@ai-dossier/sched 0.3.0 → 0.4.1

package/dist/recovery.js

@@ -0,0 +1,730 @@
+"use strict";
+/**
+ * Batch failure recovery (#472, RFC-0001 §F.2/F.8/F.9): what happens when the
+ * aggregate suite goes red or the batch PR will not merge.
+ *
+ * ```
+ * validating → attributing → fixing (ONE bounded attempt) → validating
+ *                          → evicting (revert the member's commits) → validating
+ *   > ⅓ evicted, or a revert conflict → dissolving → members requeued
+ * awaiting-merge (CONFLICTING | auto-merge-blocked)
+ *                          → rebasing → re-validating → shipping
+ *                          → (2nd occurrence) dissolving into two half-batches
+ * ```
+ *
+ * The rules this module exists to enforce:
+ *
+ * - **Nothing green is discarded.** Shipped and terminal members keep their
+ *   outcome through every eviction and dissolve; only active work requeues.
+ * - **One fix attempt per member.** A second red suite evicts — it never
+ *   re-dispatches, so a batch cannot burn its budget on one broken member.
+ * - **A revert is never left mid-conflict.** The conflicting revert is aborted
+ *   so the worktree is clean, but the reverts that already landed stay applied
+ *   — which is exactly why the batch dissolves and the branch is abandoned
+ *   rather than reused.
+ * - **The scheduler never calls an LLM.** `beginFixAttempt` returns the command
+ *   and prompt for the caller to spawn (dispatch.ts), exactly like #464.
+ *
+ * State transitions are the typed rails in state.ts; every effect (git, the
+ * suite runner, milestone posting, the journal) is injected, so the whole
+ * module is testable against scratch repos and fakes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createExecMilestonePoster = createExecMilestonePoster;
+exports.beginAttribution = beginAttribution;
+exports.beginFixAttempt = beginFixAttempt;
+exports.resolveFixAttempt = resolveFixAttempt;
+exports.expandEvictionGroups = expandEvictionGroups;
+exports.evictMembers = evictMembers;
+exports.checkDissolveTrigger = checkDissolveTrigger;
+exports.dissolveBatch = dissolveBatch;
+exports.handlePrConflict = handlePrConflict;
+const attribution_1 = require("./attribution");
+const bisect_1 = require("./bisect");
+const dispatch_1 = require("./dispatch");
+const journal_1 = require("./journal");
+const state_1 = require("./state");
+const types_1 = require("./types");
+/** Milestone values carry no spaces (the dossier rule) — collapse them to `-`. */
+function milestoneValue(value) {
+    return value.trim().replace(/\s+/g, '-');
+}
+/**
+ * The default poster: shells `ai-dossier runstate post`, which validates the
+ * phase/status/key contract and refuses a malformed milestone. Never throws —
+ * a failed post is journaled by the caller and degrades the audit trail, it
+ * does not fail the recovery.
+ */
+function createExecMilestonePoster(exec, opts = {}) {
+    const bin = opts.bin ?? 'ai-dossier';
+    return (anchor, run, milestone) => {
+        const args = [
+            'runstate',
+            'post',
+            '--issue',
+            String(anchor),
+            '--phase',
+            milestone.phase,
+            '--status',
+            milestone.status,
+            '--run',
+            run,
+        ];
+        for (const [key, value] of Object.entries(milestone.kv)) {
+            args.push('--kv', `${key}=${milestoneValue(value)}`);
+        }
+        return exec(bin, args, opts.repoDir) !== null;
+    };
+}
+function clock(deps) {
+    return deps.now ? deps.now() : new Date();
+}
+/**
+ * Re-run the aggregate suite, treating a runner that THROWS as a red suite.
+ *
+ * The re-run happens after `git revert` has already rewritten the branch, and
+ * an exception escaping here would discard the whole eviction — reverted
+ * commits on the branch, but a state file still calling the members healthy.
+ */
+function runSuite(deps, batchId, now) {
+    if (!deps.runSuite)
+        return null;
+    try {
+        return deps.runSuite();
+    }
+    catch (err) {
+        const detail = `suite runner threw: ${err.message}`;
+        journal(deps, (0, journal_1.unitEvent)('suite-failed', `batch:${batchId}`, { detail }), now);
+        return { ok: false, failing: [], detail };
+    }
+}
+function journal(deps, event, now) {
+    deps.journal?.append(event, now);
+}
+function batchOrThrow(state, batchId) {
+    const batch = (0, state_1.findBatch)(state, batchId);
+    if (!batch)
+        throw new types_1.SchedNotFoundError(`Batch not found: ${batchId}`);
+    return batch;
+}
+/**
+ * Run one git command, journaling it when it fails.
