- * `reconcileMemberSlot` so the pointer-advance rail exists once.
+ * The one-shot claim on resolving `currentMember` (#613). Transitions the batch only while
+ * it is still `executing` on exactly that member; `false` means another call already
+ * claimed it (a duplicate dispatch of the same eviction/completion, or a re-entrant tick)
+ * and this caller must journal nothing and spawn nothing. Advancing anyway would validate a
+ * batch that already validated, or skip past a member that has not run at all — which is
+ * precisely how one member's eviction record ends up naming the member the batch already
+ * advanced past while the next member gets no record.
+ *
+ * Written once and called from both arms so the two can never drift apart: they are the
+ * same claim, differing only in what they transition to.
  */
+function claimMemberResolution(deps, batchId, currentMember, now, next) {
+    return deps.store.withLock((s) => {
+        const b = (0, state_1.findBatch)(s, batchId);
+        if (!b || b.status !== 'executing' || b.executing_member !== currentMember) {
+            return {
+                state: s,
+                result: {
+                    claimed: false,
+                    observed: b?.executing_member ?? null,
+                    status: b?.status ?? null,
+                },
+            };
+        }
+        const { to, patch } = next(b);
+        return {
+            state: (0, state_1.transitionBatch)(s, batchId, to, patch, now),
+            result: { claimed: true, observed: b.executing_member, status: b.status },
+        };
+    });
+}
+/** Journal a lost claim so a batch that stops advancing never does so silently (#613). */
+function journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim) {
+    journalEvent(deps, 'member-advance-skipped', unit(batchId), {
+        issue: memberIssue,
+        detail: `another resolution already advanced past member ${currentMember} (batch is now executing_member=${claim.observed ?? 'gone'}, status=${claim.status ?? 'gone'}) — no second member-advanced and no second continuation`,
+    });
+}
 function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, currentMember, memberIssue, now, result) {
     const isLast = currentMember >= memberCount;
     if (isLast) {
-        deps.store.withLock((s) => {
-            const b = (0, state_1.findBatch)(s, batchId);
-            if (!b || b.status !== 'executing')
-                return { state: s, result: undefined };
-            return { state: (0, state_1.transitionBatch)(s, batchId, 'validating', {}, now), result: undefined };
-        });
+        const claim = claimMemberResolution(deps, batchId, currentMember, now, () => ({
+            to: 'validating',
+            patch: {},
+        }));
+        if (!claim.claimed) {
+            journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim);
+            return;
+        }
         runValidate(deps, config, dispatch, batchId, now, result);
         return;
     }
-    deps.store.withLock((s) => {
-        const b = (0, state_1.findBatch)(s, batchId);
-        if (!b || b.status !== 'executing')
-            return { state: s, result: undefined };
-        return {
-            state: (0, state_1.transitionBatch)(s, batchId, 'executing', { executing_member: b.executing_member + 1 }, now),
-            result: undefined,
-        };
-    });
+    const claim = claimMemberResolution(deps, batchId, currentMember, now, (b) => ({
+        to: 'executing',
+        patch: { executing_member: b.executing_member + 1 },
+    }));
+    if (!claim.claimed) {
+        journalAdvanceSkipped(deps, batchId, memberIssue, currentMember, claim);
+        return;
+    }
     journalEvent(deps, 'member-advanced', unit(batchId), { issue: memberIssue });
     spawnMemberContinuation(deps, config, dispatch, batchId, now, result);
 }
@@ -977,9 +1011,31 @@ function advanceMemberOrValidate(deps, config, dispatch, batchId, memberCount, c
  * Evict the current member and either dissolve, or continue the batch via
  * `advanceMemberOrValidate` — the shared tail of both member-failure rails
  * (self-reported blocked, and the incremental gate below).
