@ai-dossier/sched 0.44.0 → 0.46.0

package/dist/batch-dispatch.d.ts

@@ -65,7 +65,7 @@ import { type GroundTruth } from './groundtruth';
 import { type Journal } from './journal';
 import type { SchedStore } from './persist';
 import type { ExecFn } from './project';
-import { type SuiteResult } from './recovery';
+import { type BatchSuiteContext, type SuiteResult } from './recovery';
 import { type FsExists } from './teardown';
 import type { BatchEntry, CapabilityGateResult, SchedConfig } from './types';
 export type { CapOutcome } from './types';
@@ -88,8 +88,13 @@ export interface BatchDispatchDeps {
      * timeout, e.g. `@ai-dossier/worktree-pool`'s `WARM_COMMAND_TIMEOUT_MS`).
      */
     warmExec?: ExecFn;
-    /** Runs the aggregate suite inside a batch worktree; batches never leave `validating` without one. */
-    runSuite: (worktree: string) => SuiteResult;
+    /**
+     * Runs the aggregate suite inside a batch worktree; batches never leave
+     * `validating` without one. `ctx` (#777) names the batch and its base ref so
+     * the runner can hand them to the repo's `gate.batch` capability; optional
+     * so runners written before it keep working unchanged.
+     */
+    runSuite: (worktree: string, ctx?: BatchSuiteContext) => SuiteResult;
     /**
      * Runs one `ai-dossier cap run <capabilityId>` in a batch worktree. Two call
      * sites, different degrade contracts:
@@ -117,6 +122,14 @@ export interface BatchDispatchDeps {
      * Undefined defers to `appendSchedRunLog`'s own `os.homedir()` default.
      */
     homeDir?: string;
+    /**
+     * #768: the `owner/name` repository whose issues are this project's batch
+     * anchors and members, verified against the project by the caller
+     * (`resolveProjectRepo`). Without it the anchor close and the members-closed
+     * reconcile evidence never fire — they never act on whatever repository the
+     * cwd resolves to.
+     */
+    anchorRepo?: string;
 }
 /** What one `runBatchTick` call did, merged into `engine.ts`'s `TickResult` by the caller. */
 export interface BatchTickResult {

package/dist/batch-dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AAmBH,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,KAAK,WAAW,EAQjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAUL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAoBpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EAOpB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAYjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,WAAW,CAAC;IAC5C;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AA0hBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AA4wCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AAiSD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAkhCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CA+PjB"}
+{"version":3,"file":"batch-dispatch.d.ts","sourceRoot":"","sources":["../src/batch-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AA8BH,OAAO,EAaL,KAAK,gBAAgB,EAGrB,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,OAAO,EAEL,KAAK,WAAW,EAUjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,OAAO,EAAa,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EACL,KAAK,iBAAiB,EAUtB,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAqBpB,OAAO,EAAE,KAAK,QAAQ,EAA2D,MAAM,YAAY,CAAC;AACpG,OAAO,KAAK,EAEV,UAAU,EAEV,oBAAoB,EAOpB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAYjB,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,GAAG,EAAE,MAAM,IAAI,CAAC;IAChB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,KAAK,WAAW,CAAC;IACrE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACjF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uFAAuF;IACvF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAmiBD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3F;AA4wCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,IAAI,EACT,MAAM,EAAE,eAAe,GACtB,IAAI,CA+BN;AAiSD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,IAAI,GACR;IACD,OAAO,EAAE,eAAe,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,GAAG,qBAAqB,CAAC;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CA2KA;AAkxCD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,GACzB,eAAe,CAiQjB"}

package/dist/batch-dispatch.js

@@ -103,6 +103,7 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const core_1 = require("@ai-dossier/core");
 const worktree_pool_1 = require("@ai-dossier/worktree-pool");
+const anchor_close_1 = require("./anchor-close");
 const attribution_1 = require("./attribution");
 const dispatch_1 = require("./dispatch");
 const dispatch_health_1 = require("./dispatch-health");
@@ -356,9 +357,10 @@ function applyBatchAndIssues(fresh, computed, batchId, issues, membersBeforeReco
  * into `tick()`'s own catch — a bare `tick-failed` with no unit id, repeating
  * every reconcile interval forever since nothing about the batch changed.