+ *
+ * `ExecFn` collapses every failure into `null` — a genuine merge conflict, a
+ * bad object, a missing binary and an expired lock all look identical. The
+ * decisions here (evict? dissolve?) hang off those nulls, so the command that
+ * produced one is always recorded; without it an operator sees a dissolve with
+ * no way to tell a conflict from a broken environment.
+ */
+function git(deps, args, batchId, now) {
+    const out = deps.exec('git', args, deps.repoDir);
+    if (out === null) {
+        journal(deps, (0, journal_1.unitEvent)('git-failed', `batch:${batchId}`, { detail: `git ${args.join(' ')}` }), now);
+    }
+    return out;
+}
+/**
+ * Post a milestone (AC5), or journal the one that could not be posted.
+ *
+ * A milestone is the operator's only record of an eviction or dissolve, so
+ * every path that fails to post one says so in the journal — including the
+ * "no anchor / no run id / no poster" skips, which are silent by construction
+ * otherwise. The journalled detail carries the full key set so the post can be
+ * reconstructed by hand.
+ */
+function post(deps, batch, milestone, now) {
+    const rendered = Object.entries(milestone.kv)
+        .map(([key, value]) => `${key}=${milestoneValue(value)}`)
+        .join(' ');
+    const describe = (why) => {
+        journal(deps, (0, journal_1.unitEvent)('milestone-post-failed', `batch:${batch.id}`, {
+            detail: `${milestone.phase} ${milestone.status} ${rendered} (${why})`,
+        }), now);
+    };
+    if (batch.anchor === null) {
+        describe('batch has no anchor issue to post to');
+        return false;
+    }
+    if (batch.run_id === null) {
+        describe('batch has no run id — runstate post requires one');
+        return false;
+    }
+    if (!deps.postMilestone) {
+        describe('no milestone poster configured');
+        return false;
+    }
+    const ok = deps.postMilestone(batch.anchor, batch.run_id, milestone);
+    if (!ok)
+        describe('runstate post failed');
+    return ok;
+}
+/**
+ * `validating → attributing`: map the red suite's failures onto members (AC1).
+ * Overlap first; `git bisect` only when overlap left something ambiguous or
+ * unattributed, and only ever to ADD an offender — a bisect that lands on a
+ * non-member commit reports `unattributable` and adds nobody.
+ */
+function beginAttribution(state, batchId, input, deps) {
+    const now = clock(deps);
+    const batch = batchOrThrow(state, batchId);
+    let next = state;
+    if (batch.status !== 'attributing') {
+        next = (0, state_1.transitionBatch)(next, batchId, 'attributing', {}, now);
+    }
+    journal(deps, (0, journal_1.unitEvent)('suite-failed', `batch:${batchId}`, {
+        // Zero failing tests reaching attribution is not "the suite passed" — it
+        // is a report nothing could be read out of, which looks identical to
+        // green unless the line says so.
+        detail: input.failing.length === 0
+            ? '0 failing — nothing to attribute (the suite report may be empty or unparseable)'
+            : `${input.failing.length} failing`,
+    }), now);
+    const overlap = (0, attribution_1.attributeByOverlap)(input.failing, input.footprints);
+    const attributed = new Map(overlap.attributed);
+    let bisect = null;
+    let method = attributed.size > 0 ? 'overlap' : 'none';
+    const needsBisect = overlap.ambiguous.length > 0 || overlap.unattributed.length > 0;
+    if (needsBisect && input.bisect) {
+        bisect = (0, bisect_1.runAttributionBisect)(deps.exec, {
+            repoDir: deps.repoDir,
+            good: input.bisect.good,
+            bad: input.bisect.bad,
+            testCommand: input.bisect.testCommand,
+            boundary: input.bisect.boundary,
+            onWarn: (detail) => journal(deps, (0, journal_1.unitEvent)('git-failed', `batch:${batchId}`, { detail }), now),
+        });
+        if (bisect.kind === 'first-bad') {
+            const unresolved = [...overlap.ambiguous.map((a) => a.test), ...overlap.unattributed];
+            attributed.set(bisect.issue, [...(attributed.get(bisect.issue) ?? []), ...unresolved]);
+            method = 'bisect';
+        }
+    }
+    const outcome = {
+        method,
+        offenders: (0, attribution_1.offendersOf)(attributed),
+        attributed,
+        ambiguous: overlap.ambiguous,
+        unattributed: overlap.unattributed,
+        bisect,
+    };
+    // `method=none offenders=none` is the state that precedes a blanket dissolve,
+    // so the line has to say WHY nothing was attributed — whether bisect was
+    // never asked for, errored, or landed on a non-member commit.