+ *
+ * #613: `evictMemberDirectly`'s duplicate check (#595) is the one atomic,
+ * lock-protected claim on "did THIS member's eviction already happen" — so
+ * the `unit-failed` journal is emitted inside `evictMemberDirectly`, the
+ * moment that claim succeeds and BEFORE the dissolve that claim may trigger,
+ * rather than by each caller before it ever calls this function. A caller
+ * that journaled `unit-failed` unconditionally, before the claim, could fire
+ * it twice for one member (and once for the next member never at all) under
+ * a duplicate/re-entrant resolve — the record and the journal must share the
+ * same gate or they can disagree about which member the batch is advancing
+ * past. Emitting it inside also keeps cause before effect in the journal and
+ * survives a kill during the dissolve's shell-outs, which would otherwise
+ * leave the eviction record on disk with no line saying why.
+ *
+ * Exported (not part of the package's `index.ts` public surface — imported
+ * directly by `batch-integration.test.ts`) so #613's regression test can
+ * call it twice with one stale `BatchEntry` snapshot: the exact "another
+ * resolution already claimed this member" condition, which the public
+ * `runBatchTick`/`resumeBlockedGate` entry points cannot reproduce since
+ * both always read state fresh.
  */
-function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result) {
-    const dissolved = evictMemberDirectly(deps, config, batchId, memberIssue, reason, now);
+function evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, failure, now, result) {
+    const { dissolved, duplicate } = evictMemberDirectly(deps, config, batchId, memberIssue, failure, now);
+    if (duplicate)
+        return;
     if (dissolved) {
         result.failed.push(unit(batchId));
         return;
@@ -1040,13 +1096,11 @@ function runIncrementalGate(deps, config, dispatch, batchId, batch, memberIssue,
         const reason = `incremental-gate-failed:${earnedFailure.id}`;
         writeGateLog(deps, batchId, earnedFailure.id, memberIssue, earnedFailure.outputTail);
         const excerpt = gateDetailExcerpt(earnedFailure.outputTail, earnedFailure.reason);
-        journalEvent(deps, 'unit-failed', unit(batchId), {
-            issue: memberIssue,
+        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
             reason,
             detail: withExcerpt(`cap run ${earnedFailure.id} reported task-failed with failing-test evidence after member review done`, excerpt),
-        });
-        deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result);
+        }, now, result);
         return true;
     }
     const inconclusive = gateInconclusive ?? unevidencedFailure;
@@ -1188,12 +1242,10 @@ function resumeBlockedGate(deps, config, dispatch, batchId, now) {
     if (recheck.outcome === 'task-failed') {
         const reason = `incremental-gate-failed:${capabilityId}`;
         writeGateLog(deps, batchId, capabilityId, memberIssue, recheck.outputTail);
-        journalEvent(deps, 'unit-failed', unit(batchId), {
-            issue: memberIssue,
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
             reason,
             detail: withExcerpt(`sched resume --batch: cap run ${capabilityId} reported task-failed on recheck`, excerpt),
-        });
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result);
+        }, now, result);
         return { outcome: 'evicted', capability: capabilityId, detail: excerpt };
     }
     journalEvent(deps, 'external-advance', unit(batchId), {
@@ -1279,14 +1331,27 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
     const staleTerminal = milestone !== null &&
         (((0, groundtruth_1.isMemberComplete)(milestone) && !(0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at)) ||
             ((0, groundtruth_1.isMemberBlocked)(milestone) && !(0, groundtruth_1.isMemberBlocked)(milestone, slot.spawned_at)));
-    if (staleTerminal) {
+    // #610: this dispatch's own spawned_at IS the fence value the two
+    // predicates above already key on — reusing it here as the "already
+    // journalled" marker means a fresh dispatch (new spawned_at) invalidates
+    // the marker for free, with no reset needed at any spawn site. Without the
+    // gate this re-fired every tick for as long as the stale milestone stayed
+    // latest — once every reconcile interval for the member's whole run.
+    if (staleTerminal && slot.stale_milestone_ignored_for !== slot.spawned_at) {
         journalEvent(deps, 'stale-milestone-ignored', unit(batchId), {
             issue: memberIssue,
             slot: slot.id,
             run: milestone.run,
-            at: milestone.at,
+            // The engine's OWN decision time — `milestone.at` is kept separately so
+            // an operator can still see how old the stale milestone actually is.