  */
-function safeSuite(deps, batchId, worktree) {
+function safeSuite(deps, batch, worktree) {
+    const batchId = batch.id;
     try {
-        return deps.runSuite(worktree);
+        return deps.runSuite(worktree, batchSuiteContext(batch));
     }
     catch (err) {
         const detail = `suite runner threw: ${err.message}`;
@@ -368,13 +370,19 @@ function safeSuite(deps, batchId, worktree) {
         return { ok: false, failing: [], readable: false, detail };
     }
 }
+/** What the aggregate-suite runner is told about the batch it gates (#777). */
+function batchSuiteContext(batch) {
+    return { batchId: batch.id, baseRef: `origin/${batch.base_branch}` };
+}
 function recoveryDeps(deps, config, batch, now) {
     return {
         exec: deps.exec,
         repoDir: batch.worktree ?? deps.repoDir,
         journal: deps.journal,
         postMilestone: (0, recovery_1.createExecMilestonePoster)(deps.exec, { repoDir: deps.repoDir }),
-        runSuite: batch.worktree !== null ? () => deps.runSuite(batch.worktree) : undefined,
+        runSuite: batch.worktree !== null
+            ? () => deps.runSuite(batch.worktree, batchSuiteContext(batch))
+            : undefined,
         dissolvePolicy: (0, types_1.resolveDissolvePolicy)(config.dissolve_policy),
         now: () => now,
     };
@@ -1347,7 +1355,7 @@ function runValidate(deps, config, dispatch, batchId, now, result) {
     const batch = (0, state_1.findBatch)(state, batchId);
     if (!batch || batch.worktree === null)
         return;
-    const suite = safeSuite(deps, batchId, batch.worktree);
+    const suite = safeSuite(deps, batch, batch.worktree);
     const rDeps = recoveryDeps(deps, config, batch, now);
     const poster = (0, recovery_1.createExecMilestonePoster)(deps.exec, { repoDir: deps.repoDir });
     if (suite.ok) {
@@ -2341,7 +2349,7 @@ function reconcileFixSlot(deps, config, batchId, slot, now, result) {
     // packages/sched/README.md's dispatch-health section.
     handleDeadDispatchApiError(deps, batchId, (0, dispatch_1.batchFixLogPath)(deps.store.runsDir, batchId, offenderRecord.issue), slot.log_offset_at_spawn ?? 0, now, { release: false });
     deps.store.withLock((s) => ({ state: releaseSlot(s, batchId, now), result: undefined }));
-    const suite = safeSuite(deps, batchId, batch.worktree);
+    const suite = safeSuite(deps, batch, batch.worktree);
     const rDeps = recoveryDeps(deps, config, batch, now);
     const { state: resolved } = (0, recovery_1.resolveFixAttempt)(deps.store.load(), batchId, offenderRecord.issue, suite.ok ? 'green' : 'red', rDeps);
     deps.store.withLock((s) => ({
@@ -2628,9 +2636,10 @@ const DISPATCHED_MEMBER_STATUSES = new Set([
  * of merge evidence ("The batch branch is in `main` at c277ff59b", `pr=None`):
  * the branch was merged out of band, so its commits are IN the base even
  * though the batch never shipped a PR of its own. Two probes against the
- * remote-tracking ref (refreshed best-effort first — a merge that landed on
- * the remote is invisible to `rev-list` until fetched; fetch failure leaves
- * the stale ref, the same degradation the per-issue path tolerates):
+ * remote-tracking ref (refreshed first — a merge that landed on the remote is
+ * invisible to `rev-list` until fetched; since #768 a FAILED fetch yields no
+ * evidence at all: a stale ref is not proof, and this answer can reconcile a
+ * batch to shipped):
  *