+    const bisectNote = bisect === null
+        ? needsBisect
+            ? 'bisect=not-requested'
+            : 'bisect=not-needed'
+        : `bisect=${bisect.kind}${'sha' in bisect ? `@${bisect.sha}` : ''}${'detail' in bisect ? ` (${bisect.detail})` : ''}`;
+    journal(deps, (0, journal_1.unitEvent)('attributed', `batch:${batchId}`, {
+        detail: `method=${outcome.method} offenders=${outcome.offenders.join(',') || 'none'} ` +
+            `ambiguous=${outcome.ambiguous.length} unattributed=${outcome.unattributed.length} ${bisectNote}`,
+    }), now);
+    return { state: next, outcome };
+}
+/**
+ * `attributing → fixing`: hand back the ONE bounded fix dispatch for a member
+ * (AC2). Returns `dispatch: null` when the member already had its attempt —
+ * the caller's next step is then `evictMembers`, never a second dispatch.
+ */
+function beginFixAttempt(state, batchId, issue, deps, opts = {}) {
+    const now = clock(deps);
+    const batch = batchOrThrow(state, batchId);
+    const attempts = batch.fix_attempts.filter((a) => a.issue === issue).length;
+    if (attempts >= types_1.MAX_FIX_ATTEMPTS_PER_MEMBER) {
+        // Journaled, not silent: otherwise the trail shows one `fix-dispatched`
+        // and then a `member-evicted` with nothing explaining why no second fix
+        // was tried.
+        journal(deps, (0, journal_1.unitEvent)('fix-resolved', `batch:${batchId}`, {
+            issue,
+            detail: `refused: ${attempts}/${types_1.MAX_FIX_ATTEMPTS_PER_MEMBER} attempts already used — next step is eviction`,
+        }), now);
+        return { state, dispatch: null };
+    }
+    const tier = types_1.FIX_ATTEMPT_TIER;
+    // `max_slots` is irrelevant here — only the command/prompt/tier-model parts
+    // of the resolved dispatch are used — but SchedConfig requires it.
+    const resolved = (0, dispatch_1.resolveDispatch)(opts.config ?? { max_slots: types_1.DEFAULT_MAX_SLOTS });
+    const dispatch = {
+        issue,
+        tier,
+        command: (0, dispatch_1.buildAgentCommand)(resolved.command, tier, issue, {
+            ...dispatch_1.DEFAULT_TIER_MODELS,
+            ...resolved.tierModels,
+        }),
+        prompt: (0, dispatch_1.buildFixPrompt)(resolved.fixPrompt, issue, batchId, (opts.tests ?? []).map((t) => t.id)),
+    };
+    const record = { issue, tier, outcome: 'dispatched', at: now.toISOString() };
+    let next = state;
+    if (batch.status !== 'fixing') {
+        next = (0, state_1.transitionBatch)(next, batchId, 'fixing', {}, now);
+    }
+    next = (0, state_1.patchBatch)(next, batchId, { fix_attempts: [...batch.fix_attempts, record] }, now);
+    journal(deps, (0, journal_1.unitEvent)('fix-dispatched', `batch:${batchId}`, { issue, tier }), now);
+    return { state: next, dispatch };
+}
+/**
+ * `fixing → validating`: record how the fix attempt ended and return the batch
+ * to validation, where the suite re-run decides what happens next (AC2). A
+ * `red` outcome does NOT evict here — the caller re-runs the suite and calls
+ * `evictMembers` if it is still failing, so eviction is always driven by
+ * evidence rather than by the fix agent's own claim.