+            at: now.toISOString(),
+            milestone_at: milestone.at,
             detail: `${milestone.status === 'blocked' ? 'blocked' : 'complete'} milestone predates dispatch spawned_at=${slot.spawned_at}`,
         });
+        deps.store.withLock((s) => ({
+            state: (0, state_1.patchSlot)(s, slot.id, { stale_milestone_ignored_for: slot.spawned_at }, now),
+            result: undefined,
+        }));
     }
     if ((0, groundtruth_1.isMemberComplete)(milestone, slot.spawned_at)) {
         deps.journal.append((0, journal_1.unitEvent)('external-advance', unit(batchId), {
@@ -1323,17 +1388,6 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
                 ? 'agent-exited-unverified'
                 : 'member-blocked';
         const lastTool = recordMemberRunLog(deps, dispatch, state0, batchId, batch, memberIssue, slot, now);
-        journalEvent(deps, 'unit-failed', unit(batchId), {
-            issue: memberIssue,
-            reason,
-            detail: 'member blocked',
-            // #591: attributes an unverified member exit to a concrete cause (e.g.
-            // `Monitor`) without opening the transcript. Gated on the RESOLVED reason, not
-            // `dead` — a member can be simultaneously `dead` AND carry a milestone-posted
-            // `reason` (it posted `blocked` and then exited), and that real block has no
-            // log-derived cause to attribute; only `agent-exited-unverified` does.
-            ...(reason === 'agent-exited-unverified' && lastTool !== null ? { last_tool: lastTool } : {}),
-        });
         deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
         // A member that never went green (RFC F.1) evicts DIRECTLY — no aggregate
         // suite has run yet, so there is nothing for `attributing`/`evicting` (the
@@ -1343,7 +1397,23 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
         // attributing → evicting` is not even a legal edge from mid-`executing`
         // (BATCH_TRANSITIONS has no `executing → evicting`) — this stays entirely
         // within `executing`/`dissolving`, both of which ARE legal from here.
-        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, reason, now, result);
+        evictMemberAndContinue(deps, config, dispatch, batchId, batch, memberIssue, {
+            reason,
+            // This rail covers a self-reported block AND a member that simply died, so the
+            // detail must follow the RESOLVED reason — `member blocked` on an
+            // `agent-exited-unverified` eviction contradicts the reason on its own journal line.
+            detail: reason === 'agent-exited-unverified'
+                ? 'member agent exited without posting a terminal milestone'
+                : 'member blocked',
+            // #591: attributes an unverified member exit to a concrete cause (e.g.
+            // `Monitor`) without opening the transcript. Gated on the RESOLVED reason, not
+            // `dead` — a member can be simultaneously `dead` AND carry a milestone-posted
+            // `reason` (it posted `blocked` and then exited), and that real block has no
+            // log-derived cause to attribute; only `agent-exited-unverified` does.
+            extraKv: reason === 'agent-exited-unverified' && lastTool !== null
+                ? { last_tool: lastTool }
+                : undefined,
+        }, now, result);
     }
 }
 /**
@@ -1359,20 +1429,34 @@ function reconcileMemberSlot(deps, config, dispatch, batchId, slot, now, result)
  * and the queue entry disagreeing about why the member was evicted — and, if
  * the member has since been re-dispatched full-cycle, would take the
  * `executing → evicted → requeued` rail and kill that live run.
+ *
+ * Returns `{ dissolved, duplicate }`: `dissolved` is whether this eviction tipped the batch
+ * past its threshold and the batch is gone; `duplicate: true` means another resolution had
+ * already claimed this member's eviction, and the caller must journal nothing and advance
+ * nothing on top of it (#613 — that is exactly how a record ends up naming the member the
+ * batch already advanced past).
  */
-function evictMemberDirectly(deps, config, batchId, memberIssue, reason, now) {
+function evictMemberDirectly(deps, config, batchId, memberIssue, failure, now) {
+    const { reason } = failure;
     const dissolvePolicy = (0, types_1.resolveDissolvePolicy)(config.dissolve_policy);
     // Pass 1 (pure — requeue + record the eviction): safe to run entirely
     // inside the lock, unlike `dissolveBatch` below, which shells out
     // (`deps.exec`/`postMilestone`) and so must NOT hold the lock while it runs.