  * - `git rev-list --count origin/<base>..<branch>` is 0 — nothing of the
  *   branch is missing from the base, i.e. every member commit on it is an
@@ -2651,7 +2660,8 @@ function branchMergedIntoBase(deps, batch) {
     if (!attribution_1.SAFE_REF_RE.test(batch.branch) || !attribution_1.SAFE_REF_RE.test(batch.base_branch))
         return false;
     const base = `origin/${batch.base_branch}`;
-    deps.exec('git', ['fetch', 'origin', batch.base_branch], deps.repoDir);
+    if (deps.exec('git', ['fetch', 'origin', batch.base_branch], deps.repoDir) === null)
+        return false;
     const ahead = deps.exec('git', ['rev-list', '--count', `${base}..${batch.branch}`], deps.repoDir);
     if ((ahead ?? '').trim() !== '0')
         return false;
@@ -2693,7 +2703,7 @@ function branchMergedIntoBase(deps, batch) {
  * one journal line fires on the one-way transition, never per-tick (the
  * #632 lesson: no journal inside a loop that doesn't terminate the unit).
  */
-function reconcileStaleBlockedBatches(deps, now, result) {
+function reconcileStaleBlockedBatches(deps, now, result, anchorCtx) {
     const state = deps.store.load();
     const nowMs = now.getTime();
     for (const batch of state.batches) {
@@ -2713,8 +2723,31 @@ function reconcileStaleBlockedBatches(deps, now, result) {
         if (evidence === null && branchMergedIntoBase(deps, batch)) {
             evidence = { kind: 'commits-in-base' };
         }
+        // #768: the evidence that survives a rebase-merge (which rewrites SHAs, so
+        // the ancestry probe above can never pass) and a member shipped through a
+        // PR of its own (nothing batch-shaped ever merges): every member issue is
+        // CLOSED as completed BY CODE IN THE BASE (a merged PR / reachable commit —
+        // never a bare hand close) with no failure trail — the SAME strict
+        // predicate the anchor close uses, so the two never disagree.
+        if (evidence === null &&
+            anchorCtx !== undefined &&
+            (0, anchor_close_1.membersShippedVerdict)(state, batch, anchorCtx.read, {
+                repo: anchorCtx.repo,
+                commitInBase: anchorCtx.commitInBase,
+            }).kind === 'closable') {
+            evidence = { kind: 'members-closed' };
+        }
         if (evidence === null)
             continue;
+        // A members-closed reconcile has no merged batch PR for a report agent to
+        // report on, whatever `batch.pr` recorded — finish the rail inline, as
+        // for `pr === null`.
+        const finishInline = batch.pr === null || evidence.kind === 'members-closed';
+        // ...but never tear its worktree down: the members shipped OUTSIDE the
+        // batch branch, so the blocked integration worktree may hold an
+        // operator's unpushed repair work. It is left in place, inert, and the
+        // journal says so.
+        const keepWorktree = evidence.kind === 'members-closed';
         const blockedReason = batch.blocked_reason ?? 'blocked';
         const failedAt = batch.updated_at;
         let reconciled = false;
@@ -2750,9 +2783,9 @@ function reconcileStaleBlockedBatches(deps, now, result) {
                     entry = (0, state_1.findEntry)(n, issue);
                 }
             }
-            if (b.pr === null) {
-                // No PR → no report agent is possible (its prompt names the PR).
-                // Finish the terminal rail and let teardown run below.