+ */
+function resolveFixAttempt(state, batchId, issue, outcome, deps) {
+    const now = clock(deps);
+    const batch = batchOrThrow(state, batchId);
+    // The most recent still-open attempt for this member.
+    const idx = batch.fix_attempts.findLastIndex((a) => a.issue === issue && a.outcome === 'dispatched');
+    const fixAttempts = idx === -1
+        ? batch.fix_attempts
+        : batch.fix_attempts.map((a, i) => (i === idx ? { ...a, outcome } : a));
+    let next = (0, state_1.patchBatch)(state, batchId, { fix_attempts: fixAttempts }, now);
+    if (batch.status === 'fixing') {
+        next = (0, state_1.transitionBatch)(next, batchId, 'validating', {}, now);
+    }
+    journal(deps, (0, journal_1.unitEvent)('fix-resolved', `batch:${batchId}`, {
+        issue,
+        detail: idx === -1 ? `${outcome} (no matching dispatched attempt on record)` : outcome,
+    }), now);
+    return { state: next };
+}
+/**
+ * Every member that must leave with `issues`: an eviction group reverts
+ * together (RFC-0001 §E.4), because a member built on another's API cannot
+ * survive that API's revert.
+ */
+function expandEvictionGroups(batch, issues) {
+    const out = new Set(issues);
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const group of batch.eviction_groups) {
+            if (group.some((m) => out.has(m))) {
+                for (const member of group) {
+                    if (!out.has(member)) {
+                        out.add(member);
+                        grew = true;
+                    }
+                }
+            }
+        }
+    }
+    // Restricted to actual members: a group naming a stray issue would otherwise
+    // produce an eviction record for a non-member, which then counts against
+    // `members.length` in the dissolve trigger and dissolves the batch early.
+    return [...out].filter((issue) => batch.members.includes(issue)).sort((a, b) => a - b);
+}
+/**
+ * The targets' commits in the order a revert must walk them: newest first
+ * ACROSS members, not member by member.
+ *
+ * Grouping by member loses branch order, and reverting an older commit while a
+ * newer one still sits on top of it is precisely what makes `git revert`
+ * conflict — which dissolves the whole batch. For a branch `A1 B1 A2 B2`,
+ * evicting both members reverts `B2 A2 B1 A1`.
+ */
+function orderRevertCommits(ranges, targets) {
+    return ranges
+        .filter((range) => targets.includes(range.issue))
+        .flatMap((range) => range.commits.map((sha, i) => ({ sha, position: range.positions[i] ?? i })))
+        .sort((a, b) => b.position - a.position)
+        .map((commit) => commit.sha);
+}
+/**
+ * `attributing → evicting`: revert the offending members' commits, requeue them
+ * as full-cycle with their failure evidence, re-run the suite, and dissolve if
+ * the batch has now lost more than a third of its members (AC2/AC3/AC5).
+ *
+ * A conflicting revert aborts and dissolves immediately — a half-reverted
+ * worktree is not a state any later step can reason about.
+ */
+function evictMembers(state, batchId, input, deps) {
+    const now = clock(deps);
+    const batch = batchOrThrow(state, batchId);
+    const targets = expandEvictionGroups(batch, input.issues);
+    // An eviction group can pull in a member that already shipped. Reverting its
+    // commits would destroy merged work while `requeueMember` (rightly) refuses
+    // to requeue it — the batch would then report a member as shipped with its
+    // code gone. Dissolving instead keeps the invariant: nothing green is
+    // discarded, and the unshipped members are requeued intact.
+    const shipped = targets.filter((issue) => {
+        const entry = state.entries.find((e) => e.issue === issue);
+        return entry !== undefined && (0, state_1.isPreservedMember)(entry);
+    });
+    if (shipped.length > 0) {
+        journal(deps, (0, journal_1.unitEvent)('revert-conflict', `batch:${batchId}`, {
+            detail: `eviction group pulls in already-shipped member(s) ${shipped.join(',')} — dissolving instead of reverting merged work`,
+        }), now);
+        const dissolve = dissolveBatch(state, batchId, { strategy: 'full', reason: 'evicts-shipped-member' }, deps);
+        return {
+            state: dissolve.state,
+            evicted: [],
+            requeued: dissolve.requeued,
+            reverted: [],
+            conflict: true,
+            dissolved: true,
+            dissolve,
+            suite: null,
+        };
+    }
+    let next = state;
+    if (batch.status !== 'evicting') {
+        next = (0, state_1.transitionBatch)(next, batchId, 'evicting', {}, now);
+    }
+    const ordered = orderRevertCommits(input.ranges, targets);
+    // Validate the WHOLE plan before touching the repo: rejecting a malformed
+    // sha mid-loop would leave the earlier reverts committed.