-    const { triggered, duplicate } = deps.store.withLock((s) => {
+    const { triggered, duplicate, prior } = deps.store.withLock((s) => {
         const b = (0, state_1.findBatch)(s, batchId);
-        if (!b)
-            return { state: s, result: { triggered: false, duplicate: false } };
-        if (b.evictions.some((e) => e.issue === memberIssue)) {
+        if (!b) {
+            return { state: s, result: { triggered: false, duplicate: false, prior: undefined } };
+        }
+        const priorRecord = b.evictions.find((e) => e.issue === memberIssue);
+        if (priorRecord) {
+            // A duplicate never re-evaluates the dissolve threshold: the resolution that WROTE
+            // this record already did, under this same lock. (#595: a duplicate must not count
+            // twice; #613: it must not act on the batch at all.) Note this also means a dissolve
+            // interrupted between pass 1 and pass 2 is not retried here — re-entering
+            // `dissolveBatch` on an already-terminal batch throws `IllegalTransitionError`.
             return {
                 state: s,
-                result: { triggered: (0, recovery_1.checkDissolveTrigger)(b, dissolvePolicy), duplicate: true },
+                result: { triggered: false, duplicate: true, prior: priorRecord },
             };
         }
         const evidence = {
@@ -1404,24 +1488,42 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, reason, now) {
             result: {
                 triggered: updated !== undefined && (0, recovery_1.checkDissolveTrigger)(updated, dissolvePolicy),
                 duplicate: duplicateRecords.length > 0,
+                prior: undefined,
             },
         };
     });
     if (duplicate) {
         journalEvent(deps, 'eviction-duplicate', unit(batchId), {
             issue: memberIssue,
-            detail: (0, state_1.duplicateEvictionDetail)(memberIssue, reason),
+            detail: (0, state_1.duplicateEvictionDetail)(memberIssue, reason, prior),
         });
+        // Another resolution already claimed this member's eviction record — the
+        // caller must not journal its own `unit-failed`/advance the batch again
+        // on top of that one (#613: that is exactly how a record ends up naming
+        // the member the batch already advanced past).
+        return { dissolved: false, duplicate: true };
     }
+    // This call owns the member's resolution, so it owns recording WHY — before pass 2 below
+    // can dissolve, tear the worktree down, or be killed mid-shell-out and leave the eviction
+    // record on disk with no journal line naming its cause (#613). The caller's extras go
+    // first so the authoritative keys always win: `extraKv` is a wide Record, and a future
+    // caller passing `reason`/`detail`/`issue` must not be able to rewrite the record's own
+    // identity.
+    journalEvent(deps, 'unit-failed', unit(batchId), {
+        ...(failure.extraKv ?? {}),
+        issue: memberIssue,
+        reason,
+        detail: failure.detail,
+    });
     if (!triggered)
-        return false;
+        return { dissolved: false, duplicate: false };
     // Pass 2 (outside the lock — dissolveBatch shells out): re-load fresh
     // (pass 1's write already landed), dissolve, then re-apply just this
     // batch's + the requeued members' state under a fresh lock.
     const state = deps.store.load();
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch)
-        return false;
+        return { dissolved: false, duplicate: false };
     const rDeps = recoveryDeps(deps, config, batch, now);
     const outcome = (0, recovery_1.dissolveBatch)(state, batchId, { strategy: 'full', reason: 'eviction-threshold' }, rDeps);
     deps.store.withLock((s) => ({
@@ -1429,7 +1531,7 @@ function evictMemberDirectly(deps, config, batchId, memberIssue, reason, now) {
         result: undefined,
     }));
     teardownBatch(deps, batchId);
-    return true;
+    return { dissolved: true, duplicate: false };
 }
 function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     if (slot.pid !== null && deps.spawnDeps.isAlive(slot.pid, slot.pid_start ?? undefined))