+            if (finishInline) {
+                // No (merged) PR → no report agent is possible (its prompt names the
+                // PR). Finish the terminal rail and let teardown run below.
                 n = (0, state_1.transitionBatch)(n, batch.id, 'reported', {}, now);
                 n = (0, state_1.transitionBatch)(n, batch.id, 'done', {}, now);
             }
@@ -2769,20 +2802,192 @@ function reconcileStaleBlockedBatches(deps, now, result) {
             ...(evidence.kind === 'pr-merged' ? { mergedAt: evidence.mergedAt } : {}),
             detail: (evidence.kind === 'pr-merged'
                 ? `PR #${evidence.pr} is MERGED — ledger reconciled blocked (${blockedReason}) to the merged rail (blocked at ${failedAt}); report and teardown will now dispatch`
-                : `every member commit is an ancestor of ${batch.base_branch} — ledger reconciled blocked (${blockedReason}) to shipped (blocked at ${failedAt})`) +
-                (batch.pr === null
-                    ? ' — no PR of its own, so no report agent can be prompted; teardown dispatched inline'
+                : evidence.kind === 'members-closed'
+                    ? `every member issue is CLOSED as completed on GitHub with no failure trail — ledger reconciled blocked (${blockedReason}) to shipped (blocked at ${failedAt})`
+                    : `every member commit is an ancestor of ${batch.base_branch} — ledger reconciled blocked (${blockedReason}) to shipped (blocked at ${failedAt})`) +
+                (finishInline
+                    ? ' — no merged PR of its own, so no report agent can be prompted; ' +
+                        (keepWorktree
+                            ? `worktree KEPT in place (${batch.worktree ?? 'none'}) — the work shipped outside the batch branch, which may hold unpushed work; once inspected, remove it with \`git worktree remove\` (or \`worktree-pool return\` if pool-claimed)`
+                            : 'teardown dispatched inline')
                     : '') +
                 (unwalkable.length > 0
                     ? `; members NOT walked (no legal edge): ${unwalkable.join(',')}`
                     : ''),
         });
         result.mergeAccepted.push(unit(batch.id));
-        if (batch.pr === null) {
+        if (finishInline && !keepWorktree) {
             teardownBatch(deps, batch.id);
         }
     }
 }
+function anchorTickContext(deps) {
+    const reader = (0, groundtruth_1.issueCloseReader)(deps.groundTruth);
+    if (reader === undefined || deps.anchorRepo === undefined)
+        return undefined;
+    const cache = new Map();
+    const read = (issue) => {
+        if (!cache.has(issue))
+            cache.set(issue, reader(issue));
+        return cache.get(issue);
+    };
+    const fetched = new Map();
+    const commitInBase = (oid, baseBranch) => {
+        // CWE-88: both are interpolated into git argv — the oid comes from GitHub.
+        if (!groundtruth_1.GIT_OID_RE.test(oid) || !attribution_1.SAFE_REF_RE.test(baseBranch))
+            return false;
+        if (!fetched.has(baseBranch)) {
+            fetched.set(baseBranch, deps.exec('git', ['fetch', 'origin', baseBranch], deps.repoDir) !== null);
+        }
+        // A failed fetch leaves a possibly stale `origin/<base>` (a force-push may
+        // have dropped the commit since): unverifiable, so never evidence.
+        if (fetched.get(baseBranch) !== true)
+            return false;
+        // `--is-ancestor` exits 0 (non-null) iff reachable; 1 and any failure → null.
+        return (deps.exec('git', ['merge-base', '--is-ancestor', oid, `origin/${baseBranch}`], deps.repoDir) !== null);
+    };
+    return { repo: deps.anchorRepo, read, readFresh: reader, commitInBase };
+}
+/**
+ * #768: close a batch's anchor issue when — and ONLY when — the positive
+ * evidence holds: every member CLOSED as completed by code that landed in the
+ * base, and no member evicted, handed back, requeued, or failed
+ * (`anchor-close.ts`). Before this, the anchor closed only on the happy path
+ * (batch-integrate's #720 step), so a blocked or hand-recovered batch — or one
+ * whose members shipped through PRs of their own — left it open forever
+ * (imboard#4244, imboard#4253).