+    const malformed = ordered.find((sha) => !attribution_1.SHA_RE.test(sha));
+    if (malformed !== undefined) {
+        return revertConflict(next, batchId, targets, deps, now, [], `invalid commit sha ${malformed}`);
+    }
+    const revertedByMember = new Map();
+    for (const range of input.ranges) {
+        if (targets.includes(range.issue))
+            revertedByMember.set(range.issue, []);
+    }
+    const reverted = [];
+    // Reverts land as commits before any state is persisted, so a crash between
+    // the two would re-revert on the next run — and a double revert re-applies
+    // the broken change. Skip what the branch already carries.
+    const history = deps.exec('git', ['log', '--format=%B', '-n', '500'], deps.repoDir) ?? '';
+    for (const sha of ordered) {
+        const owner = input.ranges.find((r) => r.commits.includes(sha));
+        const record = () => {
+            reverted.push(sha);
+            if (owner) {
+                revertedByMember.set(owner.issue, [...(revertedByMember.get(owner.issue) ?? []), sha]);
+            }
+        };
+        if (history.includes(`This reverts commit ${sha}`)) {
+            record();
+            continue;
+        }
+        if (git(deps, ['revert', '--no-edit', sha], batchId, now) === null) {
+            // Leave no half-applied revert behind: abort, then `--quit` plus a hard
+            // reset as the fallback for git versions that refuse the abort outside a
+            // sequence (`--quit` alone KEEPS the conflicted index).
+            let clean = git(deps, ['revert', '--abort'], batchId, now) !== null;
+            if (!clean) {
+                git(deps, ['revert', '--quit'], batchId, now);
+                clean = git(deps, ['reset', '--hard', 'HEAD'], batchId, now) !== null;
+            }
+            return revertConflict(next, batchId, targets, deps, now, reverted, `git revert ${sha} conflicted${clean ? '' : ' — and the cleanup failed; this checkout is left mid-revert and must not be reused'}`);
+        }
+        record();
+    }
+    // Requeue every reverted member with its evidence attached (AC2).
+    const requeued = [];
+    const records = [];
+    for (const issue of targets) {
+        const tests = input.failingByMember?.get(issue) ?? [];
+        const memberCommits = revertedByMember.get(issue) ?? [];
+        const evidence = {
+            batch: batchId,
+            reason: input.reason,
+            failing_tests: tests.map((t) => t.id),
+            attribution: input.attribution,
+            reverted_commits: memberCommits,
+            at: now.toISOString(),
+        };
+        const result = (0, state_1.requeueMember)(next, issue, { mode: 'full', batch: null }, input.reason, now, {
+            failure_evidence: evidence,
+        });
+        next = result.state;
+        if (result.requeued)
+            requeued.push(issue);
+        records.push({
+            issue,
+            reason: input.reason,
+            attribution: input.attribution,
+            reverted_commits: memberCommits,
+            group: targets.filter((t) => t !== issue),
+            at: now.toISOString(),
+        });
+        journal(deps, (0, journal_1.unitEvent)('member-evicted', `batch:${batchId}`, {
+            issue,
+            // A member with no commits is NOT a clean eviction: its work is still
+            // on the branch while the queue says it was evicted, so the batch would
+            // ship code it believes it removed. `reverted=0` alone reads as "an
+            // empty range", which is why this says it in words.
+            detail: memberCommits.length === 0
+                ? `${input.reason} reverted=0 — NO commits found for this member on the batch branch; its work was NOT reverted`
+                : `${input.reason} reverted=${memberCommits.length}`,
+        }), now);
+    }
+    next = (0, state_1.patchBatch)(next, batchId, { evictions: [...batch.evictions, ...records] }, now);
+    const withoutCommits = targets.filter((t) => (revertedByMember.get(t) ?? []).length === 0);
+    post(deps, batchOrThrow(next, batchId), {
+        phase: 'batch-validate',
+        status: 'blocked',
+        kv: {
+            reason: input.reason,
+            evicted: targets.join(',') || 'none',
+            requeued: requeued.join(',') || 'none',
+            reverted: String(reverted.length),
+            attribution: input.attribution,
+            ...(withoutCommits.length > 0 ? { no_commits: withoutCommits.join(',') } : {}),
+        },
+    }, now);
+    // Back to validation with the suite re-run (AC2: "re-run the suite").