+ *
+ * Every other shape is left strictly alone: a blocked, abandoned, or
+ * partially shipped batch keeps its anchor open, and `sched status --anchors`
+ * shows it as `needs-operator`. Closing an anchor on a terminal transition
+ * alone was rejected on #768 — it would bury the failure trail.
+ *
+ * Bounded: only `blocked`/`done` batches touched within
+ * `STALE_BLOCKED_RECONCILE_WINDOW_MS` whose anchor is not yet recorded closed
+ * are examined (an older one is only ever surfaced, never auto-closed); the
+ * ledger check runs first and costs no GitHub call; member reads stop at the
+ * first disqualifier. When this pass reads an anchor and finds it closed it
+ * records `anchor_closed_at` and never polls it again. A batch the ledger
+ * rules out is never read here at all, so its `anchor_closed_at` stays null —
+ * the sweep reads (but never closes) those anchors when asked.
+ */
+function reconcileAnchorClosure(deps, now, ctx) {
+    if (ctx === undefined)
+        return;
+    const state = deps.store.load();
+    for (const batch of (0, anchor_close_1.openAnchorBatches)(state, anchor_close_1.ANCHOR_CLOSE_BATCH_STATUSES)) {
+        if (now.getTime() - Date.parse(batch.updated_at) >= STALE_BLOCKED_RECONCILE_WINDOW_MS) {
+            continue;
+        }
+        // Deliberately BEFORE classifyAnchor (which repeats it): a ledger-ruled-out
+        // batch must cost no GitHub read, and a blocked one is re-checked every tick.
+        if ((0, anchor_close_1.anchorLedgerBlockers)(state, batch).length > 0)
+            continue;
+        const verdict = (0, anchor_close_1.classifyAnchor)(state, batch, ctx.read, {
+            repo: ctx.repo,
+            commitInBase: ctx.commitInBase,
+        });
+        if (verdict.kind === 'anchor-closed') {
+            // Closed outside this pass — or by a prior pass that crashed before
+            // recording it; either way the trail gets one line.
+            recordAnchorClosed(deps, batch.id, now);
+            journalEvent(deps, 'anchor-closed', unit(batch.id), {
+                issue: batch.anchor,
+                detail: `anchor #${batch.anchor} found already closed — recorded, never polled again`,
+            });
+            continue;
+        }
+        if (verdict.kind !== 'closable') {
+            clearAnchorCloseFailed(deps, batch, now);
+            continue;
+        }
+        // The GitHub reads above took time: re-check the ledger on a FRESH load,
+        // immediately before the irreversible close, so an eviction, `abandon` or
+        // `stop` that landed meanwhile is never closed over.
+        const stillClean = deps.store.withLock((s) => {
+            const fresh = (0, state_1.findBatch)(s, batch.id);
+            const ok = fresh !== undefined &&
+                fresh.anchor_closed_at === null &&
+                anchor_close_1.ANCHOR_CLOSE_BATCH_STATUSES.has(fresh.status) &&
+                (0, anchor_close_1.anchorLedgerBlockers)(s, fresh).length === 0;
+            return { state: s, result: ok };
+        });
+        // ...and GitHub itself, uncached: a member reopened or the anchor handed
+        // back since the (cached) verdict read must stop the close too.
+        const freshVerdict = stillClean
+            ? (0, anchor_close_1.classifyAnchor)(state, batch, ctx.readFresh, {
+                repo: ctx.repo,
+                commitInBase: ctx.commitInBase,
+            })
+            : undefined;
+        if (freshVerdict?.kind !== 'closable') {
+            clearAnchorCloseFailed(deps, batch, now);
+            continue;
+        }
+        const outcome = (0, anchor_close_1.closeAnchor)(deps.exec, deps.repoDir, ctx.repo, batch, batch.anchor, verdict.members);
+        const shipped = verdict.members.map((m) => `#${m.issue}: ${m.shipped_by}`).join('; ');
+        if (outcome !== 'closed') {
+            recordAnchorCloseFailed(deps, batch, outcome, shipped, now);
+            continue;
+        }
+        // Journal before recording: a crash between the two leaves the line, and
+        // the next tick records the (already-closed) anchor.
+        journalEvent(deps, 'anchor-closed', unit(batch.id), {
+            issue: batch.anchor,
+            detail: `every member closed as completed by code in ${batch.base_branch}, no failure trail — ${shipped}`,
+        });
+        recordAnchorClosed(deps, batch.id, now);
+    }
+}
+function recordAnchorClosed(deps, batchId, now) {
+    deps.store.withLock((s) => ({
+        // Bookkeeping, not activity — `updated_at` is the blocked-window clock.
+        state: (0, state_1.patchBatch)(s, batchId, { anchor_closed_at: now.toISOString(), ...state_1.CLEARED_ANCHOR_CLOSE_FAILED_FIELDS }, now, false),
+        result: undefined,
+    }));
+}
+/**
+ * The anchor stopped qualifying: end any `anchor-close-failed` streak, so the
+ * next failure episode journals its own first line instead of continuing a
+ * stale streak's count. A no-op (no write) when no streak is recorded.
+ */
+function clearAnchorCloseFailed(deps, batch, now) {
+    if (batch.anchor_close_failed_reason === null)
+        return;
+    deps.store.withLock((s) => ({
+        state: (0, state_1.patchBatch)(s, batch.id, state_1.CLEARED_ANCHOR_CLOSE_FAILED_FIELDS, now, false),
+        result: undefined,
+    }));
+}
+/**
+ * A close that qualified but failed: journal it on the streak's first tick and
+ * every `JOURNAL_DEDUP_REANNOUNCE_TICKS` after — never every tick (#632) —
+ * exactly `reconcilePrWatch`'s `pr-watch-failed` dedup.
+ */
+function recordAnchorCloseFailed(deps, batch, outcome, shipped, now) {
+    const priorSince = batch.anchor_close_failed_since;
+    const isNewStreak = batch.anchor_close_failed_reason !== outcome || priorSince === null;
+    const ticks = isNewStreak ? 1 : batch.anchor_close_failed_ticks + 1;
+    const since = isNewStreak || priorSince === null ? now.toISOString() : priorSince;
+    if (isNewStreak || ticks % types_1.JOURNAL_DEDUP_REANNOUNCE_TICKS === 0) {
+        journalEvent(deps, 'anchor-close-failed', unit(batch.id), {
+            issue: batch.anchor ?? undefined,
+            reason: outcome,
+            at: now.toISOString(),
+            since,
+            ticks_persisted: ticks,
+            detail: `anchor #${batch.anchor} qualifies for close (${shipped}) but ${outcome}; retried every tick — the gh error is on the engine's stderr ('⚠ sched …')`,
+        });
+    }
+    deps.store.withLock((s) => ({
+        state: (0, state_1.patchBatch)(s, batch.id, {
+            anchor_close_failed_reason: outcome,
+            anchor_close_failed_since: since,
+            anchor_close_failed_ticks: ticks,
+        }, now, false),
+        result: undefined,
+    }));
+}
 /**
  * Remove the batch's shared worktree — called both on the happy path
  * (`reconcileReportSlot`, after `batch-report done`) and on every dissolve
@@ -3083,7 +3288,9 @@ function runBatchTick(deps, config, dispatch) {
         }
     }
     reconcilePrWatch(deps, now, result);
-    reconcileStaleBlockedBatches(deps, now, result);
+    const anchorCtx = anchorTickContext(deps);
+    reconcileStaleBlockedBatches(deps, now, result, anchorCtx);
+    reconcileAnchorClosure(deps, now, anchorCtx);
     return result;
 }
 //# sourceMappingURL=batch-dispatch.js.map