+    const suite = runSuite(deps, batchId, now);
+    next = (0, state_1.transitionBatch)(next, batchId, 'validating', {}, now);
+    if (checkDissolveTrigger(batchOrThrow(next, batchId))) {
+        const dissolve = dissolveBatch(next, batchId, { strategy: 'full', reason: 'eviction-threshold' }, deps);
+        return {
+            state: dissolve.state,
+            evicted: targets,
+            // The surviving members the dissolve requeued belong here too — a caller
+            // reading `requeued` must see everything that went back on the queue.
+            requeued: [...new Set([...requeued, ...dissolve.requeued])].sort((a, b) => a - b),
+            reverted,
+            conflict: false,
+            dissolved: true,
+            dissolve,
+            suite,
+        };
+    }
+    return {
+        state: next,
+        evicted: targets,
+        requeued,
+        reverted,
+        conflict: false,
+        dissolved: false,
+        suite,
+    };
+}
+/**
+ * A conflicting (or unusable) revert: abandon the batch rather than continue on
+ * a partly-reverted branch (AC3).
+ *
+ * The reverts that already succeeded stay committed — they are named in the
+ * journal line because they ride along on the abandoned branch, which is
+ * exactly why the branch is abandoned rather than reused.
+ */
+function revertConflict(state, batchId, targets, deps, now, reverted, detail) {
+    journal(deps, (0, journal_1.unitEvent)('revert-conflict', `batch:${batchId}`, {
+        detail: `${detail}; already applied and left on the abandoned branch: ${reverted.join(',') || 'none'}`,
+    }), now);
+    const dissolve = dissolveBatch(state, batchId, { strategy: 'full', reason: 'revert-conflict' }, deps);
+    return {
+        state: dissolve.state,
+        evicted: [...targets],
+        requeued: dissolve.requeued,
+        reverted,
+        conflict: true,
+        dissolved: true,
+        dissolve,
+        suite: null,
+    };
+}
+/**
+ * Whether the batch has lost STRICTLY more than a third of its members
+ * (RFC-0001 §F.8). Counted over distinct evicted members, so a member evicted
+ * once and recorded twice never inflates the trigger.
+ */
+function checkDissolveTrigger(batch) {
+    if (batch.members.length === 0)
+        return false;
+    const evicted = new Set(batch.evictions.map((e) => e.issue)).size;
+    return evicted > batch.members.length * types_1.DISSOLVE_EVICTION_FRACTION;
+}
+/**
+ * Dissolve a batch (AC3): mark it `dissolved`, requeue every unshipped member,
+ * and report what was preserved. Shipped/terminal members are never touched —
+ * "nothing green is discarded" is the whole point of dissolving rather than
+ * failing the batch.
+ *
+ * No git runs here: the batch branch is simply left behind unmerged. Sched
+ * deletes nothing, so an operator can still inspect what the batch built.
+ */
+function dissolveBatch(state, batchId, opts, deps) {
+    const now = clock(deps);
+    const batch = batchOrThrow(state, batchId);
+    if (types_1.TERMINAL_BATCH_STATUSES.has(batch.status)) {
+        // The batch WAS found — this is an illegal edge, not a missing id, and a
+        // caller catching SchedNotFoundError to mean "unknown batch" would misroute it.
+        throw new types_1.IllegalTransitionError('batch', batch.status, 'dissolving');
+    }
+    const unshipped = [];
+    const preserved = [];
+    for (const issue of batch.members) {
+        const entry = state.entries.find((e) => e.issue === issue);
+        if (!entry)
+            continue;
+        if ((0, state_1.isPreservedMember)(entry)) {
+            preserved.push(issue);
+        }
+        else {
+            unshipped.push(issue);
+        }
+    }
+    // Why the member is back on the queue, carried on the entry itself — a
+    // dissolve requeue is otherwise indistinguishable from a fresh enqueue.
+    const evidence = {
+        batch: batchId,
+        reason: opts.reason,
+        failing_tests: [],
+        attribution: 'none',
+        reverted_commits: [],
+        at: now.toISOString(),
+    };
+    let next = (0, state_1.transitionBatch)(state, batchId, 'dissolving', {}, now);
+    const newBatches = [];
+    const requeued = [];
+    if (opts.strategy === 'halved' && unshipped.length > 0) {
+        // Split by POSITION, not by coupling: the halves are the first and second
+        // half of `unshipped` in member order. A coupled eviction group straddling
+        // the pivot is therefore broken up — accepted, because both halves re-run
+        // through the same validate/evict rails, where a member that cannot stand
+        // alone is evicted rather than silently shipped.
+        const pivot = Math.ceil(unshipped.length / 2);
+        const taken = new Set(next.batches.map((b) => b.id));
+        // A colliding id would produce two batches answering to one name:
+        // `findBatch` would return the first and `validateState` would refuse to
+        // load the file at all on the next start.
+        const freeId = (base) => {
+            let id = base;
+            let n = 2;
+            while (taken.has(id))
+                id = `${base}${n++}`;
+            taken.add(id);
+            return id;
+        };
+        const halves = [
+            { id: freeId(`${batchId}-a`), members: unshipped.slice(0, pivot) },
+            { id: freeId(`${batchId}-b`), members: unshipped.slice(pivot) },
+        ].filter((h) => h.members.length > 0);
+        for (const half of halves) {
+            next = {
+                ...next,
+                batches: [
+                    ...next.batches,
+                    (0, state_1.createBatch)(half.id, half.members, now, {
+                        base_branch: batch.base_branch,
+                        anchor: batch.anchor ?? undefined,
+                        run_id: batch.run_id ?? undefined,
+                        // Groups survive the split, restricted to the members that landed
+                        // in this half — a group spanning both halves is no longer a group.
+                        eviction_groups: batch.eviction_groups
+                            .map((group) => group.filter((m) => half.members.includes(m)))
+                            .filter((group) => group.length > 1),
+                    }),
+                ],
+            };
+            newBatches.push(half.id);
+            for (const issue of half.members) {
+                const result = (0, state_1.requeueMember)(next, issue, { mode: 'slot', batch: half.id }, opts.reason, now, { failure_evidence: { ...evidence, batch: half.id } });
+                next = result.state;
+                if (result.requeued)
+                    requeued.push(issue);
+            }
+        }
+        journal(deps, (0, journal_1.unitEvent)('batch-split', `batch:${batchId}`, { detail: newBatches.join(',') }), now);
+    }
+    else {
+        for (const issue of unshipped) {
+            const result = (0, state_1.requeueMember)(next, issue, { mode: 'full', batch: null }, opts.reason, now, {
+                failure_evidence: evidence,
+            });
+            next = result.state;
+            if (result.requeued)
+                requeued.push(issue);
+        }
+    }
+    next = (0, state_1.transitionBatch)(next, batchId, 'dissolved', {}, now);
+    journal(deps, (0, journal_1.unitEvent)('batch-dissolved', `batch:${batchId}`, {
+        // Ids, not counts: "which members went back on the queue, and which kept
+        // their result?" is the question a dissolve has to answer afterwards.
+        detail: `${opts.reason} strategy=${opts.strategy} requeued=${requeued.join(',') || 'none'} ` +
+            `preserved=${preserved.join(',') || 'none'}` +
+            (newBatches.length > 0 ? ` split_into=${newBatches.join(',')}` : ''),
+    }), now);
+    post(deps, batchOrThrow(next, batchId), {
+        phase: opts.milestonePhase ?? 'batch-validate',
+        status: 'blocked',
+        kv: {
+            reason: opts.reason,
+            dissolved: 'true',
+            strategy: opts.strategy,
+            requeued: requeued.join(',') || 'none',
+            preserved: preserved.join(',') || 'none',
+            ...(newBatches.length > 0 ? { split_into: newBatches.join(',') } : {}),
+        },
+    }, now);
+    return { state: next, requeued, preserved, newBatches };
+}
+/**
+ * The batch PR came back CONFLICTING or `auto-merge-blocked` (AC4).
+ *
+ * First occurrence: rebase the batch branch onto the base, re-run the suite,
+ * and re-ship once. Second occurrence — or a rebase that conflicts, or a suite
+ * that is red after a clean rebase — dissolves the batch into two half-batches:
+ * the work is kept, the batch that could not land is not retried a third time.
+ */
+function handlePrConflict(state, batchId, deps, opts = {}) {
+    const now = clock(deps);
+    const batch = batchOrThrow(state, batchId);
+    const reason = opts.reason ?? 'pr-conflict';
+    // Both paths enter `rebasing` — it is the honest state for "the merge came
+    // back blocked" — and only the attempt count decides whether a rebase runs.
+    // Guarded, so a retry against a batch already in `rebasing` is idempotent
+    // rather than an IllegalTransitionError out of a recovery call.
+    let next = state;
+    if (batch.status !== 'rebasing') {
+        next = (0, state_1.transitionBatch)(next, batchId, 'rebasing', {}, now);
+    }
+    /** Every give-up path here ends the same way: halve the batch, keep the work. */
+    const bailToHalves = (from, bailReason, rebased = false, suite = null) => {
+        const dissolve = dissolveBatch(from, batchId, { strategy: 'halved', reason: bailReason, milestonePhase: 'batch-ship' }, deps);
+        return { state: dissolve.state, action: 'dissolved', rebased, suite, dissolve };
+    };
+    if (batch.rebase_attempts >= types_1.MAX_REBASE_ATTEMPTS) {
+        return bailToHalves(next, `${reason}-recurred`);
+    }
+    next = (0, state_1.patchBatch)(next, batchId, { rebase_attempts: batch.rebase_attempts + 1 }, now);
+    const base = batch.base_branch;
+    if (!attribution_1.SAFE_REF_RE.test(base)) {
+        return bailToHalves(next, 'invalid-base-branch');
+    }
+    // Rebase what the batch actually owns. `git rebase` acts on whatever HEAD
+    // happens to be, so a checkout left on another branch (or detached by an
+    // earlier step) would otherwise rewrite the wrong ref and "re-ship" something
+    // that is not this batch.
+    if (batch.branch !== null) {
+        const head = git(deps, ['symbolic-ref', '--quiet', '--short', 'HEAD'], batchId, now);
+        if (head !== batch.branch) {
+            journal(deps, (0, journal_1.unitEvent)('git-failed', `batch:${batchId}`, {
+                detail: `checkout is on '${head ?? 'detached HEAD'}', expected the batch branch '${batch.branch}'`,
+            }), now);
+            return bailToHalves(next, 'wrong-branch-checked-out');
+        }
+    }
+    // A failed fetch is not a conflict: rebasing onto a stale `origin/<base>`
+    // silently produces a batch that will conflict again at merge time, and
+    // reporting it as `rebase-conflict` sends the operator after the wrong cause.
+    if (git(deps, ['fetch', 'origin', '--', base], batchId, now) === null) {
+        return bailToHalves(next, 'fetch-failed');
+    }
+    if (git(deps, ['rebase', `origin/${base}`], batchId, now) === null) {
+        // Never leave the worktree mid-rebase.
+        git(deps, ['rebase', '--abort'], batchId, now);
+        return bailToHalves(next, 'rebase-conflict');
+    }
+    journal(deps, (0, journal_1.unitEvent)('batch-rebased', `batch:${batchId}`, { detail: base }), now);
+    next = (0, state_1.transitionBatch)(next, batchId, 're-validating', {}, now);
+    const suite = runSuite(deps, batchId, now);
+    if (suite !== null && !suite.ok) {
+        return bailToHalves(next, 'rebase-suite-red', true, suite);
+    }
+    next = (0, state_1.transitionBatch)(next, batchId, 'shipping', {}, now);
+    post(deps, batchOrThrow(next, batchId), {
+        phase: 'batch-ship',
+        // NOT `blocked`: the rebase worked and the batch is re-shipping. `blocked`
+        // stamps `next=done` on a run that is still going, and counts toward the
+        // runstate resume-loop cap.
+        status: 'awaiting-merge',
+        kv: { reason, rebased: base, rebase_attempts: String(batch.rebase_attempts + 1) },
+    }, now);
+    return { state: next, action: 'reship', rebased: true, suite };
+}
+//# sourceMappingURL=recovery.js.map